pfSense MCP Server Ships 95 Read Tools and Zero Writes by Default

Temporary-Fun7726 · reddit · 2026-08-29

A developer built an MCP server for pfSense firewalls, raising a general question: if a backing API can mutate production infrastructure, should connecting it to MCP automatically expose those capabilities to an agent?

His answer: no. v1.0 exposes 95 READ tools + 2 guidance tools + 0 WRITE tools in the default profile—even when the underlying pfSense API identity has more privileges. He tested end-to-end with Codex CLI against a real pfSense lab: the agent used READ tools fine, and when explicitly asked to change settings, it refused because its MCP surface had no WRITE capability.

A separate protected WRITE architecture exists, intentionally distinct from the default MCP surface. The author asks MCP server authors: should servers expose everything the credential allows, or enforce a narrower capability boundary?

Original post →

More from coding & agent

coding & agent channel →