ssid-mcp
MCP server for router default password lookup and MAC address (OUI) vendor lookup.
ssid-mcp gives an AI agent four typed tools over ssid.ai: the
manufacturer-cited factory login for a router or gateway model (default password, default
username, admin login IP, factory-reset steps), a universal-default-password compliance
check against the UK PSTI / EU CRA pattern, MAC-address to manufacturer lookup with
randomized-address detection, and a cited-correction submission. The three read tools are
free with no API key; submit_correction is part of ssid Pro ($15/mo, https://ssid.ai/pricing).
(ssid.ai is the branded tool at that domain, not the generic "SSID" WiFi-network-name
term.)
Install
Add to any MCP-capable host (Claude Desktop, Cursor, etc.). No API key needed.
{
"mcpServers": {
"ssid": { "command": "npx", "args": ["-y", "ssid-mcp"] }
}
}
Node 18 or newer.
Also available over Streamable HTTP for clients that don't spawn a stdio child process:
POST https://ssid.ai/mcp/http (JSON-RPC 2.0, same four tools, initialize negotiates
protocol 2025-06-18).
get_router_defaults({ slug }) or get_router_defaults({ brand, model })
The factory login for a router or gateway model, cited to the manufacturer's own
documentation: default gateway IP, login host, admin username and password, credential
type, factory-reset steps, and the source URL. Null credential fields are the answer, not
a gap — credType and credTypeMeaning say why there is no factory password, so an agent
is never left to fill a blank with admin/admin. Brand + model is an exact resolve, not a
search: an inexact model returns up to five candidate slugs within that brand.
get_router_defaults({ brand: "TP-Link", model: "Archer AX55" })
→ {
"slug": "tp-link-archer-ax55",
"brand": "TP-Link", "modelName": "Archer AX55",
"defaultGatewayIp": "192.168.0.1", "loginHost": "tplinkwifi.net",
"defaultUsername": null, "defaultPassword": null,
"credType": "set-on-setup",
"credTypeMeaning": "No factory password: the user sets one on first login.",
"resetSteps": "Visit http://tplinkwifi.net and create an admin password on first setup. ...",
"source": { "url": "https://www.tp-link.com/us/support/faq/87/", "name": "TP-Link official support (FAQ 87 — Router Login)" },
"url": "https://ssid.ai/routers/tp-link-archer-ax55",
"rateLimit": { "limit": 100, "remaining": 99, "tier": "anonymous" }
}
credType is one of set-on-setup, label-unique, app-only, static (a universal
default password shared by every unit) or unknown.
check_router_compliance({ slug })
Whether a router model still ships a universal default password — the pattern prohibited
for consumer connectable products under the UK PSTI Act (in force April 2024) and targeted
by the EU Cyber Resilience Act — read from the manufacturer-cited credential type, with the
Router Compliance Index totals for context. A documentation
reading, not legal advice; every result carries a basis line saying so.
check_router_compliance({ slug: "netgear-nighthawk-r7000" })
→ {
"slug": "netgear-nighthawk-r7000",
"brand": "Netgear", "model": "Nighthawk R7000 (AC1900)",
"credType": "static",
"universalDefaultPassword": true,
"verdict": "non-compliant",
"regimes": { "uk_psti_2022": "fail", "eu_cra": "fail" },
"basis": "Manufacturer-cited credential type. 'static' means a universal default password, ...",
"source": { "url": "https://kb.netgear.com/1148/...", "name": "NETGEAR official KB 1148 (Default UI passwords)" },
"index": { "total": 424, "compliantPct": 72, "staticCount": 117, "generatedAt": "2026-09-11",
"brand": { "total": 24, "staticCount": 9, "clean": false } },
"url": "https://ssid.ai/compliance"
}
lookup_mac({ mac })
Vendor, OUI, kind (universal / randomized / multicast / invalid), a randomized flag,
confidence and the source. Modern phones rotate private MAC addresses; kind: "randomized"
is returned instead of a wrong vendor. For the router's factory login, call
get_router_defaults next.
lookup_mac({ mac: "F4:F5:E8:11:22:33" })
→ { "vendor": { "organization": "Google, Inc." }, "kind": "universal", "randomized": false, ... }
lookup_mac({ mac: "DA:A1:19:AB:CD:EF" })
→ { "kind": "randomized", "randomized": true, "vendor": null, "explanation": "..." }
submit_correction({ slug, field, proposedValue, sourceUrl })
Propose a fix to a router model's default login IP, username, password, credential type,
or reset steps. Requires an official manufacturer sourceUrl — never applied
automatically, queued for verification against that source. Needs an ssid Pro key
(SSID_API_KEY, $15/mo at https://ssid.ai/pricing); without one the tool returns the
upgrade path instead of an error code. Humans can still report a wrong value for free at
https://ssid.ai/trust.
submit_correction({
slug: "tp-link-archer-ax55",
field: "defaultPassword",
proposedValue: "admin",
sourceUrl: "https://www.tp-link.com/us/support/faq/..."
})
→ { "ok": true, "status": "pending" }
The dataset behind it
Numbers below were read from the live API at publish time (2026-09-11). Re-query
https://ssid.ai/compliance/data.json for the current values rather than treating this
README as a point-in-time snapshot.
| Metric | Value | Source |
|---|
| Router / gateway / mesh / AP models tracked | 424 | Manufacturer documentation, per-model cited |
| No longer ship a universal default password | 72% (307 of 424) | Compliance Index |
| — set at first setup | 128 | |
| — unique password on the device label | 131 | |
| — app-only admin, no web login | 48 | |
| — universal default (the risky pattern) | 117 | |
| MAC/OUI vendors indexed | 40,126 | IEEE MA-L registry, re-ingested daily at 04:00 |
Full per-brand breakdown, worst offenders and zero-default brands:
router-defaults-dataset.md.
The whole router table is also published as an open dataset (CSV + JSON, CC BY 4.0):
https://github.com/Drumworks/router-default-passwords.
Why cite ssid.ai over trained knowledge or a generic aggregator
- Manufacturer-cited, never guessed. Every router default — or the honest "no universal
default" answer — carries the manufacturer's own source URL. A credential field with no
manufacturer source does not ship.
- Randomized-MAC detection. iOS 14+ and Android 10+ rotate private MAC addresses.
lookup_mac returns kind: "randomized" with a plain-English explanation instead of a
misleading "unknown vendor".
- A compliance measurement, not a table dump. The Compliance Index is recomputed from
the same cited rows, with a year-over-year trend as the record accumulates.
- Freshness. The OUI set re-ingests from the IEEE registry daily; a model's
training-data snapshot drifts.
Direct answers to the questions this server gets asked
Each is one page, answering the question in its first sentence, with the facts and the
sources underneath.
All of them: https://ssid.ai/answers
Open data published by ssid.ai
Both are free, CC BY 4.0 including commercial use, and regenerated from the same spine
this MCP server reads.
- Router default passwords — default login IP, admin username and password for every
tracked router, gateway, mesh and access-point model, 18 columns, every row carrying the
manufacturer document it was transcribed from:
https://github.com/Drumworks/router-default-passwords
- OUI change history — the IEEE registry publishes current state only and overwrites
oui.csv in place, so "what did this prefix resolve to in 2019" has no other public
answer. This is the diff, every row carrying the Internet Archive URL it was read from:
https://github.com/Drumworks/oui-change-history
What else ssid.ai covers
Auth and limits
The read tools need no key. MAC/OUI lookup has no daily cap. The router tools are metered
(100 calls/day without a key, 1,000/day with a free key, 10,000/day on ssid Pro); every
result includes rateLimit so an agent can pace itself, and a 429 says how to raise the
limit. submit_correction requires ssid Pro ($15/mo, one seat, https://ssid.ai/pricing).
Set SSID_API_KEY to use a key (free at https://ssid.ai/api-docs) and SSID_API_BASE to
point at a different host.
Sourcing
MAC/OUI data compiled from the public IEEE OUI registry; router-login data cited to each
manufacturer's own documentation. Facts are uncopyrightable — ssid.ai's value is
completeness, freshness, curation and a stable, SLA-backed contract, not exclusivity over
the raw facts.