mcp-pfsense

MCP server for managingpfSense firewallsthrough AI assistants like Claude, ChatGPT, and Copilot.

Requires:pfrestpackage installed on your pfSense instance (provides the REST API).

# Using uvx (recommended) uvx mcp-pfsense # Using pip pip install mcp-pfsense

- pfSensewithpfrestpackage installed
- A user account with API access (typicallyadmin)

{ "mcpServers": { "pfsense": { "command": "uvx", "args": ["mcp-pfsense"], "env": { "PFSENSE_HOST": "10.10.10.1", "PFSENSE_PASSWORD": "your-password" } } } }

claude mcp add pfsense -- uvx mcp-pfsense

Then set environment variables in your shell or.envfile.

- "What's the pfSense system status?"
- "Show me all firewall rules on the LAN interface"
- "List active DHCP leases"
- "Add a DNS entry for nas.home.lan pointing to 10.10.10.50"
- "What devices are connected to the network?"(ARP table)
- "Show gateway health and latency"
- "Create a firewall rule to allow TCP port 8080 on LAN"
- "Reserve IP 10.10.10.60 for MAC aa:bb:cc:dd:ee:20"

- pfSense: 2.7.x and 2.8.x
- pfrest: REST API v2 — any v2.x release, exceptlist_dhcp_static_mappings, which needsv2.7.0 or later(it uses the/services/dhcp_server/static_mappingscollection endpoint added in that release).
- Python: 3.11+

The endpoint, parameters and encoding each tool uses are pinned bytests/test_client_endpoints.pyandtests/test_wire_format.py, derived from the pfrest v2 endpoint definitions. Versions before 0.2.0 called several endpoints that do not exist in pfrest v2 (see Troubleshooting).

Note: pfrest runs on nginx (port 80 by default), separate from the pfSense WebGUI (lighttpd on port 443). If your pfrest is configured on a non-standard port, setPFSENSE_PORTandPFSENSE_SCHEMEaccordingly.

Onlyget_system_statusandget_arp_tablework; everything else returns 400/404

mcp-pfsense 0.1.1 and earlier called singular endpoints for listing (/interface,/firewall/rule,/firewall/alias) and legacy paths that pfrest v2 does not serve (/status/dhcp_leases,/services/dhcpd/static_mapping,/services/unbound/host_override,/status/gateway,/status/servicefor GET). Upgrade to 0.2.0 or later.

pfrest checks the privileges of the API user per endpoint. Grant the user theapi-v2-*privileges for the endpoints you need (orpage-allfor full access) underSystem → User Manager.

ModuleNotFoundError: No module named 'mcp.server.fastmcp'

The MCP Python SDK 2.0 removed the module that mcp-pfsense 0.1.1 and earlier import, so fresh installs (uvx mcp-pfsense,pip install) failed on startup. Upgrade to 0.2.0 or later, which pinsmcp<2. If you must stay on an older mcp-pfsense:uvx --with "mcp<2" mcp-pfsense.

A rule / mapping / override was created but is not in effect

That is the default: writes are staged (seeSafety). Check withget_pending_changes(subsystem)and activate withapply_changes(subsystem, confirm=true), or in the WebGUI. If a write returns 200 but nothing is stored at all, the pfrestread_onlysetting is on (System → REST API → Settings).

git clone https://github.com/antonio-mello-ai/mcp-pfsense.git cd mcp-pfsense python -m venv .venv source .venv/bin/activate pip install -e ".[dev]" # Run tests pytest # Lint and type check ruff check . mypy src/

Interact with the Illumio Policy Compute Engine (PCE) to manage workloads, labels, and analyze traffic flows.

Network diagnostics from 6 global regions — SSL, DNS, ping, whois, traceroute, port scan, latency. Works without an API key.

Integrate with Tailscale's CLI and API for automated network management and monitoring.

MCP access to cluster-wide L4 and L7 network traffic, packets, APIs, and complete payloads.

A complete Model Context Protocol (MCP) server for Fortinet FortiOS 7.6.6

A comprehensive Model Context Protocol (MCP) server for penetration testing and cybersecurity operations, providing seamless integration between Kali Linux tools and MCP-compatible clients.

Network reconnaissance and security scanning with port scanning, DNS analysis, and vulnerability assessment

A server for real-time network packet monitoring and security analysis.

Perform network scanning and security auditing using the NMAP utility.

Integrates the Nmap network scanning tool with MCP, enabling network scanning capabilities within MCP-compatible environments.