@usex/mikrotik-mcp 3.18.0 → 3.20.0

package/dist/index.js

@@ -768,7 +768,6 @@ function connectErrorMessage(name, dc, lastError) {
 
 // src/ssh/safe-mode.ts
 var PROMPT_RE = /\[.+?@.+?\] (?:<SAFE> )?> ?$/m;
-var NORMAL_PROMPT_RE = /\[.+?@.+?\] > ?$/m;
 var ANSI_RE = /\x1B(?:\[[0-9;]*[mA-HJ-MSTfhilnprsu]|[()][0-9A-Za-z]|\[?\?\d+[hl])/g;
 function stripAnsi(text) {
   return text.replace(ANSI_RE, "");
@@ -779,13 +778,17 @@ function isSafeModeActivated(response) {
     return true;
   return /safe mode[^\n]*\b(?:success|taken|enabled|active)\b/i.test(response);
 }
-function isSafeModeReleased(response) {
+function lastNonEmptyLine(response) {
   const lines = response.replace(/\r/g, "").split(`
 `).map((l) => l.trimEnd()).filter(Boolean);
-  const last = lines.at(-1) ?? "";
-  return NORMAL_PROMPT_RE.test(last) && !last.includes("<SAFE>");
+  return lines.at(-1) ?? "";
+}
+function classifyPrompt(response) {
+  const last = lastNonEmptyLine(response);
+  if (!PROMPT_RE.test(last))
+    return "unknown";
+  return last.includes("<SAFE>") ? "safe" : "released";
 }
-
 class SafeModeManager {
   deviceName;
   ssh = null;
@@ -860,13 +863,30 @@ class SafeModeManager {
     return this.lock(async () => {
       if (!this.active || !this.channel)
         return "Safe mode is not active. Nothing to commit.";
+      this.channel.write(`
+`);
+      const probe = await this.readSettledPrompt();
+      const before = classifyPrompt(probe);
+      if (before === "released") {
+        this.cleanup();
+        return "Safe mode already exited \u2014 your changes are committed. Safe mode DISABLED.";
+      }
+      if (before === "unknown") {
+        return "Could not read a prompt to determine Safe Mode state. The session is left open so " + "nothing is reverted \u2014 call get_safe_mode_status, retry commit_safe_mode, or " + `rollback_safe_mode. Last output: ${probe.slice(-160)}`;
+      }
       this.channel.write(CTRL_X);
-      const response = await this.readUntilPrompt(15000, (c) => isSafeModeReleased(c));
-      if (!isSafeModeReleased(response)) {
-        return "Commit may not have completed: the device did not return to a normal prompt " + `after exiting Safe Mode. Session left open \u2014 retry commit_safe_mode. Response: ${response.slice(-200)}`;
+      this.channel.write(`
+`);
+      const after = await this.readSettledPrompt();
+      switch (classifyPrompt(after)) {
+        case "released":
+          this.cleanup();
+          return "Changes committed successfully. Safe mode DISABLED.";
+        case "safe":
+          return "Commit not completed \u2014 the device is still in Safe Mode. Your changes remain held " + "in memory (not reverted); call commit_safe_mode again to retry, or rollback_safe_mode " + "to discard them.";
+        default:
+          return "Commit status unclear \u2014 no prompt seen after exiting Safe Mode. The session is left " + "open so nothing is reverted; verify with get_safe_mode_status or retry commit_safe_mode. " + `Last output: ${after.slice(-160)}`;
       }
-      this.cleanup();
-      return "Changes committed successfully. Safe mode DISABLED.";
     });
   }
   rollback() {
@@ -902,6 +922,33 @@ class SafeModeManager {
       channel.on("data", onData);
     });
   }
+  readSettledPrompt(quietMs = 450, maxMs = 8000) {
+    const channel = this.channel;
+    if (!channel)
+      return Promise.resolve("");
+    return new Promise((resolve2) => {
+      let buf = "";
+      let quiet;
+      let hard;
+      function done() {
+        clearTimeout(hard);
+        if (quiet)
+          clearTimeout(quiet);
+        channel.removeListener("data", onData);
+        resolve2(stripAnsi(buf));
+      }
+      function onData(chunk) {
+        buf += decodeOutput(chunk);
+        if (PROMPT_RE.test(lastNonEmptyLine(stripAnsi(buf)))) {
+          if (quiet)
+            clearTimeout(quiet);
+          quiet = setTimeout(done, quietMs);
+        }
+      }
+      hard = setTimeout(done, maxMs);
+      channel.on("data", onData);
+    });
+  }
   extractOutput(raw, command) {
     const text = raw.replace(/\r\n/g, `
 `).replace(/\r/g, `
@@ -991,7 +1038,7 @@ function createContext(sendLog, device) {
 }
 
 // src/core/routeros.ts
-var BARE_SAFE = /^[\w.\-:/,*@]+$/;
+var BARE_SAFE = /^[\w.\-:/,*@!]+$/;
 function quoteValue(value) {
   if (typeof value === "number" || typeof value === "boolean")
     return String(value);
@@ -2186,7 +2233,7 @@ ${result}`;
     name: "create_export",
     title: "Create Full Configuration Export",
     annotations: READ,
-    description: "Exports the complete device configuration to a `.rsc` plain-text script file (`/export" + " file=<name>`), re-applicable via `import_configuration`. Unlike `create_backup`, the result" + " is human-readable plain text \u2014 not a binary snapshot \u2014 and passwords are hidden by default" + " (`hide_sensitive=true`). `file_format` changes only the file extension used when looking up" + " the saved file \u2014 no `format=` flag is ever sent to RouterOS, so the content is always" + " RouterOS script text regardless of the chosen extension; selecting `json` or `xml` will also" + " cause the post-export file lookup to fail because RouterOS saves the file as `.rsc`. Use the" + " `compact` boolean to omit default values, or `verbose` to include all parameters;" + " `export_type` only controls where the `file=` argument is positioned in the command and" + " does not independently drive compactness or verbosity. For a single subsection only use" + " `export_section`. Returns file details of the created export file.",
+    description: "Exports the complete device configuration to a `.rsc` plain-text script file (`/export" + " file=<name>`), re-applicable via `import_configuration`. Unlike `create_backup`, the result" + " is human-readable plain text \u2014 not a binary snapshot \u2014 and passwords are hidden by default" + " (`hide_sensitive=true`). `file_format` changes only the file extension used when looking up" + " the saved file \u2014 no `format=` flag is ever sent to RouterOS, so the content is always" + " RouterOS script text regardless of the chosen extension; selecting `json` or `xml` will also" + " cause the post-export file lookup to fail because RouterOS saves the file as `.rsc`." + " ALWAYS default to a FULL configuration export: leave `compact` and `verbose` off (the plain" + " full export) unless the user explicitly asks for less or more. Set `compact` ONLY when the" + " user wants a smaller diff that omits default values, or `verbose` ONLY when they want every" + " parameter (including defaults). `export_type` only controls where the `file=` argument is" + " positioned in the command and does not independently drive compactness or verbosity. For a" + " single subsection only use `export_section`. Returns file details of the created export file.",
     inputSchema: {
       name: z5.string().optional(),
       file_format: z5.enum(["rsc", "json", "xml"]).default("rsc"),
@@ -2379,6 +2426,12 @@ ${result}`;
 // src/tools/local-backup.ts
 import { z as z6 } from "zod";
 
+// src/core/slug.ts
+function deviceSlug(name) {
+  const s = (name ?? "").replace(/[^A-Za-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
+  return s || "device";
+}
+
 // src/backups/vault.ts
 import {
   existsSync,
@@ -2499,15 +2552,17 @@ function labelSlug(label) {
   const s = (label ?? "").replace(/[^A-Za-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40);
   return s ? `_${s}` : "";
 }
+function buildExportCommand(opts = {}) {
+  return new Cmd("/export").raw(opts.verbose ? "verbose" : opts.compact ? "compact" : undefined).raw(opts.terse ? "terse" : undefined).raw(opts.showSensitive ? "show-sensitive" : undefined).build();
+}
 async function createLocalBackup(ctx, opts = {}) {
   const device = resolveDeviceName(ctx.device);
-  const cmd = new Cmd("/export").raw(opts.showSensitive ? "show-sensitive" : undefined).build();
-  const body = await executeMikrotikCommand(cmd, ctx);
+  const body = await executeMikrotikCommand(buildExportCommand(opts), ctx);
   if (isEmpty(body) || looksLikeError(body)) {
     return { ok: false, device, error: body.trim() || "(empty export)" };
   }
   const stamp = await deviceDateStamp(ctx);
-  const name = `${device}_${stamp}${labelSlug(opts.label)}.rsc`;
+  const name = `${deviceSlug(device)}_${stamp}${labelSlug(opts.label)}.rsc`;
   return { ok: true, device, name: writeBackup(name, body), bytes: Buffer.byteLength(body) };
 }
 
@@ -2578,13 +2633,22 @@ var localBackupTools = [
     name: "create_local_backup",
     title: "Create Local Config Backup (host vault)",
     annotations: WRITE,
-    description: "Captures the device's full configuration with `/export` and saves it as a timestamped " + "plain-text `.rsc` file in the MCP server's LOCAL backup vault (default " + "`~/.mikrotik-mcp/backups/`, override with the `MIKROTIK_BACKUP_DIR` env var) \u2014 NOT on the " + "device and NOT in S3. The filename is `<device>_<date_time>.rsc` stamped in the device's " + "local clock (24-hour; Jalali for the Tehran timezone, Gregorian otherwise). This is a " + "host-side, human-readable, diffable copy you can restore later with restore_local_backup. " + "Compare: create_backup makes a binary `/system backup` file ON the device; " + "capture_config_snapshot stores an export in the local snapshot database; upload_backup_to_s3 " + "pushes to S3. show_sensitive=true includes secrets (keys/passwords) in the export. " + "Returns the saved filename, byte size and vault path.",
+    description: "Captures the device's full configuration with `/export` and saves it as a timestamped " + "plain-text `.rsc` file in the MCP server's LOCAL backup vault (default " + "`~/.mikrotik-mcp/backups/`, override with the `MIKROTIK_BACKUP_DIR` env var) \u2014 NOT on the " + "device and NOT in S3. The filename is `<device-slug>_<date_time>.rsc` \u2014 the device name is " + "slugified (spaces/underscores/etc \u2192 dash) \u2014 stamped in the device's local clock (24-hour; " + "Jalali for the Tehran timezone, Gregorian otherwise). This is a host-side, human-readable, " + "diffable copy you can restore later with restore_local_backup. Compare: create_backup makes " + "a binary `/system backup` file ON the device; capture_config_snapshot stores an export in " + "the local snapshot database; upload_backup_to_s3 pushes to S3. ALWAYS default to a FULL " + "backup of the complete configuration: call this with no option flags (the bare `/export`) " + "unless the user explicitly asks for less or more. Narrow it ONLY on request \u2014 set compact to " + "drop default values, or use export_section for a single subsection. Broaden it ONLY on " + "request \u2014 set verbose to include every parameter (even defaults), show_sensitive to include " + "secrets (keys/passwords), or use create_backup for a binary full-system snapshot. terse just " + "changes the text to one machine-readable line per item. Returns the saved filename, byte size " + "and vault path.",
     inputSchema: {
       label: z6.string().optional().describe('Optional label appended to the filename, e.g. "pre-upgrade".'),
-      show_sensitive: z6.boolean().default(false).describe("Include secrets (keys/passwords) in the export. Default false.")
+      show_sensitive: z6.boolean().default(false).describe("Include secrets (keys/passwords) in the export. Default false."),
+      verbose: z6.boolean().default(false).describe("Include every parameter, even defaults (RouterOS `verbose`)."),
+      compact: z6.boolean().default(false).describe("Export only non-default values (RouterOS `compact`; ignored if verbose)."),
+      terse: z6.boolean().default(false).describe("One self-contained, machine-readable line per item (RouterOS `terse`).")
     },
     async handler(a, ctx) {
-      const r = await createLocalBackup(ctx, { label: a.label, showSensitive: a.show_sensitive });
+      const r = await createLocalBackup(ctx, {
+        label: a.label,
+        showSensitive: a.show_sensitive,
+        verbose: a.verbose,
+        compact: a.compact,
+        terse: a.terse
+      });
       if (!r.ok)
         return `Failed to capture export for a local backup: ${r.error}`;
       return `Saved local backup '${r.name}' (${r.bytes} bytes) for device '${r.device}' to ` + `${backupDir()}. Restore it with restore_local_backup name=${r.name}.`;
@@ -2720,7 +2784,7 @@ function trimSlashes(s) {
   return s.replace(/^\/+|\/+$/g, "");
 }
 function s3DevicePrefix(device) {
-  const segments = [getS3Config()?.prefix ?? "", device ?? ""].map(trimSlashes).filter(Boolean);
+  const segments = [getS3Config()?.prefix ?? "", device ? deviceSlug(device) : ""].map(trimSlashes).filter(Boolean);
   return segments.length ? `${segments.join("/")}/` : "";
 }
 function s3Key(name, device) {
@@ -6312,6 +6376,12 @@ async function updateNatRule(a, ctx) {
   put("protocol", a.protocol);
   put("in-interface", a.in_interface);
   put("out-interface", a.out_interface);
+  put("in-interface-list", a.in_interface_list);
+  put("out-interface-list", a.out_interface_list);
+  put("src-address-list", a.src_address_list);
+  put("dst-address-list", a.dst_address_list);
+  put("connection-mark", a.connection_mark);
+  put("connection-nat-state", a.connection_nat_state);
   put("to-addresses", a.to_addresses);
   put("to-ports", a.to_ports);
   if (a.comment !== undefined)
@@ -6348,8 +6418,14 @@ var firewallNatTools = [
       src_port: z24.string().optional(),
       dst_port: z24.string().optional(),
       protocol: z24.string().optional(),
-      in_interface: z24.string().optional(),
+      in_interface: z24.string().optional().describe('Negatable, e.g. "!ether1"'),
       out_interface: z24.string().optional(),
+      in_interface_list: z24.string().optional().describe('Interface list, e.g. "WAN" or "!LAN"'),
+      out_interface_list: z24.string().optional(),
+      src_address_list: z24.string().optional().describe('Match src in a named list; negate "!name"'),
+      dst_address_list: z24.string().optional().describe('Match dst in a named list; negate "!name"'),
+      connection_mark: z24.string().optional(),
+      connection_nat_state: z24.string().optional().describe('"srcnat" / "dstnat" / "!dstnat"'),
       to_addresses: z24.string().optional().describe('Single IP or range e.g. "10.0.0.1" or "10.0.0.1-10.0.0.10"'),
       to_ports: z24.string().optional().describe('Single port or range e.g. "8080" or "8080-8090"'),
       comment: z24.string().optional(),
@@ -6389,7 +6465,7 @@ var firewallNatTools = [
       } else if (a.chain === "dstnat" && !dstnatActions.includes(a.action)) {
         return `Error: Invalid action '${a.action}' for dstnat. Must be one of: ${dstnatActions.join(", ")}`;
       }
-      const cmd = new Cmd("/ip firewall nat add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("to-addresses", a.to_addresses).opt("to-ports", a.to_ports).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
+      const cmd = new Cmd("/ip firewall nat add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("in-interface-list", a.in_interface_list).opt("out-interface-list", a.out_interface_list).opt("src-address-list", a.src_address_list).opt("dst-address-list", a.dst_address_list).opt("connection-mark", a.connection_mark).opt("connection-nat-state", a.connection_nat_state).opt("to-addresses", a.to_addresses).opt("to-ports", a.to_ports).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
       const result = await executeMikrotikCommand(cmd, ctx);
       const trimmed = result.trim();
       if (looksLikeError(trimmed)) {
@@ -6487,6 +6563,12 @@ ${result}`;
       protocol: z24.string().optional(),
       in_interface: z24.string().optional(),
       out_interface: z24.string().optional(),
+      in_interface_list: z24.string().optional(),
+      out_interface_list: z24.string().optional(),
+      src_address_list: z24.string().optional().describe('Negate with "!name"'),
+      dst_address_list: z24.string().optional().describe('Negate with "!name"'),
+      connection_mark: z24.string().optional(),
+      connection_nat_state: z24.string().optional(),
       to_addresses: z24.string().optional(),
       to_ports: z24.string().optional(),
       comment: z24.string().optional(),
@@ -6579,10 +6661,33 @@ async function updateMangleRule(a, ctx) {
   put("protocol", a.protocol);
   put("in-interface", a.in_interface);
   put("out-interface", a.out_interface);
+  put("in-interface-list", a.in_interface_list);
+  put("out-interface-list", a.out_interface_list);
+  put("src-address-list", a.src_address_list);
+  put("dst-address-list", a.dst_address_list);
+  put("src-address-type", a.src_address_type);
+  put("dst-address-type", a.dst_address_type);
   put("connection-mark", a.connection_mark);
   put("packet-mark", a.packet_mark);
   put("routing-mark", a.routing_mark);
   put("connection-state", a.connection_state);
+  put("connection-nat-state", a.connection_nat_state);
+  put("connection-type", a.connection_type);
+  put("connection-bytes", a.connection_bytes);
+  put("connection-limit", a.connection_limit);
+  put("connection-rate", a.connection_rate);
+  put("per-connection-classifier", a.per_connection_classifier);
+  put("tcp-flags", a.tcp_flags);
+  put("dscp", a.dscp);
+  put("priority", a.priority);
+  put("packet-size", a.packet_size);
+  put("layer7-protocol", a.layer7_protocol);
+  put("ipsec-policy", a.ipsec_policy);
+  put("nth", a.nth);
+  put("random", a.random);
+  put("time", a.time);
+  put("hotspot", a.hotspot);
+  put("p2p", a.p2p);
   put("new-connection-mark", a.new_connection_mark);
   put("new-packet-mark", a.new_packet_mark);
   put("new-routing-mark", a.new_routing_mark);
@@ -6619,7 +6724,7 @@ var firewallMangleTools = [
     name: "create_mangle_rule",
     title: "Create IPv4 Firewall Mangle Rule",
     annotations: WRITE,
-    description: "Creates an IPv4 mangle rule (`/ip firewall mangle add`) \u2014 the packet-marking and header-modification table, " + "used to mark connections/packets/routing (for policy routing, QoS and per-connection classification) or to change DSCP/TTL/MSS. " + "For accept/drop decisions use create_filter_rule; for address translation use create_nat_rule; for IPv6 mangle use create_ipv6_mangle_rule. " + "chain: prerouting/input/forward/output/postrouting. " + "action: mark-connection/mark-packet/mark-routing/change-dscp/change-ttl/change-mss/add-src-to-address-list/add-dst-to-address-list/fasttrack-connection/route/set-priority/accept/etc. " + "Set the matching new-*-mark field for mark-* actions and keep passthrough=true so later rules can also match the same packet; " + "for add-*-to-address-list set address_list (and optionally address_list_timeout). " + "place_before accepts a rule number or ID (*N) to control insertion position. " + "Returns the created rule's detail including its `.id`.",
+    description: "Creates an IPv4 mangle rule (`/ip firewall mangle add`) \u2014 the packet-marking and header-modification table, " + "used to mark connections/packets/routing (for policy routing, QoS and per-connection classification) or to change DSCP/TTL/MSS. " + "For accept/drop decisions use create_filter_rule; for address translation use create_nat_rule; for IPv6 mangle use create_ipv6_mangle_rule. " + "chain: prerouting/input/forward/output/postrouting. " + "action: mark-connection/mark-packet/mark-routing/change-dscp/change-ttl/change-mss/add-src-to-address-list/add-dst-to-address-list/fasttrack-connection/route/set-priority/accept/etc. " + "Set the matching new-*-mark field for mark-* actions and keep passthrough=true so later rules can also match the same packet; " + "for add-*-to-address-list set address_list (and optionally address_list_timeout). " + "Full match surface: address-lists (src_address_list/dst_address_list \u2014 negate with a leading '!', e.g. dst_address_list='!IR' to route traffic NOT bound for a list), " + "interface-lists, per_connection_classifier (PCC load-balancing), connection_nat_state, tcp_flags, dscp, layer7_protocol, time, and more. " + "Typical policy-routing rule: chain=prerouting, src_address=<lan>, dst_address_list='!IR', action=mark-routing, new_routing_mark=<table>, then a routing rule/route uses that table. " + "place_before accepts a rule number or ID (*N) to control insertion position. " + "Returns the created rule's detail including its `.id`.",
     inputSchema: {
       chain: z25.enum(["prerouting", "input", "forward", "output", "postrouting"]),
       action: z25.enum([
@@ -6649,12 +6754,35 @@ var firewallMangleTools = [
       src_port: z25.string().optional(),
       dst_port: z25.string().optional(),
       protocol: z25.string().optional(),
-      in_interface: z25.string().optional(),
+      in_interface: z25.string().optional().describe('Negatable, e.g. "!ether1"'),
       out_interface: z25.string().optional(),
+      in_interface_list: z25.string().optional().describe('Interface list, negatable e.g. "!WAN"'),
+      out_interface_list: z25.string().optional(),
+      src_address_list: z25.string().optional().describe('Match src in a named list; negate "!name"'),
+      dst_address_list: z25.string().optional().describe('Match dst in a named list; negate "!name" (e.g. "!IR" routes foreign traffic)'),
+      src_address_type: z25.string().optional().describe('e.g. "local", "unicast", "!local"'),
+      dst_address_type: z25.string().optional(),
       connection_mark: z25.string().optional(),
       packet_mark: z25.string().optional(),
       routing_mark: z25.string().optional(),
-      connection_state: z25.string().optional().describe('e.g. "new", "established,related", "invalid"'),
+      connection_state: z25.string().optional().describe('e.g. "new", "established,related", "!invalid"'),
+      connection_nat_state: z25.string().optional().describe('"srcnat" / "dstnat" / "!dstnat"'),
+      connection_type: z25.string().optional().describe('Helper, e.g. "sip", "ftp"'),
+      connection_bytes: z25.string().optional().describe('e.g. "1000000-0" (>1 MB connections)'),
+      connection_limit: z25.string().optional().describe('e.g. "100,32"'),
+      connection_rate: z25.string().optional().describe('e.g. "100k-1M"'),
+      per_connection_classifier: z25.string().optional().describe('PCC for load balancing, e.g. "both-addresses:2/0"'),
+      tcp_flags: z25.string().optional().describe('RouterOS flag expression e.g. "syn,!ack"'),
+      dscp: z25.string().optional().describe("Match incoming DSCP (0-63)"),
+      priority: z25.string().optional().describe("Match packet/queue priority (0-63)"),
+      packet_size: z25.string().optional().describe('e.g. "1500" or "0-500"'),
+      layer7_protocol: z25.string().optional().describe("Name of an /ip firewall layer7-protocol regex"),
+      ipsec_policy: z25.string().optional().describe('e.g. "in,ipsec" or "out,none"'),
+      nth: z25.string().optional().describe('e.g. "2,1" \u2014 every 2nd packet'),
+      random: z25.string().optional().describe("Match a random N% of packets (1-99)"),
+      time: z25.string().optional().describe('e.g. "8h-16h,mon,tue,wed,thu,fri"'),
+      hotspot: z25.string().optional().describe('e.g. "auth", "!auth", "from-client"'),
+      p2p: z25.string().optional(),
       new_connection_mark: z25.string().optional(),
       new_packet_mark: z25.string().optional(),
       new_routing_mark: z25.string().optional(),
@@ -6673,7 +6801,7 @@ var firewallMangleTools = [
     },
     async handler(a, ctx) {
       ctx.info(`Creating mangle rule: chain=${a.chain}, action=${a.action}`);
-      const cmd = new Cmd("/ip firewall mangle add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("connection-mark", a.connection_mark).opt("packet-mark", a.packet_mark).opt("routing-mark", a.routing_mark).opt("connection-state", a.connection_state).opt("new-connection-mark", a.new_connection_mark).opt("new-packet-mark", a.new_packet_mark).opt("new-routing-mark", a.new_routing_mark).opt("new-dscp", a.new_dscp).opt("new-ttl", a.new_ttl).opt("new-mss", a.new_mss).opt("routing-table", a.routing_table).opt("address-list", a.address_list).opt("address-list-timeout", a.address_list_timeout).bool("passthrough", a.passthrough).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
+      const cmd = new Cmd("/ip firewall mangle add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("in-interface-list", a.in_interface_list).opt("out-interface-list", a.out_interface_list).opt("src-address-list", a.src_address_list).opt("dst-address-list", a.dst_address_list).opt("src-address-type", a.src_address_type).opt("dst-address-type", a.dst_address_type).opt("connection-mark", a.connection_mark).opt("packet-mark", a.packet_mark).opt("routing-mark", a.routing_mark).opt("connection-state", a.connection_state).opt("connection-nat-state", a.connection_nat_state).opt("connection-type", a.connection_type).opt("connection-bytes", a.connection_bytes).opt("connection-limit", a.connection_limit).opt("connection-rate", a.connection_rate).opt("per-connection-classifier", a.per_connection_classifier).opt("tcp-flags", a.tcp_flags).opt("dscp", a.dscp).opt("priority", a.priority).opt("packet-size", a.packet_size).opt("layer7-protocol", a.layer7_protocol).opt("ipsec-policy", a.ipsec_policy).opt("nth", a.nth).opt("random", a.random).opt("time", a.time).opt("hotspot", a.hotspot).opt("p2p", a.p2p).opt("new-connection-mark", a.new_connection_mark).opt("new-packet-mark", a.new_packet_mark).opt("new-routing-mark", a.new_routing_mark).opt("new-dscp", a.new_dscp).opt("new-ttl", a.new_ttl).opt("new-mss", a.new_mss).opt("routing-table", a.routing_table).opt("address-list", a.address_list).opt("address-list-timeout", a.address_list_timeout).bool("passthrough", a.passthrough).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
       const result = await executeMikrotikCommand(cmd, ctx);
       const trimmed = result.trim();
       if (looksLikeError(trimmed)) {
@@ -6767,10 +6895,33 @@ ${result}`;
       protocol: z25.string().optional(),
       in_interface: z25.string().optional(),
       out_interface: z25.string().optional(),
+      in_interface_list: z25.string().optional(),
+      out_interface_list: z25.string().optional(),
+      src_address_list: z25.string().optional().describe('Negate with "!name" (e.g. "!IR")'),
+      dst_address_list: z25.string().optional().describe('Negate with "!name" (e.g. "!IR")'),
+      src_address_type: z25.string().optional(),
+      dst_address_type: z25.string().optional(),
       connection_mark: z25.string().optional(),
       packet_mark: z25.string().optional(),
       routing_mark: z25.string().optional(),
       connection_state: z25.string().optional(),
+      connection_nat_state: z25.string().optional(),
+      connection_type: z25.string().optional(),
+      connection_bytes: z25.string().optional(),
+      connection_limit: z25.string().optional(),
+      connection_rate: z25.string().optional(),
+      per_connection_classifier: z25.string().optional(),
+      tcp_flags: z25.string().optional(),
+      dscp: z25.string().optional(),
+      priority: z25.string().optional(),
+      packet_size: z25.string().optional(),
+      layer7_protocol: z25.string().optional(),
+      ipsec_policy: z25.string().optional(),
+      nth: z25.string().optional(),
+      random: z25.string().optional(),
+      time: z25.string().optional(),
+      hotspot: z25.string().optional(),
+      p2p: z25.string().optional(),
       new_connection_mark: z25.string().optional(),
       new_packet_mark: z25.string().optional(),
       new_routing_mark: z25.string().optional(),
@@ -22171,7 +22322,7 @@ function selectToolModules(filter = {}, catalog = moduleCatalog) {
 // package.json
 var package_default = {
   name: "@usex/mikrotik-mcp",
-  version: "3.18.0",
+  version: "3.20.0",
   description: "MCP server for MikroTik RouterOS \u2014 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   keywords: [
     "ai",