Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, email [email protected] and we’ll put it right.

MikroMCP

NPM · MIKROMCP · SCANNED AUG 3

MCP server for MikroTik RouterOS: typed tools, dry-run, RBAC, audit logs, and rollback.

Available components

+35 this week 80 Trust /100
Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security87
  • No malware found by supply-chain analysis.Pass
  • Only part of the dependency tree could be resolved (147 of 151), so this covers what we could see, not the whole tree.Partial
  • No install/post-install scripts declared.Pass
  • Only part of the dependency tree could be resolved (147 of 151), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency97
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to AliKarami/MikroMCP). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 12 days ago).Pass
  • Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability76
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 14616 tokens (~123/item across 118 items; 118 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
  • Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · mikromcp

# add to Claude Code
claude mcp add alikarami-mikromcp -- npx -y mikromcp
# add to Codex CLI
codex mcp add alikarami-mikromcp -- npx -y mikromcp
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "alikarami-mikromcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "mikromcp"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add alikarami-mikromcp --command npx --arg -y --arg mikromcp
# ~/.hermes/config.yaml
mcp_servers:
  alikarami-mikromcp:
    command: "npx"
    args: ["-y", "mikromcp"]
// mcp.json
{
  "mcpServers": {
    "alikarami-mikromcp": {
      "command": "npx",
      "args": [
        "-y",
        "mikromcp"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 3 Aug 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

  • 2 Aug 26 +59
    • Known CVEs: unverified → partial security
    • Install scripts: unverified → pass security
    • Provenance: unverified → pass security
    • Malware scan: unverified → pass security
    • The attested source repository moved: AliKarami/MikroMCP security
    • Security disclosure: fail → unverified functional
    • Tool coverage: 100 → unverified functional
    • Stability: unverified → 0.23 functional
    • MCP protocol: unverified → pass functional
    • Maintenance: unverified → pass functional
    • Dependency health: unverified → partial functional
    • License: unverified → pass functional
    • Schema quality: unverified → excellent functional
    • Licence: MIT functional
  • 1 Aug 26 −29
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 31 Jul 26 +24
    • Malware scan: pass → unverified security
    • Provenance: unverified → pass security
    • Install scripts: unverified → pass security
    • The attested source repository moved: AliKarami/MikroMCP security
    • Dependency health: partial → unverified functional
    • Maintenance: unverified → pass functional
    • License: unverified → pass functional
    • Tool coverage: unverified → 100 functional
    • Licence: MIT functional
  • 30 Jul 26 −20
    • Tool coverage: 100 → unverified functional
    • Dependency health: unverified → partial functional
    • First check of Schema quality: unverified functional
  • 27 Jul 26 45

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/[email protected]

Provenance verified

Ecosystem: npm · Outcome: verified

Reason: verified

Source repo:
AliKarami/MikroMCP
Certificate issuer:
https://token.actions.githubusercontent.com
Certificate SAN:
https://github.com/AliKarami/MikroMCP/.github/workflows/release.yml@refs/tags/v1.8.0
Rekor log index:
2210870027
Predicate type:
https://slsa.dev/provenance/v1
Subject digest:
sha512:0606b0b9ccc755a3356526c7727fe274df619ed9234e4e97d11be3beb86fe49d55a73a1b70129be6863c7d4f5985bc16828c8e4f98d100856bf2ba98c
Discovery method:
attestation_endpoint
Dependencies 147 packages

147 packages in the resolved dependency tree · 147 deprecated · 40 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 118 exposed · ~14,519 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens
apply_plan ~122

Execute write operations in order, stopping on first failure. Each step is snapshotted and journaled individually. Non-admin identities need a confirmationToken (same two-step flow as other destructive tools). Undo individual steps via rollback_change with the returned journal IDs.

NameTypeReqDescription
confirmationTokenstringToken from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
routerIdstringRouter ID; omit to use the default router.
stepsarrayyesOrdered list of write operations to apply in sequence

No output schema declared.

No examples provided.

bandwidth_test ~120

Run a RouterOS bandwidth test from the router to a remote host running a RouterOS btest server. Returns TX and RX throughput in Mbps. Duration capped at 20 seconds. Saturates the link — not auto-retried.

NameTypeReqDescription
addressstringyesRemote host running RouterOS btest server
directionstringTest direction
durationintegerTest duration in seconds (max 20)
protocolstringTest protocol
routerIdstringRouter ID; omit to use the default router.

No output schema declared.

No examples provided.

bulk_execute ~205

Fan out a single-router tool to many routers in parallel (up to `concurrency`), targeted by routerIds or tag. Destructive tools need two-step confirmation: call without `confirmationToken` to get a fleet token (needs MIKROMCP_CONFIRMATION_SECRET), then re-call with it. Writes snapshot+journal each router for rollback. Returns per-router results with succeeded/failed counts.

NameTypeReqDescription
concurrencyintegerMax simultaneous router calls
confirmationTokenstringFleet confirmation token from a prior APPROVAL_REQUIRED response. Required to fan out a destructive tool.
paramsobjectyesParams to pass to the tool (omit routerId — injected per router)
routerIdsarrayExplicit list of router IDs to target
tagsarrayTarget all routers with ALL of these tags (mutually exclusive with routerIds)
toolNamestringyesName of the tool to fan out (must be a single-router tool)

No output schema declared.

No examples provided.

check_router_health ~66

Probe a router by fetching system/resource. Returns health status, ROS version, uptime, CPU load, and memory info. Unlike other tools, this never throws — unreachable routers are reported as healthy=false.

NameTypeReqDescription
routerIdstringRouter ID; omit to use the default router.

No output schema declared.

No examples provided.

create_backup ~101

Create a binary configuration backup on a MikroTik router. The backup is saved as <name>.backup on the router's filesystem. Supports optional encryption via password and dry-run mode.

NameTypeReqDescription
dryRunbooleanPreview the backup without creating it
namestringBackup file name (without extension)
passwordstringPassword to encrypt the backup file
routerIdstringRouter ID; omit to use the default router.

No output schema declared.

No examples provided.

delete_file ~116

Delete a file from the router filesystem by name. Idempotent: returns not_found gracefully if the file does not exist.

NameTypeReqDescription
confirmationTokenstringToken from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
dryRunbooleanPreview deletion without removing the file
namestringyesExact file name on the router (e.g. flash/backup.backup)
routerIdstringRouter ID; omit to use the default router.

No output schema declared.

No examples provided.

export_config ~116

Export the router configuration as a RouterOS script. When no file is specified, returns the script text inline. When a file is specified, saves it as <file>.rsc on the router's filesystem. Supports compact mode to show only non-default values.

NameTypeReqDescription
compactbooleanExport only non-default settings (compact format)
filestringSave the export to a file on the router (without extension); omit to return inline
routerIdstringRouter ID; omit to use the default router.

No output schema declared.

No examples provided.

fetch_url ~141

Send an HTTP/HTTPS request from the router using /tool/fetch. Response body is returned inline (capped at 64 KB with [TRUNCATED] marker). Use outputFile to save to router filesystem instead. Not read-only: POSTs have side effects and outputFile writes to the router.

NameTypeReqDescription
httpDatastringRequest body for POST
methodstringHTTP method
outputFilestringSave response body to this router file path instead of returning inline
routerIdstringRouter ID; omit to use the default router.
urlstringyesURL to fetch from the router

No output schema declared.

No examples provided.

get_container_config ~44

Read global container configuration: registry URL, RAM high-water mark, and veth interface.

NameTypeReqDescription
routerIdstringRouter ID; omit to use the default router.

No output schema declared.

No examples provided.

get_dns_settings ~48

Read DNS resolver configuration: upstream servers, cache size, cache TTL, and whether remote DNS requests are allowed.

NameTypeReqDescription
routerIdstringRouter ID; omit to use the default router.

No output schema declared.

No examples provided.

get_file_content ~73

Read a text file's contents from a MikroTik router. Only suitable for text files — binary files will return garbled content.

NameTypeReqDescription
namestringyesExact file name on the router (e.g. flash/script.rsc)
routerIdstringRouter ID; omit to use the default router.

No output schema declared.

No examples provided.

get_log ~164

Read and filter the system log from a MikroTik router. Supports filtering by topic, message prefix, and a time window (last N minutes) measured against the router's own clock. Entries with unparseable timestamps are included conservatively.

NameTypeReqDescription
limitintegerMax results to return.
offsetintegerPagination offset.
prefixstringSubstring to match against the log message
routerIdstringRouter ID; omit to use the default router.
sinceMinutesintegerOnly return entries from the last N minutes (1–1440), measured against the router's clock
topicsarrayFilter entries whose topics field contains any of these strings (e.g. ["firewall", "dhcp"])

No output schema declared.

No examples provided.

get_ntp_settings ~38

Retrieve NTP client settings from a MikroTik router.

NameTypeReqDescription
routerIdstringRouter ID; omit to use the default router.

No output schema declared.

No examples provided.

get_ovpn_server ~52

Get the OpenVPN server configuration on a MikroTik router. Throws NOT_FOUND if the OpenVPN package is not installed.

NameTypeReqDescription
routerIdstringRouter ID; omit to use the default router.

No output schema declared.

No examples provided.

get_snmp_settings ~37

Retrieve SNMP settings from a MikroTik router.

NameTypeReqDescription
routerIdstringRouter ID; omit to use the default router.

No output schema declared.

No examples provided.

get_system_clock ~55

Read the current date, time, and timezone from a MikroTik router. Focused single-purpose alternative to the clock section in get_system_status.

NameTypeReqDescription
routerIdstringRouter ID; omit to use the default router.

No output schema declared.

No examples provided.

get_system_status ~66

Retrieve system status information from a MikroTik router including resource usage, identity, license, routerboard details, health sensors, and clock.

NameTypeReqDescription
routerIdstringRouter ID; omit to use the default router.
sectionsarrayWhich system information sections to include

No output schema declared.

No examples provided.

get_upgrade_status ~56

Read the current RouterOS package upgrade status and routerboard firmware versions. Shows installed version, latest available version, update channel, and firmware upgrade availability.

NameTypeReqDescription
routerIdstringRouter ID; omit to use the default router.

No output schema declared.

No examples provided.

list_address_list_entries ~73

List firewall address list entries on a MikroTik router. Supports filtering by list name and address.

NameTypeReqDescription
addressstringFilter by address (IP or CIDR)
liststringFilter by address list name
routerIdstringRouter ID; omit to use the default router.

No output schema declared.

No examples provided.

list_arp_entries ~91

List ARP table entries on a MikroTik router.

NameTypeReqDescription
addressstringFilter by IP address (substring match)
interfacestringFilter by interface (substring match)
limitintegerMax results to return.
macAddressstringFilter by MAC address (substring match)
routerIdstringRouter ID; omit to use the default router.

No output schema declared.

No examples provided.

list_bgp_peers ~76

List BGP sessions on a MikroTik router (RouterOS 7+). Returns state, remote AS, prefix counts, and uptime.

NameTypeReqDescription
routerIdstringRouter ID; omit to use the default router.
statestringFilter by session state (e.g. established, active, idle)

No output schema declared.

No examples provided.

list_bridges ~59

List bridge interfaces and their port members on a MikroTik router.

NameTypeReqDescription
limitintegerMax results to return.
offsetintegerPagination offset.
routerIdstringRouter ID; omit to use the default router.

No output schema declared.

No examples provided.

list_certificates ~75

List certificates on a MikroTik router.

NameTypeReqDescription
expiredbooleanFilter by expiry status; omit to return all
limitintegerMax results to return.
namestringFilter by certificate name (substring match)
routerIdstringRouter ID; omit to use the default router.

No output schema declared.

No examples provided.

list_connections ~114

List active connection tracking entries from the router firewall table. Filters are applied client-side. Useful for diagnosing NAT and firewall behavior.

NameTypeReqDescription
dstAddressstringFilter by destination address (substring match)
limitintegerMax results to return.
protocolstringFilter by protocol (exact match, e.g. tcp, udp, icmp)
routerIdstringRouter ID; omit to use the default router.
srcAddressstringFilter by source address (substring match)

No output schema declared.

No examples provided.

list_container_envs ~64

List container environment variable entries, optionally filtered by container name.

NameTypeReqDescription
limitintegerMax results to return.
namestringFilter by container name (exact match)
routerIdstringRouter ID; omit to use the default router.

No output schema declared.

No examples provided.

list_container_mounts ~68

List container volume mount definitions with source path, destination path, and mount name.

NameTypeReqDescription
limitintegerMax results to return.
namestringFilter by mount name (exact match)
routerIdstringRouter ID; omit to use the default router.

No output schema declared.

No examples provided.

list_containers ~40

List RouterOS container instances with status, image, and network information.

NameTypeReqDescription
routerIdstringRouter ID; omit to use the default router.

No output schema declared.

No examples provided.

list_dhcp_clients ~99

List DHCP client configurations on a MikroTik router. Shows which interfaces obtain their IP via DHCP, current status, and assigned address.

NameTypeReqDescription
interfacestringFilter by interface name (exact match)
limitintegerMax results to return.
offsetintegerPagination offset.
routerIdstringRouter ID; omit to use the default router.
statusstringFilter by DHCP client status

No output schema declared.

No examples provided.

list_dhcp_leases ~135

List DHCP leases on a MikroTik router with optional filtering by server, status, lease type (dynamic/static), and MAC address. Supports pagination.

NameTypeReqDescription
leaseTypestringFilter by lease type (dynamic or static)
limitintegerMax results to return.
macAddressstringFilter by MAC address (exact match, case-insensitive)
offsetintegerPagination offset.
routerIdstringRouter ID; omit to use the default router.
serverstringFilter by DHCP server name
statusstringFilter by lease status

No output schema declared.

No examples provided.

list_dhcp_servers ~70

List DHCP servers on a MikroTik router.

NameTypeReqDescription
interfacestringFilter by interface name (exact match)
limitintegerMax results to return.
offsetintegerPagination offset.
routerIdstringRouter ID; omit to use the default router.

No output schema declared.

No examples provided.

list_dns_entries ~87

List static DNS entries on a MikroTik router with optional filtering by name and type.

NameTypeReqDescription
limitintegerMax results to return.
namestringFilter by hostname (partial match)
offsetintegerPagination offset.
routerIdstringRouter ID; omit to use the default router.
typestringFilter by record type

No output schema declared.

No examples provided.

list_files ~75

List files on a MikroTik router filesystem. Supports filtering by name and type.

NameTypeReqDescription
namestringFilter by file name (substring match)
routerIdstringRouter ID; omit to use the default router.
typestringFilter by file type (e.g. script, backup, package)

No output schema declared.

No examples provided.

list_firewall_rules ~128

List firewall rules from the filter or nat table on a MikroTik router. Supports filtering by chain and disabled state, with pagination.

NameTypeReqDescription
chainstringFilter rules by chain name (e.g. forward, input, srcnat)
disabledstringFilter by disabled state: true, false, or all
limitintegerMax results to return.
offsetintegerPagination offset.
routerIdstringRouter ID; omit to use the default router.
tablestringFirewall table to query: filter or nat

No output schema declared.

No examples provided.

list_interface_lists ~46

List all interface lists defined on the router.

NameTypeReqDescription
limitintegerMax results to return.
routerIdstringRouter ID; omit to use the default router.

No output schema declared.

No examples provided.

list_interfaces ~131

List network interfaces on a MikroTik router with optional filtering by type and status. Supports pagination and optional traffic counters.

NameTypeReqDescription
includeCountersbooleanInclude traffic counters (tx-byte, rx-byte, etc.)
limitintegerMax results to return.
macAddressstringFilter by MAC address (case-insensitive exact match on mac-address field)
offsetintegerPagination offset.
routerIdstringRouter ID; omit to use the default router.
statusstringFilter by running status
typestringFilter by interface type

No output schema declared.

No examples provided.

list_ip_pools ~78

List IP address pools on a MikroTik router. Supports filtering by name and pagination.

NameTypeReqDescription
limitintegerMax results to return.
namestringFilter by pool name (substring match)
offsetintegerPagination offset.
routerIdstringRouter ID; omit to use the default router.

No output schema declared.

No examples provided.

list_ip_services ~121

List IP services on a MikroTik router (api, api-ssl, ssh, telnet, www, www-ssl, winbox, ftp) with their port numbers and enabled/disabled status.

NameTypeReqDescription
enabledbooleanWhen true, return only enabled services; when false, only disabled services
namestringFilter by service name (api, api-ssl, ssh, telnet, www, www-ssl, winbox, ftp)
routerIdstringRouter ID; omit to use the default router.

No output schema declared.

No examples provided.

list_ipsec_peers ~63

List IPSec peers on a MikroTik router.

NameTypeReqDescription
addressstringFilter by remote address (substring match)
limitintegerMax results to return.
routerIdstringRouter ID; omit to use the default router.

No output schema declared.

No examples provided.

list_ipsec_policies ~79

List IPSec policies on a MikroTik router.

NameTypeReqDescription
dstAddressstringFilter by destination address (substring match)
limitintegerMax results to return.
routerIdstringRouter ID; omit to use the default router.
srcAddressstringFilter by source address (substring match)

No output schema declared.

No examples provided.

list_log_actions ~78

List RouterOS logging action targets (system/logging/action) with optional type filter.

NameTypeReqDescription
limitintegerMax results to return.
routerIdstringRouter ID; omit to use the default router.
typestringFilter by action type (exact match): memory, disk, remote, echo, email

No output schema declared.

No examples provided.

list_log_rules ~89

List RouterOS logging rules (system/logging) with optional topic substring and action exact-match filtering.

NameTypeReqDescription
limitintegerMax results to return.
logActionstringFilter by log action target (exact match on action field)
routerIdstringRouter ID; omit to use the default router.
topicsstringFilter by topics (substring match)

No output schema declared.

No examples provided.

list_mangle_rules ~107

List firewall mangle rules on a MikroTik router in evaluation order. Supports filtering by chain, action, and disabled state.

NameTypeReqDescription
actionstringFilter by mangle action (e.g. mark-routing, mark-connection)
chainstringFilter by chain name (e.g. prerouting, forward, postrouting)
disabledbooleanFilter by disabled state
routerIdstringRouter ID; omit to use the default router.

No output schema declared.

No examples provided.

list_neighbors ~69

List discovered neighbors (CDP/LLDP/MNDP) on a MikroTik router.

NameTypeReqDescription
interfacestringFilter by interface name (substring match)
limitintegerMax results to return.
routerIdstringRouter ID; omit to use the default router.

No output schema declared.

No examples provided.

list_netwatch_entries ~73

List Netwatch monitoring entries on a MikroTik router.

NameTypeReqDescription
hoststringFilter by host (substring match)
limitintegerMax results to return.
routerIdstringRouter ID; omit to use the default router.
statusstringFilter by current status

No output schema declared.

No examples provided.

list_ospf_neighbors ~81

List OSPF neighbors on a MikroTik router (RouterOS 7+). Returns neighbor state, interface, DR/BDR, and uptime.

NameTypeReqDescription
routerIdstringRouter ID; omit to use the default router.
statestringFilter by neighbor state (e.g. full, 2-way, init)

No output schema declared.

No examples provided.

list_ovpn_clients ~69

List OpenVPN client interfaces on a MikroTik router. Shows name, remote server, and connection status.

NameTypeReqDescription
limitintegerMax results to return.
offsetintegerPagination offset.
routerIdstringRouter ID; omit to use the default router.

No output schema declared.

No examples provided.

list_packages ~50

List installed RouterOS packages with version and enabled status.

NameTypeReqDescription
namestringFilter by package name (exact match)
routerIdstringRouter ID; omit to use the default router.

No output schema declared.

No examples provided.

list_ppp_profiles ~66

List PPP profiles including the built-in default and default-encryption profiles.

NameTypeReqDescription
limitintegerMax results to return.
namestringFilter by profile name (exact match)
routerIdstringRouter ID; omit to use the default router.

No output schema declared.

No examples provided.

list_pppoe_clients ~99

List PPPoE client interfaces on a MikroTik router. Shows name, parent interface, ISP username, and connection status.

NameTypeReqDescription
interfacestringFilter by parent interface name (exact match)
limitintegerMax results to return.
offsetintegerPagination offset.
routerIdstringRouter ID; omit to use the default router.
statusstringFilter by running status

No output schema declared.

No examples provided.

list_queues ~60

List simple queues on a MikroTik router.

NameTypeReqDescription
limitintegerMax results to return.
routerIdstringRouter ID; omit to use the default router.
targetstringFilter by target address (substring match)

No output schema declared.

No examples provided.