@usex/mikrotik-mcp 3.6.0 → 3.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usex/mikrotik-mcp",
-  "version": "3.6.0",
+  "version": "3.8.0",
   "description": "MCP server for MikroTik RouterOS — 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   "keywords": [
     "ai",

package/schemas/README.md

@@ -7,7 +7,7 @@ edit by hand — regenerate instead.
 | File                 | Contents                                                                                   |
 | -------------------- | ------------------------------------------------------------------------------------------ |
 | `config.schema.json` | The runtime configuration object (env vars / CLI flags).                                   |
-| `tool-catalog.json`  | Every one of the 693 tools: `name`, `risk`, `title`, `description`, and input JSON Schema. |
+| `tool-catalog.json`  | Every one of the 706 tools: `name`, `risk`, `title`, `description`, and input JSON Schema. |
 | `tools/<name>.json`  | The input JSON Schema for a single tool.                                                   |
 
 `risk` is derived from the MCP tool annotations:

package/schemas/config.schema.json

@@ -161,7 +161,7 @@
         "enabled": false,
         "host": "0.0.0.0",
         "port": 9090,
-        "dbPath": "./.mikrotik-mcp/events.db",
+        "dbPath": "/Users/alimaster/.mikrotik-mcp/events.db",
         "maxEvents": 100000,
         "captureBody": true,
         "redactInput": false,
@@ -184,7 +184,7 @@
           "maximum": 9007199254740991
         },
         "dbPath": {
-          "default": "./.mikrotik-mcp/events.db",
+          "default": "/Users/alimaster/.mikrotik-mcp/events.db",
           "type": "string"
         },
         "maxEvents": {
@@ -227,10 +227,51 @@
       "default": false,
       "type": "boolean"
     },
+    "tools": {
+      "default": {
+        "enabledModules": [],
+        "disabledModules": [],
+        "enabledGroups": [],
+        "disabledGroups": []
+      },
+      "type": "object",
+      "properties": {
+        "enabledModules": {
+          "default": [],
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "disabledModules": {
+          "default": [],
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "enabledGroups": {
+          "default": [],
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "disabledGroups": {
+          "default": [],
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      },
+      "required": ["enabledModules", "disabledModules", "enabledGroups", "disabledGroups"],
+      "additionalProperties": false
+    },
     "backupDir": {
       "type": "string"
     }
   },
-  "required": ["devices", "defaultDevice", "mcp", "dashboard", "readOnly"],
+  "required": ["devices", "defaultDevice", "mcp", "dashboard", "readOnly", "tools"],
   "additionalProperties": false
 }

package/schemas/tool-catalog.json

@@ -1,8 +1,8 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "version": "3.5.0",
+  "version": "3.7.0",
   "generated": "by scripts/gen-schemas.ts — do not edit by hand",
-  "toolCount": 693,
+  "toolCount": 706,
   "tools": [
     {
       "name": "list_interfaces",
@@ -2942,6 +2942,175 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "list_dhcp_clients",
+      "title": "List DHCP Clients",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Lists IPv4 DHCP clients (`/ip dhcp-client print`) — each interface configured to obtain its address/gateway/DNS from an upstream DHCP server (typically a WAN port). Shows the bound address, status, and whether a default route / peer DNS is used. Optional `interface_filter`. For one client's detail use get_dhcp_client; to add one use add_dhcp_client.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "interface_filter": {
+            "description": "Substring match on interface",
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "get_dhcp_client",
+      "title": "Get DHCP Client Detail",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Full detail for the DHCP client on an interface (`/ip dhcp-client print detail where interface=...`) — bound address, gateway, lease time, status, and options. Use list_dhcp_clients to find interfaces. Returns the detail block or a not-found message.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "interface": {
+            "type": "string",
+            "description": "Interface name, e.g. 'ether1'"
+          }
+        },
+        "required": ["interface"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "add_dhcp_client",
+      "title": "Add DHCP Client",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Adds an IPv4 DHCP client on an interface (`/ip dhcp-client add`) so it obtains an address from an upstream DHCP server — the usual way to configure a WAN port. `add_default_route` installs the received gateway; `use_peer_dns`/`use_peer_ntp` adopt the server's DNS/NTP. Returns the created client's detail.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "interface": {
+            "type": "string",
+            "description": "Interface to run the DHCP client on, e.g. 'ether1'"
+          },
+          "add_default_route": {
+            "default": true,
+            "description": "Install the received default gateway",
+            "type": "boolean"
+          },
+          "use_peer_dns": {
+            "default": true,
+            "type": "boolean"
+          },
+          "use_peer_ntp": {
+            "default": true,
+            "type": "boolean"
+          },
+          "disabled": {
+            "default": false,
+            "type": "boolean"
+          },
+          "comment": {
+            "type": "string"
+          }
+        },
+        "required": ["interface", "add_default_route", "use_peer_dns", "use_peer_ntp", "disabled"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "set_dhcp_client",
+      "title": "Update DHCP Client",
+      "risk": "write-idempotent",
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Updates the DHCP client on an interface (`/ip dhcp-client set [find interface=...]`) — toggle `add_default_route`, `use_peer_dns`, `use_peer_ntp`, or `disabled`. No-ops if nothing is supplied. Returns the updated detail.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "interface": {
+            "type": "string"
+          },
+          "add_default_route": {
+            "type": "boolean"
+          },
+          "use_peer_dns": {
+            "type": "boolean"
+          },
+          "use_peer_ntp": {
+            "type": "boolean"
+          },
+          "disabled": {
+            "type": "boolean"
+          }
+        },
+        "required": ["interface"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "renew_dhcp_client",
+      "title": "Renew / Release DHCP Lease",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Renews or releases the DHCP lease on an interface (`/ip dhcp-client renew|release`). `release=true` drops the current lease; otherwise it renews — use to re-pull WAN settings after an upstream change. Returns the client status afterward.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "interface": {
+            "type": "string"
+          },
+          "release": {
+            "default": false,
+            "description": "true = release the lease; false = renew",
+            "type": "boolean"
+          }
+        },
+        "required": ["interface", "release"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "remove_dhcp_client",
+      "title": "Remove DHCP Client",
+      "risk": "destructive",
+      "annotations": {
+        "destructiveHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Removes the DHCP client from an interface (`/ip dhcp-client remove [find interface=...]`) — the interface stops obtaining an address from DHCP (set a static address separately if needed). Confirms removal or reports not-found.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "interface": {
+            "type": "string"
+          }
+        },
+        "required": ["interface"],
+        "additionalProperties": false
+      }
+    },
     {
       "name": "build_guest_hotspot",
       "title": "Build Guest Hotspot (Captive Portal)",
@@ -10989,7 +11158,7 @@
         "idempotentHint": true,
         "openWorldHint": false
       },
-      "description": "Updates one or more attributes of a router management service (`/ip service set`) — port number, allowed source subnets (`address`, comma-separated CIDRs), TLS certificate name, or enabled/disabled state (`disabled: true/false`). Accepts a service name such as `ssh`, `winbox`, `api`, or `api-ssl`. To toggle only the enabled state use `enable_ip_service` or `disable_ip_service` instead. Returns updated service detail on success.",
+      "description": "Updates one or more attributes of a router management service (`/ip service set`) — port number, allowed source subnets (`address`, comma-separated CIDRs), TLS certificate name, or enabled/disabled state (`disabled: true/false`). Accepts a service name such as `ssh`, `winbox`, `api`, or `api-ssl`. Note: two services cannot share a port — if the chosen port is already used by another service the device rejects it (list_ip_services shows current ports). To toggle only the enabled state use `enable_ip_service` or `disable_ip_service` instead. Returns updated service detail on success.",
       "inputSchema": {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "type": "object",
@@ -11067,6 +11236,88 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "get_ip_cloud",
+      "title": "Get IP Cloud (DDNS) Status",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Reads the RouterOS cloud DDNS status (`/ip cloud print`) — whether `ddns-enabled` is on, the assigned `dns-name` (`<serial>.sn.mynetname.net`), the detected public IPv4/IPv6 address, the last `update-time`, and the service `status`/warnings. Use this to find the router's stable cloud hostname or check why DDNS isn't updating. To change it use set_ip_cloud; to push an update now use force_cloud_update. Returns the full cloud status block.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {},
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "set_ip_cloud",
+      "title": "Configure IP Cloud (DDNS)",
+      "risk": "write-idempotent",
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Configures RouterOS cloud DDNS (`/ip cloud set`). Enable/disable the dynamic DNS name with `ddns_enabled`, optionally also sync the router clock from the cloud with `update_time`. When enabled the router registers a `<serial>.sn.mynetname.net` name that follows its public IP. To read the resulting name/status use get_ip_cloud; to force an immediate refresh use force_cloud_update; for the local-vs-public address behaviour use set_ip_cloud_advanced. Returns the updated cloud status.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "ddns_enabled": {
+            "description": "Enable (true) or disable (false) the DDNS name",
+            "type": "boolean"
+          },
+          "update_time": {
+            "description": "Also sync the router clock from the cloud",
+            "type": "boolean"
+          }
+        },
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "force_cloud_update",
+      "title": "Force IP Cloud DDNS Update",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Forces an immediate cloud DDNS refresh (`/ip cloud force-update`) — pushes the router's current public IP to the cloud now instead of waiting for the next scheduled update. Use after a WAN IP change or to test connectivity to the cloud service. Requires DDNS to be enabled (see set_ip_cloud). Returns the cloud status after the update.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {},
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "set_ip_cloud_advanced",
+      "title": "Set IP Cloud Advanced Options",
+      "risk": "write-idempotent",
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Sets advanced cloud options (`/ip cloud advanced set`). `use_local_address=true` makes the cloud DDNS publish the router's LOCAL address instead of the detected public one (useful behind a private WAN / when you reach the router over a VPN). For the main DDNS toggle use set_ip_cloud. Returns the updated cloud status.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "use_local_address": {
+            "type": "boolean",
+            "description": "Publish the local address (true) instead of the public address (false)"
+          }
+        },
+        "required": ["use_local_address"],
+        "additionalProperties": false
+      }
+    },
     {
       "name": "add_dot1x_server",
       "title": "Add 802.1X Server (Authenticator) Entry",
@@ -17299,6 +17550,108 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "test_ssh_to_device",
+      "title": "Test SSH to a Configured Device (from the MCP host)",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Tests the SSH connection FROM THE MACHINE RUNNING THIS MCP SERVER to a CONFIGURED device, using that device's stored host/port/credentials. Use this to diagnose why a saved device is not responding — it confirms whether the MCP host can reach the device's SSH port AND authenticate, and reports the connect latency and identity. Targets the selected/default device (the `device` selector). NOTE: this opens a real SSH connection from the MCP host, not through the usual command channel, and is SSH-only (a MAC-Telnet device has no SSH). To test an UNSAVED host with ad-hoc credentials use test_ssh_to_host; to test SSH OUTBOUND from a router use test_ssh_from_device. Returns OK/failed with the reason.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {},
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "test_ssh_to_host",
+      "title": "Test SSH to Any Host (from the MCP host)",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Tests an SSH connection FROM THE MACHINE RUNNING THIS MCP SERVER to an ARBITRARY host:port with the supplied credentials — a pre-flight check BEFORE adding a device to the config, or to verify reachability/credentials for any SSH host. Confirms TCP reachability AND authentication and reports the connect latency. Provide a `password` and/or a private-key path (`key_path`). NOTE: this opens a real SSH connection from the MCP host. For a device that is ALREADY configured use test_ssh_to_device; to test SSH outbound FROM a router use test_ssh_from_device. Returns OK/failed with the reason.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "host": {
+            "type": "string",
+            "description": "Target IP or hostname"
+          },
+          "port": {
+            "default": 22,
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 65535
+          },
+          "username": {
+            "type": "string"
+          },
+          "password": {
+            "description": "Password auth (omit if using a key)",
+            "type": "string"
+          },
+          "key_path": {
+            "description": "Path (on the MCP host) to a private key file",
+            "type": "string"
+          },
+          "key_passphrase": {
+            "type": "string"
+          },
+          "command": {
+            "default": "/system identity print",
+            "description": "Command to run once connected (a harmless RouterOS read by default)",
+            "type": "string"
+          }
+        },
+        "required": ["host", "port", "username", "command"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "test_ssh_from_device",
+      "title": "Test SSH Outbound From a RouterOS Device",
+      "risk": "write",
+      "annotations": {
+        "destructiveHint": false,
+        "openWorldHint": false
+      },
+      "description": "Tests SSH OUTBOUND FROM a RouterOS device to a remote host using the device's OWN SSH client (`/system ssh-exec`) — i.e. the connection is made BY the router, not by the MCP host. Use this to check whether a router can reach and log into another host over SSH (e.g. a jump path or another router). The router's user must be able to authenticate to the target NON-interactively (a stored key on the router) — a password-only target will prompt and time out. Runs the test `command` on the remote and returns its output. To test the MCP HOST's connection to a device instead, use test_ssh_to_device (configured) or test_ssh_to_host (ad-hoc). Returns the remote command output or the device's error.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "host": {
+            "type": "string",
+            "description": "Remote host the ROUTER should SSH to"
+          },
+          "port": {
+            "default": 22,
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 65535
+          },
+          "user": {
+            "type": "string",
+            "description": "Username on the remote host"
+          },
+          "command": {
+            "default": "/system identity print",
+            "description": "Command to run on the remote host as the connectivity test",
+            "type": "string"
+          }
+        },
+        "required": ["host", "port", "user", "command"],
+        "additionalProperties": false
+      }
+    },
     {
       "name": "list_neighbors",
       "title": "List Discovered Neighbor Devices (MNDP/CDP/LLDP)",

package/schemas/tools/add_dhcp_client.json

@@ -0,0 +1,33 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "add_dhcp_client",
+  "type": "object",
+  "properties": {
+    "interface": {
+      "type": "string",
+      "description": "Interface to run the DHCP client on, e.g. 'ether1'"
+    },
+    "add_default_route": {
+      "default": true,
+      "description": "Install the received default gateway",
+      "type": "boolean"
+    },
+    "use_peer_dns": {
+      "default": true,
+      "type": "boolean"
+    },
+    "use_peer_ntp": {
+      "default": true,
+      "type": "boolean"
+    },
+    "disabled": {
+      "default": false,
+      "type": "boolean"
+    },
+    "comment": {
+      "type": "string"
+    }
+  },
+  "required": ["interface", "add_default_route", "use_peer_dns", "use_peer_ntp", "disabled"],
+  "additionalProperties": false
+}

package/schemas/tools/force_cloud_update.json

@@ -0,0 +1,7 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "force_cloud_update",
+  "type": "object",
+  "properties": {},
+  "additionalProperties": false
+}

package/schemas/tools/get_dhcp_client.json

@@ -0,0 +1,13 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "get_dhcp_client",
+  "type": "object",
+  "properties": {
+    "interface": {
+      "type": "string",
+      "description": "Interface name, e.g. 'ether1'"
+    }
+  },
+  "required": ["interface"],
+  "additionalProperties": false
+}

package/schemas/tools/get_ip_cloud.json

@@ -0,0 +1,7 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "get_ip_cloud",
+  "type": "object",
+  "properties": {},
+  "additionalProperties": false
+}

package/schemas/tools/list_dhcp_clients.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "list_dhcp_clients",
+  "type": "object",
+  "properties": {
+    "interface_filter": {
+      "description": "Substring match on interface",
+      "type": "string"
+    }
+  },
+  "additionalProperties": false
+}

package/schemas/tools/remove_dhcp_client.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "remove_dhcp_client",
+  "type": "object",
+  "properties": {
+    "interface": {
+      "type": "string"
+    }
+  },
+  "required": ["interface"],
+  "additionalProperties": false
+}

package/schemas/tools/renew_dhcp_client.json

@@ -0,0 +1,17 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "renew_dhcp_client",
+  "type": "object",
+  "properties": {
+    "interface": {
+      "type": "string"
+    },
+    "release": {
+      "default": false,
+      "description": "true = release the lease; false = renew",
+      "type": "boolean"
+    }
+  },
+  "required": ["interface", "release"],
+  "additionalProperties": false
+}

package/schemas/tools/set_dhcp_client.json

@@ -0,0 +1,24 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "set_dhcp_client",
+  "type": "object",
+  "properties": {
+    "interface": {
+      "type": "string"
+    },
+    "add_default_route": {
+      "type": "boolean"
+    },
+    "use_peer_dns": {
+      "type": "boolean"
+    },
+    "use_peer_ntp": {
+      "type": "boolean"
+    },
+    "disabled": {
+      "type": "boolean"
+    }
+  },
+  "required": ["interface"],
+  "additionalProperties": false
+}

package/schemas/tools/set_ip_cloud.json

@@ -0,0 +1,16 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "set_ip_cloud",
+  "type": "object",
+  "properties": {
+    "ddns_enabled": {
+      "description": "Enable (true) or disable (false) the DDNS name",
+      "type": "boolean"
+    },
+    "update_time": {
+      "description": "Also sync the router clock from the cloud",
+      "type": "boolean"
+    }
+  },
+  "additionalProperties": false
+}

package/schemas/tools/set_ip_cloud_advanced.json

@@ -0,0 +1,13 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "set_ip_cloud_advanced",
+  "type": "object",
+  "properties": {
+    "use_local_address": {
+      "type": "boolean",
+      "description": "Publish the local address (true) instead of the public address (false)"
+    }
+  },
+  "required": ["use_local_address"],
+  "additionalProperties": false
+}