# io.github.wiresage/mikrotik-mcp (pypi · mcp-server-mikrotik)

MCP server for MikroTik routers: firewall, NAT, routing, DHCP, DNS, WireGuard and more via SSH.

- Trust score: 71/100 (medium)
- Change this week: −12
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- pypi · `mcp-server-mikrotik`: 71/100 (this document), [markdown](https://verifymcp.io/servers/wiresage-mikrotik-mcp/mcp-server-mikrotik.md), [page](https://verifymcp.io/servers/wiresage-mikrotik-mcp/mcp-server-mikrotik)

## Channel facts

- Registry: `pypi`
- Package: `mcp-server-mikrotik`
- Version: `0.26.2.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 50/100
  - Malware scan not yet available for this package.
  - No known CVEs affecting this package version or its production dependencies.
  - Runs hatchling.build at install time, a recognised build step with no custom scripting around it.
  - 1 of 38 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 100/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to wiresage/mikrotik-mcp).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 9 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 58/100
  - AI-judged instruction clarity (fair).
  - Tool/resource definitions use about 15428 tokens (~72/item across 212 items; 212 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 73/100
  - Stability observed for 22 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 71/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 0% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 24 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 213 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### How do I install the io.github.wiresage/mikrotik-mcp server?

io.github.wiresage/mikrotik-mcp runs locally as a PyPI package, launched with uvx mcp-server-mikrotik. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add wiresage-mikrotik-mcp -- uvx mcp-server-mikrotik
```

### Cursor

```json
{
  "mcpServers": {
    "wiresage-mikrotik-mcp": {
      "command": "uvx",
      "args": [
        "mcp-server-mikrotik"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "wiresage-mikrotik-mcp": {
      "command": "uvx",
      "args": [
        "mcp-server-mikrotik"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add wiresage-mikrotik-mcp -- uvx mcp-server-mikrotik
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "wiresage-mikrotik-mcp": {
      "type": "local",
      "command": [
        "uvx",
        "mcp-server-mikrotik"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add wiresage-mikrotik-mcp --command uvx --arg mcp-server-mikrotik
```

### Hermes

```yaml
mcp_servers:
  wiresage-mikrotik-mcp:
    command: "uvx"
    args: ["mcp-server-mikrotik"]
```

### Netclaw

```json
{
  "McpServers": {
    "wiresage-mikrotik-mcp": {
      "Transport": "stdio",
      "Command": "uvx",
      "Arguments": [
        "mcp-server-mikrotik"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add wiresage-mikrotik-mcp -t stdio -c uvx -a mcp-server-mikrotik
```

### Other

```json
{
  "mcpServers": {
    "wiresage-mikrotik-mcp": {
      "command": "uvx",
      "args": [
        "mcp-server-mikrotik"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 71, −15)

- [security regression] Malware scan: pass → unverified

### 2026-11-03 (score 86, +1)

No change was recorded against any check on this day. Stability & Change Management went from 63 to 67. That category is still filling its 30-day observation window: 19 days of observed history at the previous scan, 20 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-01 (score 85, +1)

No change was recorded against any check on this day. Stability & Change Management went from 57 to 60. That category is still filling its 30-day observation window: 17 days of observed history at the previous scan, 18 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-30 (score 84, +1)

No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-28 (score 83, +1)

No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-26 (score 82, +1)

- [functional] Package version: 0.26.1.0 → 0.26.2.0

### 2026-10-24 (score 81, +16)

- [security improvement] Malware scan: unverified → pass

### 2026-10-23 (score 65, −15)

- [security regression] Malware scan: pass → unverified
- [functional] Package version: 0.25.1.0 → 0.26.1.0

## MCP tools (212)

### `create_backup` (~49 tokens)

Creates a system backup on the MikroTik device.

Input parameters:

- `comment`
- `device`
- `dont_encrypt` (boolean)
- `include_password` (boolean)
- `name`

Output parameters:

- `result` (string)

### `list_backups` (~37 tokens)

Lists backup files on the MikroTik device.

Input parameters:

- `device`
- `include_exports` (boolean)
- `name_filter`

Output parameters:

- `result` (string)

### `create_export` (~78 tokens)

Creates a configuration export file (rsc/json/xml) on the MikroTik device.

Input parameters:

- `comment`
- `compact` (boolean)
- `device`
- `export_type` (string)
- `file_format` (string)
- `hide_sensitive` (boolean)
- `name`
- `verbose` (boolean)

Output parameters:

- `result` (string)

### `export_section` (~100 tokens)

Returns a RouterOS configuration section as an export script.

Notes:
    section: RouterOS path without leading slash e.g. "ip address", "interface vlan",
        "ip firewall filter", "ip firewall nat", "queue simple"
    hide_sensitive: keep secrets out of the output (False appends show-sensitive)

Input parameters:

- `compact` (boolean)
- `device`
- `hide_sensitive` (boolean)
- `section` (string, required)

Output parameters:

- `result` (string)

### `download_file` (~46 tokens)

Downloads a backup or export file from the MikroTik device as base64-encoded content.

Input parameters:

- `device`
- `file_type` (string)
- `filename` (string, required)

Output parameters:

- `result` (string)

### `upload_file` (~47 tokens)

Uploads a base64-encoded file to the MikroTik device (for restore operations).

Input parameters:

- `content_base64` (string, required)
- `device`
- `filename` (string, required)

Output parameters:

- `result` (string)

### `restore_backup` (~40 tokens)

Restores a system backup on the MikroTik device; triggers a reboot.

Input parameters:

- `device`
- `filename` (string, required)
- `password`

Output parameters:

- `result` (string)

### `import_configuration` (~53 tokens)

Imports and executes a RouterOS configuration script (.rsc file) on the device.

Input parameters:

- `device`
- `filename` (string, required)
- `run_after_reset` (boolean)
- `verbose` (boolean)

Output parameters:

- `result` (string)

### `remove_file` (~30 tokens)

Removes a file from the MikroTik device filesystem.

Input parameters:

- `device`
- `filename` (string, required)

Output parameters:

- `result` (string)

### `backup_info` (~33 tokens)

Gets detailed information about a backup file on the MikroTik device.

Input parameters:

- `device`
- `filename` (string, required)

Output parameters:

- `result` (string)

### `create_dhcp_server` (~111 tokens)

Creates a DHCP server bound to the specified interface on the MikroTik device.

Notes:
    lease_time: duration e.g. "1d", "12h", "30m", "1h30m"

Input parameters:

- `address_pool`
- `authoritative` (string)
- `comment`
- `delay_threshold`
- `device`
- `disabled` (boolean)
- `interface` (string, required)
- `lease_time` (string)
- `name` (string, required)

Output parameters:

- `result` (string)

### `list_dhcp_servers` (~52 tokens)

Lists DHCP servers on the MikroTik device.

Input parameters:

- `device`
- `disabled_only` (boolean)
- `interface_filter`
- `invalid_only` (boolean)
- `name_filter`

Output parameters:

- `result` (string)

### `list_dhcp_leases` (~119 tokens)

Lists detailed IPv4 DHCP leases, optionally filtering active lease fields.

Notes:
    Address and identity filters are substring matches. Server, status, and
    lease time filters are exact matches against RouterOS `lease-time`.

Input parameters:

- `address_filter`
- `class_id_filter`
- `client_id_filter`
- `device`
- `hostname_filter`
- `last_seen_within`
- `lease_time_filter`
- `mac_filter`
- `server_filter`
- `status_filter`

Output parameters:

- `result` (string)

### `list_dhcpv6_bindings` (~108 tokens)

Lists detailed DHCPv6 bindings.

Notes:
    Address and DUID filters are substring matches. IAID, server, status,
    and lease time filters are exact matches; lease time maps to `life-time`.

Input parameters:

- `address_filter`
- `device`
- `duid_filter`
- `iaid_filter`
- `last_seen_within`
- `lease_time_filter`
- `server_filter`
- `status_filter`

Output parameters:

- `result` (string)

### `get_dhcp_server` (~31 tokens)

Gets detailed information about a specific DHCP server.

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `create_dhcp_network` (~91 tokens)

Creates a DHCP network configuration (gateway, DNS, domain, etc.) on the MikroTik device.

Input parameters:

- `comment`
- `device`
- `dhcp_option`
- `dns_servers`
- `domain`
- `gateway` (string, required)
- `netmask`
- `network` (string, required)
- `ntp_servers`
- `wins_servers`

Output parameters:

- `result` (string)

### `update_dhcp_network` (~116 tokens)

Updates fields on an existing DHCP network entry on the MikroTik device.

Notes:
    Pass an empty list for dns_servers/wins_servers/ntp_servers/dhcp_option
    (or "" for domain) to clear that field.

Input parameters:

- `comment`
- `device`
- `dhcp_option`
- `dns_servers`
- `domain`
- `gateway`
- `netmask`
- `network` (string, required)
- `ntp_servers`
- `wins_servers`

Output parameters:

- `result` (string)

### `remove_dhcp_network` (~33 tokens)

Removes a DHCP network configuration from the MikroTik device.

Input parameters:

- `device`
- `network` (string, required)

Output parameters:

- `result` (string)

### `create_dhcp_pool` (~126 tokens)

Creates a DHCP address pool with the given IP ranges on the MikroTik device.

Notes:
    ranges: hyphen-separated range(s) e.g. "192.168.1.1-192.168.1.100"
        Multiple ranges comma-separated: "10.0.0.1-10.0.0.50,10.0.0.100-10.0.0.120"

Input parameters:

- `comment`
- `device`
- `name` (string, required)
- `next_pool`
- `ranges` (string, required)

Output parameters:

- `result` (string)

### `remove_dhcp_server` (~32 tokens)

Removes a DHCP server from the MikroTik device.

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `set_dns_servers` (~90 tokens)

Sets DNS server configuration.

Input parameters:

- `allow_remote_requests` (boolean)
- `cache_max_ttl`
- `cache_size`
- `device`
- `doh_server`
- `max_concurrent_queries`
- `max_udp_packet_size`
- `servers` (array, required)
- `use_doh` (boolean)
- `verify_doh_cert` (boolean)

Output parameters:

- `result` (string)

### `get_dns_settings` (~19 tokens)

Gets current DNS configuration.

Input parameters:

- `device`

Output parameters:

- `result` (string)

### `add_dns_static` (~148 tokens)

Adds a static DNS entry.

Notes:
    regexp: a regular expression the name must match. A regexp entry has no name, so ``name`` is
        ignored when ``regexp`` is given (RouterOS refuses both: "only name or regexp allowed").

Input parameters:

- `address`
- `cname`
- `comment`
- `device`
- `disabled` (boolean)
- `mx_exchange`
- `mx_preference`
- `name` (string, required)
- `regexp`
- `srv_port`
- `srv_priority`
- `srv_target`
- `srv_weight`
- `text`
- `ttl`

Output parameters:

- `result` (string)

### `list_dns_static` (~53 tokens)

Lists static DNS entries.

Input parameters:

- `address_filter`
- `device`
- `disabled_only` (boolean)
- `name_filter`
- `regexp_only` (boolean)
- `type_filter`

Output parameters:

- `result` (string)

### `get_dns_static` (~31 tokens)

Gets details of a specific static DNS entry.

Input parameters:

- `device`
- `entry_id` (string, required)

Output parameters:

- `result` (string)

### `update_dns_static` (~105 tokens)

Updates a static DNS entry.

Input parameters:

- `address`
- `cname`
- `comment`
- `device`
- `disabled`
- `entry_id` (string, required)
- `mx_exchange`
- `mx_preference`
- `name`
- `regexp`
- `srv_port`
- `srv_priority`
- `srv_target`
- `srv_weight`
- `text`
- `ttl`

Output parameters:

- `result` (string)

### `remove_dns_static` (~28 tokens)

Removes a static DNS entry.

Input parameters:

- `device`
- `entry_id` (string, required)

Output parameters:

- `result` (string)

### `enable_dns_static` (~28 tokens)

Enables a static DNS entry.

Input parameters:

- `device`
- `entry_id` (string, required)

Output parameters:

- `result` (string)

### `disable_dns_static` (~29 tokens)

Disables a static DNS entry.

Input parameters:

- `device`
- `entry_id` (string, required)

Output parameters:

- `result` (string)

### `get_dns_cache` (~20 tokens)

Gets the current DNS cache.

Input parameters:

- `device`

Output parameters:

- `result` (string)

### `flush_dns_cache` (~20 tokens)

Flushes the DNS cache.

Input parameters:

- `device`

Output parameters:

- `result` (string)

### `get_dns_cache_statistics` (~20 tokens)

Gets DNS cache statistics.

Input parameters:

- `device`

Output parameters:

- `result` (string)

### `add_dns_regexp` (~54 tokens)

Adds a DNS regexp entry.

Input parameters:

- `address` (string, required)
- `comment`
- `device`
- `disabled` (boolean)
- `regexp` (string, required)
- `ttl` (string)

Output parameters:

- `result` (string)

### `test_dns_query` (~62 tokens)

Tests a DNS query.

Notes:
    type: accepted values are A/ipv4, AAAA/ipv6, any, any6

Input parameters:

- `device`
- `name` (string, required)
- `server`
- `type` (string)

Output parameters:

- `result` (string)

### `export_dns_config` (~27 tokens)

Exports DNS configuration to a file.

Input parameters:

- `device`
- `filename`

Output parameters:

- `result` (string)

### `create_address_list_entry` (~142 tokens)

Adds an entry to an IPv4 or IPv6 firewall address list.

Notes:
    address: an address or prefix; a hostname is also accepted and RouterOS
        adds a dynamic child entry per resolved address.
    timeout: RouterOS duration e.g. "1h". An entry with a timeout is
        dynamic, so it does not survive a reboot.
    list_name is matched exactly, including any leading or trailing spaces.

Input parameters:

- `address` (string, required)
- `comment`
- `device`
- `disabled` (boolean)
- `family` (string, required)
- `list_name` (string, required)
- `timeout`

Output parameters:

- `result` (string)

### `list_address_list_entries` (~111 tokens)

Lists IPv4 or IPv6 firewall address list entries.

Notes:
    list_filter: exact list name, including any trailing space.
    address_filter/comment_filter: partial match.
    static_only excludes the dynamic children a hostname entry creates.

Input parameters:

- `address_filter`
- `comment_filter`
- `device`
- `disabled_only` (boolean)
- `dynamic_only` (boolean)
- `family` (string, required)
- `list_filter`
- `static_only` (boolean)

Output parameters:

- `result` (string)

### `get_address_list_entry` (~48 tokens)

Gets one address list entry by list name and address.

Input parameters:

- `address` (string, required)
- `device`
- `family` (string, required)
- `list_name` (string, required)

Output parameters:

- `result` (string)

### `update_address_list_entry` (~98 tokens)

Updates an address list entry, located by its current list name and address.

Notes:
    Pass "" to clear comment or timeout.
    A change is confirmed on the device before success is reported.

Input parameters:

- `address` (string, required)
- `comment`
- `device`
- `disabled`
- `family` (string, required)
- `list_name` (string, required)
- `new_list_name`
- `timeout`

Output parameters:

- `result` (string)

### `remove_address_list_entry` (~68 tokens)

Removes an address list entry by list name and address.

Notes:
    Removing a hostname entry also clears the dynamic entries RouterOS
    derived from it.

Input parameters:

- `address` (string, required)
- `device`
- `family` (string, required)
- `list_name` (string, required)

Output parameters:

- `result` (string)

### `enable_address_list_entry` (~43 tokens)

Enables an address list entry.

Input parameters:

- `address` (string, required)
- `device`
- `family` (string, required)
- `list_name` (string, required)

Output parameters:

- `result` (string)

### `disable_address_list_entry` (~44 tokens)

Disables an address list entry.

Input parameters:

- `address` (string, required)
- `device`
- `family` (string, required)
- `list_name` (string, required)

Output parameters:

- `result` (string)

### `create_filter_rule` (~285 tokens)

Creates a firewall filter rule in the specified chain on the MikroTik device.

Notes:
    connection_state: comma-separated e.g. "established,related,new,invalid"
    limit: RouterOS rate/burst string e.g. "10,5:packet" or "10/1s:packet"
    tcp_flags: RouterOS flag expression e.g. "syn,!ack"
    place_before: rule number or ID (*N) to insert before e.g. "0" or "*3"
    in_interface_list/out_interface_list: name of an /interface list (e.g. "LAN", "WAN") rather than a single interface

Input parameters:

- `action` (string, required)
- `chain` (string, required)
- `comment`
- `connection_nat_state`
- `connection_state`
- `device`
- `disabled` (boolean)
- `dst_address`
- `dst_address_list`
- `dst_port`
- `in_interface`
- `in_interface_list`
- `limit`
- `log` (boolean)
- `log_prefix`
- `out_interface`
- `out_interface_list`
- `place_before`
- `protocol`
- `src_address`
- `src_address_list`
- `src_port`
- `tcp_flags`

Output parameters:

- `result` (string)

### `list_filter_rules` (~86 tokens)

Lists firewall filter rules on the MikroTik device.

Input parameters:

- `action_filter`
- `chain_filter`
- `device`
- `disabled_only` (boolean)
- `dst_address_filter`
- `dynamic_only` (boolean)
- `interface_filter`
- `invalid_only` (boolean)
- `protocol_filter`
- `src_address_filter`

Output parameters:

- `result` (string)

### `get_filter_rule` (~61 tokens)

Gets detailed information about a specific firewall filter rule.

Notes:
    rule_id: positional number from list output (e.g. "12") or internal ID (e.g. "*1A")

Input parameters:

- `device`
- `rule_id` (string, required)

Output parameters:

- `result` (string)

### `update_filter_rule` (~251 tokens)

Updates an existing firewall filter rule on the MikroTik device.

Notes:
    rule_id: positional number from list output (e.g. "12") or internal ID (e.g. "*1A")
    connection_state: comma-separated e.g. "established,related"
    limit: RouterOS rate string e.g. "10,5:packet"
    tcp_flags: RouterOS flag expression e.g. "syn,!ack"
    Pass "" to clear an optional field (e.g. src_address="").

Input parameters:

- `action`
- `chain`
- `comment`
- `connection_nat_state`
- `connection_state`
- `device`
- `disabled`
- `dst_address`
- `dst_address_list`
- `dst_port`
- `in_interface`
- `in_interface_list`
- `limit`
- `log`
- `log_prefix`
- `out_interface`
- `out_interface_list`
- `protocol`
- `rule_id` (string, required)
- `src_address`
- `src_address_list`
- `src_port`
- `tcp_flags`

Output parameters:

- `result` (string)

### `remove_filter_rule` (~62 tokens)

Removes a firewall filter rule from the MikroTik device.

Notes:
    rule_id: positional number from list output (e.g. "12") or internal ID (e.g. "*1A")

Input parameters:

- `device`
- `rule_id` (string, required)

Output parameters:

- `result` (string)

### `move_filter_rule` (~81 tokens)

Moves a firewall filter rule to a different position in the chain.

Notes:
    rule_id: positional number from list output (e.g. "12") or internal ID (e.g. "*1A")
    destination: 0-based target position index

Input parameters:

- `destination` (integer, required)
- `device`
- `rule_id` (string, required)

Output parameters:

- `result` (string)

### `enable_filter_rule` (~28 tokens)

Enables a firewall filter rule.

Input parameters:

- `device`
- `rule_id` (string, required)

Output parameters:

- `result` (string)

### `disable_filter_rule` (~29 tokens)

Disables a firewall filter rule.

Input parameters:

- `device`
- `rule_id` (string, required)

Output parameters:

- `result` (string)

### `create_basic_firewall_setup` (~31 tokens)

Creates a basic firewall setup with common security rules on the MikroTik device.

Input parameters:

- `device`

Output parameters:

- `result` (string)

### `create_nat_rule` (~216 tokens)

Creates a NAT rule (srcnat or dstnat) on the MikroTik device.

Notes:
    to_addresses: single IP or range e.g. "10.0.0.1" or "10.0.0.1-10.0.0.10"
    to_ports: single port or range e.g. "8080" or "8080-8090"
    place_before: rule number or ID (*N) to insert before e.g. "0" or "*3"

Input parameters:

- `action` (string, required)
- `chain` (string, required)
- `comment`
- `device`
- `disabled` (boolean)
- `dst_address`
- `dst_port`
- `in_interface`
- `log` (boolean)
- `log_prefix`
- `out_interface`
- `place_before`
- `protocol`
- `src_address`
- `src_port`
- `to_addresses`
- `to_ports`

Output parameters:

- `result` (string)

### `list_nat_rules` (~77 tokens)

Lists NAT rules on the MikroTik device.

Input parameters:

- `action_filter`
- `chain_filter`
- `device`
- `disabled_only` (boolean)
- `dst_address_filter`
- `interface_filter`
- `invalid_only` (boolean)
- `protocol_filter`
- `src_address_filter`

Output parameters:

- `result` (string)

### `get_nat_rule` (~53 tokens)

Gets detailed information about a specific NAT rule.

Notes:
    rule_id: use the ID from list output e.g. "*1" or "0"

Input parameters:

- `device`
- `rule_id` (string, required)

Output parameters:

- `result` (string)

### `update_nat_rule` (~209 tokens)

Updates an existing NAT rule on the MikroTik device.

Notes:
    rule_id: use the ID from list output e.g. "*1" or "0"
    to_addresses: single IP or range e.g. "10.0.0.1" or "10.0.0.1-10.0.0.10"
    to_ports: single port or range e.g. "8080" or "8080-8090"
    Pass "" to clear an optional field.

Input parameters:

- `action`
- `chain`
- `comment`
- `device`
- `disabled`
- `dst_address`
- `dst_port`
- `in_interface`
- `log`
- `log_prefix`
- `out_interface`
- `protocol`
- `rule_id` (string, required)
- `src_address`
- `src_port`
- `to_addresses`
- `to_ports`

Output parameters:

- `result` (string)

### `remove_nat_rule` (~54 tokens)

Removes a NAT rule from the MikroTik device.

Notes:
    rule_id: use the ID from list output e.g. "*1" or "0"

Input parameters:

- `device`
- `rule_id` (string, required)

Output parameters:

- `result` (string)

### `move_nat_rule` (~73 tokens)

Moves a NAT rule to a different position in the chain.

Notes:
    rule_id: use the ID from list output e.g. "*1" or "0"
    destination: 0-based target position index

Input parameters:

- `destination` (integer, required)
- `device`
- `rule_id` (string, required)

Output parameters:

- `result` (string)

### `enable_nat_rule` (~27 tokens)

Enables a NAT rule.

Input parameters:

- `device`
- `rule_id` (string, required)

Output parameters:

- `result` (string)

### `disable_nat_rule` (~28 tokens)

Disables a NAT rule.

Input parameters:

- `device`
- `rule_id` (string, required)

Output parameters:

- `result` (string)

### `list_interfaces` (~143 tokens)

Lists all interfaces on the MikroTik device (ethernet, bridge, WireGuard,
PPPoE, VLAN, WiFi, SFP, LTE, loopback, and any other type).

Notes:
    type_filter: RouterOS interface type e.g. "ether", "bridge", "vlan",
        "wg", "pppoe-out", "wifi", "lte", "loopback"
    name_filter: partial name match e.g. "ether" matches ether1, ether2 …

Input parameters:

- `device`
- `disabled_only` (boolean)
- `name_filter`
- `running_only` (boolean)
- `type_filter`

Output parameters:

- `result` (string)

### `get_interface` (~59 tokens)

Gets detailed information about a specific interface by name.

Notes:
    name: exact interface name e.g. "ether1", "bridge", "pppoe-out1", "wg0"

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `enable_interface` (~54 tokens)

Enables an interface on the MikroTik device.

Notes:
    name: exact interface name e.g. "ether1", "bridge", "pppoe-out1"

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `disable_interface` (~55 tokens)

Disables an interface on the MikroTik device.

Notes:
    name: exact interface name e.g. "ether1", "bridge", "pppoe-out1"

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `list_devices` (~79 tokens)

Lists the MikroTik devices this server manages.

Use this to discover which devices are available and what their titles are.
Every other tool takes an optional `device` argument that must be one of the
titles returned here. When only one device is configured, `device` may be
omitted and that device is used automatically.

Credentials are never returned.

Output parameters:

- `result` (string)

### `add_ip_address` (~63 tokens)

Adds an IP address to an interface on the MikroTik device.

Input parameters:

- `address` (string, required)
- `broadcast`
- `comment`
- `device`
- `disabled` (boolean)
- `interface` (string, required)
- `network`

Output parameters:

- `result` (string)

### `list_ip_addresses` (~57 tokens)

Lists IP addresses on the MikroTik device.

Input parameters:

- `address_filter`
- `device`
- `disabled_only` (boolean)
- `dynamic_only` (boolean)
- `interface_filter`
- `network_filter`

Output parameters:

- `result` (string)

### `get_ip_address` (~36 tokens)

Gets detailed information about a specific IP address by ID or address value.

Input parameters:

- `address_id` (string, required)
- `device`

Output parameters:

- `result` (string)

### `remove_ip_address` (~37 tokens)

Removes an IP address from the MikroTik device by ID or address value.

Input parameters:

- `address_id` (string, required)
- `device`

Output parameters:

- `result` (string)

### `add_ipv6_address` (~199 tokens)

Adds an IPv6 address to an interface on the MikroTik device.

Notes:
    address: IPv6 address with prefix length, e.g. "2001:db8::1/64" or
        "fe80::1/64". When `from_pool` is used, supply the host part only,
        e.g. "::1/64".
    advertise: include this prefix in Router Advertisements (default no).
    eui_64: derive the host part of the address from the interface MAC.
    from_pool: name of an IPv6 pool to take the prefix from.
    no_dad: skip Duplicate Address Detection.

Input parameters:

- `address` (string, required)
- `advertise`
- `comment`
- `device`
- `disabled` (boolean)
- `eui_64`
- `from_pool`
- `interface` (string, required)
- `no_dad`

Output parameters:

- `result` (string)

### `list_ipv6_addresses` (~129 tokens)

Lists IPv6 addresses on the MikroTik device.

Notes:
    address_filter: partial match on the address, e.g. "2001:db8" or "fe80".
    global_only: show only global (routable) addresses.
    link_local_only: show only link-local (fe80::/10) addresses.

Input parameters:

- `address_filter`
- `device`
- `disabled_only` (boolean)
- `dynamic_only` (boolean)
- `global_only` (boolean)
- `interface_filter`
- `link_local_only` (boolean)

Output parameters:

- `result` (string)

### `get_ipv6_address` (~77 tokens)

Gets detailed information about a specific IPv6 address by ID or address value.

Notes:
    address_id: a RouterOS internal id (e.g. "*1") or the address value
        (e.g. "2001:db8::1/64").

Input parameters:

- `address_id` (string, required)
- `device`

Output parameters:

- `result` (string)

### `remove_ipv6_address` (~78 tokens)

Removes an IPv6 address from the MikroTik device by ID or address value.

Notes:
    address_id: a RouterOS internal id (e.g. "*1") or the address value
        (e.g. "2001:db8::1/64").

Input parameters:

- `address_id` (string, required)
- `device`

Output parameters:

- `result` (string)

### `create_ipv6_filter_rule` (~216 tokens)

Creates an IPv6 firewall filter rule on the MikroTik device.

Notes:
    protocol: IPv6 uses "icmpv6", not the IPv4 spelling "icmp".
    jump_target: only used with action="jump".

Input parameters:

- `action` (string, required)
- `chain` (string, required)
- `comment`
- `connection_state`
- `device`
- `disabled` (boolean)
- `dst_address`
- `dst_address_list`
- `dst_address_type`
- `dst_port`
- `headers`
- `hop_limit`
- `icmp_options`
- `in_interface`
- `jump_target`
- `limit`
- `log` (boolean)
- `log_prefix`
- `out_interface`
- `place_before`
- `protocol`
- `src_address`
- `src_address_list`
- `src_address_type`
- `src_port`
- `tcp_flags`

Output parameters:

- `result` (string)

### `list_ipv6_filter_rules` (~147 tokens)

Lists IPv6 firewall filter rules on the MikroTik device.

Notes:
    protocol_filter: IPv6 uses "icmpv6", not the IPv4 spelling "icmp".
    src_address_filter/dst_address_filter: partial match on the address,
        e.g. "2001:db8" matches every rule whose address starts with it.

Input parameters:

- `action_filter`
- `chain_filter`
- `device`
- `disabled_only` (boolean)
- `dst_address_filter`
- `dynamic_only` (boolean)
- `interface_filter`
- `invalid_only` (boolean)
- `protocol_filter`
- `src_address_filter`

Output parameters:

- `result` (string)

### `get_ipv6_filter_rule` (~58 tokens)

Gets detailed information about a specific IPv6 firewall filter rule.

Notes:
    rule_id: a RouterOS internal id ("*1") or a print position ("0").

Input parameters:

- `device`
- `rule_id` (string, required)

Output parameters:

- `result` (string)

### `update_ipv6_filter_rule` (~217 tokens)

Updates an existing IPv6 firewall filter rule on the MikroTik device.

Notes:
    rule_id: a RouterOS internal id ("*1") or a print position ("0").
    Pass "" to clear an optional field (e.g. src_address="").

Input parameters:

- `action`
- `chain`
- `comment`
- `connection_state`
- `device`
- `disabled`
- `dst_address`
- `dst_address_list`
- `dst_address_type`
- `dst_port`
- `headers`
- `hop_limit`
- `icmp_options`
- `in_interface`
- `jump_target`
- `limit`
- `log`
- `log_prefix`
- `out_interface`
- `protocol`
- `rule_id` (string, required)
- `src_address`
- `src_address_list`
- `src_address_type`
- `src_port`
- `tcp_flags`

Output parameters:

- `result` (string)

### `remove_ipv6_filter_rule` (~59 tokens)

Removes an IPv6 firewall filter rule from the MikroTik device.

Notes:
    rule_id: a RouterOS internal id ("*1") or a print position ("0").

Input parameters:

- `device`
- `rule_id` (string, required)

Output parameters:

- `result` (string)

### `move_ipv6_filter_rule` (~78 tokens)

Moves an IPv6 firewall filter rule to a different position in the chain.

Notes:
    rule_id: a RouterOS internal id ("*1") or a print position ("0").
    destination: 0-based target position index

Input parameters:

- `destination` (integer, required)
- `device`
- `rule_id` (string, required)

Output parameters:

- `result` (string)

### `enable_ipv6_filter_rule` (~32 tokens)

Enables an IPv6 firewall filter rule.

Input parameters:

- `device`
- `rule_id` (string, required)

Output parameters:

- `result` (string)

### `disable_ipv6_filter_rule` (~33 tokens)

Disables an IPv6 firewall filter rule.

Input parameters:

- `device`
- `rule_id` (string, required)

Output parameters:

- `result` (string)

### `create_ip_pool` (~124 tokens)

Creates an IP pool with the given address ranges on the MikroTik device.

Notes:
    ranges: hyphen-separated range(s) e.g. "192.168.1.1-192.168.1.100"
        Multiple ranges comma-separated: "10.0.0.1-10.0.0.50,10.0.0.100-10.0.0.120"

Input parameters:

- `comment`
- `device`
- `name` (string, required)
- `next_pool`
- `ranges` (string, required)

Output parameters:

- `result` (string)

### `list_ip_pools` (~44 tokens)

Lists IP pools on the MikroTik device.

Input parameters:

- `device`
- `include_used` (boolean)
- `name_filter`
- `ranges_filter`

Output parameters:

- `result` (string)

### `get_ip_pool` (~34 tokens)

Gets detailed information about a specific IP pool including used address count.

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `update_ip_pool` (~139 tokens)

Updates an existing IP pool's name, ranges, or next-pool reference.

Notes:
    ranges: hyphen-separated range(s) e.g. "192.168.1.1-192.168.1.100"
        Multiple ranges comma-separated: "10.0.0.1-10.0.0.50,10.0.0.100-10.0.0.120"
    Pass "" for next_pool to clear it.

Input parameters:

- `comment`
- `device`
- `name` (string, required)
- `new_name`
- `next_pool`
- `ranges`

Output parameters:

- `result` (string)

### `remove_ip_pool` (~38 tokens)

Removes an IP pool from the MikroTik device (fails if pool is in use).

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `list_ip_pool_used` (~50 tokens)

Lists currently used (allocated) addresses from IP pools.

Input parameters:

- `address_filter`
- `device`
- `info_filter`
- `mac_filter`
- `pool_name`

Output parameters:

- `result` (string)

### `expand_ip_pool` (~113 tokens)

Expands an existing IP pool by appending additional address ranges.

Notes:
    additional_ranges: hyphen-separated range(s) e.g. "192.168.1.101-192.168.1.150"
        Multiple ranges comma-separated: "10.0.0.51-10.0.0.60,10.0.0.70-10.0.0.80"

Input parameters:

- `additional_ranges` (string, required)
- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `get_ipsec_installed_sa` (~423 tokens)

Lists the installed IPsec security associations (child/phase 2 SAs).

The Flags legend is the point of this view. On RouterOS 7 it reads:

    S - SEEN-TRAFFIC  the SA has carried packets
    H - HW-AEAD       the cipher is running in hardware
    E - ESP

\`S` is the only field that separates an SA carrying traffic from one that
is merely installed. A remote end reporting the connection as up, or its
own byte counters growing, does not contradict a missing `S`: those count
what the far side sent, not what arrived.

Two things this does NOT tell you, both easy to get wrong:

\- **A missing `S` can mean idle, not broken.** An SA nothing has used
  looks exactly like one that is failing, and RouterOS withholds
  \`addtime` and `expires-in` until traffic appears, which makes it look
  half installed. Put traffic over the selector before concluding
  anything.

\- **Per-SA counters do not map onto policies once a peer has several
  child SAs.** Traffic picks among them, so one SA can carry the outbound
  side of two policies while another sits frozen at the counter it had
  minutes after install. Pairing SAs by hand — by install time, by
  address, by lifetime — invents a structure that is not there. Watch
  which counters move under traffic you control instead.

Notes:
    Address filters are substring matches on the SA endpoints, which are the
    tunnel endpoints (public addresses), not the encapsulated subnets.
    Behind NAT-T the endpoints carry the port (`198.51.100.2:4500`), which
    is why this is not an exact match: filtering on the bare address would
    find nothing there and report no SAs while some exist.

Input parameters:

- `device`
- `dst_address_filter`
- `src_address_filter`

Output parameters:

- `result` (string)

### `get_ipsec_active_peers` (~116 tokens)

Lists the IPsec peers with a live IKE session, with uptime and counters.

Shows the parent (phase 1) side: `state`, `uptime`, `last-seen` and the
byte counters. A peer can sit here `established` while its child SAs
carry nothing — use `get_ipsec_installed_sa` to tell the difference.

Notes:
    Both filters are exact matches.

Input parameters:

- `device`
- `remote_address_filter`
- `state_filter`

Output parameters:

- `result` (string)

### `list_ipsec_peers` (~64 tokens)

Lists the configured IPsec peers.

Notes:
    Filters are substring matches. Secrets live on `/ip ipsec identity`
    and are not exposed by any tool in this server.

Input parameters:

- `address_filter`
- `device`
- `name_filter`

Output parameters:

- `result` (string)

### `list_ipsec_policies` (~154 tokens)

Lists the IPsec policies, with their phase 2 state.

The Flags legend distinguishes configured policies from the ones a peer
generated at runtime (`D` dynamic), and `ph2-state` says whether the
child SA is established. A policy whose selectors do not match the far
end's is the usual cause of a tunnel that comes up and passes nothing.

Notes:
    `peer_filter` is a substring match on the peer name; the address
    filters are substring matches on the policy selectors, which are the
    encapsulated subnets, not the tunnel endpoints.

Input parameters:

- `device`
- `dst_address_filter`
- `peer_filter`
- `src_address_filter`

Output parameters:

- `result` (string)

### `list_ipsec_profiles` (~133 tokens)

Lists the IPsec profiles (phase 1 proposal: DH group, hash, lifetime, DPD).

Notes:
    `lifetime` here is phase 1. It must be LONGER than the phase 2
    lifetime on `/ip ipsec proposal`, so the child SA rekeys inside a
    live parent SA; equal lifetimes tear the tunnel down on every
    rekey. `dpd-interval` multiplied by `dpd-maximum-failures` is how
    many seconds of silence the peer tolerates.

Input parameters:

- `device`
- `name_filter`

Output parameters:

- `result` (string)

### `list_ipsec_proposals` (~92 tokens)

Lists the IPsec proposals (phase 2: encryption, auth, PFS, lifetime).

Notes:
    Compare `lifetime` against the phase 1 lifetime on
    `/ip ipsec profile`, and against whatever the far end proposes — a
    cloud provider's own SA lifetime counts as a third value in that
    comparison.

Input parameters:

- `device`
- `name_filter`

Output parameters:

- `result` (string)

### `get_logs` (~139 tokens)

Gets logs from the MikroTik device with optional topic, time, and message filters.

Notes:
    topics: comma-separated, entry matches any of them e.g. "system,dhcp"
    time_filter: RouterOS duration e.g. "30s", "5m", "1h", "2d"
    message_filter: RouterOS regex matched against the message (case-sensitive)
    limit: keep only the newest N entries

Input parameters:

- `device`
- `limit`
- `message_filter`
- `prefix_filter`
- `print_as` (string)
- `time_filter`
- `topics`

Output parameters:

- `result` (string)

### `get_logs_by_severity` (~49 tokens)

Gets logs filtered by severity level (debug/info/warning/error/critical).

Input parameters:

- `device`
- `limit`
- `severity` (string, required)
- `time_filter`

Output parameters:

- `result` (string)

### `get_logs_by_topic` (~54 tokens)

Gets logs for a specific topic/facility (system, dhcp, interface, firewall, etc.).

Input parameters:

- `device`
- `limit`
- `time_filter`
- `topic` (string, required)

Output parameters:

- `result` (string)

### `search_logs` (~88 tokens)

Searches log messages for a literal term.

Notes:
    search_term: treated literally (regex specials are escaped)
    case_sensitive: RouterOS matching is case-sensitive; by default the
        search emulates case-insensitivity with character classes

Input parameters:

- `case_sensitive` (boolean)
- `device`
- `limit`
- `search_term` (string, required)
- `time_filter`

Output parameters:

- `result` (string)

### `get_system_events` (~46 tokens)

Gets system-related log events (login, reboot, config-change, etc.).

Input parameters:

- `device`
- `event_type`
- `limit`
- `time_filter`

Output parameters:

- `result` (string)

### `get_security_logs` (~41 tokens)

Gets security-related log entries (logins, failures, blocked connections, etc.).

Input parameters:

- `device`
- `limit`
- `time_filter`

Output parameters:

- `result` (string)

### `clear_logs` (~28 tokens)

Explains why MikroTik's in-memory log cannot be cleared on demand.

Input parameters:

- `device`

Output parameters:

- `result` (string)

### `get_log_statistics` (~28 tokens)

Gets log entry counts by topic and severity from the MikroTik device.

Input parameters:

- `device`

Output parameters:

- `result` (string)

### `export_logs` (~49 tokens)

Exports logs to a .txt file on the MikroTik device with optional topic and time filters.

Input parameters:

- `device`
- `filename`
- `time_filter`
- `topics`

Output parameters:

- `result` (string)

### `monitor_logs` (~61 tokens)

Watches for new log entries for a limited duration (max 60s) and returns them.

Notes:
    duration: seconds to wait for new entries, capped at 60

Input parameters:

- `device`
- `duration` (integer)
- `topics`

Output parameters:

- `result` (string)

### `list_arp_entries` (~68 tokens)

Lists detailed IPv4 ARP entries.

Notes:
    Address and MAC filters are substring matches. Interface and status
    filters are exact matches.

Input parameters:

- `address_filter`
- `device`
- `interface_filter`
- `mac_filter`
- `status_filter`

Output parameters:

- `result` (string)

### `list_ipv6_neighbors` (~69 tokens)

Lists detailed IPv6 neighbor-discovery entries.

Notes:
    Address and MAC filters are substring matches. Interface and status
    filters are exact matches.

Input parameters:

- `address_filter`
- `device`
- `interface_filter`
- `mac_filter`
- `status_filter`

Output parameters:

- `result` (string)

### `list_netwatch` (~324 tokens)

Lists the netwatch probes with their live status and measurements.

Configuration first, then a LIVE STATE block with `status`, `since` — the
timestamp of the last transition — and, on an ICMP probe, the last test's
numbers: `rtt-avg`, `loss-percent`, `failed-tests`. Match the two blocks
by `host`, or by the `.id` the live one carries.

Notes:
    `host_filter` and `comment_filter` are substring matches; `status_filter`
    and `type_filter` are exact. Pass `status_filter="down"` to list only
    what is currently failing.

    `include_source=False` (the default) omits `up-script`,
    `down-script` and `test-script`, because a probe that alerts through a
    webhook or an e-mail carries the token or the password inline. Set it
    to True only when you intend to read those commands; the output is
    redacted either way, but redaction is pattern-based and is not a
    guarantee.

    A probe with no `src-address` follows whichever WAN is active, so it
    keeps reporting across a failover; one pinned to a source address
    reports that path only. Which of the two you want depends on whether
    you are watching the internet or a specific link.

Input parameters:

- `comment_filter`
- `device`
- `host_filter`
- `include_source` (boolean)
- `status_filter`
- `type_filter`

Output parameters:

- `result` (string)

### `get_poe_monitor` (~107 tokens)

Reads real-time Power-over-Ethernet (PoE) monitor data for one or more
ethernet interfaces — PoE-out status, voltage, current, and power.

Runs ``/interface ethernet poe monitor <interfaces> once``.

Notes:
    interfaces: comma-separated ethernet interface name(s), e.g.
        "ether1" or "ether9-ap,ether10-ap,ether11-ap,ether12-ap"

Input parameters:

- `device`
- `interfaces` (string, required)

Output parameters:

- `result` (string)

### `list_poe` (~80 tokens)

Lists the Power-over-Ethernet (PoE) configuration of PoE-capable
ethernet interfaces (PoE-out mode, priority).

Runs ``/interface ethernet poe print``.

Notes:
    interface_filter: partial name match, e.g. "ether" matches ether1, ether2 …

Input parameters:

- `device`
- `interface_filter`

Output parameters:

- `result` (string)

### `get_poe_settings` (~82 tokens)

Gets the detailed PoE-out settings of a specific ethernet interface
(PoE-out mode, priority, voltage, low/high thresholds, …).

Runs ``/interface ethernet poe print detail where name=<name>``.

Notes:
    name: exact ethernet interface name, e.g. "ether1"

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `create_queue_type` (~332 tokens)

Creates a queue type (qdisc). kind selects the discipline (cake, fq-codel, sfq, red, pcq, pfifo, bfifo); remaining params are per-discipline options.

Notes:
    pcq_rate: bandwidth per flow e.g. "1M", "512k"
    pcq_classifier: comma-separated classifiers e.g. "src-address,dst-address"
    cake_rtt: round-trip time e.g. "50ms", "100ms"
    fq_codel_target / fq_codel_interval: time e.g. "5ms", "100ms"

Input parameters:

- `bfifo_limit`
- `cake_ack_filter`
- `cake_diffserv`
- `cake_flowmode`
- `cake_mpu`
- `cake_nat`
- `cake_overhead`
- `cake_overhead_scheme`
- `cake_rtt`
- `cake_wash`
- `device`
- `fq_codel_interval`
- `fq_codel_limit`
- `fq_codel_quantum`
- `fq_codel_target`
- `kind` (string)
- `name` (string, required)
- `pcq_classifier`
- `pcq_limit`
- `pcq_rate`
- `pfifo_limit`
- `red_avg_packet`
- `red_burst`
- `red_limit`
- `red_max_threshold`
- `red_min_threshold`
- `sfq_allot`
- `sfq_perturb`

Output parameters:

- `result` (string)

### `list_queue_types` (~35 tokens)

Lists queue types on the MikroTik device.

Input parameters:

- `device`
- `kind_filter`
- `name_filter`

Output parameters:

- `result` (string)

### `get_queue_type` (~30 tokens)

Gets detailed information about a specific queue type.

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `update_queue_type` (~121 tokens)

Updates an existing queue type's discipline-specific settings.

Input parameters:

- `cake_ack_filter`
- `cake_diffserv`
- `cake_flowmode`
- `cake_mpu`
- `cake_nat`
- `cake_overhead`
- `cake_overhead_scheme`
- `cake_rtt`
- `cake_wash`
- `device`
- `name` (string, required)
- `new_name`
- `pcq_classifier`
- `pcq_limit`
- `pcq_rate`

Output parameters:

- `result` (string)

### `remove_queue_type` (~31 tokens)

Removes a queue type from the MikroTik device.

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `create_queue_tree` (~180 tokens)

Creates a hierarchical queue tree entry attached to a parent interface or queue.

Notes:
    max_limit / limit_at / burst_limit / burst_threshold: bandwidth e.g. "10M", "512k", "1G"
    burst_time: duration e.g. "8s"
    parent: interface name e.g. "ether1" or parent queue name
    priority: 1 (highest) – 8 (lowest)

Input parameters:

- `bucket_size`
- `burst_limit`
- `burst_threshold`
- `burst_time`
- `comment`
- `device`
- `disabled` (boolean)
- `limit_at`
- `max_limit`
- `name` (string, required)
- `packet_mark`
- `parent` (string, required)
- `priority`
- `queue`

Output parameters:

- `result` (string)

### `list_queue_trees` (~52 tokens)

Lists queue trees on the MikroTik device.

Input parameters:

- `device`
- `disabled_only` (boolean)
- `invalid_only` (boolean)
- `name_filter`
- `parent_filter`

Output parameters:

- `result` (string)

### `get_queue_tree` (~30 tokens)

Gets detailed information about a specific queue tree.

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `update_queue_tree` (~164 tokens)

Updates an existing queue tree entry (bandwidth limits, parent, priority, etc.).

Notes:
    max_limit / limit_at / burst_limit / burst_threshold: bandwidth e.g. "10M", "512k"
    burst_time: duration e.g. "8s"
    priority: 1 (highest) – 8 (lowest)

Input parameters:

- `bucket_size`
- `burst_limit`
- `burst_threshold`
- `burst_time`
- `comment`
- `device`
- `disabled`
- `limit_at`
- `max_limit`
- `name` (string, required)
- `new_name`
- `packet_mark`
- `parent`
- `priority`
- `queue`

Output parameters:

- `result` (string)

### `remove_queue_tree` (~31 tokens)

Removes a queue tree from the MikroTik device.

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `enable_queue_tree` (~26 tokens)

Enables a queue tree.

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `disable_queue_tree` (~27 tokens)

Disables a queue tree.

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `create_simple_queue` (~215 tokens)

Creates a simple queue to rate-limit a target address or interface.

Notes:
    target: IP/CIDR or interface e.g. "192.168.1.0/24" or "ether1"
    max_limit / limit_at / burst_limit / burst_threshold: upload/download bandwidth
        as "UL/DL" e.g. "10M/10M", or single value e.g. "10M"
    burst_time: duration e.g. "8s"
    priority: 1 (highest) – 8 (lowest)

Input parameters:

- `bucket_size`
- `burst_limit`
- `burst_threshold`
- `burst_time`
- `comment`
- `device`
- `disabled` (boolean)
- `dst`
- `limit_at`
- `max_limit`
- `name` (string, required)
- `packet_marks`
- `parent`
- `priority`
- `queue`
- `target` (string, required)

Output parameters:

- `result` (string)

### `list_simple_queues` (~52 tokens)

Lists simple queues on the MikroTik device.

Input parameters:

- `device`
- `disabled_only` (boolean)
- `invalid_only` (boolean)
- `name_filter`
- `target_filter`

Output parameters:

- `result` (string)

### `get_simple_queue` (~30 tokens)

Gets detailed information about a specific simple queue.

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `update_simple_queue` (~219 tokens)

Updates an existing simple queue's rate limits, target, or scheduling settings.

Notes:
    target: IP/CIDR or interface e.g. "192.168.1.0/24" or "ether1"
    max_limit / limit_at / burst_limit / burst_threshold: upload/download bandwidth
        as "UL/DL" e.g. "10M/10M", or single value e.g. "10M"
    burst_time: duration e.g. "8s"
    priority: 1 (highest) – 8 (lowest)

Input parameters:

- `bucket_size`
- `burst_limit`
- `burst_threshold`
- `burst_time`
- `comment`
- `device`
- `disabled`
- `dst`
- `limit_at`
- `max_limit`
- `name` (string, required)
- `new_name`
- `packet_marks`
- `parent`
- `priority`
- `queue`
- `target`

Output parameters:

- `result` (string)

### `remove_simple_queue` (~31 tokens)

Removes a simple queue from the MikroTik device.

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `enable_simple_queue` (~26 tokens)

Enables a simple queue.

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `disable_simple_queue` (~27 tokens)

Disables a simple queue.

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `safe_mode_status` (~24 tokens)

Returns whether MikroTik Safe Mode is currently active.

Input parameters:

- `device`

Output parameters:

- `result` (string)

### `enable_safe_mode` (~35 tokens)

Activates MikroTik Safe Mode; changes are held in memory and auto-reverted on disconnect until committed.

Input parameters:

- `device`

Output parameters:

- `result` (string)

### `commit_safe_mode` (~29 tokens)

Commits all pending Safe Mode changes to persistent storage and exits Safe Mode.

Input parameters:

- `device`

Output parameters:

- `result` (string)

### `rollback_safe_mode` (~31 tokens)

Discards all pending Safe Mode changes by closing the SSH session, triggering automatic rollback.

Input parameters:

- `device`

Output parameters:

- `result` (string)

### `add_route` (~184 tokens)

Adds a route to the routing table.

Notes:
    dst_address: CIDR e.g. "0.0.0.0/0", "192.168.1.0/24"
    routing_table: name of a table from /routing table, e.g. "via_ISP2";
        defaults to "main". RouterOS 6 called this the routing mark.
    check_gateway: "ping" or "arp"
    distance: 1-255 (lower = higher priority)

Input parameters:

- `check_gateway`
- `comment`
- `device`
- `disabled` (boolean)
- `distance`
- `dst_address` (string, required)
- `gateway` (string, required)
- `pref_src`
- `routing_table`
- `scope`
- `target_scope`
- `vrf_interface`

Output parameters:

- `result` (string)

### `list_routes` (~78 tokens)

Lists routes in MikroTik routing table.

Input parameters:

- `active_only` (boolean)
- `device`
- `disabled_only` (boolean)
- `distance_filter`
- `dst_filter`
- `dynamic_only` (boolean)
- `gateway_filter`
- `routing_table_filter`
- `static_only` (boolean)

Output parameters:

- `result` (string)

### `get_route` (~51 tokens)

Gets detailed information about a specific route.

Notes:
    route_id: "*N" or "N" from list output e.g. "*3"

Input parameters:

- `device`
- `route_id` (string, required)

Output parameters:

- `result` (string)

### `update_route` (~198 tokens)

Updates a route.

Notes:
    route_id: "*N" or "N" from list output e.g. "*3"
    dst_address: CIDR e.g. "192.168.1.0/24"
    check_gateway: "ping" or "arp"
    distance: 1-255
    routing_table: name of a table from /routing table; "" moves the route
        back to "main", since every RouterOS 7 route belongs to a table.
    Pass "" to vrf_interface or pref_src to clear them.

Input parameters:

- `check_gateway`
- `comment`
- `device`
- `disabled`
- `distance`
- `dst_address`
- `gateway`
- `pref_src`
- `route_id` (string, required)
- `routing_table`
- `scope`
- `target_scope`
- `vrf_interface`

Output parameters:

- `result` (string)

### `remove_route` (~47 tokens)

Removes a route.

Notes:
    route_id: "*N" or "N" from list output e.g. "*3"

Input parameters:

- `device`
- `route_id` (string, required)

Output parameters:

- `result` (string)

### `enable_route` (~47 tokens)

Enables a route.

Notes:
    route_id: "*N" or "N" from list output e.g. "*3"

Input parameters:

- `device`
- `route_id` (string, required)

Output parameters:

- `result` (string)

### `disable_route` (~48 tokens)

Disables a route.

Notes:
    route_id: "*N" or "N" from list output e.g. "*3"

Input parameters:

- `device`
- `route_id` (string, required)

Output parameters:

- `result` (string)

### `get_routing_table` (~41 tokens)

Gets a specific routing table.

Input parameters:

- `active_only` (boolean)
- `device`
- `protocol_filter`
- `table_name`

Output parameters:

- `result` (string)

### `check_route_path` (~33 tokens)

Checks the route MikroTik would use to reach a destination.

Input parameters:

- `destination` (string, required)
- `device`

Output parameters:

- `result` (string)

### `get_route_cache` (~19 tokens)

Gets the route cache.

Input parameters:

- `device`

Output parameters:

- `result` (string)

### `flush_route_cache` (~20 tokens)

Flushes the route cache.

Input parameters:

- `device`

Output parameters:

- `result` (string)

### `add_default_route` (~46 tokens)

Adds a default route.

Input parameters:

- `check_gateway` (string)
- `comment`
- `device`
- `distance` (integer)
- `gateway` (string, required)

Output parameters:

- `result` (string)

### `add_blackhole_route` (~71 tokens)

Adds a blackhole route.

Notes:
    dst_address: CIDR e.g. "10.0.0.0/8"
    distance: 1-255

Input parameters:

- `comment`
- `device`
- `distance` (integer)
- `dst_address` (string, required)

Output parameters:

- `result` (string)

### `get_route_statistics` (~19 tokens)

Gets routing table statistics.

Input parameters:

- `device`

Output parameters:

- `result` (string)

### `list_schedulers` (~212 tokens)

Lists the scheduled tasks with their interval, next run and run count.

Notes:
    `name_filter` is a substring match. Read `next-run` together with
    `interval`: a scheduler whose `run-count` is not advancing is firing
    into a script that errors out, which RouterOS does not surface here —
    it shows up in the log under the `script` topic.

    `include_source=False` (the default) omits `on-event`, because a
    scheduler can carry commands inline, and those routinely hold a bot
    token or a password inside a URL. Redaction only recognises labelled
    secrets, so withholding the field is what keeps them off the wire. Set
    it to True only when you intend to read the commands; the output is
    redacted either way, but redaction is pattern-based and is not a
    guarantee.

Input parameters:

- `device`
- `include_source` (boolean)
- `name_filter`

Output parameters:

- `result` (string)

### `list_scripts` (~137 tokens)

Lists the stored scripts: owner, policy, run count and last start.

Notes:
    `include_source=False` (the default) omits the script body, because
    bodies routinely hold credentials in clear text. Set it to True only
    when you intend to read the code; the output is redacted either way,
    but redaction is pattern-based and is not a guarantee.

    `policy` is what the script may do when it runs, which can exceed what
    the user who scheduled it may do interactively.

Input parameters:

- `device`
- `include_source` (boolean)
- `name_filter`

Output parameters:

- `result` (string)

### `list_ip_services` (~196 tokens)

Lists the management services with their port and address restriction.

Notes:
    `name_filter` is a substring match (`winbox`, `ssh`, `api`, `www`,
    `www-ssl`, `ftp`, `telnet`). `enabled_only=True` hides the disabled
    ones, which is the list that actually describes exposure.

    An empty `address` means unrestricted. Read that together with how the
    device is reached: unrestricted on a router whose WAN holds a public
    address means the service is published to the internet, whether or not
    the port was changed from its default.

    `ftp` deserves its own look: RouterOS also serves SFTP file transfers
    through the SSH service to users whose group holds the `ftp` policy,
    so the two are not the same control.

Input parameters:

- `device`
- `enabled_only` (boolean)
- `name_filter`

Output parameters:

- `result` (string)

### `get_system_resource` (~89 tokens)

Reports uptime, RouterOS version, board name, architecture, CPU and memory.

Notes:
    `free-memory` against `total-memory` and `cpu-load` are the two numbers
    worth reading before blaming the network for a slow device. On the
    low-power boards a single packet-sniffing tool can saturate the CPU on
    its own.

Input parameters:

- `device`

Output parameters:

- `result` (string)

### `get_system_health` (~65 tokens)

Reports the board sensors: voltage, temperature, fan and PSU state.

Notes:
    Many boards carry no sensors at all and legitimately report nothing.
    An empty answer here means "this model does not measure it", not "the
    reading failed".

Input parameters:

- `device`

Output parameters:

- `result` (string)

### `get_system_clock` (~64 tokens)

Reports the device clock, time zone and DST setting.

Notes:
    Log timestamps are only as trustworthy as this. A device without a
    working time source dates its own evidence wrongly, which matters when
    correlating an incident across sites.

Input parameters:

- `device`

Output parameters:

- `result` (string)

### `get_system_routerboard` (~70 tokens)

Reports the model, serial number and bootloader firmware revision.

Notes:
    `current-firmware` against `upgrade-firmware` is the RouterBOOT
    bootloader, which is upgraded separately from RouterOS and is easy to
    leave behind after a package upgrade.

Input parameters:

- `device`

Output parameters:

- `result` (string)

### `list_system_packages` (~25 tokens)

Lists the installed RouterOS packages and which are disabled.

Input parameters:

- `device`

Output parameters:

- `result` (string)

### `get_system_package_update` (~76 tokens)

Reports the installed RouterOS version against the latest on its channel.

Notes:
    This reads the stored result of the last check; it does not contact
    MikroTik. `latest-version` can therefore be stale or empty on a device
    that has never checked or cannot reach the update server.

Input parameters:

- `device`

Output parameters:

- `result` (string)

### `add_user` (~59 tokens)

Adds a user to MikroTik device.

Input parameters:

- `address`
- `comment`
- `device`
- `disabled` (boolean)
- `group` (string)
- `name` (string, required)
- `password` (string, required)

Output parameters:

- `result` (string)

### `list_users` (~48 tokens)

Lists users on MikroTik device.

Input parameters:

- `active_only` (boolean)
- `device`
- `disabled_only` (boolean)
- `group_filter`
- `name_filter`

Output parameters:

- `result` (string)

### `get_user` (~28 tokens)

Gets detailed information about a specific user.

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `update_user` (~55 tokens)

Updates a user.

Input parameters:

- `address`
- `comment`
- `device`
- `disabled`
- `group`
- `name` (string, required)
- `new_name`
- `password`

Output parameters:

- `result` (string)

### `remove_user` (~24 tokens)

Removes a user.

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `disable_user` (~25 tokens)

Disables a user.

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `enable_user` (~24 tokens)

Enables a user.

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `add_user_group` (~43 tokens)

Adds a user group.

Input parameters:

- `comment`
- `device`
- `name` (string, required)
- `policy` (array, required)
- `skin`

Output parameters:

- `result` (string)

### `list_user_groups` (~34 tokens)

Lists user groups on MikroTik device.

Input parameters:

- `device`
- `name_filter`
- `policy_filter`

Output parameters:

- `result` (string)

### `get_user_group` (~30 tokens)

Gets detailed information about a specific user group.

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `update_user_group` (~47 tokens)

Updates a user group.

Input parameters:

- `comment`
- `device`
- `name` (string, required)
- `new_name`
- `policy`
- `skin`

Output parameters:

- `result` (string)

### `remove_user_group` (~26 tokens)

Removes a user group.

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `get_active_users` (~22 tokens)

Gets currently active/logged-in users.

Input parameters:

- `device`

Output parameters:

- `result` (string)

### `disconnect_user` (~28 tokens)

Disconnects an active user session.

Input parameters:

- `device`
- `user_id` (string, required)

Output parameters:

- `result` (string)

### `export_user_config` (~27 tokens)

Exports user configuration to a file.

Input parameters:

- `device`
- `filename`

Output parameters:

- `result` (string)

### `set_user_ssh_keys` (~39 tokens)

Sets SSH keys for a specific user.

Input parameters:

- `device`
- `key_file` (string, required)
- `username` (string, required)

Output parameters:

- `result` (string)

### `list_user_ssh_keys` (~31 tokens)

Lists SSH keys for a specific user.

Input parameters:

- `device`
- `username` (string, required)

Output parameters:

- `result` (string)

### `remove_user_ssh_key` (~29 tokens)

Removes an SSH key.

Input parameters:

- `device`
- `key_id` (string, required)

Output parameters:

- `result` (string)

### `create_vlan_interface` (~93 tokens)

Creates a VLAN interface on the MikroTik device with the given VLAN ID and parent interface.

Input parameters:

- `arp` (string)
- `arp_timeout`
- `comment`
- `device`
- `disabled` (boolean)
- `interface` (string, required)
- `mtu`
- `name` (string, required)
- `use_service_tag` (boolean)
- `vlan_id` (integer, required)

Output parameters:

- `result` (string)

### `list_vlan_interfaces` (~50 tokens)

Lists VLAN interfaces on the MikroTik device.

Input parameters:

- `device`
- `disabled_only` (boolean)
- `interface_filter`
- `name_filter`
- `vlan_id_filter`

Output parameters:

- `result` (string)

### `get_vlan_interface` (~30 tokens)

Gets detailed information about a specific VLAN interface.

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `update_vlan_interface` (~84 tokens)

Updates an existing VLAN interface's settings on the MikroTik device.

Input parameters:

- `arp`
- `arp_timeout`
- `comment`
- `device`
- `disabled`
- `interface`
- `mtu`
- `name` (string, required)
- `new_name`
- `use_service_tag`
- `vlan_id`

Output parameters:

- `result` (string)

### `remove_vlan_interface` (~31 tokens)

Removes a VLAN interface from the MikroTik device.

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `create_wireless_interface` (~95 tokens)

Creates a wireless interface on the MikroTik device (auto-detects RouterOS v6/v7 syntax).

Input parameters:

- `band`
- `channel_width`
- `comment`
- `device`
- `disabled` (boolean)
- `frequency`
- `mode`
- `name` (string, required)
- `radio_name`
- `security_profile`
- `ssid`

Output parameters:

- `result` (string)

### `list_wireless_interfaces` (~46 tokens)

Lists wireless interfaces on the MikroTik device.

Input parameters:

- `device`
- `disabled_only` (boolean)
- `name_filter`
- `running_only` (boolean)

Output parameters:

- `result` (string)

### `get_wireless_interface` (~31 tokens)

Gets detailed information about a specific wireless interface.

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `remove_wireless_interface` (~32 tokens)

Removes a wireless interface from the MikroTik device.

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `enable_wireless_interface` (~27 tokens)

Enables a wireless interface.

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `disable_wireless_interface` (~28 tokens)

Disables a wireless interface.

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `scan_wireless_networks` (~41 tokens)

Scans for nearby wireless networks using the specified interface.

Input parameters:

- `device`
- `duration` (integer)
- `interface` (string, required)

Output parameters:

- `result` (string)

### `get_wireless_registration_table` (~36 tokens)

Gets the wireless registration table (connected clients) from the MikroTik device.

Input parameters:

- `device`
- `interface`

Output parameters:

- `result` (string)

### `check_wireless_support` (~32 tokens)

Checks if the device supports wireless and reports the RouterOS version and wireless interface type.

Input parameters:

- `device`

Output parameters:

- `result` (string)

### `create_wireless_security_profile` (~35 tokens)

Legacy function - not supported in RouterOS v7.x

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `list_wireless_security_profiles` (~28 tokens)

Legacy function - not supported in RouterOS v7.x

Input parameters:

- `device`

Output parameters:

- `result` (string)

### `get_wireless_security_profile` (~35 tokens)

Legacy function - not supported in RouterOS v7.x

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `remove_wireless_security_profile` (~35 tokens)

Legacy function - not supported in RouterOS v7.x

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `set_wireless_security_profile` (~44 tokens)

Legacy function - not supported in RouterOS v7.x

Input parameters:

- `device`
- `interface_name` (string, required)
- `security_profile` (string, required)

Output parameters:

- `result` (string)

### `create_wireless_access_list` (~27 tokens)

Legacy function - different in RouterOS v7.x

Input parameters:

- `device`

Output parameters:

- `result` (string)

### `list_wireless_access_list` (~27 tokens)

Legacy function - different in RouterOS v7.x

Input parameters:

- `device`

Output parameters:

- `result` (string)

### `remove_wireless_access_list_entry` (~36 tokens)

Legacy function - different in RouterOS v7.x

Input parameters:

- `device`
- `entry_id` (string, required)

Output parameters:

- `result` (string)

### `update_wireless_interface` (~62 tokens)

Updates an existing wireless interface's settings (name, SSID, enabled state, etc.).

Input parameters:

- `comment`
- `device`
- `disabled`
- `name` (string, required)
- `new_name`
- `ssid`

Output parameters:

- `result` (string)

### `set_wireless_passphrase` (~96 tokens)

Sets the WiFi passphrase directly on a RouterOS v7 wireless interface (/interface wifi or wifiwave2).

Notes:
    authentication_types: comma-separated RouterOS auth types, e.g. "wpa2-psk,wpa3-psk"; unset keeps the current setting.

Input parameters:

- `authentication_types`
- `device`
- `name` (string, required)
- `passphrase` (string, required)

Output parameters:

- `result` (string)

### `create_wireguard_interface` (~62 tokens)

Creates a WireGuard interface on the MikroTik device.

Input parameters:

- `comment`
- `device`
- `disabled` (boolean)
- `listen_port`
- `mtu`
- `name` (string, required)
- `private_key`

Output parameters:

- `result` (string)

### `list_wireguard_interfaces` (~47 tokens)

Lists WireGuard interfaces on the MikroTik device.

Input parameters:

- `device`
- `disabled_only` (boolean)
- `name_filter`
- `running_only` (boolean)

Output parameters:

- `result` (string)

### `get_wireguard_interface` (~32 tokens)

Gets detailed information about a specific WireGuard interface.

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `update_wireguard_interface` (~69 tokens)

Updates an existing WireGuard interface's settings on the MikroTik device.

Input parameters:

- `comment`
- `device`
- `disabled`
- `listen_port`
- `mtu`
- `name` (string, required)
- `new_name`
- `private_key`

Output parameters:

- `result` (string)

### `remove_wireguard_interface` (~33 tokens)

Removes a WireGuard interface from the MikroTik device.

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `enable_wireguard_interface` (~28 tokens)

Enables a WireGuard interface.

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `disable_wireguard_interface` (~29 tokens)

Disables a WireGuard interface.

Input parameters:

- `device`
- `name` (string, required)

Output parameters:

- `result` (string)

### `add_wireguard_peer` (~183 tokens)

Adds a WireGuard peer (with public key and allowed addresses) to an interface on the MikroTik device.

Notes:
    allowed_address: CIDR, comma-separated for multiple e.g. "10.0.0.2/32" or "10.0.0.0/24,192.168.0.0/24"
    endpoint_address: remote host IP or hostname e.g. "203.0.113.1"
    persistent_keepalive: seconds as string e.g. "25"

Input parameters:

- `allowed_address` (string, required)
- `comment`
- `device`
- `disabled` (boolean)
- `endpoint_address`
- `endpoint_port`
- `interface` (string, required)
- `persistent_keepalive`
- `preshared_key`
- `public_key` (string, required)

Output parameters:

- `result` (string)

### `list_wireguard_peers` (~40 tokens)

Lists WireGuard peers on the MikroTik device.

Input parameters:

- `device`
- `disabled_only` (boolean)
- `interface_filter`

Output parameters:

- `result` (string)

### `get_wireguard_peer` (~57 tokens)

Gets detailed information about a specific WireGuard peer by ID.

Notes:
    peer_id: "*N" or "N" from list output e.g. "*2"

Input parameters:

- `device`
- `peer_id` (string, required)

Output parameters:

- `result` (string)

### `update_wireguard_peer` (~181 tokens)

Updates an existing WireGuard peer's allowed addresses, endpoint, keepalive, or enabled state.

Notes:
    peer_id: "*N" or "N" from list output e.g. "*2"
    allowed_address: CIDR, comma-separated e.g. "10.0.0.2/32" or "10.0.0.0/24,192.168.0.0/24"
    persistent_keepalive: seconds as string e.g. "25"
    Pass "" for endpoint_address or preshared_key to clear them.

Input parameters:

- `allowed_address`
- `comment`
- `device`
- `disabled`
- `endpoint_address`
- `endpoint_port`
- `peer_id` (string, required)
- `persistent_keepalive`
- `preshared_key`

Output parameters:

- `result` (string)

### `remove_wireguard_peer` (~56 tokens)

Removes a WireGuard peer from the MikroTik device.

Notes:
    peer_id: "*N" or "N" from list output e.g. "*2"

Input parameters:

- `device`
- `peer_id` (string, required)

Output parameters:

- `result` (string)

### `enable_wireguard_peer` (~51 tokens)

Enables a WireGuard peer.

Notes:
    peer_id: "*N" or "N" from list output e.g. "*2"

Input parameters:

- `device`
- `peer_id` (string, required)

Output parameters:

- `result` (string)

### `disable_wireguard_peer` (~52 tokens)

Disables a WireGuard peer.

Notes:
    peer_id: "*N" or "N" from list output e.g. "*2"

Input parameters:

- `device`
- `peer_id` (string, required)

Output parameters:

- `result` (string)

### `generate_wireguard_client_config` (~103 tokens)

Generates a wg0.conf client config string from the given keys and server endpoint. Does not communicate with the router.

Input parameters:

- `allowed_ips` (string)
- `client_address` (string, required)
- `client_private_key` (string, required)
- `device`
- `dns`
- `persistent_keepalive` (integer)
- `server_endpoint` (string, required)
- `server_port` (integer)
- `server_public_key` (string, required)

Output parameters:

- `result` (string)

## Diagnostics

Captured diagnostic sections: Provenance, Install scripts, Dependencies. The full working is on the page: https://verifymcp.io/servers/wiresage-mikrotik-mcp/mcp-server-mikrotik#diagnostics

## Score history

- 2026-11-05: 71
- 2026-11-04: 86
- 2026-11-03: 86
- 2026-11-02: 85
- 2026-11-01: 85
- 2026-10-31: 84
- 2026-10-30: 84
- 2026-10-29: 83
- 2026-10-28: 83
- 2026-10-27: 82
- 2026-10-26: 82
- 2026-10-25: 81
- 2026-10-24: 81
- 2026-10-23: 65
- 2026-10-22: 80
- 2026-10-21: 79
- 2026-10-20: 64
- 2026-10-19: 64
- 2026-10-18: 50
- 2026-10-17: 61
- 2026-10-16: 76
- 2026-10-15: 61
- 2026-10-14: 76
- 2026-10-13: 35
- 2026-10-12: 50

## Common questions

### What is the io.github.wiresage/mikrotik-mcp server?

io.github.wiresage/mikrotik-mcp is listed in the public MCP registry as io.github.wiresage/mikrotik-mcp. MCP server for MikroTik routers: firewall, NAT, routing, DHCP, DNS, WireGuard and more via SSH. This page covers its PyPI package (mcp-server-mikrotik).

### Is the io.github.wiresage/mikrotik-mcp server safe to use?

io.github.wiresage/mikrotik-mcp scores 71 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the io.github.wiresage/mikrotik-mcp server expose?

io.github.wiresage/mikrotik-mcp exposes 212 tools: create_backup, list_backups, create_export, export_section, download_file, and 207 more. Their descriptions and schemas cost roughly 15,351 tokens of context every time the server is loaded.

### Is the io.github.wiresage/mikrotik-mcp server still maintained?

io.github.wiresage/mikrotik-mcp is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the io.github.wiresage/mikrotik-mcp server under?

io.github.wiresage/mikrotik-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- PyPI project: https://pypi.org/project/mcp-server-mikrotik/
- Socket report: https://socket.dev/pypi/package/mcp-server-mikrotik
- Repository: https://github.com/wiresage/mikrotik-mcp
- Changelog RSS feed: https://verifymcp.io/servers/wiresage-mikrotik-mcp/mcp-server-mikrotik.xml
- Changelog JSON feed: https://verifymcp.io/servers/wiresage-mikrotik-mcp/mcp-server-mikrotik.json
- HTML version of this page: https://verifymcp.io/servers/wiresage-mikrotik-mcp/mcp-server-mikrotik