Server data from the Official MCP Registry
MCP server for MikroTik RouterOS: typed tools, dry-run, RBAC, audit logs, and rollback.
MCP server for MikroTik RouterOS: typed tools, dry-run, RBAC, audit logs, and rollback.
MikroMCP is a well-architected MCP server for RouterOS management with strong authentication, authorization, and safety controls. The codebase demonstrates good security practices including RBAC, audit logging, dry-run capabilities, and credential isolation. Minor code quality observations exist around error handling breadth and logging, but these do not constitute security vulnerabilities. Permissions are appropriate for the server's purpose of network device management. Supply chain analysis found 11 known vulnerabilities in dependencies (0 critical, 6 high severity). Package verification found 1 issue.
3 files analyzed ยท 15 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
This plugin requests these system permissions. Most are normal for its category.
Set these up before or after installing:
Environment variable: MIKROMCP_CONFIG_PATH
Environment variable: MIKROMCP_STDIO_IDENTITY
Environment variable: MIKROMCP_LOG_LEVEL
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-alikarami-mikromcp": {
"env": {
"MIKROMCP_LOG_LEVEL": "your-mikromcp-log-level-here",
"MIKROMCP_CONFIG_PATH": "your-mikromcp-config-path-here",
"MIKROMCP_STDIO_IDENTITY": "your-mikromcp-stdio-identity-here"
},
"args": [
"-y",
"mikromcp"
],
"command": "npx"
}
}
}From the project's GitHub README.
AI-native network automation for MikroTik RouterOS. MikroMCP exposes RouterOS as a typed, auditable Model Context Protocol server so Claude, Cursor, Codex, and other MCP clients can inspect, diagnose, and safely operate MikroTik routers in natural language.
MikroMCP exists because raw router CLI access is the wrong abstraction for AI agents. RouterOS is powerful, but asking an LLM to improvise shell commands against production network gear is risky. MikroMCP gives agents a controlled tool surface: strict schemas, idempotent writes, dry-run previews, per-router circuit breakers, retry policies, RBAC, audit logs, snapshots, and rollback-aware change workflows.
In one sentence: MikroMCP turns MikroTik RouterOS into a production-minded MCP control plane for AI infrastructure, DevOps automation, and modern router management.

| Instead of... | MikroMCP gives you... |
|---|---|
| Hand-written RouterOS CLI snippets from chat | Typed MCP tools with strict Zod validation |
| Blind config changes | Dry-run previews, idempotency checks, snapshots, and rollback tooling |
| One-off scripts per router | A multi-router registry with per-router credentials, tags, TLS, SSH, and maintenance windows |
| Raw network access for every assistant | RBAC identities, bearer tokens for HTTP mode, tool allowlists, and audit trails |
| Fragile troubleshooting workflows | Router-originated ping, traceroute, torch, logs, interfaces, DHCP, firewall, routes, WiFi, WireGuard, and more |
| Category | What MikroMCP covers |
|---|---|
| ๐งญ Router management | System status, clock, reboot, packages, files, scripts, scheduler jobs, containers |
| ๐ Network operations | Interfaces, VLANs, IP addresses, DHCP leases, DNS static records, bridge ports, WiFi clients |
| ๐ฅ Firewall and policy | Filter/NAT rules, mangle rules, address lists, route tables, routing rules |
| ๐ฐ๏ธ Routing visibility | Static routes, routing tables, BGP peers, OSPF neighbors |
| ๐ Secure access | HTTP bearer auth, bcrypt token hashes, RBAC, router/tool restrictions, confirmation tokens |
| ๐งช Diagnostics | Router-originated ping, traceroute, torch, log filtering, guarded SSH command execution |
| ๐ก๏ธ Change safety | Dry-run, idempotent writes, snapshots, write journal, plan_changes, apply_plan, rollback_change |
| โ๏ธ Production behavior | Retries for read tools, per-router circuit breakers, correlation IDs, structured logs, audit logs |
| ๐ค AI-agent fit | Human-readable responses plus structured JSON content for reasoning, chaining, and automation |
| ๐งฉ MCP compatibility | stdio for desktop clients, Streamable HTTP and legacy SSE for remote or service-style clients |

Recommended RouterOS policies for full tool coverage:
read, write, api, rest-api, test, ssh, sniff, ftp
sshis required forping,traceroute,torch, andrun_command.sniffis required bytorch.ftpis required only forupload_file.
npm (recommended)
npm install -g mikromcp
Standalone binaries
Download the binary for your platform from the latest GitHub release โ no Node.js required.
Docker
docker pull ghcr.io/alikarami/mikromcp:latest
Run the interactive setup wizard:
mikromcp init
The wizard will ask for your router details and write everything to ~/.mikromcp/:
~/.mikromcp/
โโโ routers.yaml # router registry
โโโ identities.yaml # RBAC identities (HTTP mode)
โโโ .env # credentials and runtime settings
~/.mikromcp/.env is loaded automatically every time MikroMCP starts โ no shell exports or Claude Desktop env blocks needed. Fill in the credentials it generates:
# ~/.mikromcp/.env (generated by mikromcp init)
ROUTER_CORE01_USER=
ROUTER_CORE01_PASS=
To edit your router registry directly:
nano ~/.mikromcp/routers.yaml
routers:
core-01:
host: "192.168.88.1"
port: 443
tls:
enabled: true
rejectUnauthorized: true
credentials:
source: "env"
envPrefix: "ROUTER_CORE01"
tags: ["core"]
rosVersion: "7"
mikromcp doctor
Doctor checks Node version, config files, router reachability, Claude Desktop registration, and whether a newer version is available.
stdio (for Claude Desktop and other desktop MCP clients)
mikromcp serve
HTTP mode (for service deployments)
MIKROMCP_TRANSPORT=http mikromcp serve
Run mikromcp init and choose Register with Claude Desktop โ it patches claude_desktop_config.json automatically.
Or add it manually to ~/Library/Application Support/Claude/claude_desktop_config.json on macOS:
{
"mcpServers": {
"mikromcp": {
"command": "mikromcp",
"args": ["serve"]
}
}
}
No env block needed โ credentials are loaded from ~/.mikromcp/.env at startup. Restart Claude Desktop, then ask:
Use MikroMCP to show CPU, memory, uptime, active interfaces, and warning logs for core-01.
HTTP mode is useful for service deployments and MCP clients that connect over a network endpoint.
Set in ~/.mikromcp/.env:
MIKROMCP_TRANSPORT=http
MIKROMCP_PORT=3000
MIKROMCP_CONFIRMATION_SECRET=<openssl rand -hex 32>
Then run:
mikromcp serve
Every HTTP request must include:
Authorization: Bearer <token>
Tokens are configured as bcrypt hashes in ~/.mikromcp/identities.yaml. Use mikromcp init to generate them.
docker run --rm \
-e MIKROMCP_TRANSPORT=http \
-e MIKROMCP_PORT=3000 \
-e MIKROMCP_CONFIRMATION_SECRET="$(openssl rand -hex 32)" \
-e ROUTER_CORE01_USER=mcp-api \
-e ROUTER_CORE01_PASS=your-router-password \
-e MIKROMCP_CONFIG_PATH=/config/routers.yaml \
-v "$HOME/.mikromcp:/config:ro" \
-p 3000:3000 \
ghcr.io/alikarami/mikromcp:latest
Pass MIKROMCP_CONFIG_PATH and MIKROMCP_IDENTITIES_PATH explicitly when running in Docker since ~/.mikromcp/ inside the container refers to the container's home directory.
All settings can be placed in ~/.mikromcp/.env or passed as environment variables. Values in ~/.mikromcp/.env are loaded at startup; explicit environment variables always take precedence.
| Variable | Default | Purpose |
|---|---|---|
MIKROMCP_TRANSPORT | stdio | stdio or http |
MIKROMCP_CONFIG_PATH | ~/.mikromcp/routers.yaml | Router registry path |
MIKROMCP_IDENTITIES_PATH | ~/.mikromcp/identities.yaml | Identity and bearer-token registry |
MIKROMCP_STDIO_IDENTITY | built-in superadmin | Named identity for stdio mode |
MIKROMCP_PORT | 3000 | HTTP transport port |
MIKROMCP_BIND_HOST | 127.0.0.1 | HTTP bind address |
MIKROMCP_CONFIRMATION_SECRET | unset | HMAC secret for destructive-action confirmation tokens |
MIKROMCP_AUDIT_LOG_PATH | unset | Optional NDJSON audit log file path |
MIKROMCP_DATA_DIR | ~/.mikromcp/data | Snapshots and write-journal directory |
MIKROMCP_HTTP_MAX_BODY_BYTES | 1048576 | HTTP request body cap |
MIKROMCP_HTTP_RATE_LIMIT_RPM | 60 | Requests per minute per IP; 0 disables rate limiting |
MIKROMCP_SSH_COMMAND_TIMEOUT_MS | 30000 | SSH command timeout |
MIKROMCP_SSH_MAX_OUTPUT_BYTES | 524288 | SSH output cap |
MIKROMCP_CMD_ALLOW | unset | Global allowlist patterns for run_command |
MIKROMCP_CMD_DENY | unset | Global denylist patterns for run_command |
ROUTER_<PREFIX>_USER | unset | Router username from envPrefix |
ROUTER_<PREFIX>_PASS | unset | Router password from envPrefix |
MikroMCP currently registers 77 MCP tools.
| Area | Tools |
|---|---|
| System | get_system_status, get_system_clock, set_system_clock, reboot |
| Interfaces and IP | list_interfaces, create_vlan, manage_ip_address |
| DHCP and DNS | list_dhcp_leases, list_dns_entries, manage_dns_entry, get_dns_settings |
| DHCP Servers & Pools | list_dhcp_servers, manage_dhcp_server, list_dhcp_pools, manage_dhcp_pool |
| Routing | list_routes, manage_route, list_routing_rules, manage_routing_rule, list_routing_tables, manage_routing_table |
| Routing protocols | list_bgp_peers, list_ospf_neighbors |
| Firewall | list_firewall_rules, manage_firewall_rule, list_mangle_rules, manage_mangle_rule, list_address_list_entries, manage_address_list_entry |
| Bridge, WiFi, WireGuard | list_bridges, manage_bridge, manage_bridge_port, list_wifi_interfaces, list_wifi_clients, manage_wifi_interface, list_wireguard_interfaces, list_wireguard_peers, manage_wireguard_peer |
| IPSec/VPN | list_ipsec_peers, list_ipsec_policies, manage_ipsec_peer |
| Certificates | list_certificates, manage_certificate |
| Users | list_users, manage_user |
| Queues/QoS | list_queues, manage_queue |
| VRRP | list_vrrp_instances, manage_vrrp_instance |
| SNMP & NTP | get_snmp_settings, get_ntp_settings |
| Netwatch | list_netwatch_entries, manage_netwatch_entry |
| Discovery & ARP | list_neighbors, list_arp_entries |
| Diagnostics | ping, traceroute, torch, get_log, run_command |
| Automation | list_scripts, manage_script, run_script, list_scheduled_jobs, manage_scheduled_job |
| Runtime | list_packages, manage_package, list_files, get_file_content, upload_file, list_containers, manage_container |
| Change management | plan_changes, apply_plan, rollback_change |
| Fleet operations | check_router_health, bulk_execute |
mindmap
root((MikroMCP tools))
Operations
System status
Logs
Clock
Reboot
Network
Interfaces
VLANs
DHCP
DNS
WiFi
WireGuard
Policy
Firewall
NAT
Mangle
Address lists
Routing rules
Automation
Scripts
Scheduler
Files
Containers
Safety
Plan changes
Apply plan
Rollback change
Use MikroMCP to inspect core-01. Summarize system resources, RouterOS version,
running interfaces, active routes, DNS settings, and recent warning/error logs.
Flag anything that looks operationally risky.
List firewall filter and NAT rules on edge-01. Identify disabled rules,
overlapping port forwards, broad accept rules, and anything without comments.
Do not change anything yet.
Dry-run a route on core-01 for 10.20.0.0/16 via 192.168.88.1 in the main table.
Show the exact planned diff and tell me whether an existing route conflicts.
Show WireGuard peers on branch-02. Sort by last handshake age and flag peers
that have not handshaken recently or have no transfer counters.
Check interface health on edge-01, then run ping and traceroute from the router
to 1.1.1.1. If packet loss is present, use torch on the WAN interface for a
short traffic snapshot.
Create a change plan that adds a DNS record and a firewall address-list entry
on edge-01. Use dry-run first, explain the plan, then wait for approval before
applying anything.
MCP gives LLMs a standard way to call tools. MikroMCP makes RouterOS a high-quality MCP target by turning network operations into well-described, machine-readable, permission-aware actions.
AI assistants can use MikroMCP to:
| Resource | Use it for |
|---|---|
| ROADMAP.md | Shipped milestones and planned work |
| Getting Started | Install, configure, and connect in 15 minutes |
| RouterOS API Setup | Enable the REST API, create a user, TLS and firewall |
| Configuration | Router registry, credentials, all environment variables |
| Connecting to Claude Desktop | Register MikroMCP in Claude Desktop |
| Connecting to AI Assistants | Claude Code, Cursor, Codex, HTTP/Docker/systemd |
| Available Tools | All 77 tools โ parameters and example prompts |
| Architecture | System layers, request pipeline, auth model |
| Error Handling | Error categories, retry engine, circuit breaker |
| Running | Run commands, HTTP transport, troubleshooting |
| Development | Project structure, tests, MCP Inspector workflow |
| Contributing | Adding tools, coding conventions, PR checklist |
npm run dev # tsx watch hot-reload
npm run build # build ESM output to dist/main.js
npm start # run built server
npm test # vitest + tsc + eslint
npm run format # Prettier
Key project paths:
| Path | Purpose |
|---|---|
src/main.ts | Loads ~/.mikromcp/.env and starts stdio or HTTP transport |
src/mcp/tool-registry.ts | Registers tools and applies auth, retry, circuit breaker, audit, snapshots, and credentials |
src/domain/tools/ | Tool definitions and handlers |
src/domain/snapshot/ | Snapshot, diff, and write-journal support |
src/adapter/rest-client.ts | RouterOS REST API client |
src/adapter/ssh-client.ts | SSH execution adapter for diagnostics and guarded commands |
src/config/router-registry.ts | Router inventory loader |
src/cli/init.ts | Interactive setup wizard (mikromcp init) |
src/cli/doctor.ts | Health check command (mikromcp doctor) |
config/routers.example.yaml | Example multi-router registry |
config/identities.example.yaml | Example RBAC identity registry |
| Milestone | Status | Focus |
|---|---|---|
| v0.1-v0.6 | โ Shipped | Foundation, core tools, diagnostics, services, firewall, routing, automation, files, containers |
| v0.7 | โ Shipped | Identity, bearer auth, RBAC, audit log, confirmation gate |
| v0.8 | โ Shipped | Snapshots, write journal, plan/apply, rollback, maintenance windows |
| v0.9 | โ Shipped | Fleet operations, IPSec, certificates, users, DHCP servers/pools, queues/QoS, VRRP, SNMP/NTP, Netwatch, discovery, ARP, health checks |
| v1.0 | โ Shipped | npm package, standalone binaries, Docker images, mikromcp init wizard, mikromcp doctor, ~/.mikromcp/ convention |
See ROADMAP.md for the complete milestone plan.
Issues, bug reports, tool requests, documentation improvements, and pull requests are welcome.
Good first contributions:
Development standards:
.js extensions.strict(), idempotency and dryRun for write toolsMikroMCPError for domain errors, focused Vitest coverage for every toolPlease open an issue before large changes so maintainers can align on scope.
MikroMCP controls real network devices. Treat it like an operations system.
~/.mikromcp/.env, not in YAML or shell history.allowedRouters and allowedToolPatterns.MIKROMCP_AUDIT_LOG_PATH) for shared or production use.dryRun: true before applying changes.For vulnerabilities or unsafe behavior, open a private security advisory or contact the maintainer before publishing details.
MikroMCP is released under the MIT License.
Be the first to review this server!
by Modelcontextprotocol ยท Developer Tools
Web content fetching and conversion for efficient LLM usage
by Modelcontextprotocol ยท Developer Tools
Read, search, and manipulate Git repositories programmatically
by Toleno ยท Developer Tools
Toleno Network MCP Server โ Manage your Toleno mining account with Claude AI using natural language.