Overview

Mikrotik MCP Server implements a Model Context Protocol (MCP) interface for managing Mikrotik RouterOS network services such as IP allocation, DHCP control, and firewall rule management. It sits between your orchestration tooling and one or more Mikrotik devices, exposing a consistent API surface that automates common network operations and keeps device state synchronized with your management system.

This server is useful when you need programmatic, repeatable interactions with Mikrotik devices across many sites — for example, dynamic DHCP provisioning, bulk IP assignment, or pushing firewall policies from a central controller. Developers can integrate the MCP server into CI/CD pipelines, inventory systems, or custom network automation scripts to remove manual configuration and reduce errors.

Features

Centralized API for Mikrotik RouterOS tasks: IP management, DHCP lease handling, and firewall rule control
JSON-based HTTP endpoints for programmatic access (compatible with MCP client patterns)
Configuration-driven connections to one or more RouterOS instances
Support for secure connections (TLS and credential management)
Idempotent operations for safe automation (create / update semantics)
Docker image and systemd-friendly deployment patterns
Logging and basic metrics for operational visibility

Installation / Configuration

Clone the repository and run the server using Docker or a local binary. Below are common installation and configuration examples.

Clone the repo:

git clone https://github.com/jeff-nasseri/mikrotik-mcp.git
cd mikrotik-mcp

Run with Docker:

# Example: run container with config mounted
docker run -d \
  --name mikrotik-mcp \
  -p 8080:8080 \
  -v "$(pwd)/config.yaml":/etc/mcp/config.yaml:ro \
  ghcr.io/jeff-nasseri/mikrotik-mcp:latest

Run local binary (if provided by repo):

# build and run (replace with repo's actual build steps if different)
go build -o mikrotik-mcp ./cmd/server
./mikrotik-mcp --config ./config.yaml

Example configuration (config.yaml):

server:
  listen: "0.0.0.0:8080"
  tls:
    enabled: false

devices:
  - name: office-router
    address: "192.0.2.1:8728"
    username: "admin"
    password: "s3cret"
    insecure_skip_verify: false

logging:
  level: info

Tips:

Store credentials securely and avoid committing them to source control.
Use TLS for the public-facing server endpoint when integrating with external controllers.

Available Resources

The MCP server exposes a set of HTTP endpoints (JSON) and typically includes:

REST API endpoints for IP, DHCP, and firewall operations
OpenAPI/Swagger specification for interactive exploration (if provided)
Sample client scripts (curl, Python, or shell) for common workflows
Docker image for containerized deployment
Example systemd unit file for long-running server processes

Sample systemd unit:

[Unit]
Description=Mikrotik MCP Server
After=network.target

[Service]
User=mikrotik
ExecStart=/usr/local/bin/mikrotik-mcp --config /etc/mcp/config.yaml
Restart=on-failure

[Install]
WantedBy=multi-user.target

API endpoint overview (example):

Area	Example Endpoint	Method
IP	/api/ip/addresses	GET/POST/PUT/DELETE
DHCP	/api/dhcp/leases	GET/POST/PUT/DELETE
Firewall	/api/firewall/rules	GET/POST/PUT/DELETE

Use Cases

DHCP provisioning for onboarding:
- When a new site is commissioned, an automation pipeline POSTs a DHCP pool and lease reservations to the MCP server. The server creates the corresponding entries on the RouterOS device and returns a canonical resource ID for later updates.
Example:
```
curl -X POST http://localhost:8080/api/dhcp/leases \
  -H "Content-Type: application/json" \
  -d '{"mac":"aa:bb:cc:dd:ee:ff","ip":"10.0.1.100","comment":"site-123 printer"}'
```
Bulk IP allocation for VM provisioning:
- A cloud orchestrator requests a block of private addresses from the MCP server. The server assigns and persists addresses centrally and applies address listings to the RouterOS IP address list.
Centralized firewall policy deployment:
- Security changes are authored in a central repository. A CI job calls the MCP server to update firewall chains and rules across multiple routers, ensuring consistent policy enforcement.
Example:
```
curl -X POST http://localhost:8080/api/firewall/rules \
  -H "Content-Type: application/json" \
  -d '{"chain":"forward","src-address":"10.0.0.0/8","action":"accept","comment":"allow internal"}'
```
Inventory and auditing:
- Periodic jobs pull current DHCP leases and firewall rules to verify drift against desired state and generate reports or alerts for manual review.

Getting Started Tips

Start in a staging environment before applying changes to production routers.
Use the server’s read endpoints to learn the current device state before making changes.
Leverage the Docker image for quick testing and a systemd unit for production deployments.
If the project provides an OpenAPI spec, import it into tools like Postman or Swagger UI for interactive testing.

For the latest code, issues, and contribution guidelines, see the project repository: https://github.com/jeff-nasseri/mikrotik-mcp.

Mikrotik MCP Server for IP, DHCP, Firewall