Opnsense (vespo92) MCP Server
opnsense-mcp-server
npm
v0.11.0
Published by vespo92 — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
Model Context Protocol server for OPNSense firewall management with inter-VLAN routing diagnostics, ARP table, DNS filtering and HAProxy support via Claude Desktop
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 7 = 93. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −6 | capability blast radius (high) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 9
high Reads a sensitive credential path or dumps the environment (dist/resources/ssh/executor.js)MTC-SRC-006
In the server's implementation (`dist/resources/ssh/executor.js:75`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: oin(homedir(), '.ssh', 'id_rsa'), passphrase: process.env.OPNSENSE_SSH_PASSPHRASE, timeout: pars
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/resources/ssh/executor.js
high Tool "cli_execute" exposes command/code executionMTC-CAP-001
Tool "cli_execute" appears to run shell commands or evaluate code (parameter "command"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool cli_execute
high Tool "ssh_execute" exposes command/code executionMTC-CAP-001
Tool "ssh_execute" appears to run shell commands or evaluate code (parameter "command"). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool ssh_execute
medium Unconstrained command parameter "command" on "cli_execute"MTC-CAP-006
Tool "cli_execute" takes a command-shaped parameter "command" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.
Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.
Location: tool cli_execute · inputSchema.properties.command
medium Unconstrained command parameter "command" on "ssh_execute"MTC-CAP-006
Tool "ssh_execute" takes a command-shaped parameter "command" with no enum/pattern constraint. Free-form, model- or attacker-controlled arguments reaching a shell is the command-injection precondition.
Fix: Constrain the parameter (enum/pattern), or build the command from a fixed template with escaped args.
Location: tool ssh_execute · inputSchema.properties.command
medium Dynamic module load from a non-literal (dist/core/plugin-system/loader.js)MTC-SRC-005
In the server's implementation (`dist/core/plugin-system/loader.js:97`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: const module = await import(indexPath); const PluginClass = module.default || module[Object.keys(module)[
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/core/plugin-system/loader.js
medium Dynamic module load from a non-literal (dist/server-v2.js)MTC-SRC-005
In the server's implementation (`dist/server-v2.js:213`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: = configPath ? require(configPath) : { server: { host: process.env.SERVER_H
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/server-v2.js
low Mutating tool "cli_execute" declares no destructiveHintMTC-CAP-005
Tool "cli_execute" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool cli_execute
low Mutating tool "ssh_execute" declares no destructiveHintMTC-CAP-005
Tool "ssh_execute" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool ssh_execute
Tools 162
Each tool and what it can reach — statically extracted from the published source.
cli_executeruns code / shellmonit_add_alertnetwork egressssh_executeruns code / shellacme_add_actionno sensitive capabilityacme_delete_actionno sensitive capabilityacme_get_settingsno sensitive capabilityacme_renew_certificateno sensitive capabilityacme_revoke_certificateno sensitive capabilityacme_sign_certificateno sensitive capabilityacme_update_certificateno sensitive capability
Show 152 more tools ↓
add_dnsbl_subscriptionno sensitive capabilityapply_blocklist_categoryno sensitive capabilityARP Tableno sensitive capabilityblock_domainno sensitive capabilityblock_multiple_domainsno sensitive capabilitycli_apply_changesno sensitive capabilitycli_check_nfsno sensitive capabilitycli_fix_dmz_routingno sensitive capabilitycli_fix_interface_blockingno sensitive capabilitycli_reload_firewallno sensitive capabilitycli_show_routingno sensitive capabilityconfigureno sensitive capabilityConnection Statusno sensitive capabilitycreate_backupno sensitive capabilitycreate_firewall_presetno sensitive capabilitycreate_firewall_ruleno sensitive capabilitycreate_vlanno sensitive capabilitydelete_firewall_ruleno sensitive capabilitydelete_vlanno sensitive capabilityDeploymentsno sensitive capabilityDHCP Leasesno sensitive capabilityDNS Blocklistno sensitive capabilityfind_arp_by_hostnameno sensitive capabilityfind_arp_by_interfaceno sensitive capabilityfind_arp_by_ipno sensitive capabilityfind_arp_by_macno sensitive capabilityfind_device_by_macno sensitive capabilityfind_device_by_nameno sensitive capabilityfind_devices_on_vlanno sensitive capabilityfind_firewall_rulesno sensitive capabilityFirewall Rulesno sensitive capabilityget_arp_statsno sensitive capabilityget_devices_by_interfaceno sensitive capabilityget_firewall_ruleno sensitive capabilityget_guest_devicesno sensitive capabilityget_interfacesno sensitive capabilityget_vlanno sensitive capabilitygroup_devicesno sensitive capabilityHAProxy Backendsno sensitive capabilityHAProxy Frontendsno sensitive capabilityHAProxy Statisticsno sensitive capabilityhaproxy_acl_createno sensitive capabilityhaproxy_acl_deleteno sensitive capabilityhaproxy_acl_updateno sensitive capabilityhaproxy_action_createno sensitive capabilityhaproxy_action_deleteno sensitive capabilityhaproxy_action_updateno sensitive capabilityhaproxy_backend_createno sensitive capabilityhaproxy_backend_deleteno sensitive capabilityhaproxy_backend_getno sensitive capabilityhaproxy_backend_healthno sensitive capabilityhaproxy_backend_listno sensitive capabilityhaproxy_backend_updateno sensitive capabilityhaproxy_certificate_createno sensitive capabilityhaproxy_certificate_listno sensitive capabilityhaproxy_frontend_createno sensitive capabilityhaproxy_frontend_deleteno sensitive capabilityhaproxy_frontend_getno sensitive capabilityhaproxy_frontend_listno sensitive capabilityhaproxy_frontend_updateno sensitive capabilityhaproxy_server_addno sensitive capabilityhaproxy_server_deleteno sensitive capabilityhaproxy_server_updateno sensitive capabilityhaproxy_service_controlno sensitive capabilityhaproxy_statsno sensitive capabilityIaC Resource Typesno sensitive capabilityiac_apply_deploymentno sensitive capabilityiac_destroy_deploymentno sensitive capabilityiac_list_resource_typesno sensitive capabilityiac_plan_deploymentno sensitive capabilityinterface_configure_dmzno sensitive capabilityinterface_enable_intervlan_allno sensitive capabilityinterface_enable_intervlan_routingno sensitive capabilityinterface_get_configno sensitive capabilityinterface_list_overviewno sensitive capabilityinterface_update_configno sensitive capabilitylist_arp_entriesno sensitive capabilitylist_available_dnsblno sensitive capabilitylist_backupsno sensitive capabilitylist_dhcp_leasesno sensitive capabilitylist_dns_blocklistno sensitive capabilitylist_firewall_rulesno sensitive capabilitylist_vlansno sensitive capabilitymacro_analyzeno sensitive capabilitymacro_deleteno sensitive capabilitymacro_exportno sensitive capabilitymacro_generate_toolno sensitive capabilitymacro_importno sensitive capabilitymacro_listno sensitive capabilitymacro_playno sensitive capabilitymacro_start_recordingno sensitive capabilitymacro_stop_recordingno sensitive capabilitymonit_add_serviceno sensitive capabilitymonit_add_testno sensitive capabilitymonit_delete_alertno sensitive capabilitymonit_delete_serviceno sensitive capabilitymonit_delete_testno sensitive capabilitymonit_get_settingsno sensitive capabilitymonit_statusno sensitive capabilitymonit_update_alertno sensitive capabilitymonit_update_serviceno sensitive capabilitymonit_update_testno sensitive capabilitynat_analyze_configno sensitive capabilitynat_apply_changesno sensitive capabilitynat_cleanup_dmz_fixno sensitive capabilitynat_create_outbound_ruleno sensitive capabilitynat_create_port_forwardno sensitive capabilitynat_delete_outbound_ruleno sensitive capabilitynat_delete_port_forwardno sensitive capabilitynat_fix_dmzno sensitive capabilitynat_get_modeno sensitive capabilitynat_list_outboundno sensitive capabilitynat_list_port_forwardsno sensitive capabilitynat_quick_fix_dmzno sensitive capabilitynat_set_modeno sensitive capabilityNetwork Interfacesno sensitive capabilitynetwork_queryno sensitive capabilityRecorded Macrosno sensitive capabilityremove_dnsbl_subscriptionno sensitive capabilityResource Stateno sensitive capabilityrestore_backupno sensitive capabilityrouting_create_intervlan_rulesno sensitive capabilityrouting_diagnosticsno sensitive capabilityrouting_fix_allno sensitive capabilityrouting_fix_dmzno sensitive capabilitysearch_dns_blocklistno sensitive capabilityssh_backup_configno sensitive capabilityssh_batch_executeno sensitive capabilityssh_check_nfs_connectivityno sensitive capabilityssh_enable_intervlan_routingno sensitive capabilityssh_fix_dmz_routingno sensitive capabilityssh_fix_interface_blockingno sensitive capabilityssh_quick_dmz_fixno sensitive capabilityssh_reload_firewallno sensitive capabilityssh_restore_configno sensitive capabilityssh_show_pf_rulesno sensitive capabilityssh_show_routingno sensitive capabilityssh_system_statusno sensitive capabilityssh_test_vlan_connectivityno sensitive capabilitysync_network_datano sensitive capabilitysystem_enable_intervlan_routingno sensitive capabilitysystem_get_settingsno sensitive capabilitysystem_update_firewall_settingsno sensitive capabilitytest_connectionno sensitive capabilitytoggle_blocklist_entryno sensitive capabilitytoggle_firewall_ruleno sensitive capabilityunblock_domainno sensitive capabilityupdate_device_nameno sensitive capabilityupdate_dnsbl_subscriptionno sensitive capabilityupdate_firewall_ruleno sensitive capabilityupdate_vlanno sensitive capabilityVLANsno sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (162 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v0.11.0 latest |
A 93/100 | 9 | 1.13.0 | 2026-09-07 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan opnsense-mcp-server --onlineOther implementations of Opnsense 4
Independent packages implementing the same tool, scanned with the same engine. Compare all 5 side by side →
Modular MCP server for OPNsense firewall management - 88 tools providing access to 2000+ methods
MCP server exposing the OPNsense API to AI assistants
Secure MCP server for OPNsense firewall management via AI assistants
Slim OPNsense MCP Server — DNS, Firewall, Diagnostics, DHCP, System management via OPNsense REST API
More in Cloud & DevOps
Operator control CLI for AdGuard Home with an MCP adapter
interacting with Aliyun (Alibaba Cloud) services through This MCP server provides tools.
MCP server for the Aspro.Cloud REST API
MCP server for Atlassian Confluence and Jira Cloud APIs
AuroraCloud-first MCP server that exposes AuroraDocs workspace data to Claude Desktop and other AI agents
The official AWS Knowledge Base retrieval server using Bedrock Agent Runtime.