Spec Driven Development
de formulahendry
MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.
Se ejecuta en tu computadora★ 440MITActualizado hace 14 meses
Instalar
OpenWrt MCP
Resumen
Descripción del creador (original en inglés)
MCP server that runs on an OpenWrt router: deny-by-default policy, audit log, rollback-armed changes
Los tres pilares de PopNx MCP
Estos tres nunca se combinan en una sola puntuación: las opiniones, las mediciones y la popularidad son cosas distintas.
- Opinión de usuariosiAún no hay reseñasLas reseñas se abrirán junto con las cuentas en una etapa posterior
- Nuestras revisiones básicasi1 de 1 superadasRevisado con información pública; el código aún no se ha escaneado
- UsoiAún sin medir★ –
Qué puedes hacer con él
Todavía no escribimos un resumen sencillo para este. Abajo están los datos que leímos del registro.
- Conexión: –
- Transporte:
- Categoría: Otros
Instalación
Elige la app de IA que usas y copia la configuración.
Antes de instalar
- Revisiones básicas: 1 de 1 superadas
- Se ejecuta en tu computadora con los permisos de tu usuario (archivos, red, apps).
- El registro no indica ninguna clave que completar.
El creador no incluyó detalles de instalación en el registro. Consulta el README del creador más abajo.
Qué puede hacer
Se ejecuta en tu computadora; la lista de herramientas aparece en tu app de IA después de instalarlo.
Revisiones básicasi
Revisamos información que cualquiera puede ver; no hemos leído el código. Las revisiones que no aplican no se cuentan. · Revisado el 7 nov 2026
- ✓ Superada
El creador coincide con el repo
El nombre en el registro se verificó con la cuenta de GitHub stanislav-testhub, dueña del repo
- … Aún sin revisar
Sigue en mantenimiento
Todavía no hemos leído este repo en GitHub
- … Aún sin revisar
Tiene licencia
Todavía no hemos leído este repo en GitHub
- – No aplica
El endpoint responde
Este se ejecuta en tu computadora; no hay endpoint en internet
- – No aplica
Inicio de sesión con OAuth
Se ejecuta en tu computadora y usa ajustes locales en su lugar
- … Aún sin revisar
Sin instrucciones ocultas en las descripciones de herramientas
Se ejecuta en tu computadora; solo podemos leer listas de herramientas de endpoints en internet
Comparado con otros en Otrosi
- Más estrellas que el 0% de los otros 32686 servidores de esta categoría
- Publicado en el registro más recientemente que el 57% de los otros 32686 servidores de esta categoría
- Revisiones básicas iguales o mejores que el 100% de los otros 32686 servidores de esta categoría
Comparado con todos los servidores activos de esta categoría en el registro. Las estrellas solo cuentan cuando quien lo publica es dueño del repo.
Preguntas frecuentes
¿Es seguro OpenWrt MCP?
Superó 1 de 1 revisiones básicas aplicables. No hemos leído el código. Antes de agregar una clave o un token, revisa qué acceso pide el servidor y usa una clave que tenga solo los permisos que necesitas.
¿Qué claves o códigos necesita?
El registro no indica ninguna clave obligatoria, aunque algunos servidores te piden iniciar sesión la primera vez que los usas.
¿Se ejecuta en mi computadora o en la nube?
Se ejecuta en tu computadora. Tu app de IA lo inicia cuando hace falta, y los datos no pasan por los servidores del creador (a menos que el propio servidor llame a un servicio en línea).
¿Sigue en mantenimiento?
El repo de GitHub cambió por última vez –, y la última versión (1.3.0) llegó al registro hace 30 días.
¿Qué apps pueden usarlo?
Las apps compatibles con MCP, como Claude Desktop, Claude Code, Cursor y VS Code.
¿Qué puedo usar en su lugar?
En la misma categoría: Spec Driven Development, Remote Desktop Commander, Verbaly
Alternativas
Servidores de la misma categoría hechos por otros creadores, ordenados por estrellas.
Cómo leer una tarjeta:★ Estrellas de GitHubiTres pilares: reseñas · revisiones · usoiActualizado = fecha en que se publicó la última versión en el registroi
Remote Desktop Commander
de desktop-commander
Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.
Se ejecuta en la nube★ 211Actualizado anteayer
Instalar
Verbaly
de AronSoto
i18n for coding agents: extract, check and translate an app's text, with drafts a person approves
Se ejecuta en tu computadoraActualizado hoy
Instalar
README del creador
Abrir el README
Copiado tal cual del repo del creador. PopNx MCP no lo ha revisado ni lo respalda. Se quitaron HTML, imágenes y scripts. Los enlaces llevan fuera de este sitio.
openwrt-mcp -- an MCP server for OpenWrt 24.10 and 25.12
English · Русский · 简体中文
An MCP server that runs on an OpenWrt router, so Claude Code (or any MCP client) can inspect and change it -- behind deny-by-default policies, an audit log, and an automatic rollback for configuration changes.
Local and private. The server makes no outbound connections of its own and sends no telemetry; it listens on loopback and on a root-only socket, and talks to your client over an SSH session you set up. The tools that can make the router itself reach out (net_diag, pkg_query with refresh, pkg_change, sysupgrade check, the uci_apply probes, ubus_call, exec) say so in their MCP annotations (openWorldHint), and each needs a grant from you. Secret values are masked in tool output by default, and a new WireGuard key never enters the conversation unless you ask for it.
Footprint. One static binary with no dependencies: 9.1 to 11.3 MB for the router architectures (9.6 MB on arm64, about 3.7 MB compressed in the release archive), about 10 MB resident on a GL-MT6000 right after start, and 23 tools in about 22 KB of tool descriptions. Every release file is checksummed and carries a build attestation.
Based on [GlassOnTin/openwrt-mcp](https://github.com/GlassOnTin/openwrt-mcp) by Ian
Williams, which targets GL.iNet firmware 4.x (OpenWrt 21.02,
opkg). This is a port to
stock OpenWrt 25.12 (
apk, fw4/nftables, procd, netifd, LuCI JS). The security core is
upstream's; see Credits for what came from where.
Requirements
- Router: stock OpenWrt 25.12 (
apk) or 24.10 (opkg), both with fw4/nftables. Nothing to install on the router beforehand. The package tools pick the manager from the binaries on the router (apkfirst, thenopkg);system_statussays which one and which firewall it found. - What differs on 24.10:
pkg_queryhas nopolicyand noaudit(opkg has neither; the tool says so).pkg_changesimulates withopkg --noaction. New package defaults arrive as-opkginstead of.apk-new, andpkg_config_diff/pkg_config_resolvehandle both (the old copy is kept as.pre-opkg-new; for/etc/config/NAMEas the hidden.NAME.pre-opkg-new, whichreload_configskips). Adding or removing a WireGuard peer re-runsifupfor the interface (24.10's handler cannot sync peers in place), so every tunnel's sessions restart for a moment.worldlists the packages opkg marks "user installed".system_status mode=doctorreportsopkg-new-pending;mode=auditskips the package audit and says why. - fw3 (OpenWrt 21.02 and older, or firmware built on it): best effort.
firewall_showanswersruleset(iptables-save, IPv4) andrendered(fw3 -q print);check,tableandchainare refused; a firewall apply is not pre-checked. - Tested on: 25.12.5 on a GL-MT6000 (hardware); the unit tests run both managers on fakes; CI runs the package and uci tools in the
openwrt/rootfscontainer of 24.10 and 25.12 (no ubus or netifd there, so network, wireless and firewall paths are not covered). Firmware derived from OpenWrt (GL.iNet, ImmortalWrt) is best effort. - Your PC: OpenSSH (Windows 10 and later, macOS and Linux have it). Installing from a release needs nothing else. Building from source needs Go 1.26+,
sshandtar(Linux, macOS, or Git Bash on Windows). - Any CPU OpenWrt and Go share: the release has a binary for each (arm64, armv5/v7, mips/mipsle softfloat, mips64/mips64le, x86, x86-64, riscv64);
install.shreads the router'sDISTRIB_ARCHand picks it, or cross-compiles when you build from source.
Tested on a GL.iNet GL-MT6000 (mediatek/filogic, aarch64_cortex-a53) with OpenWrt 25.12.5. Nothing in the code is specific to that board.
How it differs from other OpenWrt MCP servers
From each project's own README on 2026-10-07; "not stated" means the README does not say. Corrections are welcome.
| this project | openwrt_ssh_mcp | paulomac1000/openwrt-mcp | openwrt-luci-mcp | |
|---|---|---|---|---|
| Runs on | the router | a PC, in Docker | a PC, in Docker or Python | a PC, in Node.js |
| Reaches the router by | SSH to a key-bound forced command, or loopback HTTP | SSH | SSH | LuCI's HTTP /ubus |
| Changes configuration | yes, through one tool that checks first and arms a rollback | yes, including packages and a firmware flash | read-only unless ENABLE_WRITE_OPERATIONS=1 | no |
| Automatic rollback of a bad change | yes, and it survives a reboot | not stated | not stated | not applicable |
| Access control and audit | per-client grants with scopes, expiry and a rate limit, audit log, optional TOTP | command whitelist, audit log | audit log | secrets hidden, no audit log |
| Package manager | apk (25.12) or opkg (24.10) | opkg | opkg | lists installed and available |
| Flashing firmware | never | yes | not stated | no |
| Needs on the router | the binary | SSH | SSH | uhttpd-mod-ubus, rpcd |
What changed from upstream
| upstream 0.5 (21.02 / GL.iNet) | this port (25.12) | ||
|---|---|---|---|
| Packaging | .ipk for opkg | install.sh file install + keep.d (25.12's apk has no mkpkg; see below) | |
| Web UI | GL.iNet oui-httpd page | LuCI page, *Services -> MCP Server*: status, and approve or deny requests | |
| Transport | HTTP over an ssh -L tunnel | same, plus stdio over SSH via a key-bound forced command -- no tunnel to keep alive | |
| Rollback snapshot | /tmp (lost on reboot) | on flash; an unconfirmed change is rolled back at the next start, including after a power cycle | |
uci_apply | set / create / delete | + `add_list`, `del_list`, `set_list`, `dry_run`, shows the staged uci changes, strict name validation. A dry run ends with advice, warnings from this change. | |
| Reload | ubus call uci reload_config (async) | /sbin/reload_config, plus explicit config.change events when it has no checksums (first run after boot) | |
| WireGuard | GL wireguard_server / gl_ddns | stock network. + wireguard_ peers, DDNS from ddns, CGNAT warning, PSK, list and remove | |
| Packages | -- | pkg_query, pkg_change (simulate first), .apk-new review with a settings-level diff | |
| Firewall | -- | firewall_show: nft ruleset, fw4 print, fw4 check | |
| Services | -- | service_list / service_control via rpcd rc | |
| Scope globs | [0] was a character class | brackets are literal: firewall.@rule[3].* means what it says | |
| Presets | -- | `openwrt-mcp allow @readonly | @operator ` |
Tools
| Tool | Scope | |
|---|---|---|
system_status | tool | Model, release, uptime, load, memory, storage, temperatures, conntrack, every interface (state, addresses, default route, errors), radios/SSIDs, and what is outstanding. Call first. mode=doctor returns ranked health findings (radio down, interface without an address, enabled service that died, conntrack and storage nearly full, pending .apk-new, NTP or an unset clock, a newer kernel installed than running). mode=audit returns ranked security findings (what the firewall lets in from the internet, SSH and LuCI exposure, password logins, UPnP, WPS, open or weak Wi-Fi, an empty root password, modified package files, stale WireGuard peers). Both are advisory, each finding names a next read-only call and an OpenWrt wiki page, and both list what they could not check. They are separate scopes: openwrt-mcp allow system_status doctor. |
logread | tool | Whole log buffer filtered (substring, RE2, last N minutes) *before* the line limit; offset pages back from the newest line. mode=summary collapses it to distinct messages (numbers, addresses and ids become placeholders) with count, first and last time and worst severity. baseline=save returns a token; baseline= shows only the messages that were not in the log then. Baselines hold fingerprints, not log text, and live in memory. |
network_clients | tool | DHCP leases + static hosts + neighbour table + every AP's association list, joined by MAC: name, IP, SSID, signal, rates, connected time, each client's share of its radio's airtime (from hostapd), lease; 100 rows a page, offset for the next. |
firewall_show | tool | nft list ruleset, fw4 print, fw4 check, one table or chain. |
net_diag | [. ] | ping / traceroute / nslookup (optionally from a given interface), routes, policy rules, neighbours. wifi_survey reports, per radio, how busy the channel it stays on has been (busy, rx and tx airtime, noise); other channels are unmeasured, so it never recommends one. traffic samples interface rates for a few seconds and ranks the conntrack table by source. usage reads nlbwmon's totals per device for an accounting period (a month by default). All three only read. |
uci_get | [. [. ]]; refs for a name search | uci show, optionally with stable cfgXXXXXX ids. Ends with the config's revision. history=list / diff: shows the kept versions from before each confirmed change. refs=NAME finds what defines and uses a name across configs. |
uci_apply | . [. ] per change; for restore; probe. . per probe | Stage, check, commit, reload, rollback armed. dry_run shows exactly what would change and what the service's own checker says. expected_revisions refuses if a config moved meanwhile, probe checks the router afterwards, restore= puts a past version back. After the commit the config is read back; a change the router did not keep is NOT_APPLIED and nothing is reloaded. |
uci_confirm / uci_rollback | tool | Make a pending change permanent / undo it now. |
service_list / service_control | tool, .detail / . | procd services; service_list detail=NAME returns an installed add-on's own status (tailscale, AdGuard Home, podkop; the plain list names the ones installed here); stopping or disabling dropbear, network, rpcd or openwrt-mcp is refused. service_control waits for the state to settle (wait) and says if it did not; a final state that contradicts the action is NOT_APPLIED. |
pkg_query | tool | installed, upgradable, search, info, files, owner, policy, apk audit, world; 200 lines a page, offset for the next. |
pkg_change | . / upgrade | apk add/del/upgrade; simulates unless `commit=true`; reports new .apk-new files; checks /etc/apk/world afterwards. |
pkg_config_diff | tool | Every .apk-new as a diff against the live file -- for /etc/config/* by setting (uci show), so quoting/indentation noise disappears. |
pkg_config_resolve | live path | keep_current (drop the new default) or use_new (install it; rollback-armed for UCI configs). |
| sysupgrade | | list (preserved files), test (validate an image in /tmp), check (owut), backup (mode 0600; the previous archive this tool made is re
Solo se muestra el principio; lee el resto en el repo