// SCAN REPORT

MikroTik MCP Server

48 tools. 23 can modify or destroy data without limits.

1 destructive tool with no built-in limits. Policy required.

Last updated: 29 Jun 2026

23 can modify or destroy data

25 read-only

48 tools total

Community server · catalogue entry verified 29/06/2026

How to control MikroTik MCP Server ↓

TOOL MAP

What MikroTik MCP Server exposes to your agents

Read (25) Write / Execute (22) Destructive / Financial (1)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

Critical Risk

The most dangerous MikroTik MCP Server tools

Destructive · High firewall_remove_rule Remove a firewall filter, NAT, or mangle rule by ID Execute · Medium execute_batch_commands Execute multiple RouterOS commands in sequence on a device Execute · Medium execute_command Execute a RouterOS command on a connected MikroTik device. Automatically adapts commands for RouterOS 6 or 7 compatibility. Execute · Medium execute_on_all_devices Execute the same command on all connected devices concurrently

23 of MikroTik MCP Server's 48 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control MikroTik MCP Server

PolicyLayer is an MCP gateway — it sits between your AI agents and MikroTik MCP Server, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations

{
  "firewall_remove_rule": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations

{
  "backup_config": {
    "limits": [
      {
        "counter": "backup_config_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "compare_configs": {
    "limits": [
      {
        "counter": "compare_configs_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register MikroTik MCP Server — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON MIKROTIK →

Instant setup, no code required.

FULL CATALOGUE

All 48 MikroTik MCP Server tools

DESTRUCTIVE 1 tools

Destructive firewall_remove_rule Remove a firewall filter, NAT, or mangle rule by ID

EXECUTE 3 tools

Execute execute_batch_commands Execute multiple RouterOS commands in sequence on a device Execute execute_command Execute a RouterOS command on a connected MikroTik device. Automatically adapts commands for RouterOS 6 or 7 c Execute execute_on_all_devices Execute the same command on all connected devices concurrently

WRITE 19 tools

Write backup_config Export and save device configuration to a backup file Write connect_device Connect to a MikroTik device using SSH, Telnet, or API Write dhcp_add_network Add a DHCP network configuration Write dhcp_add_static_lease Add a static DHCP lease Write dhcp_create_pool Create an IP address pool Write dhcp_create_server Create a DHCP server Write disconnect_device Disconnect from a MikroTik device Write export_config Export device configuration as text (without saving to file) Write firewall_add_address_list Add an address to a firewall address list Write firewall_add_filter_rule Add a firewall filter rule Write firewall_add_nat_rule Add a NAT rule Write profile_apply Apply a configuration profile to a device Write profile_save_current Save current device configuration as a reusable profile Write restore_config Restore device configuration from a backup file Write vpn_add_ipsec_peer Add an IPsec peer Write vpn_add_l2tp_user Add an L2TP VPN user Write vpn_add_wireguard_interface Add a WireGuard interface Write vpn_add_wireguard_peer Add a WireGuard peer Write vpn_configure_l2tp_server Configure L2TP server settings

READ 25 tools

Read compare_configs Compare configurations between two devices and show differences Read dhcp_get_servers Get list of DHCP servers Read firewall_get_address_list Get firewall address list entries Read get_command_history Get command execution history from audit log Read get_connection_stats Get detailed connection statistics for a connected device (uptime, commands executed, response times, etc.) Read get_connection_status Get the connection status of all configured devices Read get_device_audit_stats Get audit statistics for a specific device Read get_device_info Get detailed information about a specific device Read get_dhcp_leases List DHCP leases on a MikroTik device Read get_firewall_rules List firewall filter rules on a MikroTik device Read get_fleet_status Get status and statistics for all configured devices Read get_interfaces List all interfaces on a connected MikroTik device Read get_ip_addresses List all IP addresses configured on a MikroTik device Read get_routes List IP routes on a MikroTik device Read get_system_info Get system resource information from a connected MikroTik device Read list_devices List all configured MikroTik devices from the devices.json configuration file Read list_supported_commands List RouterOS commands supported by a specific RouterOS version (6 or 7) Read profile_get Get details of a specific profile Read profile_list List available configuration profiles Read profile_preview Preview commands that will be executed for a profile Read profile_validate Validate a profile structure Read vpn_get_ipsec_peers Get IPsec peers Read vpn_get_l2tp_connections Get active L2TP connections Read vpn_get_ppp_secrets Get PPP secrets (L2TP/PPTP users) Read vpn_get_wireguard_interfaces Get WireGuard interfaces

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about MikroTik MCP Server

Can an AI agent delete data through the MikroTik MCP Server MCP server? +

Yes. The MikroTik MCP Server server exposes 1 destructive tools including firewall_remove_rule. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through MikroTik MCP Server? +

The MikroTik MCP Server server has 19 write tools including backup_config, connect_device, dhcp_add_network. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach MikroTik MCP Server.

How many tools does the MikroTik MCP Server MCP server expose? +

48 tools across 4 categories: Destructive, Execute, Read, Write. 25 are read-only. 23 can modify, create, or delete data.

How do I enforce a policy on MikroTik MCP Server? +

Register the MikroTik MCP Server MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every MikroTik MCP Server tool call.

Deterministic rules across all 48 MikroTik MCP Server tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON MIKROTIK →

Instant setup, no code required.

48 MikroTik MCP Server tools catalogued and risk-classified — across an index of 43,000+ MCP servers.