@usex/mikrotik-mcp 3.11.0 → 3.13.0

package/dist/cli.js

@@ -3686,7 +3686,7 @@ var changePlanTools = [
     name: "plan_changes",
     title: "Plan RouterOS Changes (Dry-Run Preview)",
     annotations: READ,
-    description: "Parses a set of intended RouterOS CLI commands locally \u2014 without contacting the device \u2014 " + "and returns a risk-scored, lock-out-aware execution plan. Classifies each command as " + "ADD/MODIFY/REMOVE/OTHER, calculates an overall risk score, emits warnings when commands would " + "drop input-chain traffic or remove the management IP, and reorders steps into the safest " + "sequence (additive changes before destructive ones). Use this to understand what will " + "happen before committing; to execute the plan use apply_plan. Provide commands as an " + "array via `commands`, as a newline-delimited string via `script`, or both \u2014 they are " + "merged. Returns a human-readable plan text and a structured plan object with per-step details.",
+    description: "Parses a set of intended RouterOS CLI commands locally \u2014 without contacting the device \u2014 " + "and returns a risk-scored, lock-out-aware execution plan. Classifies each command as " + "ADD/MODIFY/REMOVE/OTHER, calculates an overall risk score, emits warnings when commands would " + "drop input-chain traffic or remove the management IP, and reorders steps into the safest " + "sequence (additive changes before destructive ones). Use this to understand what will " + "happen before committing; to execute the plan use apply_plan. Provide commands as an " + "array via `commands`, as a newline-delimited string via `script`, or both \u2014 they are " + "merged. Before planning a change, FIRST call capture_config_snapshot to take a restore " + "point \u2014 it stores a local `/export` on the MCP host (~/.mikrotik-mcp/snapshots.db) with " + "zero footprint on the device's disk (no file is written to the router). " + "Returns a human-readable plan text and a structured plan object with per-step details.",
     inputSchema: {
       commands: z10.array(z10.string()).optional().describe("Intended RouterOS CLI commands."),
       script: z10.string().optional().describe("Newline-delimited commands (alternative to `commands`).")
@@ -3706,7 +3706,7 @@ var changePlanTools = [
     name: "apply_plan",
     title: "Apply RouterOS Change Plan in Safe Mode",
     annotations: DANGEROUS,
-    description: "Executes intended RouterOS commands inside RouterOS Safe Mode (activated by Ctrl+X over " + "an interactive SSH shell) and reports the exact unified diff of what changed, computed " + "from `/export terse` snapshots captured before and after execution. With confirm=false " + "(default) it applies all steps, captures the diff, then rolls everything back \u2014 a true " + "dry-run that shows precisely what would change without persisting anything. With " + "confirm=true it commits permanently, but ONLY after verifying the device still responds " + "to `/system identity print` \u2014 a change that would lock you out auto-reverts instead of " + "sticking. Steps execute in the same safe order that plan_changes computes (additive before " + "destructive); if any step returns a RouterOS error the entire plan rolls back immediately. " + "Safe Mode requires SSH \u2014 not available on MAC-Telnet devices. For a no-device preview " + "use plan_changes instead. Returns the plan summary, per-step execution log, unified diff, " + "and commit/rollback outcome.",
+    description: "Executes intended RouterOS commands inside RouterOS Safe Mode (activated by Ctrl+X over " + "an interactive SSH shell) and reports the exact unified diff of what changed, computed " + "from `/export terse` snapshots captured before and after execution. With confirm=false " + "(default) it applies all steps, captures the diff, then rolls everything back \u2014 a true " + "dry-run that shows precisely what would change without persisting anything. With " + "confirm=true it commits permanently, but ONLY after verifying the device still responds " + "to `/system identity print` \u2014 a change that would lock you out auto-reverts instead of " + "sticking. Steps execute in the same safe order that plan_changes computes (additive before " + "destructive); if any step returns a RouterOS error the entire plan rolls back immediately. " + "Safe Mode requires SSH \u2014 not available on MAC-Telnet devices. For a no-device preview " + "use plan_changes instead. ALWAYS call capture_config_snapshot BEFORE this tool to record " + "a restore point \u2014 it stores a local `/export` on the MCP host (~/.mikrotik-mcp/snapshots.db), " + "adding no load to the device's disk and leaving nothing to remove on the router; after the " + "change, diff_config_snapshots (from=latest, to=live) confirms what changed. Returns the " + "plan summary, per-step execution log, unified diff, and commit/rollback outcome.",
     inputSchema: {
       commands: z10.array(z10.string()).optional(),
       script: z10.string().optional(),
@@ -23304,7 +23304,7 @@ function registerPrompts(server) {
 // package.json
 var package_default = {
   name: "@usex/mikrotik-mcp",
-  version: "3.11.0",
+  version: "3.13.0",
   description: "MCP server for MikroTik RouterOS \u2014 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   keywords: [
     "ai",
@@ -23456,7 +23456,20 @@ Safety model \u2014 tools are annotated by risk:
 Before a batch of risky changes, consider enable_safe_mode: RouterOS then holds
 every change in memory and auto-reverts if the session drops, so a mistake that
 locks you out is undone automatically. commit_safe_mode persists; rollback
-discards. Prefer specific filters on list_* tools to keep output small.`;
+discards. Prefer specific filters on list_* tools to keep output small.
+
+Change workflow \u2014 ALWAYS take a restore point before a plan. Before calling
+plan_changes or apply_plan (or any batch of write/destructive tools), first call
+capture_config_snapshot to record the current configuration. These snapshots are
+captured with \`/export\` (a read-only print \u2014 it does NOT create a file on the
+router) and persisted to the MCP host's local database (~/.mikrotik-mcp/
+snapshots.db), so they add ZERO load to the MikroTik device's disk and leave
+nothing to clean up on the device. They survive device reboots/resets. After a
+change, use diff_config_snapshots (from=latest, to=live) to confirm exactly what
+changed, and if something is wrong, get_config_snapshot returns the prior
+\`/export\` text to restore from. Do NOT use create_backup/create_export for this
+pre-change restore point \u2014 those write files to the device's flash; prefer the
+local snapshot to keep the device's disk clean.`;
 var MULTI_DEVICE_INSTRUCTIONS = `
 
 Multiple devices are configured: {{names}} (default: {{default}}). Every tool
@@ -23483,12 +23496,7 @@ function createServer(opts = {}) {
       }
     ]
   }, {
-    capabilities: {
-      tools: { listChanged: true },
-      prompts: { listChanged: true },
-      resources: { listChanged: true },
-      logging: {}
-    },
+    capabilities: {},
     instructions
   });
   const sendLog = opts.sendLog ?? ((level, message) => {

package/dist/index.js

@@ -3698,7 +3698,7 @@ var changePlanTools = [
     name: "plan_changes",
     title: "Plan RouterOS Changes (Dry-Run Preview)",
     annotations: READ,
-    description: "Parses a set of intended RouterOS CLI commands locally \u2014 without contacting the device \u2014 " + "and returns a risk-scored, lock-out-aware execution plan. Classifies each command as " + "ADD/MODIFY/REMOVE/OTHER, calculates an overall risk score, emits warnings when commands would " + "drop input-chain traffic or remove the management IP, and reorders steps into the safest " + "sequence (additive changes before destructive ones). Use this to understand what will " + "happen before committing; to execute the plan use apply_plan. Provide commands as an " + "array via `commands`, as a newline-delimited string via `script`, or both \u2014 they are " + "merged. Returns a human-readable plan text and a structured plan object with per-step details.",
+    description: "Parses a set of intended RouterOS CLI commands locally \u2014 without contacting the device \u2014 " + "and returns a risk-scored, lock-out-aware execution plan. Classifies each command as " + "ADD/MODIFY/REMOVE/OTHER, calculates an overall risk score, emits warnings when commands would " + "drop input-chain traffic or remove the management IP, and reorders steps into the safest " + "sequence (additive changes before destructive ones). Use this to understand what will " + "happen before committing; to execute the plan use apply_plan. Provide commands as an " + "array via `commands`, as a newline-delimited string via `script`, or both \u2014 they are " + "merged. Before planning a change, FIRST call capture_config_snapshot to take a restore " + "point \u2014 it stores a local `/export` on the MCP host (~/.mikrotik-mcp/snapshots.db) with " + "zero footprint on the device's disk (no file is written to the router). " + "Returns a human-readable plan text and a structured plan object with per-step details.",
     inputSchema: {
       commands: z11.array(z11.string()).optional().describe("Intended RouterOS CLI commands."),
       script: z11.string().optional().describe("Newline-delimited commands (alternative to `commands`).")
@@ -3718,7 +3718,7 @@ var changePlanTools = [
     name: "apply_plan",
     title: "Apply RouterOS Change Plan in Safe Mode",
     annotations: DANGEROUS,
-    description: "Executes intended RouterOS commands inside RouterOS Safe Mode (activated by Ctrl+X over " + "an interactive SSH shell) and reports the exact unified diff of what changed, computed " + "from `/export terse` snapshots captured before and after execution. With confirm=false " + "(default) it applies all steps, captures the diff, then rolls everything back \u2014 a true " + "dry-run that shows precisely what would change without persisting anything. With " + "confirm=true it commits permanently, but ONLY after verifying the device still responds " + "to `/system identity print` \u2014 a change that would lock you out auto-reverts instead of " + "sticking. Steps execute in the same safe order that plan_changes computes (additive before " + "destructive); if any step returns a RouterOS error the entire plan rolls back immediately. " + "Safe Mode requires SSH \u2014 not available on MAC-Telnet devices. For a no-device preview " + "use plan_changes instead. Returns the plan summary, per-step execution log, unified diff, " + "and commit/rollback outcome.",
+    description: "Executes intended RouterOS commands inside RouterOS Safe Mode (activated by Ctrl+X over " + "an interactive SSH shell) and reports the exact unified diff of what changed, computed " + "from `/export terse` snapshots captured before and after execution. With confirm=false " + "(default) it applies all steps, captures the diff, then rolls everything back \u2014 a true " + "dry-run that shows precisely what would change without persisting anything. With " + "confirm=true it commits permanently, but ONLY after verifying the device still responds " + "to `/system identity print` \u2014 a change that would lock you out auto-reverts instead of " + "sticking. Steps execute in the same safe order that plan_changes computes (additive before " + "destructive); if any step returns a RouterOS error the entire plan rolls back immediately. " + "Safe Mode requires SSH \u2014 not available on MAC-Telnet devices. For a no-device preview " + "use plan_changes instead. ALWAYS call capture_config_snapshot BEFORE this tool to record " + "a restore point \u2014 it stores a local `/export` on the MCP host (~/.mikrotik-mcp/snapshots.db), " + "adding no load to the device's disk and leaving nothing to remove on the router; after the " + "change, diff_config_snapshots (from=latest, to=live) confirms what changed. Returns the " + "plan summary, per-step execution log, unified diff, and commit/rollback outcome.",
     inputSchema: {
       commands: z11.array(z11.string()).optional(),
       script: z11.string().optional(),
@@ -21707,7 +21707,7 @@ function selectToolModules(filter = {}, catalog = moduleCatalog) {
 // package.json
 var package_default = {
   name: "@usex/mikrotik-mcp",
-  version: "3.11.0",
+  version: "3.13.0",
   description: "MCP server for MikroTik RouterOS \u2014 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   keywords: [
     "ai",
@@ -21859,7 +21859,20 @@ Safety model \u2014 tools are annotated by risk:
 Before a batch of risky changes, consider enable_safe_mode: RouterOS then holds
 every change in memory and auto-reverts if the session drops, so a mistake that
 locks you out is undone automatically. commit_safe_mode persists; rollback
-discards. Prefer specific filters on list_* tools to keep output small.`;
+discards. Prefer specific filters on list_* tools to keep output small.
+
+Change workflow \u2014 ALWAYS take a restore point before a plan. Before calling
+plan_changes or apply_plan (or any batch of write/destructive tools), first call
+capture_config_snapshot to record the current configuration. These snapshots are
+captured with \`/export\` (a read-only print \u2014 it does NOT create a file on the
+router) and persisted to the MCP host's local database (~/.mikrotik-mcp/
+snapshots.db), so they add ZERO load to the MikroTik device's disk and leave
+nothing to clean up on the device. They survive device reboots/resets. After a
+change, use diff_config_snapshots (from=latest, to=live) to confirm exactly what
+changed, and if something is wrong, get_config_snapshot returns the prior
+\`/export\` text to restore from. Do NOT use create_backup/create_export for this
+pre-change restore point \u2014 those write files to the device's flash; prefer the
+local snapshot to keep the device's disk clean.`;
 var MULTI_DEVICE_INSTRUCTIONS = `
 
 Multiple devices are configured: {{names}} (default: {{default}}). Every tool
@@ -21886,12 +21899,7 @@ function createServer(opts = {}) {
       }
     ]
   }, {
-    capabilities: {
-      tools: { listChanged: true },
-      prompts: { listChanged: true },
-      resources: { listChanged: true },
-      logging: {}
-    },
+    capabilities: {},
     instructions
   });
   const sendLog = opts.sendLog ?? ((level, message) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usex/mikrotik-mcp",
-  "version": "3.11.0",
+  "version": "3.13.0",
   "description": "MCP server for MikroTik RouterOS — 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   "keywords": [
     "ai",

package/prompts/safe-change-workflow.md

@@ -0,0 +1,47 @@
+---
+name: safe-change-workflow
+title: Safe change workflow (snapshot → plan → verify)
+description: Take a local restore point, dry-run a change, apply it safely, and confirm exactly what changed — with zero footprint on the device's disk.
+arguments:
+  - name: intent
+    description: What you want to change, in plain language (e.g. "add a drop rule for inbound WAN on ether1").
+    required: false
+---
+
+Make a configuration change to this MikroTik device **safely and reversibly**.
+Follow these steps in order — never skip the snapshot.
+
+**Goal:** {{intent}}
+
+1. **Take a restore point FIRST (local, no device disk).**
+   Call `capture_config_snapshot` before doing anything else. This runs a
+   read-only `/export` and stores it in the MCP host's local database
+   (`~/.mikrotik-mcp/snapshots.db`). It does **not** create a file on the
+   router — there is zero load on the MikroTik device's flash and nothing to
+   clean up on the device afterwards. Give it a descriptive `label` (e.g.
+   `pre-<change>`). Do **not** use `create_backup` / `create_export` for this —
+   those write files to the device's disk; the local snapshot keeps the router
+   clean.
+
+2. **Dry-run the change.** Translate the intent into RouterOS CLI commands and
+   call `plan_changes` to get a risk-scored, lock-out-aware, safely-ordered plan
+   without touching the device. Review the warnings (input-chain drops, removal
+   of the management IP, etc.).
+
+3. **Apply in Safe Mode.** Call `apply_plan` with `confirm=false` first — it
+   applies every step inside RouterOS Safe Mode, shows the exact before/after
+   diff, then rolls everything back (a true dry-run on the live device). When the
+   diff looks right, re-run with `confirm=true` to commit; it only persists if
+   the device is still reachable, so a change that would lock you out
+   auto-reverts.
+
+4. **Verify what changed.** After committing, call `diff_config_snapshots` with
+   `from=latest` and `to=live` to confirm the live device matches your intent and
+   nothing unexpected drifted.
+
+5. **If something is wrong**, read the pre-change snapshot body with
+   `get_config_snapshot` (it returns the full `/export` `.rsc` text) and use it to
+   reverse the change.
+
+Report: the snapshot id you captured, the plan summary, the committed diff, and
+the post-change verification result.