NDCLIBLOCK
Command-line interface and MCP server for managing OPNsense firewall fleets with NetDefense
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Manage a fleet of OPNsense firewalls from your terminal — or let any MCP-compatible AI agent do it.
ndcli is the command-line interface and MCP server for NetDefense for OPNsense: list devices, push config, run health checks, roll out firmware, manage backups, and orchestrate an entire organizational unit or fleet from one command — scriptable end to end, no web app required.
[](LICENSE)
Give an AI agent your firewall fleet
The second binary in this repo, netdefense-mcp, exposes 159 [MCP](https://modelcontextprotocol.io) tools covering every domain ndcli does — devices, organizations, OUs, sync, tasks, run commands, schedules, snippets, software policies, templates, networks, variables, backups, support tickets, the responder console, and persistent remote consoles. Point Claude, or any other MCP-compatible client, at it and it can inspect and operate your entire fleet the same way a human operator would from the CLI — not a single device, the whole organization.
Start with the sharp edge, because it's the one that matters. ndcli.device.console_exec runs arbitrary shell commands on a device, with administrative privilege, and takes no confirmation flag. It is gated on the caller's role — a read-only token is refused before a stream ever opens — but an agent holding a write-scoped token has a shell. Scope the token you hand an agent accordingly, and if you want a hard limit that no token can cross, set the device-side remote-access policy on the firewall itself (Services → NetDefense → Settings), which caps what any session may be regardless of who asks.
The rest of the AI-facing surface has real, but narrower, guardrails:
- Destructive fleet-wide tools require an explicit confirmation. Calls to
ndcli.device.approve_all,ndcli.device.remove,ndcli.org.delete, and every other tool that mutates or deletes fleet-wide
7bf2333a575eOBSERVED · 2026-10-12Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | FAIL |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (3 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (12)
gen-smithery-payload.py
func (h *ExecHandle) Exec(ctx context.Context, command string, timeout time.Duration) (stdout, stderr string, exitCode int, truncated bool, err error) {color.New(color.FgYellow).Fprintln(w, "Warning: TLS certificate verification is disabled (controlplane.ssl_verify=false). "+
"(pathfinder.ssl_verify=false). An on-path attacker can intercept the relay connection, reading or injecting "+
t.Fatal("Exec() hung until context deadline instead of detecting the output cap overflow")if _, err := svc.TicketGet(context.Background(), "acme", "../../etc"); err == nil {got, err = resolveDownloadPath("", "../../etc/passwd")svc = service.NewFromProvider(api.NewClient("http://127.0.0.1:1", false, &noopAuthProvider{}), userStub{}, nil)config.Get().Controlplane.SSLVerify = false
config.Get().Pathfinder.SSLVerify = false
config.Get().Pathfinder.SSLVerify = false
Gates applied: no_behavioural_pass.
7bf2333a575efull audit observations/trust-audit/mcp-server/netdefense-io__ndcli.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 7bf2333a575e | BLOCK | D | 69 | first audit |
Questions
What is the NDCLI MCP server?
Command-line interface and MCP server for managing OPNsense firewall fleets with NetDefense
Is NDCLI safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 4 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does NDCLI need?
It reads NDCLI_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does NDCLI run?
It speaks stdio, so it runs as a local process your client starts.
How current is this page?
The grade is for one exact copy of the source (7bf2333a575e), read on 2026-10-12. The repository is watched and re-audited when it changes.