# MikroMCP (npm · mikromcp)

MCP server for MikroTik RouterOS: typed tools, dry-run, RBAC, audit logs, and rollback.

- Trust score: 80/100 (high trust)
- Change this week: +35
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `mikromcp`: 80/100 (this document), [markdown](https://verifymcp.io/servers/alikarami-mikromcp/mikromcp.md), [page](https://verifymcp.io/servers/alikarami-mikromcp/mikromcp)

## Channel facts

- Registry: `npm`
- Package: `mikromcp`
- Version: `1.8.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (147 of 151), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (147 of 151), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to AliKarami/MikroMCP).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 12 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 76/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 14616 tokens (~123/item across 118 items; 118 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add alikarami-mikromcp -- npx -y mikromcp
```

### Codex

```bash
codex mcp add alikarami-mikromcp -- npx -y mikromcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "alikarami-mikromcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "mikromcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add alikarami-mikromcp --command npx --arg -y --arg mikromcp
```

### Hermes

```yaml
mcp_servers:
  alikarami-mikromcp:
    command: "npx"
    args: ["-y", "mikromcp"]
```

### Other

```json
{
  "mcpServers": {
    "alikarami-mikromcp": {
      "command": "npx",
      "args": [
        "-y",
        "mikromcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 80, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 79, +59)

- [security improvement] Known CVEs: unverified → partial
- [security improvement] Install scripts: unverified → pass
- [security improvement] Provenance: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [security] The attested source repository moved: AliKarami/MikroMCP
- [functional regression] Security disclosure: fail → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] License: unverified → pass
- [functional improvement] Schema quality: unverified → excellent
- [functional] Licence: MIT

### 2026-08-01 (score 20, −29)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-31 (score 49, +24)

- [security regression] Malware scan: pass → unverified
- [security improvement] Provenance: unverified → pass
- [security improvement] Install scripts: unverified → pass
- [security] The attested source repository moved: AliKarami/MikroMCP
- [functional regression] Dependency health: partial → unverified
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] License: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional] Licence: MIT

### 2026-07-30 (score 25, −20)

- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Dependency health: unverified → partial
- [functional] First check of Schema quality: unverified

### 2026-07-27 (score 45)

First indexed and scored.

## MCP tools (118)

### `get_system_status` (~66 tokens)

Get System Status

Retrieve system status information from a MikroTik router including resource usage, identity, license, routerboard details, health sensors, and clock.

Input parameters:

- `routerId` (string): Router ID; omit to use the default router.
- `sections` (array): Which system information sections to include

### `list_interfaces` (~131 tokens)

List Interfaces

List network interfaces on a MikroTik router with optional filtering by type and status. Supports pagination and optional traffic counters.

Input parameters:

- `includeCounters` (boolean): Include traffic counters (tx-byte, rx-byte, etc.)
- `limit` (integer): Max results to return.
- `macAddress` (string): Filter by MAC address (case-insensitive exact match on mac-address field)
- `offset` (integer): Pagination offset.
- `routerId` (string): Router ID; omit to use the default router.
- `status` (string): Filter by running status
- `type` (string): Filter by interface type

### `manage_ip_address` (~226 tokens)

Manage IP Address

Add, update, or remove an IP address on a MikroTik router interface. Performs idempotency checks for add operations and supports dry-run mode for all actions.

Input parameters:

- `action` (string, required): Action to perform: add, update, or remove an IP address
- `address` (string, required): IP address with optional prefix length in CIDR notation (e.g., 192.168.1.1/24). Defaults to /32 if prefix is omitted.
- `comment` (string): Optional comment for the IP address entry
- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `disabled` (boolean): Whether the IP address should be disabled
- `dryRun` (boolean): If true, validate and return planned changes without applying
- `interface` (string, required): Interface to assign the IP address to
- `network` (string): Network address (auto-calculated from address if omitted)
- `routerId` (string): Router ID; omit to use the default router.

### `list_dhcp_leases` (~135 tokens)

List DHCP Leases

List DHCP leases on a MikroTik router with optional filtering by server, status, lease type (dynamic/static), and MAC address. Supports pagination.

Input parameters:

- `leaseType` (string): Filter by lease type (dynamic or static)
- `limit` (integer): Max results to return.
- `macAddress` (string): Filter by MAC address (exact match, case-insensitive)
- `offset` (integer): Pagination offset.
- `routerId` (string): Router ID; omit to use the default router.
- `server` (string): Filter by DHCP server name
- `status` (string): Filter by lease status

### `manage_dhcp_lease` (~109 tokens)

Manage DHCP Lease

Convert a dynamic DHCP lease to static (make-static) or remove a lease. Idempotent by MAC address.

Input parameters:

- `action` (string, required): Action to perform: make-static converts a dynamic lease to static; remove deletes the lease
- `dryRun` (boolean): Preview changes without applying.
- `macAddress` (string, required): MAC address of the lease — idempotency key (case-insensitive)
- `routerId` (string): Router ID; omit to use the default router.

### `list_routes` (~92 tokens)

List Static Routes

List static routes on a MikroTik router with optional filtering by active status and dynamic status. Supports pagination.

Input parameters:

- `activeOnly` (boolean): Return only active routes
- `limit` (integer): Max results to return.
- `offset` (integer): Pagination offset.
- `routerId` (string): Router ID; omit to use the default router.
- `staticOnly` (boolean): Return only non-dynamic routes

### `manage_route` (~238 tokens)

Manage Static Route

Add or remove a static route on a MikroTik router. Performs idempotency checks for add operations and supports dry-run mode for all actions.

Input parameters:

- `action` (string, required): Action to perform: add or remove a route
- `comment` (string): Optional comment for the route
- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `disabled` (boolean): Whether the route should be disabled
- `distance` (integer): Route distance/metric (1-255)
- `dryRun` (boolean): If true, validate and return planned changes without applying
- `dstAddress` (string, required): Destination address in CIDR notation or plain IP (auto-converted to /32), e.g. 10.0.0.0/8 or 10.77.0.4
- `gateway` (string, required): Gateway IP address
- `routerId` (string): Router ID; omit to use the default router.
- `routingTable` (string): Routing table name (default: main). Use for policy routing with separate tables.

### `list_firewall_rules` (~128 tokens)

List Firewall Rules

List firewall rules from the filter or nat table on a MikroTik router. Supports filtering by chain and disabled state, with pagination.

Input parameters:

- `chain` (string): Filter rules by chain name (e.g. forward, input, srcnat)
- `disabled` (string): Filter by disabled state: true, false, or all
- `limit` (integer): Max results to return.
- `offset` (integer): Pagination offset.
- `routerId` (string): Router ID; omit to use the default router.
- `table` (string): Firewall table to query: filter or nat

### `manage_firewall_rule` (~323 tokens)

Manage Firewall Rule

Add, remove, disable, or enable a firewall rule on a MikroTik router. Uses comment as idempotency key for deduplication and identification. Supports dry-run mode.

Input parameters:

- `action` (string, required): Action to perform: add, remove, disable, or enable a firewall rule
- `chain` (string, required): Firewall chain (e.g. forward, input, output, srcnat, dstnat)
- `comment` (string): Comment to identify the rule (used as idempotency key)
- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `disabled` (boolean): Whether the rule should be disabled
- `dryRun` (boolean): If true, validate and return planned changes without applying
- `dstAddress` (string): Destination address or network
- `dstPort` (string): Destination port or range
- `inInterface` (string): Incoming interface
- `outInterface` (string): Outgoing interface
- `placeBefore` (string): Place the new rule before this rule ID
- `protocol` (string): Protocol to match
- `routerId` (string): Router ID; omit to use the default router.
- `ruleAction` (string, required): RouterOS rule action (e.g. accept, drop, reject, masquerade)
- `srcAddress` (string): Source address or network
- `srcPort` (string): Source port or range
- `table` (string): Firewall table to manage: filter or nat

### `ping` (~122 tokens)

Ping

Send ICMP echo requests from the router to a target address. Returns per-packet RTT and summary statistics. 100% packet loss is a valid result, not an error.

Input parameters:

- `address` (string, required): Target IP address or hostname to ping
- `count` (integer): Number of ICMP echo requests (1–20)
- `routerId` (string): Router ID; omit to use the default router.
- `routingTable` (string): Routing table to use for the ping
- `size` (integer): Packet size in bytes (14–65535)

### `traceroute` (~102 tokens)

Traceroute

Trace the network path from the router to a target address. Returns an ordered hop list with RTT per hop. Timeouts and partial results are valid responses.

Input parameters:

- `address` (string, required): Target IP address or hostname to trace
- `count` (integer): Probes per hop (1–5)
- `maxHops` (integer): Maximum number of hops (1–30)
- `routerId` (string): Router ID; omit to use the default router.

### `torch` (~123 tokens)

Torch

Capture a real-time traffic snapshot on a router interface. The tool call blocks for the duration (seconds) and returns top flows by bytes. readOnlyHint true — auto-retry enabled.

Input parameters:

- `dstAddress` (string): Filter by destination IP address
- `duration` (integer): Capture duration in seconds (1–30)
- `interface` (string, required): Interface name to monitor (e.g. ether1, bridge1)
- `routerId` (string): Router ID; omit to use the default router.
- `srcAddress` (string): Filter by source IP address

### `get_log` (~164 tokens)

Get Log

Read and filter the system log from a MikroTik router. Supports filtering by topic, message prefix, and a time window (last N minutes) measured against the router's own clock. Entries with unparseable timestamps are included conservatively.

Input parameters:

- `limit` (integer): Max results to return.
- `offset` (integer): Pagination offset.
- `prefix` (string): Substring to match against the log message
- `routerId` (string): Router ID; omit to use the default router.
- `sinceMinutes` (integer): Only return entries from the last N minutes (1–1440), measured against the router's clock
- `topics` (array): Filter entries whose topics field contains any of these strings (e.g. ["firewall", "dhcp"])

### `get_system_clock` (~55 tokens)

Get System Clock

Read the current date, time, and timezone from a MikroTik router. Focused single-purpose alternative to the clock section in get_system_status.

Input parameters:

- `routerId` (string): Router ID; omit to use the default router.

### `set_system_clock` (~145 tokens)

Set System Clock

Set the system date, time, and/or timezone on a MikroTik router. Idempotent: returns already_set if the values already match. Supports dry-run.

Input parameters:

- `date` (string): Date in RouterOS format: mon/dd/yyyy (e.g. jan/02/2006)
- `dryRun` (boolean): Preview changes without applying.
- `routerId` (string): Router ID; omit to use the default router.
- `time` (string): Time in RouterOS format: hh:mm:ss (e.g. 15:04:05)
- `timeZoneName` (string): IANA timezone name (e.g. Europe/London, UTC)

### `reboot` (~119 tokens)

Reboot

Trigger a controlled router reboot with an optional delay. Supports dry-run. Use this tool instead of run_command for reboots — run_command's deny list blocks /system reboot*.

Input parameters:

- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `delay` (integer): Seconds before rebooting (0–3600)
- `dryRun` (boolean): Preview the reboot without executing
- `routerId` (string): Router ID; omit to use the default router.

### `run_command` (~151 tokens)

Run Command

Execute an arbitrary RouterOS console command via SSH. Guarded by an allow/deny policy (built-in deny list blocks destructive commands; tighten via cmdAllow in routers.yaml or MIKROMCP_CMD_ALLOW). Prefer dedicated tools (reboot, etc.) where available. Output capped at 4000 characters.

Input parameters:

- `command` (string, required): RouterOS console command to execute
- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `dryRun` (boolean): Preview the command without executing (validates allow/deny policy only)
- `routerId` (string): Router ID; omit to use the default router.

### `list_bridges` (~59 tokens)

List Bridges

List bridge interfaces and their port members on a MikroTik router.

Input parameters:

- `limit` (integer): Max results to return.
- `offset` (integer): Pagination offset.
- `routerId` (string): Router ID; omit to use the default router.

### `manage_bridge` (~136 tokens)

Manage Bridge Interface

Create or remove a bridge interface on a MikroTik router. Idempotent: create returns already_exists if bridge with same name exists.

Input parameters:

- `action` (string, required): Action to perform
- `comment` (string): Optional comment
- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `disabled` (boolean): Whether the bridge should be disabled
- `dryRun` (boolean): Preview changes without applying.
- `name` (string, required): Bridge interface name
- `routerId` (string): Router ID; omit to use the default router.

### `manage_bridge_port` (~133 tokens)

Manage Bridge Port

Add or remove an interface from a bridge on a MikroTik router. Idempotent: add returns already_exists if the port assignment already exists.

Input parameters:

- `action` (string, required): Action to perform
- `bridge` (string, required): Bridge interface name
- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `dryRun` (boolean): Preview changes without applying.
- `interface` (string, required): Interface to add or remove as a bridge port
- `routerId` (string): Router ID; omit to use the default router.

### `list_wifi_interfaces` (~79 tokens)

List WiFi Interfaces

List WiFi/wireless interfaces on a MikroTik router. Uses /interface/wifi on ROS 7.x, /interface/wireless on older versions.

Input parameters:

- `limit` (integer): Max results to return.
- `offset` (integer): Pagination offset.
- `routerId` (string): Router ID; omit to use the default router.

### `list_wifi_clients` (~75 tokens)

List WiFi Clients

List currently connected WiFi clients (stations) with signal strength and transfer rates.

Input parameters:

- `interface` (string): Filter by WiFi interface name
- `limit` (integer): Max results to return.
- `offset` (integer): Pagination offset.
- `routerId` (string): Router ID; omit to use the default router.

### `manage_wifi_interface` (~144 tokens)

Manage WiFi Interface

Enable, disable, or update SSID settings on a WiFi interface. At least one of disabled or ssid must be provided.

Input parameters:

- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `disabled` (boolean): Set to true to disable, false to enable
- `dryRun` (boolean): Preview changes without applying.
- `name` (string, required): WiFi interface name (e.g. wifi1, wlan1)
- `routerId` (string): Router ID; omit to use the default router.
- `ssid` (string): New SSID to set

### `list_wireguard_interfaces` (~60 tokens)

List WireGuard Interfaces

List WireGuard interfaces and their status on a MikroTik router.

Input parameters:

- `limit` (integer): Max results to return.
- `offset` (integer): Pagination offset.
- `routerId` (string): Router ID; omit to use the default router.

### `list_wireguard_peers` (~73 tokens)

List WireGuard Peers

List WireGuard peers with last handshake time and transfer statistics.

Input parameters:

- `interface` (string): Filter by WireGuard interface name
- `limit` (integer): Max results to return.
- `offset` (integer): Pagination offset.
- `routerId` (string): Router ID; omit to use the default router.

### `manage_wireguard_peer` (~215 tokens)

Manage WireGuard Peer

Add or remove a WireGuard peer. Idempotent by public key: add returns already_exists if a peer with the same public key already exists on the interface.

Input parameters:

- `action` (string, required): Action to perform
- `allowedAddress` (string): Allowed IP address/CIDR for this peer (e.g. 10.0.0.2/32)
- `comment` (string): Optional comment
- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `dryRun` (boolean): Preview changes without applying.
- `endpoint` (string): Peer endpoint as IP:port (e.g. 1.2.3.4:51820)
- `interface` (string, required): WireGuard interface name (e.g. wg0)
- `publicKey` (string, required): Peer public key in base64 format (44 characters)
- `routerId` (string): Router ID; omit to use the default router.

### `manage_wireguard_interface` (~182 tokens)

Manage WireGuard Interface

Add, remove, enable, or disable a WireGuard interface. Idempotent by name. RouterOS generates the private key on create — it is never passed in. The public key is returned after creation.

Input parameters:

- `action` (string, required): Action to perform
- `comment` (string): Optional comment
- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `dryRun` (boolean): Preview changes without applying.
- `listenPort` (integer): UDP listen port (RouterOS picks one if omitted)
- `mtu` (integer): MTU (default 1420)
- `name` (string, required): Interface name — idempotency key (e.g. wg0)
- `routerId` (string): Router ID; omit to use the default router.

### `list_dns_entries` (~87 tokens)

List DNS Entries

List static DNS entries on a MikroTik router with optional filtering by name and type.

Input parameters:

- `limit` (integer): Max results to return.
- `name` (string): Filter by hostname (partial match)
- `offset` (integer): Pagination offset.
- `routerId` (string): Router ID; omit to use the default router.
- `type` (string): Filter by record type

### `manage_dns_entry` (~223 tokens)

Manage DNS Entry

Add or remove a static DNS entry. Idempotent by name+type: add returns already_exists if the same record already exists.

Input parameters:

- `action` (string, required): Action to perform
- `address` (string): IP address (required for A records)
- `cname` (string): Target hostname (required for CNAME records)
- `comment` (string): Optional comment
- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `disabled` (boolean): Whether the entry should be disabled
- `dryRun` (boolean): Preview changes without applying.
- `name` (string, required): Hostname for the DNS record (e.g. server.example.com)
- `routerId` (string): Router ID; omit to use the default router.
- `text` (string): Text value (required for TXT records)
- `ttl` (string): TTL value (e.g. 1d, 00:05:00)
- `type` (string): DNS record type

### `get_dns_settings` (~48 tokens)

Get DNS Settings

Read DNS resolver configuration: upstream servers, cache size, cache TTL, and whether remote DNS requests are allowed.

Input parameters:

- `routerId` (string): Router ID; omit to use the default router.

### `manage_dns_settings` (~210 tokens)

Manage DNS Settings

Update DNS resolver settings (upstream servers, cache size, cache TTL, allow-remote-requests). Idempotent: returns no_change if nothing differs.

Input parameters:

- `allowRemoteRequests` (boolean): Allow router to answer DNS queries from the network
- `cacheMaxTtl` (string): Maximum cache TTL (e.g. '1d', '00:30:00')
- `cacheSize` (integer): DNS cache size in KiB
- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `dryRun` (boolean): Preview changes without applying.
- `maxUdpPacketSize` (integer): Maximum UDP packet size in bytes
- `routerId` (string): Router ID; omit to use the default router.
- `servers` (string): Comma-separated upstream DNS server IPs (e.g. '8.8.8.8,1.1.1.1')

### `list_mangle_rules` (~107 tokens)

List Mangle Rules

List firewall mangle rules on a MikroTik router in evaluation order. Supports filtering by chain, action, and disabled state.

Input parameters:

- `action` (string): Filter by mangle action (e.g. mark-routing, mark-connection)
- `chain` (string): Filter by chain name (e.g. prerouting, forward, postrouting)
- `disabled` (boolean): Filter by disabled state
- `routerId` (string): Router ID; omit to use the default router.

### `manage_mangle_rule` (~336 tokens)

Manage Mangle Rule

Add, remove, enable, or disable a firewall mangle rule. Uses comment as idempotency key. Supports dry-run mode.

Input parameters:

- `action` (string, required): Action to perform
- `chain` (string): Mangle chain (required on add): prerouting, input, forward, output, postrouting
- `comment` (string, required): Idempotency key — uniquely identifies this mangle rule
- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `dryRun` (boolean): Preview changes without applying.
- `dstAddress` (string): Destination IP/CIDR to match
- `dstAddressList` (string): Destination address list name to match
- `dstPort` (string): Destination port or range
- `inInterface` (string): Incoming interface to match
- `newConnectionMark` (string): Connection mark to set
- `newDscpValue` (integer): DSCP value to set (0–63)
- `newRoutingMark` (string): Routing mark to set
- `outInterface` (string): Outgoing interface to match
- `passthrough` (boolean): Whether to continue matching subsequent rules
- `protocol` (string): Protocol to match (e.g. tcp, udp)
- `routerId` (string): Router ID; omit to use the default router.
- `srcAddress` (string): Source IP/CIDR to match
- `srcAddressList` (string): Source address list name to match
- `srcPort` (string): Source port or range

### `list_address_list_entries` (~73 tokens)

List Address List Entries

List firewall address list entries on a MikroTik router. Supports filtering by list name and address.

Input parameters:

- `address` (string): Filter by address (IP or CIDR)
- `list` (string): Filter by address list name
- `routerId` (string): Router ID; omit to use the default router.

### `manage_address_list_entry` (~167 tokens)

Manage Address List Entry

Add or remove a firewall address list entry. Idempotent by list name + address. Supports dry-run mode.

Input parameters:

- `action` (string, required): Action to perform
- `address` (string, required): IP address or CIDR to add/remove
- `comment` (string): Optional comment for the entry
- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `dryRun` (boolean): Preview changes without applying.
- `list` (string, required): Address list name
- `routerId` (string): Router ID; omit to use the default router.
- `timeout` (string): Expiry timeout (e.g. 1d, 2h30m) — omit for permanent

### `list_routing_rules` (~71 tokens)

List Routing Rules

List policy routing rules on a MikroTik router in evaluation order. Supports filtering by table and disabled state.

Input parameters:

- `disabled` (boolean): Filter by disabled state
- `routerId` (string): Router ID; omit to use the default router.
- `table` (string): Filter by routing table name

### `manage_routing_rule` (~190 tokens)

Manage Routing Rule

Add, remove, enable, or disable a policy routing rule. Idempotent by srcAddress+dstAddress+interface+table composite key. Supports dry-run mode.

Input parameters:

- `action` (string, required): Action to perform
- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `dryRun` (boolean): Preview changes without applying.
- `dstAddress` (string): Destination CIDR to match
- `interface` (string): Incoming interface to match
- `priority` (integer): Rule priority (0–4294967295)
- `routerId` (string): Router ID; omit to use the default router.
- `srcAddress` (string): Source CIDR to match
- `table` (string, required): Routing table name — part of the composite idempotency key; required for all actions

### `list_routing_tables` (~37 tokens)

List Routing Tables

List custom routing tables on a MikroTik router.

Input parameters:

- `routerId` (string): Router ID; omit to use the default router.

### `manage_routing_table` (~130 tokens)

Manage Routing Table

Create or remove a custom routing table. Idempotent by table name. Supports dry-run mode.

Input parameters:

- `action` (string, required): Action to perform
- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `dryRun` (boolean): Preview changes without applying.
- `fib` (boolean): Whether to sync this table with the FIB
- `name` (string, required): Routing table name (idempotency key)
- `routerId` (string): Router ID; omit to use the default router.

### `list_bgp_peers` (~76 tokens)

List BGP Peers

List BGP sessions on a MikroTik router (RouterOS 7+). Returns state, remote AS, prefix counts, and uptime.

Input parameters:

- `routerId` (string): Router ID; omit to use the default router.
- `state` (string): Filter by session state (e.g. established, active, idle)

### `list_ospf_neighbors` (~81 tokens)

List OSPF Neighbors

List OSPF neighbors on a MikroTik router (RouterOS 7+). Returns neighbor state, interface, DR/BDR, and uptime.

Input parameters:

- `routerId` (string): Router ID; omit to use the default router.
- `state` (string): Filter by neighbor state (e.g. full, 2-way, init)

### `list_scripts` (~54 tokens)

List Scripts

List RouterOS scripts on a MikroTik router. Supports optional name filter.

Input parameters:

- `name` (string): Filter by script name (substring match)
- `routerId` (string): Router ID; omit to use the default router.

### `manage_script` (~171 tokens)

Manage Script

Add, update, or remove a RouterOS script. Idempotent by name. add throws CONFLICT if the name already exists; update throws NOT_FOUND if it does not. Supports dry-run.

Input parameters:

- `action` (string, required): Action to perform
- `comment` (string): Optional comment
- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `dontRequirePermissions` (boolean): Allow script to run without elevated permissions
- `dryRun` (boolean): Preview changes without applying.
- `name` (string, required): Script name — idempotency key
- `routerId` (string): Router ID; omit to use the default router.
- `source` (string): Script body (required for add and update)

### `run_script` (~106 tokens)

Run Script

Execute a named RouterOS script. Fire-and-forget — the script runs asynchronously and its output is written to the router system log. Use get_log after calling this tool to see results.

Input parameters:

- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `name` (string, required): Name of the script to execute
- `routerId` (string): Router ID; omit to use the default router.

### `list_scheduled_jobs` (~62 tokens)

List Scheduled Jobs

List RouterOS scheduler entries on a MikroTik router with next-run time, interval, and disabled state.

Input parameters:

- `name` (string): Filter by job name (exact match)
- `routerId` (string): Router ID; omit to use the default router.

### `manage_scheduled_job` (~198 tokens)

Manage Scheduled Job

Add, update, remove, enable, or disable a RouterOS scheduler entry. Idempotent by name. add throws CONFLICT if name exists; update throws NOT_FOUND if it does not. Supports dry-run.

Input parameters:

- `action` (string, required): Action to perform
- `comment` (string): Optional comment
- `dryRun` (boolean): Preview changes without applying.
- `interval` (string): Run interval (e.g. 00:05:00 for every 5 minutes)
- `name` (string, required): Job name — idempotency key
- `onEvent` (string): Script name or inline command to run (required on add)
- `routerId` (string): Router ID; omit to use the default router.
- `startDate` (string): Start date (e.g. jan/01/2000)
- `startTime` (string): Start time (e.g. 00:00:00)

### `list_packages` (~50 tokens)

List Packages

List installed RouterOS packages with version and enabled status.

Input parameters:

- `name` (string): Filter by package name (exact match)
- `routerId` (string): Router ID; omit to use the default router.

### `manage_package` (~123 tokens)

Manage Package

Enable or disable a RouterOS package. Changes take effect only after a router reboot — use the reboot tool to apply. Idempotent: no-op if already in the target state.

Input parameters:

- `action` (string, required): Action to perform
- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `dryRun` (boolean): Preview changes without applying.
- `name` (string, required): Package name
- `routerId` (string): Router ID; omit to use the default router.

### `list_files` (~75 tokens)

List Files

List files on a MikroTik router filesystem. Supports filtering by name and type.

Input parameters:

- `name` (string): Filter by file name (substring match)
- `routerId` (string): Router ID; omit to use the default router.
- `type` (string): Filter by file type (e.g. script, backup, package)

### `get_file_content` (~73 tokens)

Get File Content

Read a text file's contents from a MikroTik router. Only suitable for text files — binary files will return garbled content.

Input parameters:

- `name` (string, required): Exact file name on the router (e.g. flash/script.rsc)
- `routerId` (string): Router ID; omit to use the default router.

### `upload_file` (~132 tokens)

Upload File

Upload a text file to a router, overwriting any existing file of the same name. Prefers SFTP (encrypted, over SSH) and falls back to plaintext FTP if SFTP is unavailable. Requires SSH (or FTP) access for the router user. Dry-run tests connectivity only.

Input parameters:

- `content` (string, required): File content to upload (text)
- `dryRun` (boolean): Validate FTP connectivity without writing the file
- `name` (string, required): Target filename on the router (e.g. flash/my-script.rsc)
- `routerId` (string): Router ID; omit to use the default router.

### `delete_file` (~116 tokens)

Delete File

Delete a file from the router filesystem by name. Idempotent: returns not_found gracefully if the file does not exist.

Input parameters:

- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `dryRun` (boolean): Preview deletion without removing the file
- `name` (string, required): Exact file name on the router (e.g. flash/backup.backup)
- `routerId` (string): Router ID; omit to use the default router.

### `list_containers` (~40 tokens)

List Containers

List RouterOS container instances with status, image, and network information.

Input parameters:

- `routerId` (string): Router ID; omit to use the default router.

### `manage_container` (~230 tokens)

Manage Container

Create, start, stop, or remove a RouterOS container. create needs a pre-configured veth interface; start/stop are no-ops when already in the target state; remove throws NOT_FOUND when absent. Supports dry-run.

Input parameters:

- `action` (string, required): Action to perform
- `comment` (string): Optional comment
- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `dryRun` (boolean): Preview changes without applying.
- `envlist` (string): RouterOS environment list name for container env vars
- `interface` (string): veth interface name to attach the container to (required on create — must be pre-configured in RouterOS)
- `name` (string, required): Container name — idempotency key
- `remoteImage` (string): Docker image to pull (required on create, e.g. alpine:latest)
- `rootDir` (string): Root directory for container files
- `routerId` (string): Router ID; omit to use the default router.

### `list_ipsec_peers` (~63 tokens)

List IPSec Peers

List IPSec peers on a MikroTik router.

Input parameters:

- `address` (string): Filter by remote address (substring match)
- `limit` (integer): Max results to return.
- `routerId` (string): Router ID; omit to use the default router.

### `list_ipsec_policies` (~79 tokens)

List IPSec Policies

List IPSec policies on a MikroTik router.

Input parameters:

- `dstAddress` (string): Filter by destination address (substring match)
- `limit` (integer): Max results to return.
- `routerId` (string): Router ID; omit to use the default router.
- `srcAddress` (string): Filter by source address (substring match)

### `manage_ipsec_peer` (~183 tokens)

Manage IPSec Peer

Add, remove, enable, or disable an IPSec peer. Idempotent by name: add returns already_exists if a peer with the same name and address already exists.

Input parameters:

- `action` (string, required): Action to perform
- `address` (string): Remote gateway address (required for add)
- `comment` (string): Optional comment
- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `dryRun` (boolean): Preview changes without applying.
- `exchange` (string): IKE exchange mode
- `localAddress` (string): Local address
- `name` (string, required): Peer name — idempotency key
- `profile` (string): IKE profile name
- `routerId` (string): Router ID; omit to use the default router.

### `manage_ipsec_policy` (~217 tokens)

Manage IPSec Policy

Add, remove, enable, or disable an IPSec policy. Idempotent by composite key (srcAddress + dstAddress + tunnel).

Input parameters:

- `action` (string, required): Action to perform
- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `dryRun` (boolean): Preview changes without applying.
- `dstAddress` (string, required): Destination CIDR — part of composite idempotency key
- `ipsecAction` (string): IPSec action (required for add)
- `level` (string): SA level
- `routerId` (string): Router ID; omit to use the default router.
- `saDstAddress` (string): SA destination IP for tunnel mode
- `saSourceAddress` (string): SA source IP for tunnel mode
- `srcAddress` (string, required): Source CIDR — part of composite idempotency key
- `tunnel` (boolean): Tunnel mode — part of composite idempotency key

### `list_certificates` (~75 tokens)

List Certificates

List certificates on a MikroTik router.

Input parameters:

- `expired` (boolean): Filter by expiry status; omit to return all
- `limit` (integer): Max results to return.
- `name` (string): Filter by certificate name (substring match)
- `routerId` (string): Router ID; omit to use the default router.

### `manage_certificate` (~117 tokens)

Manage Certificate

Remove, trust, or untrust a certificate. Idempotent: trust/untrust return early if already in the target state.

Input parameters:

- `action` (string, required): Action to perform
- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `dryRun` (boolean): Preview changes without applying.
- `name` (string, required): Certificate name — idempotency key
- `routerId` (string): Router ID; omit to use the default router.

### `list_users` (~65 tokens)

List Users

List local users on a MikroTik router. Passwords are never returned.

Input parameters:

- `group` (string): Filter by group name (exact match)
- `limit` (integer): Max results to return.
- `routerId` (string): Router ID; omit to use the default router.

### `manage_user` (~192 tokens)

Manage User

Add, remove, enable, disable, or set the password for a local RouterOS user. Idempotent by name: add returns already_exists if a user with the same name and group already exists.

Input parameters:

- `action` (string, required): Action to perform
- `address` (string): Allowed source address or range
- `comment` (string): Optional comment
- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `dryRun` (boolean): Preview changes without applying.
- `group` (string): Group name (required for add; e.g. 'read', 'write', 'full')
- `name` (string, required): Username — idempotency key
- `password` (string): Password (required for add and set-password)
- `routerId` (string): Router ID; omit to use the default router.

### `list_user_groups` (~47 tokens)

List User Groups

List local user groups on a MikroTik router.

Input parameters:

- `limit` (integer): Max results to return.
- `routerId` (string): Router ID; omit to use the default router.

### `manage_user_group` (~162 tokens)

Manage User Group

Add, update, or remove a local RouterOS user group. Idempotent by name: add returns already_exists if a group with the same name and policy already exists.

Input parameters:

- `action` (string, required): Action to perform
- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `dryRun` (boolean): Preview changes without applying.
- `name` (string, required): Group name — idempotency key
- `policy` (string): Comma-separated policy list (e.g. 'read,write,ftp')
- `routerId` (string): Router ID; omit to use the default router.
- `skin` (string): Optional skin name for the group

### `list_dhcp_servers` (~70 tokens)

List DHCP Servers

List DHCP servers on a MikroTik router.

Input parameters:

- `interface` (string): Filter by interface name (exact match)
- `limit` (integer): Max results to return.
- `offset` (integer): Pagination offset.
- `routerId` (string): Router ID; omit to use the default router.

### `manage_dhcp_server` (~192 tokens)

Manage DHCP Server

Add, remove, enable, or disable a DHCP server. Idempotent by name: add returns already_exists if a server with the same name, interface, and address pool already exists.

Input parameters:

- `action` (string, required): Action to perform
- `addressPool` (string): IP pool name (required for add)
- `comment` (string): Optional comment
- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `dryRun` (boolean): Preview changes without applying.
- `interface` (string): Interface to serve DHCP on (required for add)
- `leaseTime` (string): Lease duration (e.g. '1d', '12h')
- `name` (string, required): Server name — idempotency key
- `routerId` (string): Router ID; omit to use the default router.

### `list_ip_pools` (~78 tokens)

List IP Pools

List IP address pools on a MikroTik router. Supports filtering by name and pagination.

Input parameters:

- `limit` (integer): Max results to return.
- `name` (string): Filter by pool name (substring match)
- `offset` (integer): Pagination offset.
- `routerId` (string): Router ID; omit to use the default router.

### `manage_ip_pool` (~138 tokens)

Manage IP Pool

Add or remove an IP address pool. Idempotent by name: add returns already_exists if a pool with the same name and ranges already exists.

Input parameters:

- `action` (string, required): Action to perform
- `dryRun` (boolean): Preview changes without applying.
- `name` (string, required): Pool name — idempotency key
- `nextPool` (string): Next pool name for overflow
- `ranges` (string): IP range (e.g. '192.168.1.100-192.168.1.200'; required for add)
- `routerId` (string): Router ID; omit to use the default router.

### `list_queues` (~60 tokens)

List Queues

List simple queues on a MikroTik router.

Input parameters:

- `limit` (integer): Max results to return.
- `routerId` (string): Router ID; omit to use the default router.
- `target` (string): Filter by target address (substring match)

### `manage_queue` (~173 tokens)

Manage Queue

Add, remove, enable, or disable a simple queue. Idempotent by name: add returns already_exists if a queue with the same name and target already exists.

Input parameters:

- `action` (string, required): Action to perform
- `comment` (string): Optional comment
- `dryRun` (boolean): Preview changes without applying.
- `limitAt` (string): Guaranteed rate (e.g. '1M/1M')
- `maxLimit` (string): Max upload/download limit (e.g. '10M/10M')
- `name` (string, required): Queue name — idempotency key
- `routerId` (string): Router ID; omit to use the default router.
- `target` (string): Target address (required for add; e.g. '192.168.1.0/24')

### `list_vrrp_instances` (~64 tokens)

List VRRP Instances

List VRRP instances on a MikroTik router.

Input parameters:

- `interface` (string): Filter by master interface name (exact match)
- `limit` (integer): Max results to return.
- `routerId` (string): Router ID; omit to use the default router.

### `manage_vrrp_instance` (~207 tokens)

Manage VRRP Instance

Add, remove, enable, or disable a VRRP instance. Idempotent by name: add returns already_exists if an instance with the same name, interface, and VRID already exists.

Input parameters:

- `action` (string, required): Action to perform
- `comment` (string): Optional comment
- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `dryRun` (boolean): Preview changes without applying.
- `interface` (string): Master interface (required for add)
- `interval` (integer): Advertisement interval in seconds
- `name` (string, required): VRRP interface name — idempotency key
- `priority` (integer): Router priority (1–254)
- `routerId` (string): Router ID; omit to use the default router.
- `version` (string): VRRP protocol version
- `vrid` (integer): Virtual router ID (required for add)

### `get_snmp_settings` (~37 tokens)

Get SNMP Settings

Retrieve SNMP settings from a MikroTik router.

Input parameters:

- `routerId` (string): Router ID; omit to use the default router.

### `get_ntp_settings` (~38 tokens)

Get NTP Settings

Retrieve NTP client settings from a MikroTik router.

Input parameters:

- `routerId` (string): Router ID; omit to use the default router.

### `list_netwatch_entries` (~73 tokens)

List Netwatch Entries

List Netwatch monitoring entries on a MikroTik router.

Input parameters:

- `host` (string): Filter by host (substring match)
- `limit` (integer): Max results to return.
- `routerId` (string): Router ID; omit to use the default router.
- `status` (string): Filter by current status

### `manage_netwatch_entry` (~164 tokens)

Manage Netwatch Entry

Add, remove, enable, or disable a Netwatch monitoring entry. Idempotent by host+port: add returns already_exists if an entry with the same host and port already exists.

Input parameters:

- `action` (string, required): Action to perform
- `comment` (string): Optional comment
- `dryRun` (boolean): Preview changes without applying.
- `host` (string, required): Host to monitor — idempotency key
- `interval` (string): Check interval (e.g. '1m'; default '1m')
- `port` (integer): TCP port (optional; ICMP if omitted)
- `routerId` (string): Router ID; omit to use the default router.
- `timeout` (string): Probe timeout (e.g. '500ms')

### `list_neighbors` (~69 tokens)

List Neighbors

List discovered neighbors (CDP/LLDP/MNDP) on a MikroTik router.

Input parameters:

- `interface` (string): Filter by interface name (substring match)
- `limit` (integer): Max results to return.
- `routerId` (string): Router ID; omit to use the default router.

### `list_arp_entries` (~91 tokens)

List ARP Entries

List ARP table entries on a MikroTik router.

Input parameters:

- `address` (string): Filter by IP address (substring match)
- `interface` (string): Filter by interface (substring match)
- `limit` (integer): Max results to return.
- `macAddress` (string): Filter by MAC address (substring match)
- `routerId` (string): Router ID; omit to use the default router.

### `manage_ntp_client` (~116 tokens)

Manage NTP Client

Update NTP client settings on a MikroTik router. Idempotent: returns already_set if no changes are needed.

Input parameters:

- `dryRun` (boolean): Preview changes without applying.
- `enabled` (boolean): Enable or disable the NTP client
- `mode` (string): NTP client mode
- `routerId` (string): Router ID; omit to use the default router.
- `servers` (string): Comma-separated NTP server addresses
- `vlanInterface` (string): VLAN interface for NTP communication

### `manage_vlan` (~232 tokens)

Manage VLAN Interface

Add, remove, enable, or disable a VLAN interface. Idempotent by name: add returns already_exists when a VLAN with matching name, vlan-id, and parent interface exists. Supports dry-run mode.

Input parameters:

- `action` (string, required): Action to perform
- `comment` (string): Optional comment (add only)
- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `disabled` (boolean): Whether to create the VLAN disabled (add only)
- `dryRun` (boolean): Preview changes without applying.
- `mtu` (integer): MTU size (add only)
- `name` (string, required): VLAN interface name — idempotency key (alphanumeric, hyphens, underscores, max 15 chars)
- `parentInterface` (string): Parent interface name (e.g., ether1, bridge1; required for add)
- `routerId` (string): Router ID; omit to use the default router.
- `vlanId` (integer): VLAN ID (1-4094; required for add)

### `list_dhcp_clients` (~99 tokens)

List DHCP Clients

List DHCP client configurations on a MikroTik router. Shows which interfaces obtain their IP via DHCP, current status, and assigned address.

Input parameters:

- `interface` (string): Filter by interface name (exact match)
- `limit` (integer): Max results to return.
- `offset` (integer): Pagination offset.
- `routerId` (string): Router ID; omit to use the default router.
- `status` (string): Filter by DHCP client status

### `manage_dhcp_client` (~209 tokens)

Manage DHCP Client

Add, remove, enable, or disable a DHCP client on an interface. Idempotent by interface name: add returns already_exists if a DHCP client is already configured on the same interface.

Input parameters:

- `action` (string, required): Action to perform
- `addDefaultRoute` (boolean): Add default route from DHCP (add only)
- `comment` (string): Optional comment (add only)
- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `dryRun` (boolean): Preview changes without applying.
- `interface` (string, required): Interface name — idempotency key (e.g. ether1, ether2)
- `routerId` (string): Router ID; omit to use the default router.
- `usePeerDns` (boolean): Use DNS servers provided by DHCP server (add only)
- `usePeerNtp` (boolean): Use NTP servers provided by DHCP server (add only)

### `list_ip_services` (~121 tokens)

List IP Services

List IP services on a MikroTik router (api, api-ssl, ssh, telnet, www, www-ssl, winbox, ftp) with their port numbers and enabled/disabled status.

Input parameters:

- `enabled` (boolean): When true, return only enabled services; when false, only disabled services
- `name` (string): Filter by service name (api, api-ssl, ssh, telnet, www, www-ssl, winbox, ftp)
- `routerId` (string): Router ID; omit to use the default router.

### `manage_ip_service` (~168 tokens)

Manage IP Service

Enable or disable a RouterOS IP service (api, api-ssl, ssh, telnet, www, www-ssl, winbox, ftp). Port number changes are intentionally not supported to prevent accidental lockout.

Input parameters:

- `action` (string, required): Action to perform — only enable/disable to prevent accidental lockout from changing ports
- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `dryRun` (boolean): Preview changes without applying.
- `name` (string, required): Service name to manage (api, api-ssl, ssh, telnet, www, www-ssl, winbox, ftp)
- `routerId` (string): Router ID; omit to use the default router.

### `list_pppoe_clients` (~99 tokens)

List PPPoE Clients

List PPPoE client interfaces on a MikroTik router. Shows name, parent interface, ISP username, and connection status.

Input parameters:

- `interface` (string): Filter by parent interface name (exact match)
- `limit` (integer): Max results to return.
- `offset` (integer): Pagination offset.
- `routerId` (string): Router ID; omit to use the default router.
- `status` (string): Filter by running status

### `manage_pppoe_client` (~267 tokens)

Manage PPPoE Client

Add, update, or remove a PPPoE client interface. Idempotent by name (already_exists on matching name+interface+user; CONFLICT on differing config; no_change when an update differs in nothing). Password is always written when provided since RouterOS does not return it on GET.

Input parameters:

- `action` (string, required): Action to perform
- `addDefaultRoute` (boolean): Add default route via PPPoE (yes/no)
- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `dialOnDemand` (boolean): Dial on demand instead of always-on (yes/no)
- `dryRun` (boolean): Preview changes without applying.
- `interface` (string): Parent interface (required for add)
- `name` (string, required): PPPoE client interface name — idempotency key (e.g. pppoe-wan)
- `password` (string): PPPoE password (never logged)
- `routerId` (string): Router ID; omit to use the default router.
- `serviceName` (string): PPPoE service name filter (leave empty to match any)
- `user` (string): PPPoE username (required for add)

### `list_ovpn_clients` (~69 tokens)

List OpenVPN Clients

List OpenVPN client interfaces on a MikroTik router. Shows name, remote server, and connection status.

Input parameters:

- `limit` (integer): Max results to return.
- `offset` (integer): Pagination offset.
- `routerId` (string): Router ID; omit to use the default router.

### `manage_ovpn_client` (~230 tokens)

Manage OpenVPN Client

Add, update, or remove an OpenVPN client interface. Idempotent by name (already_exists on matching name+connectTo; CONFLICT on differing connectTo; no_change when an update differs in nothing). Password is always written when provided since RouterOS does not return it on GET.

Input parameters:

- `action` (string, required): Action to perform
- `certificate` (string): Client certificate name
- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `connectTo` (string): Remote server address (required for add)
- `dryRun` (boolean): Preview changes without applying.
- `mode` (string): Tunnel mode
- `name` (string, required): OpenVPN client interface name — idempotency key
- `password` (string): VPN password (never logged)
- `port` (integer): Remote port number
- `protocol` (string): Transport protocol
- `routerId` (string): Router ID; omit to use the default router.
- `user` (string): VPN username

### `get_ovpn_server` (~52 tokens)

Get OpenVPN Server

Get the OpenVPN server configuration on a MikroTik router. Throws NOT_FOUND if the OpenVPN package is not installed.

Input parameters:

- `routerId` (string): Router ID; omit to use the default router.

### `manage_ovpn_server` (~197 tokens)

Manage OpenVPN Server

Enable, disable, or configure the OpenVPN server (a per-router singleton). Throws NOT_FOUND if the OpenVPN package is not installed. The set action requires at least one configuration field.

Input parameters:

- `action` (string, required): Action to perform
- `auth` (string): Authentication algorithm (set action only)
- `certificate` (string): Server certificate name (set action only)
- `cipher` (string): Encryption cipher (set action only)
- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `dryRun` (boolean): Preview changes without applying.
- `mode` (string): Tunnel mode (set action only)
- `port` (integer): Listening port (set action only)
- `protocol` (string): Transport protocol (set action only)
- `routerId` (string): Router ID; omit to use the default router.

### `list_ppp_profiles` (~66 tokens)

List PPP Profiles

List PPP profiles including the built-in default and default-encryption profiles.

Input parameters:

- `limit` (integer): Max results to return.
- `name` (string): Filter by profile name (exact match)
- `routerId` (string): Router ID; omit to use the default router.

### `manage_ppp_profile` (~207 tokens)

Manage PPP Profile

Add, update, or remove a PPP profile. Idempotent by name. update returns no_change when requested values match. Built-in profiles (default, default-encryption) cannot be removed — RouterOS blocks this and the error is surfaced.

Input parameters:

- `action` (string, required): Action to perform
- `comment` (string): Optional comment
- `dnsServer` (string): DNS server IP pushed to client
- `dryRun` (boolean): Preview changes without applying.
- `localAddress` (string): Local IP assigned to router end of PPP link
- `name` (string, required): Profile name — idempotency key
- `rateLimit` (string): Rate limit string (e.g. '10M/10M')
- `remoteAddress` (string): IP or pool name assigned to client
- `routerId` (string): Router ID; omit to use the default router.
- `sessionTimeout` (string): Session timeout duration string (e.g. '1h')

### `get_upgrade_status` (~56 tokens)

Get Upgrade Status

Read the current RouterOS package upgrade status and routerboard firmware versions. Shows installed version, latest available version, update channel, and firmware upgrade availability.

Input parameters:

- `routerId` (string): Router ID; omit to use the default router.

### `manage_upgrade` (~136 tokens)

Manage Upgrade

Trigger a RouterOS package update check or install. 'check' queries the update server for new packages. 'install' downloads and applies the update — the router will reboot automatically. Supports dry-run.

Input parameters:

- `action` (string, required): check — trigger a check for available updates; install — download and install the latest update (triggers reboot)
- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `dryRun` (boolean): Preview the action without executing
- `routerId` (string): Router ID; omit to use the default router.

### `create_backup` (~101 tokens)

Create Backup

Create a binary configuration backup on a MikroTik router. The backup is saved as <name>.backup on the router's filesystem. Supports optional encryption via password and dry-run mode.

Input parameters:

- `dryRun` (boolean): Preview the backup without creating it
- `name` (string): Backup file name (without extension)
- `password` (string): Password to encrypt the backup file
- `routerId` (string): Router ID; omit to use the default router.

### `export_config` (~116 tokens)

Export Config

Export the router configuration as a RouterOS script. When no file is specified, returns the script text inline. When a file is specified, saves it as <file>.rsc on the router's filesystem. Supports compact mode to show only non-default values.

Input parameters:

- `compact` (boolean): Export only non-default settings (compact format)
- `file` (string): Save the export to a file on the router (without extension); omit to return inline
- `routerId` (string): Router ID; omit to use the default router.

### `list_log_rules` (~89 tokens)

List Log Rules

List RouterOS logging rules (system/logging) with optional topic substring and action exact-match filtering.

Input parameters:

- `limit` (integer): Max results to return.
- `logAction` (string): Filter by log action target (exact match on action field)
- `routerId` (string): Router ID; omit to use the default router.
- `topics` (string): Filter by topics (substring match)

### `manage_log_rule` (~159 tokens)

Manage Log Rule

Add, remove, enable, or disable a RouterOS logging rule. Idempotent by topics+logAction (add → already_exists on match; remove → not_found handled gracefully; enable/disable throw NOT_FOUND when absent). Supports dry-run.

Input parameters:

- `action` (string, required): Action to perform
- `dryRun` (boolean): Preview changes without applying.
- `logAction` (string, required): Log action target name (RouterOS action field) — idempotency key
- `prefix` (string): Optional prefix to prepend to log messages
- `routerId` (string): Router ID; omit to use the default router.
- `topics` (string, required): Log topics (e.g. firewall, system, info) — idempotency key

### `list_log_actions` (~78 tokens)

List Log Actions

List RouterOS logging action targets (system/logging/action) with optional type filter.

Input parameters:

- `limit` (integer): Max results to return.
- `routerId` (string): Router ID; omit to use the default router.
- `type` (string): Filter by action type (exact match): memory, disk, remote, echo, email

### `manage_log_action` (~183 tokens)

Manage Log Action

Add or remove a RouterOS logging action target. Idempotent by name. add throws VALIDATION if type is missing; returns already_exists if name found. remove returns not_found gracefully. Supports dry-run.

Input parameters:

- `action` (string, required): Action to perform
- `diskFileName` (string): Disk log file name without extension (for type=disk)
- `dryRun` (boolean): Preview changes without applying.
- `name` (string, required): Log action name — idempotency key
- `remote` (string): Remote syslog server address (for type=remote)
- `remotePort` (integer): Remote syslog server port (for type=remote)
- `routerId` (string): Router ID; omit to use the default router.
- `type` (string): Action type: memory, disk, remote, echo, email (required on add)

### `bandwidth_test` (~120 tokens)

Bandwidth Test

Run a RouterOS bandwidth test from the router to a remote host running a RouterOS btest server. Returns TX and RX throughput in Mbps. Duration capped at 20 seconds. Saturates the link — not auto-retried.

Input parameters:

- `address` (string, required): Remote host running RouterOS btest server
- `direction` (string): Test direction
- `duration` (integer): Test duration in seconds (max 20)
- `protocol` (string): Test protocol
- `routerId` (string): Router ID; omit to use the default router.

### `fetch_url` (~141 tokens)

Fetch URL

Send an HTTP/HTTPS request from the router using /tool/fetch. Response body is returned inline (capped at 64 KB with [TRUNCATED] marker). Use outputFile to save to router filesystem instead. Not read-only: POSTs have side effects and outputFile writes to the router.

Input parameters:

- `httpData` (string): Request body for POST
- `method` (string): HTTP method
- `outputFile` (string): Save response body to this router file path instead of returning inline
- `routerId` (string): Router ID; omit to use the default router.
- `url` (string, required): URL to fetch from the router

### `list_connections` (~114 tokens)

List Connections

List active connection tracking entries from the router firewall table. Filters are applied client-side. Useful for diagnosing NAT and firewall behavior.

Input parameters:

- `dstAddress` (string): Filter by destination address (substring match)
- `limit` (integer): Max results to return.
- `protocol` (string): Filter by protocol (exact match, e.g. tcp, udp, icmp)
- `routerId` (string): Router ID; omit to use the default router.
- `srcAddress` (string): Filter by source address (substring match)

### `get_container_config` (~44 tokens)

Get Container Config

Read global container configuration: registry URL, RAM high-water mark, and veth interface.

Input parameters:

- `routerId` (string): Router ID; omit to use the default router.

### `manage_container_config` (~96 tokens)

Manage Container Config

Update global container settings. Idempotent: returns no_change if nothing differs.

Input parameters:

- `dryRun` (boolean): Preview changes without applying.
- `ramHighMb` (integer): RAM high-water mark in MB
- `registryUrl` (string): Container registry URL
- `routerId` (string): Router ID; omit to use the default router.
- `vethInterface` (string): Veth interface name for container networking

### `list_container_envs` (~64 tokens)

List Container Envs

List container environment variable entries, optionally filtered by container name.

Input parameters:

- `limit` (integer): Max results to return.
- `name` (string): Filter by container name (exact match)
- `routerId` (string): Router ID; omit to use the default router.

### `manage_container_env` (~125 tokens)

Manage Container Env

Add or remove a container environment variable. Idempotent by name+key. add returns already_exists if the entry exists with the same value; throws CONFLICT if the value differs.

Input parameters:

- `action` (string, required): Action to perform
- `dryRun` (boolean): Preview changes without applying.
- `key` (string, required): Environment variable name — part of idempotency key
- `name` (string, required): Container name
- `routerId` (string): Router ID; omit to use the default router.
- `value` (string): Environment variable value (required for add)

### `list_container_mounts` (~68 tokens)

List Container Mounts

List container volume mount definitions with source path, destination path, and mount name.

Input parameters:

- `limit` (integer): Max results to return.
- `name` (string): Filter by mount name (exact match)
- `routerId` (string): Router ID; omit to use the default router.

### `manage_container_mount` (~128 tokens)

Manage Container Mount

Add or remove a container volume mount. Idempotent by name: add returns already_exists if the mount exists with matching src/dst; throws CONFLICT if name exists with different paths.

Input parameters:

- `action` (string, required): Action to perform
- `dryRun` (boolean): Preview changes without applying.
- `dst` (string): Container destination path (required for add)
- `name` (string, required): Mount name — idempotency key
- `routerId` (string): Router ID; omit to use the default router.
- `src` (string): Host source path (required for add)

### `list_interface_lists` (~46 tokens)

List Interface Lists

List all interface lists defined on the router.

Input parameters:

- `limit` (integer): Max results to return.
- `routerId` (string): Router ID; omit to use the default router.

### `manage_interface_list` (~134 tokens)

Manage Interface List

Add or remove an interface list. Idempotent by name. Removing a list that has members is blocked by RouterOS — the error is surfaced as-is.

Input parameters:

- `action` (string, required): Action to perform
- `comment` (string): Optional comment
- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `dryRun` (boolean): Preview changes without applying.
- `name` (string, required): Interface list name — idempotency key
- `routerId` (string): Router ID; omit to use the default router.

### `manage_interface_list_member` (~161 tokens)

Manage Interface List Member

Add or remove an interface from an interface list. Idempotent by list+interface composite key. add returns already_exists if the membership exists. remove returns not_found gracefully.

Input parameters:

- `action` (string, required): Action to perform
- `comment` (string): Optional comment
- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `dryRun` (boolean): Preview changes without applying.
- `interface` (string, required): Interface name to add/remove — part of composite idempotency key
- `list` (string, required): Interface list name — part of composite idempotency key
- `routerId` (string): Router ID; omit to use the default router.

### `plan_changes` (~83 tokens)

Plan Changes

Preview a sequence of write operations: each step runs with dryRun=true against live state, returning affected paths and the predicted action per step. Use apply_plan to execute the same steps for real.

Input parameters:

- `routerId` (string): Router ID; omit to use the default router.
- `steps` (array, required): Ordered list of write operations to preview (up to 10)

### `apply_plan` (~122 tokens)

Apply Plan

Execute write operations in order, stopping on first failure. Each step is snapshotted and journaled individually. Non-admin identities need a confirmationToken (same two-step flow as other destructive tools). Undo individual steps via rollback_change with the returned journal IDs.

Input parameters:

- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `routerId` (string): Router ID; omit to use the default router.
- `steps` (array, required): Ordered list of write operations to apply in sequence

### `rollback_change` (~145 tokens)

Rollback Change

Restore RouterOS state to before a write, identified by its journal ID: reads the before-snapshot, diffs against live state, and applies the reverse. Use dryRun=true to preview the restore plan. Requires MIKROMCP_DATA_DIR (defaults to data/).

Input parameters:

- `confirmationToken` (string): Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
- `dryRun` (boolean): Preview the restore plan without applying changes
- `journalId` (string, required): Journal entry ID from write-journal.ndjson to roll back
- `routerId` (string): Router ID; omit to use the default router.

### `check_router_health` (~66 tokens)

Check Router Health

Probe a router by fetching system/resource. Returns health status, ROS version, uptime, CPU load, and memory info. Unlike other tools, this never throws — unreachable routers are reported as healthy=false.

Input parameters:

- `routerId` (string): Router ID; omit to use the default router.

### `bulk_execute` (~205 tokens)

Bulk Execute

Fan out a single-router tool to many routers in parallel (up to `concurrency`), targeted by routerIds or tag. Destructive tools need two-step confirmation: call without `confirmationToken` to get a fleet token (needs MIKROMCP_CONFIRMATION_SECRET), then re-call with it. Writes snapshot+journal each router for rollback. Returns per-router results with succeeded/failed counts.

Input parameters:

- `concurrency` (integer): Max simultaneous router calls
- `confirmationToken` (string): Fleet confirmation token from a prior APPROVAL_REQUIRED response. Required to fan out a destructive tool.
- `params` (object, required): Params to pass to the tool (omit routerId — injected per router)
- `routerIds` (array): Explicit list of router IDs to target
- `tags` (array): Target all routers with ALL of these tags (mutually exclusive with routerIds)
- `toolName` (string, required): Name of the tool to fan out (must be a single-router tool)

### `list_routers` (~102 tokens)

List Routers

List the routers configured in the registry (routers.yaml): id, host, port, TLS status, tags, ROS version, and which is the default. Read-only reflection of local config — no RouterOS API call, no credentials in the response. Use it to discover valid routerId values and tags for targeting other tools (including bulk_execute).

Input parameters:

- `tags` (array): Only return routers having any of these tags (e.g. ["edge", "prod"])

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/alikarami-mikromcp/mikromcp#diagnostics

## Score history

- 2026-08-03: 80
- 2026-08-02: 79
- 2026-08-01: 20
- 2026-07-31: 49
- 2026-07-30: 25
- 2026-07-28: 45
- 2026-07-27: 45

## Links

- npm package: https://www.npmjs.com/package/mikromcp
- Socket report: https://socket.dev/npm/package/mikromcp
- Repository: https://github.com/AliKarami/MikroMCP
- Changelog RSS feed: https://verifymcp.io/servers/alikarami-mikromcp/mikromcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/alikarami-mikromcp/mikromcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/alikarami-mikromcp/mikromcp