@usex/mikrotik-mcp 4.12.0 → 4.14.0

package/dist/shared/{cli-07emrpkr.js → cli-bk79xfcq.js}

@@ -7701,97 +7701,595 @@ ${created.join(`
 // src/tools/container.ts
 import { z as z17 } from "zod";
 
-// src/utils/ip.ts
-function isIpAddress(s) {
-  return /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(s);
+// src/core/firewall-audit.ts
+import * as ipaddr from "ipaddr.js";
+var NON_MATCH = new Set([
+  "#",
+  "flags",
+  "comment",
+  "action",
+  "chain",
+  "bytes",
+  "packets",
+  "log",
+  "log-prefix",
+  "jump-target",
+  ".id",
+  ".nextid",
+  "disabled",
+  "dynamic",
+  "invalid"
+]);
+var TRANSFORM_KEYS = new Set([
+  "to-addresses",
+  "to-ports",
+  "to-address",
+  "to-port",
+  "address-list",
+  "new-connection-mark",
+  "new-packet-mark",
+  "new-routing-mark",
+  "new-dscp",
+  "new-mss",
+  "new-priority",
+  "new-ttl",
+  "jump-target"
+]);
+var NONDETERMINISTIC = new Set([
+  "limit",
+  "dst-limit",
+  "random",
+  "nth",
+  "psd",
+  "connection-bytes",
+  "connection-rate",
+  "rate",
+  "time",
+  "content",
+  "layer7-protocol",
+  "tls-host"
+]);
+var TERMINAL = new Set(["accept", "drop", "reject", "tarpit"]);
+var ADDRESS_KEYS = new Set(["src-address", "dst-address"]);
+var CATCH_ALL_ADDR = new Set(["0.0.0.0/0", "::/0"]);
+function rulesFromRows(rows) {
+  return rows.map((r, i) => {
+    const flags = r.flags ?? "";
+    const match = {};
+    const transform = {};
+    for (const [k, v] of Object.entries(r)) {
+      if (!v || NON_MATCH.has(k))
+        continue;
+      if (TRANSFORM_KEYS.has(k))
+        transform[k] = v;
+      else
+        match[k] = v;
+    }
+    const num = (s) => {
+      if (s == null)
+        return;
+      const n = Number(s.replace(/\s/g, ""));
+      return Number.isFinite(n) ? n : undefined;
+    };
+    return {
+      index: r["#"] != null && /^\d+$/.test(r["#"]) ? Number(r["#"]) : i,
+      chain: r.chain ?? "?",
+      action: r.action ?? "?",
+      disabled: flags.includes("X"),
+      dynamic: flags.includes("D"),
+      comment: r.comment,
+      packets: num(r.packets),
+      bytes: num(r.bytes),
+      match,
+      transform,
+      raw: r
+    };
+  });
 }
-function isIpLike(s) {
-  return /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\/\d+)?$/.test(s);
+function toCidr(value) {
+  try {
+    if (value.includes("/"))
+      return ipaddr.parseCIDR(value);
+    const addr = ipaddr.parse(value);
+    return [addr, addr.kind() === "ipv6" ? 128 : 32];
+  } catch {
+    return null;
+  }
 }
-function isPrivateIp(ip) {
-  const p = ip.split(".").map(Number);
-  if (p.length !== 4)
+function cidrContains(a, b) {
+  const A = toCidr(a);
+  const B = toCidr(b);
+  if (!A || !B)
     return false;
-  if (p[0] === 10)
-    return true;
-  if (p[0] === 172 && p[1] >= 16 && p[1] <= 31)
-    return true;
-  if (p[0] === 192 && p[1] === 168)
-    return true;
-  if (p[0] === 169 && p[1] === 254)
+  const [aAddr, aBits] = A;
+  const [bAddr, bBits] = B;
+  if (aAddr.kind() !== bAddr.kind())
+    return false;
+  if (aBits > bBits)
+    return false;
+  try {
+    return bAddr.match(aAddr, aBits);
+  } catch {
+    return false;
+  }
+}
+function covers(key, aVal, bVal) {
+  if (aVal === bVal)
     return true;
+  if (ADDRESS_KEYS.has(key))
+    return cidrContains(aVal, bVal);
   return false;
 }
-// src/utils/num.ts
-function num(s) {
-  return Number.parseInt(s ?? "0", 10) || 0;
+var INTERFACE_LIST_PAIRS = [
+  ["in-interface-list", "in-interface"],
+  ["out-interface-list", "out-interface"]
+];
+var _ifaceLists;
+function interfaceListCovers(aKey, aVal, bKey, bVal) {
+  if (!_ifaceLists)
+    return;
+  for (const [listKey, ifaceKey] of INTERFACE_LIST_PAIRS) {
+    if (aKey === listKey && bKey === ifaceKey) {
+      const negated = aVal.startsWith("!");
+      const listName = negated ? aVal.slice(1) : aVal;
+      const members = _ifaceLists.get(listName);
+      if (!members)
+        return;
+      const isMember = members.has(bVal);
+      return negated ? !isMember : isMember;
+    }
+  }
+  return;
 }
-// src/utils/or-match.ts
-function orMatch(field, values, op = "~") {
-  if (values.length === 0)
-    return "";
-  const terms = values.map((v) => `${field}${op}"${v.replace(/"/g, "\\\"")}"`);
-  return `(${terms.join(" or ")})`;
+function aCoversB(a, b) {
+  for (const [k, v] of Object.entries(a.match)) {
+    const bv = b.match[k];
+    if (bv !== undefined) {
+      if (!covers(k, v, bv))
+        return false;
+      continue;
+    }
+    let crossCovered = false;
+    for (const [bk, bval] of Object.entries(b.match)) {
+      const result = interfaceListCovers(k, v, bk, bval);
+      if (result === true) {
+        crossCovered = true;
+        break;
+      }
+    }
+    if (!crossCovered)
+      return false;
+  }
+  return true;
 }
-// src/utils/redact-secrets.ts
-var SENSITIVE_KEYS = ["password", "shared-secret", "secret"];
-var REDACT_RE = new RegExp(`(?<![\\w-])(${SENSITIVE_KEYS.join("|")})="[^"]*"`, "g");
-function redactSecrets(text) {
-  return text.replace(REDACT_RE, '$1="***"');
+function matchesAll(rule) {
+  for (const [k, v] of Object.entries(rule.match)) {
+    if (ADDRESS_KEYS.has(k) && CATCH_ALL_ADDR.has(v))
+      continue;
+    return false;
+  }
+  return true;
 }
-// src/utils/tail-lines.ts
-function tailLines(text, n) {
-  if (!n || n <= 0)
-    return text;
-  const lines = text.split(`
-`);
-  return lines.length <= n ? text : lines.slice(-n).join(`
-`);
+function hasNondeterministic(rule) {
+  return Object.keys(rule.match).some((k) => NONDETERMINISTIC.has(k));
 }
-// src/tools/container.ts
-var NOT_AVAILABLE = "Container support is not available on this device. Install the `container` package and enable " + "device-mode (`/system/device-mode/update container=yes`, then physically confirm).";
-function containerMatch(name, tag) {
-  if (name)
-    return `name=${quoteValue(name)}`;
-  if (tag)
-    return `tag~${quoteValue(tag)}`;
-  return null;
+function matchSummary(rule) {
+  const order = [
+    "protocol",
+    "src-address",
+    "src-port",
+    "dst-address",
+    "dst-port",
+    "in-interface",
+    "out-interface",
+    "in-interface-list",
+    "out-interface-list",
+    "connection-state",
+    "src-address-list",
+    "dst-address-list"
+  ];
+  const parts = order.filter((k) => rule.match[k]).map((k) => `${k}=${rule.match[k]}`);
+  return parts.length ? parts.join(" ") : "any";
 }
-var IDENTITY = {
-  name: z17.string().optional().describe("Container name (set via add_container)"),
-  tag: z17.string().optional().describe("Image tag to match (e.g. 'pihole') if no name")
-};
-var containerTools = [
-  defineTool({
-    name: "list_containers",
-    title: "List Containers",
-    annotations: READ,
-    description: "List every OCI container on the device (`/container print`) with its status, image tag, name, VETH " + "interface and root-dir \u2014 the starting point for any container work and the way to POLL the lifecycle, " + "which is asynchronous: status moves extracting \u2192 stopped (ready to start) \u2192 running. Use this to find " + "the `name`/`tag` the other tools take, to confirm an add has finished extracting before start_container, " + "and to confirm a stop has completed before remove_container. Filter by partial `name_filter`, " + "`tag_filter`, or `status_filter` (e.g. 'running', 'stopped'); set `detail=true` for the full property " + "block. For one container use get_container. A container's stdout/stderr is in the system log " + '(`/log print where topics~"container"`) when it was created with logging=yes.',
-    inputSchema: {
-      name_filter: z17.string().optional().describe("Partial container name match"),
-      tag_filter: z17.string().optional().describe("Partial image tag match"),
-      status_filter: z17.string().optional().describe("e.g. 'running', 'stopped'"),
-      detail: z17.boolean().default(false).describe("Show the full per-container property block")
-    },
-    async handler(a, ctx) {
-      ctx.info("Listing containers");
-      const filters = [];
-      if (a.name_filter)
-        filters.push(`name~"${a.name_filter}"`);
-      if (a.tag_filter)
-        filters.push(`tag~"${a.tag_filter}"`);
-      if (a.status_filter)
-        filters.push(`status~"${a.status_filter}"`);
-      const result = await executeMikrotikCommand(`/container print${a.detail ? " detail" : ""}${whereClause(filters)}`, ctx);
-      if (commandUnsupported(result))
-        return NOT_AVAILABLE;
-      return isEmpty(result) ? "No containers found matching the criteria." : `CONTAINERS:
-
-${redactSecrets(result)}`;
-    }
-  }),
-  defineTool({
-    name: "get_container",
+function disableAction(table, index) {
+  const tool = table === "filter" ? "disable_filter_rule" : table === "nat" ? "disable_nat_rule" : undefined;
+  return tool ? { tool, args: { rule_id: String(index) }, label: `Disable rule ${index}` } : undefined;
+}
+function auditFilter(rules) {
+  const findings = [];
+  const active2 = rules.filter((r) => !r.disabled && !r.dynamic);
+  if (rules.length === 0) {
+    findings.push({
+      kind: "no-firewall",
+      severity: "high",
+      table: "filter",
+      chain: "input",
+      title: "No firewall configured",
+      detail: "No firewall filter rules are configured. RouterOS's default policy is ACCEPT, " + "so the device currently allows all input and forwarded traffic.",
+      suggestion: "Add a baseline ruleset: accept established/related, drop invalid, accept what you need, then drop everything else."
+    });
+    return findings;
+  }
+  const chains = [...new Set(active2.map((r) => r.chain))];
+  for (const chain of chains) {
+    const chainRules = active2.filter((r) => r.chain === chain);
+    for (let j = 0;j < chainRules.length; j++) {
+      const b = chainRules[j];
+      if (b.action === "accept" && matchesAll(b)) {
+        const sev = chain === "output" ? "low" : "high";
+        findings.push({
+          kind: "broad-accept",
+          severity: sev,
+          table: "filter",
+          chain,
+          ruleIndex: b.index,
+          title: "Overly broad accept",
+          detail: `Rule ${b.index} accepts ALL traffic in the ${chain} chain (no real match conditions), bypassing every rule after it.`,
+          suggestion: `Scope rule ${b.index} to the specific source/port it should allow, or remove it.`,
+          action: disableAction("filter", b.index)
+        });
+      }
+      for (let i = 0;i < j; i++) {
+        const a = chainRules[i];
+        if (!TERMINAL.has(a.action) || hasNondeterministic(a))
+          continue;
+        if (aCoversB(a, b)) {
+          findings.push({
+            kind: "shadowed",
+            severity: "medium",
+            table: "filter",
+            chain,
+            ruleIndex: b.index,
+            relatedIndex: a.index,
+            title: "Unreachable rule",
+            detail: `Rule ${b.index} (${b.action} ${matchSummary(b)}) can never match \u2014 rule ${a.index} ` + `already ${a.action}s ${matchesAll(a) ? "all traffic" : matchSummary(a)} earlier in the ${chain} chain.`,
+            suggestion: `Remove rule ${b.index}, or move it above rule ${a.index} if it was meant to take effect first.`,
+            action: disableAction("filter", b.index)
+          });
+          break;
+        }
+      }
+    }
+    if ((chain === "input" || chain === "forward") && chainRules.length > 0) {
+      const hasDrop = chainRules.some((r) => (r.action === "drop" || r.action === "reject") && matchesAll(r));
+      if (!hasDrop) {
+        findings.push({
+          kind: "missing-default-drop",
+          severity: "high",
+          table: "filter",
+          chain,
+          title: "No default-drop",
+          detail: `The ${chain} chain has no catch-all drop, so anything not explicitly accepted is ACCEPTED (RouterOS default policy).`,
+          suggestion: `Append a 'drop all' rule at the end of the ${chain} chain.`
+        });
+      }
+    }
+  }
+  findings.push(...duplicateFindings(active2, "filter"));
+  findings.push(...deadFindings(active2, "filter"));
+  return findings;
+}
+function auditTransform(rules, table) {
+  const active2 = rules.filter((r) => !r.disabled && !r.dynamic);
+  return [...duplicateFindings(active2, table), ...deadFindings(active2, table)];
+}
+function ruleKey(r) {
+  const m = Object.entries(r.match).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${k}=${v}`).join("&");
+  const t = Object.entries(r.transform).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${k}=${v}`).join("&");
+  return `${r.chain}|${r.action}|${m}|${t}`;
+}
+function duplicateFindings(active2, table) {
+  const findings = [];
+  const seen = new Map;
+  for (const r of active2) {
+    const key = ruleKey(r);
+    const first = seen.get(key);
+    if (first) {
+      findings.push({
+        kind: "duplicate",
+        severity: "medium",
+        table,
+        chain: r.chain,
+        ruleIndex: r.index,
+        relatedIndex: first.index,
+        title: "Duplicate rule",
+        detail: `Rule ${r.index} in the ${r.chain} chain is identical to rule ${first.index} (same match and action) \u2014 it is redundant.`,
+        suggestion: `Remove the duplicate rule ${r.index}.`,
+        action: disableAction(table, r.index)
+      });
+    } else {
+      seen.set(key, r);
+    }
+  }
+  return findings;
+}
+function deadFindings(active2, table) {
+  const findings = [];
+  for (const r of active2) {
+    if (r.packets === 0) {
+      findings.push({
+        kind: "dead-rule",
+        severity: "low",
+        table,
+        chain: r.chain,
+        ruleIndex: r.index,
+        title: "No hits since boot",
+        detail: `Rule ${r.index} (${r.chain} ${r.action}) has matched 0 packets since the counters last reset \u2014 it may be unused (or the device rebooted recently).`,
+        suggestion: `Confirm rule ${r.index} is still needed; remove it if obsolete.`
+      });
+    }
+  }
+  return findings;
+}
+var WEIGHT2 = { high: 20, medium: 8, low: 2 };
+function grade2(score) {
+  if (score === 0)
+    return "clean";
+  if (score < 15)
+    return "good";
+  if (score < 40)
+    return "fair";
+  if (score < 75)
+    return "poor";
+  return "critical";
+}
+function auditFirewall(input) {
+  _ifaceLists = input.interfaceLists;
+  const findings = [];
+  if (input.filter)
+    findings.push(...auditFilter(input.filter));
+  if (input.nat)
+    findings.push(...auditTransform(input.nat, "nat"));
+  if (input.mangle)
+    findings.push(...auditTransform(input.mangle, "mangle"));
+  const sevRank = { high: 0, medium: 1, low: 2 };
+  findings.sort((a, b) => sevRank[a.severity] - sevRank[b.severity] || a.table.localeCompare(b.table) || (a.ruleIndex ?? -1) - (b.ruleIndex ?? -1));
+  const counts = { high: 0, medium: 0, low: 0, total: findings.length };
+  let raw = 0;
+  for (const f of findings) {
+    counts[f.severity]++;
+    raw += WEIGHT2[f.severity];
+  }
+  const riskScore = Math.min(100, raw);
+  const ruleCount = (input.filter?.length ?? 0) + (input.nat?.length ?? 0) + (input.mangle?.length ?? 0);
+  return { riskScore, grade: grade2(riskScore), counts, ruleCount, findings };
+}
+function renderReport(report, device) {
+  const head = `FIREWALL AUDIT \u2014 ${device}
+
+` + `Risk score: ${report.riskScore}/100 (${report.grade})
+` + `${report.ruleCount} rule(s) analysed \xB7 ${report.counts.high} high, ${report.counts.medium} medium, ${report.counts.low} low
+`;
+  if (report.findings.length === 0) {
+    return `${head}
+No issues found \u2014 the ruleset looks clean. \u2713`;
+  }
+  const body = report.findings.map((f, i) => {
+    const tag = f.severity.toUpperCase().padEnd(6);
+    return `${i + 1}. [${tag}] ${f.title} (${f.table}/${f.chain})
+   ${f.detail}
+   \u2192 ${f.suggestion}`;
+  }).join(`
+
+`);
+  return `${head}
+${body}`;
+}
+
+// src/utils/firewall-query.ts
+async function fetchFilterChainRules(chain, ctx) {
+  const rows = await fetchRows(`/ip firewall filter print detail where chain=${chain}`, ctx);
+  return rulesFromRows(rows);
+}
+async function addressListCount(list, ctx) {
+  const raw = await executeMikrotikCommand(`/ip firewall address-list print count-only where list=${JSON.stringify(list)}`, ctx);
+  const n = Number.parseInt(raw.trim(), 10);
+  return Number.isFinite(n) ? n : 0;
+}
+async function filterChainRuleIds(chain, ctx) {
+  const raw = await executeMikrotikCommand(`:foreach i in=[/ip firewall filter find chain=${chain}] do={:put $i}`, ctx);
+  if (isEmpty(raw))
+    return [];
+  return raw.trim().split(/\r?\n/).map((l) => l.trim()).filter((l) => /^\*[0-9A-Fa-f]+$/.test(l));
+}
+// src/utils/ip.ts
+function isIpAddress(s) {
+  return /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(s);
+}
+function isIpLike(s) {
+  return /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\/\d+)?$/.test(s);
+}
+function isPrivateIp(ip) {
+  const p = ip.split(".").map(Number);
+  if (p.length !== 4)
+    return false;
+  if (p[0] === 10)
+    return true;
+  if (p[0] === 172 && p[1] >= 16 && p[1] <= 31)
+    return true;
+  if (p[0] === 192 && p[1] === 168)
+    return true;
+  if (p[0] === 169 && p[1] === 254)
+    return true;
+  return false;
+}
+// src/utils/num.ts
+function num(s) {
+  return Number.parseInt(s ?? "0", 10) || 0;
+}
+// src/utils/or-match.ts
+function orMatch(field, values, op = "~") {
+  if (values.length === 0)
+    return "";
+  const terms = values.map((v) => `${field}${op}"${v.replace(/"/g, "\\\"")}"`);
+  return `(${terms.join(" or ")})`;
+}
+// src/utils/redact-secrets.ts
+var SENSITIVE_KEYS = ["password", "shared-secret", "secret"];
+var REDACT_RE = new RegExp(`(?<![\\w-])(${SENSITIVE_KEYS.join("|")})="[^"]*"`, "g");
+function redactSecrets(text) {
+  return text.replace(REDACT_RE, '$1="***"');
+}
+// src/utils/safe-mode-apply.ts
+async function applyCommandsDirect(ctx, commands) {
+  let applied = 0;
+  for (const cmd of commands) {
+    const out = await executeMikrotikCommand(cmd, ctx).catch((e) => `error: ${String(e)}`);
+    if (looksLikeError(out) || out.startsWith("error:")) {
+      return { applied, error: out.trim().split(`
+`)[0] };
+    }
+    applied++;
+  }
+  return { applied };
+}
+async function applyWritesSafely(ctx, deviceName, commands, opts = {}) {
+  const total = commands.length;
+  const fallback = opts.allowDirectFallback === true;
+  if (total === 0)
+    return {
+      applied: 0,
+      total,
+      safeMode: "not used (nothing to write)",
+      committed: true,
+      fellBack: false
+    };
+  if (getDevice(deviceName).mac) {
+    if (!fallback)
+      return {
+        applied: 0,
+        total,
+        safeMode: "unavailable (MAC-Telnet device has no Safe Mode)",
+        committed: false,
+        fellBack: false
+      };
+    const r = await applyCommandsDirect(ctx, commands);
+    return {
+      applied: r.applied,
+      total,
+      safeMode: "not used (MAC-Telnet device \u2014 no Safe Mode)",
+      committed: !r.error,
+      error: r.error,
+      fellBack: false
+    };
+  }
+  const mgr = getSafeModeManager(deviceName);
+  const en = await mgr.enable();
+  if (en.startsWith("Error")) {
+    if (!fallback)
+      return {
+        applied: 0,
+        total,
+        safeMode: `failed to enable: ${en}`,
+        committed: false,
+        fellBack: false
+      };
+    const r = await applyCommandsDirect(ctx, commands);
+    return {
+      applied: r.applied,
+      total,
+      safeMode: `unavailable (${en.replace(/^Error:?\s*/, "")}) \u2014 applied directly; snapshot is the rollback point`,
+      committed: !r.error,
+      error: r.error,
+      fellBack: true
+    };
+  }
+  let applied = 0;
+  let wedged;
+  for (const cmd of commands) {
+    const out = await mgr.execute(cmd).catch((e) => `error: ${String(e)}`);
+    if (looksLikeError(out) || out.startsWith("error:")) {
+      wedged = out.trim().split(`
+`)[0];
+      break;
+    }
+    applied++;
+  }
+  if (wedged !== undefined) {
+    await mgr.rollback().catch(() => {
+      return;
+    });
+    if (!fallback)
+      return {
+        applied,
+        total,
+        safeMode: `rolled back (a write failed: ${wedged})`,
+        committed: false,
+        error: wedged,
+        fellBack: false
+      };
+    const r = await applyCommandsDirect(ctx, commands);
+    return {
+      applied: r.applied,
+      total,
+      safeMode: `Safe Mode wedged (${wedged}) \u2014 rolled back and re-applied directly (snapshot is the rollback point)`,
+      committed: !r.error,
+      error: r.error,
+      fellBack: true
+    };
+  }
+  const c = await mgr.commit();
+  return {
+    applied,
+    total,
+    safeMode: c.ok ? "committed" : `commit unclear (${c.message}) \u2014 re-run to reconcile if the operation is idempotent`,
+    committed: c.ok,
+    fellBack: false
+  };
+}
+// src/utils/tail-lines.ts
+function tailLines(text, n) {
+  if (!n || n <= 0)
+    return text;
+  const lines = text.split(`
+`);
+  return lines.length <= n ? text : lines.slice(-n).join(`
+`);
+}
+// src/tools/container.ts
+var NOT_AVAILABLE = "Container support is not available on this device. Install the `container` package and enable " + "device-mode (`/system/device-mode/update container=yes`, then physically confirm).";
+function containerMatch(name, tag) {
+  if (name)
+    return `name=${quoteValue(name)}`;
+  if (tag)
+    return `tag~${quoteValue(tag)}`;
+  return null;
+}
+var IDENTITY = {
+  name: z17.string().optional().describe("Container name (set via add_container)"),
+  tag: z17.string().optional().describe("Image tag to match (e.g. 'pihole') if no name")
+};
+var containerTools = [
+  defineTool({
+    name: "list_containers",
+    title: "List Containers",
+    annotations: READ,
+    description: "List every OCI container on the device (`/container print`) with its status, image tag, name, VETH " + "interface and root-dir \u2014 the starting point for any container work and the way to POLL the lifecycle, " + "which is asynchronous: status moves extracting \u2192 stopped (ready to start) \u2192 running. Use this to find " + "the `name`/`tag` the other tools take, to confirm an add has finished extracting before start_container, " + "and to confirm a stop has completed before remove_container. Filter by partial `name_filter`, " + "`tag_filter`, or `status_filter` (e.g. 'running', 'stopped'); set `detail=true` for the full property " + "block. For one container use get_container. A container's stdout/stderr is in the system log " + '(`/log print where topics~"container"`) when it was created with logging=yes.',
+    inputSchema: {
+      name_filter: z17.string().optional().describe("Partial container name match"),
+      tag_filter: z17.string().optional().describe("Partial image tag match"),
+      status_filter: z17.string().optional().describe("e.g. 'running', 'stopped'"),
+      detail: z17.boolean().default(false).describe("Show the full per-container property block")
+    },
+    async handler(a, ctx) {
+      ctx.info("Listing containers");
+      const filters = [];
+      if (a.name_filter)
+        filters.push(`name~"${a.name_filter}"`);
+      if (a.tag_filter)
+        filters.push(`tag~"${a.tag_filter}"`);
+      if (a.status_filter)
+        filters.push(`status~"${a.status_filter}"`);
+      const result = await executeMikrotikCommand(`/container print${a.detail ? " detail" : ""}${whereClause(filters)}`, ctx);
+      if (commandUnsupported(result))
+        return NOT_AVAILABLE;
+      return isEmpty(result) ? "No containers found matching the criteria." : `CONTAINERS:
+
+${redactSecrets(result)}`;
+    }
+  }),
+  defineTool({
+    name: "get_container",
     title: "Get Container Detail",
     annotations: READ,
     description: "Full detail for one container (`/container print detail`) \u2014 status, image tag, interface, root-dir, " + "env/mounts, cmd/entrypoint, hostname/dns, logging and start-on-boot. Identify by `name` (preferred) or " + "`tag`. Use list_containers to discover identifiers.",
@@ -8497,7 +8995,7 @@ var cache = null;
 async function gateway() {
   if (cache)
     return cache;
-  const { moduleCatalog } = await import("./cli-p6yc41tg.js");
+  const { moduleCatalog } = await import("./cli-cb2zp05h.js");
   const forIndex = [];
   const byName = new Map;
   for (const mod of moduleCatalog) {
@@ -8912,873 +9410,496 @@ ${result}`;
     name: "disable_dns_static",
     title: "Disable DNS Static Record",
     annotations: WRITE_IDEMPOTENT,
-    description: "Deactivates a static DNS record (`/ip dns static set disabled=yes`) without deleting it \u2014 " + "the entry is retained but ignored during resolution. " + "The `entry_id` is the `.id` from list_dns_static. " + "To re-activate use enable_dns_static. " + "To permanently delete use remove_dns_static. " + "Returns the updated entry's full detail.",
-    inputSchema: { entry_id: z21.string() },
-    handler: (a, ctx) => updateDnsStatic({ entry_id: a.entry_id, disabled: true }, ctx)
-  }),
-  defineTool({
-    name: "get_dns_cache",
-    title: "Get DNS Cache Entries",
-    annotations: READ,
-    description: "Lists all hostnames currently held in the router's DNS resolver cache (`/ip dns cache print`). " + "Use to inspect what the router has already resolved and what is available without re-querying " + "upstream servers. " + "For summary statistics (cache-size, cache-used, cache-max-ttl, total entry count) use " + "get_dns_cache_statistics. " + "To clear the cache use flush_dns_cache. " + "Returns the full cache table, or a message if the cache is empty.",
-    async handler(_a, ctx) {
-      ctx.info("Getting DNS cache");
-      const result = await executeMikrotikCommand("/ip dns cache print", ctx);
-      return isEmpty(result) ? "DNS cache is empty." : `DNS CACHE:
-
-${result}`;
-    }
-  }),
-  defineTool({
-    name: "flush_dns_cache",
-    title: "Flush DNS Cache",
-    annotations: DESTRUCTIVE,
-    description: "Clears all cached DNS entries from the router's resolver (`/ip dns cache flush`) \u2014 forces " + "the router to re-query upstream servers for all subsequent lookups. " + "Use after changing upstream servers or adding static records to evict stale cached responses. " + "To inspect the cache before flushing use get_dns_cache. " + "Returns confirmation of the flush.",
-    async handler(_a, ctx) {
-      ctx.info("Flushing DNS cache");
-      const result = await executeMikrotikCommand("/ip dns cache flush", ctx);
-      return result.trim() ? `Flush result: ${result}` : "DNS cache flushed successfully.";
-    }
-  }),
-  defineTool({
-    name: "get_dns_cache_statistics",
-    title: "Get DNS Cache Statistics",
-    annotations: READ,
-    description: "Reports DNS cache utilization metrics \u2014 extracts cache-size, cache-used, and cache-max-ttl " + "from `/ip dns print`, then appends the live count of cached entries from " + "`/ip dns cache print count-only`. " + "Use to assess cache utilization without listing every entry. Works on RouterOS v6 and v7 " + "(there is no `/ip dns cache print stats` command). " + "To see all cached entries use get_dns_cache. " + "To change cache-size or cache-max-ttl use set_dns_servers. " + "Returns cache-related fields and the total entry count.",
-    async handler(_a, ctx) {
-      ctx.info("Getting DNS cache statistics");
-      const settings = await executeMikrotikCommand("/ip dns print", ctx);
-      if (looksLikeError(settings))
-        return `Failed to get DNS cache statistics: ${settings}`;
-      if (isEmpty(settings))
-        return "Unable to retrieve DNS cache statistics.";
-      const cacheLines = settings.split(`
-`).filter((l) => l.toLowerCase().includes("cache"));
-      const stats = cacheLines.length ? cacheLines.join(`
-`) : settings.trim();
-      const count = (await executeMikrotikCommand("/ip dns cache print count-only", ctx)).trim();
-      const entryLine = /^\d+$/.test(count) ? `cached-entries: ${count}
-` : "";
-      return `DNS CACHE STATISTICS:
-
-${entryLine}${stats}`;
-    }
-  }),
-  defineTool({
-    name: "add_dns_regexp",
-    title: "Add DNS Regexp Static Record",
-    annotations: WRITE,
-    description: "Creates a regexp-pattern static DNS record (`/ip dns static add`) that matches any hostname " + "satisfying the given regular expression and resolves it to a fixed IP address (IPv4 or IPv6) \u2014 useful for " + "wildcard domains, captive portals, or ad-blocking. " + "Simplified interface requiring only `regexp` (RouterOS regex) and `address` (IPv4 or IPv6), plus " + "optional `ttl` (default 1d), `comment`, and `disabled`. " + "For full record-type support (CNAME, MX, SRV, TXT) or to set both a hostname and regexp " + "use add_dns_static. " + "Returns the created entry's full detail including its `.id`.",
-    inputSchema: {
-      regexp: z21.string(),
-      address: z21.string(),
-      ttl: z21.string().default("1d"),
-      comment: z21.string().optional(),
-      disabled: z21.boolean().default(false)
-    },
-    handler: (a, ctx) => addDnsStatic({
-      name: "dummy",
-      address: a.address,
-      regexp: a.regexp,
-      ttl: a.ttl,
-      comment: a.comment,
-      disabled: a.disabled
-    }, ctx)
-  }),
-  defineTool({
-    name: "test_dns_query",
-    title: "Test DNS Resolution From Router",
-    annotations: READ,
-    description: "Resolves a hostname using the router's own DNS resolver (`/resolve`) \u2014 tests what address " + "the router itself would obtain for a given name. Optionally directs the query to a specific " + 'upstream `server` (IP) and supports record types via `type` (e.g. "A", "AAAA", "MX"; ' + 'default "A"). ' + "Use to verify DNS reachability, that a static record override is active, or that DoH is " + "working \u2014 all from the router's perspective, not from a client behind it. " + "Returns the resolver's answer for the queried name and type.",
-    inputSchema: {
-      name: z21.string(),
-      server: z21.string().optional(),
-      type: z21.string().default("A")
-    },
-    async handler(a, ctx) {
-      ctx.info(`Testing DNS query: name=${a.name}, type=${a.type}`);
-      let cmd = `/resolve ${a.name}`;
-      if (a.server)
-        cmd += ` server=${a.server}`;
-      if (a.type !== "A")
-        cmd += ` type=${a.type}`;
-      const result = await executeMikrotikCommand(cmd, ctx);
-      return isEmpty(result) ? `Failed to resolve ${a.name}` : `DNS QUERY RESULT for ${a.name}:
-
-${result}`;
-    }
-  }),
-  defineTool({
-    name: "export_dns_config",
-    title: "Export DNS Configuration to File",
-    annotations: READ,
-    description: "Exports the full DNS configuration (resolver settings and static records) to a RouterOS " + "script file on the router's flash storage (`/ip dns export file=<filename>`). " + "The router appends `.rsc` to the filename automatically; defaults to `dns_config.rsc`. " + "The exported file can be imported on another RouterOS device to replicate DNS configuration. " + "To read current settings as structured output without writing a file use get_dns_settings. " + "To list static records use list_dns_static. " + "Returns the filename of the exported `.rsc` file on the router.",
-    inputSchema: { filename: z21.string().optional() },
-    async handler(a, ctx) {
-      ctx.info("Exporting DNS configuration");
-      const filename = a.filename || "dns_config";
-      const result = await executeMikrotikCommand(`/ip dns export file=${filename}`, ctx);
-      return result.trim() ? `Export result: ${result}` : `DNS configuration exported to ${filename}.rsc`;
-    }
-  })
-];
-
-// src/tools/parental-controls.ts
-import { z as z22 } from "zod";
-function buildPolicyCommands(o) {
-  const tag = `parental-${o.name}`;
-  const groups = [];
-  if (o.addresses?.length) {
-    groups.push({
-      label: "Target devices",
-      commands: o.addresses.map((addr) => new Cmd("/ip firewall address-list add").set("list", o.list).set("address", addr).set("comment", tag).build())
-    });
-  }
-  groups.push({
-    label: "Scheduled internet cut-off",
-    commands: [
-      new Cmd("/ip firewall filter add").set("chain", "forward").set("src-address-list", o.list).set("action", "drop").set("comment", tag).set("disabled", "yes").build(),
-      new Cmd("/system scheduler add").set("name", `${tag}-block`).set("start-time", o.blockStart).set("interval", "1d").set("on-event", `/ip firewall filter enable [find comment="${tag}"]`).set("comment", tag).build(),
-      new Cmd("/system scheduler add").set("name", `${tag}-allow`).set("start-time", o.blockEnd).set("interval", "1d").set("on-event", `/ip firewall filter disable [find comment="${tag}"]`).set("comment", tag).build()
-    ]
-  });
-  if (o.blockDomains?.length) {
-    groups.push({
-      label: "Content blocking (DNS sinkhole)",
-      commands: o.blockDomains.map((d) => new Cmd("/ip dns static add").set("name", d).set("address", "0.0.0.0").set("comment", tag).build())
-    });
-  }
-  return groups;
-}
-var parentalControlsTools = [
-  defineTool({
-    name: "set_time_policy",
-    title: "Set Time-of-Day / Parental Policy",
-    annotations: WRITE,
-    description: "Schedules per-device internet access and content blocking. Cuts internet for devices in the " + "`list` address-list between `block_start` and `block_end` daily (a forward-drop rule toggled by " + "two schedulers), optionally adds `addresses` to that list, and DNS-sinkholes any `block_domains` " + "(always blocked). DEFAULTS TO A DRY RUN (`apply=false`) showing every command; set `apply=true` " + "to install. Everything is tagged 'parental-<name>' so remove_time_policy can undo it. Returns " + "the plan or a build report.",
-    inputSchema: {
-      name: z22.string().describe("Policy id, e.g. 'kids-bedtime'"),
-      list: z22.string().default("parental-devices").describe("Address-list of the affected devices"),
-      addresses: z22.array(z22.string()).optional().describe("Device IPs to add to the list"),
-      block_start: z22.string().default("22:00").describe("Daily cut-off time (HH:MM)"),
-      block_end: z22.string().default("07:00").describe("Daily restore time (HH:MM)"),
-      block_domains: z22.array(z22.string()).optional().describe("Domains to always block via DNS"),
-      apply: z22.boolean().default(false).describe("false = preview (default); true = install")
-    },
-    async handler(a, ctx) {
-      const groups = buildPolicyCommands({
-        name: a.name,
-        list: a.list,
-        addresses: a.addresses,
-        blockStart: a.block_start,
-        blockEnd: a.block_end,
-        blockDomains: a.block_domains
-      });
-      const all = groups.flatMap((g) => g.commands);
-      if (!a.apply) {
-        const preview = groups.map((g) => `# ${g.label}
-${g.commands.map((c) => `  ${c}`).join(`
-`)}`).join(`
-
-`);
-        return `DRY RUN \u2014 policy '${a.name}': block ${a.block_start}\u2013${a.block_end} for list '${a.list}'; ${all.length} command(s) (set apply=true to install):
-
-${preview}`;
-      }
-      const done = [];
-      for (const cmd of all) {
-        const result = await executeMikrotikCommand(cmd, ctx);
-        if (looksLikeError(result)) {
-          return `Installed ${done.length}/${all.length}, then FAILED: ${result}`;
-        }
-        done.push(cmd);
-      }
-      return `Policy '${a.name}' installed \u2014 internet for '${a.list}' is blocked ${a.block_start}\u2013${a.block_end} daily${a.block_domains?.length ? `, and ${a.block_domains.length} domain(s) sinkholed` : ""}.`;
-    }
-  }),
-  defineTool({
-    name: "remove_time_policy",
-    title: "Remove Time-of-Day / Parental Policy",
-    annotations: DESTRUCTIVE,
-    description: "Removes a policy installed by set_time_policy: the schedulers, the forward-drop rule, and the " + "DNS sinkhole entries tagged 'parental-<name>'. Address-list members added for it are also " + "removed. Returns what was cleared.",
-    inputSchema: { name: z22.string().describe("The policy id used when installing") },
-    async handler(a, ctx) {
-      const tag = `parental-${a.name}`;
-      ctx.info(`Removing parental policy ${tag}`);
-      const steps = [
-        ["schedulers", `/system scheduler remove [find comment="${tag}"]`],
-        ["firewall rule", `/ip firewall filter remove [find comment="${tag}"]`],
-        ["dns sinkholes", `/ip dns static remove [find comment="${tag}"]`],
-        ["address-list", `/ip firewall address-list remove [find comment="${tag}"]`]
-      ];
-      const cleared = [];
-      for (const [label, cmd] of steps) {
-        const r = await executeMikrotikCommand(cmd, ctx);
-        if (looksLikeError(r))
-          return `Failed removing ${label}: ${r} (cleared: ${cleared.join(", ") || "none"})`;
-        cleared.push(label);
-      }
-      return `Policy '${a.name}' removed (${cleared.join(", ")}).`;
-    }
-  })
-];
-
-// src/tools/dot1x-server.ts
-import { z as z23 } from "zod";
-var AuthTypes = z23.enum(["dot1x", "mac-auth", "dot1x,mac-auth"]);
-var MacAuthMode = z23.enum(["mac-as-username", "mac-as-username-and-password"]);
-var dot1xServerTools = [
-  defineTool({
-    name: "add_dot1x_server",
-    title: "Add 802.1X Server (Authenticator) Entry",
-    annotations: WRITE,
-    description: "Creates an 802.1X authenticator entry on an interface (`/interface dot1x server add`), " + "enabling port-based network access control (IEEE 802.1X) enforced against a RADIUS server. " + "Use this to require EAP supplicant authentication (`dot1x`), MAC-bypass authentication " + "(`mac-auth`), or both on a physical port before granting network access. " + "For viewing existing entries use `list_dot1x_servers`; for modifying use `update_dot1x_server`; " + "for removal use `remove_dot1x_server`. " + `Returns the created entry's full detail.
-
-` + `Notes:
-` + `    auth_types: 'dot1x' (EAP supplicant), 'mac-auth' (MAC bypass), or
-` + `        'dot1x,mac-auth' (both).
-` + `    guest_vlan_id / reject_vlan_id / server_fail_vlan_id: VLAN to assign
-` + `        when there is no supplicant, on auth failure, or when RADIUS is
-` + `        unreachable (number, or 'none').
-` + "    interim_update: RADIUS interim-accounting update interval, e.g. '5m' or '0s'.",
-    inputSchema: {
-      interface: z23.string(),
-      auth_types: AuthTypes.optional(),
-      accounting: z23.boolean().optional(),
-      interim_update: z23.string().optional().describe("e.g. '5m' or '0s'"),
-      mac_auth_mode: MacAuthMode.optional(),
-      guest_vlan_id: z23.string().optional().describe("VLAN id or 'none'"),
-      reject_vlan_id: z23.string().optional().describe("VLAN id or 'none'"),
-      server_fail_vlan_id: z23.string().optional().describe("VLAN id or 'none'"),
-      reauth_timeout: z23.string().optional().describe("Re-auth period or 'none'"),
-      comment: z23.string().optional(),
-      disabled: z23.boolean().default(false)
-    },
-    async handler(a, ctx) {
-      ctx.info(`Adding dot1x server: interface=${a.interface}`);
-      const cmd = new Cmd("/interface dot1x server add").set("interface", a.interface).opt("auth-types", a.auth_types).bool("accounting", a.accounting).opt("interim-update", a.interim_update).opt("mac-auth-mode", a.mac_auth_mode).opt("guest-vlan-id", a.guest_vlan_id).opt("reject-vlan-id", a.reject_vlan_id).opt("server-fail-vlan-id", a.server_fail_vlan_id).opt("reauth-timeout", a.reauth_timeout).opt("comment", a.comment).flag("disabled", a.disabled).build();
-      const result = await executeMikrotikCommand(cmd, ctx);
-      if (looksLikeError(result))
-        return `Failed to add dot1x server: ${result}`;
-      const details = await executeMikrotikCommand(`/interface dot1x server print detail where interface="${a.interface}"`, ctx);
-      return details.trim() ? `Dot1x server added successfully:
-
-${details}` : "Dot1x server addition completed but unable to verify.";
-    }
+    description: "Deactivates a static DNS record (`/ip dns static set disabled=yes`) without deleting it \u2014 " + "the entry is retained but ignored during resolution. " + "The `entry_id` is the `.id` from list_dns_static. " + "To re-activate use enable_dns_static. " + "To permanently delete use remove_dns_static. " + "Returns the updated entry's full detail.",
+    inputSchema: { entry_id: z21.string() },
+    handler: (a, ctx) => updateDnsStatic({ entry_id: a.entry_id, disabled: true }, ctx)
   }),
   defineTool({
-    name: "list_dot1x_servers",
-    title: "List 802.1X Server (Authenticator) Entries",
+    name: "get_dns_cache",
+    title: "Get DNS Cache Entries",
     annotations: READ,
-    description: "Lists all 802.1X authenticator entries (`/interface dot1x server print`). " + "Optionally filter by interface name (`interface_filter`) or restrict output to disabled entries only (`disabled_only=true`). " + "For full detail on a single entry use `get_dot1x_server`. " + "Returns the tabular RouterOS print output including each entry's `.id`, interface, auth-types, and VLAN assignments.",
-    inputSchema: {
-      interface_filter: z23.string().optional(),
-      disabled_only: z23.boolean().default(false)
-    },
-    async handler(a, ctx) {
-      ctx.info("Listing dot1x servers");
-      const filters = [];
-      if (a.interface_filter)
-        filters.push(`interface="${a.interface_filter}"`);
-      if (a.disabled_only)
-        filters.push("disabled=yes");
-      const result = await executeMikrotikCommand(`/interface dot1x server print${whereClause(filters)}`, ctx);
-      return isEmpty(result) ? "No dot1x servers found matching the criteria." : `DOT1X SERVERS:
+    description: "Lists all hostnames currently held in the router's DNS resolver cache (`/ip dns cache print`). " + "Use to inspect what the router has already resolved and what is available without re-querying " + "upstream servers. " + "For summary statistics (cache-size, cache-used, cache-max-ttl, total entry count) use " + "get_dns_cache_statistics. " + "To clear the cache use flush_dns_cache. " + "Returns the full cache table, or a message if the cache is empty.",
+    async handler(_a, ctx) {
+      ctx.info("Getting DNS cache");
+      const result = await executeMikrotikCommand("/ip dns cache print", ctx);
+      return isEmpty(result) ? "DNS cache is empty." : `DNS CACHE:
 
 ${result}`;
     }
   }),
   defineTool({
-    name: "get_dot1x_server",
-    title: "Get 802.1X Server (Authenticator) Entry Detail",
-    annotations: READ,
-    description: "Retrieves full detail of a single 802.1X authenticator entry (`/interface dot1x server print detail`). " + "Accepts either the RouterOS `.id` (e.g. `*1`, from `list_dot1x_servers`) or the interface name (e.g. `ether2`) as `server_id`; " + "tries `.id` lookup first, then falls back to interface-name lookup. " + "For a summary list of all entries use `list_dot1x_servers`. " + "Returns the detailed entry or a not-found message if no match exists.",
-    inputSchema: {
-      server_id: z23.string().describe("Interface name (e.g. 'ether2') or RouterOS '.id'")
-    },
-    async handler(a, ctx) {
-      ctx.info(`Getting dot1x server: server_id=${a.server_id}`);
-      let result = await executeMikrotikCommand(`/interface dot1x server print detail where .id="${a.server_id}"`, ctx);
-      if (isEmpty(result)) {
-        result = await executeMikrotikCommand(`/interface dot1x server print detail where interface="${a.server_id}"`, ctx);
-      }
-      return isEmpty(result) ? `Dot1x server '${a.server_id}' not found.` : `DOT1X SERVER DETAILS:
-
-${result}`;
+    name: "flush_dns_cache",
+    title: "Flush DNS Cache",
+    annotations: DESTRUCTIVE,
+    description: "Clears all cached DNS entries from the router's resolver (`/ip dns cache flush`) \u2014 forces " + "the router to re-query upstream servers for all subsequent lookups. " + "Use after changing upstream servers or adding static records to evict stale cached responses. " + "To inspect the cache before flushing use get_dns_cache. " + "Returns confirmation of the flush.",
+    async handler(_a, ctx) {
+      ctx.info("Flushing DNS cache");
+      const result = await executeMikrotikCommand("/ip dns cache flush", ctx);
+      return result.trim() ? `Flush result: ${result}` : "DNS cache flushed successfully.";
     }
   }),
   defineTool({
-    name: "update_dot1x_server",
-    title: "Update 802.1X Server (Authenticator) Entry",
-    annotations: WRITE_IDEMPOTENT,
-    description: "Modifies an existing 802.1X authenticator entry (`/interface dot1x server set`) identified by interface name or RouterOS `.id`. " + "Pass `server_id` as a `.id` string (starts with `*`, e.g. `*1` \u2014 obtain from `list_dot1x_servers`) or as the interface name (e.g. `ether2`). " + 'Omit any optional field to leave it unchanged; pass `comment=""` to clear the comment. ' + "For creating a new entry use `add_dot1x_server`; for deletion use `remove_dot1x_server`. " + "Returns the updated entry's full detail after the change.",
-    inputSchema: {
-      server_id: z23.string().describe("Interface name or RouterOS '.id'"),
-      auth_types: AuthTypes.optional(),
-      accounting: z23.boolean().optional(),
-      interim_update: z23.string().optional(),
-      mac_auth_mode: MacAuthMode.optional(),
-      guest_vlan_id: z23.string().optional(),
-      reject_vlan_id: z23.string().optional(),
-      server_fail_vlan_id: z23.string().optional(),
-      reauth_timeout: z23.string().optional(),
-      comment: z23.string().optional(),
-      disabled: z23.boolean().optional()
-    },
-    async handler(a, ctx) {
-      ctx.info(`Updating dot1x server: server_id=${a.server_id}`);
-      const selector = a.server_id.startsWith("*") ? `.id="${a.server_id}"` : `interface="${a.server_id}"`;
-      const base = `/interface dot1x server set [find ${selector}]`;
-      const cmd = new Cmd(base).opt("auth-types", a.auth_types).bool("accounting", a.accounting).opt("interim-update", a.interim_update).opt("mac-auth-mode", a.mac_auth_mode).opt("guest-vlan-id", a.guest_vlan_id).opt("reject-vlan-id", a.reject_vlan_id).opt("server-fail-vlan-id", a.server_fail_vlan_id).opt("reauth-timeout", a.reauth_timeout);
-      if (a.comment !== undefined)
-        cmd.raw(`comment=${quoteValue(a.comment)}`);
-      if (a.disabled !== undefined)
-        cmd.raw(`disabled=${yesno(a.disabled)}`);
-      const built = cmd.build();
-      if (built === base)
-        return "No updates specified.";
-      const result = await executeMikrotikCommand(built, ctx);
-      if (looksLikeError(result))
-        return `Failed to update dot1x server: ${result}`;
-      const details = await executeMikrotikCommand(`/interface dot1x server print detail where ${selector}`, ctx);
-      return `Dot1x server updated successfully:
+    name: "get_dns_cache_statistics",
+    title: "Get DNS Cache Statistics",
+    annotations: READ,
+    description: "Reports DNS cache utilization metrics \u2014 extracts cache-size, cache-used, and cache-max-ttl " + "from `/ip dns print`, then appends the live count of cached entries from " + "`/ip dns cache print count-only`. " + "Use to assess cache utilization without listing every entry. Works on RouterOS v6 and v7 " + "(there is no `/ip dns cache print stats` command). " + "To see all cached entries use get_dns_cache. " + "To change cache-size or cache-max-ttl use set_dns_servers. " + "Returns cache-related fields and the total entry count.",
+    async handler(_a, ctx) {
+      ctx.info("Getting DNS cache statistics");
+      const settings = await executeMikrotikCommand("/ip dns print", ctx);
+      if (looksLikeError(settings))
+        return `Failed to get DNS cache statistics: ${settings}`;
+      if (isEmpty(settings))
+        return "Unable to retrieve DNS cache statistics.";
+      const cacheLines = settings.split(`
+`).filter((l) => l.toLowerCase().includes("cache"));
+      const stats = cacheLines.length ? cacheLines.join(`
+`) : settings.trim();
+      const count = (await executeMikrotikCommand("/ip dns cache print count-only", ctx)).trim();
+      const entryLine = /^\d+$/.test(count) ? `cached-entries: ${count}
+` : "";
+      return `DNS CACHE STATISTICS:
 
-${details}`;
+${entryLine}${stats}`;
     }
   }),
   defineTool({
-    name: "remove_dot1x_server",
-    title: "Remove 802.1X Server (Authenticator) Entry",
-    annotations: DESTRUCTIVE,
-    description: "Permanently removes an 802.1X authenticator entry (`/interface dot1x server remove`) identified by interface name or RouterOS `.id`. " + "Pass `server_id` as a `.id` string (starts with `*`, e.g. `*1` \u2014 obtain from `list_dot1x_servers`) or as the interface name (e.g. `ether2`). " + "Verifies the entry exists via a `count-only` check before deletion \u2014 returns a not-found message if absent. " + "For creating an entry use `add_dot1x_server`; for non-destructive disabling use `update_dot1x_server` with `disabled=true`.",
-    inputSchema: {
-      server_id: z23.string().describe("Interface name or RouterOS '.id'")
-    },
-    async handler(a, ctx) {
-      ctx.info(`Removing dot1x server: server_id=${a.server_id}`);
-      const selector = a.server_id.startsWith("*") ? `.id="${a.server_id}"` : `interface="${a.server_id}"`;
-      const count = await executeMikrotikCommand(`/interface dot1x server print count-only where ${selector}`, ctx);
-      if (count.trim() === "0")
-        return `Dot1x server '${a.server_id}' not found.`;
-      const result = await executeMikrotikCommand(`/interface dot1x server remove [find ${selector}]`, ctx);
-      if (looksLikeError(result))
-        return `Failed to remove dot1x server: ${result}`;
-      return `Dot1x server '${a.server_id}' removed successfully.`;
-    }
-  })
-];
-
-// src/tools/dot1x-client.ts
-import { z as z24 } from "zod";
-var dot1xClientTools = [
-  defineTool({
-    name: "add_dot1x_client",
-    title: "Add 802.1X Supplicant Client",
+    name: "add_dns_regexp",
+    title: "Add DNS Regexp Static Record",
     annotations: WRITE,
-    description: "Adds an 802.1X supplicant client entry on a specific interface (`/interface dot1x client add`) " + "so the router authenticates itself to an upstream 802.1X authenticator (e.g. a managed switch " + "or wireless AP). Use this when the MikroTik device is the *supplicant* (client) side of 802.1X " + "\u2014 not the server/authenticator side. " + "`eap_methods` is a comma-separated list, e.g. `'eap-tls'`, `'eap-peap'`, `'eap-mschapv2'`, " + "`'eap-ttls'`; `certificate` is required for eap-tls; `identity`/`password` are required for " + "password-based EAP methods. " + "Returns the created entry's full detail (including its `.id`) which is used by " + "update_dot1x_client, get_dot1x_client, and remove_dot1x_client.",
+    description: "Creates a regexp-pattern static DNS record (`/ip dns static add`) that matches any hostname " + "satisfying the given regular expression and resolves it to a fixed IP address (IPv4 or IPv6) \u2014 useful for " + "wildcard domains, captive portals, or ad-blocking. " + "Simplified interface requiring only `regexp` (RouterOS regex) and `address` (IPv4 or IPv6), plus " + "optional `ttl` (default 1d), `comment`, and `disabled`. " + "For full record-type support (CNAME, MX, SRV, TXT) or to set both a hostname and regexp " + "use add_dns_static. " + "Returns the created entry's full detail including its `.id`.",
     inputSchema: {
-      interface: z24.string(),
-      eap_methods: z24.string().describe("Comma-separated EAP methods, e.g. 'eap-tls' or 'eap-peap,eap-mschapv2'"),
-      identity: z24.string().optional().describe("EAP identity (username)"),
-      anonymous_identity: z24.string().optional(),
-      certificate: z24.string().optional().describe("Client certificate name (required for eap-tls)"),
-      password: z24.string().optional().describe("EAP password (password methods)"),
-      comment: z24.string().optional(),
-      disabled: z24.boolean().default(false)
+      regexp: z21.string(),
+      address: z21.string(),
+      ttl: z21.string().default("1d"),
+      comment: z21.string().optional(),
+      disabled: z21.boolean().default(false)
     },
-    async handler(a, ctx) {
-      ctx.info(`Adding dot1x client: interface=${a.interface}`);
-      const cmd = new Cmd("/interface dot1x client add").set("interface", a.interface).set("eap-methods", a.eap_methods).opt("identity", a.identity).opt("anonymous-identity", a.anonymous_identity).opt("certificate", a.certificate).opt("password", a.password).opt("comment", a.comment).flag("disabled", a.disabled).build();
-      const result = await executeMikrotikCommand(cmd, ctx);
-      if (looksLikeError(result))
-        return `Failed to add dot1x client: ${result}`;
-      const details = await executeMikrotikCommand(`/interface dot1x client print detail where interface="${a.interface}"`, ctx);
-      return details.trim() ? `Dot1x client added successfully:
-
-${details}` : "Dot1x client addition completed but unable to verify.";
-    }
+    handler: (a, ctx) => addDnsStatic({
+      name: "dummy",
+      address: a.address,
+      regexp: a.regexp,
+      ttl: a.ttl,
+      comment: a.comment,
+      disabled: a.disabled
+    }, ctx)
   }),
   defineTool({
-    name: "list_dot1x_clients",
-    title: "List 802.1X Supplicant Clients",
+    name: "test_dns_query",
+    title: "Test DNS Resolution From Router",
     annotations: READ,
-    description: "Lists all 802.1X supplicant client entries configured on the device (`/interface dot1x client print`). " + "Optionally filters by interface name (`interface_filter`), authentication status string " + "(`status_filter`, e.g. `'authenticated'`, `'authenticating'`), or disabled state (`disabled_only`). " + "Returns a table of all matching supplicant entries with their interface, EAP method, and status; " + "for full detail on a single entry use get_dot1x_client.",
+    description: "Resolves a hostname using the router's own DNS resolver (`/resolve`) \u2014 tests what address " + "the router itself would obtain for a given name. Optionally directs the query to a specific " + 'upstream `server` (IP) and supports record types via `type` (e.g. "A", "AAAA", "MX"; ' + 'default "A"). ' + "Use to verify DNS reachability, that a static record override is active, or that DoH is " + "working \u2014 all from the router's perspective, not from a client behind it. " + "Returns the resolver's answer for the queried name and type.",
     inputSchema: {
-      interface_filter: z24.string().optional(),
-      status_filter: z24.string().optional().describe("Match status, e.g. 'authenticated', 'authenticating'"),
-      disabled_only: z24.boolean().default(false)
+      name: z21.string(),
+      server: z21.string().optional(),
+      type: z21.string().default("A")
     },
     async handler(a, ctx) {
-      ctx.info("Listing dot1x clients");
-      const filters = [];
-      if (a.interface_filter)
-        filters.push(`interface="${a.interface_filter}"`);
-      if (a.status_filter)
-        filters.push(`status~"${a.status_filter}"`);
-      if (a.disabled_only)
-        filters.push("disabled=yes");
-      const result = await executeMikrotikCommand(`/interface dot1x client print${whereClause(filters)}`, ctx);
-      return isEmpty(result) ? "No dot1x clients found matching the criteria." : `DOT1X CLIENTS:
+      ctx.info(`Testing DNS query: name=${a.name}, type=${a.type}`);
+      let cmd = `/resolve ${a.name}`;
+      if (a.server)
+        cmd += ` server=${a.server}`;
+      if (a.type !== "A")
+        cmd += ` type=${a.type}`;
+      const result = await executeMikrotikCommand(cmd, ctx);
+      return isEmpty(result) ? `Failed to resolve ${a.name}` : `DNS QUERY RESULT for ${a.name}:
 
 ${result}`;
     }
   }),
   defineTool({
-    name: "get_dot1x_client",
-    title: "Get 802.1X Supplicant Client Detail",
+    name: "export_dns_config",
+    title: "Export DNS Configuration to File",
     annotations: READ,
-    description: "Fetches full detail for a single 802.1X supplicant client entry (`/interface dot1x client print detail`). " + "Accepts either an interface name (e.g. `'ether3'`) or a RouterOS `.id` string (e.g. `'*1'`) from " + "list_dot1x_clients as `client_id` \u2014 tries `.id` lookup first, then falls back to interface name. " + "Returns the complete supplicant configuration including EAP method, identity, certificate, and current " + "authentication status. For a bulk view of all entries use list_dot1x_clients.",
-    inputSchema: {
-      client_id: z24.string().describe("Interface name (e.g. 'ether3') or RouterOS '.id'")
-    },
+    description: "Exports the full DNS configuration (resolver settings and static records) to a RouterOS " + "script file on the router's flash storage (`/ip dns export file=<filename>`). " + "The router appends `.rsc` to the filename automatically; defaults to `dns_config.rsc`. " + "The exported file can be imported on another RouterOS device to replicate DNS configuration. " + "To read current settings as structured output without writing a file use get_dns_settings. " + "To list static records use list_dns_static. " + "Returns the filename of the exported `.rsc` file on the router.",
+    inputSchema: { filename: z21.string().optional() },
     async handler(a, ctx) {
-      ctx.info(`Getting dot1x client: client_id=${a.client_id}`);
-      let result = await executeMikrotikCommand(`/interface dot1x client print detail where .id="${a.client_id}"`, ctx);
-      if (isEmpty(result)) {
-        result = await executeMikrotikCommand(`/interface dot1x client print detail where interface="${a.client_id}"`, ctx);
-      }
-      return isEmpty(result) ? `Dot1x client '${a.client_id}' not found.` : `DOT1X CLIENT DETAILS:
-
-${result}`;
+      ctx.info("Exporting DNS configuration");
+      const filename = a.filename || "dns_config";
+      const result = await executeMikrotikCommand(`/ip dns export file=${filename}`, ctx);
+      return result.trim() ? `Export result: ${result}` : `DNS configuration exported to ${filename}.rsc`;
     }
-  }),
-  defineTool({
-    name: "update_dot1x_client",
-    title: "Update 802.1X Supplicant Client",
-    annotations: WRITE_IDEMPOTENT,
-    description: "Modifies an existing 802.1X supplicant client entry (`/interface dot1x client set`) identified by " + "interface name or RouterOS `.id` from list_dot1x_clients. `client_id` accepts an interface name " + "(e.g. `'ether3'`) or a `.id` string starting with `'*'`. Only supplied fields are changed; " + 'pass `comment=""` to clear the comment. ' + "Returns the updated entry's full detail after the change. To add a new supplicant entry use add_dot1x_client; " + "to delete one use remove_dot1x_client.",
+  })
+];
+
+// src/tools/parental-controls.ts
+import { z as z22 } from "zod";
+function buildPolicyCommands(o) {
+  const tag = `parental-${o.name}`;
+  const groups = [];
+  if (o.addresses?.length) {
+    groups.push({
+      label: "Target devices",
+      commands: o.addresses.map((addr) => new Cmd("/ip firewall address-list add").set("list", o.list).set("address", addr).set("comment", tag).build())
+    });
+  }
+  groups.push({
+    label: "Scheduled internet cut-off",
+    commands: [
+      new Cmd("/ip firewall filter add").set("chain", "forward").set("src-address-list", o.list).set("action", "drop").set("comment", tag).set("disabled", "yes").build(),
+      new Cmd("/system scheduler add").set("name", `${tag}-block`).set("start-time", o.blockStart).set("interval", "1d").set("on-event", `/ip firewall filter enable [find comment="${tag}"]`).set("comment", tag).build(),
+      new Cmd("/system scheduler add").set("name", `${tag}-allow`).set("start-time", o.blockEnd).set("interval", "1d").set("on-event", `/ip firewall filter disable [find comment="${tag}"]`).set("comment", tag).build()
+    ]
+  });
+  if (o.blockDomains?.length) {
+    groups.push({
+      label: "Content blocking (DNS sinkhole)",
+      commands: o.blockDomains.map((d) => new Cmd("/ip dns static add").set("name", d).set("address", "0.0.0.0").set("comment", tag).build())
+    });
+  }
+  return groups;
+}
+var parentalControlsTools = [
+  defineTool({
+    name: "set_time_policy",
+    title: "Set Time-of-Day / Parental Policy",
+    annotations: WRITE,
+    description: "Schedules per-device internet access and content blocking. Cuts internet for devices in the " + "`list` address-list between `block_start` and `block_end` daily (a forward-drop rule toggled by " + "two schedulers), optionally adds `addresses` to that list, and DNS-sinkholes any `block_domains` " + "(always blocked). DEFAULTS TO A DRY RUN (`apply=false`) showing every command; set `apply=true` " + "to install. Everything is tagged 'parental-<name>' so remove_time_policy can undo it. Returns " + "the plan or a build report.",
     inputSchema: {
-      client_id: z24.string().describe("Interface name or RouterOS '.id'"),
-      eap_methods: z24.string().optional(),
-      identity: z24.string().optional(),
-      anonymous_identity: z24.string().optional(),
-      certificate: z24.string().optional(),
-      password: z24.string().optional(),
-      comment: z24.string().optional(),
-      disabled: z24.boolean().optional()
+      name: z22.string().describe("Policy id, e.g. 'kids-bedtime'"),
+      list: z22.string().default("parental-devices").describe("Address-list of the affected devices"),
+      addresses: z22.array(z22.string()).optional().describe("Device IPs to add to the list"),
+      block_start: z22.string().default("22:00").describe("Daily cut-off time (HH:MM)"),
+      block_end: z22.string().default("07:00").describe("Daily restore time (HH:MM)"),
+      block_domains: z22.array(z22.string()).optional().describe("Domains to always block via DNS"),
+      apply: z22.boolean().default(false).describe("false = preview (default); true = install")
     },
     async handler(a, ctx) {
-      ctx.info(`Updating dot1x client: client_id=${a.client_id}`);
-      const selector = a.client_id.startsWith("*") ? `.id="${a.client_id}"` : `interface="${a.client_id}"`;
-      const base = `/interface dot1x client set [find ${selector}]`;
-      const cmd = new Cmd(base).opt("eap-methods", a.eap_methods).opt("identity", a.identity).opt("anonymous-identity", a.anonymous_identity).opt("certificate", a.certificate).opt("password", a.password);
-      if (a.comment !== undefined)
-        cmd.raw(`comment=${quoteValue(a.comment)}`);
-      if (a.disabled !== undefined)
-        cmd.raw(`disabled=${yesno(a.disabled)}`);
-      const built = cmd.build();
-      if (built === base)
-        return "No updates specified.";
-      const result = await executeMikrotikCommand(built, ctx);
-      if (looksLikeError(result))
-        return `Failed to update dot1x client: ${result}`;
-      const details = await executeMikrotikCommand(`/interface dot1x client print detail where ${selector}`, ctx);
-      return `Dot1x client updated successfully:
+      const groups = buildPolicyCommands({
+        name: a.name,
+        list: a.list,
+        addresses: a.addresses,
+        blockStart: a.block_start,
+        blockEnd: a.block_end,
+        blockDomains: a.block_domains
+      });
+      const all = groups.flatMap((g) => g.commands);
+      if (!a.apply) {
+        const preview = groups.map((g) => `# ${g.label}
+${g.commands.map((c) => `  ${c}`).join(`
+`)}`).join(`
 
-${details}`;
+`);
+        return `DRY RUN \u2014 policy '${a.name}': block ${a.block_start}\u2013${a.block_end} for list '${a.list}'; ${all.length} command(s) (set apply=true to install):
+
+${preview}`;
+      }
+      const done = [];
+      for (const cmd of all) {
+        const result = await executeMikrotikCommand(cmd, ctx);
+        if (looksLikeError(result)) {
+          return `Installed ${done.length}/${all.length}, then FAILED: ${result}`;
+        }
+        done.push(cmd);
+      }
+      return `Policy '${a.name}' installed \u2014 internet for '${a.list}' is blocked ${a.block_start}\u2013${a.block_end} daily${a.block_domains?.length ? `, and ${a.block_domains.length} domain(s) sinkholed` : ""}.`;
     }
   }),
   defineTool({
-    name: "remove_dot1x_client",
-    title: "Remove 802.1X Supplicant Client",
+    name: "remove_time_policy",
+    title: "Remove Time-of-Day / Parental Policy",
     annotations: DESTRUCTIVE,
-    description: "Removes an 802.1X supplicant client entry (`/interface dot1x client remove`) identified by interface " + "name or RouterOS `.id` from list_dot1x_clients. `client_id` accepts an interface name (e.g. `'ether3'`) " + "or a `.id` string starting with `'*'`. Verifies the entry exists with a count-only check before deletion " + "and returns an error if not found. Permanently stops 802.1X authentication on that interface; " + "to temporarily halt authentication without deleting the entry use update_dot1x_client with `disabled=true`.",
-    inputSchema: {
-      client_id: z24.string().describe("Interface name or RouterOS '.id'")
-    },
+    description: "Removes a policy installed by set_time_policy: the schedulers, the forward-drop rule, and the " + "DNS sinkhole entries tagged 'parental-<name>'. Address-list members added for it are also " + "removed. Returns what was cleared.",
+    inputSchema: { name: z22.string().describe("The policy id used when installing") },
     async handler(a, ctx) {
-      ctx.info(`Removing dot1x client: client_id=${a.client_id}`);
-      const selector = a.client_id.startsWith("*") ? `.id="${a.client_id}"` : `interface="${a.client_id}"`;
-      const count = await executeMikrotikCommand(`/interface dot1x client print count-only where ${selector}`, ctx);
-      if (count.trim() === "0")
-        return `Dot1x client '${a.client_id}' not found.`;
-      const result = await executeMikrotikCommand(`/interface dot1x client remove [find ${selector}]`, ctx);
-      if (looksLikeError(result))
-        return `Failed to remove dot1x client: ${result}`;
-      return `Dot1x client '${a.client_id}' removed successfully.`;
+      const tag = `parental-${a.name}`;
+      ctx.info(`Removing parental policy ${tag}`);
+      const steps = [
+        ["schedulers", `/system scheduler remove [find comment="${tag}"]`],
+        ["firewall rule", `/ip firewall filter remove [find comment="${tag}"]`],
+        ["dns sinkholes", `/ip dns static remove [find comment="${tag}"]`],
+        ["address-list", `/ip firewall address-list remove [find comment="${tag}"]`]
+      ];
+      const cleared = [];
+      for (const [label, cmd] of steps) {
+        const r = await executeMikrotikCommand(cmd, ctx);
+        if (looksLikeError(r))
+          return `Failed removing ${label}: ${r} (cleared: ${cleared.join(", ") || "none"})`;
+        cleared.push(label);
+      }
+      return `Policy '${a.name}' removed (${cleared.join(", ")}).`;
     }
   })
 ];
 
-// src/tools/firewall-audit.ts
-import { z as z25 } from "zod";
+// src/tools/dot1x-server.ts
+import { z as z23 } from "zod";
+var AuthTypes = z23.enum(["dot1x", "mac-auth", "dot1x,mac-auth"]);
+var MacAuthMode = z23.enum(["mac-as-username", "mac-as-username-and-password"]);
+var dot1xServerTools = [
+  defineTool({
+    name: "add_dot1x_server",
+    title: "Add 802.1X Server (Authenticator) Entry",
+    annotations: WRITE,
+    description: "Creates an 802.1X authenticator entry on an interface (`/interface dot1x server add`), " + "enabling port-based network access control (IEEE 802.1X) enforced against a RADIUS server. " + "Use this to require EAP supplicant authentication (`dot1x`), MAC-bypass authentication " + "(`mac-auth`), or both on a physical port before granting network access. " + "For viewing existing entries use `list_dot1x_servers`; for modifying use `update_dot1x_server`; " + "for removal use `remove_dot1x_server`. " + `Returns the created entry's full detail.
 
-// src/core/firewall-audit.ts
-import * as ipaddr from "ipaddr.js";
-var NON_MATCH = new Set([
-  "#",
-  "flags",
-  "comment",
-  "action",
-  "chain",
-  "bytes",
-  "packets",
-  "log",
-  "log-prefix",
-  "jump-target",
-  ".id",
-  ".nextid",
-  "disabled",
-  "dynamic",
-  "invalid"
-]);
-var TRANSFORM_KEYS = new Set([
-  "to-addresses",
-  "to-ports",
-  "to-address",
-  "to-port",
-  "address-list",
-  "new-connection-mark",
-  "new-packet-mark",
-  "new-routing-mark",
-  "new-dscp",
-  "new-mss",
-  "new-priority",
-  "new-ttl",
-  "jump-target"
-]);
-var NONDETERMINISTIC = new Set([
-  "limit",
-  "dst-limit",
-  "random",
-  "nth",
-  "psd",
-  "connection-bytes",
-  "connection-rate",
-  "rate",
-  "time",
-  "content",
-  "layer7-protocol",
-  "tls-host"
-]);
-var TERMINAL = new Set(["accept", "drop", "reject", "tarpit"]);
-var ADDRESS_KEYS = new Set(["src-address", "dst-address"]);
-var CATCH_ALL_ADDR = new Set(["0.0.0.0/0", "::/0"]);
-function rulesFromRows(rows) {
-  return rows.map((r, i) => {
-    const flags = r.flags ?? "";
-    const match = {};
-    const transform = {};
-    for (const [k, v] of Object.entries(r)) {
-      if (!v || NON_MATCH.has(k))
-        continue;
-      if (TRANSFORM_KEYS.has(k))
-        transform[k] = v;
-      else
-        match[k] = v;
-    }
-    const num2 = (s) => {
-      if (s == null)
-        return;
-      const n = Number(s.replace(/\s/g, ""));
-      return Number.isFinite(n) ? n : undefined;
-    };
-    return {
-      index: r["#"] != null && /^\d+$/.test(r["#"]) ? Number(r["#"]) : i,
-      chain: r.chain ?? "?",
-      action: r.action ?? "?",
-      disabled: flags.includes("X"),
-      dynamic: flags.includes("D"),
-      comment: r.comment,
-      packets: num2(r.packets),
-      bytes: num2(r.bytes),
-      match,
-      transform,
-      raw: r
-    };
-  });
-}
-function toCidr(value) {
-  try {
-    if (value.includes("/"))
-      return ipaddr.parseCIDR(value);
-    const addr = ipaddr.parse(value);
-    return [addr, addr.kind() === "ipv6" ? 128 : 32];
-  } catch {
-    return null;
-  }
-}
-function cidrContains(a, b) {
-  const A = toCidr(a);
-  const B = toCidr(b);
-  if (!A || !B)
-    return false;
-  const [aAddr, aBits] = A;
-  const [bAddr, bBits] = B;
-  if (aAddr.kind() !== bAddr.kind())
-    return false;
-  if (aBits > bBits)
-    return false;
-  try {
-    return bAddr.match(aAddr, aBits);
-  } catch {
-    return false;
-  }
-}
-function covers(key, aVal, bVal) {
-  if (aVal === bVal)
-    return true;
-  if (ADDRESS_KEYS.has(key))
-    return cidrContains(aVal, bVal);
-  return false;
-}
-var INTERFACE_LIST_PAIRS = [
-  ["in-interface-list", "in-interface"],
-  ["out-interface-list", "out-interface"]
-];
-var _ifaceLists;
-function interfaceListCovers(aKey, aVal, bKey, bVal) {
-  if (!_ifaceLists)
-    return;
-  for (const [listKey, ifaceKey] of INTERFACE_LIST_PAIRS) {
-    if (aKey === listKey && bKey === ifaceKey) {
-      const negated = aVal.startsWith("!");
-      const listName = negated ? aVal.slice(1) : aVal;
-      const members = _ifaceLists.get(listName);
-      if (!members)
-        return;
-      const isMember = members.has(bVal);
-      return negated ? !isMember : isMember;
+` + `Notes:
+` + `    auth_types: 'dot1x' (EAP supplicant), 'mac-auth' (MAC bypass), or
+` + `        'dot1x,mac-auth' (both).
+` + `    guest_vlan_id / reject_vlan_id / server_fail_vlan_id: VLAN to assign
+` + `        when there is no supplicant, on auth failure, or when RADIUS is
+` + `        unreachable (number, or 'none').
+` + "    interim_update: RADIUS interim-accounting update interval, e.g. '5m' or '0s'.",
+    inputSchema: {
+      interface: z23.string(),
+      auth_types: AuthTypes.optional(),
+      accounting: z23.boolean().optional(),
+      interim_update: z23.string().optional().describe("e.g. '5m' or '0s'"),
+      mac_auth_mode: MacAuthMode.optional(),
+      guest_vlan_id: z23.string().optional().describe("VLAN id or 'none'"),
+      reject_vlan_id: z23.string().optional().describe("VLAN id or 'none'"),
+      server_fail_vlan_id: z23.string().optional().describe("VLAN id or 'none'"),
+      reauth_timeout: z23.string().optional().describe("Re-auth period or 'none'"),
+      comment: z23.string().optional(),
+      disabled: z23.boolean().default(false)
+    },
+    async handler(a, ctx) {
+      ctx.info(`Adding dot1x server: interface=${a.interface}`);
+      const cmd = new Cmd("/interface dot1x server add").set("interface", a.interface).opt("auth-types", a.auth_types).bool("accounting", a.accounting).opt("interim-update", a.interim_update).opt("mac-auth-mode", a.mac_auth_mode).opt("guest-vlan-id", a.guest_vlan_id).opt("reject-vlan-id", a.reject_vlan_id).opt("server-fail-vlan-id", a.server_fail_vlan_id).opt("reauth-timeout", a.reauth_timeout).opt("comment", a.comment).flag("disabled", a.disabled).build();
+      const result = await executeMikrotikCommand(cmd, ctx);
+      if (looksLikeError(result))
+        return `Failed to add dot1x server: ${result}`;
+      const details = await executeMikrotikCommand(`/interface dot1x server print detail where interface="${a.interface}"`, ctx);
+      return details.trim() ? `Dot1x server added successfully:
+
+${details}` : "Dot1x server addition completed but unable to verify.";
     }
-  }
-  return;
-}
-function aCoversB(a, b) {
-  for (const [k, v] of Object.entries(a.match)) {
-    const bv = b.match[k];
-    if (bv !== undefined) {
-      if (!covers(k, v, bv))
-        return false;
-      continue;
+  }),
+  defineTool({
+    name: "list_dot1x_servers",
+    title: "List 802.1X Server (Authenticator) Entries",
+    annotations: READ,
+    description: "Lists all 802.1X authenticator entries (`/interface dot1x server print`). " + "Optionally filter by interface name (`interface_filter`) or restrict output to disabled entries only (`disabled_only=true`). " + "For full detail on a single entry use `get_dot1x_server`. " + "Returns the tabular RouterOS print output including each entry's `.id`, interface, auth-types, and VLAN assignments.",
+    inputSchema: {
+      interface_filter: z23.string().optional(),
+      disabled_only: z23.boolean().default(false)
+    },
+    async handler(a, ctx) {
+      ctx.info("Listing dot1x servers");
+      const filters = [];
+      if (a.interface_filter)
+        filters.push(`interface="${a.interface_filter}"`);
+      if (a.disabled_only)
+        filters.push("disabled=yes");
+      const result = await executeMikrotikCommand(`/interface dot1x server print${whereClause(filters)}`, ctx);
+      return isEmpty(result) ? "No dot1x servers found matching the criteria." : `DOT1X SERVERS:
+
+${result}`;
     }
-    let crossCovered = false;
-    for (const [bk, bval] of Object.entries(b.match)) {
-      const result = interfaceListCovers(k, v, bk, bval);
-      if (result === true) {
-        crossCovered = true;
-        break;
+  }),
+  defineTool({
+    name: "get_dot1x_server",
+    title: "Get 802.1X Server (Authenticator) Entry Detail",
+    annotations: READ,
+    description: "Retrieves full detail of a single 802.1X authenticator entry (`/interface dot1x server print detail`). " + "Accepts either the RouterOS `.id` (e.g. `*1`, from `list_dot1x_servers`) or the interface name (e.g. `ether2`) as `server_id`; " + "tries `.id` lookup first, then falls back to interface-name lookup. " + "For a summary list of all entries use `list_dot1x_servers`. " + "Returns the detailed entry or a not-found message if no match exists.",
+    inputSchema: {
+      server_id: z23.string().describe("Interface name (e.g. 'ether2') or RouterOS '.id'")
+    },
+    async handler(a, ctx) {
+      ctx.info(`Getting dot1x server: server_id=${a.server_id}`);
+      let result = await executeMikrotikCommand(`/interface dot1x server print detail where .id="${a.server_id}"`, ctx);
+      if (isEmpty(result)) {
+        result = await executeMikrotikCommand(`/interface dot1x server print detail where interface="${a.server_id}"`, ctx);
       }
+      return isEmpty(result) ? `Dot1x server '${a.server_id}' not found.` : `DOT1X SERVER DETAILS:
+
+${result}`;
     }
-    if (!crossCovered)
-      return false;
-  }
-  return true;
-}
-function matchesAll(rule) {
-  for (const [k, v] of Object.entries(rule.match)) {
-    if (ADDRESS_KEYS.has(k) && CATCH_ALL_ADDR.has(v))
-      continue;
-    return false;
-  }
-  return true;
-}
-function hasNondeterministic(rule) {
-  return Object.keys(rule.match).some((k) => NONDETERMINISTIC.has(k));
-}
-function matchSummary(rule) {
-  const order = [
-    "protocol",
-    "src-address",
-    "src-port",
-    "dst-address",
-    "dst-port",
-    "in-interface",
-    "out-interface",
-    "in-interface-list",
-    "out-interface-list",
-    "connection-state",
-    "src-address-list",
-    "dst-address-list"
-  ];
-  const parts = order.filter((k) => rule.match[k]).map((k) => `${k}=${rule.match[k]}`);
-  return parts.length ? parts.join(" ") : "any";
-}
-function disableAction(table, index) {
-  const tool = table === "filter" ? "disable_filter_rule" : table === "nat" ? "disable_nat_rule" : undefined;
-  return tool ? { tool, args: { rule_id: String(index) }, label: `Disable rule ${index}` } : undefined;
-}
-function auditFilter(rules) {
-  const findings = [];
-  const active2 = rules.filter((r) => !r.disabled && !r.dynamic);
-  if (rules.length === 0) {
-    findings.push({
-      kind: "no-firewall",
-      severity: "high",
-      table: "filter",
-      chain: "input",
-      title: "No firewall configured",
-      detail: "No firewall filter rules are configured. RouterOS's default policy is ACCEPT, " + "so the device currently allows all input and forwarded traffic.",
-      suggestion: "Add a baseline ruleset: accept established/related, drop invalid, accept what you need, then drop everything else."
-    });
-    return findings;
-  }
-  const chains = [...new Set(active2.map((r) => r.chain))];
-  for (const chain of chains) {
-    const chainRules = active2.filter((r) => r.chain === chain);
-    for (let j = 0;j < chainRules.length; j++) {
-      const b = chainRules[j];
-      if (b.action === "accept" && matchesAll(b)) {
-        const sev = chain === "output" ? "low" : "high";
-        findings.push({
-          kind: "broad-accept",
-          severity: sev,
-          table: "filter",
-          chain,
-          ruleIndex: b.index,
-          title: "Overly broad accept",
-          detail: `Rule ${b.index} accepts ALL traffic in the ${chain} chain (no real match conditions), bypassing every rule after it.`,
-          suggestion: `Scope rule ${b.index} to the specific source/port it should allow, or remove it.`,
-          action: disableAction("filter", b.index)
-        });
-      }
-      for (let i = 0;i < j; i++) {
-        const a = chainRules[i];
-        if (!TERMINAL.has(a.action) || hasNondeterministic(a))
-          continue;
-        if (aCoversB(a, b)) {
-          findings.push({
-            kind: "shadowed",
-            severity: "medium",
-            table: "filter",
-            chain,
-            ruleIndex: b.index,
-            relatedIndex: a.index,
-            title: "Unreachable rule",
-            detail: `Rule ${b.index} (${b.action} ${matchSummary(b)}) can never match \u2014 rule ${a.index} ` + `already ${a.action}s ${matchesAll(a) ? "all traffic" : matchSummary(a)} earlier in the ${chain} chain.`,
-            suggestion: `Remove rule ${b.index}, or move it above rule ${a.index} if it was meant to take effect first.`,
-            action: disableAction("filter", b.index)
-          });
-          break;
-        }
-      }
+  }),
+  defineTool({
+    name: "update_dot1x_server",
+    title: "Update 802.1X Server (Authenticator) Entry",
+    annotations: WRITE_IDEMPOTENT,
+    description: "Modifies an existing 802.1X authenticator entry (`/interface dot1x server set`) identified by interface name or RouterOS `.id`. " + "Pass `server_id` as a `.id` string (starts with `*`, e.g. `*1` \u2014 obtain from `list_dot1x_servers`) or as the interface name (e.g. `ether2`). " + 'Omit any optional field to leave it unchanged; pass `comment=""` to clear the comment. ' + "For creating a new entry use `add_dot1x_server`; for deletion use `remove_dot1x_server`. " + "Returns the updated entry's full detail after the change.",
+    inputSchema: {
+      server_id: z23.string().describe("Interface name or RouterOS '.id'"),
+      auth_types: AuthTypes.optional(),
+      accounting: z23.boolean().optional(),
+      interim_update: z23.string().optional(),
+      mac_auth_mode: MacAuthMode.optional(),
+      guest_vlan_id: z23.string().optional(),
+      reject_vlan_id: z23.string().optional(),
+      server_fail_vlan_id: z23.string().optional(),
+      reauth_timeout: z23.string().optional(),
+      comment: z23.string().optional(),
+      disabled: z23.boolean().optional()
+    },
+    async handler(a, ctx) {
+      ctx.info(`Updating dot1x server: server_id=${a.server_id}`);
+      const selector = a.server_id.startsWith("*") ? `.id="${a.server_id}"` : `interface="${a.server_id}"`;
+      const base = `/interface dot1x server set [find ${selector}]`;
+      const cmd = new Cmd(base).opt("auth-types", a.auth_types).bool("accounting", a.accounting).opt("interim-update", a.interim_update).opt("mac-auth-mode", a.mac_auth_mode).opt("guest-vlan-id", a.guest_vlan_id).opt("reject-vlan-id", a.reject_vlan_id).opt("server-fail-vlan-id", a.server_fail_vlan_id).opt("reauth-timeout", a.reauth_timeout);
+      if (a.comment !== undefined)
+        cmd.raw(`comment=${quoteValue(a.comment)}`);
+      if (a.disabled !== undefined)
+        cmd.raw(`disabled=${yesno(a.disabled)}`);
+      const built = cmd.build();
+      if (built === base)
+        return "No updates specified.";
+      const result = await executeMikrotikCommand(built, ctx);
+      if (looksLikeError(result))
+        return `Failed to update dot1x server: ${result}`;
+      const details = await executeMikrotikCommand(`/interface dot1x server print detail where ${selector}`, ctx);
+      return `Dot1x server updated successfully:
+
+${details}`;
+    }
+  }),
+  defineTool({
+    name: "remove_dot1x_server",
+    title: "Remove 802.1X Server (Authenticator) Entry",
+    annotations: DESTRUCTIVE,
+    description: "Permanently removes an 802.1X authenticator entry (`/interface dot1x server remove`) identified by interface name or RouterOS `.id`. " + "Pass `server_id` as a `.id` string (starts with `*`, e.g. `*1` \u2014 obtain from `list_dot1x_servers`) or as the interface name (e.g. `ether2`). " + "Verifies the entry exists via a `count-only` check before deletion \u2014 returns a not-found message if absent. " + "For creating an entry use `add_dot1x_server`; for non-destructive disabling use `update_dot1x_server` with `disabled=true`.",
+    inputSchema: {
+      server_id: z23.string().describe("Interface name or RouterOS '.id'")
+    },
+    async handler(a, ctx) {
+      ctx.info(`Removing dot1x server: server_id=${a.server_id}`);
+      const selector = a.server_id.startsWith("*") ? `.id="${a.server_id}"` : `interface="${a.server_id}"`;
+      const count = await executeMikrotikCommand(`/interface dot1x server print count-only where ${selector}`, ctx);
+      if (count.trim() === "0")
+        return `Dot1x server '${a.server_id}' not found.`;
+      const result = await executeMikrotikCommand(`/interface dot1x server remove [find ${selector}]`, ctx);
+      if (looksLikeError(result))
+        return `Failed to remove dot1x server: ${result}`;
+      return `Dot1x server '${a.server_id}' removed successfully.`;
+    }
+  })
+];
+
+// src/tools/dot1x-client.ts
+import { z as z24 } from "zod";
+var dot1xClientTools = [
+  defineTool({
+    name: "add_dot1x_client",
+    title: "Add 802.1X Supplicant Client",
+    annotations: WRITE,
+    description: "Adds an 802.1X supplicant client entry on a specific interface (`/interface dot1x client add`) " + "so the router authenticates itself to an upstream 802.1X authenticator (e.g. a managed switch " + "or wireless AP). Use this when the MikroTik device is the *supplicant* (client) side of 802.1X " + "\u2014 not the server/authenticator side. " + "`eap_methods` is a comma-separated list, e.g. `'eap-tls'`, `'eap-peap'`, `'eap-mschapv2'`, " + "`'eap-ttls'`; `certificate` is required for eap-tls; `identity`/`password` are required for " + "password-based EAP methods. " + "Returns the created entry's full detail (including its `.id`) which is used by " + "update_dot1x_client, get_dot1x_client, and remove_dot1x_client.",
+    inputSchema: {
+      interface: z24.string(),
+      eap_methods: z24.string().describe("Comma-separated EAP methods, e.g. 'eap-tls' or 'eap-peap,eap-mschapv2'"),
+      identity: z24.string().optional().describe("EAP identity (username)"),
+      anonymous_identity: z24.string().optional(),
+      certificate: z24.string().optional().describe("Client certificate name (required for eap-tls)"),
+      password: z24.string().optional().describe("EAP password (password methods)"),
+      comment: z24.string().optional(),
+      disabled: z24.boolean().default(false)
+    },
+    async handler(a, ctx) {
+      ctx.info(`Adding dot1x client: interface=${a.interface}`);
+      const cmd = new Cmd("/interface dot1x client add").set("interface", a.interface).set("eap-methods", a.eap_methods).opt("identity", a.identity).opt("anonymous-identity", a.anonymous_identity).opt("certificate", a.certificate).opt("password", a.password).opt("comment", a.comment).flag("disabled", a.disabled).build();
+      const result = await executeMikrotikCommand(cmd, ctx);
+      if (looksLikeError(result))
+        return `Failed to add dot1x client: ${result}`;
+      const details = await executeMikrotikCommand(`/interface dot1x client print detail where interface="${a.interface}"`, ctx);
+      return details.trim() ? `Dot1x client added successfully:
+
+${details}` : "Dot1x client addition completed but unable to verify.";
+    }
+  }),
+  defineTool({
+    name: "list_dot1x_clients",
+    title: "List 802.1X Supplicant Clients",
+    annotations: READ,
+    description: "Lists all 802.1X supplicant client entries configured on the device (`/interface dot1x client print`). " + "Optionally filters by interface name (`interface_filter`), authentication status string " + "(`status_filter`, e.g. `'authenticated'`, `'authenticating'`), or disabled state (`disabled_only`). " + "Returns a table of all matching supplicant entries with their interface, EAP method, and status; " + "for full detail on a single entry use get_dot1x_client.",
+    inputSchema: {
+      interface_filter: z24.string().optional(),
+      status_filter: z24.string().optional().describe("Match status, e.g. 'authenticated', 'authenticating'"),
+      disabled_only: z24.boolean().default(false)
+    },
+    async handler(a, ctx) {
+      ctx.info("Listing dot1x clients");
+      const filters = [];
+      if (a.interface_filter)
+        filters.push(`interface="${a.interface_filter}"`);
+      if (a.status_filter)
+        filters.push(`status~"${a.status_filter}"`);
+      if (a.disabled_only)
+        filters.push("disabled=yes");
+      const result = await executeMikrotikCommand(`/interface dot1x client print${whereClause(filters)}`, ctx);
+      return isEmpty(result) ? "No dot1x clients found matching the criteria." : `DOT1X CLIENTS:
+
+${result}`;
     }
-    if ((chain === "input" || chain === "forward") && chainRules.length > 0) {
-      const hasDrop = chainRules.some((r) => (r.action === "drop" || r.action === "reject") && matchesAll(r));
-      if (!hasDrop) {
-        findings.push({
-          kind: "missing-default-drop",
-          severity: "high",
-          table: "filter",
-          chain,
-          title: "No default-drop",
-          detail: `The ${chain} chain has no catch-all drop, so anything not explicitly accepted is ACCEPTED (RouterOS default policy).`,
-          suggestion: `Append a 'drop all' rule at the end of the ${chain} chain.`
-        });
+  }),
+  defineTool({
+    name: "get_dot1x_client",
+    title: "Get 802.1X Supplicant Client Detail",
+    annotations: READ,
+    description: "Fetches full detail for a single 802.1X supplicant client entry (`/interface dot1x client print detail`). " + "Accepts either an interface name (e.g. `'ether3'`) or a RouterOS `.id` string (e.g. `'*1'`) from " + "list_dot1x_clients as `client_id` \u2014 tries `.id` lookup first, then falls back to interface name. " + "Returns the complete supplicant configuration including EAP method, identity, certificate, and current " + "authentication status. For a bulk view of all entries use list_dot1x_clients.",
+    inputSchema: {
+      client_id: z24.string().describe("Interface name (e.g. 'ether3') or RouterOS '.id'")
+    },
+    async handler(a, ctx) {
+      ctx.info(`Getting dot1x client: client_id=${a.client_id}`);
+      let result = await executeMikrotikCommand(`/interface dot1x client print detail where .id="${a.client_id}"`, ctx);
+      if (isEmpty(result)) {
+        result = await executeMikrotikCommand(`/interface dot1x client print detail where interface="${a.client_id}"`, ctx);
       }
+      return isEmpty(result) ? `Dot1x client '${a.client_id}' not found.` : `DOT1X CLIENT DETAILS:
+
+${result}`;
     }
-  }
-  findings.push(...duplicateFindings(active2, "filter"));
-  findings.push(...deadFindings(active2, "filter"));
-  return findings;
-}
-function auditTransform(rules, table) {
-  const active2 = rules.filter((r) => !r.disabled && !r.dynamic);
-  return [...duplicateFindings(active2, table), ...deadFindings(active2, table)];
-}
-function ruleKey(r) {
-  const m = Object.entries(r.match).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${k}=${v}`).join("&");
-  const t = Object.entries(r.transform).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${k}=${v}`).join("&");
-  return `${r.chain}|${r.action}|${m}|${t}`;
-}
-function duplicateFindings(active2, table) {
-  const findings = [];
-  const seen = new Map;
-  for (const r of active2) {
-    const key = ruleKey(r);
-    const first = seen.get(key);
-    if (first) {
-      findings.push({
-        kind: "duplicate",
-        severity: "medium",
-        table,
-        chain: r.chain,
-        ruleIndex: r.index,
-        relatedIndex: first.index,
-        title: "Duplicate rule",
-        detail: `Rule ${r.index} in the ${r.chain} chain is identical to rule ${first.index} (same match and action) \u2014 it is redundant.`,
-        suggestion: `Remove the duplicate rule ${r.index}.`,
-        action: disableAction(table, r.index)
-      });
-    } else {
-      seen.set(key, r);
+  }),
+  defineTool({
+    name: "update_dot1x_client",
+    title: "Update 802.1X Supplicant Client",
+    annotations: WRITE_IDEMPOTENT,
+    description: "Modifies an existing 802.1X supplicant client entry (`/interface dot1x client set`) identified by " + "interface name or RouterOS `.id` from list_dot1x_clients. `client_id` accepts an interface name " + "(e.g. `'ether3'`) or a `.id` string starting with `'*'`. Only supplied fields are changed; " + 'pass `comment=""` to clear the comment. ' + "Returns the updated entry's full detail after the change. To add a new supplicant entry use add_dot1x_client; " + "to delete one use remove_dot1x_client.",
+    inputSchema: {
+      client_id: z24.string().describe("Interface name or RouterOS '.id'"),
+      eap_methods: z24.string().optional(),
+      identity: z24.string().optional(),
+      anonymous_identity: z24.string().optional(),
+      certificate: z24.string().optional(),
+      password: z24.string().optional(),
+      comment: z24.string().optional(),
+      disabled: z24.boolean().optional()
+    },
+    async handler(a, ctx) {
+      ctx.info(`Updating dot1x client: client_id=${a.client_id}`);
+      const selector = a.client_id.startsWith("*") ? `.id="${a.client_id}"` : `interface="${a.client_id}"`;
+      const base = `/interface dot1x client set [find ${selector}]`;
+      const cmd = new Cmd(base).opt("eap-methods", a.eap_methods).opt("identity", a.identity).opt("anonymous-identity", a.anonymous_identity).opt("certificate", a.certificate).opt("password", a.password);
+      if (a.comment !== undefined)
+        cmd.raw(`comment=${quoteValue(a.comment)}`);
+      if (a.disabled !== undefined)
+        cmd.raw(`disabled=${yesno(a.disabled)}`);
+      const built = cmd.build();
+      if (built === base)
+        return "No updates specified.";
+      const result = await executeMikrotikCommand(built, ctx);
+      if (looksLikeError(result))
+        return `Failed to update dot1x client: ${result}`;
+      const details = await executeMikrotikCommand(`/interface dot1x client print detail where ${selector}`, ctx);
+      return `Dot1x client updated successfully:
+
+${details}`;
     }
-  }
-  return findings;
-}
-function deadFindings(active2, table) {
-  const findings = [];
-  for (const r of active2) {
-    if (r.packets === 0) {
-      findings.push({
-        kind: "dead-rule",
-        severity: "low",
-        table,
-        chain: r.chain,
-        ruleIndex: r.index,
-        title: "No hits since boot",
-        detail: `Rule ${r.index} (${r.chain} ${r.action}) has matched 0 packets since the counters last reset \u2014 it may be unused (or the device rebooted recently).`,
-        suggestion: `Confirm rule ${r.index} is still needed; remove it if obsolete.`
-      });
+  }),
+  defineTool({
+    name: "remove_dot1x_client",
+    title: "Remove 802.1X Supplicant Client",
+    annotations: DESTRUCTIVE,
+    description: "Removes an 802.1X supplicant client entry (`/interface dot1x client remove`) identified by interface " + "name or RouterOS `.id` from list_dot1x_clients. `client_id` accepts an interface name (e.g. `'ether3'`) " + "or a `.id` string starting with `'*'`. Verifies the entry exists with a count-only check before deletion " + "and returns an error if not found. Permanently stops 802.1X authentication on that interface; " + "to temporarily halt authentication without deleting the entry use update_dot1x_client with `disabled=true`.",
+    inputSchema: {
+      client_id: z24.string().describe("Interface name or RouterOS '.id'")
+    },
+    async handler(a, ctx) {
+      ctx.info(`Removing dot1x client: client_id=${a.client_id}`);
+      const selector = a.client_id.startsWith("*") ? `.id="${a.client_id}"` : `interface="${a.client_id}"`;
+      const count = await executeMikrotikCommand(`/interface dot1x client print count-only where ${selector}`, ctx);
+      if (count.trim() === "0")
+        return `Dot1x client '${a.client_id}' not found.`;
+      const result = await executeMikrotikCommand(`/interface dot1x client remove [find ${selector}]`, ctx);
+      if (looksLikeError(result))
+        return `Failed to remove dot1x client: ${result}`;
+      return `Dot1x client '${a.client_id}' removed successfully.`;
     }
-  }
-  return findings;
-}
-var WEIGHT2 = { high: 20, medium: 8, low: 2 };
-function grade2(score) {
-  if (score === 0)
-    return "clean";
-  if (score < 15)
-    return "good";
-  if (score < 40)
-    return "fair";
-  if (score < 75)
-    return "poor";
-  return "critical";
-}
-function auditFirewall(input) {
-  _ifaceLists = input.interfaceLists;
-  const findings = [];
-  if (input.filter)
-    findings.push(...auditFilter(input.filter));
-  if (input.nat)
-    findings.push(...auditTransform(input.nat, "nat"));
-  if (input.mangle)
-    findings.push(...auditTransform(input.mangle, "mangle"));
-  const sevRank = { high: 0, medium: 1, low: 2 };
-  findings.sort((a, b) => sevRank[a.severity] - sevRank[b.severity] || a.table.localeCompare(b.table) || (a.ruleIndex ?? -1) - (b.ruleIndex ?? -1));
-  const counts = { high: 0, medium: 0, low: 0, total: findings.length };
-  let raw = 0;
-  for (const f of findings) {
-    counts[f.severity]++;
-    raw += WEIGHT2[f.severity];
-  }
-  const riskScore = Math.min(100, raw);
-  const ruleCount = (input.filter?.length ?? 0) + (input.nat?.length ?? 0) + (input.mangle?.length ?? 0);
-  return { riskScore, grade: grade2(riskScore), counts, ruleCount, findings };
-}
-function renderReport(report, device) {
-  const head = `FIREWALL AUDIT \u2014 ${device}
-
-` + `Risk score: ${report.riskScore}/100 (${report.grade})
-` + `${report.ruleCount} rule(s) analysed \xB7 ${report.counts.high} high, ${report.counts.medium} medium, ${report.counts.low} low
-`;
-  if (report.findings.length === 0) {
-    return `${head}
-No issues found \u2014 the ruleset looks clean. \u2713`;
-  }
-  const body = report.findings.map((f, i) => {
-    const tag = f.severity.toUpperCase().padEnd(6);
-    return `${i + 1}. [${tag}] ${f.title} (${f.table}/${f.chain})
-   ${f.detail}
-   \u2192 ${f.suggestion}`;
-  }).join(`
-
-`);
-  return `${head}
-${body}`;
-}
+  })
+];
 
 // src/tools/firewall-audit.ts
+import { z as z25 } from "zod";
 async function fetchRules(path, ctx) {
   const out = await executeMikrotikCommand(`${path} print detail`, ctx);
   if (looksLikeError(out) || isEmpty(out))
@@ -11825,21 +11946,6 @@ function planPortScanDetection(state, args) {
 }
 
 // src/tools/port-scan-detection.ts
-async function fetchChainRules(chain, ctx) {
-  const rows = await fetchRows(`/ip firewall filter print detail where chain=${chain}`, ctx);
-  return rulesFromRows(rows);
-}
-async function addressListCount(list, ctx) {
-  const raw = await executeMikrotikCommand(`/ip firewall address-list print count-only where list=${JSON.stringify(list)}`, ctx);
-  const n = Number.parseInt(raw.trim(), 10);
-  return Number.isFinite(n) ? n : 0;
-}
-async function inputChainIds(ctx) {
-  const raw = await executeMikrotikCommand(":foreach i in=[/ip firewall filter find chain=input] do={:put $i}", ctx);
-  if (isEmpty(raw))
-    return [];
-  return raw.trim().split(/\r?\n/).map((l) => l.trim()).filter((l) => /^\*[0-9A-Fa-f]+$/.test(l));
-}
 var portScanDetectionTools = [
   defineTool({
     name: "list_port_scan_detection_signatures",
@@ -11849,7 +11955,7 @@ var portScanDetectionTools = [
     async handler(_a, ctx) {
       let present = null;
       if (ctx.device !== undefined) {
-        const detect = await fetchChainRules(DETECT_CHAIN, ctx);
+        const detect = await fetchFilterChainRules(DETECT_CHAIN, ctx);
         present = new Set(PORT_SCAN_SIGNATURES.filter((s) => signaturePresent(detect, s)).map((s) => s.id));
       }
       const lines = [
@@ -11872,7 +11978,7 @@ var portScanDetectionTools = [
     name: "add_port_scan_detection_rules",
     title: "Add Port-Scan Detection Rules",
     annotations: DANGEROUS,
-    description: "Installs the user-selected port-scan detection signatures into a dedicated `detect-portscan` " + "sub-chain, gated by a single input jump that EXCLUDES a trusted address-list (so trusted " + "sources are never tagged). These rules only add the source to an address list \u2014 they NEVER " + "drop or block. NEVER call this with a guessed or default set of rule_types: it must only be " + "called with signature IDs the user explicitly chose after seeing " + "list_port_scan_detection_signatures \u2014 there is no select-all. Requires `trusted_list_name` " + "(must already exist and be non-empty on the device) and the human acknowledgement " + "`confirmed_trusted_list_includes_my_ip=true`. Captures a config snapshot and applies every " + "write inside Safe Mode (auto-revert on session drop). Idempotent \u2014 a second identical run adds " + "nothing. Enforcement/blocking of the tagged list is intentionally out of scope.",
+    description: "Installs the user-selected port-scan detection signatures into a dedicated `detect-portscan` " + "sub-chain, gated by a single input jump that EXCLUDES a trusted address-list (so trusted " + "sources are never tagged). These rules only add the source to an address list \u2014 they NEVER " + "drop or block. NEVER call this with a guessed or default set of rule_types: it must only be " + "called with signature IDs the user explicitly chose after seeing " + "list_port_scan_detection_signatures \u2014 there is no select-all. Requires `trusted_list_name` " + "(must already exist and be non-empty on the device) and the human acknowledgement " + "`confirmed_trusted_list_includes_my_ip=true`. Captures a config snapshot, then applies every " + "write inside Safe Mode (auto-revert on session drop) \u2014 or, if Safe Mode is unavailable or goes " + "silent on the device (a known flaky case on some RouterOS SSH builds), applies the writes " + "DIRECTLY instead of aborting, since these rules only tag and cannot lock you out (the snapshot " + "is the rollback point). Idempotent \u2014 a second identical run adds nothing. Enforcement/blocking " + "of the tagged list is intentionally out of scope.",
     inputSchema: {
       rule_types: z28.array(z28.enum(PORT_SCAN_SIGNATURE_IDS)).min(1).describe("REQUIRED, non-empty. The specific signature IDs the user explicitly chose after seeing " + "the catalog. No default, no select-all \u2014 unknown values are rejected."),
       trusted_list_name: z28.string().min(1).describe("REQUIRED. The management/trusted address-list on THIS device (no default). Must already " + "exist and contain at least one entry, or the call is refused."),
@@ -11885,8 +11991,8 @@ var portScanDetectionTools = [
       const device = resolveDeviceName(ctx.device);
       ctx.info(`[${device}] add_port_scan_detection_rules: ${a.rule_types.join(",")}`);
       const [inputRules, detectChainRules, trustListCount] = await Promise.all([
-        fetchChainRules("input", ctx),
-        fetchChainRules(DETECT_CHAIN, ctx),
+        fetchFilterChainRules("input", ctx),
+        fetchFilterChainRules(DETECT_CHAIN, ctx),
         addressListCount(a.trusted_list_name, ctx)
       ]);
       const state = {
@@ -11911,61 +12017,30 @@ ${plan.error}`;
       if (!plan.jump.present) {
         let placeBeforeId;
         if (plan.jump.placeBeforeIndex !== null) {
-          const ids = await inputChainIds(ctx);
+          const ids = await filterChainRuleIds("input", ctx);
           placeBeforeId = ids[plan.jump.placeBeforeIndex];
         }
         writeCommands.push(buildJumpCommand(a.trusted_list_name, placeBeforeId));
       }
-      const result = await applyWrites(ctx, device, writeCommands);
+      const result = await applyWritesSafely(ctx, device, writeCommands, {
+        allowDirectFallback: true
+      });
       return renderResult(a, plan, snapshotId, result, ctx);
     }
   })
 ];
-async function applyWrites(ctx, deviceName, commands) {
-  if (commands.length === 0)
-    return { applied: 0, safeMode: "not used (nothing to write)", committed: true };
-  const useSafe = !getDevice(deviceName).mac;
-  const mgr = getSafeModeManager(deviceName);
-  if (useSafe) {
-    const en = await mgr.enable();
-    if (en.startsWith("Error"))
-      return { applied: 0, safeMode: `failed to enable: ${en}`, committed: false };
-  }
-  let applied = 0;
-  for (const cmd of commands) {
-    const out = useSafe ? await mgr.execute(cmd).catch((e) => `error: ${String(e)}`) : await executeMikrotikCommand(cmd, ctx);
-    if (looksLikeError(out) || out.startsWith("error:")) {
-      if (useSafe)
-        await mgr.rollback();
-      return {
-        applied,
-        safeMode: useSafe ? "rolled back (a write failed \u2014 no changes kept)" : "not used",
-        committed: false,
-        error: out.trim().split(`
-`)[0]
-      };
-    }
-    applied++;
-  }
-  if (useSafe) {
-    const c = await mgr.commit();
-    return {
-      applied,
-      safeMode: c.ok ? "committed" : `commit FAILED \u2014 changes revert: ${c.message}`,
-      committed: c.ok
-    };
-  }
-  return { applied, safeMode: "not used (MAC-Telnet device \u2014 no Safe Mode)", committed: true };
-}
 async function renderResult(a, plan, snapshotId, outcome, ctx) {
   const lines = [];
   lines.push(`PORT-SCAN DETECTION \u2014 snapshot=${snapshotId}  safe-mode=${outcome.safeMode}`);
   if (outcome.error) {
-    lines.push(`FAILED after ${outcome.applied} write(s): ${outcome.error}`);
-    lines.push("No partial state kept if Safe Mode rolled back \u2014 re-run after fixing the cause.");
+    lines.push(`FAILED after ${outcome.applied}/${outcome.total} write(s): ${outcome.error}`);
+    lines.push(outcome.fellBack || outcome.applied > 0 ? `Partial state may be applied. The rules are idempotent \u2014 fix the cause and RE-RUN to finish, ` + `or roll back with: diff_config_snapshots from=${snapshotId} to=live (then restore the snapshot).` : "No changes were kept \u2014 fix the cause and re-run.");
     return lines.join(`
 `);
   }
+  if (outcome.fellBack) {
+    lines.push("NOTE: Safe Mode was not usable on this device, so the writes were applied directly. These " + "rules cannot lock you out (they only tag; the jump excludes the trusted list), and the " + `snapshot above is your rollback point (diff_config_snapshots from=${snapshotId} to=live).`);
+  }
   const created = plan.signatures.filter((s) => s.status === "create");
   const existing = plan.signatures.filter((s) => s.status === "already_present");
   lines.push("");
@@ -12199,9 +12274,9 @@ var firewallFilterTools = [
     name: "create_filter_rule",
     title: "Create Firewall Filter Rule",
     annotations: WRITE,
-    description: "Creates an IPv4 firewall FILTER rule (`/ip firewall filter`) \u2014 the accept/drop/reject " + "decision table for traffic TO the router (chain=input), THROUGH it (forward) or FROM it " + "(output). Use this to allow or block traffic. For address translation use the NAT tools, " + "for packet marking use mangle, for pre-connection-tracking drops use raw, and for IPv6 use " + "create_ipv6_filter_rule. Rule order matters (first match wins) \u2014 use place_before or " + "move_filter_rule to position it. Returns the created rule's detail including its `.id`. " + 'connection_state: comma-separated e.g. "established,related,new,invalid". ' + 'limit: RouterOS rate/burst string e.g. "10,5:packet" or "10/1s:packet". ' + 'tcp_flags: RouterOS flag expression e.g. "syn,!ack". ' + 'place_before: rule number or ID (*N) to insert before e.g. "0" or "*3".',
+    description: "Creates an IPv4 firewall FILTER rule (`/ip firewall filter`) \u2014 the accept/drop/reject " + "decision table for traffic TO the router (chain=input), THROUGH it (forward) or FROM it " + "(output). Use this to allow or block traffic. For address translation use the NAT tools, " + "for packet marking use mangle, for pre-connection-tracking drops use raw, and for IPv6 use " + "create_ipv6_filter_rule. `chain` also accepts a CUSTOM sub-chain name (e.g. detect-portscan) " + "reached by an action=jump rule, and `action` supports add-src-to-address-list / " + "add-dst-to-address-list (with `address_list` + `address_list_timeout`) for tagging/detection " + "rules. Rule order matters (first match wins) \u2014 use place_before or " + "move_filter_rule to position it. Returns the created rule's detail including its `.id`. " + 'connection_state: comma-separated e.g. "established,related,new,invalid". ' + 'limit: RouterOS rate/burst string e.g. "10,5:packet" or "10/1s:packet". ' + 'tcp_flags: RouterOS flag expression e.g. "syn,!ack". ' + 'place_before: rule number or ID (*N) to insert before e.g. "0" or "*3".',
     inputSchema: {
-      chain: z30.enum(["input", "forward", "output"]),
+      chain: z30.string().describe("The built-in `input`, `forward`, or `output` chain \u2014 OR a custom sub-chain name " + "(e.g. `detect-portscan`). A custom chain runs only when a rule with action=jump and " + "jump-target=<that chain> sends traffic into it; use this to build tagging/detection sub-chains."),
       action: z30.enum([
         "accept",
         "drop",
@@ -12211,7 +12286,9 @@ var firewallFilterTools = [
         "passthrough",
         "return",
         "tarpit",
-        "fasttrack-connection"
+        "fasttrack-connection",
+        "add-src-to-address-list",
+        "add-dst-to-address-list"
       ]),
       src_address: z30.string().optional(),
       dst_address: z30.string().optional(),