MikroTik RouterOS MCP server

mikrotik-mcp

<!-- The MCP registry verifies package ownership by looking for this token in the PyPI description, which is this README. It must sit on its own line. --> mcp-name: io.github.StefanKnol/mikrotik-mcp

An MCP server for MikroTik RouterOS, over the binary API rather than by driving the CLI over SSH.

That distinction is the whole point. The CLI prints positional numbers, which are not a rule's identity. A server that lists rules by position and then writes by position either fails outright — where .id=3 matches nothing, so every write reports "not found" for rules that plainly exist — or, worse, succeeds against a different rule once the order has shifted. On a firewall that means deleting the wrong rule.

The binary API returns the real .id (7, 1f) on every read. So:

writes, with an error that explains why;

• every read returns id, and every write takes one back;
• list results also carry position, which is display-only and refused for

rule it deleted.

• writes read back what they wrote, so a change can be verified rather than assumed;
• removefirewallrule takes an optional confirm_comment and returns the

Use it

uvx mikrotik-mcp

Configure through the environment — ps would show a password passed as a flag:

In an MCP client's config:

{
  "mcpServers": {
    "mikrotik": {
      "command": "uvx",
      "args": ["mikrotik-mcp"],
      "env": {
        "MIKROTIK_HOST": "192.168.88.1",
        "MIKROTIK_USERNAME": "mcp-agent",
        "MIKROTIK_PASSWORD": "..."
      }
    }
  }
}

On the router

/ip service enable api-ssl
/user group add name=mcp policy=api,read,write,test
/user add name=mcp-agent group=mcp password=<strong-password>

The api policy is not optional, and its absence produces a login error identical to a wrong password — so if credentials look right and login still fails, check the group first.

Set MIKROTIKTLSFINGERPRINT if you can. MikroTik's API-SSL certificate is self-signed, so ordinary CA validation cannot succeed against a stock device; pinning is what makes the connection authenticated rather than merely encrypted.

Tools

34 of them, covering system info, interfaces, IP addressing, firewall filter (IPv4 and IPv6), firewall address lists, NAT, DHCP leases, DNS, routes and logs — plus ros_list, which reads any RouterOS path and so covers everything without a dedicated tool.

There is deliberately no generic write escape hatch.

Three things worth knowing before the first call:

result. position is where a rule currently sits in evaluation order; it shifts whenever anything is added, removed or moved, and it is counted across the whole table rather than within the chain you filtered to. Passing one to a write is rejected rather than guessed at.

• Writes take an id (7), never a position.** Both appear in every list

and default to ipv4, so a device can read as locked down while its IPv6 table is empty and therefore accepting everything. Listing IPv4 reports the IPv6 rule count for exactly this reason.

• IPv4 and IPv6 are separate rule sets. The firewall tools take a family

adds at runtime carry a timeout and exist only in memory. Ask listaddresslistentries for a countonly first: a populated block list can hold tens of thousands.

• Address lists hold state no configuration export shows. Entries a rule

With mcphub

Shortened. The full README is on GitHub.