// SCAN REPORT

MikroTik MCP

124 tools. 71 can modify or destroy data without limits.

17 destructive tools with no built-in limits. Policy required.

Last updated:

71 can modify or destroy data
53 read-only
124 tools total

Community server · catalogue entry verified 01/07/2026

How to control MikroTik MCP ↓

TOOL MAP

What MikroTik MCP exposes to your agents

Read (53) Write / Execute (54) Destructive / Financial (17)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS
Critical Risk

The most dangerous MikroTik MCP tools

Destructive · High mikrotik_clear_logs This tool permanently deletes audit logs and system logs from a network device. Destructive · High mikrotik_remove_dhcp_server This tool irreversibly deletes DHCP server configuration from a network device. Destructive · High mikrotik_remove_dns_static Removing a static DNS entry is an irreversible deletion operation. Destructive · Critical mikrotik_remove_file File removal is a destructive operation that cannot be undone.

71 of MikroTik MCP's 124 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control MikroTik MCP

PolicyLayer is an MCP gateway — it sits between your AI agents and MikroTik MCP, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations
{
  "mikrotik_clear_logs": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations
{
  "mikrotik_add_blackhole_route": {
    "limits": [
      {
        "counter": "mikrotik_add_blackhole_route_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations
{
  "mikrotik_backup_info": {
    "limits": [
      {
        "counter": "mikrotik_backup_info_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

  1. Create a free account and register MikroTik MCP — nothing to install.
  2. Add these rules — paste them, or build them visually. Tune the limits to your setup.
  3. Point your MCP client (Claude, Cursor, anything) at your gateway URL.
ENFORCE POLICY ON MIKROTIK →

Instant setup, no code required.

FULL CATALOGUE

All 124 MikroTik MCP tools

DESTRUCTIVE 17 tools
Destructive mikrotik_clear_logs Clears all logs from MikroTik device Destructive mikrotik_remove_dhcp_server Removes a DHCP server from MikroTik device Destructive mikrotik_remove_dns_static Removes a static DNS entry Destructive mikrotik_remove_file Removes a file from MikroTik device Destructive mikrotik_remove_filter_rule Removes a firewall filter rule from MikroTik device Destructive mikrotik_remove_ip_address Removes an IP address from MikroTik device Destructive mikrotik_remove_ip_pool Removes an IP pool from MikroTik device Destructive mikrotik_remove_nat_rule Removes a NAT rule from MikroTik device Destructive mikrotik_remove_route Removes a route from MikroTik routing table Destructive mikrotik_remove_user Removes a user from MikroTik device Destructive mikrotik_remove_user_group Removes a user group from MikroTik device Destructive mikrotik_remove_user_ssh_key Removes an SSH key Destructive mikrotik_remove_vlan_interface Removes a VLAN interface from MikroTik device Destructive mikrotik_remove_wireless_access_list_entry Removes a wireless access list entry (legacy systems only) Destructive mikrotik_remove_wireless_interface Removes a wireless interface from MikroTik device Destructive mikrotik_remove_wireless_security_profile Removes a wireless security profile (legacy systems only) Destructive mikrotik_restore_backup Restores a system backup on MikroTik device
EXECUTE 3 tools
Execute mikrotik_disconnect_user Disconnects an active user session Execute mikrotik_flush_route_cache Flushes the route cache Execute mikrotik_import_configuration Imports a configuration script file
WRITE 51 tools
Write mikrotik_add_blackhole_route Adds a blackhole route Write mikrotik_add_default_route Adds a default route (0.0.0.0/0) Write mikrotik_add_dns_regexp Adds a DNS regexp entry for pattern matching Write mikrotik_add_dns_static Adds a static DNS entry Write mikrotik_add_ip_address Adds an IP address to an interface Write mikrotik_add_route Adds a route to MikroTik routing table Write mikrotik_add_user Adds a new user to MikroTik device Write mikrotik_add_user_group Adds a new user group to MikroTik device Write mikrotik_create_backup Creates a system backup on MikroTik device Write mikrotik_create_basic_firewall_setup Creates a basic firewall setup with common security rules Write mikrotik_create_dhcp_network Creates a DHCP network configuration Write mikrotik_create_dhcp_pool Creates a DHCP address pool Write mikrotik_create_dhcp_server Creates a DHCP server on MikroTik device Write mikrotik_create_filter_rule Creates a firewall filter rule on MikroTik device Write mikrotik_create_ip_pool Creates an IP pool on MikroTik device Write mikrotik_create_nat_rule Creates a NAT rule on MikroTik device Write mikrotik_create_vlan_interface Creates a VLAN interface on MikroTik device Write mikrotik_create_wireless_access_list Creates a wireless access list entry (legacy systems only) Write mikrotik_create_wireless_interface Creates a wireless interface on MikroTik device Write mikrotik_create_wireless_security_profile Creates a wireless security profile (legacy systems only) Write mikrotik_disable_dns_static Disables a static DNS entry Write mikrotik_disable_filter_rule Disables a firewall filter rule Write mikrotik_disable_nat_rule Disables a NAT rule Write mikrotik_disable_route Disables a route Write mikrotik_disable_user Disables a user account Write mikrotik_disable_wireless_interface Disables a wireless interface Write mikrotik_enable_dns_static Enables a static DNS entry Write mikrotik_enable_filter_rule Enables a firewall filter rule Write mikrotik_enable_nat_rule Enables a NAT rule Write mikrotik_enable_route Enables a route Write mikrotik_enable_user Enables a user account Write mikrotik_enable_wireless_interface Enables a wireless interface Write mikrotik_expand_ip_pool Expands an existing IP pool by adding more ranges Write mikrotik_export_dns_config Exports DNS configuration to a file Write mikrotik_export_logs Exports logs to a file on the MikroTik device Write mikrotik_flush_dns_cache Flushes the DNS cache Write mikrotik_move_filter_rule Moves a firewall filter rule to a different position Write mikrotik_move_nat_rule Moves a NAT rule to a different position in the chain Write mikrotik_set_dns_servers Sets DNS server configuration on MikroTik device Write mikrotik_set_user_ssh_keys Sets SSH public keys for a user Write mikrotik_set_wireless_security_profile Sets security profile for interface (legacy systems only) Write mikrotik_update_dns_static Updates an existing static DNS entry Write mikrotik_update_filter_rule Updates an existing firewall filter rule on MikroTik device Write mikrotik_update_ip_pool Updates an existing IP pool on MikroTik device Write mikrotik_update_nat_rule Updates an existing NAT rule on MikroTik device Write mikrotik_update_route Updates an existing route in MikroTik routing table Write mikrotik_update_user Updates an existing user on MikroTik device Write mikrotik_update_user_group Updates an existing user group on MikroTik device Write mikrotik_update_vlan_interface Updates an existing VLAN interface on MikroTik device Write mikrotik_update_wireless_interface Updates an existing wireless interface Write mikrotik_upload_file Uploads a file to MikroTik device
READ 53 tools
Read mikrotik_backup_info Gets detailed information about a backup file Read mikrotik_check_route_path Checks the route path to a destination Read mikrotik_check_wireless_support Checks if the device supports wireless functionality Read mikrotik_create_export Creates a configuration export on MikroTik device Read mikrotik_download_file Downloads a file from MikroTik device Read mikrotik_export_section Exports a specific configuration section Read mikrotik_export_user_config Exports user configuration to a file Read mikrotik_get_active_users Gets currently active/logged-in users Read mikrotik_get_dhcp_server Gets detailed information about a specific DHCP server Read mikrotik_get_dns_cache Gets the current DNS cache Read mikrotik_get_dns_cache_statistics Gets DNS cache statistics Read mikrotik_get_dns_settings Gets current DNS configuration Read mikrotik_get_dns_static Gets details of a specific static DNS entry Read mikrotik_get_filter_rule Gets detailed information about a specific firewall filter rule Read mikrotik_get_ip_address Gets detailed information about a specific IP address Read mikrotik_get_ip_pool Gets detailed information about a specific IP pool Read mikrotik_get_log_statistics Gets statistics about log entries Read mikrotik_get_logs Gets logs from MikroTik device with filtering options Read mikrotik_get_logs_by_severity Gets logs filtered by severity level Read mikrotik_get_logs_by_topic Gets logs for a specific topic/facility Read mikrotik_get_nat_rule Gets detailed information about a specific NAT rule Read mikrotik_get_route Gets detailed information about a specific route Read mikrotik_get_route_cache Gets the route cache Read mikrotik_get_route_statistics Gets routing table statistics Read mikrotik_get_routing_table Gets a specific routing table Read mikrotik_get_security_logs Gets security-related log entries Read mikrotik_get_system_events Gets system-related log events Read mikrotik_get_user Gets detailed information about a specific user Read mikrotik_get_user_group Gets detailed information about a specific user group Read mikrotik_get_vlan_interface Gets detailed information about a specific VLAN interface Read mikrotik_get_wireless_interface Gets detailed information about a specific wireless interface Read mikrotik_get_wireless_registration_table Gets the wireless registration table (connected clients) Read mikrotik_get_wireless_security_profile Gets wireless security profile details (legacy systems only) Read mikrotik_list_backups Lists backup files on MikroTik device Read mikrotik_list_dhcp_servers Lists DHCP servers on MikroTik device Read mikrotik_list_dns_static Lists static DNS entries Read mikrotik_list_filter_rules Lists firewall filter rules on MikroTik device Read mikrotik_list_ip_addresses Lists IP addresses on MikroTik device Read mikrotik_list_ip_pool_used Lists used addresses from IP pools Read mikrotik_list_ip_pools Lists IP pools on MikroTik device Read mikrotik_list_nat_rules Lists NAT rules on MikroTik device Read mikrotik_list_routes Lists routes in MikroTik routing table Read mikrotik_list_user_groups Lists user groups on MikroTik device Read mikrotik_list_user_ssh_keys Lists SSH keys for a specific user Read mikrotik_list_users Lists users on MikroTik device Read mikrotik_list_vlan_interfaces Lists VLAN interfaces on MikroTik device Read mikrotik_list_wireless_access_list Lists wireless access list entries (legacy systems only) Read mikrotik_list_wireless_interfaces Lists wireless interfaces on MikroTik device Read mikrotik_list_wireless_security_profiles Lists wireless security profiles (legacy systems only) Read mikrotik_monitor_logs Monitors logs in real-time for a specified duration Read mikrotik_scan_wireless_networks Scans for wireless networks using specified interface Read mikrotik_search_logs Searches logs for a specific term Read mikrotik_test_dns_query Tests a DNS query
EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

Yaver 1060 tools
admin
Nodebench 824 tools
admin
UnClick 813 tools
admin
Binance MCP Server 734 tools
admin
Pfsense 680 tools
admin
AdButler 622 tools
admin
Fortimanager 584 tools
admin
Crow 573 tools
admin
FAQ

Questions about MikroTik MCP

Can an AI agent delete data through the MikroTik MCP server? +

Yes. The MikroTik MCP server exposes 17 destructive tools including mikrotik_clear_logs, mikrotik_remove_dhcp_server, mikrotik_remove_dns_static. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through MikroTik MCP? +

The MikroTik MCP server has 51 write tools including mikrotik_add_blackhole_route, mikrotik_add_default_route, mikrotik_add_dns_regexp. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach MikroTik MCP.

How many tools does the MikroTik MCP server expose? +

124 tools across 3 categories: Destructive, Read, Write. 53 are read-only. 71 can modify, create, or delete data.

How do I enforce a policy on MikroTik MCP? +

Register the MikroTik MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every MikroTik MCP tool call.

Deterministic rules across all 124 MikroTik MCP tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON MIKROTIK →

Instant setup, no code required.

124 MikroTik MCP tools catalogued and risk-classified — across an index of 43,000+ MCP servers.

// GET IN TOUCH

Have a question or want to learn more? Send us a message.

Message sent.

We'll get back to you soon.