I Made REGENT: An MCP Server for Configuring OpenWrt Routers Through an AI

我开发了 REGENT：一个通过 AI 配置 OpenWrt 路由器的 MCP 服务器

A while ago my own OpenWrt router simply stopped passing traffic, and everything in the web interface looked perfectly fine. It took me a whole afternoon to find the cause: four separate misconfigurations, each enough to stop traffic on its own, none of them visible on the page where I had set them up. This became the reason for creating REGENT — a server that lets an AI read the entire router at once, tell you what is actually broken, and fix it in plain language, without ever touching the command line yourself.

前段时间，我自己的 OpenWrt 路由器突然无法传输流量，但 Web 管理界面上的一切看起来都完全正常。我花了一整个下午才找到原因：四个独立的配置错误，每一个都足以导致流量中断，且在设置它们的页面上完全看不出来。这就是我创建 REGENT 的原因——它是一个 MCP 服务器，允许 AI 一次性读取整个路由器的状态，告诉你哪里出了问题，并用通俗易懂的语言修复它，而无需你亲自触碰命令行。

What is it?

它是什么？

REGENT is an MCP server that hands an AI controlled root access to an OpenWrt router. You describe what the network should do in ordinary words, and it works out which uci and ubus commands that takes, in which order, and which service has to reload before the change means anything. It handles ordinary OpenWrt configuration across network, Wi-Fi, firewall, packages and services, and goes deepest on the routed client mode scenario, where the router joins an upstream Wi-Fi network and shares that connection onward with the VPN and ad-blocking the upstream cannot provide.

REGENT 是一个 MCP 服务器，它将受控的 root 权限交给 AI 来管理 OpenWrt 路由器。你只需用普通的语言描述网络需求，它就能计算出需要哪些 uci 和 ubus 命令、执行顺序，以及在更改生效前需要重启哪些服务。它涵盖了 OpenWrt 在网络、Wi-Fi、防火墙、软件包和服务方面的常规配置，并深入支持“路由客户端模式”（routed client mode）场景，即路由器连接上游 Wi-Fi 网络，并通过 VPN 和广告拦截功能将该连接共享给下游，而这些功能是上游网络无法提供的。

How does it work?

它是如何工作的？

REGENT speaks the Model Context Protocol over stdin and stdout, so the AI client spawns it directly and no network ports are ever opened. It holds a single reused SSH session to the router and turns natural-language intent into ordered uci, ubus and opkg calls. Rather than dumping the raw configuration, its topology tool reads the whole router in one pass and names the specific misconfigurations that leave a router looking healthy while nothing works.

REGENT 通过标准输入（stdin）和标准输出（stdout）使用模型上下文协议（MCP），因此 AI 客户端可以直接启动它，无需打开任何网络端口。它保持一个复用的 SSH 会话连接到路由器，并将自然语言意图转换为有序的 uci、ubus 和 opkg 调用。与其直接转储原始配置，它的拓扑工具会一次性读取整个路由器状态，并指出那些导致路由器看起来正常却无法工作的具体配置错误。

Every change is guarded on two fronts. A three-level access gate keeps reading always available, while writes need an explicit gate and destructive actions need a separate confirmation on each call. And before any risky change, the configuration is snapshotted and a deferred restore is armed on the router itself — if connectivity is confirmed afterwards the restore is cancelled, and if it is not, the router puts itself back on its own.

每一次更改都有双重保护。三级访问控制确保读取功能始终可用，而写入操作需要明确的权限门控，破坏性操作则需要每次调用时进行单独确认。在进行任何风险操作前，系统会拍摄配置快照，并在路由器上设置延迟恢复任务——如果更改后连接确认正常，则取消恢复任务；如果连接中断，路由器会自动恢复到之前的状态。

Example diagnosis:

诊断示例：

UPLINK wwan via phy1-sta0, 192.168.1.4/24, gateway 192.168.1.1
SERVES lan 192.168.1.1/24 DHCP OFF
AP HomeNet 2.4 GHz → wwan2
WARNINGS 4
! lan is on the same subnet as the uplink — the gateway resolves to this router itself and nothing routes out
! access point HomeNet is attached to 'wwan2', which is not up
! dhcp is not serving lan — clients must be configured by hand
! the uplink sits in zone lan, which does not masquerade

Key Features:

核心功能：

Natural-Language Configuration: Say what the network should do, and REGENT works out the exact uci and ubus commands, their order, and the service reload each one needs. 自然语言配置：说出你想要的网络需求，REGENT 会计算出确切的 uci 和 ubus 命令、执行顺序以及所需的各项服务重启。
Diagnosis, Not a Dump: Its topology tool reads the whole configuration in one call and reports what is broken and why it stops traffic, instead of a listing to interpret by hand. 诊断而非转储：其拓扑工具通过一次调用读取完整配置，并报告哪里损坏以及为何导致流量中断，而不是给你一堆需要手动解读的列表。
Whole Recipes: Composite intents like “share the uplink with clients” run as one ordered change across several config files, so the AI never has to reassemble the steps itself. 完整方案：像“与客户端共享上游连接”这样的复合意图，会作为跨多个配置文件的有序更改一次性执行，因此 AI 无需自行重新组合步骤。
Watchdog Rollback: Before a risky change the router is snapshotted and a restore is armed on the device itself, so a change that severs your own connection is undone automatically. 看门狗回滚：在风险更改前，路由器会拍摄快照并在设备上设置恢复任务，因此如果更改导致连接中断，系统会自动撤销更改。
Three Levels of Access: Reading always works, changing needs the write gate open, and rebooting, flashing or resetting need the gate plus a separate confirmation on each call. 三级访问控制：读取始终可用，更改需要开启写入权限，而重启、刷机或重置则需要权限门控外加每次调用的单独确认。
Secrets Stay In: Wi-Fi passwords, VPN keys and subscription links are stripped before anything reaches the model, the command log, or the system log. 隐私保护：Wi-Fi 密码、VPN 密钥和订阅链接在发送给模型、命令日志或系统日志之前都会被剔除。

Roadmap:

路线图：

apk Support: Package handling on OpenWrt 24.10 and newer, where opkg became apk. apk 支持：针对 OpenWrt 24.10 及更新版本（opkg 已变更为 apk）的软件包处理支持。
Wider Device Coverage: Verification beyond the single TP-Link Archer C59 confirmed so far. 更广泛的设备覆盖：目前仅在 TP-Link Archer C59 上验证过，未来将支持更多设备。
Guest Network: A separate isolated Wi-Fi brought up in one intent. 访客网络：通过一个意图即可建立独立的隔离 Wi-Fi。

Repository Link: https://github.com/m-o-z-z-i-x/REGENT