@usex/mikrotik-mcp 3.10.0 → 3.13.0

package/dist/cli.js

@@ -3686,7 +3686,7 @@ var changePlanTools = [
     name: "plan_changes",
     title: "Plan RouterOS Changes (Dry-Run Preview)",
     annotations: READ,
-    description: "Parses a set of intended RouterOS CLI commands locally \u2014 without contacting the device \u2014 " + "and returns a risk-scored, lock-out-aware execution plan. Classifies each command as " + "ADD/MODIFY/REMOVE/OTHER, calculates an overall risk score, emits warnings when commands would " + "drop input-chain traffic or remove the management IP, and reorders steps into the safest " + "sequence (additive changes before destructive ones). Use this to understand what will " + "happen before committing; to execute the plan use apply_plan. Provide commands as an " + "array via `commands`, as a newline-delimited string via `script`, or both \u2014 they are " + "merged. Returns a human-readable plan text and a structured plan object with per-step details.",
+    description: "Parses a set of intended RouterOS CLI commands locally \u2014 without contacting the device \u2014 " + "and returns a risk-scored, lock-out-aware execution plan. Classifies each command as " + "ADD/MODIFY/REMOVE/OTHER, calculates an overall risk score, emits warnings when commands would " + "drop input-chain traffic or remove the management IP, and reorders steps into the safest " + "sequence (additive changes before destructive ones). Use this to understand what will " + "happen before committing; to execute the plan use apply_plan. Provide commands as an " + "array via `commands`, as a newline-delimited string via `script`, or both \u2014 they are " + "merged. Before planning a change, FIRST call capture_config_snapshot to take a restore " + "point \u2014 it stores a local `/export` on the MCP host (~/.mikrotik-mcp/snapshots.db) with " + "zero footprint on the device's disk (no file is written to the router). " + "Returns a human-readable plan text and a structured plan object with per-step details.",
     inputSchema: {
       commands: z10.array(z10.string()).optional().describe("Intended RouterOS CLI commands."),
       script: z10.string().optional().describe("Newline-delimited commands (alternative to `commands`).")
@@ -3706,7 +3706,7 @@ var changePlanTools = [
     name: "apply_plan",
     title: "Apply RouterOS Change Plan in Safe Mode",
     annotations: DANGEROUS,
-    description: "Executes intended RouterOS commands inside RouterOS Safe Mode (activated by Ctrl+X over " + "an interactive SSH shell) and reports the exact unified diff of what changed, computed " + "from `/export terse` snapshots captured before and after execution. With confirm=false " + "(default) it applies all steps, captures the diff, then rolls everything back \u2014 a true " + "dry-run that shows precisely what would change without persisting anything. With " + "confirm=true it commits permanently, but ONLY after verifying the device still responds " + "to `/system identity print` \u2014 a change that would lock you out auto-reverts instead of " + "sticking. Steps execute in the same safe order that plan_changes computes (additive before " + "destructive); if any step returns a RouterOS error the entire plan rolls back immediately. " + "Safe Mode requires SSH \u2014 not available on MAC-Telnet devices. For a no-device preview " + "use plan_changes instead. Returns the plan summary, per-step execution log, unified diff, " + "and commit/rollback outcome.",
+    description: "Executes intended RouterOS commands inside RouterOS Safe Mode (activated by Ctrl+X over " + "an interactive SSH shell) and reports the exact unified diff of what changed, computed " + "from `/export terse` snapshots captured before and after execution. With confirm=false " + "(default) it applies all steps, captures the diff, then rolls everything back \u2014 a true " + "dry-run that shows precisely what would change without persisting anything. With " + "confirm=true it commits permanently, but ONLY after verifying the device still responds " + "to `/system identity print` \u2014 a change that would lock you out auto-reverts instead of " + "sticking. Steps execute in the same safe order that plan_changes computes (additive before " + "destructive); if any step returns a RouterOS error the entire plan rolls back immediately. " + "Safe Mode requires SSH \u2014 not available on MAC-Telnet devices. For a no-device preview " + "use plan_changes instead. ALWAYS call capture_config_snapshot BEFORE this tool to record " + "a restore point \u2014 it stores a local `/export` on the MCP host (~/.mikrotik-mcp/snapshots.db), " + "adding no load to the device's disk and leaving nothing to remove on the router; after the " + "change, diff_config_snapshots (from=latest, to=live) confirms what changed. Returns the " + "plan summary, per-step execution log, unified diff, and commit/rollback outcome.",
     inputSchema: {
       commands: z10.array(z10.string()).optional(),
       script: z10.string().optional(),
@@ -23304,7 +23304,7 @@ function registerPrompts(server) {
 // package.json
 var package_default = {
   name: "@usex/mikrotik-mcp",
-  version: "3.10.0",
+  version: "3.13.0",
   description: "MCP server for MikroTik RouterOS \u2014 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   keywords: [
     "ai",
@@ -23456,7 +23456,20 @@ Safety model \u2014 tools are annotated by risk:
 Before a batch of risky changes, consider enable_safe_mode: RouterOS then holds
 every change in memory and auto-reverts if the session drops, so a mistake that
 locks you out is undone automatically. commit_safe_mode persists; rollback
-discards. Prefer specific filters on list_* tools to keep output small.`;
+discards. Prefer specific filters on list_* tools to keep output small.
+
+Change workflow \u2014 ALWAYS take a restore point before a plan. Before calling
+plan_changes or apply_plan (or any batch of write/destructive tools), first call
+capture_config_snapshot to record the current configuration. These snapshots are
+captured with \`/export\` (a read-only print \u2014 it does NOT create a file on the
+router) and persisted to the MCP host's local database (~/.mikrotik-mcp/
+snapshots.db), so they add ZERO load to the MikroTik device's disk and leave
+nothing to clean up on the device. They survive device reboots/resets. After a
+change, use diff_config_snapshots (from=latest, to=live) to confirm exactly what
+changed, and if something is wrong, get_config_snapshot returns the prior
+\`/export\` text to restore from. Do NOT use create_backup/create_export for this
+pre-change restore point \u2014 those write files to the device's flash; prefer the
+local snapshot to keep the device's disk clean.`;
 var MULTI_DEVICE_INSTRUCTIONS = `
 
 Multiple devices are configured: {{names}} (default: {{default}}). Every tool
@@ -23483,12 +23496,7 @@ function createServer(opts = {}) {
       }
     ]
   }, {
-    capabilities: {
-      tools: { listChanged: true },
-      prompts: { listChanged: true },
-      resources: { listChanged: true },
-      logging: {}
-    },
+    capabilities: {},
     instructions
   });
   const sendLog = opts.sendLog ?? ((level, message) => {

package/dist/index.js

@@ -3698,7 +3698,7 @@ var changePlanTools = [
     name: "plan_changes",
     title: "Plan RouterOS Changes (Dry-Run Preview)",
     annotations: READ,
-    description: "Parses a set of intended RouterOS CLI commands locally \u2014 without contacting the device \u2014 " + "and returns a risk-scored, lock-out-aware execution plan. Classifies each command as " + "ADD/MODIFY/REMOVE/OTHER, calculates an overall risk score, emits warnings when commands would " + "drop input-chain traffic or remove the management IP, and reorders steps into the safest " + "sequence (additive changes before destructive ones). Use this to understand what will " + "happen before committing; to execute the plan use apply_plan. Provide commands as an " + "array via `commands`, as a newline-delimited string via `script`, or both \u2014 they are " + "merged. Returns a human-readable plan text and a structured plan object with per-step details.",
+    description: "Parses a set of intended RouterOS CLI commands locally \u2014 without contacting the device \u2014 " + "and returns a risk-scored, lock-out-aware execution plan. Classifies each command as " + "ADD/MODIFY/REMOVE/OTHER, calculates an overall risk score, emits warnings when commands would " + "drop input-chain traffic or remove the management IP, and reorders steps into the safest " + "sequence (additive changes before destructive ones). Use this to understand what will " + "happen before committing; to execute the plan use apply_plan. Provide commands as an " + "array via `commands`, as a newline-delimited string via `script`, or both \u2014 they are " + "merged. Before planning a change, FIRST call capture_config_snapshot to take a restore " + "point \u2014 it stores a local `/export` on the MCP host (~/.mikrotik-mcp/snapshots.db) with " + "zero footprint on the device's disk (no file is written to the router). " + "Returns a human-readable plan text and a structured plan object with per-step details.",
     inputSchema: {
       commands: z11.array(z11.string()).optional().describe("Intended RouterOS CLI commands."),
       script: z11.string().optional().describe("Newline-delimited commands (alternative to `commands`).")
@@ -3718,7 +3718,7 @@ var changePlanTools = [
     name: "apply_plan",
     title: "Apply RouterOS Change Plan in Safe Mode",
     annotations: DANGEROUS,
-    description: "Executes intended RouterOS commands inside RouterOS Safe Mode (activated by Ctrl+X over " + "an interactive SSH shell) and reports the exact unified diff of what changed, computed " + "from `/export terse` snapshots captured before and after execution. With confirm=false " + "(default) it applies all steps, captures the diff, then rolls everything back \u2014 a true " + "dry-run that shows precisely what would change without persisting anything. With " + "confirm=true it commits permanently, but ONLY after verifying the device still responds " + "to `/system identity print` \u2014 a change that would lock you out auto-reverts instead of " + "sticking. Steps execute in the same safe order that plan_changes computes (additive before " + "destructive); if any step returns a RouterOS error the entire plan rolls back immediately. " + "Safe Mode requires SSH \u2014 not available on MAC-Telnet devices. For a no-device preview " + "use plan_changes instead. Returns the plan summary, per-step execution log, unified diff, " + "and commit/rollback outcome.",
+    description: "Executes intended RouterOS commands inside RouterOS Safe Mode (activated by Ctrl+X over " + "an interactive SSH shell) and reports the exact unified diff of what changed, computed " + "from `/export terse` snapshots captured before and after execution. With confirm=false " + "(default) it applies all steps, captures the diff, then rolls everything back \u2014 a true " + "dry-run that shows precisely what would change without persisting anything. With " + "confirm=true it commits permanently, but ONLY after verifying the device still responds " + "to `/system identity print` \u2014 a change that would lock you out auto-reverts instead of " + "sticking. Steps execute in the same safe order that plan_changes computes (additive before " + "destructive); if any step returns a RouterOS error the entire plan rolls back immediately. " + "Safe Mode requires SSH \u2014 not available on MAC-Telnet devices. For a no-device preview " + "use plan_changes instead. ALWAYS call capture_config_snapshot BEFORE this tool to record " + "a restore point \u2014 it stores a local `/export` on the MCP host (~/.mikrotik-mcp/snapshots.db), " + "adding no load to the device's disk and leaving nothing to remove on the router; after the " + "change, diff_config_snapshots (from=latest, to=live) confirms what changed. Returns the " + "plan summary, per-step execution log, unified diff, and commit/rollback outcome.",
     inputSchema: {
       commands: z11.array(z11.string()).optional(),
       script: z11.string().optional(),
@@ -21707,7 +21707,7 @@ function selectToolModules(filter = {}, catalog = moduleCatalog) {
 // package.json
 var package_default = {
   name: "@usex/mikrotik-mcp",
-  version: "3.10.0",
+  version: "3.13.0",
   description: "MCP server for MikroTik RouterOS \u2014 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   keywords: [
     "ai",
@@ -21859,7 +21859,20 @@ Safety model \u2014 tools are annotated by risk:
 Before a batch of risky changes, consider enable_safe_mode: RouterOS then holds
 every change in memory and auto-reverts if the session drops, so a mistake that
 locks you out is undone automatically. commit_safe_mode persists; rollback
-discards. Prefer specific filters on list_* tools to keep output small.`;
+discards. Prefer specific filters on list_* tools to keep output small.
+
+Change workflow \u2014 ALWAYS take a restore point before a plan. Before calling
+plan_changes or apply_plan (or any batch of write/destructive tools), first call
+capture_config_snapshot to record the current configuration. These snapshots are
+captured with \`/export\` (a read-only print \u2014 it does NOT create a file on the
+router) and persisted to the MCP host's local database (~/.mikrotik-mcp/
+snapshots.db), so they add ZERO load to the MikroTik device's disk and leave
+nothing to clean up on the device. They survive device reboots/resets. After a
+change, use diff_config_snapshots (from=latest, to=live) to confirm exactly what
+changed, and if something is wrong, get_config_snapshot returns the prior
+\`/export\` text to restore from. Do NOT use create_backup/create_export for this
+pre-change restore point \u2014 those write files to the device's flash; prefer the
+local snapshot to keep the device's disk clean.`;
 var MULTI_DEVICE_INSTRUCTIONS = `
 
 Multiple devices are configured: {{names}} (default: {{default}}). Every tool
@@ -21886,12 +21899,7 @@ function createServer(opts = {}) {
       }
     ]
   }, {
-    capabilities: {
-      tools: { listChanged: true },
-      prompts: { listChanged: true },
-      resources: { listChanged: true },
-      logging: {}
-    },
+    capabilities: {},
     instructions
   });
   const sendLog = opts.sendLog ?? ((level, message) => {