MikroMCP

NPM · MIKROMCP · SCANNED AUG 3

MCP server for MikroTik RouterOS: typed tools, dry-run, RBAC, audit logs, and rollback.

Available components

+35 this week 80 80 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security87

No malware found by supply-chain analysis.Pass
Only part of the dependency tree could be resolved (147 of 151), so this covers what we could see, not the whole tree.Partial
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (147 of 151), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency97

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Cryptographically verified build provenance (signed, bound to AliKarami/MikroMCP). View diagnostics → Pass
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 12 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability76

AI-judged instruction clarity (excellent).Pass
Context-footprint check failed: tool/resource definitions use about 14616 tokens (~123/item across 118 items; 118 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management27

Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial

Tool Coverage100

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
100% of tool parameters carry a description.Pass

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · mikromcp

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add alikarami-mikromcp -- npx -y mikromcp

# add to Codex CLI

codex mcp add alikarami-mikromcp -- npx -y mikromcp

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "alikarami-mikromcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "mikromcp"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add alikarami-mikromcp --command npx --arg -y --arg mikromcp

# ~/.hermes/config.yaml

mcp_servers:
  alikarami-mikromcp:
    command: "npx"
    args: ["-y", "mikromcp"]

// mcp.json

{
  "mcpServers": {
    "alikarami-mikromcp": {
      "command": "npx",
      "args": [
        "-y",
        "mikromcp"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

3 Aug 26 +1

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.
2 Aug 26 +59
- Known CVEs: unverified → partial ▲ security
- Install scripts: unverified → pass ▲ security
- Provenance: unverified → pass ▲ security
- Malware scan: unverified → pass ▲ security
- The attested source repository moved: AliKarami/MikroMCP security
- Security disclosure: fail → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Stability: unverified → 0.23 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Maintenance: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- License: unverified → pass ▲ functional
- Schema quality: unverified → excellent ▲ functional
- Licence: MIT functional
1 Aug 26 −29
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
31 Jul 26 +24
- Malware scan: pass → unverified ▼ security
- Provenance: unverified → pass ▲ security
- Install scripts: unverified → pass ▲ security
- The attested source repository moved: AliKarami/MikroMCP security
- Dependency health: partial → unverified ▼ functional
- Maintenance: unverified → pass ▲ functional
- License: unverified → pass ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- Licence: MIT functional
30 Jul 26 −20
- Tool coverage: 100 → unverified ▼ functional
- Dependency health: unverified → partial ▲ functional
- First check of Schema quality: unverified functional
27 Jul 26 45

First indexed and scored.

Show 3 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/[email protected]

Provenance verified

Ecosystem: npm · Outcome: verified

Reason: verified

Source repo:: AliKarami/MikroMCP
Certificate issuer:: https://token.actions.githubusercontent.com
Certificate SAN:: https://github.com/AliKarami/MikroMCP/.github/workflows/release.yml@refs/tags/v1.8.0
Rekor log index:: 2210870027
Predicate type:: https://slsa.dev/provenance/v1
Subject digest:: sha512:0606b0b9ccc755a3356526c7727fe274df619ed9234e4e97d11be3beb86fe49d55a73a1b70129be6863c7d4f5985bc16828c8e4f98d100856bf2ba98c
Discovery method:: attestation_endpoint

Dependencies 147 packages

147 packages in the resolved dependency tree · 147 deprecated · 40 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 118 exposed · ~14,519 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

list_routers List Routers ~102

List the routers configured in the registry (routers.yaml): id, host, port, TLS status, tags, ROS version, and which is the default. Read-only reflection of local config — no RouterOS API call, no credentials in the response. Use it to discover valid routerId values and tags for targeting other tools (including bulk_execute).

Input Output Examples

Name	Type	Req	Description
tags	array	—	Only return routers having any of these tags (e.g. ["edge", "prod"])

No output schema declared.

No examples provided.

list_routes List Static Routes ~92

List static routes on a MikroTik router with optional filtering by active status and dynamic status. Supports pagination.

Input Output Examples

Name	Type	Req	Description
activeOnly	boolean	—	Return only active routes
limit	integer	—	Max results to return.
offset	integer	—	Pagination offset.
routerId	string	—	Router ID; omit to use the default router.
staticOnly	boolean	—	Return only non-dynamic routes

No output schema declared.

No examples provided.

list_routing_rules List Routing Rules ~71

List policy routing rules on a MikroTik router in evaluation order. Supports filtering by table and disabled state.

Input Output Examples

Name	Type	Req	Description
disabled	boolean	—	Filter by disabled state
routerId	string	—	Router ID; omit to use the default router.
table	string	—	Filter by routing table name

No output schema declared.

No examples provided.

list_routing_tables List Routing Tables ~37

List custom routing tables on a MikroTik router.

Input Output Examples

Name	Type	Req	Description
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

list_scheduled_jobs List Scheduled Jobs ~62

List RouterOS scheduler entries on a MikroTik router with next-run time, interval, and disabled state.

Input Output Examples

Name	Type	Req	Description
name	string	—	Filter by job name (exact match)
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

list_scripts List Scripts ~54

List RouterOS scripts on a MikroTik router. Supports optional name filter.

Input Output Examples

Name	Type	Req	Description
name	string	—	Filter by script name (substring match)
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

list_user_groups List User Groups ~47

List local user groups on a MikroTik router.

Input Output Examples

Name	Type	Req	Description
limit	integer	—	Max results to return.
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

list_users List Users ~65

List local users on a MikroTik router. Passwords are never returned.

Input Output Examples

Name	Type	Req	Description
group	string	—	Filter by group name (exact match)
limit	integer	—	Max results to return.
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

list_vrrp_instances List VRRP Instances ~64

List VRRP instances on a MikroTik router.

Input Output Examples

Name	Type	Req	Description
interface	string	—	Filter by master interface name (exact match)
limit	integer	—	Max results to return.
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

list_wifi_clients List WiFi Clients ~75

List currently connected WiFi clients (stations) with signal strength and transfer rates.

Input Output Examples

Name	Type	Req	Description
interface	string	—	Filter by WiFi interface name
limit	integer	—	Max results to return.
offset	integer	—	Pagination offset.
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

list_wifi_interfaces List WiFi Interfaces ~79

List WiFi/wireless interfaces on a MikroTik router. Uses /interface/wifi on ROS 7.x, /interface/wireless on older versions.

Input Output Examples

Name	Type	Req	Description
limit	integer	—	Max results to return.
offset	integer	—	Pagination offset.
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

list_wireguard_interfaces List WireGuard Interfaces ~60

List WireGuard interfaces and their status on a MikroTik router.

Input Output Examples

Name	Type	Req	Description
limit	integer	—	Max results to return.
offset	integer	—	Pagination offset.
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

list_wireguard_peers List WireGuard Peers ~73

List WireGuard peers with last handshake time and transfer statistics.

Input Output Examples

Name	Type	Req	Description
interface	string	—	Filter by WireGuard interface name
limit	integer	—	Max results to return.
offset	integer	—	Pagination offset.
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

manage_address_list_entry Manage Address List Entry ~167

Add or remove a firewall address list entry. Idempotent by list name + address. Supports dry-run mode.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
address	string	yes	IP address or CIDR to add/remove
comment	string	—	Optional comment for the entry
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
dryRun	boolean	—	Preview changes without applying.
list	string	yes	Address list name
routerId	string	—	Router ID; omit to use the default router.
timeout	string	—	Expiry timeout (e.g. 1d, 2h30m) — omit for permanent

No output schema declared.

No examples provided.

manage_bridge Manage Bridge Interface ~136

Create or remove a bridge interface on a MikroTik router. Idempotent: create returns already_exists if bridge with same name exists.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
comment	string	—	Optional comment
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
disabled	boolean	—	Whether the bridge should be disabled
dryRun	boolean	—	Preview changes without applying.
name	string	yes	Bridge interface name
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

manage_bridge_port Manage Bridge Port ~133

Add or remove an interface from a bridge on a MikroTik router. Idempotent: add returns already_exists if the port assignment already exists.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
bridge	string	yes	Bridge interface name
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
dryRun	boolean	—	Preview changes without applying.
interface	string	yes	Interface to add or remove as a bridge port
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

manage_certificate Manage Certificate ~117

Remove, trust, or untrust a certificate. Idempotent: trust/untrust return early if already in the target state.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
dryRun	boolean	—	Preview changes without applying.
name	string	yes	Certificate name — idempotency key
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

manage_container Manage Container ~230

Create, start, stop, or remove a RouterOS container. create needs a pre-configured veth interface; start/stop are no-ops when already in the target state; remove throws NOT_FOUND when absent. Supports dry-run.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
comment	string	—	Optional comment
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
dryRun	boolean	—	Preview changes without applying.
envlist	string	—	RouterOS environment list name for container env vars
interface	string	—	veth interface name to attach the container to (required on create — must be pre-configured in RouterOS)
name	string	yes	Container name — idempotency key
remoteImage	string	—	Docker image to pull (required on create, e.g. alpine:latest)
rootDir	string	—	Root directory for container files
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

manage_container_config Manage Container Config ~96

Update global container settings. Idempotent: returns no_change if nothing differs.

Input Output Examples

Name	Type	Req	Description
dryRun	boolean	—	Preview changes without applying.
ramHighMb	integer	—	RAM high-water mark in MB
registryUrl	string	—	Container registry URL
routerId	string	—	Router ID; omit to use the default router.
vethInterface	string	—	Veth interface name for container networking

No output schema declared.

No examples provided.

manage_container_env Manage Container Env ~125

Add or remove a container environment variable. Idempotent by name+key. add returns already_exists if the entry exists with the same value; throws CONFLICT if the value differs.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
dryRun	boolean	—	Preview changes without applying.
key	string	yes	Environment variable name — part of idempotency key
name	string	yes	Container name
routerId	string	—	Router ID; omit to use the default router.
value	string	—	Environment variable value (required for add)

No output schema declared.

No examples provided.

manage_container_mount Manage Container Mount ~128

Add or remove a container volume mount. Idempotent by name: add returns already_exists if the mount exists with matching src/dst; throws CONFLICT if name exists with different paths.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
dryRun	boolean	—	Preview changes without applying.
dst	string	—	Container destination path (required for add)
name	string	yes	Mount name — idempotency key
routerId	string	—	Router ID; omit to use the default router.
src	string	—	Host source path (required for add)

No output schema declared.

No examples provided.

manage_dhcp_client Manage DHCP Client ~209

Add, remove, enable, or disable a DHCP client on an interface. Idempotent by interface name: add returns already_exists if a DHCP client is already configured on the same interface.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
addDefaultRoute	boolean	—	Add default route from DHCP (add only)
comment	string	—	Optional comment (add only)
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
dryRun	boolean	—	Preview changes without applying.
interface	string	yes	Interface name — idempotency key (e.g. ether1, ether2)
routerId	string	—	Router ID; omit to use the default router.
usePeerDns	boolean	—	Use DNS servers provided by DHCP server (add only)
usePeerNtp	boolean	—	Use NTP servers provided by DHCP server (add only)

No output schema declared.

No examples provided.

manage_dhcp_lease Manage DHCP Lease ~109

Convert a dynamic DHCP lease to static (make-static) or remove a lease. Idempotent by MAC address.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform: make-static converts a dynamic lease to static; remove deletes the lease
dryRun	boolean	—	Preview changes without applying.
macAddress	string	yes	MAC address of the lease — idempotency key (case-insensitive)
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

manage_dhcp_server Manage DHCP Server ~192

Add, remove, enable, or disable a DHCP server. Idempotent by name: add returns already_exists if a server with the same name, interface, and address pool already exists.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
addressPool	string	—	IP pool name (required for add)
comment	string	—	Optional comment
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
dryRun	boolean	—	Preview changes without applying.
interface	string	—	Interface to serve DHCP on (required for add)
leaseTime	string	—	Lease duration (e.g. '1d', '12h')
name	string	yes	Server name — idempotency key
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

manage_dns_entry Manage DNS Entry ~223

Add or remove a static DNS entry. Idempotent by name+type: add returns already_exists if the same record already exists.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
address	string	—	IP address (required for A records)
cname	string	—	Target hostname (required for CNAME records)
comment	string	—	Optional comment
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
disabled	boolean	—	Whether the entry should be disabled
dryRun	boolean	—	Preview changes without applying.
name	string	yes	Hostname for the DNS record (e.g. server.example.com)
routerId	string	—	Router ID; omit to use the default router.
text	string	—	Text value (required for TXT records)
ttl	string	—	TTL value (e.g. 1d, 00:05:00)
type	string	—	DNS record type

No output schema declared.

No examples provided.

manage_dns_settings Manage DNS Settings ~210

Update DNS resolver settings (upstream servers, cache size, cache TTL, allow-remote-requests). Idempotent: returns no_change if nothing differs.

Input Output Examples

Name	Type	Req	Description
allowRemoteRequests	boolean	—	Allow router to answer DNS queries from the network
cacheMaxTtl	string	—	Maximum cache TTL (e.g. '1d', '00:30:00')
cacheSize	integer	—	DNS cache size in KiB
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
dryRun	boolean	—	Preview changes without applying.
maxUdpPacketSize	integer	—	Maximum UDP packet size in bytes
routerId	string	—	Router ID; omit to use the default router.
servers	string	—	Comma-separated upstream DNS server IPs (e.g. '8.8.8.8,1.1.1.1')

No output schema declared.

No examples provided.

manage_firewall_rule Manage Firewall Rule ~323

Add, remove, disable, or enable a firewall rule on a MikroTik router. Uses comment as idempotency key for deduplication and identification. Supports dry-run mode.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform: add, remove, disable, or enable a firewall rule
chain	string	yes	Firewall chain (e.g. forward, input, output, srcnat, dstnat)
comment	string	—	Comment to identify the rule (used as idempotency key)
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
disabled	boolean	—	Whether the rule should be disabled
dryRun	boolean	—	If true, validate and return planned changes without applying
dstAddress	string	—	Destination address or network
dstPort	string	—	Destination port or range
inInterface	string	—	Incoming interface
outInterface	string	—	Outgoing interface
placeBefore	string	—	Place the new rule before this rule ID
protocol	string	—	Protocol to match
routerId	string	—	Router ID; omit to use the default router.
ruleAction	string	yes	RouterOS rule action (e.g. accept, drop, reject, masquerade)
srcAddress	string	—	Source address or network
srcPort	string	—	Source port or range
table	string	—	Firewall table to manage: filter or nat

No output schema declared.

No examples provided.

manage_interface_list Manage Interface List ~134

Add or remove an interface list. Idempotent by name. Removing a list that has members is blocked by RouterOS — the error is surfaced as-is.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
comment	string	—	Optional comment
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
dryRun	boolean	—	Preview changes without applying.
name	string	yes	Interface list name — idempotency key
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

manage_interface_list_member Manage Interface List Member ~161

Add or remove an interface from an interface list. Idempotent by list+interface composite key. add returns already_exists if the membership exists. remove returns not_found gracefully.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
comment	string	—	Optional comment
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
dryRun	boolean	—	Preview changes without applying.
interface	string	yes	Interface name to add/remove — part of composite idempotency key
list	string	yes	Interface list name — part of composite idempotency key
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

manage_ip_address Manage IP Address ~226

Add, update, or remove an IP address on a MikroTik router interface. Performs idempotency checks for add operations and supports dry-run mode for all actions.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform: add, update, or remove an IP address
address	string	yes	IP address with optional prefix length in CIDR notation (e.g., 192.168.1.1/24). Defaults to /32 if prefix is omitted.
comment	string	—	Optional comment for the IP address entry
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
disabled	boolean	—	Whether the IP address should be disabled
dryRun	boolean	—	If true, validate and return planned changes without applying
interface	string	yes	Interface to assign the IP address to
network	string	—	Network address (auto-calculated from address if omitted)
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

manage_ip_pool Manage IP Pool ~138

Add or remove an IP address pool. Idempotent by name: add returns already_exists if a pool with the same name and ranges already exists.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
dryRun	boolean	—	Preview changes without applying.
name	string	yes	Pool name — idempotency key
nextPool	string	—	Next pool name for overflow
ranges	string	—	IP range (e.g. '192.168.1.100-192.168.1.200'; required for add)
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

manage_ip_service Manage IP Service ~168

Enable or disable a RouterOS IP service (api, api-ssl, ssh, telnet, www, www-ssl, winbox, ftp). Port number changes are intentionally not supported to prevent accidental lockout.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform — only enable/disable to prevent accidental lockout from changing ports
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
dryRun	boolean	—	Preview changes without applying.
name	string	yes	Service name to manage (api, api-ssl, ssh, telnet, www, www-ssl, winbox, ftp)
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

manage_ipsec_peer Manage IPSec Peer ~183

Add, remove, enable, or disable an IPSec peer. Idempotent by name: add returns already_exists if a peer with the same name and address already exists.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
address	string	—	Remote gateway address (required for add)
comment	string	—	Optional comment
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
dryRun	boolean	—	Preview changes without applying.
exchange	string	—	IKE exchange mode
localAddress	string	—	Local address
name	string	yes	Peer name — idempotency key
profile	string	—	IKE profile name
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

manage_ipsec_policy Manage IPSec Policy ~217

Add, remove, enable, or disable an IPSec policy. Idempotent by composite key (srcAddress + dstAddress + tunnel).

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
dryRun	boolean	—	Preview changes without applying.
dstAddress	string	yes	Destination CIDR — part of composite idempotency key
ipsecAction	string	—	IPSec action (required for add)
level	string	—	SA level
routerId	string	—	Router ID; omit to use the default router.
saDstAddress	string	—	SA destination IP for tunnel mode
saSourceAddress	string	—	SA source IP for tunnel mode
srcAddress	string	yes	Source CIDR — part of composite idempotency key
tunnel	boolean	—	Tunnel mode — part of composite idempotency key

No output schema declared.

No examples provided.

manage_log_action Manage Log Action ~183

Add or remove a RouterOS logging action target. Idempotent by name. add throws VALIDATION if type is missing; returns already_exists if name found. remove returns not_found gracefully. Supports dry-run.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
diskFileName	string	—	Disk log file name without extension (for type=disk)
dryRun	boolean	—	Preview changes without applying.
name	string	yes	Log action name — idempotency key
remote	string	—	Remote syslog server address (for type=remote)
remotePort	integer	—	Remote syslog server port (for type=remote)
routerId	string	—	Router ID; omit to use the default router.
type	string	—	Action type: memory, disk, remote, echo, email (required on add)

No output schema declared.

No examples provided.

manage_log_rule Manage Log Rule ~159

Add, remove, enable, or disable a RouterOS logging rule. Idempotent by topics+logAction (add → already_exists on match; remove → not_found handled gracefully; enable/disable throw NOT_FOUND when absent). Supports dry-run.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
dryRun	boolean	—	Preview changes without applying.
logAction	string	yes	Log action target name (RouterOS action field) — idempotency key
prefix	string	—	Optional prefix to prepend to log messages
routerId	string	—	Router ID; omit to use the default router.
topics	string	yes	Log topics (e.g. firewall, system, info) — idempotency key

No output schema declared.

No examples provided.

manage_mangle_rule Manage Mangle Rule ~336

Add, remove, enable, or disable a firewall mangle rule. Uses comment as idempotency key. Supports dry-run mode.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
chain	string	—	Mangle chain (required on add): prerouting, input, forward, output, postrouting
comment	string	yes	Idempotency key — uniquely identifies this mangle rule
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
dryRun	boolean	—	Preview changes without applying.
dstAddress	string	—	Destination IP/CIDR to match
dstAddressList	string	—	Destination address list name to match
dstPort	string	—	Destination port or range
inInterface	string	—	Incoming interface to match
newConnectionMark	string	—	Connection mark to set
newDscpValue	integer	—	DSCP value to set (0–63)
newRoutingMark	string	—	Routing mark to set
outInterface	string	—	Outgoing interface to match
passthrough	boolean	—	Whether to continue matching subsequent rules
protocol	string	—	Protocol to match (e.g. tcp, udp)
routerId	string	—	Router ID; omit to use the default router.
srcAddress	string	—	Source IP/CIDR to match
srcAddressList	string	—	Source address list name to match
srcPort	string	—	Source port or range

No output schema declared.

No examples provided.

manage_netwatch_entry Manage Netwatch Entry ~164

Add, remove, enable, or disable a Netwatch monitoring entry. Idempotent by host+port: add returns already_exists if an entry with the same host and port already exists.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
comment	string	—	Optional comment
dryRun	boolean	—	Preview changes without applying.
host	string	yes	Host to monitor — idempotency key
interval	string	—	Check interval (e.g. '1m'; default '1m')
port	integer	—	TCP port (optional; ICMP if omitted)
routerId	string	—	Router ID; omit to use the default router.
timeout	string	—	Probe timeout (e.g. '500ms')

No output schema declared.

No examples provided.

manage_ntp_client Manage NTP Client ~116

Update NTP client settings on a MikroTik router. Idempotent: returns already_set if no changes are needed.

Input Output Examples

Name	Type	Req	Description
dryRun	boolean	—	Preview changes without applying.
enabled	boolean	—	Enable or disable the NTP client
mode	string	—	NTP client mode
routerId	string	—	Router ID; omit to use the default router.
servers	string	—	Comma-separated NTP server addresses
vlanInterface	string	—	VLAN interface for NTP communication

No output schema declared.

No examples provided.

manage_ovpn_client Manage OpenVPN Client ~230

Add, update, or remove an OpenVPN client interface. Idempotent by name (already_exists on matching name+connectTo; CONFLICT on differing connectTo; no_change when an update differs in nothing). Password is always written when provided since RouterOS does not return it on GET.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
certificate	string	—	Client certificate name
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
connectTo	string	—	Remote server address (required for add)
dryRun	boolean	—	Preview changes without applying.
mode	string	—	Tunnel mode
name	string	yes	OpenVPN client interface name — idempotency key
password	string	—	VPN password (never logged)
port	integer	—	Remote port number
protocol	string	—	Transport protocol
routerId	string	—	Router ID; omit to use the default router.
user	string	—	VPN username

No output schema declared.

No examples provided.

manage_ovpn_server Manage OpenVPN Server ~197

Enable, disable, or configure the OpenVPN server (a per-router singleton). Throws NOT_FOUND if the OpenVPN package is not installed. The set action requires at least one configuration field.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
auth	string	—	Authentication algorithm (set action only)
certificate	string	—	Server certificate name (set action only)
cipher	string	—	Encryption cipher (set action only)
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
dryRun	boolean	—	Preview changes without applying.
mode	string	—	Tunnel mode (set action only)
port	integer	—	Listening port (set action only)
protocol	string	—	Transport protocol (set action only)
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

manage_package Manage Package ~123

Enable or disable a RouterOS package. Changes take effect only after a router reboot — use the reboot tool to apply. Idempotent: no-op if already in the target state.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
dryRun	boolean	—	Preview changes without applying.
name	string	yes	Package name
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

manage_ppp_profile Manage PPP Profile ~207

Add, update, or remove a PPP profile. Idempotent by name. update returns no_change when requested values match. Built-in profiles (default, default-encryption) cannot be removed — RouterOS blocks this and the error is surfaced.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
comment	string	—	Optional comment
dnsServer	string	—	DNS server IP pushed to client
dryRun	boolean	—	Preview changes without applying.
localAddress	string	—	Local IP assigned to router end of PPP link
name	string	yes	Profile name — idempotency key
rateLimit	string	—	Rate limit string (e.g. '10M/10M')
remoteAddress	string	—	IP or pool name assigned to client
routerId	string	—	Router ID; omit to use the default router.
sessionTimeout	string	—	Session timeout duration string (e.g. '1h')

No output schema declared.

No examples provided.

manage_pppoe_client Manage PPPoE Client ~267

Add, update, or remove a PPPoE client interface. Idempotent by name (already_exists on matching name+interface+user; CONFLICT on differing config; no_change when an update differs in nothing). Password is always written when provided since RouterOS does not return it on GET.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
addDefaultRoute	boolean	—	Add default route via PPPoE (yes/no)
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
dialOnDemand	boolean	—	Dial on demand instead of always-on (yes/no)
dryRun	boolean	—	Preview changes without applying.
interface	string	—	Parent interface (required for add)
name	string	yes	PPPoE client interface name — idempotency key (e.g. pppoe-wan)
password	string	—	PPPoE password (never logged)
routerId	string	—	Router ID; omit to use the default router.
serviceName	string	—	PPPoE service name filter (leave empty to match any)
user	string	—	PPPoE username (required for add)

No output schema declared.

No examples provided.

manage_queue Manage Queue ~173

Add, remove, enable, or disable a simple queue. Idempotent by name: add returns already_exists if a queue with the same name and target already exists.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
comment	string	—	Optional comment
dryRun	boolean	—	Preview changes without applying.
limitAt	string	—	Guaranteed rate (e.g. '1M/1M')
maxLimit	string	—	Max upload/download limit (e.g. '10M/10M')
name	string	yes	Queue name — idempotency key
routerId	string	—	Router ID; omit to use the default router.
target	string	—	Target address (required for add; e.g. '192.168.1.0/24')

No output schema declared.

No examples provided.

manage_route Manage Static Route ~238

Add or remove a static route on a MikroTik router. Performs idempotency checks for add operations and supports dry-run mode for all actions.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform: add or remove a route
comment	string	—	Optional comment for the route
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
disabled	boolean	—	Whether the route should be disabled
distance	integer	—	Route distance/metric (1-255)
dryRun	boolean	—	If true, validate and return planned changes without applying
dstAddress	string	yes	Destination address in CIDR notation or plain IP (auto-converted to /32), e.g. 10.0.0.0/8 or 10.77.0.4
gateway	string	yes	Gateway IP address
routerId	string	—	Router ID; omit to use the default router.
routingTable	string	—	Routing table name (default: main). Use for policy routing with separate tables.

No output schema declared.

No examples provided.

manage_routing_rule Manage Routing Rule ~190

Add, remove, enable, or disable a policy routing rule. Idempotent by srcAddress+dstAddress+interface+table composite key. Supports dry-run mode.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
dryRun	boolean	—	Preview changes without applying.
dstAddress	string	—	Destination CIDR to match
interface	string	—	Incoming interface to match
priority	integer	—	Rule priority (0–4294967295)
routerId	string	—	Router ID; omit to use the default router.
srcAddress	string	—	Source CIDR to match
table	string	yes	Routing table name — part of the composite idempotency key; required for all actions

No output schema declared.

No examples provided.

manage_routing_table Manage Routing Table ~130

Create or remove a custom routing table. Idempotent by table name. Supports dry-run mode.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
dryRun	boolean	—	Preview changes without applying.
fib	boolean	—	Whether to sync this table with the FIB
name	string	yes	Routing table name (idempotency key)
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

manage_scheduled_job Manage Scheduled Job ~198

Add, update, remove, enable, or disable a RouterOS scheduler entry. Idempotent by name. add throws CONFLICT if name exists; update throws NOT_FOUND if it does not. Supports dry-run.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
comment	string	—	Optional comment
dryRun	boolean	—	Preview changes without applying.
interval	string	—	Run interval (e.g. 00:05:00 for every 5 minutes)
name	string	yes	Job name — idempotency key
onEvent	string	—	Script name or inline command to run (required on add)
routerId	string	—	Router ID; omit to use the default router.
startDate	string	—	Start date (e.g. jan/01/2000)
startTime	string	—	Start time (e.g. 00:00:00)

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 3 Aug