Open-source MCP server · RouterOS-native New routeros-lsp·routeros-skills

Talk to your
RouterOS routers
in plain English.

MikroTik MCP is the bridge between your AI assistant and your RouterOS fleet — let Claude, ChatGPT, or any MCP-capable client manage VLANs, IPv4 and IPv6 firewall rules, DHCP, NAT, WireGuard, and 17 other categories from a single prompt — on one router or across a whole fleet. No web UI clicks. No Winbox tabs.

Read the docs → wiresage/mikrotik-mcp Join the Discord

22 tool categories

196 RouterOS tools

3 transports (stdio · SSE · HTTP)

MIT licensed

claude · mikrotik-mcp-server

You

Spin up a Guest VLAN on ether1 (id 200), give it 192.168.200.1/24, a DHCP pool from .10 to .100, and masquerade out to WAN.

Claude

On it. Running four tools in order:

mikrotik_create_vlan_interface(name="vlan200", vlan_id=200, interface="ether1")

✓ vlan200 created on ether1 · tag 200

mikrotik_add_ip_address(address="192.168.200.1/24", interface="vlan200")

✓ 192.168.200.1/24 bound to vlan200

mikrotik_create_dhcp_pool(name="pool-200", ranges="192.168.200.10-192.168.200.100")

✓ Pool "pool-200" · 91 addresses

mikrotik_create_nat_rule(chain="srcnat", action="masquerade", out_interface="ether1")

✓ NAT rule added at index 0

Guest VLAN is live. Want me to set a rate limit?

01 — What it is

The connective tissue between LLMs and RouterOS.

MikroTik MCP is a Model Context Protocol server. It exposes your RouterOS device's configuration surface as typed tools — your AI client picks the right one, fills in the parameters, and runs it over SSH. You stay in the loop; the model just handles the syntax.

// 01

Natural language → typed tools

Every RouterOS noun has a verb. "Make a VLAN" maps onto mikrotik_create_vlan_interface with strict, validated arguments. No hallucinated CLI.

// 02

Three transports, one server

Run it over stdio for desktop AI clients, expose it as SSE for streaming agents, or wrap it in HTTP for REST consumers via mcpo.

// 03

Safe-mode aware

Wrap risky operations in RouterOS safe-mode sessions. If a change locks you out, the device rolls everything back automatically — no manual recovery.

02 — Capabilities

22 categories. Roughly everything you'd touch in Winbox.

Each category exposes typed tools — create, list, get, update, remove, plus category-specific verbs like move_filter_rule or flush_dns_cache. Click any to jump to its reference.

5 tools

VLAN

Create, list, get, update, and remove tagged interfaces on any parent port. IDs 1–4094.

9 tools

Firewall

Filter rules across input, forward, output chains. Move, enable, disable, plus a basic-setup helper.

8 tools

IPv6 Firewall

Filter rules under /ipv6 firewall — icmpv6, hop-limit, extension headers, address types.

2 tools

Neighbors

ARP and IPv6 Neighbor Discovery tables — see what's on the segment and which port it's on.

7 tools

Address Lists

Named IPv4 + IPv6 address sets for firewall rules — one tool set, a family argument.

8 tools

NAT

srcnat / dstnat / masquerade. Port forwards, redirects, move, enable, disable.

10 tools

DHCP

Servers, networks, pools, plus live lease and DHCPv6 binding views.

15 tools

DNS

Static records, regexp blocklists, cache + statistics, query testing.

14 tools

Routes

Static, default, blackhole. Active filters, table + cache inspection, path checks.

15 tools

WireGuard

Interfaces, peers, key management, client-config generation, allowed-IPs.

18 tools

Users

Local accounts, groups, policies, active sessions, SSH keys, exports.

10 tools

Backup & Export

Binary backups, .rsc configuration exports, section dumps, file transfer, restore.

10 tools

Logs

Stream, filter by topic or severity, search, statistics, export, live monitor.

7 tools

IP Pool

Named pools, range expansion, used-address inspection.

4 tools

Safe Mode

Status, enable, commit, rollback sessions. Auto-revert on connection loss.

19 tools

Queues

Simple queues, queue trees, queue types. Rate limit per VLAN, per client.

4 tools

IP Address

Bind, list, get, remove. Comments, network filters, dynamic detection.

4 tools

IPv6 Address

IPv6 bindings under /ipv6 — advertise, EUI-64, prefix delegation, global vs link-local.

18 tools

Wireless

Interfaces, security profiles, access lists, network scan, registration table.

4 tools

Interfaces

List, get, enable, disable any interface — physical or virtual.

fleet

Inventory

One server, many routers — a YAML fleet inventory with per-device targeting via device.

3 tools

PoE

Power-over-Ethernet monitoring — live PoE-out voltage, current, power, and per-port settings.

03 — How it works

From English to `/ip vlan add` in three hops.

The MCP server advertises typed tools to your AI client. The client picks the right one based on context, fills the parameters, and posts back. The server validates, translates to RouterOS CLI, and runs it over SSH against your device.

Client discovers tools. On startup the AI client queries the server for available tool schemas and descriptions.

Model selects + fills. Given your prompt, it picks the right tool and constructs validated arguments.

Server executes. The tool handler builds the RouterOS command, runs it over SSH, and returns structured output.

Model summarizes. The result feeds back to the model, which explains the outcome in plain English.

04 — Install

Up in about a minute.

Pick a transport, paste a config, point it at your router. The Docker route is the shortest — no Python toolchain required.

# Build & run the container

# Clone & build
$ git clone https://github.com/wiresage/mikrotik-mcp.git
$ cd mikrotik-mcp
$ docker build -t mikrotik-mcp .

# Run with stdio (IDE integration)
$ docker run --rm -i \
    -e MIKROTIK_HOST=192.168.88.1 \
    -e MIKROTIK_USERNAME=sshuser \
    -e MIKROTIK_PASSWORD=your_password \
    -e MIKROTIK_PORT=22 \
    mikrotik-mcp

# Manual / Python install

$ git clone https://github.com/wiresage/mikrotik-mcp.git
$ cd mikrotik-mcp

# Create & activate venv
$ python -m venv .venv
$ source .venv/bin/activate

# Install + run
$ pip install -e .
$ mcp-server-mikrotik

# ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "mikrotik": {
      "command": "uvx",
      "args": [
        "mcp-server-mikrotik",
        "--host",     "<HOST>",
        "--username", "<USERNAME>",
        "--password", "<PASSWORD>",
        "--port",     "22"
      ]
    }
  }
}

# HTTP/SSE transport via Docker

$ docker run --rm -p 8000:8000 \
    -e MIKROTIK_HOST=192.168.88.1 \
    -e MIKROTIK_USERNAME=sshuser \
    -e MIKROTIK_PASSWORD=your_password \
    -e MIKROTIK_MCP__TRANSPORT=sse \
    mikrotik-mcp

# Server is up:
#   SSE:             http://localhost:8000/sse
#   Streamable HTTP: http://localhost:8000/mcp
#   Health probe:    GET /health

05 — Language server

Catch it in the editor, not on the router.

routeros-lsp is a Language Server Protocol server for RouterOS scripts (.rsc). Your editor — or your AI coding agent — gets immediate feedback while the script is being written: syntax errors, unknown menus, commands and parameters, and the variable-scope mistakes RouterOS only reveals at import time. A sibling of MikroTik MCP; it works on its own.

routeros-lsp · RouterOS 7.21.4

guest-vlan.rsc2 errors2 warnings

# Guest VLAN

:local vlanId 200

/interface vlan add name=vlan200 vlan-id=$vlanId interface=ether1

/ip adress add address=192.168.200.1/24 interface=vlan200

/ip pool add name=pool-200 ranges=192.168.200.10-192.168.200.100

/ip firewall nat add chain=srcnat action=masquerade # WAN

:set vlanId 201

Problems2 errors2 warnings

schema/unexpected-argumentdeviceLn 6, Col 53

This command takes no unnamed arguments, and a '#' only starts a comment at the beginning of a command, so RouterOS reads this as an argument. Put ';' before the comment. (RouterOS behaviour that the documentation does not describe)

Built to stay quiet when you're right. Checked against RouterOS 7.21.4 on 16,900 generated command lines, it never reported one the router accepts. It does miss some the router rejects — mostly the kinds it doesn't check, like parameter values. Method and limits →

Diagnostics

Syntax, variables, menus and commands: 36 rules, each with an id, a severity and a label for how well founded it is. Messages say what RouterOS will do and how to fix it.

Completion and hover

Menus, commands and parameters (required first), values after name=, variables in scope. Hover shows the description, type and values from the command database.

Outline and folding

Functions, :global and :local declarations and the menu headers of an export fill the outline; blocks, continued lines and comment runs fold.

Command line

routeros-lsp check runs the same analysis for CI, a pre-commit hook, or a script an agent just wrote. Exit status 1 when it finds errors.

Install

One command. No dependencies.

# Python 3.10+

$ pipx install routeros-lsp     # or: uv tool install routeros-lsp
$ routeros-lsp --version
$ routeros-lsp check scripts/     # exit 1 when there are errors

Language server docs →Diagnostic rules →wiresage/routeros-lsp ↗

MIT licensed · Claude Code plugin included · works with any LSP client over stdio

Better together

Check the script, then apply it.

Write

Your editor or AI agent drafts a .rsc script.

Check

routeros-lsp reports what the router would reject — no router needed.

Apply

MikroTik MCP uploads and imports it: mikrotik_upload_file, then mikrotik_import_configuration.

Independent tools — use either one on its own.

06 — Agent skills

Let your agent read the manual first.

routeros-skills is 34 agent skills for RouterOS 7: short, task-oriented instructions — what to do, what to avoid — each backed by MikroTik's official documentation as plain Markdown, so your agent looks up the exact command instead of guessing. They are plain SKILL.md folders that Claude Code, Codex, GitHub Copilot and any agent that reads them can use. Built to sit beside MikroTik MCP and routeros-lsp; each works on its own. Listed on skills.sh, where npx skills add wiresage/routeros-skills installs them.

Replay of a Claude Code session with routeros-skills installed: the 34 skills are listed, the routeros-firewall skill loads for a firewall question, and the answer begins. — **A real session, replayed.** Claude's Code tab with the skills installed in `.claude/skills`: it lists them, loads the one that fits the task and opens the reference files it needs. Drawn from the session transcript — not a screen recording — and the answer is shortened.

Always in context

The name and description of every skill — nothing more until a task matches.

name: routeros-firewall
description: Writing and reviewing the MikroTik RouterOS firewall. Covers the filter, NAT, mangle and raw tables … Use when adding, ordering, debugging or auditing firewall or NAT rules …

Read when a task matches

SKILL.md holds the instructions: order of steps, recipes, pitfalls.

## A safe input chain
Do not drop traffic until the accept rules for your own access exist, and put new rules before the catch-all drop with place-before …

Opened only for the detail

MikroTik's manual as plain Markdown: 373 guides, the full CLI reference and 246 hardware manuals. Every page links to its source.

references/INDEX.mdwhat is inside, one line per file

references/guides/…/firewall/nat.mdNAT, masquerade, CGNAT

references/cli/ip/firewall/every property of a table

What's covered

34 skills, seven areas.

Every name starts with routeros-. Start with fundamentals: it explains the console conventions and maps the rest. Pick a skill to see what it covers and how much of the manual sits behind it.

Start here4

Security and access5

Interfaces and IP services7

Routing, tunnels and redundancy7

Wireless, mobile and access networks4

Operations and automation3

Hardware, storage and apps4

Install

Plain folders. Installing is a copy.

# every skill · add names to pick some, --link to symlink

$ git clone https://github.com/wiresage/routeros-skills.git
$ cd routeros-skills
$ scripts/install-skills.sh --target ~/.claude/skills
$ scripts/install-skills.sh --list

Claude Code: ~/.claude/skills · .claude/skills
Codex: ~/.agents/skills · .agents/skills
GitHub Copilot: .github/skills

wiresage/routeros-skills ↗Browse the skills ↗routeros-skills on skills.sh ↗All skills by area →

MIT licensed · MikroTik documentation copies, snapshot of 2026-10-18 · agent folders change, so check your agent's docs

Better together

Know it, check it, apply it.

Skills

routeros-skills teaches the agent how RouterOS works, what to avoid and where to look it up.

LSP

routeros-lsp reports what the router would reject in the .rsc scripts it writes.

MCP

MikroTik MCP reads and changes the real router through typed tools.

Independent — use any one alone. The skills also work with no live access: they tell the agent which commands to propose and how to verify them.

Talk to your RouterOS routers in plain English.

The connective tissue between LLMs and RouterOS.

Natural language → typed tools

Three transports, one server

Safe-mode aware

22 categories. Roughly everything you'd touch in Winbox.

VLAN

Firewall

IPv6 Firewall

Neighbors

Address Lists

NAT

DHCP

DNS

Routes

WireGuard

Users

Backup & Export

Logs

IP Pool

Safe Mode

Queues

IP Address

IPv6 Address

Wireless

Interfaces

Inventory

PoE

From English to /ip vlan add in three hops.

Up in about a minute.

Catch it in the editor, not on the router.

Diagnostics

Completion and hover

Outline and folding

Command line

One command. No dependencies.

Check the script, then apply it.

Let your agent read the manual first.

Always in context

Read when a task matches

Opened only for the detail

34 skills, seven areas.

Plain folders. Installing is a copy.

Know it, check it, apply it.

Stop clicking through Winbox.Start describing what you want.

Talk to your
RouterOS routers
in plain English.

From English to `/ip vlan add` in three hops.

Stop clicking through Winbox.
Start describing what you want.