MikroMCP MCP server

Read from the package source without running it. The installed server may list more.

• apply_planwrite action

  Execute write operations in order, stopping on first failure. Each step is snapshotted and journaled individually. Non-admin identities need a confirmationToken (same two-step flow as other destructive tools). Undo individual steps via rollback_change with the returned journal IDs.

• create_backupwrite action

  Create a binary configuration backup on a MikroTik router. The backup is saved as <name>.backup on the router's filesystem. Supports optional encryption via password and dry-run mode.

• delete_filewrite action

  Delete a file from the router filesystem by name. Idempotent: returns not_found gracefully if the file does not exist.

• export_config

  Export the router configuration as a RouterOS script. When no file is specified, returns the script text inline. When a file is specified, saves it as <file>.rsc on the router's filesystem. Supports compact mode to show only non-default values.

• get_dns_settings

  Read DNS resolver configuration: upstream servers, cache size, cache TTL, and whether remote DNS requests are allowed.

• get_file_content

  Read a text file's contents from a MikroTik router. Only suitable for text files \u2014 binary files will return garbled content.

• get_log

  Read and filter the system log from a MikroTik router. Supports filtering by topic, message prefix, and a time window (last N minutes) measured against the router's own clock. Entries with unparseable timestamps are included conservatively.

• get_ntp_settings

  Retrieve NTP client settings from a MikroTik router.

• get_ovpn_server

  Get the OpenVPN server configuration on a MikroTik router. Throws NOT_FOUND if the OpenVPN package is not installed.

• get_snmp_settings

  Retrieve SNMP settings from a MikroTik router.

• get_system_clock

  Read the current date, time, and timezone from a MikroTik router. Focused single-purpose alternative to the clock section in get_system_status.

• get_system_status

  Retrieve system status information from a MikroTik router including resource usage, identity, license, routerboard details, health sensors, and clock.

• get_upgrade_status

  Read the current RouterOS package upgrade status and routerboard firmware versions. Shows installed version, latest available version, update channel, and firmware upgrade availability.

• list_address_list_entries

  List firewall address list entries on a MikroTik router. Supports filtering by list name and address.

• list_arp_entries

  List ARP table entries on a MikroTik router.

• list_bgp_peers

  List BGP sessions on a MikroTik router (RouterOS 7+). Returns state, remote AS, prefix counts, and uptime.

• list_bridges

  List bridge interfaces and their port members on a MikroTik router.

• list_certificates

  List certificates on a MikroTik router.

• list_containers

  List RouterOS container instances with status, image, and network information.

• list_dhcp_clients

  List DHCP client configurations on a MikroTik router. Shows which interfaces obtain their IP via DHCP, current status, and assigned address.

• list_dhcp_leases

  List DHCP leases on a MikroTik router with optional filtering by server, status, lease type (dynamic/static), and MAC address. Supports pagination.

• list_dhcp_servers

  List DHCP servers on a MikroTik router.

• list_dns_entries

  List static DNS entries on a MikroTik router with optional filtering by name and type.

• list_files

  List files on a MikroTik router filesystem. Supports filtering by name and type.

• list_firewall_rules

  List firewall rules from the filter or nat table on a MikroTik router. Supports filtering by chain and disabled state, with pagination.

• list_interfaces

  List network interfaces on a MikroTik router with optional filtering by type and status. Supports pagination and optional traffic counters.

• list_ip_pools

  List IP address pools on a MikroTik router. Supports filtering by name and pagination.

• list_ip_services

  List IP services on a MikroTik router (api, api-ssl, ssh, telnet, www, www-ssl, winbox, ftp) with their port numbers and enabled/disabled status.

• list_ipsec_peers

  List IPSec peers on a MikroTik router.

• list_ipsec_policies

  List IPSec policies on a MikroTik router.

• list_log_rules

  List RouterOS logging rules (system/logging) with optional topic substring and action exact-match filtering.

• list_mangle_rules

  List firewall mangle rules on a MikroTik router in evaluation order. Supports filtering by chain, action, and disabled state.

• list_neighbors

  List discovered neighbors (CDP/LLDP/MNDP) on a MikroTik router.

• list_netwatch_entries

  List Netwatch monitoring entries on a MikroTik router.

• list_ospf_neighbors

  List OSPF neighbors on a MikroTik router (RouterOS 7+). Returns neighbor state, interface, DR/BDR, and uptime.

• list_ovpn_clients

  List OpenVPN client interfaces on a MikroTik router. Shows name, remote server, and connection status.

• list_packages

  List installed RouterOS packages with version and enabled status.

• list_ppp_profiles

  List PPP profiles including the built-in default and default-encryption profiles.

• list_pppoe_clients

  List PPPoE client interfaces on a MikroTik router. Shows name, parent interface, ISP username, and connection status.

• list_queues

  List simple queues on a MikroTik router.

• list_routes

  List static routes on a MikroTik router with optional filtering by active status and dynamic status. Supports pagination.

• list_routing_rules

  List policy routing rules on a MikroTik router in evaluation order. Supports filtering by table and disabled state.

• list_routing_tables

  List custom routing tables on a MikroTik router.

• list_scheduled_jobs

  List RouterOS scheduler entries on a MikroTik router with next-run time, interval, and disabled state.

• list_scripts

  List RouterOS scripts on a MikroTik router. Supports optional name filter.

• list_user_groups

  List local user groups on a MikroTik router.

• list_users

  List local users on a MikroTik router. Passwords are never returned.

• list_vrrp_instances

  List VRRP instances on a MikroTik router.

• list_wifi_clients

  List currently connected WiFi clients (stations) with signal strength and transfer rates.

• list_wifi_interfaces

  List WiFi/wireless interfaces on a MikroTik router. Uses /interface/wifi on ROS 7.x, /interface/wireless on older versions.

• list_wireguard_interfaces

  List WireGuard interfaces and their status on a MikroTik router.

• list_wireguard_peers

  List WireGuard peers with last handshake time and transfer statistics.

• manage_address_list_entry

  Add or remove a firewall address list entry. Idempotent by list name + address. Supports dry-run mode.

• manage_bridgewrite action

  Create or remove a bridge interface on a MikroTik router. Idempotent: create returns already_exists if bridge with same name exists.

• manage_bridge_port

  Add or remove an interface from a bridge on a MikroTik router. Idempotent: add returns already_exists if the port assignment already exists.

• manage_certificatewrite action

  Remove, trust, or untrust a certificate. Idempotent: trust/untrust return early if already in the target state.

• manage_containerwrite action

  Create, start, stop, or remove a RouterOS container. create needs a pre-configured veth interface; start/stop are no-ops when already in the target state; remove throws NOT_FOUND when absent. Supports dry-run.

• manage_dhcp_client

  Add, remove, enable, or disable a DHCP client on an interface. Idempotent by interface name: add returns already_exists if a DHCP client is already configured on the same interface.

• manage_dhcp_lease

  Convert a dynamic DHCP lease to static (make-static) or remove a lease. Idempotent by MAC address.

• manage_dhcp_server

  Add, remove, enable, or disable a DHCP server. Idempotent by name: add returns already_exists if a server with the same name, interface, and address pool already exists.

• manage_dns_entry

  Add or remove a static DNS entry. Idempotent by name+type: add returns already_exists if the same record already exists.

• manage_dns_settingswrite action

  Update DNS resolver settings (upstream servers, cache size, cache TTL, allow-remote-requests). Idempotent: returns no_change if nothing differs.

• manage_firewall_rule

  Add, remove, disable, or enable a firewall rule on a MikroTik router. Uses comment as idempotency key for deduplication and identification. Supports dry-run mode.

• manage_ip_address

  Add, update, or remove an IP address on a MikroTik router interface. Performs idempotency checks for add operations and supports dry-run mode for all actions.

• manage_ip_pool

  Add or remove an IP address pool. Idempotent by name: add returns already_exists if a pool with the same name and ranges already exists.

• manage_ip_service

  Enable or disable a RouterOS IP service (api, api-ssl, ssh, telnet, www, www-ssl, winbox, ftp). Port number changes are intentionally not supported to prevent accidental lockout.

• manage_ipsec_peer

  Add, remove, enable, or disable an IPSec peer. Idempotent by name: add returns already_exists if a peer with the same name and address already exists.

• manage_ipsec_policy

  Add, remove, enable, or disable an IPSec policy. Idempotent by composite key (srcAddress + dstAddress + tunnel).

• manage_mangle_rule

  Add, remove, enable, or disable a firewall mangle rule. Uses comment as idempotency key. Supports dry-run mode.

• manage_netwatch_entry

  Add, remove, enable, or disable a Netwatch monitoring entry. Idempotent by host+port: add returns already_exists if an entry with the same host and port already exists.

• manage_ntp_clientwrite action

  Update NTP client settings on a MikroTik router. Idempotent: returns already_set if no changes are needed.

• manage_ovpn_client

  Add, update, or remove an OpenVPN client interface. Idempotent by name (already_exists on matching name+connectTo; CONFLICT on differing connectTo; no_change when an update differs in nothing). Password is always written when provided since RouterOS does not return it on GET.

• manage_ovpn_server

  Enable, disable, or configure the OpenVPN server (a per-router singleton). Throws NOT_FOUND if the OpenVPN package is not installed. The set action requires at least one configuration field.

• manage_package

  Enable or disable a RouterOS package. Changes take effect only after a router reboot \u2014 use the reboot tool to apply. Idempotent: no-op if already in the target state.

• manage_ppp_profile

  Add, update, or remove a PPP profile. Idempotent by name. update returns no_change when requested values match. Built-in profiles (default, default-encryption) cannot be removed \u2014 RouterOS blocks this and the error is surfaced.

• manage_pppoe_client

  Add, update, or remove a PPPoE client interface. Idempotent by name (already_exists on matching name+interface+user; CONFLICT on differing config; no_change when an update differs in nothing). Password is always written when provided since RouterOS does not return it on GET.

• manage_queue

  Add, remove, enable, or disable a simple queue. Idempotent by name: add returns already_exists if a queue with the same name and target already exists.

• manage_route

  Add or remove a static route on a MikroTik router. Performs idempotency checks for add operations and supports dry-run mode for all actions.

• manage_routing_rule

  Add, remove, enable, or disable a policy routing rule. Idempotent by srcAddress+dstAddress+interface+table composite key. Supports dry-run mode.

• manage_routing_tablewrite action

  Create or remove a custom routing table. Idempotent by table name. Supports dry-run mode.

• manage_scheduled_job

  Add, update, remove, enable, or disable a RouterOS scheduler entry. Idempotent by name. add throws CONFLICT if name exists; update throws NOT_FOUND if it does not. Supports dry-run.

• manage_script

  Add, update, or remove a RouterOS script. Idempotent by name. add throws CONFLICT if the name already exists; update throws NOT_FOUND if it does not. Supports dry-run.

• manage_upgrade

  Trigger a RouterOS package update check or install. 'check' queries the update server for new packages. 'install' downloads and applies the update \u2014 the router will reboot automatically. Supports dry-run.

• manage_user

  Add, remove, enable, disable, or set the password for a local RouterOS user. Idempotent by name: add returns already_exists if a user with the same name and group already exists.

• manage_user_group

  Add, update, or remove a local RouterOS user group. Idempotent by name: add returns already_exists if a group with the same name and policy already exists.

• manage_vlan

  Add, remove, enable, or disable a VLAN interface. Idempotent by name: add returns already_exists when a VLAN with matching name, vlan-id, and parent interface exists. Supports dry-run mode.

• manage_vrrp_instance

  Add, remove, enable, or disable a VRRP instance. Idempotent by name: add returns already_exists if an instance with the same name, interface, and VRID already exists.

• manage_wifi_interface

  Enable, disable, or update SSID settings on a WiFi interface. At least one of disabled or ssid must be provided.

• manage_wireguard_interface

  Add, remove, enable, or disable a WireGuard interface. Idempotent by name. RouterOS generates the private key on create \u2014 it is never passed in. The public key is returned after creation.

• manage_wireguard_peer

  Add or remove a WireGuard peer. Idempotent by public key: add returns already_exists if a peer with the same public key already exists on the interface.

• pingwrite action

  Send ICMP echo requests from the router to a target address. Returns per-packet RTT and summary statistics. 100% packet loss is a valid result, not an error.

• plan_changes

  Preview a sequence of write operations: each step runs with dryRun=true against live state, returning affected paths and the predicted action per step. Use apply_plan to execute the same steps for real.

• reboot

  Trigger a controlled router reboot with an optional delay. Supports dry-run. Use this tool instead of run_command for reboots \u2014 run_command's deny list blocks /system reboot*.

• rollback_change

  Restore device state to before a write, identified by its journal ID. RouterOS: reads the before-snapshot, diffs against live state, and applies the reverse. SwOS: re-POSTs the exact pre-write '.b' blob. Use dryRun=true to preview. Requires MIKROMCP_DATA_DIR (defaults to data/).

• run_commandwrite action

  Execute an arbitrary RouterOS console command via SSH. Guarded by an allow/deny policy (built-in deny list blocks destructive commands; tighten via cmdAllow in routers.yaml or MIKROMCP_CMD_ALLOW). Prefer dedicated tools (reboot, etc.) where available. Output capped at 4000 characters.

• run_scriptwrite action

  Execute a named RouterOS script. Fire-and-forget \u2014 the script runs asynchronously and its output is written to the router system log. Use get_log after calling this tool to see results.

• set_system_clock

  Set the system date, time, and/or timezone on a MikroTik router. Idempotent: returns already_set if the values already match. Supports dry-run.

• torch

  Capture a real-time traffic snapshot on a router interface. The tool call blocks for the duration (seconds) and returns top flows by bytes. readOnlyHint true \u2014 auto-retry enabled.

• traceroute

  Trace the network path from the router to a target address. Returns an ordered hop list with RTT per hop. Timeouts and partial results are valid responses.

• upload_filewrite action

  Upload a text file to a router, overwriting any existing file of the same name. Prefers SFTP (encrypted, over SSH) and falls back to plaintext FTP if SFTP is unavailable. Requires SSH (or FTP) access for the router user. Dry-run tests connectivity only.

• Code scan4 source files scanned25/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitylocal package, no credentials required12/15
• Maintenancelast push 14 days ago15/15
• Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

MikroMCP: common questions

Is MikroMCP MCP server safe?

Yes, by our scan: it is graded A (92/100). Read the MikroMCP safety report

How do I install MikroMCP?

It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.

Does MikroMCP need an API key?

No secret keys are declared. It reads 3 settings from the environment.

Is MikroMCP maintained?

The last commit was 15 days ago (2026-09-06). The latest release is v1.11.0.