@usex/mikrotik-mcp 5.1.0 → 5.3.0

package/dist/cli.js

@@ -230,7 +230,7 @@ import {
   validatePolicyText,
   worstSeverity,
   writeBackup
-} from "./shared/cli-mqb3rqfy.js";
+} from "./shared/cli-54yv0kd3.js";
 
 // src/cli.ts
 import { existsSync as existsSync2 } from "fs";
@@ -3267,6 +3267,11 @@ function configPayload() {
     s3: cfg.s3,
     dashboard: cfg.dashboard,
     ssh: cfg.ssh,
+    alerts: cfg.alerts,
+    flows: cfg.flows,
+    policy: cfg.policy,
+    schedules: cfg.schedules,
+    attacks: cfg.attacks,
     readOnly: cfg.readOnly,
     tools: cfg.tools,
     memory: cfg.memory,

package/dist/index.js

@@ -29,7 +29,7 @@ import {
   selectToolModules,
   setConfig,
   updateSummaryLine
-} from "./shared/library-tq8phch8.js";
+} from "./shared/library-s7s3s14v.js";
 // src/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";

package/dist/shared/{cli-mqb3rqfy.js → cli-54yv0kd3.js}

@@ -10832,7 +10832,7 @@ var cache2 = null;
 async function gateway() {
   if (cache2)
     return cache2;
-  const { moduleCatalog } = await import("./cli-s9fc4c7j.js");
+  const { moduleCatalog } = await import("./cli-f80vccvs.js");
   const forIndex = [];
   const byName = new Map;
   for (const mod of moduleCatalog) {
@@ -28428,6 +28428,8 @@ function analyzeRootCause(data) {
       summary: `All ${data.tunnelInterfaces.length} tunnel(s) running`
     });
   }
+  const mtuFindings = analyzeTunnelMtu(data);
+  evidence.push(...mtuFindings.evidence);
   correlateRootCauses(data, evidence, rootCauses);
   if (data.ping && data.ping.lossPct === 0) {
     const contradicted = new Set([
@@ -28462,6 +28464,105 @@ function analyzeRootCause(data) {
     dimensionSummary
   };
 }
+var TUNNEL_OVERHEAD = [
+  { match: "gre", bytes: 24, label: "GRE", path: "/interface gre" },
+  { match: "ipip", bytes: 20, label: "IPIP", path: "/interface ipip" },
+  { match: "eoip", bytes: 42, label: "EoIP", path: "/interface eoip" },
+  { match: "vxlan", bytes: 50, label: "VXLAN", path: "/interface vxlan" },
+  { match: "wg", bytes: 60, label: "WireGuard", path: "/interface wireguard" },
+  { match: "l2tp", bytes: 100, label: "L2TP" },
+  { match: "pptp", bytes: 100, label: "PPTP" },
+  { match: "sstp", bytes: 100, label: "SSTP" },
+  { match: "ovpn", bytes: 100, label: "OpenVPN" }
+];
+var PPP_FAMILY = /l2tp|pptp|sstp|ovpn|pppoe/;
+function tunnelOverhead(type) {
+  const t = type.toLowerCase();
+  return TUNNEL_OVERHEAD.find((o) => t.includes(o.match));
+}
+function analyzeTunnelMtu(data) {
+  const evidence = [];
+  const unclamped = [];
+  const oversizedMtu = [];
+  const tunnels = data.tunnelInterfaces.filter((t) => !t.disabled);
+  const clampRules = data.mangleRules.filter((r) => r.action === "change-mss" && !r.disabled);
+  const globalClamp = clampRules.some((r) => r.chain === "forward" || r.chain === "postrouting" || r.chain === "output");
+  const strandedClamp = clampRules.length > 0 && !globalClamp;
+  const pppoeWan = data.interfaces.some((i) => i.type.toLowerCase().includes("pppoe"));
+  const pathBudget = pppoeWan ? 1492 : 1500;
+  const pppClampedEverywhere = data.pppProfilesMissingMssClamp.length === 0;
+  for (const t of tunnels) {
+    const overhead = tunnelOverhead(t.type);
+    if (!overhead)
+      continue;
+    const effective = t.actualMtu ?? t.mtu;
+    const budget = pathBudget - overhead.bytes;
+    if (effective > budget) {
+      oversizedMtu.push({ iface: t, effective, budget, label: overhead.label });
+      evidence.push({
+        dimension: "vpn",
+        severity: "warning",
+        summary: `Tunnel ${t.name} MTU ${effective} exceeds the ${budget}-byte budget for ` + `${overhead.label} (${overhead.bytes} B overhead${pppoeWan ? " + PPPoE 8 B" : ""})`,
+        detail: "Packets at this size need fragmentation the transit path will not perform, " + "so they are dropped silently.",
+        reference: t.name
+      });
+    }
+    const covered = t.clampTcpMss === true || globalClamp || PPP_FAMILY.test(t.type.toLowerCase()) && pppClampedEverywhere;
+    if (!covered) {
+      unclamped.push(t);
+      evidence.push({
+        dimension: "vpn",
+        severity: "warning",
+        summary: `Tunnel ${t.name} (${overhead.label}) has no TCP MSS clamp`,
+        detail: "Hosts derive their MSS from their own LAN MTU and set DF, so full-size " + "segments enter the tunnel and are dropped in transit. Small flows (ping, " + "logins) work; large ones (file transfer, photo/video upload, TLS) stall.",
+        reference: t.name
+      });
+    }
+  }
+  if (strandedClamp) {
+    evidence.push({
+      dimension: "vpn",
+      severity: "warning",
+      summary: `A change-mss rule exists but only in chain '${clampRules[0].chain}' \u2014 ` + "transit traffic is clamped in forward/postrouting, not there"
+    });
+  }
+  if (data.pppProfilesMissingMssClamp.length > 0 && tunnels.some((t) => PPP_FAMILY.test(t.type))) {
+    evidence.push({
+      dimension: "vpn",
+      severity: "warning",
+      summary: `PPP profile(s) without change-tcp-mss: ${data.pppProfilesMissingMssClamp.join(", ")}`,
+      detail: "PPP-family tunnels (L2TP/PPTP/SSTP/OpenVPN/PPPoE) clamp MSS through their " + "profile. Sessions using these profiles are unprotected."
+    });
+  }
+  const keepaliveOff = data.wireguardPeers.filter((p) => !p.disabled && p.persistentKeepalive <= 0);
+  if (keepaliveOff.length > 0) {
+    evidence.push({
+      dimension: "vpn",
+      severity: "warning",
+      summary: `${keepaliveOff.length} WireGuard peer(s) have persistent-keepalive off`,
+      detail: "NAT and stateful firewalls drop idle UDP mappings after ~30 s. Without " + "keepalive the peer becomes unreachable from this side until it transmits.",
+      reference: keepaliveOff[0].interface
+    });
+  }
+  if (tunnels.length > 0 && unclamped.length === 0 && oversizedMtu.length === 0 && keepaliveOff.length === 0) {
+    evidence.push({
+      dimension: "vpn",
+      severity: "ok",
+      summary: `MTU/MSS sane on all ${tunnels.length} tunnel(s)`
+    });
+  }
+  return { evidence, unclamped, oversizedMtu, keepaliveOff };
+}
+function suggestedMtu(type, pppoeWan) {
+  const o = tunnelOverhead(type);
+  return o ? (pppoeWan ? 1492 : 1500) - o.bytes : undefined;
+}
+function mtuFixCommand(iface, mtu) {
+  const o = tunnelOverhead(iface.type);
+  if (o?.path)
+    return `${o.path} set [find name="${iface.name}"] mtu=${mtu}`;
+  return `# ${iface.name} (${o?.label ?? iface.type}): set max-mtu=${mtu} max-mru=${mtu} on the ` + "client interface, or on the server settings for an inbound session";
+}
 function correlateRootCauses(data, evidence, causes) {
   const criticals = evidence.filter((e) => e.severity === "critical");
   const warnings = evidence.filter((e) => e.severity === "warning");
@@ -28592,6 +28693,41 @@ function correlateRootCauses(data, evidence, causes) {
       dimensions: ["vpn"]
     });
   }
+  const mtu = analyzeTunnelMtu(data);
+  const pppoeWan = data.interfaces.some((i) => i.type.toLowerCase().includes("pppoe"));
+  if (mtu.unclamped.length > 0 || mtu.oversizedMtu.length > 0) {
+    const names = [
+      ...new Set([...mtu.unclamped, ...mtu.oversizedMtu.map((o) => o.iface)].map((t) => t.name))
+    ];
+    const bothProblems = mtu.unclamped.length > 0 && mtu.oversizedMtu.length > 0;
+    const pingOk = data.ping?.lossPct === 0;
+    causes.push({
+      cause: "MTU/MSS black hole on tunnel",
+      explanation: `Tunnel(s) ${names.join(", ")} carry traffic larger than the path can deliver. ` + "Encapsulation shrinks the usable MTU, but hosts still negotiate a TCP MSS from " + "their own LAN MTU and set the don't-fragment bit; transit routers drop the " + "oversized packets and the ICMP 'fragmentation needed' reply is commonly filtered, " + "so the sender never learns to back off. The result is a tunnel that pings clean " + "and passes logins while file transfers, media uploads and some HTTPS sites hang.",
+      confidence: bothProblems || pingOk ? "high" : "medium",
+      evidence: mtu.evidence.filter((e) => e.severity === "warning"),
+      fixes: [
+        ...mtu.oversizedMtu.map((o) => mtuFixCommand(o.iface, suggestedMtu(o.iface.type, pppoeWan) ?? o.budget)),
+        ...mtu.unclamped.length > 0 ? [
+          "# Clamp TCP MSS for every forwarded flow (covers all tunnel types):",
+          "/ip firewall mangle add chain=forward protocol=tcp tcp-flags=syn " + 'tcp-mss=1400-65535 action=change-mss new-mss=clamp-to-pmtu comment="clamp MSS to PMTU"',
+          "# PPP-family tunnels (L2TP/PPTP/SSTP/OVPN) can clamp via their profile instead:",
+          "/ppp profile set [find] change-tcp-mss=yes"
+        ] : []
+      ],
+      dimensions: ["vpn", "firewall"]
+    });
+  }
+  if (mtu.keepaliveOff.length > 0) {
+    causes.push({
+      cause: "WireGuard peer unreachable after idle (no persistent-keepalive)",
+      explanation: `${mtu.keepaliveOff.length} enabled peer(s) have persistent-keepalive off: ` + `${mtu.keepaliveOff.map((p) => `${p.interface}/${p.publicKey.slice(0, 12)}\u2026`).join(", ")}. ` + "WireGuard is silent when idle, so the NAT/firewall mapping the peer punched " + "expires (typically ~30 s) and this side can no longer initiate. The tunnel " + "appears to work whenever the peer starts the traffic and to be down otherwise.",
+      confidence: "medium",
+      evidence: evidence.filter((e) => e.dimension === "vpn" && e.severity === "warning"),
+      fixes: mtu.keepaliveOff.map((p) => `/interface wireguard peers set [find public-key="${p.publicKey}"] persistent-keepalive=25s`),
+      dimensions: ["vpn"]
+    });
+  }
   const flapping = data.interfaces.filter((i) => i.linkDowns > 5 && i.running);
   if (flapping.length > 0 && data.ping && data.ping.lossPct > 0 && data.ping.lossPct < 100) {
     causes.push({
@@ -28797,7 +28933,9 @@ async function collectInterfaces(ctx) {
     rxErrors: num(r["rx-error"]),
     linkDowns: num(r["link-downs"]),
     lastLinkDownTime: r["last-link-down-time"],
-    mtu: num(r.mtu) || 1500
+    mtu: num(r.mtu) || 1500,
+    actualMtu: num(r["actual-mtu"]) || undefined,
+    clampTcpMss: r["clamp-tcp-mss"] === undefined ? undefined : isYes(r["clamp-tcp-mss"])
   }));
 }
 async function collectRoutes(ctx) {
@@ -28930,9 +29068,35 @@ async function collectTunnels(ctx) {
     txErrors: num(r["tx-error"]),
     rxErrors: num(r["rx-error"]),
     linkDowns: num(r["link-downs"]),
-    mtu: num(r.mtu) || 1500
+    mtu: num(r.mtu) || 1500,
+    actualMtu: num(r["actual-mtu"]) || undefined,
+    clampTcpMss: r["clamp-tcp-mss"] === undefined ? undefined : isYes(r["clamp-tcp-mss"])
+  }));
+}
+async function collectMangleRules(ctx) {
+  const raw = await safe("/ip firewall mangle print detail", ctx);
+  if (!raw)
+    return [];
+  return parseRecords(raw).rows.map(parseFirewallRow);
+}
+async function collectWireguardPeers(ctx) {
+  const raw = await safe("/interface wireguard peers print detail", ctx);
+  if (!raw || isEmpty(raw))
+    return [];
+  return parseRecords(raw).rows.map((r) => ({
+    interface: r.interface ?? "",
+    publicKey: r["public-key"] ?? "",
+    endpoint: r["endpoint-address"] || undefined,
+    persistentKeepalive: num(r["persistent-keepalive"]),
+    disabled: (r.flags ?? "").includes("X") || r.disabled === "true"
   }));
 }
+async function collectPppProfilesMissingMssClamp(ctx) {
+  const raw = await safe("/ppp profile print detail", ctx);
+  if (!raw || isEmpty(raw))
+    return [];
+  return parseRecords(raw).rows.filter((r) => !isYes(r["change-tcp-mss"])).map((r) => r.name ?? "").filter(Boolean);
+}
 async function collectDiagnosticData(target, ctx, dimensions) {
   const dims = new Set(dimensions ?? ALL_DIMENSIONS);
   const [
@@ -28950,7 +29114,10 @@ async function collectDiagnosticData(target, ctx, dimensions) {
     dnsSettingsParts,
     resourceRaw,
     logs,
-    tunnels
+    tunnels,
+    mangleRules,
+    wireguardPeers,
+    pppProfilesMissingMssClamp
   ] = await Promise.all([
     dims.has("connectivity") ? safe(`/ping ${quoteValue(target)} count=5`, ctx) : Promise.resolve(""),
     dims.has("interfaces") ? collectInterfaces(ctx) : Promise.resolve([]),
@@ -28970,7 +29137,10 @@ async function collectDiagnosticData(target, ctx, dimensions) {
     ]) : Promise.resolve(["", "", ""]),
     dims.has("resources") ? safe("/system resource print", ctx) : Promise.resolve(""),
     dims.has("logs") ? collectLogs(target, ctx) : Promise.resolve([]),
-    dims.has("vpn") ? collectTunnels(ctx) : Promise.resolve([])
+    dims.has("vpn") ? collectTunnels(ctx) : Promise.resolve([]),
+    dims.has("vpn") || dims.has("firewall") ? collectMangleRules(ctx) : Promise.resolve([]),
+    dims.has("vpn") ? collectWireguardPeers(ctx) : Promise.resolve([]),
+    dims.has("vpn") ? collectPppProfilesMissingMssClamp(ctx) : Promise.resolve([])
   ]);
   const ping = pingResult ? parsePingSummary(pingResult) ?? undefined : undefined;
   const [dnsServersRaw, dnsDynamicRaw, dnsAllowRemoteRaw] = dnsSettingsParts;
@@ -29002,7 +29172,10 @@ async function collectDiagnosticData(target, ctx, dimensions) {
     uptime: resKv.uptime ?? "",
     rosVersion: resKv.version ?? "",
     relevantLogs: logs,
-    tunnelInterfaces: tunnels
+    tunnelInterfaces: tunnels,
+    mangleRules,
+    wireguardPeers,
+    pppProfilesMissingMssClamp
   };
 }
 var dimensionEnum = z94.enum(ALL_DIMENSIONS).describe("Diagnostic dimension to investigate.");
@@ -29011,7 +29184,7 @@ var rootCauseTools = [
     name: "diagnose",
     title: "Intelligent Root-Cause Diagnosis",
     annotations: READ,
-    description: "Autonomously investigate a network problem across all diagnostic dimensions: " + "connectivity (ping), interface state & error counters, routing table & BGP/OSPF " + "neighbors, firewall rules & hit counters, NAT & connection tracking, ARP/DHCP " + "state, DNS resolution, CPU/memory pressure, system logs, and VPN tunnel state. " + "Correlates the evidence to deliver ranked root-cause hypotheses with confidence " + "levels, plain-language explanations, and exact RouterOS fix commands. " + "Pass an IP address, hostname, or symptom description as the target. " + "For hop-by-hop path analysis use `trace_path`; for log-specific investigation " + "use `correlate_events`; for fix commands only use `suggest_fix`.",
+    description: "Autonomously investigate a network problem across all diagnostic dimensions: " + "connectivity (ping), interface state & error counters, routing table & BGP/OSPF " + "neighbors, firewall rules & hit counters, NAT & connection tracking, ARP/DHCP " + "state, DNS resolution, CPU/memory pressure, system logs, and VPN tunnel state \u2014 " + "including the tunnel MTU / TCP-MSS-clamp / WireGuard-keepalive checks that catch a " + "PMTU black hole (tunnel pings fine but large transfers, uploads and some HTTPS hang). " + "Correlates the evidence to deliver ranked root-cause hypotheses with confidence " + "levels, plain-language explanations, and exact RouterOS fix commands. " + "Pass an IP address, hostname, or symptom description as the target. " + "For hop-by-hop path analysis use `trace_path`; for log-specific investigation " + "use `correlate_events`; for fix commands only use `suggest_fix`.",
     inputSchema: {
       target: z94.string().describe("The target to investigate \u2014 an IP address (e.g. '8.8.8.8'), hostname " + "(e.g. 'google.com'), or network/subnet (e.g. '10.0.0.0/24')."),
       dimensions: z94.array(dimensionEnum).optional().describe(`Limit investigation to specific dimensions. ` + `Omit to check all: ${ALL_DIMENSIONS.join(", ")}`),
@@ -34834,7 +35007,7 @@ var riskByTool = null;
 async function riskIndex() {
   if (riskByTool)
     return riskByTool;
-  const { moduleCatalog } = await import("./cli-s9fc4c7j.js");
+  const { moduleCatalog } = await import("./cli-f80vccvs.js");
   const index = new Map;
   for (const mod of moduleCatalog) {
     for (const tool of mod.tools)

package/dist/shared/{cli-s9fc4c7j.js → cli-f80vccvs.js}

@@ -4,7 +4,7 @@ import {
   allToolModules,
   moduleCatalog,
   selectToolModules
-} from "./cli-mqb3rqfy.js";
+} from "./cli-54yv0kd3.js";
 export {
   selectToolModules,
   moduleCatalog,

package/dist/shared/{library-xgy70fsf.js → library-4a4mfnxf.js}

@@ -4,7 +4,7 @@ import {
   allToolModules,
   moduleCatalog,
   selectToolModules
-} from "./library-tq8phch8.js";
+} from "./library-s7s3s14v.js";
 export {
   selectToolModules,
   moduleCatalog,

package/dist/shared/{library-tq8phch8.js → library-s7s3s14v.js}

@@ -10607,7 +10607,7 @@ var cache2 = null;
 async function gateway() {
   if (cache2)
     return cache2;
-  const { moduleCatalog } = await import("./library-xgy70fsf.js");
+  const { moduleCatalog } = await import("./library-4a4mfnxf.js");
   const forIndex = [];
   const byName = new Map;
   for (const mod of moduleCatalog) {
@@ -28176,6 +28176,8 @@ function analyzeRootCause(data) {
       summary: `All ${data.tunnelInterfaces.length} tunnel(s) running`
     });
   }
+  const mtuFindings = analyzeTunnelMtu(data);
+  evidence.push(...mtuFindings.evidence);
   correlateRootCauses(data, evidence, rootCauses);
   if (data.ping && data.ping.lossPct === 0) {
     const contradicted = new Set([
@@ -28210,6 +28212,105 @@ function analyzeRootCause(data) {
     dimensionSummary
   };
 }
+var TUNNEL_OVERHEAD = [
+  { match: "gre", bytes: 24, label: "GRE", path: "/interface gre" },
+  { match: "ipip", bytes: 20, label: "IPIP", path: "/interface ipip" },
+  { match: "eoip", bytes: 42, label: "EoIP", path: "/interface eoip" },
+  { match: "vxlan", bytes: 50, label: "VXLAN", path: "/interface vxlan" },
+  { match: "wg", bytes: 60, label: "WireGuard", path: "/interface wireguard" },
+  { match: "l2tp", bytes: 100, label: "L2TP" },
+  { match: "pptp", bytes: 100, label: "PPTP" },
+  { match: "sstp", bytes: 100, label: "SSTP" },
+  { match: "ovpn", bytes: 100, label: "OpenVPN" }
+];
+var PPP_FAMILY = /l2tp|pptp|sstp|ovpn|pppoe/;
+function tunnelOverhead(type) {
+  const t = type.toLowerCase();
+  return TUNNEL_OVERHEAD.find((o) => t.includes(o.match));
+}
+function analyzeTunnelMtu(data) {
+  const evidence = [];
+  const unclamped = [];
+  const oversizedMtu = [];
+  const tunnels = data.tunnelInterfaces.filter((t) => !t.disabled);
+  const clampRules = data.mangleRules.filter((r) => r.action === "change-mss" && !r.disabled);
+  const globalClamp = clampRules.some((r) => r.chain === "forward" || r.chain === "postrouting" || r.chain === "output");
+  const strandedClamp = clampRules.length > 0 && !globalClamp;
+  const pppoeWan = data.interfaces.some((i) => i.type.toLowerCase().includes("pppoe"));
+  const pathBudget = pppoeWan ? 1492 : 1500;
+  const pppClampedEverywhere = data.pppProfilesMissingMssClamp.length === 0;
+  for (const t of tunnels) {
+    const overhead = tunnelOverhead(t.type);
+    if (!overhead)
+      continue;
+    const effective = t.actualMtu ?? t.mtu;
+    const budget = pathBudget - overhead.bytes;
+    if (effective > budget) {
+      oversizedMtu.push({ iface: t, effective, budget, label: overhead.label });
+      evidence.push({
+        dimension: "vpn",
+        severity: "warning",
+        summary: `Tunnel ${t.name} MTU ${effective} exceeds the ${budget}-byte budget for ` + `${overhead.label} (${overhead.bytes} B overhead${pppoeWan ? " + PPPoE 8 B" : ""})`,
+        detail: "Packets at this size need fragmentation the transit path will not perform, " + "so they are dropped silently.",
+        reference: t.name
+      });
+    }
+    const covered = t.clampTcpMss === true || globalClamp || PPP_FAMILY.test(t.type.toLowerCase()) && pppClampedEverywhere;
+    if (!covered) {
+      unclamped.push(t);
+      evidence.push({
+        dimension: "vpn",
+        severity: "warning",
+        summary: `Tunnel ${t.name} (${overhead.label}) has no TCP MSS clamp`,
+        detail: "Hosts derive their MSS from their own LAN MTU and set DF, so full-size " + "segments enter the tunnel and are dropped in transit. Small flows (ping, " + "logins) work; large ones (file transfer, photo/video upload, TLS) stall.",
+        reference: t.name
+      });
+    }
+  }
+  if (strandedClamp) {
+    evidence.push({
+      dimension: "vpn",
+      severity: "warning",
+      summary: `A change-mss rule exists but only in chain '${clampRules[0].chain}' \u2014 ` + "transit traffic is clamped in forward/postrouting, not there"
+    });
+  }
+  if (data.pppProfilesMissingMssClamp.length > 0 && tunnels.some((t) => PPP_FAMILY.test(t.type))) {
+    evidence.push({
+      dimension: "vpn",
+      severity: "warning",
+      summary: `PPP profile(s) without change-tcp-mss: ${data.pppProfilesMissingMssClamp.join(", ")}`,
+      detail: "PPP-family tunnels (L2TP/PPTP/SSTP/OpenVPN/PPPoE) clamp MSS through their " + "profile. Sessions using these profiles are unprotected."
+    });
+  }
+  const keepaliveOff = data.wireguardPeers.filter((p) => !p.disabled && p.persistentKeepalive <= 0);
+  if (keepaliveOff.length > 0) {
+    evidence.push({
+      dimension: "vpn",
+      severity: "warning",
+      summary: `${keepaliveOff.length} WireGuard peer(s) have persistent-keepalive off`,
+      detail: "NAT and stateful firewalls drop idle UDP mappings after ~30 s. Without " + "keepalive the peer becomes unreachable from this side until it transmits.",
+      reference: keepaliveOff[0].interface
+    });
+  }
+  if (tunnels.length > 0 && unclamped.length === 0 && oversizedMtu.length === 0 && keepaliveOff.length === 0) {
+    evidence.push({
+      dimension: "vpn",
+      severity: "ok",
+      summary: `MTU/MSS sane on all ${tunnels.length} tunnel(s)`
+    });
+  }
+  return { evidence, unclamped, oversizedMtu, keepaliveOff };
+}
+function suggestedMtu(type, pppoeWan) {
+  const o = tunnelOverhead(type);
+  return o ? (pppoeWan ? 1492 : 1500) - o.bytes : undefined;
+}
+function mtuFixCommand(iface, mtu) {
+  const o = tunnelOverhead(iface.type);
+  if (o?.path)
+    return `${o.path} set [find name="${iface.name}"] mtu=${mtu}`;
+  return `# ${iface.name} (${o?.label ?? iface.type}): set max-mtu=${mtu} max-mru=${mtu} on the ` + "client interface, or on the server settings for an inbound session";
+}
 function correlateRootCauses(data, evidence, causes) {
   const criticals = evidence.filter((e) => e.severity === "critical");
   const warnings = evidence.filter((e) => e.severity === "warning");
@@ -28340,6 +28441,41 @@ function correlateRootCauses(data, evidence, causes) {
       dimensions: ["vpn"]
     });
   }
+  const mtu = analyzeTunnelMtu(data);
+  const pppoeWan = data.interfaces.some((i) => i.type.toLowerCase().includes("pppoe"));
+  if (mtu.unclamped.length > 0 || mtu.oversizedMtu.length > 0) {
+    const names = [
+      ...new Set([...mtu.unclamped, ...mtu.oversizedMtu.map((o) => o.iface)].map((t) => t.name))
+    ];
+    const bothProblems = mtu.unclamped.length > 0 && mtu.oversizedMtu.length > 0;
+    const pingOk = data.ping?.lossPct === 0;
+    causes.push({
+      cause: "MTU/MSS black hole on tunnel",
+      explanation: `Tunnel(s) ${names.join(", ")} carry traffic larger than the path can deliver. ` + "Encapsulation shrinks the usable MTU, but hosts still negotiate a TCP MSS from " + "their own LAN MTU and set the don't-fragment bit; transit routers drop the " + "oversized packets and the ICMP 'fragmentation needed' reply is commonly filtered, " + "so the sender never learns to back off. The result is a tunnel that pings clean " + "and passes logins while file transfers, media uploads and some HTTPS sites hang.",
+      confidence: bothProblems || pingOk ? "high" : "medium",
+      evidence: mtu.evidence.filter((e) => e.severity === "warning"),
+      fixes: [
+        ...mtu.oversizedMtu.map((o) => mtuFixCommand(o.iface, suggestedMtu(o.iface.type, pppoeWan) ?? o.budget)),
+        ...mtu.unclamped.length > 0 ? [
+          "# Clamp TCP MSS for every forwarded flow (covers all tunnel types):",
+          "/ip firewall mangle add chain=forward protocol=tcp tcp-flags=syn " + 'tcp-mss=1400-65535 action=change-mss new-mss=clamp-to-pmtu comment="clamp MSS to PMTU"',
+          "# PPP-family tunnels (L2TP/PPTP/SSTP/OVPN) can clamp via their profile instead:",
+          "/ppp profile set [find] change-tcp-mss=yes"
+        ] : []
+      ],
+      dimensions: ["vpn", "firewall"]
+    });
+  }
+  if (mtu.keepaliveOff.length > 0) {
+    causes.push({
+      cause: "WireGuard peer unreachable after idle (no persistent-keepalive)",
+      explanation: `${mtu.keepaliveOff.length} enabled peer(s) have persistent-keepalive off: ` + `${mtu.keepaliveOff.map((p) => `${p.interface}/${p.publicKey.slice(0, 12)}\u2026`).join(", ")}. ` + "WireGuard is silent when idle, so the NAT/firewall mapping the peer punched " + "expires (typically ~30 s) and this side can no longer initiate. The tunnel " + "appears to work whenever the peer starts the traffic and to be down otherwise.",
+      confidence: "medium",
+      evidence: evidence.filter((e) => e.dimension === "vpn" && e.severity === "warning"),
+      fixes: mtu.keepaliveOff.map((p) => `/interface wireguard peers set [find public-key="${p.publicKey}"] persistent-keepalive=25s`),
+      dimensions: ["vpn"]
+    });
+  }
   const flapping = data.interfaces.filter((i) => i.linkDowns > 5 && i.running);
   if (flapping.length > 0 && data.ping && data.ping.lossPct > 0 && data.ping.lossPct < 100) {
     causes.push({
@@ -28545,7 +28681,9 @@ async function collectInterfaces(ctx) {
     rxErrors: num(r["rx-error"]),
     linkDowns: num(r["link-downs"]),
     lastLinkDownTime: r["last-link-down-time"],
-    mtu: num(r.mtu) || 1500
+    mtu: num(r.mtu) || 1500,
+    actualMtu: num(r["actual-mtu"]) || undefined,
+    clampTcpMss: r["clamp-tcp-mss"] === undefined ? undefined : isYes(r["clamp-tcp-mss"])
   }));
 }
 async function collectRoutes(ctx) {
@@ -28678,9 +28816,35 @@ async function collectTunnels(ctx) {
     txErrors: num(r["tx-error"]),
     rxErrors: num(r["rx-error"]),
     linkDowns: num(r["link-downs"]),
-    mtu: num(r.mtu) || 1500
+    mtu: num(r.mtu) || 1500,
+    actualMtu: num(r["actual-mtu"]) || undefined,
+    clampTcpMss: r["clamp-tcp-mss"] === undefined ? undefined : isYes(r["clamp-tcp-mss"])
+  }));
+}
+async function collectMangleRules(ctx) {
+  const raw = await safe("/ip firewall mangle print detail", ctx);
+  if (!raw)
+    return [];
+  return parseRecords(raw).rows.map(parseFirewallRow);
+}
+async function collectWireguardPeers(ctx) {
+  const raw = await safe("/interface wireguard peers print detail", ctx);
+  if (!raw || isEmpty(raw))
+    return [];
+  return parseRecords(raw).rows.map((r) => ({
+    interface: r.interface ?? "",
+    publicKey: r["public-key"] ?? "",
+    endpoint: r["endpoint-address"] || undefined,
+    persistentKeepalive: num(r["persistent-keepalive"]),
+    disabled: (r.flags ?? "").includes("X") || r.disabled === "true"
   }));
 }
+async function collectPppProfilesMissingMssClamp(ctx) {
+  const raw = await safe("/ppp profile print detail", ctx);
+  if (!raw || isEmpty(raw))
+    return [];
+  return parseRecords(raw).rows.filter((r) => !isYes(r["change-tcp-mss"])).map((r) => r.name ?? "").filter(Boolean);
+}
 async function collectDiagnosticData(target, ctx, dimensions) {
   const dims = new Set(dimensions ?? ALL_DIMENSIONS);
   const [
@@ -28698,7 +28862,10 @@ async function collectDiagnosticData(target, ctx, dimensions) {
     dnsSettingsParts,
     resourceRaw,
     logs,
-    tunnels
+    tunnels,
+    mangleRules,
+    wireguardPeers,
+    pppProfilesMissingMssClamp
   ] = await Promise.all([
     dims.has("connectivity") ? safe(`/ping ${quoteValue(target)} count=5`, ctx) : Promise.resolve(""),
     dims.has("interfaces") ? collectInterfaces(ctx) : Promise.resolve([]),
@@ -28718,7 +28885,10 @@ async function collectDiagnosticData(target, ctx, dimensions) {
     ]) : Promise.resolve(["", "", ""]),
     dims.has("resources") ? safe("/system resource print", ctx) : Promise.resolve(""),
     dims.has("logs") ? collectLogs(target, ctx) : Promise.resolve([]),
-    dims.has("vpn") ? collectTunnels(ctx) : Promise.resolve([])
+    dims.has("vpn") ? collectTunnels(ctx) : Promise.resolve([]),
+    dims.has("vpn") || dims.has("firewall") ? collectMangleRules(ctx) : Promise.resolve([]),
+    dims.has("vpn") ? collectWireguardPeers(ctx) : Promise.resolve([]),
+    dims.has("vpn") ? collectPppProfilesMissingMssClamp(ctx) : Promise.resolve([])
   ]);
   const ping = pingResult ? parsePingSummary(pingResult) ?? undefined : undefined;
   const [dnsServersRaw, dnsDynamicRaw, dnsAllowRemoteRaw] = dnsSettingsParts;
@@ -28750,7 +28920,10 @@ async function collectDiagnosticData(target, ctx, dimensions) {
     uptime: resKv.uptime ?? "",
     rosVersion: resKv.version ?? "",
     relevantLogs: logs,
-    tunnelInterfaces: tunnels
+    tunnelInterfaces: tunnels,
+    mangleRules,
+    wireguardPeers,
+    pppProfilesMissingMssClamp
   };
 }
 var dimensionEnum = z94.enum(ALL_DIMENSIONS).describe("Diagnostic dimension to investigate.");
@@ -28759,7 +28932,7 @@ var rootCauseTools = [
     name: "diagnose",
     title: "Intelligent Root-Cause Diagnosis",
     annotations: READ,
-    description: "Autonomously investigate a network problem across all diagnostic dimensions: " + "connectivity (ping), interface state & error counters, routing table & BGP/OSPF " + "neighbors, firewall rules & hit counters, NAT & connection tracking, ARP/DHCP " + "state, DNS resolution, CPU/memory pressure, system logs, and VPN tunnel state. " + "Correlates the evidence to deliver ranked root-cause hypotheses with confidence " + "levels, plain-language explanations, and exact RouterOS fix commands. " + "Pass an IP address, hostname, or symptom description as the target. " + "For hop-by-hop path analysis use `trace_path`; for log-specific investigation " + "use `correlate_events`; for fix commands only use `suggest_fix`.",
+    description: "Autonomously investigate a network problem across all diagnostic dimensions: " + "connectivity (ping), interface state & error counters, routing table & BGP/OSPF " + "neighbors, firewall rules & hit counters, NAT & connection tracking, ARP/DHCP " + "state, DNS resolution, CPU/memory pressure, system logs, and VPN tunnel state \u2014 " + "including the tunnel MTU / TCP-MSS-clamp / WireGuard-keepalive checks that catch a " + "PMTU black hole (tunnel pings fine but large transfers, uploads and some HTTPS hang). " + "Correlates the evidence to deliver ranked root-cause hypotheses with confidence " + "levels, plain-language explanations, and exact RouterOS fix commands. " + "Pass an IP address, hostname, or symptom description as the target. " + "For hop-by-hop path analysis use `trace_path`; for log-specific investigation " + "use `correlate_events`; for fix commands only use `suggest_fix`.",
     inputSchema: {
       target: z94.string().describe("The target to investigate \u2014 an IP address (e.g. '8.8.8.8'), hostname " + "(e.g. 'google.com'), or network/subnet (e.g. '10.0.0.0/24')."),
       dimensions: z94.array(dimensionEnum).optional().describe(`Limit investigation to specific dimensions. ` + `Omit to check all: ${ALL_DIMENSIONS.join(", ")}`),
@@ -34334,7 +34507,7 @@ var riskByTool = null;
 async function riskIndex() {
   if (riskByTool)
     return riskByTool;
-  const { moduleCatalog } = await import("./library-xgy70fsf.js");
+  const { moduleCatalog } = await import("./library-4a4mfnxf.js");
   const index = new Map;
   for (const mod of moduleCatalog) {
     for (const tool of mod.tools)