Deterministic Network Engineering
Meets Modern AI Agents

MikroTik-Skill provides Model Context Protocol (MCP) tooling and OpenAPI 3.1.0 specifications for LLMs. Generate mathematically certified multi-WAN PCC configurations, Curve25519 WireGuard keypairs, 7-pillar security audits, and 10-track blueprints without exposing credentials.

$ npx mikrotik-skill mcp

10 Tracks

Certified Blueprints

MTCNA through MTCWE RouterOS v7 scripts

14 Tools

Model Context Protocol

Zero-friction tool-calling for LLM agents

0 Secrets

Air-Gapped Cloud Mode

Pure reference logic without storing router tokens

REST & 8728

Dual Transport Engine

Native REST API with binary port fallback

Secure Dual-Architecture Pipeline

Guarantees zero credential leakage by separating cloud intelligence from private router execution.

AIR-GAPPED CLOUD GATEWAY (Vercel)

Knowledge & Synthesis

• Public SSE endpoint (/sse) & OpenAPI (/openapi.json)
• Asymmetric PCC GCD stream calculations
• Curve25519 Road-Warrior WireGuard provisioning
• Static NetDevOps script linting & credential masking
• Zero router IP, user, or password credentials accepted

LOCAL RUNTIME (Your Machine / Bastion)

Execution & Safe Watchdog

• Local CLI binary (mtik) & stdio MCP server
• Direct connection to LAN/VPN router (REST or Port 8728)
• Automated 30-second safe-mode rollback watchdog
• Live 7-pillar security audit & Mangle placement checks
• Multi-router fleet inventory (inventory.yml)

Connect to Your AI Agent & IDE

Configure Cursor, Windsurf, Claude Desktop, VS Code, ChatGPT, or Claude Code in seconds.

.cursor/mcp.json

Zero-Credential Engineering Workbench

Perform complex network calculations, keypair generation, and script audits directly in your browser or through the API.

Raw RouterOS Script or /export Content

Sanitized Output (Safe to share with AI or public repositories)

WAN Interfaces & Bandwidth Ratios

Classifier

LAN Bridge / Interface

RouterOS v7 Script

Client Identifier

Client VPN IP & Subnet

Router Public Endpoint

Router WireGuard Public Key

Venue / Brand Name

Authentication Model

Voucher Rate Limit

Walled Garden Payment Gateway

Hotspot DNS Name

Free Trial Limit

Deploy to router flash storage: scp -P 22 login.html admin@<router-ip>:/flash/hotspot/

RouterOS .rsc Script

Select Certification Track: ROUTEROS V7

Certified configuration script blueprint

Loading template...

Model Context Protocol (MCP) Tools Reference

Standardized tools exposed by MikroTik-Skill for LLMs, autonomous coding agents, and IDE extensions.

Tool Name	Environment	Description & Capabilities
`mikrotik_generate_template`	Air-Gapped	Generates production configuration scripts across all 10 certification tracks (MTCNA to MTCWE) with vendor-neutral naming.
`mikrotik_generate_hotspot_portal`	Air-Gapped	Generates production-ready `login.html`, `status.html`, and RouterOS v7 walled-garden configuration script supporting Voucher PINs, Member logins, Google OAuth relay, and Free Trial access.
`mikrotik_calculate_pcc`	Air-Gapped	Calculates normalized asymmetric N-WAN PCC load balancing ratios with strict bypass priority ordering.
`mikrotik_provision_wireguard`	Air-Gapped	Generates Curve25519 Road-Warrior keypairs, client `.conf`, router CLI commands, and QR code DataURLs.
`mikrotik_lint_config`	Air-Gapped	Static security audit and credential leak detection on RouterOS v7 `.rsc` scripts without executing code.
`mikrotik_migrate_filter`	Air-Gapped	Transpiles legacy RouterOS v6 routing filter rules to modern RouterOS v7 rule engine syntax (`if ... then`).
`mikrotik_sanitize_config`	Air-Gapped	Masks MAC addresses, serial numbers, passwords, and VPN tokens from raw scripts or exports.
`mikrotik_validate_routing_mark`	Air-Gapped	Verifies that proposed routing tables exist in `/routing table` with `fib=yes` before Mangle injection.
`mikrotik_get_chat_prompt`	Air-Gapped	Exports certified RouterOS Senior Network Engineer prompt guidelines tailored for ChatGPT or Claude.
`mikrotik_list_devices`	Fleet Local	Enumerates all managed routers defined in `inventory.yml`, saved profiles, or environment variables.
`mikrotik_get_logs`	Router Live	Queries live system, firewall, DHCP, and VPN logs with topic filtering and entry limits.
`mikrotik_manage_poe`	Router Live	Inspects PoE port status, voltage, and power consumption, or power-cycles downstream APs and cameras.
`mikrotik_manage_queues`	Router Live	Inspects Simple Queues or deploys low-latency CAKE SQM queue types to resolve bufferbloat.
`mikrotik_get_wireless_clients`	Router Live	Lists connected WiFi clients across RouterOS v7 wifiwave2/wifi or legacy wireless registration tables.
`mikrotik_test_connection`	Router Live	Validates router reachability, latency, and transport fallback (REST API vs Native API Port 8728).
`mikrotik_audit_security`	Router Live	Runs automated 7-Pillar Security Audit (DNS open resolver, sensitive ports, NTP drift, Hairpin NAT Mangle).

REST API & Protocol Endpoints

Zero-credential HTTP endpoints callable via standard HTTP clients or curl.

Endpoint	Method	Description	Example Request
/sse	`GET`	MCP Server-Sent Events stream for AI agents	`curl -N https://mikrotik-skill.vercel.app/sse`
/openapi.json	`GET`	OpenAPI 3.1.0 schema for ChatGPT Actions	`curl https://mikrotik-skill.vercel.app/openapi.json`
/api/v1/knowledge/tracks	`GET`	List all 10 MikroTik Certification track blueprints	`curl https://mikrotik-skill.vercel.app/api/v1/knowledge/tracks`
/api/v1/knowledge/template	`GET`	Fetch specific track script (e.g. `?track=mtcre`)	`curl "https://mikrotik-skill.vercel.app/api/v1/knowledge/template?track=mtcse"`
/api/v1/knowledge/pcc	`POST`	Calculate asymmetric multi-WAN PCC script	`curl -X POST https://mikrotik-skill.vercel.app/api/v1/knowledge/pcc -d '{"wans":[{"name":"ISP1","weight":2},{"name":"ISP2","weight":1}]}' -H 'Content-Type: application/json'`
/api/v1/knowledge/hotspot	`POST`	Generate captive portal bundle (login.html, status.html, .rsc)	`curl -X POST https://mikrotik-skill.vercel.app/api/v1/knowledge/hotspot -d '{"venueName":"My Cafe","model":"voucher"}' -H 'Content-Type: application/json'`
/api/v1/knowledge/wireguard	`POST`	Provision Road-Warrior WireGuard peer & QR	`curl -X POST https://mikrotik-skill.vercel.app/api/v1/knowledge/wireguard -d '{"clientName":"alice","clientIp":"10.10.0.2/24","serverEndpoint":"vpn.example.com:13231","serverPublicKey":"..."}' -H 'Content-Type: application/json'`
/api/v1/knowledge/lint	`POST`	Audit RouterOS .rsc script for vulnerabilities	`curl -X POST https://mikrotik-skill.vercel.app/api/v1/knowledge/lint -d '{"script":"/user add name=admin password=123"}' -H 'Content-Type: application/json'`
/api/v1/knowledge/sanitize	`POST`	Redact credentials and identifiers offline	`curl -X POST https://mikrotik-skill.vercel.app/api/v1/knowledge/sanitize -d '{"configText":"mac-address=00:11:22:33:44:55"}' -H 'Content-Type: application/json'`
/llms.txt	`GET`	Curated LLM crawler index & documentation sitemap	`curl https://mikrotik-skill.vercel.app/llms.txt`
/llms-full.txt	`GET`	Complete technical knowledge base and all 10 scripts	`curl https://mikrotik-skill.vercel.app/llms-full.txt`

Deterministic Network Engineering Meets Modern AI Agents