OPNsense MCP Server

Slim OPNsense MCP Server for managing firewall infrastructure via the OPNsense REST API. Its 40 documented tools cover opnsense, dns, diag, nat. It runs locally over stdio via the published package.

People connecting API integration tools to Claude, Cursor, VS Code, or another MCP client. The project is written in TypeScript.

VERIFIED ACTIVE

LAST COMMIT 2026-05-06 · ★ 2 · #187 OF 250 MAINTAINED API INTEGRATION · VERIFIED 2026-08-25

AGPL-3.0 · TypeScript servers · how we verify → /methodology

01 · Install OPNsense MCP Server

before you install - you'll need

Set NAS_VAULT_ADDR, NAS_VAULT_ROLE_ID, NAS_VAULT_SECRET_ID, OPNSENSE_VERIFY_SSL, OPNSENSE_URL, OPNSENSE_API_KEY, OPNSENSE_API_SECRET, MCP_SECRETS_FILE, OPNSENSE_SSH_ENABLED, OPNSENSE_SSH_HOST, OPNSENSE_SSH_USER before connecting. NAS_VAULT_KV_MOUNT is optional or environment-specific per the README.

Claude Code

claude mcp add itunified-io-mcp-opnsense -- npx -y @itunified.io/mcp-opnsense

Claude Desktop / Cursor / VS Code - add to config

{
  "mcpServers": {
    "itunified-io-mcp-opnsense": {
      "command": "npx",
      "args": [
        "-y",
        "@itunified.io/mcp-opnsense"
      ]
    }
  }
}

Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as local process (stdio) - runs on your machine with your user's permissions

license AGPL-3.0 - declared in the repository

npm package @itunified.io/mcp-opnsense - the @itunified.io scope differs from the repo owner (itunified-io); confirm it's the project's official package

registry namespace io.github.itunified-io is GitHub-verified and matches the repo owner

03 · What OPNsense MCP Server can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

What you can build

With this server connected, an agent can list host overrides (A/AAAA/CNAME), add a host override record, delete a host override by UUID, and add a DNS forwarding server.

The 40 tools it gives your agent

Extracted from the project's README - what OPNsense MCP Server lets an agent do.

opnsense_dns_list_overrides: - List host overrides (A/AAAA/CNAME)
opnsense_dns_add_override: - Add a host override record
opnsense_dns_delete_override: - Delete a host override by UUID
opnsense_dns_list_forwards: - List DNS-over-TLS forwarding servers
opnsense_dns_add_forward: - Add a DNS forwarding server
opnsense_dns_delete_forward: - Delete a DNS forward by UUID
opnsense_dns_list_blocklist: - List domain overrides (blocked domains)
opnsense_dns_block_domain: - Block a domain
opnsense_dns_unblock_domain: - Unblock a domain by UUID
opnsense_dns_flush_cache: - Flush DNS cache and DNSBL data
opnsense_dns_diagnostics: - Dump DNS cache for diagnostics
opnsense_dns_apply: - Apply DNS changes (reconfigure Unbound)

show all 40 tools

opnsense_nat_source_list: - List all SNAT rules
opnsense_nat_source_get: - Get a single SNAT rule by UUID
opnsense_nat_source_add: - Add a SNAT rule (requires confirm: true)
opnsense_nat_source_update: - Round-trip update of an existing SNAT rule (requires confirm: true)
opnsense_nat_source_delete: - Delete a SNAT rule (requires confirm: true)
opnsense_nat_source_toggle: - Toggle a SNAT rule's enabled state (requires confirm: true)
opnsense_nat_apply: - Apply pending NAT changes (requires confirm: true)
opnsense_fw_list_rules: - List all firewall filter rules
opnsense_fw_add_rule: - Create a firewall rule
opnsense_fw_update_rule: - Update a firewall rule by UUID
opnsense_fw_delete_rule: - Delete a firewall rule by UUID
opnsense_fw_toggle_rule: - Enable/disable a firewall rule
opnsense_fw_reorder_rules: - Change the evaluation order (sequence) of a rule - enforces whitelist-before-deny
opnsense_fw_drift_check: - Audit rule descriptions against a regex (default: ^#\d+: issue-reference prefix)
opnsense_fw_list_aliases: - List firewall aliases (host, network, port, URL)
opnsense_fw_manage_alias: - Create/update/delete aliases
opnsense_fw_apply: - Apply pending firewall changes
opnsense_diag_arp_table: - Show ARP table (IP-to-MAC mappings)
opnsense_diag_routes: - Show routing table
opnsense_diag_ping: - Ping a host from OPNsense
opnsense_diag_traceroute: - Traceroute to a destination
opnsense_diag_dns_lookup: - Perform DNS lookup from OPNsense
opnsense_diag_fw_states: - List active firewall connection states
opnsense_diag_fw_logs: - Retrieve recent firewall log entries
opnsense_diag_system_info: - Get system status (CPU, memory, uptime, disk)
opnsense_diag_log_system: - Retrieve recent system log entries
opnsense_diag_log_gateways: - Retrieve recent gateway monitoring (dpinger) log entries
opnsense_diag_log_routing: - Retrieve recent routing daemon log entries

Latest releases

v2026.05.06.4 · 2026-05-06

Summary · Reverts the 3 \opnsense_sys_tunable_\ tools shipped briefly in v2026.5.6-1 (#133) - they always 404 against OPNsense because no public REST API exists for FreeBSD sysctl tunables. Tunables are managed via the…

v2026.05.06.3 · 2026-05-06

Summary · Fixes #132 - the 4 \opnsense_diag_log_\ tools (system, gateways, routing, resolver) returned empty arrays on current OPNsense even when logs existed. Hard-coded \/diagnostics/log/core/<category>\ is no longer…

v2026.05.06.2 · 2026-05-06

Summary · Fixes #131 - \opnsense_dhcp_list_leases\ and \opnsense_dhcp_find_lease\ previously returned empty arrays on Kea-backed OPNsense installs (the modern default) because they only queried the legacy ISC endpoint.…

04 · Who maintains OPNsense MCP Server

OPNsense MCP Server is maintained by itunified-io. We track 4 MCP servers from itunified-io - 4 actively maintained, 3 combined GitHub stars, oldest repo from Mar 2026.

05 · Facts

repository: github.com/itunified-io/mcp-opnsense
category: API integration - ranked #187 of 250 actively-maintained API integration servers as of 2026-08-25.
registry: io.github.itunified-io/opnsense (active, first published 2026-04-10)
packages: npm:@itunified.io/mcp-opnsense

06 · OPNsense MCP Server FAQ

Is OPNsense MCP Server still maintained?

Yes - as of 2026-08-25, its last commit was 2026-05-06. We re-verify nightly.

What can OPNsense MCP Server do?

With this server connected, an agent can list host overrides (A/AAAA/CNAME), add a host override record, delete a host override by UUID, and add a DNS forwarding server.

How do I install OPNsense MCP Server?

Run `npx -y @itunified.io/mcp-opnsense`. The README documents 12 environment variables (NAS_VAULT_ADDR, NAS_VAULT_ROLE_ID, NAS_VAULT_SECRET_ID…) to set first. Set NAS_VAULT_ADDR, NAS_VAULT_ROLE_ID, NAS_VAULT_SECRET_ID, OPNSENSE_VERIFY_SSL, OPNSENSE_URL, OPNSENSE_API_KEY, OPNSENSE_API_SECRET, MCP_SECRETS_FILE, OPNSENSE_SSH_ENABLED, OPNSENSE_SSH_HOST, OPNSENSE_SSH_USER before connecting. NAS_VAULT_KV_MOUNT is optional or environment-specific per the README. You can also paste the ready-made client config above.

Does OPNsense MCP Server run locally?

Yes - it's a stdio server: it runs on your machine (via npx) with your user's permissions. Your data stays local unless the server itself calls external APIs.

07 · Alternatives to OPNsense MCP Server

Alternatives to OPNsense MCP Server

Maintained API integration servers if OPNsense MCP Server isn't the fit.

More API integration MCP servers · ServiceNow MCP AI · TLE Satellite Tracker · Allmcps Server · German Newsfeed MCP Server · Spotify

More TypeScript MCP servers · Postgram · Cubelife · CodeWiki MCP - AI-generated docs for GitHub repos · iz-tolk-MCP - Tolk Compiler for TON · see all