SkillFoxx

MikroMCP

An MCP server for MikroTik RouterOS and SwOS: 133 typed tools with dry-run, snapshots and change rollback.

  • 103 ★ on the repository
  • Last commit
MCP server

Broad access

Why this level

  • An agent can change routes, firewall rules and configuration of live routers and, if allowed, run SSH commands.
  • Router access credentials are kept in the server configuration.
All reasons and checks

alikarami/mikromcpAuthor:AliKarami

Install

In your terminal, with SkillFoxx CLI

npx skillfoxx add mcp/mikromcp

Detects the agents on your machine, shows the access level and pins the version.

Other ways to install

Access and checks

How we review

Broad accessThe tool can change data, run commands or handle secrets.

  • An agent can change routes, firewall rules and configuration of live routers and, if allowed, run SSH commands.
  • Router access credentials are kept in the server configuration.

This is third-party code. Review the repository files before installing.

What it does

MikroMCP exposes RouterOS routers and SwOS switches as 133 typed MCP tools. The agent reads system state, interfaces, VLANs, addresses, DHCP, DNS, firewall and NAT rules, routes, BGP and OSPF, reads logs and runs `ping`, `traceroute` and `torch` from the router itself. Tools validate argument schemas, make writes idempotent and can show planned changes without applying them. Protection comes from bearer tokens with bcrypt hashes, roles and limits per router and tool, confirmation tokens, an audit log and guarded SSH command execution. Safe changes use snapshots, a write journal, `plan_changes`, `apply_plan` and `rollback_change`. Each router has its own circuit breaker against cascading failures. It runs over stdio for desktop clients and over Streamable HTTP and SSE.

Who it is for. Network engineers and MikroTik administrators who want to review configuration and diagnose a network through an assistant.

Good fit when

  • You want router state, interfaces, routes and recent log errors in one request.
  • Firewall rules should be checked for disabled and overlapping port forwards without changing anything.
  • A new route is first shown in dry-run with a change plan and only then applied.
  • Several people manage a router fleet and each needs their own permissions.

Not a fit when

  • Routers run RouterOS 6: the server targets the version 7 REST API.
  • You need SwOS switches in production: support is marked experimental.
  • An agent must not get access to a live network without a human in the loop.

Example request

Inspect the edge-01 router: list disabled firewall rules and overlapping port forwards without changing anything yet.

MCP

Transport
stdio, http, sse
Authentication
API key

Environment variables

MIKROMCP_DEFAULT_ROUTER
Default router ID for single-router setups.

Limitations

Node.js 22 and RouterOS 7 with the REST API enabled are required. SwOS and SwOS Lite switch support is experimental and built on a reverse-engineered `.b` HTTP interface, so writes go through a firmware compatibility check. HTTP and SSE modes need tokens and roles configured and plain stdio launch targets a single router. The SSH command tool is guarded by limits but stays powerful: set permissions and confirmations for it. Retries apply only to read tools. Detailed installation and configuration guides live in the project wiki.

How to disable. Remove the `mikromcp` entry from the client config and the package with `npm uninstall -g mikromcp`. On the router revoke the API user the server used.

FAQ

How do I install MikroMCP?

Run `npm install -g mikromcp`, then `mikromcp init`. For a single router over stdio that is enough, and Docker and HTTP are covered in the wiki guide.

How do I avoid risky changes?

Use dry-run, `plan_changes`, confirmation tokens and roles limited by router and tool. `rollback_change` and snapshots cover rollback.

Which transports are supported?

stdio for desktop clients, plus Streamable HTTP and legacy SSE for remote and service-style use.

How do I set a default router?

Set the `MIKROMCP_DEFAULT_ROUTER` variable: the router ID in calls becomes optional.

Is there a Claude Code skill?

Yes, the repository ships a skill for safe tool use, described in the wiki page Using the Skill.

Discussion

No questions or reviews yet.

MCP servers

An MCP server for MikroTik routers: the agent reads and changes RouterOS configuration over SSH on a chat request

MCP serverBroad access334
Official

An MCP server for Linux diagnostics: an AI client reads services, logs and network on local and remote hosts, read-only

MCP serverExtended access320

MCP Slim Guard sits between an agent and your MCP servers: it validates calls against schemas and returns big results in parts.

MCP serverExtended access180

A self-hosted gateway that merges several MCP servers into one endpoint with auth and tool selection

MCP serverBroad access2.8K
Russian stack

MCP server for Keenetic routers: the agent lists devices and Wi-Fi, changes rules through the RCI API and installs nothing on the router

MCP serverBroad access31

An MCP server connects agents to UniFi infrastructure for device diagnostics, configuration reviews and approved changes

MCP serverBroad access351

README in short

The README explains why a layer between agent and router is needed, lists capabilities by category, shows sample prompts and compares the server with the raw REST API and SSH. Installation, tools and configuration are covered in the wiki.

README badge

Report a problem