Summary

The point is the safety layer, not the tool count: dry-run, rollback, RBAC and audit sit between the model and production network gear.

RouterOS already has a REST API; what this adds is that every write is schema-validated and idempotent, can be previewed before it lands, and leaves an audit trail — which is the difference between an agent that can help on an edge router and one you would never point at production. Coverage is wide enough to diagnose without leaving the conversation: torch and traceroute run on the device, and the firewall, routing and VPN state are all readable in the same session.

What it is

A RouterOS server that wraps the REST API in schema-validated tools: reads for every major subsystem, and writes that can be previewed before they take effect.

What you get

The basics an operator reaches for first — system status and clock, interfaces, IP addresses, routes, DHCP leases and firewall rules, each with a listing and a managing counterpart
Live diagnostics from the router itself: ping, traceroute, packet torch and the log
Layer 2 and wireless: bridges and bridge ports, Wi-Fi interfaces and their connected clients
VPN both ways — WireGuard interfaces and peers, IPsec peers and policies — plus certificates
DNS entries and settings, address lists, mangle rules, routing rules and tables, and BGP peers and OSPF neighbours read back
DHCP servers, IP pools and queues for the addressing and shaping side
Automation on the device: scripts listed, managed and run, and scheduled jobs
Housekeeping — packages, files listed, read, uploaded and deleted, containers, users and user groups
A raw command tool for the surfaces the typed ones do not cover, and a reboot
Safety built into the write path: strict schemas, idempotent writes, dry-run previews, per-router circuit breakers and retries, RBAC identities, audit logging, and snapshots with rollback-aware change workflows
Structured JSON alongside the human-readable answer, and an instructions string advertised at initialize so clients configure themselves

Requirements

A MikroTik router on RouterOS 7.x with the REST API enabled and a user for the server to authenticate as. Node.js 22 or newer; published on npm as mikromcp. Credentials live in ~/.mikromcp/.env, and MIKROMCP_DEFAULT_ROUTER lets single-router setups omit the router id on every call. The project's own guidance is to run it like an operations system: least-privilege RouterOS users, verified TLS or pinned fingerprints, and scoped RBAC identities where it is shared.

Setup effort

One command plus a key — npm install -g mikromcp, then supply credentials

MikroMCP