SkillFoxx

pfSense MCP Server

MCP server for a pfSense firewall via its REST API: 332 tools, confirmation for risky actions and a revision to roll back to

  • 121 ★ on the repository
  • Last commit
  • MIT
MCP server

Broad access

Why this level

  • Tools create, change and delete firewall rules, VPN, users and certificates on a live network device
  • Reboot and halt are available, and configuration rollback is manual
All reasons and checks

gensecaihq/pfsense-mcp-serverAuthor:GenSec AI HQ

Install

Manual install

{
  "mcpServers": {
    "pfsense": {
      "command": "uvx",
      "args": ["--from", "git+https://github.com/gensecaihq/pfsense-mcp-server@v1.1.0", "pfsense-mcp-server"],
      "env": {
        "PFSENSE_URL": "https://192.168.1.1",
        "AUTH_METHOD": "basic",
        "PFSENSE_USERNAME": "admin",
        "PFSENSE_PASSWORD": "your-password",
        "PFSENSE_VERSION": "CE_2_8_1",
        "PFSENSE_CA_FILE": "/path/to/pfsense-ca.pem"
      }
    }
  }
}

A snippet for claude_desktop_config.json. Remove PFSENSE_CA_FILE if the certificate is signed by a public CA.

Access and checks

How we review

Broad accessThe tool can change data, run commands or handle secrets.

  • Tools create, change and delete firewall rules, VPN, users and certificates on a live network device
  • Reboot and halt are available, and configuration rollback is manual

This is third-party code. Review the repository files before installing.

What it does

pfSense MCP Server connects Claude Desktop, Claude Code and other MCP clients to a pfSense firewall. The agent reads and changes rules, aliases, NAT, routes, DNS and DHCP, configures OpenVPN, IPsec and WireGuard, manages certificates, users and services, reads logs and traces why a host cannot connect. There are 332 tools, 131 of them read-only. Every change passes nine checks: operation risk classification, an allowlist of tools, parameter sanitising, a rate limit, a `dry_run` preview, `confirm=True`, a config revision snapshot, the API call and an audit log with secrets redacted. The response names the revision you can restore in the pfSense web interface. `MCP_READ_ONLY=true` leaves only read tools, while `MCP_ALLOWED_TOOLS` permits the listed write tools. You need the pfSense REST API package and Python 3.11 or newer.

Who it is for. Network administrators running pfSense who want to describe rule and VPN changes in words instead of clicking through web interface tabs.

Good fit when

  • A host cannot reach the internet and the agent looks for the blocking rule and the down gateway
  • You need to block an address on WAN and get a config revision to roll back to
  • You need to add a WireGuard peer for a user and get the client config
  • A pfSense install is reviewed in `MCP_READ_ONLY` mode before the agent may edit anything

Not a fit when

  • A production firewall with no backup and no maintenance window: rollback is manual in the web interface
  • You manage several pfSense boxes at once: one server process serves a single instance
  • You need OPNsense or another platform: the tool targets only the pfSense REST API v2

Example request

Why can't 192.168.1.50 reach the internet? Check gateways and LAN rules and change nothing.

MCP

Transport
stdio
Authentication
key is optional

Environment variables

PFSENSE_URL required
pfSense address, for example https://192.168.1.1.
AUTH_METHOD required
Sign-in method: basic, api_key or jwt.
PFSENSE_PASSWORD secret
User password for basic and jwt.
MCP_READ_ONLY
Set to true to expose read tools only.

Limitations

The pfSense REST API v2 package must be on the firewall itself, plus Python 3.11 or newer. The project is not on PyPI, and the name `pfsense-mcp-server` there belongs to a different package, so install from Git with `uvx`. Rollback is manual: the REST API cannot restore a configuration and the server only returns a revision number. The `confirm=True` flag is sent by the client and is not a separate human approval, so keep your client's tool-approval prompts on. About 11 tools for nested objects, such as DHCP pools and shaper queues, do not send `parent_id` and fail.

How to disable. Remove the pfsense entry from claude_desktop_config.json and stop the server process. If you created an API key or a dedicated user for the agent, revoke them in pfSense.

FAQ

Can I install it with pip?

No. A different, unrelated project on PyPI has the same name, so never run `pip install pfsense-mcp-server`. Use `uvx --from git+https://github.com/gensecaihq/pfsense-mcp-server@v1.1.0 pfsense-mcp-server` or the release assets.

How do I give the agent read-only access?

Set `MCP_READ_ONLY=true` to keep the 131 read tools. For targeted writes use `MCP_ALLOWED_TOOLS`, for example `create_firewall_rule_advanced,delete_firewall_rule`.

How do I undo a change?

A guarded tool returns `pre_change_revision_id`. In the pfSense web interface open Diagnostics, Backup and Restore, Config History and restore that revision by hand.

Which sign-in methods are supported?

Three: `basic` with a username and password, `api_key` with a key from System, REST API, Keys, and `jwt` with automatic token renewal. Set the method in `AUTH_METHOD`.

Why does certificate verification fail?

pfSense uses a self-signed certificate from its own CA and Python does not read the OS trust store. Export the CA under System, Cert. Manager, CAs and point `PFSENSE_CA_FILE` at the file; a missing or broken file stops the server at startup.

Discussion

No questions or reviews yet.

MCP servers
Official

Official Cloudflare MCP server: the agent drives the whole Cloudflare API by searching the spec and running code

MCP serverBroad access1.1K

An SSH MCP server: the agent runs commands, reads and writes files over SFTP, transfers files and starts long jobs while credentials stay with you

MCP serverBroad access1K

An MCP server connects agents to UniFi infrastructure for device diagnostics, configuration reviews and approved changes

MCP serverBroad access351
Official

A Perforce MCP server for P4: files, changelists, shelves, reviews and streams for the agent, with a flag to disable writes.

MCP serverExtended access126

MCP Slim Guard sits between an agent and your MCP servers: it validates calls against schemas and returns big results in parts.

MCP serverExtended access180
Official

The official TrueNAS MCP server: ask about pools, snapshots, virtual machines and apps in plain language.

MCP serverBroad access117

README in short

The README opens with sample conversations with a firewall and explains why a production pfSense needs guardrail layers. It then covers a quick start via uvx or a clone, a table of 332 tools by area, nine checks before a change, supported versions, sign-in methods, deployment and known limitations.

README badge

Report a problem