# MikroTik RouterOS API MCP Server

A Read-Only MCP server implementation for interacting with MikroTik routers using the RouterOS API.

## Features

- **Connection Management**: Connect and authenticate with MikroTik routers.
- **Resource Monitoring**: Dynamic access to interfaces, bridges, and routing tables via MCP resources.
- **Protocol Support**: Works with both plain TCP (8728) and secure SSL/TLS (8729).
- **Modern & Legacy Login**: Supports RouterOS versions prior to and after v6.43.

## Resources

This server exposes MikroTik entities as MCP resources for direct inspection:

- **Interfaces**: `mikrotik://interface/{name}`
  - Example: `mikrotik://interface/ether1`
- **Bridges**: `mikrotik://bridge/{name}`
  - Example: `mikrotik://bridge/bridge1`
- **Bridge Ports**: `mikrotik://bridge/{bridge_name}/{interface_name}`
  - Example: `mikrotik://bridge/bridge1/ether2`
- **IP Routes**: `mikrotik://route/{id}`
  - Example: `mikrotik://route/400AF317` (Note: internal IDs are used for routing entries)

## Tools

1. `mk-connect`: Connects to a router.
   - `host`: IP address of the router.
   - `user`: Username.
   - `password`: Password.
   - `secure`: (Optional) Use SSL/TLS. Default is `false`.

Example:
 mk-connect 192.168.88.1 admin mypassword

2. `mk-report`: Generates a comprehensive system report.
   - Aggregates system resources, health, routerboard info, and interface traffic statistics (using `monitor-traffic` once).

3. `mk-get`: Returns a JSON array with the result of a MikroTik API `/print` command.
   - `sentence`: The API path (e.g., `/ip/route`, `/interface`, `/log`).
   - The server automatically ensures the path starts with `/` and ends with `/print`.

4. `mk-awr`: Generates an Automatic Workload Repository (AWR) style report for MikroTik.
   - Includes performance metrics, security audit, and recommendations.
   - No input required.

## Prompts

The server provides several pre-defined prompts for common tasks:

- **mk-connect: Connect to MikroTik**: Helps you establish a connection to your router.
- **mk-report: System Report**: Requests a full system status and traffic report.
- **mk-get-route: Routing Table**: Specifically asks for the current IP routing table.
- **mk-get-interface: List Interfaces**: Specifically asks for all configured interfaces.
- **mk-get-log: View Logs**: Requests the latest system log entries.
- **mk-awr: Security Audit**: Initiates a full performance and security audit of the router.

### Configuration

The MikroTik server can use environment variables or the `mk-connect` tool for secure credential management:

- **`MK_USER`**: MikroTik username (required if providing host at startup)
- **`MK_PASSWORD`**: MikroTik password (required if providing host at startup)

### Startup Arguments

You can optionally provide the host and security setting as command-line arguments:
1. `host`: (Optional) IP address of the router.
2. `secure`: (Optional) Use SSL/TLS. Default is `false`.

If these are provided, the server will attempt to connect automatically on startup using `MK_USER` and `MK_PASSWORD`.

### Local Build

```bash
cd src/mikrotik
npm install
npm run build
```

### Usage with Claude Desktop

Add this to your `claude_desktop_config.json`:

```json
{
  "mcpServers": {
    "mikrotik": {
      "command": "npx",
      "args": [
        "-y",
        "@marcelo-ochoa/server-mikrotik",
        "192.168.88.1"
      ],
      "env": {
        "MK_USER": "ai_agent",
        "MK_PASSWORD": "ai_password"
      }
    }
  }
}
```

Sample using Docker:

```json
{
  "mcpServers": {
    "mikrotik": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "MK_USER=admin",
        "-e",
        "MK_PASSWORD=password",
        "mochoa/mcp-mikrotik",
        "192.168.88.1",
        "false"
      ]
    }
}
```

Note: Arguments and environment variables are optional. You can connect later using `mk-connect`.

## Demos

Using the information of `mk-get`:
   - interface
   - ip/address
   - ip/route
   - ip/route/rules
   - ip/firewall[address-list,filter,nat,mangle]
find potential security risk and no-used entities

See [Demos](https://github.com/marcelo-ochoa/servers/blob/main/src/mikrotik/Demos.md) for usage examples with Claude Desktop, Gemini CLI, and Antigravity Code Editor.

### MikroTik AWR in action

See [MikroTik AWR in action](https://github.com/marcelo-ochoa/servers/blob/main/src/mikrotik/AWR_example.md) for an example of an Automatic Workload Repository (AWR) style report generated by the `mk-awr` tool for a MikroTik router, highlighting performance metrics and security risks.

## Docker

Building the container:

```bash
docker build -t mochoa/mcp-mikrotik -f src/mikrotik/Dockerfile .
```

Running the container:

```bash
docker run -i --rm -e MK_USER=admin -e MK_PASSWORD=mypassword mochoa/mcp-mikrotik 192.168.88.1
```

## Change Log

See [Change Log](https://github.com/marcelo-ochoa/servers/blob/main/src/mikrotik/CHANGELOG.md) for the history of changes.

## Sources

As usual, the code of this extension is at [GitHub](https://github.com/marcelo-ochoa/servers), feel free to suggest changes and make contributions.

## 📜 License

This project is licensed under the Apache License, Version 2.0 for new contributions, with existing code under MIT - see the [LICENSE](https://github.com/marcelo-ochoa/servers/blob/main/src/mikrotik/LICENSE) file for details.