MikroMCP
NPM · MIKROMCP
MCP server for MikroTik RouterOS and SwOS: typed tools, dry-run, RBAC, audit logs, and rollback.
Available components
Last scanned (22 hours ago)
Scores higher than 93% of npm servers
Category Cloud Infrastructure
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security81
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 40 of 144 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to AliKarami/MikroMCP). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 1 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability71
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 19175 tokens (~144/item across 133 items; 133 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety97
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 7 of 8 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "ping" implies "send" and declares readOnlyHint instead, contradicting what its own name says it does. See how to fix → Partial
- An AI judge read all 134 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Checks we ran (16)
- Malware scan
- Known CVEs
- Install scripts
- Dependency health
- Source repository
- Provenance
- License
- Maintenance
- Security disclosure
- Schema quality
- Stability
- Tool coverage
- Injection markers
- Destructive annotations
- Judged manipulation
- MCP protocol
Does not apply to this package (2)
- Endpoint SecurityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
- Transport & ReachabilityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
The score does not measure everything. What the score does not measure →
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +15
- Malware scan: unverified → pass ▲ security
- 4 Nov 26 −15
- Malware scan: pass → unverified ▼ security
- Package version: 1.16.0 → 1.16.1 functional
- 2 Nov 26 +1
- Stability: 0.97 → pass security
- Security disclosure: unverified → pass ▲ functional
- 1 Nov 26 −1
- Security disclosure: pass → unverified ▼ functional
- Stability: pass → 0.97 functional
- 25 Oct 26 +20
- CVE-2023-54404 affects this package: high ▼ security
- Known CVEs: unverified → fail ▼ security
- Malware scan: unverified → pass ▲ security
- Dependency health: unverified → 0.89 ▲ functional
- 24 Oct 26 −25
- CVE-2023-54404 affects this package: high ▼ security
- Known CVEs: pass → unverified ▼ security
- Malware scan: pass → unverified ▼ security
- Known CVEs: pass → fail ▼ security
- Dependency health: 0.88 → unverified ▼ functional
- Package version: 1.14.1 → 1.16.0 functional
- Package version: 1.14.1 → 1.15.0 functional
- 20 Oct 26 0
- Stability: 0.97 → pass security
- 19 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/mikromcp@1.16.1
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | AliKarami/MikroMCP |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/AliKarami/MikroMCP/.github/workflows/release.yml@refs/tags/v1.16.1 |
| Rekor log index | 3682638700 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:0ada8df87b4de4de5ea313bd817a31423833a973797d156105195a444d11870b07d628d61c0e28c5b8d42c1c1d03715bf7ec04416cbca21d51e1cf125 |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-mrhx-c7xc-m3w5 | CVE-2023-54404 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 144 packages
| Packages resolved | 144 |
|---|---|
| Stale | 40 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
list_mangle_rules List Mangle Rules ~107
List firewall mangle rules on a MikroTik router in evaluation order. Supports filtering by chain, action, and disabled state.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | Filter by mangle action (e.g. mark-routing, mark-connection) |
| chain | string | – | Filter by chain name (e.g. prerouting, forward, postrouting) |
| disabled | boolean | – | Filter by disabled state |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
list_neighbors List Neighbors ~69
List discovered neighbors (CDP/LLDP/MNDP) on a MikroTik router.
| Name | Type | Req | Description |
|---|---|---|---|
| interface | string | – | Filter by interface name (substring match) |
| limit | integer | – | Max results to return. |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
list_netwatch_entries List Netwatch Entries ~73
List Netwatch monitoring entries on a MikroTik router.
| Name | Type | Req | Description |
|---|---|---|---|
| host | string | – | Filter by host (substring match) |
| limit | integer | – | Max results to return. |
| routerId | string | – | Router ID; omit to use the default router. |
| status | string | – | Filter by current status |
No output schema declared.
No examples provided.
list_ospf_neighbors List OSPF Neighbors ~81
List OSPF neighbors on a MikroTik router (RouterOS 7+). Returns neighbor state, interface, DR/BDR, and uptime.
| Name | Type | Req | Description |
|---|---|---|---|
| routerId | string | – | Router ID; omit to use the default router. |
| state | string | – | Filter by neighbor state (e.g. full, 2-way, init) |
No output schema declared.
No examples provided.
list_ovpn_clients List OpenVPN Clients ~69
List OpenVPN client interfaces on a MikroTik router. Shows name, remote server, and connection status.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max results to return. |
| offset | integer | – | Pagination offset. |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
list_packages List Packages ~50
List installed RouterOS packages with version and enabled status.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | – | Filter by package name (exact match) |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
list_ppp_profiles List PPP Profiles ~66
List PPP profiles including the built-in default and default-encryption profiles.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max results to return. |
| name | string | – | Filter by profile name (exact match) |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
list_pppoe_clients List PPPoE Clients ~99
List PPPoE client interfaces on a MikroTik router. Shows name, parent interface, ISP username, and connection status.
| Name | Type | Req | Description |
|---|---|---|---|
| interface | string | – | Filter by parent interface name (exact match) |
| limit | integer | – | Max results to return. |
| offset | integer | – | Pagination offset. |
| routerId | string | – | Router ID; omit to use the default router. |
| status | string | – | Filter by running status |
No output schema declared.
No examples provided.
list_queues List Queues ~60
List simple queues on a MikroTik router.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max results to return. |
| routerId | string | – | Router ID; omit to use the default router. |
| target | string | – | Filter by target address (substring match) |
No output schema declared.
No examples provided.
list_routers List Routers ~128
List the routers configured in the registry (routers.yaml): id, host, port, TLS status, tags, ROS version, and which is the default. Read-only reflection of local config — no RouterOS API call, no credentials in the response. rosVersion is what routers.yaml states and may lag a router upgrade — ask get_system_status for the live version. Use it to discover valid routerId values and tags for targeting other tools (including bulk_read and bulk_execute).
| Name | Type | Req | Description |
|---|---|---|---|
| tags | array | – | Only return routers having any of these tags (e.g. ["edge", "prod"]) |
No output schema declared.
No examples provided.
list_routes List Static Routes ~92
List static routes on a MikroTik router with optional filtering by active status and dynamic status. Supports pagination.
| Name | Type | Req | Description |
|---|---|---|---|
| activeOnly | boolean | – | Return only active routes |
| limit | integer | – | Max results to return. |
| offset | integer | – | Pagination offset. |
| routerId | string | – | Router ID; omit to use the default router. |
| staticOnly | boolean | – | Return only non-dynamic routes |
No output schema declared.
No examples provided.
list_routing_rules List Routing Rules ~71
List policy routing rules on a MikroTik router in evaluation order. Supports filtering by table and disabled state.
| Name | Type | Req | Description |
|---|---|---|---|
| disabled | boolean | – | Filter by disabled state |
| routerId | string | – | Router ID; omit to use the default router. |
| table | string | – | Filter by routing table name |
No output schema declared.
No examples provided.
list_routing_tables List Routing Tables ~37
List custom routing tables on a MikroTik router.
| Name | Type | Req | Description |
|---|---|---|---|
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
list_scheduled_jobs List Scheduled Jobs ~62
List RouterOS scheduler entries on a MikroTik router with next-run time, interval, and disabled state.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | – | Filter by job name (exact match) |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
list_scripts List Scripts ~54
List RouterOS scripts on a MikroTik router. Supports optional name filter.
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | – | Filter by script name (substring match) |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
list_swos_endpoints List SwOS Endpoints ~64
List the SwOS/SwOS Lite '.b' API endpoints supported by this server, with the decoded field names per endpoint. Read-only schema introspection — no device call.
| Name | Type | Req | Description |
|---|---|---|---|
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
list_user_groups List User Groups ~47
List local user groups on a MikroTik router.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max results to return. |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
list_users List Users ~65
List local users on a MikroTik router. Passwords are never returned.
| Name | Type | Req | Description |
|---|---|---|---|
| group | string | – | Filter by group name (exact match) |
| limit | integer | – | Max results to return. |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
list_vrrp_instances List VRRP Instances ~64
List VRRP instances on a MikroTik router.
| Name | Type | Req | Description |
|---|---|---|---|
| interface | string | – | Filter by master interface name (exact match) |
| limit | integer | – | Max results to return. |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
list_wifi_clients List WiFi Clients ~75
List currently connected WiFi clients (stations) with signal strength and transfer rates.
| Name | Type | Req | Description |
|---|---|---|---|
| interface | string | – | Filter by WiFi interface name |
| limit | integer | – | Max results to return. |
| offset | integer | – | Pagination offset. |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
list_wifi_interfaces List WiFi Interfaces ~79
List WiFi/wireless interfaces on a MikroTik router. Uses /interface/wifi on ROS 7.x, /interface/wireless on older versions.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max results to return. |
| offset | integer | – | Pagination offset. |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
list_wireguard_interfaces List WireGuard Interfaces ~60
List WireGuard interfaces and their status on a MikroTik router.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Max results to return. |
| offset | integer | – | Pagination offset. |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
list_wireguard_peers List WireGuard Peers ~73
List WireGuard peers with last handshake time and transfer statistics.
| Name | Type | Req | Description |
|---|---|---|---|
| interface | string | – | Filter by WireGuard interface name |
| limit | integer | – | Max results to return. |
| offset | integer | – | Pagination offset. |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
manage_address_list_entry Manage Address List Entry ~167
Add or remove a firewall address list entry. Idempotent by list name + address. Supports dry-run mode.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| address | string | yes | IP address or CIDR to add/remove |
| comment | string | – | Optional comment for the entry |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| list | string | yes | Address list name |
| routerId | string | – | Router ID; omit to use the default router. |
| timeout | string | – | Expiry timeout (e.g. 1d, 2h30m) — omit for permanent |
No output schema declared.
No examples provided.
manage_bridge Manage Bridge Interface ~161
Create or remove a bridge interface on a MikroTik router. Idempotent: create returns already_exists if bridge with same name exists.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| comment | string | – | Optional comment |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| disabled | boolean | – | Whether the bridge should be disabled |
| dryRun | boolean | – | Preview changes without applying. |
| name | string | yes | Bridge interface name, taken verbatim for remove; create accepts letters, digits, dot, hyphen, underscore, up to 64 chars |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
manage_bridge_port Manage Bridge Port ~133
Add or remove an interface from a bridge on a MikroTik router. Idempotent: add returns already_exists if the port assignment already exists.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| bridge | string | yes | Bridge interface name |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| interface | string | yes | Interface to add or remove as a bridge port |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
manage_certificate Manage Certificate ~117
Remove, trust, or untrust a certificate. Idempotent: trust/untrust return early if already in the target state.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| name | string | yes | Certificate name — idempotency key |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
manage_container Manage Container ~230
Create, start, stop, or remove a RouterOS container. create needs a pre-configured veth interface; start/stop are no-ops when already in the target state; remove throws NOT_FOUND when absent. Supports dry-run.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| comment | string | – | Optional comment |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| envlist | string | – | RouterOS environment list name for container env vars |
| interface | string | – | veth interface name to attach the container to (required on create — must be pre-configured in RouterOS) |
| name | string | yes | Container name — idempotency key |
| remoteImage | string | – | Docker image to pull (required on create, e.g. alpine:latest) |
| rootDir | string | – | Root directory for container files |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
manage_container_config Manage Container Config ~126
Update global container settings. Idempotent: returns no_change if nothing differs.
| Name | Type | Req | Description |
|---|---|---|---|
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| ramHighMb | integer | – | RAM high-water mark in MB |
| registryUrl | string | – | Container registry URL |
| routerId | string | – | Router ID; omit to use the default router. |
| vethInterface | string | – | Veth interface name for container networking |
No output schema declared.
No examples provided.
manage_container_env Manage Container Env ~155
Add or remove a container environment variable. Idempotent by name+key. add returns already_exists if the entry exists with the same value; throws CONFLICT if the value differs.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| key | string | yes | Environment variable name — part of idempotency key |
| name | string | yes | Container name |
| routerId | string | – | Router ID; omit to use the default router. |
| value | string | – | Environment variable value (required for add) |
No output schema declared.
No examples provided.
manage_container_mount Manage Container Mount ~158
Add or remove a container volume mount. Idempotent by name: add returns already_exists if the mount exists with matching src/dst; throws CONFLICT if name exists with different paths.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| dst | string | – | Container destination path (required for add) |
| name | string | yes | Mount name — idempotency key |
| routerId | string | – | Router ID; omit to use the default router. |
| src | string | – | Host source path (required for add) |
No output schema declared.
No examples provided.
manage_dhcp_client Manage DHCP Client ~219
Add, remove, enable, or disable a DHCP client on an interface. Idempotent by interface name: add returns already_exists if a DHCP client is already configured on the same interface.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| addDefaultRoute | boolean | – | Add default route from DHCP (add only) |
| comment | string | – | Optional comment (add only) |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| interface | string | yes | Interface name — idempotency key (e.g. ether1); for remove/enable/disable a client's display name also matches |
| routerId | string | – | Router ID; omit to use the default router. |
| usePeerDns | boolean | – | Use DNS servers provided by DHCP server (add only) |
| usePeerNtp | boolean | – | Use NTP servers provided by DHCP server (add only) |
No output schema declared.
No examples provided.
manage_dhcp_lease Manage DHCP Lease ~139
Convert a dynamic DHCP lease to static (make-static) or remove a lease. Idempotent by MAC address.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform: make-static converts a dynamic lease to static; remove deletes the lease |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| macAddress | string | yes | MAC address of the lease — idempotency key (case-insensitive) |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
manage_dhcp_server Manage DHCP Server ~192
Add, remove, enable, or disable a DHCP server. Idempotent by name: add returns already_exists if a server with the same name, interface, and address pool already exists.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| addressPool | string | – | IP pool name (required for add) |
| comment | string | – | Optional comment |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| interface | string | – | Interface to serve DHCP on (required for add) |
| leaseTime | string | – | Lease duration (e.g. '1d', '12h') |
| name | string | yes | Server name — idempotency key |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
manage_dns_entry Manage DNS Entry ~329
Add or remove a static DNS entry, found by name (case-insensitive) and type. add returns already_exists if such a record already has the requested value and disabled state (and ttl/comment, when given), and throws CONFLICT if it differs; add never creates a second record with the same name and type. remove deletes the one matching record; when several share the name (round-robin), pass address/cname/text to pick one.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| address | string | – | IP address (required for A records; on remove, picks the record when several share the name) |
| cname | string | – | Target hostname (required for CNAME records; on remove, picks the record when several share the name) |
| comment | string | – | Optional comment |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| disabled | boolean | – | Whether the entry should be disabled |
| dryRun | boolean | – | Preview changes without applying. |
| name | string | yes | Hostname for the DNS record (e.g. server.example.com); matched case-insensitively |
| routerId | string | – | Router ID; omit to use the default router. |
| text | string | – | Text value (required for TXT records; on remove, picks the record when several share the name) |
| ttl | string | – | TTL value (e.g. 1d, 00:05:00) |
| type | string | – | DNS record type |
No output schema declared.
No examples provided.
manage_dns_settings Manage DNS Settings ~210
Update DNS resolver settings (upstream servers, cache size, cache TTL, allow-remote-requests). Idempotent: returns no_change if nothing differs.
| Name | Type | Req | Description |
|---|---|---|---|
| allowRemoteRequests | boolean | – | Allow router to answer DNS queries from the network |
| cacheMaxTtl | string | – | Maximum cache TTL (e.g. '1d', '00:30:00') |
| cacheSize | integer | – | DNS cache size in KiB |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| maxUdpPacketSize | integer | – | Maximum UDP packet size in bytes |
| routerId | string | – | Router ID; omit to use the default router. |
| servers | string | – | Comma-separated upstream DNS server IPs (e.g. '8.8.8.8,1.1.1.1') |
No output schema declared.
No examples provided.
manage_firewall_rule Manage Firewall Rule ~529
Add, remove, disable, or enable a firewall rule on a MikroTik router. Matches addresses, ports, protocol, interfaces, interface lists, and connection/NAT state; nat rules take toAddresses/toPorts (e.g. a dst-nat port forward). Uses comment as idempotency key for deduplication and identification: a repeated add returns already_exists only when the match, NAT targets, and disabled state agree, otherwise CONFLICT (use enable/disable when only the disabled state differs). Supports dry-run mode.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform: add, remove, disable, or enable a firewall rule |
| chain | string | yes | Firewall chain (e.g. forward, input, output, srcnat, dstnat) |
| comment | string | – | Comment to identify the rule (used as idempotency key); omit for none |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| connectionNatState | string | – | Connection NAT state to match, e.g. dstnat or !dstnat |
| connectionState | string | – | Connection-tracking states, comma-separated, optionally negated: established,related or !invalid |
| disabled | boolean | – | Whether the rule should be disabled |
| dryRun | boolean | – | If true, validate and return planned changes without applying |
| dstAddress | string | – | Destination address or network |
| dstPort | string | – | Destination port or range |
| inInterface | string | – | Incoming interface |
| inInterfaceList | string | – | Incoming interface list, e.g. WAN or !LAN |
| outInterface | string | – | Outgoing interface |
| outInterfaceList | string | – | Outgoing interface list, e.g. WAN or !LAN |
| placeBefore | string | – | Place the new rule before this rule ID |
| protocol | string | – | Protocol to match |
| routerId | string | – | Router ID; omit to use the default router. |
| ruleAction | string | yes | RouterOS rule action (e.g. accept, drop, reject, masquerade) |
| srcAddress | string | – | Source address or network |
| srcPort | string | – | Source port or range |
| table | string | – | Firewall table to manage: filter or nat |
| toAddresses | string | – | NAT target address or range (nat table only, e.g. dst-nat) |
| toPorts | string | – | NAT target port or range (nat table only) |
No output schema declared.
No examples provided.
manage_interface_list Manage Interface List ~134
Add or remove an interface list. Idempotent by name. Removing a list that has members is blocked by RouterOS — the error is surfaced as-is.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| comment | string | – | Optional comment |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| name | string | yes | Interface list name — idempotency key |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
manage_interface_list_member Manage Interface List Member ~161
Add or remove an interface from an interface list. Idempotent by list+interface composite key. add returns already_exists if the membership exists. remove returns not_found gracefully.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| comment | string | – | Optional comment |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| interface | string | yes | Interface name to add/remove — part of composite idempotency key |
| list | string | yes | Interface list name — part of composite idempotency key |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
manage_ip_address Manage IP Address ~226
Add, update, or remove an IP address on a MikroTik router interface. Performs idempotency checks for add operations and supports dry-run mode for all actions.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform: add, update, or remove an IP address |
| address | string | yes | IP address with optional prefix length in CIDR notation (e.g., 192.168.1.1/24). Defaults to /32 if prefix is omitted. |
| comment | string | – | Optional comment for the IP address entry |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| disabled | boolean | – | Whether the IP address should be disabled |
| dryRun | boolean | – | If true, validate and return planned changes without applying |
| interface | string | yes | Interface to assign the IP address to |
| network | string | – | Network address (auto-calculated from address if omitted) |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
manage_ip_pool Manage IP Pool ~168
Add or remove an IP address pool. Idempotent by name: add returns already_exists if a pool with the same name and ranges already exists.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| name | string | yes | Pool name — idempotency key |
| nextPool | string | – | Next pool name for overflow |
| ranges | string | – | IP range (e.g. '192.168.1.100-192.168.1.200'; required for add) |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
manage_ip_service Manage IP Service ~212
Enable or disable a RouterOS IP service (api, api-ssl, ssh, telnet, www, www-ssl, winbox, ftp). Port number changes are intentionally not supported to prevent accidental lockout. MikroMCP reaches RouterOS through the REST API on www-ssl (or www for plaintext): disabling the service its connection uses cuts MikroMCP off from the router, including any later call to re-enable it.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform — only enable/disable to prevent accidental lockout from changing ports |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| name | string | yes | Service name to manage (api, api-ssl, ssh, telnet, www, www-ssl, winbox, ftp) |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
manage_ipsec_peer Manage IPSec Peer ~183
Add, remove, enable, or disable an IPSec peer. Idempotent by name: add returns already_exists if a peer with the same name and address already exists.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| address | string | – | Remote gateway address (required for add) |
| comment | string | – | Optional comment |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| exchange | string | – | IKE exchange mode |
| localAddress | string | – | Local address |
| name | string | yes | Peer name — idempotency key |
| profile | string | – | IKE profile name |
| routerId | string | – | Router ID; omit to use the default router. |
No output schema declared.
No examples provided.
manage_ipsec_policy Manage IPSec Policy ~217
Add, remove, enable, or disable an IPSec policy. Idempotent by composite key (srcAddress + dstAddress + tunnel).
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| dstAddress | string | yes | Destination CIDR — part of composite idempotency key |
| ipsecAction | string | – | IPSec action (required for add) |
| level | string | – | SA level |
| routerId | string | – | Router ID; omit to use the default router. |
| saDstAddress | string | – | SA destination IP for tunnel mode |
| saSourceAddress | string | – | SA source IP for tunnel mode |
| srcAddress | string | yes | Source CIDR — part of composite idempotency key |
| tunnel | boolean | – | Tunnel mode — part of composite idempotency key |
No output schema declared.
No examples provided.
manage_log_action Manage Log Action ~213
Add or remove a RouterOS logging action target. Idempotent by name. add throws VALIDATION if type is missing; returns already_exists if name found. remove returns not_found gracefully. Supports dry-run.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| diskFileName | string | – | Disk log file name without extension (for type=disk) |
| dryRun | boolean | – | Preview changes without applying. |
| name | string | yes | Log action name — idempotency key |
| remote | string | – | Remote syslog server address (for type=remote) |
| remotePort | integer | – | Remote syslog server port (for type=remote) |
| routerId | string | – | Router ID; omit to use the default router. |
| type | string | – | Action type: memory, disk, remote, echo, email (required on add) |
No output schema declared.
No examples provided.
manage_log_rule Manage Log Rule ~189
Add, remove, enable, or disable a RouterOS logging rule. Idempotent by topics+logAction (add → already_exists on match; remove → not_found handled gracefully; enable/disable throw NOT_FOUND when absent). Supports dry-run.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| logAction | string | yes | Log action target name (RouterOS action field) — idempotency key |
| prefix | string | – | Optional prefix to prepend to log messages |
| routerId | string | – | Router ID; omit to use the default router. |
| topics | string | yes | Log topics (e.g. firewall, system, info) — idempotency key |
No output schema declared.
No examples provided.
manage_mangle_rule Manage Mangle Rule ~593
Add, remove, enable, or disable a firewall mangle rule. ruleAction sets the action; when it is omitted, a new* value implies its own (newRoutingMark → mark-routing), otherwise accept. Each new* value is accepted only under its action. Uses comment as idempotency key: a repeated add returns already_exists only when the chain, match fields, marks, DSCP, MSS, passthrough, and the given or implied action agree, otherwise CONFLICT. Supports dry-run mode.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| chain | string | – | Mangle chain (required on add): prerouting, input, forward, output, postrouting |
| comment | string | yes | Idempotency key — uniquely identifies this mangle rule |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| dstAddress | string | – | Destination IP/CIDR to match |
| dstAddressList | string | – | Destination address list name to match |
| dstPort | string | – | Destination port or range |
| inInterface | string | – | Incoming interface to match |
| newConnectionMark | string | – | Connection mark to set (ruleAction mark-connection) |
| newDscpValue | integer | – | DSCP value to set, 0–63 (ruleAction change-dscp) |
| newMss | – | – | MSS to set: a number or clamp-to-pmtu (ruleAction change-mss, with protocol tcp and tcpFlags syn) |
| newPacketMark | string | – | Packet mark to set (ruleAction mark-packet) |
| newRoutingMark | string | – | Routing mark to set (ruleAction mark-routing, chain prerouting or output) |
| outInterface | string | – | Outgoing interface to match |
| passthrough | boolean | – | Whether to continue matching subsequent rules |
| protocol | string | – | Protocol to match (e.g. tcp, udp) |
| routerId | string | – | Router ID; omit to use the default router. |
| ruleAction | string | – | Mangle action, add only. Omitted: the action of the new* value given (newRoutingMark → mark-routing, newConnectionMark → mark-connection, newPacketMark → mark-packet, newDscpValue → change-dscp, newM… |
| srcAddress | string | – | Source IP/CIDR to match |
| srcAddressList | string | – | Source address list name to match |
| srcPort | string | – | Source port or range |
| tcpFlags | string | – | TCP flags to match, comma-separated, ! negates one (e.g. "syn"); needs protocol tcp |
No output schema declared.
No examples provided.
manage_netwatch_entry Manage Netwatch Entry ~194
Add, remove, enable, or disable a Netwatch monitoring entry. Idempotent by host+port: add returns already_exists if an entry with the same host and port already exists.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| comment | string | – | Optional comment |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| host | string | yes | Host to monitor — idempotency key |
| interval | string | – | Check interval (e.g. '1m'; default '1m') |
| port | integer | – | TCP port (optional; ICMP if omitted) |
| routerId | string | – | Router ID; omit to use the default router. |
| timeout | string | – | Probe timeout (e.g. '500ms') |
No output schema declared.
No examples provided.
manage_ntp_client Manage NTP Client ~146
Update NTP client settings on a MikroTik router. Idempotent: returns already_set if no changes are needed.
| Name | Type | Req | Description |
|---|---|---|---|
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| dryRun | boolean | – | Preview changes without applying. |
| enabled | boolean | – | Enable or disable the NTP client |
| mode | string | – | NTP client mode |
| routerId | string | – | Router ID; omit to use the default router. |
| servers | string | – | Comma-separated NTP server addresses |
| vlanInterface | string | – | VLAN interface for NTP communication |
No output schema declared.
No examples provided.
manage_ovpn_client Manage OpenVPN Client ~230
Add, update, or remove an OpenVPN client interface. Idempotent by name (already_exists on matching name+connectTo; CONFLICT on differing connectTo; no_change when an update differs in nothing). Password is always written when provided since RouterOS does not return it on GET.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | Action to perform |
| certificate | string | – | Client certificate name |
| confirmationToken | string | – | Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action. |
| connectTo | string | – | Remote server address (required for add) |
| dryRun | boolean | – | Preview changes without applying. |
| mode | string | – | Tunnel mode |
| name | string | yes | OpenVPN client interface name — idempotency key |
| password | string | – | VPN password (never logged) |
| port | integer | – | Remote port number |
| protocol | string | – | Transport protocol |
| routerId | string | – | Router ID; omit to use the default router. |
| user | string | – | VPN username |
No output schema declared.
No examples provided.
How do I install the MikroMCP MCP server?
MikroMCP runs locally as an npm package, launched with npx -y mikromcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · mikromcp
claude mcp add alikarami-mikromcp -- npx -y mikromcp
What is the MikroMCP MCP server?
MikroMCP is an MCP server listed in the public MCP registry as io.github.AliKarami/mikromcp. MCP server for MikroTik RouterOS and SwOS: typed tools, dry-run, RBAC, audit logs, and rollback. This page covers its npm package (mikromcp).
Is the MikroMCP MCP server safe to use?
MikroMCP scores 89 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 5 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the MikroMCP MCP server expose?
MikroMCP exposes 133 tools: get_system_status, list_interfaces, list_ip_addresses, manage_ip_address, list_dhcp_leases, and 128 more. Their descriptions and schemas cost roughly 19,031 tokens of context every time the server is loaded.
Is the MikroMCP MCP server still maintained?
MikroMCP is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the MikroMCP MCP server under?
MikroMCP declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.
What did VerifyMCP test on the MikroMCP MCP server?
VerifyMCP ran 16 checks on MikroMCP, covering Malware scan, Known CVEs, Install scripts, Dependency health and 12 more. Endpoint Security and Transport & Reachability do not apply to an npm package, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.