Spec Driven Development
by formulahendry
MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.
Runs on your computer★ 440MITUpdated 14 months ago
Install
OpenWrt MCP
Overview
Description from the maker (original English)
MCP server that runs on an OpenWrt router: deny-by-default policy, audit log, rollback-armed changes
PopNx MCP’s three pillars
These three are never merged into one score: opinions, measurements and popularity are different things.
- User voiceiNo reviews yetReviews open together with accounts in a later step
- Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
- UsageiNot measured yet★ –
What you can do with it
We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.
- Connection: –
- Transport:
- Category: Other
Install
Pick the AI app you use, then copy the settings.
Before you install
- Basic checks: 1 of 1 passed
- Runs on your computer with your user’s permissions (files, network, apps).
- The registry lists no key to fill in.
The maker has not listed install details in the registry. See the maker’s README below.
What it can do
Runs on your computer; the tool list appears in your AI app after you install it.
Basic checksi
We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 7, 2026
- ✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account stanislav-testhub, which owns the repo
- … Not checked yet
Still maintained
We have not read this repo from GitHub yet
- … Not checked yet
Has a licence
We have not read this repo from GitHub yet
- – Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
- – Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
- … Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints
Compared with others in Otheri
- More stars than 0% of the other 32715 servers in this category
- Published to the registry more recently than 57% of the other 32715 servers in this category
- Basic checks equal to or better than 100% of the other 32715 servers in this category
Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.
Common questions
Is OpenWrt MCP safe?
It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.
What keys or codes does it need?
The registry does not list a required key, though some servers ask you to sign in on first use.
Does it run on my computer or in the cloud?
It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).
Is it still maintained?
The GitHub repo last changed –, and the latest version (1.3.0) reached the registry 30 days ago.
Which apps can use it?
Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code.
What can I use instead?
In the same category: Spec Driven Development, Remote Desktop Commander, First Sale Scout
Alternatives
Servers in the same category from other makers, sorted by stars.
Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi
Remote Desktop Commander
by desktop-commander
Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.
Runs in the cloud★ 211Updated 2 days ago
Install
First Sale Scout
by firstsale.pro
Playbooks and a 14-day checklist for founders winning their first paying customers.
Runs in the cloudUpdated today
Install
README from the maker
Open the README
Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.
openwrt-mcp -- an MCP server for OpenWrt 24.10 and 25.12
English · Русский · 简体中文
An MCP server that runs on an OpenWrt router, so Claude Code (or any MCP client) can inspect and change it -- behind deny-by-default policies, an audit log, and an automatic rollback for configuration changes.
Local and private. The server makes no outbound connections of its own and sends no telemetry; it listens on loopback and on a root-only socket, and talks to your client over an SSH session you set up. The tools that can make the router itself reach out (net_diag, pkg_query with refresh, pkg_change, sysupgrade check, the uci_apply probes, ubus_call, exec) say so in their MCP annotations (openWorldHint), and each needs a grant from you. Secret values are masked in tool output by default, and a new WireGuard key never enters the conversation unless you ask for it.
Footprint. One static binary with no dependencies: 9.1 to 11.3 MB for the router architectures (9.6 MB on arm64, about 3.7 MB compressed in the release archive), about 10 MB resident on a GL-MT6000 right after start, and 23 tools in about 22 KB of tool descriptions. Every release file is checksummed and carries a build attestation.
Based on [GlassOnTin/openwrt-mcp](https://github.com/GlassOnTin/openwrt-mcp) by Ian
Williams, which targets GL.iNet firmware 4.x (OpenWrt 21.02,
opkg). This is a port to
stock OpenWrt 25.12 (
apk, fw4/nftables, procd, netifd, LuCI JS). The security core is
upstream's; see Credits for what came from where.
Requirements
- Router: stock OpenWrt 25.12 (
apk) or 24.10 (opkg), both with fw4/nftables. Nothing to install on the router beforehand. The package tools pick the manager from the binaries on the router (apkfirst, thenopkg);system_statussays which one and which firewall it found. - What differs on 24.10:
pkg_queryhas nopolicyand noaudit(opkg has neither; the tool says so).pkg_changesimulates withopkg --noaction. New package defaults arrive as-opkginstead of.apk-new, andpkg_config_diff/pkg_config_resolvehandle both (the old copy is kept as.pre-opkg-new; for/etc/config/NAMEas the hidden.NAME.pre-opkg-new, whichreload_configskips). Adding or removing a WireGuard peer re-runsifupfor the interface (24.10's handler cannot sync peers in place), so every tunnel's sessions restart for a moment.worldlists the packages opkg marks "user installed".system_status mode=doctorreportsopkg-new-pending;mode=auditskips the package audit and says why. - fw3 (OpenWrt 21.02 and older, or firmware built on it): best effort.
firewall_showanswersruleset(iptables-save, IPv4) andrendered(fw3 -q print);check,tableandchainare refused; a firewall apply is not pre-checked. - Tested on: 25.12.5 on a GL-MT6000 (hardware); the unit tests run both managers on fakes; CI runs the package and uci tools in the
openwrt/rootfscontainer of 24.10 and 25.12 (no ubus or netifd there, so network, wireless and firewall paths are not covered). Firmware derived from OpenWrt (GL.iNet, ImmortalWrt) is best effort. - Your PC: OpenSSH (Windows 10 and later, macOS and Linux have it). Installing from a release needs nothing else. Building from source needs Go 1.26+,
sshandtar(Linux, macOS, or Git Bash on Windows). - Any CPU OpenWrt and Go share: the release has a binary for each (arm64, armv5/v7, mips/mipsle softfloat, mips64/mips64le, x86, x86-64, riscv64);
install.shreads the router'sDISTRIB_ARCHand picks it, or cross-compiles when you build from source.
Tested on a GL.iNet GL-MT6000 (mediatek/filogic, aarch64_cortex-a53) with OpenWrt 25.12.5. Nothing in the code is specific to that board.
How it differs from other OpenWrt MCP servers
From each project's own README on 2026-10-07; "not stated" means the README does not say. Corrections are welcome.
| this project | openwrt_ssh_mcp | paulomac1000/openwrt-mcp | openwrt-luci-mcp | |
|---|---|---|---|---|
| Runs on | the router | a PC, in Docker | a PC, in Docker or Python | a PC, in Node.js |
| Reaches the router by | SSH to a key-bound forced command, or loopback HTTP | SSH | SSH | LuCI's HTTP /ubus |
| Changes configuration | yes, through one tool that checks first and arms a rollback | yes, including packages and a firmware flash | read-only unless ENABLE_WRITE_OPERATIONS=1 | no |
| Automatic rollback of a bad change | yes, and it survives a reboot | not stated | not stated | not applicable |
| Access control and audit | per-client grants with scopes, expiry and a rate limit, audit log, optional TOTP | command whitelist, audit log | audit log | secrets hidden, no audit log |
| Package manager | apk (25.12) or opkg (24.10) | opkg | opkg | lists installed and available |
| Flashing firmware | never | yes | not stated | no |
| Needs on the router | the binary | SSH | SSH | uhttpd-mod-ubus, rpcd |
What changed from upstream
| upstream 0.5 (21.02 / GL.iNet) | this port (25.12) | ||
|---|---|---|---|
| Packaging | .ipk for opkg | install.sh file install + keep.d (25.12's apk has no mkpkg; see below) | |
| Web UI | GL.iNet oui-httpd page | LuCI page, *Services -> MCP Server*: status, and approve or deny requests | |
| Transport | HTTP over an ssh -L tunnel | same, plus stdio over SSH via a key-bound forced command -- no tunnel to keep alive | |
| Rollback snapshot | /tmp (lost on reboot) | on flash; an unconfirmed change is rolled back at the next start, including after a power cycle | |
uci_apply | set / create / delete | + `add_list`, `del_list`, `set_list`, `dry_run`, shows the staged uci changes, strict name validation. A dry run ends with advice, warnings from this change. | |
| Reload | ubus call uci reload_config (async) | /sbin/reload_config, plus explicit config.change events when it has no checksums (first run after boot) | |
| WireGuard | GL wireguard_server / gl_ddns | stock network. + wireguard_ peers, DDNS from ddns, CGNAT warning, PSK, list and remove | |
| Packages | -- | pkg_query, pkg_change (simulate first), .apk-new review with a settings-level diff | |
| Firewall | -- | firewall_show: nft ruleset, fw4 print, fw4 check | |
| Services | -- | service_list / service_control via rpcd rc | |
| Scope globs | [0] was a character class | brackets are literal: firewall.@rule[3].* means what it says | |
| Presets | -- | `openwrt-mcp allow @readonly | @operator ` |
Tools
| Tool | Scope | |
|---|---|---|
system_status | tool | Model, release, uptime, load, memory, storage, temperatures, conntrack, every interface (state, addresses, default route, errors), radios/SSIDs, and what is outstanding. Call first. mode=doctor returns ranked health findings (radio down, interface without an address, enabled service that died, conntrack and storage nearly full, pending .apk-new, NTP or an unset clock, a newer kernel installed than running). mode=audit returns ranked security findings (what the firewall lets in from the internet, SSH and LuCI exposure, password logins, UPnP, WPS, open or weak Wi-Fi, an empty root password, modified package files, stale WireGuard peers). Both are advisory, each finding names a next read-only call and an OpenWrt wiki page, and both list what they could not check. They are separate scopes: openwrt-mcp allow system_status doctor. |
logread | tool | Whole log buffer filtered (substring, RE2, last N minutes) *before* the line limit; offset pages back from the newest line. mode=summary collapses it to distinct messages (numbers, addresses and ids become placeholders) with count, first and last time and worst severity. baseline=save returns a token; baseline= shows only the messages that were not in the log then. Baselines hold fingerprints, not log text, and live in memory. |
network_clients | tool | DHCP leases + static hosts + neighbour table + every AP's association list, joined by MAC: name, IP, SSID, signal, rates, connected time, each client's share of its radio's airtime (from hostapd), lease; 100 rows a page, offset for the next. |
firewall_show | tool | nft list ruleset, fw4 print, fw4 check, one table or chain. |
net_diag | [. ] | ping / traceroute / nslookup (optionally from a given interface), routes, policy rules, neighbours. wifi_survey reports, per radio, how busy the channel it stays on has been (busy, rx and tx airtime, noise); other channels are unmeasured, so it never recommends one. traffic samples interface rates for a few seconds and ranks the conntrack table by source. usage reads nlbwmon's totals per device for an accounting period (a month by default). All three only read. |
uci_get | [. [. ]]; refs for a name search | uci show, optionally with stable cfgXXXXXX ids. Ends with the config's revision. history=list / diff: shows the kept versions from before each confirmed change. refs=NAME finds what defines and uses a name across configs. |
uci_apply | . [. ] per change; for restore; probe. . per probe | Stage, check, commit, reload, rollback armed. dry_run shows exactly what would change and what the service's own checker says. expected_revisions refuses if a config moved meanwhile, probe checks the router afterwards, restore= puts a past version back. After the commit the config is read back; a change the router did not keep is NOT_APPLIED and nothing is reloaded. |
uci_confirm / uci_rollback | tool | Make a pending change permanent / undo it now. |
service_list / service_control | tool, .detail / . | procd services; service_list detail=NAME returns an installed add-on's own status (tailscale, AdGuard Home, podkop; the plain list names the ones installed here); stopping or disabling dropbear, network, rpcd or openwrt-mcp is refused. service_control waits for the state to settle (wait) and says if it did not; a final state that contradicts the action is NOT_APPLIED. |
pkg_query | tool | installed, upgradable, search, info, files, owner, policy, apk audit, world; 200 lines a page, offset for the next. |
pkg_change | . / upgrade | apk add/del/upgrade; simulates unless `commit=true`; reports new .apk-new files; checks /etc/apk/world afterwards. |
pkg_config_diff | tool | Every .apk-new as a diff against the live file -- for /etc/config/* by setting (uci show), so quoting/indentation noise disappears. |
pkg_config_resolve | live path | keep_current (drop the new default) or use_new (install it; rollback-armed for UCI configs). |
| sysupgrade | | list (preserved files), test (validate an image in /tmp), check (owut), backup (mode 0600; the previous archive this tool made is re
Only the beginning is shown; read the rest in the repo