wg-easy-mcpBLOCK
MCP server for administering wg-easy (WireGuard Easy) instances
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/ni-c/wg-easy-mcp/actions/workflows/ci.yml) [](https://scorecard.dev/viewer/?uri=github.com/ni-c/wg-easy-mcp) [](https://socket.dev/npm/package/wg-easy-mcp) [](https://glama.ai/mcp/servers/ni-c/wg-easy-mcp)
[](https://www.npmjs.com/package/wg-easy-mcp) [](https://github.com/ni-c/wg-easy-mcp/pkgs/container/wg-easy-mcp) [](https://mcp-hub.ni-c.de)
[](https://wg-easy-mcp.ni-c.de) [](https://github.com/sponsors/ni-c)
A Model Context Protocol (MCP) server for administering wg-easy (WireGuard Easy) instances.
Lets MCP clients like Claude Code, Claude Desktop or Codex manage your WireGuard VPN: list, create, update, enable/disable and delete clients, fetch configuration files and QR codes, and inspect the server status — all through the wg-easy v15 REST API.
Eleven tools is the ceiling, not the floor: WG_EASY_ALLOW_TOOLS=essential registers a curated six instead, and a model picks the right tool far more reliably from six than from eleven — see [choosing which tools load](#choosing-which-tools-lo
58d63016f144OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add wg-easy-mcp --env WG_EASY_PASSWORD=${WG_EASY_PASSWORD} --env WG_EASY_PASSWORD=${WG_EASY_PASSWORD} -- npx -y [email protected]claude mcp add wg-easy-mcp:0.3.0 --env WG_EASY_PASSWORD=${WG_EASY_PASSWORD} --env WG_EASY_PASSWORD=${WG_EASY_PASSWORD} -- docker run -i --rm ghcr.io/ni-c/wg-easy-mcp:0.3.0:NoneExposed tools (12)
7 read · 4 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
create_client | write | |
delete_client | destructive | |
disable_client | write | |
enable_client | write | |
generate_one_time_link | read | |
get_client | read | |
get_client_config | read | |
get_client_qrcode | read | |
get_server_info | read | |
list_clients | read | |
update_client | write | |
wg-easy-mcp | read | Administer wg-easy (WireGuard Easy) v15: manage VPN clients, configs, QR codes and server status |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (2 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (16)
connect: { rejectUnauthorized: false },client called “ignore previous instructions” would read as the server speaking.
export const PASSWORD = 'integration-not-a-secret-12';
delete_client
.oxlintrc.json
.prettierignore
.nojekyll
fileURLToPath(new URL('../../package.json', import.meta.url)),'<!--@include: ../../CHANGELOG.md#changelog-->'
import { ALL_TOOLS } from '../../src/tools/catalogue.js';WG_EASY_URL=http://127.0.0.1:51821 WG_EASY_USERNAME=integration \
loadConfig(env({ WG_EASY_URL: 'http://127.0.0.1:51821' }));url = 'http://127.0.0.1:51821'
@modelcontextprotocol/server, mcp-approval, mcp-internal-hosts, mcp-tool-allowlist, undici, zod, @modelcontextprotocol/client, @types/node
Please use [GitHub private vulnerability reporting](https://github.com/ni-c/wg-easy-mcp/security/advisories/new). Do not open a public issue for an unpatched vulnerability and do not include real cred
## 1. Collect the credentials
Gates applied: instruction_override, no_behavioural_pass.
58d63016f144full audit observations/trust-audit/mcp-server/ni-c__wg-easy-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 58d63016f144 | BLOCK | D | 69 | first audit |
Questions
What is the wg-easy-mcp MCP server?
MCP server for administering wg-easy (WireGuard Easy) instances
What tools does wg-easy-mcp expose?
12 in total: 7 read-only, 4 that write, and 1 that can delete or overwrite (delete_client). Every one is listed on this page with its risk.
Is wg-easy-mcp safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does wg-easy-mcp need?
It reads NODE_TLS_REJECT_UNAUTHORIZED and WG_EASY_PASSWORD from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does wg-easy-mcp run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as wg-easy-mcp at 0.6.0.
How current is this page?
The grade is for one exact copy of the source (58d63016f144), read on 2026-10-12. The repository is watched and re-audited when it changes.