@usex/mikrotik-mcp 3.50.1 → 3.51.1

package/schemas/tool-catalog.json

@@ -1,8 +1,8 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "version": "3.49.0",
+  "version": "3.50.1",
   "generated": "by scripts/gen-schemas.ts — do not edit by hand",
-  "toolCount": 768,
+  "toolCount": 793,
   "tools": [
     {
       "name": "find_tools",
@@ -14559,6 +14559,173 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "run_compliance_audit",
+      "title": "Run Network Compliance Audit",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Deep-scan a single device's security posture across SSH, management services, firewall, users, DNS, certificates, network services, SNMP, system hardening and VPN — 36 checks scored A+ through F with per-check pass/fail/warn and fix commands. Returns a scored compliance report. Optionally narrow by category or severity, and generate a combined RouterOS fix script. For fleet-wide audit across all devices use `audit_fleet`. For firewall-specific analysis use `firewall_audit`; for certificate lifecycle use `cert_expiry_audit`; for hardening use `security_shield`. This tool ties them all together into a unified compliance grade.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "categories": {
+            "description": "Narrow the audit to specific categories. Available: ssh_security, management_services, firewall_posture, user_security, dns_security, certificate_health, network_services, snmp_security, system_hardening, vpn_security. Omit to audit all.",
+            "type": "array",
+            "items": {
+              "type": "string",
+              "enum": [
+                "ssh_security",
+                "management_services",
+                "firewall_posture",
+                "user_security",
+                "dns_security",
+                "certificate_health",
+                "network_services",
+                "snmp_security",
+                "system_hardening",
+                "vpn_security"
+              ],
+              "description": "Category slug to filter by."
+            }
+          },
+          "severity_threshold": {
+            "description": "Only report checks at or above this severity (default: all).",
+            "type": "string",
+            "enum": ["critical", "high", "medium", "low"]
+          },
+          "generate_fix_script": {
+            "default": false,
+            "description": "Append a combined RouterOS fix script for all failing checks.",
+            "type": "boolean"
+          }
+        },
+        "required": ["generate_fix_script"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "audit_fleet",
+      "title": "Fleet-wide Compliance Audit",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Run the compliance audit across ALL configured devices (or a specified subset) and return a consolidated fleet report with per-device grades, an aggregate fleet score, and a summary of the most common failures across the fleet. For single-device audit use `run_compliance_audit`.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "devices": {
+            "description": "Subset of device names to audit. Omit to audit all configured devices.",
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "severity_threshold": {
+            "description": "Only report checks at or above this severity (default: all).",
+            "type": "string",
+            "enum": ["critical", "high", "medium", "low"]
+          },
+          "generate_fix_script": {
+            "default": false,
+            "description": "Append per-device fix scripts.",
+            "type": "boolean"
+          }
+        },
+        "required": ["generate_fix_script"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "audit_remediate",
+      "title": "Apply Compliance Fixes",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Run the compliance audit on a device and automatically apply fix commands for all failing/warning checks that have a known fix. Returns the audit report followed by the result of each applied fix command. Use `run_compliance_audit` with `generate_fix_script=true` first to preview fixes, then call this tool to apply them. Only applies fixes for checks that actually fail; checks that already pass are untouched.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "categories": {
+            "description": "Narrow remediation to specific categories.",
+            "type": "array",
+            "items": {
+              "type": "string",
+              "enum": [
+                "ssh_security",
+                "management_services",
+                "firewall_posture",
+                "user_security",
+                "dns_security",
+                "certificate_health",
+                "network_services",
+                "snmp_security",
+                "system_hardening",
+                "vpn_security"
+              ],
+              "description": "Category slug to filter by."
+            }
+          },
+          "severity_threshold": {
+            "description": "Only remediate checks at or above this severity.",
+            "type": "string",
+            "enum": ["critical", "high", "medium", "low"]
+          },
+          "dry_run": {
+            "default": true,
+            "description": "Preview fix commands without applying (default: true). Set false to apply.",
+            "type": "boolean"
+          }
+        },
+        "required": ["dry_run"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "list_compliance_checks",
+      "title": "List Compliance Checks",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Reference listing of all compliance checks — ID, category, severity and title. No device connection needed. Use to understand available checks before running `run_compliance_audit` with category or severity filters.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "category": {
+            "description": "Filter to a single category.",
+            "type": "string",
+            "enum": [
+              "ssh_security",
+              "management_services",
+              "firewall_posture",
+              "user_security",
+              "dns_security",
+              "certificate_health",
+              "network_services",
+              "snmp_security",
+              "system_hardening",
+              "vpn_security"
+            ]
+          }
+        },
+        "additionalProperties": false
+      }
+    },
     {
       "name": "list_ip_services",
       "title": "List IP Management Services",
@@ -22212,6 +22379,132 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "firmware_check",
+      "title": "Check Firmware Updates",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Discover available RouterOS updates for a single device or the entire fleet. Queries the configured update channel, compares installed vs. latest version, flags outdated firmware, and assesses upgrade readiness (CPU, memory, version jump). Optionally set the update channel before checking. Use `firmware_status` for detailed package/routerboard info; use `firmware_stage` to download packages after confirming an update is available.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "channel": {
+            "description": "Set the update channel before checking (default: keep current).",
+            "type": "string",
+            "enum": ["stable", "long-term", "testing"]
+          },
+          "fleet": {
+            "default": false,
+            "description": "Check all configured devices instead of just one.",
+            "type": "boolean"
+          },
+          "devices": {
+            "description": "Specific device names to check (fleet mode). Omit to check all.",
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        },
+        "required": ["fleet"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "firmware_stage",
+      "title": "Stage Firmware Packages",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Download and pre-stage RouterOS update packages on the device WITHOUT installing or rebooting (`/system package update download`). Use after `firmware_check` confirms an update is available. Once staged, use `firmware_upgrade` to install during a maintenance window. The download runs in the background on the device; re-run `firmware_status` to verify the download completed.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "channel": {
+            "description": "Set the update channel before downloading (default: keep current).",
+            "type": "string",
+            "enum": ["stable", "long-term", "testing"]
+          }
+        },
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "firmware_upgrade",
+      "title": "Upgrade Firmware",
+      "risk": "dangerous",
+      "annotations": {
+        "destructiveHint": true,
+        "openWorldHint": false
+      },
+      "description": "Execute the RouterOS upgrade pipeline on a device. Takes a pre-upgrade health snapshot, installs staged packages (device reboots automatically), and optionally schedules the upgrade for a future maintenance window. RouterOS has a built-in fallback mechanism: if the device fails to boot after an upgrade, it automatically reverts to the previous firmware. Use `firmware_check` first to verify an update is available, and `firmware_stage` to pre-download packages. After the device reboots, use `firmware_status` to verify the upgrade and run the post-upgrade health comparison. Requires `confirm=true` — the device WILL REBOOT and be offline for 1-3 minutes.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "confirm": {
+            "type": "boolean",
+            "description": "Must be true to execute the upgrade. Device will reboot."
+          },
+          "schedule_time": {
+            "description": "Schedule the upgrade for a future time instead of immediate execution. Format: HH:MM:SS (e.g. '03:00:00' for 3 AM). The device will reboot at this time.",
+            "type": "string"
+          },
+          "schedule_date": {
+            "description": "Date for scheduled upgrade. Format: 'jan/01/2026'. Omit to use today (or the next occurrence of schedule_time).",
+            "type": "string"
+          },
+          "upgrade_routerboard": {
+            "default": false,
+            "description": "Also upgrade RouterBOARD firmware after RouterOS upgrade (`/system routerboard upgrade`). Requires a second reboot.",
+            "type": "boolean"
+          },
+          "capture_health": {
+            "default": true,
+            "description": "Capture a pre-upgrade health snapshot for later comparison.",
+            "type": "boolean"
+          }
+        },
+        "required": ["confirm", "upgrade_routerboard", "capture_health"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "firmware_status",
+      "title": "Firmware Status & Health Check",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Show detailed firmware status for a device: RouterOS version, architecture, installed packages, RouterBOARD firmware, update channel status, and upgrade readiness assessment. Set `post_check=true` after an upgrade to capture a post-upgrade health snapshot and compare it against the pre-upgrade baseline — verifying routes, interfaces, sessions, and system resources came back healthy. For fleet-wide status use `firmware_check` with `fleet=true`.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "post_check": {
+            "default": false,
+            "description": "Capture a health snapshot and compare against the pre-upgrade baseline. Use after an upgrade to verify the device came back healthy.",
+            "type": "boolean"
+          },
+          "pre_snapshot_version": {
+            "description": "The version that was running before the upgrade (for comparison context). If not provided, the post-check captures the snapshot without comparison.",
+            "type": "string"
+          }
+        },
+        "required": ["post_check"],
+        "additionalProperties": false
+      }
+    },
     {
       "name": "ping",
       "title": "Ping Host via Router",
@@ -22492,92 +22785,256 @@
       }
     },
     {
-      "name": "test_ssh_to_device",
-      "title": "Test SSH to a Configured Device (from the MCP host)",
+      "name": "diagnose",
+      "title": "Intelligent Root-Cause Diagnosis",
       "risk": "read",
       "annotations": {
         "readOnlyHint": true,
         "idempotentHint": true,
         "openWorldHint": false
       },
-      "description": "Tests the SSH connection FROM THE MACHINE RUNNING THIS MCP SERVER to a CONFIGURED device, using that device's stored host/port/credentials. Use this to diagnose why a saved device is not responding — it confirms whether the MCP host can reach the device's SSH port AND authenticate, and reports the connect latency and identity. Targets the selected/default device (the `device` selector). NOTE: this opens a real SSH connection from the MCP host, not through the usual command channel, and is SSH-only (a MAC-Telnet device has no SSH). To test an UNSAVED host with ad-hoc credentials use test_ssh_to_host; to test SSH OUTBOUND from a router use test_ssh_from_device. Returns OK/failed with the reason.",
+      "description": "Autonomously investigate a network problem across all diagnostic dimensions: connectivity (ping), interface state & error counters, routing table & BGP/OSPF neighbors, firewall rules & hit counters, NAT & connection tracking, ARP/DHCP state, DNS resolution, CPU/memory pressure, system logs, and VPN tunnel state. Correlates the evidence to deliver ranked root-cause hypotheses with confidence levels, plain-language explanations, and exact RouterOS fix commands. Pass an IP address, hostname, or symptom description as the target. For hop-by-hop path analysis use `trace_path`; for log-specific investigation use `correlate_events`; for fix commands only use `suggest_fix`.",
       "inputSchema": {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "type": "object",
-        "properties": {},
+        "properties": {
+          "target": {
+            "type": "string",
+            "description": "The target to investigate — an IP address (e.g. '8.8.8.8'), hostname (e.g. 'google.com'), or network/subnet (e.g. '10.0.0.0/24')."
+          },
+          "dimensions": {
+            "description": "Limit investigation to specific dimensions. Omit to check all: connectivity, interfaces, routing, firewall, nat, arp_dhcp, dns, resources, logs, vpn",
+            "type": "array",
+            "items": {
+              "type": "string",
+              "enum": [
+                "connectivity",
+                "interfaces",
+                "routing",
+                "firewall",
+                "nat",
+                "arp_dhcp",
+                "dns",
+                "resources",
+                "logs",
+                "vpn"
+              ],
+              "description": "Diagnostic dimension to investigate."
+            }
+          },
+          "symptom": {
+            "description": "Free-text symptom description (e.g. 'client cannot reach internet', 'VPN tunnel keeps dropping', 'slow throughput').",
+            "type": "string"
+          }
+        },
+        "required": ["target"],
         "additionalProperties": false
       }
     },
     {
-      "name": "test_ssh_to_host",
-      "title": "Test SSH to Any Host (from the MCP host)",
+      "name": "trace_path",
+      "title": "Trace Network Path",
       "risk": "read",
       "annotations": {
         "readOnlyHint": true,
         "idempotentHint": true,
         "openWorldHint": false
       },
-      "description": "Tests an SSH connection FROM THE MACHINE RUNNING THIS MCP SERVER to an ARBITRARY host:port with the supplied credentials — a pre-flight check BEFORE adding a device to the config, or to verify reachability/credentials for any SSH host. Confirms TCP reachability AND authentication and reports the connect latency. Provide a `password` and/or a private-key path (`key_path`). NOTE: this opens a real SSH connection from the MCP host. For a device that is ALREADY configured use test_ssh_to_device; to test SSH outbound FROM a router use test_ssh_from_device. Returns OK/failed with the reason.",
+      "description": "Trace the full network path from this device to a destination with hop-by-hop analysis. Runs a traceroute, then for each hop that is a locally-connected device, checks interface state and routing. Also runs a parallel ping to measure end-to-end reachability and latency. Use for path-specific troubleshooting — where packets are being dropped or rerouted. For full multi-dimensional root-cause analysis use `diagnose`.",
       "inputSchema": {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "type": "object",
         "properties": {
-          "host": {
+          "target": {
             "type": "string",
-            "description": "Target IP or hostname"
+            "description": "Destination IP or hostname to trace to."
           },
-          "port": {
-            "default": 22,
+          "count": {
+            "default": 3,
+            "description": "Probes per hop (default: 3).",
             "type": "integer",
             "minimum": 1,
-            "maximum": 65535
-          },
-          "username": {
-            "type": "string"
-          },
-          "password": {
-            "description": "Password auth (omit if using a key)",
-            "type": "string"
-          },
-          "key_path": {
-            "description": "Path (on the MCP host) to a private key file",
-            "type": "string"
-          },
-          "key_passphrase": {
-            "type": "string"
+            "maximum": 10
           },
-          "command": {
-            "default": "/system identity print",
-            "description": "Command to run once connected (a harmless RouterOS read by default)",
-            "type": "string"
+          "use_dns": {
+            "default": true,
+            "description": "Resolve hop addresses to hostnames.",
+            "type": "boolean"
           }
         },
-        "required": ["host", "port", "username", "command"],
+        "required": ["target", "count", "use_dns"],
         "additionalProperties": false
       }
     },
     {
-      "name": "test_ssh_from_device",
-      "title": "Test SSH Outbound From a RouterOS Device",
-      "risk": "write",
+      "name": "correlate_events",
+      "title": "Correlate System Events",
+      "risk": "read",
       "annotations": {
-        "destructiveHint": false,
+        "readOnlyHint": true,
+        "idempotentHint": true,
         "openWorldHint": false
       },
-      "description": "Tests SSH OUTBOUND FROM a RouterOS device to a remote host using the device's OWN SSH client (`/system ssh-exec`) — i.e. the connection is made BY the router, not by the MCP host. Use this to check whether a router can reach and log into another host over SSH (e.g. a jump path or another router). The router's user must be able to authenticate to the target NON-interactively (a stored key on the router) — a password-only target will prompt and time out. Runs the test `command` on the remote and returns its output. To test the MCP HOST's connection to a device instead, use test_ssh_to_device (configured) or test_ssh_to_host (ad-hoc). Returns the remote command output or the device's error.",
+      "description": "Search and correlate system log events across topics (firewall, DHCP, routing, system, interface) to find patterns around a given time window or keyword. Groups related events chronologically and highlights sequences that indicate cascading failures (e.g. interface down → OSPF neighbor lost → route withdrawn). For full root-cause analysis use `diagnose`; for path tracing use `trace_path`.",
       "inputSchema": {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "type": "object",
         "properties": {
-          "host": {
-            "type": "string",
-            "description": "Remote host the ROUTER should SSH to"
-          },
-          "port": {
-            "default": 22,
-            "type": "integer",
-            "minimum": 1,
-            "maximum": 65535
+          "keyword": {
+            "description": "Filter logs by keyword (IP address, interface name, error message). Omit to show all error/warning/critical events.",
+            "type": "string"
+          },
+          "topics": {
+            "description": "Comma-separated log topics to search (e.g. 'firewall,dhcp,system'). Default: error, warning, critical, firewall, system, interface.",
+            "type": "string"
+          },
+          "time_window": {
+            "default": "30m",
+            "description": "How far back to search: '10m', '1h', '6h', '1d' (default: 30m).",
+            "type": "string"
+          },
+          "limit": {
+            "default": 100,
+            "description": "Maximum log entries to return (default: 100).",
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 500
+          }
+        },
+        "required": ["time_window", "limit"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "suggest_fix",
+      "title": "Suggest Fix Commands",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Run a quick diagnosis and return ONLY the actionable fix commands — no verbose report. Useful when you already know the symptom and just need the remediation steps. Each fix command comes with a one-line explanation of what it addresses. For the full diagnostic report use `diagnose`.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "target": {
+            "type": "string",
+            "description": "Target to investigate (IP, hostname, or subnet)."
+          },
+          "dimensions": {
+            "description": "Limit investigation to specific dimensions.",
+            "type": "array",
+            "items": {
+              "type": "string",
+              "enum": [
+                "connectivity",
+                "interfaces",
+                "routing",
+                "firewall",
+                "nat",
+                "arp_dhcp",
+                "dns",
+                "resources",
+                "logs",
+                "vpn"
+              ],
+              "description": "Diagnostic dimension to investigate."
+            }
+          }
+        },
+        "required": ["target"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "test_ssh_to_device",
+      "title": "Test SSH to a Configured Device (from the MCP host)",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Tests the SSH connection FROM THE MACHINE RUNNING THIS MCP SERVER to a CONFIGURED device, using that device's stored host/port/credentials. Use this to diagnose why a saved device is not responding — it confirms whether the MCP host can reach the device's SSH port AND authenticate, and reports the connect latency and identity. Targets the selected/default device (the `device` selector). NOTE: this opens a real SSH connection from the MCP host, not through the usual command channel, and is SSH-only (a MAC-Telnet device has no SSH). To test an UNSAVED host with ad-hoc credentials use test_ssh_to_host; to test SSH OUTBOUND from a router use test_ssh_from_device. Returns OK/failed with the reason.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {},
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "test_ssh_to_host",
+      "title": "Test SSH to Any Host (from the MCP host)",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Tests an SSH connection FROM THE MACHINE RUNNING THIS MCP SERVER to an ARBITRARY host:port with the supplied credentials — a pre-flight check BEFORE adding a device to the config, or to verify reachability/credentials for any SSH host. Confirms TCP reachability AND authentication and reports the connect latency. Provide a `password` and/or a private-key path (`key_path`). NOTE: this opens a real SSH connection from the MCP host. For a device that is ALREADY configured use test_ssh_to_device; to test SSH outbound FROM a router use test_ssh_from_device. Returns OK/failed with the reason.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "host": {
+            "type": "string",
+            "description": "Target IP or hostname"
+          },
+          "port": {
+            "default": 22,
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 65535
+          },
+          "username": {
+            "type": "string"
+          },
+          "password": {
+            "description": "Password auth (omit if using a key)",
+            "type": "string"
+          },
+          "key_path": {
+            "description": "Path (on the MCP host) to a private key file",
+            "type": "string"
+          },
+          "key_passphrase": {
+            "type": "string"
+          },
+          "command": {
+            "default": "/system identity print",
+            "description": "Command to run once connected (a harmless RouterOS read by default)",
+            "type": "string"
+          }
+        },
+        "required": ["host", "port", "username", "command"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "test_ssh_from_device",
+      "title": "Test SSH Outbound From a RouterOS Device",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Tests SSH OUTBOUND FROM a RouterOS device to a remote host using the device's OWN SSH client (`/system ssh-exec`) — i.e. the connection is made BY the router, not by the MCP host. Use this to check whether a router can reach and log into another host over SSH (e.g. a jump path or another router). The router's user must be able to authenticate to the target NON-interactively (a stored key on the router) — a password-only target will prompt and time out. Runs the test `command` on the remote and returns its output. To test the MCP HOST's connection to a device instead, use test_ssh_to_device (configured) or test_ssh_to_host (ad-hoc). Returns the remote command output or the device's error.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "host": {
+            "type": "string",
+            "description": "Remote host the ROUTER should SSH to"
+          },
+          "port": {
+            "default": 22,
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 65535
           },
           "user": {
             "type": "string",
@@ -26079,6 +26536,129 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "config_set_baseline",
+      "title": "Set Golden Config Baseline",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Capture the current device `/export` and designate it as the golden-config baseline — the known-good reference point for drift detection. A device can have exactly one baseline; setting a new one replaces the previous. The export is also stored as a regular config snapshot in `~/.mikrotik-mcp/snapshots.db`. Use `config_check_drift` to compare the live config against this baseline; use `config_promote_drift` to accept the current (drifted) config as the new baseline. Optionally limit to one RouterOS section via `section` (e.g. 'ip firewall filter').",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "label": {
+            "description": "Human label for this baseline, e.g. 'production-v2'.",
+            "type": "string"
+          },
+          "notes": {
+            "description": "Free-text notes about why this baseline was set.",
+            "type": "string"
+          },
+          "section": {
+            "description": "RouterOS path without leading slash. Omit for full config.",
+            "type": "string"
+          },
+          "terse": {
+            "default": true,
+            "description": "Use `/export terse` for cleaner diffs. Default true.",
+            "type": "boolean"
+          },
+          "show_sensitive": {
+            "default": false,
+            "type": "boolean"
+          }
+        },
+        "required": ["terse", "show_sensitive"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "config_check_drift",
+      "title": "Check Config Drift Against Baseline",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Compare the live device configuration against its golden baseline and return a drift report with: severity score (0–100), per-section breakdown of what changed, change attribution from system logs (who changed what and when), and a unified diff. Requires a baseline to be set first via `config_set_baseline`. Set `include_logs=false` to skip log-based change attribution (faster). Use `config_reconcile` to push the baseline back onto the device, or `config_promote_drift` to accept the drift.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "include_logs": {
+            "default": true,
+            "description": "Fetch system logs for change attribution. Default true.",
+            "type": "boolean"
+          },
+          "log_duration": {
+            "default": "7d",
+            "description": "How far back to search logs. RouterOS duration (e.g. '7d', '24h').",
+            "type": "string"
+          },
+          "max_output_lines": {
+            "default": 800,
+            "description": "Truncate the unified diff beyond this many lines.",
+            "type": "integer",
+            "minimum": 50,
+            "maximum": 5000
+          }
+        },
+        "required": ["include_logs", "log_duration", "max_output_lines"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "config_reconcile",
+      "title": "Reconcile Device to Golden Baseline",
+      "risk": "dangerous",
+      "annotations": {
+        "destructiveHint": true,
+        "openWorldHint": false
+      },
+      "description": "Push the golden baseline configuration back onto the device, reverting all drift. Replays the baseline's `/export` commands through RouterOS Safe Mode — if any command fails or the device becomes unreachable, all changes are automatically rolled back. With `confirm=false` (default) this is a DRY RUN: commands are applied and then rolled back, showing what would change. Set `confirm=true` to actually commit. Requires SSH (not MAC-Telnet). After a successful commit, a verification snapshot is captured to confirm the state.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "confirm": {
+            "default": false,
+            "description": "false = dry-run (apply + rollback); true = commit for real.",
+            "type": "boolean"
+          }
+        },
+        "required": ["confirm"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "config_promote_drift",
+      "title": "Promote Current Config as New Baseline",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Accept the device's current (drifted) configuration as the new golden baseline. Captures a fresh `/export` snapshot and replaces the existing baseline pointer. Use this after reviewing drift with `config_check_drift` and deciding the changes are intentional. The old baseline snapshot is preserved in snapshot history.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "label": {
+            "description": "Label for the new baseline.",
+            "type": "string"
+          },
+          "notes": {
+            "description": "Why the drift is being accepted.",
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      }
+    },
     {
       "name": "s3_backup_status",
       "title": "Check S3 Backup Configuration Status",
@@ -27367,6 +27947,319 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "memory_create_entities",
+      "title": "Create Knowledge Graph Entities",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Create one or more new entities in the persistent knowledge graph. Each entity has a unique name, a type (e.g. 'router', 'subnet', 'vlan', 'person', 'config_pattern'), and optional initial observations. Entities that already exist are silently skipped. Use this to record things the AI learns about the network, devices, users, or patterns.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "entities": {
+            "minItems": 1,
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "description": "Unique name of the entity"
+                },
+                "entityType": {
+                  "type": "string",
+                  "description": "Type/category of the entity (e.g. 'router', 'subnet', 'person')"
+                },
+                "observations": {
+                  "description": "Initial observations (facts) to attach",
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  }
+                }
+              },
+              "required": ["name", "entityType"],
+              "additionalProperties": false
+            },
+            "description": "Entities to create"
+          }
+        },
+        "required": ["entities"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "memory_create_relations",
+      "title": "Create Knowledge Graph Relations",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Create directed relations between existing entities in the knowledge graph. Both endpoint entities must already exist. Use active voice for relation types (e.g. 'manages', 'connects_to', 'provides_dhcp_for', 'part_of'). Duplicate relations are silently skipped.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "relations": {
+            "minItems": 1,
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "from": {
+                  "type": "string",
+                  "description": "Source entity name"
+                },
+                "to": {
+                  "type": "string",
+                  "description": "Target entity name"
+                },
+                "relationType": {
+                  "type": "string",
+                  "description": "Relation type in active voice (e.g. 'manages', 'connects_to', 'depends_on')"
+                }
+              },
+              "required": ["from", "to", "relationType"],
+              "additionalProperties": false
+            },
+            "description": "Relations to create"
+          }
+        },
+        "required": ["relations"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "memory_add_observations",
+      "title": "Add Observations to Entities",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Add new observations (discrete facts) to existing entities in the knowledge graph. Each observation is a string (e.g. 'runs RouterOS 7.16', 'has 4 ether ports', 'managed by John'). Duplicate observations on the same entity are silently skipped. The entity must already exist.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "observations": {
+            "minItems": 1,
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "entityName": {
+                  "type": "string",
+                  "description": "Name of the existing entity"
+                },
+                "contents": {
+                  "minItems": 1,
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "description": "Observations to add"
+                }
+              },
+              "required": ["entityName", "contents"],
+              "additionalProperties": false
+            }
+          }
+        },
+        "required": ["observations"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "memory_delete_entities",
+      "title": "Delete Knowledge Graph Entities",
+      "risk": "destructive",
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Remove entities from the knowledge graph. This also deletes all their observations and any relations where they appear as an endpoint (cascade delete).",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "entityNames": {
+            "minItems": 1,
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Names of entities to delete"
+          }
+        },
+        "required": ["entityNames"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "memory_delete_observations",
+      "title": "Delete Observations from Entities",
+      "risk": "destructive",
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Remove specific observations from entities in the knowledge graph. The entity itself is kept; only the named observation strings are removed.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "deletions": {
+            "minItems": 1,
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "entityName": {
+                  "type": "string",
+                  "description": "Entity to remove observations from"
+                },
+                "observations": {
+                  "minItems": 1,
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "description": "Exact observation strings to delete"
+                }
+              },
+              "required": ["entityName", "observations"],
+              "additionalProperties": false
+            }
+          }
+        },
+        "required": ["deletions"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "memory_delete_relations",
+      "title": "Delete Knowledge Graph Relations",
+      "risk": "destructive",
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Remove specific relations from the knowledge graph. Each relation is identified by its (from, to, relationType) triple.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "relations": {
+            "minItems": 1,
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "from": {
+                  "type": "string",
+                  "description": "Source entity name"
+                },
+                "to": {
+                  "type": "string",
+                  "description": "Target entity name"
+                },
+                "relationType": {
+                  "type": "string",
+                  "description": "Relation type in active voice (e.g. 'manages', 'connects_to', 'depends_on')"
+                }
+              },
+              "required": ["from", "to", "relationType"],
+              "additionalProperties": false
+            },
+            "description": "Relations to delete"
+          }
+        },
+        "required": ["relations"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "memory_read_graph",
+      "title": "Read Entire Knowledge Graph",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Read the entire knowledge graph — all entities with their observations, plus all relations. Use this to get a complete picture of accumulated knowledge. For large graphs, prefer memory_search_nodes or memory_open_nodes.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {},
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "memory_search_nodes",
+      "title": "Search Knowledge Graph",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Search for entities in the knowledge graph by name, type, or observation content. Returns matching entities with their observations, plus any relations where at least one endpoint is in the result set.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "query": {
+            "type": "string",
+            "description": "Search term — matched against entity names, types, and observation content"
+          },
+          "limit": {
+            "description": "Max entities to return (default 50)",
+            "type": "integer",
+            "exclusiveMinimum": 0,
+            "maximum": 9007199254740991
+          }
+        },
+        "required": ["query"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "memory_open_nodes",
+      "title": "Open Knowledge Graph Nodes",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Retrieve specific entities by exact name from the knowledge graph, with all their observations and any relations where at least one endpoint is in the requested set.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "names": {
+            "minItems": 1,
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Exact entity names to retrieve"
+          }
+        },
+        "required": ["names"],
+        "additionalProperties": false
+      }
+    },
     {
       "name": "show_system_dashboard",
       "title": "Show System Dashboard",