wg-easy-mcp

wg-easy-mcpYour WireGuard VPN, spoken to

An MCP server for wg-easy v15: list, create and revoke VPN clients, pull configs and QR codes, and read server status — from Claude, Codex or any MCP client.

Get started
Tools reference
GitHub

  • Eleven tools, one API

    Full client lifecycle over the wg-easy v15 REST API — including .conf files, QR codes and one-time download links — with partial updates that merge into the current client state instead of overwriting it.

  • Runs anywhere stdio does

    A single npx command, a Claude Desktop JSON block, a Codex TOML entry or a multi-arch container image with an SBOM and build provenance.

  • A context-sized subset

    WG_EASY_READ_ONLY=true registers the read tools and nothing else. WG_EASY_ALLOW_TOOLS cuts finer — essential for a curated eight, your own comma-separated list, or a whole family with list_* — and WG_EASY_DENY_TOOLS subtracts. Whatever is filtered out does not exist on the protocol rather than failing when called, and a name that matches no tool stops the server at startup instead of quietly going missing.

  • Safe by default

    Creating, changing or deleting a client, and issuing a one-time configuration link, ask a person first through MCP elicitation — a dialog the model cannot answer on its behalf, falling back to a token bound to the exact target where the client cannot show one. Admin secrets are redacted, upstream content is marked untrusted, and relaxed TLS is scoped to one connection instead of the whole process.

wg-easy-mcp architectureAn MCP client speaks stdio to wg-easy-mcp, which calls the wg-easy REST API over HTTPS with Basic Authentication; wg-easy configures the WireGuard interface.MCP clientClaude, Codex, Inspectorwg-easy-mcp11 tools, zod-validatedwg-easy v15REST API :51821WireGuardwg0 interfacestdioHTTPSBasic Authasks a person · redaction · response budget
The server holds no state beyond short-lived approvals; wg-easy remains the source of truth.

Listing the tools, narrowing them to the essential preset, and the startup abort a mistyped tool name produces

Running it elsewhere ​

A client that cannot spawn a local process — ChatGPT connectors, Claude on the web, Cursor, LibreChat — cannot start wg-easy-mcp the way Claude Code does. mcp-hub is the bridge: one container serves many stdio MCP servers over Streamable HTTP, with an OAuth 2.1 login behind a single password and long-lived tokens for the clients that cannot do OAuth. Its /hub endpoint puts every server behind six meta-tools, so one connector reaches all of them without N×tool schemas in the model's context, and it speaks both protocol revisions — a question this server asks travels through it to the person at the far end instead of ending at the gateway.

Its configuration is Claude Code's mcpServers format, so the entry you already have is the entry it takes: Through mcp-hub.

Released under the MIT License.

Copyright © 2026 Willi Thiel