@usex/mikrotik-mcp 3.27.0 → 3.28.0

package/schemas/tool-catalog.json

@@ -1,8 +1,8 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "version": "3.26.0",
+  "version": "3.27.0",
   "generated": "by scripts/gen-schemas.ts — do not edit by hand",
-  "toolCount": 738,
+  "toolCount": 758,
   "tools": [
     {
       "name": "list_interfaces",
@@ -26152,11 +26152,30 @@
         "idempotentHint": true,
         "openWorldHint": false
       },
-      "description": "List all storage disks (`/disk print`) attached to the MikroTik device — USB drives, NVMe, and internal flash. Use this to discover available storage and obtain disk names before calling get_disk or format_disk. Returns each disk's name, type, size, and status. For per-disk detail use get_disk.",
+      "description": "List all storage devices (`/disk print`) attached to the MikroTik — NVMe, SATA/SSD, USB drives, eMMC/internal flash, their partitions, plus any RAID/rsync/RAM virtual disks. Use this to discover storage and obtain each disk's `slot` (the identifier needed by get_disk, format_disk, set_disk, share_disk, eject_disk and remove_disk). Returns slot, type, model/serial, interface, size, free space, filesystem, label and mount point. Optionally filter by partial `slot_filter`, `type_filter` (e.g. raid, partition, rsync) or `interface_filter` (e.g. nvme, usb, sata). Set `detail=true` for the full per-disk property block. For one disk use get_disk.",
       "inputSchema": {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "type": "object",
-        "properties": {},
+        "properties": {
+          "slot_filter": {
+            "description": "Partial slot match, e.g. 'usb'",
+            "type": "string"
+          },
+          "type_filter": {
+            "description": "Partial type match, e.g. 'raid', 'partition'",
+            "type": "string"
+          },
+          "interface_filter": {
+            "description": "Partial interface match, e.g. 'nvme', 'usb'",
+            "type": "string"
+          },
+          "detail": {
+            "default": false,
+            "description": "Show the full per-disk property block",
+            "type": "boolean"
+          }
+        },
+        "required": ["detail"],
         "additionalProperties": false
       }
     },
@@ -26169,17 +26188,17 @@
         "idempotentHint": true,
         "openWorldHint": false
       },
-      "description": "Get detailed information about a single disk (`/disk print detail where name=...`). Use this to inspect a specific disk's filesystem type, free space, mount status, and other properties. The `name` argument takes a disk name (e.g. `disk1`) as returned by list_disks. For all disks in one call use list_disks; to erase and reformat a disk use format_disk.",
+      "description": "Get full detail for a single disk by slot (`/disk print detail where slot=...`) — its type, filesystem, size and free space, label, mount point, partition layout, model/serial/firmware, RAID role, SMART status, and any SMB/NFS sharing. Use list_disks to find the slot. To erase/reformat use format_disk; to change its label or sharing use set_disk / share_disk.",
       "inputSchema": {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "type": "object",
         "properties": {
-          "name": {
+          "slot": {
             "type": "string",
-            "description": "Disk name, e.g. 'disk1'"
+            "description": "Disk slot, e.g. 'nvme1', 'usb1'"
           }
         },
-        "required": ["name"],
+        "required": ["slot"],
         "additionalProperties": false
       }
     },
@@ -26191,30 +26210,740 @@
         "destructiveHint": true,
         "openWorldHint": false
       },
-      "description": "Erase and reformat a disk (`/disk format-drive`) — PERMANENTLY DESTROYS all data on the target disk. Use this to prepare a new or blank storage device for use on the router. Requires confirm=true to proceed; without it the command is aborted. Optional file_system (ext4, fat32, exfat, ntfs) selects the filesystem; optional label sets the volume label. The `name` argument takes a disk name (e.g. `disk1`) as returned by list_disks. For read-only disk inspection use list_disks or get_disk.",
+      "description": "Erase and (re)format a disk or partition (`/disk format-drive`) — PERMANENTLY DESTROYS all data on the target slot. Use to prepare new storage, change filesystem, repartition, or enable encryption. Requires confirm=true. `file_system` picks the filesystem (ext4, exfat, fat32, ntfs). `label` sets the volume label. `partition_size` (e.g. '10G') formats only part of the drive (creating a partition) instead of the whole device. `encryption` + `encryption_password` create an encrypted volume (supply the RouterOS encryption value, e.g. 'aes-cbc'). Identify the disk by `slot` from list_disks. For read-only inspection use list_disks / get_disk.",
       "inputSchema": {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "type": "object",
         "properties": {
-          "name": {
+          "slot": {
             "type": "string",
-            "description": "Disk name to format, e.g. 'disk1'"
+            "description": "Disk slot to format, e.g. 'usb1'"
           },
           "file_system": {
-            "description": "File system to create",
+            "description": "Filesystem to create (RouterOS can format these)",
             "type": "string",
-            "enum": ["ext4", "fat32", "exfat", "ntfs"]
+            "enum": ["ext4", "exfat", "fat32", "ntfs"]
           },
           "label": {
             "description": "Volume label",
             "type": "string"
           },
+          "partition_size": {
+            "description": "Format only this much as a partition, e.g. '10G' (omit = whole drive)",
+            "type": "string"
+          },
+          "encryption": {
+            "description": "Encryption algorithm to enable, e.g. 'aes-cbc' (RouterOS value)",
+            "type": "string"
+          },
+          "encryption_password": {
+            "description": "Passphrase when encryption is set",
+            "type": "string"
+          },
           "confirm": {
             "type": "boolean",
-            "description": "Must be true to actually erase the disk"
+            "description": "Must be true to actually ERASE the disk"
           }
         },
-        "required": ["name", "confirm"],
+        "required": ["slot", "confirm"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "set_disk",
+      "title": "Set Disk Properties",
+      "risk": "write-idempotent",
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Update a disk's non-destructive properties (`/disk set [find slot=...]`) — set its `label` or `comment`, enable/disable it, or assign it to a software RAID array via `raid_master` (the slot of the RAID disk created with add_disk) or attach it under a `parent`. Does NOT erase data (use format_disk for that) and does NOT configure sharing (use share_disk). Identify by `slot` from list_disks.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "slot": {
+            "type": "string",
+            "description": "Disk slot to modify"
+          },
+          "label": {
+            "description": "Volume / disk label",
+            "type": "string"
+          },
+          "comment": {
+            "type": "string"
+          },
+          "raid_master": {
+            "description": "Slot of the RAID disk to make this a member of",
+            "type": "string"
+          },
+          "parent": {
+            "description": "Parent disk slot to attach under",
+            "type": "string"
+          },
+          "disabled": {
+            "type": "boolean"
+          }
+        },
+        "required": ["slot"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "share_disk",
+      "title": "Share a Disk over SMB / NFS",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Expose a disk on the network by setting its sharing properties (`/disk set [find slot=...]`) — toggle `smb_sharing` (Windows/macOS file sharing) with a `smb_share_name` and allowed `smb_users`, and/or `nfs_sharing` for Unix clients. RouterOS serves the share from the disk's mount point. The SMB/NFS server must be enabled on the device. Pass smb_sharing=false / nfs_sharing=false to stop sharing. Identify the disk by `slot` from list_disks.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "slot": {
+            "type": "string",
+            "description": "Disk slot to share"
+          },
+          "smb_sharing": {
+            "description": "Enable/disable SMB (CIFS) sharing",
+            "type": "boolean"
+          },
+          "smb_share_name": {
+            "description": "SMB share name shown to clients",
+            "type": "string"
+          },
+          "smb_users": {
+            "description": "Comma-separated SMB users allowed to access the share",
+            "type": "string"
+          },
+          "nfs_sharing": {
+            "description": "Enable/disable NFS sharing",
+            "type": "boolean"
+          }
+        },
+        "required": ["slot"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "add_disk",
+      "title": "Add a Virtual Disk (RAID / rsync / RAM)",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Create a virtual disk (`/disk add`). Use `type` to pick the kind: `raid` (software RAID array — set `raid_type` such as raid0/raid1/raid5/raid6/raid10, then add member drives with set_disk raid_master=<new slot>), `rsync` (a network rsync backup target), or `tmpfs` (a RAM disk — set `tmpfs_max_size`, e.g. '256M'). Optionally name the new disk via `slot`. `properties` passes any additional RouterOS attribute=value pairs for the chosen type (e.g. rsync-target, nfs-server). Requires RouterOS 7.x with disk/RAID support. To delete a virtual disk use remove_disk.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "type": {
+            "type": "string",
+            "description": "Virtual disk type: 'raid', 'rsync', 'tmpfs', 'encrypted', …"
+          },
+          "slot": {
+            "description": "Name/slot for the new virtual disk",
+            "type": "string"
+          },
+          "raid_type": {
+            "description": "For type=raid, e.g. 'raid1', 'raid5'",
+            "type": "string"
+          },
+          "tmpfs_max_size": {
+            "description": "For type=tmpfs, e.g. '256M'",
+            "type": "string"
+          },
+          "comment": {
+            "type": "string"
+          },
+          "properties": {
+            "description": "Extra RouterOS attribute=value pairs for this disk type",
+            "type": "object",
+            "propertyNames": {
+              "type": "string"
+            },
+            "additionalProperties": {
+              "type": "string"
+            }
+          }
+        },
+        "required": ["type"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "eject_disk",
+      "title": "Eject Removable Disk",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Safely eject / unmount a removable disk (`/disk eject`) so it can be physically unplugged without data loss — flushes caches and unmounts the device. Use for USB drives and other hot-pluggable media before removal. Identify by `slot` from list_disks. This does not erase data; to delete a virtual disk entry use remove_disk.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "slot": {
+            "type": "string",
+            "description": "Disk slot to eject, e.g. 'usb1'"
+          }
+        },
+        "required": ["slot"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "remove_disk",
+      "title": "Remove a Virtual Disk Entry",
+      "risk": "destructive",
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Delete a virtual disk entry (`/disk remove [find slot=...]`) — for software RAID arrays, rsync targets, RAM disks and other entries created with add_disk. Verifies the disk exists first. This removes the logical disk (and, for a RAID, breaks the array); it is NOT for formatting a physical drive — use format_disk for that, or eject_disk to safely unplug removable media. Identify by `slot`.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "slot": {
+            "type": "string",
+            "description": "Virtual disk slot to remove"
+          }
+        },
+        "required": ["slot"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "list_containers",
+      "title": "List Containers",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "List every OCI container on the device (`/container print`) with its status, image tag, name, VETH interface and root-dir — the starting point for any container work and the way to POLL the lifecycle, which is asynchronous: status moves extracting → stopped (ready to start) → running. Use this to find the `name`/`tag` the other tools take, to confirm an add has finished extracting before start_container, and to confirm a stop has completed before remove_container. Filter by partial `name_filter`, `tag_filter`, or `status_filter` (e.g. 'running', 'stopped'); set `detail=true` for the full property block. For one container use get_container. A container's stdout/stderr is in the system log (`/log print where topics~\"container\"`) when it was created with logging=yes.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "name_filter": {
+            "description": "Partial container name match",
+            "type": "string"
+          },
+          "tag_filter": {
+            "description": "Partial image tag match",
+            "type": "string"
+          },
+          "status_filter": {
+            "description": "e.g. 'running', 'stopped'",
+            "type": "string"
+          },
+          "detail": {
+            "default": false,
+            "description": "Show the full per-container property block",
+            "type": "boolean"
+          }
+        },
+        "required": ["detail"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "get_container",
+      "title": "Get Container Detail",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Full detail for one container (`/container print detail`) — status, image tag, interface, root-dir, env/mounts, cmd/entrypoint, hostname/dns, logging and start-on-boot. Identify by `name` (preferred) or `tag`. Use list_containers to discover identifiers.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "name": {
+            "description": "Container name (set via add_container)",
+            "type": "string"
+          },
+          "tag": {
+            "description": "Image tag to match (e.g. 'pihole') if no name",
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "add_container",
+      "title": "Add Container",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Create an OCI container (`/container add`). PREREQUISITES, in order: (1) the `container` package installed + device-mode `container=yes`; (2) an external disk for storage (containers should never run on internal flash); (3) for `remote_image`, a registry URL + on-disk `tmpdir` set via set_container_config; (4) a VETH for networking — create it first with `/interface veth add name=veth1 address=172.17.0.2/24 gateway=172.17.0.1`, then bridge it and add a srcnat masquerade rule for internet (and a dst-nat to publish a port). Then create the container: supply EITHER `remote_image` (registry pull, e.g. 'library/alpine:latest') OR `file` (a local image tar on the device — must be a SINGLE-LAYER, UNCOMPRESSED Docker-v1 tar). Set `interface` to the VETH and `root_dir` to a path on the external disk (e.g. 'disk1/myapp'). Attach config via inline `env` ('K=v,K2=v2') / `mount` ('src=disk1/data,dst=/data'), or reference named lists with `envlists`/`mountlists` (add_container_env / add_container_mount). Override `cmd`/`entrypoint`/`workdir`; set `hostname`/`dns`; enable `logging`/`start_on_boot`; cap `memory_high`/`cpu_list`. ALWAYS set `name` so the lifecycle tools can find it. The image pull/extract is ASYNCHRONOUS: this returns immediately, then poll list_containers until status becomes 'stopped' (extraction done) before calling start_container.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "name": {
+            "description": "Container name (recommended for management)",
+            "type": "string"
+          },
+          "remote_image": {
+            "description": "Registry image, e.g. 'library/alpine:latest'",
+            "type": "string"
+          },
+          "file": {
+            "description": "Local Docker-v1 tar on the device (alternative to remote_image)",
+            "type": "string"
+          },
+          "interface": {
+            "description": "VETH interface name",
+            "type": "string"
+          },
+          "root_dir": {
+            "description": "Filesystem root, e.g. 'disk1/myapp'",
+            "type": "string"
+          },
+          "env": {
+            "description": "Inline env vars: 'K=v,K2=v2' (7.21+)",
+            "type": "string"
+          },
+          "envlists": {
+            "description": "Named env list name(s) (add_container_env)",
+            "type": "string"
+          },
+          "mount": {
+            "description": "Inline mount: 'src=disk1/data,dst=/data' (7.21+)",
+            "type": "string"
+          },
+          "mountlists": {
+            "description": "Named mount name(s) (add_container_mount)",
+            "type": "string"
+          },
+          "cmd": {
+            "description": "Override container CMD",
+            "type": "string"
+          },
+          "entrypoint": {
+            "description": "Override container ENTRYPOINT",
+            "type": "string"
+          },
+          "workdir": {
+            "description": "Override working directory",
+            "type": "string"
+          },
+          "hostname": {
+            "type": "string"
+          },
+          "dns": {
+            "description": "DNS server for the container",
+            "type": "string"
+          },
+          "user": {
+            "type": "string"
+          },
+          "stop_signal": {
+            "description": "Signal used to stop the container",
+            "type": "string"
+          },
+          "devices": {
+            "description": "Pass-through physical devices (7.20+)",
+            "type": "string"
+          },
+          "cpu_list": {
+            "description": "CPU core affinity",
+            "type": "string"
+          },
+          "memory_high": {
+            "description": "RAM limit, e.g. '256M'",
+            "type": "string"
+          },
+          "logging": {
+            "description": "Send stdout/stderr to the RouterOS log",
+            "type": "boolean"
+          },
+          "start_on_boot": {
+            "description": "Auto-start on device boot",
+            "type": "boolean"
+          },
+          "comment": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "update_container",
+      "title": "Update Container",
+      "risk": "write-idempotent",
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Modify an existing container's properties in place (`/container set [find …]`) without recreating it — change `start_on_boot`, `logging`, `cmd`/`entrypoint`/`workdir`, `hostname`/`dns`, `interface`, `root_dir`, inline `env`/`mount` or `envlists`/`mountlists`, resource caps, or `comment`. Identify by `name` or `tag`. Best practice: stop the container first (stop_container) before changing runtime properties like interface, env, mounts or cmd — they take effect on the next start_container, not live. To create a new container use add_container; to change the image, remove and re-add.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "name": {
+            "description": "Container name (set via add_container)",
+            "type": "string"
+          },
+          "tag": {
+            "description": "Image tag to match (e.g. 'pihole') if no name",
+            "type": "string"
+          },
+          "interface": {
+            "type": "string"
+          },
+          "root_dir": {
+            "type": "string"
+          },
+          "env": {
+            "type": "string"
+          },
+          "envlists": {
+            "type": "string"
+          },
+          "mount": {
+            "type": "string"
+          },
+          "mountlists": {
+            "type": "string"
+          },
+          "cmd": {
+            "type": "string"
+          },
+          "entrypoint": {
+            "type": "string"
+          },
+          "workdir": {
+            "type": "string"
+          },
+          "hostname": {
+            "type": "string"
+          },
+          "dns": {
+            "type": "string"
+          },
+          "cpu_list": {
+            "type": "string"
+          },
+          "memory_high": {
+            "type": "string"
+          },
+          "logging": {
+            "type": "boolean"
+          },
+          "start_on_boot": {
+            "type": "boolean"
+          },
+          "comment": {
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "start_container",
+      "title": "Start Container",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Start a stopped container (`/container start [find …]`). Identify by `name` or `tag`. The container must have finished extracting (status 'stopped') first — check with list_containers. View its output in the log when logging=yes. To stop it use stop_container.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "name": {
+            "description": "Container name (set via add_container)",
+            "type": "string"
+          },
+          "tag": {
+            "description": "Image tag to match (e.g. 'pihole') if no name",
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "stop_container",
+      "title": "Stop Container",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Stop a running container (`/container stop [find …]`). Identify by `name` or `tag`. Stopping is asynchronous — poll list_containers until status is 'stopped' before removing it. To start it again use start_container.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "name": {
+            "description": "Container name (set via add_container)",
+            "type": "string"
+          },
+          "tag": {
+            "description": "Image tag to match (e.g. 'pihole') if no name",
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "remove_container",
+      "title": "Remove Container",
+      "risk": "destructive",
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Permanently delete a container (`/container remove [find …]`). The container must be FULLY STOPPED first — RouterOS rejects removal while it is running or still stopping. If removal fails for that reason, stop it (stop_container), wait until list_containers shows status 'stopped', then retry. Identify by `name` or `tag`. This does not delete its root-dir data on disk.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "name": {
+            "description": "Container name (set via add_container)",
+            "type": "string"
+          },
+          "tag": {
+            "description": "Image tag to match (e.g. 'pihole') if no name",
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "get_container_config",
+      "title": "Get Container Global Config",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Read the global container configuration (`/container config print`) — the image registry URL, the tmpdir used for pulls/extraction, the layer directory, and the RAM-high limit. Use to verify the registry/tmpdir are set before pulling images. To change them use set_container_config.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {},
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "set_container_config",
+      "title": "Set Container Global Config",
+      "risk": "write-idempotent",
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Configure the global container settings (`/container config set`) — the router-wide singleton that MUST be set before pulling any `remote_image` with add_container. Set `registry_url` (Docker Hub is 'https://registry-1.docker.io') and `tmpdir` to a path on an EXTERNAL disk (e.g. 'disk1/pull') — pulls and extraction need real space and IOPS, never internal flash. Optionally set `layer_dir`, a `ram_high` cap, and `username`/`password` for a private registry (credentials are redacted from output). The router also needs working DNS + internet to reach the registry. To read the current values use get_container_config.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "registry_url": {
+            "description": "Image registry URL",
+            "type": "string"
+          },
+          "tmpdir": {
+            "description": "Pull/extract temp dir, e.g. 'disk1/pull'",
+            "type": "string"
+          },
+          "layer_dir": {
+            "description": "Directory for extracted image layers",
+            "type": "string"
+          },
+          "ram_high": {
+            "description": "RAM-high limit, e.g. '256M'",
+            "type": "string"
+          },
+          "username": {
+            "description": "Registry username (private registries)",
+            "type": "string"
+          },
+          "password": {
+            "description": "Registry password (private registries)",
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "list_container_envs",
+      "title": "List Container Env Variables",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "List named environment-variable entries (`/container envs print`) — each has a `list` (the group name referenced by a container's envlists), a `key` and a `value`. Optionally filter by partial `list_filter`. To add one use add_container_env; to delete use remove_container_env.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "list_filter": {
+            "description": "Partial env-list (group) name match",
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "add_container_env",
+      "title": "Add Container Env Variable",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Add an environment variable to a named list (`/container envs add list= key= value=`). Group related variables under the same `list` name, then point a container at the group with `envlists=<list>` (add_container or update_container) — a container that is already running must be restarted to pick up env changes. Named lists are reusable across containers; for a one-off, self-contained setup the inline `env` on add_container is simpler. The grouping `list=` property requires RouterOS 7.20+. Values may be secrets and are redacted from output.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "list": {
+            "type": "string",
+            "description": "Env-list (group) name, e.g. 'MYAPP'"
+          },
+          "key": {
+            "type": "string",
+            "description": "Variable name, e.g. 'TZ'"
+          },
+          "value": {
+            "type": "string",
+            "description": "Variable value"
+          }
+        },
+        "required": ["list", "key", "value"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "remove_container_env",
+      "title": "Remove Container Env Variable",
+      "risk": "destructive",
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Delete an environment variable from a list (`/container envs remove [find list= key=]`). Supply the `list` (group) name and the `key`. Verifies it exists first. To browse entries use list_container_envs.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "list": {
+            "type": "string",
+            "description": "Env-list (group) name"
+          },
+          "key": {
+            "type": "string",
+            "description": "Variable name to remove"
+          }
+        },
+        "required": ["list", "key"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "list_container_mounts",
+      "title": "List Container Mounts",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "List named volume mounts (`/container mounts print`) — each has a `name` (referenced by a container's mountlists), a host source `src` (e.g. 'disk1/appdata') and a container destination `dst` (e.g. '/data'). Optionally filter by partial `name_filter`. To add one use add_container_mount; to delete use remove_container_mount.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "name_filter": {
+            "description": "Partial mount name match",
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "add_container_mount",
+      "title": "Add Container Mount",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Create a named volume mount (`/container mounts add name= src= dst=`) — persists container data on the host so it survives restarts/recreation. Maps a host source `src` (put it on an EXTERNAL disk, e.g. 'disk1/appdata', never internal flash) to a path `dst` inside the container (e.g. '/data'). Point a container at it with `mountlists=<name>` (add_container or update_container); a running container must be restarted to apply mount changes. For a one-off, the inline `mount` on add_container is simpler. Named mounts and `mountlists` require RouterOS 7.21+.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "Mount name, e.g. 'appdata'"
+          },
+          "src": {
+            "type": "string",
+            "description": "Host source path, e.g. 'disk1/appdata'"
+          },
+          "dst": {
+            "type": "string",
+            "description": "Container destination path, e.g. '/data'"
+          }
+        },
+        "required": ["name", "src", "dst"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "remove_container_mount",
+      "title": "Remove Container Mount",
+      "risk": "destructive",
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Delete a named volume mount (`/container mounts remove [find name=...]`). Verifies it exists first. Does not delete the host data at `src`. To browse mounts use list_container_mounts.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "Mount name to remove"
+          }
+        },
+        "required": ["name"],
         "additionalProperties": false
       }
     },