You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
tik4mcp — Native entity support (most-requested object types)
What "native" means here: a curated, strongly-typed tik4mcp tool surface for a RouterOS object type
— schema-validated read/write — rather than only the raw mikrotik_command. This list prioritizes
which object types to promote to native tools, grounded in (a) the entities tik4net.entities
already ships, (b) real demand from the tik4net issue tracker and MikroTik forum, and
(c) the router-from-scratch provisioning flow that is phase-1's focus.
Legend: ✅ typed entity already exists in tik4net.entities (tik4mcp can wrap it cheaply) ·
⚠️ gap no typed entity yet (tik4mcp would use raw command or a new entity needs adding upstream).
Tiers: P1 must-have · P2 common · P3 advanced/niche.
A. Prioritized object types by domain
System / Management
Path
tik4net entity
Demand signal
Tier
/system/identity
✅ SystemIdentity
First step of every provisioning script
P1
/system/resource
✅ SystemResource
Universal health check
P1
/system/routerboard
✅ SystemRouterboard
Model/firmware info
P2
/system/clock
⚠️ gap
Timezone — needed before certs/scheduler
P1
/system/ntp/client
⚠️ gap
Time sync for logs/certs
P1
/system/backup + /export
⚠️ gap
Backup-before-change, config diffing
P1
/ip/service
⚠️ gap
Service hardening (disable telnet/ftp/www) — security baseline
P1
/system/scheduler
⚠️ gap
Cron automation — frequently scripted
P2
/system/script
⚠️ gap
Stored scripts
P2
/log
✅ Log
Diagnostics — already a tik4mcp tool
P1
/system/health
⚠️ gap
Temp/voltage/fan
P3
/certificate
⚠️ gap
API-SSL/REST-SSL — recurring pain point
P2
Users / Access
Path
tik4net entity
Demand signal
Tier
/user
✅ User
Create agent/admin accounts, lock down default admin
P1
/user/group
✅ UserGroup
RBAC / least-privilege
P1
Interfaces
Path
tik4net entity
Demand signal
Tier
/interface
✅ Interface
List/enable/disable — universal
P1
/interface/ethernet
✅ InterfaceEthernet
Physical port config
P1
/interface/bridge (+/port,/settings)
✅ InterfaceBridge/BridgePort/BridgeSettings
Core L2 topology on RouterOS 7
P1
/interface/vlan
✅ InterfaceVlan
VLAN segmentation — very common
P1
/interface/list (+/member)
⚠️ gap
WAN/LAN grouping for modern firewall — requested (issue #85)
The ordered provisioning flow and the entity set it needs (most already exist in tik4net.entities;
the gaps marked ⚠️ are what to add or drive via raw command first):
Reach the box (no IP yet) — MNDP discover ✅ + WinboxCliMac/MacTelnet ✅ (tik4mcp strength; demand: issue #89 "Connect via MAC Address?").
Identity — /system/identity ✅.
Users / lock down default admin — /user ✅ (+ /user/group ✅): add strong admin/agent account, then change/clear the default admin and disable it.
WAN uplink — /ip/dhcp-client ✅, or /ip/address ✅ (static) / /interface/pppoe-client ✅.
LAN bridge + addressing — /interface/bridge(+/port) ✅, then /ip/address ✅ on the bridge.
Default route — /ip/route ✅ (skip if DHCP/PPPoE supplies it).
DNS — /ip/dns ✅ (servers + allow-remote-requests).
NAT masquerade — /ip/firewall/nat ✅, with /interface/list(+member) ⚠️ defining WAN/LAN.
Highest-value gaps to close for phase-1:/interface/list(+member), /ip/service,
/system/clock, /system/ntp/client, /system/backup+/export. Everything else in the flow already
has a typed entity in tik4net.entities.
C. Common tik4net feature questions / pain points (issue tracker + MikroTik forum)
Connection stability — "Can not read sentence from connection" recurs (issues #61, #82, #83); reboot/shutdown causes IOException (#100). tik4mcp should surface clean errors and not leak these.
RouterOS 7 support — explicit requests (#101 "Support routerOS 7?", #103 v7.18 !empty response). Field/path drift between ROS 6 and 7 affects typed entities.
v6.43+ / v6.45 login — historical auth confusion (#63, #64; forum: Api vs the old Api_v2). The alpha uses the new scheme.
Duplicate fields in a response — forum: /ip/ipsec/remote-peers/print throws on multiple port fields (local-port/remote-port); workaround is .proplist. Also #51/#56. Semantic tools must tolerate repeated keys.
Enum/format parsing — multi-flag enums and values like established,related,untracked threw FormatException (#94, #79); firewall protocol=tcp issue (#52). Be defensive when echoing entity values.
API stricter than the terminal — forum: a slightly wrong path (remote-peer vs remote-peers) yields "no such command prefix"; users also struggle with filter syntax (?src-address=, stack ops ?#|). The raw tool should pass paths through verbatim and document filter form.
SSL/API onboarding — forum: port 8728 refused when the api service is disabled, and ApiSsl cert validation failures. Mirrors the router-init "enable api + switch transport" step.
.id / find semantics — "Get id of any object" (#95), ID numbering (#71), find without .id (#66). The raw tool already exposes .id; semantic tools should too.
Missing entities — interface lists (#85), hotspot ip-binding (forum, since added); and per the entity audit /ip/service, /system/ntp, /interface/wifi, IPsec, OSPF are not yet typed.
Async / listen — LoadAsync with listen/follow (#88); note REST/CLI/WinBox transports don't support Listen/Streaming.
Forum signal strongly validates phase-1. Multiple forum posts wanted MAC-Telnet access and
noted "resetting routers requires workarounds since MAC-telnet lacks .NET support" — exactly the
IP-less provisioning/recovery gap that tik4net 4.x's MAC transports and the router-init skill now
close. /ip/ipsec/remote-peers (read) and /ip/hotspot/ip-binding also surface as real demand.
D. Sources
tik4net repo & entity classes (audited live via the GitHub API — the ✅ list is exact):
github.com/danikf/tik4net, tik4net.objects/
Stack Overflow: could not be retrieved.stackoverflow.com is blocked for Anthropic's web
crawler (HTTP 400 / "unable to fetch" on both fetch and search), so SO answer bodies were not
directly inspected. One question was supplied directly —
SO Q48160658 "How to add profile and user in mikrotik by tik4net"
— its title confirms demand for PPP profile + secret provisioning (corroborated by the forum and
issues #73/#84), but the code/accepted answer could not be read. The forum + issue tracker already
cover the same recurring topics (firewall, DHCP, hotspot, IPsec, PPP, login, SSL).
Note: the ✅/⚠️ split was verified against the live tik4net.objects tree on master. Before
building native tools, re-check the alpha branch in case new entities (e.g. /interface/wifi) have
landed since.