I Made REGENT: An MCP Server for Configuring OpenWrt Routers Through an AI

A developer created REGENT, an MCP server that gives AI-controlled root access to OpenWrt routers, allowing natural-language configuration and diagnosis. The tool reads the entire router configuration in one pass, identifies specific misconfigurations, and applies fixes with automatic rollback protection. It uses a three-level access gate and watchdog rollback to ensure safe operation.

A while ago my own OpenWrt router simply stopped passing traffic, and everything in the web interface looked perfectly fine. It took me a whole afternoon to find the cause: four separate misconfigurations, each enough to stop traffic on its own, none of them visible on the page where I had set them up This became the reason for creating REGENT — a server that lets an AI read the entire router at once, tell you what is actually broken, and fix it in plain language, without ever touching the command line yourself REGENT is an MCP server that hands an AI controlled root access to an OpenWrt router. You describe what the network should do in ordinary words, and it works out which uci and ubus commands that takes, in which order, and which service has to reload before the change means anything. It handles ordinary OpenWrt configuration across network, Wi-Fi, firewall, packages and services, and goes deepest on the routed client mode scenario, where the router joins an upstream Wi-Fi network and shares that connection onward with the VPN and ad-blocking the upstream cannot provide REGENT speaks the Model Context Protocol over stdin and stdout, so the AI client spawns it directly and no network ports are ever opened. It holds a single reused SSH session to the router and turns natural-language intent into ordered uci , ubus and opkg calls. Rather than dumping the raw configuration, its topology tool reads the whole router in one pass and names the specific misconfigurations that leave a router looking healthy while nothing works Every change is guarded on two fronts. A three-level access gate keeps reading always available, while writes need an explicit gate and destructive actions need a separate confirmation on each call. And before any risky change, the configuration is snapshotted and a deferred restore is armed on the router itself — if connectivity is confirmed afterwards the restore is cancelled, and if it is not, the router puts itself back on its own Example diagnosis: UPLINK wwan via phy1-sta0, 192.168.1.4/24, gateway 192.168.1.1 SERVES lan 192.168.1.1/24 DHCP OFF AP HomeNet 2.4 GHz → wwan2 WARNINGS 4 lan is on the same subnet as the uplink — the gateway resolves to this router itself and nothing routes out access point HomeNet is attached to 'wwan2', which is not up dhcp is not serving lan — clients must be configured by hand the uplink sits in zone lan, which does not masquerade Natural-Language Configuration Say what the network should do, and REGENT works out the exact uci and ubus commands, their order, and the service reload each one needs Diagnosis, Not a Dump Its topology tool reads the whole configuration in one call and reports what is broken and why it stops traffic, instead of a listing to interpret by hand Whole Recipes Composite intents like "share the uplink with clients" run as one ordered change across several config files, so the AI never has to reassemble the steps itself Watchdog Rollback Before a risky change the router is snapshotted and a restore is armed on the device itself, so a change that severs your own connection is undone automatically Three Levels of Access Reading always works, changing needs the write gate open, and rebooting, flashing or resetting need the gate plus a separate confirmation on each call Secrets Stay In Wi-Fi passwords, VPN keys and subscription links are stripped before anything reaches the model, the command log, or the system log apk Support — package handling on OpenWrt 24.10 and newer, where opkg became apk Wider Device Coverage — verification beyond the single TP-Link Archer C59 confirmed so far Guest Network — a separate isolated Wi-Fi brought up in one intent