@usex/mikrotik-mcp 3.47.0 → 3.48.0

package/dist/cli.js

@@ -89,7 +89,7 @@ import {
   toggleAaaEntity,
   updateAaaEntity,
   writeBackup
-} from "./shared/cli-b6nehpgn.js";
+} from "./shared/cli-rcs47w19.js";
 
 // src/cli.ts
 import { existsSync as existsSync2 } from "fs";
@@ -1143,7 +1143,7 @@ function computeStats(events, opts) {
 // package.json
 var package_default = {
   name: "@usex/mikrotik-mcp",
-  version: "3.47.0",
+  version: "3.48.0",
   description: "MCP server for MikroTik RouterOS \u2014 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   keywords: [
     "ai",
@@ -2491,6 +2491,19 @@ interfaces, IP addressing, DHCP, DNS, firewall (filter + NAT), routing, VLANs,
 wireless, WireGuard, queues/QoS, users, logs, backups, PoE, system, network
 tools, bridges, address-lists, scheduler/scripts and certificates.
 
+Tool discovery \u2014 MANDATORY workflow:
+  This server has several hundred dedicated tools, but the host only surfaces a
+  small subset at a time. You MUST follow this order:
+    1. ALWAYS call \`find_tools\` FIRST \u2014 describe what you want to do and it
+       searches the full catalog for the best-matching dedicated tool.
+    2. (Optional) Call \`describe_tool\` to get the exact parameter schema.
+    3. Call the tool directly if it is listed, or via \`invoke_tool\` if not.
+    4. ONLY if \`find_tools\` returned ZERO results, fall back to
+       \`run_routeros_command\` as a last resort.
+  Dedicated tools have schema validation, structured output, and correct risk
+  annotations \u2014 \`run_routeros_command\` has none of these. Always prefer the
+  dedicated tool path.
+
 Safety model \u2014 tools are annotated by risk:
   \u2022 readOnlyHint     \u2192 inspection only, no changes
   \u2022 destructiveHint  \u2192 removes or replaces configuration

package/dist/index.js

@@ -21,7 +21,7 @@ import {
   resolveDeviceName,
   selectToolModules,
   setConfig
-} from "./shared/library-wppv8kdx.js";
+} from "./shared/library-esjkmrg2.js";
 // src/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
@@ -131,7 +131,7 @@ function registerPrompts(server) {
 // package.json
 var package_default = {
   name: "@usex/mikrotik-mcp",
-  version: "3.47.0",
+  version: "3.48.0",
   description: "MCP server for MikroTik RouterOS \u2014 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   keywords: [
     "ai",
@@ -280,6 +280,19 @@ interfaces, IP addressing, DHCP, DNS, firewall (filter + NAT), routing, VLANs,
 wireless, WireGuard, queues/QoS, users, logs, backups, PoE, system, network
 tools, bridges, address-lists, scheduler/scripts and certificates.
 
+Tool discovery \u2014 MANDATORY workflow:
+  This server has several hundred dedicated tools, but the host only surfaces a
+  small subset at a time. You MUST follow this order:
+    1. ALWAYS call \`find_tools\` FIRST \u2014 describe what you want to do and it
+       searches the full catalog for the best-matching dedicated tool.
+    2. (Optional) Call \`describe_tool\` to get the exact parameter schema.
+    3. Call the tool directly if it is listed, or via \`invoke_tool\` if not.
+    4. ONLY if \`find_tools\` returned ZERO results, fall back to
+       \`run_routeros_command\` as a last resort.
+  Dedicated tools have schema validation, structured output, and correct risk
+  annotations \u2014 \`run_routeros_command\` has none of these. Always prefer the
+  dedicated tool path.
+
 Safety model \u2014 tools are annotated by risk:
   \u2022 readOnlyHint     \u2192 inspection only, no changes
   \u2022 destructiveHint  \u2192 removes or replaces configuration

package/dist/shared/{cli-je6h62bk.js → cli-frtfsqcq.js}

@@ -4,7 +4,7 @@ import {
   allToolModules,
   moduleCatalog,
   selectToolModules
-} from "./cli-b6nehpgn.js";
+} from "./cli-rcs47w19.js";
 export {
   selectToolModules,
   moduleCatalog,

package/dist/shared/{cli-b6nehpgn.js → cli-rcs47w19.js}

@@ -6188,7 +6188,9 @@ var rawCommandTools = [
     name: "run_routeros_command",
     title: "Run a RouterOS Command (raw CLI)",
     annotations: WRITE,
-    description: "Execute ANY single RouterOS / MikroTik CLI command on the device and return its console output \u2014 the " + "universal primitive to read or change anything when no dedicated tool fits, for uncommon or bulk " + "operations, or simply when you can't quickly find the specific tool among the catalog. " + "Pass the command EXACTLY as typed in the RouterOS terminal, e.g. " + "`/system identity set name=Router1`, " + "`/ip dns set servers=1.1.1.1,8.8.8.8 allow-remote-requests=yes`, " + "`/ip address print`, `/ip firewall filter print`, `/interface print`, `/ip service print`, " + "`/system resource print`. " + "Works for reads (`\u2026 print`) and writes (`\u2026 set` / `add` / `remove`). Runs one command per call \u2014 " + "call again with a `\u2026 print` to verify a change. Prefer a dedicated tool when you know its name " + "(better validation and structured output); use this whenever discovery is the bottleneck. " + "WARNING: the command is run as-is and is NOT validated \u2014 it can be destructive (e.g. " + "`/system reset-configuration`, removing the management address), so review it before running. " + "For a stored multi-command script use add_script then run_script.",
+    description: "\u26A0\uFE0F LAST RESORT \u2014 do NOT call this tool directly. ALWAYS call `find_tools` first to locate the " + "dedicated tool for your task, then run it via `invoke_tool`. Dedicated tools provide schema " + "validation, structured output, and accurate risk annotations that this raw command lacks. " + "Only use this tool when `find_tools` returned zero results for your query AND you are certain " + `no dedicated tool exists.
+
+` + "When you do use it: pass one RouterOS CLI command exactly as typed in the terminal. " + "The command is executed as-is with NO validation \u2014 it can be destructive, so review carefully. " + "Runs one command per call; call again with `\u2026 print` to verify a change. " + "For multi-command scripts use add_script + run_script instead.",
     inputSchema: {
       command: z17.string().describe("Full RouterOS CLI command exactly as typed, e.g. '/ip address print'")
     },
@@ -6319,7 +6321,7 @@ var cache = null;
 async function gateway() {
   if (cache)
     return cache;
-  const { moduleCatalog } = await import("./cli-je6h62bk.js");
+  const { moduleCatalog } = await import("./cli-frtfsqcq.js");
   const forIndex = [];
   const byName = new Map;
   for (const mod of moduleCatalog) {
@@ -6357,7 +6359,9 @@ var toolGatewayTools = [
     name: "find_tools",
     title: "Find Tools (catalog search)",
     annotations: READ,
-    description: "Search the FULL MikroTik tool catalog by intent and get back the tools that best match \u2014 " + "use this FIRST whenever you can't immediately see the specific tool you need among the listed tools (the host only surfaces a subset of the several-hundred-tool catalog). Describe the task in natural language or keywords, e.g. 'block a LAN client by MAC', 'add an IPv4 firewall filter rule', 'import a TLS certificate', 'list DHCP leases', 'create a WireGuard peer'. Returns each match's exact tool name, what it does, and its " + "parameter names \u2014 then call it directly if it's already available, or run it via " + "`invoke_tool`. For IPv4 vs IPv6, say which: 'ipv4'/'ipv6' disambiguates the result.",
+    description: "\uD83D\uDD0D START HERE \u2014 this is the PRIMARY entry point for ANY MikroTik / RouterOS task. " + "ALWAYS call this tool FIRST before attempting any other tool. This server has several hundred dedicated tools with full validation and structured output, but the host only surfaces a small " + `subset \u2014 this tool searches the FULL catalog and finds the best match for your intent.
+
+` + "Describe what you want to do in natural language or keywords, e.g. 'block a LAN client by MAC', 'add an IPv4 firewall filter rule', 'import a TLS certificate', 'list DHCP leases', " + "'create a WireGuard peer'. Returns each match's exact tool name, description, and parameters \u2014 " + "then call it directly if available, or via `invoke_tool`.\n\n" + "Workflow: find_tools \u2192 (optional) describe_tool \u2192 invoke_tool. " + "Only fall back to run_routeros_command if this search returns zero results. For IPv4 vs IPv6, include 'ipv4' or 'ipv6' to disambiguate.",
     inputSchema: {
       query: z18.string().min(1).describe("What you want to do, in words or keywords (e.g. 'add ipv4 nat masquerade rule')."),
       limit: z18.coerce.number().int().min(1).max(25).optional().describe("Max results to return (default 8).")
@@ -24778,7 +24782,7 @@ ${result}`;
       const interfaceType = await detectWirelessInterfaceType(ctx);
       if (!interfaceType)
         return "Error: No wireless interface support detected on this device.";
-      const scanCmd = new Cmd(`${interfaceType} scan`).raw(a.interface).set("duration", a.duration).build();
+      const scanCmd = new Cmd(`${interfaceType} scan`).raw(quoteValue(a.interface)).set("duration", a.duration).build();
       const result = await executeMikrotikCommand(scanCmd, ctx);
       if (looksLikeError(result))
         return `Failed to scan wireless networks: ${result}`;

package/dist/shared/{library-wppv8kdx.js → library-esjkmrg2.js}

@@ -6129,7 +6129,9 @@ var rawCommandTools = [
     name: "run_routeros_command",
     title: "Run a RouterOS Command (raw CLI)",
     annotations: WRITE,
-    description: "Execute ANY single RouterOS / MikroTik CLI command on the device and return its console output \u2014 the " + "universal primitive to read or change anything when no dedicated tool fits, for uncommon or bulk " + "operations, or simply when you can't quickly find the specific tool among the catalog. " + "Pass the command EXACTLY as typed in the RouterOS terminal, e.g. " + "`/system identity set name=Router1`, " + "`/ip dns set servers=1.1.1.1,8.8.8.8 allow-remote-requests=yes`, " + "`/ip address print`, `/ip firewall filter print`, `/interface print`, `/ip service print`, " + "`/system resource print`. " + "Works for reads (`\u2026 print`) and writes (`\u2026 set` / `add` / `remove`). Runs one command per call \u2014 " + "call again with a `\u2026 print` to verify a change. Prefer a dedicated tool when you know its name " + "(better validation and structured output); use this whenever discovery is the bottleneck. " + "WARNING: the command is run as-is and is NOT validated \u2014 it can be destructive (e.g. " + "`/system reset-configuration`, removing the management address), so review it before running. " + "For a stored multi-command script use add_script then run_script.",
+    description: "\u26A0\uFE0F LAST RESORT \u2014 do NOT call this tool directly. ALWAYS call `find_tools` first to locate the " + "dedicated tool for your task, then run it via `invoke_tool`. Dedicated tools provide schema " + "validation, structured output, and accurate risk annotations that this raw command lacks. " + "Only use this tool when `find_tools` returned zero results for your query AND you are certain " + `no dedicated tool exists.
+
+` + "When you do use it: pass one RouterOS CLI command exactly as typed in the terminal. " + "The command is executed as-is with NO validation \u2014 it can be destructive, so review carefully. " + "Runs one command per call; call again with `\u2026 print` to verify a change. " + "For multi-command scripts use add_script + run_script instead.",
     inputSchema: {
       command: z17.string().describe("Full RouterOS CLI command exactly as typed, e.g. '/ip address print'")
     },
@@ -6260,7 +6262,7 @@ var cache = null;
 async function gateway() {
   if (cache)
     return cache;
-  const { moduleCatalog } = await import("./library-fnp716x3.js");
+  const { moduleCatalog } = await import("./library-xvsabg24.js");
   const forIndex = [];
   const byName = new Map;
   for (const mod of moduleCatalog) {
@@ -6298,7 +6300,9 @@ var toolGatewayTools = [
     name: "find_tools",
     title: "Find Tools (catalog search)",
     annotations: READ,
-    description: "Search the FULL MikroTik tool catalog by intent and get back the tools that best match \u2014 " + "use this FIRST whenever you can't immediately see the specific tool you need among the listed tools (the host only surfaces a subset of the several-hundred-tool catalog). Describe the task in natural language or keywords, e.g. 'block a LAN client by MAC', 'add an IPv4 firewall filter rule', 'import a TLS certificate', 'list DHCP leases', 'create a WireGuard peer'. Returns each match's exact tool name, what it does, and its " + "parameter names \u2014 then call it directly if it's already available, or run it via " + "`invoke_tool`. For IPv4 vs IPv6, say which: 'ipv4'/'ipv6' disambiguates the result.",
+    description: "\uD83D\uDD0D START HERE \u2014 this is the PRIMARY entry point for ANY MikroTik / RouterOS task. " + "ALWAYS call this tool FIRST before attempting any other tool. This server has several hundred dedicated tools with full validation and structured output, but the host only surfaces a small " + `subset \u2014 this tool searches the FULL catalog and finds the best match for your intent.
+
+` + "Describe what you want to do in natural language or keywords, e.g. 'block a LAN client by MAC', 'add an IPv4 firewall filter rule', 'import a TLS certificate', 'list DHCP leases', " + "'create a WireGuard peer'. Returns each match's exact tool name, description, and parameters \u2014 " + "then call it directly if available, or via `invoke_tool`.\n\n" + "Workflow: find_tools \u2192 (optional) describe_tool \u2192 invoke_tool. " + "Only fall back to run_routeros_command if this search returns zero results. For IPv4 vs IPv6, include 'ipv4' or 'ipv6' to disambiguate.",
     inputSchema: {
       query: z18.string().min(1).describe("What you want to do, in words or keywords (e.g. 'add ipv4 nat masquerade rule')."),
       limit: z18.coerce.number().int().min(1).max(25).optional().describe("Max results to return (default 8).")
@@ -24719,7 +24723,7 @@ ${result}`;
       const interfaceType = await detectWirelessInterfaceType(ctx);
       if (!interfaceType)
         return "Error: No wireless interface support detected on this device.";
-      const scanCmd = new Cmd(`${interfaceType} scan`).raw(a.interface).set("duration", a.duration).build();
+      const scanCmd = new Cmd(`${interfaceType} scan`).raw(quoteValue(a.interface)).set("duration", a.duration).build();
       const result = await executeMikrotikCommand(scanCmd, ctx);
       if (looksLikeError(result))
         return `Failed to scan wireless networks: ${result}`;

package/dist/shared/{library-fnp716x3.js → library-xvsabg24.js}

@@ -4,7 +4,7 @@ import {
   allToolModules,
   moduleCatalog,
   selectToolModules
-} from "./library-wppv8kdx.js";
+} from "./library-esjkmrg2.js";
 export {
   selectToolModules,
   moduleCatalog,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usex/mikrotik-mcp",
-  "version": "3.47.0",
+  "version": "3.48.0",
   "description": "MCP server for MikroTik RouterOS — 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   "keywords": [
     "ai",