Isolated networks: a guest network, an IoT network, a segment routed through a VPN tunnel, created so the router actually lists them.
The problem this solves
The obvious way to build one is a bridge with an address, NAT and a Wi-Fi binding. It works: clients associate, get addresses, reach the internet, and stay off the home network. It is also invisible. Nothing appears in the segment list, and the network cannot be managed from the web interface at all.
What the router calls a segment is VLAN-backed. Three steps are missing: a GigabitEthernet0/VlanN subinterface, that VLAN trunked over every switch port, and the subinterface bridged in. The router then computes the iseg block itself, and that is what the web interface reads.
New tools
| Tool | |
|---|---|
create_segment |
the whole sequence in one call: VLAN, bridge, address, NAT, DHCP, and optionally Wi-Fi and a routing policy |
list_segments |
every bridge, with uiVisible per bridge |
delete_segment |
the segment and everything created with it, including the VLAN on every port |
Free identifiers are chosen automatically. The result is verified against iseg rather than against the return value, because the router answers a wrong field name with {} and no error. A failure anywhere rolls the whole thing back and names anything it could not undo.
create_segment { "name": "iot", "ssid": "…", "psk": "…" }
create_segment { "name": "vpn", "permit_interfaces": ["Wireguard1"] }
New skill
keenetic-segments carries the same sequence for doing it by hand through rci_call: the discovery reads that find free identifiers, the build, the verification, and the teardown, including the per-port VLAN removal that gets forgotten and leaves the switch full of orphaned VLANs.
Verified on hardware
Built and torn down on a Keenetic Ultra (KN-1811) running 5.1.3.
ports before access=1 trunk=[2]
ports during access=1 trunk=[2,3]
ports after access=1 trunk=[2]
switchport trunk vlan is additive, so trunking every port leaves the home network and any existing segment on those ports untouched. Two things the live run corrected: Bridge0 has an empty iseg because the home network is untagged rather than a VLAN, and is now reported as home instead of as invisible; and a segment with no Wi-Fi does not appear on the "My networks and Wi-Fi" page, because that page lists Wi-Fi networks. Both are documented in the skill.
Safety, unchanged
Nothing is saved. A segment is discarded on reboot until save_config runs, which makes it cheap to build one, look at it, and change your mind. delete_segment refuses the home segment and leaves any routing policy alone, because policies are shared.
Install
Claude Code
/plugin marketplace add salatmaster/keenetic-mcp
/plugin install keenetic@keenetic
npx -y keenetic-mcp init
Codex
codex plugin marketplace add salatmaster/keenetic-mcp
codex plugin add keenetic@keenetic
npx -y keenetic-mcp init
Anything else
{ "mcpServers": { "keenetic": { "command": "npx", "args": ["-y", "keenetic-mcp"] } } }245 tests. Notes on the API itself are in docs/rci-api.md.