io.github.wiresage/mikrotik-mcp
PYPI · MCP-SERVER-MIKROTIK
MCP server for MikroTik routers: firewall, NAT, routing, DHCP, DNS, WireGuard and more via SSH.
Available components
Last scanned (12 hours ago)
Scores higher than 68% of PyPI servers
Category Cloud Infrastructure
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security50
- Malware scan not yet available for this package.Unverified
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs hatchling.build at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
- 1 of 38 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to wiresage/mikrotik-mcp). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 9 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability58
- AI-judged instruction clarity (fair).Partial
- Tool/resource definitions use about 15428 tokens (~72/item across 212 items; 212 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management73
- Stability observed for 22 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage71
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 0% of tool parameters carry a description.Fail
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 24 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 213 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Checks we ran (15)
- Known CVEs
- Install scripts
- Dependency health
- Source repository
- Provenance
- License
- Maintenance
- Security disclosure
- Schema quality
- Stability
- Tool coverage
- Injection markers
- Destructive annotations
- Judged manipulation
- MCP protocol
Checks we could not complete (1)
These are gaps on our side, not findings about this package. We only credit what we can confirm, so a category made up entirely of them scores 0.
- Malware scan in Supply Chain SecurityMalware scan not yet available for this package.
Does not apply to this package (2)
- Endpoint SecurityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
- Transport & ReachabilityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
The score does not measure everything. What the score does not measure →
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 −15
- Malware scan: pass → unverified ▼ security
- 3 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 63 to 67. That category is still filling its 30-day observation window: 19 days of observed history at the previous scan, 20 at this one. The score rises as the window fills, whether or not the server changes.
- 1 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 57 to 60. That category is still filling its 30-day observation window: 17 days of observed history at the previous scan, 18 at this one. The score rises as the window fills, whether or not the server changes.
- 30 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.
- 28 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.
- 26 Oct 26 +1
- Package version: 0.26.1.0 → 0.26.2.0 functional
- 24 Oct 26 +16
- Malware scan: unverified → pass ▲ security
- 23 Oct 26 −15
- Malware scan: pass → unverified ▼ security
- Package version: 0.25.1.0 → 0.26.1.0 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed pypi/mcp-server-mikrotik@0.26.2.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | pypi |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | wiresage/mikrotik-mcp |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/wiresage/mikrotik-mcp/.github/workflows/publish.yml@refs/heads/master |
| Rekor log index | 3494336129 |
| Predicate type | PyPI publish attestation https://docs.pypi.org/attestations/publish/v1 |
| Subject digest | sha256:52ab730bf6ff17539f0ea46e29a20737f739a7f494dac53296e1be4420564173 |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | Known build tool | hatchling.build |
Background: Why install scripts are a supply-chain risk →
Dependencies 38 packages
| Packages resolved | 38 |
|---|---|
| No linked repository | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
get_simple_queue ~30
Gets detailed information about a specific simple queue.
| Name | Type | Req | Description |
|---|---|---|---|
| device | – | – | – |
| name | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
get_system_clock ~64
Reports the device clock, time zone and DST setting. Notes: Log timestamps are only as trustworthy as this. A device without a working time source dates its own evidence wrongly, which matters when correlating an incident across sites.
| Name | Type | Req | Description |
|---|---|---|---|
| device | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
get_system_events ~46
Gets system-related log events (login, reboot, config-change, etc.).
| Name | Type | Req | Description |
|---|---|---|---|
| device | – | – | – |
| event_type | – | – | – |
| limit | – | – | – |
| time_filter | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
get_system_health ~65
Reports the board sensors: voltage, temperature, fan and PSU state. Notes: Many boards carry no sensors at all and legitimately report nothing. An empty answer here means "this model does not measure it", not "the reading failed".
| Name | Type | Req | Description |
|---|---|---|---|
| device | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
get_system_package_update ~76
Reports the installed RouterOS version against the latest on its channel. Notes: This reads the stored result of the last check; it does not contact MikroTik. `latest-version` can therefore be stale or empty on a device that has never checked or cannot reach the update server.
| Name | Type | Req | Description |
|---|---|---|---|
| device | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
get_system_resource ~89
Reports uptime, RouterOS version, board name, architecture, CPU and memory. Notes: `free-memory` against `total-memory` and `cpu-load` are the two numbers worth reading before blaming the network for a slow device. On the low-power boards a single packet-sniffing tool can saturate the CPU on its own.
| Name | Type | Req | Description |
|---|---|---|---|
| device | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
get_system_routerboard ~70
Reports the model, serial number and bootloader firmware revision. Notes: `current-firmware` against `upgrade-firmware` is the RouterBOOT bootloader, which is upgraded separately from RouterOS and is easy to leave behind after a package upgrade.
| Name | Type | Req | Description |
|---|---|---|---|
| device | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
get_user ~28
Gets detailed information about a specific user.
| Name | Type | Req | Description |
|---|---|---|---|
| device | – | – | – |
| name | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
get_user_group ~30
Gets detailed information about a specific user group.
| Name | Type | Req | Description |
|---|---|---|---|
| device | – | – | – |
| name | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
get_vlan_interface ~30
Gets detailed information about a specific VLAN interface.
| Name | Type | Req | Description |
|---|---|---|---|
| device | – | – | – |
| name | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
get_wireguard_interface ~32
Gets detailed information about a specific WireGuard interface.
| Name | Type | Req | Description |
|---|---|---|---|
| device | – | – | – |
| name | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
get_wireguard_peer ~57
Gets detailed information about a specific WireGuard peer by ID. Notes: peer_id: "*N" or "N" from list output e.g. "*2"
| Name | Type | Req | Description |
|---|---|---|---|
| device | – | – | – |
| peer_id | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
get_wireless_interface ~31
Gets detailed information about a specific wireless interface.
| Name | Type | Req | Description |
|---|---|---|---|
| device | – | – | – |
| name | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
get_wireless_registration_table ~36
Gets the wireless registration table (connected clients) from the MikroTik device.
| Name | Type | Req | Description |
|---|---|---|---|
| device | – | – | – |
| interface | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
get_wireless_security_profile ~35
Legacy function - not supported in RouterOS v7.x
| Name | Type | Req | Description |
|---|---|---|---|
| device | – | – | – |
| name | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
import_configuration ~53
Imports and executes a RouterOS configuration script (.rsc file) on the device.
| Name | Type | Req | Description |
|---|---|---|---|
| device | – | – | – |
| filename | string | yes | – |
| run_after_reset | boolean | – | – |
| verbose | boolean | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_address_list_entries ~111
Lists IPv4 or IPv6 firewall address list entries. Notes: list_filter: exact list name, including any trailing space. address_filter/comment_filter: partial match. static_only excludes the dynamic children a hostname entry creates.
| Name | Type | Req | Description |
|---|---|---|---|
| address_filter | – | – | – |
| comment_filter | – | – | – |
| device | – | – | – |
| disabled_only | boolean | – | – |
| dynamic_only | boolean | – | – |
| family | string | yes | – |
| list_filter | – | – | – |
| static_only | boolean | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_arp_entries ~68
Lists detailed IPv4 ARP entries. Notes: Address and MAC filters are substring matches. Interface and status filters are exact matches.
| Name | Type | Req | Description |
|---|---|---|---|
| address_filter | – | – | – |
| device | – | – | – |
| interface_filter | – | – | – |
| mac_filter | – | – | – |
| status_filter | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_backups ~37
Lists backup files on the MikroTik device.
| Name | Type | Req | Description |
|---|---|---|---|
| device | – | – | – |
| include_exports | boolean | – | – |
| name_filter | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_devices ~79
Lists the MikroTik devices this server manages. Use this to discover which devices are available and what their titles are. Every other tool takes an optional `device` argument that must be one of the titles returned here. When only one device is configured, `device` may be omitted and that device is used automatically. Credentials are never returned.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_dhcp_leases ~119
Lists detailed IPv4 DHCP leases, optionally filtering active lease fields. Notes: Address and identity filters are substring matches. Server, status, and lease time filters are exact matches against RouterOS `lease-time`.
| Name | Type | Req | Description |
|---|---|---|---|
| address_filter | – | – | – |
| class_id_filter | – | – | – |
| client_id_filter | – | – | – |
| device | – | – | – |
| hostname_filter | – | – | – |
| last_seen_within | – | – | – |
| lease_time_filter | – | – | – |
| mac_filter | – | – | – |
| server_filter | – | – | – |
| status_filter | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_dhcp_servers ~52
Lists DHCP servers on the MikroTik device.
| Name | Type | Req | Description |
|---|---|---|---|
| device | – | – | – |
| disabled_only | boolean | – | – |
| interface_filter | – | – | – |
| invalid_only | boolean | – | – |
| name_filter | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_dhcpv6_bindings ~108
Lists detailed DHCPv6 bindings. Notes: Address and DUID filters are substring matches. IAID, server, status, and lease time filters are exact matches; lease time maps to `life-time`.
| Name | Type | Req | Description |
|---|---|---|---|
| address_filter | – | – | – |
| device | – | – | – |
| duid_filter | – | – | – |
| iaid_filter | – | – | – |
| last_seen_within | – | – | – |
| lease_time_filter | – | – | – |
| server_filter | – | – | – |
| status_filter | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_dns_static ~53
Lists static DNS entries.
| Name | Type | Req | Description |
|---|---|---|---|
| address_filter | – | – | – |
| device | – | – | – |
| disabled_only | boolean | – | – |
| name_filter | – | – | – |
| regexp_only | boolean | – | – |
| type_filter | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_filter_rules ~86
Lists firewall filter rules on the MikroTik device.
| Name | Type | Req | Description |
|---|---|---|---|
| action_filter | – | – | – |
| chain_filter | – | – | – |
| device | – | – | – |
| disabled_only | boolean | – | – |
| dst_address_filter | – | – | – |
| dynamic_only | boolean | – | – |
| interface_filter | – | – | – |
| invalid_only | boolean | – | – |
| protocol_filter | – | – | – |
| src_address_filter | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_interfaces ~143
Lists all interfaces on the MikroTik device (ethernet, bridge, WireGuard, PPPoE, VLAN, WiFi, SFP, LTE, loopback, and any other type). Notes: type_filter: RouterOS interface type e.g. "ether", "bridge", "vlan", "wg", "pppoe-out", "wifi", "lte", "loopback" name_filter: partial name match e.g. "ether" matches ether1, ether2 …
| Name | Type | Req | Description |
|---|---|---|---|
| device | – | – | – |
| disabled_only | boolean | – | – |
| name_filter | – | – | – |
| running_only | boolean | – | – |
| type_filter | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_ip_addresses ~57
Lists IP addresses on the MikroTik device.
| Name | Type | Req | Description |
|---|---|---|---|
| address_filter | – | – | – |
| device | – | – | – |
| disabled_only | boolean | – | – |
| dynamic_only | boolean | – | – |
| interface_filter | – | – | – |
| network_filter | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_ip_pool_used ~50
Lists currently used (allocated) addresses from IP pools.
| Name | Type | Req | Description |
|---|---|---|---|
| address_filter | – | – | – |
| device | – | – | – |
| info_filter | – | – | – |
| mac_filter | – | – | – |
| pool_name | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_ip_pools ~44
Lists IP pools on the MikroTik device.
| Name | Type | Req | Description |
|---|---|---|---|
| device | – | – | – |
| include_used | boolean | – | – |
| name_filter | – | – | – |
| ranges_filter | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_ip_services ~196
Lists the management services with their port and address restriction. Notes: `name_filter` is a substring match (`winbox`, `ssh`, `api`, `www`, `www-ssl`, `ftp`, `telnet`). `enabled_only=True` hides the disabled ones, which is the list that actually describes exposure. An empty `address` means unrestricted. Read that together with how the device is reached: unrestricted on a router whose WAN holds a public address means the service is published to the internet, whether or not the port was changed from its default. `ftp` deserves its own look: RouterOS also serves SFTP file transfers through the SSH service to users whose group holds the `ftp` policy, so the two are not the same control.
| Name | Type | Req | Description |
|---|---|---|---|
| device | – | – | – |
| enabled_only | boolean | – | – |
| name_filter | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_ipsec_peers ~64
Lists the configured IPsec peers. Notes: Filters are substring matches. Secrets live on `/ip ipsec identity` and are not exposed by any tool in this server.
| Name | Type | Req | Description |
|---|---|---|---|
| address_filter | – | – | – |
| device | – | – | – |
| name_filter | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_ipsec_policies ~154
Lists the IPsec policies, with their phase 2 state. The Flags legend distinguishes configured policies from the ones a peer generated at runtime (`D` dynamic), and `ph2-state` says whether the child SA is established. A policy whose selectors do not match the far end's is the usual cause of a tunnel that comes up and passes nothing. Notes: `peer_filter` is a substring match on the peer name; the address filters are substring matches on the policy selectors, which are the encapsulated subnets, not the tunnel endpoints.
| Name | Type | Req | Description |
|---|---|---|---|
| device | – | – | – |
| dst_address_filter | – | – | – |
| peer_filter | – | – | – |
| src_address_filter | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_ipsec_profiles ~133
Lists the IPsec profiles (phase 1 proposal: DH group, hash, lifetime, DPD). Notes: `lifetime` here is phase 1. It must be LONGER than the phase 2 lifetime on `/ip ipsec proposal`, so the child SA rekeys inside a live parent SA; equal lifetimes tear the tunnel down on every rekey. `dpd-interval` multiplied by `dpd-maximum-failures` is how many seconds of silence the peer tolerates.
| Name | Type | Req | Description |
|---|---|---|---|
| device | – | – | – |
| name_filter | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_ipsec_proposals ~92
Lists the IPsec proposals (phase 2: encryption, auth, PFS, lifetime). Notes: Compare `lifetime` against the phase 1 lifetime on `/ip ipsec profile`, and against whatever the far end proposes — a cloud provider's own SA lifetime counts as a third value in that comparison.
| Name | Type | Req | Description |
|---|---|---|---|
| device | – | – | – |
| name_filter | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_ipv6_addresses ~129
Lists IPv6 addresses on the MikroTik device. Notes: address_filter: partial match on the address, e.g. "2001:db8" or "fe80". global_only: show only global (routable) addresses. link_local_only: show only link-local (fe80::/10) addresses.
| Name | Type | Req | Description |
|---|---|---|---|
| address_filter | – | – | – |
| device | – | – | – |
| disabled_only | boolean | – | – |
| dynamic_only | boolean | – | – |
| global_only | boolean | – | – |
| interface_filter | – | – | – |
| link_local_only | boolean | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_ipv6_filter_rules ~147
Lists IPv6 firewall filter rules on the MikroTik device. Notes: protocol_filter: IPv6 uses "icmpv6", not the IPv4 spelling "icmp". src_address_filter/dst_address_filter: partial match on the address, e.g. "2001:db8" matches every rule whose address starts with it.
| Name | Type | Req | Description |
|---|---|---|---|
| action_filter | – | – | – |
| chain_filter | – | – | – |
| device | – | – | – |
| disabled_only | boolean | – | – |
| dst_address_filter | – | – | – |
| dynamic_only | boolean | – | – |
| interface_filter | – | – | – |
| invalid_only | boolean | – | – |
| protocol_filter | – | – | – |
| src_address_filter | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_ipv6_neighbors ~69
Lists detailed IPv6 neighbor-discovery entries. Notes: Address and MAC filters are substring matches. Interface and status filters are exact matches.
| Name | Type | Req | Description |
|---|---|---|---|
| address_filter | – | – | – |
| device | – | – | – |
| interface_filter | – | – | – |
| mac_filter | – | – | – |
| status_filter | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_nat_rules ~77
Lists NAT rules on the MikroTik device.
| Name | Type | Req | Description |
|---|---|---|---|
| action_filter | – | – | – |
| chain_filter | – | – | – |
| device | – | – | – |
| disabled_only | boolean | – | – |
| dst_address_filter | – | – | – |
| interface_filter | – | – | – |
| invalid_only | boolean | – | – |
| protocol_filter | – | – | – |
| src_address_filter | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_netwatch ~324
Lists the netwatch probes with their live status and measurements. Configuration first, then a LIVE STATE block with `status`, `since` — the timestamp of the last transition — and, on an ICMP probe, the last test's numbers: `rtt-avg`, `loss-percent`, `failed-tests`. Match the two blocks by `host`, or by the `.id` the live one carries. Notes: `host_filter` and `comment_filter` are substring matches; `status_filter` and `type_filter` are exact. Pass `status_filter="down"` to list only what is currently failing. `include_source=False` (the default) omits `up-script`, `down-script` and `test-script`, because a probe that alerts through a webhook or an e-mail carries the token or the password inline. Set it to True only when you intend to read those commands; the output is redacted either way, but redaction is pattern-based and is not a guarantee. A probe with no `src-address` follows whichever WAN is active, so it keeps reporting across a failover; one pinned to a source address reports that path only. Which of the two you want depends on whether you are watching the internet or a specific link.
| Name | Type | Req | Description |
|---|---|---|---|
| comment_filter | – | – | – |
| device | – | – | – |
| host_filter | – | – | – |
| include_source | boolean | – | – |
| status_filter | – | – | – |
| type_filter | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_poe ~80
Lists the Power-over-Ethernet (PoE) configuration of PoE-capable ethernet interfaces (PoE-out mode, priority). Runs ``/interface ethernet poe print``. Notes: interface_filter: partial name match, e.g. "ether" matches ether1, ether2 …
| Name | Type | Req | Description |
|---|---|---|---|
| device | – | – | – |
| interface_filter | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_queue_trees ~52
Lists queue trees on the MikroTik device.
| Name | Type | Req | Description |
|---|---|---|---|
| device | – | – | – |
| disabled_only | boolean | – | – |
| invalid_only | boolean | – | – |
| name_filter | – | – | – |
| parent_filter | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_queue_types ~35
Lists queue types on the MikroTik device.
| Name | Type | Req | Description |
|---|---|---|---|
| device | – | – | – |
| kind_filter | – | – | – |
| name_filter | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_routes ~78
Lists routes in MikroTik routing table.
| Name | Type | Req | Description |
|---|---|---|---|
| active_only | boolean | – | – |
| device | – | – | – |
| disabled_only | boolean | – | – |
| distance_filter | – | – | – |
| dst_filter | – | – | – |
| dynamic_only | boolean | – | – |
| gateway_filter | – | – | – |
| routing_table_filter | – | – | – |
| static_only | boolean | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_schedulers ~212
Lists the scheduled tasks with their interval, next run and run count. Notes: `name_filter` is a substring match. Read `next-run` together with `interval`: a scheduler whose `run-count` is not advancing is firing into a script that errors out, which RouterOS does not surface here — it shows up in the log under the `script` topic. `include_source=False` (the default) omits `on-event`, because a scheduler can carry commands inline, and those routinely hold a bot token or a password inside a URL. Redaction only recognises labelled secrets, so withholding the field is what keeps them off the wire. Set it to True only when you intend to read the commands; the output is redacted either way, but redaction is pattern-based and is not a guarantee.
| Name | Type | Req | Description |
|---|---|---|---|
| device | – | – | – |
| include_source | boolean | – | – |
| name_filter | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_scripts ~137
Lists the stored scripts: owner, policy, run count and last start. Notes: `include_source=False` (the default) omits the script body, because bodies routinely hold credentials in clear text. Set it to True only when you intend to read the code; the output is redacted either way, but redaction is pattern-based and is not a guarantee. `policy` is what the script may do when it runs, which can exceed what the user who scheduled it may do interactively.
| Name | Type | Req | Description |
|---|---|---|---|
| device | – | – | – |
| include_source | boolean | – | – |
| name_filter | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_simple_queues ~52
Lists simple queues on the MikroTik device.
| Name | Type | Req | Description |
|---|---|---|---|
| device | – | – | – |
| disabled_only | boolean | – | – |
| invalid_only | boolean | – | – |
| name_filter | – | – | – |
| target_filter | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_system_packages ~25
Lists the installed RouterOS packages and which are disabled.
| Name | Type | Req | Description |
|---|---|---|---|
| device | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_user_groups ~34
Lists user groups on MikroTik device.
| Name | Type | Req | Description |
|---|---|---|---|
| device | – | – | – |
| name_filter | – | – | – |
| policy_filter | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_user_ssh_keys ~31
Lists SSH keys for a specific user.
| Name | Type | Req | Description |
|---|---|---|---|
| device | – | – | – |
| username | string | yes | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
list_users ~48
Lists users on MikroTik device.
| Name | Type | Req | Description |
|---|---|---|---|
| active_only | boolean | – | – |
| device | – | – | – |
| disabled_only | boolean | – | – |
| group_filter | – | – | – |
| name_filter | – | – | – |
| Name | Type | Req | Description |
|---|---|---|---|
| result | string | yes | – |
No examples provided.
How do I install the io.github.wiresage/mikrotik-mcp server?
io.github.wiresage/mikrotik-mcp runs locally as a PyPI package, launched with uvx mcp-server-mikrotik. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · mcp-server-mikrotik
claude mcp add wiresage-mikrotik-mcp -- uvx mcp-server-mikrotik
What is the io.github.wiresage/mikrotik-mcp server?
io.github.wiresage/mikrotik-mcp is listed in the public MCP registry as io.github.wiresage/mikrotik-mcp. MCP server for MikroTik routers: firewall, NAT, routing, DHCP, DNS, WireGuard and more via SSH. This page covers its PyPI package (mcp-server-mikrotik).
Is the io.github.wiresage/mikrotik-mcp server safe to use?
io.github.wiresage/mikrotik-mcp scores 71 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.wiresage/mikrotik-mcp server expose?
io.github.wiresage/mikrotik-mcp exposes 212 tools: create_backup, list_backups, create_export, export_section, download_file, and 207 more. Their descriptions and schemas cost roughly 15,351 tokens of context every time the server is loaded.
Is the io.github.wiresage/mikrotik-mcp server still maintained?
io.github.wiresage/mikrotik-mcp is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.wiresage/mikrotik-mcp server under?
io.github.wiresage/mikrotik-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.
What did VerifyMCP test on the io.github.wiresage/mikrotik-mcp server?
VerifyMCP ran 15 checks on io.github.wiresage/mikrotik-mcp, covering Known CVEs, Install scripts, Dependency health, Source repository and 11 more. One item could not be completed, a gap on our side rather than a finding about io.github.wiresage/mikrotik-mcp: Malware scan. Endpoint Security and Transport & Reachability do not apply to a PyPI package, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.