@usex/mikrotik-mcp 3.4.0 → 3.6.0

package/schemas/tool-catalog.json

@@ -1,8 +1,8 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "version": "3.3.0",
+  "version": "3.5.0",
   "generated": "by scripts/gen-schemas.ts — do not edit by hand",
-  "toolCount": 670,
+  "toolCount": 693,
   "tools": [
     {
       "name": "list_interfaces",
@@ -312,6 +312,80 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "design_network_segment",
+      "title": "Design Isolated VLAN Segment",
+      "risk": "dangerous",
+      "annotations": {
+        "destructiveHint": true,
+        "openWorldHint": false
+      },
+      "description": "Stands up a complete isolated network segment in one call: a VLAN interface on the bridge, its gateway IP, a DHCP server + pool + network, optional internet access (srcnat masquerade), and inter-VLAN isolation firewall rules — e.g. 'a guest VLAN that reaches the internet but not the LAN'. DEFAULTS TO A DRY RUN (`apply=false`) showing every command grouped; set `apply=true` to build it. Bridge VLAN tagging is added when `tagged_ports`/`untagged_ports` are given (requires bridge vlan-filtering). Isolation drops forward traffic from this subnet to each `isolate_from` subnet. Returns the plan or a build report.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "vlan_id": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 4094
+          },
+          "name": {
+            "type": "string",
+            "description": "Name for the VLAN interface, e.g. 'guest'"
+          },
+          "subnet": {
+            "type": "string",
+            "description": "CIDR for the segment, e.g. '192.168.30.0/24'"
+          },
+          "gateway": {
+            "type": "string",
+            "description": "Router's address in the segment, e.g. '192.168.30.1'"
+          },
+          "bridge": {
+            "default": "bridge",
+            "description": "Bridge to put the VLAN on",
+            "type": "string"
+          },
+          "tagged_ports": {
+            "description": "Comma-separated trunk/tagged ports (+ the bridge)",
+            "type": "string"
+          },
+          "untagged_ports": {
+            "description": "Comma-separated access/untagged ports",
+            "type": "string"
+          },
+          "dhcp": {
+            "default": true,
+            "description": "Create a DHCP server + pool for the segment",
+            "type": "boolean"
+          },
+          "dhcp_range": {
+            "description": "Pool range; defaults to .10–.254 of the subnet",
+            "type": "string"
+          },
+          "internet": {
+            "default": true,
+            "description": "Allow internet access via srcnat masquerade",
+            "type": "boolean"
+          },
+          "isolate_from": {
+            "description": "Subnets this segment must NOT reach, e.g. ['192.168.1.0/24']",
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "apply": {
+            "default": false,
+            "description": "false = preview (default); true = build",
+            "type": "boolean"
+          }
+        },
+        "required": ["vlan_id", "name", "subnet", "gateway", "bridge", "dhcp", "internet", "apply"],
+        "additionalProperties": false
+      }
+    },
     {
       "name": "create_bridge",
       "title": "Create Bridge Interface",
@@ -1084,6 +1158,38 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "tune_wifi_channel",
+      "title": "Survey & Tune Wi-Fi Channel",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Runs an RF survey on a wireless radio (`/interface wireless frequency-monitor`, blocking for `duration`), finds the least-congested channel, and reports a before/after. DEFAULTS TO A DRY RUN (`apply=false`) — it surveys and recommends; set `apply=true` to set the radio to the best frequency (`/interface wireless set`). Targets the LEGACY wireless stack; for wifiwave2 (`/interface wifi`) tune via those tools. Returns the per-channel usage finding and the chosen frequency.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "interface": {
+            "type": "string",
+            "description": "Wireless interface, e.g. 'wlan1'"
+          },
+          "duration": {
+            "default": "5",
+            "description": "Survey duration in seconds",
+            "type": "string"
+          },
+          "apply": {
+            "default": false,
+            "description": "false = survey & recommend (default); true = set it",
+            "type": "boolean"
+          }
+        },
+        "required": ["interface", "duration", "apply"],
+        "additionalProperties": false
+      }
+    },
     {
       "name": "get_poe_monitor",
       "title": "Read PoE Interface Live Metrics",
@@ -2538,6 +2644,92 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "setup_wan_failover",
+      "title": "Set Up Multi-WAN Failover",
+      "risk": "dangerous",
+      "annotations": {
+        "destructiveHint": true,
+        "openWorldHint": false
+      },
+      "description": "Builds ACTIVE-PASSIVE multi-WAN failover by adding health-checked default routes with ascending distances (primary=1, each backup +1). RouterOS uses the lowest-distance reachable route; `check-gateway` withdraws a route when its gateway stops answering, so traffic fails over to the next WAN — and fails back automatically when the primary recovers. DEFAULTS TO A DRY RUN (`apply=false`) so you can review before changing default routing (which can cut your own access); set `apply=true` to execute. Does NOT remove existing 0.0.0.0/0 routes — clear conflicting ones first with the route tools. For load balancing instead of failover use setup_wan_loadbalance. Returns the plan or the resulting default routes.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "primary_gateway": {
+            "type": "string",
+            "description": "Primary WAN gateway IP (or interface name)"
+          },
+          "backup_gateways": {
+            "minItems": 1,
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "One or more backup WAN gateways, in failover order"
+          },
+          "check": {
+            "default": "ping",
+            "description": "Gateway health-check method",
+            "type": "string",
+            "enum": ["ping", "arp"]
+          },
+          "comment_prefix": {
+            "default": "wan-failover",
+            "type": "string"
+          },
+          "apply": {
+            "default": false,
+            "description": "false = preview only (default); true = execute",
+            "type": "boolean"
+          }
+        },
+        "required": ["primary_gateway", "backup_gateways", "check", "comment_prefix", "apply"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "setup_wan_loadbalance",
+      "title": "Set Up Multi-WAN Load Balancing (ECMP)",
+      "risk": "dangerous",
+      "annotations": {
+        "destructiveHint": true,
+        "openWorldHint": false
+      },
+      "description": "Builds ECMP (equal-cost multi-path) load balancing across multiple WANs by adding ONE default route whose `gateway` lists every WAN — RouterOS then spreads connections across the links (per-connection, so a single flow stays on one WAN). `check-gateway` drops a dead link from the set. DEFAULTS TO A DRY RUN (`apply=false`); set `apply=true` to execute. Does NOT remove existing 0.0.0.0/0 routes — clear conflicting ones first. ECMP is simple but balances by connection-hash, not by bandwidth; for sticky per-source balancing (PCC) use the firewall mangle + routing-table tools. For failover instead of balancing use setup_wan_failover. Returns the plan or the resulting default route.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "gateways": {
+            "minItems": 2,
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Two or more WAN gateways to balance across"
+          },
+          "check": {
+            "default": "ping",
+            "description": "Gateway health-check method",
+            "type": "string",
+            "enum": ["ping", "arp"]
+          },
+          "comment": {
+            "default": "wan-ecmp",
+            "type": "string"
+          },
+          "apply": {
+            "default": false,
+            "description": "false = preview only (default); true = execute",
+            "type": "boolean"
+          }
+        },
+        "required": ["gateways", "check", "comment", "apply"],
+        "additionalProperties": false
+      }
+    },
     {
       "name": "create_dhcp_server",
       "title": "Create DHCP Server Instance",
@@ -2750,6 +2942,105 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "build_guest_hotspot",
+      "title": "Build Guest Hotspot (Captive Portal)",
+      "risk": "dangerous",
+      "annotations": {
+        "destructiveHint": true,
+        "openWorldHint": false
+      },
+      "description": "Stands up a guest hotspot with a captive sign-in portal in one call: the gateway IP, an address pool, a DHCP server, the `/ip hotspot` server + profile (with a per-guest `rate_limit` bandwidth cap and optional `dns_name`), and a walled garden (the `walled_garden` domains reachable BEFORE sign-in, e.g. your payment/login pages). DEFAULTS TO A DRY RUN (`apply=false`) showing every command; set `apply=true` to build it. Generate printable guest codes with generate_hotspot_vouchers. Returns the plan or a build report.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "interface": {
+            "type": "string",
+            "description": "Interface/bridge the hotspot runs on, e.g. 'guest-bridge'"
+          },
+          "subnet": {
+            "default": "10.5.50.0/24",
+            "description": "Hotspot subnet",
+            "type": "string"
+          },
+          "gateway": {
+            "default": "10.5.50.1",
+            "description": "Router address in the hotspot subnet",
+            "type": "string"
+          },
+          "pool_range": {
+            "description": "DHCP/hotspot pool; defaults to .10–.254",
+            "type": "string"
+          },
+          "dns_name": {
+            "description": "Captive-portal hostname, e.g. 'guest.wifi'",
+            "type": "string"
+          },
+          "rate_limit": {
+            "default": "5M/5M",
+            "description": "Per-guest max-limit (rx/tx)",
+            "type": "string"
+          },
+          "walled_garden": {
+            "description": "Domains reachable before sign-in, e.g. ['*.stripe.com']",
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "apply": {
+            "default": false,
+            "description": "false = preview (default); true = build",
+            "type": "boolean"
+          }
+        },
+        "required": ["interface", "subnet", "gateway", "rate_limit", "apply"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "generate_hotspot_vouchers",
+      "title": "Generate Hotspot Vouchers",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Creates `count` random guest login codes as `/ip hotspot user` entries (username = password = code), each with an optional uptime limit and hotspot user profile — the printable vouchers you hand to guests. DEFAULTS TO A DRY RUN (`apply=false`) that just shows the codes it would create; set `apply=true` to add them. Returns the generated codes.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "count": {
+            "default": 10,
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 200
+          },
+          "uptime_limit": {
+            "description": "Per-voucher uptime, e.g. '1h', '1d'",
+            "type": "string"
+          },
+          "profile": {
+            "description": "Hotspot user profile to assign",
+            "type": "string"
+          },
+          "code_prefix": {
+            "default": "g",
+            "description": "Prefix for the generated codes",
+            "type": "string"
+          },
+          "apply": {
+            "default": false,
+            "description": "false = preview codes (default); true = create",
+            "type": "boolean"
+          }
+        },
+        "required": ["count", "code_prefix", "apply"],
+        "additionalProperties": false
+      }
+    },
     {
       "name": "set_dns_servers",
       "title": "Configure DNS Resolver Settings",
@@ -3226,6 +3517,85 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "set_time_policy",
+      "title": "Set Time-of-Day / Parental Policy",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Schedules per-device internet access and content blocking. Cuts internet for devices in the `list` address-list between `block_start` and `block_end` daily (a forward-drop rule toggled by two schedulers), optionally adds `addresses` to that list, and DNS-sinkholes any `block_domains` (always blocked). DEFAULTS TO A DRY RUN (`apply=false`) showing every command; set `apply=true` to install. Everything is tagged 'parental-<name>' so remove_time_policy can undo it. Returns the plan or a build report.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "Policy id, e.g. 'kids-bedtime'"
+          },
+          "list": {
+            "default": "parental-devices",
+            "description": "Address-list of the affected devices",
+            "type": "string"
+          },
+          "addresses": {
+            "description": "Device IPs to add to the list",
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "block_start": {
+            "default": "22:00",
+            "description": "Daily cut-off time (HH:MM)",
+            "type": "string"
+          },
+          "block_end": {
+            "default": "07:00",
+            "description": "Daily restore time (HH:MM)",
+            "type": "string"
+          },
+          "block_domains": {
+            "description": "Domains to always block via DNS",
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "apply": {
+            "default": false,
+            "description": "false = preview (default); true = install",
+            "type": "boolean"
+          }
+        },
+        "required": ["name", "list", "block_start", "block_end", "apply"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "remove_time_policy",
+      "title": "Remove Time-of-Day / Parental Policy",
+      "risk": "destructive",
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Removes a policy installed by set_time_policy: the schedulers, the forward-drop rule, and the DNS sinkhole entries tagged 'parental-<name>'. Address-list members added for it are also removed. Returns what was cleared.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "The policy id used when installing"
+          }
+        },
+        "required": ["name"],
+        "additionalProperties": false
+      }
+    },
     {
       "name": "add_ipv6_address",
       "title": "Add IPv6 Address to Interface",
@@ -9335,7 +9705,7 @@
             "type": "string"
           },
           "place_before": {
-            "description": "Rule number or ID (*N) to insert before e.g. \"0\" or \"*3\"",
+            "description": "Insert before this position. Either a bare ordinal/row number (e.g. \"0\", \"13\") OR a CURRENT internal .id (\"*N\") from list_filter_rules. Note: a \"*N\" .id is hexadecimal and reassigned over time — it is NOT the row number, so \"*13\" ≠ the 13th rule.",
             "type": "string"
           }
         },
@@ -9905,6 +10275,60 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "forward_port",
+      "title": "Forward a Port (Smart Wizard)",
+      "risk": "dangerous",
+      "annotations": {
+        "destructiveHint": true,
+        "openWorldHint": false
+      },
+      "description": "Exposes an internal service correctly and completely in one call: the DST-NAT rule that forwards `external_port` to `internal_host:internal_port`, the matching forward-chain accept (so it passes a default-drop firewall), and — when `lan_subnet` is given — the hairpin/loopback srcnat so the service also works when reached from inside the LAN via the public IP. DEFAULTS TO A DRY RUN (`apply=false`) showing every rule; set `apply=true` to create them. All rules are tagged 'port-forward:'. Returns the plan or a build report.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "protocol": {
+            "default": "tcp",
+            "type": "string",
+            "enum": ["tcp", "udp"]
+          },
+          "external_port": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 65535
+          },
+          "internal_host": {
+            "type": "string",
+            "description": "LAN IP of the service, e.g. '192.168.1.10'"
+          },
+          "internal_port": {
+            "description": "Defaults to external_port",
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 65535
+          },
+          "wan_interface": {
+            "description": "Restrict the forward to this WAN interface",
+            "type": "string"
+          },
+          "lan_subnet": {
+            "description": "LAN subnet for hairpin NAT, e.g. '192.168.1.0/24'",
+            "type": "string"
+          },
+          "comment": {
+            "type": "string"
+          },
+          "apply": {
+            "default": false,
+            "description": "false = preview (default); true = create",
+            "type": "boolean"
+          }
+        },
+        "required": ["protocol", "external_port", "internal_host", "apply"],
+        "additionalProperties": false
+      }
+    },
     {
       "name": "add_address_list_entry",
       "title": "Add Firewall Address-List Entry",
@@ -10095,6 +10519,201 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "harden_firewall",
+      "title": "Harden Firewall (Security Shield)",
+      "risk": "dangerous",
+      "annotations": {
+        "destructiveHint": true,
+        "openWorldHint": false
+      },
+      "description": "Hardens the IPv4 firewall against common attacks by applying a chosen set of best-practice rules (DDoS/connection-rate, SSH/Winbox brute-force ladder, SYN-flood and ICMP rate limits, port-scan detection, anti-spoof/bogon, raw pre-conntrack drops, management lock-down). Pick a `preset` (basic · standard · paranoid) and/or toggle individual `protections`. DEFAULTS TO A DRY RUN (`apply=false`) that returns the exact commands grouped by protection. Applying defaults to SAFE MODE (`safe_mode=true`) so a rule that cuts your own access auto-reverts. Anti-lockout: set `trusted_sources` (an address or address-list always accepted first); input-drop protections are refused without it unless `i_accept_lockout_risk=true`. Every rule is tagged with a 'security-shield:' comment — audit with audit_firewall_hardening, undo with remove_firewall_hardening. Rules are appended; review order for an existing ruleset.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "preset": {
+            "default": "standard",
+            "description": "Bundle to apply; 'custom' uses only the `protections` toggles",
+            "type": "string",
+            "enum": ["basic", "standard", "paranoid", "custom"]
+          },
+          "protections": {
+            "description": "Per-protection on/off, overriding/extending the preset",
+            "type": "object",
+            "propertyNames": {
+              "type": "string",
+              "enum": [
+                "state_hygiene",
+                "ssh_bruteforce",
+                "ddos_conn_limit",
+                "syn_flood",
+                "icmp_limit",
+                "port_scan",
+                "anti_spoof",
+                "raw_drops",
+                "mgmt_lockdown"
+              ]
+            },
+            "additionalProperties": {
+              "type": "boolean"
+            },
+            "required": [
+              "state_hygiene",
+              "ssh_bruteforce",
+              "ddos_conn_limit",
+              "syn_flood",
+              "icmp_limit",
+              "port_scan",
+              "anti_spoof",
+              "raw_drops",
+              "mgmt_lockdown"
+            ]
+          },
+          "trusted_sources": {
+            "description": "Address or address-list name always accepted first (anti-lockout)",
+            "type": "string"
+          },
+          "wan_interface": {
+            "description": "WAN interface (required for anti_spoof)",
+            "type": "string"
+          },
+          "mgmt_ports": {
+            "default": "22,8291,8728",
+            "description": "Management TCP ports",
+            "type": "string"
+          },
+          "ssh_ports": {
+            "default": "22",
+            "description": "Ports watched by the brute-force ladder",
+            "type": "string"
+          },
+          "conn_limit": {
+            "default": 100,
+            "description": "Per-source TCP connection cap",
+            "type": "integer",
+            "minimum": -9007199254740991,
+            "maximum": 9007199254740991
+          },
+          "syn_rate": {
+            "default": "200,50:packet",
+            "type": "string"
+          },
+          "icmp_rate": {
+            "default": "50,10:packet",
+            "type": "string"
+          },
+          "apply": {
+            "default": false,
+            "description": "false = preview only (default); true = apply",
+            "type": "boolean"
+          },
+          "safe_mode": {
+            "default": true,
+            "description": "Apply through Safe Mode (auto-revert on lockout)",
+            "type": "boolean"
+          },
+          "i_accept_lockout_risk": {
+            "default": false,
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "preset",
+          "mgmt_ports",
+          "ssh_ports",
+          "conn_limit",
+          "syn_rate",
+          "icmp_rate",
+          "apply",
+          "safe_mode",
+          "i_accept_lockout_risk"
+        ],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "audit_firewall_hardening",
+      "title": "Audit Firewall Hardening",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Reports which Security Shield protections are present on the firewall by scanning for the 'security-shield:' tagged rules (`/ip firewall filter` + `/ip firewall raw`), and notes the foundational checks (accept established/related, drop invalid) regardless of tag. Use to see coverage and gaps before/after harden_firewall. Complements the broader firewall-audit tools. Returns a per-protection present/absent summary.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {},
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "remove_firewall_hardening",
+      "title": "Remove Firewall Hardening",
+      "risk": "destructive",
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Removes every firewall rule that Security Shield installed — all `/ip firewall filter` and `/ip firewall raw` entries tagged with the 'security-shield:' comment (the shield's own address-lists are left, since they may be referenced elsewhere). Use to roll back harden_firewall. Does NOT touch rules you created by hand. Returns how many rules were removed.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {},
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "setup_port_knock",
+      "title": "Set Up Port-Knock Guardian",
+      "risk": "dangerous",
+      "annotations": {
+        "destructiveHint": true,
+        "openWorldHint": false
+      },
+      "description": "Hides management services behind a secret port-knock `sequence`: a source must connect to the knock ports in order to be added to an allow-list, after which the `protect_ports` (SSH/Winbox/API, default 22,8291,8728) accept it — everyone else is dropped, so the ports are invisible to scanners. Generates the staged address-list ladder + accept/drop rules. DEFAULTS TO A DRY RUN (`apply=false`); set `apply=true` to install. WARNING: after applying, management is only reachable by knocking the exact sequence — make sure you can knock (and keep a console/trusted path). Rules are tagged 'port-knock:'. Returns the plan or a build report.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "sequence": {
+            "minItems": 2,
+            "type": "array",
+            "items": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 65535
+            },
+            "description": "Secret knock ports, in order, e.g. [7001, 8002, 9003]"
+          },
+          "protect_ports": {
+            "default": "22,8291,8728",
+            "description": "Management ports to hide",
+            "type": "string"
+          },
+          "open_timeout": {
+            "default": "1h",
+            "description": "How long access stays open after the knock",
+            "type": "string"
+          },
+          "stage_timeout": {
+            "default": "10s",
+            "description": "Allowed window between consecutive knocks",
+            "type": "string"
+          },
+          "apply": {
+            "default": false,
+            "description": "false = preview (default); true = install",
+            "type": "boolean"
+          }
+        },
+        "required": ["sequence", "protect_ports", "open_timeout", "stage_timeout", "apply"],
+        "additionalProperties": false
+      }
+    },
     {
       "name": "list_certificates",
       "title": "List Certificates",
@@ -10222,54 +10841,102 @@
       }
     },
     {
-      "name": "remove_certificate",
-      "title": "Remove Certificate",
-      "risk": "destructive",
+      "name": "remove_certificate",
+      "title": "Remove Certificate",
+      "risk": "destructive",
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Permanently deletes a named certificate from the device store (`/certificate remove [find name=...]`). Performs an existence check first and returns an error if the certificate is not found. Removing a CA certificate will invalidate any leaf certificates it signed. Use `list_certificates` to browse certificate names before removal.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string"
+          }
+        },
+        "required": ["name"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "import_certificate",
+      "title": "Import Certificate from File",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Imports a certificate or private key from a file already present on the device filesystem (`/certificate import`). Use when you have uploaded a PEM, DER, or PKCS12 file to the device via FTP/SCP/Winbox and need to register it in the certificate store. Supply `passphrase` if the key is encrypted, and `name` to label the imported entry in the store. To generate a certificate locally on the device instead use `create_certificate` followed by `sign_certificate`.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "file_name": {
+            "type": "string",
+            "description": "Name of the certificate/key file to import"
+          },
+          "passphrase": {
+            "description": "Passphrase protecting the imported key, if any",
+            "type": "string"
+          },
+          "name": {
+            "description": "Name to assign to the imported certificate",
+            "type": "string"
+          }
+        },
+        "required": ["file_name"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "audit_certificate_expiry",
+      "title": "Audit Certificate Expiry",
+      "risk": "read",
       "annotations": {
-        "destructiveHint": true,
+        "readOnlyHint": true,
         "idempotentHint": true,
         "openWorldHint": false
       },
-      "description": "Permanently deletes a named certificate from the device store (`/certificate remove [find name=...]`). Performs an existence check first and returns an error if the certificate is not found. Removing a CA certificate will invalidate any leaf certificates it signed. Use `list_certificates` to browse certificate names before removal.",
+      "description": "Scans every certificate in the device store (`/certificate print detail`) and reports how long until each one expires — sorted by urgency, with anything ALREADY EXPIRED or expiring within `warn_within_days` (default 30) flagged first. Use this to catch a TLS cert (SSTP, API-SSL, hotspot, REST/www-ssl) before it lapses and silently breaks a service. For the full detail of one certificate use get_certificate; to obtain/renew a Let's Encrypt cert use request_letsencrypt_certificate. Returns a grouped report (expired · expiring soon · ok), plus any certs with no parseable expiry (e.g. unsigned templates).",
       "inputSchema": {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "type": "object",
         "properties": {
-          "name": {
-            "type": "string"
+          "warn_within_days": {
+            "default": 30,
+            "description": "Flag certificates expiring within this many days as 'expiring soon'",
+            "type": "integer",
+            "minimum": -9007199254740991,
+            "maximum": 9007199254740991
           }
         },
-        "required": ["name"],
+        "required": ["warn_within_days"],
         "additionalProperties": false
       }
     },
     {
-      "name": "import_certificate",
-      "title": "Import Certificate from File",
+      "name": "request_letsencrypt_certificate",
+      "title": "Request/Renew Let's Encrypt Certificate",
       "risk": "write",
       "annotations": {
         "destructiveHint": false,
         "openWorldHint": false
       },
-      "description": "Imports a certificate or private key from a file already present on the device filesystem (`/certificate import`). Use when you have uploaded a PEM, DER, or PKCS12 file to the device via FTP/SCP/Winbox and need to register it in the certificate store. Supply `passphrase` if the key is encrypted, and `name` to label the imported entry in the store. To generate a certificate locally on the device instead use `create_certificate` followed by `sign_certificate`.",
+      "description": "Obtains (or renews) a free Let's Encrypt TLS certificate for `dns_name` using RouterOS's built-in ACME client (`/certificate enable-ssl-certificate`). The device must be reachable from the internet on TCP 80 and `dns_name` must already resolve to it (ACME http-01 challenge). On success the certificate is installed in the store and bound to the www-ssl service; re-running this for the same name renews it. To check what is installed and when it expires use audit_certificate_expiry. NOTE: this reaches the public ACME service and may take several seconds. Returns the device's output from the request.",
       "inputSchema": {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "type": "object",
         "properties": {
-          "file_name": {
+          "dns_name": {
             "type": "string",
-            "description": "Name of the certificate/key file to import"
-          },
-          "passphrase": {
-            "description": "Passphrase protecting the imported key, if any",
-            "type": "string"
-          },
-          "name": {
-            "description": "Name to assign to the imported certificate",
-            "type": "string"
+            "description": "Public DNS name that resolves to this router, e.g. 'vpn.example.com'"
           }
         },
-        "required": ["file_name"],
+        "required": ["dns_name"],
         "additionalProperties": false
       }
     },
@@ -11229,6 +11896,165 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "build_wireguard_mesh",
+      "title": "Build WireGuard Mesh / Hub-Spoke VPN",
+      "risk": "dangerous",
+      "annotations": {
+        "destructiveHint": true,
+        "openWorldHint": false
+      },
+      "description": "Stands up a WireGuard VPN across several configured devices in ONE call: ensures a WireGuard interface on each, reads each device's public key, assigns every device a mesh address from `address_prefix`, then wires the peers between routers — `topology=full-mesh` connects every pair, `hub-spoke` connects the `hub` to each spoke — distributing public keys automatically. Endpoints default to each device's configured host (override per device via `endpoints`); add each site's LAN subnet via `allowed_lans` to route it through the tunnel. DEFAULTS TO A DRY RUN (`apply=false`) that shows the full plan; set `apply=true` to build it. Operates across MULTIPLE devices, so it is not affected by the single `device` selector. SSH devices only (needs to read public keys). Returns the plan, or a per-device build report.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "devices": {
+            "minItems": 2,
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Configured device names to include in the mesh (2+)"
+          },
+          "address_prefix": {
+            "default": "10.20.0.0/24",
+            "description": "Mesh subnet; each device gets <prefix>.<index+1> on its WireGuard interface",
+            "type": "string"
+          },
+          "interface": {
+            "default": "wg-mesh",
+            "description": "WireGuard interface name to create/use",
+            "type": "string"
+          },
+          "listen_port": {
+            "default": 13231,
+            "type": "integer",
+            "minimum": -9007199254740991,
+            "maximum": 9007199254740991
+          },
+          "topology": {
+            "default": "full-mesh",
+            "type": "string",
+            "enum": ["full-mesh", "hub-spoke"]
+          },
+          "hub": {
+            "description": "Hub device name (required when topology=hub-spoke)",
+            "type": "string"
+          },
+          "endpoints": {
+            "description": "Per-device public endpoint host override, e.g. {\"site-a\":\"a.example.com\"}",
+            "type": "object",
+            "propertyNames": {
+              "type": "string"
+            },
+            "additionalProperties": {
+              "type": "string"
+            }
+          },
+          "allowed_lans": {
+            "description": "Per-device LAN subnet to route through the tunnel, e.g. {\"site-a\":\"192.168.10.0/24\"}",
+            "type": "object",
+            "propertyNames": {
+              "type": "string"
+            },
+            "additionalProperties": {
+              "type": "string"
+            }
+          },
+          "persistent_keepalive": {
+            "default": "25s",
+            "type": "string"
+          },
+          "apply": {
+            "default": false,
+            "description": "false = preview the plan (default); true = build",
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "devices",
+          "address_prefix",
+          "interface",
+          "listen_port",
+          "topology",
+          "persistent_keepalive",
+          "apply"
+        ],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "onboard_wireguard_user",
+      "title": "Onboard WireGuard Remote User",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Generates a ready-to-use WireGuard remote-access profile for one user: creates a client keypair, adds the peer to the server `interface` (allowed-address = the client's tunnel IP), reads the server's public key, and returns a complete client .conf to paste into the WireGuard app or a QR generator. The peer is tagged `vpn-user: <user>` so revoke_wireguard_user can remove it. NOTE: the returned config contains the client PRIVATE key (required to connect) — handle it securely. `endpoint` is the server's public host:port; `allowed_ips` controls split vs full tunnel. SSH devices only. Returns the client config.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "interface": {
+            "type": "string",
+            "description": "Existing WireGuard SERVER interface, e.g. 'wg-server'"
+          },
+          "user": {
+            "type": "string",
+            "description": "User/device label, e.g. 'alice-laptop'"
+          },
+          "address": {
+            "type": "string",
+            "description": "Tunnel IP to assign the client, e.g. '10.20.0.50'"
+          },
+          "endpoint": {
+            "type": "string",
+            "description": "Server public endpoint host:port, e.g. 'vpn.example.com:13231'"
+          },
+          "dns": {
+            "description": "DNS for the client, e.g. '10.20.0.1'",
+            "type": "string"
+          },
+          "allowed_ips": {
+            "default": "0.0.0.0/0",
+            "description": "Client AllowedIPs: '0.0.0.0/0' full-tunnel, or a LAN subnet for split-tunnel",
+            "type": "string"
+          },
+          "keepalive": {
+            "default": "25",
+            "description": "PersistentKeepalive seconds",
+            "type": "string"
+          }
+        },
+        "required": ["interface", "user", "address", "endpoint", "allowed_ips", "keepalive"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "revoke_wireguard_user",
+      "title": "Revoke WireGuard Remote User",
+      "risk": "destructive",
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Revokes a remote-access user created by onboard_wireguard_user: removes the WireGuard peer tagged `vpn-user: <user>` from the server, immediately cutting their access. Returns whether a peer was removed.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "user": {
+            "type": "string",
+            "description": "The user label used at onboarding"
+          }
+        },
+        "required": ["user"],
+        "additionalProperties": false
+      }
+    },
     {
       "name": "create_ipsec_profile",
       "title": "Create IPsec Phase-1 Profile",
@@ -15353,6 +16179,63 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "apply_traffic_shaping",
+      "title": "Apply Traffic-Shaping Policy",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Builds a traffic-shaping policy as a batch of `/queue simple` classes (target address, max-limit, priority) in one call — e.g. prioritize a VoIP subnet and cap a guest network. DEFAULTS TO A DRY RUN: with `apply=false` (default) it returns the exact RouterOS commands it WOULD run so the shape can be reviewed first; set `apply=true` to create the queues and verify them. Classes are created in array order, and RouterOS evaluates simple queues top-down, so list the most specific/important first. For classification by port/protocol (not address) use the firewall mangle tools to mark packets, then a queue tree. Returns the dry-run plan or the created queues.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "classes": {
+            "minItems": 1,
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "description": "Queue name, e.g. 'voip' or 'guest-cap'"
+                },
+                "target": {
+                  "type": "string",
+                  "description": "Target address/subnet this class applies to, e.g. '192.168.20.0/24'"
+                },
+                "max_limit": {
+                  "type": "string",
+                  "description": "RouterOS max-limit as 'upload/download', e.g. '10M/10M' (or a single value)"
+                },
+                "priority": {
+                  "default": 8,
+                  "description": "1 (highest) … 8 (lowest); lower number wins under contention",
+                  "type": "integer",
+                  "minimum": 1,
+                  "maximum": 8
+                },
+                "comment": {
+                  "type": "string"
+                }
+              },
+              "required": ["name", "target", "max_limit", "priority"],
+              "additionalProperties": false
+            },
+            "description": "Shaping classes to create, in priority order"
+          },
+          "apply": {
+            "default": false,
+            "description": "false = preview the commands only (default); true = create the queues",
+            "type": "boolean"
+          }
+        },
+        "required": ["classes", "apply"],
+        "additionalProperties": false
+      }
+    },
     {
       "name": "list_queue_interfaces",
       "title": "List Queue Interface Assignments",
@@ -17997,6 +18880,39 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "forecast_link_saturation",
+      "title": "Forecast Link Saturation",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Estimates when an interface will saturate. Samples its current throughput (`/interface monitor-traffic ... once`), computes utilization against `capacity_mbps` (the link's rated speed), and projects the trend forward at `monthly_growth_pct` to a saturation date. Note: this is a single live sample projected at an ASSUMED growth rate — feed a realistic growth figure (or watch the trend over time) for a better forecast. Returns current load, utilization, and the projected days/date to saturation.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "interface": {
+            "type": "string",
+            "description": "Interface to sample, e.g. 'ether1-wan'"
+          },
+          "capacity_mbps": {
+            "default": 1000,
+            "description": "Link rated speed in Mbit/s (e.g. 1000 for gig)",
+            "type": "number"
+          },
+          "monthly_growth_pct": {
+            "default": 10,
+            "description": "Assumed month-over-month traffic growth %",
+            "type": "number"
+          }
+        },
+        "required": ["interface", "capacity_mbps", "monthly_growth_pct"],
+        "additionalProperties": false
+      }
+    },
     {
       "name": "wake_on_lan",
       "title": "Send Wake-on-LAN Magic Packet",
@@ -18277,6 +19193,75 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "subscribe_threat_feed",
+      "title": "Subscribe to Threat-Intel Feed",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Subscribes the router to an external threat-intelligence IP feed: installs a `/system script` that fetches `url` and imports it into the `address_list`, a `/system scheduler` that re-runs it every `interval`, and (when `drop=true`) a raw pre-conntrack drop for that list — a self-updating blocklist (e.g. Spamhaus DROP, tor exit nodes, your own deny list). `url` MUST point to a RouterOS `.rsc` file that populates the address-list. DEFAULTS TO A DRY RUN (`apply=false`); set `apply=true` to install. Script/scheduler/rule are named/tagged `threat-feed-<name>` so remove_threat_feed can undo them. Returns the plan or a build report.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "Short feed id, e.g. 'spamhaus-drop'"
+          },
+          "url": {
+            "type": "string",
+            "description": "HTTPS URL of a RouterOS .rsc address-list file"
+          },
+          "address_list": {
+            "default": "threat-blocklist",
+            "description": "Address-list to populate",
+            "type": "string"
+          },
+          "interval": {
+            "default": "1h",
+            "description": "How often to refresh the feed",
+            "type": "string"
+          },
+          "drop": {
+            "default": true,
+            "description": "Also add a raw drop rule for the address-list",
+            "type": "boolean"
+          },
+          "apply": {
+            "default": false,
+            "description": "false = preview (default); true = install",
+            "type": "boolean"
+          }
+        },
+        "required": ["name", "url", "address_list", "interval", "drop", "apply"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "remove_threat_feed",
+      "title": "Remove Threat-Intel Feed",
+      "risk": "destructive",
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Removes a threat feed installed by subscribe_threat_feed: deletes its `/system scheduler` and `/system script` (named `threat-feed-<name>`) and any raw drop rule tagged for it. Does NOT flush the address-list entries themselves. Returns what was removed.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "The feed id used when subscribing"
+          }
+        },
+        "required": ["name"],
+        "additionalProperties": false
+      }
+    },
     {
       "name": "add_user",
       "title": "Add Local User Account",
@@ -20119,6 +21104,48 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "run_failover_drill",
+      "title": "Run Failover DR Drill",
+      "risk": "dangerous",
+      "annotations": {
+        "destructiveHint": true,
+        "openWorldHint": false
+      },
+      "description": "Rehearses a disaster safely: INSIDE SAFE MODE it disables a target (a WAN/tunnel interface, or a route), pings `verify_host` to check the backup path actually carries traffic, then ROLLS BACK — Safe Mode auto-reverts, so the change is never committed. Proves your failover works without a real outage. Requires `confirm=true` to run (it briefly disrupts traffic on the target); with confirm=false it just describes the drill. SSH-only (Safe Mode is unavailable on MAC-Telnet). Returns whether connectivity held during the simulated failure.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "target_type": {
+            "default": "interface",
+            "type": "string",
+            "enum": ["interface", "route"]
+          },
+          "target": {
+            "type": "string",
+            "description": "Interface name (e.g. 'ether1-wan') or, for route, a find expression / .id"
+          },
+          "verify_host": {
+            "type": "string",
+            "description": "Host to ping during the outage to confirm the backup path, e.g. '8.8.8.8'"
+          },
+          "ping_count": {
+            "default": 5,
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 50
+          },
+          "confirm": {
+            "default": false,
+            "description": "Must be true to actually run the drill",
+            "type": "boolean"
+          }
+        },
+        "required": ["target_type", "target", "verify_host", "ping_count", "confirm"],
+        "additionalProperties": false
+      }
+    },
     {
       "name": "plan_changes",
       "title": "Plan RouterOS Changes (Dry-Run Preview)",