AliKarami/MikroMCP

> **AI-native network automation for MikroTik RouterOS and SwOS.** MikroMCP exposes RouterOS routers and SwOS switches as a typed, auditable Model Context Protocol server so Claude, Cursor, Codex, and other MCP clients can inspect, diagnose, and safely operate MikroTik gear in natural language.
MikroMCP exists because raw router CLI access is the wrong abstraction for AI agents. RouterOS is powerful, but asking an LLM to improvise shell commands against production network gear is risky. MikroMCP gives agents a controlled tool surface: strict schemas, idempotent writes, dry-run previews, per-router circuit breakers, retry policies, RBAC, audit logs, snapshots, and rollback-aware change workflows.
**In one sentence:** MikroMCP turns MikroTik RouterOS into a production-minded MCP control plane for AI infrastructure, DevOps automation, and modern router management.
---
Quick Start
That's the whole setup for a single-router stdio deployment. For standalone binaries, Docker, HTTP/SSE mode, the RouterOS API prerequisites, and the full 15-minute walkthrough, see the **Getting Started guide**.
---
Feature Showcase
| Category | What MikroMCP covers |
| -------------------------- | ----------------------------------------------------------------------------------------------------- |
| 🧭 **Router management** | System status, clock, reboot, packages, files, scripts, scheduler jobs, containers |
| 🌐 **Network operations** | Interfaces, VLANs, IP addresses, DHCP leases, DNS static records, bridge ports, WiFi clients |
| 🔥 **Firewall and policy** | Filter/NAT rules, mangle rules, address lists, route tables, routing rules |
| 🛰️ **Routing visibility** | Static routes, routing tables, BGP peers, OSPF neighbors |
| 🔀 **SwOS switches** | *Experimental.* MikroTik SwOS and SwOS Lite switches (deviceType: "swos") over the reverse-engineered .b HTTP API: port links, PoE, SFP diagnostics, guarded whole-blob writes with a firmware-compatibility check, the whole switch config as one YAML document (export, dry-run, apply), backups and firmware upgrades |
| 🔐 **Secure access** | HTTP bearer auth, bcrypt token hashes, RBAC, router/tool restrictions, confirmation tokens |
| 🧪 **Diagnostics** | Router-originated ping, traceroute, torch, log filtering, guarded SSH command execution |
| 🛡️ **Change safety** | Dry-run, idempotent writes, snapshots, write journal, plan_changes, apply_plan, rollback_change |
| ⚙️ **Production behavior** | Retries for read tools, per-router circuit breakers, correlation IDs, structured logs, audit logs |
| 🤖 **AI-agent fit** | Human-readable responses plus structured JSON content for reasoning, chaining, and automation; server advertises an instructions string on MCP initialize so clients self-configure; optional routerId resolved via MIKROMCP_DEFAULT_ROUTER for single-router setups; usage skill for safe, guided tool use in Claude Code |
| 🧩 **MCP compatibility** | stdio for desktop clients, Streamable HTTP and legacy SSE for remote or service-style clients |
**132 typed tools** in total — browse the full catalog with parameters, defaults, and copy-paste example prompts in **Available Tools**.
---
Demo
Usage
Review by Claude
---
Real-World Usage Examples
Router Inspection
Firewall Management
Safe Static Route Change
WireGuard Operations
Interface Diagnostics
Plan / Apply / Rollback Workflow
---
Why MikroMCP Is Useful For AI Agents
MCP gives LLMs a standard way to call tools. MikroMCP makes RouterOS a high-quality MCP target by turning network operations into well-described, machine-readable, permission-aware actions.
AI assistants can use MikroMCP to:
- Investigate router state without memorizing RouterOS command syntax.