@usex/mikrotik-mcp 4.15.0 → 4.17.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usex/mikrotik-mcp",
-  "version": "4.15.0",
+  "version": "4.17.0",
   "description": "MCP server for MikroTik RouterOS — 780+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   "keywords": [
     "ai",

package/schemas/README.md

@@ -7,7 +7,7 @@ edit by hand — regenerate instead.
 | File | Contents |
 |------|----------|
 | `config.schema.json` | The runtime configuration object (env vars / CLI flags). |
-| `tool-catalog.json` | Every one of the 821 tools: `name`, `risk`, `title`, `description`, and input JSON Schema. |
+| `tool-catalog.json` | Every one of the 833 tools: `name`, `risk`, `title`, `description`, and input JSON Schema. |
 | `tools/<name>.json` | The input JSON Schema for a single tool. |
 
 `risk` is derived from the MCP tool annotations:

package/schemas/tool-catalog.json

@@ -1,8 +1,8 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "version": "4.15.0",
+  "version": "4.17.0",
   "generated": "by scripts/gen-schemas.ts — do not edit by hand",
-  "toolCount": 821,
+  "toolCount": 833,
   "tools": [
     {
       "name": "find_tools",
@@ -2011,6 +2011,325 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "run_capsman_audit",
+      "title": "Run CAPsMAN Audit",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Read-only. Audits the device's CAPsMAN Wi-Fi fabric across coverage/co-channel, weak-signal clients, resource-aware load, 802.11r (FT) roaming, and HA (backup-manager) redundancy — one severity-ranked report with per-finding id, severity and confidence (proven vs needs_live_verification; steering/balancing are advisory since RouterOS has no force-move). Supports both the v7 `/interface wifi` CAPsMAN and legacy `/caps-man`. Narrow with `categories`. For a single dimension use audit_capsman_coverage / report_weak_signal_clients / audit_capsman_load / audit_capsman_ft / audit_capsman_ha.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "categories": {
+            "description": "Narrow to specific categories. Omit to audit all five.",
+            "type": "array",
+            "items": {
+              "type": "string",
+              "enum": [
+                "coverage",
+                "weak_signal",
+                "load",
+                "ft",
+                "ha"
+              ]
+            }
+          },
+          "weak_dbm": {
+            "description": "Weak-signal threshold in dBm (negative; default -70).",
+            "type": "integer",
+            "minimum": -9007199254740991,
+            "maximum": -1
+          }
+        },
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "audit_capsman_coverage",
+      "title": "Audit CAPsMAN Coverage & Channels",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Read-only. Inventories every managed CAP radio (band, manual channel/width, tx-power, client count), detects CO-CHANNEL overlap between physically-adjacent radios (adjacency inferred from clients seen on more than one radio), and proposes a non-overlapping manual channel plan (2.4 GHz → 1/6/11; 5 GHz DFS-aware). Preview only — apply is a later, confirm-gated tool.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {},
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "report_weak_signal_clients",
+      "title": "Report Weak-Signal Clients",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Read-only. Merges every CAP's registration-table and lists clients below the weak-signal threshold (default -70 dBm), each with its current AP, signal, band, and — when a neighbor radio hears it meaningfully stronger — the recommended AP to steer toward and the dB gain. Steering itself is a later, confirm-gated tool (soft 802.11k/v or hard signal-range).",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "weak_dbm": {
+            "description": "Weak-signal threshold in dBm (negative; default -70).",
+            "type": "integer",
+            "minimum": -9007199254740991,
+            "maximum": -1
+          }
+        },
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "audit_capsman_load",
+      "title": "Audit CAPsMAN Load & Resources",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Read-only. Reports per-radio client load and the owning CAP's CPU/mem, flags overloaded or resource-constrained radios that have an adjacent radio with spare capacity, and recommends a resource-aware rebalance (offload toward the idle neighbor; steer dual-band clients to 5 GHz). Advisory — apply is a later, confirm-gated tool.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {},
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "audit_capsman_ft",
+      "title": "Audit CAPsMAN Fast-Roaming (802.11r)",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Read-only. Checks 802.11r fast-transition per SSID: is `ft` enabled, is 802.11k/v steering on, and is the `ft-mobility-domain` CONSISTENT across all CAPs (fast roaming only works within one domain). Reports roam-readiness. Enabling FT is a later, confirm-gated tool.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {},
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "audit_capsman_ha",
+      "title": "Audit CAPsMAN High-Availability",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Read-only. Checks CAPsMAN redundancy: is there a backup manager, are the CAPs pointed at both managers, and is require-peer-certificate on? Flags single points of failure (one manager = the whole building's Wi-Fi drops if it reboots). Setting up HA is a later, confirm-gated tool.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {},
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "steer_client",
+      "title": "Steer a Weak-Signal Client",
+      "risk": "dangerous",
+      "annotations": {
+        "destructiveHint": true,
+        "openWorldHint": false
+      },
+      "description": "Steers ONE weak client toward a better AP. `mode=hard` installs an access-list signal-range REJECT on the client's current radio so it re-associates on a neighbor it hears stronger (can briefly disconnect it). `mode=soft` is 802.11k/v-only and installs no rule (advisory — enable steering via enable_capsman_ft). ADVISORY: RouterOS has no force-move, so the client ultimately decides. DRY RUN unless confirm=true. Snapshots first and applies inside Safe Mode (auto-revert on lockout). Idempotent — a re-run for the same MAC adds nothing.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "mac": {
+            "type": "string",
+            "minLength": 1,
+            "description": "Client MAC address to steer."
+          },
+          "mode": {
+            "default": "hard",
+            "description": "hard = signal-range reject; soft = k/v only (no write).",
+            "type": "string",
+            "enum": [
+              "soft",
+              "hard"
+            ]
+          },
+          "reject_above_dbm": {
+            "description": "dBm ceiling of the reject band for hard mode (default -70).",
+            "type": "integer",
+            "minimum": -9007199254740991,
+            "maximum": -1
+          },
+          "confirm": {
+            "description": "Must be true to write; omit for a dry-run preview.",
+            "type": "boolean",
+            "const": true
+          }
+        },
+        "required": [
+          "mac",
+          "mode"
+        ],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "apply_capsman_load_balance",
+      "title": "Apply CAPsMAN Load Balance",
+      "risk": "dangerous",
+      "annotations": {
+        "destructiveHint": true,
+        "openWorldHint": false
+      },
+      "description": "Applies a resource-aware rebalance: for each overloaded / CPU-constrained radio that has an adjacent radio with spare capacity, installs a connect-priority nudge so NEW clients prefer the idle neighbor (gentle — does not disconnect existing clients). ADVISORY. DRY RUN unless confirm=true. Snapshots first, applies inside Safe Mode. Idempotent. Preview the plan with audit_capsman_load first.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "confirm": {
+            "description": "Must be true to write; omit for a dry-run preview.",
+            "type": "boolean",
+            "const": true
+          }
+        },
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "apply_capsman_channel_plan",
+      "title": "Apply CAPsMAN Channel Plan",
+      "risk": "dangerous",
+      "annotations": {
+        "destructiveHint": true,
+        "openWorldHint": false
+      },
+      "description": "Applies the proposed non-overlapping manual channel plan (from audit_capsman_coverage) to the managed radios by setting each radio's frequency — resolving co-channel conflicts. Optionally scope to specific radios with `radio_ids`. DRY RUN unless confirm=true. Snapshots first, applies inside Safe Mode; idempotent (radios already on the target channel are skipped). v7 `/interface wifi` only — on legacy `/caps-man` the channel lives in named channel objects, so edit those manually (the audit still shows the plan).",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "radio_ids": {
+            "description": "Only re-channel these radio ids. Omit to apply the whole plan.",
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "confirm": {
+            "description": "Must be true to write; omit for a dry-run preview.",
+            "type": "boolean",
+            "const": true
+          }
+        },
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "enable_capsman_ft",
+      "title": "Enable CAPsMAN Fast-Roaming (802.11r)",
+      "risk": "dangerous",
+      "annotations": {
+        "destructiveHint": true,
+        "openWorldHint": false
+      },
+      "description": "Enables 802.11r fast-transition on the CAPsMAN security configs, converging every one on a SINGLE shared `ft-mobility-domain` (so roaming between floors is seamless and consistent) — fixing the ft-off and ft-domain-mismatch findings. Scope with `config_names`; set the domain with `mobility_domain` (default: the existing domain, else 0001). Note: enabling FT changes the SSID's roaming behaviour and briefly re-keys clients. DRY RUN unless confirm=true. Snapshots first, applies inside Safe Mode; idempotent. 802.11k/v steering is configured separately.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "config_names": {
+            "description": "Only enable FT on these security configs. Omit for all.",
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "mobility_domain": {
+            "description": "Shared ft-mobility-domain to converge on. Omit to adopt the existing one (or 0001).",
+            "type": "string"
+          },
+          "confirm": {
+            "description": "Must be true to write; omit for a dry-run preview.",
+            "type": "boolean",
+            "const": true
+          }
+        },
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "setup_capsman_ha",
+      "title": "Set Up CAPsMAN High-Availability",
+      "risk": "dangerous",
+      "annotations": {
+        "destructiveHint": true,
+        "openWorldHint": false
+      },
+      "description": "Hardens CAPsMAN redundancy. Applies what THIS manager can safely do — enable require-peer-certificate (so a rogue manager can't adopt your CAPs) — and returns the exact manual, multi-device steps to finish HA (stand up a second manager with the same certificate, point every CAP at both managers). Standing up the backup + editing each CAP is inherently multi-device, so it is NOT auto-applied. HIGHEST blast radius — DRY RUN unless confirm=true; snapshots first, applies inside Safe Mode. Requires a `reason`.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "backup_manager_address": {
+            "description": "Address of the (planned) backup manager, woven into the guidance.",
+            "type": "string"
+          },
+          "confirm": {
+            "description": "Must be true to write; omit for a dry-run preview.",
+            "type": "boolean",
+            "const": true
+          }
+        },
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "apply_capsman_fixes",
+      "title": "Apply CAPsMAN Fixes",
+      "risk": "dangerous",
+      "annotations": {
+        "destructiveHint": true,
+        "openWorldHint": false
+      },
+      "description": "Applies specific finding_ids from a prior run_capsman_audit, dispatching each to its remediation in a SAFE order (coverage/channel-plan → load-balance → steer → FT → HA), all wrapped in ONE snapshot + ONE Safe-Mode session. Returns the applied commands + snapshot id. DRY RUN unless confirm=true. NEVER a blanket 'fix everything' — pass explicit finding_ids from an audit. Steering/balancing remain advisory; HA require-cert is applied but the multi-device HA steps are not.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "finding_ids": {
+            "minItems": 1,
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Explicit finding_id(s) from a prior run_capsman_audit. No blanket apply."
+          },
+          "confirm": {
+            "description": "Must be true to write; omit for a dry-run preview.",
+            "type": "boolean",
+            "const": true
+          }
+        },
+        "required": [
+          "finding_ids"
+        ],
+        "additionalProperties": false
+      }
+    },
     {
       "name": "get_poe_monitor",
       "title": "Read PoE Interface Live Metrics",

package/schemas/tools/apply_capsman_channel_plan.json

@@ -0,0 +1,20 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "apply_capsman_channel_plan",
+  "type": "object",
+  "properties": {
+    "radio_ids": {
+      "description": "Only re-channel these radio ids. Omit to apply the whole plan.",
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "confirm": {
+      "description": "Must be true to write; omit for a dry-run preview.",
+      "type": "boolean",
+      "const": true
+    }
+  },
+  "additionalProperties": false
+}

package/schemas/tools/apply_capsman_fixes.json

@@ -0,0 +1,24 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "apply_capsman_fixes",
+  "type": "object",
+  "properties": {
+    "finding_ids": {
+      "minItems": 1,
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "description": "Explicit finding_id(s) from a prior run_capsman_audit. No blanket apply."
+    },
+    "confirm": {
+      "description": "Must be true to write; omit for a dry-run preview.",
+      "type": "boolean",
+      "const": true
+    }
+  },
+  "required": [
+    "finding_ids"
+  ],
+  "additionalProperties": false
+}

package/schemas/tools/apply_capsman_load_balance.json

@@ -0,0 +1,13 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "apply_capsman_load_balance",
+  "type": "object",
+  "properties": {
+    "confirm": {
+      "description": "Must be true to write; omit for a dry-run preview.",
+      "type": "boolean",
+      "const": true
+    }
+  },
+  "additionalProperties": false
+}

package/schemas/tools/audit_capsman_coverage.json

@@ -0,0 +1,7 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "audit_capsman_coverage",
+  "type": "object",
+  "properties": {},
+  "additionalProperties": false
+}

package/schemas/tools/audit_capsman_ft.json

@@ -0,0 +1,7 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "audit_capsman_ft",
+  "type": "object",
+  "properties": {},
+  "additionalProperties": false
+}

package/schemas/tools/audit_capsman_ha.json

@@ -0,0 +1,7 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "audit_capsman_ha",
+  "type": "object",
+  "properties": {},
+  "additionalProperties": false
+}

package/schemas/tools/audit_capsman_load.json

@@ -0,0 +1,7 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "audit_capsman_load",
+  "type": "object",
+  "properties": {},
+  "additionalProperties": false
+}

package/schemas/tools/enable_capsman_ft.json

@@ -0,0 +1,24 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "enable_capsman_ft",
+  "type": "object",
+  "properties": {
+    "config_names": {
+      "description": "Only enable FT on these security configs. Omit for all.",
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "mobility_domain": {
+      "description": "Shared ft-mobility-domain to converge on. Omit to adopt the existing one (or 0001).",
+      "type": "string"
+    },
+    "confirm": {
+      "description": "Must be true to write; omit for a dry-run preview.",
+      "type": "boolean",
+      "const": true
+    }
+  },
+  "additionalProperties": false
+}

package/schemas/tools/report_weak_signal_clients.json

@@ -0,0 +1,14 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "report_weak_signal_clients",
+  "type": "object",
+  "properties": {
+    "weak_dbm": {
+      "description": "Weak-signal threshold in dBm (negative; default -70).",
+      "type": "integer",
+      "minimum": -9007199254740991,
+      "maximum": -1
+    }
+  },
+  "additionalProperties": false
+}

package/schemas/tools/run_capsman_audit.json

@@ -0,0 +1,28 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "run_capsman_audit",
+  "type": "object",
+  "properties": {
+    "categories": {
+      "description": "Narrow to specific categories. Omit to audit all five.",
+      "type": "array",
+      "items": {
+        "type": "string",
+        "enum": [
+          "coverage",
+          "weak_signal",
+          "load",
+          "ft",
+          "ha"
+        ]
+      }
+    },
+    "weak_dbm": {
+      "description": "Weak-signal threshold in dBm (negative; default -70).",
+      "type": "integer",
+      "minimum": -9007199254740991,
+      "maximum": -1
+    }
+  },
+  "additionalProperties": false
+}

package/schemas/tools/setup_capsman_ha.json

@@ -0,0 +1,17 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "setup_capsman_ha",
+  "type": "object",
+  "properties": {
+    "backup_manager_address": {
+      "description": "Address of the (planned) backup manager, woven into the guidance.",
+      "type": "string"
+    },
+    "confirm": {
+      "description": "Must be true to write; omit for a dry-run preview.",
+      "type": "boolean",
+      "const": true
+    }
+  },
+  "additionalProperties": false
+}

package/schemas/tools/steer_client.json

@@ -0,0 +1,37 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "steer_client",
+  "type": "object",
+  "properties": {
+    "mac": {
+      "type": "string",
+      "minLength": 1,
+      "description": "Client MAC address to steer."
+    },
+    "mode": {
+      "default": "hard",
+      "description": "hard = signal-range reject; soft = k/v only (no write).",
+      "type": "string",
+      "enum": [
+        "soft",
+        "hard"
+      ]
+    },
+    "reject_above_dbm": {
+      "description": "dBm ceiling of the reject band for hard mode (default -70).",
+      "type": "integer",
+      "minimum": -9007199254740991,
+      "maximum": -1
+    },
+    "confirm": {
+      "description": "Must be true to write; omit for a dry-run preview.",
+      "type": "boolean",
+      "const": true
+    }
+  },
+  "required": [
+    "mac",
+    "mode"
+  ],
+  "additionalProperties": false
+}