mikrotik-mcp (wiresage)
access level: configurable✔ Source-reviewed Oct 2026
We read this project's source code and tool definitions (Oct 2026). This is a code review, not a live test against real systems. Re-check after upgrades.
| Repository | https://github.com/wiresage/mikrotik-mcp |
|---|---|
| Category | Network/firewall |
| Systems touched | MikroTik RouterOS (fleet inventory): interfaces, VLANs, WireGuard, firewall, DHCP, DNS, routing, … |
| Access (as described) | configurable |
| License / price | MIT / free |
| GitHub stars | 325 |
| Read tools | list/get interfaces, VLANs, WireGuard, wireless, DHCP/DNS/firewall/routing prints (large surface; see api-coverage.md) |
| Write / delete / exec tools | create/update/remove/enable/disable across interfaces, WireGuard, firewall, DHCP, DNS, routing, etc. when not in read-only mode |
| Read-only mode | Yes: --read-only / MIKROTIK_READ_ONLY=true exposes only non-modifying tools (still pair with a restricted RouterOS account) |
| Safety notes | --read-only only shrinks the tool catalogue — real enforcement is the RouterOS user privileges. HTTP mode needs Host/Origin/IP allowlists (DNS-rebinding protection). SSH-agent auth is opt-in. |
| Verified | yes (README review 2026-11-07) |
| Notes | 151/334 in-scope RouterOS 7.26 commands mapped. Multi-device inventory since 0.14. Actively updated (push 2026-11-05; presentations note Nov 2026). Added 2026-11-07. |
📬 SysAdmin Agents
The SysAdmin Agents newsletter: new MCP servers, agent skills and safety notes for sysadmins. One email a week.