All documented modules
Firewall, interfaces, routing, IPsec, OpenVPN, WireGuard, Unbound, DHCP, ACME, CrowdSec and more, generated automatically from the API.
AI that understands your rule set
Firewall configurations grow organically: a rule for the new VPN access, a permit for the cloud application. After a few years nobody knows exactly which rules are still needed. Our OPNsense MCP server lets an AI read the rule set, assess it and suggest improvements.
OPNsense MCP
Which rules at the North site have not been used in the last 90 days?
Read rules, query hit counters
7 of 64 rules have no hits, including 2 permits for a VPN that has been shut down. Shall I disable them? I will create a restore point first.
Yes, disable them.
Create restore point, disable rules (risk level medium, confirmed)
Done. Restore point created, 7 rules disabled, can be undone at any time.
What the MCP server can do
Structured access instead of a text file
The Model Context Protocol is an open standard that lets AI assistants work securely with other systems. Our server speaks the documented OPNsense REST API.
Configuration analysis
Rule sets are read as a security architecture: unused, duplicate or overly broad rules, missing segmentation, old certificates.
Restore points
Before rule changes the server creates a restore point. If something goes wrong, the previous state is back immediately.
Multiple firewalls
Sites can be compared centrally: where does a rule set deviate from the standard?
Security
Every tool has a risk level
The AI can only do what the level allows. Destructive calls require explicit confirmation, and critical ones are also rate-limited.
- readReadquery rules, interfaces, logs and status
- lowLowmaintain aliases, reload services
- mediumMediumcreate or change rules, with a restore point
- highHighdelete, change VPN tunnels, only with confirmation
- criticalCriticalreboot, shut down, with confirmation and rate limiting
Data sovereignty
AI in the cloud or entirely on your premises
Operating modes
- locally in the editor, without network access from outside
- as a team service behind a reverse proxy with CrowdSec and encrypted secrets
- with a local language model via Ollama, even without internet access
When the AI runs locally
- no configurations or logs sent to third parties
- you choose the model
- suitable for KRITIS, healthcare and public authorities
- also works in air-gapped networks
The AI does not replace an administrator. But it sees things that get lost in day-to-day work, and it sees them in every analysis, not only during the annual audit. Decisions are made by a person.
FAQ
Frequently asked questions
Which AI assistants work with it?
All assistants and tools that support the Model Context Protocol, as well as local models via Ollama. We advise you on the choice.
Can the AI take the firewall down?
Only with the permissions you grant. Critical actions such as a reboot require explicit confirmation and are rate-limited. The read level is sufficient for analyses.
Is this included in operations?
The managed firewall includes a regular AI configuration analysis with a report. In the maintenance contract it is optional.
Contact
AI analysis for your firewall
We show you what the analysis finds, using your own rule set.