mcp-mikrotik

certificates

List MikroTik RouterOS cert metadata, calculate days until expiry, and strip private keys defensively.

Instructions

List certificates (/certificate): name, common-name, subject/issuer fields (if present), invalid-before/invalid-after (raw RouterOS date strings, kept as-is), key-size/key-type, fingerprint, and RouterOS's own flags (expired, trusted) - all returned exactly as the device sends them (booleans may come back as Python bool or be omitted entirely; see formatting.coerce_ros_bool for a caller that needs to branch on expired/trusted rather than just display them).

Adds a computed daysUntilExpiry (int, negative once past due) from invalid-after whenever it can be parsed - see formatting.parse_ros_datetime's docstring for the two RouterOS date shapes handled ("2027-01-15 12:00:00" and "jan/15/2027 12:00:00"). RouterOS's own date rendering varies by version/locale; parsing is DEFENSIVE and never raises - a row whose invalid-after doesn't match either known shape simply has no daysUntilExpiry key added, with the raw invalid-after string left untouched so a caller can still see it.

SECURITY: /certificate's own API reply never carries a private key (RouterOS only returns certificate metadata over the API) - a private-key field is nonetheless stripped defensively before returning, in case a future RouterOS version or firmware quirk ever adds one (same strip_sensitive_fields mechanism ppp_secrets/ wireguard_interfaces use). See test_certificates_strips_private_key_defensively.

See also security_audit's certificate-expiry check (v1.6), which flags an expired or soon-to-expire (<=30 days) certificate as a finding using this same expiry logic.

Returns an empty list (never an error) for a device with no certificates configured.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`device_name`	Yes

Output Schema

TableJSON Schema

Name	Required	Description	Default
`result`	Yes

Schema Changelog

Changes observed during successful MCP inspections.

Addedv1.11.0Sep 13, 2026

TDQS

A3.8/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden and does so thoroughly: it discloses defensive date parsing that never raises, the conditional `daysUntilExpiry` key, the stripping of `private-key` even though the API doesn't return it, boolean coercion caveats, and that an empty list is returned (never an error) for devices with no certificates. This is rich, non-redundant behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is quite long and dense, with some repetition (e.g., multiple mentions of defensive handling). It is front-loaded with the field list but the security and parsing details, while useful, could be tightened. Every sentence does earn its place by adding behavioral context, but the overall length is borderline excessive for a list tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (custom parsing, security stripping, conditional fields) and the presence of an output schema (which is not described here, appropriately), the description is complete enough for an agent to call the tool correctly. It covers return value nuances, edge cases, and security behavior without needing to explain the output schema's structure.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and the single parameter `device_name` is undocumented in the schema, but the description doesn't explicitly explain it either. However, with 1 parameter, the baseline is 4, and the description's focus on returned fields and behavior partially compensates by clarifying scope. It does not add parameter-specific meaning beyond the name.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it lists certificates from `/certificate`, a specific verb+resource, and enumerates the returned fields. It does not explicitly distinguish itself from siblings like `security_audit` (which it mentions) or `ppp_secrets`/`wireguard_interfaces` (which it references only for a shared mechanism), but the core purpose is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit guidance on when to use this tool versus alternatives. The mention of `security_audit`'s expiry check is informative but framed as a 'see also' rather than a routing rule. An agent is left to infer that this is purely a read/list tool separate from audit operations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server