Mikrotik MCP

Adds an entry to an IPv4 or IPv6 firewall address list. Notes: address: an address or prefix; a hostname is also accepted and RouterOS adds a dynamic child entry per resolved address. timeout: RouterOS duration e.g. "1h". An entry with a timeout is dynamic, so it does not survive a reboot. list_name is matched exactly, including any leading or trailing spaces.

Creates a system backup on the MikroTik device.

Creates a basic firewall setup with common security rules on the MikroTik device.

Creates a DHCP network configuration (gateway, DNS, domain, etc.) on the MikroTik device.

Creates a DHCP address pool with the given IP ranges on the MikroTik device. Notes: ranges: hyphen-separated range(s) e.g. "192.168.1.1-192.168.1.100" Multiple ranges comma-separated: "10.0.0.1-10.0.0.50,10.0.0.100-10.0.0.120"

Creates a DHCP server bound to the specified interface on the MikroTik device. Notes: lease_time: duration e.g. "1d", "12h", "30m", "1h30m"

Creates a configuration export file (rsc/json/xml) on the MikroTik device.

Creates a firewall filter rule in the specified chain on the MikroTik device. Notes: connection_state: comma-separated e.g. "established,related,new,invalid" limit: RouterOS rate/burst string e.g. "10,5:packet" or "10/1s:packet" tcp_flags: RouterOS flag expression e.g. "syn,!ack" place_before: rule number or ID (*N) to insert before e.g. "0" or "*3" in_interface_list/out_interface_list: name of an /interface list (e.g. "LAN", "WAN") rather than a single interface

Creates an IP pool with the given address ranges on the MikroTik device. Notes: ranges: hyphen-separated range(s) e.g. "192.168.1.1-192.168.1.100" Multiple ranges comma-separated: "10.0.0.1-10.0.0.50,10.0.0.100-10.0.0.120"

Creates an IPv6 firewall filter rule on the MikroTik device. Notes: protocol: IPv6 uses "icmpv6", not the IPv4 spelling "icmp". jump_target: only used with action="jump".

Creates a NAT rule (srcnat or dstnat) on the MikroTik device. Notes: to_addresses: single IP or range e.g. "10.0.0.1" or "10.0.0.1-10.0.0.10" to_ports: single port or range e.g. "8080" or "8080-8090" place_before: rule number or ID (*N) to insert before e.g. "0" or "*3"

Creates a hierarchical queue tree entry attached to a parent interface or queue. Notes: max_limit / limit_at / burst_limit / burst_threshold: bandwidth e.g. "10M", "512k", "1G" burst_time: duration e.g. "8s" parent: interface name e.g. "ether1" or parent queue name priority: 1 (highest) – 8 (lowest)

Creates a queue type (qdisc). kind selects the discipline (cake, fq-codel, sfq, red, pcq, pfifo, bfifo); remaining params are per-discipline options. Notes: pcq_rate: bandwidth per flow e.g. "1M", "512k" pcq_classifier: comma-separated classifiers e.g. "src-address,dst-address" cake_rtt: round-trip time e.g. "50ms", "100ms" fq_codel_target / fq_codel_interval: time e.g. "5ms", "100ms"

Creates a simple queue to rate-limit a target address or interface. Notes: target: IP/CIDR or interface e.g. "192.168.1.0/24" or "ether1" max_limit / limit_at / burst_limit / burst_threshold: upload/download bandwidth as "UL/DL" e.g. "10M/10M", or single value e.g. "10M" burst_time: duration e.g. "8s" priority: 1 (highest) – 8 (lowest)

Creates a VLAN interface on the MikroTik device with the given VLAN ID and parent interface.

Creates a WireGuard interface on the MikroTik device.

Legacy function - different in RouterOS v7.x

Creates a wireless interface on the MikroTik device (auto-detects RouterOS v6/v7 syntax).

Legacy function - not supported in RouterOS v7.x

Disables an address list entry.

Disables a static DNS entry.

Disables a firewall filter rule.

Disables an interface on the MikroTik device. Notes: name: exact interface name e.g. "ether1", "bridge", "pppoe-out1"

Disables an IPv6 firewall filter rule.

Disables a NAT rule.

Disables a queue tree.

Disables a route. Notes: route_id: "*N" or "N" from list output e.g. "*3"

Disables a simple queue.

Disables a user.

Disables a WireGuard interface.

Disables a WireGuard peer. Notes: peer_id: "*N" or "N" from list output e.g. "*2"

Disables a wireless interface.

Disconnects an active user session.

Downloads a backup or export file from the MikroTik device as base64-encoded content.

Enables an address list entry.

Enables a static DNS entry.

Enables a firewall filter rule.

Enables an interface on the MikroTik device. Notes: name: exact interface name e.g. "ether1", "bridge", "pppoe-out1"

Enables an IPv6 firewall filter rule.

Enables a NAT rule.

Enables a queue tree.

Enables a route. Notes: route_id: "*N" or "N" from list output e.g. "*3"

Activates MikroTik Safe Mode; changes are held in memory and auto-reverted on disconnect until committed.

Enables a simple queue.

Enables a user.

Enables a WireGuard interface.

Enables a WireGuard peer. Notes: peer_id: "*N" or "N" from list output e.g. "*2"

Enables a wireless interface.

Expands an existing IP pool by appending additional address ranges. Notes: additional_ranges: hyphen-separated range(s) e.g. "192.168.1.101-192.168.1.150" Multiple ranges comma-separated: "10.0.0.51-10.0.0.60,10.0.0.70-10.0.0.80"

Exports DNS configuration to a file.

Exports logs to a .txt file on the MikroTik device with optional topic and time filters.

Returns a RouterOS configuration section as an export script. Notes: section: RouterOS path without leading slash e.g. "ip address", "interface vlan", "ip firewall filter", "ip firewall nat", "queue simple" hide_sensitive: keep secrets out of the output (False appends show-sensitive)

Exports user configuration to a file.

Flushes the DNS cache.

Flushes the route cache.

Generates a wg0.conf client config string from the given keys and server endpoint. Does not communicate with the router.

Gets currently active/logged-in users.

Gets one address list entry by list name and address.

Gets detailed information about a specific DHCP server.

Gets the current DNS cache.

Gets DNS cache statistics.

Gets current DNS configuration.

Gets details of a specific static DNS entry.

Gets detailed information about a specific firewall filter rule. Notes: rule_id: positional number from list output (e.g. "12") or internal ID (e.g. "*1A")

Gets detailed information about a specific interface by name. Notes: name: exact interface name e.g. "ether1", "bridge", "pppoe-out1", "wg0"

Gets detailed information about a specific IP address by ID or address value.

Gets detailed information about a specific IP pool including used address count.

Lists the IPsec peers with a live IKE session, with uptime and counters. Shows the parent (phase 1) side: `state`, `uptime`, `last-seen` and the byte counters. A peer can sit here `established` while its child SAs carry nothing — use `get_ipsec_installed_sa` to tell the difference. Notes: Both filters are exact matches.

Lists the installed IPsec security associations (child/phase 2 SAs). The Flags legend is the point of this view. On RouterOS 7 it reads: S - SEEN-TRAFFIC the SA has carried packets H - HW-AEAD the cipher is running in hardware E - ESP `S` is the only field that separates an SA carrying traffic from one that is merely installed. A remote end reporting the connection as up, or its own byte counters growing, does not contradict a missing `S`: those count what the far side sent, not what arrived. Two things this does NOT tell you, both easy to get wrong: - **A missing `S` c…

Gets detailed information about a specific IPv6 address by ID or address value. Notes: address_id: a RouterOS internal id (e.g. "*1") or the address value (e.g. "2001:db8::1/64").

Gets detailed information about a specific IPv6 firewall filter rule. Notes: rule_id: a RouterOS internal id ("*1") or a print position ("0").

Gets log entry counts by topic and severity from the MikroTik device.

Gets logs from the MikroTik device with optional topic, time, and message filters. Notes: topics: comma-separated, entry matches any of them e.g. "system,dhcp" time_filter: RouterOS duration e.g. "30s", "5m", "1h", "2d" message_filter: RouterOS regex matched against the message (case-sensitive) limit: keep only the newest N entries

Gets logs filtered by severity level (debug/info/warning/error/critical).

Gets logs for a specific topic/facility (system, dhcp, interface, firewall, etc.).

Gets detailed information about a specific NAT rule. Notes: rule_id: use the ID from list output e.g. "*1" or "0"

Reads real-time Power-over-Ethernet (PoE) monitor data for one or more ethernet interfaces — PoE-out status, voltage, current, and power. Runs ``/interface ethernet poe monitor <interfaces> once``. Notes: interfaces: comma-separated ethernet interface name(s), e.g. "ether1" or "ether9-ap,ether10-ap,ether11-ap,ether12-ap"

Gets the detailed PoE-out settings of a specific ethernet interface (PoE-out mode, priority, voltage, low/high thresholds, …). Runs ``/interface ethernet poe print detail where name=<name>``. Notes: name: exact ethernet interface name, e.g. "ether1"

Gets detailed information about a specific queue tree.

Gets detailed information about a specific queue type.

Gets detailed information about a specific route. Notes: route_id: "*N" or "N" from list output e.g. "*3"

Gets the route cache.

Gets routing table statistics.

Gets a specific routing table.

Gets security-related log entries (logins, failures, blocked connections, etc.).

Gets detailed information about a specific simple queue.

Reports the device clock, time zone and DST setting. Notes: Log timestamps are only as trustworthy as this. A device without a working time source dates its own evidence wrongly, which matters when correlating an incident across sites.

Gets system-related log events (login, reboot, config-change, etc.).

Reports the board sensors: voltage, temperature, fan and PSU state. Notes: Many boards carry no sensors at all and legitimately report nothing. An empty answer here means "this model does not measure it", not "the reading failed".

Reports the installed RouterOS version against the latest on its channel. Notes: This reads the stored result of the last check; it does not contact MikroTik. `latest-version` can therefore be stale or empty on a device that has never checked or cannot reach the update server.

Reports uptime, RouterOS version, board name, architecture, CPU and memory. Notes: `free-memory` against `total-memory` and `cpu-load` are the two numbers worth reading before blaming the network for a slow device. On the low-power boards a single packet-sniffing tool can saturate the CPU on its own.

Reports the model, serial number and bootloader firmware revision. Notes: `current-firmware` against `upgrade-firmware` is the RouterBOOT bootloader, which is upgraded separately from RouterOS and is easy to leave behind after a package upgrade.

Gets detailed information about a specific user.

Gets detailed information about a specific user group.

Gets detailed information about a specific VLAN interface.

Gets detailed information about a specific WireGuard interface.

Gets detailed information about a specific WireGuard peer by ID. Notes: peer_id: "*N" or "N" from list output e.g. "*2"

Gets detailed information about a specific wireless interface.

Gets the wireless registration table (connected clients) from the MikroTik device.

Legacy function - not supported in RouterOS v7.x

Imports and executes a RouterOS configuration script (.rsc file) on the device.

Lists IPv4 or IPv6 firewall address list entries. Notes: list_filter: exact list name, including any trailing space. address_filter/comment_filter: partial match. static_only excludes the dynamic children a hostname entry creates.

Lists detailed IPv4 ARP entries. Notes: Address and MAC filters are substring matches. Interface and status filters are exact matches.

Lists backup files on the MikroTik device.

Lists the MikroTik devices this server manages. Use this to discover which devices are available and what their titles are. Every other tool takes an optional `device` argument that must be one of the titles returned here. When only one device is configured, `device` may be omitted and that device is used automatically. Credentials are never returned.

Lists detailed IPv4 DHCP leases, optionally filtering active lease fields. Notes: Address and identity filters are substring matches. Server, status, and lease time filters are exact matches against RouterOS `lease-time`.

Lists DHCP servers on the MikroTik device.

Lists detailed DHCPv6 bindings. Notes: Address and DUID filters are substring matches. IAID, server, status, and lease time filters are exact matches; lease time maps to `life-time`.

Lists static DNS entries.

Lists firewall filter rules on the MikroTik device.

Lists all interfaces on the MikroTik device (ethernet, bridge, WireGuard, PPPoE, VLAN, WiFi, SFP, LTE, loopback, and any other type). Notes: type_filter: RouterOS interface type e.g. "ether", "bridge", "vlan", "wg", "pppoe-out", "wifi", "lte", "loopback" name_filter: partial name match e.g. "ether" matches ether1, ether2 …

Lists IP addresses on the MikroTik device.

Lists currently used (allocated) addresses from IP pools.

Lists IP pools on the MikroTik device.

Lists the management services with their port and address restriction. Notes: `name_filter` is a substring match (`winbox`, `ssh`, `api`, `www`, `www-ssl`, `ftp`, `telnet`). `enabled_only=True` hides the disabled ones, which is the list that actually describes exposure. An empty `address` means unrestricted. Read that together with how the device is reached: unrestricted on a router whose WAN holds a public address means the service is published to the internet, whether or not the port was changed from its default. `ftp` deserves its own look: RouterOS also s…

Lists the configured IPsec peers. Notes: Filters are substring matches. Secrets live on `/ip ipsec identity` and are not exposed by any tool in this server.

Lists the IPsec policies, with their phase 2 state. The Flags legend distinguishes configured policies from the ones a peer generated at runtime (`D` dynamic), and `ph2-state` says whether the child SA is established. A policy whose selectors do not match the far end's is the usual cause of a tunnel that comes up and passes nothing. Notes: `peer_filter` is a substring match on the peer name; the address filters are substring matches on the policy selectors, which are the encapsulated subnets, not the tunnel endpoints.

Lists the IPsec profiles (phase 1 proposal: DH group, hash, lifetime, DPD). Notes: `lifetime` here is phase 1. It must be LONGER than the phase 2 lifetime on `/ip ipsec proposal`, so the child SA rekeys inside a live parent SA; equal lifetimes tear the tunnel down on every rekey. `dpd-interval` multiplied by `dpd-maximum-failures` is how many seconds of silence the peer tolerates.

Lists the IPsec proposals (phase 2: encryption, auth, PFS, lifetime). Notes: Compare `lifetime` against the phase 1 lifetime on `/ip ipsec profile`, and against whatever the far end proposes — a cloud provider's own SA lifetime counts as a third value in that comparison.

Lists IPv6 addresses on the MikroTik device. Notes: address_filter: partial match on the address, e.g. "2001:db8" or "fe80". global_only: show only global (routable) addresses. link_local_only: show only link-local (fe80::/10) addresses.

Lists IPv6 firewall filter rules on the MikroTik device. Notes: protocol_filter: IPv6 uses "icmpv6", not the IPv4 spelling "icmp". src_address_filter/dst_address_filter: partial match on the address, e.g. "2001:db8" matches every rule whose address starts with it.

Lists detailed IPv6 neighbor-discovery entries. Notes: Address and MAC filters are substring matches. Interface and status filters are exact matches.

Lists NAT rules on the MikroTik device.

Lists the netwatch probes with their live status and measurements. Configuration first, then a LIVE STATE block with `status`, `since` — the timestamp of the last transition — and, on an ICMP probe, the last test's numbers: `rtt-avg`, `loss-percent`, `failed-tests`. Match the two blocks by `host`, or by the `.id` the live one carries. Notes: `host_filter` and `comment_filter` are substring matches; `status_filter` and `type_filter` are exact. Pass `status_filter="down"` to list only what is currently failing. `include_source=False` (the default) omits `up-script`, `down-…

Lists the Power-over-Ethernet (PoE) configuration of PoE-capable ethernet interfaces (PoE-out mode, priority). Runs ``/interface ethernet poe print``. Notes: interface_filter: partial name match, e.g. "ether" matches ether1, ether2 …

Lists queue trees on the MikroTik device.

Lists queue types on the MikroTik device.

Lists routes in MikroTik routing table.

Lists the scheduled tasks with their interval, next run and run count. Notes: `name_filter` is a substring match. Read `next-run` together with `interval`: a scheduler whose `run-count` is not advancing is firing into a script that errors out, which RouterOS does not surface here — it shows up in the log under the `script` topic. `include_source=False` (the default) omits `on-event`, because a scheduler can carry commands inline, and those routinely hold a bot token or a password inside a URL. Redaction only recognises labelled secrets, so withholding the fiel…

Lists the stored scripts: owner, policy, run count and last start. Notes: `include_source=False` (the default) omits the script body, because bodies routinely hold credentials in clear text. Set it to True only when you intend to read the code; the output is redacted either way, but redaction is pattern-based and is not a guarantee. `policy` is what the script may do when it runs, which can exceed what the user who scheduled it may do interactively.

Lists simple queues on the MikroTik device.

Lists the installed RouterOS packages and which are disabled.

Lists user groups on MikroTik device.

Lists SSH keys for a specific user.

Lists users on MikroTik device.

Lists VLAN interfaces on the MikroTik device.

Lists WireGuard interfaces on the MikroTik device.

Lists WireGuard peers on the MikroTik device.

Legacy function - different in RouterOS v7.x

Lists wireless interfaces on the MikroTik device.

Legacy function - not supported in RouterOS v7.x

Watches for new log entries for a limited duration (max 60s) and returns them. Notes: duration: seconds to wait for new entries, capped at 60

Moves a firewall filter rule to a different position in the chain. Notes: rule_id: positional number from list output (e.g. "12") or internal ID (e.g. "*1A") destination: 0-based target position index

Moves an IPv6 firewall filter rule to a different position in the chain. Notes: rule_id: a RouterOS internal id ("*1") or a print position ("0"). destination: 0-based target position index

Moves a NAT rule to a different position in the chain. Notes: rule_id: use the ID from list output e.g. "*1" or "0" destination: 0-based target position index

Removes an address list entry by list name and address. Notes: Removing a hostname entry also clears the dynamic entries RouterOS derived from it.

Removes a DHCP network configuration from the MikroTik device.

Removes a DHCP server from the MikroTik device.

Removes a static DNS entry.

Removes a file from the MikroTik device filesystem.

Removes a firewall filter rule from the MikroTik device. Notes: rule_id: positional number from list output (e.g. "12") or internal ID (e.g. "*1A")

Removes an IP address from the MikroTik device by ID or address value.

Removes an IP pool from the MikroTik device (fails if pool is in use).

Removes an IPv6 address from the MikroTik device by ID or address value. Notes: address_id: a RouterOS internal id (e.g. "*1") or the address value (e.g. "2001:db8::1/64").

Removes an IPv6 firewall filter rule from the MikroTik device. Notes: rule_id: a RouterOS internal id ("*1") or a print position ("0").

Removes a NAT rule from the MikroTik device. Notes: rule_id: use the ID from list output e.g. "*1" or "0"

Removes a queue tree from the MikroTik device.

Removes a queue type from the MikroTik device.

Removes a route. Notes: route_id: "*N" or "N" from list output e.g. "*3"

Removes a simple queue from the MikroTik device.

Removes a user.

Removes a user group.

Removes an SSH key.

Removes a VLAN interface from the MikroTik device.

Removes a WireGuard interface from the MikroTik device.

Removes a WireGuard peer from the MikroTik device. Notes: peer_id: "*N" or "N" from list output e.g. "*2"

Legacy function - different in RouterOS v7.x

Removes a wireless interface from the MikroTik device.

Legacy function - not supported in RouterOS v7.x

Restores a system backup on the MikroTik device; triggers a reboot.

Discards all pending Safe Mode changes by closing the SSH session, triggering automatic rollback.

Returns whether MikroTik Safe Mode is currently active.

Scans for nearby wireless networks using the specified interface.

Searches log messages for a literal term. Notes: search_term: treated literally (regex specials are escaped) case_sensitive: RouterOS matching is case-sensitive; by default the search emulates case-insensitivity with character classes

Sets DNS server configuration.

Sets SSH keys for a specific user.

Sets the WiFi passphrase directly on a RouterOS v7 wireless interface (/interface wifi or wifiwave2). Notes: authentication_types: comma-separated RouterOS auth types, e.g. "wpa2-psk,wpa3-psk"; unset keeps the current setting.

Legacy function - not supported in RouterOS v7.x

Tests a DNS query. Notes: type: accepted values are A/ipv4, AAAA/ipv6, any, any6

Updates an address list entry, located by its current list name and address. Notes: Pass "" to clear comment or timeout. A change is confirmed on the device before success is reported.

Updates fields on an existing DHCP network entry on the MikroTik device. Notes: Pass an empty list for dns_servers/wins_servers/ntp_servers/dhcp_option (or "" for domain) to clear that field.

Updates a static DNS entry.

Updates an existing firewall filter rule on the MikroTik device. Notes: rule_id: positional number from list output (e.g. "12") or internal ID (e.g. "*1A") connection_state: comma-separated e.g. "established,related" limit: RouterOS rate string e.g. "10,5:packet" tcp_flags: RouterOS flag expression e.g. "syn,!ack" Pass "" to clear an optional field (e.g. src_address="").

Updates an existing IP pool's name, ranges, or next-pool reference. Notes: ranges: hyphen-separated range(s) e.g. "192.168.1.1-192.168.1.100" Multiple ranges comma-separated: "10.0.0.1-10.0.0.50,10.0.0.100-10.0.0.120" Pass "" for next_pool to clear it.

Updates an existing IPv6 firewall filter rule on the MikroTik device. Notes: rule_id: a RouterOS internal id ("*1") or a print position ("0"). Pass "" to clear an optional field (e.g. src_address="").

Updates an existing NAT rule on the MikroTik device. Notes: rule_id: use the ID from list output e.g. "*1" or "0" to_addresses: single IP or range e.g. "10.0.0.1" or "10.0.0.1-10.0.0.10" to_ports: single port or range e.g. "8080" or "8080-8090" Pass "" to clear an optional field.

Updates an existing queue tree entry (bandwidth limits, parent, priority, etc.). Notes: max_limit / limit_at / burst_limit / burst_threshold: bandwidth e.g. "10M", "512k" burst_time: duration e.g. "8s" priority: 1 (highest) – 8 (lowest)

Updates an existing queue type's discipline-specific settings.

Updates a route. Notes: route_id: "*N" or "N" from list output e.g. "*3" dst_address: CIDR e.g. "192.168.1.0/24" check_gateway: "ping" or "arp" distance: 1-255 routing_table: name of a table from /routing table; "" moves the route back to "main", since every RouterOS 7 route belongs to a table. Pass "" to vrf_interface or pref_src to clear them.

Updates an existing simple queue's rate limits, target, or scheduling settings. Notes: target: IP/CIDR or interface e.g. "192.168.1.0/24" or "ether1" max_limit / limit_at / burst_limit / burst_threshold: upload/download bandwidth as "UL/DL" e.g. "10M/10M", or single value e.g. "10M" burst_time: duration e.g. "8s" priority: 1 (highest) – 8 (lowest)

Updates a user.

Updates a user group.

Updates an existing VLAN interface's settings on the MikroTik device.

Updates an existing WireGuard interface's settings on the MikroTik device.

Updates an existing WireGuard peer's allowed addresses, endpoint, keepalive, or enabled state. Notes: peer_id: "*N" or "N" from list output e.g. "*2" allowed_address: CIDR, comma-separated e.g. "10.0.0.2/32" or "10.0.0.0/24,192.168.0.0/24" persistent_keepalive: seconds as string e.g. "25" Pass "" for endpoint_address or preshared_key to clear them.

Updates an existing wireless interface's settings (name, SSID, enabled state, etc.).

Uploads a base64-encoded file to the MikroTik device (for restore operations).