Skip to content

Releases: gabrielion/OPNSenseMCP

Release list

v0.1.1

v0.1.1 Latest
Latest

Choose a tag to compare

View all tags
@gabrielion gabrielion released this 18 Aug 00:28
v0.1.1
fbecc85

Patch release of @gabrielion/opnsense-mcp — ask your firewall questions in plain language, from
Claude Code, Codex or OpenCode. Still a preview: read-only by default, with one experimental,
confirmation-gated alias mutation.

Fixed since 0.1.0

  • Service listing against a real OPNsense no longer fails intermittently on large pages: the
    server now accepts OPNsense's clamped rowCount echo instead of rejecting the page.
  • --help and --version now answer usefully; previously any argument other than configure
    printed a bare Error. npx -y @gabrielion/opnsense-mcp --version is now the documented
    install check.
  • The README's claude mcp add one-liner was corrected (the previous flag order fails on current
    Claude Code versions).

Under the hood

  • Groundwork for durable mutation state (a hardened, concurrency-proven private state-root module)
    ships in this build but is not yet wired to any tool — writes keep their current
    process-lifetime backup and audit semantics, documented in the README.
  • CI now enforces the sealed packaged-server evidence on every push and on the release path.

Getting started

npx -y @gabrielion/opnsense-mcp configure

Then connect your assistant — see the Quickstart.
Need to create the API key first? Set up your OPNsense
walks the firewall side with screenshots.

Requires Node.js 22.19 or newer within major 22, on macOS or Linux.

Assets 2
Loading

v0.1.0

v0.1.0

Choose a tag to compare

View all tags
@gabrielion gabrielion released this 29 Jul 18:24
v0.1.0
e6be17b

First published release of @gabrielion/opnsense-mcp — ask your firewall questions in plain
language, from Claude Code, Codex or OpenCode.

This is a preview: a small MCP server that lets an assistant inspect an OPNsense system, and —
only when explicitly enabled — create or delete one kind of firewall alias behind a confirmation,
backup and audit envelope.

Getting started

npx -y @gabrielion/opnsense-mcp configure

Then connect your assistant — see the Quickstart.
Need to create the API key first? Set up your OPNsense
walks the firewall side with screenshots.

Requires Node.js 22.19 or newer within major 22, on macOS or Linux.

What it exposes

Four read-only tools — server_status, opn_describe, opn_get, opn_list — plus three prompts
that only produce a read-only preparation plan and execute nothing.

READ_ONLY=true is the default, and under it no write tool is listed or dispatchable. The two
experimental write tools additionally require a feature flag and an explicit ALLOWED_RESOURCES
scope, so nothing becomes writable by accident.

Credentials are read from a stored configuration: nothing is echoed and nothing is passed as a
process argument.

Evidence

The claims above are tested rather than asserted:

  • Live VM attestation — the read surface and the bounded alias lifecycle (list, create, read
    back, delete, prove absence) run against a disposable, SHA-256-pinned official OPNsense 26.7
    image, with no operator credential. The attestation is bound to the released commit and
    re-verified by CI:
    docs/evidence/product3-vm.json.
  • Protocol conformance scenarios for MCP 2025-11-25 and 2026-07-28. These are targeted
    interoperability scenarios, not a claim of complete protocol conformance.
  • Compatibility floor built and tested on Node.js 22.19.0.

Windows is a required product target but is not yet claimed: macOS and Linux are the verified hosts.

Supply chain

Published from this GitHub Release through npm Trusted Publishing (OIDC). No npm token exists in
this repository, and provenance is attached automatically.

Licence

AGPL-3.0-or-later.

Loading