Safe Mode for MikroTik MCP: try a change, then keep it or drop it

1 hour ago

This pull request teaches the MikroTik MCP server to use Safe Mode. The assistant can enable it, make changes on the router, and then either commit them or throw them away. Until it commits, every change lives in memory only, so a dropped connection or a reboot puts the router back the way it was.

Ask about this presentation

Chapters

  1. 0:00The change
  2. 0:19Why
  3. 0:42How it works
  4. 1:08The work
  5. 1:43Review it
Show transcript
  1. This pull request teaches the MikroTik MCP server to use Safe Mode. The assistant can enable it, make changes on the router, and then either commit them or throw them away. Until it commits, every change lives in memory only, so a dropped connection or a reboot puts the router back the way it was.

    Slide text
    Pull request 48 · merged

    The assistant can try a router change, then keep it or drop it

    MikroTik Safe Mode, as four new tools
  2. The pull request describes the goal as preventing accidental misconfigurations. That risk is sharp here, because the assistant manages the router over the same network it is changing. A bad firewall rule or address change can lock it out. Safe Mode is the router's own answer. If the connection is lost, RouterOS undoes everything done since Safe Mode started.

    Slide text
    The problem

    One wrong firewall rule can cut off the assistant's own connection

    Safe Mode reverts everything when the session drops
  3. Safe Mode only works inside an interactive shell, and the server normally opens a fresh connection for every command. So enabling it opens a shell that stays open. The server sends Control X, and RouterOS confirms with a SAFE prompt. Sending Control X a second time commits the changes and ends Safe Mode. To roll back, the server simply closes the session, and RouterOS reverts everything on its own.

    Slide text
    Three moves

    Control X over a shell that stays open

    Enable Open a persistent shell, send Control X. Prompt shows SAFE.
    Commit Send Control X again. Changes are saved, Safe Mode ends.
    Rollback Close the session. RouterOS reverts the changes.
  4. The change adds four tools: enable, commit, rollback and status, each taking the optional device name. The important edit is in the connector. Before it runs a command, it asks whether Safe Mode is active for that router. If so, the command goes through the open shell instead of a new connection. The shell code also strips terminal escape codes, answers the router's terminal probes, and marks the end of each command's output with a sentinel line. Managers are kept per device, so enabling Safe Mode on one router never captures commands meant for another.

    Slide text
    What it touches

    Every command follows the open shell while Safe Mode is on

    enable_safe_mode
    commit_safe_mode
    rollback_safe_mode
    safe_mode_status
    connector.py sends commands through the shell for that router
  5. If you review this, spend your time in two places: how the safe mode module reads and writes the interactive shell, and how the connector decides where a command goes. One limit follows from the design. Anything not committed disappears when the session closes, so a change the assistant wants to keep must be committed before the conversation ends. That is the whole idea: try a change, then keep it or drop it.

    Slide text
    For a reviewer

    Check the shell handling in safe_mode.py and the routing in connector.py

    Uncommitted changes disappear when the session closes. Commit before ending the conversation.

What happened in AI today, in your inbox

One short email each evening. Read it and you’re caught up.

Built with ❤️ in New York