MikroMCP
NPM · MIKROMCP · SCANNED SEP 20
MCP server for MikroTik RouterOS: typed tools, dry-run, RBAC, audit logs, and rollback.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security99
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 42 of 147 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to AliKarami/MikroMCP). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 14 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability75
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 15241 tokens (~124/item across 122 items; 122 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management93
- Stability observed for 28 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety97
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 7 of 8 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "ping" implies "send" and declares readOnlyHint instead, contradicting what its own name says it does. See how to fix → Partial
- An AI judge read all 123 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the MikroMCP MCP server?
MikroMCP runs locally as an npm package, launched with npx -y mikromcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · mikromcp
claude mcp add alikarami-mikromcp -- npx -y mikromcp
{
"mcpServers": {
"alikarami-mikromcp": {
"command": "npx",
"args": [
"-y",
"mikromcp"
]
}
}
} {
"servers": {
"alikarami-mikromcp": {
"command": "npx",
"args": [
"-y",
"mikromcp"
]
}
}
} codex mcp add alikarami-mikromcp -- npx -y mikromcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"alikarami-mikromcp": {
"type": "local",
"command": [
"npx",
"-y",
"mikromcp"
],
"enabled": true
}
}
} openclaw mcp add alikarami-mikromcp --command npx --arg -y --arg mikromcp
mcp_servers:
alikarami-mikromcp:
command: "npx"
args: ["-y", "mikromcp"] {
"McpServers": {
"alikarami-mikromcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"mikromcp"
]
}
}
} assistant mcp add alikarami-mikromcp -t stdio -c npx -a -y mikromcp
{
"mcpServers": {
"alikarami-mikromcp": {
"command": "npx",
"args": [
"-y",
"mikromcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
- Security disclosure: unverified → pass ▲ functional
- 19 Sept 26 0
- Security disclosure: pass → unverified ▼ functional
- 17 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes. Other categories moved too: Supply Chain Security rose 1.
- 16 Sept 26 −3
- Stability: pass → 0.80 functional
- 15 Sept 26 +1
- Stability: 0.97 → pass security
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 11 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 9 Sept 26 −3
- Stability: pass → 0.80 functional
- Package version: 1.8.0 → 1.11.0 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/mikromcp@1.11.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | AliKarami/MikroMCP |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/AliKarami/MikroMCP/.github/workflows/release.yml@refs/tags/v1.11.0 |
| Rekor log index | 2723383711 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:c76356c9095f2707cba9c4964ff7e3de0ca3b1cc7ad92d991a8f6057c2f218d3031b4b3d614c616555078fd89b31a938a38e8a79d6173ac72cf6aa84b |
Background: How many MCP packages publish verified provenance →
Dependencies 147 packages
| Packages resolved | 147 |
|---|---|
| Stale | 42 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
list_pppoe_clients List PPPoE Clients ~99
List PPPoE client interfaces on a MikroTik router. Shows name, parent interface, ISP username, and connection status.
| Name | Type | Req | Description |
|---|---|---|---|
| interface | string | – | Filter by parent interface name (exact match) |
| limit | integer | – | Max results to return. |
| offset | integer | – | Pagination offset. |
| routerId | string | – | Router ID; omit to use the default router. |
| status | string | – | Filter by running status |
No output schema declared.
No examples provided.
list_queues List Queues ~60
List simple queues on a MikroTik router.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max results to return. |
| routerId | string | – | Router ID; omit to use the default router. |
| target | string | – | Filter by target address (substring match) |
No output schema declared.
No examples provided.
list_routers List Routers ~102
List the routers configured in the registry (routers.yaml): id, host, port, TLS status, tags, ROS version, and which is the default. Read-only reflection of local config — no RouterOS API call, no credentials in the response. Use it to discover valid routerId values and tags for targeting other tools (including bulk_execute).
| Name | Type | Req | Description |
|---|---|---|---|
| tags | array | – | Only return routers having any of these tags (e.g. ["edge", "prod"]) |
No output schema declared.
No examples provided.
list_routes List Static Routes ~92
List static routes on a MikroTik router with optional filtering by active status and dynamic status. Supports pagination.
| Name | Type | Req | Description |
|---|---|---|---|
| activeOnly | boolean | – | Return only active routes |
| limit | integer | – | Max results to return. |
| offset | integer | – | Pagination offset. |
| routerId | string | – | Router ID; omit to use the default router. |
| staticOnly | boolean | – | Return only non-dynamic routes |
No output schema declared.
No examples provided.
list_routing_rules List Routing Rules ~71
List policy routing rules on a MikroTik router in evaluation order. Supports filtering by table and disabled state.
| Name | Type | Req | Description |
|---|---|---|---|
| disabled | boolean | – | Filter by disabled state |
| routerId | string | – | Router ID; omit to use the default router. |
| table | string | – | Filter by routing table name |
No output schema declared.
No examples provided.
list_routing_tables List Routing Tables ~37
List custom routing tables on a MikroTik router.
| Name | Type | Req | Description |
|---|---|---|---|
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
list_scheduled_jobs List Scheduled Jobs ~62
List RouterOS scheduler entries on a MikroTik router with next-run time, interval, and disabled state.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | – | Filter by job name (exact match) |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
list_scripts List Scripts ~54
List RouterOS scripts on a MikroTik router. Supports optional name filter.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | – | Filter by script name (substring match) |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
list_swos_endpoints List SwOS Endpoints ~64
List the SwOS/SwOS Lite '.b' API endpoints supported by this server, with the decoded field names per endpoint. Read-only schema introspection — no device call.
| Name | Type | Req | Description |
|---|---|---|---|
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
list_user_groups List User Groups ~47
List local user groups on a MikroTik router.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max results to return. |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
list_users List Users ~65
List local users on a MikroTik router. Passwords are never returned.
| Name | Type | Req | Description |
|---|---|---|---|
| group | string | – | Filter by group name (exact match) |
| limit | integer | – | Max results to return. |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
list_vrrp_instances List VRRP Instances ~64
List VRRP instances on a MikroTik router.
| Name | Type | Req | Description |
|---|---|---|---|
| interface | string | – | Filter by master interface name (exact match) |
| limit | integer | – | Max results to return. |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
list_wifi_clients List WiFi Clients ~75
List currently connected WiFi clients (stations) with signal strength and transfer rates.
| Name | Type | Req | Description |
|---|---|---|---|
| interface | string | – | Filter by WiFi interface name |
| limit | integer | – | Max results to return. |
| offset | integer | – | Pagination offset. |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
list_wifi_interfaces List WiFi Interfaces ~79
List WiFi/wireless interfaces on a MikroTik router. Uses /interface/wifi on ROS 7.x, /interface/wireless on older versions.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max results to return. |
| offset | integer | – | Pagination offset. |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
list_wireguard_interfaces List WireGuard Interfaces ~60
List WireGuard interfaces and their status on a MikroTik router.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max results to return. |
| offset | integer | – | Pagination offset. |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
list_wireguard_peers List WireGuard Peers ~73
List WireGuard peers with last handshake time and transfer statistics.
| Name | Type | Req | Description |
|---|---|---|---|
| interface | string | – | Filter by WireGuard interface name |
| limit | integer | – | Max results to return. |
| offset | integer | – | Pagination offset. |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
manage_address_list_entry Manage Address List Entry ~167
Add or remove a firewall address list entry. Idempotent by list name + address. Supports dry-run mode.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| address | string | yes | IP address or CIDR to add/remove |
| comment | string | – | Optional comment for the entry |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| list | string | yes | Address list name |
| routerId | string | – | Router ID; omit to use the default router. |
| timeout | string | – | Expiry timeout (e.g. 1d, 2h30m) — omit for permanent |
No output schema declared.
No examples provided.
manage_bridge Manage Bridge Interface ~136
Create or remove a bridge interface on a MikroTik router. Idempotent: create returns already_exists if bridge with same name exists.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| comment | string | – | Optional comment |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| disabled | boolean | – | Whether the bridge should be disabled |
| dryRun | boolean | – | Preview changes without applying. |
| name | string | yes | Bridge interface name |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
manage_bridge_port Manage Bridge Port ~133
Add or remove an interface from a bridge on a MikroTik router. Idempotent: add returns already_exists if the port assignment already exists.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| bridge | string | yes | Bridge interface name |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| interface | string | yes | Interface to add or remove as a bridge port |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
manage_certificate Manage Certificate ~117
Remove, trust, or untrust a certificate. Idempotent: trust/untrust return early if already in the target state.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| name | string | yes | Certificate name — idempotency key |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
manage_container Manage Container ~230
Create, start, stop, or remove a RouterOS container. create needs a pre-configured veth interface; start/stop are no-ops when already in the target state; remove throws NOT_FOUND when absent. Supports dry-run.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| comment | string | – | Optional comment |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| envlist | string | – | RouterOS environment list name for container env vars |
| interface | string | – | veth interface name to attach the container to (required on create — must be pre-configured in RouterOS) |
| name | string | yes | Container name — idempotency key |
| remoteImage | string | – | Docker image to pull (required on create, e.g. alpine:latest) |
| rootDir | string | – | Root directory for container files |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
manage_container_config Manage Container Config ~96
Update global container settings. Idempotent: returns no_change if nothing differs.
| Name | Type | Req | Description |
|---|---|---|---|
| dryRun | boolean | – | Preview changes without applying. |
| ramHighMb | integer | – | RAM high-water mark in MB |
| registryUrl | string | – | Container registry URL |
| routerId | string | – | Router ID; omit to use the default router. |
| vethInterface | string | – | Veth interface name for container networking |
No output schema declared.
No examples provided.
manage_container_env Manage Container Env ~125
Add or remove a container environment variable. Idempotent by name+key. add returns already_exists if the entry exists with the same value; throws CONFLICT if the value differs.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| dryRun | boolean | – | Preview changes without applying. |
| key | string | yes | Environment variable name — part of idempotency key |
| name | string | yes | Container name |
| routerId | string | – | Router ID; omit to use the default router. |
| value | string | – | Environment variable value (required for add) |
No output schema declared.
No examples provided.
manage_container_mount Manage Container Mount ~128
Add or remove a container volume mount. Idempotent by name: add returns already_exists if the mount exists with matching src/dst; throws CONFLICT if name exists with different paths.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| dryRun | boolean | – | Preview changes without applying. |
| dst | string | – | Container destination path (required for add) |
| name | string | yes | Mount name — idempotency key |
| routerId | string | – | Router ID; omit to use the default router. |
| src | string | – | Host source path (required for add) |
No output schema declared.
No examples provided.
manage_dhcp_client Manage DHCP Client ~209
Add, remove, enable, or disable a DHCP client on an interface. Idempotent by interface name: add returns already_exists if a DHCP client is already configured on the same interface.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| addDefaultRoute | boolean | – | Add default route from DHCP (add only) |
| comment | string | – | Optional comment (add only) |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| interface | string | yes | Interface name — idempotency key (e.g. ether1, ether2) |
| routerId | string | – | Router ID; omit to use the default router. |
| usePeerDns | boolean | – | Use DNS servers provided by DHCP server (add only) |
| usePeerNtp | boolean | – | Use NTP servers provided by DHCP server (add only) |
No output schema declared.
No examples provided.
manage_dhcp_lease Manage DHCP Lease ~109
Convert a dynamic DHCP lease to static (make-static) or remove a lease. Idempotent by MAC address.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform: make-static converts a dynamic lease to static; remove deletes the lease |
| dryRun | boolean | – | Preview changes without applying. |
| macAddress | string | yes | MAC address of the lease — idempotency key (case-insensitive) |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
manage_dhcp_server Manage DHCP Server ~192
Add, remove, enable, or disable a DHCP server. Idempotent by name: add returns already_exists if a server with the same name, interface, and address pool already exists.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| addressPool | string | – | IP pool name (required for add) |
| comment | string | – | Optional comment |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| interface | string | – | Interface to serve DHCP on (required for add) |
| leaseTime | string | – | Lease duration (e.g. '1d', '12h') |
| name | string | yes | Server name — idempotency key |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
manage_dns_entry Manage DNS Entry ~223
Add or remove a static DNS entry. Idempotent by name+type: add returns already_exists if the same record already exists.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| address | string | – | IP address (required for A records) |
| cname | string | – | Target hostname (required for CNAME records) |
| comment | string | – | Optional comment |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| disabled | boolean | – | Whether the entry should be disabled |
| dryRun | boolean | – | Preview changes without applying. |
| name | string | yes | Hostname for the DNS record (e.g. server.example.com) |
| routerId | string | – | Router ID; omit to use the default router. |
| text | string | – | Text value (required for TXT records) |
| ttl | string | – | TTL value (e.g. 1d, 00:05:00) |
| type | string | – | DNS record type |
No output schema declared.
No examples provided.
manage_dns_settings Manage DNS Settings ~210
Update DNS resolver settings (upstream servers, cache size, cache TTL, allow-remote-requests). Idempotent: returns no_change if nothing differs.
| Name | Type | Req | Description |
|---|---|---|---|
| allowRemoteRequests | boolean | – | Allow router to answer DNS queries from the network |
| cacheMaxTtl | string | – | Maximum cache TTL (e.g. '1d', '00:30:00') |
| cacheSize | integer | – | DNS cache size in KiB |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| maxUdpPacketSize | integer | – | Maximum UDP packet size in bytes |
| routerId | string | – | Router ID; omit to use the default router. |
| servers | string | – | Comma-separated upstream DNS server IPs (e.g. '8.8.8.8,1.1.1.1') |
No output schema declared.
No examples provided.
manage_firewall_rule Manage Firewall Rule ~323
Add, remove, disable, or enable a firewall rule on a MikroTik router. Uses comment as idempotency key for deduplication and identification. Supports dry-run mode.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform: add, remove, disable, or enable a firewall rule |
| chain | string | yes | Firewall chain (e.g. forward, input, output, srcnat, dstnat) |
| comment | string | – | Comment to identify the rule (used as idempotency key) |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| disabled | boolean | – | Whether the rule should be disabled |
| dryRun | boolean | – | If true, validate and return planned changes without applying |
| dstAddress | string | – | Destination address or network |
| dstPort | string | – | Destination port or range |
| inInterface | string | – | Incoming interface |
| outInterface | string | – | Outgoing interface |
| placeBefore | string | – | Place the new rule before this rule ID |
| protocol | string | – | Protocol to match |
| routerId | string | – | Router ID; omit to use the default router. |
| ruleAction | string | yes | RouterOS rule action (e.g. accept, drop, reject, masquerade) |
| srcAddress | string | – | Source address or network |
| srcPort | string | – | Source port or range |
| table | string | – | Firewall table to manage: filter or nat |
No output schema declared.
No examples provided.
manage_interface_list Manage Interface List ~134
Add or remove an interface list. Idempotent by name. Removing a list that has members is blocked by RouterOS — the error is surfaced as-is.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| comment | string | – | Optional comment |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| name | string | yes | Interface list name — idempotency key |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
manage_interface_list_member Manage Interface List Member ~161
Add or remove an interface from an interface list. Idempotent by list+interface composite key. add returns already_exists if the membership exists. remove returns not_found gracefully.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| comment | string | – | Optional comment |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| interface | string | yes | Interface name to add/remove — part of composite idempotency key |
| list | string | yes | Interface list name — part of composite idempotency key |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
manage_ip_address Manage IP Address ~226
Add, update, or remove an IP address on a MikroTik router interface. Performs idempotency checks for add operations and supports dry-run mode for all actions.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform: add, update, or remove an IP address |
| address | string | yes | IP address with optional prefix length in CIDR notation (e.g., 192.168.1.1/24). Defaults to /32 if prefix is omitted. |
| comment | string | – | Optional comment for the IP address entry |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| disabled | boolean | – | Whether the IP address should be disabled |
| dryRun | boolean | – | If true, validate and return planned changes without applying |
| interface | string | yes | Interface to assign the IP address to |
| network | string | – | Network address (auto-calculated from address if omitted) |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
manage_ip_pool Manage IP Pool ~138
Add or remove an IP address pool. Idempotent by name: add returns already_exists if a pool with the same name and ranges already exists.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| dryRun | boolean | – | Preview changes without applying. |
| name | string | yes | Pool name — idempotency key |
| nextPool | string | – | Next pool name for overflow |
| ranges | string | – | IP range (e.g. '192.168.1.100-192.168.1.200'; required for add) |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
manage_ip_service Manage IP Service ~168
Enable or disable a RouterOS IP service (api, api-ssl, ssh, telnet, www, www-ssl, winbox, ftp). Port number changes are intentionally not supported to prevent accidental lockout.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform — only enable/disable to prevent accidental lockout from changing ports |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| name | string | yes | Service name to manage (api, api-ssl, ssh, telnet, www, www-ssl, winbox, ftp) |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
manage_ipsec_peer Manage IPSec Peer ~183
Add, remove, enable, or disable an IPSec peer. Idempotent by name: add returns already_exists if a peer with the same name and address already exists.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| address | string | – | Remote gateway address (required for add) |
| comment | string | – | Optional comment |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| exchange | string | – | IKE exchange mode |
| localAddress | string | – | Local address |
| name | string | yes | Peer name — idempotency key |
| profile | string | – | IKE profile name |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
manage_ipsec_policy Manage IPSec Policy ~217
Add, remove, enable, or disable an IPSec policy. Idempotent by composite key (srcAddress + dstAddress + tunnel).
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| dstAddress | string | yes | Destination CIDR — part of composite idempotency key |
| ipsecAction | string | – | IPSec action (required for add) |
| level | string | – | SA level |
| routerId | string | – | Router ID; omit to use the default router. |
| saDstAddress | string | – | SA destination IP for tunnel mode |
| saSourceAddress | string | – | SA source IP for tunnel mode |
| srcAddress | string | yes | Source CIDR — part of composite idempotency key |
| tunnel | boolean | – | Tunnel mode — part of composite idempotency key |
No output schema declared.
No examples provided.
manage_log_action Manage Log Action ~183
Add or remove a RouterOS logging action target. Idempotent by name. add throws VALIDATION if type is missing; returns already_exists if name found. remove returns not_found gracefully. Supports dry-run.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| diskFileName | string | – | Disk log file name without extension (for type=disk) |
| dryRun | boolean | – | Preview changes without applying. |
| name | string | yes | Log action name — idempotency key |
| remote | string | – | Remote syslog server address (for type=remote) |
| remotePort | integer | – | Remote syslog server port (for type=remote) |
| routerId | string | – | Router ID; omit to use the default router. |
| type | string | – | Action type: memory, disk, remote, echo, email (required on add) |
No output schema declared.
No examples provided.
manage_log_rule Manage Log Rule ~159
Add, remove, enable, or disable a RouterOS logging rule. Idempotent by topics+logAction (add → already_exists on match; remove → not_found handled gracefully; enable/disable throw NOT_FOUND when absent). Supports dry-run.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| dryRun | boolean | – | Preview changes without applying. |
| logAction | string | yes | Log action target name (RouterOS action field) — idempotency key |
| prefix | string | – | Optional prefix to prepend to log messages |
| routerId | string | – | Router ID; omit to use the default router. |
| topics | string | yes | Log topics (e.g. firewall, system, info) — idempotency key |
No output schema declared.
No examples provided.
manage_mangle_rule Manage Mangle Rule ~336
Add, remove, enable, or disable a firewall mangle rule. Uses comment as idempotency key. Supports dry-run mode.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| chain | string | – | Mangle chain (required on add): prerouting, input, forward, output, postrouting |
| comment | string | yes | Idempotency key — uniquely identifies this mangle rule |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| dstAddress | string | – | Destination IP/CIDR to match |
| dstAddressList | string | – | Destination address list name to match |
| dstPort | string | – | Destination port or range |
| inInterface | string | – | Incoming interface to match |
| newConnectionMark | string | – | Connection mark to set |
| newDscpValue | integer | – | DSCP value to set (0–63) |
| newRoutingMark | string | – | Routing mark to set |
| outInterface | string | – | Outgoing interface to match |
| passthrough | boolean | – | Whether to continue matching subsequent rules |
| protocol | string | – | Protocol to match (e.g. tcp, udp) |
| routerId | string | – | Router ID; omit to use the default router. |
| srcAddress | string | – | Source IP/CIDR to match |
| srcAddressList | string | – | Source address list name to match |
| srcPort | string | – | Source port or range |
No output schema declared.
No examples provided.
manage_netwatch_entry Manage Netwatch Entry ~164
Add, remove, enable, or disable a Netwatch monitoring entry. Idempotent by host+port: add returns already_exists if an entry with the same host and port already exists.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| comment | string | – | Optional comment |
| dryRun | boolean | – | Preview changes without applying. |
| host | string | yes | Host to monitor — idempotency key |
| interval | string | – | Check interval (e.g. '1m'; default '1m') |
| port | integer | – | TCP port (optional; ICMP if omitted) |
| routerId | string | – | Router ID; omit to use the default router. |
| timeout | string | – | Probe timeout (e.g. '500ms') |
No output schema declared.
No examples provided.
manage_ntp_client Manage NTP Client ~116
Update NTP client settings on a MikroTik router. Idempotent: returns already_set if no changes are needed.
| Name | Type | Req | Description |
|---|---|---|---|
| dryRun | boolean | – | Preview changes without applying. |
| enabled | boolean | – | Enable or disable the NTP client |
| mode | string | – | NTP client mode |
| routerId | string | – | Router ID; omit to use the default router. |
| servers | string | – | Comma-separated NTP server addresses |
| vlanInterface | string | – | VLAN interface for NTP communication |
No output schema declared.
No examples provided.
manage_ovpn_client Manage OpenVPN Client ~230
Add, update, or remove an OpenVPN client interface. Idempotent by name (already_exists on matching name+connectTo; CONFLICT on differing connectTo; no_change when an update differs in nothing). Password is always written when provided since RouterOS does not return it on GET.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| certificate | string | – | Client certificate name |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| connectTo | string | – | Remote server address (required for add) |
| dryRun | boolean | – | Preview changes without applying. |
| mode | string | – | Tunnel mode |
| name | string | yes | OpenVPN client interface name — idempotency key |
| password | string | – | VPN password (never logged) |
| port | integer | – | Remote port number |
| protocol | string | – | Transport protocol |
| routerId | string | – | Router ID; omit to use the default router. |
| user | string | – | VPN username |
No output schema declared.
No examples provided.
manage_ovpn_server Manage OpenVPN Server ~197
Enable, disable, or configure the OpenVPN server (a per-router singleton). Throws NOT_FOUND if the OpenVPN package is not installed. The set action requires at least one configuration field.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| auth | string | – | Authentication algorithm (set action only) |
| certificate | string | – | Server certificate name (set action only) |
| cipher | string | – | Encryption cipher (set action only) |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| mode | string | – | Tunnel mode (set action only) |
| port | integer | – | Listening port (set action only) |
| protocol | string | – | Transport protocol (set action only) |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
manage_package Manage Package ~123
Enable or disable a RouterOS package. Changes take effect only after a router reboot — use the reboot tool to apply. Idempotent: no-op if already in the target state.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| name | string | yes | Package name |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
manage_ppp_profile Manage PPP Profile ~207
Add, update, or remove a PPP profile. Idempotent by name. update returns no_change when requested values match. Built-in profiles (default, default-encryption) cannot be removed — RouterOS blocks this and the error is surfaced.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| comment | string | – | Optional comment |
| dnsServer | string | – | DNS server IP pushed to client |
| dryRun | boolean | – | Preview changes without applying. |
| localAddress | string | – | Local IP assigned to router end of PPP link |
| name | string | yes | Profile name — idempotency key |
| rateLimit | string | – | Rate limit string (e.g. '10M/10M') |
| remoteAddress | string | – | IP or pool name assigned to client |
| routerId | string | – | Router ID; omit to use the default router. |
| sessionTimeout | string | – | Session timeout duration string (e.g. '1h') |
No output schema declared.
No examples provided.
manage_pppoe_client Manage PPPoE Client ~267
Add, update, or remove a PPPoE client interface. Idempotent by name (already_exists on matching name+interface+user; CONFLICT on differing config; no_change when an update differs in nothing). Password is always written when provided since RouterOS does not return it on GET.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| addDefaultRoute | boolean | – | Add default route via PPPoE (yes/no) |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dialOnDemand | boolean | – | Dial on demand instead of always-on (yes/no) |
| dryRun | boolean | – | Preview changes without applying. |
| interface | string | – | Parent interface (required for add) |
| name | string | yes | PPPoE client interface name — idempotency key (e.g. pppoe-wan) |
| password | string | – | PPPoE password (never logged) |
| routerId | string | – | Router ID; omit to use the default router. |
| serviceName | string | – | PPPoE service name filter (leave empty to match any) |
| user | string | – | PPPoE username (required for add) |
No output schema declared.
No examples provided.
manage_queue Manage Queue ~173
Add, remove, enable, or disable a simple queue. Idempotent by name: add returns already_exists if a queue with the same name and target already exists.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| comment | string | – | Optional comment |
| dryRun | boolean | – | Preview changes without applying. |
| limitAt | string | – | Guaranteed rate (e.g. '1M/1M') |
| maxLimit | string | – | Max upload/download limit (e.g. '10M/10M') |
| name | string | yes | Queue name — idempotency key |
| routerId | string | – | Router ID; omit to use the default router. |
| target | string | – | Target address (required for add; e.g. '192.168.1.0/24') |
No output schema declared.
No examples provided.
manage_route Manage Static Route ~238
Add or remove a static route on a MikroTik router. Performs idempotency checks for add operations and supports dry-run mode for all actions.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform: add or remove a route |
| comment | string | – | Optional comment for the route |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| disabled | boolean | – | Whether the route should be disabled |
| distance | integer | – | Route distance/metric (1-255) |
| dryRun | boolean | – | If true, validate and return planned changes without applying |
| dstAddress | string | yes | Destination address in CIDR notation or plain IP (auto-converted to /32), e.g. 10.0.0.0/8 or 10.77.0.4 |
| gateway | string | yes | Gateway IP address |
| routerId | string | – | Router ID; omit to use the default router. |
| routingTable | string | – | Routing table name (default: main). Use for policy routing with separate tables. |
No output schema declared.
No examples provided.
manage_routing_rule Manage Routing Rule ~190
Add, remove, enable, or disable a policy routing rule. Idempotent by srcAddress+dstAddress+interface+table composite key. Supports dry-run mode.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| dstAddress | string | – | Destination CIDR to match |
| interface | string | – | Incoming interface to match |
| priority | integer | – | Rule priority (0–4294967295) |
| routerId | string | – | Router ID; omit to use the default router. |
| srcAddress | string | – | Source CIDR to match |
| table | string | yes | Routing table name — part of the composite idempotency key; required for all actions |
No output schema declared.
No examples provided.
What is the MikroMCP MCP server?
MikroMCP is an MCP server listed in the public MCP registry as io.github.AliKarami/mikromcp. MCP server for MikroTik RouterOS: typed tools, dry-run, RBAC, audit logs, and rollback. This page covers its npm package (mikromcp).
Is the MikroMCP MCP server safe to use?
MikroMCP scores 94 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the MikroMCP MCP server expose?
MikroMCP exposes 122 tools: get_system_status, list_interfaces, manage_ip_address, list_dhcp_leases, manage_dhcp_lease, and 117 more. Their descriptions and schemas cost roughly 15,117 tokens of context every time the server is loaded.
Is the MikroMCP MCP server still maintained?
MikroMCP is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the MikroMCP MCP server under?
MikroMCP declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.