@usex/mikrotik-mcp 3.2.0 → 3.4.0

package/schemas/tool-catalog.json

@@ -1,8 +1,8 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "version": "2.5.0",
+  "version": "3.3.0",
   "generated": "by scripts/gen-schemas.ts — do not edit by hand",
-  "toolCount": 664,
+  "toolCount": 670,
   "tools": [
     {
       "name": "list_interfaces",
@@ -2089,7 +2089,7 @@
         "destructiveHint": false,
         "openWorldHint": false
       },
-      "description": "Adds an IPv4 static route (`/ip route add`) to the routing table — use this to define any non-default unicast next-hop (host, subnet, or summarized prefix). For the 0.0.0.0/0 default gateway use add_default_route; for null/drop routes use add_blackhole_route; for IPv6 use add_ipv6_route. `distance` sets priority (1–255, lower wins); `routing_mark` assigns the route to a policy-routing table; `check_gateway` (\"ping\" or \"arp\") enables active gateway monitoring. Returns the created route's detail including its `.id`.",
+      "description": "Adds an IPv4 static route (`/ip route add`) to the routing table — use this to define any non-default unicast next-hop (host, subnet, or summarized prefix). For the 0.0.0.0/0 default gateway use add_default_route; for null/drop routes use add_blackhole_route; for IPv6 use add_ipv6_route. `distance` sets priority (1–255, lower wins); `routing_table` assigns the route to a policy-routing table (must already exist — see add_routing_table); `check_gateway` (\"ping\" or \"arp\") enables active gateway monitoring. Returns the created route's detail including its `.id`.",
       "inputSchema": {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "type": "object",
@@ -2117,7 +2117,12 @@
             "minimum": -9007199254740991,
             "maximum": 9007199254740991
           },
+          "routing_table": {
+            "description": "Policy-routing table name, e.g. \"main\" or a custom table (RouterOS v7)",
+            "type": "string"
+          },
           "routing_mark": {
+            "description": "Deprecated alias for routing_table (RouterOS v6 name)",
             "type": "string"
           },
           "comment": {
@@ -2151,7 +2156,7 @@
         "idempotentHint": true,
         "openWorldHint": false
       },
-      "description": "Lists IPv4 routes from `/ip route` with optional filters — the primary tool for inspecting what routes the router knows. `dst_filter` and `gateway_filter` do substring matching; `routing_mark_filter` and `distance_filter` do exact matching; `active_only`/`disabled_only`/`dynamic_only`/`static_only` are boolean flags. For a table-scoped view of active routes use get_routing_table; for counts and summary stats use get_route_statistics; for IPv6 use list_ipv6_routes. Returns all matching route entries.",
+      "description": "Lists IPv4 routes from `/ip route` with optional filters — the primary tool for inspecting what routes the router knows. `dst_filter` and `gateway_filter` do substring matching; `routing_table_filter` and `distance_filter` do exact matching; `active_only`/`disabled_only`/`dynamic_only`/`static_only` are boolean flags. For a table-scoped view of active routes use get_routing_table; for counts and summary stats use get_route_statistics; for IPv6 use list_ipv6_routes. Returns all matching route entries.",
       "inputSchema": {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "type": "object",
@@ -2162,7 +2167,12 @@
           "gateway_filter": {
             "type": "string"
           },
+          "routing_table_filter": {
+            "description": "Exact policy-routing table name (RouterOS v7)",
+            "type": "string"
+          },
           "routing_mark_filter": {
+            "description": "Deprecated alias for routing_table_filter",
             "type": "string"
           },
           "distance_filter": {
@@ -2223,7 +2233,7 @@
         "idempotentHint": true,
         "openWorldHint": false
       },
-      "description": "Modifies an existing IPv4 static route (`/ip route set`) — change its gateway, dst-address, distance, scope, routing-mark, VRF interface, preferred-source, or gateway check method. `route_id` is the `*N` `.id` from list_routes. Pass an empty string (\"\") for `routing_mark`, `vrf_interface`, or `pref_src` to clear those fields. For toggling active state without editing attributes use enable_route / disable_route. Returns the updated route detail.",
+      "description": "Modifies an existing IPv4 static route (`/ip route set`) — change its gateway, dst-address, distance, scope, routing-table, VRF interface, preferred-source, or gateway check method. `route_id` is the `*N` `.id` from list_routes. Pass an empty string (\"\") for `routing_table`, `vrf_interface`, or `pref_src` to clear those fields. For toggling active state without editing attributes use enable_route / disable_route. Returns the updated route detail.",
       "inputSchema": {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "type": "object",
@@ -2255,7 +2265,12 @@
             "minimum": -9007199254740991,
             "maximum": 9007199254740991
           },
+          "routing_table": {
+            "description": "Policy-routing table name (RouterOS v7); \"\" clears it",
+            "type": "string"
+          },
           "routing_mark": {
+            "description": "Deprecated alias for routing_table (RouterOS v6 name)",
             "type": "string"
           },
           "comment": {
@@ -12830,7 +12845,7 @@
         "destructiveHint": false,
         "openWorldHint": false
       },
-      "description": "Create an outbound SSTP client tunnel interface (`/interface sstp-client add`) so this router dials out to a remote SSTP server over TLS. Use when this device must act as a VPN client, not the VPN server — for server-side settings use `set_sstp_server`. `connect_to` is the remote host:port or IP address. For L2TP outbound tunnels use `create_l2tp_client`, for OpenVPN use `create_ovpn_client`, for PPTP use `create_pptp_client`. Credentials are accepted but redacted from return values. Returns the created interface detail (name, status, remote address); use the interface `name` with `get_sstp_client` or `remove_sstp_client`.",
+      "description": "Create an outbound SSTP client tunnel interface (`/interface sstp-client add`) so this router dials out to a remote SSTP server over TLS. Use when this device must act as a VPN client, not the VPN server — for server-side settings use `set_sstp_server`. `connect_to` is the remote server address (IP or DNS name); the TCP port is separate. You may pass the port in `port` or inline as `host:port` in `connect_to` (it is split out automatically — RouterOS rejects a port embedded in connect-to). SSTP defaults to 443. For L2TP outbound tunnels use `create_l2tp_client`, for OpenVPN use `create_ovpn_client`, for PPTP use `create_pptp_client`. Credentials are accepted but redacted from return values. Returns the created interface detail (name, status, remote address); use the interface `name` with `get_sstp_client` or `remove_sstp_client`.",
       "inputSchema": {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "type": "object",
@@ -12841,7 +12856,13 @@
           },
           "connect_to": {
             "type": "string",
-            "description": "Remote SSTP server address (host:port or IP)"
+            "description": "Remote SSTP server address (IP or DNS name; host:port also accepted)"
+          },
+          "port": {
+            "description": "TCP port (default 443 if omitted)",
+            "type": "integer",
+            "minimum": -9007199254740991,
+            "maximum": 9007199254740991
           },
           "user": {
             "type": "string"
@@ -19814,6 +19835,150 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "create_local_backup",
+      "title": "Create Local Config Backup (host vault)",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Captures the device's full configuration with `/export` and saves it as a timestamped plain-text `.rsc` file in the MCP server's LOCAL backup vault (default `~/.mikrotik-mcp/backups/`, override with the `MIKROTIK_BACKUP_DIR` env var) — NOT on the device and NOT in S3. The filename is `<device>_<date_time>.rsc` stamped in the device's local clock (24-hour; Jalali for the Tehran timezone, Gregorian otherwise). This is a host-side, human-readable, diffable copy you can restore later with restore_local_backup. Compare: create_backup makes a binary `/system backup` file ON the device; capture_config_snapshot stores an export in the local snapshot database; upload_backup_to_s3 pushes to S3. show_sensitive=true includes secrets (keys/passwords) in the export. Returns the saved filename, byte size and vault path.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "label": {
+            "description": "Optional label appended to the filename, e.g. \"pre-upgrade\".",
+            "type": "string"
+          },
+          "show_sensitive": {
+            "default": false,
+            "description": "Include secrets (keys/passwords) in the export. Default false.",
+            "type": "boolean"
+          }
+        },
+        "required": ["show_sensitive"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "list_local_backups",
+      "title": "List Local Config Backups (host vault)",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Lists the `/export` config backups stored in the MCP server's LOCAL backup vault (`~/.mikrotik-mcp/backups/` or `MIKROTIK_BACKUP_DIR`) — each with its filename, source device, byte size and capture time, newest first. These are host-side text backups created by create_local_backup, distinct from list_backups (binary `.backup` files ON the device) and list_s3_backups (objects in an S3 bucket). Use a returned filename with get_local_backup, restore_local_backup, rename_local_backup or delete_local_backup.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {},
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "get_local_backup",
+      "title": "Get Local Config Backup Contents (host vault)",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Returns the full `/export` `.rsc` text of one backup in the MCP server's LOCAL vault, by filename (get the name from list_local_backups). This is the exact configuration script that restore_local_backup would replay onto a device — useful for reviewing or diffing a saved config before restoring. Returns a 'not found' message if the filename doesn't exist. `name` is the exact filename from list_local_backups.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "Backup filename, e.g. 'edge_2026-06-25_1430.rsc'."
+          }
+        },
+        "required": ["name"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "rename_local_backup",
+      "title": "Rename Local Config Backup (host vault)",
+      "risk": "write-idempotent",
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Renames a backup file in the MCP server's LOCAL vault (e.g. to label it 'pre-upgrade' or 'golden'). Forces an `.rsc` extension and refuses if the target name already exists. Host-side only — it does NOT touch the device or S3. `name` is the current filename (from list_local_backups); `new_name` is the desired filename. Returns the new filename.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "Current backup filename."
+          },
+          "new_name": {
+            "type": "string",
+            "description": "Desired filename (an `.rsc` suffix is added if missing)."
+          }
+        },
+        "required": ["name", "new_name"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "delete_local_backup",
+      "title": "Delete Local Config Backup (host vault)",
+      "risk": "destructive",
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Permanently deletes one backup file from the MCP server's LOCAL vault by filename. This removes only the host-side copy — it does NOT touch the device's configuration, its on-device `.backup` files, or any S3 object. Use list_local_backups to find the name; for deleting an S3 object use delete_s3_backup instead. Returns a 'not found' message if the filename doesn't exist.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "Backup filename to delete."
+          }
+        },
+        "required": ["name"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "restore_local_backup",
+      "title": "Restore Local Config Backup to Device (Safe Mode)",
+      "risk": "dangerous",
+      "annotations": {
+        "destructiveHint": true,
+        "openWorldHint": false
+      },
+      "description": "Replays a LOCAL vault backup's `/export` configuration onto a device INSIDE RouterOS Safe Mode — every command is held in memory and AUTO-REVERTS if the SSH session drops, so a change that would lock you out is undone instead of sticking. With confirm=false (default) it applies the whole config, then rolls it all back — a true dry-run that proves the restore runs cleanly. With confirm=true it commits, but ONLY after verifying the device still answers. Because a `/export` is additive, restoring onto an already-configured device LAYERS the saved config on top (duplicate rules are possible) — it is cleanest on a freshly reset device. Requires SSH (Safe Mode is not available on MAC-Telnet devices). Alternatives: import_configuration runs a `.rsc` already ON the device; restore_backup loads a binary `.backup` (and reboots). `name` is the filename from list_local_backups.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "Backup filename to restore (from list_local_backups)."
+          },
+          "confirm": {
+            "default": false,
+            "description": "false = apply, then roll back (dry-run). true = commit if still reachable.",
+            "type": "boolean"
+          }
+        },
+        "required": ["name", "confirm"],
+        "additionalProperties": false
+      }
+    },
     {
       "name": "list_disks",
       "title": "List All Attached Disks",

package/schemas/tools/add_route.json

@@ -26,7 +26,12 @@
       "minimum": -9007199254740991,
       "maximum": 9007199254740991
     },
+    "routing_table": {
+      "description": "Policy-routing table name, e.g. \"main\" or a custom table (RouterOS v7)",
+      "type": "string"
+    },
     "routing_mark": {
+      "description": "Deprecated alias for routing_table (RouterOS v6 name)",
       "type": "string"
     },
     "comment": {

package/schemas/tools/create_local_backup.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "create_local_backup",
+  "type": "object",
+  "properties": {
+    "label": {
+      "description": "Optional label appended to the filename, e.g. \"pre-upgrade\".",
+      "type": "string"
+    },
+    "show_sensitive": {
+      "default": false,
+      "description": "Include secrets (keys/passwords) in the export. Default false.",
+      "type": "boolean"
+    }
+  },
+  "required": ["show_sensitive"],
+  "additionalProperties": false
+}

package/schemas/tools/create_sstp_client.json

@@ -9,7 +9,13 @@
     },
     "connect_to": {
       "type": "string",
-      "description": "Remote SSTP server address (host:port or IP)"
+      "description": "Remote SSTP server address (IP or DNS name; host:port also accepted)"
+    },
+    "port": {
+      "description": "TCP port (default 443 if omitted)",
+      "type": "integer",
+      "minimum": -9007199254740991,
+      "maximum": 9007199254740991
     },
     "user": {
       "type": "string"

package/schemas/tools/delete_local_backup.json

@@ -0,0 +1,13 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "delete_local_backup",
+  "type": "object",
+  "properties": {
+    "name": {
+      "type": "string",
+      "description": "Backup filename to delete."
+    }
+  },
+  "required": ["name"],
+  "additionalProperties": false
+}

package/schemas/tools/get_local_backup.json

@@ -0,0 +1,13 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "get_local_backup",
+  "type": "object",
+  "properties": {
+    "name": {
+      "type": "string",
+      "description": "Backup filename, e.g. 'edge_2026-06-25_1430.rsc'."
+    }
+  },
+  "required": ["name"],
+  "additionalProperties": false
+}

package/schemas/tools/list_local_backups.json

@@ -0,0 +1,7 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "list_local_backups",
+  "type": "object",
+  "properties": {},
+  "additionalProperties": false
+}

package/schemas/tools/list_routes.json

@@ -9,7 +9,12 @@
     "gateway_filter": {
       "type": "string"
     },
+    "routing_table_filter": {
+      "description": "Exact policy-routing table name (RouterOS v7)",
+      "type": "string"
+    },
     "routing_mark_filter": {
+      "description": "Deprecated alias for routing_table_filter",
       "type": "string"
     },
     "distance_filter": {

package/schemas/tools/rename_local_backup.json

@@ -0,0 +1,17 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "rename_local_backup",
+  "type": "object",
+  "properties": {
+    "name": {
+      "type": "string",
+      "description": "Current backup filename."
+    },
+    "new_name": {
+      "type": "string",
+      "description": "Desired filename (an `.rsc` suffix is added if missing)."
+    }
+  },
+  "required": ["name", "new_name"],
+  "additionalProperties": false
+}

package/schemas/tools/restore_local_backup.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "restore_local_backup",
+  "type": "object",
+  "properties": {
+    "name": {
+      "type": "string",
+      "description": "Backup filename to restore (from list_local_backups)."
+    },
+    "confirm": {
+      "default": false,
+      "description": "false = apply, then roll back (dry-run). true = commit if still reachable.",
+      "type": "boolean"
+    }
+  },
+  "required": ["name", "confirm"],
+  "additionalProperties": false
+}

package/schemas/tools/update_route.json

@@ -30,7 +30,12 @@
       "minimum": -9007199254740991,
       "maximum": 9007199254740991
     },
+    "routing_table": {
+      "description": "Policy-routing table name (RouterOS v7); \"\" clears it",
+      "type": "string"
+    },
     "routing_mark": {
+      "description": "Deprecated alias for routing_table (RouterOS v6 name)",
       "type": "string"
     },
     "comment": {