NetDefense for OPNsense● live

Manage a fleet of OPNsense firewalls from your AI client — 129 tools across devices, config sync, tasks, schedules, templates, backups and remote consoles. Every command to a firewall is Ed25519-signed; the console tools give an agent an administrative shell, so scope its token accordingly. `netdefense-mcp` is the MCP server for [NetDefense for OPNsense](https://netdefense.io), central management for fleets of OPNsense firewalls. It exposes every domain the `ndcli` CLI does: devices, organizations, organizational units, configuration sync, tasks, run commands, schedules, snippets, software policies, templates, VPN networks, variables, backups, and persistent remote consoles. ## Setup You need a NetDefense account and a Personal Access Token. 1. Sign up at [app.netdefense.io](https://app.netdefense.io) — the free tier covers homelabs, labs and evaluation 2. Create an organization, then install the agent on your OPNsense box (the Devices page gives you a one-line installer) 3. Go to **Settings → Personal Access Tokens**, create a token, and set it as `NDCLI_TOKEN` The token is **required** — this server has no interactive login of its own. Tokens default to 90-day expiry, so pick a longer lifetime if you don't want to rotate. ## Guardrails Letting an agent near firewall infrastructure only makes sense if the blast radius is bounded, so: - **Destructive tools require explicit confirmation.** Anything that mutates or deletes fleet-wide state returns a dry-run preview unless called with `confirm=true`. - **It cannot mint non-expiring credentials.** Tokens created over MCP accept only 30–365 day lifetimes; the schema offers no `never` option. - **Secrets are absent from the toolset.** Backup encryption keys and storage credentials have no MCP tool and no MCP-exposed field — they're reachable only from the CLI. - **The sharp edge, stated plainly.** `console_exec` runs arbitrary shell commands on a device with administrative privilege and takes no confirmation flag. It is gated on the caller's role — a read-only token is refused before a stream ever opens — but a write-scoped token gives an agent a shell. Scope the token you hand an agent accordingly, and if you want a ceiling no token can cross, set the remote-access policy on the firewall itself (Services → NetDefense → Settings), which caps every session at full, read-only or disabled and cannot be raised by the control plane. Browser login and account deletion are CLI-only, but treat "CLI-only command" and "not reachable by an agent" as different things: the device-session capability *is* reachable over MCP through the `console_*` tools. Underneath, every command reaching a firewall is Ed25519-signed — binding the operation, the target device, an expiry and a strictly-increasing per-device sequence number, so replays are no-ops and late commands fail closed. The on-firewall agent opens no listening port; it dials out. ## Open source The agent and CLI are Apache-2.0 and buildable from source: [NDCLI](https://github.com/netdefense-io/NDCLI) · [NDAgent](https://github.com/netdefense-io/NDAgent). The control plane is closed-source SaaS with a free tier. Security model: https://netdefense.io/security · Docs: https://netdefense.io/docs/mcp/