MikroMCP

NPM · MIKROMCP · SCANNED AUG 3

MCP server for MikroTik RouterOS: typed tools, dry-run, RBAC, audit logs, and rollback.

Available components

+35 this week 80 80 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security87

No malware found by supply-chain analysis.Pass
Only part of the dependency tree could be resolved (147 of 151), so this covers what we could see, not the whole tree.Partial
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (147 of 151), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency97

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Cryptographically verified build provenance (signed, bound to AliKarami/MikroMCP). View diagnostics → Pass
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 12 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability76

AI-judged instruction clarity (excellent).Pass
Context-footprint check failed: tool/resource definitions use about 14616 tokens (~123/item across 118 items; 118 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management27

Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial

Tool Coverage100

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
100% of tool parameters carry a description.Pass

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · mikromcp

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add alikarami-mikromcp -- npx -y mikromcp

# add to Codex CLI

codex mcp add alikarami-mikromcp -- npx -y mikromcp

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "alikarami-mikromcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "mikromcp"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add alikarami-mikromcp --command npx --arg -y --arg mikromcp

# ~/.hermes/config.yaml

mcp_servers:
  alikarami-mikromcp:
    command: "npx"
    args: ["-y", "mikromcp"]

// mcp.json

{
  "mcpServers": {
    "alikarami-mikromcp": {
      "command": "npx",
      "args": [
        "-y",
        "mikromcp"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

3 Aug 26 +1

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.
2 Aug 26 +59
- Known CVEs: unverified → partial ▲ security
- Install scripts: unverified → pass ▲ security
- Provenance: unverified → pass ▲ security
- Malware scan: unverified → pass ▲ security
- The attested source repository moved: AliKarami/MikroMCP security
- Security disclosure: fail → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Stability: unverified → 0.23 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Maintenance: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- License: unverified → pass ▲ functional
- Schema quality: unverified → excellent ▲ functional
- Licence: MIT functional
1 Aug 26 −29
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
31 Jul 26 +24
- Malware scan: pass → unverified ▼ security
- Provenance: unverified → pass ▲ security
- Install scripts: unverified → pass ▲ security
- The attested source repository moved: AliKarami/MikroMCP security
- Dependency health: partial → unverified ▼ functional
- Maintenance: unverified → pass ▲ functional
- License: unverified → pass ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- Licence: MIT functional
30 Jul 26 −20
- Tool coverage: 100 → unverified ▼ functional
- Dependency health: unverified → partial ▲ functional
- First check of Schema quality: unverified functional
27 Jul 26 45

First indexed and scored.

Show 3 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/[email protected]

Provenance verified

Ecosystem: npm · Outcome: verified

Reason: verified

Source repo:: AliKarami/MikroMCP
Certificate issuer:: https://token.actions.githubusercontent.com
Certificate SAN:: https://github.com/AliKarami/MikroMCP/.github/workflows/release.yml@refs/tags/v1.8.0
Rekor log index:: 2210870027
Predicate type:: https://slsa.dev/provenance/v1
Subject digest:: sha512:0606b0b9ccc755a3356526c7727fe274df619ed9234e4e97d11be3beb86fe49d55a73a1b70129be6863c7d4f5985bc16828c8e4f98d100856bf2ba98c
Discovery method:: attestation_endpoint

Dependencies 147 packages

147 packages in the resolved dependency tree · 147 deprecated · 40 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 118 exposed · ~14,519 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

manage_script Manage Script ~171

Add, update, or remove a RouterOS script. Idempotent by name. add throws CONFLICT if the name already exists; update throws NOT_FOUND if it does not. Supports dry-run.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
comment	string	—	Optional comment
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
dontRequirePermissions	boolean	—	Allow script to run without elevated permissions
dryRun	boolean	—	Preview changes without applying.
name	string	yes	Script name — idempotency key
routerId	string	—	Router ID; omit to use the default router.
source	string	—	Script body (required for add and update)

No output schema declared.

No examples provided.

manage_upgrade Manage Upgrade ~136

Trigger a RouterOS package update check or install. 'check' queries the update server for new packages. 'install' downloads and applies the update — the router will reboot automatically. Supports dry-run.

Input Output Examples

Name	Type	Req	Description
action	string	yes	check — trigger a check for available updates; install — download and install the latest update (triggers reboot)
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
dryRun	boolean	—	Preview the action without executing
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

manage_user Manage User ~192

Add, remove, enable, disable, or set the password for a local RouterOS user. Idempotent by name: add returns already_exists if a user with the same name and group already exists.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
address	string	—	Allowed source address or range
comment	string	—	Optional comment
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
dryRun	boolean	—	Preview changes without applying.
group	string	—	Group name (required for add; e.g. 'read', 'write', 'full')
name	string	yes	Username — idempotency key
password	string	—	Password (required for add and set-password)
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

manage_user_group Manage User Group ~162

Add, update, or remove a local RouterOS user group. Idempotent by name: add returns already_exists if a group with the same name and policy already exists.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
dryRun	boolean	—	Preview changes without applying.
name	string	yes	Group name — idempotency key
policy	string	—	Comma-separated policy list (e.g. 'read,write,ftp')
routerId	string	—	Router ID; omit to use the default router.
skin	string	—	Optional skin name for the group

No output schema declared.

No examples provided.

manage_vlan Manage VLAN Interface ~232

Add, remove, enable, or disable a VLAN interface. Idempotent by name: add returns already_exists when a VLAN with matching name, vlan-id, and parent interface exists. Supports dry-run mode.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
comment	string	—	Optional comment (add only)
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
disabled	boolean	—	Whether to create the VLAN disabled (add only)
dryRun	boolean	—	Preview changes without applying.
mtu	integer	—	MTU size (add only)
name	string	yes	VLAN interface name — idempotency key (alphanumeric, hyphens, underscores, max 15 chars)
parentInterface	string	—	Parent interface name (e.g., ether1, bridge1; required for add)
routerId	string	—	Router ID; omit to use the default router.
vlanId	integer	—	VLAN ID (1-4094; required for add)

No output schema declared.

No examples provided.

manage_vrrp_instance Manage VRRP Instance ~207

Add, remove, enable, or disable a VRRP instance. Idempotent by name: add returns already_exists if an instance with the same name, interface, and VRID already exists.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
comment	string	—	Optional comment
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
dryRun	boolean	—	Preview changes without applying.
interface	string	—	Master interface (required for add)
interval	integer	—	Advertisement interval in seconds
name	string	yes	VRRP interface name — idempotency key
priority	integer	—	Router priority (1–254)
routerId	string	—	Router ID; omit to use the default router.
version	string	—	VRRP protocol version
vrid	integer	—	Virtual router ID (required for add)

No output schema declared.

No examples provided.

manage_wifi_interface Manage WiFi Interface ~144

Enable, disable, or update SSID settings on a WiFi interface. At least one of disabled or ssid must be provided.

Input Output Examples

Name	Type	Req	Description
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
disabled	boolean	—	Set to true to disable, false to enable
dryRun	boolean	—	Preview changes without applying.
name	string	yes	WiFi interface name (e.g. wifi1, wlan1)
routerId	string	—	Router ID; omit to use the default router.
ssid	string	—	New SSID to set

No output schema declared.

No examples provided.

manage_wireguard_interface Manage WireGuard Interface ~182

Add, remove, enable, or disable a WireGuard interface. Idempotent by name. RouterOS generates the private key on create — it is never passed in. The public key is returned after creation.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
comment	string	—	Optional comment
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
dryRun	boolean	—	Preview changes without applying.
listenPort	integer	—	UDP listen port (RouterOS picks one if omitted)
mtu	integer	—	MTU (default 1420)
name	string	yes	Interface name — idempotency key (e.g. wg0)
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

manage_wireguard_peer Manage WireGuard Peer ~215

Add or remove a WireGuard peer. Idempotent by public key: add returns already_exists if a peer with the same public key already exists on the interface.

Input Output Examples

Name	Type	Req	Description
action	string	yes	Action to perform
allowedAddress	string	—	Allowed IP address/CIDR for this peer (e.g. 10.0.0.2/32)
comment	string	—	Optional comment
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
dryRun	boolean	—	Preview changes without applying.
endpoint	string	—	Peer endpoint as IP:port (e.g. 1.2.3.4:51820)
interface	string	yes	WireGuard interface name (e.g. wg0)
publicKey	string	yes	Peer public key in base64 format (44 characters)
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

ping Ping ~122

Send ICMP echo requests from the router to a target address. Returns per-packet RTT and summary statistics. 100% packet loss is a valid result, not an error.

Input Output Examples

Name	Type	Req	Description
address	string	yes	Target IP address or hostname to ping
count	integer	—	Number of ICMP echo requests (1–20)
routerId	string	—	Router ID; omit to use the default router.
routingTable	string	—	Routing table to use for the ping
size	integer	—	Packet size in bytes (14–65535)

No output schema declared.

No examples provided.

plan_changes Plan Changes ~83

Preview a sequence of write operations: each step runs with dryRun=true against live state, returning affected paths and the predicted action per step. Use apply_plan to execute the same steps for real.

Input Output Examples

Name	Type	Req	Description
routerId	string	—	Router ID; omit to use the default router.
steps	array	yes	Ordered list of write operations to preview (up to 10)

No output schema declared.

No examples provided.

reboot Reboot ~119

Trigger a controlled router reboot with an optional delay. Supports dry-run. Use this tool instead of run_command for reboots — run_command's deny list blocks /system reboot*.

Input Output Examples

Name	Type	Req	Description
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
delay	integer	—	Seconds before rebooting (0–3600)
dryRun	boolean	—	Preview the reboot without executing
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

rollback_change Rollback Change ~145

Restore RouterOS state to before a write, identified by its journal ID: reads the before-snapshot, diffs against live state, and applies the reverse. Use dryRun=true to preview the restore plan. Requires MIKROMCP_DATA_DIR (defaults to data/).

Input Output Examples

Name	Type	Req	Description
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
dryRun	boolean	—	Preview the restore plan without applying changes
journalId	string	yes	Journal entry ID from write-journal.ndjson to roll back
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

run_command Run Command ~151

Execute an arbitrary RouterOS console command via SSH. Guarded by an allow/deny policy (built-in deny list blocks destructive commands; tighten via cmdAllow in routers.yaml or MIKROMCP_CMD_ALLOW). Prefer dedicated tools (reboot, etc.) where available. Output capped at 4000 characters.

Input Output Examples

Name	Type	Req	Description
command	string	yes	RouterOS console command to execute
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
dryRun	boolean	—	Preview the command without executing (validates allow/deny policy only)
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

run_script Run Script ~106

Execute a named RouterOS script. Fire-and-forget — the script runs asynchronously and its output is written to the router system log. Use get_log after calling this tool to see results.

Input Output Examples

Name	Type	Req	Description
confirmationToken	string	—	Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.
name	string	yes	Name of the script to execute
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

set_system_clock Set System Clock ~145

Set the system date, time, and/or timezone on a MikroTik router. Idempotent: returns already_set if the values already match. Supports dry-run.

Input Output Examples

Name	Type	Req	Description
date	string	—	Date in RouterOS format: mon/dd/yyyy (e.g. jan/02/2006)
dryRun	boolean	—	Preview changes without applying.
routerId	string	—	Router ID; omit to use the default router.
time	string	—	Time in RouterOS format: hh:mm:ss (e.g. 15:04:05)
timeZoneName	string	—	IANA timezone name (e.g. Europe/London, UTC)

No output schema declared.

No examples provided.

torch Torch ~123

Capture a real-time traffic snapshot on a router interface. The tool call blocks for the duration (seconds) and returns top flows by bytes. readOnlyHint true — auto-retry enabled.

Input Output Examples

Name	Type	Req	Description
dstAddress	string	—	Filter by destination IP address
duration	integer	—	Capture duration in seconds (1–30)
interface	string	yes	Interface name to monitor (e.g. ether1, bridge1)
routerId	string	—	Router ID; omit to use the default router.
srcAddress	string	—	Filter by source IP address

No output schema declared.

No examples provided.

traceroute Traceroute ~102

Trace the network path from the router to a target address. Returns an ordered hop list with RTT per hop. Timeouts and partial results are valid responses.

Input Output Examples

Name	Type	Req	Description
address	string	yes	Target IP address or hostname to trace
count	integer	—	Probes per hop (1–5)
maxHops	integer	—	Maximum number of hops (1–30)
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

upload_file Upload File ~132

Upload a text file to a router, overwriting any existing file of the same name. Prefers SFTP (encrypted, over SSH) and falls back to plaintext FTP if SFTP is unavailable. Requires SSH (or FTP) access for the router user. Dry-run tests connectivity only.

Input Output Examples

Name	Type	Req	Description
content	string	yes	File content to upload (text)
dryRun	boolean	—	Validate FTP connectivity without writing the file
name	string	yes	Target filename on the router (e.g. flash/my-script.rsc)
routerId	string	—	Router ID; omit to use the default router.

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 3 Aug