MikroTik MCP for n8n
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| LOG_LEVEL | No | Nível de log: DEBUG, INFO, WARNING, ERROR | INFO |
| MIKROTIK_HOST | Yes | IP do roteador MikroTik | 192.168.88.1 |
| MIKROTIK_PORT | No | Porta SSH | 22 |
| N8N_NETWORK_NAME | No | Nome da rede Docker do seu n8n para comunicação interna | n8n_default |
| MIKROTIK_PASSWORD | Yes | Senha SSH | |
| MIKROTIK_USERNAME | Yes | Usuário SSH | admin |
| MIKROTIK_MCP__TRANSPORT | No | Transporte: sse, streamable-http, stdio | sse |
| MIKROTIK_MCP__ALLOWED_HOSTS | No | Use * para rede local |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| create_backupC | Creates a system backup on the MikroTik device. |
| list_backupsC | Lists backup files on the MikroTik device. |
| create_exportC | Creates a configuration export file (rsc/json/xml) on the MikroTik device. |
| export_sectionA | Exports a specific RouterOS configuration section to a file. Notes: section: RouterOS path without leading slash e.g. "ip address", "interface vlan", "ip firewall filter", "ip firewall nat", "queue simple" |
| download_fileA | Downloads a backup or export file from the MikroTik device as base64-encoded content. |
| upload_fileB | Uploads a base64-encoded file to the MikroTik device (for restore operations). |
| restore_backupA | Restores a system backup on the MikroTik device; triggers a reboot. |
| import_configurationC | Imports and executes a RouterOS configuration script (.rsc file) on the device. |
| remove_fileA | Removes a file from the MikroTik device filesystem. |
| backup_infoA | Gets detailed information about a backup file on the MikroTik device. |
| create_dhcp_serverB | Creates a DHCP server bound to the specified interface on the MikroTik device. Notes: lease_time: duration e.g. "1d", "12h", "30m", "1h30m" |
| list_dhcp_serversB | Lists DHCP servers on the MikroTik device. |
| get_dhcp_serverB | Gets detailed information about a specific DHCP server. |
| create_dhcp_networkC | Creates a DHCP network configuration (gateway, DNS, domain, etc.) on the MikroTik device. |
| create_dhcp_poolB | Creates a DHCP address pool with the given IP ranges on the MikroTik device. Notes: ranges: hyphen-separated range(s) e.g. "192.168.1.1-192.168.1.100" Multiple ranges comma-separated: "10.0.0.1-10.0.0.50,10.0.0.100-10.0.0.120" |
| remove_dhcp_serverA | Removes a DHCP server from the MikroTik device. |
| set_dns_serversC | Sets DNS server configuration. |
| get_dns_settingsC | Gets current DNS configuration. |
| add_dns_staticC | Adds a static DNS entry. |
| list_dns_staticB | Lists static DNS entries. |
| get_dns_staticA | Gets details of a specific static DNS entry. |
| update_dns_staticC | Updates a static DNS entry. |
| remove_dns_staticC | Removes a static DNS entry. |
| enable_dns_staticB | Enables a static DNS entry. |
| disable_dns_staticB | Disables a static DNS entry. |
| get_dns_cacheB | Gets the current DNS cache. |
| flush_dns_cacheB | Flushes the DNS cache. |
| get_dns_cache_statisticsC | Gets DNS cache statistics. |
| add_dns_regexpC | Adds a DNS regexp entry. |
| test_dns_queryC | Tests a DNS query. |
| export_dns_configC | Exports DNS configuration to a file. |
| create_filter_ruleA | Creates a firewall filter rule in the specified chain on the MikroTik device. Notes: connection_state: comma-separated e.g. "established,related,new,invalid" limit: RouterOS rate/burst string e.g. "10,5:packet" or "10/1s:packet" tcp_flags: RouterOS flag expression e.g. "syn,!ack" place_before: rule number or ID (*N) to insert before e.g. "0" or "*3" |
| list_filter_rulesC | Lists firewall filter rules on the MikroTik device. |
| get_filter_ruleA | Gets detailed information about a specific firewall filter rule. Notes: rule_id: use the ID from list output e.g. "*1" or "0" |
| update_filter_ruleA | Updates an existing firewall filter rule on the MikroTik device. Notes: rule_id: use the ID from list output e.g. "*1" or "0" connection_state: comma-separated e.g. "established,related" limit: RouterOS rate string e.g. "10,5:packet" tcp_flags: RouterOS flag expression e.g. "syn,!ack" Pass "" to clear an optional field (e.g. src_address=""). |
| remove_filter_ruleA | Removes a firewall filter rule from the MikroTik device. Notes: rule_id: use the ID from list output e.g. "*1" or "0" |
| move_filter_ruleA | Moves a firewall filter rule to a different position in the chain. Notes: rule_id: use the ID from list output e.g. "*1" or "0" destination: 0-based target position index |
| enable_filter_ruleB | Enables a firewall filter rule. |
| disable_filter_ruleB | Disables a firewall filter rule. |
| create_basic_firewall_setupC | Creates a basic firewall setup with common security rules on the MikroTik device. |
| create_nat_ruleB | Creates a NAT rule (srcnat or dstnat) on the MikroTik device. Notes: to_addresses: single IP or range e.g. "10.0.0.1" or "10.0.0.1-10.0.0.10" to_ports: single port or range e.g. "8080" or "8080-8090" place_before: rule number or ID (*N) to insert before e.g. "0" or "*3" |
| list_nat_rulesB | Lists NAT rules on the MikroTik device. |
| get_nat_ruleA | Gets detailed information about a specific NAT rule. Notes: rule_id: use the ID from list output e.g. "*1" or "0" |
| update_nat_ruleA | Updates an existing NAT rule on the MikroTik device. Notes: rule_id: use the ID from list output e.g. "*1" or "0" to_addresses: single IP or range e.g. "10.0.0.1" or "10.0.0.1-10.0.0.10" to_ports: single port or range e.g. "8080" or "8080-8090" Pass "" to clear an optional field. |
| remove_nat_ruleB | Removes a NAT rule from the MikroTik device. Notes: rule_id: use the ID from list output e.g. "*1" or "0" |
| move_nat_ruleA | Moves a NAT rule to a different position in the chain. Notes: rule_id: use the ID from list output e.g. "*1" or "0" destination: 0-based target position index |
| enable_nat_ruleC | Enables a NAT rule. |
| disable_nat_ruleA | Disables a NAT rule. |
| list_interfacesA | Lists all interfaces on the MikroTik device (ethernet, bridge, WireGuard, PPPoE, VLAN, WiFi, SFP, LTE, loopback, and any other type). Notes: type_filter: RouterOS interface type e.g. "ether", "bridge", "vlan", "wg", "pppoe-out", "wifi", "lte", "loopback" name_filter: partial name match e.g. "ether" matches ether1, ether2 … |
| get_interfaceA | Gets detailed information about a specific interface by name. Notes: name: exact interface name e.g. "ether1", "bridge", "pppoe-out1", "wg0" |
| enable_interfaceB | Enables an interface on the MikroTik device. Notes: name: exact interface name e.g. "ether1", "bridge", "pppoe-out1" |
| disable_interfaceB | Disables an interface on the MikroTik device. Notes: name: exact interface name e.g. "ether1", "bridge", "pppoe-out1" |
| list_devicesA | Lists the MikroTik devices this server manages. Use this to discover which devices are available and what their titles are.
Every other tool takes an optional Credentials are never returned. |
| add_ip_addressC | Adds an IP address to an interface on the MikroTik device. |
| list_ip_addressesB | Lists IP addresses on the MikroTik device. |
| get_ip_addressB | Gets detailed information about a specific IP address by ID or address value. |
| remove_ip_addressA | Removes an IP address from the MikroTik device by ID or address value. |
| add_ipv6_addressA | Adds an IPv6 address to an interface on the MikroTik device. Notes:
address: IPv6 address with prefix length, e.g. "2001:db8::1/64" or
"fe80::1/64". When |
| list_ipv6_addressesA | Lists IPv6 addresses on the MikroTik device. Notes: address_filter: partial match on the address, e.g. "2001:db8" or "fe80". global_only: show only global (routable) addresses. link_local_only: show only link-local (fe80::/10) addresses. |
| get_ipv6_addressA | Gets detailed information about a specific IPv6 address by ID or address value. Notes: address_id: a RouterOS internal id (e.g. "*1") or the address value (e.g. "2001:db8::1/64"). |
| remove_ipv6_addressA | Removes an IPv6 address from the MikroTik device by ID or address value. Notes: address_id: a RouterOS internal id (e.g. "*1") or the address value (e.g. "2001:db8::1/64"). |
| create_ip_poolA | Creates an IP pool with the given address ranges on the MikroTik device. Notes: ranges: hyphen-separated range(s) e.g. "192.168.1.1-192.168.1.100" Multiple ranges comma-separated: "10.0.0.1-10.0.0.50,10.0.0.100-10.0.0.120" |
| list_ip_poolsC | Lists IP pools on the MikroTik device. |
| get_ip_poolA | Gets detailed information about a specific IP pool including used address count. |
| update_ip_poolA | Updates an existing IP pool's name, ranges, or next-pool reference. Notes: ranges: hyphen-separated range(s) e.g. "192.168.1.1-192.168.1.100" Multiple ranges comma-separated: "10.0.0.1-10.0.0.50,10.0.0.100-10.0.0.120" Pass "" for next_pool to clear it. |
| remove_ip_poolA | Removes an IP pool from the MikroTik device (fails if pool is in use). |
| list_ip_pool_usedA | Lists currently used (allocated) addresses from IP pools. |
| expand_ip_poolA | Expands an existing IP pool by appending additional address ranges. Notes: additional_ranges: hyphen-separated range(s) e.g. "192.168.1.101-192.168.1.150" Multiple ranges comma-separated: "10.0.0.51-10.0.0.60,10.0.0.70-10.0.0.80" |
| get_logsB | Gets logs from the MikroTik device with optional topic, time, and message filters. |
| get_logs_by_severityB | Gets logs filtered by severity level (debug/info/warning/error/critical). |
| get_logs_by_topicA | Gets logs for a specific topic/facility (system, dhcp, interface, firewall, etc.). |
| search_logsB | Searches log messages for a specific term. |
| get_system_eventsB | Gets system-related log events (login, reboot, config-change, etc.). |
| get_security_logsB | Gets security-related log entries (login failures, blocked connections, etc.). |
| clear_logsB | Clears all logs from the MikroTik device. This action cannot be undone. |
| get_log_statisticsA | Gets log entry counts by topic and severity from the MikroTik device. |
| export_logsB | Exports logs to a file on the MikroTik device with optional topic and time filters. |
| monitor_logsA | Monitors MikroTik logs in near-real-time for a limited duration (max 60s). |
| get_poe_monitorA | Reads real-time Power-over-Ethernet (PoE) monitor data for one or more ethernet interfaces — PoE-out status, voltage, current, and power. Runs Notes: interfaces: comma-separated ethernet interface name(s), e.g. "ether1" or "ether9-ap,ether10-ap,ether11-ap,ether12-ap" |
| list_poeA | Lists the Power-over-Ethernet (PoE) configuration of PoE-capable ethernet interfaces (PoE-out mode, priority). Runs Notes: interface_filter: partial name match, e.g. "ether" matches ether1, ether2 … |
| get_poe_settingsA | Gets the detailed PoE-out settings of a specific ethernet interface (PoE-out mode, priority, voltage, low/high thresholds, …). Runs Notes: name: exact ethernet interface name, e.g. "ether1" |
| create_queue_typeB | Creates a queue type (qdisc). kind selects the discipline (cake, fq-codel, sfq, red, pcq, pfifo, bfifo); remaining params are per-discipline options. Notes: pcq_rate: bandwidth per flow e.g. "1M", "512k" pcq_classifier: comma-separated classifiers e.g. "src-address,dst-address" cake_rtt: round-trip time e.g. "50ms", "100ms" fq_codel_target / fq_codel_interval: time e.g. "5ms", "100ms" |
| list_queue_typesB | Lists queue types on the MikroTik device. |
| get_queue_typeC | Gets detailed information about a specific queue type. |
| update_queue_typeB | Updates an existing queue type's discipline-specific settings. |
| remove_queue_typeB | Removes a queue type from the MikroTik device. |
| create_queue_treeB | Creates a hierarchical queue tree entry attached to a parent interface or queue. Notes: max_limit / limit_at / burst_limit / burst_threshold: bandwidth e.g. "10M", "512k", "1G" burst_time: duration e.g. "8s" parent: interface name e.g. "ether1" or parent queue name priority: 1 (highest) – 8 (lowest) |
| list_queue_treesC | Lists queue trees on the MikroTik device. |
| get_queue_treeA | Gets detailed information about a specific queue tree. |
| update_queue_treeA | Updates an existing queue tree entry (bandwidth limits, parent, priority, etc.). Notes: max_limit / limit_at / burst_limit / burst_threshold: bandwidth e.g. "10M", "512k" burst_time: duration e.g. "8s" priority: 1 (highest) – 8 (lowest) |
| remove_queue_treeB | Removes a queue tree from the MikroTik device. |
| enable_queue_treeC | Enables a queue tree. |
| disable_queue_treeC | Disables a queue tree. |
| create_simple_queueA | Creates a simple queue to rate-limit a target address or interface. Notes: target: IP/CIDR or interface e.g. "192.168.1.0/24" or "ether1" max_limit / limit_at / burst_limit / burst_threshold: upload/download bandwidth as "UL/DL" e.g. "10M/10M", or single value e.g. "10M" burst_time: duration e.g. "8s" priority: 1 (highest) – 8 (lowest) |
| list_simple_queuesB | Lists simple queues on the MikroTik device. |
| get_simple_queueA | Gets detailed information about a specific simple queue. |
| update_simple_queueA | Updates an existing simple queue's rate limits, target, or scheduling settings. Notes: target: IP/CIDR or interface e.g. "192.168.1.0/24" or "ether1" max_limit / limit_at / burst_limit / burst_threshold: upload/download bandwidth as "UL/DL" e.g. "10M/10M", or single value e.g. "10M" burst_time: duration e.g. "8s" priority: 1 (highest) – 8 (lowest) |
| remove_simple_queueB | Removes a simple queue from the MikroTik device. |
| enable_simple_queueC | Enables a simple queue. |
| disable_simple_queueC | Disables a simple queue. |
| safe_mode_statusA | Returns whether MikroTik Safe Mode is currently active. |
| enable_safe_modeA | Activates MikroTik Safe Mode; changes are held in memory and auto-reverted on disconnect until committed. |
| commit_safe_modeA | Commits all pending Safe Mode changes to persistent storage and exits Safe Mode. |
| rollback_safe_modeA | Discards all pending Safe Mode changes by closing the SSH session, triggering automatic rollback. |
| add_routeC | Adds a route to the routing table. Notes: dst_address: CIDR e.g. "0.0.0.0/0", "192.168.1.0/24" check_gateway: "ping" or "arp" distance: 1-255 (lower = higher priority) |
| list_routesC | Lists routes in MikroTik routing table. |
| get_routeA | Gets detailed information about a specific route. Notes: route_id: "*N" or "N" from list output e.g. "*3" |
| update_routeA | Updates a route. Notes: route_id: "*N" or "N" from list output e.g. "*3" dst_address: CIDR e.g. "192.168.1.0/24" check_gateway: "ping" or "arp" distance: 1-255 Pass "" to routing_mark, vrf_interface, or pref_src to clear them. |
| remove_routeA | Removes a route. Notes: route_id: "*N" or "N" from list output e.g. "*3" |
| enable_routeB | Enables a route. Notes: route_id: "*N" or "N" from list output e.g. "*3" |
| disable_routeA | Disables a route. Notes: route_id: "*N" or "N" from list output e.g. "*3" |
| get_routing_tableC | Gets a specific routing table. |
| check_route_pathC | Checks the route path to a destination. |
| get_route_cacheC | Gets the route cache. |
| flush_route_cacheB | Flushes the route cache. |
| add_default_routeC | Adds a default route. |
| add_blackhole_routeC | Adds a blackhole route. Notes: dst_address: CIDR e.g. "10.0.0.0/8" distance: 1-255 |
| get_route_statisticsB | Gets routing table statistics. |
| add_userC | Adds a user to MikroTik device. |
| list_usersC | Lists users on MikroTik device. |
| get_userA | Gets detailed information about a specific user. |
| update_userC | Updates a user. |
| remove_userC | Removes a user. |
| disable_userC | Disables a user. |
| enable_userB | Enables a user. |
| add_user_groupC | Adds a user group. |
| list_user_groupsB | Lists user groups on MikroTik device. |
| get_user_groupA | Gets detailed information about a specific user group. |
| update_user_groupD | Updates a user group. |
| remove_user_groupC | Removes a user group. |
| get_active_usersB | Gets currently active/logged-in users. |
| disconnect_userC | Disconnects an active user session. |
| export_user_configB | Exports user configuration to a file. |
| set_user_ssh_keysC | Sets SSH keys for a specific user. |
| list_user_ssh_keysA | Lists SSH keys for a specific user. |
| remove_user_ssh_keyC | Removes an SSH key. |
| create_vlan_interfaceB | Creates a VLAN interface on the MikroTik device with the given VLAN ID and parent interface. |
| list_vlan_interfacesA | Lists VLAN interfaces on the MikroTik device. |
| get_vlan_interfaceA | Gets detailed information about a specific VLAN interface. |
| update_vlan_interfaceA | Updates an existing VLAN interface's settings on the MikroTik device. |
| remove_vlan_interfaceC | Removes a VLAN interface from the MikroTik device. |
| create_wireless_interfaceA | Creates a wireless interface on the MikroTik device (auto-detects RouterOS v6/v7 syntax). |
| list_wireless_interfacesC | Lists wireless interfaces on the MikroTik device. |
| get_wireless_interfaceC | Gets detailed information about a specific wireless interface. |
| remove_wireless_interfaceC | Removes a wireless interface from the MikroTik device. |
| enable_wireless_interfaceC | Enables a wireless interface. |
| disable_wireless_interfaceC | Disables a wireless interface. |
| scan_wireless_networksA | Scans for nearby wireless networks using the specified interface. |
| get_wireless_registration_tableB | Gets the wireless registration table (connected clients) from the MikroTik device. |
| check_wireless_supportA | Checks if the device supports wireless and reports the RouterOS version and wireless interface type. |
| create_wireless_security_profileD | Legacy function - not supported in RouterOS v7.x |
| list_wireless_security_profilesA | Legacy function - not supported in RouterOS v7.x |
| get_wireless_security_profileC | Legacy function - not supported in RouterOS v7.x |
| remove_wireless_security_profileB | Legacy function - not supported in RouterOS v7.x |
| set_wireless_security_profileD | Legacy function - not supported in RouterOS v7.x |
| create_wireless_access_listD | Legacy function - different in RouterOS v7.x |
| list_wireless_access_listD | Legacy function - different in RouterOS v7.x |
| remove_wireless_access_list_entryD | Legacy function - different in RouterOS v7.x |
| update_wireless_interfaceB | Updates an existing wireless interface's settings (name, SSID, enabled state, etc.). |
| create_wireguard_interfaceC | Creates a WireGuard interface on the MikroTik device. |
| list_wireguard_interfacesC | Lists WireGuard interfaces on the MikroTik device. |
| get_wireguard_interfaceB | Gets detailed information about a specific WireGuard interface. |
| update_wireguard_interfaceB | Updates an existing WireGuard interface's settings on the MikroTik device. |
| remove_wireguard_interfaceB | Removes a WireGuard interface from the MikroTik device. |
| enable_wireguard_interfaceC | Enables a WireGuard interface. |
| disable_wireguard_interfaceB | Disables a WireGuard interface. |
| add_wireguard_peerB | Adds a WireGuard peer (with public key and allowed addresses) to an interface on the MikroTik device. Notes: allowed_address: CIDR, comma-separated for multiple e.g. "10.0.0.2/32" or "10.0.0.0/24,192.168.0.0/24" endpoint_address: remote host IP or hostname e.g. "203.0.113.1" persistent_keepalive: seconds as string e.g. "25" |
| list_wireguard_peersB | Lists WireGuard peers on the MikroTik device. |
| get_wireguard_peerA | Gets detailed information about a specific WireGuard peer by ID. Notes: peer_id: "*N" or "N" from list output e.g. "*2" |
| update_wireguard_peerA | Updates an existing WireGuard peer's allowed addresses, endpoint, keepalive, or enabled state. Notes: peer_id: "*N" or "N" from list output e.g. "*2" allowed_address: CIDR, comma-separated e.g. "10.0.0.2/32" or "10.0.0.0/24,192.168.0.0/24" persistent_keepalive: seconds as string e.g. "25" Pass "" for endpoint_address or preshared_key to clear them. |
| remove_wireguard_peerA | Removes a WireGuard peer from the MikroTik device. Notes: peer_id: "*N" or "N" from list output e.g. "*2" |
| enable_wireguard_peerA | Enables a WireGuard peer. Notes: peer_id: "*N" or "N" from list output e.g. "*2" |
| disable_wireguard_peerA | Disables a WireGuard peer. Notes: peer_id: "*N" or "N" from list output e.g. "*2" |
| generate_wireguard_client_configA | Generates a wg0.conf client config string from the given keys and server endpoint. Does not communicate with the router. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 174 tools
Most tools are clearly grouped by resource (DNS, firewall, NAT, queues, users), but several clusters overlap: the six log-reading tools (get_logs, get_logs_by_severity, get_logs_by_topic, search_logs, get_system_events, get_security_logs) serve nearly the same purpose, and add_route/add_default_route/add_blackhole_route plus create_dhcp_pool/create_ip_pool create boundary confusion. Descriptions reduce but don't eliminate the ambiguity.
The dominant verb_noun pattern (get_/list_/create_/update_/remove_/enable_/disable_) is readable, but it is not consistent: add_ vs create_ (add_ip_address vs create_filter_rule), set_ vs update_ (set_dns_servers vs update_dns_static), and a few oddities like safe_mode_status and remove_user_ssh_key break the pattern.
174 tools is far beyond the 50+ threshold for an extreme count. Even for a comprehensive router-management server, the surface is bloated and will overwhelm an agent's tool-selection context.
Coverage is deep in many areas (firewall, NAT, queues, users, routes, logs), but several lifecycle gaps remain: DHCP networks and pools are create-only, IP addresses have no update, and DNS regexp entries cannot be listed or removed. The broad scope also omits common router domains like ARP, mangle rules, bridges, and system identity/resource management.