@usex/mikrotik-mcp 3.5.0 → 3.7.0

package/schemas/tool-catalog.json

@@ -1,8 +1,8 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "version": "3.4.0",
+  "version": "3.6.0",
   "generated": "by scripts/gen-schemas.ts — do not edit by hand",
-  "toolCount": 670,
+  "toolCount": 706,
   "tools": [
     {
       "name": "list_interfaces",
@@ -312,6 +312,80 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "design_network_segment",
+      "title": "Design Isolated VLAN Segment",
+      "risk": "dangerous",
+      "annotations": {
+        "destructiveHint": true,
+        "openWorldHint": false
+      },
+      "description": "Stands up a complete isolated network segment in one call: a VLAN interface on the bridge, its gateway IP, a DHCP server + pool + network, optional internet access (srcnat masquerade), and inter-VLAN isolation firewall rules — e.g. 'a guest VLAN that reaches the internet but not the LAN'. DEFAULTS TO A DRY RUN (`apply=false`) showing every command grouped; set `apply=true` to build it. Bridge VLAN tagging is added when `tagged_ports`/`untagged_ports` are given (requires bridge vlan-filtering). Isolation drops forward traffic from this subnet to each `isolate_from` subnet. Returns the plan or a build report.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "vlan_id": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 4094
+          },
+          "name": {
+            "type": "string",
+            "description": "Name for the VLAN interface, e.g. 'guest'"
+          },
+          "subnet": {
+            "type": "string",
+            "description": "CIDR for the segment, e.g. '192.168.30.0/24'"
+          },
+          "gateway": {
+            "type": "string",
+            "description": "Router's address in the segment, e.g. '192.168.30.1'"
+          },
+          "bridge": {
+            "default": "bridge",
+            "description": "Bridge to put the VLAN on",
+            "type": "string"
+          },
+          "tagged_ports": {
+            "description": "Comma-separated trunk/tagged ports (+ the bridge)",
+            "type": "string"
+          },
+          "untagged_ports": {
+            "description": "Comma-separated access/untagged ports",
+            "type": "string"
+          },
+          "dhcp": {
+            "default": true,
+            "description": "Create a DHCP server + pool for the segment",
+            "type": "boolean"
+          },
+          "dhcp_range": {
+            "description": "Pool range; defaults to .10–.254 of the subnet",
+            "type": "string"
+          },
+          "internet": {
+            "default": true,
+            "description": "Allow internet access via srcnat masquerade",
+            "type": "boolean"
+          },
+          "isolate_from": {
+            "description": "Subnets this segment must NOT reach, e.g. ['192.168.1.0/24']",
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "apply": {
+            "default": false,
+            "description": "false = preview (default); true = build",
+            "type": "boolean"
+          }
+        },
+        "required": ["vlan_id", "name", "subnet", "gateway", "bridge", "dhcp", "internet", "apply"],
+        "additionalProperties": false
+      }
+    },
     {
       "name": "create_bridge",
       "title": "Create Bridge Interface",
@@ -1084,6 +1158,38 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "tune_wifi_channel",
+      "title": "Survey & Tune Wi-Fi Channel",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Runs an RF survey on a wireless radio (`/interface wireless frequency-monitor`, blocking for `duration`), finds the least-congested channel, and reports a before/after. DEFAULTS TO A DRY RUN (`apply=false`) — it surveys and recommends; set `apply=true` to set the radio to the best frequency (`/interface wireless set`). Targets the LEGACY wireless stack; for wifiwave2 (`/interface wifi`) tune via those tools. Returns the per-channel usage finding and the chosen frequency.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "interface": {
+            "type": "string",
+            "description": "Wireless interface, e.g. 'wlan1'"
+          },
+          "duration": {
+            "default": "5",
+            "description": "Survey duration in seconds",
+            "type": "string"
+          },
+          "apply": {
+            "default": false,
+            "description": "false = survey & recommend (default); true = set it",
+            "type": "boolean"
+          }
+        },
+        "required": ["interface", "duration", "apply"],
+        "additionalProperties": false
+      }
+    },
     {
       "name": "get_poe_monitor",
       "title": "Read PoE Interface Live Metrics",
@@ -2538,6 +2644,92 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "setup_wan_failover",
+      "title": "Set Up Multi-WAN Failover",
+      "risk": "dangerous",
+      "annotations": {
+        "destructiveHint": true,
+        "openWorldHint": false
+      },
+      "description": "Builds ACTIVE-PASSIVE multi-WAN failover by adding health-checked default routes with ascending distances (primary=1, each backup +1). RouterOS uses the lowest-distance reachable route; `check-gateway` withdraws a route when its gateway stops answering, so traffic fails over to the next WAN — and fails back automatically when the primary recovers. DEFAULTS TO A DRY RUN (`apply=false`) so you can review before changing default routing (which can cut your own access); set `apply=true` to execute. Does NOT remove existing 0.0.0.0/0 routes — clear conflicting ones first with the route tools. For load balancing instead of failover use setup_wan_loadbalance. Returns the plan or the resulting default routes.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "primary_gateway": {
+            "type": "string",
+            "description": "Primary WAN gateway IP (or interface name)"
+          },
+          "backup_gateways": {
+            "minItems": 1,
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "One or more backup WAN gateways, in failover order"
+          },
+          "check": {
+            "default": "ping",
+            "description": "Gateway health-check method",
+            "type": "string",
+            "enum": ["ping", "arp"]
+          },
+          "comment_prefix": {
+            "default": "wan-failover",
+            "type": "string"
+          },
+          "apply": {
+            "default": false,
+            "description": "false = preview only (default); true = execute",
+            "type": "boolean"
+          }
+        },
+        "required": ["primary_gateway", "backup_gateways", "check", "comment_prefix", "apply"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "setup_wan_loadbalance",
+      "title": "Set Up Multi-WAN Load Balancing (ECMP)",
+      "risk": "dangerous",
+      "annotations": {
+        "destructiveHint": true,
+        "openWorldHint": false
+      },
+      "description": "Builds ECMP (equal-cost multi-path) load balancing across multiple WANs by adding ONE default route whose `gateway` lists every WAN — RouterOS then spreads connections across the links (per-connection, so a single flow stays on one WAN). `check-gateway` drops a dead link from the set. DEFAULTS TO A DRY RUN (`apply=false`); set `apply=true` to execute. Does NOT remove existing 0.0.0.0/0 routes — clear conflicting ones first. ECMP is simple but balances by connection-hash, not by bandwidth; for sticky per-source balancing (PCC) use the firewall mangle + routing-table tools. For failover instead of balancing use setup_wan_failover. Returns the plan or the resulting default route.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "gateways": {
+            "minItems": 2,
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Two or more WAN gateways to balance across"
+          },
+          "check": {
+            "default": "ping",
+            "description": "Gateway health-check method",
+            "type": "string",
+            "enum": ["ping", "arp"]
+          },
+          "comment": {
+            "default": "wan-ecmp",
+            "type": "string"
+          },
+          "apply": {
+            "default": false,
+            "description": "false = preview only (default); true = execute",
+            "type": "boolean"
+          }
+        },
+        "required": ["gateways", "check", "comment", "apply"],
+        "additionalProperties": false
+      }
+    },
     {
       "name": "create_dhcp_server",
       "title": "Create DHCP Server Instance",
@@ -2751,168 +2943,436 @@
       }
     },
     {
-      "name": "set_dns_servers",
-      "title": "Configure DNS Resolver Settings",
-      "risk": "write",
+      "name": "list_dhcp_clients",
+      "title": "List DHCP Clients",
+      "risk": "read",
       "annotations": {
-        "destructiveHint": false,
+        "readOnlyHint": true,
+        "idempotentHint": true,
         "openWorldHint": false
       },
-      "description": "Configures the DNS resolver (`/ip dns set`) — sets upstream server IPs, enables or disables forwarding client queries to this router (allow_remote_requests), tunes cache limits (cache_size in KiB, cache_max_ttl, max_udp_packet_size, max_concurrent_queries), and optionally switches to DNS-over-HTTPS (use_doh=true + doh_server URL + verify_doh_cert). Use this when you need to CHANGE which servers the router queries or how its resolver behaves. To read current settings without changing them use get_dns_settings. Returns the updated `/ip dns print` output after applying changes.",
+      "description": "Lists IPv4 DHCP clients (`/ip dhcp-client print`) — each interface configured to obtain its address/gateway/DNS from an upstream DHCP server (typically a WAN port). Shows the bound address, status, and whether a default route / peer DNS is used. Optional `interface_filter`. For one client's detail use get_dhcp_client; to add one use add_dhcp_client.",
       "inputSchema": {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "type": "object",
         "properties": {
-          "servers": {
-            "type": "array",
-            "items": {
-              "type": "string"
-            },
-            "description": "DNS server IP addresses"
-          },
-          "allow_remote_requests": {
-            "default": false,
-            "type": "boolean"
-          },
-          "max_udp_packet_size": {
-            "type": "integer",
-            "minimum": -9007199254740991,
-            "maximum": 9007199254740991
-          },
-          "max_concurrent_queries": {
-            "type": "integer",
-            "minimum": -9007199254740991,
-            "maximum": 9007199254740991
-          },
-          "cache_size": {
-            "type": "integer",
-            "minimum": -9007199254740991,
-            "maximum": 9007199254740991
-          },
-          "cache_max_ttl": {
-            "type": "string"
-          },
-          "use_doh": {
-            "default": false,
-            "type": "boolean"
-          },
-          "doh_server": {
+          "interface_filter": {
+            "description": "Substring match on interface",
             "type": "string"
-          },
-          "verify_doh_cert": {
-            "default": true,
-            "type": "boolean"
           }
         },
-        "required": ["servers", "allow_remote_requests", "use_doh", "verify_doh_cert"],
         "additionalProperties": false
       }
     },
     {
-      "name": "get_dns_settings",
-      "title": "Get DNS Resolver Settings",
+      "name": "get_dhcp_client",
+      "title": "Get DHCP Client Detail",
       "risk": "read",
       "annotations": {
         "readOnlyHint": true,
         "idempotentHint": true,
         "openWorldHint": false
       },
-      "description": "Reads the current DNS resolver configuration (`/ip dns print`) — upstream server IPs, allow-remote-requests flag, cache-size, cache-max-ttl, max-udp-packet-size, max-concurrent-queries, and DNS-over-HTTPS settings. To change these settings use set_dns_servers. For cache entry counts and utilization metrics use get_dns_cache_statistics. Returns the full `/ip dns print` settings block.",
+      "description": "Full detail for the DHCP client on an interface (`/ip dhcp-client print detail where interface=...`) — bound address, gateway, lease time, status, and options. Use list_dhcp_clients to find interfaces. Returns the detail block or a not-found message.",
       "inputSchema": {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "type": "object",
-        "properties": {},
+        "properties": {
+          "interface": {
+            "type": "string",
+            "description": "Interface name, e.g. 'ether1'"
+          }
+        },
+        "required": ["interface"],
         "additionalProperties": false
       }
     },
     {
-      "name": "add_dns_static",
-      "title": "Add DNS Static Record",
+      "name": "add_dhcp_client",
+      "title": "Add DHCP Client",
       "risk": "write",
       "annotations": {
         "destructiveHint": false,
         "openWorldHint": false
       },
-      "description": "Creates a static DNS record in `/ip dns static` — the local override table that answers DNS queries before upstream resolvers are consulted. Supports A (address), CNAME (cname), MX (mx_preference + mx_exchange), TXT (text), and SRV (srv_priority + srv_weight + srv_port + srv_target) record types; provide exactly one record type's fields per call. A regexp pattern may also be set for wildcard hostname matching — for a simpler regexp-only interface use add_dns_regexp instead. To inspect existing records use list_dns_static. Returns the created entry's full detail including its `.id`.",
+      "description": "Adds an IPv4 DHCP client on an interface (`/ip dhcp-client add`) so it obtains an address from an upstream DHCP server — the usual way to configure a WAN port. `add_default_route` installs the received gateway; `use_peer_dns`/`use_peer_ntp` adopt the server's DNS/NTP. Returns the created client's detail.",
       "inputSchema": {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "type": "object",
         "properties": {
-          "name": {
-            "type": "string"
-          },
-          "address": {
-            "type": "string"
-          },
-          "cname": {
-            "type": "string"
-          },
-          "mx_preference": {
-            "type": "integer",
-            "minimum": -9007199254740991,
-            "maximum": 9007199254740991
-          },
-          "mx_exchange": {
-            "type": "string"
-          },
-          "text": {
-            "type": "string"
-          },
-          "srv_priority": {
-            "type": "integer",
-            "minimum": -9007199254740991,
-            "maximum": 9007199254740991
-          },
-          "srv_weight": {
-            "type": "integer",
-            "minimum": -9007199254740991,
-            "maximum": 9007199254740991
-          },
-          "srv_port": {
-            "type": "integer",
-            "minimum": -9007199254740991,
-            "maximum": 9007199254740991
+          "interface": {
+            "type": "string",
+            "description": "Interface to run the DHCP client on, e.g. 'ether1'"
           },
-          "srv_target": {
-            "type": "string"
+          "add_default_route": {
+            "default": true,
+            "description": "Install the received default gateway",
+            "type": "boolean"
           },
-          "ttl": {
-            "type": "string"
+          "use_peer_dns": {
+            "default": true,
+            "type": "boolean"
           },
-          "comment": {
-            "type": "string"
+          "use_peer_ntp": {
+            "default": true,
+            "type": "boolean"
           },
           "disabled": {
             "default": false,
             "type": "boolean"
           },
-          "regexp": {
+          "comment": {
             "type": "string"
           }
         },
-        "required": ["name", "disabled"],
+        "required": ["interface", "add_default_route", "use_peer_dns", "use_peer_ntp", "disabled"],
         "additionalProperties": false
       }
     },
     {
-      "name": "list_dns_static",
-      "title": "List DNS Static Records",
-      "risk": "read",
+      "name": "set_dhcp_client",
+      "title": "Update DHCP Client",
+      "risk": "write-idempotent",
       "annotations": {
-        "readOnlyHint": true,
+        "destructiveHint": false,
         "idempotentHint": true,
         "openWorldHint": false
       },
-      "description": "Lists static DNS records from `/ip dns static print` — the local resolver override table. Supports optional filters: name_filter (substring match on hostname), address_filter (substring match on IP), type_filter (exact record type, e.g. \"A\", \"CNAME\", \"MX\"), disabled_only (only disabled entries), regexp_only (only regexp-pattern entries). To retrieve full field detail for one specific entry by `.id` use get_dns_static. Returns a table of all matching static DNS records with their `.id` values.",
+      "description": "Updates the DHCP client on an interface (`/ip dhcp-client set [find interface=...]`) — toggle `add_default_route`, `use_peer_dns`, `use_peer_ntp`, or `disabled`. No-ops if nothing is supplied. Returns the updated detail.",
       "inputSchema": {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "type": "object",
         "properties": {
-          "name_filter": {
+          "interface": {
             "type": "string"
           },
-          "address_filter": {
-            "type": "string"
+          "add_default_route": {
+            "type": "boolean"
+          },
+          "use_peer_dns": {
+            "type": "boolean"
+          },
+          "use_peer_ntp": {
+            "type": "boolean"
+          },
+          "disabled": {
+            "type": "boolean"
+          }
+        },
+        "required": ["interface"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "renew_dhcp_client",
+      "title": "Renew / Release DHCP Lease",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Renews or releases the DHCP lease on an interface (`/ip dhcp-client renew|release`). `release=true` drops the current lease; otherwise it renews — use to re-pull WAN settings after an upstream change. Returns the client status afterward.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "interface": {
+            "type": "string"
+          },
+          "release": {
+            "default": false,
+            "description": "true = release the lease; false = renew",
+            "type": "boolean"
+          }
+        },
+        "required": ["interface", "release"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "remove_dhcp_client",
+      "title": "Remove DHCP Client",
+      "risk": "destructive",
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Removes the DHCP client from an interface (`/ip dhcp-client remove [find interface=...]`) — the interface stops obtaining an address from DHCP (set a static address separately if needed). Confirms removal or reports not-found.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "interface": {
+            "type": "string"
+          }
+        },
+        "required": ["interface"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "build_guest_hotspot",
+      "title": "Build Guest Hotspot (Captive Portal)",
+      "risk": "dangerous",
+      "annotations": {
+        "destructiveHint": true,
+        "openWorldHint": false
+      },
+      "description": "Stands up a guest hotspot with a captive sign-in portal in one call: the gateway IP, an address pool, a DHCP server, the `/ip hotspot` server + profile (with a per-guest `rate_limit` bandwidth cap and optional `dns_name`), and a walled garden (the `walled_garden` domains reachable BEFORE sign-in, e.g. your payment/login pages). DEFAULTS TO A DRY RUN (`apply=false`) showing every command; set `apply=true` to build it. Generate printable guest codes with generate_hotspot_vouchers. Returns the plan or a build report.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "interface": {
+            "type": "string",
+            "description": "Interface/bridge the hotspot runs on, e.g. 'guest-bridge'"
+          },
+          "subnet": {
+            "default": "10.5.50.0/24",
+            "description": "Hotspot subnet",
+            "type": "string"
+          },
+          "gateway": {
+            "default": "10.5.50.1",
+            "description": "Router address in the hotspot subnet",
+            "type": "string"
+          },
+          "pool_range": {
+            "description": "DHCP/hotspot pool; defaults to .10–.254",
+            "type": "string"
+          },
+          "dns_name": {
+            "description": "Captive-portal hostname, e.g. 'guest.wifi'",
+            "type": "string"
+          },
+          "rate_limit": {
+            "default": "5M/5M",
+            "description": "Per-guest max-limit (rx/tx)",
+            "type": "string"
+          },
+          "walled_garden": {
+            "description": "Domains reachable before sign-in, e.g. ['*.stripe.com']",
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "apply": {
+            "default": false,
+            "description": "false = preview (default); true = build",
+            "type": "boolean"
+          }
+        },
+        "required": ["interface", "subnet", "gateway", "rate_limit", "apply"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "generate_hotspot_vouchers",
+      "title": "Generate Hotspot Vouchers",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Creates `count` random guest login codes as `/ip hotspot user` entries (username = password = code), each with an optional uptime limit and hotspot user profile — the printable vouchers you hand to guests. DEFAULTS TO A DRY RUN (`apply=false`) that just shows the codes it would create; set `apply=true` to add them. Returns the generated codes.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "count": {
+            "default": 10,
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 200
+          },
+          "uptime_limit": {
+            "description": "Per-voucher uptime, e.g. '1h', '1d'",
+            "type": "string"
+          },
+          "profile": {
+            "description": "Hotspot user profile to assign",
+            "type": "string"
+          },
+          "code_prefix": {
+            "default": "g",
+            "description": "Prefix for the generated codes",
+            "type": "string"
+          },
+          "apply": {
+            "default": false,
+            "description": "false = preview codes (default); true = create",
+            "type": "boolean"
+          }
+        },
+        "required": ["count", "code_prefix", "apply"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "set_dns_servers",
+      "title": "Configure DNS Resolver Settings",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Configures the DNS resolver (`/ip dns set`) — sets upstream server IPs, enables or disables forwarding client queries to this router (allow_remote_requests), tunes cache limits (cache_size in KiB, cache_max_ttl, max_udp_packet_size, max_concurrent_queries), and optionally switches to DNS-over-HTTPS (use_doh=true + doh_server URL + verify_doh_cert). Use this when you need to CHANGE which servers the router queries or how its resolver behaves. To read current settings without changing them use get_dns_settings. Returns the updated `/ip dns print` output after applying changes.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "servers": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "DNS server IP addresses"
+          },
+          "allow_remote_requests": {
+            "default": false,
+            "type": "boolean"
+          },
+          "max_udp_packet_size": {
+            "type": "integer",
+            "minimum": -9007199254740991,
+            "maximum": 9007199254740991
+          },
+          "max_concurrent_queries": {
+            "type": "integer",
+            "minimum": -9007199254740991,
+            "maximum": 9007199254740991
+          },
+          "cache_size": {
+            "type": "integer",
+            "minimum": -9007199254740991,
+            "maximum": 9007199254740991
+          },
+          "cache_max_ttl": {
+            "type": "string"
+          },
+          "use_doh": {
+            "default": false,
+            "type": "boolean"
+          },
+          "doh_server": {
+            "type": "string"
+          },
+          "verify_doh_cert": {
+            "default": true,
+            "type": "boolean"
+          }
+        },
+        "required": ["servers", "allow_remote_requests", "use_doh", "verify_doh_cert"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "get_dns_settings",
+      "title": "Get DNS Resolver Settings",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Reads the current DNS resolver configuration (`/ip dns print`) — upstream server IPs, allow-remote-requests flag, cache-size, cache-max-ttl, max-udp-packet-size, max-concurrent-queries, and DNS-over-HTTPS settings. To change these settings use set_dns_servers. For cache entry counts and utilization metrics use get_dns_cache_statistics. Returns the full `/ip dns print` settings block.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {},
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "add_dns_static",
+      "title": "Add DNS Static Record",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Creates a static DNS record in `/ip dns static` — the local override table that answers DNS queries before upstream resolvers are consulted. Supports A (address), CNAME (cname), MX (mx_preference + mx_exchange), TXT (text), and SRV (srv_priority + srv_weight + srv_port + srv_target) record types; provide exactly one record type's fields per call. A regexp pattern may also be set for wildcard hostname matching — for a simpler regexp-only interface use add_dns_regexp instead. To inspect existing records use list_dns_static. Returns the created entry's full detail including its `.id`.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string"
+          },
+          "address": {
+            "type": "string"
+          },
+          "cname": {
+            "type": "string"
+          },
+          "mx_preference": {
+            "type": "integer",
+            "minimum": -9007199254740991,
+            "maximum": 9007199254740991
+          },
+          "mx_exchange": {
+            "type": "string"
+          },
+          "text": {
+            "type": "string"
+          },
+          "srv_priority": {
+            "type": "integer",
+            "minimum": -9007199254740991,
+            "maximum": 9007199254740991
+          },
+          "srv_weight": {
+            "type": "integer",
+            "minimum": -9007199254740991,
+            "maximum": 9007199254740991
+          },
+          "srv_port": {
+            "type": "integer",
+            "minimum": -9007199254740991,
+            "maximum": 9007199254740991
+          },
+          "srv_target": {
+            "type": "string"
+          },
+          "ttl": {
+            "type": "string"
+          },
+          "comment": {
+            "type": "string"
+          },
+          "disabled": {
+            "default": false,
+            "type": "boolean"
+          },
+          "regexp": {
+            "type": "string"
+          }
+        },
+        "required": ["name", "disabled"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "list_dns_static",
+      "title": "List DNS Static Records",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Lists static DNS records from `/ip dns static print` — the local resolver override table. Supports optional filters: name_filter (substring match on hostname), address_filter (substring match on IP), type_filter (exact record type, e.g. \"A\", \"CNAME\", \"MX\"), disabled_only (only disabled entries), regexp_only (only regexp-pattern entries). To retrieve full field detail for one specific entry by `.id` use get_dns_static. Returns a table of all matching static DNS records with their `.id` values.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "name_filter": {
+            "type": "string"
+          },
+          "address_filter": {
+            "type": "string"
           },
           "type_filter": {
             "type": "string"
@@ -3226,6 +3686,85 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "set_time_policy",
+      "title": "Set Time-of-Day / Parental Policy",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Schedules per-device internet access and content blocking. Cuts internet for devices in the `list` address-list between `block_start` and `block_end` daily (a forward-drop rule toggled by two schedulers), optionally adds `addresses` to that list, and DNS-sinkholes any `block_domains` (always blocked). DEFAULTS TO A DRY RUN (`apply=false`) showing every command; set `apply=true` to install. Everything is tagged 'parental-<name>' so remove_time_policy can undo it. Returns the plan or a build report.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "Policy id, e.g. 'kids-bedtime'"
+          },
+          "list": {
+            "default": "parental-devices",
+            "description": "Address-list of the affected devices",
+            "type": "string"
+          },
+          "addresses": {
+            "description": "Device IPs to add to the list",
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "block_start": {
+            "default": "22:00",
+            "description": "Daily cut-off time (HH:MM)",
+            "type": "string"
+          },
+          "block_end": {
+            "default": "07:00",
+            "description": "Daily restore time (HH:MM)",
+            "type": "string"
+          },
+          "block_domains": {
+            "description": "Domains to always block via DNS",
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "apply": {
+            "default": false,
+            "description": "false = preview (default); true = install",
+            "type": "boolean"
+          }
+        },
+        "required": ["name", "list", "block_start", "block_end", "apply"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "remove_time_policy",
+      "title": "Remove Time-of-Day / Parental Policy",
+      "risk": "destructive",
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Removes a policy installed by set_time_policy: the schedulers, the forward-drop rule, and the DNS sinkhole entries tagged 'parental-<name>'. Address-list members added for it are also removed. Returns what was cleared.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "The policy id used when installing"
+          }
+        },
+        "required": ["name"],
+        "additionalProperties": false
+      }
+    },
     {
       "name": "add_ipv6_address",
       "title": "Add IPv6 Address to Interface",
@@ -9905,6 +10444,60 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "forward_port",
+      "title": "Forward a Port (Smart Wizard)",
+      "risk": "dangerous",
+      "annotations": {
+        "destructiveHint": true,
+        "openWorldHint": false
+      },
+      "description": "Exposes an internal service correctly and completely in one call: the DST-NAT rule that forwards `external_port` to `internal_host:internal_port`, the matching forward-chain accept (so it passes a default-drop firewall), and — when `lan_subnet` is given — the hairpin/loopback srcnat so the service also works when reached from inside the LAN via the public IP. DEFAULTS TO A DRY RUN (`apply=false`) showing every rule; set `apply=true` to create them. All rules are tagged 'port-forward:'. Returns the plan or a build report.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "protocol": {
+            "default": "tcp",
+            "type": "string",
+            "enum": ["tcp", "udp"]
+          },
+          "external_port": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 65535
+          },
+          "internal_host": {
+            "type": "string",
+            "description": "LAN IP of the service, e.g. '192.168.1.10'"
+          },
+          "internal_port": {
+            "description": "Defaults to external_port",
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 65535
+          },
+          "wan_interface": {
+            "description": "Restrict the forward to this WAN interface",
+            "type": "string"
+          },
+          "lan_subnet": {
+            "description": "LAN subnet for hairpin NAT, e.g. '192.168.1.0/24'",
+            "type": "string"
+          },
+          "comment": {
+            "type": "string"
+          },
+          "apply": {
+            "default": false,
+            "description": "false = preview (default); true = create",
+            "type": "boolean"
+          }
+        },
+        "required": ["protocol", "external_port", "internal_host", "apply"],
+        "additionalProperties": false
+      }
+    },
     {
       "name": "add_address_list_entry",
       "title": "Add Firewall Address-List Entry",
@@ -10071,27 +10664,222 @@
       "title": "Audit IPv4 Firewall Rulesets",
       "risk": "read",
       "annotations": {
-        "readOnlyHint": true,
-        "idempotentHint": true,
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Audits IPv4 firewall rulesets (`/ip firewall filter print detail`; optionally `/ip firewall nat print detail` when include_nat=true (default on); `/ip firewall mangle print detail` when include_mangle=true (default off)) — use to review, harden, or understand a router's full firewall posture in one pass. Detects unreachable/shadowed rules, overly-broad accepts, a missing default-drop, duplicate rules, and dead rules with zero packet hits. For browsing individual rules without analysis use list_filter_rules, list_nat_rules; for IPv6 filter rules use list_ipv6_filter_rules; for IPv6 NAT use list_ipv6_nat_rules; for IPv6 mangle use list_ipv6_mangle_rules. Returns a risk score and a prioritised list of plain-language findings with suggested per-rule fixes; in MCP App hosts also renders an interactive findings table with one-click disable. Scoped to IPv4 paths only — no IPv6 audit twin exists.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "include_nat": {
+            "default": true,
+            "description": "Also audit `/ip firewall nat`.",
+            "type": "boolean"
+          },
+          "include_mangle": {
+            "default": false,
+            "description": "Also audit `/ip firewall mangle`.",
+            "type": "boolean"
+          }
+        },
+        "required": ["include_nat", "include_mangle"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "harden_firewall",
+      "title": "Harden Firewall (Security Shield)",
+      "risk": "dangerous",
+      "annotations": {
+        "destructiveHint": true,
+        "openWorldHint": false
+      },
+      "description": "Hardens the IPv4 firewall against common attacks by applying a chosen set of best-practice rules (DDoS/connection-rate, SSH/Winbox brute-force ladder, SYN-flood and ICMP rate limits, port-scan detection, anti-spoof/bogon, raw pre-conntrack drops, management lock-down). Pick a `preset` (basic · standard · paranoid) and/or toggle individual `protections`. DEFAULTS TO A DRY RUN (`apply=false`) that returns the exact commands grouped by protection. Applying defaults to SAFE MODE (`safe_mode=true`) so a rule that cuts your own access auto-reverts. Anti-lockout: set `trusted_sources` (an address or address-list always accepted first); input-drop protections are refused without it unless `i_accept_lockout_risk=true`. Every rule is tagged with a 'security-shield:' comment — audit with audit_firewall_hardening, undo with remove_firewall_hardening. Rules are appended; review order for an existing ruleset.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "preset": {
+            "default": "standard",
+            "description": "Bundle to apply; 'custom' uses only the `protections` toggles",
+            "type": "string",
+            "enum": ["basic", "standard", "paranoid", "custom"]
+          },
+          "protections": {
+            "description": "Per-protection on/off, overriding/extending the preset",
+            "type": "object",
+            "propertyNames": {
+              "type": "string",
+              "enum": [
+                "state_hygiene",
+                "ssh_bruteforce",
+                "ddos_conn_limit",
+                "syn_flood",
+                "icmp_limit",
+                "port_scan",
+                "anti_spoof",
+                "raw_drops",
+                "mgmt_lockdown"
+              ]
+            },
+            "additionalProperties": {
+              "type": "boolean"
+            },
+            "required": [
+              "state_hygiene",
+              "ssh_bruteforce",
+              "ddos_conn_limit",
+              "syn_flood",
+              "icmp_limit",
+              "port_scan",
+              "anti_spoof",
+              "raw_drops",
+              "mgmt_lockdown"
+            ]
+          },
+          "trusted_sources": {
+            "description": "Address or address-list name always accepted first (anti-lockout)",
+            "type": "string"
+          },
+          "wan_interface": {
+            "description": "WAN interface (required for anti_spoof)",
+            "type": "string"
+          },
+          "mgmt_ports": {
+            "default": "22,8291,8728",
+            "description": "Management TCP ports",
+            "type": "string"
+          },
+          "ssh_ports": {
+            "default": "22",
+            "description": "Ports watched by the brute-force ladder",
+            "type": "string"
+          },
+          "conn_limit": {
+            "default": 100,
+            "description": "Per-source TCP connection cap",
+            "type": "integer",
+            "minimum": -9007199254740991,
+            "maximum": 9007199254740991
+          },
+          "syn_rate": {
+            "default": "200,50:packet",
+            "type": "string"
+          },
+          "icmp_rate": {
+            "default": "50,10:packet",
+            "type": "string"
+          },
+          "apply": {
+            "default": false,
+            "description": "false = preview only (default); true = apply",
+            "type": "boolean"
+          },
+          "safe_mode": {
+            "default": true,
+            "description": "Apply through Safe Mode (auto-revert on lockout)",
+            "type": "boolean"
+          },
+          "i_accept_lockout_risk": {
+            "default": false,
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "preset",
+          "mgmt_ports",
+          "ssh_ports",
+          "conn_limit",
+          "syn_rate",
+          "icmp_rate",
+          "apply",
+          "safe_mode",
+          "i_accept_lockout_risk"
+        ],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "audit_firewall_hardening",
+      "title": "Audit Firewall Hardening",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Reports which Security Shield protections are present on the firewall by scanning for the 'security-shield:' tagged rules (`/ip firewall filter` + `/ip firewall raw`), and notes the foundational checks (accept established/related, drop invalid) regardless of tag. Use to see coverage and gaps before/after harden_firewall. Complements the broader firewall-audit tools. Returns a per-protection present/absent summary.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {},
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "remove_firewall_hardening",
+      "title": "Remove Firewall Hardening",
+      "risk": "destructive",
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Removes every firewall rule that Security Shield installed — all `/ip firewall filter` and `/ip firewall raw` entries tagged with the 'security-shield:' comment (the shield's own address-lists are left, since they may be referenced elsewhere). Use to roll back harden_firewall. Does NOT touch rules you created by hand. Returns how many rules were removed.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {},
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "setup_port_knock",
+      "title": "Set Up Port-Knock Guardian",
+      "risk": "dangerous",
+      "annotations": {
+        "destructiveHint": true,
         "openWorldHint": false
       },
-      "description": "Audits IPv4 firewall rulesets (`/ip firewall filter print detail`; optionally `/ip firewall nat print detail` when include_nat=true (default on); `/ip firewall mangle print detail` when include_mangle=true (default off)) — use to review, harden, or understand a router's full firewall posture in one pass. Detects unreachable/shadowed rules, overly-broad accepts, a missing default-drop, duplicate rules, and dead rules with zero packet hits. For browsing individual rules without analysis use list_filter_rules, list_nat_rules; for IPv6 filter rules use list_ipv6_filter_rules; for IPv6 NAT use list_ipv6_nat_rules; for IPv6 mangle use list_ipv6_mangle_rules. Returns a risk score and a prioritised list of plain-language findings with suggested per-rule fixes; in MCP App hosts also renders an interactive findings table with one-click disable. Scoped to IPv4 paths only — no IPv6 audit twin exists.",
+      "description": "Hides management services behind a secret port-knock `sequence`: a source must connect to the knock ports in order to be added to an allow-list, after which the `protect_ports` (SSH/Winbox/API, default 22,8291,8728) accept it — everyone else is dropped, so the ports are invisible to scanners. Generates the staged address-list ladder + accept/drop rules. DEFAULTS TO A DRY RUN (`apply=false`); set `apply=true` to install. WARNING: after applying, management is only reachable by knocking the exact sequence — make sure you can knock (and keep a console/trusted path). Rules are tagged 'port-knock:'. Returns the plan or a build report.",
       "inputSchema": {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "type": "object",
         "properties": {
-          "include_nat": {
-            "default": true,
-            "description": "Also audit `/ip firewall nat`.",
-            "type": "boolean"
+          "sequence": {
+            "minItems": 2,
+            "type": "array",
+            "items": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 65535
+            },
+            "description": "Secret knock ports, in order, e.g. [7001, 8002, 9003]"
           },
-          "include_mangle": {
+          "protect_ports": {
+            "default": "22,8291,8728",
+            "description": "Management ports to hide",
+            "type": "string"
+          },
+          "open_timeout": {
+            "default": "1h",
+            "description": "How long access stays open after the knock",
+            "type": "string"
+          },
+          "stage_timeout": {
+            "default": "10s",
+            "description": "Allowed window between consecutive knocks",
+            "type": "string"
+          },
+          "apply": {
             "default": false,
-            "description": "Also audit `/ip firewall mangle`.",
+            "description": "false = preview (default); true = install",
             "type": "boolean"
           }
         },
-        "required": ["include_nat", "include_mangle"],
+        "required": ["sequence", "protect_ports", "open_timeout", "stage_timeout", "apply"],
         "additionalProperties": false
       }
     },
@@ -10273,6 +11061,54 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "audit_certificate_expiry",
+      "title": "Audit Certificate Expiry",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Scans every certificate in the device store (`/certificate print detail`) and reports how long until each one expires — sorted by urgency, with anything ALREADY EXPIRED or expiring within `warn_within_days` (default 30) flagged first. Use this to catch a TLS cert (SSTP, API-SSL, hotspot, REST/www-ssl) before it lapses and silently breaks a service. For the full detail of one certificate use get_certificate; to obtain/renew a Let's Encrypt cert use request_letsencrypt_certificate. Returns a grouped report (expired · expiring soon · ok), plus any certs with no parseable expiry (e.g. unsigned templates).",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "warn_within_days": {
+            "default": 30,
+            "description": "Flag certificates expiring within this many days as 'expiring soon'",
+            "type": "integer",
+            "minimum": -9007199254740991,
+            "maximum": 9007199254740991
+          }
+        },
+        "required": ["warn_within_days"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "request_letsencrypt_certificate",
+      "title": "Request/Renew Let's Encrypt Certificate",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Obtains (or renews) a free Let's Encrypt TLS certificate for `dns_name` using RouterOS's built-in ACME client (`/certificate enable-ssl-certificate`). The device must be reachable from the internet on TCP 80 and `dns_name` must already resolve to it (ACME http-01 challenge). On success the certificate is installed in the store and bound to the www-ssl service; re-running this for the same name renews it. To check what is installed and when it expires use audit_certificate_expiry. NOTE: this reaches the public ACME service and may take several seconds. Returns the device's output from the request.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "dns_name": {
+            "type": "string",
+            "description": "Public DNS name that resolves to this router, e.g. 'vpn.example.com'"
+          }
+        },
+        "required": ["dns_name"],
+        "additionalProperties": false
+      }
+    },
     {
       "name": "list_ip_services",
       "title": "List IP Management Services",
@@ -10322,7 +11158,7 @@
         "idempotentHint": true,
         "openWorldHint": false
       },
-      "description": "Updates one or more attributes of a router management service (`/ip service set`) — port number, allowed source subnets (`address`, comma-separated CIDRs), TLS certificate name, or enabled/disabled state (`disabled: true/false`). Accepts a service name such as `ssh`, `winbox`, `api`, or `api-ssl`. To toggle only the enabled state use `enable_ip_service` or `disable_ip_service` instead. Returns updated service detail on success.",
+      "description": "Updates one or more attributes of a router management service (`/ip service set`) — port number, allowed source subnets (`address`, comma-separated CIDRs), TLS certificate name, or enabled/disabled state (`disabled: true/false`). Accepts a service name such as `ssh`, `winbox`, `api`, or `api-ssl`. Note: two services cannot share a port — if the chosen port is already used by another service the device rejects it (list_ip_services shows current ports). To toggle only the enabled state use `enable_ip_service` or `disable_ip_service` instead. Returns updated service detail on success.",
       "inputSchema": {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "type": "object",
@@ -10400,6 +11236,88 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "get_ip_cloud",
+      "title": "Get IP Cloud (DDNS) Status",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Reads the RouterOS cloud DDNS status (`/ip cloud print`) — whether `ddns-enabled` is on, the assigned `dns-name` (`<serial>.sn.mynetname.net`), the detected public IPv4/IPv6 address, the last `update-time`, and the service `status`/warnings. Use this to find the router's stable cloud hostname or check why DDNS isn't updating. To change it use set_ip_cloud; to push an update now use force_cloud_update. Returns the full cloud status block.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {},
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "set_ip_cloud",
+      "title": "Configure IP Cloud (DDNS)",
+      "risk": "write-idempotent",
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Configures RouterOS cloud DDNS (`/ip cloud set`). Enable/disable the dynamic DNS name with `ddns_enabled`, optionally also sync the router clock from the cloud with `update_time`. When enabled the router registers a `<serial>.sn.mynetname.net` name that follows its public IP. To read the resulting name/status use get_ip_cloud; to force an immediate refresh use force_cloud_update; for the local-vs-public address behaviour use set_ip_cloud_advanced. Returns the updated cloud status.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "ddns_enabled": {
+            "description": "Enable (true) or disable (false) the DDNS name",
+            "type": "boolean"
+          },
+          "update_time": {
+            "description": "Also sync the router clock from the cloud",
+            "type": "boolean"
+          }
+        },
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "force_cloud_update",
+      "title": "Force IP Cloud DDNS Update",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Forces an immediate cloud DDNS refresh (`/ip cloud force-update`) — pushes the router's current public IP to the cloud now instead of waiting for the next scheduled update. Use after a WAN IP change or to test connectivity to the cloud service. Requires DDNS to be enabled (see set_ip_cloud). Returns the cloud status after the update.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {},
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "set_ip_cloud_advanced",
+      "title": "Set IP Cloud Advanced Options",
+      "risk": "write-idempotent",
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Sets advanced cloud options (`/ip cloud advanced set`). `use_local_address=true` makes the cloud DDNS publish the router's LOCAL address instead of the detected public one (useful behind a private WAN / when you reach the router over a VPN). For the main DDNS toggle use set_ip_cloud. Returns the updated cloud status.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "use_local_address": {
+            "type": "boolean",
+            "description": "Publish the local address (true) instead of the public address (false)"
+          }
+        },
+        "required": ["use_local_address"],
+        "additionalProperties": false
+      }
+    },
     {
       "name": "add_dot1x_server",
       "title": "Add 802.1X Server (Authenticator) Entry",
@@ -11167,65 +12085,224 @@
             "description": "\"*N\" or \"N\" from list output e.g. \"*2\""
           }
         },
-        "required": ["peer_id"],
+        "required": ["peer_id"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "generate_wireguard_client_config",
+      "title": "Generate WireGuard Client Config File",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Generates a standard wg0.conf client configuration file (`[Interface] + [Peer]` sections) entirely from the provided keys and server endpoint — runs locally, never contacts the router. Use this after registering a client's public key with add_wireguard_peer to produce the config text to distribute to that client. Returns the config text ready to save as /etc/wireguard/wg0.conf (Linux) or import into the WireGuard app, with instructions for generating client keys and bringing the tunnel up.\n\nNotes:\n  allowed_ips: CIDRs routed through the tunnel by the client, default \"0.0.0.0/0\" (all IPv4 traffic; add ::/0 to also route IPv6)\n  persistent_keepalive: seconds integer, default 25",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "client_private_key": {
+            "type": "string"
+          },
+          "client_address": {
+            "type": "string"
+          },
+          "server_public_key": {
+            "type": "string"
+          },
+          "server_endpoint": {
+            "type": "string"
+          },
+          "server_port": {
+            "default": 51820,
+            "type": "integer",
+            "minimum": -9007199254740991,
+            "maximum": 9007199254740991
+          },
+          "allowed_ips": {
+            "default": "0.0.0.0/0",
+            "type": "string"
+          },
+          "dns": {
+            "type": "string"
+          },
+          "persistent_keepalive": {
+            "default": 25,
+            "type": "integer",
+            "minimum": -9007199254740991,
+            "maximum": 9007199254740991
+          }
+        },
+        "required": [
+          "client_private_key",
+          "client_address",
+          "server_public_key",
+          "server_endpoint",
+          "server_port",
+          "allowed_ips",
+          "persistent_keepalive"
+        ],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "build_wireguard_mesh",
+      "title": "Build WireGuard Mesh / Hub-Spoke VPN",
+      "risk": "dangerous",
+      "annotations": {
+        "destructiveHint": true,
+        "openWorldHint": false
+      },
+      "description": "Stands up a WireGuard VPN across several configured devices in ONE call: ensures a WireGuard interface on each, reads each device's public key, assigns every device a mesh address from `address_prefix`, then wires the peers between routers — `topology=full-mesh` connects every pair, `hub-spoke` connects the `hub` to each spoke — distributing public keys automatically. Endpoints default to each device's configured host (override per device via `endpoints`); add each site's LAN subnet via `allowed_lans` to route it through the tunnel. DEFAULTS TO A DRY RUN (`apply=false`) that shows the full plan; set `apply=true` to build it. Operates across MULTIPLE devices, so it is not affected by the single `device` selector. SSH devices only (needs to read public keys). Returns the plan, or a per-device build report.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "devices": {
+            "minItems": 2,
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Configured device names to include in the mesh (2+)"
+          },
+          "address_prefix": {
+            "default": "10.20.0.0/24",
+            "description": "Mesh subnet; each device gets <prefix>.<index+1> on its WireGuard interface",
+            "type": "string"
+          },
+          "interface": {
+            "default": "wg-mesh",
+            "description": "WireGuard interface name to create/use",
+            "type": "string"
+          },
+          "listen_port": {
+            "default": 13231,
+            "type": "integer",
+            "minimum": -9007199254740991,
+            "maximum": 9007199254740991
+          },
+          "topology": {
+            "default": "full-mesh",
+            "type": "string",
+            "enum": ["full-mesh", "hub-spoke"]
+          },
+          "hub": {
+            "description": "Hub device name (required when topology=hub-spoke)",
+            "type": "string"
+          },
+          "endpoints": {
+            "description": "Per-device public endpoint host override, e.g. {\"site-a\":\"a.example.com\"}",
+            "type": "object",
+            "propertyNames": {
+              "type": "string"
+            },
+            "additionalProperties": {
+              "type": "string"
+            }
+          },
+          "allowed_lans": {
+            "description": "Per-device LAN subnet to route through the tunnel, e.g. {\"site-a\":\"192.168.10.0/24\"}",
+            "type": "object",
+            "propertyNames": {
+              "type": "string"
+            },
+            "additionalProperties": {
+              "type": "string"
+            }
+          },
+          "persistent_keepalive": {
+            "default": "25s",
+            "type": "string"
+          },
+          "apply": {
+            "default": false,
+            "description": "false = preview the plan (default); true = build",
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "devices",
+          "address_prefix",
+          "interface",
+          "listen_port",
+          "topology",
+          "persistent_keepalive",
+          "apply"
+        ],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "onboard_wireguard_user",
+      "title": "Onboard WireGuard Remote User",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Generates a ready-to-use WireGuard remote-access profile for one user: creates a client keypair, adds the peer to the server `interface` (allowed-address = the client's tunnel IP), reads the server's public key, and returns a complete client .conf to paste into the WireGuard app or a QR generator. The peer is tagged `vpn-user: <user>` so revoke_wireguard_user can remove it. NOTE: the returned config contains the client PRIVATE key (required to connect) — handle it securely. `endpoint` is the server's public host:port; `allowed_ips` controls split vs full tunnel. SSH devices only. Returns the client config.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "interface": {
+            "type": "string",
+            "description": "Existing WireGuard SERVER interface, e.g. 'wg-server'"
+          },
+          "user": {
+            "type": "string",
+            "description": "User/device label, e.g. 'alice-laptop'"
+          },
+          "address": {
+            "type": "string",
+            "description": "Tunnel IP to assign the client, e.g. '10.20.0.50'"
+          },
+          "endpoint": {
+            "type": "string",
+            "description": "Server public endpoint host:port, e.g. 'vpn.example.com:13231'"
+          },
+          "dns": {
+            "description": "DNS for the client, e.g. '10.20.0.1'",
+            "type": "string"
+          },
+          "allowed_ips": {
+            "default": "0.0.0.0/0",
+            "description": "Client AllowedIPs: '0.0.0.0/0' full-tunnel, or a LAN subnet for split-tunnel",
+            "type": "string"
+          },
+          "keepalive": {
+            "default": "25",
+            "description": "PersistentKeepalive seconds",
+            "type": "string"
+          }
+        },
+        "required": ["interface", "user", "address", "endpoint", "allowed_ips", "keepalive"],
         "additionalProperties": false
       }
     },
     {
-      "name": "generate_wireguard_client_config",
-      "title": "Generate WireGuard Client Config File",
-      "risk": "read",
+      "name": "revoke_wireguard_user",
+      "title": "Revoke WireGuard Remote User",
+      "risk": "destructive",
       "annotations": {
-        "readOnlyHint": true,
+        "destructiveHint": true,
         "idempotentHint": true,
         "openWorldHint": false
       },
-      "description": "Generates a standard wg0.conf client configuration file (`[Interface] + [Peer]` sections) entirely from the provided keys and server endpoint — runs locally, never contacts the router. Use this after registering a client's public key with add_wireguard_peer to produce the config text to distribute to that client. Returns the config text ready to save as /etc/wireguard/wg0.conf (Linux) or import into the WireGuard app, with instructions for generating client keys and bringing the tunnel up.\n\nNotes:\n  allowed_ips: CIDRs routed through the tunnel by the client, default \"0.0.0.0/0\" (all IPv4 traffic; add ::/0 to also route IPv6)\n  persistent_keepalive: seconds integer, default 25",
+      "description": "Revokes a remote-access user created by onboard_wireguard_user: removes the WireGuard peer tagged `vpn-user: <user>` from the server, immediately cutting their access. Returns whether a peer was removed.",
       "inputSchema": {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "type": "object",
         "properties": {
-          "client_private_key": {
-            "type": "string"
-          },
-          "client_address": {
-            "type": "string"
-          },
-          "server_public_key": {
-            "type": "string"
-          },
-          "server_endpoint": {
-            "type": "string"
-          },
-          "server_port": {
-            "default": 51820,
-            "type": "integer",
-            "minimum": -9007199254740991,
-            "maximum": 9007199254740991
-          },
-          "allowed_ips": {
-            "default": "0.0.0.0/0",
-            "type": "string"
-          },
-          "dns": {
-            "type": "string"
-          },
-          "persistent_keepalive": {
-            "default": 25,
-            "type": "integer",
-            "minimum": -9007199254740991,
-            "maximum": 9007199254740991
+          "user": {
+            "type": "string",
+            "description": "The user label used at onboarding"
           }
         },
-        "required": [
-          "client_private_key",
-          "client_address",
-          "server_public_key",
-          "server_endpoint",
-          "server_port",
-          "allowed_ips",
-          "persistent_keepalive"
-        ],
+        "required": ["user"],
         "additionalProperties": false
       }
     },
@@ -15353,6 +16430,63 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "apply_traffic_shaping",
+      "title": "Apply Traffic-Shaping Policy",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Builds a traffic-shaping policy as a batch of `/queue simple` classes (target address, max-limit, priority) in one call — e.g. prioritize a VoIP subnet and cap a guest network. DEFAULTS TO A DRY RUN: with `apply=false` (default) it returns the exact RouterOS commands it WOULD run so the shape can be reviewed first; set `apply=true` to create the queues and verify them. Classes are created in array order, and RouterOS evaluates simple queues top-down, so list the most specific/important first. For classification by port/protocol (not address) use the firewall mangle tools to mark packets, then a queue tree. Returns the dry-run plan or the created queues.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "classes": {
+            "minItems": 1,
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "description": "Queue name, e.g. 'voip' or 'guest-cap'"
+                },
+                "target": {
+                  "type": "string",
+                  "description": "Target address/subnet this class applies to, e.g. '192.168.20.0/24'"
+                },
+                "max_limit": {
+                  "type": "string",
+                  "description": "RouterOS max-limit as 'upload/download', e.g. '10M/10M' (or a single value)"
+                },
+                "priority": {
+                  "default": 8,
+                  "description": "1 (highest) … 8 (lowest); lower number wins under contention",
+                  "type": "integer",
+                  "minimum": 1,
+                  "maximum": 8
+                },
+                "comment": {
+                  "type": "string"
+                }
+              },
+              "required": ["name", "target", "max_limit", "priority"],
+              "additionalProperties": false
+            },
+            "description": "Shaping classes to create, in priority order"
+          },
+          "apply": {
+            "default": false,
+            "description": "false = preview the commands only (default); true = create the queues",
+            "type": "boolean"
+          }
+        },
+        "required": ["classes", "apply"],
+        "additionalProperties": false
+      }
+    },
     {
       "name": "list_queue_interfaces",
       "title": "List Queue Interface Assignments",
@@ -16416,6 +17550,108 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "test_ssh_to_device",
+      "title": "Test SSH to a Configured Device (from the MCP host)",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Tests the SSH connection FROM THE MACHINE RUNNING THIS MCP SERVER to a CONFIGURED device, using that device's stored host/port/credentials. Use this to diagnose why a saved device is not responding — it confirms whether the MCP host can reach the device's SSH port AND authenticate, and reports the connect latency and identity. Targets the selected/default device (the `device` selector). NOTE: this opens a real SSH connection from the MCP host, not through the usual command channel, and is SSH-only (a MAC-Telnet device has no SSH). To test an UNSAVED host with ad-hoc credentials use test_ssh_to_host; to test SSH OUTBOUND from a router use test_ssh_from_device. Returns OK/failed with the reason.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {},
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "test_ssh_to_host",
+      "title": "Test SSH to Any Host (from the MCP host)",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Tests an SSH connection FROM THE MACHINE RUNNING THIS MCP SERVER to an ARBITRARY host:port with the supplied credentials — a pre-flight check BEFORE adding a device to the config, or to verify reachability/credentials for any SSH host. Confirms TCP reachability AND authentication and reports the connect latency. Provide a `password` and/or a private-key path (`key_path`). NOTE: this opens a real SSH connection from the MCP host. For a device that is ALREADY configured use test_ssh_to_device; to test SSH outbound FROM a router use test_ssh_from_device. Returns OK/failed with the reason.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "host": {
+            "type": "string",
+            "description": "Target IP or hostname"
+          },
+          "port": {
+            "default": 22,
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 65535
+          },
+          "username": {
+            "type": "string"
+          },
+          "password": {
+            "description": "Password auth (omit if using a key)",
+            "type": "string"
+          },
+          "key_path": {
+            "description": "Path (on the MCP host) to a private key file",
+            "type": "string"
+          },
+          "key_passphrase": {
+            "type": "string"
+          },
+          "command": {
+            "default": "/system identity print",
+            "description": "Command to run once connected (a harmless RouterOS read by default)",
+            "type": "string"
+          }
+        },
+        "required": ["host", "port", "username", "command"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "test_ssh_from_device",
+      "title": "Test SSH Outbound From a RouterOS Device",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Tests SSH OUTBOUND FROM a RouterOS device to a remote host using the device's OWN SSH client (`/system ssh-exec`) — i.e. the connection is made BY the router, not by the MCP host. Use this to check whether a router can reach and log into another host over SSH (e.g. a jump path or another router). The router's user must be able to authenticate to the target NON-interactively (a stored key on the router) — a password-only target will prompt and time out. Runs the test `command` on the remote and returns its output. To test the MCP HOST's connection to a device instead, use test_ssh_to_device (configured) or test_ssh_to_host (ad-hoc). Returns the remote command output or the device's error.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "host": {
+            "type": "string",
+            "description": "Remote host the ROUTER should SSH to"
+          },
+          "port": {
+            "default": 22,
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 65535
+          },
+          "user": {
+            "type": "string",
+            "description": "Username on the remote host"
+          },
+          "command": {
+            "default": "/system identity print",
+            "description": "Command to run on the remote host as the connectivity test",
+            "type": "string"
+          }
+        },
+        "required": ["host", "port", "user", "command"],
+        "additionalProperties": false
+      }
+    },
     {
       "name": "list_neighbors",
       "title": "List Discovered Neighbor Devices (MNDP/CDP/LLDP)",
@@ -17997,6 +19233,39 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "forecast_link_saturation",
+      "title": "Forecast Link Saturation",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Estimates when an interface will saturate. Samples its current throughput (`/interface monitor-traffic ... once`), computes utilization against `capacity_mbps` (the link's rated speed), and projects the trend forward at `monthly_growth_pct` to a saturation date. Note: this is a single live sample projected at an ASSUMED growth rate — feed a realistic growth figure (or watch the trend over time) for a better forecast. Returns current load, utilization, and the projected days/date to saturation.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "interface": {
+            "type": "string",
+            "description": "Interface to sample, e.g. 'ether1-wan'"
+          },
+          "capacity_mbps": {
+            "default": 1000,
+            "description": "Link rated speed in Mbit/s (e.g. 1000 for gig)",
+            "type": "number"
+          },
+          "monthly_growth_pct": {
+            "default": 10,
+            "description": "Assumed month-over-month traffic growth %",
+            "type": "number"
+          }
+        },
+        "required": ["interface", "capacity_mbps", "monthly_growth_pct"],
+        "additionalProperties": false
+      }
+    },
     {
       "name": "wake_on_lan",
       "title": "Send Wake-on-LAN Magic Packet",
@@ -18277,6 +19546,75 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "subscribe_threat_feed",
+      "title": "Subscribe to Threat-Intel Feed",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Subscribes the router to an external threat-intelligence IP feed: installs a `/system script` that fetches `url` and imports it into the `address_list`, a `/system scheduler` that re-runs it every `interval`, and (when `drop=true`) a raw pre-conntrack drop for that list — a self-updating blocklist (e.g. Spamhaus DROP, tor exit nodes, your own deny list). `url` MUST point to a RouterOS `.rsc` file that populates the address-list. DEFAULTS TO A DRY RUN (`apply=false`); set `apply=true` to install. Script/scheduler/rule are named/tagged `threat-feed-<name>` so remove_threat_feed can undo them. Returns the plan or a build report.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "Short feed id, e.g. 'spamhaus-drop'"
+          },
+          "url": {
+            "type": "string",
+            "description": "HTTPS URL of a RouterOS .rsc address-list file"
+          },
+          "address_list": {
+            "default": "threat-blocklist",
+            "description": "Address-list to populate",
+            "type": "string"
+          },
+          "interval": {
+            "default": "1h",
+            "description": "How often to refresh the feed",
+            "type": "string"
+          },
+          "drop": {
+            "default": true,
+            "description": "Also add a raw drop rule for the address-list",
+            "type": "boolean"
+          },
+          "apply": {
+            "default": false,
+            "description": "false = preview (default); true = install",
+            "type": "boolean"
+          }
+        },
+        "required": ["name", "url", "address_list", "interval", "drop", "apply"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "remove_threat_feed",
+      "title": "Remove Threat-Intel Feed",
+      "risk": "destructive",
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Removes a threat feed installed by subscribe_threat_feed: deletes its `/system scheduler` and `/system script` (named `threat-feed-<name>`) and any raw drop rule tagged for it. Does NOT flush the address-list entries themselves. Returns what was removed.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "The feed id used when subscribing"
+          }
+        },
+        "required": ["name"],
+        "additionalProperties": false
+      }
+    },
     {
       "name": "add_user",
       "title": "Add Local User Account",
@@ -20119,6 +21457,48 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "run_failover_drill",
+      "title": "Run Failover DR Drill",
+      "risk": "dangerous",
+      "annotations": {
+        "destructiveHint": true,
+        "openWorldHint": false
+      },
+      "description": "Rehearses a disaster safely: INSIDE SAFE MODE it disables a target (a WAN/tunnel interface, or a route), pings `verify_host` to check the backup path actually carries traffic, then ROLLS BACK — Safe Mode auto-reverts, so the change is never committed. Proves your failover works without a real outage. Requires `confirm=true` to run (it briefly disrupts traffic on the target); with confirm=false it just describes the drill. SSH-only (Safe Mode is unavailable on MAC-Telnet). Returns whether connectivity held during the simulated failure.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "target_type": {
+            "default": "interface",
+            "type": "string",
+            "enum": ["interface", "route"]
+          },
+          "target": {
+            "type": "string",
+            "description": "Interface name (e.g. 'ether1-wan') or, for route, a find expression / .id"
+          },
+          "verify_host": {
+            "type": "string",
+            "description": "Host to ping during the outage to confirm the backup path, e.g. '8.8.8.8'"
+          },
+          "ping_count": {
+            "default": 5,
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 50
+          },
+          "confirm": {
+            "default": false,
+            "description": "Must be true to actually run the drill",
+            "type": "boolean"
+          }
+        },
+        "required": ["target_type", "target", "verify_host", "ping_count", "confirm"],
+        "additionalProperties": false
+      }
+    },
     {
       "name": "plan_changes",
       "title": "Plan RouterOS Changes (Dry-Run Preview)",