@usex/mikrotik-mcp 4.21.0 → 4.23.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usex/mikrotik-mcp",
-  "version": "4.21.0",
+  "version": "4.23.0",
   "description": "MCP server for MikroTik RouterOS — 780+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   "keywords": [
     "ai",
@@ -54,11 +54,12 @@
     "dev": "bunup --watch",
     "prepack": "bunup && chmod +x dist/cli.js && bun run build:ui && bun run gen",
     "auth-check": "bun run --bun src/cli.ts auth-check",
-    "gen:schemas": "bun run --bun scripts/gen-schemas.ts",
+    "gen:schemas": "bun run --bun scripts/gen-schemas.ts && vp fmt --write schemas",
     "gen:docs": "bun run --bun scripts/gen-tool-docs.ts",
     "gen": "bun run --bun gen:schemas && bun run --bun gen:docs",
     "start": "bun run --bun src/cli.ts serve",
     "discover": "bun run --bun scripts/discover-macs.ts",
+    "flags:download": "bun run --bun scripts/download-flags.ts",
     "chat": "bunx mcp-chat --server \"./dist/cli.js serve\"",
     "inspect": "bunx @modelcontextprotocol/inspector bun run --bun src/cli.ts serve",
     "inspect:built": "bun run --bun build && bunx @modelcontextprotocol/inspector bun dist/cli.js serve",
@@ -94,7 +95,7 @@
   "devDependencies": {
     "@anthropic-ai/mcpb": "^2.1.2",
     "@resvg/resvg-js": "^2.6.2",
-    "@tailwindcss/vite": "^4.3.2",
+    "@tailwindcss/vite": "^4.3.3",
     "@types/bun": "latest",
     "@types/figlet": "^1.7.0",
     "@types/node": "^26.1.1",
@@ -107,7 +108,7 @@
     "clsx": "^2.1.1",
     "gsap": "^3.15.0",
     "license-checker": "^25.0.1",
-    "lucide-react": "^1.24.0",
+    "lucide-react": "^1.25.0",
     "radix-ui": "^1.6.2",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
@@ -115,7 +116,7 @@
     "release-it": "^20.2.1",
     "sonner": "^2.0.7",
     "tailwind-merge": "^3.6.0",
-    "tailwindcss": "^4.3.2",
+    "tailwindcss": "^4.3.3",
     "tw-animate-css": "^1.4.0",
     "vite": "catalog:",
     "vite-plus": "catalog:"

package/prompts/setup-eoip-tunnel-between-sites.md

@@ -32,6 +32,10 @@ Device B: {{device_b}}
 Tunnel ID: {{tunnel_id}}
 Encrypt with IPsec: {{encrypt}}
 
+## Back up before the first write
+
+Before your FIRST configuration change in this workflow — the tunnel/interface, keys/peers, addresses, routes, NAT, or any mangle or firewall filter rule — ASK the user "Create a local backup first?" and, on yes, call `create_local_backup` for each device you are about to change. It saves a host-side `.rsc` restore point you can `restore_local_backup` if the change cuts the link. Discovery and the read-only fact-gathering steps below need no backup — do it once, right before you start writing. Tunnel creation always warrants a backup; you may skip it only for a minor, non-critical mangle/filter tweak the user explicitly waves off.
+
 ## 0. Discover and confirm (FIRST)
 
 - `list_mikrotik_devices`; resolve {{device_a}}/{{device_b}} — never substitute a

package/prompts/setup-gre-tunnel-between-sites.md

@@ -31,6 +31,10 @@ Device B: {{device_b}}
 Transit subnet: {{tunnel_subnet}}
 Encrypt with IPsec: {{encrypt}}
 
+## Back up before the first write
+
+Before your FIRST configuration change in this workflow — the tunnel/interface, keys/peers, addresses, routes, NAT, or any mangle or firewall filter rule — ASK the user "Create a local backup first?" and, on yes, call `create_local_backup` for each device you are about to change. It saves a host-side `.rsc` restore point you can `restore_local_backup` if the change cuts the link. Discovery and the read-only fact-gathering steps below need no backup — do it once, right before you start writing. Tunnel creation always warrants a backup; you may skip it only for a minor, non-critical mangle/filter tweak the user explicitly waves off.
+
 ## 0. Discover and confirm both endpoints (do this FIRST)
 
 - Call `list_mikrotik_devices` to enumerate the configured routers (key, label,

package/prompts/setup-ipip-tunnel-between-sites.md

@@ -31,6 +31,10 @@ Device B: {{device_b}}
 Transit subnet: {{tunnel_subnet}}
 Encrypt with IPsec: {{encrypt}}
 
+## Back up before the first write
+
+Before your FIRST configuration change in this workflow — the tunnel/interface, keys/peers, addresses, routes, NAT, or any mangle or firewall filter rule — ASK the user "Create a local backup first?" and, on yes, call `create_local_backup` for each device you are about to change. It saves a host-side `.rsc` restore point you can `restore_local_backup` if the change cuts the link. Discovery and the read-only fact-gathering steps below need no backup — do it once, right before you start writing. Tunnel creation always warrants a backup; you may skip it only for a minor, non-critical mangle/filter tweak the user explicitly waves off.
+
 ## 0. Discover and confirm both endpoints (FIRST)
 
 - `list_mikrotik_devices`; resolve {{device_a}}/{{device_b}} against it — never

package/prompts/setup-ipsec-site-to-site.md

@@ -23,6 +23,10 @@ Local subnet: {{local_subnet}}
 Remote subnet: {{remote_subnet}}
 Peer address: {{peer_address}}
 
+## Back up before the first write
+
+Before your FIRST configuration change in this workflow — the tunnel/interface, keys/peers, addresses, routes, NAT, or any mangle or firewall filter rule — ASK the user "Create a local backup first?" and, on yes, call `create_local_backup` for each device you are about to change. It saves a host-side `.rsc` restore point you can `restore_local_backup` if the change cuts the link. Discovery and the read-only fact-gathering steps below need no backup — do it once, right before you start writing. Tunnel creation always warrants a backup; you may skip it only for a minor, non-critical mangle/filter tweak the user explicitly waves off.
+
 Build order (use the `create_ipsec_*` tools; keep phase-1/phase-2 parameters
 identical on both ends):
 

package/prompts/setup-l2tp-ipsec-roadwarrior.md

@@ -18,6 +18,10 @@ install). Plan first, then apply (firewall under Safe Mode).
 Client address pool: {{vpn_pool}}
 Gateway / DNS for clients: {{local_gateway}}
 
+## Back up before the first write
+
+Before your FIRST configuration change in this workflow — the tunnel/interface, keys/peers, addresses, routes, NAT, or any mangle or firewall filter rule — ASK the user "Create a local backup first?" and, on yes, call `create_local_backup` for each device you are about to change. It saves a host-side `.rsc` restore point you can `restore_local_backup` if the change cuts the link. Discovery and the read-only fact-gathering steps below need no backup — do it once, right before you start writing. Tunnel creation always warrants a backup; you may skip it only for a minor, non-critical mangle/filter tweak the user explicitly waves off.
+
 Build order:
 
 1. **IP pool** — `create_ip_pool` for {{vpn_pool}} (e.g. name `l2tp-pool`).

package/prompts/setup-openvpn-tunnel-between-sites.md

@@ -35,6 +35,10 @@ Mode: {{mode}}
 Protocol: {{protocol}}
 Port: {{port}}
 
+## Back up before the first write
+
+Before your FIRST configuration change in this workflow — the tunnel/interface, keys/peers, addresses, routes, NAT, or any mangle or firewall filter rule — ASK the user "Create a local backup first?" and, on yes, call `create_local_backup` for each device you are about to change. It saves a host-side `.rsc` restore point you can `restore_local_backup` if the change cuts the link. Discovery and the read-only fact-gathering steps below need no backup — do it once, right before you start writing. Tunnel creation always warrants a backup; you may skip it only for a minor, non-critical mangle/filter tweak the user explicitly waves off.
+
 ## 0. Discover and assign roles (FIRST)
 
 - `list_mikrotik_devices`; resolve {{server_device}}/{{client_device}} — never

package/prompts/setup-sstp-tunnel-between-sites.md

@@ -30,6 +30,10 @@ Client device: {{client_device}}
 Transit subnet: {{tunnel_subnet}}
 Port: {{port}}
 
+## Back up before the first write
+
+Before your FIRST configuration change in this workflow — the tunnel/interface, keys/peers, addresses, routes, NAT, or any mangle or firewall filter rule — ASK the user "Create a local backup first?" and, on yes, call `create_local_backup` for each device you are about to change. It saves a host-side `.rsc` restore point you can `restore_local_backup` if the change cuts the link. Discovery and the read-only fact-gathering steps below need no backup — do it once, right before you start writing. Tunnel creation always warrants a backup; you may skip it only for a minor, non-critical mangle/filter tweak the user explicitly waves off.
+
 ## 0. Discover and assign roles (FIRST)
 
 - `list_mikrotik_devices`; resolve {{server_device}}/{{client_device}} — never

package/prompts/setup-tunnel-between-sites.md

@@ -32,6 +32,10 @@ Device A: {{device_a}}
 Device B: {{device_b}}
 Requested technology: {{technology}}
 
+## Back up before the first write
+
+Before your FIRST configuration change in this workflow — the tunnel/interface, keys/peers, addresses, routes, NAT, or any mangle or firewall filter rule — ASK the user "Create a local backup first?" and, on yes, call `create_local_backup` for each device you are about to change. It saves a host-side `.rsc` restore point you can `restore_local_backup` if the change cuts the link. Discovery and the read-only fact-gathering steps below need no backup — do it once, right before you start writing. Tunnel creation always warrants a backup; you may skip it only for a minor, non-critical mangle/filter tweak the user explicitly waves off.
+
 Work in this order, confirming the plan before any change:
 
 0. **Discover both endpoints.** Call `list_mikrotik_devices` first and resolve

package/prompts/setup-v2ray-container-proxy.md

@@ -39,6 +39,10 @@ Routing scope: {{scope}}
 
 ---
 
+## Back up before the first write
+
+Before your FIRST configuration change in this workflow — the tunnel/interface, keys/peers, addresses, routes, NAT, or any mangle or firewall filter rule — ASK the user "Create a local backup first?" and, on yes, call `create_local_backup` for each device you are about to change. It saves a host-side `.rsc` restore point you can `restore_local_backup` if the change cuts the link. Discovery and the read-only fact-gathering steps below need no backup — do it once, right before you start writing. Tunnel creation always warrants a backup; you may skip it only for a minor, non-critical mangle/filter tweak the user explicitly waves off.
+
 ## 0. Discover the device and confirm it CAN run containers (do this FIRST)
 
 - Call `list_mikrotik_devices`; resolve `{{device}}` (never substitute a similar

package/prompts/setup-vxlan-tunnel-between-sites.md

@@ -42,6 +42,10 @@ Device B: {{device_b}}
 VNI: {{vni}}
 UDP port: {{port}}
 
+## Back up before the first write
+
+Before your FIRST configuration change in this workflow — the tunnel/interface, keys/peers, addresses, routes, NAT, or any mangle or firewall filter rule — ASK the user "Create a local backup first?" and, on yes, call `create_local_backup` for each device you are about to change. It saves a host-side `.rsc` restore point you can `restore_local_backup` if the change cuts the link. Discovery and the read-only fact-gathering steps below need no backup — do it once, right before you start writing. Tunnel creation always warrants a backup; you may skip it only for a minor, non-critical mangle/filter tweak the user explicitly waves off.
+
 ## 0. Discover and confirm (FIRST)
 
 - `list_mikrotik_devices`; resolve the endpoints — never substitute a similar name;

package/prompts/setup-wireguard-tunnel-between-sites.md

@@ -29,6 +29,10 @@ Device B: {{device_b}}
 Transit subnet: {{tunnel_subnet}}
 Listen port: {{listen_port}}
 
+## Back up before the first write
+
+Before your FIRST configuration change in this workflow — the tunnel/interface, keys/peers, addresses, routes, NAT, or any mangle or firewall filter rule — ASK the user "Create a local backup first?" and, on yes, call `create_local_backup` for each device you are about to change. It saves a host-side `.rsc` restore point you can `restore_local_backup` if the change cuts the link. Discovery and the read-only fact-gathering steps below need no backup — do it once, right before you start writing. Tunnel creation always warrants a backup; you may skip it only for a minor, non-critical mangle/filter tweak the user explicitly waves off.
+
 ## 0. Discover and confirm both endpoints (do this FIRST)
 
 - Call `list_mikrotik_devices` to enumerate the configured routers (key, label,

package/prompts/setup-wireguard-vpn.md

@@ -21,6 +21,10 @@ VPN subnet: {{vpn_subnet}}
 Public endpoint: {{endpoint}}
 Listen port: {{listen_port}}
 
+## Back up before the first write
+
+Before your FIRST configuration change in this workflow — the tunnel/interface, keys/peers, addresses, routes, NAT, or any mangle or firewall filter rule — ASK the user "Create a local backup first?" and, on yes, call `create_local_backup` for each device you are about to change. It saves a host-side `.rsc` restore point you can `restore_local_backup` if the change cuts the link. Discovery and the read-only fact-gathering steps below need no backup — do it once, right before you start writing. Tunnel creation always warrants a backup; you may skip it only for a minor, non-critical mangle/filter tweak the user explicitly waves off.
+
 Steps:
 
 1. **Server interface** — `create_wireguard_interface` (e.g. name `wg-vpn`,

package/schemas/README.md

@@ -4,11 +4,11 @@ Machine-readable JSON Schemas for `@usex/mikrotik-mcp`, **generated** from the
 TypeScript source by `scripts/gen-schemas.ts` (`bun run gen:schemas`). Do not
 edit by hand — regenerate instead.
 
-| File | Contents |
-|------|----------|
-| `config.schema.json` | The runtime configuration object (env vars / CLI flags). |
-| `tool-catalog.json` | Every one of the 833 tools: `name`, `risk`, `title`, `description`, and input JSON Schema. |
-| `tools/<name>.json` | The input JSON Schema for a single tool. |
+| File                 | Contents                                                                                   |
+| -------------------- | ------------------------------------------------------------------------------------------ |
+| `config.schema.json` | The runtime configuration object (env vars / CLI flags).                                   |
+| `tool-catalog.json`  | Every one of the 833 tools: `name`, `risk`, `title`, `description`, and input JSON Schema. |
+| `tools/<name>.json`  | The input JSON Schema for a single tool.                                                   |
 
 `risk` is derived from the MCP tool annotations:
 `read` · `write` · `write-idempotent` · `destructive` · `dangerous`.

package/schemas/config.schema.json

@@ -90,11 +90,7 @@
                 "maximum": 9007199254740991
               }
             },
-            "required": [
-              "host",
-              "port",
-              "username"
-            ],
+            "required": ["host", "port", "username"],
             "additionalProperties": false
           },
           "mac": {
@@ -118,13 +114,7 @@
             "type": "boolean"
           }
         },
-        "required": [
-          "host",
-          "username",
-          "password",
-          "port",
-          "timeoutMs"
-        ],
+        "required": ["host", "username", "password", "port", "timeoutMs"],
         "additionalProperties": false
       }
     },
@@ -148,11 +138,7 @@
         "transport": {
           "default": "stdio",
           "type": "string",
-          "enum": [
-            "stdio",
-            "sse",
-            "streamable-http"
-          ]
+          "enum": ["stdio", "sse", "streamable-http"]
         },
         "host": {
           "default": "0.0.0.0",
@@ -231,10 +217,7 @@
           "maximum": 9007199254740991
         }
       },
-      "required": [
-        "prefix",
-        "presignExpiresIn"
-      ],
+      "required": ["prefix", "presignExpiresIn"],
       "additionalProperties": false
     },
     "dashboard": {
@@ -337,11 +320,7 @@
           "maximum": 9007199254740991
         }
       },
-      "required": [
-        "keepAlive",
-        "keepAliveInterval",
-        "idleTimeout"
-      ],
+      "required": ["keepAlive", "keepAliveInterval", "idleTimeout"],
       "additionalProperties": false
     },
     "readOnly": {
@@ -386,12 +365,7 @@
           }
         }
       },
-      "required": [
-        "enabledModules",
-        "disabledModules",
-        "enabledGroups",
-        "disabledGroups"
-      ],
+      "required": ["enabledModules", "disabledModules", "enabledGroups", "disabledGroups"],
       "additionalProperties": false
     },
     "memory": {
@@ -410,10 +384,7 @@
           "type": "string"
         }
       },
-      "required": [
-        "enabled",
-        "dbPath"
-      ],
+      "required": ["enabled", "dbPath"],
       "additionalProperties": false
     },
     "backupDir": {