@ai-solutions.ru/mikrotik-mcp-server

High-performance TypeScript MCP (Model Context Protocol) server for MikroTik RouterOS management. Connect Claude, GPT-4, or any MCP-compatible AI to your MikroTik router and manage it through natural language.

npx @ai-solutions.ru/mikrotik-mcp-server

🚀 Why This Server?

Related MCP server: vyos-mcp

✨ Unique Features

1. Dynamic API Discovery (unique in ecosystem)

Browse the entire RouterOS API tree without needing to know command paths in advance. The AI can explore unknown router configurations autonomously.

→ mikrotik_discover_endpoints(path: "/ip")
  Returns: address, arp, dhcp-client, dhcp-server, dns, firewall, hotspot, ipsec, ...

→ mikrotik_get_endpoint_schema(path: "/ip/firewall/filter")
  Returns: available commands (print, add, remove, set, enable, disable) and parameters

This means Claude can discover and interact with any RouterOS subsystem — including packages you've installed, containers, advanced routing, hardware-specific features — without the server needing hardcoded knowledge of them.

2. Structured Content + Zod Output Schemas

Every tool returns both human-readable Markdown and machine-readable JSON via structuredContent. The JSON is validated against Zod schemas, giving you typed, predictable data structures that work with MCP clients that support structured output.

// Example: mikrotik_list_ip_addresses returns
{
  content: [{ type: "text", text: "# IP Addresses\n..." }],   // ← Markdown for AI
  structuredContent: {                                          // ← Typed JSON for clients
    total: 5,
    addresses: [{ id: "*1", address: "192.168.1.1/24", interface: "bridge", ... }]
  }
}

3. MCP Safety Annotations

Tools are annotated with MCP 2025 safety hints so AI clients can present appropriate warnings:

• readOnlyHint: true — safe to call without side effects (list/print operations)

• destructiveHint: true — modifies router state (add/remove/reboot)

• idempotentHint: true — safe to retry

• openWorldHint: true — queries live state from router

The reboot tool additionally requires confirm: true parameter as an extra safety gate.

4. VPN Management (WireGuard + IPsec)

First MikroTik MCP server with WireGuard peer management:

• List all WireGuard peers with traffic stats

• Add new WireGuard peers with endpoint and allowed addresses

• List IPsec peers with profiles

• Graceful handling when WireGuard package isn't installed

5. Raw Command Execution

mikrotik_execute_command provides a full escape hatch to the RouterOS API — execute any RouterOS command with any parameters. This enables AI to handle edge cases, new RouterOS features, or complex operations not covered by specialized tools.

6. Configuration Backup & Export

• mikrotik_create_backup — binary RouterOS backup (survives factory reset)

• mikrotik_export_config — human-readable script export with statistics (line count, command count, size)

📋 Full Tool Reference

🖥 System (2 tools)

🔌 Interfaces (3 tools)

🌐 IP Addresses (3 tools)

🔥 Firewall (3 tools)

📡 DHCP (3 tools)

🔍 DNS (2 tools)

🗺 Routing (3 tools)

🔐 VPN (3 tools)

💾 Backup (2 tools)

⚡ Execute (1 tool)

🔭 Discovery (2 tools)

Total: 27 tools + 4 MCP resources

📦 MCP Resources

🔧 Installation & Setup

Claude Desktop

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "mikrotik": {
      "command": "npx",
      "args": ["-y", "@ai-solutions.ru/mikrotik-mcp-server"],
      "env": {
        "MIKROTIK_HOST": "192.168.88.1",
        "MIKROTIK_USER": "admin",
        "MIKROTIK_PASSWORD": "yourpassword",
        "MIKROTIK_PORT": "8728",
        "MIKROTIK_SECURE": "false"
      }
    }
  }
}

Environment Variables

Enable RouterOS API

In RouterOS WebFig or terminal:

/ip service enable api

For TLS: /ip service enable api-ssl

💬 Example Conversations

"What's the current state of my router?"

Calls mikrotik_system_info → Returns device name, RouterOS version, CPU load, RAM usage, uptime

"Show me all firewall rules that drop traffic"

Calls mikrotik_list_firewall_rules(chain="forward") → Filters by action=drop

"Add a static DNS record for myserver.local pointing to 10.0.0.50"

Calls mikrotik_add_dns_record(name="myserver.local", address="10.0.0.50")

"List all WireGuard peers and their traffic stats"

Calls mikrotik_list_wireguard_peers() → Returns peers with RX/TX bytes

"What API endpoints are available under /container?"

Calls mikrotik_discover_endpoints(path="/container") → Browses RouterOS container API

"Export the full router config as a backup script"

Calls mikrotik_export_config() → Returns full RouterOS export with stats

🏗 Architecture

src/
├── index.ts              # Entry point, env config
├── server.ts             # MCP server + tool/resource registration
├── constants.ts          # Configuration constants
├── routeros/
│   └── client.ts         # RouterOS API client (node-routeros)
├── cache/
│   └── memory.ts         # LRU in-memory cache
├── discovery/
│   └── service.ts        # Dynamic API discovery service
├── tools/
│   ├── system.ts         # System info & reboot
│   ├── interfaces.ts     # Interface management
│   ├── ip-address.ts     # IP address CRUD
│   ├── firewall.ts       # Firewall rules
│   ├── dhcp.ts           # DHCP leases & servers
│   ├── dns.ts            # Static DNS records
│   ├── routing.ts        # Routes & NAT
│   ├── vpn.ts            # WireGuard & IPsec
│   ├── backup.ts         # Backup & export
│   ├── execute.ts        # Raw command execution
│   └── discovery.ts      # API discovery tools
├── resources/
│   ├── system-info.ts    # System resource
│   ├── interfaces.ts     # Interfaces resource
│   ├── firewall.ts       # Firewall resource
│   └── routing.ts        # Routing resource
└── utils/
    ├── format.ts         # Formatting, truncation, pagination
    ├── errors.ts         # RouterOS error handling
    └── logger.ts         # Structured logging

🔒 Security Notes

• All write operations carry destructiveHint: true annotation

• Reboot requires explicit confirm: true parameter

• Credentials are passed via environment variables (never in code)

• TLS support via MIKROTIK_SECURE=true + port 8729

• Consider using a read-only RouterOS API user for monitoring-only setups

📜 License

MIT © AI Solutions