MikroTik RouterOS over the binary API, addressing rules by real .id not list position.
Connect Runs on your machine
claude mcp add mikrotik-mcp -e MIKROTIK_HOST=<MIKROTIK_HOST> -e MIKROTIK_USERNAME=<MIKROTIK_USERNAME> -e MIKROTIK_PASSWORD=<MIKROTIK_PASSWORD> -e MIKROTIK_PORT=<MIKROTIK_PORT> -e MIKROTIK_TLS=<MIKROTIK_TLS> -e MIKROTIK_TLS_FINGERPRINT=<MIKROTIK_TLS_FINGERPRINT> -e MIKROTIK_TIMEOUT=<MIKROTIK_TIMEOUT> -- uvx mikrotik-mcp==0.3.1{
"mcpServers": {
"mikrotik-mcp": {
"command": "uvx",
"args": [
"mikrotik-mcp==0.3.1"
],
"env": {
"MIKROTIK_HOST": "<MIKROTIK_HOST>",
"MIKROTIK_USERNAME": "<MIKROTIK_USERNAME>",
"MIKROTIK_PASSWORD": "<MIKROTIK_PASSWORD>",
"MIKROTIK_PORT": "<MIKROTIK_PORT>",
"MIKROTIK_TLS": "<MIKROTIK_TLS>",
"MIKROTIK_TLS_FINGERPRINT": "<MIKROTIK_TLS_FINGERPRINT>",
"MIKROTIK_TIMEOUT": "<MIKROTIK_TIMEOUT>"
}
}
}
}{
"mcpServers": {
"mikrotik-mcp": {
"command": "uvx",
"args": [
"mikrotik-mcp==0.3.1"
],
"env": {
"MIKROTIK_HOST": "<MIKROTIK_HOST>",
"MIKROTIK_USERNAME": "<MIKROTIK_USERNAME>",
"MIKROTIK_PASSWORD": "<MIKROTIK_PASSWORD>",
"MIKROTIK_PORT": "<MIKROTIK_PORT>",
"MIKROTIK_TLS": "<MIKROTIK_TLS>",
"MIKROTIK_TLS_FINGERPRINT": "<MIKROTIK_TLS_FINGERPRINT>",
"MIKROTIK_TIMEOUT": "<MIKROTIK_TIMEOUT>"
}
}
}
}{
"servers": {
"mikrotik-mcp": {
"type": "stdio",
"command": "uvx",
"args": [
"mikrotik-mcp==0.3.1"
],
"env": {
"MIKROTIK_HOST": "<MIKROTIK_HOST>",
"MIKROTIK_USERNAME": "<MIKROTIK_USERNAME>",
"MIKROTIK_PASSWORD": "<MIKROTIK_PASSWORD>",
"MIKROTIK_PORT": "<MIKROTIK_PORT>",
"MIKROTIK_TLS": "<MIKROTIK_TLS>",
"MIKROTIK_TLS_FINGERPRINT": "<MIKROTIK_TLS_FINGERPRINT>",
"MIKROTIK_TIMEOUT": "<MIKROTIK_TIMEOUT>"
}
}
}
}Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.
Tools
This server runs locally, so its tools are listed by your MCP client once it starts.
Environment variables
| Name | Description |
|---|---|
MIKROTIK_HOSTRequired | IP address or hostname of the router, e.g. 192.168.88.1 |
MIKROTIK_USERNAMERequired | RouterOS user. Use a dedicated account rather than admin; its group must carry the `api` policy, and a group without it is rejected with the same error as a wrong password. |
MIKROTIK_PASSWORDRequired, secret | Password for that user. |
MIKROTIK_PORTOptional | API port: 8729 for api-ssl (default), 8728 for plaintext. |
MIKROTIK_TLSOptional | Use the TLS API. Defaults to true; turning it off sends the router password over the network in the clear. |
MIKROTIK_TLS_FINGERPRINTOptional | SHA-256 of the router certificate. MikroTik's API-SSL certificate is self-signed, so pinning this is what makes the connection authenticated rather than merely encrypted. |
MIKROTIK_TIMEOUTOptional | Connection timeout in seconds. Defaults to 10. |
Details
| Package | [email protected] (PYPI, stdio) |
| First published | 12 Nov 2026 |
| Last updated | 12 Nov 2026 |
| Registry name | io.github.StefanKnol/mikrotik-mcp |
More other servers See all
Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.