mikrotik-mcp

Secure, Strictly Read-Only Model Context Protocol (MCP) Server for MikroTik RouterOS v7 REST API.

Features • RouterOS Requirements • Configuration • Client Setup • Docker • Security

📌 Overview

mikrotik-mcp is an official Model Context Protocol (MCP) server that seamlessly connects AI assistants (such as Claude Desktop, Cursor, Antigravity, Cline, or other MCP-compatible clients) to MikroTik RouterOS v7 devices via the native REST API.

Engineered specifically for network observability, performance monitoring, diagnostics, and configuration inspection, this server follows a strict zero-mutation security model to eliminate any risk of accidental router modifications.

🛡️ Zero-Mutation Security Guarantee

1. 100% Read-Only: All exposed tools perform read-only inspection operations (HTTP GET only).

2. Hardened HTTP Client: The internal HTTP client enforces GET requests exclusively at the source-code level. Methods for POST, PUT, PATCH, and DELETE do not exist in the client.

3. No Arbitrary Execution: No arbitrary REST endpoints, CLI command execution, terminal sessions, or script evaluations are exposed.

4. Least-Privilege Friendly: Requires only read and rest-api policies on the router. It never requires write, policy, password, or sensitive permissions.

Related MCP server: mtik-mcp

⚡ Features & Available Tools

All tools return structured, LLM-friendly JSON output:

🚀 MikroTik RouterOS Setup

1. Enable the REST API Service

Ensure the www-ssl service (HTTPS - port 443) or www service (HTTP - port 80) is enabled on your RouterOS v7 device:

# Check service status
/ip service print

# Enable www-ssl (strongly recommended)
/ip service enable www-ssl

2. Create a Dedicated Read-Only User (Best Practice)

Create a dedicated group and user restricted to read-only API access:

# 1. Create a group with minimal policies: 'read' and 'rest-api' (or 'api')
/user group add name=mcp-readonly policy=read,api,web,rest-api

# 2. Create a dedicated user for the MCP server
/user add name=mcp-agent group=mcp-readonly password="ReplaceWithStrongPassword123!"

⚙️ Configuration

The server can be configured via Environment Variables, CLI arguments, or a .env file (automatically loaded in Node.js 20+):

🧩 Client Integration

1. Claude Desktop

Add the server entry to your Claude Desktop configuration file:

• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json

• Windows: %APPDATA%\Claude\claude_desktop_config.json

• Linux: ~/.config/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "mikrotik": {
      "command": "node",
      "args": ["/path/to/mikrotik-mcp/dist/index.js"],
      "env": {
        "MIKROTIK_HOST": "192.168.88.1",
        "MIKROTIK_PORT": "443",
        "MIKROTIK_USERNAME": "mcp-agent",
        "MIKROTIK_PASSWORD": "ReplaceWithStrongPassword123!",
        "MIKROTIK_USE_SSL": "true",
        "MIKROTIK_ALLOW_INSECURE_SSL": "true"
      }
    }
  }
}

2. Cursor / Antigravity / OpenCode / Cline

Add the server block to your MCP client configuration:

{
  "mcpServers": {
    "mikrotik": {
      "command": "npx",
      "args": ["-y", "@reyhanfahlevi/mikrotik-mcp"],
      "env": {
        "MIKROTIK_HOST": "192.168.88.1",
        "MIKROTIK_USERNAME": "mcp-agent",
        "MIKROTIK_PASSWORD": "ReplaceWithStrongPassword123!"
      }
    }
  }
}

Note: If running directly from a local clone before publishing to npm, you can point directly to the local folder:

"command": "npx",
"args": ["-y", "/absolute/path/to/mikrotik-mcp"]

🐳 Docker Deployment

The image utilizes a minimal, multi-stage Alpine build without development dependencies and runs under an unprivileged node user.

Build the Image

docker build -t mikrotik-mcp:latest .

Run with Security Hardening

docker run -i --rm \
  --read-only \
  --cap-drop=ALL \
  --security-opt=no-new-privileges:true \
  -e MIKROTIK_HOST="192.168.88.1" \
  -e MIKROTIK_USERNAME="mcp-agent" \
  -e MIKROTIK_PASSWORD="ReplaceWithStrongPassword123!" \
  mikrotik-mcp:latest

Using Docker Compose

Copy .env.example to .env, adjust your credentials, and start the service:

docker compose run --rm mikrotik-mcp

💻 Local Development

# 1. Clone repository
git clone https://github.com/reyhanfahlevi/mikrotik-mcp.git
cd mikrotik-mcp

# 2. Install dependencies
npm install

# 3. Start development server with hot-reload (tsx)
npm run dev

# 4. Build TypeScript to production JavaScript
npm run build

📄 License & Maintainer

• Author: Reyhan Fahlevi

• Repository: https://github.com/reyhanfahlevi/mikrotik-mcp

• License: MIT License