Critical-risk tools in Pfsense

Critical severity Pfsense MCP Server 178 of 680 tools

178 of the 680 tools in Pfsense are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.

Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.

Tools at critical risk

pfsense_delete_auth_key Destructive

pfsense_delete_auth_key
pfsense_delete_auth_keys Destructive

pfsense_delete_auth_keys
pfsense_delete_diagnostics_arp_table Destructive

pfsense_delete_diagnostics_arp_table
pfsense_delete_diagnostics_arp_table_entry Destructive

DELETE /api/v2/diagnostics/arp_table/entry
pfsense_delete_diagnostics_config_history_revision Destructive

DELETE /api/v2/diagnostics/config_history/revision
pfsense_delete_diagnostics_config_history_revisions Destructive

pfsense_delete_diagnostics_config_history_revisions
pfsense_delete_diagnostics_table Destructive

DELETE /api/v2/diagnostics/table
pfsense_delete_firewall_alias Destructive

DELETE /api/v2/firewall/alias
pfsense_delete_firewall_aliases Destructive

pfsense_delete_firewall_aliases
pfsense_delete_firewall_nat_one_to_one_mapping Destructive

pfsense_delete_firewall_nat_one_to_one_mapping
pfsense_delete_firewall_nat_one_to_one_mappings Destructive

pfsense_delete_firewall_nat_one_to_one_mappings
pfsense_delete_firewall_nat_outbound_mapping Destructive

pfsense_delete_firewall_nat_outbound_mapping
pfsense_delete_firewall_nat_outbound_mappings Destructive

pfsense_delete_firewall_nat_outbound_mappings
pfsense_delete_firewall_nat_port_forward Destructive

pfsense_delete_firewall_nat_port_forward
pfsense_delete_firewall_nat_port_forwards Destructive

pfsense_delete_firewall_nat_port_forwards
pfsense_delete_firewall_rule Destructive

DELETE /api/v2/firewall/rule
pfsense_delete_firewall_rules Destructive

pfsense_delete_firewall_rules
pfsense_delete_firewall_schedule Destructive

DELETE /api/v2/firewall/schedule
pfsense_delete_firewall_schedule_time_range Destructive

pfsense_delete_firewall_schedule_time_range
pfsense_delete_firewall_schedule_time_ranges Destructive

pfsense_delete_firewall_schedule_time_ranges
pfsense_delete_firewall_schedules Destructive

pfsense_delete_firewall_schedules
pfsense_delete_firewall_state Destructive

DELETE /api/v2/firewall/state
pfsense_delete_firewall_states Destructive

pfsense_delete_firewall_states
pfsense_delete_firewall_traffic_shaper Destructive

pfsense_delete_firewall_traffic_shaper
pfsense_delete_firewall_traffic_shaper_limiter Destructive

pfsense_delete_firewall_traffic_shaper_limiter
pfsense_delete_firewall_traffic_shaper_limiter_bandwidth Destructive

pfsense_delete_firewall_traffic_shaper_limiter_bandwidth
pfsense_delete_firewall_traffic_shaper_limiter_bandwidths Destructive

pfsense_delete_firewall_traffic_shaper_limiter_bandwidths
pfsense_delete_firewall_traffic_shaper_limiter_queue Destructive

pfsense_delete_firewall_traffic_shaper_limiter_queue
pfsense_delete_firewall_traffic_shaper_limiter_queues Destructive

pfsense_delete_firewall_traffic_shaper_limiter_queues
pfsense_delete_firewall_traffic_shaper_queue Destructive

pfsense_delete_firewall_traffic_shaper_queue
pfsense_delete_firewall_traffic_shaper_queues Destructive

pfsense_delete_firewall_traffic_shaper_queues
pfsense_delete_firewall_traffic_shapers Destructive

pfsense_delete_firewall_traffic_shapers
pfsense_delete_firewall_virtual_ip Destructive

pfsense_delete_firewall_virtual_ip
pfsense_delete_firewall_virtual_ips Destructive

pfsense_delete_firewall_virtual_ips
pfsense_delete_interface_bridge Destructive

DELETE /api/v2/interface/bridge
pfsense_delete_interface_gre Destructive

DELETE /api/v2/interface/gre
pfsense_delete_interface_gres Destructive

pfsense_delete_interface_gres
pfsense_delete_interface_group Destructive

DELETE /api/v2/interface/group
pfsense_delete_interface_groups Destructive

pfsense_delete_interface_groups
pfsense_delete_interface_lagg Destructive

DELETE /api/v2/interface/lagg
pfsense_delete_interface_laggs Destructive

pfsense_delete_interface_laggs
pfsense_delete_interface_vlan Destructive

DELETE /api/v2/interface/vlan
pfsense_delete_interface_vlans Destructive

pfsense_delete_interface_vlans
pfsense_delete_network_interface Destructive

DELETE /api/v2/interface
pfsense_delete_network_interfaces Destructive

pfsense_delete_network_interfaces
pfsense_delete_routing_gateway Destructive

DELETE /api/v2/routing/gateway
pfsense_delete_routing_gateway_group Destructive

DELETE /api/v2/routing/gateway/group
pfsense_delete_routing_gateway_group_priorities Destructive

pfsense_delete_routing_gateway_group_priorities
pfsense_delete_routing_gateway_group_priority Destructive

pfsense_delete_routing_gateway_group_priority
pfsense_delete_routing_gateway_groups Destructive

pfsense_delete_routing_gateway_groups
pfsense_delete_routing_gateways Destructive

pfsense_delete_routing_gateways
pfsense_delete_routing_static_route Destructive

DELETE /api/v2/routing/static_route
pfsense_delete_routing_static_routes Destructive

pfsense_delete_routing_static_routes
pfsense_delete_services_acme_account_key Destructive

DELETE /api/v2/services/acme/account_key
pfsense_delete_services_acme_account_keys Destructive

pfsense_delete_services_acme_account_keys
pfsense_delete_services_acme_certificate Destructive

DELETE /api/v2/services/acme/certificate
pfsense_delete_services_acme_certificate_action Destructive

DELETE /api/v2/services/acme/certificate/action
pfsense_delete_services_acme_certificate_domain Destructive

DELETE /api/v2/services/acme/certificate/domain
pfsense_delete_services_acme_certificates Destructive

pfsense_delete_services_acme_certificates
pfsense_delete_services_bind_access_list Destructive

DELETE /api/v2/services/bind/access_list
pfsense_delete_services_bind_access_list_entries Destructive

pfsense_delete_services_bind_access_list_entries
pfsense_delete_services_bind_access_list_entry Destructive

DELETE /api/v2/services/bind/access_list/entry
pfsense_delete_services_bind_access_lists Destructive

pfsense_delete_services_bind_access_lists
pfsense_delete_services_bind_sync_remote_host Destructive

DELETE /api/v2/services/bind/sync/remote_host
pfsense_delete_services_bind_sync_remote_hosts Destructive

pfsense_delete_services_bind_sync_remote_hosts
pfsense_delete_services_bind_view Destructive

DELETE /api/v2/services/bind/view
pfsense_delete_services_bind_views Destructive

pfsense_delete_services_bind_views
pfsense_delete_services_bind_zone Destructive

DELETE /api/v2/services/bind/zone
pfsense_delete_services_bind_zone_record Destructive

DELETE /api/v2/services/bind/zone/record
pfsense_delete_services_bind_zones Destructive

pfsense_delete_services_bind_zones
pfsense_delete_services_cron_job Destructive

DELETE /api/v2/services/cron/job
pfsense_delete_services_cron_jobs Destructive

pfsense_delete_services_cron_jobs
pfsense_delete_services_dhcp_server Destructive

pfsense_delete_services_dhcp_server
pfsense_delete_services_dhcp_server_address_pool Destructive

pfsense_delete_services_dhcp_server_address_pool
pfsense_delete_services_dhcp_server_address_pools Destructive

pfsense_delete_services_dhcp_server_address_pools
pfsense_delete_services_dhcp_server_custom_option Destructive

pfsense_delete_services_dhcp_server_custom_option
pfsense_delete_services_dhcp_server_custom_options Destructive

pfsense_delete_services_dhcp_server_custom_options
pfsense_delete_services_dhcp_server_static_mapping Destructive

pfsense_delete_services_dhcp_server_static_mapping
pfsense_delete_services_dhcp_server_static_mappings Destructive

pfsense_delete_services_dhcp_server_static_mappings
pfsense_delete_services_dns_forwarder_host_override Destructive

pfsense_delete_services_dns_forwarder_host_override
pfsense_delete_services_dns_forwarder_host_override_alias Destructive

pfsense_delete_services_dns_forwarder_host_override_alias
pfsense_delete_services_dns_forwarder_host_override_aliases Destructive

pfsense_delete_services_dns_forwarder_host_override_aliases
pfsense_delete_services_dns_forwarder_host_overrides Destructive

pfsense_delete_services_dns_forwarder_host_overrides
pfsense_delete_services_dns_resolver_access_list Destructive

pfsense_delete_services_dns_resolver_access_list
pfsense_delete_services_dns_resolver_access_list_network Destructive

pfsense_delete_services_dns_resolver_access_list_network
pfsense_delete_services_dns_resolver_access_list_networks Destructive

pfsense_delete_services_dns_resolver_access_list_networks
pfsense_delete_services_dns_resolver_access_lists Destructive

pfsense_delete_services_dns_resolver_access_lists
pfsense_delete_services_dns_resolver_domain_override Destructive

pfsense_delete_services_dns_resolver_domain_override
pfsense_delete_services_dns_resolver_domain_overrides Destructive

pfsense_delete_services_dns_resolver_domain_overrides
pfsense_delete_services_dns_resolver_host_override Destructive

pfsense_delete_services_dns_resolver_host_override
pfsense_delete_services_dns_resolver_host_override_alias Destructive

pfsense_delete_services_dns_resolver_host_override_alias
pfsense_delete_services_dns_resolver_host_override_aliases Destructive

pfsense_delete_services_dns_resolver_host_override_aliases
pfsense_delete_services_dns_resolver_host_overrides Destructive

pfsense_delete_services_dns_resolver_host_overrides
pfsense_delete_services_free_radius_client Destructive

DELETE /api/v2/services/freeradius/client
pfsense_delete_services_free_radius_clients Destructive

pfsense_delete_services_free_radius_clients
pfsense_delete_services_free_radius_interface Destructive

DELETE /api/v2/services/freeradius/interface
pfsense_delete_services_free_radius_interfaces Destructive

pfsense_delete_services_free_radius_interfaces
pfsense_delete_services_free_radius_user Destructive

DELETE /api/v2/services/freeradius/user
pfsense_delete_services_free_radius_users Destructive

pfsense_delete_services_free_radius_users
pfsense_delete_services_haproxy_backend Destructive

DELETE /api/v2/services/haproxy/backend
pfsense_delete_services_haproxy_backend_acl Destructive

pfsense_delete_services_haproxy_backend_acl
pfsense_delete_services_haproxy_backend_acls Destructive

pfsense_delete_services_haproxy_backend_acls
pfsense_delete_services_haproxy_backend_action Destructive

pfsense_delete_services_haproxy_backend_action
pfsense_delete_services_haproxy_backend_actions Destructive

pfsense_delete_services_haproxy_backend_actions
pfsense_delete_services_haproxy_backend_error_file Destructive

pfsense_delete_services_haproxy_backend_error_file
pfsense_delete_services_haproxy_backend_error_files Destructive

pfsense_delete_services_haproxy_backend_error_files
pfsense_delete_services_haproxy_backend_server Destructive

pfsense_delete_services_haproxy_backend_server
pfsense_delete_services_haproxy_backend_servers Destructive

pfsense_delete_services_haproxy_backend_servers
pfsense_delete_services_haproxy_backends Destructive

pfsense_delete_services_haproxy_backends
pfsense_delete_services_haproxy_file Destructive

DELETE /api/v2/services/haproxy/file
pfsense_delete_services_haproxy_files Destructive

pfsense_delete_services_haproxy_files
pfsense_delete_services_haproxy_frontend Destructive

DELETE /api/v2/services/haproxy/frontend
pfsense_delete_services_haproxy_frontend_acl Destructive

pfsense_delete_services_haproxy_frontend_acl
pfsense_delete_services_haproxy_frontend_acls Destructive

pfsense_delete_services_haproxy_frontend_acls
pfsense_delete_services_haproxy_frontend_action Destructive

pfsense_delete_services_haproxy_frontend_action
pfsense_delete_services_haproxy_frontend_actions Destructive

pfsense_delete_services_haproxy_frontend_actions
pfsense_delete_services_haproxy_frontend_address Destructive

pfsense_delete_services_haproxy_frontend_address
pfsense_delete_services_haproxy_frontend_addresses Destructive

pfsense_delete_services_haproxy_frontend_addresses
pfsense_delete_services_haproxy_frontend_certificate Destructive

pfsense_delete_services_haproxy_frontend_certificate
pfsense_delete_services_haproxy_frontend_certificates Destructive

pfsense_delete_services_haproxy_frontend_certificates
pfsense_delete_services_haproxy_frontend_error_file Destructive

pfsense_delete_services_haproxy_frontend_error_file
pfsense_delete_services_haproxy_frontend_error_files Destructive

pfsense_delete_services_haproxy_frontend_error_files
pfsense_delete_services_haproxy_frontends Destructive

pfsense_delete_services_haproxy_frontends
pfsense_delete_services_haproxy_settings_dns_resolver Destructive

DELETE /api/v2/services/haproxy/settings/dns_resolver
pfsense_delete_services_haproxy_settings_dns_resolvers Destructive

pfsense_delete_services_haproxy_settings_dns_resolvers
pfsense_delete_services_haproxy_settings_email_mailer Destructive

DELETE /api/v2/services/haproxy/settings/email_mailer
pfsense_delete_services_haproxy_settings_email_mailers Destructive

pfsense_delete_services_haproxy_settings_email_mailers
pfsense_delete_services_ntp_time_server Destructive

DELETE /api/v2/services/ntp/time_server
pfsense_delete_services_ntp_time_servers Destructive

pfsense_delete_services_ntp_time_servers
pfsense_delete_services_service_watchdog Destructive

DELETE /api/v2/services/service_watchdog
pfsense_delete_services_service_watchdogs Destructive

pfsense_delete_services_service_watchdogs
pfsense_delete_status_dhcp_server_leases Destructive

pfsense_delete_status_dhcp_server_leases
pfsense_delete_status_openvpn_server_connection Destructive

DELETE /api/v2/status/openvpn/server/connection
pfsense_delete_status_openvpn_server_connections Destructive

pfsense_delete_status_openvpn_server_connections
pfsense_delete_system_certificate Destructive

DELETE /api/v2/system/certificate
pfsense_delete_system_certificate_authorities Destructive

pfsense_delete_system_certificate_authorities
pfsense_delete_system_certificate_authority Destructive

DELETE /api/v2/system/certificate_authority
pfsense_delete_system_certificates Destructive

pfsense_delete_system_certificates
pfsense_delete_system_crl Destructive

DELETE /api/v2/system/crl
pfsense_delete_system_crl_revoked_certificate Destructive

DELETE /api/v2/system/crl/revoked_certificate
pfsense_delete_system_crls Destructive

pfsense_delete_system_crls
pfsense_delete_system_package Destructive

DELETE /api/v2/system/package
pfsense_delete_system_packages Destructive

pfsense_delete_system_packages
pfsense_delete_system_restapi_access_list Destructive

pfsense_delete_system_restapi_access_list
pfsense_delete_system_restapi_access_list_entry Destructive

DELETE /api/v2/system/restapi/access_list/entry
pfsense_delete_system_tunable Destructive

DELETE /api/v2/system/tunable
pfsense_delete_system_tunables Destructive

pfsense_delete_system_tunables
pfsense_delete_user Destructive

DELETE /api/v2/user
pfsense_delete_user_auth_server Destructive

DELETE /api/v2/user/auth_server
pfsense_delete_user_auth_servers Destructive

pfsense_delete_user_auth_servers
pfsense_delete_user_group Destructive

DELETE /api/v2/user/group
pfsense_delete_user_groups Destructive

pfsense_delete_user_groups
pfsense_delete_users Destructive

pfsense_delete_users
pfsense_delete_vpn_ipsec_phase1 Destructive

DELETE /api/v2/vpn/ipsec/phase1
pfsense_delete_vpn_ipsec_phase1_encryption Destructive

pfsense_delete_vpn_ipsec_phase1_encryption
pfsense_delete_vpn_ipsec_phase1_encryptions Destructive

pfsense_delete_vpn_ipsec_phase1_encryptions
pfsense_delete_vpn_ipsec_phase1s Destructive

pfsense_delete_vpn_ipsec_phase1s
pfsense_delete_vpn_ipsec_phase2 Destructive

DELETE /api/v2/vpn/ipsec/phase2
pfsense_delete_vpn_ipsec_phase2_encryption Destructive

pfsense_delete_vpn_ipsec_phase2_encryption
pfsense_delete_vpn_ipsec_phase2_encryptions Destructive

pfsense_delete_vpn_ipsec_phase2_encryptions
pfsense_delete_vpn_ipsec_phase2s Destructive

pfsense_delete_vpn_ipsec_phase2s
pfsense_delete_vpn_openvpn_client Destructive

DELETE /api/v2/vpn/openvpn/client
pfsense_delete_vpn_openvpn_client_export_config Destructive

DELETE /api/v2/vpn/openvpn/client_export/config
pfsense_delete_vpn_openvpn_client_export_configs Destructive

pfsense_delete_vpn_openvpn_client_export_configs
pfsense_delete_vpn_openvpn_clients Destructive

pfsense_delete_vpn_openvpn_clients
pfsense_delete_vpn_openvpn_cso Destructive

DELETE /api/v2/vpn/openvpn/cso
pfsense_delete_vpn_openvpn_csos Destructive

pfsense_delete_vpn_openvpn_csos
pfsense_delete_vpn_openvpn_server Destructive

DELETE /api/v2/vpn/openvpn/server
pfsense_delete_vpn_openvpn_servers Destructive

pfsense_delete_vpn_openvpn_servers
pfsense_delete_vpn_wireguard_peer Destructive

pfsense_delete_vpn_wireguard_peer
pfsense_delete_vpn_wireguard_peer_allowed_ip Destructive

pfsense_delete_vpn_wireguard_peer_allowed_ip
pfsense_delete_vpn_wireguard_peer_allowed_ips Destructive

pfsense_delete_vpn_wireguard_peer_allowed_ips
pfsense_delete_vpn_wireguard_peers Destructive

pfsense_delete_vpn_wireguard_peers
pfsense_delete_vpn_wireguard_tunnel Destructive

pfsense_delete_vpn_wireguard_tunnel
pfsense_delete_vpn_wireguard_tunnel_address Destructive

pfsense_delete_vpn_wireguard_tunnel_address
pfsense_delete_vpn_wireguard_tunnel_addresses Destructive

pfsense_delete_vpn_wireguard_tunnel_addresses
pfsense_delete_vpn_wireguard_tunnels Destructive

pfsense_delete_vpn_wireguard_tunnels
pfsense_post_diagnostics_halt_system Destructive

POST /api/v2/diagnostics/halt_system

Attacks that target this class

Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.

Destructive Action Autonomy
Privilege escalation via admin-only tools
Data exfiltration via tool chaining
Runaway Tool Loops

Critical-risk tools in Pfsense

Tools at critical risk

Attacks that target this class

More on Pfsense

Enforce policy on every Pfsense tool call.