MikroMCP

Retrieve system status information from a MikroTik router including resource usage, identity, license, routerboard details, health sensors, and clock.

List network interfaces on a MikroTik router with optional filtering by type and status. Supports pagination and optional traffic counters.

List IPv4 addresses assigned to interfaces on a MikroTik router, including dynamic ones (DHCP client, PPP). Supports filtering by interface and disabled state, with pagination.

Add, update, or remove an IP address on a MikroTik router interface. Performs idempotency checks for add operations and supports dry-run mode for all actions.

List DHCP leases on a MikroTik router with optional filtering by server, status, lease type (dynamic/static), and MAC address. Supports pagination.

Convert a dynamic DHCP lease to static (make-static) or remove a lease. Idempotent by MAC address.

List static routes on a MikroTik router with optional filtering by active status and dynamic status. Supports pagination.

Add or remove a static route on a MikroTik router. Performs idempotency checks for add operations and supports dry-run mode for all actions.

List firewall rules from the filter or nat table on a MikroTik router. Supports filtering by chain and disabled state, with pagination.

Add, remove, disable, or enable a firewall rule on a MikroTik router. Matches addresses, ports, protocol, interfaces, interface lists, and connection/NAT state; nat rules take toAddresses/toPorts (e.g. a dst-nat port forward). Uses comment as idempotency key for deduplication and identification: a repeated add returns already_exists only when the match, NAT targets, and disabled state agree, otherwise CONFLICT (use enable/disable when only the disabled state differs). Supports dry-run mode.

Send ICMP echo requests from the router to a target address. Returns per-packet RTT and summary statistics. 100% packet loss is a valid result, not an error.

Trace the network path from the router to a target address. Returns an ordered hop list with RTT per hop. Timeouts and partial results are valid responses. Not auto-retried.

Capture a real-time traffic snapshot on a router interface. RouterOS runs the capture for `duration` seconds; the tool returns the flows of the final update with their TX/RX rates in bits per second and packets per second. Not auto-retried.

Read and filter the system log from a MikroTik router. Supports filtering by topic, message prefix, and a time window (last N minutes) measured against the router's own clock. Entries with unparseable timestamps are included conservatively.

Read the current date, time, and timezone from a MikroTik router. Focused single-purpose alternative to the clock section in get_system_status.

Set the system date, time, and/or timezone on a MikroTik router. Idempotent: returns already_set if the values already match. Supports dry-run.

Trigger a controlled router reboot with an optional delay. delay=0 reboots immediately; delay>0 adds a one-shot "mikromcp-reboot" scheduler entry on the router (calling again replaces it; remove it to cancel). Supports dry-run. Use this tool instead of run_command for reboots — run_command's deny list blocks /system reboot*.

Execute an arbitrary RouterOS console command via SSH. Guarded by an allow/deny policy (built-in deny list blocks destructive commands; tighten via cmdAllow in routers.yaml or MIKROMCP_CMD_ALLOW). Prefer dedicated tools (reboot, etc.) where available. Output capped at 4000 characters. Journaled for audit like every write (see list_journal), but never snapshotted: arbitrary commands touch unknown config sections, so it cannot be rolled back via rollback_change — prefer a dedicated tool when one exists, and note the manual undo command in your own records.

List bridge interfaces and their port members on a MikroTik router.

Create or remove a bridge interface on a MikroTik router. Idempotent: create returns already_exists if bridge with same name exists.

Add or remove an interface from a bridge on a MikroTik router. Idempotent: add returns already_exists if the port assignment already exists.

List bridge port entries (interface membership, PVID, STP role and status) on a MikroTik router. Supports filtering by bridge and interface, with pagination.

List WiFi/wireless interfaces on a MikroTik router. Uses /interface/wifi on ROS 7.x, /interface/wireless on older versions.

List currently connected WiFi clients (stations) with signal strength and transfer rates.

Enable, disable, or update SSID settings on a WiFi interface. At least one of disabled or ssid must be provided.

List WireGuard interfaces and their status on a MikroTik router.

List WireGuard peers with last handshake time and transfer statistics.

Add or remove a WireGuard peer. Add returns already_exists when the public key and explicitly requested endpoint/allowed addresses match; different settings produce CONFLICT without changing the peer. Omitted settings are left unchanged.

Add, remove, enable, or disable a WireGuard interface. Idempotent by name. RouterOS generates the private key on create — it is never passed in. The public key is returned after creation.

List static DNS entries on a MikroTik router with optional filtering by name and type.

Add or remove a static DNS entry, found by name (case-insensitive) and type. add returns already_exists if such a record already has the requested value and disabled state (and ttl/comment, when given), and throws CONFLICT if it differs; add never creates a second record with the same name and type. remove deletes the one matching record; when several share the name (round-robin), pass address/cname/text to pick one.

Read DNS resolver configuration: upstream servers, cache size, cache TTL, and whether remote DNS requests are allowed.

Update DNS resolver settings (upstream servers, cache size, cache TTL, allow-remote-requests). Idempotent: returns no_change if nothing differs.

List firewall mangle rules on a MikroTik router in evaluation order. Supports filtering by chain, action, and disabled state.

Add, remove, enable, or disable a firewall mangle rule. ruleAction sets the action; when it is omitted, a new* value implies its own (newRoutingMark → mark-routing), otherwise accept. Each new* value is accepted only under its action. Uses comment as idempotency key: a repeated add returns already_exists only when the chain, match fields, marks, DSCP, MSS, passthrough, and the given or implied action agree, otherwise CONFLICT. Supports dry-run mode.

List firewall address list entries on a MikroTik router. Supports filtering by list name and address.

Add or remove a firewall address list entry. Idempotent by list name + address. Supports dry-run mode.

List policy routing rules on a MikroTik router in evaluation order. Supports filtering by table and disabled state.

Add, remove, enable, or disable a policy routing rule. Idempotent by srcAddress+dstAddress+interface+table composite key; a repeated add with an explicit, different ruleAction is a CONFLICT. Supports dry-run mode.

List custom routing tables on a MikroTik router.

Create or remove a custom routing table. Idempotent by table name. Supports dry-run mode.

List BGP sessions on a MikroTik router (RouterOS 7+). Returns state, remote AS, prefix counts, and uptime.

List OSPF neighbors on a MikroTik router (RouterOS 7+). Returns neighbor state, interface, DR/BDR, and uptime.

List RouterOS scripts on a MikroTik router. Supports optional name filter.

Add, update, or remove a RouterOS script. Idempotent by name. add throws CONFLICT if the name already exists; update throws NOT_FOUND if it does not. Supports dry-run.

Execute a named RouterOS script. Fire-and-forget — the script runs asynchronously and its output is written to the router system log. Use get_log after calling this tool to see results.

List RouterOS scheduler entries on a MikroTik router with next-run time, interval, and disabled state.

Add, update, remove, enable, or disable a RouterOS scheduler entry. onEvent is arbitrary RouterOS script run with the router user's policies, so this tool is destructive. Idempotent by name. add throws CONFLICT if name exists; update throws NOT_FOUND if it does not. Supports dry-run.

List installed RouterOS packages with version and enabled status.

Enable or disable a RouterOS package. Changes take effect only after a router reboot — use the reboot tool to apply. Idempotent: no-op if already in the target state.

List files on a MikroTik router filesystem. Supports filtering by name and type.

Read a text file's contents from a MikroTik router. Only suitable for text files — binary files will return garbled content.

Upload a text file to a router, overwriting any existing file of the same name. Prefers SFTP (encrypted, over SSH) and falls back to plaintext FTP if SFTP is unavailable. Requires SSH (or FTP) access for the router user. RouterOS runs a file named *.auto.rsc as a script when it arrives over FTP. Dry-run tests connectivity only.

Delete a file from the router filesystem by name. Idempotent: returns not_found gracefully if the file does not exist.

List RouterOS container instances with status, image, and network information.

Create, start, stop, or remove a RouterOS container. create needs a pre-configured veth interface; start/stop are no-ops when already in the target state; remove throws NOT_FOUND when absent. Supports dry-run.

List IPSec peers on a MikroTik router.

List IPSec policies on a MikroTik router.

Add, remove, enable, or disable an IPSec peer. Idempotent by name: add returns already_exists if a peer with the same name and address already exists.

Add, remove, enable, or disable an IPSec policy. Idempotent by composite key (srcAddress + dstAddress + tunnel).

List certificates on a MikroTik router.

Remove, trust, or untrust a certificate. Idempotent: trust/untrust return early if already in the target state.

List local users on a MikroTik router. Passwords are never returned.

Add, remove, enable, disable, or set the password for a local RouterOS user. Idempotent by name: add returns already_exists if a user with the same name and group already exists.

List local user groups on a MikroTik router.

Add, update, or remove a local RouterOS user group. Idempotent by name: add returns already_exists if a group with the same name and policy already exists.

List DHCP servers on a MikroTik router.

Add, remove, enable, or disable a DHCP server. Idempotent by name: add returns already_exists if a server with the same name, interface, and address pool already exists.

List IP address pools on a MikroTik router. Supports filtering by name and pagination.

Add or remove an IP address pool. Idempotent by name: add returns already_exists if a pool with the same name and ranges already exists.

List simple queues on a MikroTik router.

Add, remove, enable, or disable a simple queue. Idempotent by name: add returns already_exists if a queue with the same name and target already exists.

List VRRP instances on a MikroTik router.

Add, remove, enable, or disable a VRRP instance. Idempotent by name: add returns already_exists if an instance with the same name, interface, and VRID already exists.

Retrieve SNMP settings from a MikroTik router.

Retrieve NTP client settings from a MikroTik router.

List Netwatch monitoring entries on a MikroTik router.

Add, remove, enable, or disable a Netwatch monitoring entry. Idempotent by host+port: add returns already_exists if an entry with the same host and port already exists.

List discovered neighbors (CDP/LLDP/MNDP) on a MikroTik router.

List ARP table entries on a MikroTik router.

Update NTP client settings on a MikroTik router. Idempotent: returns already_set if no changes are needed.

Add, remove, enable, or disable a VLAN interface. Idempotent by name: add returns already_exists when a VLAN with matching name, vlan-id, and parent interface exists. Supports dry-run mode.

List DHCP client configurations on a MikroTik router. Shows which interfaces obtain their IP via DHCP, current status, and assigned address.

Add, remove, enable, or disable a DHCP client on an interface. Idempotent by interface name: add returns already_exists if a DHCP client is already configured on the same interface.

List IP services on a MikroTik router (api, api-ssl, ssh, telnet, www, www-ssl, winbox, ftp) with their port numbers and enabled/disabled status.

Enable or disable a RouterOS IP service (api, api-ssl, ssh, telnet, www, www-ssl, winbox, ftp). Port number changes are intentionally not supported to prevent accidental lockout. MikroMCP reaches RouterOS through the REST API on www-ssl (or www for plaintext): disabling the service its connection uses cuts MikroMCP off from the router, including any later call to re-enable it.

List PPPoE client interfaces on a MikroTik router. Shows name, parent interface, ISP username, and connection status.

Add, update, or remove a PPPoE client interface. Idempotent by name (already_exists on matching name+interface+user; CONFLICT on differing config; no_change when an update differs in nothing). Password is always written when provided since RouterOS does not return it on GET.

List OpenVPN client interfaces on a MikroTik router. Shows name, remote server, and connection status.

Add, update, or remove an OpenVPN client interface. Idempotent by name (already_exists on matching name+connectTo; CONFLICT on differing connectTo; no_change when an update differs in nothing). Password is always written when provided since RouterOS does not return it on GET.

Get the OpenVPN server configuration on a MikroTik router. Throws NOT_FOUND if the OpenVPN package is not installed.

Enable, disable, or configure the OpenVPN server (a per-router singleton). Throws NOT_FOUND if the OpenVPN package is not installed. The set action requires at least one configuration field.

List PPP profiles including the built-in default and default-encryption profiles.

Add, update, or remove a PPP profile. Idempotent by name. update returns no_change when requested values match. Built-in profiles (default, default-encryption) cannot be removed — RouterOS blocks this and the error is surfaced.

Read the current RouterOS package upgrade status and routerboard firmware versions. Shows installed version, latest available version, update channel, and firmware upgrade availability.

Trigger a RouterOS package update check or install. 'check' queries the update server for new packages. 'install' downloads and applies the update — the router will reboot automatically. Supports dry-run.

Create a binary configuration backup on a MikroTik router. The backup is saved as <name>.backup on the router's filesystem. To encrypt it, prefer passwordSecret (a MIKROMCP_SECRET_<NAME> bound to the router in routers.yaml — the password never reaches the conversation) over a literal password. Dry run checks that the secret resolves.

Export the router configuration as a RouterOS script. When no file is specified, returns the script text inline. When a file is specified, saves it as <file>.rsc on the router's filesystem. Supports compact mode to show only non-default values.

List RouterOS logging rules (system/logging) with optional topic substring and action exact-match filtering.

Add, remove, enable, or disable a RouterOS logging rule. Idempotent by topics+logAction (add → already_exists on match; remove → not_found handled gracefully; enable/disable throw NOT_FOUND when absent). Supports dry-run.

List RouterOS logging action targets (system/logging/action) with optional type filter.

Add or remove a RouterOS logging action target. Idempotent by name. add throws VALIDATION if type is missing; returns already_exists if name found. remove returns not_found gracefully. Supports dry-run.

Run a RouterOS bandwidth test from the router to a remote host running a RouterOS btest server. Returns TX and RX throughput in Mbps. Duration capped at 20 seconds. Saturates the link — not auto-retried.

Send an HTTP/HTTPS request from the router using /tool/fetch. Response body is returned inline (capped at 64 KB with [TRUNCATED] marker). Use outputFile to save to router filesystem instead. Not read-only: POSTs have side effects and outputFile writes to the router.

List active connection tracking entries from the router firewall table. Filters are applied client-side. Useful for diagnosing NAT and firewall behavior.

Read global container configuration: registry URL, RAM high-water mark, and veth interface.

Update global container settings. Idempotent: returns no_change if nothing differs.

List container environment variable entries, optionally filtered by container name.

Add or remove a container environment variable. Idempotent by name+key. add returns already_exists if the entry exists with the same value; throws CONFLICT if the value differs.

List container volume mount definitions with source path, destination path, and mount name.

Add or remove a container volume mount. Idempotent by name: add returns already_exists if the mount exists with matching src/dst; throws CONFLICT if name exists with different paths.

List all interface lists defined on the router.

Add or remove an interface list. Idempotent by name. Removing a list that has members is blocked by RouterOS — the error is surfaced as-is.

Add or remove an interface from an interface list. Idempotent by list+interface composite key. add returns already_exists if the membership exists. remove returns not_found gracefully.

List interface list memberships (which interface belongs to which list, e.g. WAN/LAN) on a MikroTik router. Supports filtering by list and interface, with pagination.

List the SwOS/SwOS Lite '.b' API endpoints supported by this server, with the decoded field names per endpoint. Read-only schema introspection — no device call.

Retrieve status from a MikroTik SwOS switch (SwOS or SwOS Lite): identity, model, firmware, uptime, per-port link state/speed/duplex, PoE mode/state/power, and SFP modules.

Fetch and decode a single SwOS '.b' endpoint (link.b, sys.b, poe.b, lacp.b, rstp.b, snmp.b, fwd.b, vlan.b, stats.b, sfp.b, host.b, acl.b, ...) as structured data. Unknown keys are preserved under '_raw'.

Mutate a SwOS '.b' endpoint on a MikroTik switch. The full endpoint blob is read, the given fields are merged in, and the entire blob is written back (the firmware only accepts whole-blob writes); untouched fields are re-sent byte-for-byte, and a field this firmware does not expose is refused rather than injected. dryRun defaults to true — preview first. Every result reports whether the schema has been verified against the switch's firmware. The pre-write blob is snapshotted, so the change can be undone with rollback_change. Returns no_change when the values already match.

Export a SwOS switch's configuration as one YAML document: system settings (including management access), every port's name, enabled state and VLAN settings, the VLAN table (full SwOS) and SNMP. The SNMP community is never exported. The document is the input format of apply_swos_config, so it doubles as a backup you can read and diff.

Apply a switch config document (the format get_swos_config exports) to a SwOS switch. Plans every change against the switch first; dryRun defaults to true. Writes only the endpoints that change: the VLAN table grows first (new VLANs and members), then the per-port settings (VLAN, isolation, storm and flood control), port names/negotiation/enabled, LAG and SNMP, then the table shrinks (removed VLANs and members), then system — so no port loses its VLAN mid-apply. Refuses management changes (address, allow-from) unless includeManagement is true, and any plan that would cut a linked port off (its untagged VLAN moved or dropped, a trunk losing tagged VLANs or becoming an access port, a forced VLAN, a port that starts filtering VLANs, the port disabled, renegotiating, isolated from another linked port or moved in or out of a LAG, every linked port dropped from allow_from_ports; only risks the plan introduces) unless acceptLockoutRisk is true. All six endpoints are snapshotted before a real apply, so rollback_change restores the previous state; the result names any endpoint whose snapshot failed, and says so when none was recorded. A document that moves management to another VLAN (allow_from_vlan) and changes a port's VLAN settings or the VLAN table's membership at the same time is refused, because that cannot be written in a safe order (sys.b goes last and cuts the session): apply the VLAN changes first, then the move. `snmp.community` may reference only the secrets bound to the switch (its `secrets` list in routers.yaml); a switch without a list may reference none.

Download the switch's own configuration backup (backup.swb, the file the web UI's Save Backup produces) into the server's SwOS folder. The file is MikroTik's opaque format: it restores only through restore_swos_backup or the web UI, on the same model. A switch on factory defaults has nothing to save. Writes a file on the server (owner-only), so it is audited like a write.

Restore a backup.swb file from the server's SwOS folder onto the switch, as the web UI's Restore Backup does. The switch replaces its whole configuration and reboots, so it is unreachable for a while, and its address may change to the one in the backup. By default the current configuration is saved first. dryRun defaults to true.

Upgrade a SwOS switch's firmware the way the web UI's Upgrade tab does. Resolves the latest stable version for the model from MikroTik's download server (or takes `version`), downloads swos-<board>-<version>.bin over HTTPS into the server's SwOS folder (or uses `file`), checks it, then flashes it; the switch reboots. Refuses release candidates unless allowPrerelease is true. A switch still on its preinstalled backup firmware (a version ending in 'p', which cannot save configuration) counts as needing the upgrade. dryRun defaults to true.

Change a SwOS switch's admin password, as the web UI's Password Change does. The new password comes from the server secret MIKROMCP_PASSWORD_<newPasswordSecret>, never from the conversation; the current one is the router's configured credential. Passwords are ASCII, at most 15 characters. After the change this call's client keeps working with the new password, but the server rebuilds the client from the router's configured credential ({PREFIX}_PASS) after any authentication failure or restart, so that variable must be updated right away. On SwOS Lite the switch does not answer the change; the result is confirmed by logging in with the new password. dryRun defaults to true.

Preview a sequence of write operations: each step runs with dryRun=true against live state, returning affected paths and the predicted action per step. Use apply_plan to execute the same steps for real.

Execute write operations in order, stopping on first failure. Each step is snapshotted and journaled individually. Non-admin identities need a confirmationToken (same two-step flow as other destructive tools). Undo individual steps via rollback_change with the returned journal IDs.

Restore device state to before a write, identified by its journal ID. RouterOS: reads the before-snapshot, diffs against live state, and applies the reverse. SwOS: re-POSTs the exact pre-write '.b' blob. Use dryRun=true to preview. Requires MIKROMCP_DATA_DIR (defaults to data/).

List recent entries from the server's write journal (write-journal.ndjson): every journaled write with its journalId, timestamp, tool, router, parameters (as redacted at write time), snapshot ids and outcome — newest first. Read-only. Use it to recover a lost journalId for rollback_change, or to audit what was written when. Only entries with rollbackable: true can be rolled back — dry runs and writes without snapshots (run_command, plan_changes) cannot.

Probe a device: RouterOS routers via system/resource, SwOS switches via sys.b. Returns health status, firmware version, uptime, and (RouterOS only) CPU load and memory info. Unlike other tools, this never throws — unreachable devices are reported as healthy=false.

Fan out a single-router tool to many routers in parallel (up to `concurrency`), targeted by routerIds or tag. Write tools need two-step confirmation for every role: call without `confirmationToken` to get a fleet token, then re-call with it. Read-only tools fan out immediately. Writes snapshot+journal each router for rollback. Returns per-router results with succeeded/failed counts. To fan out a read-only tool, prefer bulk_read.

Fan out a read-only single-router tool (list_*, get_* and others annotated read-only) to many routers in parallel (up to `concurrency`), targeted by routerIds or tag. Unlike bulk_execute, the server refuses every write tool and the traffic-generating diagnostics (ping, traceroute, torch, bandwidth_test) with BULK_READ_TOOL_NOT_READ_ONLY, and never needs a confirmation token, snapshot or journal — so an MCP client can allow bulk_read without allowing fleet-wide writes. Use bulk_execute for anything else. Returns per-router results with succeeded/failed counts.

List the routers configured in the registry (routers.yaml): id, host, port, TLS status, tags, ROS version, and which is the default. Read-only reflection of local config — no RouterOS API call, no credentials in the response. rosVersion is what routers.yaml states and may lag a router upgrade — ask get_system_status for the live version. Use it to discover valid routerId values and tags for targeting other tools (including bulk_read and bulk_execute).