gensecaihq/pfsense-mcp-server

uvx --from git+https://github.com/gensecaihq/pfsense-mcp-server pfsense-mcp-server
git clone https://github.com/gensecaihq/pfsense-mcp-server.git && cd pfsense-mcp-server && pip install -r requirements.txt

Usage

• •Set PFSENSE_URL, AUTH_METHOD, and credentials in claude_desktop_config.json
• •"Block all traffic from 203.0.113.5 on WAN"
• •"Create a port forward for port 443 to 192.168.1.50"
• •python3 -m src.main -t streamable-http --port 3000

Key features

• ✓333 tools across firewall rules, aliases, NAT, VPN (OpenVPN/IPsec/WireGuard), routing, DNS, DHCP, certificates, users, interfaces, system, services, logs, traffic shaping, packages
• ✓9-layer safety pipeline: classify, allowlist, sanitize, rate limit, dry-run, confirm, backup, execute, audit
• ✓Config backup with one-line rollback on every destructive operation
• ✓Wire-format contract tests against the real pfSense REST API v2.10.0 schema
• ✓Read-only mode (MCP_READ_ONLY), tool allowlists, and audit logging with secret redaction
• ✓stdio, Streamable HTTP, and hardened Docker deployments

Best for

pfSense administrators who want to manage and troubleshoot a firewall conversationally through Claude with strong safety guardrails

Caveats

• ⚠Requires pfSense with the REST API v2 package installed (use v2.10.0+ for security fixes)
• ⚠Destructive actions require explicit confirm=True unless read-only mode is set
• ⚠52 destructive tools plus 150 mutating tools are rate-limited
• ⚠Python 3.11+ required