# mikrotik-mcp [Health: Active]

**Category:** 💻 Developer Tools  
**Repository:** https://github.com/wiresage/mikrotik-mcp  
**GitHub Stars:** 303  
**Views:** 3  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/mikrotik-mcp

## Description
MCP server for MikroTik routers: firewall, NAT, routing, DHCP, DNS, WireGuard and more via SSH.

## Tools
Capabilities this server exposes over MCP:

- **create_backup** — Creates a system backup on the MikroTik device.
- **list_backups** — Lists backup files on the MikroTik device.
- **create_export** — Creates a configuration export file (rsc/json/xml) on the MikroTik device.
- **export_section** — Returns a RouterOS configuration section as an export script.

    Notes:
        section: RouterOS path without leading slash e.g. "ip address", "interface vlan",
            "ip firewall filter", "ip firewall nat", "queue simple"
        hide_sensitive: keep secrets out of the output (False appends show-sensitive)
    
- **download_file** — Downloads a backup or export file from the MikroTik device as base64-encoded content.
- **upload_file** — Uploads a base64-encoded file to the MikroTik device (for restore operations).
- **restore_backup** — Restores a system backup on the MikroTik device; triggers a reboot.
- **import_configuration** — Imports and executes a RouterOS configuration script (.rsc file) on the device.
- **remove_file** — Removes a file from the MikroTik device filesystem.
- **backup_info** — Gets detailed information about a backup file on the MikroTik device.
- **create_dhcp_server** — Creates a DHCP server bound to the specified interface on the MikroTik device.

    Notes:
        lease_time: duration e.g. "1d", "12h", "30m", "1h30m"
    
- **list_dhcp_servers** — Lists DHCP servers on the MikroTik device.
- **list_dhcp_leases** — Lists detailed IPv4 DHCP leases, optionally filtering active lease fields.

    Notes:
        Address and identity filters are substring matches. Server, status, and
        lease time filters are exact matches against RouterOS `lease-time`.
    
- **list_dhcpv6_bindings** — Lists detailed DHCPv6 bindings.

    Notes:
        Address and DUID filters are substring matches. IAID, server, status,
        and lease time filters are exact matches; lease time maps to `life-time`.
    
- **get_dhcp_server** — Gets detailed information about a specific DHCP server.
- **create_dhcp_network** — Creates a DHCP network configuration (gateway, DNS, domain, etc.) on the MikroTik device.
- **update_dhcp_network** — Updates fields on an existing DHCP network entry on the MikroTik device.

    Notes:
        Pass an empty list for dns_servers/wins_servers/ntp_servers/dhcp_option
        (or "" for domain) to clear that field.
    
- **remove_dhcp_network** — Removes a DHCP network configuration from the MikroTik device.
- **create_dhcp_pool** — Creates a DHCP address pool with the given IP ranges on the MikroTik device.

    Notes:
        ranges: hyphen-separated range(s) e.g. "192.168.1.1-192.168.1.100"
            Multiple ranges comma-separated: "10.0.0.1-10.0.0.50,10.0.0.100-10.0.0.120"
    
- **remove_dhcp_server** — Removes a DHCP server from the MikroTik device.
- **set_dns_servers** — Sets DNS server configuration.
- **get_dns_settings** — Gets current DNS configuration.
- **add_dns_static** — Adds a static DNS entry.

    Notes:
        regexp: a regular expression the name must match. A regexp entry has no name, so ``name`` is
            ignored when ``regexp`` is given (RouterOS refuses both: "only name or regexp allowed").
    
- **list_dns_static** — Lists static DNS entries.
- **get_dns_static** — Gets details of a specific static DNS entry.
- **update_dns_static** — Updates a static DNS entry.
- **remove_dns_static** — Removes a static DNS entry.
- **enable_dns_static** — Enables a static DNS entry.
- **disable_dns_static** — Disables a static DNS entry.
- **get_dns_cache** — Gets the current DNS cache.
- **flush_dns_cache** — Flushes the DNS cache.
- **get_dns_cache_statistics** — Gets DNS cache statistics.
- **add_dns_regexp** — Adds a DNS regexp entry.
- **test_dns_query** — Tests a DNS query.

    Notes:
        type: accepted values are A/ipv4, AAAA/ipv6, any, any6
    
- **export_dns_config** — Exports DNS configuration to a file.
- **create_address_list_entry** — Adds an entry to an IPv4 or IPv6 firewall address list.

    Notes:
        address: an address or prefix; a hostname is also accepted and RouterOS
            adds a dynamic child entry per resolved address.
        timeout: RouterOS duration e.g. "1h". An entry with a timeout is
            dynamic, so it does not survive a reboot.
        list_name is matched exactly, including any leading or trailing spaces.
    
- **list_address_list_entries** — Lists IPv4 or IPv6 firewall address list entries.

    Notes:
        list_filter: exact list name, including any trailing space.
        address_filter/comment_filter: partial match.
        static_only excludes the dynamic children a hostname entry creates.
    
- **get_address_list_entry** — Gets one address list entry by list name and address.
- **update_address_list_entry** — Updates an address list entry, located by its current list name and address.

    Notes:
        Pass "" to clear comment or timeout.
        A change is confirmed on the device before success is reported.
    
- **remove_address_list_entry** — Removes an address list entry by list name and address.

    Notes:
        Removing a hostname entry also clears the dynamic entries RouterOS
        derived from it.
    
- **enable_address_list_entry** — Enables an address list entry.
- **disable_address_list_entry** — Disables an address list entry.
- **create_filter_rule** — Creates a firewall filter rule in the specified chain on the MikroTik device.

    Notes:
        connection_state: comma-separated e.g. "established,related,new,invalid"
        limit: RouterOS rate/burst string e.g. "10,5:packet" or "10/1s:packet"
        tcp_flags: RouterOS flag expression e.g. "syn,!ack"
        place_before: rule number or ID (*N) to insert before e.g. "0" or "*3"
        in_interface_list/out_interface_list: name of an /interface list (e.g. "LAN", "WAN") rather than a single interface
    
- **list_filter_rules** — Lists firewall filter rules on the MikroTik device.
- **get_filter_rule** — Gets detailed information about a specific firewall filter rule.

    Notes:
        rule_id: positional number from list output (e.g. "12") or internal ID (e.g. "*1A")
    
- **update_filter_rule** — Updates an existing firewall filter rule on the MikroTik device.

    Notes:
        rule_id: positional number from list output (e.g. "12") or internal ID (e.g. "*1A")
        connection_state: comma-separated e.g. "established,related"
        limit: RouterOS rate string e.g. "10,5:packet"
        tcp_flags: RouterOS flag expression e.g. "syn,!ack"
        Pass "" to clear an optional field (e.g. src_address="").
    
- **remove_filter_rule** — Removes a firewall filter rule from the MikroTik device.

    Notes:
        rule_id: positional number from list output (e.g. "12") or internal ID (e.g. "*1A")
    
- **move_filter_rule** — Moves a firewall filter rule to a different position in the chain.

    Notes:
        rule_id: positional number from list output (e.g. "12") or internal ID (e.g. "*1A")
        destination: 0-based target position index
    
- **enable_filter_rule** — Enables a firewall filter rule.
- **disable_filter_rule** — Disables a firewall filter rule.
- **create_basic_firewall_setup** — Creates a basic firewall setup with common security rules on the MikroTik device.
- **create_nat_rule** — Creates a NAT rule (srcnat or dstnat) on the MikroTik device.

    Notes:
        to_addresses: single IP or range e.g. "10.0.0.1" or "10.0.0.1-10.0.0.10"
        to_ports: single port or range e.g. "8080" or "8080-8090"
        place_before: rule number or ID (*N) to insert before e.g. "0" or "*3"
    
- **list_nat_rules** — Lists NAT rules on the MikroTik device.
- **get_nat_rule** — Gets detailed information about a specific NAT rule.

    Notes:
        rule_id: use the ID from list output e.g. "*1" or "0"
    
- **update_nat_rule** — Updates an existing NAT rule on the MikroTik device.

    Notes:
        rule_id: use the ID from list output e.g. "*1" or "0"
        to_addresses: single IP or range e.g. "10.0.0.1" or "10.0.0.1-10.0.0.10"
        to_ports: single port or range e.g. "8080" or "8080-8090"
        Pass "" to clear an optional field.
    
- **remove_nat_rule** — Removes a NAT rule from the MikroTik device.

    Notes:
        rule_id: use the ID from list output e.g. "*1" or "0"
    
- **move_nat_rule** — Moves a NAT rule to a different position in the chain.

    Notes:
        rule_id: use the ID from list output e.g. "*1" or "0"
        destination: 0-based target position index
    
- **enable_nat_rule** — Enables a NAT rule.
- **disable_nat_rule** — Disables a NAT rule.
- **list_interfaces** — Lists all interfaces on the MikroTik device (ethernet, bridge, WireGuard,
    PPPoE, VLAN, WiFi, SFP, LTE, loopback, and any other type).

    Notes:
        type_filter: RouterOS interface type e.g. "ether", "bridge", "vlan",
            "wg", "pppoe-out", "wifi", "lte", "loopback"
        name_filter: partial name match e.g. "ether" matches ether1, ether2 …
    
- **get_interface** — Gets detailed information about a specific interface by name.

    Notes:
        name: exact interface name e.g. "ether1", "bridge", "pppoe-out1", "wg0"
    
- **enable_interface** — Enables an interface on the MikroTik device.

    Notes:
        name: exact interface name e.g. "ether1", "bridge", "pppoe-out1"
    
- **disable_interface** — Disables an interface on the MikroTik device.

    Notes:
        name: exact interface name e.g. "ether1", "bridge", "pppoe-out1"
    
- **list_devices** — Lists the MikroTik devices this server manages.

    Use this to discover which devices are available and what their titles are.
    Every other tool takes an optional `device` argument that must be one of the
    titles returned here. When only one device is configured, `device` may be
    omitted and that device is used automatically.

    Credentials are never returned.
    
- **add_ip_address** — Adds an IP address to an interface on the MikroTik device.
- **list_ip_addresses** — Lists IP addresses on the MikroTik device.
- **get_ip_address** — Gets detailed information about a specific IP address by ID or address value.
- **remove_ip_address** — Removes an IP address from the MikroTik device by ID or address value.
- **add_ipv6_address** — Adds an IPv6 address to an interface on the MikroTik device.

    Notes:
        address: IPv6 address with prefix length, e.g. "2001:db8::1/64" or
            "fe80::1/64". When `from_pool` is used, supply the host part only,
            e.g. "::1/64".
        advertise: include this prefix in Router Advertisements (default no).
        eui_64: derive the host part of the address from the interface MAC.
        from_pool: name of an IPv6 pool to take the prefix from.
        no_dad: skip Duplicate Address Detection.
    
- **list_ipv6_addresses** — Lists IPv6 addresses on the MikroTik device.

    Notes:
        address_filter: partial match on the address, e.g. "2001:db8" or "fe80".
        global_only: show only global (routable) addresses.
        link_local_only: show only link-local (fe80::/10) addresses.
    
- **get_ipv6_address** — Gets detailed information about a specific IPv6 address by ID or address value.

    Notes:
        address_id: a RouterOS internal id (e.g. "*1") or the address value
            (e.g. "2001:db8::1/64").
    
- **remove_ipv6_address** — Removes an IPv6 address from the MikroTik device by ID or address value.

    Notes:
        address_id: a RouterOS internal id (e.g. "*1") or the address value
            (e.g. "2001:db8::1/64").
    
- **create_ipv6_filter_rule** — Creates an IPv6 firewall filter rule on the MikroTik device.

    Notes:
        protocol: IPv6 uses "icmpv6", not the IPv4 spelling "icmp".
        jump_target: only used with action="jump".
    
- **list_ipv6_filter_rules** — Lists IPv6 firewall filter rules on the MikroTik device.

    Notes:
        protocol_filter: IPv6 uses "icmpv6", not the IPv4 spelling "icmp".
        src_address_filter/dst_address_filter: partial match on the address,
            e.g. "2001:db8" matches every rule whose address starts with it.
    
- **get_ipv6_filter_rule** — Gets detailed information about a specific IPv6 firewall filter rule.

    Notes:
        rule_id: a RouterOS internal id ("*1") or a print position ("0").
    
- **update_ipv6_filter_rule** — Updates an existing IPv6 firewall filter rule on the MikroTik device.

    Notes:
        rule_id: a RouterOS internal id ("*1") or a print position ("0").
        Pass "" to clear an optional field (e.g. src_address="").
    
- **remove_ipv6_filter_rule** — Removes an IPv6 firewall filter rule from the MikroTik device.

    Notes:
        rule_id: a RouterOS internal id ("*1") or a print position ("0").
    
- **move_ipv6_filter_rule** — Moves an IPv6 firewall filter rule to a different position in the chain.

    Notes:
        rule_id: a RouterOS internal id ("*1") or a print position ("0").
        destination: 0-based target position index
    
- **enable_ipv6_filter_rule** — Enables an IPv6 firewall filter rule.
- **disable_ipv6_filter_rule** — Disables an IPv6 firewall filter rule.
- **create_ip_pool** — Creates an IP pool with the given address ranges on the MikroTik device.

    Notes:
        ranges: hyphen-separated range(s) e.g. "192.168.1.1-192.168.1.100"
            Multiple ranges comma-separated: "10.0.0.1-10.0.0.50,10.0.0.100-10.0.0.120"
    
- **list_ip_pools** — Lists IP pools on the MikroTik device.
- **get_ip_pool** — Gets detailed information about a specific IP pool including used address count.
- **update_ip_pool** — Updates an existing IP pool's name, ranges, or next-pool reference.

    Notes:
        ranges: hyphen-separated range(s) e.g. "192.168.1.1-192.168.1.100"
            Multiple ranges comma-separated: "10.0.0.1-10.0.0.50,10.0.0.100-10.0.0.120"
        Pass "" for next_pool to clear it.
    
- **remove_ip_pool** — Removes an IP pool from the MikroTik device (fails if pool is in use).
- **list_ip_pool_used** — Lists currently used (allocated) addresses from IP pools.
- **expand_ip_pool** — Expands an existing IP pool by appending additional address ranges.

    Notes:
        additional_ranges: hyphen-separated range(s) e.g. "192.168.1.101-192.168.1.150"
            Multiple ranges comma-separated: "10.0.0.51-10.0.0.60,10.0.0.70-10.0.0.80"
    
- **get_logs** — Gets logs from the MikroTik device with optional topic, time, and message filters.

    Notes:
        topics: comma-separated, entry matches any of them e.g. "system,dhcp"
        time_filter: RouterOS duration e.g. "30s", "5m", "1h", "2d"
        message_filter: RouterOS regex matched against the message (case-sensitive)
        limit: keep only the newest N entries
    
- **get_logs_by_severity** — Gets logs filtered by severity level (debug/info/warning/error/critical).
- **get_logs_by_topic** — Gets logs for a specific topic/facility (system, dhcp, interface, firewall, etc.).
- **search_logs** — Searches log messages for a literal term.

    Notes:
        search_term: treated literally (regex specials are escaped)
        case_sensitive: RouterOS matching is case-sensitive; by default the
            search emulates case-insensitivity with character classes
    
- **get_system_events** — Gets system-related log events (login, reboot, config-change, etc.).
- **get_security_logs** — Gets security-related log entries (logins, failures, blocked connections, etc.).
- **clear_logs** — Explains why MikroTik's in-memory log cannot be cleared on demand.
- **get_log_statistics** — Gets log entry counts by topic and severity from the MikroTik device.
- **export_logs** — Exports logs to a .txt file on the MikroTik device with optional topic and time filters.
- **monitor_logs** — Watches for new log entries for a limited duration (max 60s) and returns them.

    Notes:
        duration: seconds to wait for new entries, capped at 60
    
- **list_arp_entries** — Lists detailed IPv4 ARP entries.

    Notes:
        Address and MAC filters are substring matches. Interface and status
        filters are exact matches.
    
- **list_ipv6_neighbors** — Lists detailed IPv6 neighbor-discovery entries.

    Notes:
        Address and MAC filters are substring matches. Interface and status
        filters are exact matches.
    
- **get_poe_monitor** — Reads real-time Power-over-Ethernet (PoE) monitor data for one or more
    ethernet interfaces — PoE-out status, voltage, current, and power.

    Runs ``/interface ethernet poe monitor <interfaces> once``.

    Notes:
        interfaces: comma-separated ethernet interface name(s), e.g.
            "ether1" or "ether9-ap,ether10-ap,ether11-ap,ether12-ap"
    
- **list_poe** — Lists the Power-over-Ethernet (PoE) configuration of PoE-capable
    ethernet interfaces (PoE-out mode, priority).

    Runs ``/interface ethernet poe print``.

    Notes:
        interface_filter: partial name match, e.g. "ether" matches ether1, ether2 …
    
- **get_poe_settings** — Gets the detailed PoE-out settings of a specific ethernet interface
    (PoE-out mode, priority, voltage, low/high thresholds, …).

    Runs ``/interface ethernet poe print detail where name=<name>``.

    Notes:
        name: exact ethernet interface name, e.g. "ether1"
    
- **create_queue_type** — Creates a queue type (qdisc). kind selects the discipline (cake, fq-codel, sfq, red, pcq, pfifo, bfifo); remaining params are per-discipline options.

    Notes:
        pcq_rate: bandwidth per flow e.g. "1M", "512k"
        pcq_classifier: comma-separated classifiers e.g. "src-address,dst-address"
        cake_rtt: round-trip time e.g. "50ms", "100ms"
        fq_codel_target / fq_codel_interval: time e.g. "5ms", "100ms"
    
- **list_queue_types** — Lists queue types on the MikroTik device.
- **get_queue_type** — Gets detailed information about a specific queue type.
- **update_queue_type** — Updates an existing queue type's discipline-specific settings.
- **remove_queue_type** — Removes a queue type from the MikroTik device.
- **create_queue_tree** — Creates a hierarchical queue tree entry attached to a parent interface or queue.

    Notes:
        max_limit / limit_at / burst_limit / burst_threshold: bandwidth e.g. "10M", "512k", "1G"
        burst_time: duration e.g. "8s"
        parent: interface name e.g. "ether1" or parent queue name
        priority: 1 (highest) – 8 (lowest)
    
- **list_queue_trees** — Lists queue trees on the MikroTik device.
- **get_queue_tree** — Gets detailed information about a specific queue tree.
- **update_queue_tree** — Updates an existing queue tree entry (bandwidth limits, parent, priority, etc.).

    Notes:
        max_limit / limit_at / burst_limit / burst_threshold: bandwidth e.g. "10M", "512k"
        burst_time: duration e.g. "8s"
        priority: 1 (highest) – 8 (lowest)
    
- **remove_queue_tree** — Removes a queue tree from the MikroTik device.
- **enable_queue_tree** — Enables a queue tree.
- **disable_queue_tree** — Disables a queue tree.
- **create_simple_queue** — Creates a simple queue to rate-limit a target address or interface.

    Notes:
        target: IP/CIDR or interface e.g. "192.168.1.0/24" or "ether1"
        max_limit / limit_at / burst_limit / burst_threshold: upload/download bandwidth
            as "UL/DL" e.g. "10M/10M", or single value e.g. "10M"
        burst_time: duration e.g. "8s"
        priority: 1 (highest) – 8 (lowest)
    
- **list_simple_queues** — Lists simple queues on the MikroTik device.
- **get_simple_queue** — Gets detailed information about a specific simple queue.
- **update_simple_queue** — Updates an existing simple queue's rate limits, target, or scheduling settings.

    Notes:
        target: IP/CIDR or interface e.g. "192.168.1.0/24" or "ether1"
        max_limit / limit_at / burst_limit / burst_threshold: upload/download bandwidth
            as "UL/DL" e.g. "10M/10M", or single value e.g. "10M"
        burst_time: duration e.g. "8s"
        priority: 1 (highest) – 8 (lowest)
    
- **remove_simple_queue** — Removes a simple queue from the MikroTik device.
- **enable_simple_queue** — Enables a simple queue.
- **disable_simple_queue** — Disables a simple queue.
- **safe_mode_status** — Returns whether MikroTik Safe Mode is currently active.
- **enable_safe_mode** — Activates MikroTik Safe Mode; changes are held in memory and auto-reverted on disconnect until committed.
- **commit_safe_mode** — Commits all pending Safe Mode changes to persistent storage and exits Safe Mode.
- **rollback_safe_mode** — Discards all pending Safe Mode changes by closing the SSH session, triggering automatic rollback.
- **add_route** — Adds a route to the routing table.

    Notes:
        dst_address: CIDR e.g. "0.0.0.0/0", "192.168.1.0/24"
        routing_table: name of a table from /routing table, e.g. "via_ISP2";
            defaults to "main". RouterOS 6 called this the routing mark.
        check_gateway: "ping" or "arp"
        distance: 1-255 (lower = higher priority)
    
- **list_routes** — Lists routes in MikroTik routing table.
- **get_route** — Gets detailed information about a specific route.

    Notes:
        route_id: "*N" or "N" from list output e.g. "*3"
    
- **update_route** — Updates a route.

    Notes:
        route_id: "*N" or "N" from list output e.g. "*3"
        dst_address: CIDR e.g. "192.168.1.0/24"
        check_gateway: "ping" or "arp"
        distance: 1-255
        routing_table: name of a table from /routing table; "" moves the route
            back to "main", since every RouterOS 7 route belongs to a table.
        Pass "" to vrf_interface or pref_src to clear them.
    
- **remove_route** — Removes a route.

    Notes:
        route_id: "*N" or "N" from list output e.g. "*3"
    
- **enable_route** — Enables a route.

    Notes:
        route_id: "*N" or "N" from list output e.g. "*3"
    
- **disable_route** — Disables a route.

    Notes:
        route_id: "*N" or "N" from list output e.g. "*3"
    
- **get_routing_table** — Gets a specific routing table.
- **check_route_path** — Checks the route MikroTik would use to reach a destination.
- **get_route_cache** — Gets the route cache.
- **flush_route_cache** — Flushes the route cache.
- **add_default_route** — Adds a default route.
- **add_blackhole_route** — Adds a blackhole route.

    Notes:
        dst_address: CIDR e.g. "10.0.0.0/8"
        distance: 1-255
    
- **get_route_statistics** — Gets routing table statistics.
- **add_user** — Adds a user to MikroTik device.
- **list_users** — Lists users on MikroTik device.
- **get_user** — Gets detailed information about a specific user.
- **update_user** — Updates a user.
- **remove_user** — Removes a user.
- **disable_user** — Disables a user.
- **enable_user** — Enables a user.
- **add_user_group** — Adds a user group.
- **list_user_groups** — Lists user groups on MikroTik device.
- **get_user_group** — Gets detailed information about a specific user group.
- **update_user_group** — Updates a user group.
- **remove_user_group** — Removes a user group.
- **get_active_users** — Gets currently active/logged-in users.
- **disconnect_user** — Disconnects an active user session.
- **export_user_config** — Exports user configuration to a file.
- **set_user_ssh_keys** — Sets SSH keys for a specific user.
- **list_user_ssh_keys** — Lists SSH keys for a specific user.
- **remove_user_ssh_key** — Removes an SSH key.
- **create_vlan_interface** — Creates a VLAN interface on the MikroTik device with the given VLAN ID and parent interface.
- **list_vlan_interfaces** — Lists VLAN interfaces on the MikroTik device.
- **get_vlan_interface** — Gets detailed information about a specific VLAN interface.
- **update_vlan_interface** — Updates an existing VLAN interface's settings on the MikroTik device.
- **remove_vlan_interface** — Removes a VLAN interface from the MikroTik device.
- **create_wireless_interface** — Creates a wireless interface on the MikroTik device (auto-detects RouterOS v6/v7 syntax).
- **list_wireless_interfaces** — Lists wireless interfaces on the MikroTik device.
- **get_wireless_interface** — Gets detailed information about a specific wireless interface.
- **remove_wireless_interface** — Removes a wireless interface from the MikroTik device.
- **enable_wireless_interface** — Enables a wireless interface.
- **disable_wireless_interface** — Disables a wireless interface.
- **scan_wireless_networks** — Scans for nearby wireless networks using the specified interface.
- **get_wireless_registration_table** — Gets the wireless registration table (connected clients) from the MikroTik device.
- **check_wireless_support** — Checks if the device supports wireless and reports the RouterOS version and wireless interface type.
- **create_wireless_security_profile** — Legacy function - not supported in RouterOS v7.x
- **list_wireless_security_profiles** — Legacy function - not supported in RouterOS v7.x
- **get_wireless_security_profile** — Legacy function - not supported in RouterOS v7.x
- **remove_wireless_security_profile** — Legacy function - not supported in RouterOS v7.x
- **set_wireless_security_profile** — Legacy function - not supported in RouterOS v7.x
- **create_wireless_access_list** — Legacy function - different in RouterOS v7.x
- **list_wireless_access_list** — Legacy function - different in RouterOS v7.x
- **remove_wireless_access_list_entry** — Legacy function - different in RouterOS v7.x
- **update_wireless_interface** — Updates an existing wireless interface's settings (name, SSID, enabled state, etc.).
- **set_wireless_passphrase** — Sets the WiFi passphrase directly on a RouterOS v7 wireless interface (/interface wifi or wifiwave2).

    Notes:
        authentication_types: comma-separated RouterOS auth types, e.g. "wpa2-psk,wpa3-psk"; unset keeps the current setting.
    
- **create_wireguard_interface** — Creates a WireGuard interface on the MikroTik device.
- **list_wireguard_interfaces** — Lists WireGuard interfaces on the MikroTik device.
- **get_wireguard_interface** — Gets detailed information about a specific WireGuard interface.
- **update_wireguard_interface** — Updates an existing WireGuard interface's settings on the MikroTik device.
- **remove_wireguard_interface** — Removes a WireGuard interface from the MikroTik device.
- **enable_wireguard_interface** — Enables a WireGuard interface.
- **disable_wireguard_interface** — Disables a WireGuard interface.
- **add_wireguard_peer** — Adds a WireGuard peer (with public key and allowed addresses) to an interface on the MikroTik device.

    Notes:
        allowed_address: CIDR, comma-separated for multiple e.g. "10.0.0.2/32" or "10.0.0.0/24,192.168.0.0/24"
        endpoint_address: remote host IP or hostname e.g. "203.0.113.1"
        persistent_keepalive: seconds as string e.g. "25"
    
- **list_wireguard_peers** — Lists WireGuard peers on the MikroTik device.
- **get_wireguard_peer** — Gets detailed information about a specific WireGuard peer by ID.

    Notes:
        peer_id: "*N" or "N" from list output e.g. "*2"
    
- **update_wireguard_peer** — Updates an existing WireGuard peer's allowed addresses, endpoint, keepalive, or enabled state.

    Notes:
        peer_id: "*N" or "N" from list output e.g. "*2"
        allowed_address: CIDR, comma-separated e.g. "10.0.0.2/32" or "10.0.0.0/24,192.168.0.0/24"
        persistent_keepalive: seconds as string e.g. "25"
        Pass "" for endpoint_address or preshared_key to clear them.
    
- **remove_wireguard_peer** — Removes a WireGuard peer from the MikroTik device.

    Notes:
        peer_id: "*N" or "N" from list output e.g. "*2"
    
- **enable_wireguard_peer** — Enables a WireGuard peer.

    Notes:
        peer_id: "*N" or "N" from list output e.g. "*2"
    
- **disable_wireguard_peer** — Disables a WireGuard peer.

    Notes:
        peer_id: "*N" or "N" from list output e.g. "*2"
    
- **generate_wireguard_client_config** — Generates a wg0.conf client config string from the given keys and server endpoint. Does not communicate with the router.
- **get_ipsec_installed_sa** — Lists the installed IPsec security associations (child/phase 2 SAs).

    The Flags legend is the point of this view. On RouterOS 7 it reads:

        S - SEEN-TRAFFIC  the SA has carried packets
        H - HW-AEAD       the cipher is running in hardware
        E - ESP

    `S` is the only field that separates an SA carrying traffic from one that
    is merely installed. A remote end reporting the connection as up, or its
    own byte counters growing, does not contradict a missing `S`: those count
    what the far side sent, not what arrived.

    Two things this does NOT tell you, both easy to get wrong:

    - **A missing `S` can mean idle, not broken.** An SA nothing has used
      looks exactly like one that is failing, and RouterOS withholds
      `addtime` and `expires-in` until traffic appears, which makes it look
      half installed. Put traffic over the selector before concluding
      anything.

    - **Per-SA counters do not map onto policies once a peer has several
      child SAs.** Traffic picks among them, so one SA can carry the outbound
      side of two policies while another sits frozen at the counter it had
      minutes after install. Pairing SAs by hand — by install time, by
      address, by lifetime — invents a structure that is not there. Watch
      which counters move under traffic you control instead.

    Notes:
        Address filters are exact matches on the SA endpoints, which are the
        tunnel endpoints (public addresses), not the encapsulated subnets.
    
- **get_ipsec_active_peers** — Lists the IPsec peers with a live IKE session, with uptime and counters.

    Shows the parent (phase 1) side: `state`, `uptime`, `last-seen` and the
    byte counters. A peer can sit here `established` while its child SAs
    carry nothing — use `get_ipsec_installed_sa` to tell the difference.

    Notes:
        Both filters are exact matches.
    
- **list_ipsec_peers** — Lists the configured IPsec peers.

    Notes:
        Filters are substring matches. Secrets live on `/ip ipsec identity`
        and are not exposed by any tool in this server.
    
- **list_ipsec_policies** — Lists the IPsec policies, with their phase 2 state.

    The Flags legend distinguishes configured policies from the ones a peer
    generated at runtime (`D` dynamic), and `ph2-state` says whether the
    child SA is established. A policy whose selectors do not match the far
    end's is the usual cause of a tunnel that comes up and passes nothing.

    Notes:
        `peer_filter` is a substring match on the peer name; the address
        filters are substring matches on the policy selectors, which are the
        encapsulated subnets, not the tunnel endpoints.
    
- **list_ipsec_profiles** — Lists the IPsec profiles (phase 1 proposal: DH group, hash, lifetime, DPD).

    Notes:
        `lifetime` here is phase 1. It must be LONGER than the phase 2
        lifetime on `/ip ipsec proposal`, so the child SA rekeys inside a
        live parent SA; equal lifetimes tear the tunnel down on every
        rekey. `dpd-interval` multiplied by `dpd-maximum-failures` is how
        many seconds of silence the peer tolerates.
    
- **list_ipsec_proposals** — Lists the IPsec proposals (phase 2: encryption, auth, PFS, lifetime).

    Notes:
        Compare `lifetime` against the phase 1 lifetime on
        `/ip ipsec profile`, and against whatever the far end proposes — a
        cloud provider's own SA lifetime counts as a third value in that
        comparison.
    
- **list_netwatch** — Lists the netwatch probes with their live status and measurements.

    Configuration first, then a LIVE STATE block with `status`, `since` — the
    timestamp of the last transition — and, on an ICMP probe, the last test's
    numbers: `rtt-avg`, `loss-percent`, `failed-tests`. Match the two blocks
    by `host`, or by the `.id` the live one carries.

    Notes:
        `host_filter` and `comment_filter` are substring matches; `status_filter`
        and `type_filter` are exact. Pass `status_filter="down"` to list only
        what is currently failing.

        `include_source=False` (the default) omits `up-script`,
        `down-script` and `test-script`, because a probe that alerts through a
        webhook or an e-mail carries the token or the password inline. Set it
        to True only when you intend to read those commands; the output is
        redacted either way, but redaction is pattern-based and is not a
        guarantee.

        A probe with no `src-address` follows whichever WAN is active, so it
        keeps reporting across a failover; one pinned to a source address
        reports that path only. Which of the two you want depends on whether
        you are watching the internet or a specific link.
    
- **list_schedulers** — Lists the scheduled tasks with their interval, next run and run count.

    Notes:
        `name_filter` is a substring match. Read `next-run` together with
        `interval`: a scheduler whose `run-count` is not advancing is firing
        into a script that errors out, which RouterOS does not surface here —
        it shows up in the log under the `script` topic.

        `on-event` is passed through the server's redaction, since a scheduler
        can carry commands inline rather than calling a named script.
    
- **list_scripts** — Lists the stored scripts: owner, policy, run count and last start.

    Notes:
        `include_source=False` (the default) omits the script body, because
        bodies routinely hold credentials in clear text. Set it to True only
        when you intend to read the code; the output is redacted either way,
        but redaction is pattern-based and is not a guarantee.

        `policy` is what the script may do when it runs, which can exceed what
        the user who scheduled it may do interactively.
    
- **list_ip_services** — Lists the management services with their port and address restriction.

    Notes:
        `name_filter` is a substring match (`winbox`, `ssh`, `api`, `www`,
        `www-ssl`, `ftp`, `telnet`). `enabled_only=True` hides the disabled
        ones, which is the list that actually describes exposure.

        An empty `address` means unrestricted. Read that together with how the
        device is reached: unrestricted on a router whose WAN holds a public
        address means the service is published to the internet, whether or not
        the port was changed from its default.

        `ftp` deserves its own look: RouterOS also serves SFTP file transfers
        through the SSH service to users whose group holds the `ftp` policy,
        so the two are not the same control.
    
- **get_system_resource** — Reports uptime, RouterOS version, board name, architecture, CPU and memory.

    Notes:
        `free-memory` against `total-memory` and `cpu-load` are the two numbers
        worth reading before blaming the network for a slow device. On the
        low-power boards a single packet-sniffing tool can saturate the CPU on
        its own.
    
- **get_system_health** — Reports the board sensors: voltage, temperature, fan and PSU state.

    Notes:
        Many boards carry no sensors at all and legitimately report nothing.
        An empty answer here means "this model does not measure it", not "the
        reading failed".
    
- **get_system_clock** — Reports the device clock, time zone and DST setting.

    Notes:
        Log timestamps are only as trustworthy as this. A device without a
        working time source dates its own evidence wrongly, which matters when
        correlating an incident across sites.
    
- **get_system_routerboard** — Reports the model, serial number and bootloader firmware revision.

    Notes:
        `current-firmware` against `upgrade-firmware` is the RouterBOOT
        bootloader, which is upgraded separately from RouterOS and is easy to
        leave behind after a package upgrade.
    
- **list_system_packages** — Lists the installed RouterOS packages and which are disabled.
- **get_system_package_update** — Reports the installed RouterOS version against the latest on its channel.

    Notes:
        This reads the stored result of the last check; it does not contact
        MikroTik. `latest-version` can therefore be stale or empty on a device
        that has never checked or cannot reach the update server.
    

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `uvx` (confidence: high):

```json
"mcpServers": {
  "mikrotik-mcp": {
    "command": "uvx",
    "args": ["mcp-server-mikrotik"]
  }
}
```

## Documentation

## What mikrotik-mcp does

mikrotik-mcp provides an MCP interface for interacting with MikroTik RouterOS devices through SSH. It lets an AI assistant perform router administration tasks involving system backups, configuration exports, filesystem files, DHCP, and DNS. The project also supports managing multiple MikroTik devices through an inventory structure, allowing an LLM to work with devices in a fleet rather than only a single router.

The server is relevant for operators who want conversational access to routine RouterOS administration. It can create and inspect backup artifacts, extract configuration sections, manage DHCP objects, and read or modify DNS configuration. Configuration changes are executed on the target device, so requests should be treated like direct administrative operations.

## Tools and capabilities

Backup and configuration tools cover the lifecycle of RouterOS backup and export files:

- Create system backups and list the backup files stored on a device.
- Generate configuration exports in RSC, JSON, or XML formats.
- Export a selected RouterOS section, such as `ip address`, `interface vlan`, `ip firewall filter`, `ip firewall nat`, or `queue simple`.
- Download device files as base64-encoded content and upload base64-encoded files for restore workflows.
- Inspect backup metadata, remove files, import an RSC configuration script, or restore a system backup.

DHCP tools create and manage DHCP servers, networks, and address pools. They also retrieve DHCP server details, IPv4 lease records, and DHCPv6 bindings. DHCP network fields include gateway, DNS, domain, and related options, while pools accept one or more IP ranges.

DNS tools read and change resolver configuration. Available operations include setting DNS servers, retrieving DNS settings, creating and listing static records, inspecting individual entries, updating or removing records, enabling or disabling records, and reading the DNS cache. Static entries can use either a name or a regular expression matching rule.

## Limitations and notes

Restoring a system backup triggers a MikroTik device reboot. Importing a configuration executes the supplied RouterOS script, while file upload is intended to support restore operations; these actions should be used with appropriate change controls.

The export-section operation accepts a RouterOS path without a leading slash. Its sensitivity option controls whether secrets are kept out of the generated output. DHCP filters use different matching behavior: address and identity filters are substring matches, while server, status, and lease-time filters are exact matches. DHCPv6 uses substring matching for address and DUID filters, with exact matching for IAID, server, status, and lifetime.

DHCP lease durations use RouterOS-style values such as `1d`, `12h`, `30m`, or `1h30m`. DHCP pool ranges use hyphen-separated addresses, and multiple ranges are comma-separated. DNS static entries configured with a regular expression cannot also specify a name.

_Full upstream README: https://allmcps.com/mcp/mikrotik-mcp/readme_