@usex/mikrotik-mcp 3.18.0 → 3.20.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usex/mikrotik-mcp",
-  "version": "3.18.0",
+  "version": "3.20.0",
   "description": "MCP server for MikroTik RouterOS — 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   "keywords": [
     "ai",

package/schemas/tool-catalog.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "version": "3.16.0",
+  "version": "3.19.0",
   "generated": "by scripts/gen-schemas.ts — do not edit by hand",
   "toolCount": 721,
   "tools": [
@@ -10179,11 +10179,34 @@
             "type": "string"
           },
           "in_interface": {
+            "description": "Negatable, e.g. \"!ether1\"",
             "type": "string"
           },
           "out_interface": {
             "type": "string"
           },
+          "in_interface_list": {
+            "description": "Interface list, e.g. \"WAN\" or \"!LAN\"",
+            "type": "string"
+          },
+          "out_interface_list": {
+            "type": "string"
+          },
+          "src_address_list": {
+            "description": "Match src in a named list; negate \"!name\"",
+            "type": "string"
+          },
+          "dst_address_list": {
+            "description": "Match dst in a named list; negate \"!name\"",
+            "type": "string"
+          },
+          "connection_mark": {
+            "type": "string"
+          },
+          "connection_nat_state": {
+            "description": "\"srcnat\" / \"dstnat\" / \"!dstnat\"",
+            "type": "string"
+          },
           "to_addresses": {
             "description": "Single IP or range e.g. \"10.0.0.1\" or \"10.0.0.1-10.0.0.10\"",
             "type": "string"
@@ -10327,6 +10350,26 @@
           "out_interface": {
             "type": "string"
           },
+          "in_interface_list": {
+            "type": "string"
+          },
+          "out_interface_list": {
+            "type": "string"
+          },
+          "src_address_list": {
+            "description": "Negate with \"!name\"",
+            "type": "string"
+          },
+          "dst_address_list": {
+            "description": "Negate with \"!name\"",
+            "type": "string"
+          },
+          "connection_mark": {
+            "type": "string"
+          },
+          "connection_nat_state": {
+            "type": "string"
+          },
           "to_addresses": {
             "type": "string"
           },
@@ -10452,7 +10495,7 @@
         "destructiveHint": false,
         "openWorldHint": false
       },
-      "description": "Creates an IPv4 mangle rule (`/ip firewall mangle add`) — the packet-marking and header-modification table, used to mark connections/packets/routing (for policy routing, QoS and per-connection classification) or to change DSCP/TTL/MSS. For accept/drop decisions use create_filter_rule; for address translation use create_nat_rule; for IPv6 mangle use create_ipv6_mangle_rule. chain: prerouting/input/forward/output/postrouting. action: mark-connection/mark-packet/mark-routing/change-dscp/change-ttl/change-mss/add-src-to-address-list/add-dst-to-address-list/fasttrack-connection/route/set-priority/accept/etc. Set the matching new-*-mark field for mark-* actions and keep passthrough=true so later rules can also match the same packet; for add-*-to-address-list set address_list (and optionally address_list_timeout). place_before accepts a rule number or ID (*N) to control insertion position. Returns the created rule's detail including its `.id`.",
+      "description": "Creates an IPv4 mangle rule (`/ip firewall mangle add`) — the packet-marking and header-modification table, used to mark connections/packets/routing (for policy routing, QoS and per-connection classification) or to change DSCP/TTL/MSS. For accept/drop decisions use create_filter_rule; for address translation use create_nat_rule; for IPv6 mangle use create_ipv6_mangle_rule. chain: prerouting/input/forward/output/postrouting. action: mark-connection/mark-packet/mark-routing/change-dscp/change-ttl/change-mss/add-src-to-address-list/add-dst-to-address-list/fasttrack-connection/route/set-priority/accept/etc. Set the matching new-*-mark field for mark-* actions and keep passthrough=true so later rules can also match the same packet; for add-*-to-address-list set address_list (and optionally address_list_timeout). Full match surface: address-lists (src_address_list/dst_address_list — negate with a leading '!', e.g. dst_address_list='!IR' to route traffic NOT bound for a list), interface-lists, per_connection_classifier (PCC load-balancing), connection_nat_state, tcp_flags, dscp, layer7_protocol, time, and more. Typical policy-routing rule: chain=prerouting, src_address=<lan>, dst_address_list='!IR', action=mark-routing, new_routing_mark=<table>, then a routing rule/route uses that table. place_before accepts a rule number or ID (*N) to control insertion position. Returns the created rule's detail including its `.id`.",
       "inputSchema": {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "type": "object",
@@ -10502,11 +10545,34 @@
             "type": "string"
           },
           "in_interface": {
+            "description": "Negatable, e.g. \"!ether1\"",
             "type": "string"
           },
           "out_interface": {
             "type": "string"
           },
+          "in_interface_list": {
+            "description": "Interface list, negatable e.g. \"!WAN\"",
+            "type": "string"
+          },
+          "out_interface_list": {
+            "type": "string"
+          },
+          "src_address_list": {
+            "description": "Match src in a named list; negate \"!name\"",
+            "type": "string"
+          },
+          "dst_address_list": {
+            "description": "Match dst in a named list; negate \"!name\" (e.g. \"!IR\" routes foreign traffic)",
+            "type": "string"
+          },
+          "src_address_type": {
+            "description": "e.g. \"local\", \"unicast\", \"!local\"",
+            "type": "string"
+          },
+          "dst_address_type": {
+            "type": "string"
+          },
           "connection_mark": {
             "type": "string"
           },
@@ -10517,7 +10583,74 @@
             "type": "string"
           },
           "connection_state": {
-            "description": "e.g. \"new\", \"established,related\", \"invalid\"",
+            "description": "e.g. \"new\", \"established,related\", \"!invalid\"",
+            "type": "string"
+          },
+          "connection_nat_state": {
+            "description": "\"srcnat\" / \"dstnat\" / \"!dstnat\"",
+            "type": "string"
+          },
+          "connection_type": {
+            "description": "Helper, e.g. \"sip\", \"ftp\"",
+            "type": "string"
+          },
+          "connection_bytes": {
+            "description": "e.g. \"1000000-0\" (>1 MB connections)",
+            "type": "string"
+          },
+          "connection_limit": {
+            "description": "e.g. \"100,32\"",
+            "type": "string"
+          },
+          "connection_rate": {
+            "description": "e.g. \"100k-1M\"",
+            "type": "string"
+          },
+          "per_connection_classifier": {
+            "description": "PCC for load balancing, e.g. \"both-addresses:2/0\"",
+            "type": "string"
+          },
+          "tcp_flags": {
+            "description": "RouterOS flag expression e.g. \"syn,!ack\"",
+            "type": "string"
+          },
+          "dscp": {
+            "description": "Match incoming DSCP (0-63)",
+            "type": "string"
+          },
+          "priority": {
+            "description": "Match packet/queue priority (0-63)",
+            "type": "string"
+          },
+          "packet_size": {
+            "description": "e.g. \"1500\" or \"0-500\"",
+            "type": "string"
+          },
+          "layer7_protocol": {
+            "description": "Name of an /ip firewall layer7-protocol regex",
+            "type": "string"
+          },
+          "ipsec_policy": {
+            "description": "e.g. \"in,ipsec\" or \"out,none\"",
+            "type": "string"
+          },
+          "nth": {
+            "description": "e.g. \"2,1\" — every 2nd packet",
+            "type": "string"
+          },
+          "random": {
+            "description": "Match a random N% of packets (1-99)",
+            "type": "string"
+          },
+          "time": {
+            "description": "e.g. \"8h-16h,mon,tue,wed,thu,fri\"",
+            "type": "string"
+          },
+          "hotspot": {
+            "description": "e.g. \"auth\", \"!auth\", \"from-client\"",
+            "type": "string"
+          },
+          "p2p": {
             "type": "string"
           },
           "new_connection_mark": {
@@ -10689,6 +10822,26 @@
           "out_interface": {
             "type": "string"
           },
+          "in_interface_list": {
+            "type": "string"
+          },
+          "out_interface_list": {
+            "type": "string"
+          },
+          "src_address_list": {
+            "description": "Negate with \"!name\" (e.g. \"!IR\")",
+            "type": "string"
+          },
+          "dst_address_list": {
+            "description": "Negate with \"!name\" (e.g. \"!IR\")",
+            "type": "string"
+          },
+          "src_address_type": {
+            "type": "string"
+          },
+          "dst_address_type": {
+            "type": "string"
+          },
           "connection_mark": {
             "type": "string"
           },
@@ -10701,6 +10854,57 @@
           "connection_state": {
             "type": "string"
           },
+          "connection_nat_state": {
+            "type": "string"
+          },
+          "connection_type": {
+            "type": "string"
+          },
+          "connection_bytes": {
+            "type": "string"
+          },
+          "connection_limit": {
+            "type": "string"
+          },
+          "connection_rate": {
+            "type": "string"
+          },
+          "per_connection_classifier": {
+            "type": "string"
+          },
+          "tcp_flags": {
+            "type": "string"
+          },
+          "dscp": {
+            "type": "string"
+          },
+          "priority": {
+            "type": "string"
+          },
+          "packet_size": {
+            "type": "string"
+          },
+          "layer7_protocol": {
+            "type": "string"
+          },
+          "ipsec_policy": {
+            "type": "string"
+          },
+          "nth": {
+            "type": "string"
+          },
+          "random": {
+            "type": "string"
+          },
+          "time": {
+            "type": "string"
+          },
+          "hotspot": {
+            "type": "string"
+          },
+          "p2p": {
+            "type": "string"
+          },
           "new_connection_mark": {
             "type": "string"
           },
@@ -21290,7 +21494,7 @@
         "idempotentHint": true,
         "openWorldHint": false
       },
-      "description": "Exports the complete device configuration to a `.rsc` plain-text script file (`/export file=<name>`), re-applicable via `import_configuration`. Unlike `create_backup`, the result is human-readable plain text — not a binary snapshot — and passwords are hidden by default (`hide_sensitive=true`). `file_format` changes only the file extension used when looking up the saved file — no `format=` flag is ever sent to RouterOS, so the content is always RouterOS script text regardless of the chosen extension; selecting `json` or `xml` will also cause the post-export file lookup to fail because RouterOS saves the file as `.rsc`. Use the `compact` boolean to omit default values, or `verbose` to include all parameters; `export_type` only controls where the `file=` argument is positioned in the command and does not independently drive compactness or verbosity. For a single subsection only use `export_section`. Returns file details of the created export file.",
+      "description": "Exports the complete device configuration to a `.rsc` plain-text script file (`/export file=<name>`), re-applicable via `import_configuration`. Unlike `create_backup`, the result is human-readable plain text — not a binary snapshot — and passwords are hidden by default (`hide_sensitive=true`). `file_format` changes only the file extension used when looking up the saved file — no `format=` flag is ever sent to RouterOS, so the content is always RouterOS script text regardless of the chosen extension; selecting `json` or `xml` will also cause the post-export file lookup to fail because RouterOS saves the file as `.rsc`. ALWAYS default to a FULL configuration export: leave `compact` and `verbose` off (the plain full export) unless the user explicitly asks for less or more. Set `compact` ONLY when the user wants a smaller diff that omits default values, or `verbose` ONLY when they want every parameter (including defaults). `export_type` only controls where the `file=` argument is positioned in the command and does not independently drive compactness or verbosity. For a single subsection only use `export_section`. Returns file details of the created export file.",
       "inputSchema": {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "type": "object",
@@ -21830,7 +22034,7 @@
         "destructiveHint": false,
         "openWorldHint": false
       },
-      "description": "Captures the device's full configuration with `/export` and saves it as a timestamped plain-text `.rsc` file in the MCP server's LOCAL backup vault (default `~/.mikrotik-mcp/backups/`, override with the `MIKROTIK_BACKUP_DIR` env var) — NOT on the device and NOT in S3. The filename is `<device>_<date_time>.rsc` stamped in the device's local clock (24-hour; Jalali for the Tehran timezone, Gregorian otherwise). This is a host-side, human-readable, diffable copy you can restore later with restore_local_backup. Compare: create_backup makes a binary `/system backup` file ON the device; capture_config_snapshot stores an export in the local snapshot database; upload_backup_to_s3 pushes to S3. show_sensitive=true includes secrets (keys/passwords) in the export. Returns the saved filename, byte size and vault path.",
+      "description": "Captures the device's full configuration with `/export` and saves it as a timestamped plain-text `.rsc` file in the MCP server's LOCAL backup vault (default `~/.mikrotik-mcp/backups/`, override with the `MIKROTIK_BACKUP_DIR` env var) — NOT on the device and NOT in S3. The filename is `<device-slug>_<date_time>.rsc` — the device name is slugified (spaces/underscores/etc → dash) — stamped in the device's local clock (24-hour; Jalali for the Tehran timezone, Gregorian otherwise). This is a host-side, human-readable, diffable copy you can restore later with restore_local_backup. Compare: create_backup makes a binary `/system backup` file ON the device; capture_config_snapshot stores an export in the local snapshot database; upload_backup_to_s3 pushes to S3. ALWAYS default to a FULL backup of the complete configuration: call this with no option flags (the bare `/export`) unless the user explicitly asks for less or more. Narrow it ONLY on request — set compact to drop default values, or use export_section for a single subsection. Broaden it ONLY on request — set verbose to include every parameter (even defaults), show_sensitive to include secrets (keys/passwords), or use create_backup for a binary full-system snapshot. terse just changes the text to one machine-readable line per item. Returns the saved filename, byte size and vault path.",
       "inputSchema": {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "type": "object",
@@ -21843,9 +22047,24 @@
             "default": false,
             "description": "Include secrets (keys/passwords) in the export. Default false.",
             "type": "boolean"
+          },
+          "verbose": {
+            "default": false,
+            "description": "Include every parameter, even defaults (RouterOS `verbose`).",
+            "type": "boolean"
+          },
+          "compact": {
+            "default": false,
+            "description": "Export only non-default values (RouterOS `compact`; ignored if verbose).",
+            "type": "boolean"
+          },
+          "terse": {
+            "default": false,
+            "description": "One self-contained, machine-readable line per item (RouterOS `terse`).",
+            "type": "boolean"
           }
         },
-        "required": ["show_sensitive"],
+        "required": ["show_sensitive", "verbose", "compact", "terse"],
         "additionalProperties": false
       }
     },

package/schemas/tools/create_local_backup.json

@@ -11,8 +11,23 @@
       "default": false,
       "description": "Include secrets (keys/passwords) in the export. Default false.",
       "type": "boolean"
+    },
+    "verbose": {
+      "default": false,
+      "description": "Include every parameter, even defaults (RouterOS `verbose`).",
+      "type": "boolean"
+    },
+    "compact": {
+      "default": false,
+      "description": "Export only non-default values (RouterOS `compact`; ignored if verbose).",
+      "type": "boolean"
+    },
+    "terse": {
+      "default": false,
+      "description": "One self-contained, machine-readable line per item (RouterOS `terse`).",
+      "type": "boolean"
     }
   },
-  "required": ["show_sensitive"],
+  "required": ["show_sensitive", "verbose", "compact", "terse"],
   "additionalProperties": false
 }

package/schemas/tools/create_mangle_rule.json

@@ -48,11 +48,34 @@
       "type": "string"
     },
     "in_interface": {
+      "description": "Negatable, e.g. \"!ether1\"",
       "type": "string"
     },
     "out_interface": {
       "type": "string"
     },
+    "in_interface_list": {
+      "description": "Interface list, negatable e.g. \"!WAN\"",
+      "type": "string"
+    },
+    "out_interface_list": {
+      "type": "string"
+    },
+    "src_address_list": {
+      "description": "Match src in a named list; negate \"!name\"",
+      "type": "string"
+    },
+    "dst_address_list": {
+      "description": "Match dst in a named list; negate \"!name\" (e.g. \"!IR\" routes foreign traffic)",
+      "type": "string"
+    },
+    "src_address_type": {
+      "description": "e.g. \"local\", \"unicast\", \"!local\"",
+      "type": "string"
+    },
+    "dst_address_type": {
+      "type": "string"
+    },
     "connection_mark": {
       "type": "string"
     },
@@ -63,7 +86,74 @@
       "type": "string"
     },
     "connection_state": {
-      "description": "e.g. \"new\", \"established,related\", \"invalid\"",
+      "description": "e.g. \"new\", \"established,related\", \"!invalid\"",
+      "type": "string"
+    },
+    "connection_nat_state": {
+      "description": "\"srcnat\" / \"dstnat\" / \"!dstnat\"",
+      "type": "string"
+    },
+    "connection_type": {
+      "description": "Helper, e.g. \"sip\", \"ftp\"",
+      "type": "string"
+    },
+    "connection_bytes": {
+      "description": "e.g. \"1000000-0\" (>1 MB connections)",
+      "type": "string"
+    },
+    "connection_limit": {
+      "description": "e.g. \"100,32\"",
+      "type": "string"
+    },
+    "connection_rate": {
+      "description": "e.g. \"100k-1M\"",
+      "type": "string"
+    },
+    "per_connection_classifier": {
+      "description": "PCC for load balancing, e.g. \"both-addresses:2/0\"",
+      "type": "string"
+    },
+    "tcp_flags": {
+      "description": "RouterOS flag expression e.g. \"syn,!ack\"",
+      "type": "string"
+    },
+    "dscp": {
+      "description": "Match incoming DSCP (0-63)",
+      "type": "string"
+    },
+    "priority": {
+      "description": "Match packet/queue priority (0-63)",
+      "type": "string"
+    },
+    "packet_size": {
+      "description": "e.g. \"1500\" or \"0-500\"",
+      "type": "string"
+    },
+    "layer7_protocol": {
+      "description": "Name of an /ip firewall layer7-protocol regex",
+      "type": "string"
+    },
+    "ipsec_policy": {
+      "description": "e.g. \"in,ipsec\" or \"out,none\"",
+      "type": "string"
+    },
+    "nth": {
+      "description": "e.g. \"2,1\" — every 2nd packet",
+      "type": "string"
+    },
+    "random": {
+      "description": "Match a random N% of packets (1-99)",
+      "type": "string"
+    },
+    "time": {
+      "description": "e.g. \"8h-16h,mon,tue,wed,thu,fri\"",
+      "type": "string"
+    },
+    "hotspot": {
+      "description": "e.g. \"auth\", \"!auth\", \"from-client\"",
+      "type": "string"
+    },
+    "p2p": {
       "type": "string"
     },
     "new_connection_mark": {

package/schemas/tools/create_nat_rule.json

@@ -26,11 +26,34 @@
       "type": "string"
     },
     "in_interface": {
+      "description": "Negatable, e.g. \"!ether1\"",
       "type": "string"
     },
     "out_interface": {
       "type": "string"
     },
+    "in_interface_list": {
+      "description": "Interface list, e.g. \"WAN\" or \"!LAN\"",
+      "type": "string"
+    },
+    "out_interface_list": {
+      "type": "string"
+    },
+    "src_address_list": {
+      "description": "Match src in a named list; negate \"!name\"",
+      "type": "string"
+    },
+    "dst_address_list": {
+      "description": "Match dst in a named list; negate \"!name\"",
+      "type": "string"
+    },
+    "connection_mark": {
+      "type": "string"
+    },
+    "connection_nat_state": {
+      "description": "\"srcnat\" / \"dstnat\" / \"!dstnat\"",
+      "type": "string"
+    },
     "to_addresses": {
       "description": "Single IP or range e.g. \"10.0.0.1\" or \"10.0.0.1-10.0.0.10\"",
       "type": "string"

package/schemas/tools/update_mangle_rule.json

@@ -33,6 +33,26 @@
     "out_interface": {
       "type": "string"
     },
+    "in_interface_list": {
+      "type": "string"
+    },
+    "out_interface_list": {
+      "type": "string"
+    },
+    "src_address_list": {
+      "description": "Negate with \"!name\" (e.g. \"!IR\")",
+      "type": "string"
+    },
+    "dst_address_list": {
+      "description": "Negate with \"!name\" (e.g. \"!IR\")",
+      "type": "string"
+    },
+    "src_address_type": {
+      "type": "string"
+    },
+    "dst_address_type": {
+      "type": "string"
+    },
     "connection_mark": {
       "type": "string"
     },
@@ -45,6 +65,57 @@
     "connection_state": {
       "type": "string"
     },
+    "connection_nat_state": {
+      "type": "string"
+    },
+    "connection_type": {
+      "type": "string"
+    },
+    "connection_bytes": {
+      "type": "string"
+    },
+    "connection_limit": {
+      "type": "string"
+    },
+    "connection_rate": {
+      "type": "string"
+    },
+    "per_connection_classifier": {
+      "type": "string"
+    },
+    "tcp_flags": {
+      "type": "string"
+    },
+    "dscp": {
+      "type": "string"
+    },
+    "priority": {
+      "type": "string"
+    },
+    "packet_size": {
+      "type": "string"
+    },
+    "layer7_protocol": {
+      "type": "string"
+    },
+    "ipsec_policy": {
+      "type": "string"
+    },
+    "nth": {
+      "type": "string"
+    },
+    "random": {
+      "type": "string"
+    },
+    "time": {
+      "type": "string"
+    },
+    "hotspot": {
+      "type": "string"
+    },
+    "p2p": {
+      "type": "string"
+    },
     "new_connection_mark": {
       "type": "string"
     },

package/schemas/tools/update_nat_rule.json

@@ -33,6 +33,26 @@
     "out_interface": {
       "type": "string"
     },
+    "in_interface_list": {
+      "type": "string"
+    },
+    "out_interface_list": {
+      "type": "string"
+    },
+    "src_address_list": {
+      "description": "Negate with \"!name\"",
+      "type": "string"
+    },
+    "dst_address_list": {
+      "description": "Negate with \"!name\"",
+      "type": "string"
+    },
+    "connection_mark": {
+      "type": "string"
+    },
+    "connection_nat_state": {
+      "type": "string"
+    },
     "to_addresses": {
       "type": "string"
     },