MikroTik MCP Server

How to use

Use an MCP client or MCPO proxy to interact with the MikroTik MCP Server. Start the MCP server locally or run it via a wrapper like MCPO to expose a RESTful API. From there, you can perform common network administration tasks such as creating VLAN interfaces, adding IP addresses, configuring DHCP, managing NAT rules, and overseeing wireless configurations through clearly named tools.

How to install

Prerequisites: Python 3.8+ and a MikroTik RouterOS device with API access enabled. You also need Python dependencies such as a MikroTik API client.

# Manual Installation
# 1. Clone the MikroTik MCP repository
git clone https://github.com/jeff-nasseri/mikrotik-mcp/tree/master
cd mcp-mikrotik

# 2. Create a Python virtual environment
python -m venv .venv
source .venv/bin/activate  # On Windows: .venv\Scripts\activate

# 3. Install dependencies
pip install -e .

# 4. Run the MikroTik MCP server
mcp-server-mikrotik

# Docker Installation
# 1. Clone the repository
git clone https://github.com/jeff-nasseri/mikrotik-mcp.git
cd mikrotik-mcp

# 2. Build the Docker image
docker build -t mikrotik-mcp .

# 3. Configure Cursor IDE to connect to the container
# Add this to your ~/.cursor/mcp.json
{
  "mcpServers": {
    "mikrotik-mcp-server": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "-e", "MIKROTIK_HOST=192.168.88.1",
        "-e", "MIKROTIK_USERNAME=sshuser",
        "-e", "MIKROTIK_PASSWORD=your_password",
        "-e", "MIKROTIK_PORT=22",
        "mikrotik-mcp"
      ]
    }
  }
}

Environment variables shown for the Docker setup include: MIKROTIK_HOST (MikroTik device IP or hostname), MIKROTIK_USERNAME (SSH username), MIKROTIK_PASSWORD (SSH password), and MIKROTIK_PORT (SSH port, default 22).

# MCPO (exposing MCP Server via REST) example
# 1. Install MCPO (example uses uvx as a launcher)
# Option 1: Using uvx (recommended - no installation needed)
uvx mcpo --help

# Option 2: Using pip
pip install mcpo

# 2. MCPO configuration to run the MikroTik MCP server locally
# Create mcp-config.json with a stdio entry
{
  "mcpServers": {
    "mikrotik-mcp-server": {
      "command": "python",
      "args": [
        "src/mcp_mikrotik/server.py",
        "--password", "admin",
        "--host", "<HOST>",
        "--port", "22",
        "--username", "admin"
      ],
      "env": {}
    }
  }
}

Configuration

The MikroTik MCP server can be run in traditional local mode or exposed via MCPO for REST access. Environment variables are used to configure the MikroTik connection when using containerized or remote runs. You may also run the MCP server directly with Python or via MCPO to surface a REST API.

# Example MCPO JSON configuration for local runtime
{
  "mcpServers": {
    "mikrotik-mcp-server": {
      "command": "python",
      "args": [
        "src/mcp_mikrotik/server.py",
        "--password", "admin",
        "--host", "192.168.1.1",
        "--port", "22",
        "--username", "admin"
      ],
      "env": {}
    }
  }
}

Environment variables you may set when running via Docker are: - MIKROTIK_HOST: MikroTik device IP or hostname - MIKROTIK_USERNAME: SSH username - MIKROTIK_PASSWORD: SSH password - MIKROTIK_PORT: SSH port (default 22)

Usage examples with mcp-cli

Use the provided MCP CLI to run specific MikroTik MCP tools from a shell. The commands below show how you can create, list, update, and remove MikroTik resources via the single MCP interface.

# Create VLAN interface
uv run mcp-cli cmd --server mikrotik --tool mikrotik_create_vlan_interface --tool-args '{"name": "vlan100", "vlan_id": 100, "interface": "ether1", "comment": "Production VLAN"}'

# List VLAN interfaces
uv run mcp-cli cmd --server mikrotik --tool mikrotik_list_vlan_interfaces --tool-args '{}'

# Get VLAN interface details
uv run mcp-cli cmd --server mikrotik --tool mikrotik_get_vlan_interface --tool-args '{"name": "vlan100"}'

# Update VLAN interface
uv run mcp-cli cmd --server mikrotik --tool mikrotik_update_vlan_interface --tool-args '{"name": "vlan100", "comment": "Updated VLAN"}'

# Remove VLAN interface
uv run mcp-cli cmd --server mikrotik --tool mikrotik_remove_vlan_interface --tool-args '{"name": "vlan100"}'

Additional usage and examples

You can perform a wide range of tasks using the tools listed in the MikroTik MCP server. Examples include IP address management, DHCP configuration, NAT rules, DNS configuration, user management, backup/export operations, firewall rules, and wireless network management. The following sections provide concrete examples for common workflows.

mikrotik_create_vlan_interface

Creates a VLAN interface on the MikroTik device with required fields: name, vlan_id, and interface, plus optional settings like comment, disabled, mtu, use_service_tag, arp, and arp_timeout.

mikrotik_list_vlan_interfaces

Lists VLAN interfaces with optional filters by name, VLAN ID, parent interface, and disabled status.

mikrotik_get_vlan_interface

Retrieves detailed information about a specific VLAN interface by name.

mikrotik_update_vlan_interface

Updates an existing VLAN interface with new values for any of its parameters.

mikrotik_remove_vlan_interface

Removes a VLAN interface from the MikroTik device.

mikrotik_add_ip_address

Adds an IP address to a specified interface with optional network, broadcast, comment, and disabled fields.

mikrotik_list_ip_addresses

Lists IP addresses with optional filtering by interface, address, network, or status.

mikrotik_get_ip_address

Gets detailed information about a specific IP address by address_id.

mikrotik_remove_ip_address

Removes an IP address by address_id.

mikrotik_create_dhcp_server

Creates a DHCP server bound to a specific interface with options for lease time, pool, authorization, and comments.

mikrotik_list_dhcp_servers

Lists DHCP servers with optional filters by name, interface, and status.

mikrotik_get_dhcp_server

Retrieves details for a specific DHCP server by name.

mikrotik_create_dhcp_network

Creates a DHCP network configuration including network, gateway, and optional DNS/WINS/NTP settings.

mikrotik_create_dhcp_pool

Creates a DHCP address pool with a name and IP ranges.

mikrotik_remove_dhcp_server

Removes a DHCP server by name.

mikrotik_create_nat_rule

Creates a NAT rule with chain, action, and optional fields like addresses, ports, interfaces, and logging.

mikrotik_list_nat_rules

Lists NAT rules with multiple filters and status options.

mikrotik_get_nat_rule

Gets details for a NAT rule by rule_id.

mikrotik_update_nat_rule

Updates an existing NAT rule with any subset of the create parameters.

mikrotik_remove_nat_rule

Removes a NAT rule by rule_id.

mikrotik_move_nat_rule

Moves a NAT rule to a new position in the list.

mikrotik_enable_nat_rule

Enables a NAT rule by rule_id.

mikrotik_disable_nat_rule

Disables a NAT rule by rule_id.

mikrotik_create_ip_pool

Creates an IP pool with a name and IP ranges.

mikrotik_list_ip_pools

Lists IP pools with optional filters and flags.

mikrotik_get_ip_pool

Gets details for a specific IP pool by name.

mikrotik_update_ip_pool

Updates an existing IP pool with new ranges or metadata.

mikrotik_remove_ip_pool

Removes an IP pool by name.

mikrotik_list_ip_pool_used

Lists addresses currently used from within a pool.

mikrotik_expand_ip_pool

Expands an existing IP pool by adding more ranges.

mikrotik_create_backup

Creates a system backup with optional encryption and password inclusion.

mikrotik_list_backups

Lists available backups with options to include exports.

mikrotik_create_export

Exports a configuration in a chosen format and type.

mikrotik_export_section

Exports a specific configuration section to a file.

mikrotik_download_file

Downloads a file from the MikroTik device by filename and optional type.

mikrotik_upload_file

Uploads a file to the MikroTik device using base64 content.

mikrotik_restore_backup

Restores a system backup by filename with an optional password.

mikrotik_import_configuration

Imports a configuration script and optionally runs after reset.

mikrotik_remove_file

Removes a file from the MikroTik device.

mikrotik_backup_info

Gets detailed information about a backup file.

mikrotik_get_logs

Retrieves device logs with various filters for topics, time, and limit.

mikrotik_get_logs_by_severity

Gets logs filtered by severity level.

mikrotik_get_logs_by_topic

Gets logs for a specific topic.

mikrotik_search_logs

Searches logs for a term with optional time and case sensitivity.

mikrotik_get_system_events

Fetches system-related log events by type.

mikrotik_get_security_logs

Retrieves security-related log entries.

mikrotik_clear_logs

Clears all logs from the device.

mikrotik_get_log_statistics

Gets statistics about log entries.

mikrotik_export_logs

Exports logs to a file with optional topic and format.

mikrotik_monitor_logs

Monitors logs in real time for a duration.

mikrotik_create_filter_rule

Creates a firewall filter rule with many optional matching criteria.

mikrotik_list_filter_rules

Lists firewall filter rules with various filters.

mikrotik_get_filter_rule

Gets details for a firewall filter rule by rule_id.

mikrotik_update_filter_rule

Updates a firewall filter rule with optional fields.

mikrotik_remove_filter_rule

Removes a firewall filter rule by rule_id.

mikrotik_move_filter_rule

Moves a firewall filter rule to a new position.

mikrotik_enable_filter_rule

Enables a firewall filter rule.

mikrotik_disable_filter_rule

Disables a firewall filter rule.

mikrotik_create_basic_firewall_setup

Creates a basic firewall configuration with common security rules.

mikrotik_add_route

Adds a routing entry to the main routing table.

mikrotik_list_routes

Lists routes with filters for destination, gateway, and status.

mikrotik_get_route

Gets details for a specific route by route_id.

mikrotik_update_route

Updates a route with new parameters.

mikrotik_remove_route

Removes a route by route_id.

mikrotik_enable_route

Enables a route by route_id.

mikrotik_disable_route

Disables a route by route_id.

mikrotik_get_routing_table

Retrieves a routing table with optional filtering.

mikrotik_check_route_path

Checks the path to a destination.

mikrotik_get_route_cache

Gets the route cache.

mikrotik_flush_route_cache

Flushes the route cache.

mikrotik_add_default_route

Adds a default route (0.0.0.0/0) with a gateway.

mikrotik_add_blackhole_route

Adds a blackhole route for a destination.

mikrotik_get_route_statistics

Gets statistics about the routing table.

mikrotik_set_dns_servers

Configures DNS servers and related options.

mikrotik_get_dns_settings

Retrieves current DNS settings.

mikrotik_add_dns_static

Adds a static DNS entry with optional CNAME/MX/TXT/SRV records.

mikrotik_list_dns_static

Lists static DNS entries with filters.

mikrotik_get_dns_static

Gets details for a specific static DNS entry.

mikrotik_update_dns_static

Updates a DNS static entry.

mikrotik_remove_dns_static

Removes a static DNS entry.

mikrotik_enable_dns_static

Enables a static DNS entry.

mikrotik_disable_dns_static

Disables a static DNS entry.

mikrotik_get_dns_cache

Gets the DNS cache.

mikrotik_flush_dns_cache

Flushes the DNS cache.

mikrotik_get_dns_cache_statistics

Gets DNS cache statistics.

mikrotik_add_dns_regexp

Adds a DNS regexp entry for pattern matching.

mikrotik_test_dns_query

Tests a DNS query against a server.

mikrotik_export_dns_config

Exports DNS configuration to a file.

mikrotik_add_user

Adds a new user with password and optional group/address constraints.

mikrotik_list_users

Lists users with optional filters.

mikrotik_get_user

Gets details for a specific user.

mikrotik_update_user

Updates user credentials and attributes.

mikrotik_remove_user

Removes a user.

mikrotik_disable_user

Disables a user account.

mikrotik_enable_user

Enables a user account.

mikrotik_add_user_group

Adds a new user group with policy and optional skins.

mikrotik_list_user_groups

Lists user groups.

mikrotik_get_user_group

Gets details for a specific user group.

mikrotik_update_user_group

Updates a user group permissions/skin.

mikrotik_remove_user_group

Removes a user group.

mikrotik_get_active_users

Retrieves currently active users.

mikrotik_disconnect_user

Disconnects a user session by ID.

mikrotik_export_user_config

Exports the user configuration to a file.

mikrotik_set_user_ssh_keys

Associates SSH keys with a user.

mikrotik_list_user_ssh_keys

Lists SSH keys for a user.

mikrotik_remove_user_ssh_key

Removes an SSH key by ID.