@usex/mikrotik-mcp 3.11.0 → 3.14.0

package/dist/cli.js

@@ -3686,7 +3686,7 @@ var changePlanTools = [
     name: "plan_changes",
     title: "Plan RouterOS Changes (Dry-Run Preview)",
     annotations: READ,
-    description: "Parses a set of intended RouterOS CLI commands locally \u2014 without contacting the device \u2014 " + "and returns a risk-scored, lock-out-aware execution plan. Classifies each command as " + "ADD/MODIFY/REMOVE/OTHER, calculates an overall risk score, emits warnings when commands would " + "drop input-chain traffic or remove the management IP, and reorders steps into the safest " + "sequence (additive changes before destructive ones). Use this to understand what will " + "happen before committing; to execute the plan use apply_plan. Provide commands as an " + "array via `commands`, as a newline-delimited string via `script`, or both \u2014 they are " + "merged. Returns a human-readable plan text and a structured plan object with per-step details.",
+    description: "Parses a set of intended RouterOS CLI commands locally \u2014 without contacting the device \u2014 " + "and returns a risk-scored, lock-out-aware execution plan. Classifies each command as " + "ADD/MODIFY/REMOVE/OTHER, calculates an overall risk score, emits warnings when commands would " + "drop input-chain traffic or remove the management IP, and reorders steps into the safest " + "sequence (additive changes before destructive ones). Use this to understand what will " + "happen before committing; to execute the plan use apply_plan. Provide commands as an " + "array via `commands`, as a newline-delimited string via `script`, or both \u2014 they are " + "merged. Before planning a change, FIRST call capture_config_snapshot to take a restore " + "point \u2014 it stores a local `/export` on the MCP host (~/.mikrotik-mcp/snapshots.db) with " + "zero footprint on the device's disk (no file is written to the router). " + "Returns a human-readable plan text and a structured plan object with per-step details.",
     inputSchema: {
       commands: z10.array(z10.string()).optional().describe("Intended RouterOS CLI commands."),
       script: z10.string().optional().describe("Newline-delimited commands (alternative to `commands`).")
@@ -3706,7 +3706,7 @@ var changePlanTools = [
     name: "apply_plan",
     title: "Apply RouterOS Change Plan in Safe Mode",
     annotations: DANGEROUS,
-    description: "Executes intended RouterOS commands inside RouterOS Safe Mode (activated by Ctrl+X over " + "an interactive SSH shell) and reports the exact unified diff of what changed, computed " + "from `/export terse` snapshots captured before and after execution. With confirm=false " + "(default) it applies all steps, captures the diff, then rolls everything back \u2014 a true " + "dry-run that shows precisely what would change without persisting anything. With " + "confirm=true it commits permanently, but ONLY after verifying the device still responds " + "to `/system identity print` \u2014 a change that would lock you out auto-reverts instead of " + "sticking. Steps execute in the same safe order that plan_changes computes (additive before " + "destructive); if any step returns a RouterOS error the entire plan rolls back immediately. " + "Safe Mode requires SSH \u2014 not available on MAC-Telnet devices. For a no-device preview " + "use plan_changes instead. Returns the plan summary, per-step execution log, unified diff, " + "and commit/rollback outcome.",
+    description: "Executes intended RouterOS commands inside RouterOS Safe Mode (activated by Ctrl+X over " + "an interactive SSH shell) and reports the exact unified diff of what changed, computed " + "from `/export terse` snapshots captured before and after execution. With confirm=false " + "(default) it applies all steps, captures the diff, then rolls everything back \u2014 a true " + "dry-run that shows precisely what would change without persisting anything. With " + "confirm=true it commits permanently, but ONLY after verifying the device still responds " + "to `/system identity print` \u2014 a change that would lock you out auto-reverts instead of " + "sticking. Steps execute in the same safe order that plan_changes computes (additive before " + "destructive); if any step returns a RouterOS error the entire plan rolls back immediately. " + "Safe Mode requires SSH \u2014 not available on MAC-Telnet devices. For a no-device preview " + "use plan_changes instead. ALWAYS call capture_config_snapshot BEFORE this tool to record " + "a restore point \u2014 it stores a local `/export` on the MCP host (~/.mikrotik-mcp/snapshots.db), " + "adding no load to the device's disk and leaving nothing to remove on the router; after the " + "change, diff_config_snapshots (from=latest, to=live) confirms what changed. Returns the " + "plan summary, per-step execution log, unified diff, and commit/rollback outcome.",
     inputSchema: {
       commands: z10.array(z10.string()).optional(),
       script: z10.string().optional(),
@@ -12722,7 +12722,7 @@ var openvpnTools = [
     name: "get_ovpn_server",
     title: "Get OpenVPN Server Configuration",
     annotations: READ,
-    description: "Read the OpenVPN server settings (`/interface ovpn-server server print`) \u2014 the singleton" + " inbound-server instance (enabled state, certificate, auth/cipher algorithms, port, protocol," + " netmask, mode, max_mtu, default_profile, require_client_certificate). Use set_ovpn_server to" + " modify these settings. For outbound OVPN tunnels to a remote server use list_ovpn_clients or" + " get_ovpn_client. For other VPN tunnel types use create_l2tp_client, create_pptp_client, or" + " create_sstp_client. Returns the full server parameter block or a not-found message.",
+    description: "`get_ovpn_server` \u2014 READ / get / show / inspect the OpenVPN (OVPN) server settings and status" + " (`/interface ovpn-server server print`) \u2014 the singleton inbound-server instance: whether it is" + " enabled/running, certificate, auth/cipher algorithms, port, protocol, netmask, mode, max_mtu," + " default_profile, require_client_certificate. Use set_ovpn_server to modify these settings. For" + " outbound OVPN tunnels to a remote server use list_ovpn_clients or get_ovpn_client. For other VPN" + " tunnel types use create_l2tp_client, create_pptp_client, or create_sstp_client. Returns the full" + " server parameter block or a not-found message.",
     async handler(_a, ctx) {
       ctx.info("Getting OpenVPN server configuration");
       const result = await executeMikrotikCommand("/interface ovpn-server server print", ctx);
@@ -12806,7 +12806,7 @@ ${redactSecrets(details)}` : "OpenVPN client creation completed but unable to ve
     name: "list_ovpn_clients",
     title: "List OpenVPN Client Interfaces",
     annotations: READ,
-    description: "List all OpenVPN client interfaces (`/interface ovpn-client print`) configured on this" + " router, optionally filtered by partial interface name (name_filter). Use this to enumerate" + " existing OVPN uplinks and their connection status before calling get_ovpn_client," + " enable_ovpn_client, disable_ovpn_client, or remove_ovpn_client. For inbound server" + " settings use get_ovpn_server. For L2TP, PPTP, or SSTP tunnels use the respective tools." + " Returns a redacted table of all matching OVPN client interfaces.",
+    description: "`list_ovpn_clients` \u2014 READ / list / show / inspect / enumerate all OpenVPN (OVPN) client" + " interfaces (`/interface ovpn-client print`) and whether each tunnel is running/connected," + " optionally filtered by partial interface name (name_filter). Returns each client's name," + " running status, remote server (connect-to), port, mode and user. Use this to read existing OVPN" + " uplinks and their status before calling get_ovpn_client, enable_ovpn_client," + " disable_ovpn_client, or remove_ovpn_client. For inbound server settings use get_ovpn_server." + " For L2TP, PPTP, or SSTP tunnels use the respective tools." + " Returns a redacted table of all matching OVPN client interfaces.",
     inputSchema: {
       name_filter: z67.string().optional().describe("Partial name match")
     },
@@ -12825,7 +12825,7 @@ ${redactSecrets(result)}`;
     name: "get_ovpn_client",
     title: "Get OpenVPN Client Interface Detail",
     annotations: READ,
-    description: "Fetch detailed settings for a specific OpenVPN client interface by name" + " (`/interface ovpn-client print detail where name=...`). Use list_ovpn_clients first to" + " enumerate available interface names. For the inbound OVPN server settings use" + " get_ovpn_server. Returns the full interface detail with secrets redacted, or a not-found" + " message if the name does not exist.",
+    description: "`get_ovpn_client` \u2014 READ / get / show / inspect one OpenVPN (OVPN) client interface's full" + " detail and running status by name (`/interface ovpn-client print detail where name=...`):" + " running/connected state, remote server (connect-to), port, mode, user, profile, certificate," + " cipher and auth. Use list_ovpn_clients first to enumerate available interface names. For the" + " inbound OVPN server settings use get_ovpn_server. Returns the full interface detail with" + " secrets redacted, or a not-found message if the name does not exist.",
     inputSchema: { name: z67.string() },
     async handler(a, ctx) {
       ctx.info(`Getting OpenVPN client details: name=${a.name}`);
@@ -23304,7 +23304,7 @@ function registerPrompts(server) {
 // package.json
 var package_default = {
   name: "@usex/mikrotik-mcp",
-  version: "3.11.0",
+  version: "3.14.0",
   description: "MCP server for MikroTik RouterOS \u2014 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   keywords: [
     "ai",
@@ -23456,7 +23456,20 @@ Safety model \u2014 tools are annotated by risk:
 Before a batch of risky changes, consider enable_safe_mode: RouterOS then holds
 every change in memory and auto-reverts if the session drops, so a mistake that
 locks you out is undone automatically. commit_safe_mode persists; rollback
-discards. Prefer specific filters on list_* tools to keep output small.`;
+discards. Prefer specific filters on list_* tools to keep output small.
+
+Change workflow \u2014 ALWAYS take a restore point before a plan. Before calling
+plan_changes or apply_plan (or any batch of write/destructive tools), first call
+capture_config_snapshot to record the current configuration. These snapshots are
+captured with \`/export\` (a read-only print \u2014 it does NOT create a file on the
+router) and persisted to the MCP host's local database (~/.mikrotik-mcp/
+snapshots.db), so they add ZERO load to the MikroTik device's disk and leave
+nothing to clean up on the device. They survive device reboots/resets. After a
+change, use diff_config_snapshots (from=latest, to=live) to confirm exactly what
+changed, and if something is wrong, get_config_snapshot returns the prior
+\`/export\` text to restore from. Do NOT use create_backup/create_export for this
+pre-change restore point \u2014 those write files to the device's flash; prefer the
+local snapshot to keep the device's disk clean.`;
 var MULTI_DEVICE_INSTRUCTIONS = `
 
 Multiple devices are configured: {{names}} (default: {{default}}). Every tool
@@ -23483,12 +23496,7 @@ function createServer(opts = {}) {
       }
     ]
   }, {
-    capabilities: {
-      tools: { listChanged: true },
-      prompts: { listChanged: true },
-      resources: { listChanged: true },
-      logging: {}
-    },
+    capabilities: {},
     instructions
   });
   const sendLog = opts.sendLog ?? ((level, message) => {

package/dist/index.js

@@ -3698,7 +3698,7 @@ var changePlanTools = [
     name: "plan_changes",
     title: "Plan RouterOS Changes (Dry-Run Preview)",
     annotations: READ,
-    description: "Parses a set of intended RouterOS CLI commands locally \u2014 without contacting the device \u2014 " + "and returns a risk-scored, lock-out-aware execution plan. Classifies each command as " + "ADD/MODIFY/REMOVE/OTHER, calculates an overall risk score, emits warnings when commands would " + "drop input-chain traffic or remove the management IP, and reorders steps into the safest " + "sequence (additive changes before destructive ones). Use this to understand what will " + "happen before committing; to execute the plan use apply_plan. Provide commands as an " + "array via `commands`, as a newline-delimited string via `script`, or both \u2014 they are " + "merged. Returns a human-readable plan text and a structured plan object with per-step details.",
+    description: "Parses a set of intended RouterOS CLI commands locally \u2014 without contacting the device \u2014 " + "and returns a risk-scored, lock-out-aware execution plan. Classifies each command as " + "ADD/MODIFY/REMOVE/OTHER, calculates an overall risk score, emits warnings when commands would " + "drop input-chain traffic or remove the management IP, and reorders steps into the safest " + "sequence (additive changes before destructive ones). Use this to understand what will " + "happen before committing; to execute the plan use apply_plan. Provide commands as an " + "array via `commands`, as a newline-delimited string via `script`, or both \u2014 they are " + "merged. Before planning a change, FIRST call capture_config_snapshot to take a restore " + "point \u2014 it stores a local `/export` on the MCP host (~/.mikrotik-mcp/snapshots.db) with " + "zero footprint on the device's disk (no file is written to the router). " + "Returns a human-readable plan text and a structured plan object with per-step details.",
     inputSchema: {
       commands: z11.array(z11.string()).optional().describe("Intended RouterOS CLI commands."),
       script: z11.string().optional().describe("Newline-delimited commands (alternative to `commands`).")
@@ -3718,7 +3718,7 @@ var changePlanTools = [
     name: "apply_plan",
     title: "Apply RouterOS Change Plan in Safe Mode",
     annotations: DANGEROUS,
-    description: "Executes intended RouterOS commands inside RouterOS Safe Mode (activated by Ctrl+X over " + "an interactive SSH shell) and reports the exact unified diff of what changed, computed " + "from `/export terse` snapshots captured before and after execution. With confirm=false " + "(default) it applies all steps, captures the diff, then rolls everything back \u2014 a true " + "dry-run that shows precisely what would change without persisting anything. With " + "confirm=true it commits permanently, but ONLY after verifying the device still responds " + "to `/system identity print` \u2014 a change that would lock you out auto-reverts instead of " + "sticking. Steps execute in the same safe order that plan_changes computes (additive before " + "destructive); if any step returns a RouterOS error the entire plan rolls back immediately. " + "Safe Mode requires SSH \u2014 not available on MAC-Telnet devices. For a no-device preview " + "use plan_changes instead. Returns the plan summary, per-step execution log, unified diff, " + "and commit/rollback outcome.",
+    description: "Executes intended RouterOS commands inside RouterOS Safe Mode (activated by Ctrl+X over " + "an interactive SSH shell) and reports the exact unified diff of what changed, computed " + "from `/export terse` snapshots captured before and after execution. With confirm=false " + "(default) it applies all steps, captures the diff, then rolls everything back \u2014 a true " + "dry-run that shows precisely what would change without persisting anything. With " + "confirm=true it commits permanently, but ONLY after verifying the device still responds " + "to `/system identity print` \u2014 a change that would lock you out auto-reverts instead of " + "sticking. Steps execute in the same safe order that plan_changes computes (additive before " + "destructive); if any step returns a RouterOS error the entire plan rolls back immediately. " + "Safe Mode requires SSH \u2014 not available on MAC-Telnet devices. For a no-device preview " + "use plan_changes instead. ALWAYS call capture_config_snapshot BEFORE this tool to record " + "a restore point \u2014 it stores a local `/export` on the MCP host (~/.mikrotik-mcp/snapshots.db), " + "adding no load to the device's disk and leaving nothing to remove on the router; after the " + "change, diff_config_snapshots (from=latest, to=live) confirms what changed. Returns the " + "plan summary, per-step execution log, unified diff, and commit/rollback outcome.",
     inputSchema: {
       commands: z11.array(z11.string()).optional(),
       script: z11.string().optional(),
@@ -12734,7 +12734,7 @@ var openvpnTools = [
     name: "get_ovpn_server",
     title: "Get OpenVPN Server Configuration",
     annotations: READ,
-    description: "Read the OpenVPN server settings (`/interface ovpn-server server print`) \u2014 the singleton" + " inbound-server instance (enabled state, certificate, auth/cipher algorithms, port, protocol," + " netmask, mode, max_mtu, default_profile, require_client_certificate). Use set_ovpn_server to" + " modify these settings. For outbound OVPN tunnels to a remote server use list_ovpn_clients or" + " get_ovpn_client. For other VPN tunnel types use create_l2tp_client, create_pptp_client, or" + " create_sstp_client. Returns the full server parameter block or a not-found message.",
+    description: "`get_ovpn_server` \u2014 READ / get / show / inspect the OpenVPN (OVPN) server settings and status" + " (`/interface ovpn-server server print`) \u2014 the singleton inbound-server instance: whether it is" + " enabled/running, certificate, auth/cipher algorithms, port, protocol, netmask, mode, max_mtu," + " default_profile, require_client_certificate. Use set_ovpn_server to modify these settings. For" + " outbound OVPN tunnels to a remote server use list_ovpn_clients or get_ovpn_client. For other VPN" + " tunnel types use create_l2tp_client, create_pptp_client, or create_sstp_client. Returns the full" + " server parameter block or a not-found message.",
     async handler(_a, ctx) {
       ctx.info("Getting OpenVPN server configuration");
       const result = await executeMikrotikCommand("/interface ovpn-server server print", ctx);
@@ -12818,7 +12818,7 @@ ${redactSecrets(details)}` : "OpenVPN client creation completed but unable to ve
     name: "list_ovpn_clients",
     title: "List OpenVPN Client Interfaces",
     annotations: READ,
-    description: "List all OpenVPN client interfaces (`/interface ovpn-client print`) configured on this" + " router, optionally filtered by partial interface name (name_filter). Use this to enumerate" + " existing OVPN uplinks and their connection status before calling get_ovpn_client," + " enable_ovpn_client, disable_ovpn_client, or remove_ovpn_client. For inbound server" + " settings use get_ovpn_server. For L2TP, PPTP, or SSTP tunnels use the respective tools." + " Returns a redacted table of all matching OVPN client interfaces.",
+    description: "`list_ovpn_clients` \u2014 READ / list / show / inspect / enumerate all OpenVPN (OVPN) client" + " interfaces (`/interface ovpn-client print`) and whether each tunnel is running/connected," + " optionally filtered by partial interface name (name_filter). Returns each client's name," + " running status, remote server (connect-to), port, mode and user. Use this to read existing OVPN" + " uplinks and their status before calling get_ovpn_client, enable_ovpn_client," + " disable_ovpn_client, or remove_ovpn_client. For inbound server settings use get_ovpn_server." + " For L2TP, PPTP, or SSTP tunnels use the respective tools." + " Returns a redacted table of all matching OVPN client interfaces.",
     inputSchema: {
       name_filter: z68.string().optional().describe("Partial name match")
     },
@@ -12837,7 +12837,7 @@ ${redactSecrets(result)}`;
     name: "get_ovpn_client",
     title: "Get OpenVPN Client Interface Detail",
     annotations: READ,
-    description: "Fetch detailed settings for a specific OpenVPN client interface by name" + " (`/interface ovpn-client print detail where name=...`). Use list_ovpn_clients first to" + " enumerate available interface names. For the inbound OVPN server settings use" + " get_ovpn_server. Returns the full interface detail with secrets redacted, or a not-found" + " message if the name does not exist.",
+    description: "`get_ovpn_client` \u2014 READ / get / show / inspect one OpenVPN (OVPN) client interface's full" + " detail and running status by name (`/interface ovpn-client print detail where name=...`):" + " running/connected state, remote server (connect-to), port, mode, user, profile, certificate," + " cipher and auth. Use list_ovpn_clients first to enumerate available interface names. For the" + " inbound OVPN server settings use get_ovpn_server. Returns the full interface detail with" + " secrets redacted, or a not-found message if the name does not exist.",
     inputSchema: { name: z68.string() },
     async handler(a, ctx) {
       ctx.info(`Getting OpenVPN client details: name=${a.name}`);
@@ -21707,7 +21707,7 @@ function selectToolModules(filter = {}, catalog = moduleCatalog) {
 // package.json
 var package_default = {
   name: "@usex/mikrotik-mcp",
-  version: "3.11.0",
+  version: "3.14.0",
   description: "MCP server for MikroTik RouterOS \u2014 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   keywords: [
     "ai",
@@ -21859,7 +21859,20 @@ Safety model \u2014 tools are annotated by risk:
 Before a batch of risky changes, consider enable_safe_mode: RouterOS then holds
 every change in memory and auto-reverts if the session drops, so a mistake that
 locks you out is undone automatically. commit_safe_mode persists; rollback
-discards. Prefer specific filters on list_* tools to keep output small.`;
+discards. Prefer specific filters on list_* tools to keep output small.
+
+Change workflow \u2014 ALWAYS take a restore point before a plan. Before calling
+plan_changes or apply_plan (or any batch of write/destructive tools), first call
+capture_config_snapshot to record the current configuration. These snapshots are
+captured with \`/export\` (a read-only print \u2014 it does NOT create a file on the
+router) and persisted to the MCP host's local database (~/.mikrotik-mcp/
+snapshots.db), so they add ZERO load to the MikroTik device's disk and leave
+nothing to clean up on the device. They survive device reboots/resets. After a
+change, use diff_config_snapshots (from=latest, to=live) to confirm exactly what
+changed, and if something is wrong, get_config_snapshot returns the prior
+\`/export\` text to restore from. Do NOT use create_backup/create_export for this
+pre-change restore point \u2014 those write files to the device's flash; prefer the
+local snapshot to keep the device's disk clean.`;
 var MULTI_DEVICE_INSTRUCTIONS = `
 
 Multiple devices are configured: {{names}} (default: {{default}}). Every tool
@@ -21886,12 +21899,7 @@ function createServer(opts = {}) {
       }
     ]
   }, {
-    capabilities: {
-      tools: { listChanged: true },
-      prompts: { listChanged: true },
-      resources: { listChanged: true },
-      logging: {}
-    },
+    capabilities: {},
     instructions
   });
   const sendLog = opts.sendLog ?? ((level, message) => {