@usex/mikrotik-mcp 3.7.0 → 3.8.0

package/README.md

@@ -1,21 +1,21 @@
 <div align="center">
   <img src="assets/logo.svg" alt="@usex/mikrotik-mcp" width="440" />
-  <p><strong>A Bun-native MCP server that turns one or more MikroTik routers into 640 tools your AI can drive.</strong><br/>
+  <p><strong>A Bun-native MCP server that turns one or more MikroTik routers into 706 tools your AI can drive.</strong><br/>
   Firewall · routing · DHCP/DNS · wireless · QoS · and a complete VPN suite — over SSH, with transactional Safe Mode.</p>
 
   <p>
     <a href="LICENSE"><img alt="License: MIT" src="https://img.shields.io/badge/License-MIT-7C3AED.svg"></a>
     <img alt="Runtime: Bun" src="https://img.shields.io/badge/runtime-Bun%20%E2%89%A5%201.3-06B6D4.svg">
     <img alt="TypeScript" src="https://img.shields.io/badge/TypeScript-strict-6366F1.svg">
-    <img alt="MCP" src="https://img.shields.io/badge/MCP-640%20tools-1F2937.svg">
+    <img alt="MCP" src="https://img.shields.io/badge/MCP-706%20tools-1F2937.svg">
     <a href="docs/"><img alt="Docs" src="https://img.shields.io/badge/docs-reference-7C3AED.svg"></a>
   </p>
 </div>
 
 ---
 
-`@usex/mikrotik-mcp` exposes **MikroTik RouterOS** as **640 [Model Context Protocol](https://modelcontextprotocol.io)
-tools across 51 modules**, so an AI client (Claude Desktop, Claude Code, any MCP
+`@usex/mikrotik-mcp` exposes **MikroTik RouterOS** as **706 [Model Context Protocol](https://modelcontextprotocol.io)
+tools across 111 modules**, so an AI client (Claude Desktop, Claude Code, any MCP
 client) can read and configure your router in plain language. It speaks to the
 device over **SSH** — no agent, no API package to install on RouterOS — runs on
 **[Bun](https://bun.sh)**, and validates every tool call against a Zod schema.
@@ -46,7 +46,7 @@ in memory and auto-reverts if your session drops, so you can't lock yourself out
 
 ## Why it's different
 
-- 🧰 **Breadth** — 640 tools covering the whole device: L2 (bridge, VLAN, wireless,
+- 🧰 **Breadth** — 706 tools covering the whole device: L2 (bridge, VLAN, wireless,
   PoE), L3 (addressing, routing, DHCP, DNS), security (firewall, NAT, address-lists,
   certificates), QoS (queues), and system ops (users, logs, backups, scheduler).
 - 🔐 **A complete VPN suite** — WireGuard, IPsec (IKEv1/IKEv2), L2TP, PPTP, SSTP,
@@ -87,7 +87,7 @@ mikrotik-mcp serve
 against the server (from source):
 
 ```bash
-bun run inspect        # opens the Inspector UI to browse/run all 640 tools
+bun run inspect        # opens the Inspector UI to browse/run all 706 tools
 ```
 
 **Prefer SSH keys over a password?** Point the server at a key file instead — and
@@ -115,7 +115,7 @@ bun run build            # bundle to dist/
 
 ## The tool catalog
 
-**640 tools across 51 modules.** Full, always-current reference (parameters +
+**706 tools across 111 modules.** Full, always-current reference (parameters +
 risk per tool) is generated from source: **[docs/tools-reference.md](docs/tools-reference.md)**.
 
 | Group                    | Tools | Modules                                                                                                    |

package/dist/cli.js

@@ -60,6 +60,12 @@ var DashboardConfigSchema = z.object({
   maxBodyBytes: z.coerce.number().int().nonnegative().default(16384),
   token: z.string().optional()
 });
+var ToolFilterSchema = z.object({
+  enabledModules: z.array(z.string()).default([]),
+  disabledModules: z.array(z.string()).default([]),
+  enabledGroups: z.array(z.string()).default([]),
+  disabledGroups: z.array(z.string()).default([])
+});
 var MikrotikConfigSchema = z.object({
   devices: z.record(z.string(), DeviceConfigSchema).default(() => ({ default: DeviceConfigSchema.parse({}) })),
   defaultDevice: z.string().default("default"),
@@ -67,6 +73,7 @@ var MikrotikConfigSchema = z.object({
   s3: S3ConfigSchema.optional(),
   dashboard: DashboardConfigSchema.default(() => DashboardConfigSchema.parse({})),
   readOnly: z.boolean().default(false),
+  tools: ToolFilterSchema.default(() => ToolFilterSchema.parse({})),
   backupDir: z.string().optional()
 });
 function env(...names) {
@@ -112,7 +119,8 @@ function parseDevicesSource(raw, fromFile) {
   const defaultDevice = typeof obj.defaultDevice === "string" ? obj.defaultDevice : undefined;
   const s3 = structured && obj.s3 && typeof obj.s3 === "object" ? obj.s3 : undefined;
   const dashboard = structured && obj.dashboard && typeof obj.dashboard === "object" ? obj.dashboard : undefined;
-  return { devices, defaultDevice, s3, dashboard };
+  const tools = structured && obj.tools && typeof obj.tools === "object" ? obj.tools : undefined;
+  return { devices, defaultDevice, s3, dashboard, tools };
 }
 var configSource = { path: DEFAULT_CONFIG_FILE, fromFile: false };
 function getConfigSource() {
@@ -147,6 +155,7 @@ function loadConfig(argv = process.argv.slice(2)) {
   const devicesInline = flags.devices ?? env("MIKROTIK_DEVICES");
   let fileS3 = {};
   let fileDashboard = {};
+  let fileTools;
   if (configFile || devicesInline) {
     const src = configFile ? parseDevicesSource(configFile, true) : parseDevicesSource(devicesInline, false);
     for (const [name, dc] of Object.entries(src.devices))
@@ -157,6 +166,7 @@ function loadConfig(argv = process.argv.slice(2)) {
       defaultDevice = Object.keys(src.devices)[0];
     fileS3 = src.s3;
     fileDashboard = src.dashboard;
+    fileTools = src.tools;
   }
   const s3 = {
     accessKeyId: pick("s3-access-key-id", "S3_ACCESS_KEY_ID", "AWS_ACCESS_KEY_ID"),
@@ -179,6 +189,14 @@ function loadConfig(argv = process.argv.slice(2)) {
   };
   const isTruthy = (v) => /^(1|true|yes|on)$/i.test(v ?? "");
   const readOnly = isTruthy(pick("read-only", "MIKROTIK_READ_ONLY"));
+  const csv = (v) => v === undefined ? undefined : v.split(",").map((s) => s.trim()).filter(Boolean);
+  const tools = {
+    enabledModules: csv(pick("tools-enabled-modules", "MIKROTIK_TOOLS__ENABLED_MODULES")),
+    disabledModules: csv(pick("tools-disabled-modules", "MIKROTIK_TOOLS__DISABLED_MODULES")),
+    enabledGroups: csv(pick("tools-enabled-groups", "MIKROTIK_TOOLS__ENABLED_GROUPS")),
+    disabledGroups: csv(pick("tools-disabled-groups", "MIKROTIK_TOOLS__DISABLED_GROUPS")),
+    ...fileTools
+  };
   const boolOpt = (v) => v === undefined ? undefined : isTruthy(v);
   const dashboard = {
     enabled: boolOpt(pick("dashboard", "MIKROTIK_DASHBOARD__ENABLED", "MIKROTIK_DASHBOARD")),
@@ -199,6 +217,7 @@ function loadConfig(argv = process.argv.slice(2)) {
     mcp,
     dashboard,
     readOnly,
+    tools,
     ...hasS3 ? { s3 } : {}
   };
   const pruned = JSON.parse(JSON.stringify(raw));
@@ -1048,6 +1067,16 @@ function isEmpty(result) {
   const t = result.trim();
   return t === "" || t === "no such item" || t === "no such item (4)";
 }
+function extractCreatedId(output) {
+  const star = output.match(/\*[0-9A-Fa-f]+/);
+  if (star)
+    return star[0];
+  const num = output.trim().match(/^\d+$/);
+  return num ? num[0] : undefined;
+}
+function readBackUnavailable(details) {
+  return isEmpty(details) || /no such item/i.test(details) || looksLikeError(details);
+}
 function looksLikeError(result) {
   const t = result.toLowerCase();
   return t.includes("failure:") || t.includes("syntax error") || t.includes("bad command") || t.includes("bad parameter") || t.includes("expected end of command") || t.includes("invalid value") || t.includes("input does not match") || t.includes("ambiguous value") || t.startsWith("error");
@@ -6044,16 +6073,17 @@ var firewallFilterTools = [
       ctx.info(`Creating firewall filter rule: chain=${a.chain}, action=${a.action}`);
       const cmd = new Cmd("/ip firewall filter add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("connection-state", a.connection_state).opt("connection-nat-state", a.connection_nat_state).opt("src-address-list", a.src_address_list).opt("dst-address-list", a.dst_address_list).opt("limit", a.limit).opt("tcp-flags", a.tcp_flags).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
       const result = await executeMikrotikCommand(cmd, ctx);
-      if (result.trim()) {
-        const trimmed = result.trim();
-        if (trimmed.includes("*") || isDigits(trimmed)) {
-          const details = await executeMikrotikCommand(`/ip firewall filter print detail where .id=${trimmed}`, ctx);
-          return details.trim() ? `Firewall filter rule created successfully:
+      const trimmed = result.trim();
+      if (looksLikeError(trimmed)) {
+        const hint = placeBeforeError(trimmed, a.place_before);
+        return `Failed to create firewall filter rule: ${hint ?? trimmed}`;
+      }
+      const createdId = extractCreatedId(trimmed);
+      if (createdId) {
+        const details = await executeMikrotikCommand(`/ip firewall filter print detail where .id=${createdId}`, ctx);
+        return readBackUnavailable(details) ? `Firewall filter rule created (id ${createdId}).` : `Firewall filter rule created successfully:
 
-${details}` : `Firewall filter rule created with ID: ${result}`;
-        }
-        const hint = placeBeforeError(result, a.place_before);
-        return `Failed to create firewall filter rule: ${hint ?? result}`;
+${details}`;
       }
       const count = await executeMikrotikCommand("/ip firewall filter print detail count-only", ctx);
       const c = count.trim();
@@ -6341,16 +6371,17 @@ var firewallNatTools = [
       }
       const cmd = new Cmd("/ip firewall nat add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("to-addresses", a.to_addresses).opt("to-ports", a.to_ports).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
       const result = await executeMikrotikCommand(cmd, ctx);
-      if (result.trim()) {
-        const trimmed = result.trim();
-        if (trimmed.includes("*") || isDigits2(trimmed)) {
-          const details = await executeMikrotikCommand(`/ip firewall nat print detail where .id=${trimmed}`, ctx);
-          return details.trim() ? `NAT rule created successfully:
+      const trimmed = result.trim();
+      if (looksLikeError(trimmed)) {
+        const hint = placeBeforeError(trimmed, a.place_before);
+        return `Failed to create NAT rule: ${hint ?? trimmed}`;
+      }
+      const createdId = extractCreatedId(trimmed);
+      if (createdId) {
+        const details = await executeMikrotikCommand(`/ip firewall nat print detail where .id=${createdId}`, ctx);
+        return readBackUnavailable(details) ? `NAT rule created (id ${createdId}).` : `NAT rule created successfully:
 
-${details}` : `NAT rule created with ID: ${result}`;
-        }
-        const hint = placeBeforeError(result, a.place_before);
-        return `Failed to create NAT rule: ${hint ?? result}`;
+${details}`;
       }
       const count = await executeMikrotikCommand("/ip firewall nat print detail count-only", ctx);
       const c = count.trim();
@@ -8013,15 +8044,16 @@ var ipv6FirewallFilterTools = [
       ctx.info(`Creating IPv6 firewall filter rule: chain=${a.chain}, action=${a.action}`);
       const cmd = new Cmd("/ipv6 firewall filter add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("in-interface-list", a.in_interface_list).opt("out-interface-list", a.out_interface_list).opt("connection-state", a.connection_state).opt("src-address-list", a.src_address_list).opt("dst-address-list", a.dst_address_list).opt("hop-limit", a.hop_limit).opt("limit", a.limit).opt("tcp-flags", a.tcp_flags).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
       const result = await executeMikrotikCommand(cmd, ctx);
-      if (result.trim()) {
-        const trimmed = result.trim();
-        if (trimmed.includes("*") || isDigits3(trimmed)) {
-          const details = await executeMikrotikCommand(`/ipv6 firewall filter print detail where .id=${trimmed}`, ctx);
-          return details.trim() ? `IPv6 firewall filter rule created successfully:
+      const trimmed = result.trim();
+      if (looksLikeError(trimmed)) {
+        return `Failed to create IPv6 firewall filter rule: ${trimmed}`;
+      }
+      const createdId = extractCreatedId(trimmed);
+      if (createdId) {
+        const details = await executeMikrotikCommand(`/ipv6 firewall filter print detail where .id=${createdId}`, ctx);
+        return readBackUnavailable(details) ? `IPv6 firewall filter rule created (id ${createdId}).` : `IPv6 firewall filter rule created successfully:
 
-${details}` : `IPv6 firewall filter rule created with ID: ${result}`;
-        }
-        return `Failed to create IPv6 firewall filter rule: ${result}`;
+${details}`;
       }
       const count = await executeMikrotikCommand("/ipv6 firewall filter print detail count-only", ctx);
       const c = count.trim();
@@ -8274,15 +8306,16 @@ var ipv6FirewallNatTools = [
       ctx.info(`Creating IPv6 firewall NAT rule: chain=${a.chain}, action=${a.action}`);
       const cmd = new Cmd("/ipv6 firewall nat add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("to-address", a.to_address).opt("to-ports", a.to_ports).opt("src-address-list", a.src_address_list).opt("dst-address-list", a.dst_address_list).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
       const result = await executeMikrotikCommand(cmd, ctx);
-      if (result.trim()) {
-        const trimmed = result.trim();
-        if (trimmed.includes("*") || isDigits4(trimmed)) {
-          const details = await executeMikrotikCommand(`/ipv6 firewall nat print detail where .id=${trimmed}`, ctx);
-          return details.trim() ? `IPv6 firewall NAT rule created successfully:
+      const trimmed = result.trim();
+      if (looksLikeError(trimmed)) {
+        return `Failed to create IPv6 firewall NAT rule: ${trimmed}`;
+      }
+      const createdId = extractCreatedId(trimmed);
+      if (createdId) {
+        const details = await executeMikrotikCommand(`/ipv6 firewall nat print detail where .id=${createdId}`, ctx);
+        return readBackUnavailable(details) ? `IPv6 firewall NAT rule created (id ${createdId}).` : `IPv6 firewall NAT rule created successfully:
 
-${details}` : `IPv6 firewall NAT rule created with ID: ${result}`;
-        }
-        return `Failed to create IPv6 firewall NAT rule: ${result}`;
+${details}`;
       }
       const count = await executeMikrotikCommand("/ipv6 firewall nat print detail count-only", ctx);
       const c = count.trim();
@@ -8538,15 +8571,16 @@ var ipv6FirewallMangleTools = [
       ctx.info(`Creating IPv6 firewall mangle rule: chain=${a.chain}, action=${a.action}`);
       const cmd = new Cmd("/ipv6 firewall mangle add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("connection-mark", a.connection_mark).opt("packet-mark", a.packet_mark).opt("routing-mark", a.routing_mark).opt("new-connection-mark", a.new_connection_mark).opt("new-packet-mark", a.new_packet_mark).opt("new-routing-mark", a.new_routing_mark).opt("new-dscp", a.new_dscp).opt("new-hop-limit", a.new_hop_limit).bool("passthrough", a.passthrough).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
       const result = await executeMikrotikCommand(cmd, ctx);
-      if (result.trim()) {
-        const trimmed = result.trim();
-        if (trimmed.includes("*") || isDigits5(trimmed)) {
-          const details = await executeMikrotikCommand(`/ipv6 firewall mangle print detail where .id=${trimmed}`, ctx);
-          return details.trim() ? `IPv6 firewall mangle rule created successfully:
+      const trimmed = result.trim();
+      if (looksLikeError(trimmed)) {
+        return `Failed to create IPv6 firewall mangle rule: ${trimmed}`;
+      }
+      const createdId = extractCreatedId(trimmed);
+      if (createdId) {
+        const details = await executeMikrotikCommand(`/ipv6 firewall mangle print detail where .id=${createdId}`, ctx);
+        return readBackUnavailable(details) ? `IPv6 firewall mangle rule created (id ${createdId}).` : `IPv6 firewall mangle rule created successfully:
 
-${details}` : `IPv6 firewall mangle rule created with ID: ${result}`;
-        }
-        return `Failed to create IPv6 firewall mangle rule: ${result}`;
+${details}`;
       }
       const count = await executeMikrotikCommand("/ipv6 firewall mangle print detail count-only", ctx);
       const c = count.trim();
@@ -8777,15 +8811,16 @@ var ipv6FirewallRawTools = [
       ctx.info(`Creating IPv6 firewall raw rule: chain=${a.chain}, action=${a.action}`);
       const cmd = new Cmd("/ipv6 firewall raw add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("src-address-list", a.src_address_list).opt("dst-address-list", a.dst_address_list).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
       const result = await executeMikrotikCommand(cmd, ctx);
-      if (result.trim()) {
-        const trimmed = result.trim();
-        if (trimmed.includes("*") || isDigits6(trimmed)) {
-          const details = await executeMikrotikCommand(`/ipv6 firewall raw print detail where .id=${trimmed}`, ctx);
-          return details.trim() ? `IPv6 firewall raw rule created successfully:
+      const trimmed = result.trim();
+      if (looksLikeError(trimmed)) {
+        return `Failed to create IPv6 firewall raw rule: ${trimmed}`;
+      }
+      const createdId = extractCreatedId(trimmed);
+      if (createdId) {
+        const details = await executeMikrotikCommand(`/ipv6 firewall raw print detail where .id=${createdId}`, ctx);
+        return readBackUnavailable(details) ? `IPv6 firewall raw rule created (id ${createdId}).` : `IPv6 firewall raw rule created successfully:
 
-${details}` : `IPv6 firewall raw rule created with ID: ${result}`;
-        }
-        return `Failed to create IPv6 firewall raw rule: ${result}`;
+${details}`;
       }
       const count = await executeMikrotikCommand("/ipv6 firewall raw print detail count-only", ctx);
       const c = count.trim();
@@ -17698,15 +17733,16 @@ var switchRuleTools = [
       ctx.info(`Adding switch rule: switch=${a.switch}, ports=${a.ports}`);
       const cmd = new Cmd("/interface ethernet switch rule add").set("switch", a.switch).set("ports", a.ports).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-mac-address", a.src_mac_address).opt("dst-mac-address", a.dst_mac_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("mac-protocol", a.mac_protocol).opt("vlan-id", a.vlan_id).opt("vlan-priority", a.vlan_priority).opt("dscp", a.dscp).opt("flow-label", a.flow_label).opt("new-dst-ports", a.new_dst_ports).opt("new-vlan-id", a.new_vlan_id).opt("new-vlan-priority", a.new_vlan_priority).bool("redirect-to-cpu", a.redirect_to_cpu).bool("copy-to-cpu", a.copy_to_cpu).bool("mirror", a.mirror).opt("rate", a.rate).opt("comment", a.comment).flag("disabled", a.disabled).build();
       const result = await executeMikrotikCommand(cmd, ctx);
-      if (result.trim()) {
-        const trimmed = result.trim();
-        if (trimmed.includes("*") || isDigits7(trimmed)) {
-          const details = await executeMikrotikCommand(`/interface ethernet switch rule print detail where .id=${trimmed}`, ctx);
-          return details.trim() ? `Switch rule added successfully:
+      const trimmed = result.trim();
+      if (looksLikeError(trimmed)) {
+        return `Failed to add switch rule: ${trimmed}`;
+      }
+      const createdId = extractCreatedId(trimmed);
+      if (createdId) {
+        const details = await executeMikrotikCommand(`/interface ethernet switch rule print detail where .id=${createdId}`, ctx);
+        return readBackUnavailable(details) ? `Switch rule added (id ${createdId}).` : `Switch rule added successfully:
 
-${details}` : `Switch rule added with ID: ${result}`;
-        }
-        return `Failed to add switch rule: ${result}`;
+${details}`;
       }
       const count = await executeMikrotikCommand("/interface ethernet switch rule print detail count-only", ctx);
       const c = count.trim();
@@ -21611,6 +21647,23 @@ var moduleCatalog = [
   }
 ];
 var allToolModules = moduleCatalog.map((m) => m.tools);
+function selectToolModules(filter = {}, catalog = moduleCatalog) {
+  const lc = (xs) => new Set((xs ?? []).map((s) => s.toLowerCase()));
+  const enabledModules = lc(filter.enabledModules);
+  const disabledModules = lc(filter.disabledModules);
+  const enabledGroups = lc(filter.enabledGroups);
+  const disabledGroups = lc(filter.disabledGroups);
+  const hasAllow = enabledModules.size > 0 || enabledGroups.size > 0;
+  return catalog.filter((m) => {
+    const slug = m.slug.toLowerCase();
+    const group = m.group.toLowerCase();
+    if (disabledModules.has(slug) || disabledGroups.has(group))
+      return false;
+    if (hasAllow && !(enabledModules.has(slug) || enabledGroups.has(group)))
+      return false;
+    return true;
+  }).map((m) => m.tools);
+}
 
 // src/observability/dashboard.ts
 import { readFileSync as readFileSync6 } from "fs";
@@ -23223,7 +23276,7 @@ function registerPrompts(server) {
 // package.json
 var package_default = {
   name: "@usex/mikrotik-mcp",
-  version: "3.7.0",
+  version: "3.8.0",
   description: "MCP server for MikroTik RouterOS \u2014 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   keywords: [
     "ai",
@@ -23415,7 +23468,8 @@ function createServer(opts = {}) {
       server.server.sendLoggingMessage({ level, data: message }).catch(() => {});
     } catch {}
   });
-  const toolCount = registerTools(server, allToolModules, {
+  const toolModules = selectToolModules(getConfig().tools);
+  const toolCount = registerTools(server, toolModules, {
     sendLog,
     deviceNames: names,
     readOnly

package/dist/index.js

@@ -56,6 +56,12 @@ var DashboardConfigSchema = z.object({
   maxBodyBytes: z.coerce.number().int().nonnegative().default(16384),
   token: z.string().optional()
 });
+var ToolFilterSchema = z.object({
+  enabledModules: z.array(z.string()).default([]),
+  disabledModules: z.array(z.string()).default([]),
+  enabledGroups: z.array(z.string()).default([]),
+  disabledGroups: z.array(z.string()).default([])
+});
 var MikrotikConfigSchema = z.object({
   devices: z.record(z.string(), DeviceConfigSchema).default(() => ({ default: DeviceConfigSchema.parse({}) })),
   defaultDevice: z.string().default("default"),
@@ -63,6 +69,7 @@ var MikrotikConfigSchema = z.object({
   s3: S3ConfigSchema.optional(),
   dashboard: DashboardConfigSchema.default(() => DashboardConfigSchema.parse({})),
   readOnly: z.boolean().default(false),
+  tools: ToolFilterSchema.default(() => ToolFilterSchema.parse({})),
   backupDir: z.string().optional()
 });
 function env(...names) {
@@ -108,7 +115,8 @@ function parseDevicesSource(raw, fromFile) {
   const defaultDevice = typeof obj.defaultDevice === "string" ? obj.defaultDevice : undefined;
   const s3 = structured && obj.s3 && typeof obj.s3 === "object" ? obj.s3 : undefined;
   const dashboard = structured && obj.dashboard && typeof obj.dashboard === "object" ? obj.dashboard : undefined;
-  return { devices, defaultDevice, s3, dashboard };
+  const tools = structured && obj.tools && typeof obj.tools === "object" ? obj.tools : undefined;
+  return { devices, defaultDevice, s3, dashboard, tools };
 }
 var configSource = { path: DEFAULT_CONFIG_FILE, fromFile: false };
 function loadConfig(argv = process.argv.slice(2)) {
@@ -140,6 +148,7 @@ function loadConfig(argv = process.argv.slice(2)) {
   const devicesInline = flags.devices ?? env("MIKROTIK_DEVICES");
   let fileS3 = {};
   let fileDashboard = {};
+  let fileTools;
   if (configFile || devicesInline) {
     const src = configFile ? parseDevicesSource(configFile, true) : parseDevicesSource(devicesInline, false);
     for (const [name, dc] of Object.entries(src.devices))
@@ -150,6 +159,7 @@ function loadConfig(argv = process.argv.slice(2)) {
       defaultDevice = Object.keys(src.devices)[0];
     fileS3 = src.s3;
     fileDashboard = src.dashboard;
+    fileTools = src.tools;
   }
   const s3 = {
     accessKeyId: pick("s3-access-key-id", "S3_ACCESS_KEY_ID", "AWS_ACCESS_KEY_ID"),
@@ -172,6 +182,14 @@ function loadConfig(argv = process.argv.slice(2)) {
   };
   const isTruthy = (v) => /^(1|true|yes|on)$/i.test(v ?? "");
   const readOnly = isTruthy(pick("read-only", "MIKROTIK_READ_ONLY"));
+  const csv = (v) => v === undefined ? undefined : v.split(",").map((s) => s.trim()).filter(Boolean);
+  const tools = {
+    enabledModules: csv(pick("tools-enabled-modules", "MIKROTIK_TOOLS__ENABLED_MODULES")),
+    disabledModules: csv(pick("tools-disabled-modules", "MIKROTIK_TOOLS__DISABLED_MODULES")),
+    enabledGroups: csv(pick("tools-enabled-groups", "MIKROTIK_TOOLS__ENABLED_GROUPS")),
+    disabledGroups: csv(pick("tools-disabled-groups", "MIKROTIK_TOOLS__DISABLED_GROUPS")),
+    ...fileTools
+  };
   const boolOpt = (v) => v === undefined ? undefined : isTruthy(v);
   const dashboard = {
     enabled: boolOpt(pick("dashboard", "MIKROTIK_DASHBOARD__ENABLED", "MIKROTIK_DASHBOARD")),
@@ -192,6 +210,7 @@ function loadConfig(argv = process.argv.slice(2)) {
     mcp,
     dashboard,
     readOnly,
+    tools,
     ...hasS3 ? { s3 } : {}
   };
   const pruned = JSON.parse(JSON.stringify(raw));
@@ -1033,6 +1052,16 @@ function isEmpty(result) {
   const t = result.trim();
   return t === "" || t === "no such item" || t === "no such item (4)";
 }
+function extractCreatedId(output) {
+  const star = output.match(/\*[0-9A-Fa-f]+/);
+  if (star)
+    return star[0];
+  const num = output.trim().match(/^\d+$/);
+  return num ? num[0] : undefined;
+}
+function readBackUnavailable(details) {
+  return isEmpty(details) || /no such item/i.test(details) || looksLikeError(details);
+}
 function looksLikeError(result) {
   const t = result.toLowerCase();
   return t.includes("failure:") || t.includes("syntax error") || t.includes("bad command") || t.includes("bad parameter") || t.includes("expected end of command") || t.includes("invalid value") || t.includes("input does not match") || t.includes("ambiguous value") || t.startsWith("error");
@@ -6056,16 +6085,17 @@ var firewallFilterTools = [
       ctx.info(`Creating firewall filter rule: chain=${a.chain}, action=${a.action}`);
       const cmd = new Cmd("/ip firewall filter add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("connection-state", a.connection_state).opt("connection-nat-state", a.connection_nat_state).opt("src-address-list", a.src_address_list).opt("dst-address-list", a.dst_address_list).opt("limit", a.limit).opt("tcp-flags", a.tcp_flags).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
       const result = await executeMikrotikCommand(cmd, ctx);
-      if (result.trim()) {
-        const trimmed = result.trim();
-        if (trimmed.includes("*") || isDigits(trimmed)) {
-          const details = await executeMikrotikCommand(`/ip firewall filter print detail where .id=${trimmed}`, ctx);
-          return details.trim() ? `Firewall filter rule created successfully:
+      const trimmed = result.trim();
+      if (looksLikeError(trimmed)) {
+        const hint = placeBeforeError(trimmed, a.place_before);
+        return `Failed to create firewall filter rule: ${hint ?? trimmed}`;
+      }
+      const createdId = extractCreatedId(trimmed);
+      if (createdId) {
+        const details = await executeMikrotikCommand(`/ip firewall filter print detail where .id=${createdId}`, ctx);
+        return readBackUnavailable(details) ? `Firewall filter rule created (id ${createdId}).` : `Firewall filter rule created successfully:
 
-${details}` : `Firewall filter rule created with ID: ${result}`;
-        }
-        const hint = placeBeforeError(result, a.place_before);
-        return `Failed to create firewall filter rule: ${hint ?? result}`;
+${details}`;
       }
       const count = await executeMikrotikCommand("/ip firewall filter print detail count-only", ctx);
       const c = count.trim();
@@ -6353,16 +6383,17 @@ var firewallNatTools = [
       }
       const cmd = new Cmd("/ip firewall nat add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("to-addresses", a.to_addresses).opt("to-ports", a.to_ports).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
       const result = await executeMikrotikCommand(cmd, ctx);
-      if (result.trim()) {
-        const trimmed = result.trim();
-        if (trimmed.includes("*") || isDigits2(trimmed)) {
-          const details = await executeMikrotikCommand(`/ip firewall nat print detail where .id=${trimmed}`, ctx);
-          return details.trim() ? `NAT rule created successfully:
+      const trimmed = result.trim();
+      if (looksLikeError(trimmed)) {
+        const hint = placeBeforeError(trimmed, a.place_before);
+        return `Failed to create NAT rule: ${hint ?? trimmed}`;
+      }
+      const createdId = extractCreatedId(trimmed);
+      if (createdId) {
+        const details = await executeMikrotikCommand(`/ip firewall nat print detail where .id=${createdId}`, ctx);
+        return readBackUnavailable(details) ? `NAT rule created (id ${createdId}).` : `NAT rule created successfully:
 
-${details}` : `NAT rule created with ID: ${result}`;
-        }
-        const hint = placeBeforeError(result, a.place_before);
-        return `Failed to create NAT rule: ${hint ?? result}`;
+${details}`;
       }
       const count = await executeMikrotikCommand("/ip firewall nat print detail count-only", ctx);
       const c = count.trim();
@@ -8025,15 +8056,16 @@ var ipv6FirewallFilterTools = [
       ctx.info(`Creating IPv6 firewall filter rule: chain=${a.chain}, action=${a.action}`);
       const cmd = new Cmd("/ipv6 firewall filter add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("in-interface-list", a.in_interface_list).opt("out-interface-list", a.out_interface_list).opt("connection-state", a.connection_state).opt("src-address-list", a.src_address_list).opt("dst-address-list", a.dst_address_list).opt("hop-limit", a.hop_limit).opt("limit", a.limit).opt("tcp-flags", a.tcp_flags).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
       const result = await executeMikrotikCommand(cmd, ctx);
-      if (result.trim()) {
-        const trimmed = result.trim();
-        if (trimmed.includes("*") || isDigits3(trimmed)) {
-          const details = await executeMikrotikCommand(`/ipv6 firewall filter print detail where .id=${trimmed}`, ctx);
-          return details.trim() ? `IPv6 firewall filter rule created successfully:
+      const trimmed = result.trim();
+      if (looksLikeError(trimmed)) {
+        return `Failed to create IPv6 firewall filter rule: ${trimmed}`;
+      }
+      const createdId = extractCreatedId(trimmed);
+      if (createdId) {
+        const details = await executeMikrotikCommand(`/ipv6 firewall filter print detail where .id=${createdId}`, ctx);
+        return readBackUnavailable(details) ? `IPv6 firewall filter rule created (id ${createdId}).` : `IPv6 firewall filter rule created successfully:
 
-${details}` : `IPv6 firewall filter rule created with ID: ${result}`;
-        }
-        return `Failed to create IPv6 firewall filter rule: ${result}`;
+${details}`;
       }
       const count = await executeMikrotikCommand("/ipv6 firewall filter print detail count-only", ctx);
       const c = count.trim();
@@ -8286,15 +8318,16 @@ var ipv6FirewallNatTools = [
       ctx.info(`Creating IPv6 firewall NAT rule: chain=${a.chain}, action=${a.action}`);
       const cmd = new Cmd("/ipv6 firewall nat add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("to-address", a.to_address).opt("to-ports", a.to_ports).opt("src-address-list", a.src_address_list).opt("dst-address-list", a.dst_address_list).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
       const result = await executeMikrotikCommand(cmd, ctx);
-      if (result.trim()) {
-        const trimmed = result.trim();
-        if (trimmed.includes("*") || isDigits4(trimmed)) {
-          const details = await executeMikrotikCommand(`/ipv6 firewall nat print detail where .id=${trimmed}`, ctx);
-          return details.trim() ? `IPv6 firewall NAT rule created successfully:
+      const trimmed = result.trim();
+      if (looksLikeError(trimmed)) {
+        return `Failed to create IPv6 firewall NAT rule: ${trimmed}`;
+      }
+      const createdId = extractCreatedId(trimmed);
+      if (createdId) {
+        const details = await executeMikrotikCommand(`/ipv6 firewall nat print detail where .id=${createdId}`, ctx);
+        return readBackUnavailable(details) ? `IPv6 firewall NAT rule created (id ${createdId}).` : `IPv6 firewall NAT rule created successfully:
 
-${details}` : `IPv6 firewall NAT rule created with ID: ${result}`;
-        }
-        return `Failed to create IPv6 firewall NAT rule: ${result}`;
+${details}`;
       }
       const count = await executeMikrotikCommand("/ipv6 firewall nat print detail count-only", ctx);
       const c = count.trim();
@@ -8550,15 +8583,16 @@ var ipv6FirewallMangleTools = [
       ctx.info(`Creating IPv6 firewall mangle rule: chain=${a.chain}, action=${a.action}`);
       const cmd = new Cmd("/ipv6 firewall mangle add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("connection-mark", a.connection_mark).opt("packet-mark", a.packet_mark).opt("routing-mark", a.routing_mark).opt("new-connection-mark", a.new_connection_mark).opt("new-packet-mark", a.new_packet_mark).opt("new-routing-mark", a.new_routing_mark).opt("new-dscp", a.new_dscp).opt("new-hop-limit", a.new_hop_limit).bool("passthrough", a.passthrough).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
       const result = await executeMikrotikCommand(cmd, ctx);
-      if (result.trim()) {
-        const trimmed = result.trim();
-        if (trimmed.includes("*") || isDigits5(trimmed)) {
-          const details = await executeMikrotikCommand(`/ipv6 firewall mangle print detail where .id=${trimmed}`, ctx);
-          return details.trim() ? `IPv6 firewall mangle rule created successfully:
+      const trimmed = result.trim();
+      if (looksLikeError(trimmed)) {
+        return `Failed to create IPv6 firewall mangle rule: ${trimmed}`;
+      }
+      const createdId = extractCreatedId(trimmed);
+      if (createdId) {
+        const details = await executeMikrotikCommand(`/ipv6 firewall mangle print detail where .id=${createdId}`, ctx);
+        return readBackUnavailable(details) ? `IPv6 firewall mangle rule created (id ${createdId}).` : `IPv6 firewall mangle rule created successfully:
 
-${details}` : `IPv6 firewall mangle rule created with ID: ${result}`;
-        }
-        return `Failed to create IPv6 firewall mangle rule: ${result}`;
+${details}`;
       }
       const count = await executeMikrotikCommand("/ipv6 firewall mangle print detail count-only", ctx);
       const c = count.trim();
@@ -8789,15 +8823,16 @@ var ipv6FirewallRawTools = [
       ctx.info(`Creating IPv6 firewall raw rule: chain=${a.chain}, action=${a.action}`);
       const cmd = new Cmd("/ipv6 firewall raw add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("src-address-list", a.src_address_list).opt("dst-address-list", a.dst_address_list).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
       const result = await executeMikrotikCommand(cmd, ctx);
-      if (result.trim()) {
-        const trimmed = result.trim();
-        if (trimmed.includes("*") || isDigits6(trimmed)) {
-          const details = await executeMikrotikCommand(`/ipv6 firewall raw print detail where .id=${trimmed}`, ctx);
-          return details.trim() ? `IPv6 firewall raw rule created successfully:
+      const trimmed = result.trim();
+      if (looksLikeError(trimmed)) {
+        return `Failed to create IPv6 firewall raw rule: ${trimmed}`;
+      }
+      const createdId = extractCreatedId(trimmed);
+      if (createdId) {
+        const details = await executeMikrotikCommand(`/ipv6 firewall raw print detail where .id=${createdId}`, ctx);
+        return readBackUnavailable(details) ? `IPv6 firewall raw rule created (id ${createdId}).` : `IPv6 firewall raw rule created successfully:
 
-${details}` : `IPv6 firewall raw rule created with ID: ${result}`;
-        }
-        return `Failed to create IPv6 firewall raw rule: ${result}`;
+${details}`;
       }
       const count = await executeMikrotikCommand("/ipv6 firewall raw print detail count-only", ctx);
       const c = count.trim();
@@ -17710,15 +17745,16 @@ var switchRuleTools = [
       ctx.info(`Adding switch rule: switch=${a.switch}, ports=${a.ports}`);
       const cmd = new Cmd("/interface ethernet switch rule add").set("switch", a.switch).set("ports", a.ports).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-mac-address", a.src_mac_address).opt("dst-mac-address", a.dst_mac_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("mac-protocol", a.mac_protocol).opt("vlan-id", a.vlan_id).opt("vlan-priority", a.vlan_priority).opt("dscp", a.dscp).opt("flow-label", a.flow_label).opt("new-dst-ports", a.new_dst_ports).opt("new-vlan-id", a.new_vlan_id).opt("new-vlan-priority", a.new_vlan_priority).bool("redirect-to-cpu", a.redirect_to_cpu).bool("copy-to-cpu", a.copy_to_cpu).bool("mirror", a.mirror).opt("rate", a.rate).opt("comment", a.comment).flag("disabled", a.disabled).build();
       const result = await executeMikrotikCommand(cmd, ctx);
-      if (result.trim()) {
-        const trimmed = result.trim();
-        if (trimmed.includes("*") || isDigits7(trimmed)) {
-          const details = await executeMikrotikCommand(`/interface ethernet switch rule print detail where .id=${trimmed}`, ctx);
-          return details.trim() ? `Switch rule added successfully:
+      const trimmed = result.trim();
+      if (looksLikeError(trimmed)) {
+        return `Failed to add switch rule: ${trimmed}`;
+      }
+      const createdId = extractCreatedId(trimmed);
+      if (createdId) {
+        const details = await executeMikrotikCommand(`/interface ethernet switch rule print detail where .id=${createdId}`, ctx);
+        return readBackUnavailable(details) ? `Switch rule added (id ${createdId}).` : `Switch rule added successfully:
 
-${details}` : `Switch rule added with ID: ${result}`;
-        }
-        return `Failed to add switch rule: ${result}`;
+${details}`;
       }
       const count = await executeMikrotikCommand("/interface ethernet switch rule print detail count-only", ctx);
       const c = count.trim();
@@ -21623,10 +21659,27 @@ var moduleCatalog = [
   }
 ];
 var allToolModules = moduleCatalog.map((m) => m.tools);
+function selectToolModules(filter = {}, catalog = moduleCatalog) {
+  const lc = (xs) => new Set((xs ?? []).map((s) => s.toLowerCase()));
+  const enabledModules = lc(filter.enabledModules);
+  const disabledModules = lc(filter.disabledModules);
+  const enabledGroups = lc(filter.enabledGroups);
+  const disabledGroups = lc(filter.disabledGroups);
+  const hasAllow = enabledModules.size > 0 || enabledGroups.size > 0;
+  return catalog.filter((m) => {
+    const slug = m.slug.toLowerCase();
+    const group = m.group.toLowerCase();
+    if (disabledModules.has(slug) || disabledGroups.has(group))
+      return false;
+    if (hasAllow && !(enabledModules.has(slug) || enabledGroups.has(group)))
+      return false;
+    return true;
+  }).map((m) => m.tools);
+}
 // package.json
 var package_default = {
   name: "@usex/mikrotik-mcp",
-  version: "3.7.0",
+  version: "3.8.0",
   description: "MCP server for MikroTik RouterOS \u2014 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   keywords: [
     "ai",
@@ -21818,7 +21871,8 @@ function createServer(opts = {}) {
       server.server.sendLoggingMessage({ level, data: message }).catch(() => {});
     } catch {}
   });
-  const toolCount = registerTools(server, allToolModules, {
+  const toolModules = selectToolModules(getConfig().tools);
+  const toolCount = registerTools(server, toolModules, {
     sendLog,
     deviceNames: names,
     readOnly

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usex/mikrotik-mcp",
-  "version": "3.7.0",
+  "version": "3.8.0",
   "description": "MCP server for MikroTik RouterOS — 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   "keywords": [
     "ai",

package/schemas/config.schema.json

@@ -161,7 +161,7 @@
         "enabled": false,
         "host": "0.0.0.0",
         "port": 9090,
-        "dbPath": "./.mikrotik-mcp/events.db",
+        "dbPath": "/Users/alimaster/.mikrotik-mcp/events.db",
         "maxEvents": 100000,
         "captureBody": true,
         "redactInput": false,
@@ -184,7 +184,7 @@
           "maximum": 9007199254740991
         },
         "dbPath": {
-          "default": "./.mikrotik-mcp/events.db",
+          "default": "/Users/alimaster/.mikrotik-mcp/events.db",
           "type": "string"
         },
         "maxEvents": {
@@ -227,10 +227,51 @@
       "default": false,
       "type": "boolean"
     },
+    "tools": {
+      "default": {
+        "enabledModules": [],
+        "disabledModules": [],
+        "enabledGroups": [],
+        "disabledGroups": []
+      },
+      "type": "object",
+      "properties": {
+        "enabledModules": {
+          "default": [],
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "disabledModules": {
+          "default": [],
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "enabledGroups": {
+          "default": [],
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "disabledGroups": {
+          "default": [],
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      },
+      "required": ["enabledModules", "disabledModules", "enabledGroups", "disabledGroups"],
+      "additionalProperties": false
+    },
     "backupDir": {
       "type": "string"
     }
   },
-  "required": ["devices", "defaultDevice", "mcp", "dashboard", "readOnly"],
+  "required": ["devices", "defaultDevice", "mcp", "dashboard", "readOnly", "tools"],
   "additionalProperties": false
 }

package/schemas/tool-catalog.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "version": "3.6.0",
+  "version": "3.7.0",
   "generated": "by scripts/gen-schemas.ts — do not edit by hand",
   "toolCount": 706,
   "tools": [