antonio-mello-ai/mcp-pfsense

MCP server for managing **pfSense firewalls** through AI assistants like Claude, ChatGPT, and Copilot.
> **Requires**: pfrest package installed on your pfSense instance (provides the REST API).
Features
**20 tools** across 7 categories:
| Category | Tools | Description |
|----------|-------|-------------|
| **System** | get_system_status, get_interfaces | Version, CPU, memory, uptime, temperature, network interfaces |
| **Firewall** | list_firewall_rules, add_firewall_rule, delete_firewall_rule, list_firewall_aliases | Rule management with interface filtering, alias listing |
| **DHCP** | list_dhcp_leases, list_dhcp_static_mappings, add_dhcp_static_mapping, delete_dhcp_static_mapping | Active leases, IP reservations |
| **DNS** | list_dns_host_overrides, add_dns_host_override, delete_dns_host_override | Unbound DNS Resolver host overrides |
| **Pending changes** | get_pending_changes, apply_changes | See what is staged per subsystem (firewall, dhcp, dns) and apply it |
| **Monitoring** | get_gateway_status, get_arp_table, list_services, get_firewall_logs | Gateway health, connected devices, service status, recent raw firewall log entries |
| **Services** | restart_service | Restart any pfSense service |
Safety
- **Two-step confirmation** for destructive operations (delete rules, delete mappings, restart services, apply changes): the tool returns a warning on first call and only executes when called again with confirm=true.
- **Writes are staged, not live.** Like the pfSense WebGUI, add_* and delete_* store the change in the config but do not activate it. The tool response says so (applied: false, plus a pending note). Activate with apply_changes(subsystem, confirm=true) — which reloads that subsystem, including anything a human left staged in the WebGUI — or pass apply=true on the write itself when you explicitly want a one-shot change. Nothing the assistant does reaches the packet filter without one of those two explicit steps.
- delete_dhcp_static_mapping takes the mapping's interface (its parent_id in list_dhcp_static_mappings) and mapping_id; a mapping is addressed by both.
Installation
Prerequisites
1. **pfSense** with pfrest package installed
2. A user account with API access (typically admin)
Configuration
Set environment variables:
| Variable | Required | Default | Description |
|----------|----------|---------|-------------|
| PFSENSE_HOST | Yes | — | pfSense hostname or IP |
| PFSENSE_PASSWORD | Yes | — | API user password |
| PFSENSE_USERNAME | No | admin | API username |
| PFSENSE_PORT | No | 443 | API port |
| PFSENSE_SCHEME | No | https | http or https |
| PFSENSE_VERIFY_SSL | No | false | Verify SSL certificate |
Claude Desktop
Add to claude_desktop_config.json:
Claude Code
Then set environment variables in your shell or .env file.
Usage Examples
Once connected, ask your AI assistant:
- *"What's the pfSense system status?"*
- *"Show me all firewall rules on the LAN interface"*
- *"List active DHCP leases"*
- *"Add a DNS entry for nas.home.lan pointing to 10.10.10.50"*