Skip to main content
Glama

Manage WireGuard Peer

manage_wireguard_peer
DestructiveIdempotent

Add or remove WireGuard peers on a MikroTik RouterOS interface; use dry-run to preview changes and avoid unintended configuration updates.

Instructions

Add or remove a WireGuard peer. Add returns already_exists when the public key and explicitly requested endpoint/allowed addresses match; different settings produce CONFLICT without changing the peer. Omitted settings are left unchanged.

Input Schema

NameRequiredDescriptionDefault
actionYesAction to perform
dryRunNoPreview changes without applying.
commentNoOptional comment
endpointNoAdd only: IPv4:port, hostname:port or [IPv6]:port (port 1–65535); hostname labels may contain underscores. Address-only IPv4/hostname/IPv6 (bare or bracketed) leaves the RouterOS port default unchanged, which may not allow initiation. Ignored for remove; omit for a roaming peer.
routerIdNoRouter ID; omit to use the default router.
interfaceYesWireGuard interface name (e.g. wg0)
publicKeyYesPeer public key in base64 format (44 characters)
allowedAddressNoAllowed IP address/CIDR for this peer (e.g. 10.0.0.2/32)
confirmationTokenNoToken from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changedv1.14.1
    • changedInput schema / properties / endpoint / description
      Previous value: -"Peer endpoint as IP:port (e.g. 1.2.3.4:51820)"New value: +"Add only: IPv4:port, hostname:port or [IPv6]:port (port 1–65535); hostname labels may contain underscores. Address-only IPv4/hostname/IPv6 (bare or bracketed) leaves the RouterOS port default unchanged, which may not allow initiation. Ignored for remove; omit for a roaming peer."
  2. Changed3 schema fields changedv1.6.0
    • changedInput schema / properties / dryRun / description
      Previous value: -"Preview changes without applying"New value: +"Preview changes without applying."
    • changedInput schema / properties / routerId / description
      Previous value: -"Target router identifier from the router registry"New value: +"Router ID; omit to use the default router."
    • changedInput schema / required
      Previous value: -[
      -  "routerId",
      -  "action",
      -  "interface",
      -  "publicKey"
      -]New value: +[
      +  "action",
      +  "interface",
      +  "publicKey"
      +]
  3. Addedv1.5.0
  4. Removedv1.1.0
  5. First observedv0.1.0

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true, idempotentHint=true and readOnlyHint=false, so the safety profile is covered. The description goes beyond that by explaining the add-time idempotency contract (matching settings return already_exists, differing settings return CONFLICT with no mutation) and the partial-update rule that omitted settings are left unchanged — genuinely useful behavior not encoded in annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three compact sentences, front-loaded with the core action, then the add-result contract, then the update semantics. Every sentence carries information an agent needs; no boilerplate or repetition of the title.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 9-parameter destructive mutation with no output schema, the description covers the main behavioral contract, and the confirmationToken/APPROVAL_REQUIRED workflow plus parameter details live in the schema. What is missing is an explicit note that 'remove' is the destructive path requiring confirmation, but the annotations and schema together make the tool callable correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3; the description adds semantics the schema cannot: which parameters only apply to add ('omitted settings are left unchanged', endpoint vs allowedAddress acting as the match key), plus the add/remove asymmetry. That is a modest but real value-add above the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb pair and resource: 'Add or remove a WireGuard peer.' That cleanly separates it from list_wireguard_peers (read-only listing) and manage_wireguard_interface (a different resource), so an agent can route correctly without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It outlines add-time behavior (already_exists vs CONFLICT, omitted settings unchanged), which implies the tool is for mutation rather than inspection, but never states when to choose this over siblings like manage_wireguard_interface or list_wireguard_peers, and never mentions the APPROVAL_REQUIRED/confirmationToken flow needed for removal. Usage is inferable, not spelled out.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools