I gave Claude a read-only window into my firewall. Not “pasted some logs into a chat” — an actual Model Context Protocol server wrapping the OPNsense API, so Claude Code could call leasesSearchLease, dnsReverseLookup, and dozens of other firewall functions on demand. Then I pointed it at a simple question — what is actually on my network, and where does it all phone home? — and got a genuinely uncomfortable answer.

This post is two things: how to stand up an OPNsense MCP server in Docker safely, and the little network-forensics session it enabled, which is the real reason to build one.

Aiming an over-the-air TV antenna is traditionally a two-person job with a lot of yelling: one person on the roof rotating the mast, one inside shouting “better… worse… BETTER… no, worse again.” The feedback loop is slow, the signal bar in the tuner’s web UI updates lazily, and you can never quite tell whether that last nudge helped.

I wanted a tight feedback loop: a live graph, updating every few seconds, of the exact signal metrics that matter — so I could rotate the antenna and watch a line move in real time. My tuner is an HDHomeRun FLEX 4K, and it turns out you can scrape per-tuner signal quality straight into Prometheus and chart it in Grafana. This post is how I built that, the one exporter that actually does the job, and the surprise ending where the data explained a “broken” channel that wasn’t broken at all.