A bad rule applied instantly can lock you out of the box you are talking to, so the two-step shape matters more here than in most integrations: writes land in the config marked applied: false, and nothing reaches the packet filter until you apply the subsystem or explicitly pass apply=true. Destructive calls go further and refuse the first attempt outright. One thing to know before you use apply_changes: it activates everything staged in that subsystem, including whatever a human left pending in the pfSense web interface and has not reviewed.
A client for a pfSense box's REST API: 19 tools across system status, firewall rules and aliases, DHCP leases and reservations, DNS resolver overrides, gateway and ARP monitoring, and service control.
- System and interface state — version, CPU, memory, uptime, temperature, and every interface with its status and configuration (get_system_status, get_interfaces).
- Firewall rules listed and filtered by interface, added as pass, block or reject, deleted by the ID the listing gave you, and the IP, port and URL alias groups read alongside them (list_firewall_rules, add_firewall_rule, delete_firewall_rule, list_firewall_aliases).
- DHCP both ways: the leases handed out right now with IP, MAC, hostname and lease times, and the static reservations created, listed and removed (list_dhcp_leases, list_dhcp_static_mappings, add_dhcp_static_mapping, delete_dhcp_static_mapping).
- Local names in the Unbound resolver listed, added and deleted (list_dns_host_overrides, add_dns_host_override, delete_dns_host_override).
- A staging model rather than instant writes: check what a subsystem has waiting, then activate it deliberately — or pass apply=true on a single write when you want it live at once (get_pending_changes, apply_changes).
- Monitoring and service control: gateway latency, packet loss and online state; the ARP table of connected devices; every service and whether it is running; and a restart for one that is wedged (get_gateway_status, get_arp_table, list_services, restart_service).
A pfSense instance running 2.7.x or 2.8.x with the pfrest REST API package installed, and a user account with API access. Python 3.11 or newer — `uvx mcp-pfsense` is the shortest route. PFSENSE_HOST and PFSENSE_PASSWORD are required; username defaults to admin, port to 443, scheme to https, and SSL verification is off by default. One tool needs a newer API than the rest: listing DHCP static mappings requires pfrest v2.7.0 or later.
One command plus a key — uvx mcp-pfsense, then supply credentials