MikroTik RouterOS API MCP Server

A Read-Only MCP server implementation for interacting with MikroTik routers using the RouterOS API.

Features

• Connection Management: Connect and authenticate with MikroTik routers.
• Resource Monitoring: Dynamic access to interfaces, bridges, and routing tables via MCP resources.
• Protocol Support: Works with both plain TCP (8728) and secure SSL/TLS (8729).
• Modern & Legacy Login: Supports RouterOS versions prior to and after v6.43.

Resources

This server exposes MikroTik entities as MCP resources for direct inspection:

• Interfaces: mikrotik://interface/{name}
  • Example: mikrotik://interface/ether1
• Bridges: mikrotik://bridge/{name}
  • Example: mikrotik://bridge/bridge1
• Bridge Ports: mikrotik://bridge/{bridge_name}/{interface_name}
  • Example: mikrotik://bridge/bridge1/ether2
• IP Routes: mikrotik://route/{id}
  • Example: mikrotik://route/400AF317 (Note: internal IDs are used for routing entries)

Tools

1. mk-connect: Connects to a router.
   • host: IP address of the router.
   • user: Username.
   • password: Password.
   • secure: (Optional) Use SSL/TLS. Default is false.

Example: mk-connect 192.168.88.1 admin mypassword

2. mk-report: Generates a comprehensive system report.

   • Aggregates system resources, health, routerboard info, and interface traffic statistics (using monitor-traffic once).

3. mk-get: Returns a JSON array with the result of a MikroTik API /print command.

   • sentence: The API path (e.g., /ip/route, /interface, /log).
   • The server automatically ensures the path starts with / and ends with /print.

4. mk-awr: Generates an Automatic Workload Repository (AWR) style report for MikroTik.

   • Includes performance metrics, security audit, and recommendations.
   • No input required.

Prompts

The server provides several pre-defined prompts for common tasks:

• mk-connect: Connect to MikroTik: Helps you establish a connection to your router.
• mk-report: System Report: Requests a full system status and traffic report.
• mk-get-route: Routing Table: Specifically asks for the current IP routing table.
• mk-get-interface: List Interfaces: Specifically asks for all configured interfaces.
• mk-get-log: View Logs: Requests the latest system log entries.
• mk-awr: Security Audit: Initiates a full performance and security audit of the router.

Configuration

The MikroTik server can use environment variables or the mk-connect tool for secure credential management:

• MK_USER: MikroTik username (required if providing host at startup)
• MK_PASSWORD: MikroTik password (required if providing host at startup)

Startup Arguments

You can optionally provide the host and security setting as command-line arguments:

1. host: (Optional) IP address of the router.
2. secure: (Optional) Use SSL/TLS. Default is false.

If these are provided, the server will attempt to connect automatically on startup using MK_USER and MK_PASSWORD.

Local Build

cd src/mikrotik
npm install
npm run build

Usage with Claude Desktop

Add this to your claude_desktop_config.json:

{
  "mcpServers": {
    "mikrotik": {
      "command": "npx",
      "args": [
        "-y",
        "@marcelo-ochoa/server-mikrotik",
        "192.168.88.1"
      ],
      "env": {
        "MK_USER": "ai_agent",
        "MK_PASSWORD": "ai_password"
      }
    }
  }
}

Sample using Docker:

{
  "mcpServers": {
    "mikrotik": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "MK_USER=admin",
        "-e",
        "MK_PASSWORD=password",
        "mochoa/mcp-mikrotik",
        "192.168.88.1",
        "false"
      ]
    }
}

Note: Arguments and environment variables are optional. You can connect later using mk-connect.

Demos

Using the information of mk-get:

• interface
• ip/address
• ip/route
• ip/route/rules
• ip/firewall[address-list,filter,nat,mangle] find potential security risk and no-used entities

See Demos for usage examples with Claude Desktop, Gemini CLI, and Antigravity Code Editor.

MikroTik AWR in action

See MikroTik AWR in action for an example of an Automatic Workload Repository (AWR) style report generated by the mk-awr tool for a MikroTik router, highlighting performance metrics and security risks.

Docker

Building the container:

docker build -t mochoa/mcp-mikrotik -f src/mikrotik/Dockerfile .

Running the container:

docker run -i --rm -e MK_USER=admin -e MK_PASSWORD=mypassword mochoa/mcp-mikrotik 192.168.88.1

Change Log

See Change Log for the history of changes.

Sources

As usual, the code of this extension is at GitHub, feel free to suggest changes and make contributions.

📜 License

This project is licensed under the Apache License, Version 2.0 for new contributions, with existing code under MIT - see the LICENSE file for details.