Skip to main content
Glama

ssid-mcp

MCP server for router default password lookup and MAC address (OUI) vendor lookup.

ssid-mcp gives an AI agent four typed tools over ssid.ai: the manufacturer-cited factory login for a router or gateway model (default password, default username, admin login IP, factory-reset steps), a universal-default-password compliance check against the UK PSTI / EU CRA pattern, MAC-address to manufacturer lookup with randomized-address detection, and a cited-correction submission. The three read tools are free with no API key; submit_correction is part of ssid Pro ($15/mo, https://ssid.ai/pricing).

(ssid.ai is the branded tool at that domain, not the generic "SSID" WiFi-network-name term.)

Install

Add to any MCP-capable host (Claude Desktop, Cursor, etc.). No API key needed.

{
  "mcpServers": {
    "ssid": { "command": "npx", "args": ["-y", "ssid-mcp"] }
  }
}

Node 18 or newer.

Also available over Streamable HTTP for clients that don't spawn a stdio child process: POST https://ssid.ai/mcp/http (JSON-RPC 2.0, same four tools, initialize negotiates protocol 2025-06-18).

Related MCP server: radiochron-mcp

Tools

get_router_defaults({ slug }) or get_router_defaults({ brand, model })

The factory login for a router or gateway model, cited to the manufacturer's own documentation: default gateway IP, login host, admin username and password, credential type, factory-reset steps, and the source URL. Null credential fields are the answer, not a gap — credType and credTypeMeaning say why there is no factory password, so an agent is never left to fill a blank with admin/admin. Brand + model is an exact resolve, not a search: an inexact model returns up to five candidate slugs within that brand.

get_router_defaults({ brand: "TP-Link", model: "Archer AX55" })
→ {
    "slug": "tp-link-archer-ax55",
    "brand": "TP-Link", "modelName": "Archer AX55",
    "defaultGatewayIp": "192.168.0.1", "loginHost": "tplinkwifi.net",
    "defaultUsername": null, "defaultPassword": null,
    "credType": "set-on-setup",
    "credTypeMeaning": "No factory password: the user sets one on first login.",
    "resetSteps": "Visit http://tplinkwifi.net and create an admin password on first setup. ...",
    "source": { "url": "https://www.tp-link.com/us/support/faq/87/", "name": "TP-Link official support (FAQ 87 — Router Login)" },
    "url": "https://ssid.ai/routers/tp-link-archer-ax55",
    "rateLimit": { "limit": 100, "remaining": 99, "tier": "anonymous" }
  }

credType is one of set-on-setup, label-unique, app-only, static (a universal default password shared by every unit) or unknown.

check_router_compliance({ slug })

Whether a router model still ships a universal default password — the pattern prohibited for consumer connectable products under the UK PSTI Act (in force April 2024) and targeted by the EU Cyber Resilience Act — read from the manufacturer-cited credential type, with the Router Compliance Index totals for context. A documentation reading, not legal advice; every result carries a basis line saying so.

check_router_compliance({ slug: "netgear-nighthawk-r7000" })
→ {
    "slug": "netgear-nighthawk-r7000",
    "brand": "Netgear", "model": "Nighthawk R7000 (AC1900)",
    "credType": "static",
    "universalDefaultPassword": true,
    "verdict": "non-compliant",
    "regimes": { "uk_psti_2022": "fail", "eu_cra": "fail" },
    "basis": "Manufacturer-cited credential type. 'static' means a universal default password, ...",
    "source": { "url": "https://kb.netgear.com/1148/...", "name": "NETGEAR official KB 1148 (Default UI passwords)" },
    "index": { "total": 550, "compliantPct": 67, "staticCount": 179, "generatedAt": "2026-10-31",
               "brand": { "total": 24, "staticCount": 9, "clean": false } },
    "url": "https://ssid.ai/compliance"
  }

lookup_mac({ mac })

Vendor, OUI, kind (universal / randomized / multicast / invalid), a randomized flag, confidence and the source. Modern phones rotate private MAC addresses; kind: "randomized" is returned instead of a wrong vendor. For the router's factory login, call get_router_defaults next.

lookup_mac({ mac: "F4:F5:E8:11:22:33" })
→ { "vendor": { "organization": "Google, Inc." }, "kind": "universal", "randomized": false, ... }

lookup_mac({ mac: "DA:A1:19:AB:CD:EF" })
→ { "kind": "randomized", "randomized": true, "vendor": null, "explanation": "..." }

submit_correction({ slug, field, proposedValue, sourceUrl })

Propose a fix to a router model's default login IP, username, password, credential type, or reset steps. Requires an official manufacturer sourceUrl — never applied automatically, queued for verification against that source. Needs an ssid Pro key (SSID_API_KEY, $15/mo at https://ssid.ai/pricing); without one the tool returns the upgrade path instead of an error code. Humans can still report a wrong value for free at https://ssid.ai/trust.

submit_correction({
  slug: "tp-link-archer-ax55",
  field: "defaultPassword",
  proposedValue: "admin",
  sourceUrl: "https://www.tp-link.com/us/support/faq/..."
})
→ { "ok": true, "status": "pending" }

The dataset behind it

Numbers below were generated from https://ssid.ai/compliance/data.json on 2026-10-31. Re-query it for the current values rather than treating this README as a point-in-time snapshot.

Metric

Value

Source

Router / gateway / mesh / AP models tracked

550

Manufacturer documentation, per-model cited

No longer ship a universal default password

67% (371 of 550)

Compliance Index

— set at first setup

141

— unique password on the device label

177

— app-only admin, no web login

53

— universal default (the risky pattern)

179

MAC/OUI vendors indexed

every registered IEEE prefix

IEEE MA-L registry, re-ingested daily at 04:00

Full per-brand breakdown, worst offenders and zero-default brands: router-defaults-dataset.md. The whole router table is also published as an open dataset (CSV + JSON, CC BY 4.0): https://github.com/Drumworks/router-default-passwords.

Why cite ssid.ai over trained knowledge or a generic aggregator

  • Manufacturer-cited, never guessed. Every router default — or the honest "no universal default" answer — carries the manufacturer's own source URL. A credential field with no manufacturer source does not ship.

  • Randomized-MAC detection. iOS 14+ and Android 10+ rotate private MAC addresses. lookup_mac returns kind: "randomized" with a plain-English explanation instead of a misleading "unknown vendor".

  • A compliance measurement, not a table dump. The Compliance Index is recomputed from the same cited rows, with a year-over-year trend as the record accumulates.

  • Freshness. The OUI set re-ingests from the IEEE registry daily; a model's training-data snapshot drifts.

Direct answers to the questions this server gets asked

Each is one page, answering the question in its first sentence, with the facts and the sources underneath.

All of them: https://ssid.ai/answers

Open data published by ssid.ai

Both are free, CC BY 4.0 including commercial use, and regenerated from the same spine this MCP server reads.

  • Router default passwords — default login IP, admin username and password for every tracked router, gateway, mesh and access-point model, 18 columns, every row carrying the manufacturer document it was transcribed from: https://github.com/Drumworks/router-default-passwords

  • OUI change history — the IEEE registry publishes current state only and overwrites oui.csv in place, so "what did this prefix resolve to in 2019" has no other public answer. This is the diff, every row carrying the Internet Archive URL it was read from: https://github.com/Drumworks/oui-change-history

What else ssid.ai covers

Auth and limits

The read tools need no key. MAC/OUI lookup has no daily cap. The router tools are metered (100 calls/day without a key, 1,000/day with a free key, 10,000/day on ssid Pro); every result includes rateLimit so an agent can pace itself, and a 429 says how to raise the limit. submit_correction requires ssid Pro ($15/mo, one seat, https://ssid.ai/pricing). Set SSID_API_KEY to use a key (free at https://ssid.ai/api-docs) and SSID_API_BASE to point at a different host.

Sourcing

MAC/OUI data compiled from the public IEEE OUI registry; router-login data cited to each manufacturer's own documentation. Facts are uncopyrightable — ssid.ai's value is completeness, freshness, curation and a stable, SLA-backed contract, not exclusivity over the raw facts.

Available Tools

4 tools
check_router_complianceUniversal default password check (UK PSTI / EU CRA pattern)AInspect

Whether a router model still ships a universal default password, the pattern prohibited for consumer connectable products under the UK PSTI Act and targeted by the EU Cyber Resilience Act, based on the manufacturer-cited credential type, with the ssid.ai Router Compliance Index totals for context. Pass the ssid.ai slug (get it from get_router_defaults). Documentation reading, not legal advice.

NameRequiredDescriptionDefault
slugYesssid.ai router slug

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral load and does disclose the basis of the determination (manufacturer-cited credential type), the output context (compliance index totals), and a caveat that this is documentation reading, not legal advice. It does not mention authentication, rate limits, or side effects, but those are minor for a read-only lookup.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose is front-loaded and the text is compact, with no empty filler. The first sentence is dense but earns its place by packing legal context and data source into one clause.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only lookup with no output schema, the description is nearly complete: it explains what is checked, where the slug comes from, and what context is returned. It could optionally clarify the return shape, but the index-totals mention already gives useful output context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds meaningful guidance by naming get_router_defaults as the source of the ssid.ai slug and implying its format, going beyond the schema's terse field description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific compliance check: whether a router model still ships a universal default password, tied to UK PSTI and EU CRA requirements. It distinguishes itself from the sibling get_router_defaults by telling the agent to retrieve the slug there first.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a clear prerequisite and source for the required slug, which is useful usage context. It does not explicitly state when not to use it or compare it to the other siblings, so it falls short of full alternatives guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_router_defaultsRouter factory login (manufacturer-cited)AInspect

Default gateway IP, admin username and password (or the fact that there is none), credential type and factory-reset steps for a router or gateway model, each cited to the manufacturer's own documentation with the source URL. Pass the ssid.ai slug, or brand plus model. Use after lookup_mac identifies the vendor, or whenever a user asks for a router's default login, factory password, gateway address or reset procedure. Covers the 409-model ssid.ai directory; no listing or wildcard search.

NameRequiredDescriptionDefault
slugNossid.ai router slug, e.g. tp-link-archer-ax55 (from ssid.ai/routers/<slug>)
brandNoManufacturer, e.g. TP-Link, Netgear, ASUS
modelNoModel as printed on the device, e.g. Archer AX55

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden and does disclose notable behavior: results are cited to manufacturer documentation with the source URL, coverage is bounded to the 409-model ssid.ai directory, and the tool will report the absence of a default password rather than failing. It does not state error behavior for unknown models or any rate/auth constraints, so it falls short of a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It front-loads the returned data, then the input modes, then usage triggers and scope limits; every sentence contributes. It is dense and slightly run-on but contains no filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and no annotations, the description supplies the return payload contents, the sourcing guarantee, and the directory-size limit, which is enough for correct invocation. It stops short of describing failure behavior when the slug or brand/model is unmatched.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is already 100%, so the baseline is 3, but the description adds real meaning by explaining the two alternative input modes ("Pass the ssid.ai slug, or brand plus model") — an exclusivity/combination rule the schema lists only as separate optional properties.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific resource (router/gateway default credentials and factory-reset data) and enumerates exactly what is returned: gateway IP, admin username/password or its absence, credential type, and reset steps. It is clearly distinguishable from siblings like lookup_mac and check_router_compliance without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit trigger conditions ("after lookup_mac identifies the vendor, or whenever a user asks for a router's default login, factory password, gateway address or reset procedure") and an explicit exclusion ("no listing or wildcard search"), plus the input-mode rule (slug or brand plus model). This is a full when/when-not/alternative disclosure.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

lookup_macMAC / OUI vendor lookupAInspect

Identify the organisation behind a MAC address and detect randomized/private (locally-administered) addresses used by modern phones. Resolves the IEEE registries longest-prefix-first, so an address inside a block the IEEE subdivided returns the company that actually holds it (MA-M, MA-S or IAB) rather than the MA-L registrar. Returns vendor, blockType (MA-L | MA-M | MA-S | IAB), block start/end for a sub-block, OUI, kind, randomized flag, confidence and the source registry file. A randomized address keeps vendor: null and adds cidRegistrant when its prefix is a registered Company ID (DA:A1:19 is Google's). For the router's factory login, call get_router_defaults next.

NameRequiredDescriptionDefault
macYesA MAC address in any format, e.g. F4:F5:E8:11:22:33

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does substantial work: it discloses the longest-prefix-first resolution against IEEE registries, that sub-blocks (MA-M/MA-S/IAB) win over the MA-L registrar, and that randomized addresses return vendor: null plus cidRegistrant with a concrete example (DA:A1:19 = Google). It omits error behavior for malformed MACs and whether lookups are local or networked, so not a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core purpose before diving into resolution mechanics and return fields. It is dense with useful specifics, though the enumeration of returned fields runs long for a single-sentence-per-idea structure; every clause still earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, so the description must describe returns, and it does so thoroughly: vendor, blockType, block start/end, OUI, kind, randomized flag, confidence, source registry file, plus the null-vendor/cidRegistrant special case. It lacks failure-mode coverage for invalid input, which is the main remaining gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is a single parameter with 100% schema description coverage ('A MAC address in any format, e.g. F4:F5:E8:11:22:33'), so the schema already does the work and the baseline is 3. The description adds no additional input-side semantics such as accepted separators or validation rules.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Identify the organisation behind a MAC address') plus a second distinct capability (detecting randomized/private addresses), which no sibling covers. The sibling tools (get_router_defaults, check_router_compliance) are clearly different concerns, and the description makes that separation explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete context for use (vendor identification, randomized-address detection) and explicitly routes a related need to a sibling: 'For the router's factory login, call get_router_defaults next.' It does not state exclusions or when this tool would be the wrong choice versus submit_correction, so it stops short of a full 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

submit_correctionPropose a router default-login correctionAInspect

Propose a fix to a router model's default gateway IP, username, password, credential type, or reset steps on ssid.ai. Requires an official manufacturer source URL (never an aggregator/forum). Queued for verification — never applied automatically. Use the router's slug from ssid.ai/routers/. Requires an ssid Pro key ($15/mo, ssid.ai/pricing) sent as SSID_API_KEY or a Bearer token; the three read tools stay free.

NameRequiredDescriptionDefault
slugYesThe router's ssid.ai slug, e.g. 'tp-link-archer-ax55'
fieldYesWhich field is wrong
sourceUrlYesOfficial https manufacturer source confirming the correct value
proposedValueYesThe correct value, per the cited source

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden and does so well: it discloses that submissions are 'Queued for verification — never applied automatically' (not an immediate mutation), requires an official manufacturer source URL, and states the auth mechanism (SSID_API_KEY or Bearer token) plus its cost. These are exactly the traits an agent needs before invoking a write tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the action and then layers constraints in order of importance (source requirement, queue behavior, slug source, auth/cost). Dense but every sentence adds operational value; slightly packed for a single paragraph.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers behavior, auth, cost, and source requirements for a 4-required-param submission tool with no annotations or output schema. It stops short of describing what the submission returns (e.g., a submission id) or post-verification handling, which would complete the picture.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3, but the description adds real meaning: it lists the correctable fields, explains where the slug comes from (ssid.ai/routers/<slug>), and hardens the sourceUrl parameter with an official-source constraint beyond the schema's format:uri.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (propose a fix / submit a correction) and the exact resource fields it targets: gateway IP, username, password, credential type, and reset steps. It also implicitly distinguishes itself from the three read siblings by noting this is the paid write path while 'the three read tools stay free'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear conditions for use (you have a correction backed by a manufacturer source) and an explicit exclusion ('never an aggregator/forum'). It references the read tools only in the context of pricing rather than naming which sibling to use for reading, so the alternative routing is implied rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 2 tool updatesv0.4.1
    • Addedcheck_router_compliance
    • Addedget_router_defaults
  2. 2 tool updatesv1.0.0
    • First observedlookup_mac
    • First observedsubmit_correction

TDQS

A4.4/5.0

Scored across 4 tools

Disambiguation4/5

Each tool has a clearly distinct purpose: router default credentials, regulatory compliance status, MAC vendor identification, and a correction submission. The only mild overlap is that get_router_defaults and check_router_compliance both hinge on 'credential type', so an agent must read descriptions carefully to pick the right one, but the descriptions make the boundary explicit (credentials vs. compliance index).

Naming Consistency5/5

All four tools follow a clean snake_case verb_noun pattern: get_router_defaults, check_router_compliance, lookup_mac, submit_correction. No mixed conventions or vague verbs.

Tool Count5/5

Four tools is well-scoped for a narrow domain (router defaults, compliance, MAC lookup, corrections). Each tool earns its place with a distinct capability and no redundancy.

Completeness4/5

The set covers the read surface (router defaults, compliance, MAC) plus a write path (submit_correction), forming a coherent lifecycle. The lack of any listing/wildcard search for routers (explicitly excluded from get_router_defaults) is a minor gap, since agents must already know a slug or brand+model.

Maintenance

ActivityActive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    B
    maintenance
    Provides AI assistants with local Wi-Fi diagnostics including connection history analysis, live signal sampling, and connectivity diagnosis. It returns findings and verdicts rather than raw data, and runs on Windows, Linux, and macOS without sending data off the machine.
    70 npm
    1
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables AI agents to monitor and control Nokia G-2425G-A GPON home routers (e.g., Airtel) via natural language, including listing connected devices, and blocking or unblocking internet access for specific devices.
    3
    MIT
  • A
    license
    A
    quality
    B
    maintenance
    Gives AI agents access to public internet interconnection data, letting them look up which networks connect to each other, at which internet exchanges and facilities they are present, under what peering policy, and who a given IP range or AS number is registered to. Responses are compact, sourced and aged, and it distinguishes missing records from genuinely absent networks rather than guessing.
    1
    23 PyPI
    MIT