@usex/mikrotik-mcp 3.51.1 → 3.53.0

package/dist/shared/{library-mwcpnqqg.js → library-n3yvjpkm.js}

@@ -5738,7 +5738,7 @@ function renderComplianceReport(report, device, options) {
 `).trimEnd();
 }
 
-// src/tools/compliance-audit.ts
+// src/utils/safe-exec.ts
 async function safe(cmd, ctx) {
   try {
     const out = await executeMikrotikCommand(cmd, ctx);
@@ -5747,6 +5747,8 @@ async function safe(cmd, ctx) {
     return "";
   }
 }
+
+// src/tools/compliance-audit.ts
 async function fetchComplianceState(ctx) {
   const [
     sshRaw,
@@ -7104,6 +7106,31 @@ ${created.join(`
 // src/tools/container.ts
 import { z as z17 } from "zod";
 
+// src/utils/ip.ts
+function isIpAddress(s) {
+  return /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(s);
+}
+function isIpLike(s) {
+  return /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\/\d+)?$/.test(s);
+}
+function isPrivateIp(ip) {
+  const p = ip.split(".").map(Number);
+  if (p.length !== 4)
+    return false;
+  if (p[0] === 10)
+    return true;
+  if (p[0] === 172 && p[1] >= 16 && p[1] <= 31)
+    return true;
+  if (p[0] === 192 && p[1] === 168)
+    return true;
+  if (p[0] === 169 && p[1] === 254)
+    return true;
+  return false;
+}
+// src/utils/num.ts
+function num(s) {
+  return Number.parseInt(s ?? "0", 10) || 0;
+}
 // src/utils/or-match.ts
 function orMatch(field, values, op = "~") {
   if (values.length === 0)
@@ -7875,7 +7902,7 @@ var cache = null;
 async function gateway() {
   if (cache)
     return cache;
-  const { moduleCatalog } = await import("./library-510csx1a.js");
+  const { moduleCatalog } = await import("./library-4npjv6jq.js");
   const forIndex = [];
   const byName = new Map;
   for (const mod of moduleCatalog) {
@@ -8845,7 +8872,7 @@ function rulesFromRows(rows) {
       else
         match[k] = v;
     }
-    const num = (s) => {
+    const num2 = (s) => {
       if (s == null)
         return;
       const n = Number(s.replace(/\s/g, ""));
@@ -8858,8 +8885,8 @@ function rulesFromRows(rows) {
       disabled: flags.includes("X"),
       dynamic: flags.includes("D"),
       comment: r.comment,
-      packets: num(r.packets),
-      bytes: num(r.bytes),
+      packets: num2(r.packets),
+      bytes: num2(r.bytes),
       match,
       transform,
       raw: r
@@ -8928,6 +8955,8 @@ function matchSummary(rule) {
     "dst-port",
     "in-interface",
     "out-interface",
+    "in-interface-list",
+    "out-interface-list",
     "connection-state",
     "src-address-list",
     "dst-address-list"
@@ -9676,11 +9705,12 @@ async function updateFilterRule(a, ctx) {
   }
   if (updates.length === 0)
     return "No updates specified.";
-  const cmd = `/ip firewall filter set ${a.rule_id} ${updates.join(" ")}`;
+  const id = /^\d+$/.test(a.rule_id) ? `*${a.rule_id}` : a.rule_id;
+  const cmd = `/ip firewall filter set ${id} ${updates.join(" ")}`;
   const result = await executeMikrotikCommand(cmd, ctx);
   if (looksLikeError(result))
     return `Failed to update firewall filter rule: ${result}`;
-  const details = await executeMikrotikCommand(`/ip firewall filter print detail where .id=${a.rule_id}`, ctx);
+  const details = await executeMikrotikCommand(`/ip firewall filter print detail where .id=${id}`, ctx);
   return `Firewall filter rule updated successfully:
 
 ${details}`;
@@ -9835,7 +9865,8 @@ ${result}`;
     },
     async handler(a, ctx) {
       ctx.info(`Getting firewall filter rule details: rule_id=${a.rule_id}`);
-      const result = await executeMikrotikCommand(`/ip firewall filter print detail where .id=${a.rule_id}`, ctx);
+      const id = /^\d+$/.test(a.rule_id) ? `*${a.rule_id}` : a.rule_id;
+      const result = await executeMikrotikCommand(`/ip firewall filter print detail where .id=${id}`, ctx);
       return isEmpty(result) ? `Firewall filter rule with ID '${a.rule_id}' not found.` : `FIREWALL FILTER RULE DETAILS:
 
 ${result}`;
@@ -9911,10 +9942,11 @@ ${result}`;
     inputSchema: { rule_id: z28.string() },
     async handler(a, ctx) {
       ctx.info(`Removing firewall filter rule: rule_id=${a.rule_id}`);
-      const count = await executeMikrotikCommand(`/ip firewall filter print count-only where .id=${a.rule_id}`, ctx);
+      const id = /^\d+$/.test(a.rule_id) ? `*${a.rule_id}` : a.rule_id;
+      const count = await executeMikrotikCommand(`/ip firewall filter print count-only where .id=${id}`, ctx);
       if (count.trim() === "0")
         return `Firewall filter rule with ID '${a.rule_id}' not found.`;
-      const result = await executeMikrotikCommand(`/ip firewall filter remove ${a.rule_id}`, ctx);
+      const result = await executeMikrotikCommand(`/ip firewall filter remove ${id}`, ctx);
       if (looksLikeError(result))
         return `Failed to remove firewall filter rule: ${result}`;
       return `Firewall filter rule with ID '${a.rule_id}' removed successfully.`;
@@ -9931,10 +9963,11 @@ ${result}`;
     },
     async handler(a, ctx) {
       ctx.info(`Moving firewall filter rule: rule_id=${a.rule_id} to position ${a.destination}`);
-      const count = await executeMikrotikCommand(`/ip firewall filter print count-only where .id=${a.rule_id}`, ctx);
+      const id = /^\d+$/.test(a.rule_id) ? `*${a.rule_id}` : a.rule_id;
+      const count = await executeMikrotikCommand(`/ip firewall filter print count-only where .id=${id}`, ctx);
       if (count.trim() === "0")
         return `Firewall filter rule with ID '${a.rule_id}' not found.`;
-      const result = await executeMikrotikCommand(`/ip firewall filter move ${a.rule_id} destination=${a.destination}`, ctx);
+      const result = await executeMikrotikCommand(`/ip firewall filter move ${id} destination=${a.destination}`, ctx);
       if (looksLikeError(result))
         return `Failed to move firewall filter rule: ${result}`;
       return `Firewall filter rule with ID '${a.rule_id}' moved to position ${a.destination}.`;
@@ -10831,7 +10864,7 @@ function assessUpgradeReadiness(state) {
     });
   }
   const cpuNum = Number.parseInt(state.cpuLoad, 10);
-  if (!isNaN(cpuNum) && cpuNum > 80) {
+  if (!Number.isNaN(cpuNum) && cpuNum > 80) {
     checks.push({
       label: "CPU load",
       status: "caution",
@@ -10844,8 +10877,8 @@ function assessUpgradeReadiness(state) {
       detail: `${state.cpuLoad}`
     });
   }
-  const free = parseMem(state.freeMemory);
-  const total = parseMem(state.totalMemory);
+  const free = parseSize(state.freeMemory) ?? 0;
+  const total = parseSize(state.totalMemory) ?? 0;
   if (free > 0 && total > 0) {
     const pct2 = Math.round(free / total * 100);
     if (pct2 < 20) {
@@ -10882,20 +10915,6 @@ function assessUpgradeReadiness(state) {
   }
   return checks;
 }
-function parseMem(s) {
-  const m = s.match(/([\d.]+)\s*(MiB|GiB|KiB)?/i);
-  if (!m)
-    return 0;
-  const val = Number.parseFloat(m[1]);
-  const unit = (m[2] ?? "").toLowerCase();
-  if (unit === "gib")
-    return val * 1024 * 1024 * 1024;
-  if (unit === "mib")
-    return val * 1024 * 1024;
-  if (unit === "kib")
-    return val * 1024;
-  return val;
-}
 function renderFirmwareStatus(state, device) {
   const lines = [];
   lines.push(`FIRMWARE STATUS \u2014 ${device}`);
@@ -11033,14 +11052,6 @@ function renderReadiness(checks) {
 }
 
 // src/tools/firmware-lifecycle.ts
-async function safe2(cmd, ctx) {
-  try {
-    const out = await executeMikrotikCommand(cmd, ctx);
-    return looksLikeError(out) ? "" : out;
-  } catch {
-    return "";
-  }
-}
 function parsePackages(raw) {
   if (!raw)
     return [];
@@ -11085,10 +11096,10 @@ function parseUpdateInfo(raw) {
 }
 async function fetchFirmwareState(ctx) {
   const [resourceRaw, packagesRaw, routerboardRaw, updateRaw] = await Promise.all([
-    safe2("/system resource print", ctx),
-    safe2("/system package print detail", ctx),
-    safe2("/system routerboard print", ctx),
-    safe2("/system package update print", ctx)
+    safe("/system resource print", ctx),
+    safe("/system package print detail", ctx),
+    safe("/system routerboard print", ctx),
+    safe("/system package update print", ctx)
   ]);
   const res = parseKeyValues(resourceRaw);
   return {
@@ -11106,12 +11117,12 @@ async function fetchFirmwareState(ctx) {
 }
 async function captureHealthSnapshot(ctx) {
   const [resourceRaw, healthRaw, routesRaw, interfacesRaw, pppRaw, dhcpRaw] = await Promise.all([
-    safe2("/system resource print", ctx),
-    safe2("/system health print", ctx),
-    safe2("/ip route print count-only", ctx),
-    safe2("/interface print detail", ctx),
-    safe2("/ppp active print count-only", ctx),
-    safe2("/ip dhcp-server lease print count-only where status=bound", ctx)
+    safe("/system resource print", ctx),
+    safe("/system health print", ctx),
+    safe("/ip route print count-only", ctx),
+    safe("/interface print detail", ctx),
+    safe("/ppp active print count-only", ctx),
+    safe("/ip dhcp-server lease print count-only where status=bound", ctx)
   ]);
   const res = parseKeyValues(resourceRaw);
   const ifRows = interfacesRaw ? parseRecords(interfacesRaw).rows : [];
@@ -11211,8 +11222,8 @@ var firmwareLifecycleTools = [
         if (looksLikeError(chResult))
           return `Failed to set channel: ${chResult}`;
       }
-      const checkResult = await executeMikrotikCommand("/system package update check-for-updates once", ctx);
-      const updateRaw = await safe2("/system package update print", ctx);
+      await executeMikrotikCommand("/system package update check-for-updates once", ctx);
+      const updateRaw = await safe("/system package update print", ctx);
       const updateInfo = parseUpdateInfo(updateRaw);
       if (!updateInfo?.updateAvailable) {
         return `No update available on '${device}'.
@@ -11226,7 +11237,7 @@ var firmwareLifecycleTools = [
       if (looksLikeError(dlResult)) {
         return `Failed to download update packages: ${dlResult}`;
       }
-      const postRaw = await safe2("/system package update print", ctx);
+      const postRaw = await safe("/system package update print", ctx);
       const postStatus = parseKeyValues(postRaw);
       const lines = [];
       lines.push(`FIRMWARE STAGED \u2014 ${device}`);
@@ -11259,7 +11270,7 @@ var firmwareLifecycleTools = [
         return "Upgrade not confirmed. Pass confirm=true to proceed. The device WILL reboot.";
       const device = resolveDeviceName(ctx.device);
       ctx.info(`Firmware upgrade on '${device}'`);
-      const updateRaw = await safe2("/system package update print", ctx);
+      const updateRaw = await safe("/system package update print", ctx);
       const updateInfo = parseUpdateInfo(updateRaw);
       if (!updateInfo?.updateAvailable) {
         return `No update available on '${device}'. ` + `Run \`firmware_check\` or \`firmware_stage\` first.
@@ -11368,7 +11379,7 @@ var firmwareLifecycleTools = [
         lines.push(`  Current: ${state.routerboard.currentFirmware}  \u2192  Available: ${state.routerboard.upgradeFirmware}`);
         lines.push("  Use `firmware_upgrade` with `upgrade_routerboard=true` to include it.");
       }
-      const schedRaw = await safe2('/system scheduler print detail where name="mcp-firmware-upgrade"', ctx);
+      const schedRaw = await safe('/system scheduler print detail where name="mcp-firmware-upgrade"', ctx);
       if (schedRaw && !isEmpty(schedRaw)) {
         lines.push("");
         lines.push("PENDING SCHEDULED UPGRADE:");
@@ -20326,7 +20337,7 @@ function analyzeRootCause(data) {
       summary: `${boundLeases.length} active DHCP leases`
     });
   }
-  if (isIpAddress(data.target)) {
+  if (isIpAddress(data.target) && isPrivateIp(data.target)) {
     const lease = data.dhcpLeases.find((l) => l.address === data.target);
     const arp = data.arpEntries.find((e) => e.address === data.target);
     if (!lease && !arp) {
@@ -20581,7 +20592,7 @@ function correlateRootCauses(data, evidence, causes) {
       dimensions: ["resources"]
     });
   }
-  if (isIpAddress(data.target)) {
+  if (isIpAddress(data.target) && isPrivateIp(data.target)) {
     const arp = data.arpEntries.find((e) => e.address === data.target);
     if (arp && !arp.complete && data.ping?.lossPct === 100) {
       causes.push({
@@ -20636,9 +20647,6 @@ function correlateRootCauses(data, evidence, causes) {
     });
   }
 }
-function isIpAddress(s) {
-  return /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(s);
-}
 function formatRule(r) {
   const parts = [`chain=${r.chain}`, `action=${r.action}`];
   if (r.srcAddress)
@@ -20798,19 +20806,8 @@ ${footer}`;
 }
 
 // src/tools/root-cause.ts
-async function safe3(cmd, ctx) {
-  try {
-    const out = await executeMikrotikCommand(cmd, ctx);
-    return looksLikeError(out) ? "" : out;
-  } catch {
-    return "";
-  }
-}
-function num(s) {
-  return Number.parseInt(s ?? "0", 10) || 0;
-}
 async function collectInterfaces(ctx) {
-  const raw = await safe3("/interface print detail", ctx);
+  const raw = await safe("/interface print detail", ctx);
   if (!raw)
     return [];
   return parseRecords(raw).rows.map((r) => ({
@@ -20828,7 +20825,7 @@ async function collectInterfaces(ctx) {
   }));
 }
 async function collectRoutes(ctx) {
-  const raw = await safe3("/ip route print detail", ctx);
+  const raw = await safe("/ip route print detail", ctx);
   if (!raw)
     return { routes: [], count: 0, hasDefault: false };
   const rows = parseRecords(raw).rows;
@@ -20843,7 +20840,7 @@ async function collectRoutes(ctx) {
   return { routes, count: routes.length, hasDefault };
 }
 async function collectOspfNeighbors(ctx) {
-  const raw = await safe3("/routing ospf neighbor print detail", ctx);
+  const raw = await safe("/routing ospf neighbor print detail", ctx);
   if (!raw)
     return [];
   return parseRecords(raw).rows.map((r) => ({
@@ -20855,9 +20852,9 @@ async function collectOspfNeighbors(ctx) {
   }));
 }
 async function collectBgpPeers(ctx) {
-  const raw = await safe3("/routing bgp session print detail", ctx);
+  const raw = await safe("/routing bgp session print detail", ctx);
   if (!raw) {
-    const raw2 = await safe3("/routing bgp peer print detail", ctx);
+    const raw2 = await safe("/routing bgp peer print detail", ctx);
     if (!raw2)
       return [];
     return parseRecords(raw2).rows.map((r) => ({
@@ -20877,12 +20874,12 @@ async function collectBgpPeers(ctx) {
   }));
 }
 async function collectFirewallRules(target, ctx) {
-  const raw = await safe3("/ip firewall filter print detail", ctx);
+  const raw = await safe("/ip firewall filter print detail", ctx);
   if (!raw)
     return { matching: [], totalCount: 0 };
   const rows = parseRecords(raw).rows;
   const all = rows.map(parseFirewallRow);
-  const isIp = /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(target);
+  const isIp = isIpAddress(target);
   const matching = isIp ? all.filter((r) => !r.srcAddress || r.srcAddress === target || !r.dstAddress || r.dstAddress === target) : all;
   return { matching, totalCount: all.length };
 }
@@ -20902,13 +20899,13 @@ function parseFirewallRow(r, i) {
   };
 }
 async function collectNatRules(ctx) {
-  const raw = await safe3("/ip firewall nat print detail", ctx);
+  const raw = await safe("/ip firewall nat print detail", ctx);
   if (!raw)
     return [];
   return parseRecords(raw).rows.map(parseFirewallRow);
 }
 async function collectArp(ctx) {
-  const raw = await safe3("/ip arp print detail", ctx);
+  const raw = await safe("/ip arp print detail", ctx);
   if (!raw)
     return [];
   return parseRecords(raw).rows.map((r) => ({
@@ -20920,7 +20917,7 @@ async function collectArp(ctx) {
   }));
 }
 async function collectDhcpLeases(ctx) {
-  const raw = await safe3("/ip dhcp-server lease print detail", ctx);
+  const raw = await safe("/ip dhcp-server lease print detail", ctx);
   if (!raw)
     return [];
   return parseRecords(raw).rows.map((r) => ({
@@ -20933,7 +20930,7 @@ async function collectDhcpLeases(ctx) {
   }));
 }
 async function collectLogs(target, ctx) {
-  const raw = await safe3('/log print where topics~"error" or topics~"warning" or topics~"critical" or topics~"firewall" or topics~"system"', ctx);
+  const raw = await safe('/log print where topics~"error" or topics~"warning" or topics~"critical" or topics~"firewall" or topics~"system"', ctx);
   if (!raw)
     return [];
   const rows = parseRecords(raw).rows;
@@ -20944,7 +20941,7 @@ async function collectLogs(target, ctx) {
   }));
 }
 async function collectTunnels(ctx) {
-  const raw = await safe3('/interface print detail where type~"gre|ipip|eoip|vxlan|wireguard|ovpn|sstp|pptp|l2tp"', ctx);
+  const raw = await safe('/interface print detail where type~"gre|ipip|eoip|vxlan|wireguard|ovpn|sstp|pptp|l2tp"', ctx);
   if (!raw)
     return [];
   return parseRecords(raw).rows.map((r) => ({
@@ -20979,27 +20976,27 @@ async function collectDiagnosticData(target, ctx, dimensions) {
     logs,
     tunnels
   ] = await Promise.all([
-    dims.has("connectivity") ? safe3(`/ping ${quoteValue(target)} count=5`, ctx) : Promise.resolve(""),
+    dims.has("connectivity") ? safe(`/ping ${quoteValue(target)} count=5`, ctx) : Promise.resolve(""),
     dims.has("interfaces") ? collectInterfaces(ctx) : Promise.resolve([]),
     dims.has("routing") ? collectRoutes(ctx) : Promise.resolve({ routes: [], count: 0, hasDefault: true }),
     dims.has("routing") ? collectOspfNeighbors(ctx) : Promise.resolve([]),
     dims.has("routing") ? collectBgpPeers(ctx) : Promise.resolve([]),
     dims.has("firewall") ? collectFirewallRules(target, ctx) : Promise.resolve({ matching: [], totalCount: 0 }),
     dims.has("nat") ? collectNatRules(ctx) : Promise.resolve([]),
-    dims.has("nat") ? safe3("/ip firewall connection print count-only", ctx) : Promise.resolve("0"),
+    dims.has("nat") ? safe("/ip firewall connection print count-only", ctx) : Promise.resolve("0"),
     dims.has("arp_dhcp") ? collectArp(ctx) : Promise.resolve([]),
     dims.has("arp_dhcp") ? collectDhcpLeases(ctx) : Promise.resolve([]),
-    dims.has("dns") && !isIpLike(target) ? safe3(`[:resolve ${quoteValue(target)}]`, ctx) : Promise.resolve(undefined),
-    dims.has("dns") ? safe3("/ip dns print", ctx) : Promise.resolve(""),
-    dims.has("resources") ? safe3("/system resource print", ctx) : Promise.resolve(""),
+    dims.has("dns") && !isIpLike(target) ? safe(`[:resolve ${quoteValue(target)}]`, ctx) : Promise.resolve(undefined),
+    dims.has("dns") ? safe("/ip dns print", ctx) : Promise.resolve(""),
+    dims.has("resources") ? safe("/system resource print", ctx) : Promise.resolve(""),
     dims.has("logs") ? collectLogs(target, ctx) : Promise.resolve([]),
     dims.has("vpn") ? collectTunnels(ctx) : Promise.resolve([])
   ]);
   const ping = pingResult ? parsePingSummary(pingResult) ?? undefined : undefined;
   const dnsKv = parseKeyValues(dnsSettingsRaw);
   const resKv = parseKeyValues(resourceRaw);
-  const totalMem = parseMemMiB(resKv["total-memory"]);
-  const freeMem = parseMemMiB(resKv["free-memory"]);
+  const totalMem = parseSize(resKv["total-memory"]) ?? 0;
+  const freeMem = parseSize(resKv["free-memory"]) ?? 0;
   const memUsedPct = totalMem > 0 ? Math.round((totalMem - freeMem) / totalMem * 100) : 0;
   return {
     target,
@@ -21018,9 +21015,9 @@ async function collectDiagnosticData(target, ctx, dimensions) {
     arpEntries,
     dhcpLeases,
     dnsResolveResult: dnsResult ?? undefined,
-    dnsServers: dnsKv.servers ?? "",
+    dnsServers: [dnsKv.servers, dnsKv["dynamic-servers"]].filter(Boolean).join(",") || "",
     dnsAllowRemote: (dnsKv["allow-remote-requests"] ?? "").toLowerCase() === "yes",
-    cpuLoad: num(resKv["cpu-load"]),
+    cpuLoad: parsePercent(resKv["cpu-load"]) ?? 0,
     memoryUsedPct: memUsedPct,
     uptime: resKv.uptime ?? "",
     rosVersion: resKv.version ?? "",
@@ -21028,23 +21025,6 @@ async function collectDiagnosticData(target, ctx, dimensions) {
     tunnelInterfaces: tunnels
   };
 }
-function isIpLike(s) {
-  return /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\/\d+)?$/.test(s);
-}
-function parseMemMiB(s) {
-  if (!s)
-    return 0;
-  const m = s.match(/([\d.]+)\s*(MiB|GiB|KiB)?/i);
-  if (!m)
-    return 0;
-  const v = Number.parseFloat(m[1]);
-  const u = (m[2] ?? "").toLowerCase();
-  if (u === "gib")
-    return v * 1024;
-  if (u === "kib")
-    return v / 1024;
-  return v;
-}
 var dimensionEnum = z86.enum(ALL_DIMENSIONS).describe("Diagnostic dimension to investigate.");
 var rootCauseTools = [
   defineTool({
@@ -21086,9 +21066,9 @@ var rootCauseTools = [
       const device = resolveDeviceName(ctx.device);
       ctx.info(`Tracing path from '${device}' to ${a.target}`);
       const [traceResult, pingResult, routeResult] = await Promise.all([
-        safe3(`/tool traceroute ${quoteValue(a.target)} count=${a.count} use-dns=${a.use_dns ? "yes" : "no"}`, ctx),
-        safe3(`/ping ${quoteValue(a.target)} count=5`, ctx),
-        safe3(`/ip route print where dst-address=0.0.0.0/0`, ctx)
+        safe(`/tool traceroute ${quoteValue(a.target)} count=${a.count} use-dns=${a.use_dns ? "yes" : "no"}`, ctx),
+        safe(`/ping ${quoteValue(a.target)} count=5`, ctx),
+        safe(`/ip route print where dst-address=0.0.0.0/0`, ctx)
       ]);
       const ping = parsePingSummary(pingResult);
       const lines = [];
@@ -21150,7 +21130,7 @@ var rootCauseTools = [
         filters.push(`message~"${a.keyword}"`);
       }
       const where = filters.length > 0 ? ` where ${filters.join(" ")}` : "";
-      const raw = await safe3(`/log print detail${where}`, ctx);
+      const raw = await safe(`/log print detail${where}`, ctx);
       if (!raw || isEmpty(raw)) {
         return `No matching log events found on '${device}' in the last ${a.time_window}.`;
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usex/mikrotik-mcp",
-  "version": "3.51.1",
+  "version": "3.53.0",
   "description": "MCP server for MikroTik RouterOS — 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   "keywords": [
     "ai",

package/prompts/audit-security-posture.md

@@ -0,0 +1,41 @@
+---
+name: audit-security-posture
+title: Run a compliance security audit
+description: Comprehensive security audit across SSH, services, firewall, users, DNS, certificates, SNMP, hardening, and VPN — scored A+ through F with actionable fix commands.
+arguments:
+  - name: categories
+    description: Comma-separated categories to audit (e.g. "ssh,firewall,users"). Omit for a full audit across all 9 categories.
+    required: false
+---
+
+Run a comprehensive security compliance audit on this MikroTik device. The audit
+covers 36 checks across 9 categories — SSH, management services, firewall, user
+accounts, DNS, certificates, SNMP, system hardening, and VPN — and scores the
+device from A+ (excellent) down to F (critical).
+
+Categories to audit: {{categories}}
+
+Follow this workflow:
+
+1. **Run the audit.** Call `run_compliance_audit` (optionally filtered to
+   `{{categories}}`). Review the per-check results: each check reports pass, fail,
+   or warn with a severity level and a specific fix command.
+
+2. **Present the results.** Organize findings by severity (critical → low):
+   - The overall grade (A+ through F) and numeric score.
+   - A summary table of failed and warning checks.
+   - For each failing check: what it found, why it matters, and the exact fix
+     command provided by the audit engine.
+
+3. **Remediate (with user approval).** If the user wants to fix failing checks,
+   call `audit_remediate` with `dry_run=true` first to preview what commands would
+   run. Then, with approval, call `audit_remediate` with `dry_run=false` to apply.
+
+4. **Re-audit.** After remediation, run `run_compliance_audit` again to confirm
+   the score improved and no new issues were introduced.
+
+5. **Fleet-wide (optional).** If multiple devices are configured, offer to run
+   `audit_fleet` for a consolidated report with aggregate scores and the most
+   common failures across the fleet.
+
+Do not apply any fixes without user approval. Present the audit report first.

package/prompts/backup-and-document.md

@@ -9,9 +9,12 @@ Create a restore point for this MikroTik device and then write up a clear,
 human-readable summary of how it's configured. This is read-mostly: the only
 change is creating a backup/export.
 
-1. **Restore point** — `create_backup` (binary, for full restore) and
+1. **Local snapshot (zero device footprint)** — `capture_config_snapshot` first.
+   This stores a text `/export` in the MCP host's local database — no file is
+   written on the router's flash. Give it a descriptive `label` (e.g. `pre-audit`).
+2. **Device restore point** — `create_backup` (binary, for full restore) and
    `create_export` (text `.rsc`, for review/diff). List them with `list_backups`.
-2. **Inventory** — gather the configuration with read tools and organize it:
+3. **Inventory** — gather the configuration with read tools and organize it:
    - System: `get_system_identity`, `get_system_resources`, `get_routerboard`,
      `get_installed_packages`.
    - L2/L3: `list_interfaces`, `list_vlan_interfaces`, `list_bridges`,
@@ -23,10 +26,12 @@ change is creating a backup/export.
      `list_users`, `list_certificates`.
    - VPN/QoS: `list_wireguard_interfaces` + `list_wireguard_peers`,
      `list_simple_queues`, `list_queue_trees`.
+   - Containers: `list_containers` (if the container feature is enabled).
    - Automation: `list_schedulers`, `list_scripts`.
 
 Produce a structured Markdown report: a one-paragraph overview, a table of
 interfaces and addressing, the firewall posture, and a "things worth reviewing"
-section (defaults left in place, disabled-but-present rules, expiring certs).
-Reference the backup/export filenames you created so the user knows their restore
-point.
+section (defaults left in place, disabled-but-present rules, expiring certs —
+check `list_certificates` for any expiring within 30 days).
+Reference the snapshot id and backup/export filenames you created so the user
+knows their restore points.

package/prompts/choose-vpn-solution.md

@@ -23,6 +23,9 @@ Decision guidance — weigh these MikroTik options:
 - **WireGuard** — fastest, simplest, modern. Best for MikroTik↔MikroTik and
   laptops/phones with the WireGuard app. No built-in OS client on older systems.
   Tools: `create_wireguard_interface`, `add_wireguard_peer`, `generate_wireguard_client_config`.
+  For **3+ sites** (full-mesh or hub-spoke): `build_wireguard_mesh`.
+  For **user onboarding** (generate config, add peer, revoke later):
+  `onboard_wireguard_user`, `revoke_wireguard_user`.
 - **IPsec (IKEv2)** — the interoperability choice for site-to-site with
   _other vendors_ (Cisco/Fortinet/pfSense) and for native iOS/Windows IKEv2
   road-warrior. Most config surface. Tools: `create_ipsec_*` (profile/peer/

package/prompts/design-qos-policy.md

@@ -0,0 +1,49 @@
+---
+name: design-qos-policy
+title: Design a traffic shaping policy
+description: Build a QoS queue hierarchy from business requirements — define traffic classes, priorities, and bandwidth guarantees with preview before apply.
+arguments:
+  - name: wan_bandwidth
+    description: WAN bandwidth in download/upload format (e.g. "100M/50M", "1G/1G").
+    required: true
+  - name: classes
+    description: Describe traffic classes and priorities (e.g. "VoIP=highest, video conferencing=high, web=normal, bulk downloads=low"). If omitted, a sensible default is used.
+    required: false
+---
+
+Design and deploy a traffic shaping (QoS) policy on this MikroTik device that
+prioritizes important traffic and prevents bulk downloads from saturating the
+link. All changes are previewed before applying.
+
+WAN bandwidth: {{wan_bandwidth}}
+Traffic classes: {{classes}}
+
+Steps:
+
+1. **Understand the network.** Call `list_interfaces` and `list_ip_addresses` to
+   identify the WAN interface. Call `list_queue_trees` and `list_simple_queues`
+   to check if any QoS is already in place.
+
+2. **Design the policy.** Translate {{classes}} into a queue hierarchy:
+   - A parent queue on the WAN interface capped at {{wan_bandwidth}}.
+   - Child queues for each traffic class with appropriate priorities,
+     guaranteed minimum bandwidth, and burst settings.
+     Call `apply_traffic_shaping` in **preview mode** to see the queue tree
+     structure before applying.
+
+3. **Review the queue tree.** Present a table showing:
+   - Each traffic class, its priority level, guaranteed bandwidth, max bandwidth.
+   - Packet marks or connection marks used to classify traffic.
+   - Mangle rules that mark traffic into classes.
+
+4. **Apply.** With user approval, deploy the QoS policy.
+
+5. **Verify.** Call `list_queue_trees` to confirm the hierarchy is in place.
+   Monitor briefly to see traffic flowing through the queues.
+
+6. **Capacity planning (optional).** Call `forecast_link_saturation` on the WAN
+   interface to project when the current link will reach capacity at the observed
+   growth rate — useful for planning upgrades.
+
+Report the complete QoS policy: queue hierarchy, classification rules, and
+bandwidth allocations per class.