mcp-mikrotik

torch

Monitor live traffic on a MikroTik interface to find current bandwidth consumers, filtered by source address, destination address, or port.

Instructions

Live traffic snapshot of one interface (/tool/torch interface=<interface> once=yes) - RouterOS's own real-time traffic monitor, useful to answer "who is consuming bandwidth on this link RIGHT NOW". interface is validated for shape (validate_interface_name) before it is ever sent to the device - existence isn't checked separately, so a typo'd/unknown interface name simply produces whatever error RouterOS itself returns.

src_address/dst_address (plain IPv4/IPv6 addresses - validate_ip_address) and port (1-65535 - validate_conntrack_dst_port, reused here for the same "TCP/UDP port" shape) are all optional filters forwarded to RouterOS itself, narrowing the snapshot BEFORE it ever leaves the device - use them to cut down volume on a busy interface rather than fetching every flow and filtering client-side.

once=yes makes this a single instantaneous snapshot, not a continuous stream (same "once" convention as interface_traffic/ poe_status/lte_status - see client.MikrotikClient.torch), so the call always returns promptly instead of opening RouterOS's normal interactive torch stream.

VOLUME CAP: regardless of how many flows RouterOS reports for this snapshot, the result's flows list is sorted by total traffic (tx+rx bytes, biggest first - the "top talkers") and hard-capped at MAX_TORCH_LIMIT (50) entries - truncated is true whenever more flows matched than were returned, and total_matched always reports the real (pre-cap) count. RouterOS's own torch field names for a flow's traffic volume aren't perfectly uniform across RouterOS versions/hardware - this sorts by whichever of tx/rx (bits- or bytes-per-second, depending on version) the device actually returned, defaulting a flow with neither to 0 (sorted last) rather than failing the whole call over one unexpected row shape.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`port`	No
`interface`	Yes
`device_name`	Yes
`dst_address`	No
`src_address`	No

Output Schema

TableJSON Schema

Name	Required	Description	Default
No arguments

Schema Changelog

Changes observed during successful MCP inspections.

Addedv1.11.0Sep 13, 2026

TDQS

A4.7/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so richly: it discloses the once=yes single-snapshot semantics, the 50-entry MAX_TORCH_LIMIT cap, sort-by-total-traffic behavior, the truncated/total_matched reporting, permissive error behavior on typo'd interfaces, and a defensive fallback for non-uniform RouterOS field names.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The lead sentence front-loads the core purpose and the details are well-organized into distinct paragraphs. It is dense and runs long, with some parenthetical asides (validate_* helpers, the once convention) that border on over-explanation, but nearly every sentence adds actionable information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Even though an output schema exists (so return values needn't be explained), the description goes further by documenting the flows list, sorting, cap, and truncated/total_matched fields. Combined with validation, error, and filter behavior, an agent has everything needed to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate and it does: interface is shape-validated (existence not checked), src_address/dst_address are IPv4/IPv6 via validate_ip_address, and port is 1-65535 with TCP/UDP semantics via validate_conntrack_dst_port. It also explains that these filters are forwarded to RouterOS to narrow before egress.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource (live traffic snapshot of one interface) and frames it as RouterOS's real-time traffic monitor answering 'who is consuming bandwidth RIGHT NOW'. It implicitly distinguishes itself from polling-style siblings by stressing it is an instantaneous snapshot, not a continuous stream.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear context for use (top-talkers on a busy link right now) and explicit advice to use the src/dst/port filters to narrow on-device rather than fetching everything and filtering client-side. It references the 'once' convention shared with interface_traffic/poe_status/lte_status, but never explicitly states when to pick this over interface_traffic.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server