API reference

Lists the devices this server manages — title, host, port, username, tags, and region. Credentials are never returned. Use it to discover the fleet before targeting a device.

The inventory is YAML, from one of two sources — MIKROTIK_INVENTORY_FILE (path to a YAML file, recommended) or MIKROTIK_INVENTORY (the inventory written inline; YAML flow syntax needs no escaped quotes, and plain JSON works too since it's a YAML subset). When both are set, the inline value wins. A broken inventory (missing file, bad YAML, invalid entry) stops the server at startup with one clear message. A ready-to-copy template ships at the repository root as inventory.example.yml.

Every device-scoped tool takes an optional device argument. One device configured — omit it; that device is used automatically. More than one — pass the title. Omitting it, or passing an unknown title, returns an error that lists the valid titles, so an AI caller corrects itself on the next call instead of quietly running the command on the wrong router.

Lists all interfaces, with optional filtering by type, name, or running/disabled state.

Returns detailed information about a single interface by exact name.

Bring an interface up or take it down without removing it.

Reads real-time PoE-out telemetry — status, voltage, current, and power — for one or more ethernet interfaces. Runs /interface ethernet poe monitor … once.

Lists the PoE-out configuration (PoE-out mode, priority) of PoE-capable ethernet interfaces. Runs /interface ethernet poe print.

Gets the detailed PoE-out settings of a specific ethernet interface — mode, priority, voltage, and low/high thresholds. Runs /interface ethernet poe print detail where name=….

Creates a VLAN interface on a parent port.

Lists VLAN interfaces, optionally filtered.

Returns full details for a specific VLAN interface.

Updates an existing VLAN interface in place. Pass only the fields you want to change.

Removes a VLAN interface. Dependent IP addresses, DHCP servers, and firewall rules that reference the interface will be orphaned — clean them up first.

Bind an address to an interface.

Inspect bindings — list takes optional filters (by interface, address, network, dynamic flag, or disabled-only); get returns one address record by ID.

Adds an IPv6 address to an interface. Runs /ipv6 address add ….

Lists IPv6 addresses, with optional filtering. Runs /ipv6 address print.

Gets details for a single IPv6 address, by RouterOS id or by address value. Runs /ipv6 address print detail where ….

Removes an IPv6 address by id or address value. Runs /ipv6 address remove [find …].

Inspect pool definitions, fetch a single pool by name, plus the live used-address table (which addresses are currently leased from a pool). list_ip_pools accepts name_filter / ranges_filter / include_used; list_ip_pool_used filters by pool_name, address_filter, mac_filter, and info_filter.

update edits a pool's name (rename via new_name), ranges, or next-pool chain; expand appends additional ranges without disrupting existing leases.

Remove a pool. Servers using it will refuse new leases.

Build a DHCP service for a subnet in three steps. create_dhcp_server takes name + interface (plus optional lease_time defaulting to "1d", address_pool, authoritative, …).

List all DHCP servers or fetch one by name.

Removes a DHCP server. The underlying pool and network records survive.

Configure upstream resolvers, add static records, and define regex-based blocklists. set_dns_servers also accepts allow_remote_requests, cache tuning (cache_size, cache_max_ttl, max_udp_packet_size, max_concurrent_queries), and DoH options (use_doh, doh_server, verify_doh_cert). add_dns_static takes the record-type fields cname, mx_preference/mx_exchange, text, srv_priority/weight/port/target, plus ttl and regexp.

Inspect resolver settings, list or fetch static records, dump the cache and its statistics, and run a live test query.

Edit a static record, enable/disable it without deleting, clear the resolver cache, or dump the full DNS configuration to a file.

Three flavors of route creation. add_route takes dst_address + gateway (plus optional distance, scope, routing_mark, pref_src, check_gateway, …).

Inspect the routing table from several angles: list all, single route, traceroute-style path check, full table dump (table_name defaults to "main"), the kernel route cache, and aggregate statistics.

Edit a route in place, toggle individual routes by ID, or flush the route cache.

Creates a new firewall filter rule. Most match parameters are optional — combine them to build whatever predicate you need.

List rules with optional filters (chain, action, addresses, protocol, interface, disabled/invalid/dynamic), or fetch a single rule by ID.

Edit a rule in place, reorder it within its chain (critical for ordered evaluation), or toggle it on/off without removing it.

Creates a sensible baseline: accept established/related, drop invalid, accept ICMP, drop everything else on input. Useful for fresh routers.

Creates a NAT rule on the srcnat or dstnat chain.

Inspect NAT rules — optionally filtered by chain. get returns one rule's full record.

Same edit / reorder / toggle surface as the firewall counterparts.

Stands up a WireGuard interface. If no private key is supplied, one is generated; read the matching public key back via get_wireguard_interface.

List all WireGuard interfaces or fetch one — the latter includes the device's public key for clients to use.

Edit, toggle, or remove an interface. Removing an interface also deletes all of its peers.

Attaches a peer to an interface.

Inspect peers and their handshake state.

Edit, toggle, or remove peers. Identifiers are RouterOS peer IDs.

Produces a complete client .conf (the [Interface] / [Peer] blocks) ready to paste into a WireGuard client. This tool only formats text locally — it does not contact the router, so first use get_wireguard_interface for the server's public key and add_wireguard_peer to register the client.

The single-purpose tools above compose into a full VPN server. Run them in order — steps 2–4 reach into other categories (IP address, firewall, NAT):

Creates / configures a wireless interface (SSID, band, channel, mode, and an attached security profile).

List wireless interfaces or fetch one's full configuration.

Edit, toggle, or remove a wireless interface.

Full lifecycle for security profiles — WPA/WPA2/WPA3 modes, passphrases, encryption. set attaches a profile to an interface.

Scan for nearby networks (optional duration) and list currently-associated clients with signal data.

MAC-based allow/deny entries with optional signal-range and time constraints.

Reports whether the device's RouterOS build supports the wireless tooling. Call this first.

Per-target rate limits — the simplest way to throttle a host or subnet. max_limit takes an upload/download pair like "10M/20M".

Hierarchical HTB shaping. Attach to a parent, match traffic by packet_mark, set max_limit / limit_at / burst, and priority (1–8).

Define reusable queue disciplines. kind (default cake) is one of cake, fq-codel, sfq, red, pcq, pfifo, bfifo, … each with its own tuning parameters (e.g. cake_flowmode/cake_nat/cake_overhead for CAKE, pcq_rate/pcq_classifier for PCQ, sfq_perturb for SFQ, red_* thresholds for RED). Built-in types (default, default-small, …) can't be modified or removed.

Create users and permission groups. Groups take a policy list (e.g. read,write,ssh).

Inspect users, groups, and currently-connected sessions.

Edit users / groups, toggle accounts, or forcibly disconnect an active session.

Import a user's SSH public key (key-based auth), list installed keys, or remove one by ID.

Dumps the full user / group configuration to a file.

Remove a user or a group.

Three formats: a binary .backup (full snapshot), a .rsc export (declarative, choose rsc/json/xml and full/compact/verbose), or a single-section dump.

List backup files, inspect a backup's metadata, and download files off the device. download_file pulls the raw bytes over SFTP and returns them base64-encoded, so binary .backup files survive the round-trip intact alongside text .rsc exports.

Restore a binary backup (pass password for an encrypted backup), import a .rsc config, or upload an arbitrary file to the device — upload_file takes base64 content and writes the decoded bytes over SFTP.

Removes any file from the device's filesystem.

Seven lenses on the log buffer — by topic, by severity (debug/info/warning/error/critical), free-text search, system events, the security topic, or aggregate stats.

Live-tail logs for a duration, or dump them to plain / csv.

Clears the in-memory log buffer. Doesn't affect file-backed logs.

Starts a safe-mode session; afterwards every tool call runs inside the one persistent shell until you commit or roll back. Returns an Error: … string if the SSH connection fails or the router doesn't confirm the <SAFE> prompt.

Persist the journaled changes, or revert them immediately. Both are no-ops when safe mode isn't active — they return "Safe mode is not active. Nothing to commit / roll back."

Reports whether a safe-mode session is currently active — e.g. "Safe mode is ACTIVE. Changes are pending — NOT yet persisted…" versus "Safe mode is NOT active…".