MikroMCP

Execute write operations in order, stopping on first failure. Each step is snapshotted and journaled individually. Non-admin identities need a confirmationToken (same two-step flow as other destructive tools). Undo individual steps via rollback_change with the returned journal IDs.

Apply a switch config document (the format get_swos_config exports) to a SwOS switch. Plans every change against the switch first; dryRun defaults to true. Writes only the endpoints that change: the VLAN table grows first (new VLANs and members), then the per-port settings (VLAN, isolation, storm and flood control), port names/negotiation/enabled, LAG and SNMP, then the table shrinks (removed VLANs and members), then system — so no port loses its VLAN mid-apply. Refuses management changes (address, allow-from) unless includeManagement is true, and any plan that would cut a linked port off (its untagged VLAN moved or dropped, a trunk losing tagged VLANs or becoming an access port, a forced VLAN, a port that starts filtering VLANs, the port disabled, renegotiating, isolated from another linked port or moved in or out of a LAG, every linked port dropped from allow_from_ports; only risks the plan introduces) unless acceptLockoutRisk is true. All six endpoints are snapshotted before a real apply, so rollback_change restores the previous state; the result names any endpoint whose snapshot failed, and says so when none was recorded. A document that moves management to another VLAN (allow_from_vlan) and changes a port's VLAN settings or the VLAN table's membership at the same time is refused, because that cannot be written in a safe order (sys.b goes last and cuts the session): apply the VLAN changes first, then the move. `snmp.community` may reference only the secrets bound to the switch (its `secrets` list in routers.yaml); a switch without a list may reference none.

Run a RouterOS bandwidth test from the router to a remote host running a RouterOS btest server. Returns TX and RX throughput in Mbps. Duration capped at 20 seconds. Saturates the link — not auto-retried.

Fan out a single-router tool to many routers in parallel (up to `concurrency`), targeted by routerIds or tag. Write tools need two-step confirmation for every role: call without `confirmationToken` to get a fleet token, then re-call with it. Read-only tools fan out immediately. Writes snapshot+journal each router for rollback. Returns per-router results with succeeded/failed counts. To fan out a read-only tool, prefer bulk_read.

Fan out a read-only single-router tool (list_*, get_* and others annotated read-only) to many routers in parallel (up to `concurrency`), targeted by routerIds or tag. Unlike bulk_execute, the server refuses every write tool and the traffic-generating diagnostics (ping, traceroute, torch, bandwidth_test) with BULK_READ_TOOL_NOT_READ_ONLY, and never needs a confirmation token, snapshot or journal — so an MCP client can allow bulk_read without allowing fleet-wide writes. Use bulk_execute for anything else. Returns per-router results with succeeded/failed counts.

Probe a device: RouterOS routers via system/resource, SwOS switches via sys.b. Returns health status, firmware version, uptime, and (RouterOS only) CPU load and memory info. Unlike other tools, this never throws — unreachable devices are reported as healthy=false.

Create a binary configuration backup on a MikroTik router. The backup is saved as <name>.backup on the router's filesystem. To encrypt it, prefer passwordSecret (a MIKROMCP_SECRET_<NAME> bound to the router in routers.yaml — the password never reaches the conversation) over a literal password. Dry run checks that the secret resolves.

Delete a file from the router filesystem by name. Idempotent: returns not_found gracefully if the file does not exist.

Export the router configuration as a RouterOS script. When no file is specified, returns the script text inline. When a file is specified, saves it as <file>.rsc on the router's filesystem. Supports compact mode to show only non-default values.

Send an HTTP/HTTPS request from the router using /tool/fetch. Response body is returned inline (capped at 64 KB with [TRUNCATED] marker). Use outputFile to save to router filesystem instead. Not read-only: POSTs have side effects and outputFile writes to the router.

Read global container configuration: registry URL, RAM high-water mark, and veth interface.

Read DNS resolver configuration: upstream servers, cache size, cache TTL, and whether remote DNS requests are allowed.

Read a text file's contents from a MikroTik router. Only suitable for text files — binary files will return garbled content.

Read and filter the system log from a MikroTik router. Supports filtering by topic, message prefix, and a time window (last N minutes) measured against the router's own clock. Entries with unparseable timestamps are included conservatively.

Retrieve NTP client settings from a MikroTik router.

Get the OpenVPN server configuration on a MikroTik router. Throws NOT_FOUND if the OpenVPN package is not installed.

Retrieve SNMP settings from a MikroTik router.

Export a SwOS switch's configuration as one YAML document: system settings (including management access), every port's name, enabled state and VLAN settings, the VLAN table (full SwOS) and SNMP. The SNMP community is never exported. The document is the input format of apply_swos_config, so it doubles as a backup you can read and diff.

Fetch and decode a single SwOS '.b' endpoint (link.b, sys.b, poe.b, lacp.b, rstp.b, snmp.b, fwd.b, vlan.b, stats.b, sfp.b, host.b, acl.b, ...) as structured data. Unknown keys are preserved under '_raw'.

Retrieve status from a MikroTik SwOS switch (SwOS or SwOS Lite): identity, model, firmware, uptime, per-port link state/speed/duplex, PoE mode/state/power, and SFP modules.

Read the current date, time, and timezone from a MikroTik router. Focused single-purpose alternative to the clock section in get_system_status.

Retrieve system status information from a MikroTik router including resource usage, identity, license, routerboard details, health sensors, and clock.

Read the current RouterOS package upgrade status and routerboard firmware versions. Shows installed version, latest available version, update channel, and firmware upgrade availability.

List firewall address list entries on a MikroTik router. Supports filtering by list name and address.

List ARP table entries on a MikroTik router.

List BGP sessions on a MikroTik router (RouterOS 7+). Returns state, remote AS, prefix counts, and uptime.

List bridge port entries (interface membership, PVID, STP role and status) on a MikroTik router. Supports filtering by bridge and interface, with pagination.

List bridge interfaces and their port members on a MikroTik router.

List certificates on a MikroTik router.

List active connection tracking entries from the router firewall table. Filters are applied client-side. Useful for diagnosing NAT and firewall behavior.

List container environment variable entries, optionally filtered by container name.

List container volume mount definitions with source path, destination path, and mount name.

List RouterOS container instances with status, image, and network information.

List DHCP client configurations on a MikroTik router. Shows which interfaces obtain their IP via DHCP, current status, and assigned address.

List DHCP leases on a MikroTik router with optional filtering by server, status, lease type (dynamic/static), and MAC address. Supports pagination.

List DHCP servers on a MikroTik router.

List static DNS entries on a MikroTik router with optional filtering by name and type.

List files on a MikroTik router filesystem. Supports filtering by name and type.

List firewall rules from the filter or nat table on a MikroTik router. Supports filtering by chain and disabled state, with pagination.

List interface list memberships (which interface belongs to which list, e.g. WAN/LAN) on a MikroTik router. Supports filtering by list and interface, with pagination.

List all interface lists defined on the router.

List network interfaces on a MikroTik router with optional filtering by type and status. Supports pagination and optional traffic counters.

List IPv4 addresses assigned to interfaces on a MikroTik router, including dynamic ones (DHCP client, PPP). Supports filtering by interface and disabled state, with pagination.

List IP address pools on a MikroTik router. Supports filtering by name and pagination.

List IP services on a MikroTik router (api, api-ssl, ssh, telnet, www, www-ssl, winbox, ftp) with their port numbers and enabled/disabled status.

List IPSec peers on a MikroTik router.

List IPSec policies on a MikroTik router.

List recent entries from the server's write journal (write-journal.ndjson): every journaled write with its journalId, timestamp, tool, router, parameters (as redacted at write time), snapshot ids and outcome — newest first. Read-only. Use it to recover a lost journalId for rollback_change, or to audit what was written when. Only entries with rollbackable: true can be rolled back — dry runs and writes without snapshots (run_command, plan_changes) cannot.

List RouterOS logging action targets (system/logging/action) with optional type filter.

List RouterOS logging rules (system/logging) with optional topic substring and action exact-match filtering.