BunkerWeb MCP Server
Official BunkerWeb MCP server: 44 tools for WAF services, instances, IP bans, configurations and plugins.
- 10 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- The tools delete services and plugins, stop instances and ban IP addresses in a live firewall.
- The server has no per-client roles: the agent's rights equal the BunkerWeb API token rights.
Install
- Works in
Manual install
docker run --rm -p 127.0.0.1:8080:8080 --env-file .env bunkerity/bunkerweb-mcp:latestREADME command for the published image. Before running, copy `.env.example` to `.env` and set the BunkerWeb API address and token.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The tools delete services and plugins, stop instances and ban IP addresses in a live firewall.
- The server has no per-client roles: the agent's rights equal the BunkerWeb API token rights.
This is third-party code. Review the repository files before installing.
What it does
The server hands an agent the management API of BunkerWeb, an open-source web firewall. The agent creates, changes and deletes protected services, reloads and stops instances, bans and unbans IPs, edits global and custom configuration, uploads plugins and runs scheduler jobs. After a write to a service the server reads the data back and returns a receipt saying whether the settings matched in the database, always marking that live behavior is unconfirmed. For reading there are the resources `config://global`, `bans://active`, `instances://status` and `logs://jobs`. The server serves 13 bundled BunkerWeb Agent Skills as `skill://bunkerweb/` resources.
Who it is for. BunkerWeb administrators and DevOps engineers who protect sites with the firewall and want to edit services, bans and configuration by asking an agent.
Good fit when
- An attacker's address has to be banned at once, and the agent does it by command without opening the interface.
- Sites move from Apache or Caddy to BunkerWeb with the bundled migration skills.
- Before a rollout the API state, version, MULTISITE and instance count are checked.
- A new service is created from a template and the write result is read back right away.
Not a fit when
- The BunkerWeb API is unreachable from the server host: the tools have nothing to answer with.
- Different roles per client are needed: the server has no per-client roles.
- A production firewall with no configuration backup: the tools delete services and plugins.
Example request
Show the BunkerWeb instances and active bans, then ban the address 203.0.113.15 and reload the instances.MCP
- Transport
- http, stdio
- Authentication
- key is optional
Environment variables
BUNKERWEB_BASE_URLrequired- BunkerWeb control-plane API URL. Defaults to `http://localhost:8888`; inside a container `localhost` points at the container itself.
BUNKERWEB_API_TOKENsecret- Static API token for the Bearer header.
BUNKERWEB_BASIC_USERNAME- Username for Basic authentication when there is no token.
BUNKERWEB_BASIC_PASSWORDsecret- Password for Basic authentication.
MCP_READ_ONLY- The value `true` keeps only read tools on every transport.
MCP_ALLOWED_HOSTS- Comma-separated allowlist of Host values; for a local client it includes `127.0.0.1:8080`.
Limitations
A reachable BunkerWeb API and its credentials are required. The server has no per-client roles, so the agent's rights equal the token's rights, and access is narrowed with `MCP_READ_ONLY=true`. The HTTP address `/mcp/` has no token protection, so keep it on a trusted network or behind an authenticating proxy. The demo `docker-compose.yml` opens port 8080 without a client token check and suits only a developer machine. A write receipt does not prove that instances have already applied the settings.
How to disable. Stop the container, for example with `docker stop` for the running image, and delete the `bunkerweb` entry from `.mcp.json` or the client config. Reissue the BunkerWeb API token.
FAQ
How do I connect BunkerWeb MCP Server to Claude Code?
Start the image with `docker run --rm -p 127.0.0.1:8080:8080 --env-file .env bunkerity/bunkerweb-mcp:latest` and add an entry of type `http` with the address `http://127.0.0.1:8080/mcp/` to `.mcp.json`. The trailing slash is required.
How do I leave the agent read-only?
Set `MCP_READ_ONLY=true`. Write tools disappear on every transport, including `authenticate`, which returns credentials.
Can the server run without HTTP?
Yes, as a stdio process. Create a virtual environment with Python 3.11 or newer, install the package from the repository and point the client config at `.venv/bin/bunkerweb-mcp` with `BUNKERWEB_BASE_URL` and `BUNKERWEB_API_TOKEN`.
What does the diagnose tool do?
It shows the API host, reachability, sign-in result, version, the MULTISITE value and instance counts. With a service name it adds the service state, draft flag and setting-owner counts.
Where do the bundled skills come from?
From the `bunkerity/bunkerweb-skills` repository, with the version pinned in the `SKILLS_REF` file. There are 13 and the entry point is `skill://bunkerweb/bunkerweb/SKILL.md`. The `MCP_ENABLE_SKILLS=false` setting turns them off.
Discussion
No questions or reviews yet.
Related
MCP serversMCP access to Wazuh for investigating alerts and vulnerabilities, checking SIEM health and invoking response tools
Open-source deception framework: decoy SSH, HTTP, database and MCP services in YAML, optional LLM responses, attacker activity logged as evidence
An offensive security MCP server: the agent runs 150+ pentest and recon tools and drives automated target assessments
The official MCP exposes Bitwarden vault operations and, with separate credentials, organization administration.
Burp Suite MCP Server
Burp Suite MCP Server Extension
PortSwigger's official extension that exposes Burp Suite to AI clients over MCP for working with web traffic during testing
A bridge between an MCP client and a Kali Linux terminal so the agent can run nmap, sqlmap, hydra and other tools for authorized pentesting and CTF
README in short
The quick start attaches a container to an existing BunkerWeb API or brings up a full demo stack. Then come HTTP and stdio clients, an environment variable table, the tool and resource lists, a security section and monitoring through Prometheus and Grafana.