Opnsense (lucamarien) MCP Server
opnsense-mcp-server
PyPI
v0.4.0
Published by lucamarien — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 4 = 96. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −3 | capability blast radius (moderate) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
| ✓ | inspection depth (source) — how much of the target the scan could see |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 0
Tools 81
Each tool and what it can reach — statically extracted from the published source.
opn_download_configingests untrusted inputopn_update_dnsblreads sensitive dataopn_add_aliasno sensitive capabilityopn_add_ddns_accountno sensitive capabilityopn_add_dns_overrideno sensitive capabilityopn_add_dnsbl_allowlistno sensitive capabilityopn_add_dnsmasq_rangeno sensitive capabilityopn_add_firewall_categoryno sensitive capabilityopn_add_firewall_ruleno sensitive capabilityopn_add_icmpv6_rulesno sensitive capabilityopn_add_nat_ruleno sensitive capabilityopn_arp_tableno sensitive capabilityopn_configure_mdns_repeaterno sensitive capabilityopn_confirm_changesno sensitive capabilityopn_crowdsec_alertsno sensitive capabilityopn_crowdsec_statusno sensitive capabilityopn_delete_aliasno sensitive capabilityopn_delete_ddns_accountno sensitive capabilityopn_delete_dns_overrideno sensitive capabilityopn_delete_dnsmasq_rangeno sensitive capabilityopn_delete_firewall_categoryno sensitive capabilityopn_delete_firewall_ruleno sensitive capabilityopn_delete_nat_ruleno sensitive capabilityopn_dns_lookupno sensitive capabilityopn_dns_statsno sensitive capabilityopn_firewall_logno sensitive capabilityopn_gateway_statusno sensitive capabilityopn_get_config_sectionno sensitive capabilityopn_get_dnsblno sensitive capabilityopn_haproxy_addno sensitive capabilityopn_haproxy_configtestno sensitive capabilityopn_haproxy_deleteno sensitive capabilityopn_haproxy_getno sensitive capabilityopn_haproxy_searchno sensitive capabilityopn_haproxy_statusno sensitive capabilityopn_haproxy_updateno sensitive capabilityopn_interface_statsno sensitive capabilityopn_ipsec_statusno sensitive capabilityopn_ipv6_statusno sensitive capabilityopn_list_acme_certsno sensitive capabilityopn_list_cron_jobsno sensitive capabilityopn_list_ddns_accountsno sensitive capabilityopn_list_dhcp_leasesno sensitive capabilityopn_list_dns_forwardsno sensitive capabilityopn_list_dns_overridesno sensitive capabilityopn_list_dnsblno sensitive capabilityopn_list_dnsmasq_leasesno sensitive capabilityopn_list_dnsmasq_rangesno sensitive capabilityopn_list_firewall_aliasesno sensitive capabilityopn_list_firewall_categoriesno sensitive capabilityopn_list_firewall_rulesno sensitive capabilityopn_list_kea_leasesno sensitive capabilityopn_list_nat_rulesno sensitive capabilityopn_list_servicesno sensitive capabilityopn_list_static_routesno sensitive capabilityopn_mcp_infono sensitive capabilityopn_mdns_repeater_statusno sensitive capabilityopn_ndp_tableno sensitive capabilityopn_openvpn_statusno sensitive capabilityopn_pf_statesno sensitive capabilityopn_pingno sensitive capabilityopn_reconfigure_ddclientno sensitive capabilityopn_reconfigure_dnsmasqno sensitive capabilityopn_reconfigure_haproxyno sensitive capabilityopn_reconfigure_unboundno sensitive capabilityopn_remove_dnsbl_allowlistno sensitive capabilityopn_scan_configno sensitive capabilityopn_security_auditno sensitive capabilityopn_set_dnsblno sensitive capabilityopn_set_rule_categoriesno sensitive capabilityopn_system_statusno sensitive capabilityopn_toggle_aliasno sensitive capabilityopn_toggle_firewall_ruleno sensitive capabilityopn_tracerouteno sensitive capabilityopn_update_aliasno sensitive capabilityopn_update_ddns_accountno sensitive capabilityopn_update_dns_overrideno sensitive capabilityopn_update_dnsmasq_rangeno sensitive capabilityopn_update_firewall_ruleno sensitive capabilityopn_update_nat_ruleno sensitive capabilityopn_wireguard_statusno sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (81 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v0.4.0 latest |
A 96/100 | 0 | 1.8.0 | 2026-07-23 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan opnsense-mcp-server --online --registry pypiOther implementations of Opnsense 4
Independent packages implementing the same tool, scanned with the same engine. Compare all 5 side by side →
Security scan results for the Opnsense (richard-stovall) MCP server.
Security scan results for the Opnsense (itunified.io) MCP server.
Security scan results for the Opnsense (vespo92) MCP server.
Security scan results for the Opnsense (PyPI) MCP server.
More in API Development
Security scan results for the Admin MCP server.
Security scan results for the Assessment MCP server.
Security scan results for the Base MCP server.
Security scan results for the Bling MCP server.
Security scan results for the Blogger MCP server.
Security scan results for the Brilliant Directories MCP server.