AsusWRT MCP Server

mcp-name: io.github.teefloo/asuswrt-mcp

Model Context Protocol (MCP) server for secure, controlled administration of AsusWRT and AsusWRT-Merlin routers via SSH.

Overview

This MCP server provides AI assistants (like Claude, Cursor, etc.) with a safe interface to monitor and manage AsusWRT routers. It operates exclusively over SSH using allowlisted operations—no arbitrary command execution, no firmware modifications, and no factory resets.

Features

Read-Only Monitoring (42 tools)

| Category | Tools | |----------|-------| | Identity & Health | Router model, firmware version, uptime, load, memory | | Network | LAN/WAN details, DNS config, IPv6 status, routing table | | Clients | Connected clients, DHCP leases, ARP neighbors | | Wireless | Radio status, SSIDs, guest networks, client counts per band | | Services | Running processes, open ports, cron jobs | | Storage | USB devices, mounts, partitions, filesystem usage | | Security | UPnP, DDNS, Samba status, conntrack usage | | VPN | OpenVPN server, WireGuard, VPN client profiles | | Administration | Web admin ports, SSH/telnet access settings | | Diagnostics | SSH TCP/banner/auth diagnostics, config snapshot |

Mutation Tools (with safety guards)

All mutation tools require:

• confirm: true parameter
• ASUSWRT_ALLOW_MUTATIONS=true environment variable
• Support for dry_run: true to preview changes

| Tool | Description | |------|-------------| | asuswrt_restart_service | Restart allowlisted services (httpd, firewall, wireless, dnsmasq, etc.) | | asuswrt_dhcp_server | Enable/disable DHCP server | | asuswrt_upnp | Enable/disable UPnP | | asuswrt_radio | Enable/disable Wi-Fi radio bands | | asuswrt_guest_wifi | Enable/disable guest Wi-Fi | | asuswrt_guest_lan_access | Toggle LAN access for guest Wi-Fi | | asuswrt_port_forwarding | List, add, remove, enable/disable port forwarding rules | | asuswrt_vpn_server | Enable/disable OpenVPN server | | asuswrt_parental_access | List, block, unblock, remove parental control rules | | asuswrt_parental_block_all | Toggle block-all mode | | asuswrt_dhcp_reservation | List, add, remove DHCP static reservations |

Safety Model

• No arbitrary SSH: Only allowlisted commands are executed via NVRAM and service calls
• No firmware operations: No flash, reset, or bootloader access
• Secret redaction: Passwords and sensitive data are never exposed in tool responses
• Dry-run support: Every mutation can be previewed before applying
• Confirmation required: Mutations require explicit confirm=True
• SSH-only transport: No exposure of the router's web API

Prerequisites

• Python 3.11+
• An AsusWRT or AsusWRT-Merlin router with SSH access enabled
• Network connectivity from the MCP client to the router

Installation

1. Clone and setup

git clone https://github.com/Teeflo/asuswrt-mcp.git
cd asuswrt-mcp

# Create virtual environment
python -m venv .venv

# Activate (Linux/macOS)
source .venv/bin/activate

# Activate (Windows)
.venv\Scripts\activate

# Install dependencies
pip install -e .

2. Configure environment

# Copy example configuration
cp .env.example .env

# Edit with your router credentials
# Use your favorite editor:
notepad .env        # Windows
nano .env           # Linux/macOS

3. Configure .env

# Required: Router connection
ASUSWRT_HOST=192.168.1.1
ASUSWRT_SSH_USERNAME=admin
ASUSWRT_SSH_PASSWORD=your_password

# Optional: SSH key authentication
# ASUSWRT_SSH_KEY_FILE=~/.ssh/id_rsa

# Optional: Enable mutations (disabled by default)
# ASUSWRT_ALLOW_MUTATIONS=true

# Optional: Connection settings
# ASUSWRT_SSH_PORT=22
# ASUSWRT_TIMEOUT_SECONDS=10

Usage

Run the MCP server

# Standard stdio mode
python -m asuswrt_mcp.server

# Or use the entry point
asuswrt-mcp

Configure in Claude Desktop / Cursor

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "asuswrt-mcp": {
      "command": "C:\\path\\to\\asuswrt-mcp\\.venv\\Scripts\\python.exe",
      "args": ["-m", "asuswrt_mcp.server"],
      "env": {
        "ASUSWRT_HOST": "192.168.1.1",
        "ASUSWRT_SSH_USERNAME": "admin",
        "ASUSWRT_SSH_PASSWORD": "your_password"
      }
    }
  }
}

Using with npx Inspector (development)

npx @modelcontextprotocol/inspector python -m asuswrt_mcp.server

Development

Run tests

pip install -e ".[dev]"
pytest

Run with live router integration tests

ASUSWRT_TEST_ROUTER=1 pytest

Project Structure

asuswrt-mcp/
├── src/asuswrt_mcp/
│   ├── server.py          # FastMCP entrypoint & tool definitions
│   ├── service.py         # Business logic & router operations
│   ├── config.py          # Settings management
│   ├── clients/
│   │   └── ssh.py         # SSH client wrapper
│   ├── nvram.py           # NVRAM parsing utilities
│   ├── ssh_parsers.py     # Output parsers for SSH commands
│   ├── security.py        # Mutation guards & redaction
│   ├── validators.py      # Input validation
│   ├── responses.py       # Tool response formatting
│   ├── errors.py          # Custom exceptions
│   └── serialization.py   # Safe serialization
├── tests/                 # Test suite (69 tests)
├── .env.example           # Example configuration
├── pyproject.toml         # Project metadata
└── README.md              # This file

License

MIT License - see LICENSE for details.

Acknowledgments

• asusrouter for the underlying Python library
• MCP for the protocol specification
• AsusWRT-Merlin for the firmware