Skip to main content
Glama
Sign In
MikroTik MCP for n8n

MikroTik MCP for n8n

by Foninhoiuri
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Hybrid

MikroTik MCP for n8n

Fork do mikrotik-mcp configurado para rodar como container Docker com transporte SSE, pronto para integração com n8n.

O que muda neste fork

  • Transporte SSE por padrão — o container já sobe em modo SSE (HTTP), sem precisar configurar

  • Docker Compose pronto — aponte o Portainer para este repo e deploy

  • Log configurável — variável LOG_LEVEL para debug sem rebuild

  • Documentação em PT-BR — instruções completas em README-N8N.md

Related MCP server: RouterOS MCP Server

Arquitetura

┌─────────────────┐     HTTP/SSE      ┌─────────────────────┐     SSH      ┌──────────────┐
│    n8n           │ ──────────────►   │  mikrotik-mcp:8000  │ ──────────►  │  MikroTik    │
│  (AI Agent)      │   porta 3000     │  (Docker Container) │  porta 22   │  Router      │
└─────────────────┘                   └─────────────────────┘              └──────────────┘

Quick Start

1. Deploy via Portainer (recomendado)

  1. Stacks → Add Stack

  2. Repository: https://github.com/Foninhoiuri/mcp-mikrotik-for-n8n.git

  3. Compose path: docker-compose.yml

  4. Ajuste as variáveis de ambiente (IP, usuário, senha do MikroTik)

  5. Deploy the stack

2. Deploy manual

git clone https://github.com/Foninhoiuri/mcp-mikrotik-for-n8n.git
cd mcp-mikrotik-for-n8n

# Edite o docker-compose.yml com suas credenciais
docker compose up -d

3. Conectar no n8n

  1. No n8n, vá em Settings → MCP Servers

  2. Transporte: SSE

  3. URL: http://IP_DO_SEU_SERVIDOR:3000/sse

As ferramentas do MikroTik aparecem automaticamente no AI Agent.

Variáveis de Ambiente

Variável

Padrão

Descrição

MIKROTIK_HOST

192.168.88.1

IP do roteador MikroTik

MIKROTIK_USERNAME

admin

Usuário SSH

MIKROTIK_PASSWORD

(vazio)

Senha SSH

MIKROTIK_PORT

22

Porta SSH

MIKROTIK_MCP__TRANSPORT

sse

Transporte: sse, streamable-http, stdio

MIKROTIK_MCP__ALLOWED_HOSTS

(vazio)

Use * para rede local

LOG_LEVEL

INFO

Nível de log: DEBUG, INFO, WARNING, ERROR

N8N_NETWORK_NAME

n8n_default

Nome da rede Docker do seu n8n para comunicação interna

Ferramentas disponíveis

Todas as 173+ tools do projeto original, incluindo:

  • 🔥 Firewall — regras de filter e NAT

  • 🌐 DNS — registros estáticos e configurações

  • 📡 DHCP — leases e configuração de servidor

  • 🔒 WireGuard — peers e interfaces VPN

  • 🖧 Interfaces — VLANs, bridges, ethernet

  • 📊 Queues — controle de banda

  • 🗂️ Backup — export e backup do sistema

  • 👥 Usuários — gerenciamento de contas

  • 📋 Logs — consulta de logs do sistema

  • 🛣️ Rotas — tabela de roteamento

Documentação completa

📚 Veja README-N8N.md para instruções detalhadas incluindo:

  • Deploy via Portainer

  • Configuração multi-device (vários MikroTiks)

  • Troubleshooting

Créditos

Baseado no projeto mikrotik-mcp por Jeff Nasseri.

Licença

MIT License — veja LICENSE.

Available Tools

174 tools
add_blackhole_routeC

Adds a blackhole route.

Notes: dst_address: CIDR e.g. "10.0.0.0/8" distance: 1-255

Inputs: dst_address (required), device, comment, distance. Returns: result

add_default_routeC

Adds a default route.

Inputs: gateway (required), device, comment, distance, +1 more. Returns: result

add_dns_regexpC

Adds a DNS regexp entry.

Inputs: regexp (required), address (required), ttl, device, +2 more. Returns: result

add_dns_staticC

Adds a static DNS entry.

Inputs: name (required), ttl, text, cname, +11 more. Returns: result

add_ip_addressC

Adds an IP address to an interface on the MikroTik device.

Inputs: address (required), interface (required), device, comment, +3 more. Returns: result

add_ipv6_addressA

Adds an IPv6 address to an interface on the MikroTik device.

Notes: address: IPv6 address with prefix length, e.g. "2001:db8::1/64" or "fe80::1/64". When from_pool is used, supply the host part only, e.g. "::1/64". advertise: include this prefix in Router Advertisements (default no). eui_64: derive the host part of the address from the interface MAC. from_pool: name of an IPv6 pool to take the prefix from. no_dad: skip Duplicate Address Detection.

Inputs: address (required), interface (required), device, eui_64, +5 more. Returns: result

add_routeC

Adds a route to the routing table.

Notes: dst_address: CIDR e.g. "0.0.0.0/0", "192.168.1.0/24" check_gateway: "ping" or "arp" distance: 1-255 (lower = higher priority)

Inputs: gateway (required), dst_address (required), scope, device, +8 more. Returns: result

add_userC

Adds a user to MikroTik device.

Inputs: name (required), password (required), group, device, +3 more. Returns: result

add_user_groupC

Adds a user group.

Inputs: name (required), policy (required), skin, device, +1 more. Returns: result

add_wireguard_peerB

Adds a WireGuard peer (with public key and allowed addresses) to an interface on the MikroTik device.

Notes: allowed_address: CIDR, comma-separated for multiple e.g. "10.0.0.2/32" or "10.0.0.0/24,192.168.0.0/24" endpoint_address: remote host IP or hostname e.g. "203.0.113.1" persistent_keepalive: seconds as string e.g. "25"

Inputs: interface (required), public_key (required), allowed_address (required), device, +6 more. Returns: result

backup_infoA
Read-onlyIdempotent

Gets detailed information about a backup file on the MikroTik device.

Inputs: filename (required), device. Returns: result

check_route_pathC
Read-onlyIdempotent

Checks the route path to a destination.

Inputs: destination (required), device, source, routing_mark. Returns: result

check_wireless_supportA
Read-onlyIdempotent

Checks if the device supports wireless and reports the RouterOS version and wireless interface type.

Inputs: device. Returns: result

clear_logsB
DestructiveIdempotent

Clears all logs from the MikroTik device. This action cannot be undone.

Inputs: device. Returns: result

commit_safe_modeA

Commits all pending Safe Mode changes to persistent storage and exits Safe Mode.

Inputs: device. Returns: result

create_backupC

Creates a system backup on the MikroTik device.

Inputs: name, device, comment, dont_encrypt, +1 more. Returns: result

create_basic_firewall_setupC
Destructive

Creates a basic firewall setup with common security rules on the MikroTik device.

Inputs: device. Returns: result

create_dhcp_networkC

Creates a DHCP network configuration (gateway, DNS, domain, etc.) on the MikroTik device.

Inputs: gateway (required), network (required), device, domain, +6 more. Returns: result

create_dhcp_poolB

Creates a DHCP address pool with the given IP ranges on the MikroTik device.

Notes: ranges: hyphen-separated range(s) e.g. "192.168.1.1-192.168.1.100" Multiple ranges comma-separated: "10.0.0.1-10.0.0.50,10.0.0.100-10.0.0.120"

Inputs: name (required), ranges (required), device, comment, +1 more. Returns: result

create_dhcp_serverB

Creates a DHCP server bound to the specified interface on the MikroTik device.

Notes: lease_time: duration e.g. "1d", "12h", "30m", "1h30m"

Inputs: name (required), interface (required), device, comment, +5 more. Returns: result

create_exportC
Read-onlyIdempotent

Creates a configuration export file (rsc/json/xml) on the MikroTik device.

Inputs: name, device, comment, compact, +4 more. Returns: result

create_filter_ruleA

Creates a firewall filter rule in the specified chain on the MikroTik device.

Notes: connection_state: comma-separated e.g. "established,related,new,invalid" limit: RouterOS rate/burst string e.g. "10,5:packet" or "10/1s:packet" tcp_flags: RouterOS flag expression e.g. "syn,!ack" place_before: rule number or ID (*N) to insert before e.g. "0" or "*3"

Inputs: chain (required), action (required), log, limit, +17 more. Returns: result

create_ip_poolA

Creates an IP pool with the given address ranges on the MikroTik device.

Notes: ranges: hyphen-separated range(s) e.g. "192.168.1.1-192.168.1.100" Multiple ranges comma-separated: "10.0.0.1-10.0.0.50,10.0.0.100-10.0.0.120"

Inputs: name (required), ranges (required), device, comment, +1 more. Returns: result

create_nat_ruleB

Creates a NAT rule (srcnat or dstnat) on the MikroTik device.

Notes: to_addresses: single IP or range e.g. "10.0.0.1" or "10.0.0.1-10.0.0.10" to_ports: single port or range e.g. "8080" or "8080-8090" place_before: rule number or ID (*N) to insert before e.g. "0" or "*3"

Inputs: chain (required), action (required), log, device, +13 more. Returns: result

create_queue_treeB

Creates a hierarchical queue tree entry attached to a parent interface or queue.

Notes: max_limit / limit_at / burst_limit / burst_threshold: bandwidth e.g. "10M", "512k", "1G" burst_time: duration e.g. "8s" parent: interface name e.g. "ether1" or parent queue name priority: 1 (highest) – 8 (lowest)

Inputs: name (required), parent (required), queue, device, +10 more. Returns: result

create_queue_typeB

Creates a queue type (qdisc). kind selects the discipline (cake, fq-codel, sfq, red, pcq, pfifo, bfifo); remaining params are per-discipline options.

Notes: pcq_rate: bandwidth per flow e.g. "1M", "512k" pcq_classifier: comma-separated classifiers e.g. "src-address,dst-address" cake_rtt: round-trip time e.g. "50ms", "100ms" fq_codel_target / fq_codel_interval: time e.g. "5ms", "100ms"

Inputs: name (required), kind, device, cake_mpu, +24 more. Returns: result

create_simple_queueA

Creates a simple queue to rate-limit a target address or interface.

Notes: target: IP/CIDR or interface e.g. "192.168.1.0/24" or "ether1" max_limit / limit_at / burst_limit / burst_threshold: upload/download bandwidth as "UL/DL" e.g. "10M/10M", or single value e.g. "10M" burst_time: duration e.g. "8s" priority: 1 (highest) – 8 (lowest)

Inputs: name (required), target (required), dst, queue, +12 more. Returns: result

create_vlan_interfaceB

Creates a VLAN interface on the MikroTik device with the given VLAN ID and parent interface.

Inputs: name (required), vlan_id (required), interface (required), arp, +6 more. Returns: result

create_wireguard_interfaceC

Creates a WireGuard interface on the MikroTik device.

Inputs: name (required), mtu, device, comment, +3 more. Returns: result

create_wireless_access_listD

Legacy function - different in RouterOS v7.x

Inputs: device. Returns: result

create_wireless_interfaceA

Creates a wireless interface on the MikroTik device (auto-detects RouterOS v6/v7 syntax).

Inputs: name (required), band, mode, ssid, +7 more. Returns: result

create_wireless_security_profileD

Legacy function - not supported in RouterOS v7.x

Inputs: name (required), device. Returns: result

disable_dns_staticB
Idempotent

Disables a static DNS entry.

Inputs: entry_id (required), device. Returns: result

disable_filter_ruleB
Idempotent

Disables a firewall filter rule.

Inputs: rule_id (required), device. Returns: result

disable_interfaceB
Idempotent

Disables an interface on the MikroTik device.

Notes: name: exact interface name e.g. "ether1", "bridge", "pppoe-out1"

Inputs: name (required), device. Returns: result

disable_nat_ruleA
Idempotent

Disables a NAT rule.

Inputs: rule_id (required), device. Returns: result

disable_queue_treeC
Idempotent

Disables a queue tree.

Inputs: name (required), device. Returns: result

disable_routeA
Idempotent

Disables a route.

Notes: route_id: "*N" or "N" from list output e.g. "*3"

Inputs: route_id (required), device. Returns: result

disable_simple_queueC
Idempotent

Disables a simple queue.

Inputs: name (required), device. Returns: result

disable_userC
Idempotent

Disables a user.

Inputs: name (required), device. Returns: result

disable_wireguard_interfaceB
Idempotent

Disables a WireGuard interface.

Inputs: name (required), device. Returns: result

disable_wireguard_peerA
Idempotent

Disables a WireGuard peer.

Notes: peer_id: "*N" or "N" from list output e.g. "*2"

Inputs: peer_id (required), device. Returns: result

disable_wireless_interfaceC
Idempotent

Disables a wireless interface.

Inputs: name (required), device. Returns: result

disconnect_userC
DestructiveIdempotent

Disconnects an active user session.

Inputs: user_id (required), device. Returns: result

download_fileA
Read-onlyIdempotent

Downloads a backup or export file from the MikroTik device as base64-encoded content.

Inputs: filename (required), device, file_type. Returns: result

enable_dns_staticB
Idempotent

Enables a static DNS entry.

Inputs: entry_id (required), device. Returns: result

enable_filter_ruleB
Idempotent

Enables a firewall filter rule.

Inputs: rule_id (required), device. Returns: result

enable_interfaceB
Idempotent

Enables an interface on the MikroTik device.

Notes: name: exact interface name e.g. "ether1", "bridge", "pppoe-out1"

Inputs: name (required), device. Returns: result

enable_nat_ruleC
Idempotent

Enables a NAT rule.

Inputs: rule_id (required), device. Returns: result

enable_queue_treeC
Idempotent

Enables a queue tree.

Inputs: name (required), device. Returns: result

enable_routeB
Idempotent

Enables a route.

Notes: route_id: "*N" or "N" from list output e.g. "*3"

Inputs: route_id (required), device. Returns: result

enable_safe_modeA

Activates MikroTik Safe Mode; changes are held in memory and auto-reverted on disconnect until committed.

Inputs: device. Returns: result

enable_simple_queueC
Idempotent

Enables a simple queue.

Inputs: name (required), device. Returns: result

enable_userB
Idempotent

Enables a user.

Inputs: name (required), device. Returns: result

enable_wireguard_interfaceC
Idempotent

Enables a WireGuard interface.

Inputs: name (required), device. Returns: result

enable_wireguard_peerA
Idempotent

Enables a WireGuard peer.

Notes: peer_id: "*N" or "N" from list output e.g. "*2"

Inputs: peer_id (required), device. Returns: result

enable_wireless_interfaceC
Idempotent

Enables a wireless interface.

Inputs: name (required), device. Returns: result

expand_ip_poolA
Idempotent

Expands an existing IP pool by appending additional address ranges.

Notes: additional_ranges: hyphen-separated range(s) e.g. "192.168.1.101-192.168.1.150" Multiple ranges comma-separated: "10.0.0.51-10.0.0.60,10.0.0.70-10.0.0.80"

Inputs: name (required), additional_ranges (required), device. Returns: result

export_dns_configC
Read-onlyIdempotent

Exports DNS configuration to a file.

Inputs: device, filename. Returns: result

export_logsB
Read-onlyIdempotent

Exports logs to a file on the MikroTik device with optional topic and time filters.

Inputs: device, format, topics, filename, +1 more. Returns: result

export_sectionA
Read-onlyIdempotent

Exports a specific RouterOS configuration section to a file.

Notes: section: RouterOS path without leading slash e.g. "ip address", "interface vlan", "ip firewall filter", "ip firewall nat", "queue simple"

Inputs: section (required), name, device, compact, +1 more. Returns: result

export_user_configB
Read-onlyIdempotent

Exports user configuration to a file.

Inputs: device, filename. Returns: result

flush_dns_cacheB
DestructiveIdempotent

Flushes the DNS cache.

Inputs: device. Returns: result

flush_route_cacheB
DestructiveIdempotent

Flushes the route cache.

Inputs: device. Returns: result

generate_wireguard_client_configA
Read-onlyIdempotent

Generates a wg0.conf client config string from the given keys and server endpoint. Does not communicate with the router.

Inputs: client_address (required), server_endpoint (required), server_public_key (required), client_private_key (required), +5 mo… Returns: result

get_active_usersB
Read-onlyIdempotent

Gets currently active/logged-in users.

Inputs: device. Returns: result

get_dhcp_serverB
Read-onlyIdempotent

Gets detailed information about a specific DHCP server.

Inputs: name (required), device. Returns: result

get_dns_cacheB
Read-onlyIdempotent

Gets the current DNS cache.

Inputs: device. Returns: result

get_dns_cache_statisticsC
Read-onlyIdempotent

Gets DNS cache statistics.

Inputs: device. Returns: result

get_dns_settingsC
Read-onlyIdempotent

Gets current DNS configuration.

Inputs: device. Returns: result

get_dns_staticA
Read-onlyIdempotent

Gets details of a specific static DNS entry.

Inputs: entry_id (required), device. Returns: result

get_filter_ruleA
Read-onlyIdempotent

Gets detailed information about a specific firewall filter rule.

Notes: rule_id: use the ID from list output e.g. "*1" or "0"

Inputs: rule_id (required), device. Returns: result

get_interfaceA
Read-onlyIdempotent

Gets detailed information about a specific interface by name.

Notes: name: exact interface name e.g. "ether1", "bridge", "pppoe-out1", "wg0"

Inputs: name (required), device. Returns: result

get_ip_addressB
Read-onlyIdempotent

Gets detailed information about a specific IP address by ID or address value.

Inputs: address_id (required), device. Returns: result

get_ip_poolA
Read-onlyIdempotent

Gets detailed information about a specific IP pool including used address count.

Inputs: name (required), device. Returns: result

get_ipv6_addressA
Read-onlyIdempotent

Gets detailed information about a specific IPv6 address by ID or address value.

Notes: address_id: a RouterOS internal id (e.g. "*1") or the address value (e.g. "2001:db8::1/64").

Inputs: address_id (required), device. Returns: result

get_logsB
Read-onlyIdempotent

Gets logs from the MikroTik device with optional topic, time, and message filters.

Inputs: limit, action, device, follow, +5 more. Returns: result

get_logs_by_severityB
Read-onlyIdempotent

Gets logs filtered by severity level (debug/info/warning/error/critical).

Inputs: severity (required), limit, device, time_filter. Returns: result

get_logs_by_topicA
Read-onlyIdempotent

Gets logs for a specific topic/facility (system, dhcp, interface, firewall, etc.).

Inputs: topic (required), limit, device, time_filter. Returns: result

get_log_statisticsA
Read-onlyIdempotent

Gets log entry counts by topic and severity from the MikroTik device.

Inputs: device. Returns: result

get_nat_ruleA
Read-onlyIdempotent

Gets detailed information about a specific NAT rule.

Notes: rule_id: use the ID from list output e.g. "*1" or "0"

Inputs: rule_id (required), device. Returns: result

get_poe_monitorA
Read-onlyIdempotent

Reads real-time Power-over-Ethernet (PoE) monitor data for one or more ethernet interfaces — PoE-out status, voltage, current, and power.

Runs /interface ethernet poe monitor <interfaces> once.

Notes: interfaces: comma-separated ethernet interface name(s), e.g. "ether1" or "ether9-ap,ether10-ap,ether11-ap,ether12-ap"

Inputs: interfaces (required), device. Returns: result

get_poe_settingsA
Read-onlyIdempotent

Gets the detailed PoE-out settings of a specific ethernet interface (PoE-out mode, priority, voltage, low/high thresholds, …).

Runs /interface ethernet poe print detail where name=<name>.

Notes: name: exact ethernet interface name, e.g. "ether1"

Inputs: name (required), device. Returns: result

get_queue_treeA
Read-onlyIdempotent

Gets detailed information about a specific queue tree.

Inputs: name (required), device. Returns: result

get_queue_typeC
Read-onlyIdempotent

Gets detailed information about a specific queue type.

Inputs: name (required), device. Returns: result

get_routeA
Read-onlyIdempotent

Gets detailed information about a specific route.

Notes: route_id: "*N" or "N" from list output e.g. "*3"

Inputs: route_id (required), device. Returns: result

get_route_cacheC
Read-onlyIdempotent

Gets the route cache.

Inputs: device. Returns: result

get_route_statisticsB
Read-onlyIdempotent

Gets routing table statistics.

Inputs: device. Returns: result

get_routing_tableC
Read-onlyIdempotent

Gets a specific routing table.

Inputs: device, table_name, active_only, protocol_filter. Returns: result

get_security_logsB
Read-onlyIdempotent

Gets security-related log entries (login failures, blocked connections, etc.).

Inputs: limit, device, time_filter. Returns: result

get_simple_queueA
Read-onlyIdempotent

Gets detailed information about a specific simple queue.

Inputs: name (required), device. Returns: result

get_system_eventsB
Read-onlyIdempotent

Gets system-related log events (login, reboot, config-change, etc.).

Inputs: limit, device, event_type, time_filter. Returns: result

get_userA
Read-onlyIdempotent

Gets detailed information about a specific user.

Inputs: name (required), device. Returns: result

get_user_groupA
Read-onlyIdempotent

Gets detailed information about a specific user group.

Inputs: name (required), device. Returns: result

get_vlan_interfaceA
Read-onlyIdempotent

Gets detailed information about a specific VLAN interface.

Inputs: name (required), device. Returns: result

get_wireguard_interfaceB
Read-onlyIdempotent

Gets detailed information about a specific WireGuard interface.

Inputs: name (required), device. Returns: result

get_wireguard_peerA
Read-onlyIdempotent

Gets detailed information about a specific WireGuard peer by ID.

Notes: peer_id: "*N" or "N" from list output e.g. "*2"

Inputs: peer_id (required), device. Returns: result

get_wireless_interfaceC
Read-onlyIdempotent

Gets detailed information about a specific wireless interface.

Inputs: name (required), device. Returns: result

get_wireless_registration_tableB
Read-onlyIdempotent

Gets the wireless registration table (connected clients) from the MikroTik device.

Inputs: device, interface. Returns: result

get_wireless_security_profileC
Read-onlyIdempotent

Legacy function - not supported in RouterOS v7.x

Inputs: name (required), device. Returns: result

import_configurationC
Destructive

Imports and executes a RouterOS configuration script (.rsc file) on the device.

Inputs: filename (required), device, verbose, run_after_reset. Returns: result

list_backupsC
Read-onlyIdempotent

Lists backup files on the MikroTik device.

Inputs: device, name_filter, include_exports. Returns: result

list_devicesA
Read-onlyIdempotent

Lists the MikroTik devices this server manages.

Use this to discover which devices are available and what their titles are. Every other tool takes an optional device argument that must be one of the titles returned here. When only one device is configured, device may be omitted and that device is used automatically.

Credentials are never returned.

Inputs: no named parameters. Returns: result

list_dhcp_serversB
Read-onlyIdempotent

Lists DHCP servers on the MikroTik device.

Inputs: device, name_filter, invalid_only, disabled_only, +1 more. Returns: result

list_dns_staticB
Read-onlyIdempotent

Lists static DNS entries.

Inputs: device, name_filter, regexp_only, type_filter, +2 more. Returns: result

list_filter_rulesC
Read-onlyIdempotent

Lists firewall filter rules on the MikroTik device.

Inputs: device, chain_filter, dynamic_only, invalid_only, +6 more. Returns: result

list_interfacesA
Read-onlyIdempotent

Lists all interfaces on the MikroTik device (ethernet, bridge, WireGuard, PPPoE, VLAN, WiFi, SFP, LTE, loopback, and any other type).

Notes: type_filter: RouterOS interface type e.g. "ether", "bridge", "vlan", "wg", "pppoe-out", "wifi", "lte", "loopback" name_filter: partial name match e.g. "ether" matches ether1, ether2 …

Inputs: device, name_filter, type_filter, running_only, +1 more. Returns: result

list_ip_addressesB
Read-onlyIdempotent

Lists IP addresses on the MikroTik device.

Inputs: device, dynamic_only, disabled_only, address_filter, +2 more. Returns: result

list_ip_poolsC
Read-onlyIdempotent

Lists IP pools on the MikroTik device.

Inputs: device, name_filter, include_used, ranges_filter. Returns: result

list_ip_pool_usedA
Read-onlyIdempotent

Lists currently used (allocated) addresses from IP pools.

Inputs: device, pool_name, mac_filter, info_filter, +1 more. Returns: result

list_ipv6_addressesA
Read-onlyIdempotent

Lists IPv6 addresses on the MikroTik device.

Notes: address_filter: partial match on the address, e.g. "2001:db8" or "fe80". global_only: show only global (routable) addresses. link_local_only: show only link-local (fe80::/10) addresses.

Inputs: device, global_only, dynamic_only, disabled_only, +3 more. Returns: result

list_nat_rulesB
Read-onlyIdempotent

Lists NAT rules on the MikroTik device.

Inputs: device, chain_filter, invalid_only, action_filter, +5 more. Returns: result

list_poeA
Read-onlyIdempotent

Lists the Power-over-Ethernet (PoE) configuration of PoE-capable ethernet interfaces (PoE-out mode, priority).

Runs /interface ethernet poe print.

Notes: interface_filter: partial name match, e.g. "ether" matches ether1, ether2 …

Inputs: device, interface_filter. Returns: result

list_queue_treesC
Read-onlyIdempotent

Lists queue trees on the MikroTik device.

Inputs: device, name_filter, invalid_only, disabled_only, +1 more. Returns: result

list_queue_typesB
Read-onlyIdempotent

Lists queue types on the MikroTik device.

Inputs: device, kind_filter, name_filter. Returns: result

list_routesC
Read-onlyIdempotent

Lists routes in MikroTik routing table.

Inputs: device, dst_filter, active_only, static_only, +5 more. Returns: result

list_simple_queuesB
Read-onlyIdempotent

Lists simple queues on the MikroTik device.

Inputs: device, name_filter, invalid_only, disabled_only, +1 more. Returns: result

list_user_groupsB
Read-onlyIdempotent

Lists user groups on MikroTik device.

Inputs: device, name_filter, policy_filter. Returns: result

list_usersC
Read-onlyIdempotent

Lists users on MikroTik device.

Inputs: device, active_only, name_filter, group_filter, +1 more. Returns: result

list_user_ssh_keysA
Read-onlyIdempotent

Lists SSH keys for a specific user.

Inputs: username (required), device. Returns: result

list_vlan_interfacesA
Read-onlyIdempotent

Lists VLAN interfaces on the MikroTik device.

Inputs: device, name_filter, disabled_only, vlan_id_filter, +1 more. Returns: result

list_wireguard_interfacesC
Read-onlyIdempotent

Lists WireGuard interfaces on the MikroTik device.

Inputs: device, name_filter, running_only, disabled_only. Returns: result

list_wireguard_peersB
Read-onlyIdempotent

Lists WireGuard peers on the MikroTik device.

Inputs: device, disabled_only, interface_filter. Returns: result

list_wireless_access_listD
Read-onlyIdempotent

Legacy function - different in RouterOS v7.x

Inputs: device. Returns: result

list_wireless_interfacesC
Read-onlyIdempotent

Lists wireless interfaces on the MikroTik device.

Inputs: device, name_filter, running_only, disabled_only. Returns: result

list_wireless_security_profilesA
Read-onlyIdempotent

Legacy function - not supported in RouterOS v7.x

Inputs: device. Returns: result

monitor_logsA
Read-onlyIdempotent

Monitors MikroTik logs in near-real-time for a limited duration (max 60s).

Inputs: action, device, topics, duration. Returns: result

move_filter_ruleA
Idempotent

Moves a firewall filter rule to a different position in the chain.

Notes: rule_id: use the ID from list output e.g. "*1" or "0" destination: 0-based target position index

Inputs: rule_id (required), destination (required), device. Returns: result

move_nat_ruleA
Idempotent

Moves a NAT rule to a different position in the chain.

Notes: rule_id: use the ID from list output e.g. "*1" or "0" destination: 0-based target position index

Inputs: rule_id (required), destination (required), device. Returns: result

remove_dhcp_serverA
DestructiveIdempotent

Removes a DHCP server from the MikroTik device.

Inputs: name (required), device. Returns: result

remove_dns_staticC
DestructiveIdempotent

Removes a static DNS entry.

Inputs: entry_id (required), device. Returns: result

remove_fileA
Destructive

Removes a file from the MikroTik device filesystem.

Inputs: filename (required), device. Returns: result

remove_filter_ruleA
DestructiveIdempotent

Removes a firewall filter rule from the MikroTik device.

Notes: rule_id: use the ID from list output e.g. "*1" or "0"

Inputs: rule_id (required), device. Returns: result

remove_ip_addressA
DestructiveIdempotent

Removes an IP address from the MikroTik device by ID or address value.

Inputs: address_id (required), device. Returns: result

remove_ip_poolA
DestructiveIdempotent

Removes an IP pool from the MikroTik device (fails if pool is in use).

Inputs: name (required), device. Returns: result

remove_ipv6_addressA
DestructiveIdempotent

Removes an IPv6 address from the MikroTik device by ID or address value.

Notes: address_id: a RouterOS internal id (e.g. "*1") or the address value (e.g. "2001:db8::1/64").

Inputs: address_id (required), device. Returns: result

remove_nat_ruleB
DestructiveIdempotent

Removes a NAT rule from the MikroTik device.

Notes: rule_id: use the ID from list output e.g. "*1" or "0"

Inputs: rule_id (required), device. Returns: result

remove_queue_treeB
DestructiveIdempotent

Removes a queue tree from the MikroTik device.

Inputs: name (required), device. Returns: result

remove_queue_typeB
DestructiveIdempotent

Removes a queue type from the MikroTik device.

Inputs: name (required), device. Returns: result

remove_routeA
DestructiveIdempotent

Removes a route.

Notes: route_id: "*N" or "N" from list output e.g. "*3"

Inputs: route_id (required), device. Returns: result

remove_simple_queueB
DestructiveIdempotent

Removes a simple queue from the MikroTik device.

Inputs: name (required), device. Returns: result

remove_userC
DestructiveIdempotent

Removes a user.

Inputs: name (required), device. Returns: result

remove_user_groupC
DestructiveIdempotent

Removes a user group.

Inputs: name (required), device. Returns: result

remove_user_ssh_keyC
DestructiveIdempotent

Removes an SSH key.

Inputs: key_id (required), device. Returns: result

remove_vlan_interfaceC
DestructiveIdempotent

Removes a VLAN interface from the MikroTik device.

Inputs: name (required), device. Returns: result

remove_wireguard_interfaceB
DestructiveIdempotent

Removes a WireGuard interface from the MikroTik device.

Inputs: name (required), device. Returns: result

remove_wireguard_peerA
DestructiveIdempotent

Removes a WireGuard peer from the MikroTik device.

Notes: peer_id: "*N" or "N" from list output e.g. "*2"

Inputs: peer_id (required), device. Returns: result

remove_wireless_access_list_entryD
DestructiveIdempotent

Legacy function - different in RouterOS v7.x

Inputs: entry_id (required), device. Returns: result

remove_wireless_interfaceC
DestructiveIdempotent

Removes a wireless interface from the MikroTik device.

Inputs: name (required), device. Returns: result

remove_wireless_security_profileB
DestructiveIdempotent

Legacy function - not supported in RouterOS v7.x

Inputs: name (required), device. Returns: result

restore_backupA
Destructive

Restores a system backup on the MikroTik device; triggers a reboot.

Inputs: filename (required), device, password. Returns: result

rollback_safe_modeA

Discards all pending Safe Mode changes by closing the SSH session, triggering automatic rollback.

Inputs: device. Returns: result

safe_mode_statusA
Read-onlyIdempotent

Returns whether MikroTik Safe Mode is currently active.

Inputs: device. Returns: result

scan_wireless_networksA
Read-onlyIdempotent

Scans for nearby wireless networks using the specified interface.

Inputs: interface (required), device, duration. Returns: result

search_logsB
Read-onlyIdempotent

Searches log messages for a specific term.

Inputs: search_term (required), limit, device, time_filter, +1 more. Returns: result

set_dns_serversC

Sets DNS server configuration.

Inputs: servers (required), device, use_doh, cache_size, +6 more. Returns: result

set_user_ssh_keysC

Sets SSH keys for a specific user.

Inputs: key_file (required), username (required), device. Returns: result

set_wireless_security_profileD

Legacy function - not supported in RouterOS v7.x

Inputs: interface_name (required), security_profile (required), device. Returns: result

test_dns_queryC
Read-onlyIdempotent

Tests a DNS query.

Inputs: name (required), type, device, server. Returns: result

update_dns_staticC
Idempotent

Updates a static DNS entry.

Inputs: entry_id (required), ttl, name, text, +12 more. Returns: result

update_filter_ruleA
Idempotent

Updates an existing firewall filter rule on the MikroTik device.

Notes: rule_id: use the ID from list output e.g. "*1" or "0" connection_state: comma-separated e.g. "established,related" limit: RouterOS rate string e.g. "10,5:packet" tcp_flags: RouterOS flag expression e.g. "syn,!ack" Pass "" to clear an optional field (e.g. src_address="").

Inputs: rule_id (required), log, chain, limit, +17 more. Returns: result

update_ip_poolA
Idempotent

Updates an existing IP pool's name, ranges, or next-pool reference.

Notes: ranges: hyphen-separated range(s) e.g. "192.168.1.1-192.168.1.100" Multiple ranges comma-separated: "10.0.0.1-10.0.0.50,10.0.0.100-10.0.0.120" Pass "" for next_pool to clear it.

Inputs: name (required), device, ranges, comment, +2 more. Returns: result

update_nat_ruleA
Idempotent

Updates an existing NAT rule on the MikroTik device.

Notes: rule_id: use the ID from list output e.g. "*1" or "0" to_addresses: single IP or range e.g. "10.0.0.1" or "10.0.0.1-10.0.0.10" to_ports: single port or range e.g. "8080" or "8080-8090" Pass "" to clear an optional field.

Inputs: rule_id (required), log, chain, action, +13 more. Returns: result

update_queue_treeA
Idempotent

Updates an existing queue tree entry (bandwidth limits, parent, priority, etc.).

Notes: max_limit / limit_at / burst_limit / burst_threshold: bandwidth e.g. "10M", "512k" burst_time: duration e.g. "8s" priority: 1 (highest) – 8 (lowest)

Inputs: name (required), queue, device, parent, +11 more. Returns: result

update_queue_typeB
Idempotent

Updates an existing queue type's discipline-specific settings.

Inputs: name (required), device, cake_mpu, cake_nat, +11 more. Returns: result

update_routeA
Idempotent

Updates a route.

Notes: route_id: "*N" or "N" from list output e.g. "*3" dst_address: CIDR e.g. "192.168.1.0/24" check_gateway: "ping" or "arp" distance: 1-255 Pass "" to routing_mark, vrf_interface, or pref_src to clear them.

Inputs: route_id (required), scope, device, comment, +9 more. Returns: result

update_simple_queueA
Idempotent

Updates an existing simple queue's rate limits, target, or scheduling settings.

Notes: target: IP/CIDR or interface e.g. "192.168.1.0/24" or "ether1" max_limit / limit_at / burst_limit / burst_threshold: upload/download bandwidth as "UL/DL" e.g. "10M/10M", or single value e.g. "10M" burst_time: duration e.g. "8s" priority: 1 (highest) – 8 (lowest)

Inputs: name (required), dst, queue, device, +13 more. Returns: result

update_userC
Idempotent

Updates a user.

Inputs: name (required), group, device, address, +4 more. Returns: result

update_user_groupD
Idempotent

Updates a user group.

Inputs: name (required), skin, device, policy, +2 more. Returns: result

update_vlan_interfaceA
Idempotent

Updates an existing VLAN interface's settings on the MikroTik device.

Inputs: name (required), arp, mtu, device, +7 more. Returns: result

update_wireguard_interfaceB
Idempotent

Updates an existing WireGuard interface's settings on the MikroTik device.

Inputs: name (required), mtu, device, comment, +4 more. Returns: result

update_wireguard_peerA
Idempotent

Updates an existing WireGuard peer's allowed addresses, endpoint, keepalive, or enabled state.

Notes: peer_id: "*N" or "N" from list output e.g. "*2" allowed_address: CIDR, comma-separated e.g. "10.0.0.2/32" or "10.0.0.0/24,192.168.0.0/24" persistent_keepalive: seconds as string e.g. "25" Pass "" for endpoint_address or preshared_key to clear them.

Inputs: peer_id (required), device, comment, disabled, +5 more. Returns: result

update_wireless_interfaceB
Idempotent

Updates an existing wireless interface's settings (name, SSID, enabled state, etc.).

Inputs: name (required), ssid, device, comment, +2 more. Returns: result

upload_fileB

Uploads a base64-encoded file to the MikroTik device (for restore operations).

Inputs: filename (required), content_base64 (required), device. Returns: result

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    C2.4/5.0

    Scored across 174 tools

    Disambiguation3/5

    Most tools are clearly grouped by resource (DNS, firewall, NAT, queues, users), but several clusters overlap: the six log-reading tools (get_logs, get_logs_by_severity, get_logs_by_topic, search_logs, get_system_events, get_security_logs) serve nearly the same purpose, and add_route/add_default_route/add_blackhole_route plus create_dhcp_pool/create_ip_pool create boundary confusion. Descriptions reduce but don't eliminate the ambiguity.

    Naming Consistency3/5

    The dominant verb_noun pattern (get_/list_/create_/update_/remove_/enable_/disable_) is readable, but it is not consistent: add_ vs create_ (add_ip_address vs create_filter_rule), set_ vs update_ (set_dns_servers vs update_dns_static), and a few oddities like safe_mode_status and remove_user_ssh_key break the pattern.

    Tool Count1/5

    174 tools is far beyond the 50+ threshold for an extreme count. Even for a comprehensive router-management server, the surface is bloated and will overwhelm an agent's tool-selection context.

    Completeness3/5

    Coverage is deep in many areas (firewall, NAT, queues, users, routes, logs), but several lifecycle gaps remain: DHCP networks and pools are create-only, IP addresses have no update, and DNS regexp entries cannot be listed or removed. The broad scope also omits common router domains like ARP, mangle rules, bridges, and system identity/resource management.

    Maintenance

    ActivityNo data
    ResponsivenessSyncing

    Resources

    Related MCP Connectors

    Related MCP Servers

    • MikroTik MCP

      tarcisiodier
      A
      license
      Not graded
      quality
      D
      maintenance
      A bridge between AI assistants and MikroTik RouterOS devices, allowing natural language interaction to manage network configurations including VLANs, firewalls, DNS settings, and more.
      1
      MIT

    • RouterOS MCP Server

      sevaepsteyn
      A
      license
      Not graded
      quality
      D
      maintenance
      Enables AI assistants to interact with MikroTik RouterOS devices through API and SSH connections, supporting network monitoring, configuration management, and diagnostics across multiple routers with automatic connection fallback.
      3
      MIT

    • MikroTik MCP

      wiresage
      A
      license
      C
      quality
      A
      maintenance
      Provides a bridge between AI assistants and MikroTik RouterOS devices, enabling natural language management of VLANs, firewall rules, DNS settings, and more.
      218
      487 PyPI
      325
      MIT