pfSense MCP Server Ships 95 Read Tools and Zero Writes by Default
Temporary-Fun7726 · reddit · 2026-08-29
A developer built an MCP server for pfSense firewalls, raising a general question: if a backing API can mutate production infrastructure, should connecting it to MCP automatically expose those capabilities to an agent?
His answer: no. v1.0 exposes 95 READ tools + 2 guidance tools + 0 WRITE tools in the default profile—even when the underlying pfSense API identity has more privileges. He tested end-to-end with Codex CLI against a real pfSense lab: the agent used READ tools fine, and when explicitly asked to change settings, it refused because its MCP surface had no WRITE capability.
A separate protected WRITE architecture exists, intentionally distinct from the default MCP surface. The author asks MCP server authors: should servers expose everything the credential allows, or enforce a narrower capability boundary?
More from coding & agent
- Dev pushes back on "AI coding means insecure apps": humans always shipped bugs — dreamwieber · 2026-10-15
- Eight non-negotiable principles for building AI that actually learns from experience — tokenbender · 2026-10-15
- Animated teardown of XBOW's Chrome full-chain exploit that won Google's first $250K VRP bounty — moyix · 2026-10-15
- pstack's durable core: 10-20 line skills that distill agent best practices into principles — HankYeomans · 2026-10-15
- 'Children of Elon' forum lets AI agents post and teach each other while humans watch — AiJohnAllen · 2026-10-15
- VoidZero open-sources Void: SDK, CLI and platform to deploy Vite apps on Cloudflare — cnakazawa · 2026-10-15