OfficialVerified

Mikrotik MCP Server (Actemium Schweiz AG)

MikroTik RouterOS fleet management via REST API with KeePass credential isolation.

Data last scanned today · Reviewed today

43 1 dangerous tool3 tools★ 2TypeScriptApache-2.0

Overview

This TypeScript-based MCP server provides an interface to manage MikroTik RouterOS devices. It utilizes the RouterOS REST API to provide structured access to 65 distinct tools covering network administration, interface management, firewall configurations, and system monitoring. The server is built for fleet-wide operations, supporting parallel execution across multiple devices identified by their IDs. Security is addressed by separating authentication from the AI model. Device credentials remain within a KeePass vault, with the model only interacting with device IDs. For restricted environments, the server includes a read-only mode that disables write and execution tools, limiting access to state-query functions only.

Our verdict

With a security score of 30/100, this server is classified as high-risk. The score reflects its status as a community-maintained project rather than an official vendor tool, coupled with limited external validation. While it implements a secure credential vaulting system and provides an optional read-only mode to mitigate risks, users should exercise caution. It is suitable for advanced network administrators in non-production or well-monitored environments who can independently verify the implementation.

Supports parallel commands across multiple device targets.
Uses structured REST API instead of brittle CLI scraping.
Centralizes sensitive credentials within local KeePass vaults.
Limits supply chain surface with only five direct dependencies.

High-risk score due to community-only maintenance.
Limited community presence with only two GitHub stars.
Lacks independent editorial or security audit documentation.

Setup

Claude Desktop

{
  "mcpServers": {
    "vesact-mikrotik-mcp": {
      "args": [
        "-y",
        "mikrotik-mcp"
      ],
      "command": "npx"
    }
  }
}

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.

No read-only mode — running this grants full read/write access.
No built-in authentication — anyone with access to this config can invoke every tool it exposes.

Tools

Tool	Description	Risk
device-list	List all devices available in the managed fleet from the KeePass vault.	low
setup-new-device	Bootstrap a new MikroTik device into the managed fleet.	medium
ros-command	Execute an arbitrary RouterOS CLI command over SSH.	high

Compatibility

Client	Local	Docker	Remote	Read-only
ChatGPT
Claude Desktop
Cursor
VS Code
Windsurf

Frequently asked questions

›How are device credentials managed?

The server retrieves credentials at runtime from a KeePass (.kdbx) vault file, ensuring that sensitive passwords are never exposed to the AI model.

›Can I restrict the server to read-only access?

Yes, by setting the READ_ONLY environment variable to true, the server will disable all 14 write and active-diagnostic tools, leaving only 51 state-query tools available.

›What happens if one device in a batch request is unreachable?

Commands are executed in parallel across the specified targets, and the server returns results for each device individually; a single unreachable device will not cause the entire batch operation to fail.

›Which RouterOS version is required?

This server requires MikroTik RouterOS v7.1 or higher to support the necessary REST API functionality.

›Does the server support different MCP transport modes?

Yes, the server supports stdio for local clients like Claude Desktop or Claude Code, and Streamable HTTP for shared team server deployments.

›Is there any authentication for the HTTP endpoint?

The HTTP transport does not have built-in authentication, but it supports security configurations including DNS-rebinding protection via allow-lists for Host and Origin headers.