This MCP server enables AI agents to inspect and modify an OPNsense firewall via natural language, using a compact set of generic tools and a resource registry to cover 96 CRUD operations.
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Drizzle ORM has SQL injection via improperly escaped SQL identifiers
process.env. You'll be asked to provide them before it can run.ALLOWED_RESOURCES— =firewall_alias,unbound_host_overrideAUDIT_LOG— =/var/log/opnsense-mcp/audit.jsonlAUDIT_LOG_STRICT— false When true, an fsynced intent record is written before each mutation and the mutation is refused if that write failsAUTO_BACKUP— true # snapshot before classified firewall mutationsAUTO_BACKUP_KEEP— 50 # prune to N most recentAUTO_BACKUP_STRICT— true # refuse a mutation when its pre-change backup failsBACKUP_ENABLEDBACKUP_PATH— /var/lib/opnsense-mcp/backupsCACHE_TTLDMZ_INTERFACEENABLE_CACHEENABLE_CONFIGURE_TOOL— true). The serverENABLE_RAW_API_TOOL— (=true) can call an endpoint supplied by the client. This is broadENABLE_RESTORE_TOOLS— false Additionally required for restore_backup_ssh (with ENABLE_SSH_FEATURES)ENABLE_SHELL_TOOLS— Shell tools (cli_ / ssh_) are hidden unless =true. SeeENABLE_SSH_FEATURES— ENABLE_RESTORE_TOOLS false Additionally required for restore_backup_ssh (with )IAC_ENABLED— false Expose the experimental iac_ tools (previously on by default)INIT_MAX_ATTEMPTSLOG_FILELOG_LEVEL— INFO # ERROR WARN INFO DEBUG; known secret keys/patterns are redactedLOG_MAX_FILESLOG_MAX_SIZEMACRO_STORAGE_PATHMCP_ALLOWED_HOSTS— loopback names Host-header allow-list (DNS-rebinding defense); defaults to localhost/127.0.0.1/[::1]MCP_ALLOWED_ORIGINS— =https://approved-client.example # exact origins; wildcard is fatalMCP_CORS_ORIGIN— unset Deprecated alias for a single allowed origin; is a fatal startup errorMCP_DEBUGMCP_SSE_HOST— MCP_SSE_PORT=3000 =127.0.0.1MCP_SSE_PORT— =3000 MCP_SSE_HOST=127.0.0.1MCP_TRANSPORT— stdio # recommended default; no listening socketOPNSENSE_API_KEY— your-api-keyOPNSENSE_API_SECRET— your-api-secretOPNSENSE_API_URLOPNSENSE_HOST— / OPNSENSE_API_KEY / OPNSENSE_API_SECRET are set. (Runtime credential setup viaOPNSENSE_INTERFACE_MAPPINGSOPNSENSE_SSH_HOST— your-opnsenseOPNSENSE_SSH_KEEPALIVEOPNSENSE_SSH_KEY_PATH— /absolute/path/to/a/private/keyOPNSENSE_SSH_PASSPHRASEOPNSENSE_SSH_PASSWORDOPNSENSE_SSH_PORTOPNSENSE_SSH_READY_TIMEOUTOPNSENSE_SSH_TIMEOUTOPNSENSE_SSH_USERNAME— root # privileged boundary; use only when the REST gap justifies itOPNSENSE_VERIFY_SSL— true # verification is ON unless set to falsePOSTGRES_DBPOSTGRES_HOSTPOSTGRES_PASSWORDPOSTGRES_PORTPOSTGRES_SCHEMAPOSTGRES_USERREAD_ONLY— false When true, hide and refuse every mutation, including local ones (backups, configure)REDIS_DBREDIS_HOSTREDIS_KEY_PREFIXREDIS_PASSWORDREDIS_PORTSTATE_ENCRYPTION_KEY[](https://m8ven.ai/mcp/gabrielion-opnsensemcp-1yx5k9)