nearxos/opnsense-mcp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add Unbound DNS, VPN, firmware, logs, and certificate tools (v1.1.0)

Browse Source
This commit is contained in:
Hermes CT107
2026-06-12 18:54:21 +00:00
parent 74edd09eb8
commit 22e4f3a469
11 changed files with 546 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
README.md
View File

@@ -4,7 +4,7 @@ Model Context Protocol server for [OPNsense](https://opnsense.org/) firewall man
## Features
- **60+ tools** covering system info, interfaces, firewall rules, aliases, NAT, DHCP, diagnostics, routes, and gateways
- **90+ tools** covering system info, interfaces, firewall rules, aliases, NAT, DHCP, diagnostics, routes, gateways, Unbound DNS, VPN (WireGuard/OpenVPN/IPsec), firmware/updates, system logs, and certificates
- **Safety guardrails**: write operations disabled by default, dry-run mode, WAN rule blocking, required description prefix
- **Savepoint workflow**: create savepoint → apply → cancel rollback (matches OPNsense official API pattern)
- **Audit logging**: all mutations logged to JSONL
@@ -101,6 +101,15 @@ Or ask Hermes: *"Use opnsense_test_connection to verify firewall access"*
| `opnsense_get_firewall_log` | Recent blocked/ passed traffic |
| `opnsense_get_pf_states` | Active connection states |
| `opnsense_search_port_forwards` | Port forward rules |
| `opnsense_search_dns_host_overrides` | Unbound local DNS records |
| `opnsense_wireguard_status` | WireGuard tunnels and peer handshakes |
| `opnsense_openvpn_sessions` | Connected OpenVPN clients |
| `opnsense_ipsec_status` | IPsec service and sessions |
| `opnsense_firmware_check_updates` | Available updates from mirrors |
| `opnsense_firmware_audit` | Package vulnerability audit |
| `opnsense_get_system_log` | Syslog search (system, dhcp, dns, vpn, audit, ...) |
| `opnsense_list_certificates` | Trust store certificates (no private keys) |
| `opnsense_get_interface_traffic` | Per-interface traffic rates |
### Write operations (require `OPNSENSE_ALLOW_WRITES=true`)
@@ -114,6 +123,10 @@ Or ask Hermes: *"Use opnsense_test_connection to verify firewall access"*
| `opnsense_safe_apply_firewall_rule_change` | Savepoint + toggle + apply workflow |
| `opnsense_alias_add_entry` | Add IP to alias |
| `opnsense_add_d_nat_rule` | Add port forward |
| `opnsense_add_dns_host_override` | Add local DNS record (+ reconfigure) |
| `opnsense_wireguard_toggle_peer` | Enable/disable WireGuard peer |
| `opnsense_unbound_restart` | Restart DNS resolver |
| `opnsense_firmware_update` | Install updates (double confirm) |
## Safe Change Workflow