MikroTik RouterOS Plugin

Network infrastructure management with safety built in.

Overview

The MikroTik RouterOS plugin connects directly through the RouterOS API — not SSH. This means structured data, proper authentication, and reliable command execution. Discover routers on your network automatically via CDP/MNDP neighbour discovery, monitor health across all devices, manage DHCP and firewall rules, check VPN tunnel status, and run diagnostics without leaving QuoxCORE.

Every dangerous change requires explicit approval. A four-tier safety system (GREEN/BLUE/AMBER/RED) ensures read-only queries pass through instantly while destructive operations need confirmation and include auto-rollback on failure.

Setup

1. Enable the RouterOS API

On each MikroTik router you want to manage:

/ip service enable api
/ip service set api port=8728

For secure connections, enable api-ssl on port 8729.

2. Create an API user

/user add name=quox group=full password=<strong-password>

Use group=read for read-only monitoring without management capabilities.

3. Configure in QuoxCORE

Open the MikroTik RouterOS plugin from the sidebar. The setup wizard guides you through:

• Entering the router IP and API port
• Testing connectivity
• Running neighbour discovery to find additional routers

Features

Router Discovery

CDP/MNDP neighbour discovery finds MikroTik devices on your network automatically. No manual IP entry required for routers that are neighbours of an already-connected device.

Health Monitoring

Track CPU, memory, temperature, and interface status across all connected routers. Each device gets a combined health score so you can spot degradation before it becomes an outage.

DHCP Management

• List active DHCP leases with hostname and MAC address
• Create static reservations
• Detect IP address conflicts
• MAC vendor lookup for device identification

Firewall Rules

• View active firewall filter and NAT rules
• Block and unblock IP addresses via address lists
• Rule count and chain overview

VPN Health

• WireGuard tunnel monitoring with handshake freshness checks
• IPsec tunnel status and peer connectivity
• Per-tunnel traffic statistics

Network Diagnostics

Run diagnostics directly from the router without Winbox or SSH:

• Ping with packet loss and latency
• Traceroute
• DNS lookups
• MTU path discovery

Alert System

Six alert conditions monitored across all routers:

Safety Levels

MCP Tools

18 entity tools are declared for CommanderQ and automated workflows. 9 have a working reference implementation today; the rest return an honest not-implemented response rather than fabricated data:

• mikrotik.discovery.* — router discovery and neighbour scanning
• mikrotik.monitoring.* — health checks, interface stats, resource usage
• mikrotik.dhcp.* — lease management, reservations, conflict detection
• mikrotik.firewall.* — rule viewing, address list management
• mikrotik.vpn.* — WireGuard and IPsec tunnel status
• mikrotik.diagnostics.* — ping, traceroute, DNS, MTU discovery

Agent

A NETWATCH specialist agent identity exists, intended to act as a patient networking mentor that explains issues using analogies and walks through diagnostics step by step. Its RouterOS tool calls currently point at a collector route that does not exist, so asking NETWATCH about your router in chat does not work yet.

The dashboard panels already show the same health, device, DHCP, and VPN data directly, and that is the reliable way to check a router today. Plain English Mode, where it applies to the panels, translates technical output into clear explanations.

Known limitations

• Two implementations, one capability. The dashboard's RouterOS panels are served by the collector's REST proxy. A separate, verified Go binary-API client is also registered in quoxagent with its own handlers. They are not the same code path and are not yet unified.
• NETWATCH tool-calling does not work yet. The UI panels do; the agent's own RouterOS tool access is not wired.
• 9 of 18 declared MCP tools have no reference implementation anywhere in the codebase yet.
• REST access authenticates over plain HTTP (port 80) because the router's TLS service is closed on the test device. Treat this as insecure-by-default until TLS is available.

Verified live against a real MikroTik CHR (RouterOS 7.16.2): the integration suite passes 16 subtests, including a write with read-back, and the REST proxy returns real data (board type, uptime, and configuration).

Pricing