wg-easy-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| WG_EASY_URL | Yes | Base URL of the wg-easy web UI, e.g. http://vpn.example.com:51821 | |
| WG_EASY_PASSWORD | Yes | Password of that account | |
| WG_EASY_USERNAME | Yes | Username of a wg-easy admin account | |
| WG_EASY_INSECURE_TLS | No | Set to true to accept self-signed TLS certificates |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| list_clientsA | List all WireGuard clients of the wg-easy instance, including their status (enabled/expired), addresses and traffic statistics. |
| get_clientA | Get the full details of a single WireGuard client. |
| create_clientA | Create a new WireGuard client. Keys and IP addresses are generated by wg-easy. Returns the new client ID. |
| update_clientA | Update a WireGuard client. Only the provided fields are changed; all other settings are preserved. |
| enable_clientA | Enable a WireGuard client so it can connect again. |
| disable_clientA | Disable a WireGuard client. The client keeps its configuration but can no longer connect. |
| delete_clientA | Permanently delete a WireGuard client. This is irreversible: the client loses VPN access and its keys cannot be restored. The first call returns a short-lived confirmation token; ask the user for confirmation, then call again with confirmToken. |
| get_client_configA | Get the WireGuard configuration file (wg .conf format) for a client. SENSITIVE: the output contains the client private key — treat it as a secret and do not repeat it unnecessarily. |
| get_client_qrcodeA | Get the client configuration as a QR code (SVG markup) for scanning with the WireGuard mobile app. SENSITIVE: the QR code encodes the client private key — treat it as a secret. |
| generate_one_time_linkA | Generate a one-time download link for a client configuration that can be shared with the end user. Requires WG_ENABLE_ONE_TIME_LINKS to be enabled on the wg-easy instance. SENSITIVE: anyone with the link can download the full client configuration without authentication — share it only with the intended user. |
| get_server_infoA | Get information about the wg-easy instance: release/update status, general settings and the WireGuard interface configuration. Secret fields (private keys, passwords) are redacted. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 11 tools
Each tool maps cleanly to a distinct resource and action: client list/get/create/update/enable/disable/delete, server info, and three clearly separated config delivery methods (raw file, QR code, one-time link). Although multiple tools surface client configuration, their output formats and purposes are explicitly distinct.
All tool names follow a consistent verb_noun snake_case pattern, using standard lifecycle verbs (list, get, create, update, enable, disable, delete). Config-related tools are uniformly prefixed with get_client_ or generate_one_time_link, making the naming predictable.
Eleven tools is a well-scoped size for a WireGuard client management server: it covers the full client lifecycle plus configuration delivery and server info without redundancy. Each tool serves a distinct need and none feels like filler.
The surface provides complete CRUD lifecycle coverage for clients (list, get, create, update, delete) along with operational actions (enable/disable) that wg-easy users need. Configuration retrieval is covered in multiple practical formats, including a shareable one-time link, and server info rounds out the domain.