MCP server for the OPNsense REST API
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"tazendor-opnsense-mcp","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# OPNsense MCP Server [](https://github.com/tazendor/opnsense-mcp-server/actions/workflows/ci.yml) [](https://pypi.org/project/tazendor-opnsense-mcp/) [](LICENSE) [](https://github.com/github/spec-kit) **GitHub**: https://github.com/tazendor/opnsense-mcp-server A Python [Model Context Protocol](https://modelcontextprotocol.io/) server that exposes the OPNsense REST API to AI clients such as Claude Desktop and Claude Code. ## What it does The server proxies 43 OPNsense API endpoints across eight domains as MCP tools, letting AI clients query and mutate firewall state through natural language. | Domain | Tools | Capabilities | |--------|-------|--------------| | System | 3 | Status, firmware check, config backup | | Firewall | 17 | Rule and alias CRUD, NAT port forwards, apply | | Interfaces | 4 | Interface list, config, ARP/NDP tables | | DHCP | 3 | Lease list, settings, static mappings | | Routes | 5 | Static route CRUD and apply | | DNS | 6 | Unbound settings and host override CRUD | | IDS | 1 | Ruleset list | | Services | 4 | Start/stop/restart/status for core modules | Mutating operations follow OPNsense's staged-then-apply model: changes are staged by `_add`/`_update`/`_delete` tools and committed by the corresponding `_apply` tool. ## Requirements - Python 3.12+ - [`uv`](https://docs.astral.sh/uv/) - OPNsense **26.1+** with API access enabled > **Compatibility**: Tested against OPNsense 26.1.10. The 26.x release series > made breaking REST API changes — Kea replaced ISC DHCPv4 (`kea/*` paths), > port-forward NAT moved to Destination NAT (`firewall/d_nat/*`), and the system > status endpoint changed. Older releases are not supported. ## Installation ```bash p…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.