@usex/mikrotik-mcp 4.10.0 → 4.11.0

package/README.md

@@ -349,6 +349,10 @@ On top of the per-scope tools, the server ships higher-level workflows:
   CRL, segmentation, DNS) plus an orchestrator. Every audit is read-only; every
   fix defaults to dry-run and snapshots + Safe-Modes before writing, remediating
   by explicit `finding_id`.
+- **[Port-Scan Detection](docs/port-scan-detection.md)** — detect (never block) six
+  port-scan signatures (psd, Nmap FIN/NULL/Xmas, SYN/FIN, SYN/RST) by tagging the
+  source, inside a trust-excluding `detect-portscan` jump-gate; explicit signature
+  selection, trust-list pre-flight, snapshot + Safe-Mode apply.
 - **[Packet Capture Studio](docs/packet-capture.md)** — stream mirrored packets to
   the host as TZSP, decode them live in the dashboard, and export `.pcap`.
 - **[Discovery](docs/discovery.md)** — `bun run discover` lists MikroTik devices on
@@ -380,6 +384,7 @@ source** (`bun run gen:schemas`) so they can never drift:
 | **[Config Snapshots](docs/config-snapshots.md)**              | `/export` snapshots + time-travel diff                                |
 | **[Firewall Audit](docs/firewall-audit.md)**                  | Shadowed/broad/dead rules, risk-scored                                |
 | **[Security Hardening](docs/security-hardening.md)**          | Per-category audit+remediate, fix by finding_id, snapshot + Safe-Mode |
+| **[Port-Scan Detection](docs/port-scan-detection.md)**        | Detect+tag six scan signatures behind a trust-excluding jump-gate     |
 | **[Packet Capture Studio](docs/packet-capture.md)**           | Live TZSP capture + pcap export                                       |
 | **[Discovery](docs/discovery.md)**                            | `bun run discover`, MNDP neighbours, topology map                     |
 | **[Config Studio](docs/config-studio.md)**                    | Edit config in the dashboard with autocomplete                        |

package/dist/cli.js

@@ -106,7 +106,7 @@ import {
   updateAaaEntity,
   updateSummaryLine,
   writeBackup
-} from "./shared/cli-vfm5c52q.js";
+} from "./shared/cli-07emrpkr.js";
 
 // src/cli.ts
 import { existsSync as existsSync2 } from "fs";
@@ -1771,6 +1771,29 @@ async function configRoutes(req, url, admin) {
     const rolledBack = admin.rollback(String(body?.pendingId ?? ""));
     return json3({ rolledBack, config: redact(getConfig()) });
   }
+  if (p === "/api/reload" && req.method === "POST") {
+    const body = await readJson(req);
+    if (body?.hard === true) {
+      logger.warn("Dashboard requested a HARD restart \u2014 exiting for supervisor respawn");
+      setTimeout(() => process.exit(0), 300);
+      return json3({
+        ok: true,
+        mode: "restart",
+        note: "Process is exiting now; it only comes back if a supervisor (systemd/docker/pm2/MCP host) respawns it."
+      });
+    }
+    try {
+      const cfg = loadConfig();
+      setConfig(cfg);
+      const devices = Object.keys(cfg.devices);
+      logger.info(`Config reloaded from source \u2014 ${devices.length} device(s): ${devices.join(", ")}`);
+      return json3({ ok: true, mode: "config", count: devices.length, devices });
+    } catch (e) {
+      const error = e instanceof Error ? e.message : String(e);
+      logger.error(`Config reload failed: ${error}`);
+      return json3({ ok: false, error }, 500);
+    }
+  }
   if (p === "/api/config/history" && req.method === "GET") {
     const current = JSON.stringify(redact(getConfig()), null, 2);
     const versions = listVersions().map((v) => {

package/dist/index.js

@@ -29,7 +29,7 @@ import {
   selectToolModules,
   setConfig,
   updateSummaryLine
-} from "./shared/library-vpg7d53z.js";
+} from "./shared/library-pczgrhdt.js";
 // src/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";