@usex/mikrotik-mcp 3.10.0 → 3.13.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli.js +18 -10
- package/dist/index.js +18 -10
- package/dist/ui/observability.html +41 -41
- package/package.json +1 -1
- package/prompts/safe-change-workflow.md +47 -0
package/package.json
CHANGED
|
@@ -0,0 +1,47 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: safe-change-workflow
|
|
3
|
+
title: Safe change workflow (snapshot → plan → verify)
|
|
4
|
+
description: Take a local restore point, dry-run a change, apply it safely, and confirm exactly what changed — with zero footprint on the device's disk.
|
|
5
|
+
arguments:
|
|
6
|
+
- name: intent
|
|
7
|
+
description: What you want to change, in plain language (e.g. "add a drop rule for inbound WAN on ether1").
|
|
8
|
+
required: false
|
|
9
|
+
---
|
|
10
|
+
|
|
11
|
+
Make a configuration change to this MikroTik device **safely and reversibly**.
|
|
12
|
+
Follow these steps in order — never skip the snapshot.
|
|
13
|
+
|
|
14
|
+
**Goal:** {{intent}}
|
|
15
|
+
|
|
16
|
+
1. **Take a restore point FIRST (local, no device disk).**
|
|
17
|
+
Call `capture_config_snapshot` before doing anything else. This runs a
|
|
18
|
+
read-only `/export` and stores it in the MCP host's local database
|
|
19
|
+
(`~/.mikrotik-mcp/snapshots.db`). It does **not** create a file on the
|
|
20
|
+
router — there is zero load on the MikroTik device's flash and nothing to
|
|
21
|
+
clean up on the device afterwards. Give it a descriptive `label` (e.g.
|
|
22
|
+
`pre-<change>`). Do **not** use `create_backup` / `create_export` for this —
|
|
23
|
+
those write files to the device's disk; the local snapshot keeps the router
|
|
24
|
+
clean.
|
|
25
|
+
|
|
26
|
+
2. **Dry-run the change.** Translate the intent into RouterOS CLI commands and
|
|
27
|
+
call `plan_changes` to get a risk-scored, lock-out-aware, safely-ordered plan
|
|
28
|
+
without touching the device. Review the warnings (input-chain drops, removal
|
|
29
|
+
of the management IP, etc.).
|
|
30
|
+
|
|
31
|
+
3. **Apply in Safe Mode.** Call `apply_plan` with `confirm=false` first — it
|
|
32
|
+
applies every step inside RouterOS Safe Mode, shows the exact before/after
|
|
33
|
+
diff, then rolls everything back (a true dry-run on the live device). When the
|
|
34
|
+
diff looks right, re-run with `confirm=true` to commit; it only persists if
|
|
35
|
+
the device is still reachable, so a change that would lock you out
|
|
36
|
+
auto-reverts.
|
|
37
|
+
|
|
38
|
+
4. **Verify what changed.** After committing, call `diff_config_snapshots` with
|
|
39
|
+
`from=latest` and `to=live` to confirm the live device matches your intent and
|
|
40
|
+
nothing unexpected drifted.
|
|
41
|
+
|
|
42
|
+
5. **If something is wrong**, read the pre-change snapshot body with
|
|
43
|
+
`get_config_snapshot` (it returns the full `/export` `.rsc` text) and use it to
|
|
44
|
+
reverse the change.
|
|
45
|
+
|
|
46
|
+
Report: the snapshot id you captured, the plan summary, the committed diff, and
|
|
47
|
+
the post-change verification result.
|