@usex/mikrotik-mcp 3.7.0 → 3.9.0

package/README.md

@@ -1,21 +1,21 @@
 <div align="center">
   <img src="assets/logo.svg" alt="@usex/mikrotik-mcp" width="440" />
-  <p><strong>A Bun-native MCP server that turns one or more MikroTik routers into 640 tools your AI can drive.</strong><br/>
+  <p><strong>A Bun-native MCP server that turns one or more MikroTik routers into 706 tools your AI can drive.</strong><br/>
   Firewall · routing · DHCP/DNS · wireless · QoS · and a complete VPN suite — over SSH, with transactional Safe Mode.</p>
 
   <p>
     <a href="LICENSE"><img alt="License: MIT" src="https://img.shields.io/badge/License-MIT-7C3AED.svg"></a>
     <img alt="Runtime: Bun" src="https://img.shields.io/badge/runtime-Bun%20%E2%89%A5%201.3-06B6D4.svg">
     <img alt="TypeScript" src="https://img.shields.io/badge/TypeScript-strict-6366F1.svg">
-    <img alt="MCP" src="https://img.shields.io/badge/MCP-640%20tools-1F2937.svg">
+    <img alt="MCP" src="https://img.shields.io/badge/MCP-706%20tools-1F2937.svg">
     <a href="docs/"><img alt="Docs" src="https://img.shields.io/badge/docs-reference-7C3AED.svg"></a>
   </p>
 </div>
 
 ---
 
-`@usex/mikrotik-mcp` exposes **MikroTik RouterOS** as **640 [Model Context Protocol](https://modelcontextprotocol.io)
-tools across 51 modules**, so an AI client (Claude Desktop, Claude Code, any MCP
+`@usex/mikrotik-mcp` exposes **MikroTik RouterOS** as **706 [Model Context Protocol](https://modelcontextprotocol.io)
+tools across 111 modules**, so an AI client (Claude Desktop, Claude Code, any MCP
 client) can read and configure your router in plain language. It speaks to the
 device over **SSH** — no agent, no API package to install on RouterOS — runs on
 **[Bun](https://bun.sh)**, and validates every tool call against a Zod schema.
@@ -46,7 +46,7 @@ in memory and auto-reverts if your session drops, so you can't lock yourself out
 
 ## Why it's different
 
-- 🧰 **Breadth** — 640 tools covering the whole device: L2 (bridge, VLAN, wireless,
+- 🧰 **Breadth** — 706 tools covering the whole device: L2 (bridge, VLAN, wireless,
   PoE), L3 (addressing, routing, DHCP, DNS), security (firewall, NAT, address-lists,
   certificates), QoS (queues), and system ops (users, logs, backups, scheduler).
 - 🔐 **A complete VPN suite** — WireGuard, IPsec (IKEv1/IKEv2), L2TP, PPTP, SSTP,
@@ -87,7 +87,7 @@ mikrotik-mcp serve
 against the server (from source):
 
 ```bash
-bun run inspect        # opens the Inspector UI to browse/run all 640 tools
+bun run inspect        # opens the Inspector UI to browse/run all 706 tools
 ```
 
 **Prefer SSH keys over a password?** Point the server at a key file instead — and
@@ -115,7 +115,7 @@ bun run build            # bundle to dist/
 
 ## The tool catalog
 
-**640 tools across 51 modules.** Full, always-current reference (parameters +
+**706 tools across 111 modules.** Full, always-current reference (parameters +
 risk per tool) is generated from source: **[docs/tools-reference.md](docs/tools-reference.md)**.
 
 | Group                    | Tools | Modules                                                                                                    |

package/dist/cli.js

@@ -60,6 +60,12 @@ var DashboardConfigSchema = z.object({
   maxBodyBytes: z.coerce.number().int().nonnegative().default(16384),
   token: z.string().optional()
 });
+var ToolFilterSchema = z.object({
+  enabledModules: z.array(z.string()).default([]),
+  disabledModules: z.array(z.string()).default([]),
+  enabledGroups: z.array(z.string()).default([]),
+  disabledGroups: z.array(z.string()).default([])
+});
 var MikrotikConfigSchema = z.object({
   devices: z.record(z.string(), DeviceConfigSchema).default(() => ({ default: DeviceConfigSchema.parse({}) })),
   defaultDevice: z.string().default("default"),
@@ -67,6 +73,7 @@ var MikrotikConfigSchema = z.object({
   s3: S3ConfigSchema.optional(),
   dashboard: DashboardConfigSchema.default(() => DashboardConfigSchema.parse({})),
   readOnly: z.boolean().default(false),
+  tools: ToolFilterSchema.default(() => ToolFilterSchema.parse({})),
   backupDir: z.string().optional()
 });
 function env(...names) {
@@ -112,7 +119,8 @@ function parseDevicesSource(raw, fromFile) {
   const defaultDevice = typeof obj.defaultDevice === "string" ? obj.defaultDevice : undefined;
   const s3 = structured && obj.s3 && typeof obj.s3 === "object" ? obj.s3 : undefined;
   const dashboard = structured && obj.dashboard && typeof obj.dashboard === "object" ? obj.dashboard : undefined;
-  return { devices, defaultDevice, s3, dashboard };
+  const tools = structured && obj.tools && typeof obj.tools === "object" ? obj.tools : undefined;
+  return { devices, defaultDevice, s3, dashboard, tools };
 }
 var configSource = { path: DEFAULT_CONFIG_FILE, fromFile: false };
 function getConfigSource() {
@@ -147,6 +155,7 @@ function loadConfig(argv = process.argv.slice(2)) {
   const devicesInline = flags.devices ?? env("MIKROTIK_DEVICES");
   let fileS3 = {};
   let fileDashboard = {};
+  let fileTools;
   if (configFile || devicesInline) {
     const src = configFile ? parseDevicesSource(configFile, true) : parseDevicesSource(devicesInline, false);
     for (const [name, dc] of Object.entries(src.devices))
@@ -157,6 +166,7 @@ function loadConfig(argv = process.argv.slice(2)) {
       defaultDevice = Object.keys(src.devices)[0];
     fileS3 = src.s3;
     fileDashboard = src.dashboard;
+    fileTools = src.tools;
   }
   const s3 = {
     accessKeyId: pick("s3-access-key-id", "S3_ACCESS_KEY_ID", "AWS_ACCESS_KEY_ID"),
@@ -179,6 +189,14 @@ function loadConfig(argv = process.argv.slice(2)) {
   };
   const isTruthy = (v) => /^(1|true|yes|on)$/i.test(v ?? "");
   const readOnly = isTruthy(pick("read-only", "MIKROTIK_READ_ONLY"));
+  const csv = (v) => v === undefined ? undefined : v.split(",").map((s) => s.trim()).filter(Boolean);
+  const tools = {
+    enabledModules: csv(pick("tools-enabled-modules", "MIKROTIK_TOOLS__ENABLED_MODULES")),
+    disabledModules: csv(pick("tools-disabled-modules", "MIKROTIK_TOOLS__DISABLED_MODULES")),
+    enabledGroups: csv(pick("tools-enabled-groups", "MIKROTIK_TOOLS__ENABLED_GROUPS")),
+    disabledGroups: csv(pick("tools-disabled-groups", "MIKROTIK_TOOLS__DISABLED_GROUPS")),
+    ...fileTools
+  };
   const boolOpt = (v) => v === undefined ? undefined : isTruthy(v);
   const dashboard = {
     enabled: boolOpt(pick("dashboard", "MIKROTIK_DASHBOARD__ENABLED", "MIKROTIK_DASHBOARD")),
@@ -199,6 +217,7 @@ function loadConfig(argv = process.argv.slice(2)) {
     mcp,
     dashboard,
     readOnly,
+    tools,
     ...hasS3 ? { s3 } : {}
   };
   const pruned = JSON.parse(JSON.stringify(raw));
@@ -1048,6 +1067,16 @@ function isEmpty(result) {
   const t = result.trim();
   return t === "" || t === "no such item" || t === "no such item (4)";
 }
+function extractCreatedId(output) {
+  const star = output.match(/\*[0-9A-Fa-f]+/);
+  if (star)
+    return star[0];
+  const num = output.trim().match(/^\d+$/);
+  return num ? num[0] : undefined;
+}
+function readBackUnavailable(details) {
+  return isEmpty(details) || /no such item/i.test(details) || looksLikeError(details);
+}
 function looksLikeError(result) {
   const t = result.toLowerCase();
   return t.includes("failure:") || t.includes("syntax error") || t.includes("bad command") || t.includes("bad parameter") || t.includes("expected end of command") || t.includes("invalid value") || t.includes("input does not match") || t.includes("ambiguous value") || t.startsWith("error");
@@ -6044,16 +6073,17 @@ var firewallFilterTools = [
       ctx.info(`Creating firewall filter rule: chain=${a.chain}, action=${a.action}`);
       const cmd = new Cmd("/ip firewall filter add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("connection-state", a.connection_state).opt("connection-nat-state", a.connection_nat_state).opt("src-address-list", a.src_address_list).opt("dst-address-list", a.dst_address_list).opt("limit", a.limit).opt("tcp-flags", a.tcp_flags).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
       const result = await executeMikrotikCommand(cmd, ctx);
-      if (result.trim()) {
-        const trimmed = result.trim();
-        if (trimmed.includes("*") || isDigits(trimmed)) {
-          const details = await executeMikrotikCommand(`/ip firewall filter print detail where .id=${trimmed}`, ctx);
-          return details.trim() ? `Firewall filter rule created successfully:
+      const trimmed = result.trim();
+      if (looksLikeError(trimmed)) {
+        const hint = placeBeforeError(trimmed, a.place_before);
+        return `Failed to create firewall filter rule: ${hint ?? trimmed}`;
+      }
+      const createdId = extractCreatedId(trimmed);
+      if (createdId) {
+        const details = await executeMikrotikCommand(`/ip firewall filter print detail where .id=${createdId}`, ctx);
+        return readBackUnavailable(details) ? `Firewall filter rule created (id ${createdId}).` : `Firewall filter rule created successfully:
 
-${details}` : `Firewall filter rule created with ID: ${result}`;
-        }
-        const hint = placeBeforeError(result, a.place_before);
-        return `Failed to create firewall filter rule: ${hint ?? result}`;
+${details}`;
       }
       const count = await executeMikrotikCommand("/ip firewall filter print detail count-only", ctx);
       const c = count.trim();
@@ -6341,16 +6371,17 @@ var firewallNatTools = [
       }
       const cmd = new Cmd("/ip firewall nat add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("to-addresses", a.to_addresses).opt("to-ports", a.to_ports).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
       const result = await executeMikrotikCommand(cmd, ctx);
-      if (result.trim()) {
-        const trimmed = result.trim();
-        if (trimmed.includes("*") || isDigits2(trimmed)) {
-          const details = await executeMikrotikCommand(`/ip firewall nat print detail where .id=${trimmed}`, ctx);
-          return details.trim() ? `NAT rule created successfully:
+      const trimmed = result.trim();
+      if (looksLikeError(trimmed)) {
+        const hint = placeBeforeError(trimmed, a.place_before);
+        return `Failed to create NAT rule: ${hint ?? trimmed}`;
+      }
+      const createdId = extractCreatedId(trimmed);
+      if (createdId) {
+        const details = await executeMikrotikCommand(`/ip firewall nat print detail where .id=${createdId}`, ctx);
+        return readBackUnavailable(details) ? `NAT rule created (id ${createdId}).` : `NAT rule created successfully:
 
-${details}` : `NAT rule created with ID: ${result}`;
-        }
-        const hint = placeBeforeError(result, a.place_before);
-        return `Failed to create NAT rule: ${hint ?? result}`;
+${details}`;
       }
       const count = await executeMikrotikCommand("/ip firewall nat print detail count-only", ctx);
       const c = count.trim();
@@ -8013,15 +8044,16 @@ var ipv6FirewallFilterTools = [
       ctx.info(`Creating IPv6 firewall filter rule: chain=${a.chain}, action=${a.action}`);
       const cmd = new Cmd("/ipv6 firewall filter add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("in-interface-list", a.in_interface_list).opt("out-interface-list", a.out_interface_list).opt("connection-state", a.connection_state).opt("src-address-list", a.src_address_list).opt("dst-address-list", a.dst_address_list).opt("hop-limit", a.hop_limit).opt("limit", a.limit).opt("tcp-flags", a.tcp_flags).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
       const result = await executeMikrotikCommand(cmd, ctx);
-      if (result.trim()) {
-        const trimmed = result.trim();
-        if (trimmed.includes("*") || isDigits3(trimmed)) {
-          const details = await executeMikrotikCommand(`/ipv6 firewall filter print detail where .id=${trimmed}`, ctx);
-          return details.trim() ? `IPv6 firewall filter rule created successfully:
+      const trimmed = result.trim();
+      if (looksLikeError(trimmed)) {
+        return `Failed to create IPv6 firewall filter rule: ${trimmed}`;
+      }
+      const createdId = extractCreatedId(trimmed);
+      if (createdId) {
+        const details = await executeMikrotikCommand(`/ipv6 firewall filter print detail where .id=${createdId}`, ctx);
+        return readBackUnavailable(details) ? `IPv6 firewall filter rule created (id ${createdId}).` : `IPv6 firewall filter rule created successfully:
 
-${details}` : `IPv6 firewall filter rule created with ID: ${result}`;
-        }
-        return `Failed to create IPv6 firewall filter rule: ${result}`;
+${details}`;
       }
       const count = await executeMikrotikCommand("/ipv6 firewall filter print detail count-only", ctx);
       const c = count.trim();
@@ -8274,15 +8306,16 @@ var ipv6FirewallNatTools = [
       ctx.info(`Creating IPv6 firewall NAT rule: chain=${a.chain}, action=${a.action}`);
       const cmd = new Cmd("/ipv6 firewall nat add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("to-address", a.to_address).opt("to-ports", a.to_ports).opt("src-address-list", a.src_address_list).opt("dst-address-list", a.dst_address_list).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
       const result = await executeMikrotikCommand(cmd, ctx);
-      if (result.trim()) {
-        const trimmed = result.trim();
-        if (trimmed.includes("*") || isDigits4(trimmed)) {
-          const details = await executeMikrotikCommand(`/ipv6 firewall nat print detail where .id=${trimmed}`, ctx);
-          return details.trim() ? `IPv6 firewall NAT rule created successfully:
+      const trimmed = result.trim();
+      if (looksLikeError(trimmed)) {
+        return `Failed to create IPv6 firewall NAT rule: ${trimmed}`;
+      }
+      const createdId = extractCreatedId(trimmed);
+      if (createdId) {
+        const details = await executeMikrotikCommand(`/ipv6 firewall nat print detail where .id=${createdId}`, ctx);
+        return readBackUnavailable(details) ? `IPv6 firewall NAT rule created (id ${createdId}).` : `IPv6 firewall NAT rule created successfully:
 
-${details}` : `IPv6 firewall NAT rule created with ID: ${result}`;
-        }
-        return `Failed to create IPv6 firewall NAT rule: ${result}`;
+${details}`;
       }
       const count = await executeMikrotikCommand("/ipv6 firewall nat print detail count-only", ctx);
       const c = count.trim();
@@ -8538,15 +8571,16 @@ var ipv6FirewallMangleTools = [
       ctx.info(`Creating IPv6 firewall mangle rule: chain=${a.chain}, action=${a.action}`);
       const cmd = new Cmd("/ipv6 firewall mangle add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("connection-mark", a.connection_mark).opt("packet-mark", a.packet_mark).opt("routing-mark", a.routing_mark).opt("new-connection-mark", a.new_connection_mark).opt("new-packet-mark", a.new_packet_mark).opt("new-routing-mark", a.new_routing_mark).opt("new-dscp", a.new_dscp).opt("new-hop-limit", a.new_hop_limit).bool("passthrough", a.passthrough).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
       const result = await executeMikrotikCommand(cmd, ctx);
-      if (result.trim()) {
-        const trimmed = result.trim();
-        if (trimmed.includes("*") || isDigits5(trimmed)) {
-          const details = await executeMikrotikCommand(`/ipv6 firewall mangle print detail where .id=${trimmed}`, ctx);
-          return details.trim() ? `IPv6 firewall mangle rule created successfully:
+      const trimmed = result.trim();
+      if (looksLikeError(trimmed)) {
+        return `Failed to create IPv6 firewall mangle rule: ${trimmed}`;
+      }
+      const createdId = extractCreatedId(trimmed);
+      if (createdId) {
+        const details = await executeMikrotikCommand(`/ipv6 firewall mangle print detail where .id=${createdId}`, ctx);
+        return readBackUnavailable(details) ? `IPv6 firewall mangle rule created (id ${createdId}).` : `IPv6 firewall mangle rule created successfully:
 
-${details}` : `IPv6 firewall mangle rule created with ID: ${result}`;
-        }
-        return `Failed to create IPv6 firewall mangle rule: ${result}`;
+${details}`;
       }
       const count = await executeMikrotikCommand("/ipv6 firewall mangle print detail count-only", ctx);
       const c = count.trim();
@@ -8777,15 +8811,16 @@ var ipv6FirewallRawTools = [
       ctx.info(`Creating IPv6 firewall raw rule: chain=${a.chain}, action=${a.action}`);
       const cmd = new Cmd("/ipv6 firewall raw add").set("chain", a.chain).set("action", a.action).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("in-interface", a.in_interface).opt("out-interface", a.out_interface).opt("src-address-list", a.src_address_list).opt("dst-address-list", a.dst_address_list).opt("comment", a.comment).flag("disabled", a.disabled).flag("log", a.log).opt("log-prefix", a.log ? a.log_prefix : undefined).opt("place-before", a.place_before).build();
       const result = await executeMikrotikCommand(cmd, ctx);
-      if (result.trim()) {
-        const trimmed = result.trim();
-        if (trimmed.includes("*") || isDigits6(trimmed)) {
-          const details = await executeMikrotikCommand(`/ipv6 firewall raw print detail where .id=${trimmed}`, ctx);
-          return details.trim() ? `IPv6 firewall raw rule created successfully:
+      const trimmed = result.trim();
+      if (looksLikeError(trimmed)) {
+        return `Failed to create IPv6 firewall raw rule: ${trimmed}`;
+      }
+      const createdId = extractCreatedId(trimmed);
+      if (createdId) {
+        const details = await executeMikrotikCommand(`/ipv6 firewall raw print detail where .id=${createdId}`, ctx);
+        return readBackUnavailable(details) ? `IPv6 firewall raw rule created (id ${createdId}).` : `IPv6 firewall raw rule created successfully:
 
-${details}` : `IPv6 firewall raw rule created with ID: ${result}`;
-        }
-        return `Failed to create IPv6 firewall raw rule: ${result}`;
+${details}`;
       }
       const count = await executeMikrotikCommand("/ipv6 firewall raw print detail count-only", ctx);
       const c = count.trim();
@@ -17698,15 +17733,16 @@ var switchRuleTools = [
       ctx.info(`Adding switch rule: switch=${a.switch}, ports=${a.ports}`);
       const cmd = new Cmd("/interface ethernet switch rule add").set("switch", a.switch).set("ports", a.ports).opt("src-address", a.src_address).opt("dst-address", a.dst_address).opt("src-mac-address", a.src_mac_address).opt("dst-mac-address", a.dst_mac_address).opt("src-port", a.src_port).opt("dst-port", a.dst_port).opt("protocol", a.protocol).opt("mac-protocol", a.mac_protocol).opt("vlan-id", a.vlan_id).opt("vlan-priority", a.vlan_priority).opt("dscp", a.dscp).opt("flow-label", a.flow_label).opt("new-dst-ports", a.new_dst_ports).opt("new-vlan-id", a.new_vlan_id).opt("new-vlan-priority", a.new_vlan_priority).bool("redirect-to-cpu", a.redirect_to_cpu).bool("copy-to-cpu", a.copy_to_cpu).bool("mirror", a.mirror).opt("rate", a.rate).opt("comment", a.comment).flag("disabled", a.disabled).build();
       const result = await executeMikrotikCommand(cmd, ctx);
-      if (result.trim()) {
-        const trimmed = result.trim();
-        if (trimmed.includes("*") || isDigits7(trimmed)) {
-          const details = await executeMikrotikCommand(`/interface ethernet switch rule print detail where .id=${trimmed}`, ctx);
-          return details.trim() ? `Switch rule added successfully:
+      const trimmed = result.trim();
+      if (looksLikeError(trimmed)) {
+        return `Failed to add switch rule: ${trimmed}`;
+      }
+      const createdId = extractCreatedId(trimmed);
+      if (createdId) {
+        const details = await executeMikrotikCommand(`/interface ethernet switch rule print detail where .id=${createdId}`, ctx);
+        return readBackUnavailable(details) ? `Switch rule added (id ${createdId}).` : `Switch rule added successfully:
 
-${details}` : `Switch rule added with ID: ${result}`;
-        }
-        return `Failed to add switch rule: ${result}`;
+${details}`;
       }
       const count = await executeMikrotikCommand("/interface ethernet switch rule print detail count-only", ctx);
       const c = count.trim();
@@ -20002,7 +20038,7 @@ ${details}` : "WireGuard interface created successfully.";
     name: "list_wireguard_interfaces",
     title: "List WireGuard Interfaces",
     annotations: READ,
-    description: "Lists WireGuard tunnel interfaces (`/interface wireguard print`). Returns each interface's" + " name, listen-port, public-key, MTU, and running/disabled status." + " Supports filtering by name substring (name_filter), disabled-only, or running-only." + " For the peer table use list_wireguard_peers." + " Use the name from this output with get_wireguard_interface or update_wireguard_interface.",
+    description: "`list_wireguard_interfaces` \u2014 READ / list / show / inspect all WireGuard tunnel interfaces" + " (`/interface wireguard print`). The go-to tool to read the current WireGuard state on a" + " device. Returns each interface's name, listen-port, public-key, MTU, and running/disabled" + " status. Filter by name substring (name_filter), disabled-only, or running-only." + " For one interface's full detail use get_wireguard_interface; for the peer table use" + " list_wireguard_peers; for interfaces AND peers in one call use get_wireguard_status.",
     inputSchema: {
       name_filter: z108.string().optional(),
       disabled_only: z108.boolean().default(false),
@@ -20027,7 +20063,7 @@ ${result}`;
     name: "get_wireguard_interface",
     title: "Get WireGuard Interface Details",
     annotations: READ,
-    description: "Retrieves full detail of a single WireGuard tunnel interface (`/interface wireguard print detail`)" + " looked up by name. Returns listen-port, private-key, public-key, MTU, running state, and comment." + " For the peer table use get_wireguard_peer." + " Use list_wireguard_interfaces to discover available interface names.",
+    description: "`get_wireguard_interface` \u2014 READ / get / show the full detail of ONE WireGuard tunnel interface" + " (`/interface wireguard print detail`) looked up by name. Returns listen-port, private-key," + " public-key, MTU, running state, and comment. To list all interfaces use" + " list_wireguard_interfaces; for that interface's peers use list_wireguard_peers; for" + " interfaces AND peers in one call use get_wireguard_status.",
     inputSchema: { name: z108.string() },
     async handler(a, ctx) {
       ctx.info(`Getting WireGuard interface details: name=${a.name}`);
@@ -20037,6 +20073,31 @@ ${result}`;
 ${result}`;
     }
   }),
+  defineTool({
+    name: "get_wireguard_status",
+    title: "Get WireGuard Status (Interfaces + Peers)",
+    annotations: READ,
+    description: "`get_wireguard_status` \u2014 READ the current WireGuard state on a device in ONE call: ALL tunnel" + " interfaces AND ALL peers together. Use this FIRST to inspect / show / check WireGuard before" + " changing anything (e.g. to read public keys, see which side initiates, or confirm the tunnel" + " is up). Interfaces report name, listen-port, public-key, MTU and running state; peers report" + " .id, interface, public-key, allowed-address, endpoint/current-endpoint, last-handshake time" + " and rx/tx bytes. Combines list_wireguard_interfaces + list_wireguard_peers; optionally filter" + " both to one interface with interface_filter.",
+    inputSchema: {
+      interface_filter: z108.string().optional().describe("Limit to one interface name, e.g. 'wg-mesh'")
+    },
+    async handler(a, ctx) {
+      ctx.info("Reading WireGuard status (interfaces + peers)");
+      const ifFilters = a.interface_filter ? [`name="${a.interface_filter}"`] : [];
+      const peerFilters = a.interface_filter ? [`interface="${a.interface_filter}"`] : [];
+      const interfaces = await executeMikrotikCommand(`/interface wireguard print${whereClause(ifFilters)}`, ctx);
+      const peers = await executeMikrotikCommand(`/interface wireguard peers print${whereClause(peerFilters)}`, ctx);
+      const ifBlock = isEmpty(interfaces) ? "(none)" : interfaces;
+      const peerBlock = isEmpty(peers) ? "(none)" : peers;
+      return `WIREGUARD INTERFACES:
+
+${ifBlock}
+
+WIREGUARD PEERS:
+
+${peerBlock}`;
+    }
+  }),
   defineTool({
     name: "update_wireguard_interface",
     title: "Update WireGuard Interface",
@@ -20149,7 +20210,7 @@ ${details}` : "WireGuard peer added successfully.";
     name: "list_wireguard_peers",
     title: "List WireGuard Peers",
     annotations: READ,
-    description: "Lists all WireGuard peer entries (`/interface wireguard peers print`)." + " Returns each peer's .id, interface, public-key, allowed-address, endpoint, last-handshake time, and rx/tx byte counters." + " Filter by interface name (interface_filter) or disabled-only." + " For the interface table use list_wireguard_interfaces." + " Use the .id from this output with get_wireguard_peer, update_wireguard_peer, remove_wireguard_peer," + " enable_wireguard_peer, or disable_wireguard_peer.",
+    description: "`list_wireguard_peers` \u2014 READ / list / show / inspect all WireGuard peers" + " (`/interface wireguard peers print`). Use this to read which peers are configured and" + " whether the tunnel is up (handshake). Returns each peer's .id, interface, public-key," + " allowed-address, endpoint/current-endpoint, last-handshake time, and rx/tx byte counters." + " Filter by interface name (interface_filter) or disabled-only. For the interface table use" + " list_wireguard_interfaces; for one peer's full detail use get_wireguard_peer; for interfaces" + " AND peers in one call use get_wireguard_status. Use the .id from this output with" + " update_wireguard_peer, remove_wireguard_peer, enable_wireguard_peer, or disable_wireguard_peer.",
     inputSchema: {
       interface_filter: z108.string().optional(),
       disabled_only: z108.boolean().default(false)
@@ -20171,7 +20232,7 @@ ${result}`;
     name: "get_wireguard_peer",
     title: "Get WireGuard Peer Details",
     annotations: READ,
-    description: "Retrieves full detail of a single WireGuard peer (`/interface wireguard peers print detail`) by its .id." + " Returns public-key, allowed-address, endpoint, preshared-key presence, last-handshake time, and rx/tx bytes." + " For the interface table use get_wireguard_interface." + ` Use list_wireguard_peers to obtain peer .id values.
+    description: "`get_wireguard_peer` \u2014 READ / get / show the full detail of ONE WireGuard peer" + " (`/interface wireguard peers print detail`) by its .id. Returns public-key, allowed-address," + " endpoint/current-endpoint, preshared-key presence, last-handshake time, and rx/tx bytes." + " To list all peers use list_wireguard_peers; for interfaces AND peers in one call use" + ` get_wireguard_status.
 
 ` + `Notes:
 ` + '  peer_id: the .id from list_wireguard_peers, format "*N" or "N" e.g. "*2"',
@@ -21611,6 +21672,23 @@ var moduleCatalog = [
   }
 ];
 var allToolModules = moduleCatalog.map((m) => m.tools);
+function selectToolModules(filter = {}, catalog = moduleCatalog) {
+  const lc = (xs) => new Set((xs ?? []).map((s) => s.toLowerCase()));
+  const enabledModules = lc(filter.enabledModules);
+  const disabledModules = lc(filter.disabledModules);
+  const enabledGroups = lc(filter.enabledGroups);
+  const disabledGroups = lc(filter.disabledGroups);
+  const hasAllow = enabledModules.size > 0 || enabledGroups.size > 0;
+  return catalog.filter((m) => {
+    const slug = m.slug.toLowerCase();
+    const group = m.group.toLowerCase();
+    if (disabledModules.has(slug) || disabledGroups.has(group))
+      return false;
+    if (hasAllow && !(enabledModules.has(slug) || enabledGroups.has(group)))
+      return false;
+    return true;
+  }).map((m) => m.tools);
+}
 
 // src/observability/dashboard.ts
 import { readFileSync as readFileSync6 } from "fs";
@@ -23223,7 +23301,7 @@ function registerPrompts(server) {
 // package.json
 var package_default = {
   name: "@usex/mikrotik-mcp",
-  version: "3.7.0",
+  version: "3.9.0",
   description: "MCP server for MikroTik RouterOS \u2014 660+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   keywords: [
     "ai",
@@ -23415,7 +23493,8 @@ function createServer(opts = {}) {
       server.server.sendLoggingMessage({ level, data: message }).catch(() => {});
     } catch {}
   });
-  const toolCount = registerTools(server, allToolModules, {
+  const toolModules = selectToolModules(getConfig().tools);
+  const toolCount = registerTools(server, toolModules, {
     sendLog,
     deviceNames: names,
     readOnly