@usex/mikrotik-mcp 3.15.0 → 3.17.0

package/dist/cli.js

@@ -13070,6 +13070,152 @@ ${result}`;
 ${details}`;
     }
   }),
+  defineTool({
+    name: "add_ovpn_server",
+    title: "Add Named OpenVPN Server",
+    annotations: WRITE,
+    description: "Add a named inbound OpenVPN server instance (`/interface ovpn-server server add`) \u2014 the" + " RouterOS 7.17+ multi-server model, where several OVPN servers can run side by side, each on" + " its own port/certificate/profile. Provide a unique name; port defaults to 1194. Supports" + " protocol (tcp/udp), ip or ethernet mode, certificate, auth/cipher algorithm lists, netmask," + " max_mtu, default_profile, mac_address (ethernet mode) and require_client_certificate. For the" + " legacy single-server (selector-less) menu on older RouterOS use set_ovpn_server. To remove a" + " named server use remove_ovpn_server; to list them use list_ovpn_servers. For outbound tunnels" + " use create_ovpn_client. Returns the created server's detail including its name.",
+    inputSchema: {
+      name: z68.string().describe("Unique name for the new OpenVPN server instance"),
+      port: z68.number().int().default(1194),
+      protocol: z68.enum(["tcp", "udp"]).optional(),
+      mode: z68.enum(["ip", "ethernet"]).optional(),
+      netmask: z68.number().int().optional(),
+      mac_address: z68.string().optional().describe("Server MAC for ethernet mode"),
+      certificate: z68.string().optional(),
+      auth: z68.string().optional().describe("Comma-separated, e.g. 'sha256,sha1'"),
+      cipher: z68.string().optional().describe("Comma-separated, e.g. 'aes256-cbc,aes256-gcm'"),
+      max_mtu: z68.number().int().optional(),
+      default_profile: z68.string().optional(),
+      require_client_certificate: z68.boolean().optional(),
+      comment: z68.string().optional(),
+      disabled: z68.boolean().default(false)
+    },
+    async handler(a, ctx) {
+      ctx.info(`Adding OpenVPN server: name=${a.name}`);
+      const cmd = new Cmd("/interface ovpn-server server add").set("name", a.name).opt("port", a.port).opt("protocol", a.protocol).opt("mode", a.mode).opt("netmask", a.netmask).opt("mac-address", a.mac_address).opt("certificate", a.certificate).opt("auth", a.auth).opt("cipher", a.cipher).opt("max-mtu", a.max_mtu).opt("default-profile", a.default_profile).bool("require-client-certificate", a.require_client_certificate).opt("comment", a.comment).flag("disabled", a.disabled).build();
+      const result = await executeMikrotikCommand(cmd, ctx);
+      if (containsRawParserError(result)) {
+        return "Failed to add OpenVPN server: this RouterOS build does not support named OpenVPN" + " server instances (the multi-server model requires RouterOS 7.17+). Use set_ovpn_server" + ` to configure the single legacy server instead.
+
+${result}`;
+      }
+      if (looksLikeError(result))
+        return `Failed to add OpenVPN server: ${result}`;
+      const details = await executeMikrotikCommand(`/interface ovpn-server server print detail where name="${a.name}"`, ctx);
+      return details.trim() ? `OpenVPN server '${a.name}' added successfully:
+
+${details}` : "OpenVPN server creation completed but unable to verify.";
+    }
+  }),
+  defineTool({
+    name: "list_ovpn_servers",
+    title: "List Named OpenVPN Servers",
+    annotations: READ,
+    description: "`list_ovpn_servers` \u2014 READ / list / show / inspect all named OpenVPN server instances" + " (`/interface ovpn-server server print detail`) on the RouterOS 7.17+ multi-server model," + " optionally filtered by partial name (name_filter). Returns each server's name, port, protocol," + " certificate, profile and disabled state. Pass a name_filter to fetch one server's full detail" + " (this doubles as get-by-name). The `.id`/name values feed update_ovpn_server," + " remove_ovpn_server, enable_ovpn_server and disable_ovpn_server. For the legacy single-server" + " menu use get_ovpn_server; for outbound tunnels use list_ovpn_clients.",
+    inputSchema: {
+      name_filter: z68.string().optional().describe("Partial name match")
+    },
+    async handler(a, ctx) {
+      ctx.info("Listing OpenVPN servers");
+      const filters = [];
+      if (a.name_filter)
+        filters.push(`name~"${a.name_filter}"`);
+      const result = await executeMikrotikCommand(`/interface ovpn-server server print detail${whereClause(filters)}`, ctx);
+      return isEmpty(result) ? "No named OpenVPN servers found (the device may use the legacy single-server menu \u2014 try get_ovpn_server)." : `OPENVPN SERVERS:
+
+${result}`;
+    }
+  }),
+  defineTool({
+    name: "update_ovpn_server",
+    title: "Update Named OpenVPN Server",
+    annotations: WRITE_IDEMPOTENT,
+    description: "Modify a named OpenVPN server instance (`/interface ovpn-server server set [find name=...]`) on" + " the RouterOS 7.17+ multi-server model \u2014 change port, protocol, mode, certificate, auth/cipher," + " netmask, max_mtu, default_profile, mac_address, comment or require_client_certificate without" + " recreating it. To toggle only the enabled state use enable_ovpn_server / disable_ovpn_server." + " To create a server use add_ovpn_server; to remove one use remove_ovpn_server. For the legacy" + " single-server menu use set_ovpn_server. Returns the updated server's detail.",
+    inputSchema: {
+      name: z68.string().describe("Existing OpenVPN server instance name"),
+      port: z68.number().int().optional(),
+      protocol: z68.enum(["tcp", "udp"]).optional(),
+      mode: z68.enum(["ip", "ethernet"]).optional(),
+      netmask: z68.number().int().optional(),
+      mac_address: z68.string().optional(),
+      certificate: z68.string().optional(),
+      auth: z68.string().optional(),
+      cipher: z68.string().optional(),
+      max_mtu: z68.number().int().optional(),
+      default_profile: z68.string().optional(),
+      require_client_certificate: z68.boolean().optional(),
+      comment: z68.string().optional()
+    },
+    async handler(a, ctx) {
+      ctx.info(`Updating OpenVPN server: name=${a.name}`);
+      const base = `/interface ovpn-server server set [find name="${a.name}"]`;
+      const cmd = new Cmd(base).opt("port", a.port).opt("protocol", a.protocol).opt("mode", a.mode).opt("netmask", a.netmask).opt("mac-address", a.mac_address).opt("certificate", a.certificate).opt("auth", a.auth).opt("cipher", a.cipher).opt("max-mtu", a.max_mtu).opt("default-profile", a.default_profile).bool("require-client-certificate", a.require_client_certificate).opt("comment", a.comment).build();
+      if (cmd === base)
+        return "No updates specified.";
+      const count = await executeMikrotikCommand(`/interface ovpn-server server print count-only where name="${a.name}"`, ctx);
+      if (count.trim() === "0")
+        return `OpenVPN server '${a.name}' not found.`;
+      const result = await executeMikrotikCommand(cmd, ctx);
+      if (looksLikeError(result))
+        return `Failed to update OpenVPN server: ${result}`;
+      const details = await executeMikrotikCommand(`/interface ovpn-server server print detail where name="${a.name}"`, ctx);
+      return `OpenVPN server '${a.name}' updated successfully:
+
+${details}`;
+    }
+  }),
+  defineTool({
+    name: "remove_ovpn_server",
+    title: "Remove Named OpenVPN Server",
+    annotations: DESTRUCTIVE,
+    description: "Permanently delete a named OpenVPN server instance (`/interface ovpn-server server remove" + " [find name=...]`) on the RouterOS 7.17+ multi-server model \u2014 verifies existence with a" + " count-only check before deleting. Use list_ovpn_servers to confirm the name. To stop a server" + " without deleting it use disable_ovpn_server. This does not touch the legacy single-server menu" + " (use set_ovpn_server with enabled=false for that) or any OVPN clients. Returns a success or" + " not-found message.",
+    inputSchema: { name: z68.string() },
+    async handler(a, ctx) {
+      ctx.info(`Removing OpenVPN server: name=${a.name}`);
+      const count = await executeMikrotikCommand(`/interface ovpn-server server print count-only where name="${a.name}"`, ctx);
+      if (count.trim() === "0")
+        return `OpenVPN server '${a.name}' not found.`;
+      const result = await executeMikrotikCommand(`/interface ovpn-server server remove [find name="${a.name}"]`, ctx);
+      if (looksLikeError(result))
+        return `Failed to remove OpenVPN server: ${result}`;
+      return `OpenVPN server '${a.name}' removed successfully.`;
+    }
+  }),
+  defineTool({
+    name: "enable_ovpn_server",
+    title: "Enable Named OpenVPN Server",
+    annotations: WRITE_IDEMPOTENT,
+    description: "Enable a disabled named OpenVPN server instance (`/interface ovpn-server server enable" + " [find name=...]`) on the RouterOS 7.17+ multi-server model, so it starts accepting clients." + " Use list_ovpn_servers to confirm the name. To deactivate use disable_ovpn_server; to delete" + " use remove_ovpn_server. For the legacy single-server menu use set_ovpn_server with" + " enabled=true. Returns a success or error message.",
+    inputSchema: { name: z68.string() },
+    async handler(a, ctx) {
+      ctx.info(`Enabling OpenVPN server: name=${a.name}`);
+      const count = await executeMikrotikCommand(`/interface ovpn-server server print count-only where name="${a.name}"`, ctx);
+      if (count.trim() === "0")
+        return `OpenVPN server '${a.name}' not found.`;
+      const result = await executeMikrotikCommand(`/interface ovpn-server server enable [find name="${a.name}"]`, ctx);
+      if (looksLikeError(result))
+        return `Failed to enable OpenVPN server: ${result}`;
+      return `OpenVPN server '${a.name}' enabled successfully.`;
+    }
+  }),
+  defineTool({
+    name: "disable_ovpn_server",
+    title: "Disable Named OpenVPN Server",
+    annotations: WRITE_IDEMPOTENT,
+    description: "Disable an active named OpenVPN server instance (`/interface ovpn-server server disable" + " [find name=...]`) on the RouterOS 7.17+ multi-server model, stopping it without deleting its" + " configuration. Use list_ovpn_servers to confirm the name. To re-activate use" + " enable_ovpn_server; to delete use remove_ovpn_server. For the legacy single-server menu use" + " set_ovpn_server with enabled=false. Returns a success or error message.",
+    inputSchema: { name: z68.string() },
+    async handler(a, ctx) {
+      ctx.info(`Disabling OpenVPN server: name=${a.name}`);
+      const count = await executeMikrotikCommand(`/interface ovpn-server server print count-only where name="${a.name}"`, ctx);
+      if (count.trim() === "0")
+        return `OpenVPN server '${a.name}' not found.`;
+      const result = await executeMikrotikCommand(`/interface ovpn-server server disable [find name="${a.name}"]`, ctx);
+      if (looksLikeError(result))
+        return `Failed to disable OpenVPN server: ${result}`;
+      return `OpenVPN server '${a.name}' disabled successfully.`;
+    }
+  }),
   defineTool({
     name: "create_ovpn_client",
     title: "Create OpenVPN Client Interface",
@@ -17023,6 +17169,16 @@ ${details}`;
 // src/tools/routing-table.ts
 import { z as z91 } from "zod";
 var UNSUPPORTED14 = "Routing tables are not available on this device (requires RouterOS v7 with the routing package).";
+function fibToken(fib, onSet = false) {
+  if (fib === undefined)
+    return;
+  if (fib)
+    return "fib";
+  return onSet ? "!fib" : undefined;
+}
+function buildAddRoutingTableCommand(a) {
+  return new Cmd("/routing table add").set("name", a.name).raw(fibToken(a.fib)).opt("comment", a.comment).flag("disabled", a.disabled).build();
+}
 var routingTableTools = [
   defineTool({
     name: "list_routing_tables",
@@ -17072,7 +17228,7 @@ ${result}`;
     },
     async handler(a, ctx) {
       ctx.info(`Adding routing table: ${a.name}`);
-      const cmd = new Cmd("/routing table add").set("name", a.name).bool("fib", a.fib).opt("comment", a.comment).flag("disabled", a.disabled).build();
+      const cmd = buildAddRoutingTableCommand(a);
       const result = await executeMikrotikCommand(cmd, ctx);
       if (commandUnsupported(result))
         return UNSUPPORTED14;
@@ -17099,8 +17255,7 @@ ${details}`;
       ctx.info(`Updating routing table: ${a.name}`);
       const base = `/routing table set [find name="${a.name}"]`;
       const cmd = new Cmd(base);
-      if (a.fib !== undefined)
-        cmd.bool("fib", a.fib);
+      cmd.raw(fibToken(a.fib, true));
       if (a.comment !== undefined)
         cmd.set("comment", a.comment);
       if (a.disabled !== undefined)
@@ -21692,7 +21847,7 @@ var moduleCatalog = [
     label: "OpenVPN",
     slug: "openvpn",
     group: "VPN & Tunneling",
-    description: "OpenVPN server + clients (`/interface ovpn-*`).",
+    description: "OpenVPN servers \u2014 legacy single + RouterOS 7.17 multi-server \u2014 and clients (`/interface ovpn-*`).",
     tools: openvpnTools
   },
   {
@@ -23613,7 +23768,7 @@ function registerPrompts(server) {
 // package.json
 var package_default = {
   name: "@usex/mikrotik-mcp",
-  version: "3.15.0",
+  version: "3.17.0",
   description: "MCP server for MikroTik RouterOS \u2014 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   keywords: [
     "ai",

package/dist/index.js

@@ -13082,6 +13082,152 @@ ${result}`;
 ${details}`;
     }
   }),
+  defineTool({
+    name: "add_ovpn_server",
+    title: "Add Named OpenVPN Server",
+    annotations: WRITE,
+    description: "Add a named inbound OpenVPN server instance (`/interface ovpn-server server add`) \u2014 the" + " RouterOS 7.17+ multi-server model, where several OVPN servers can run side by side, each on" + " its own port/certificate/profile. Provide a unique name; port defaults to 1194. Supports" + " protocol (tcp/udp), ip or ethernet mode, certificate, auth/cipher algorithm lists, netmask," + " max_mtu, default_profile, mac_address (ethernet mode) and require_client_certificate. For the" + " legacy single-server (selector-less) menu on older RouterOS use set_ovpn_server. To remove a" + " named server use remove_ovpn_server; to list them use list_ovpn_servers. For outbound tunnels" + " use create_ovpn_client. Returns the created server's detail including its name.",
+    inputSchema: {
+      name: z69.string().describe("Unique name for the new OpenVPN server instance"),
+      port: z69.number().int().default(1194),
+      protocol: z69.enum(["tcp", "udp"]).optional(),
+      mode: z69.enum(["ip", "ethernet"]).optional(),
+      netmask: z69.number().int().optional(),
+      mac_address: z69.string().optional().describe("Server MAC for ethernet mode"),
+      certificate: z69.string().optional(),
+      auth: z69.string().optional().describe("Comma-separated, e.g. 'sha256,sha1'"),
+      cipher: z69.string().optional().describe("Comma-separated, e.g. 'aes256-cbc,aes256-gcm'"),
+      max_mtu: z69.number().int().optional(),
+      default_profile: z69.string().optional(),
+      require_client_certificate: z69.boolean().optional(),
+      comment: z69.string().optional(),
+      disabled: z69.boolean().default(false)
+    },
+    async handler(a, ctx) {
+      ctx.info(`Adding OpenVPN server: name=${a.name}`);
+      const cmd = new Cmd("/interface ovpn-server server add").set("name", a.name).opt("port", a.port).opt("protocol", a.protocol).opt("mode", a.mode).opt("netmask", a.netmask).opt("mac-address", a.mac_address).opt("certificate", a.certificate).opt("auth", a.auth).opt("cipher", a.cipher).opt("max-mtu", a.max_mtu).opt("default-profile", a.default_profile).bool("require-client-certificate", a.require_client_certificate).opt("comment", a.comment).flag("disabled", a.disabled).build();
+      const result = await executeMikrotikCommand(cmd, ctx);
+      if (containsRawParserError(result)) {
+        return "Failed to add OpenVPN server: this RouterOS build does not support named OpenVPN" + " server instances (the multi-server model requires RouterOS 7.17+). Use set_ovpn_server" + ` to configure the single legacy server instead.
+
+${result}`;
+      }
+      if (looksLikeError(result))
+        return `Failed to add OpenVPN server: ${result}`;
+      const details = await executeMikrotikCommand(`/interface ovpn-server server print detail where name="${a.name}"`, ctx);
+      return details.trim() ? `OpenVPN server '${a.name}' added successfully:
+
+${details}` : "OpenVPN server creation completed but unable to verify.";
+    }
+  }),
+  defineTool({
+    name: "list_ovpn_servers",
+    title: "List Named OpenVPN Servers",
+    annotations: READ,
+    description: "`list_ovpn_servers` \u2014 READ / list / show / inspect all named OpenVPN server instances" + " (`/interface ovpn-server server print detail`) on the RouterOS 7.17+ multi-server model," + " optionally filtered by partial name (name_filter). Returns each server's name, port, protocol," + " certificate, profile and disabled state. Pass a name_filter to fetch one server's full detail" + " (this doubles as get-by-name). The `.id`/name values feed update_ovpn_server," + " remove_ovpn_server, enable_ovpn_server and disable_ovpn_server. For the legacy single-server" + " menu use get_ovpn_server; for outbound tunnels use list_ovpn_clients.",
+    inputSchema: {
+      name_filter: z69.string().optional().describe("Partial name match")
+    },
+    async handler(a, ctx) {
+      ctx.info("Listing OpenVPN servers");
+      const filters = [];
+      if (a.name_filter)
+        filters.push(`name~"${a.name_filter}"`);
+      const result = await executeMikrotikCommand(`/interface ovpn-server server print detail${whereClause(filters)}`, ctx);
+      return isEmpty(result) ? "No named OpenVPN servers found (the device may use the legacy single-server menu \u2014 try get_ovpn_server)." : `OPENVPN SERVERS:
+
+${result}`;
+    }
+  }),
+  defineTool({
+    name: "update_ovpn_server",
+    title: "Update Named OpenVPN Server",
+    annotations: WRITE_IDEMPOTENT,
+    description: "Modify a named OpenVPN server instance (`/interface ovpn-server server set [find name=...]`) on" + " the RouterOS 7.17+ multi-server model \u2014 change port, protocol, mode, certificate, auth/cipher," + " netmask, max_mtu, default_profile, mac_address, comment or require_client_certificate without" + " recreating it. To toggle only the enabled state use enable_ovpn_server / disable_ovpn_server." + " To create a server use add_ovpn_server; to remove one use remove_ovpn_server. For the legacy" + " single-server menu use set_ovpn_server. Returns the updated server's detail.",
+    inputSchema: {
+      name: z69.string().describe("Existing OpenVPN server instance name"),
+      port: z69.number().int().optional(),
+      protocol: z69.enum(["tcp", "udp"]).optional(),
+      mode: z69.enum(["ip", "ethernet"]).optional(),
+      netmask: z69.number().int().optional(),
+      mac_address: z69.string().optional(),
+      certificate: z69.string().optional(),
+      auth: z69.string().optional(),
+      cipher: z69.string().optional(),
+      max_mtu: z69.number().int().optional(),
+      default_profile: z69.string().optional(),
+      require_client_certificate: z69.boolean().optional(),
+      comment: z69.string().optional()
+    },
+    async handler(a, ctx) {
+      ctx.info(`Updating OpenVPN server: name=${a.name}`);
+      const base = `/interface ovpn-server server set [find name="${a.name}"]`;
+      const cmd = new Cmd(base).opt("port", a.port).opt("protocol", a.protocol).opt("mode", a.mode).opt("netmask", a.netmask).opt("mac-address", a.mac_address).opt("certificate", a.certificate).opt("auth", a.auth).opt("cipher", a.cipher).opt("max-mtu", a.max_mtu).opt("default-profile", a.default_profile).bool("require-client-certificate", a.require_client_certificate).opt("comment", a.comment).build();
+      if (cmd === base)
+        return "No updates specified.";
+      const count = await executeMikrotikCommand(`/interface ovpn-server server print count-only where name="${a.name}"`, ctx);
+      if (count.trim() === "0")
+        return `OpenVPN server '${a.name}' not found.`;
+      const result = await executeMikrotikCommand(cmd, ctx);
+      if (looksLikeError(result))
+        return `Failed to update OpenVPN server: ${result}`;
+      const details = await executeMikrotikCommand(`/interface ovpn-server server print detail where name="${a.name}"`, ctx);
+      return `OpenVPN server '${a.name}' updated successfully:
+
+${details}`;
+    }
+  }),
+  defineTool({
+    name: "remove_ovpn_server",
+    title: "Remove Named OpenVPN Server",
+    annotations: DESTRUCTIVE,
+    description: "Permanently delete a named OpenVPN server instance (`/interface ovpn-server server remove" + " [find name=...]`) on the RouterOS 7.17+ multi-server model \u2014 verifies existence with a" + " count-only check before deleting. Use list_ovpn_servers to confirm the name. To stop a server" + " without deleting it use disable_ovpn_server. This does not touch the legacy single-server menu" + " (use set_ovpn_server with enabled=false for that) or any OVPN clients. Returns a success or" + " not-found message.",
+    inputSchema: { name: z69.string() },
+    async handler(a, ctx) {
+      ctx.info(`Removing OpenVPN server: name=${a.name}`);
+      const count = await executeMikrotikCommand(`/interface ovpn-server server print count-only where name="${a.name}"`, ctx);
+      if (count.trim() === "0")
+        return `OpenVPN server '${a.name}' not found.`;
+      const result = await executeMikrotikCommand(`/interface ovpn-server server remove [find name="${a.name}"]`, ctx);
+      if (looksLikeError(result))
+        return `Failed to remove OpenVPN server: ${result}`;
+      return `OpenVPN server '${a.name}' removed successfully.`;
+    }
+  }),
+  defineTool({
+    name: "enable_ovpn_server",
+    title: "Enable Named OpenVPN Server",
+    annotations: WRITE_IDEMPOTENT,
+    description: "Enable a disabled named OpenVPN server instance (`/interface ovpn-server server enable" + " [find name=...]`) on the RouterOS 7.17+ multi-server model, so it starts accepting clients." + " Use list_ovpn_servers to confirm the name. To deactivate use disable_ovpn_server; to delete" + " use remove_ovpn_server. For the legacy single-server menu use set_ovpn_server with" + " enabled=true. Returns a success or error message.",
+    inputSchema: { name: z69.string() },
+    async handler(a, ctx) {
+      ctx.info(`Enabling OpenVPN server: name=${a.name}`);
+      const count = await executeMikrotikCommand(`/interface ovpn-server server print count-only where name="${a.name}"`, ctx);
+      if (count.trim() === "0")
+        return `OpenVPN server '${a.name}' not found.`;
+      const result = await executeMikrotikCommand(`/interface ovpn-server server enable [find name="${a.name}"]`, ctx);
+      if (looksLikeError(result))
+        return `Failed to enable OpenVPN server: ${result}`;
+      return `OpenVPN server '${a.name}' enabled successfully.`;
+    }
+  }),
+  defineTool({
+    name: "disable_ovpn_server",
+    title: "Disable Named OpenVPN Server",
+    annotations: WRITE_IDEMPOTENT,
+    description: "Disable an active named OpenVPN server instance (`/interface ovpn-server server disable" + " [find name=...]`) on the RouterOS 7.17+ multi-server model, stopping it without deleting its" + " configuration. Use list_ovpn_servers to confirm the name. To re-activate use" + " enable_ovpn_server; to delete use remove_ovpn_server. For the legacy single-server menu use" + " set_ovpn_server with enabled=false. Returns a success or error message.",
+    inputSchema: { name: z69.string() },
+    async handler(a, ctx) {
+      ctx.info(`Disabling OpenVPN server: name=${a.name}`);
+      const count = await executeMikrotikCommand(`/interface ovpn-server server print count-only where name="${a.name}"`, ctx);
+      if (count.trim() === "0")
+        return `OpenVPN server '${a.name}' not found.`;
+      const result = await executeMikrotikCommand(`/interface ovpn-server server disable [find name="${a.name}"]`, ctx);
+      if (looksLikeError(result))
+        return `Failed to disable OpenVPN server: ${result}`;
+      return `OpenVPN server '${a.name}' disabled successfully.`;
+    }
+  }),
   defineTool({
     name: "create_ovpn_client",
     title: "Create OpenVPN Client Interface",
@@ -17035,6 +17181,16 @@ ${details}`;
 // src/tools/routing-table.ts
 import { z as z92 } from "zod";
 var UNSUPPORTED14 = "Routing tables are not available on this device (requires RouterOS v7 with the routing package).";
+function fibToken(fib, onSet = false) {
+  if (fib === undefined)
+    return;
+  if (fib)
+    return "fib";
+  return onSet ? "!fib" : undefined;
+}
+function buildAddRoutingTableCommand(a) {
+  return new Cmd("/routing table add").set("name", a.name).raw(fibToken(a.fib)).opt("comment", a.comment).flag("disabled", a.disabled).build();
+}
 var routingTableTools = [
   defineTool({
     name: "list_routing_tables",
@@ -17084,7 +17240,7 @@ ${result}`;
     },
     async handler(a, ctx) {
       ctx.info(`Adding routing table: ${a.name}`);
-      const cmd = new Cmd("/routing table add").set("name", a.name).bool("fib", a.fib).opt("comment", a.comment).flag("disabled", a.disabled).build();
+      const cmd = buildAddRoutingTableCommand(a);
       const result = await executeMikrotikCommand(cmd, ctx);
       if (commandUnsupported(result))
         return UNSUPPORTED14;
@@ -17111,8 +17267,7 @@ ${details}`;
       ctx.info(`Updating routing table: ${a.name}`);
       const base = `/routing table set [find name="${a.name}"]`;
       const cmd = new Cmd(base);
-      if (a.fib !== undefined)
-        cmd.bool("fib", a.fib);
+      cmd.raw(fibToken(a.fib, true));
       if (a.comment !== undefined)
         cmd.set("comment", a.comment);
       if (a.disabled !== undefined)
@@ -21704,7 +21859,7 @@ var moduleCatalog = [
     label: "OpenVPN",
     slug: "openvpn",
     group: "VPN & Tunneling",
-    description: "OpenVPN server + clients (`/interface ovpn-*`).",
+    description: "OpenVPN servers \u2014 legacy single + RouterOS 7.17 multi-server \u2014 and clients (`/interface ovpn-*`).",
     tools: openvpnTools
   },
   {
@@ -22016,7 +22171,7 @@ function selectToolModules(filter = {}, catalog = moduleCatalog) {
 // package.json
 var package_default = {
   name: "@usex/mikrotik-mcp",
-  version: "3.15.0",
+  version: "3.17.0",
   description: "MCP server for MikroTik RouterOS \u2014 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   keywords: [
     "ai",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usex/mikrotik-mcp",
-  "version": "3.15.0",
+  "version": "3.17.0",
   "description": "MCP server for MikroTik RouterOS — 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   "keywords": [
     "ai",

package/schemas/README.md

@@ -7,7 +7,7 @@ edit by hand — regenerate instead.
 | File                 | Contents                                                                                   |
 | -------------------- | ------------------------------------------------------------------------------------------ |
 | `config.schema.json` | The runtime configuration object (env vars / CLI flags).                                   |
-| `tool-catalog.json`  | Every one of the 715 tools: `name`, `risk`, `title`, `description`, and input JSON Schema. |
+| `tool-catalog.json`  | Every one of the 721 tools: `name`, `risk`, `title`, `description`, and input JSON Schema. |
 | `tools/<name>.json`  | The input JSON Schema for a single tool.                                                   |
 
 `risk` is derived from the MCP tool annotations:

package/schemas/tool-catalog.json

@@ -1,8 +1,8 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "version": "3.14.0",
+  "version": "3.16.0",
   "generated": "by scripts/gen-schemas.ts — do not edit by hand",
-  "toolCount": 715,
+  "toolCount": 721,
   "tools": [
     {
       "name": "list_interfaces",
@@ -14539,6 +14539,235 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "add_ovpn_server",
+      "title": "Add Named OpenVPN Server",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Add a named inbound OpenVPN server instance (`/interface ovpn-server server add`) — the RouterOS 7.17+ multi-server model, where several OVPN servers can run side by side, each on its own port/certificate/profile. Provide a unique name; port defaults to 1194. Supports protocol (tcp/udp), ip or ethernet mode, certificate, auth/cipher algorithm lists, netmask, max_mtu, default_profile, mac_address (ethernet mode) and require_client_certificate. For the legacy single-server (selector-less) menu on older RouterOS use set_ovpn_server. To remove a named server use remove_ovpn_server; to list them use list_ovpn_servers. For outbound tunnels use create_ovpn_client. Returns the created server's detail including its name.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "Unique name for the new OpenVPN server instance"
+          },
+          "port": {
+            "default": 1194,
+            "type": "integer",
+            "minimum": -9007199254740991,
+            "maximum": 9007199254740991
+          },
+          "protocol": {
+            "type": "string",
+            "enum": ["tcp", "udp"]
+          },
+          "mode": {
+            "type": "string",
+            "enum": ["ip", "ethernet"]
+          },
+          "netmask": {
+            "type": "integer",
+            "minimum": -9007199254740991,
+            "maximum": 9007199254740991
+          },
+          "mac_address": {
+            "description": "Server MAC for ethernet mode",
+            "type": "string"
+          },
+          "certificate": {
+            "type": "string"
+          },
+          "auth": {
+            "description": "Comma-separated, e.g. 'sha256,sha1'",
+            "type": "string"
+          },
+          "cipher": {
+            "description": "Comma-separated, e.g. 'aes256-cbc,aes256-gcm'",
+            "type": "string"
+          },
+          "max_mtu": {
+            "type": "integer",
+            "minimum": -9007199254740991,
+            "maximum": 9007199254740991
+          },
+          "default_profile": {
+            "type": "string"
+          },
+          "require_client_certificate": {
+            "type": "boolean"
+          },
+          "comment": {
+            "type": "string"
+          },
+          "disabled": {
+            "default": false,
+            "type": "boolean"
+          }
+        },
+        "required": ["name", "port", "disabled"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "list_ovpn_servers",
+      "title": "List Named OpenVPN Servers",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "`list_ovpn_servers` — READ / list / show / inspect all named OpenVPN server instances (`/interface ovpn-server server print detail`) on the RouterOS 7.17+ multi-server model, optionally filtered by partial name (name_filter). Returns each server's name, port, protocol, certificate, profile and disabled state. Pass a name_filter to fetch one server's full detail (this doubles as get-by-name). The `.id`/name values feed update_ovpn_server, remove_ovpn_server, enable_ovpn_server and disable_ovpn_server. For the legacy single-server menu use get_ovpn_server; for outbound tunnels use list_ovpn_clients.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "name_filter": {
+            "description": "Partial name match",
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "update_ovpn_server",
+      "title": "Update Named OpenVPN Server",
+      "risk": "write-idempotent",
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Modify a named OpenVPN server instance (`/interface ovpn-server server set [find name=...]`) on the RouterOS 7.17+ multi-server model — change port, protocol, mode, certificate, auth/cipher, netmask, max_mtu, default_profile, mac_address, comment or require_client_certificate without recreating it. To toggle only the enabled state use enable_ovpn_server / disable_ovpn_server. To create a server use add_ovpn_server; to remove one use remove_ovpn_server. For the legacy single-server menu use set_ovpn_server. Returns the updated server's detail.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "Existing OpenVPN server instance name"
+          },
+          "port": {
+            "type": "integer",
+            "minimum": -9007199254740991,
+            "maximum": 9007199254740991
+          },
+          "protocol": {
+            "type": "string",
+            "enum": ["tcp", "udp"]
+          },
+          "mode": {
+            "type": "string",
+            "enum": ["ip", "ethernet"]
+          },
+          "netmask": {
+            "type": "integer",
+            "minimum": -9007199254740991,
+            "maximum": 9007199254740991
+          },
+          "mac_address": {
+            "type": "string"
+          },
+          "certificate": {
+            "type": "string"
+          },
+          "auth": {
+            "type": "string"
+          },
+          "cipher": {
+            "type": "string"
+          },
+          "max_mtu": {
+            "type": "integer",
+            "minimum": -9007199254740991,
+            "maximum": 9007199254740991
+          },
+          "default_profile": {
+            "type": "string"
+          },
+          "require_client_certificate": {
+            "type": "boolean"
+          },
+          "comment": {
+            "type": "string"
+          }
+        },
+        "required": ["name"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "remove_ovpn_server",
+      "title": "Remove Named OpenVPN Server",
+      "risk": "destructive",
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Permanently delete a named OpenVPN server instance (`/interface ovpn-server server remove [find name=...]`) on the RouterOS 7.17+ multi-server model — verifies existence with a count-only check before deleting. Use list_ovpn_servers to confirm the name. To stop a server without deleting it use disable_ovpn_server. This does not touch the legacy single-server menu (use set_ovpn_server with enabled=false for that) or any OVPN clients. Returns a success or not-found message.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string"
+          }
+        },
+        "required": ["name"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "enable_ovpn_server",
+      "title": "Enable Named OpenVPN Server",
+      "risk": "write-idempotent",
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Enable a disabled named OpenVPN server instance (`/interface ovpn-server server enable [find name=...]`) on the RouterOS 7.17+ multi-server model, so it starts accepting clients. Use list_ovpn_servers to confirm the name. To deactivate use disable_ovpn_server; to delete use remove_ovpn_server. For the legacy single-server menu use set_ovpn_server with enabled=true. Returns a success or error message.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string"
+          }
+        },
+        "required": ["name"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "disable_ovpn_server",
+      "title": "Disable Named OpenVPN Server",
+      "risk": "write-idempotent",
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Disable an active named OpenVPN server instance (`/interface ovpn-server server disable [find name=...]`) on the RouterOS 7.17+ multi-server model, stopping it without deleting its configuration. Use list_ovpn_servers to confirm the name. To re-activate use enable_ovpn_server; to delete use remove_ovpn_server. For the legacy single-server menu use set_ovpn_server with enabled=false. Returns a success or error message.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string"
+          }
+        },
+        "required": ["name"],
+        "additionalProperties": false
+      }
+    },
     {
       "name": "create_ovpn_client",
       "title": "Create OpenVPN Client Interface",

package/schemas/tools/add_ovpn_server.json

@@ -0,0 +1,65 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "add_ovpn_server",
+  "type": "object",
+  "properties": {
+    "name": {
+      "type": "string",
+      "description": "Unique name for the new OpenVPN server instance"
+    },
+    "port": {
+      "default": 1194,
+      "type": "integer",
+      "minimum": -9007199254740991,
+      "maximum": 9007199254740991
+    },
+    "protocol": {
+      "type": "string",
+      "enum": ["tcp", "udp"]
+    },
+    "mode": {
+      "type": "string",
+      "enum": ["ip", "ethernet"]
+    },
+    "netmask": {
+      "type": "integer",
+      "minimum": -9007199254740991,
+      "maximum": 9007199254740991
+    },
+    "mac_address": {
+      "description": "Server MAC for ethernet mode",
+      "type": "string"
+    },
+    "certificate": {
+      "type": "string"
+    },
+    "auth": {
+      "description": "Comma-separated, e.g. 'sha256,sha1'",
+      "type": "string"
+    },
+    "cipher": {
+      "description": "Comma-separated, e.g. 'aes256-cbc,aes256-gcm'",
+      "type": "string"
+    },
+    "max_mtu": {
+      "type": "integer",
+      "minimum": -9007199254740991,
+      "maximum": 9007199254740991
+    },
+    "default_profile": {
+      "type": "string"
+    },
+    "require_client_certificate": {
+      "type": "boolean"
+    },
+    "comment": {
+      "type": "string"
+    },
+    "disabled": {
+      "default": false,
+      "type": "boolean"
+    }
+  },
+  "required": ["name", "port", "disabled"],
+  "additionalProperties": false
+}

package/schemas/tools/disable_ovpn_server.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "disable_ovpn_server",
+  "type": "object",
+  "properties": {
+    "name": {
+      "type": "string"
+    }
+  },
+  "required": ["name"],
+  "additionalProperties": false
+}

package/schemas/tools/enable_ovpn_server.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "enable_ovpn_server",
+  "type": "object",
+  "properties": {
+    "name": {
+      "type": "string"
+    }
+  },
+  "required": ["name"],
+  "additionalProperties": false
+}

package/schemas/tools/list_ovpn_servers.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "list_ovpn_servers",
+  "type": "object",
+  "properties": {
+    "name_filter": {
+      "description": "Partial name match",
+      "type": "string"
+    }
+  },
+  "additionalProperties": false
+}

package/schemas/tools/remove_ovpn_server.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "remove_ovpn_server",
+  "type": "object",
+  "properties": {
+    "name": {
+      "type": "string"
+    }
+  },
+  "required": ["name"],
+  "additionalProperties": false
+}

package/schemas/tools/update_ovpn_server.json

@@ -0,0 +1,57 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "update_ovpn_server",
+  "type": "object",
+  "properties": {
+    "name": {
+      "type": "string",
+      "description": "Existing OpenVPN server instance name"
+    },
+    "port": {
+      "type": "integer",
+      "minimum": -9007199254740991,
+      "maximum": 9007199254740991
+    },
+    "protocol": {
+      "type": "string",
+      "enum": ["tcp", "udp"]
+    },
+    "mode": {
+      "type": "string",
+      "enum": ["ip", "ethernet"]
+    },
+    "netmask": {
+      "type": "integer",
+      "minimum": -9007199254740991,
+      "maximum": 9007199254740991
+    },
+    "mac_address": {
+      "type": "string"
+    },
+    "certificate": {
+      "type": "string"
+    },
+    "auth": {
+      "type": "string"
+    },
+    "cipher": {
+      "type": "string"
+    },
+    "max_mtu": {
+      "type": "integer",
+      "minimum": -9007199254740991,
+      "maximum": 9007199254740991
+    },
+    "default_profile": {
+      "type": "string"
+    },
+    "require_client_certificate": {
+      "type": "boolean"
+    },
+    "comment": {
+      "type": "string"
+    }
+  },
+  "required": ["name"],
+  "additionalProperties": false
+}