@usex/mikrotik-mcp 3.42.0 → 3.44.0

package/README.md

@@ -66,6 +66,9 @@ in memory and auto-reverts if your session drops, so you can't lock yourself out
 - 🪜 **SSH jump hosts** — reach a router with no exposed port by tunnelling
   through another via `jumpVia` (ProxyJump/bastion) — commands, Safe Mode and
   file upload all ride the hop. No new WAN port.
+- ⚡ **Connection pooling** — one persistent SSH session per device, reused
+  across tool calls. Saves ~200-500 ms handshake per command (double through
+  jump hosts). Idle connections auto-close after 30 s.
 - 🤖 **Guided prompts** — 9 built-in workflows (harden, diagnose, guest Wi-Fi, VPNs,
   cross-device tunnels, backup & document) that turn an intent into tool calls.
 
@@ -217,6 +220,37 @@ HTTP transports expose `POST /mcp` and a `GET /health` check, with DNS-rebinding
 protection that reconciles with your bind host automatically. See
 **[docs/transports.md](docs/transports.md)**.
 
+## SSH connection pooling
+
+By default the server keeps **one persistent SSH connection per device** and
+opens a fresh exec channel for each tool call — eliminating the ~200-500 ms
+handshake overhead that a one-shot connection incurs on every command. Through
+a jump host the savings double (two handshakes avoided). Idle connections are
+closed automatically after 30 s.
+
+```bash
+# Disable pooling (revert to one-shot per tool call)
+MIKROTIK_SSH__KEEP_ALIVE=false mikrotik-mcp serve
+
+# Tune the idle timeout (ms)
+mikrotik-mcp serve --ssh-idle-timeout 60000
+```
+
+In a JSON config file:
+
+```jsonc
+{
+  "ssh": {
+    "keepAlive": true, // default — set false to disable
+    "keepAliveInterval": 10000, // SSH keepalive packet interval (ms)
+    "idleTimeout": 30000, // close idle connections after (ms)
+  },
+}
+```
+
+Connection pooling is SSH-only; MAC-Telnet devices always use one-shot
+connections. Safe Mode still uses its own dedicated persistent session.
+
 ## Safe Mode
 
 ```text
@@ -234,21 +268,23 @@ See **[docs/safe-mode.md](docs/safe-mode.md)**.
 Connection and transport settings come from `MIKROTIK_*` env vars or matching CLI
 flags (highest precedence last: defaults → env → flags).
 
-| Variable                      | Flag               | Default     | Purpose                                                                                              |
-| ----------------------------- | ------------------ | ----------- | ---------------------------------------------------------------------------------------------------- |
-| `MIKROTIK_HOST`               | `--host`           | `127.0.0.1` | RouterOS host                                                                                        |
-| `MIKROTIK_USERNAME`           | `--username`       | `admin`     | SSH user                                                                                             |
-| `MIKROTIK_PORT`               | `--port`           | `22`        | SSH port                                                                                             |
-| `MIKROTIK_PASSWORD`           | `--password`       | —           | SSH password _(or use a key →)_                                                                      |
-| `MIKROTIK_KEY_FILENAME`       | `--key-filename`   | —           | SSH private-key file path                                                                            |
-| `MIKROTIK_PRIVATE_KEY`        | `--private-key`    | —           | Inline private key (PEM)                                                                             |
-| `MIKROTIK_KEY_PASSPHRASE`     | `--key-passphrase` | —           | Passphrase for an encrypted key                                                                      |
-| `MIKROTIK_JUMP_HOST`          | `--jump-host`      | —           | SSH bastion to tunnel through ([jump hosts](docs/multi-device.md#ssh-jump-hosts-bastion--proxyjump)) |
-| `MIKROTIK_CONFIG_FILE`        | `--config`         | —           | JSON file of named devices ([multi-device](docs/multi-device.md))                                    |
-| `MIKROTIK_DEVICES`            | `--devices`        | —           | Inline JSON of named devices                                                                         |
-| `MIKROTIK_MCP__TRANSPORT`     | `--transport`      | `stdio`     | `stdio` / `streamable-http` / `sse`                                                                  |
-| `MIKROTIK_MCP__PORT`          | `--mcp-port`       | `8000`      | HTTP bind port                                                                                       |
-| `MIKROTIK_DASHBOARD__ENABLED` | `--dashboard`      | `false`     | Real-time observability dashboard ([docs](docs/observability.md))                                    |
+| Variable                      | Flag                 | Default     | Purpose                                                                                              |
+| ----------------------------- | -------------------- | ----------- | ---------------------------------------------------------------------------------------------------- |
+| `MIKROTIK_HOST`               | `--host`             | `127.0.0.1` | RouterOS host                                                                                        |
+| `MIKROTIK_USERNAME`           | `--username`         | `admin`     | SSH user                                                                                             |
+| `MIKROTIK_PORT`               | `--port`             | `22`        | SSH port                                                                                             |
+| `MIKROTIK_PASSWORD`           | `--password`         | —           | SSH password _(or use a key →)_                                                                      |
+| `MIKROTIK_KEY_FILENAME`       | `--key-filename`     | —           | SSH private-key file path                                                                            |
+| `MIKROTIK_PRIVATE_KEY`        | `--private-key`      | —           | Inline private key (PEM)                                                                             |
+| `MIKROTIK_KEY_PASSPHRASE`     | `--key-passphrase`   | —           | Passphrase for an encrypted key                                                                      |
+| `MIKROTIK_JUMP_HOST`          | `--jump-host`        | —           | SSH bastion to tunnel through ([jump hosts](docs/multi-device.md#ssh-jump-hosts-bastion--proxyjump)) |
+| `MIKROTIK_CONFIG_FILE`        | `--config`           | —           | JSON file of named devices ([multi-device](docs/multi-device.md))                                    |
+| `MIKROTIK_DEVICES`            | `--devices`          | —           | Inline JSON of named devices                                                                         |
+| `MIKROTIK_MCP__TRANSPORT`     | `--transport`        | `stdio`     | `stdio` / `streamable-http` / `sse`                                                                  |
+| `MIKROTIK_MCP__PORT`          | `--mcp-port`         | `8000`      | HTTP bind port                                                                                       |
+| `MIKROTIK_SSH__KEEP_ALIVE`    | `--ssh-keep-alive`   | `true`      | SSH connection pooling (reuse connections across tool calls)                                         |
+| `MIKROTIK_SSH__IDLE_TIMEOUT`  | `--ssh-idle-timeout` | `30000`     | Close idle pooled connections after (ms)                                                             |
+| `MIKROTIK_DASHBOARD__ENABLED` | `--dashboard`        | `false`     | Real-time observability dashboard ([docs](docs/observability.md))                                    |
 
 Full table (incl. HTTP host, allow-lists, timeouts, `MIKROTIK_LOG_LEVEL`):
 **[docs/configuration.md](docs/configuration.md)**.

package/dist/cli.js

@@ -20,6 +20,7 @@ import {
   blockDevice,
   buildChangePlan,
   capture,
+  closeAll,
   commandUnsupported,
   configureRecorder,
   createContext,
@@ -40,6 +41,8 @@ import {
   getS3Client,
   getUmSettings,
   isEmpty,
+  isMacTelnetDevice,
+  isPoolEnabled,
   isS3Configured,
   listAaaEntity,
   listBackups,
@@ -57,6 +60,7 @@ import {
   parseRouterosDate,
   parseSize,
   parseSystemResource,
+  poolStatus,
   presignExpiresIn,
   readBackup,
   redact,
@@ -70,6 +74,7 @@ import {
   resolveDeviceName,
   restoreLocalBackup,
   s3Target,
+  sampleAllTraffic,
   sampleDeviceTraffic,
   selectToolModules,
   setConfig,
@@ -84,7 +89,7 @@ import {
   toggleAaaEntity,
   updateAaaEntity,
   writeBackup
-} from "./shared/cli-sq4trv31.js";
+} from "./shared/cli-k2ghtqd0.js";
 
 // src/cli.ts
 import { existsSync as existsSync2 } from "fs";
@@ -1209,28 +1214,41 @@ function deviceActivity(store) {
 function devicesPayload(store) {
   const cfg = getConfig();
   const activity = deviceActivity(store);
-  const devices = Object.entries(cfg.devices).map(([name, dc]) => ({
-    name,
-    host: dc.host,
-    port: dc.port,
-    mac: dc.mac,
-    transport: dc.mac ? "mac-telnet" : "ssh",
-    address: dc.mac ? dc.mac : `${dc.host}:${dc.port}`,
-    username: dc.username,
-    authMode: dc.mac ? "mac-telnet" : dc.keyFilename || dc.privateKey ? "key" : dc.password ? "password" : "none",
-    isDefault: name === cfg.defaultDevice,
-    description: dc.description,
-    jumpVia: dc.jumpVia,
-    jumpHost: dc.jumpHost ? { host: dc.jumpHost.host, port: dc.jumpHost.port } : undefined,
-    status: getDeviceStatus(name),
-    history: getDeviceHistory(name),
-    activity: activity.get(name) ?? {
-      calls: 0,
-      errors: 0,
-      lastSeen: 0,
-      avgMs: 0
-    }
-  }));
+  const poolEnabled = isPoolEnabled();
+  const poolMap = new Map(poolStatus().map((p) => [p.device, p]));
+  const devices = Object.entries(cfg.devices).map(([name, dc]) => {
+    const isMac = isMacTelnetDevice(dc);
+    const ps = poolMap.get(name);
+    return {
+      name,
+      host: dc.host,
+      port: dc.port,
+      mac: dc.mac,
+      transport: dc.mac ? "mac-telnet" : "ssh",
+      address: dc.mac ? dc.mac : `${dc.host}:${dc.port}`,
+      username: dc.username,
+      authMode: dc.mac ? "mac-telnet" : dc.keyFilename || dc.privateKey ? "key" : dc.password ? "password" : "none",
+      isDefault: name === cfg.defaultDevice,
+      description: dc.description,
+      jumpVia: dc.jumpVia,
+      jumpHost: dc.jumpHost ? { host: dc.jumpHost.host, port: dc.jumpHost.port } : undefined,
+      status: getDeviceStatus(name),
+      history: getDeviceHistory(name),
+      activity: activity.get(name) ?? {
+        calls: 0,
+        errors: 0,
+        lastSeen: 0,
+        avgMs: 0
+      },
+      pool: isMac || !poolEnabled ? null : {
+        device: name,
+        pooled: !!ps,
+        inflight: ps?.inflight ?? 0,
+        idle: ps?.idle ?? false,
+        dead: ps?.dead ?? false
+      }
+    };
+  });
   return { server: SERVER_TAG2, defaultDevice: cfg.defaultDevice, devices };
 }
 function topologyPayload() {
@@ -1544,6 +1562,10 @@ async function clientsRoutes(req, url) {
     const ctx = createContext(undefined, deviceFromQuery());
     return json(await sampleDeviceTraffic(ctx, ip));
   }
+  if (p === "/api/clients/traffic-bulk" && req.method === "GET") {
+    const ctx = createContext(undefined, deviceFromQuery());
+    return json(await sampleAllTraffic(ctx));
+  }
   if (req.method === "POST") {
     const b = await readJson(req);
     const ctx = createContext(undefined, b?.device);
@@ -1990,6 +2012,29 @@ async function runDashboard(cfg, transportLabel) {
       const removed = body.all === true ? db.clear() : db.delete(ids);
       return json({ removed, total: db.total() });
     }
+    if (url.pathname === "/api/ssh-pool") {
+      const cfg2 = getConfig();
+      const enabled = isPoolEnabled();
+      const ps = poolStatus();
+      const totalInflight = ps.reduce((s, p) => s + p.inflight, 0);
+      const totalIdle = ps.filter((p) => p.idle).length;
+      const totalBusy = ps.filter((p) => p.inflight > 0).length;
+      return json({
+        enabled,
+        config: {
+          keepAlive: cfg2.ssh.keepAlive,
+          keepAliveInterval: cfg2.ssh.keepAliveInterval,
+          idleTimeout: cfg2.ssh.idleTimeout
+        },
+        aggregate: {
+          totalConnections: ps.length,
+          totalInflight,
+          totalIdle,
+          totalBusy
+        },
+        devices: ps
+      });
+    }
     if (url.pathname === "/api/devices") {
       return json(devicesPayload(db));
     }
@@ -2242,7 +2287,7 @@ function registerPrompts(server) {
 // package.json
 var package_default = {
   name: "@usex/mikrotik-mcp",
-  version: "3.42.0",
+  version: "3.44.0",
   description: "MCP server for MikroTik RouterOS \u2014 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   keywords: [
     "ai",
@@ -2615,6 +2660,11 @@ TRANSPORT OPTIONS
   --mcp-port           HTTP bind port                   (MIKROTIK_MCP__PORT)
   --mcp-allowed-hosts  Host header allow-list (DNS-rebinding protection)
 
+SSH CONNECTION POOLING  (persistent connections, on by default)
+  --ssh-keep-alive          Enable/disable pooling   (MIKROTIK_SSH__KEEP_ALIVE, default true)
+  --ssh-keepalive-interval  Keepalive packet interval (ms) (MIKROTIK_SSH__KEEPALIVE_INTERVAL)
+  --ssh-idle-timeout        Close idle connections after (ms) (MIKROTIK_SSH__IDLE_TIMEOUT)
+
 OBSERVABILITY DASHBOARD  (optional; real-time feed + analytics of every tool call)
   --dashboard               Enable the dashboard     (MIKROTIK_DASHBOARD__ENABLED)
   --dashboard-host          Bind host (default 0.0.0.0=LAN) (MIKROTIK_DASHBOARD__HOST)
@@ -2717,7 +2767,13 @@ async function main() {
   setConfig(cfg);
   warnIfPlaintextPasswordInContainer(Object.values(cfg.devices).some((d) => !!d.password));
   const deviceNames = Object.keys(cfg.devices);
-  logger.info(`Starting ${SERVER_NAME} v${VERSION} (transport=${cfg.mcp.transport}, ` + `devices=${deviceNames.length === 1 ? deviceNames[0] : deviceNames.join("/")})`);
+  logger.info(`Starting ${SERVER_NAME} v${VERSION} (transport=${cfg.mcp.transport}, ` + `devices=${deviceNames.length === 1 ? deviceNames[0] : deviceNames.join("/")}, ` + `ssh-pool=${cfg.ssh.keepAlive ? "on" : "off"})`);
+  const cleanup = () => {
+    closeAll();
+  };
+  process.on("SIGINT", cleanup);
+  process.on("SIGTERM", cleanup);
+  process.on("exit", cleanup);
   const startDashboard = async () => {
     if (!cfg.dashboard.enabled)
       return;

package/dist/index.d.ts

@@ -192,6 +192,10 @@ interface SSHClientOptions {
 	* carry its own `jump` for a multi-hop chain (A → B → target).
 	*/
 	jump?: SSHClientOptions;
+	/** Interval (ms) for SSH keepalive packets. 0 disables (default). */
+	keepAliveInterval?: number;
+	/** Max consecutive keepalive failures before disconnect. Default: 3. */
+	keepAliveCountMax?: number;
 }
 declare class MikroTikSSHClient {
 	private client;

package/dist/index.js

@@ -21,7 +21,7 @@ import {
   resolveDeviceName,
   selectToolModules,
   setConfig
-} from "./shared/library-5cjmn0n7.js";
+} from "./shared/library-nb4wss02.js";
 // src/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
@@ -131,7 +131,7 @@ function registerPrompts(server) {
 // package.json
 var package_default = {
   name: "@usex/mikrotik-mcp",
-  version: "3.42.0",
+  version: "3.44.0",
   description: "MCP server for MikroTik RouterOS \u2014 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   keywords: [
     "ai",

package/dist/shared/{cli-rptenaf7.js → cli-1e5sj65w.js}

@@ -4,7 +4,7 @@ import {
   allToolModules,
   moduleCatalog,
   selectToolModules
-} from "./cli-sq4trv31.js";
+} from "./cli-k2ghtqd0.js";
 export {
   selectToolModules,
   moduleCatalog,