YasnaMCP

Category: 8

  • Connect MikroTik (RouterOS) to AI with YasnaMCP

    Connect MikroTik to AI — no API service, no open port

    Your MikroTik router is the centre of most networks, yet almost every question about it still means opening a terminal. With the YasnaMCP MikroTik connector, the router itself connects securely to the assistant: ask “is the firewall configured correctly?”, “which clients are on Wi-Fi?” or “block this address for an hour” in plain language.

    RouterOS Device → YasnaMCP MikroTik Edge → YasnaMCP Server → AI Client

    The architectural point matters: nothing is enabled on the router. No api, no www-ssl, no listening port. The router dials out to YasnaMCP, exactly as it already does for WireGuard — so no new inbound door is opened into your network.

    Step 1 — create a connector in the panel, then paste its token here

    The router joins your own organisation, so it starts with a connector you create in the YasnaMCP panel. Three steps, under a minute:

    1

    Create the connector

    Sign in to the YasnaMCP panel with your organisation’s account and open Connectors. Create a new connector and name it whatever you like — the name is free and is what appears in your connector list.

    2

    Copy its token

    The panel shows a token starting with ymc_ct_. Copy it: it authorises this router to join your organisation, and handing it out is like handing out a building key.

    3

    Enter the router name and the token below

    The token is checked against YasnaMCP immediately. A valid one returns a ready-to-paste install command and confirms your organisation; a wrong or revoked one is reported here, not after installing on the router.

    RouterOS Connector

    کلید اتصال روتر خود را بگیرید

    نام سایت یا شعبه را وارد کنید؛ یک کلید یکتا برای همین روتر ساخته میشود و فرمان نصب، آمادهٔ کپی تحویل داده میشود.

    توکن را در پنل YasnaMCP → Connectors بسازید و کپی کنید. روتر با همین توکن، داخل سازمان خودتان ثبت می‌شود و در فهرست کانکتورهای همان سازمان دیده می‌شود.

    Several routers in one organisation? Create one connector per router and repeat. Each router keeps its own connector, so either can be narrowed or disabled independently.

    Step 2 — run the command on the router

    1

    Open a RouterOS terminal

    In WebFig press New Terminal, or open New Terminal in WinBox. A full administrator account is required: the installer creates a script, a scheduler and a downloaded file.

    2

    Paste the two lines together

    The first line stores three values in the router’s own environment; the second fetches the installer from the site and runs it. Paste both lines at once:

    :global YasnaEdge "https://humanfree.ir/mt"; :global YasnaDevice "mt-xxxxxxxxxx"; :global YasnaToken "ysm_...";
/tool fetch url=("https://humanfree.ir/mt/install/yasna-mt-install.rsc") dst-path="yasna-mt-install.rsc" check-certificate=yes; :delay 1s; /import file-name="yasna-mt-install.rsc"

    The values above are a sample; copy the real ones from the Step 1 card. The installer finishes by reporting the router id, the access level and the operations it may run.

    3

    What it creates on the router

    Three objects and nothing else: the script yasna-mt-agent, a scheduler of the same name that runs one cycle every few seconds, and a downloaded install file. The script runs with read,write,policy,test,ftp,sensitive so that reads, command execution and backups are possible.

    If the installer reports “cannot reach …/install/manifest.json”: check DNS and the router’s outbound path, and more often than not, the router clock. TLS compares certificate dates against it, and a router that booted without NTP fails every HTTPS call. Quick fix: /system ntp client set enabled=yes servers=pool.ntp.org

    Step 3 — confirm the connection

    1

    Run the self-test

    It reports RouterOS version, clock, the service URL, scheduler state, connectivity and the connector’s most recent log lines:

    /system script run yasna-mt-selftest
    2

    What you see in YasnaMCP

    The router appears in the control panel as its own connector, with its name, board model and RouterOS version. “Online” next to the name means the whole path works. Changing configuration needs two permissions at once: the grant in the panel, and write access on the router itself.

    What the assistant can do with a router

    • State: identity, resources (CPU, RAM, storage), board health, RouterOS and package versions, clock and NTP
    • Network: interfaces and counters, bridges, VLANs, WireGuard interfaces and their peers
    • Addressing and routing: addresses, ARP, routes, static DNS
    • DHCP: servers, networks and leases
    • Firewall: filter/nat/mangle/raw rules as JSON, plus address-list management with timeouts
    • Monitoring: ping and traceroute from the router, Netwatch, queues, wireless registration
    • Maintenance: configuration export, backup, update check, controlled reboot
    • Anything else: by running a RouterOS command directly (mikrotik.cli) — full coverage, including menus added after this connector shipped

    Requirements

    • RouterOS 7 (version 6 is not supported; the connector relies on version 7 scripting and JSON)
    • A correct router clock — NTP solves it
    • Outbound HTTPS from the router; a WireGuard tunnel is equally fine
    • Full administrator access for the initial install
    • A YasnaMCP panel account that may create connectors (needed for the token)
    • No extra package, no container and no external disk — which is why it also runs on mipsbe and arm32 boards

    Security and control

    • No service and no listening port is enabled on the router; only an outbound connection
    • Every router has its own key; leaking one does not expose the others
    • A router enrolled here is read-only by default; changing configuration needs a deliberate grant
    • The operation allow-list is enforced on the server and re-checked on the router
    • The key can be revoked at any moment; the router is refused on its next call
    • Every call is recorded in the panel, in the service log and in the router log (topic yasnamcp)

    Download the install files

    The two-line command is all you normally need. If you want to keep the files, or install on a network without internet access, the current build is here:

    FAQ

    Do I have to enable the MikroTik API service?

    No. This connector never uses /ip service api or REST. The router is only an outbound client.

    What happens if the router loses internet?

    Nothing breaks. The router keeps trying every few seconds and resumes by itself. Meanwhile an assistant call answers “the router is offline” instead of an obscure failure.

    How do I widen or narrow the access?

    Two layers: the grant in the YasnaMCP panel, and the operation allow-list on the router. A router enrolled here is read-only; opening configuration changes is a deliberate act by the YasnaMCP team or the router’s administrator.

    How do I remove it?

    Run yasna-mt-uninstall to delete the scheduler, scripts and install files, then revoke the key. Leaving the key unrevoked does not harm the router, but it is a leaked credential.

    Which MikroTik models are supported?

    Any device running RouterOS 7 — hAP and hEX through CCR and CHR, on any architecture (arm64, arm32, mipsbe, x86).