@usex/mikrotik-mcp 3.54.0 → 3.55.0

package/dist/cli.js

@@ -96,7 +96,7 @@ import {
   toggleAaaEntity,
   updateAaaEntity,
   writeBackup
-} from "./shared/cli-njttbdf8.js";
+} from "./shared/cli-44v6pb38.js";
 
 // src/cli.ts
 import { existsSync as existsSync2 } from "fs";

package/dist/index.js

@@ -22,7 +22,7 @@ import {
   resolveDeviceName,
   selectToolModules,
   setConfig
-} from "./shared/library-hk90ad18.js";
+} from "./shared/library-83q9t27c.js";
 // src/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";

package/dist/shared/{cli-njttbdf8.js → cli-44v6pb38.js}

@@ -1762,7 +1762,7 @@ function parseKvTokens(chunk) {
   return out;
 }
 var INDEX_LINE = /^\s*(\d+)\s+(.*)$/;
-var LEADING_FLAGS = /^([A-Z]+)(?=\s|$)/;
+var LEADING_FLAGS = /^([A-Z][A-Za-z]*)(?=\s|$)/;
 function unionColumns(rows) {
   const seen = new Set;
   const cols = [];
@@ -8313,7 +8313,7 @@ var cache = null;
 async function gateway() {
   if (cache)
     return cache;
-  const { moduleCatalog } = await import("./cli-xt3qvpz0.js");
+  const { moduleCatalog } = await import("./cli-yxah49n1.js");
   const forIndex = [];
   const byName = new Map;
   for (const mod of moduleCatalog) {
@@ -9338,10 +9338,44 @@ function covers(key, aVal, bVal) {
     return cidrContains(aVal, bVal);
   return false;
 }
+var INTERFACE_LIST_PAIRS = [
+  ["in-interface-list", "in-interface"],
+  ["out-interface-list", "out-interface"]
+];
+var _ifaceLists;
+function interfaceListCovers(aKey, aVal, bKey, bVal) {
+  if (!_ifaceLists)
+    return;
+  for (const [listKey, ifaceKey] of INTERFACE_LIST_PAIRS) {
+    if (aKey === listKey && bKey === ifaceKey) {
+      const negated = aVal.startsWith("!");
+      const listName = negated ? aVal.slice(1) : aVal;
+      const members = _ifaceLists.get(listName);
+      if (!members)
+        return;
+      const isMember = members.has(bVal);
+      return negated ? !isMember : isMember;
+    }
+  }
+  return;
+}
 function aCoversB(a, b) {
   for (const [k, v] of Object.entries(a.match)) {
     const bv = b.match[k];
-    if (bv === undefined || !covers(k, v, bv))
+    if (bv !== undefined) {
+      if (!covers(k, v, bv))
+        return false;
+      continue;
+    }
+    let crossCovered = false;
+    for (const [bk, bval] of Object.entries(b.match)) {
+      const result = interfaceListCovers(k, v, bk, bval);
+      if (result === true) {
+        crossCovered = true;
+        break;
+      }
+    }
+    if (!crossCovered)
       return false;
   }
   return true;
@@ -9518,6 +9552,7 @@ function grade2(score) {
   return "critical";
 }
 function auditFirewall(input) {
+  _ifaceLists = input.interfaceLists;
   const findings = [];
   if (input.filter)
     findings.push(...auditFilter(input.filter));
@@ -9566,6 +9601,25 @@ async function fetchRules(path, ctx) {
     return [];
   return parseRecords(out).rows;
 }
+async function fetchInterfaceListMembers(ctx) {
+  const out = await executeMikrotikCommand("/interface list member print detail", ctx);
+  const members = new Map;
+  if (looksLikeError(out) || isEmpty(out))
+    return members;
+  for (const row of parseRecords(out).rows) {
+    const list = row.list;
+    const iface = row.interface;
+    if (!list || !iface)
+      continue;
+    let set = members.get(list);
+    if (!set) {
+      set = new Set;
+      members.set(list, set);
+    }
+    set.add(iface);
+  }
+  return members;
+}
 var firewallAuditTools = [
   defineTool({
     name: "firewall_audit",
@@ -9580,10 +9634,16 @@ var firewallAuditTools = [
     async handler(a, ctx) {
       const device = resolveDeviceName(ctx.device);
       ctx.info(`Auditing firewall for '${device}'`);
-      const filter = rulesFromRows(await fetchRules("/ip firewall filter", ctx));
-      const nat = a.include_nat ? rulesFromRows(await fetchRules("/ip firewall nat", ctx)) : undefined;
-      const mangle = a.include_mangle ? rulesFromRows(await fetchRules("/ip firewall mangle", ctx)) : undefined;
-      const report = auditFirewall({ filter, nat, mangle });
+      const [filterRows, natRows, mangleRows, interfaceLists] = await Promise.all([
+        fetchRules("/ip firewall filter", ctx),
+        a.include_nat ? fetchRules("/ip firewall nat", ctx) : Promise.resolve(undefined),
+        a.include_mangle ? fetchRules("/ip firewall mangle", ctx) : Promise.resolve(undefined),
+        fetchInterfaceListMembers(ctx)
+      ]);
+      const filter = rulesFromRows(filterRows);
+      const nat = natRows ? rulesFromRows(natRows) : undefined;
+      const mangle = mangleRows ? rulesFromRows(mangleRows) : undefined;
+      const report = auditFirewall({ filter, nat, mangle, interfaceLists });
       const structuredContent = {
         __mikrotikView: "firewall-audit",
         device,
@@ -10048,6 +10108,22 @@ Management access may be partially restricted \u2014 review immediately.`;
 // src/tools/firewall-filter.ts
 import { z as z28 } from "zod";
 var isDigits = (s) => /^\d+$/.test(s);
+async function resolveFilterRuleId(ruleId, ctx) {
+  if (/^\d+$/.test(ruleId)) {
+    const id = `*${ruleId}`;
+    const byId = await executeMikrotikCommand(`/ip firewall filter print count-only where .id=${id}`, ctx);
+    if (byId.trim() !== "0")
+      return id;
+    const idsRaw = await executeMikrotikCommand(`:foreach i in=[/ip firewall filter find] do={:put $i}`, ctx);
+    if (isEmpty(idsRaw))
+      return null;
+    const ids = idsRaw.trim().split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
+    const pos = Number.parseInt(ruleId, 10);
+    return pos >= 0 && pos < ids.length ? ids[pos] : null;
+  }
+  const count = await executeMikrotikCommand(`/ip firewall filter print count-only where .id=${ruleId}`, ctx);
+  return count.trim() !== "0" ? ruleId : null;
+}
 async function updateFilterRule(a, ctx) {
   ctx.info(`Updating firewall filter rule: rule_id=${a.rule_id}`);
   const updates = [];
@@ -10116,7 +10192,9 @@ async function updateFilterRule(a, ctx) {
   }
   if (updates.length === 0)
     return "No updates specified.";
-  const id = /^\d+$/.test(a.rule_id) ? `*${a.rule_id}` : a.rule_id;
+  const id = await resolveFilterRuleId(a.rule_id, ctx);
+  if (!id)
+    return `Firewall filter rule '${a.rule_id}' not found.`;
   const cmd = `/ip firewall filter set ${id} ${updates.join(" ")}`;
   const result = await executeMikrotikCommand(cmd, ctx);
   if (looksLikeError(result))
@@ -10260,7 +10338,7 @@ ${details}`;
         filters.push("invalid=yes");
       if (a.dynamic_only)
         filters.push("dynamic=yes");
-      const result = await executeMikrotikCommand(`/ip firewall filter print${whereClause(filters)}`, ctx);
+      const result = await executeMikrotikCommand(`/ip firewall filter print detail${whereClause(filters)}`, ctx);
       return isEmpty(result) ? "No firewall filter rules found matching the criteria." : `FIREWALL FILTER RULES:
 
 ${result}`;
@@ -10270,15 +10348,17 @@ ${result}`;
     name: "get_filter_rule",
     title: "Get Firewall Filter Rule",
     annotations: READ,
-    description: "Gets the full detail of one IPv4 firewall FILTER rule (`/ip firewall filter`) by id \u2014 " + "every matcher, action, counter and flag. For IPv6 use get_ipv6_filter_rule. " + 'rule_id: the `.id` from list_filter_rules e.g. "*1" or "0".',
+    description: "Gets the full detail of one IPv4 firewall FILTER rule (`/ip firewall filter`) by id \u2014 " + "every matcher, action, counter and flag. For IPv6 use get_ipv6_filter_rule. " + 'rule_id: preferably the `.id` from list_filter_rules e.g. "*1F". A bare number like "3" ' + "is tried as `.id=*3` first, then as the positional row index if no `.id` matches.",
     inputSchema: {
-      rule_id: z28.string().describe('Rule ID from list output e.g. "*1" or "0"')
+      rule_id: z28.string().describe('Rule .id e.g. "*1F", or bare position number e.g. "3"')
     },
     async handler(a, ctx) {
       ctx.info(`Getting firewall filter rule details: rule_id=${a.rule_id}`);
-      const id = /^\d+$/.test(a.rule_id) ? `*${a.rule_id}` : a.rule_id;
+      const id = await resolveFilterRuleId(a.rule_id, ctx);
+      if (!id)
+        return `Firewall filter rule '${a.rule_id}' not found.`;
       const result = await executeMikrotikCommand(`/ip firewall filter print detail where .id=${id}`, ctx);
-      return isEmpty(result) ? `Firewall filter rule with ID '${a.rule_id}' not found.` : `FIREWALL FILTER RULE DETAILS:
+      return isEmpty(result) ? `Firewall filter rule '${a.rule_id}' not found.` : `FIREWALL FILTER RULE DETAILS:
 
 ${result}`;
     }
@@ -10353,14 +10433,13 @@ ${result}`;
     inputSchema: { rule_id: z28.string() },
     async handler(a, ctx) {
       ctx.info(`Removing firewall filter rule: rule_id=${a.rule_id}`);
-      const id = /^\d+$/.test(a.rule_id) ? `*${a.rule_id}` : a.rule_id;
-      const count = await executeMikrotikCommand(`/ip firewall filter print count-only where .id=${id}`, ctx);
-      if (count.trim() === "0")
-        return `Firewall filter rule with ID '${a.rule_id}' not found.`;
+      const id = await resolveFilterRuleId(a.rule_id, ctx);
+      if (!id)
+        return `Firewall filter rule '${a.rule_id}' not found.`;
       const result = await executeMikrotikCommand(`/ip firewall filter remove ${id}`, ctx);
       if (looksLikeError(result))
         return `Failed to remove firewall filter rule: ${result}`;
-      return `Firewall filter rule with ID '${a.rule_id}' removed successfully.`;
+      return `Firewall filter rule '${a.rule_id}' (${id}) removed successfully.`;
     }
   }),
   defineTool({
@@ -10374,14 +10453,13 @@ ${result}`;
     },
     async handler(a, ctx) {
       ctx.info(`Moving firewall filter rule: rule_id=${a.rule_id} to position ${a.destination}`);
-      const id = /^\d+$/.test(a.rule_id) ? `*${a.rule_id}` : a.rule_id;
-      const count = await executeMikrotikCommand(`/ip firewall filter print count-only where .id=${id}`, ctx);
-      if (count.trim() === "0")
-        return `Firewall filter rule with ID '${a.rule_id}' not found.`;
+      const id = await resolveFilterRuleId(a.rule_id, ctx);
+      if (!id)
+        return `Firewall filter rule '${a.rule_id}' not found.`;
       const result = await executeMikrotikCommand(`/ip firewall filter move ${id} destination=${a.destination}`, ctx);
       if (looksLikeError(result))
         return `Failed to move firewall filter rule: ${result}`;
-      return `Firewall filter rule with ID '${a.rule_id}' moved to position ${a.destination}.`;
+      return `Firewall filter rule '${a.rule_id}' (${id}) moved to position ${a.destination}.`;
     }
   }),
   defineTool({
@@ -20657,13 +20735,27 @@ function analyzeRootCause(data) {
     }
   }
   if (downInterfaces.length === 0 && errorInterfaces.length === 0) {
+    if (data.interfaces.length === 0) {
+      evidence.push({
+        dimension: "interfaces",
+        severity: "warning",
+        summary: "Interface data unavailable \u2014 the device returned no parseable interface records. " + "Run `/interface print detail` manually to verify."
+      });
+    } else {
+      evidence.push({
+        dimension: "interfaces",
+        severity: "ok",
+        summary: `All ${data.interfaces.length} interfaces healthy`
+      });
+    }
+  }
+  if (data.routeCount === 0) {
     evidence.push({
-      dimension: "interfaces",
-      severity: "ok",
-      summary: `All ${data.interfaces.length} interfaces healthy`
+      dimension: "routing",
+      severity: "warning",
+      summary: "Route data unavailable \u2014 the device returned no parseable route records. " + "Run `/ip route print detail` manually to verify."
     });
-  }
-  if (!data.defaultRouteExists) {
+  } else if (!data.defaultRouteExists) {
     evidence.push({
       dimension: "routing",
       severity: "critical",
@@ -20676,7 +20768,7 @@ function analyzeRootCause(data) {
       summary: `Default route present, ${data.routeCount} total routes`
     });
   }
-  const ospfDown = data.ospfNeighbors.filter((n) => n.state.toLowerCase() !== "full");
+  const ospfDown = data.ospfNeighbors.filter((n) => (n.id || n.address) && n.state.toLowerCase() !== "full");
   for (const n of ospfDown) {
     evidence.push({
       dimension: "routing",
@@ -20685,7 +20777,7 @@ function analyzeRootCause(data) {
       reference: n.id
     });
   }
-  const bgpDown = data.bgpPeers.filter((p) => !p.state.toLowerCase().includes("established"));
+  const bgpDown = data.bgpPeers.filter((p) => (p.id || p.address) && !p.state.toLowerCase().includes("established"));
   for (const p of bgpDown) {
     evidence.push({
       dimension: "routing",
@@ -20788,7 +20880,13 @@ function analyzeRootCause(data) {
       summary: "No DNS servers configured"
     });
   }
-  if (data.cpuLoad > 90) {
+  if (data.cpuLoad === 0 && data.memoryUsedPct === 0 && !data.rosVersion && !data.uptime) {
+    evidence.push({
+      dimension: "resources",
+      severity: "warning",
+      summary: "System resource data unavailable \u2014 CPU 0%, memory 0%, no version or uptime. " + "The `/system resource print` output may not have been parsed correctly."
+    });
+  } else if (data.cpuLoad > 90) {
     evidence.push({
       dimension: "resources",
       severity: "critical",
@@ -20807,24 +20905,26 @@ function analyzeRootCause(data) {
       summary: `CPU load: ${data.cpuLoad}%`
     });
   }
-  if (data.memoryUsedPct > 90) {
-    evidence.push({
-      dimension: "resources",
-      severity: "critical",
-      summary: `Memory critically low: ${data.memoryUsedPct}% used`
-    });
-  } else if (data.memoryUsedPct > 75) {
-    evidence.push({
-      dimension: "resources",
-      severity: "warning",
-      summary: `Memory pressure: ${data.memoryUsedPct}% used`
-    });
-  } else {
-    evidence.push({
-      dimension: "resources",
-      severity: "ok",
-      summary: `Memory: ${data.memoryUsedPct}% used`
-    });
+  if (data.rosVersion || data.uptime || data.cpuLoad > 0 || data.memoryUsedPct > 0) {
+    if (data.memoryUsedPct > 90) {
+      evidence.push({
+        dimension: "resources",
+        severity: "critical",
+        summary: `Memory critically low: ${data.memoryUsedPct}% used`
+      });
+    } else if (data.memoryUsedPct > 75) {
+      evidence.push({
+        dimension: "resources",
+        severity: "warning",
+        summary: `Memory pressure: ${data.memoryUsedPct}% used`
+      });
+    } else {
+      evidence.push({
+        dimension: "resources",
+        severity: "ok",
+        summary: `Memory: ${data.memoryUsedPct}% used`
+      });
+    }
   }
   const errorLogs = data.relevantLogs.filter((l) => l.topics.includes("error") || l.topics.includes("critical") || l.topics.includes("warning"));
   const firewallLogs = data.relevantLogs.filter((l) => l.topics.includes("firewall"));
@@ -20861,14 +20961,24 @@ function analyzeRootCause(data) {
       summary: "No concerning log entries in the last 10 minutes"
     });
   }
+  const isServerBinding = (t) => /-(in|server)$/.test(t.type) || t.name.startsWith("<");
   const downTunnels = data.tunnelInterfaces.filter((t) => !t.running && !t.disabled);
   for (const t of downTunnels) {
-    evidence.push({
-      dimension: "vpn",
-      severity: "critical",
-      summary: `Tunnel ${t.name} (${t.type}) is down`,
-      reference: t.name
-    });
+    if (isServerBinding(t)) {
+      evidence.push({
+        dimension: "vpn",
+        severity: "info",
+        summary: `Server binding ${t.name} (${t.type}) is idle \u2014 no active client session`,
+        reference: t.name
+      });
+    } else {
+      evidence.push({
+        dimension: "vpn",
+        severity: "critical",
+        summary: `Tunnel ${t.name} (${t.type}) is down`,
+        reference: t.name
+      });
+    }
   }
   if (data.tunnelInterfaces.length > 0 && downTunnels.length === 0) {
     evidence.push({
@@ -20878,6 +20988,19 @@ function analyzeRootCause(data) {
     });
   }
   correlateRootCauses(data, evidence, rootCauses);
+  if (data.ping && data.ping.lossPct === 0) {
+    const contradicted = new Set([
+      "Missing default route",
+      "Missing source NAT / masquerade",
+      "Interface link failure"
+    ]);
+    for (const rc of rootCauses) {
+      if (contradicted.has(rc.cause) && rc.confidence !== "low") {
+        rc.confidence = "low";
+        rc.explanation += " (Note: ping to the target succeeded with 0% loss, which contradicts this hypothesis.)";
+      }
+    }
+  }
   rootCauses.sort((a, b) => CONFIDENCE_RANK[a.confidence] - CONFIDENCE_RANK[b.confidence]);
   const dimensionSummary = ALL_DIMENSIONS.map((dim) => {
     const dimEvidence = evidence.filter((e) => e.dimension === dim);
@@ -21016,14 +21139,15 @@ function correlateRootCauses(data, evidence, causes) {
       });
     }
   }
-  const downTunnels = data.tunnelInterfaces.filter((t) => !t.running && !t.disabled);
-  if (downTunnels.length > 0) {
+  const isServerTunnel = (t) => /-(in|server)$/.test(t.type) || t.name.startsWith("<");
+  const realDownTunnels = data.tunnelInterfaces.filter((t) => !t.running && !t.disabled && !isServerTunnel(t));
+  if (realDownTunnels.length > 0) {
     causes.push({
       cause: "VPN/tunnel interface down",
-      explanation: `Tunnel(s) ${downTunnels.map((t) => `${t.name} (${t.type})`).join(", ")} are down. ` + "Traffic destined for remote networks over these tunnels will be black-holed.",
+      explanation: `Tunnel(s) ${realDownTunnels.map((t) => `${t.name} (${t.type})`).join(", ")} are down. ` + "Traffic destined for remote networks over these tunnels will be black-holed.",
       confidence: "high",
       evidence: evidence.filter((e) => e.dimension === "vpn" && e.severity === "critical"),
-      fixes: downTunnels.map((t) => `/interface enable [find name="${t.name}"]`),
+      fixes: realDownTunnels.map((t) => `/interface enable [find name="${t.name}"]`),
       dimensions: ["vpn"]
     });
   }
@@ -21252,7 +21376,7 @@ async function collectRoutes(ctx) {
 }
 async function collectOspfNeighbors(ctx) {
   const raw = await safe("/routing ospf neighbor print detail", ctx);
-  if (!raw)
+  if (!raw || isEmpty(raw))
     return [];
   return parseRecords(raw).rows.map((r) => ({
     id: r["neighbor-id"] ?? r.router ?? "",
@@ -21260,13 +21384,13 @@ async function collectOspfNeighbors(ctx) {
     state: r.state ?? "",
     interface: r.interface ?? "",
     uptime: r.uptime
-  }));
+  })).filter((n) => n.id || n.address);
 }
 async function collectBgpPeers(ctx) {
   const raw = await safe("/routing bgp session print detail", ctx);
-  if (!raw) {
+  if (!raw || isEmpty(raw)) {
     const raw2 = await safe("/routing bgp peer print detail", ctx);
-    if (!raw2)
+    if (!raw2 || isEmpty(raw2))
       return [];
     return parseRecords(raw2).rows.map((r) => ({
       id: r.name ?? "",
@@ -21274,7 +21398,7 @@ async function collectBgpPeers(ctx) {
       state: r.state ?? "",
       interface: r.interface ?? "",
       uptime: r.uptime
-    }));
+    })).filter((p) => p.id || p.address);
   }
   return parseRecords(raw).rows.map((r) => ({
     id: r.name ?? r["remote.address"] ?? "",
@@ -21282,7 +21406,7 @@ async function collectBgpPeers(ctx) {
     state: r.state ?? r.established ?? "",
     interface: r.interface ?? "",
     uptime: r.uptime
-  }));
+  })).filter((p) => p.id || p.address);
 }
 async function collectFirewallRules(target, ctx) {
   const raw = await safe("/ip firewall filter print detail", ctx);
@@ -21382,7 +21506,7 @@ async function collectDiagnosticData(target, ctx, dimensions) {
     arpEntries,
     dhcpLeases,
     dnsResult,
-    dnsSettingsRaw,
+    dnsSettingsParts,
     resourceRaw,
     logs,
     tunnels
@@ -21398,13 +21522,17 @@ async function collectDiagnosticData(target, ctx, dimensions) {
     dims.has("arp_dhcp") ? collectArp(ctx) : Promise.resolve([]),
     dims.has("arp_dhcp") ? collectDhcpLeases(ctx) : Promise.resolve([]),
     dims.has("dns") && !isIpLike(target) ? safe(`[:resolve ${quoteValue(target)}]`, ctx) : Promise.resolve(undefined),
-    dims.has("dns") ? safe("/ip dns print", ctx) : Promise.resolve(""),
+    dims.has("dns") ? Promise.all([
+      safe(":put [/ip dns get servers]", ctx),
+      safe(":put [/ip dns get dynamic-servers]", ctx),
+      safe(":put [/ip dns get allow-remote-requests]", ctx)
+    ]) : Promise.resolve(["", "", ""]),
     dims.has("resources") ? safe("/system resource print", ctx) : Promise.resolve(""),
     dims.has("logs") ? collectLogs(target, ctx) : Promise.resolve([]),
     dims.has("vpn") ? collectTunnels(ctx) : Promise.resolve([])
   ]);
   const ping = pingResult ? parsePingSummary(pingResult) ?? undefined : undefined;
-  const dnsKv = parseKeyValues(dnsSettingsRaw);
+  const [dnsServersRaw, dnsDynamicRaw, dnsAllowRemoteRaw] = dnsSettingsParts;
   const resKv = parseKeyValues(resourceRaw);
   const totalMem = parseSize(resKv["total-memory"]) ?? 0;
   const freeMem = parseSize(resKv["free-memory"]) ?? 0;
@@ -21426,8 +21554,8 @@ async function collectDiagnosticData(target, ctx, dimensions) {
     arpEntries,
     dhcpLeases,
     dnsResolveResult: dnsResult ?? undefined,
-    dnsServers: [dnsKv.servers, dnsKv["dynamic-servers"]].filter(Boolean).join(",") || "",
-    dnsAllowRemote: (dnsKv["allow-remote-requests"] ?? "").toLowerCase() === "yes",
+    dnsServers: [dnsServersRaw.trim(), dnsDynamicRaw.trim()].filter(Boolean).join(",") || "",
+    dnsAllowRemote: dnsAllowRemoteRaw.trim().toLowerCase() === "yes" || dnsAllowRemoteRaw.trim().toLowerCase() === "true",
     cpuLoad: parsePercent(resKv["cpu-load"]) ?? 0,
     memoryUsedPct: memUsedPct,
     uptime: resKv.uptime ?? "",

package/dist/shared/{cli-xt3qvpz0.js → cli-yxah49n1.js}

@@ -4,7 +4,7 @@ import {
   allToolModules,
   moduleCatalog,
   selectToolModules
-} from "./cli-njttbdf8.js";
+} from "./cli-44v6pb38.js";
 export {
   selectToolModules,
   moduleCatalog,

package/dist/shared/{library-hk90ad18.js → library-83q9t27c.js}

@@ -1743,7 +1743,7 @@ function parseKvTokens(chunk) {
   return out;
 }
 var INDEX_LINE = /^\s*(\d+)\s+(.*)$/;
-var LEADING_FLAGS = /^([A-Z]+)(?=\s|$)/;
+var LEADING_FLAGS = /^([A-Z][A-Za-z]*)(?=\s|$)/;
 function unionColumns(rows) {
   const seen = new Set;
   const cols = [];
@@ -8243,7 +8243,7 @@ var cache = null;
 async function gateway() {
   if (cache)
     return cache;
-  const { moduleCatalog } = await import("./library-84y0nvhr.js");
+  const { moduleCatalog } = await import("./library-cs13jqp9.js");
   const forIndex = [];
   const byName = new Map;
   for (const mod of moduleCatalog) {
@@ -9268,10 +9268,44 @@ function covers(key, aVal, bVal) {
     return cidrContains(aVal, bVal);
   return false;
 }
+var INTERFACE_LIST_PAIRS = [
+  ["in-interface-list", "in-interface"],
+  ["out-interface-list", "out-interface"]
+];
+var _ifaceLists;
+function interfaceListCovers(aKey, aVal, bKey, bVal) {
+  if (!_ifaceLists)
+    return;
+  for (const [listKey, ifaceKey] of INTERFACE_LIST_PAIRS) {
+    if (aKey === listKey && bKey === ifaceKey) {
+      const negated = aVal.startsWith("!");
+      const listName = negated ? aVal.slice(1) : aVal;
+      const members = _ifaceLists.get(listName);
+      if (!members)
+        return;
+      const isMember = members.has(bVal);
+      return negated ? !isMember : isMember;
+    }
+  }
+  return;
+}
 function aCoversB(a, b) {
   for (const [k, v] of Object.entries(a.match)) {
     const bv = b.match[k];
-    if (bv === undefined || !covers(k, v, bv))
+    if (bv !== undefined) {
+      if (!covers(k, v, bv))
+        return false;
+      continue;
+    }
+    let crossCovered = false;
+    for (const [bk, bval] of Object.entries(b.match)) {
+      const result = interfaceListCovers(k, v, bk, bval);
+      if (result === true) {
+        crossCovered = true;
+        break;
+      }
+    }
+    if (!crossCovered)
       return false;
   }
   return true;
@@ -9448,6 +9482,7 @@ function grade2(score) {
   return "critical";
 }
 function auditFirewall(input) {
+  _ifaceLists = input.interfaceLists;
   const findings = [];
   if (input.filter)
     findings.push(...auditFilter(input.filter));
@@ -9496,6 +9531,25 @@ async function fetchRules(path, ctx) {
     return [];
   return parseRecords(out).rows;
 }
+async function fetchInterfaceListMembers(ctx) {
+  const out = await executeMikrotikCommand("/interface list member print detail", ctx);
+  const members = new Map;
+  if (looksLikeError(out) || isEmpty(out))
+    return members;
+  for (const row of parseRecords(out).rows) {
+    const list = row.list;
+    const iface = row.interface;
+    if (!list || !iface)
+      continue;
+    let set = members.get(list);
+    if (!set) {
+      set = new Set;
+      members.set(list, set);
+    }
+    set.add(iface);
+  }
+  return members;
+}
 var firewallAuditTools = [
   defineTool({
     name: "firewall_audit",
@@ -9510,10 +9564,16 @@ var firewallAuditTools = [
     async handler(a, ctx) {
       const device = resolveDeviceName(ctx.device);
       ctx.info(`Auditing firewall for '${device}'`);
-      const filter = rulesFromRows(await fetchRules("/ip firewall filter", ctx));
-      const nat = a.include_nat ? rulesFromRows(await fetchRules("/ip firewall nat", ctx)) : undefined;
-      const mangle = a.include_mangle ? rulesFromRows(await fetchRules("/ip firewall mangle", ctx)) : undefined;
-      const report = auditFirewall({ filter, nat, mangle });
+      const [filterRows, natRows, mangleRows, interfaceLists] = await Promise.all([
+        fetchRules("/ip firewall filter", ctx),
+        a.include_nat ? fetchRules("/ip firewall nat", ctx) : Promise.resolve(undefined),
+        a.include_mangle ? fetchRules("/ip firewall mangle", ctx) : Promise.resolve(undefined),
+        fetchInterfaceListMembers(ctx)
+      ]);
+      const filter = rulesFromRows(filterRows);
+      const nat = natRows ? rulesFromRows(natRows) : undefined;
+      const mangle = mangleRows ? rulesFromRows(mangleRows) : undefined;
+      const report = auditFirewall({ filter, nat, mangle, interfaceLists });
       const structuredContent = {
         __mikrotikView: "firewall-audit",
         device,
@@ -9978,6 +10038,22 @@ Management access may be partially restricted \u2014 review immediately.`;
 // src/tools/firewall-filter.ts
 import { z as z28 } from "zod";
 var isDigits = (s) => /^\d+$/.test(s);
+async function resolveFilterRuleId(ruleId, ctx) {
+  if (/^\d+$/.test(ruleId)) {
+    const id = `*${ruleId}`;
+    const byId = await executeMikrotikCommand(`/ip firewall filter print count-only where .id=${id}`, ctx);
+    if (byId.trim() !== "0")
+      return id;
+    const idsRaw = await executeMikrotikCommand(`:foreach i in=[/ip firewall filter find] do={:put $i}`, ctx);
+    if (isEmpty(idsRaw))
+      return null;
+    const ids = idsRaw.trim().split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
+    const pos = Number.parseInt(ruleId, 10);
+    return pos >= 0 && pos < ids.length ? ids[pos] : null;
+  }
+  const count = await executeMikrotikCommand(`/ip firewall filter print count-only where .id=${ruleId}`, ctx);
+  return count.trim() !== "0" ? ruleId : null;
+}
 async function updateFilterRule(a, ctx) {
   ctx.info(`Updating firewall filter rule: rule_id=${a.rule_id}`);
   const updates = [];
@@ -10046,7 +10122,9 @@ async function updateFilterRule(a, ctx) {
   }
   if (updates.length === 0)
     return "No updates specified.";
-  const id = /^\d+$/.test(a.rule_id) ? `*${a.rule_id}` : a.rule_id;
+  const id = await resolveFilterRuleId(a.rule_id, ctx);
+  if (!id)
+    return `Firewall filter rule '${a.rule_id}' not found.`;
   const cmd = `/ip firewall filter set ${id} ${updates.join(" ")}`;
   const result = await executeMikrotikCommand(cmd, ctx);
   if (looksLikeError(result))
@@ -10190,7 +10268,7 @@ ${details}`;
         filters.push("invalid=yes");
       if (a.dynamic_only)
         filters.push("dynamic=yes");
-      const result = await executeMikrotikCommand(`/ip firewall filter print${whereClause(filters)}`, ctx);
+      const result = await executeMikrotikCommand(`/ip firewall filter print detail${whereClause(filters)}`, ctx);
       return isEmpty(result) ? "No firewall filter rules found matching the criteria." : `FIREWALL FILTER RULES:
 
 ${result}`;
@@ -10200,15 +10278,17 @@ ${result}`;
     name: "get_filter_rule",
     title: "Get Firewall Filter Rule",
     annotations: READ,
-    description: "Gets the full detail of one IPv4 firewall FILTER rule (`/ip firewall filter`) by id \u2014 " + "every matcher, action, counter and flag. For IPv6 use get_ipv6_filter_rule. " + 'rule_id: the `.id` from list_filter_rules e.g. "*1" or "0".',
+    description: "Gets the full detail of one IPv4 firewall FILTER rule (`/ip firewall filter`) by id \u2014 " + "every matcher, action, counter and flag. For IPv6 use get_ipv6_filter_rule. " + 'rule_id: preferably the `.id` from list_filter_rules e.g. "*1F". A bare number like "3" ' + "is tried as `.id=*3` first, then as the positional row index if no `.id` matches.",
     inputSchema: {
-      rule_id: z28.string().describe('Rule ID from list output e.g. "*1" or "0"')
+      rule_id: z28.string().describe('Rule .id e.g. "*1F", or bare position number e.g. "3"')
     },
     async handler(a, ctx) {
       ctx.info(`Getting firewall filter rule details: rule_id=${a.rule_id}`);
-      const id = /^\d+$/.test(a.rule_id) ? `*${a.rule_id}` : a.rule_id;
+      const id = await resolveFilterRuleId(a.rule_id, ctx);
+      if (!id)
+        return `Firewall filter rule '${a.rule_id}' not found.`;
       const result = await executeMikrotikCommand(`/ip firewall filter print detail where .id=${id}`, ctx);
-      return isEmpty(result) ? `Firewall filter rule with ID '${a.rule_id}' not found.` : `FIREWALL FILTER RULE DETAILS:
+      return isEmpty(result) ? `Firewall filter rule '${a.rule_id}' not found.` : `FIREWALL FILTER RULE DETAILS:
 
 ${result}`;
     }
@@ -10283,14 +10363,13 @@ ${result}`;
     inputSchema: { rule_id: z28.string() },
     async handler(a, ctx) {
       ctx.info(`Removing firewall filter rule: rule_id=${a.rule_id}`);
-      const id = /^\d+$/.test(a.rule_id) ? `*${a.rule_id}` : a.rule_id;
-      const count = await executeMikrotikCommand(`/ip firewall filter print count-only where .id=${id}`, ctx);
-      if (count.trim() === "0")
-        return `Firewall filter rule with ID '${a.rule_id}' not found.`;
+      const id = await resolveFilterRuleId(a.rule_id, ctx);
+      if (!id)
+        return `Firewall filter rule '${a.rule_id}' not found.`;
       const result = await executeMikrotikCommand(`/ip firewall filter remove ${id}`, ctx);
       if (looksLikeError(result))
         return `Failed to remove firewall filter rule: ${result}`;
-      return `Firewall filter rule with ID '${a.rule_id}' removed successfully.`;
+      return `Firewall filter rule '${a.rule_id}' (${id}) removed successfully.`;
     }
   }),
   defineTool({
@@ -10304,14 +10383,13 @@ ${result}`;
     },
     async handler(a, ctx) {
       ctx.info(`Moving firewall filter rule: rule_id=${a.rule_id} to position ${a.destination}`);
-      const id = /^\d+$/.test(a.rule_id) ? `*${a.rule_id}` : a.rule_id;
-      const count = await executeMikrotikCommand(`/ip firewall filter print count-only where .id=${id}`, ctx);
-      if (count.trim() === "0")
-        return `Firewall filter rule with ID '${a.rule_id}' not found.`;
+      const id = await resolveFilterRuleId(a.rule_id, ctx);
+      if (!id)
+        return `Firewall filter rule '${a.rule_id}' not found.`;
       const result = await executeMikrotikCommand(`/ip firewall filter move ${id} destination=${a.destination}`, ctx);
       if (looksLikeError(result))
         return `Failed to move firewall filter rule: ${result}`;
-      return `Firewall filter rule with ID '${a.rule_id}' moved to position ${a.destination}.`;
+      return `Firewall filter rule '${a.rule_id}' (${id}) moved to position ${a.destination}.`;
     }
   }),
   defineTool({
@@ -20587,13 +20665,27 @@ function analyzeRootCause(data) {
     }
   }
   if (downInterfaces.length === 0 && errorInterfaces.length === 0) {
+    if (data.interfaces.length === 0) {
+      evidence.push({
+        dimension: "interfaces",
+        severity: "warning",
+        summary: "Interface data unavailable \u2014 the device returned no parseable interface records. " + "Run `/interface print detail` manually to verify."
+      });
+    } else {
+      evidence.push({
+        dimension: "interfaces",
+        severity: "ok",
+        summary: `All ${data.interfaces.length} interfaces healthy`
+      });
+    }
+  }
+  if (data.routeCount === 0) {
     evidence.push({
-      dimension: "interfaces",
-      severity: "ok",
-      summary: `All ${data.interfaces.length} interfaces healthy`
+      dimension: "routing",
+      severity: "warning",
+      summary: "Route data unavailable \u2014 the device returned no parseable route records. " + "Run `/ip route print detail` manually to verify."
     });
-  }
-  if (!data.defaultRouteExists) {
+  } else if (!data.defaultRouteExists) {
     evidence.push({
       dimension: "routing",
       severity: "critical",
@@ -20606,7 +20698,7 @@ function analyzeRootCause(data) {
       summary: `Default route present, ${data.routeCount} total routes`
     });
   }
-  const ospfDown = data.ospfNeighbors.filter((n) => n.state.toLowerCase() !== "full");
+  const ospfDown = data.ospfNeighbors.filter((n) => (n.id || n.address) && n.state.toLowerCase() !== "full");
   for (const n of ospfDown) {
     evidence.push({
       dimension: "routing",
@@ -20615,7 +20707,7 @@ function analyzeRootCause(data) {
       reference: n.id
     });
   }
-  const bgpDown = data.bgpPeers.filter((p) => !p.state.toLowerCase().includes("established"));
+  const bgpDown = data.bgpPeers.filter((p) => (p.id || p.address) && !p.state.toLowerCase().includes("established"));
   for (const p of bgpDown) {
     evidence.push({
       dimension: "routing",
@@ -20718,7 +20810,13 @@ function analyzeRootCause(data) {
       summary: "No DNS servers configured"
     });
   }
-  if (data.cpuLoad > 90) {
+  if (data.cpuLoad === 0 && data.memoryUsedPct === 0 && !data.rosVersion && !data.uptime) {
+    evidence.push({
+      dimension: "resources",
+      severity: "warning",
+      summary: "System resource data unavailable \u2014 CPU 0%, memory 0%, no version or uptime. " + "The `/system resource print` output may not have been parsed correctly."
+    });
+  } else if (data.cpuLoad > 90) {
     evidence.push({
       dimension: "resources",
       severity: "critical",
@@ -20737,24 +20835,26 @@ function analyzeRootCause(data) {
       summary: `CPU load: ${data.cpuLoad}%`
     });
   }
-  if (data.memoryUsedPct > 90) {
-    evidence.push({
-      dimension: "resources",
-      severity: "critical",
-      summary: `Memory critically low: ${data.memoryUsedPct}% used`
-    });
-  } else if (data.memoryUsedPct > 75) {
-    evidence.push({
-      dimension: "resources",
-      severity: "warning",
-      summary: `Memory pressure: ${data.memoryUsedPct}% used`
-    });
-  } else {
-    evidence.push({
-      dimension: "resources",
-      severity: "ok",
-      summary: `Memory: ${data.memoryUsedPct}% used`
-    });
+  if (data.rosVersion || data.uptime || data.cpuLoad > 0 || data.memoryUsedPct > 0) {
+    if (data.memoryUsedPct > 90) {
+      evidence.push({
+        dimension: "resources",
+        severity: "critical",
+        summary: `Memory critically low: ${data.memoryUsedPct}% used`
+      });
+    } else if (data.memoryUsedPct > 75) {
+      evidence.push({
+        dimension: "resources",
+        severity: "warning",
+        summary: `Memory pressure: ${data.memoryUsedPct}% used`
+      });
+    } else {
+      evidence.push({
+        dimension: "resources",
+        severity: "ok",
+        summary: `Memory: ${data.memoryUsedPct}% used`
+      });
+    }
   }
   const errorLogs = data.relevantLogs.filter((l) => l.topics.includes("error") || l.topics.includes("critical") || l.topics.includes("warning"));
   const firewallLogs = data.relevantLogs.filter((l) => l.topics.includes("firewall"));
@@ -20791,14 +20891,24 @@ function analyzeRootCause(data) {
       summary: "No concerning log entries in the last 10 minutes"
     });
   }
+  const isServerBinding = (t) => /-(in|server)$/.test(t.type) || t.name.startsWith("<");
   const downTunnels = data.tunnelInterfaces.filter((t) => !t.running && !t.disabled);
   for (const t of downTunnels) {
-    evidence.push({
-      dimension: "vpn",
-      severity: "critical",
-      summary: `Tunnel ${t.name} (${t.type}) is down`,
-      reference: t.name
-    });
+    if (isServerBinding(t)) {
+      evidence.push({
+        dimension: "vpn",
+        severity: "info",
+        summary: `Server binding ${t.name} (${t.type}) is idle \u2014 no active client session`,
+        reference: t.name
+      });
+    } else {
+      evidence.push({
+        dimension: "vpn",
+        severity: "critical",
+        summary: `Tunnel ${t.name} (${t.type}) is down`,
+        reference: t.name
+      });
+    }
   }
   if (data.tunnelInterfaces.length > 0 && downTunnels.length === 0) {
     evidence.push({
@@ -20808,6 +20918,19 @@ function analyzeRootCause(data) {
     });
   }
   correlateRootCauses(data, evidence, rootCauses);
+  if (data.ping && data.ping.lossPct === 0) {
+    const contradicted = new Set([
+      "Missing default route",
+      "Missing source NAT / masquerade",
+      "Interface link failure"
+    ]);
+    for (const rc of rootCauses) {
+      if (contradicted.has(rc.cause) && rc.confidence !== "low") {
+        rc.confidence = "low";
+        rc.explanation += " (Note: ping to the target succeeded with 0% loss, which contradicts this hypothesis.)";
+      }
+    }
+  }
   rootCauses.sort((a, b) => CONFIDENCE_RANK[a.confidence] - CONFIDENCE_RANK[b.confidence]);
   const dimensionSummary = ALL_DIMENSIONS.map((dim) => {
     const dimEvidence = evidence.filter((e) => e.dimension === dim);
@@ -20946,14 +21069,15 @@ function correlateRootCauses(data, evidence, causes) {
       });
     }
   }
-  const downTunnels = data.tunnelInterfaces.filter((t) => !t.running && !t.disabled);
-  if (downTunnels.length > 0) {
+  const isServerTunnel = (t) => /-(in|server)$/.test(t.type) || t.name.startsWith("<");
+  const realDownTunnels = data.tunnelInterfaces.filter((t) => !t.running && !t.disabled && !isServerTunnel(t));
+  if (realDownTunnels.length > 0) {
     causes.push({
       cause: "VPN/tunnel interface down",
-      explanation: `Tunnel(s) ${downTunnels.map((t) => `${t.name} (${t.type})`).join(", ")} are down. ` + "Traffic destined for remote networks over these tunnels will be black-holed.",
+      explanation: `Tunnel(s) ${realDownTunnels.map((t) => `${t.name} (${t.type})`).join(", ")} are down. ` + "Traffic destined for remote networks over these tunnels will be black-holed.",
       confidence: "high",
       evidence: evidence.filter((e) => e.dimension === "vpn" && e.severity === "critical"),
-      fixes: downTunnels.map((t) => `/interface enable [find name="${t.name}"]`),
+      fixes: realDownTunnels.map((t) => `/interface enable [find name="${t.name}"]`),
       dimensions: ["vpn"]
     });
   }
@@ -21182,7 +21306,7 @@ async function collectRoutes(ctx) {
 }
 async function collectOspfNeighbors(ctx) {
   const raw = await safe("/routing ospf neighbor print detail", ctx);
-  if (!raw)
+  if (!raw || isEmpty(raw))
     return [];
   return parseRecords(raw).rows.map((r) => ({
     id: r["neighbor-id"] ?? r.router ?? "",
@@ -21190,13 +21314,13 @@ async function collectOspfNeighbors(ctx) {
     state: r.state ?? "",
     interface: r.interface ?? "",
     uptime: r.uptime
-  }));
+  })).filter((n) => n.id || n.address);
 }
 async function collectBgpPeers(ctx) {
   const raw = await safe("/routing bgp session print detail", ctx);
-  if (!raw) {
+  if (!raw || isEmpty(raw)) {
     const raw2 = await safe("/routing bgp peer print detail", ctx);
-    if (!raw2)
+    if (!raw2 || isEmpty(raw2))
       return [];
     return parseRecords(raw2).rows.map((r) => ({
       id: r.name ?? "",
@@ -21204,7 +21328,7 @@ async function collectBgpPeers(ctx) {
       state: r.state ?? "",
       interface: r.interface ?? "",
       uptime: r.uptime
-    }));
+    })).filter((p) => p.id || p.address);
   }
   return parseRecords(raw).rows.map((r) => ({
     id: r.name ?? r["remote.address"] ?? "",
@@ -21212,7 +21336,7 @@ async function collectBgpPeers(ctx) {
     state: r.state ?? r.established ?? "",
     interface: r.interface ?? "",
     uptime: r.uptime
-  }));
+  })).filter((p) => p.id || p.address);
 }
 async function collectFirewallRules(target, ctx) {
   const raw = await safe("/ip firewall filter print detail", ctx);
@@ -21312,7 +21436,7 @@ async function collectDiagnosticData(target, ctx, dimensions) {
     arpEntries,
     dhcpLeases,
     dnsResult,
-    dnsSettingsRaw,
+    dnsSettingsParts,
     resourceRaw,
     logs,
     tunnels
@@ -21328,13 +21452,17 @@ async function collectDiagnosticData(target, ctx, dimensions) {
     dims.has("arp_dhcp") ? collectArp(ctx) : Promise.resolve([]),
     dims.has("arp_dhcp") ? collectDhcpLeases(ctx) : Promise.resolve([]),
     dims.has("dns") && !isIpLike(target) ? safe(`[:resolve ${quoteValue(target)}]`, ctx) : Promise.resolve(undefined),
-    dims.has("dns") ? safe("/ip dns print", ctx) : Promise.resolve(""),
+    dims.has("dns") ? Promise.all([
+      safe(":put [/ip dns get servers]", ctx),
+      safe(":put [/ip dns get dynamic-servers]", ctx),
+      safe(":put [/ip dns get allow-remote-requests]", ctx)
+    ]) : Promise.resolve(["", "", ""]),
     dims.has("resources") ? safe("/system resource print", ctx) : Promise.resolve(""),
     dims.has("logs") ? collectLogs(target, ctx) : Promise.resolve([]),
     dims.has("vpn") ? collectTunnels(ctx) : Promise.resolve([])
   ]);
   const ping = pingResult ? parsePingSummary(pingResult) ?? undefined : undefined;
-  const dnsKv = parseKeyValues(dnsSettingsRaw);
+  const [dnsServersRaw, dnsDynamicRaw, dnsAllowRemoteRaw] = dnsSettingsParts;
   const resKv = parseKeyValues(resourceRaw);
   const totalMem = parseSize(resKv["total-memory"]) ?? 0;
   const freeMem = parseSize(resKv["free-memory"]) ?? 0;
@@ -21356,8 +21484,8 @@ async function collectDiagnosticData(target, ctx, dimensions) {
     arpEntries,
     dhcpLeases,
     dnsResolveResult: dnsResult ?? undefined,
-    dnsServers: [dnsKv.servers, dnsKv["dynamic-servers"]].filter(Boolean).join(",") || "",
-    dnsAllowRemote: (dnsKv["allow-remote-requests"] ?? "").toLowerCase() === "yes",
+    dnsServers: [dnsServersRaw.trim(), dnsDynamicRaw.trim()].filter(Boolean).join(",") || "",
+    dnsAllowRemote: dnsAllowRemoteRaw.trim().toLowerCase() === "yes" || dnsAllowRemoteRaw.trim().toLowerCase() === "true",
     cpuLoad: parsePercent(resKv["cpu-load"]) ?? 0,
     memoryUsedPct: memUsedPct,
     uptime: resKv.uptime ?? "",

package/dist/shared/{library-84y0nvhr.js → library-cs13jqp9.js}

@@ -4,7 +4,7 @@ import {
   allToolModules,
   moduleCatalog,
   selectToolModules
-} from "./library-hk90ad18.js";
+} from "./library-83q9t27c.js";
 export {
   selectToolModules,
   moduleCatalog,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usex/mikrotik-mcp",
-  "version": "3.54.0",
+  "version": "3.55.0",
   "description": "MCP server for MikroTik RouterOS — 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   "keywords": [
     "ai",