# keenetic-mcp [Health: Active]

**Category:** 🏠 Home Automation  
**Repository:** https://github.com/salatmaster/keenetic-mcp  
**GitHub Stars:** 29  
**npm Downloads (last month):** 1230  
**Views:** 2  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/keenetic-mcp

## Description
Control a Keenetic router: devices, Wi-Fi, VPN routing, segments, safe verified writes.

## Tools
Capabilities this server exposes over MCP:

- **get_system_info** — Model, firmware version, uptime, CPU and memory load, and the list of installed KeeneticOS components. Call this first when you need to know what the router supports: the component list tells you which features exist on this device.
- **get_config_state** — Whether the running configuration has unsaved changes, who last changed it and when, and the state of the router fail-safe timer. Unsaved changes are lost on reboot. unsavedChanges is null when the saved checksum could not be read - treat that as unknown, not as saved.
- **list_devices** — Every device the router knows about, with IP, name, how it is connected, signal strength and traffic counters. Use filter to narrow to active, wired, wireless or blocked devices, and sort to rank by traffic, name, signal or last seen.
- **get_device** — Every field the router holds for a single device: DHCP lease, Wi-Fi rate and mode, access policy, traffic shaping, first and last seen. Identify it by MAC, IP or name.
- **update_device** — Rename a device, allow or block its internet access, put it on a routing policy or a schedule, or set its traffic priority. Changes apply immediately but are NOT saved: a reboot discards them until save_config is called.
- **list_interfaces** — Every interface on the router - WAN links, bridges, Wi-Fi access points and VPN tunnels - with link state, address and whether it carries the default route. Summary detail is the default because the full listing is very large.
- **get_interface** — Every field for a single interface, including protocol-specific detail such as WireGuard peers or PPPoE session state. Get the exact name from list_interfaces first.
- **set_interface_state** — Enables or disables a network interface. Taking down a bridge or the WAN link can cut off access to the router itself, including this connection. Confirm what the interface carries with get_interface before calling this.
- **get_internet_status** — Whether the router currently reaches the internet, and which check failed if not: gateway reachability, DNS resolution, and captive-portal detection. Start here when the user reports the internet is down.
- **list_routes** — The routing table: destination, gateway, outgoing interface and metric. Use kind=default to see only the default route, which tells you which link traffic leaves through.
- **list_policies** — Connection policies, which decide that a given device leaves through a given link - typically used to send some devices through a VPN tunnel and the rest direct. The names returned here are what a device is assigned to.
- **get_wifi_status** — Wi-Fi radios grouped by band, each with its access points, SSIDs, link state and the number of connected clients. Use this rather than list_interfaces when the question is about Wi-Fi coverage or which network a device should be on.
- **list_segments** — Every bridge on the router, and whether the web interface lists it as a segment. A bridge that carries an address but has no VLAN behind it works for traffic and never appears under /access-points, so uiVisible is the field that matters.
- **create_segment** — Creates an isolated network that the web interface actually lists as a segment: a VLAN subinterface trunked over every switch port, a bridge, an address, NAT, a DHCP pool, and optionally a Wi-Fi network and a routing policy. Free identifiers are chosen automatically. The result is verified against the router-computed iseg block, and a failure anywhere rolls the whole thing back. Nothing is saved; call save_config once the user confirms.
- **delete_segment** — Removes a segment and everything created with it: the Wi-Fi networks bound to it, its policy, its DHCP pool, NAT, the bridge, and the VLAN on every switch port. Removing the bridge alone leaves the VLAN trunked over the whole switch. Devices on the segment lose their connection. Refuses the home segment.
- **backup_config** — Saves the router startup configuration to a local file. Take one before any sequence of changes so there is a known-good state to return to. Reading the configuration changes nothing on the router.
- **save_config** — Writes the running configuration to the startup configuration, so pending changes survive a reboot. Nothing else in this server saves, so call this only once the user has confirmed the changes are what they want.
- **rci_call** — Sends a raw request to the router RCI interface, for anything the other tools do not cover. GET reads a path such as "show/version" or "interface/Bridge0"; POST sends a command object mirroring the CLI tree. The response is capped, so ask for a narrow path rather than a broad one: show/ip/nat alone is over 100 KB.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "keenetic-mcp": {
    "command": "npx",
    "args": ["-y","keenetic-mcp"],
    "env": {
      "KEENETIC_HOST": "",
      "KEENETIC_USER": "",
      "KEENETIC_PASSWORD": ""
    }
  }
}
```

**Requires environment variables:** `KEENETIC_HOST`, `KEENETIC_USER`, `KEENETIC_PASSWORD` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What keenetic-mcp MCP server does

The keenetic-mcp MCP server gives an MCP-compatible agent access to a Keenetic router’s local management API. It can inspect connected devices, interface and Wi-Fi status, internet reachability, routes, connection policies, system information, configuration state, and network segments. It can also save a local configuration backup.

Write operations cover device names and access state, routing policies, schedules and priorities; interface state; segment creation and deletion; and saving the running configuration. The `rci_call` tool provides access to other router API paths when the purpose-built tools do not cover a needed operation.

## How it works

The server communicates with KeeneticOS through RCI, a JSON representation of the router’s command tree exposed over HTTP. It authenticates using the router’s challenge-response flow and maintains a session while the agent continues making requests. Responses are shaped before being returned so large router listings fit more usefully in the model context.

The keenetic-mcp MCP server runs on the machine hosting the MCP client and does not install packages, firmware, USB software, or Entware on the router.

By default, changes affect the running configuration only. Before the first change in a session, the server creates a backup. Each write is read back and checked before the operation is reported as successful. Calling `save_config` is a separate step that makes pending changes survive a reboot.

## Setup and configuration

Install the package with `npx -y keenetic-mcp`, or add it to an MCP client configuration as a stdio server. Claude Code and Codex also have documented plugin installation commands, while Codex can register the standalone command directly.

Running `npx -y keenetic-mcp init` starts a setup wizard. It discovers the router through the default gateway, confirms that the device is Keenetic, tests the password, and stores that password in the operating system keychain. The settings file contains the router address and login rather than the password.

For containerized or non-interactive deployments, `KEENETIC_HOST`, `KEENETIC_USER`, and `KEENETIC_PASSWORD` override the saved settings. The server also supports a `--read-only` option; in that mode, write tools are not registered with the client.

## Tools and capabilities

Read-oriented tools include `list_devices`, `get_device`, `list_interfaces`, `get_interface`, `get_wifi_status`, `get_internet_status`, `list_routes`, `list_policies`, `get_system_info`, `get_config_state`, `list_segments`, and `backup_config`.

Mutation tools include `update_device`, `set_interface_state`, `create_segment`, `delete_segment`, and `save_config`. Segment creation can include Wi-Fi, DHCP, and optional VPN routing. `rci_call` acts as a lower-level escape hatch for supported router API paths not represented elsewhere.

## Limitations and notes

Compatibility depends on the router’s KeeneticOS components. The project was verified on a Keenetic Ultra KN-1811 running KeeneticOS 5.1.3 and lists multiple models on the 5.1 branch; older routers with RCI may expose a different tool set. The keenetic-mcp MCP server is intended for LAN access, not remote cloud administration.

The router may accept an invalid command without applying it, which is why writes are verified. Unsaved changes disappear after a reboot. Segment behavior depends on the router configuration, including the VLAN-backed setup required for a segment to appear in the web interface.

_Full upstream README: https://allmcps.com/mcp/keenetic-mcp/readme_