@usex/mikrotik-mcp 3.19.0 → 3.20.0

package/dist/cli.js

@@ -782,7 +782,6 @@ import { z as z3 } from "zod";
 
 // src/ssh/safe-mode.ts
 var PROMPT_RE = /\[.+?@.+?\] (?:<SAFE> )?> ?$/m;
-var NORMAL_PROMPT_RE = /\[.+?@.+?\] > ?$/m;
 var ANSI_RE = /\x1B(?:\[[0-9;]*[mA-HJ-MSTfhilnprsu]|[()][0-9A-Za-z]|\[?\?\d+[hl])/g;
 function stripAnsi(text) {
   return text.replace(ANSI_RE, "");
@@ -793,13 +792,17 @@ function isSafeModeActivated(response) {
     return true;
   return /safe mode[^\n]*\b(?:success|taken|enabled|active)\b/i.test(response);
 }
-function isSafeModeReleased(response) {
+function lastNonEmptyLine(response) {
   const lines = response.replace(/\r/g, "").split(`
 `).map((l) => l.trimEnd()).filter(Boolean);
-  const last = lines.at(-1) ?? "";
-  return NORMAL_PROMPT_RE.test(last) && !last.includes("<SAFE>");
+  return lines.at(-1) ?? "";
+}
+function classifyPrompt(response) {
+  const last = lastNonEmptyLine(response);
+  if (!PROMPT_RE.test(last))
+    return "unknown";
+  return last.includes("<SAFE>") ? "safe" : "released";
 }
-
 class SafeModeManager {
   deviceName;
   ssh = null;
@@ -874,13 +877,30 @@ class SafeModeManager {
     return this.lock(async () => {
       if (!this.active || !this.channel)
         return "Safe mode is not active. Nothing to commit.";
+      this.channel.write(`
+`);
+      const probe = await this.readSettledPrompt();
+      const before = classifyPrompt(probe);
+      if (before === "released") {
+        this.cleanup();
+        return "Safe mode already exited \u2014 your changes are committed. Safe mode DISABLED.";
+      }
+      if (before === "unknown") {
+        return "Could not read a prompt to determine Safe Mode state. The session is left open so " + "nothing is reverted \u2014 call get_safe_mode_status, retry commit_safe_mode, or " + `rollback_safe_mode. Last output: ${probe.slice(-160)}`;
+      }
       this.channel.write(CTRL_X);
-      const response = await this.readUntilPrompt(15000, (c) => isSafeModeReleased(c));
-      if (!isSafeModeReleased(response)) {
-        return "Commit may not have completed: the device did not return to a normal prompt " + `after exiting Safe Mode. Session left open \u2014 retry commit_safe_mode. Response: ${response.slice(-200)}`;
+      this.channel.write(`
+`);
+      const after = await this.readSettledPrompt();
+      switch (classifyPrompt(after)) {
+        case "released":
+          this.cleanup();
+          return "Changes committed successfully. Safe mode DISABLED.";
+        case "safe":
+          return "Commit not completed \u2014 the device is still in Safe Mode. Your changes remain held " + "in memory (not reverted); call commit_safe_mode again to retry, or rollback_safe_mode " + "to discard them.";
+        default:
+          return "Commit status unclear \u2014 no prompt seen after exiting Safe Mode. The session is left " + "open so nothing is reverted; verify with get_safe_mode_status or retry commit_safe_mode. " + `Last output: ${after.slice(-160)}`;
       }
-      this.cleanup();
-      return "Changes committed successfully. Safe mode DISABLED.";
     });
   }
   rollback() {
@@ -916,6 +936,33 @@ class SafeModeManager {
       channel.on("data", onData);
     });
   }
+  readSettledPrompt(quietMs = 450, maxMs = 8000) {
+    const channel = this.channel;
+    if (!channel)
+      return Promise.resolve("");
+    return new Promise((resolve2) => {
+      let buf = "";
+      let quiet;
+      let hard;
+      function done() {
+        clearTimeout(hard);
+        if (quiet)
+          clearTimeout(quiet);
+        channel.removeListener("data", onData);
+        resolve2(stripAnsi(buf));
+      }
+      function onData(chunk) {
+        buf += decodeOutput(chunk);
+        if (PROMPT_RE.test(lastNonEmptyLine(stripAnsi(buf)))) {
+          if (quiet)
+            clearTimeout(quiet);
+          quiet = setTimeout(done, quietMs);
+        }
+      }
+      hard = setTimeout(done, maxMs);
+      channel.on("data", onData);
+    });
+  }
   extractOutput(raw, command) {
     const text = raw.replace(/\r\n/g, `
 `).replace(/\r/g, `
@@ -1006,7 +1053,7 @@ function createContext(sendLog, device) {
 }
 
 // src/core/routeros.ts
-var BARE_SAFE = /^[\w.\-:/,*@]+$/;
+var BARE_SAFE = /^[\w.\-:/,*@!]+$/;
 function quoteValue(value) {
   if (typeof value === "number" || typeof value === "boolean")
     return String(value);
@@ -6317,6 +6364,12 @@ async function updateNatRule(a, ctx) {
   put("protocol", a.protocol);
   put("in-interface", a.in_interface);
   put("out-interface", a.out_interface);
+  put("in-interface-list", a.in_interface_list);
+  put("out-interface-list", a.out_interface_list);
+  put("src-address-list", a.src_address_list);
+  put("dst-address-list", a.dst_address_list);
+  put("connection-mark", a.connection_mark);
+  put("connection-nat-state", a.connection_nat_state);
   put("to-addresses", a.to_addresses);
   put("to-ports", a.to_ports);
   if (a.comment !== undefined)
@@ -6353,8 +6406,14 @@ var firewallNatTools = [
       src_port: z23.string().optional(),
       dst_port: z23.string().optional(),
       protocol: z23.string().optional(),
-      in_interface: z23.string().optional(),
+      in_interface: z23.string().optional().describe('Negatable, e.g. "!ether1"'),
       out_interface: z23.string().optional(),
+      in_interface_list: z23.string().optional().describe('Interface list, e.g. "WAN" or "!LAN"'),
+      out_interface_list: z23.string().optional(),
+      src_address_list: z23.string().optional().describe('Match src in a named list; negate "!name"'),
+      dst_address_list: z23.string().optional().describe('Match dst in a named list; negate "!name"'),
+      connection_mark: z23.string().optional(),
+      connection_nat_state: z23.string().optional().describe('"srcnat" / "dstnat" / "!dstnat"'),
       to_addresses: z23.string().optional().describe('Single IP or range e.g. "10.0.0.1" or "10.0.0.1-10.0.0.10"'),
       to_ports: z23.string().optional().describe('Single port or range e.g. "8080" or "8080-8090"'),
       comment: z23.string().optional(),
@@ -6394,7 +6453,7 @@ var firewallNatTools = [
       } else if (a.chain === "dstnat" && !dstnatActions.includes(a.action)) {
         return `Error: Invalid action '${a.action}' for dstnat. Must be one of: ${dstnatActions.join(", ")}`;
       }
-      const cmd = new Cmd("/ip firewall nat add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("to-addresses", a.to_addresses).opt("to-ports", a.to_ports).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
+      const cmd = new Cmd("/ip firewall nat add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("in-interface-list", a.in_interface_list).opt("out-interface-list", a.out_interface_list).opt("src-address-list", a.src_address_list).opt("dst-address-list", a.dst_address_list).opt("connection-mark", a.connection_mark).opt("connection-nat-state", a.connection_nat_state).opt("to-addresses", a.to_addresses).opt("to-ports", a.to_ports).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
       const result = await executeMikrotikCommand(cmd, ctx);
       const trimmed = result.trim();
       if (looksLikeError(trimmed)) {
@@ -6492,6 +6551,12 @@ ${result}`;
       protocol: z23.string().optional(),
       in_interface: z23.string().optional(),
       out_interface: z23.string().optional(),
+      in_interface_list: z23.string().optional(),
+      out_interface_list: z23.string().optional(),
+      src_address_list: z23.string().optional().describe('Negate with "!name"'),
+      dst_address_list: z23.string().optional().describe('Negate with "!name"'),
+      connection_mark: z23.string().optional(),
+      connection_nat_state: z23.string().optional(),
       to_addresses: z23.string().optional(),
       to_ports: z23.string().optional(),
       comment: z23.string().optional(),
@@ -6584,10 +6649,33 @@ async function updateMangleRule(a, ctx) {
   put("protocol", a.protocol);
   put("in-interface", a.in_interface);
   put("out-interface", a.out_interface);
+  put("in-interface-list", a.in_interface_list);
+  put("out-interface-list", a.out_interface_list);
+  put("src-address-list", a.src_address_list);
+  put("dst-address-list", a.dst_address_list);
+  put("src-address-type", a.src_address_type);
+  put("dst-address-type", a.dst_address_type);
   put("connection-mark", a.connection_mark);
   put("packet-mark", a.packet_mark);
   put("routing-mark", a.routing_mark);
   put("connection-state", a.connection_state);
+  put("connection-nat-state", a.connection_nat_state);
+  put("connection-type", a.connection_type);
+  put("connection-bytes", a.connection_bytes);
+  put("connection-limit", a.connection_limit);
+  put("connection-rate", a.connection_rate);
+  put("per-connection-classifier", a.per_connection_classifier);
+  put("tcp-flags", a.tcp_flags);
+  put("dscp", a.dscp);
+  put("priority", a.priority);
+  put("packet-size", a.packet_size);
+  put("layer7-protocol", a.layer7_protocol);
+  put("ipsec-policy", a.ipsec_policy);
+  put("nth", a.nth);
+  put("random", a.random);
+  put("time", a.time);
+  put("hotspot", a.hotspot);
+  put("p2p", a.p2p);
   put("new-connection-mark", a.new_connection_mark);
   put("new-packet-mark", a.new_packet_mark);
   put("new-routing-mark", a.new_routing_mark);
@@ -6624,7 +6712,7 @@ var firewallMangleTools = [
     name: "create_mangle_rule",
     title: "Create IPv4 Firewall Mangle Rule",
     annotations: WRITE,
-    description: "Creates an IPv4 mangle rule (`/ip firewall mangle add`) \u2014 the packet-marking and header-modification table, " + "used to mark connections/packets/routing (for policy routing, QoS and per-connection classification) or to change DSCP/TTL/MSS. " + "For accept/drop decisions use create_filter_rule; for address translation use create_nat_rule; for IPv6 mangle use create_ipv6_mangle_rule. " + "chain: prerouting/input/forward/output/postrouting. " + "action: mark-connection/mark-packet/mark-routing/change-dscp/change-ttl/change-mss/add-src-to-address-list/add-dst-to-address-list/fasttrack-connection/route/set-priority/accept/etc. " + "Set the matching new-*-mark field for mark-* actions and keep passthrough=true so later rules can also match the same packet; " + "for add-*-to-address-list set address_list (and optionally address_list_timeout). " + "place_before accepts a rule number or ID (*N) to control insertion position. " + "Returns the created rule's detail including its `.id`.",
+    description: "Creates an IPv4 mangle rule (`/ip firewall mangle add`) \u2014 the packet-marking and header-modification table, " + "used to mark connections/packets/routing (for policy routing, QoS and per-connection classification) or to change DSCP/TTL/MSS. " + "For accept/drop decisions use create_filter_rule; for address translation use create_nat_rule; for IPv6 mangle use create_ipv6_mangle_rule. " + "chain: prerouting/input/forward/output/postrouting. " + "action: mark-connection/mark-packet/mark-routing/change-dscp/change-ttl/change-mss/add-src-to-address-list/add-dst-to-address-list/fasttrack-connection/route/set-priority/accept/etc. " + "Set the matching new-*-mark field for mark-* actions and keep passthrough=true so later rules can also match the same packet; " + "for add-*-to-address-list set address_list (and optionally address_list_timeout). " + "Full match surface: address-lists (src_address_list/dst_address_list \u2014 negate with a leading '!', e.g. dst_address_list='!IR' to route traffic NOT bound for a list), " + "interface-lists, per_connection_classifier (PCC load-balancing), connection_nat_state, tcp_flags, dscp, layer7_protocol, time, and more. " + "Typical policy-routing rule: chain=prerouting, src_address=<lan>, dst_address_list='!IR', action=mark-routing, new_routing_mark=<table>, then a routing rule/route uses that table. " + "place_before accepts a rule number or ID (*N) to control insertion position. " + "Returns the created rule's detail including its `.id`.",
     inputSchema: {
       chain: z24.enum(["prerouting", "input", "forward", "output", "postrouting"]),
       action: z24.enum([
@@ -6654,12 +6742,35 @@ var firewallMangleTools = [
       src_port: z24.string().optional(),
       dst_port: z24.string().optional(),
       protocol: z24.string().optional(),
-      in_interface: z24.string().optional(),
+      in_interface: z24.string().optional().describe('Negatable, e.g. "!ether1"'),
       out_interface: z24.string().optional(),
+      in_interface_list: z24.string().optional().describe('Interface list, negatable e.g. "!WAN"'),
+      out_interface_list: z24.string().optional(),
+      src_address_list: z24.string().optional().describe('Match src in a named list; negate "!name"'),
+      dst_address_list: z24.string().optional().describe('Match dst in a named list; negate "!name" (e.g. "!IR" routes foreign traffic)'),
+      src_address_type: z24.string().optional().describe('e.g. "local", "unicast", "!local"'),
+      dst_address_type: z24.string().optional(),
       connection_mark: z24.string().optional(),
       packet_mark: z24.string().optional(),
       routing_mark: z24.string().optional(),
-      connection_state: z24.string().optional().describe('e.g. "new", "established,related", "invalid"'),
+      connection_state: z24.string().optional().describe('e.g. "new", "established,related", "!invalid"'),
+      connection_nat_state: z24.string().optional().describe('"srcnat" / "dstnat" / "!dstnat"'),
+      connection_type: z24.string().optional().describe('Helper, e.g. "sip", "ftp"'),
+      connection_bytes: z24.string().optional().describe('e.g. "1000000-0" (>1 MB connections)'),
+      connection_limit: z24.string().optional().describe('e.g. "100,32"'),
+      connection_rate: z24.string().optional().describe('e.g. "100k-1M"'),
+      per_connection_classifier: z24.string().optional().describe('PCC for load balancing, e.g. "both-addresses:2/0"'),
+      tcp_flags: z24.string().optional().describe('RouterOS flag expression e.g. "syn,!ack"'),
+      dscp: z24.string().optional().describe("Match incoming DSCP (0-63)"),
+      priority: z24.string().optional().describe("Match packet/queue priority (0-63)"),
+      packet_size: z24.string().optional().describe('e.g. "1500" or "0-500"'),
+      layer7_protocol: z24.string().optional().describe("Name of an /ip firewall layer7-protocol regex"),
+      ipsec_policy: z24.string().optional().describe('e.g. "in,ipsec" or "out,none"'),
+      nth: z24.string().optional().describe('e.g. "2,1" \u2014 every 2nd packet'),
+      random: z24.string().optional().describe("Match a random N% of packets (1-99)"),
+      time: z24.string().optional().describe('e.g. "8h-16h,mon,tue,wed,thu,fri"'),
+      hotspot: z24.string().optional().describe('e.g. "auth", "!auth", "from-client"'),
+      p2p: z24.string().optional(),
       new_connection_mark: z24.string().optional(),
       new_packet_mark: z24.string().optional(),
       new_routing_mark: z24.string().optional(),
@@ -6678,7 +6789,7 @@ var firewallMangleTools = [
     },
     async handler(a, ctx) {
       ctx.info(`Creating mangle rule: chain=${a.chain}, action=${a.action}`);
-      const cmd = new Cmd("/ip firewall mangle add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("connection-mark", a.connection_mark).opt("packet-mark", a.packet_mark).opt("routing-mark", a.routing_mark).opt("connection-state", a.connection_state).opt("new-connection-mark", a.new_connection_mark).opt("new-packet-mark", a.new_packet_mark).opt("new-routing-mark", a.new_routing_mark).opt("new-dscp", a.new_dscp).opt("new-ttl", a.new_ttl).opt("new-mss", a.new_mss).opt("routing-table", a.routing_table).opt("address-list", a.address_list).opt("address-list-timeout", a.address_list_timeout).bool("passthrough", a.passthrough).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
+      const cmd = new Cmd("/ip firewall mangle add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("in-interface-list", a.in_interface_list).opt("out-interface-list", a.out_interface_list).opt("src-address-list", a.src_address_list).opt("dst-address-list", a.dst_address_list).opt("src-address-type", a.src_address_type).opt("dst-address-type", a.dst_address_type).opt("connection-mark", a.connection_mark).opt("packet-mark", a.packet_mark).opt("routing-mark", a.routing_mark).opt("connection-state", a.connection_state).opt("connection-nat-state", a.connection_nat_state).opt("connection-type", a.connection_type).opt("connection-bytes", a.connection_bytes).opt("connection-limit", a.connection_limit).opt("connection-rate", a.connection_rate).opt("per-connection-classifier", a.per_connection_classifier).opt("tcp-flags", a.tcp_flags).opt("dscp", a.dscp).opt("priority", a.priority).opt("packet-size", a.packet_size).opt("layer7-protocol", a.layer7_protocol).opt("ipsec-policy", a.ipsec_policy).opt("nth", a.nth).opt("random", a.random).opt("time", a.time).opt("hotspot", a.hotspot).opt("p2p", a.p2p).opt("new-connection-mark", a.new_connection_mark).opt("new-packet-mark", a.new_packet_mark).opt("new-routing-mark", a.new_routing_mark).opt("new-dscp", a.new_dscp).opt("new-ttl", a.new_ttl).opt("new-mss", a.new_mss).opt("routing-table", a.routing_table).opt("address-list", a.address_list).opt("address-list-timeout", a.address_list_timeout).bool("passthrough", a.passthrough).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
       const result = await executeMikrotikCommand(cmd, ctx);
       const trimmed = result.trim();
       if (looksLikeError(trimmed)) {
@@ -6772,10 +6883,33 @@ ${result}`;
       protocol: z24.string().optional(),
       in_interface: z24.string().optional(),
       out_interface: z24.string().optional(),
+      in_interface_list: z24.string().optional(),
+      out_interface_list: z24.string().optional(),
+      src_address_list: z24.string().optional().describe('Negate with "!name" (e.g. "!IR")'),
+      dst_address_list: z24.string().optional().describe('Negate with "!name" (e.g. "!IR")'),
+      src_address_type: z24.string().optional(),
+      dst_address_type: z24.string().optional(),
       connection_mark: z24.string().optional(),
       packet_mark: z24.string().optional(),
       routing_mark: z24.string().optional(),
       connection_state: z24.string().optional(),
+      connection_nat_state: z24.string().optional(),
+      connection_type: z24.string().optional(),
+      connection_bytes: z24.string().optional(),
+      connection_limit: z24.string().optional(),
+      connection_rate: z24.string().optional(),
+      per_connection_classifier: z24.string().optional(),
+      tcp_flags: z24.string().optional(),
+      dscp: z24.string().optional(),
+      priority: z24.string().optional(),
+      packet_size: z24.string().optional(),
+      layer7_protocol: z24.string().optional(),
+      ipsec_policy: z24.string().optional(),
+      nth: z24.string().optional(),
+      random: z24.string().optional(),
+      time: z24.string().optional(),
+      hotspot: z24.string().optional(),
+      p2p: z24.string().optional(),
       new_connection_mark: z24.string().optional(),
       new_packet_mark: z24.string().optional(),
       new_routing_mark: z24.string().optional(),
@@ -23788,7 +23922,7 @@ function registerPrompts(server) {
 // package.json
 var package_default = {
   name: "@usex/mikrotik-mcp",
-  version: "3.19.0",
+  version: "3.20.0",
   description: "MCP server for MikroTik RouterOS \u2014 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   keywords: [
     "ai",

package/dist/index.d.ts

@@ -185,6 +185,14 @@ declare class SafeModeManager {
 	* (safe-mode marker present/absent), not merely the first prompt-shaped line.
 	*/
 	private readUntilPrompt;
+	/**
+	* Read until the output SETTLES: once any prompt is visible, wait for a quiet
+	* gap (`quietMs` with no new bytes) before resolving, or give up at `maxMs`.
+	* Used by commit, where Ctrl+X + Enter can emit a transient `<SAFE>` redraw
+	* followed by the real post-commit prompt — settling on the LAST prompt after
+	* a quiet period is what makes mode detection reliable.
+	*/
+	private readSettledPrompt;
 	private extractOutput;
 	private cleanup;
 }

package/dist/index.js

@@ -768,7 +768,6 @@ function connectErrorMessage(name, dc, lastError) {
 
 // src/ssh/safe-mode.ts
 var PROMPT_RE = /\[.+?@.+?\] (?:<SAFE> )?> ?$/m;
-var NORMAL_PROMPT_RE = /\[.+?@.+?\] > ?$/m;
 var ANSI_RE = /\x1B(?:\[[0-9;]*[mA-HJ-MSTfhilnprsu]|[()][0-9A-Za-z]|\[?\?\d+[hl])/g;
 function stripAnsi(text) {
   return text.replace(ANSI_RE, "");
@@ -779,13 +778,17 @@ function isSafeModeActivated(response) {
     return true;
   return /safe mode[^\n]*\b(?:success|taken|enabled|active)\b/i.test(response);
 }
-function isSafeModeReleased(response) {
+function lastNonEmptyLine(response) {
   const lines = response.replace(/\r/g, "").split(`
 `).map((l) => l.trimEnd()).filter(Boolean);
-  const last = lines.at(-1) ?? "";
-  return NORMAL_PROMPT_RE.test(last) && !last.includes("<SAFE>");
+  return lines.at(-1) ?? "";
+}
+function classifyPrompt(response) {
+  const last = lastNonEmptyLine(response);
+  if (!PROMPT_RE.test(last))
+    return "unknown";
+  return last.includes("<SAFE>") ? "safe" : "released";
 }
-
 class SafeModeManager {
   deviceName;
   ssh = null;
@@ -860,13 +863,30 @@ class SafeModeManager {
     return this.lock(async () => {
       if (!this.active || !this.channel)
         return "Safe mode is not active. Nothing to commit.";
+      this.channel.write(`
+`);
+      const probe = await this.readSettledPrompt();
+      const before = classifyPrompt(probe);
+      if (before === "released") {
+        this.cleanup();
+        return "Safe mode already exited \u2014 your changes are committed. Safe mode DISABLED.";
+      }
+      if (before === "unknown") {
+        return "Could not read a prompt to determine Safe Mode state. The session is left open so " + "nothing is reverted \u2014 call get_safe_mode_status, retry commit_safe_mode, or " + `rollback_safe_mode. Last output: ${probe.slice(-160)}`;
+      }
       this.channel.write(CTRL_X);
-      const response = await this.readUntilPrompt(15000, (c) => isSafeModeReleased(c));
-      if (!isSafeModeReleased(response)) {
-        return "Commit may not have completed: the device did not return to a normal prompt " + `after exiting Safe Mode. Session left open \u2014 retry commit_safe_mode. Response: ${response.slice(-200)}`;
+      this.channel.write(`
+`);
+      const after = await this.readSettledPrompt();
+      switch (classifyPrompt(after)) {
+        case "released":
+          this.cleanup();
+          return "Changes committed successfully. Safe mode DISABLED.";
+        case "safe":
+          return "Commit not completed \u2014 the device is still in Safe Mode. Your changes remain held " + "in memory (not reverted); call commit_safe_mode again to retry, or rollback_safe_mode " + "to discard them.";
+        default:
+          return "Commit status unclear \u2014 no prompt seen after exiting Safe Mode. The session is left " + "open so nothing is reverted; verify with get_safe_mode_status or retry commit_safe_mode. " + `Last output: ${after.slice(-160)}`;
       }
-      this.cleanup();
-      return "Changes committed successfully. Safe mode DISABLED.";
     });
   }
   rollback() {
@@ -902,6 +922,33 @@ class SafeModeManager {
       channel.on("data", onData);
     });
   }
+  readSettledPrompt(quietMs = 450, maxMs = 8000) {
+    const channel = this.channel;
+    if (!channel)
+      return Promise.resolve("");
+    return new Promise((resolve2) => {
+      let buf = "";
+      let quiet;
+      let hard;
+      function done() {
+        clearTimeout(hard);
+        if (quiet)
+          clearTimeout(quiet);
+        channel.removeListener("data", onData);
+        resolve2(stripAnsi(buf));
+      }
+      function onData(chunk) {
+        buf += decodeOutput(chunk);
+        if (PROMPT_RE.test(lastNonEmptyLine(stripAnsi(buf)))) {
+          if (quiet)
+            clearTimeout(quiet);
+          quiet = setTimeout(done, quietMs);
+        }
+      }
+      hard = setTimeout(done, maxMs);
+      channel.on("data", onData);
+    });
+  }
   extractOutput(raw, command) {
     const text = raw.replace(/\r\n/g, `
 `).replace(/\r/g, `
@@ -991,7 +1038,7 @@ function createContext(sendLog, device) {
 }
 
 // src/core/routeros.ts
-var BARE_SAFE = /^[\w.\-:/,*@]+$/;
+var BARE_SAFE = /^[\w.\-:/,*@!]+$/;
 function quoteValue(value) {
   if (typeof value === "number" || typeof value === "boolean")
     return String(value);
@@ -6329,6 +6376,12 @@ async function updateNatRule(a, ctx) {
   put("protocol", a.protocol);
   put("in-interface", a.in_interface);
   put("out-interface", a.out_interface);
+  put("in-interface-list", a.in_interface_list);
+  put("out-interface-list", a.out_interface_list);
+  put("src-address-list", a.src_address_list);
+  put("dst-address-list", a.dst_address_list);
+  put("connection-mark", a.connection_mark);
+  put("connection-nat-state", a.connection_nat_state);
   put("to-addresses", a.to_addresses);
   put("to-ports", a.to_ports);
   if (a.comment !== undefined)
@@ -6365,8 +6418,14 @@ var firewallNatTools = [
       src_port: z24.string().optional(),
       dst_port: z24.string().optional(),
       protocol: z24.string().optional(),
-      in_interface: z24.string().optional(),
+      in_interface: z24.string().optional().describe('Negatable, e.g. "!ether1"'),
       out_interface: z24.string().optional(),
+      in_interface_list: z24.string().optional().describe('Interface list, e.g. "WAN" or "!LAN"'),
+      out_interface_list: z24.string().optional(),
+      src_address_list: z24.string().optional().describe('Match src in a named list; negate "!name"'),
+      dst_address_list: z24.string().optional().describe('Match dst in a named list; negate "!name"'),
+      connection_mark: z24.string().optional(),
+      connection_nat_state: z24.string().optional().describe('"srcnat" / "dstnat" / "!dstnat"'),
       to_addresses: z24.string().optional().describe('Single IP or range e.g. "10.0.0.1" or "10.0.0.1-10.0.0.10"'),
       to_ports: z24.string().optional().describe('Single port or range e.g. "8080" or "8080-8090"'),
       comment: z24.string().optional(),
@@ -6406,7 +6465,7 @@ var firewallNatTools = [
       } else if (a.chain === "dstnat" && !dstnatActions.includes(a.action)) {
         return `Error: Invalid action '${a.action}' for dstnat. Must be one of: ${dstnatActions.join(", ")}`;
       }
-      const cmd = new Cmd("/ip firewall nat add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("to-addresses", a.to_addresses).opt("to-ports", a.to_ports).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
+      const cmd = new Cmd("/ip firewall nat add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("in-interface-list", a.in_interface_list).opt("out-interface-list", a.out_interface_list).opt("src-address-list", a.src_address_list).opt("dst-address-list", a.dst_address_list).opt("connection-mark", a.connection_mark).opt("connection-nat-state", a.connection_nat_state).opt("to-addresses", a.to_addresses).opt("to-ports", a.to_ports).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
       const result = await executeMikrotikCommand(cmd, ctx);
       const trimmed = result.trim();
       if (looksLikeError(trimmed)) {
@@ -6504,6 +6563,12 @@ ${result}`;
       protocol: z24.string().optional(),
       in_interface: z24.string().optional(),
       out_interface: z24.string().optional(),
+      in_interface_list: z24.string().optional(),
+      out_interface_list: z24.string().optional(),
+      src_address_list: z24.string().optional().describe('Negate with "!name"'),
+      dst_address_list: z24.string().optional().describe('Negate with "!name"'),
+      connection_mark: z24.string().optional(),
+      connection_nat_state: z24.string().optional(),
       to_addresses: z24.string().optional(),
       to_ports: z24.string().optional(),
       comment: z24.string().optional(),
@@ -6596,10 +6661,33 @@ async function updateMangleRule(a, ctx) {
   put("protocol", a.protocol);
   put("in-interface", a.in_interface);
   put("out-interface", a.out_interface);
+  put("in-interface-list", a.in_interface_list);
+  put("out-interface-list", a.out_interface_list);
+  put("src-address-list", a.src_address_list);
+  put("dst-address-list", a.dst_address_list);
+  put("src-address-type", a.src_address_type);
+  put("dst-address-type", a.dst_address_type);
   put("connection-mark", a.connection_mark);
   put("packet-mark", a.packet_mark);
   put("routing-mark", a.routing_mark);
   put("connection-state", a.connection_state);
+  put("connection-nat-state", a.connection_nat_state);
+  put("connection-type", a.connection_type);
+  put("connection-bytes", a.connection_bytes);
+  put("connection-limit", a.connection_limit);
+  put("connection-rate", a.connection_rate);
+  put("per-connection-classifier", a.per_connection_classifier);
+  put("tcp-flags", a.tcp_flags);
+  put("dscp", a.dscp);
+  put("priority", a.priority);
+  put("packet-size", a.packet_size);
+  put("layer7-protocol", a.layer7_protocol);
+  put("ipsec-policy", a.ipsec_policy);
+  put("nth", a.nth);
+  put("random", a.random);
+  put("time", a.time);
+  put("hotspot", a.hotspot);
+  put("p2p", a.p2p);
   put("new-connection-mark", a.new_connection_mark);
   put("new-packet-mark", a.new_packet_mark);
   put("new-routing-mark", a.new_routing_mark);
@@ -6636,7 +6724,7 @@ var firewallMangleTools = [
     name: "create_mangle_rule",
     title: "Create IPv4 Firewall Mangle Rule",
     annotations: WRITE,
-    description: "Creates an IPv4 mangle rule (`/ip firewall mangle add`) \u2014 the packet-marking and header-modification table, " + "used to mark connections/packets/routing (for policy routing, QoS and per-connection classification) or to change DSCP/TTL/MSS. " + "For accept/drop decisions use create_filter_rule; for address translation use create_nat_rule; for IPv6 mangle use create_ipv6_mangle_rule. " + "chain: prerouting/input/forward/output/postrouting. " + "action: mark-connection/mark-packet/mark-routing/change-dscp/change-ttl/change-mss/add-src-to-address-list/add-dst-to-address-list/fasttrack-connection/route/set-priority/accept/etc. " + "Set the matching new-*-mark field for mark-* actions and keep passthrough=true so later rules can also match the same packet; " + "for add-*-to-address-list set address_list (and optionally address_list_timeout). " + "place_before accepts a rule number or ID (*N) to control insertion position. " + "Returns the created rule's detail including its `.id`.",
+    description: "Creates an IPv4 mangle rule (`/ip firewall mangle add`) \u2014 the packet-marking and header-modification table, " + "used to mark connections/packets/routing (for policy routing, QoS and per-connection classification) or to change DSCP/TTL/MSS. " + "For accept/drop decisions use create_filter_rule; for address translation use create_nat_rule; for IPv6 mangle use create_ipv6_mangle_rule. " + "chain: prerouting/input/forward/output/postrouting. " + "action: mark-connection/mark-packet/mark-routing/change-dscp/change-ttl/change-mss/add-src-to-address-list/add-dst-to-address-list/fasttrack-connection/route/set-priority/accept/etc. " + "Set the matching new-*-mark field for mark-* actions and keep passthrough=true so later rules can also match the same packet; " + "for add-*-to-address-list set address_list (and optionally address_list_timeout). " + "Full match surface: address-lists (src_address_list/dst_address_list \u2014 negate with a leading '!', e.g. dst_address_list='!IR' to route traffic NOT bound for a list), " + "interface-lists, per_connection_classifier (PCC load-balancing), connection_nat_state, tcp_flags, dscp, layer7_protocol, time, and more. " + "Typical policy-routing rule: chain=prerouting, src_address=<lan>, dst_address_list='!IR', action=mark-routing, new_routing_mark=<table>, then a routing rule/route uses that table. " + "place_before accepts a rule number or ID (*N) to control insertion position. " + "Returns the created rule's detail including its `.id`.",
     inputSchema: {
       chain: z25.enum(["prerouting", "input", "forward", "output", "postrouting"]),
       action: z25.enum([
@@ -6666,12 +6754,35 @@ var firewallMangleTools = [
       src_port: z25.string().optional(),
       dst_port: z25.string().optional(),
       protocol: z25.string().optional(),
-      in_interface: z25.string().optional(),
+      in_interface: z25.string().optional().describe('Negatable, e.g. "!ether1"'),
       out_interface: z25.string().optional(),
+      in_interface_list: z25.string().optional().describe('Interface list, negatable e.g. "!WAN"'),
+      out_interface_list: z25.string().optional(),
+      src_address_list: z25.string().optional().describe('Match src in a named list; negate "!name"'),
+      dst_address_list: z25.string().optional().describe('Match dst in a named list; negate "!name" (e.g. "!IR" routes foreign traffic)'),
+      src_address_type: z25.string().optional().describe('e.g. "local", "unicast", "!local"'),
+      dst_address_type: z25.string().optional(),
       connection_mark: z25.string().optional(),
       packet_mark: z25.string().optional(),
       routing_mark: z25.string().optional(),
-      connection_state: z25.string().optional().describe('e.g. "new", "established,related", "invalid"'),
+      connection_state: z25.string().optional().describe('e.g. "new", "established,related", "!invalid"'),
+      connection_nat_state: z25.string().optional().describe('"srcnat" / "dstnat" / "!dstnat"'),
+      connection_type: z25.string().optional().describe('Helper, e.g. "sip", "ftp"'),
+      connection_bytes: z25.string().optional().describe('e.g. "1000000-0" (>1 MB connections)'),
+      connection_limit: z25.string().optional().describe('e.g. "100,32"'),
+      connection_rate: z25.string().optional().describe('e.g. "100k-1M"'),
+      per_connection_classifier: z25.string().optional().describe('PCC for load balancing, e.g. "both-addresses:2/0"'),
+      tcp_flags: z25.string().optional().describe('RouterOS flag expression e.g. "syn,!ack"'),
+      dscp: z25.string().optional().describe("Match incoming DSCP (0-63)"),
+      priority: z25.string().optional().describe("Match packet/queue priority (0-63)"),
+      packet_size: z25.string().optional().describe('e.g. "1500" or "0-500"'),
+      layer7_protocol: z25.string().optional().describe("Name of an /ip firewall layer7-protocol regex"),
+      ipsec_policy: z25.string().optional().describe('e.g. "in,ipsec" or "out,none"'),
+      nth: z25.string().optional().describe('e.g. "2,1" \u2014 every 2nd packet'),
+      random: z25.string().optional().describe("Match a random N% of packets (1-99)"),
+      time: z25.string().optional().describe('e.g. "8h-16h,mon,tue,wed,thu,fri"'),
+      hotspot: z25.string().optional().describe('e.g. "auth", "!auth", "from-client"'),
+      p2p: z25.string().optional(),
       new_connection_mark: z25.string().optional(),
       new_packet_mark: z25.string().optional(),
       new_routing_mark: z25.string().optional(),
@@ -6690,7 +6801,7 @@ var firewallMangleTools = [
     },
     async handler(a, ctx) {
       ctx.info(`Creating mangle rule: chain=${a.chain}, action=${a.action}`);
-      const cmd = new Cmd("/ip firewall mangle add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("connection-mark", a.connection_mark).opt("packet-mark", a.packet_mark).opt("routing-mark", a.routing_mark).opt("connection-state", a.connection_state).opt("new-connection-mark", a.new_connection_mark).opt("new-packet-mark", a.new_packet_mark).opt("new-routing-mark", a.new_routing_mark).opt("new-dscp", a.new_dscp).opt("new-ttl", a.new_ttl).opt("new-mss", a.new_mss).opt("routing-table", a.routing_table).opt("address-list", a.address_list).opt("address-list-timeout", a.address_list_timeout).bool("passthrough", a.passthrough).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
+      const cmd = new Cmd("/ip firewall mangle add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("in-interface-list", a.in_interface_list).opt("out-interface-list", a.out_interface_list).opt("src-address-list", a.src_address_list).opt("dst-address-list", a.dst_address_list).opt("src-address-type", a.src_address_type).opt("dst-address-type", a.dst_address_type).opt("connection-mark", a.connection_mark).opt("packet-mark", a.packet_mark).opt("routing-mark", a.routing_mark).opt("connection-state", a.connection_state).opt("connection-nat-state", a.connection_nat_state).opt("connection-type", a.connection_type).opt("connection-bytes", a.connection_bytes).opt("connection-limit", a.connection_limit).opt("connection-rate", a.connection_rate).opt("per-connection-classifier", a.per_connection_classifier).opt("tcp-flags", a.tcp_flags).opt("dscp", a.dscp).opt("priority", a.priority).opt("packet-size", a.packet_size).opt("layer7-protocol", a.layer7_protocol).opt("ipsec-policy", a.ipsec_policy).opt("nth", a.nth).opt("random", a.random).opt("time", a.time).opt("hotspot", a.hotspot).opt("p2p", a.p2p).opt("new-connection-mark", a.new_connection_mark).opt("new-packet-mark", a.new_packet_mark).opt("new-routing-mark", a.new_routing_mark).opt("new-dscp", a.new_dscp).opt("new-ttl", a.new_ttl).opt("new-mss", a.new_mss).opt("routing-table", a.routing_table).opt("address-list", a.address_list).opt("address-list-timeout", a.address_list_timeout).bool("passthrough", a.passthrough).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
       const result = await executeMikrotikCommand(cmd, ctx);
       const trimmed = result.trim();
       if (looksLikeError(trimmed)) {
@@ -6784,10 +6895,33 @@ ${result}`;
       protocol: z25.string().optional(),
       in_interface: z25.string().optional(),
       out_interface: z25.string().optional(),
+      in_interface_list: z25.string().optional(),
+      out_interface_list: z25.string().optional(),
+      src_address_list: z25.string().optional().describe('Negate with "!name" (e.g. "!IR")'),
+      dst_address_list: z25.string().optional().describe('Negate with "!name" (e.g. "!IR")'),
+      src_address_type: z25.string().optional(),
+      dst_address_type: z25.string().optional(),
       connection_mark: z25.string().optional(),
       packet_mark: z25.string().optional(),
       routing_mark: z25.string().optional(),
       connection_state: z25.string().optional(),
+      connection_nat_state: z25.string().optional(),
+      connection_type: z25.string().optional(),
+      connection_bytes: z25.string().optional(),
+      connection_limit: z25.string().optional(),
+      connection_rate: z25.string().optional(),
+      per_connection_classifier: z25.string().optional(),
+      tcp_flags: z25.string().optional(),
+      dscp: z25.string().optional(),
+      priority: z25.string().optional(),
+      packet_size: z25.string().optional(),
+      layer7_protocol: z25.string().optional(),
+      ipsec_policy: z25.string().optional(),
+      nth: z25.string().optional(),
+      random: z25.string().optional(),
+      time: z25.string().optional(),
+      hotspot: z25.string().optional(),
+      p2p: z25.string().optional(),
       new_connection_mark: z25.string().optional(),
       new_packet_mark: z25.string().optional(),
       new_routing_mark: z25.string().optional(),
@@ -22188,7 +22322,7 @@ function selectToolModules(filter = {}, catalog = moduleCatalog) {
 // package.json
 var package_default = {
   name: "@usex/mikrotik-mcp",
-  version: "3.19.0",
+  version: "3.20.0",
   description: "MCP server for MikroTik RouterOS \u2014 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   keywords: [
     "ai",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usex/mikrotik-mcp",
-  "version": "3.19.0",
+  "version": "3.20.0",
   "description": "MCP server for MikroTik RouterOS — 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   "keywords": [
     "ai",

package/schemas/tool-catalog.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "version": "3.18.0",
+  "version": "3.19.0",
   "generated": "by scripts/gen-schemas.ts — do not edit by hand",
   "toolCount": 721,
   "tools": [
@@ -10179,11 +10179,34 @@
             "type": "string"
           },
           "in_interface": {
+            "description": "Negatable, e.g. \"!ether1\"",
             "type": "string"
           },
           "out_interface": {
             "type": "string"
           },
+          "in_interface_list": {
+            "description": "Interface list, e.g. \"WAN\" or \"!LAN\"",
+            "type": "string"
+          },
+          "out_interface_list": {
+            "type": "string"
+          },
+          "src_address_list": {
+            "description": "Match src in a named list; negate \"!name\"",
+            "type": "string"
+          },
+          "dst_address_list": {
+            "description": "Match dst in a named list; negate \"!name\"",
+            "type": "string"
+          },
+          "connection_mark": {
+            "type": "string"
+          },
+          "connection_nat_state": {
+            "description": "\"srcnat\" / \"dstnat\" / \"!dstnat\"",
+            "type": "string"
+          },
           "to_addresses": {
             "description": "Single IP or range e.g. \"10.0.0.1\" or \"10.0.0.1-10.0.0.10\"",
             "type": "string"
@@ -10327,6 +10350,26 @@
           "out_interface": {
             "type": "string"
           },
+          "in_interface_list": {
+            "type": "string"
+          },
+          "out_interface_list": {
+            "type": "string"
+          },
+          "src_address_list": {
+            "description": "Negate with \"!name\"",
+            "type": "string"
+          },
+          "dst_address_list": {
+            "description": "Negate with \"!name\"",
+            "type": "string"
+          },
+          "connection_mark": {
+            "type": "string"
+          },
+          "connection_nat_state": {
+            "type": "string"
+          },
           "to_addresses": {
             "type": "string"
           },
@@ -10452,7 +10495,7 @@
         "destructiveHint": false,
         "openWorldHint": false
       },
-      "description": "Creates an IPv4 mangle rule (`/ip firewall mangle add`) — the packet-marking and header-modification table, used to mark connections/packets/routing (for policy routing, QoS and per-connection classification) or to change DSCP/TTL/MSS. For accept/drop decisions use create_filter_rule; for address translation use create_nat_rule; for IPv6 mangle use create_ipv6_mangle_rule. chain: prerouting/input/forward/output/postrouting. action: mark-connection/mark-packet/mark-routing/change-dscp/change-ttl/change-mss/add-src-to-address-list/add-dst-to-address-list/fasttrack-connection/route/set-priority/accept/etc. Set the matching new-*-mark field for mark-* actions and keep passthrough=true so later rules can also match the same packet; for add-*-to-address-list set address_list (and optionally address_list_timeout). place_before accepts a rule number or ID (*N) to control insertion position. Returns the created rule's detail including its `.id`.",
+      "description": "Creates an IPv4 mangle rule (`/ip firewall mangle add`) — the packet-marking and header-modification table, used to mark connections/packets/routing (for policy routing, QoS and per-connection classification) or to change DSCP/TTL/MSS. For accept/drop decisions use create_filter_rule; for address translation use create_nat_rule; for IPv6 mangle use create_ipv6_mangle_rule. chain: prerouting/input/forward/output/postrouting. action: mark-connection/mark-packet/mark-routing/change-dscp/change-ttl/change-mss/add-src-to-address-list/add-dst-to-address-list/fasttrack-connection/route/set-priority/accept/etc. Set the matching new-*-mark field for mark-* actions and keep passthrough=true so later rules can also match the same packet; for add-*-to-address-list set address_list (and optionally address_list_timeout). Full match surface: address-lists (src_address_list/dst_address_list — negate with a leading '!', e.g. dst_address_list='!IR' to route traffic NOT bound for a list), interface-lists, per_connection_classifier (PCC load-balancing), connection_nat_state, tcp_flags, dscp, layer7_protocol, time, and more. Typical policy-routing rule: chain=prerouting, src_address=<lan>, dst_address_list='!IR', action=mark-routing, new_routing_mark=<table>, then a routing rule/route uses that table. place_before accepts a rule number or ID (*N) to control insertion position. Returns the created rule's detail including its `.id`.",
       "inputSchema": {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "type": "object",
@@ -10502,11 +10545,34 @@
             "type": "string"
           },
           "in_interface": {
+            "description": "Negatable, e.g. \"!ether1\"",
             "type": "string"
           },
           "out_interface": {
             "type": "string"
           },
+          "in_interface_list": {
+            "description": "Interface list, negatable e.g. \"!WAN\"",
+            "type": "string"
+          },
+          "out_interface_list": {
+            "type": "string"
+          },
+          "src_address_list": {
+            "description": "Match src in a named list; negate \"!name\"",
+            "type": "string"
+          },
+          "dst_address_list": {
+            "description": "Match dst in a named list; negate \"!name\" (e.g. \"!IR\" routes foreign traffic)",
+            "type": "string"
+          },
+          "src_address_type": {
+            "description": "e.g. \"local\", \"unicast\", \"!local\"",
+            "type": "string"
+          },
+          "dst_address_type": {
+            "type": "string"
+          },
           "connection_mark": {
             "type": "string"
           },
@@ -10517,7 +10583,74 @@
             "type": "string"
           },
           "connection_state": {
-            "description": "e.g. \"new\", \"established,related\", \"invalid\"",
+            "description": "e.g. \"new\", \"established,related\", \"!invalid\"",
+            "type": "string"
+          },
+          "connection_nat_state": {
+            "description": "\"srcnat\" / \"dstnat\" / \"!dstnat\"",
+            "type": "string"
+          },
+          "connection_type": {
+            "description": "Helper, e.g. \"sip\", \"ftp\"",
+            "type": "string"
+          },
+          "connection_bytes": {
+            "description": "e.g. \"1000000-0\" (>1 MB connections)",
+            "type": "string"
+          },
+          "connection_limit": {
+            "description": "e.g. \"100,32\"",
+            "type": "string"
+          },
+          "connection_rate": {
+            "description": "e.g. \"100k-1M\"",
+            "type": "string"
+          },
+          "per_connection_classifier": {
+            "description": "PCC for load balancing, e.g. \"both-addresses:2/0\"",
+            "type": "string"
+          },
+          "tcp_flags": {
+            "description": "RouterOS flag expression e.g. \"syn,!ack\"",
+            "type": "string"
+          },
+          "dscp": {
+            "description": "Match incoming DSCP (0-63)",
+            "type": "string"
+          },
+          "priority": {
+            "description": "Match packet/queue priority (0-63)",
+            "type": "string"
+          },
+          "packet_size": {
+            "description": "e.g. \"1500\" or \"0-500\"",
+            "type": "string"
+          },
+          "layer7_protocol": {
+            "description": "Name of an /ip firewall layer7-protocol regex",
+            "type": "string"
+          },
+          "ipsec_policy": {
+            "description": "e.g. \"in,ipsec\" or \"out,none\"",
+            "type": "string"
+          },
+          "nth": {
+            "description": "e.g. \"2,1\" — every 2nd packet",
+            "type": "string"
+          },
+          "random": {
+            "description": "Match a random N% of packets (1-99)",
+            "type": "string"
+          },
+          "time": {
+            "description": "e.g. \"8h-16h,mon,tue,wed,thu,fri\"",
+            "type": "string"
+          },
+          "hotspot": {
+            "description": "e.g. \"auth\", \"!auth\", \"from-client\"",
+            "type": "string"
+          },
+          "p2p": {
             "type": "string"
           },
           "new_connection_mark": {
@@ -10689,6 +10822,26 @@
           "out_interface": {
             "type": "string"
           },
+          "in_interface_list": {
+            "type": "string"
+          },
+          "out_interface_list": {
+            "type": "string"
+          },
+          "src_address_list": {
+            "description": "Negate with \"!name\" (e.g. \"!IR\")",
+            "type": "string"
+          },
+          "dst_address_list": {
+            "description": "Negate with \"!name\" (e.g. \"!IR\")",
+            "type": "string"
+          },
+          "src_address_type": {
+            "type": "string"
+          },
+          "dst_address_type": {
+            "type": "string"
+          },
           "connection_mark": {
             "type": "string"
           },
@@ -10701,6 +10854,57 @@
           "connection_state": {
             "type": "string"
           },
+          "connection_nat_state": {
+            "type": "string"
+          },
+          "connection_type": {
+            "type": "string"
+          },
+          "connection_bytes": {
+            "type": "string"
+          },
+          "connection_limit": {
+            "type": "string"
+          },
+          "connection_rate": {
+            "type": "string"
+          },
+          "per_connection_classifier": {
+            "type": "string"
+          },
+          "tcp_flags": {
+            "type": "string"
+          },
+          "dscp": {
+            "type": "string"
+          },
+          "priority": {
+            "type": "string"
+          },
+          "packet_size": {
+            "type": "string"
+          },
+          "layer7_protocol": {
+            "type": "string"
+          },
+          "ipsec_policy": {
+            "type": "string"
+          },
+          "nth": {
+            "type": "string"
+          },
+          "random": {
+            "type": "string"
+          },
+          "time": {
+            "type": "string"
+          },
+          "hotspot": {
+            "type": "string"
+          },
+          "p2p": {
+            "type": "string"
+          },
           "new_connection_mark": {
             "type": "string"
           },

package/schemas/tools/create_mangle_rule.json

@@ -48,11 +48,34 @@
       "type": "string"
     },
     "in_interface": {
+      "description": "Negatable, e.g. \"!ether1\"",
       "type": "string"
     },
     "out_interface": {
       "type": "string"
     },
+    "in_interface_list": {
+      "description": "Interface list, negatable e.g. \"!WAN\"",
+      "type": "string"
+    },
+    "out_interface_list": {
+      "type": "string"
+    },
+    "src_address_list": {
+      "description": "Match src in a named list; negate \"!name\"",
+      "type": "string"
+    },
+    "dst_address_list": {
+      "description": "Match dst in a named list; negate \"!name\" (e.g. \"!IR\" routes foreign traffic)",
+      "type": "string"
+    },
+    "src_address_type": {
+      "description": "e.g. \"local\", \"unicast\", \"!local\"",
+      "type": "string"
+    },
+    "dst_address_type": {
+      "type": "string"
+    },
     "connection_mark": {
       "type": "string"
     },
@@ -63,7 +86,74 @@
       "type": "string"
     },
     "connection_state": {
-      "description": "e.g. \"new\", \"established,related\", \"invalid\"",
+      "description": "e.g. \"new\", \"established,related\", \"!invalid\"",
+      "type": "string"
+    },
+    "connection_nat_state": {
+      "description": "\"srcnat\" / \"dstnat\" / \"!dstnat\"",
+      "type": "string"
+    },
+    "connection_type": {
+      "description": "Helper, e.g. \"sip\", \"ftp\"",
+      "type": "string"
+    },
+    "connection_bytes": {
+      "description": "e.g. \"1000000-0\" (>1 MB connections)",
+      "type": "string"
+    },
+    "connection_limit": {
+      "description": "e.g. \"100,32\"",
+      "type": "string"
+    },
+    "connection_rate": {
+      "description": "e.g. \"100k-1M\"",
+      "type": "string"
+    },
+    "per_connection_classifier": {
+      "description": "PCC for load balancing, e.g. \"both-addresses:2/0\"",
+      "type": "string"
+    },
+    "tcp_flags": {
+      "description": "RouterOS flag expression e.g. \"syn,!ack\"",
+      "type": "string"
+    },
+    "dscp": {
+      "description": "Match incoming DSCP (0-63)",
+      "type": "string"
+    },
+    "priority": {
+      "description": "Match packet/queue priority (0-63)",
+      "type": "string"
+    },
+    "packet_size": {
+      "description": "e.g. \"1500\" or \"0-500\"",
+      "type": "string"
+    },
+    "layer7_protocol": {
+      "description": "Name of an /ip firewall layer7-protocol regex",
+      "type": "string"
+    },
+    "ipsec_policy": {
+      "description": "e.g. \"in,ipsec\" or \"out,none\"",
+      "type": "string"
+    },
+    "nth": {
+      "description": "e.g. \"2,1\" — every 2nd packet",
+      "type": "string"
+    },
+    "random": {
+      "description": "Match a random N% of packets (1-99)",
+      "type": "string"
+    },
+    "time": {
+      "description": "e.g. \"8h-16h,mon,tue,wed,thu,fri\"",
+      "type": "string"
+    },
+    "hotspot": {
+      "description": "e.g. \"auth\", \"!auth\", \"from-client\"",
+      "type": "string"
+    },
+    "p2p": {
       "type": "string"
     },
     "new_connection_mark": {

package/schemas/tools/create_nat_rule.json

@@ -26,11 +26,34 @@
       "type": "string"
     },
     "in_interface": {
+      "description": "Negatable, e.g. \"!ether1\"",
       "type": "string"
     },
     "out_interface": {
       "type": "string"
     },
+    "in_interface_list": {
+      "description": "Interface list, e.g. \"WAN\" or \"!LAN\"",
+      "type": "string"
+    },
+    "out_interface_list": {
+      "type": "string"
+    },
+    "src_address_list": {
+      "description": "Match src in a named list; negate \"!name\"",
+      "type": "string"
+    },
+    "dst_address_list": {
+      "description": "Match dst in a named list; negate \"!name\"",
+      "type": "string"
+    },
+    "connection_mark": {
+      "type": "string"
+    },
+    "connection_nat_state": {
+      "description": "\"srcnat\" / \"dstnat\" / \"!dstnat\"",
+      "type": "string"
+    },
     "to_addresses": {
       "description": "Single IP or range e.g. \"10.0.0.1\" or \"10.0.0.1-10.0.0.10\"",
       "type": "string"

package/schemas/tools/update_mangle_rule.json

@@ -33,6 +33,26 @@
     "out_interface": {
       "type": "string"
     },
+    "in_interface_list": {
+      "type": "string"
+    },
+    "out_interface_list": {
+      "type": "string"
+    },
+    "src_address_list": {
+      "description": "Negate with \"!name\" (e.g. \"!IR\")",
+      "type": "string"
+    },
+    "dst_address_list": {
+      "description": "Negate with \"!name\" (e.g. \"!IR\")",
+      "type": "string"
+    },
+    "src_address_type": {
+      "type": "string"
+    },
+    "dst_address_type": {
+      "type": "string"
+    },
     "connection_mark": {
       "type": "string"
     },
@@ -45,6 +65,57 @@
     "connection_state": {
       "type": "string"
     },
+    "connection_nat_state": {
+      "type": "string"
+    },
+    "connection_type": {
+      "type": "string"
+    },
+    "connection_bytes": {
+      "type": "string"
+    },
+    "connection_limit": {
+      "type": "string"
+    },
+    "connection_rate": {
+      "type": "string"
+    },
+    "per_connection_classifier": {
+      "type": "string"
+    },
+    "tcp_flags": {
+      "type": "string"
+    },
+    "dscp": {
+      "type": "string"
+    },
+    "priority": {
+      "type": "string"
+    },
+    "packet_size": {
+      "type": "string"
+    },
+    "layer7_protocol": {
+      "type": "string"
+    },
+    "ipsec_policy": {
+      "type": "string"
+    },
+    "nth": {
+      "type": "string"
+    },
+    "random": {
+      "type": "string"
+    },
+    "time": {
+      "type": "string"
+    },
+    "hotspot": {
+      "type": "string"
+    },
+    "p2p": {
+      "type": "string"
+    },
     "new_connection_mark": {
       "type": "string"
     },

package/schemas/tools/update_nat_rule.json

@@ -33,6 +33,26 @@
     "out_interface": {
       "type": "string"
     },
+    "in_interface_list": {
+      "type": "string"
+    },
+    "out_interface_list": {
+      "type": "string"
+    },
+    "src_address_list": {
+      "description": "Negate with \"!name\"",
+      "type": "string"
+    },
+    "dst_address_list": {
+      "description": "Negate with \"!name\"",
+      "type": "string"
+    },
+    "connection_mark": {
+      "type": "string"
+    },
+    "connection_nat_state": {
+      "type": "string"
+    },
     "to_addresses": {
       "type": "string"
     },