One MikroTik MCP server, many routers

Until now, the MikroTik server talked to exactly one router. This change lets a single server manage a whole fleet. Every existing structured tool, more than 170 of them, gains an optional device argument, so the model names a router by its title and never writes raw RouterOS syntax.

The connector picks the target before it executes anything. With one device configured, you can leave the argument out. With several, leaving it out is an error that lists the available titles, and so is an unknown title. A mistake can't silently land on another router. Matching ignores case, and the new list devices tool never returns credentials.

The inventory is a YAML file, and JSON still works because it is a subset. Each entry has a unique title, a host, and credentials. A broken inventory stops the server at startup with one clear message, and validation errors report the position and field name only, so a typo can't leak a password into a log. With no inventory, the old single-device settings still work unchanged. The Docker image mounts the file under slash config.

- title: TitleA
  host: 192.168.88.1
  username: admin
  key_filename: /config/keys/id_ed25519

The first version pooled one SSH client per device. Because the inventory is a shared singleton, every session in the process shared that client, so a timeout in one session could break a command in another, and one slow handshake blocked everything. The author removed pooling. Each command opens its own connection and closes it in a finally block. Safe mode is the exception: it keeps one persistent shell per device, because RouterOS safe mode is a transaction on one session.

The proof comes late, so you know what to look for. One hundred thirty three unit tests pass. The smoke test drives the server over stdio against two live RouterOS containers, and renaming each router produced different system IDs, so the calls reached different machines. Twelve concurrent calls each reached the right router, judged by each container's own MAC address.

RouterA: system id cW+yPDdE1WK
RouterB: system id p9Urq9Hc7+L
12 concurrent calls, all on the right router

Two limits remain. Every command now pays a fresh SSH handshake, tens of milliseconds on a LAN and more on a distant device. And in review, Jeff pointed out that the device note repeated under every tool grows the token cost of loading the server, and asked whether it could move into the system prompt. A reviewer should start with the per-device safe mode manager and the connector, since that is where a wrong router would be reported as success. The title again: one server, many routers.