asuswrt_admin_access
Inspect web, SSH, and telnet administrative access settings.
LABSCO SUMMARY
Reading clients, DHCP leases and ARP neighbours as three separate tools is the tell — whoever built this knows those three lists disagreeing is the actual diagnostic.
A router's client list, its DHCP leases and its ARP table describe the same network and routinely differ: a device with a lease that is not responding, a neighbour with no lease, a client the UI shows that the kernel does not. Collapsing them into one 'devices' tool would lose exactly the signal someone is looking for at two in the morning. The same instinct shows in the SSH diagnostic splitting reachability from banner from authentication, and in a capabilities tool that states its own guardrails up front. Changes are fenced off: the mutation tools refuse to run unless ASUSWRT_ALLOW_MUTATIONS=true is set and the call passes confirm: true, and dry_run: true previews a change first — which for a home router reached by an agent is the right side of the line to be on.
What it is
An ASUSWRT diagnostic client that reaches the router over SSH and reports what it finds, across identity and health, network and addressing, wireless, administrative access, storage, and process and kernel state.
What you get
- asuswrt_capabilities returns the server's own guardrails and safe settings, so what it will and will not do is knowable before anything else is called.
- asuswrt_ssh_diagnostics separates TCP reachability, banner exchange and authentication — three different failures that otherwise present as one.
- The network picture in layers: LAN addressing and DHCP presence, WAN protocol with gateway and DNS, IPv6 prefix and router address, DHCP pool and static reservations, and NVRAM-reported DNS settings.
- Who is actually on it — connected clients, active dnsmasq leases and ARP neighbours read separately, because they disagree in useful ways.
- Security-relevant surface: web admin ports and processes, web, SSH and telnet access settings, listening TCP and UDP sockets, loaded kernel modules and scheduled cron jobs.
- Wireless radios with SSIDs and per-band connection counts, plus guest networks with their LAN-access state.
- Capacity and storage: per-interface RX and TX counters from the kernel, conntrack table usage against its limit, filesystem usage, mounts and partitions.
Requirements
SSH access to the router, with SSH enabled on it. The monitoring tools only read; the mutation tools stay off unless ASUSWRT_ALLOW_MUTATIONS=true is set.
Setup effort
One command plus credentials — uvx asuswrt-mcp, then supply credentials
USE CASES
01
Working out why a device cannot get on the network
Compare the router's client list against the active DHCP leases and the ARP neighbours — the three disagreeing is usually the answer.
02
Checking what is exposed
Read the administrative access settings for web, SSH and telnet, the web admin ports, and every listening socket the router reports.
03
Diagnosing a connection that is up but wrong
Inspect the WAN protocol, gateway and DNS, the DNS settings NVRAM actually holds, and the IPv6 service state.
04
Finding out whether the router itself is the bottleneck
Read uptime, load and memory, the conntrack table against its limit, and per-interface RX and TX counters straight from the kernel.
05
Auditing the wireless side
Inspect the radios with their SSIDs and per-band client counts, and check which guest networks exist and whether they can reach the LAN.
06
Finding something that should not be running
List the scheduled cron jobs, the loaded kernel modules and the allowlisted processes, alongside the storage and mounts they might be using.
47 tools
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
asuswrt_arp_neighbors
List ARP/IP neighbor entries known by the router.
asuswrt_capabilities
Return server capabilities, guardrails, and safe settings.
asuswrt_clients
List connected clients reported by the router.
asuswrt_config_snapshot
Fetch a redacted read-only configuration snapshot.
asuswrt_conntrack_status
Inspect conntrack table usage and limits.
asuswrt_cron_jobs
Inspect scheduled cron jobs reported by cru.
asuswrt_ddns_status
Inspect Dynamic DNS enablement and current provider settings.
asuswrt_dhcp_config
Inspect DHCP server pool settings and static reservations.
asuswrt_dhcp_leases
List active DHCP leases from dnsmasq.
asuswrt_dhcp_reservation
List, add, or remove DHCP static reservations via SSH NVRAM.
asuswrt_dhcp_server
Enable or disable the DHCP server.
asuswrt_dns_config
Inspect WAN and LAN DNS settings reported by NVRAM.
asuswrt_guest_lan_access
Toggle LAN access for a guest Wi-Fi slot.
asuswrt_guest_networks
List guest Wi-Fi networks and LAN-access state.
asuswrt_guest_wifi
Enable or disable a guest Wi-Fi slot.
asuswrt_health
Fetch router identity and basic health data.
asuswrt_identity
Fetch router model and firmware identity.
asuswrt_interface_stats
Inspect per-interface RX/TX counters from /proc/net/dev.
asuswrt_ipv6_status
Inspect IPv6 service, prefix, and router address details.
asuswrt_kernel_modules
Inspect loaded kernel modules reported by lsmod.
asuswrt_lan_details
Inspect LAN interface, addressing, and DHCP presence.
asuswrt_mounts
Inspect mounted filesystems and mount options.
asuswrt_network_overview
Fetch LAN, WAN, and routing overview details.
asuswrt_open_ports
Inspect listening TCP/UDP sockets reported by netstat.
asuswrt_parental_access
List or manage AsusWRT parental access rules.
asuswrt_parental_block_all
Toggle parental-control block-all mode.
asuswrt_partitions
Inspect block-device partitions reported by the router kernel.
asuswrt_policy_routing
Inspect policy-routing rules reported by ip rule.
asuswrt_port_forwarding
List, enable/disable, add, or remove port forwarding rules.
asuswrt_radio
Enable or disable a main Wi-Fi radio band.
asuswrt_restart_service
Restart an allowlisted AsusWRT service.
asuswrt_route_table
Inspect the router IPv4 route table.
asuswrt_samba_status
Inspect Samba/SMB status and related processes.
asuswrt_service_processes
List key allowlisted router processes and services.
asuswrt_ssh_diagnostics
Diagnose SSH TCP reachability, banner exchange, and authentication.
asuswrt_storage_usage
Inspect storage/filesystem usage reported by the router.
asuswrt_system_stats
Fetch router uptime, load, and memory statistics.
asuswrt_time_sync
Inspect timezone and NTP synchronization settings.
asuswrt_upnp
Enable or disable UPnP.
asuswrt_upnp_status
Inspect UPnP enablement and housekeeping settings.
asuswrt_usb_overview
Inspect USB/storage-related partitions, mounts, and filesystems.
asuswrt_vpn_overview
Inspect configured VPN modes and related processes.
asuswrt_vpn_server
Enable or disable the OpenVPN server toggle.
asuswrt_wan_details
Inspect WAN protocol, IP, gateway, DNS, and interface details.
asuswrt_web_admin
Inspect web admin ports and related web processes.
asuswrt_wireless_overview
Inspect wireless radios, SSIDs, and connected band counts.
BEFORE YOU INSTALL
What to know first
Tools you get
47 tools when we connected. Eleven mutation tools refuse unless ASUSWRT_ALLOW_MUTATIONS=true is set and the call passes confirm: true, so a default install has 36 working tools; dry_run: true previews changes.
Requires
- uvx on PATH
- Python 3.11+
- ASUSWRT_HOST in your environment
- ASUSWRT_SSH_USERNAME in your environment
- ASUSWRT_SSH_PASSWORD in your environment
Where it runs
Both documented clients run the server on your machine.
CONTEXT COST
Light Standing cost
Rated by the size of the 47 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
Connect your client
Server setup
TERMINAL
uvx asuswrt-mcpMCP Clients
Claude Desktop, Cursor
JSON
{
"mcpServers": {
"asuswrt-mcp": {
"command": "uvx",
"args": [
"asuswrt-mcp"
],
"env": {
"ASUSWRT_HOST": "192.168.1.1",
"ASUSWRT_SSH_USERNAME": "admin",
"ASUSWRT_SSH_PASSWORD": "<YOUR_ASUSWRT_SSH_PASSWORD>"
}
}
}
}
