@usex/mikrotik-mcp 5.2.0 → 5.3.0

package/dist/cli.js

@@ -230,7 +230,7 @@ import {
   validatePolicyText,
   worstSeverity,
   writeBackup
-} from "./shared/cli-mqb3rqfy.js";
+} from "./shared/cli-54yv0kd3.js";
 
 // src/cli.ts
 import { existsSync as existsSync2 } from "fs";

package/dist/index.js

@@ -29,7 +29,7 @@ import {
   selectToolModules,
   setConfig,
   updateSummaryLine
-} from "./shared/library-tq8phch8.js";
+} from "./shared/library-s7s3s14v.js";
 // src/server.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";

package/dist/shared/{cli-mqb3rqfy.js → cli-54yv0kd3.js}

@@ -10832,7 +10832,7 @@ var cache2 = null;
 async function gateway() {
   if (cache2)
     return cache2;
-  const { moduleCatalog } = await import("./cli-s9fc4c7j.js");
+  const { moduleCatalog } = await import("./cli-f80vccvs.js");
   const forIndex = [];
   const byName = new Map;
   for (const mod of moduleCatalog) {
@@ -28428,6 +28428,8 @@ function analyzeRootCause(data) {
       summary: `All ${data.tunnelInterfaces.length} tunnel(s) running`
     });
   }
+  const mtuFindings = analyzeTunnelMtu(data);
+  evidence.push(...mtuFindings.evidence);
   correlateRootCauses(data, evidence, rootCauses);
   if (data.ping && data.ping.lossPct === 0) {
     const contradicted = new Set([
@@ -28462,6 +28464,105 @@ function analyzeRootCause(data) {
     dimensionSummary
   };
 }
+var TUNNEL_OVERHEAD = [
+  { match: "gre", bytes: 24, label: "GRE", path: "/interface gre" },
+  { match: "ipip", bytes: 20, label: "IPIP", path: "/interface ipip" },
+  { match: "eoip", bytes: 42, label: "EoIP", path: "/interface eoip" },
+  { match: "vxlan", bytes: 50, label: "VXLAN", path: "/interface vxlan" },
+  { match: "wg", bytes: 60, label: "WireGuard", path: "/interface wireguard" },
+  { match: "l2tp", bytes: 100, label: "L2TP" },
+  { match: "pptp", bytes: 100, label: "PPTP" },
+  { match: "sstp", bytes: 100, label: "SSTP" },
+  { match: "ovpn", bytes: 100, label: "OpenVPN" }
+];
+var PPP_FAMILY = /l2tp|pptp|sstp|ovpn|pppoe/;
+function tunnelOverhead(type) {
+  const t = type.toLowerCase();
+  return TUNNEL_OVERHEAD.find((o) => t.includes(o.match));
+}
+function analyzeTunnelMtu(data) {
+  const evidence = [];
+  const unclamped = [];
+  const oversizedMtu = [];
+  const tunnels = data.tunnelInterfaces.filter((t) => !t.disabled);
+  const clampRules = data.mangleRules.filter((r) => r.action === "change-mss" && !r.disabled);
+  const globalClamp = clampRules.some((r) => r.chain === "forward" || r.chain === "postrouting" || r.chain === "output");
+  const strandedClamp = clampRules.length > 0 && !globalClamp;
+  const pppoeWan = data.interfaces.some((i) => i.type.toLowerCase().includes("pppoe"));
+  const pathBudget = pppoeWan ? 1492 : 1500;
+  const pppClampedEverywhere = data.pppProfilesMissingMssClamp.length === 0;
+  for (const t of tunnels) {
+    const overhead = tunnelOverhead(t.type);
+    if (!overhead)
+      continue;
+    const effective = t.actualMtu ?? t.mtu;
+    const budget = pathBudget - overhead.bytes;
+    if (effective > budget) {
+      oversizedMtu.push({ iface: t, effective, budget, label: overhead.label });
+      evidence.push({
+        dimension: "vpn",
+        severity: "warning",
+        summary: `Tunnel ${t.name} MTU ${effective} exceeds the ${budget}-byte budget for ` + `${overhead.label} (${overhead.bytes} B overhead${pppoeWan ? " + PPPoE 8 B" : ""})`,
+        detail: "Packets at this size need fragmentation the transit path will not perform, " + "so they are dropped silently.",
+        reference: t.name
+      });
+    }
+    const covered = t.clampTcpMss === true || globalClamp || PPP_FAMILY.test(t.type.toLowerCase()) && pppClampedEverywhere;
+    if (!covered) {
+      unclamped.push(t);
+      evidence.push({
+        dimension: "vpn",
+        severity: "warning",
+        summary: `Tunnel ${t.name} (${overhead.label}) has no TCP MSS clamp`,
+        detail: "Hosts derive their MSS from their own LAN MTU and set DF, so full-size " + "segments enter the tunnel and are dropped in transit. Small flows (ping, " + "logins) work; large ones (file transfer, photo/video upload, TLS) stall.",
+        reference: t.name
+      });
+    }
+  }
+  if (strandedClamp) {
+    evidence.push({
+      dimension: "vpn",
+      severity: "warning",
+      summary: `A change-mss rule exists but only in chain '${clampRules[0].chain}' \u2014 ` + "transit traffic is clamped in forward/postrouting, not there"
+    });
+  }
+  if (data.pppProfilesMissingMssClamp.length > 0 && tunnels.some((t) => PPP_FAMILY.test(t.type))) {
+    evidence.push({
+      dimension: "vpn",
+      severity: "warning",
+      summary: `PPP profile(s) without change-tcp-mss: ${data.pppProfilesMissingMssClamp.join(", ")}`,
+      detail: "PPP-family tunnels (L2TP/PPTP/SSTP/OpenVPN/PPPoE) clamp MSS through their " + "profile. Sessions using these profiles are unprotected."
+    });
+  }
+  const keepaliveOff = data.wireguardPeers.filter((p) => !p.disabled && p.persistentKeepalive <= 0);
+  if (keepaliveOff.length > 0) {
+    evidence.push({
+      dimension: "vpn",
+      severity: "warning",
+      summary: `${keepaliveOff.length} WireGuard peer(s) have persistent-keepalive off`,
+      detail: "NAT and stateful firewalls drop idle UDP mappings after ~30 s. Without " + "keepalive the peer becomes unreachable from this side until it transmits.",
+      reference: keepaliveOff[0].interface
+    });
+  }
+  if (tunnels.length > 0 && unclamped.length === 0 && oversizedMtu.length === 0 && keepaliveOff.length === 0) {
+    evidence.push({
+      dimension: "vpn",
+      severity: "ok",
+      summary: `MTU/MSS sane on all ${tunnels.length} tunnel(s)`
+    });
+  }
+  return { evidence, unclamped, oversizedMtu, keepaliveOff };
+}
+function suggestedMtu(type, pppoeWan) {
+  const o = tunnelOverhead(type);
+  return o ? (pppoeWan ? 1492 : 1500) - o.bytes : undefined;
+}
+function mtuFixCommand(iface, mtu) {
+  const o = tunnelOverhead(iface.type);
+  if (o?.path)
+    return `${o.path} set [find name="${iface.name}"] mtu=${mtu}`;
+  return `# ${iface.name} (${o?.label ?? iface.type}): set max-mtu=${mtu} max-mru=${mtu} on the ` + "client interface, or on the server settings for an inbound session";
+}
 function correlateRootCauses(data, evidence, causes) {
   const criticals = evidence.filter((e) => e.severity === "critical");
   const warnings = evidence.filter((e) => e.severity === "warning");
@@ -28592,6 +28693,41 @@ function correlateRootCauses(data, evidence, causes) {
       dimensions: ["vpn"]
     });
   }
+  const mtu = analyzeTunnelMtu(data);
+  const pppoeWan = data.interfaces.some((i) => i.type.toLowerCase().includes("pppoe"));
+  if (mtu.unclamped.length > 0 || mtu.oversizedMtu.length > 0) {
+    const names = [
+      ...new Set([...mtu.unclamped, ...mtu.oversizedMtu.map((o) => o.iface)].map((t) => t.name))
+    ];
+    const bothProblems = mtu.unclamped.length > 0 && mtu.oversizedMtu.length > 0;
+    const pingOk = data.ping?.lossPct === 0;
+    causes.push({
+      cause: "MTU/MSS black hole on tunnel",
+      explanation: `Tunnel(s) ${names.join(", ")} carry traffic larger than the path can deliver. ` + "Encapsulation shrinks the usable MTU, but hosts still negotiate a TCP MSS from " + "their own LAN MTU and set the don't-fragment bit; transit routers drop the " + "oversized packets and the ICMP 'fragmentation needed' reply is commonly filtered, " + "so the sender never learns to back off. The result is a tunnel that pings clean " + "and passes logins while file transfers, media uploads and some HTTPS sites hang.",
+      confidence: bothProblems || pingOk ? "high" : "medium",
+      evidence: mtu.evidence.filter((e) => e.severity === "warning"),
+      fixes: [
+        ...mtu.oversizedMtu.map((o) => mtuFixCommand(o.iface, suggestedMtu(o.iface.type, pppoeWan) ?? o.budget)),
+        ...mtu.unclamped.length > 0 ? [
+          "# Clamp TCP MSS for every forwarded flow (covers all tunnel types):",
+          "/ip firewall mangle add chain=forward protocol=tcp tcp-flags=syn " + 'tcp-mss=1400-65535 action=change-mss new-mss=clamp-to-pmtu comment="clamp MSS to PMTU"',
+          "# PPP-family tunnels (L2TP/PPTP/SSTP/OVPN) can clamp via their profile instead:",
+          "/ppp profile set [find] change-tcp-mss=yes"
+        ] : []
+      ],
+      dimensions: ["vpn", "firewall"]
+    });
+  }
+  if (mtu.keepaliveOff.length > 0) {
+    causes.push({
+      cause: "WireGuard peer unreachable after idle (no persistent-keepalive)",
+      explanation: `${mtu.keepaliveOff.length} enabled peer(s) have persistent-keepalive off: ` + `${mtu.keepaliveOff.map((p) => `${p.interface}/${p.publicKey.slice(0, 12)}\u2026`).join(", ")}. ` + "WireGuard is silent when idle, so the NAT/firewall mapping the peer punched " + "expires (typically ~30 s) and this side can no longer initiate. The tunnel " + "appears to work whenever the peer starts the traffic and to be down otherwise.",
+      confidence: "medium",
+      evidence: evidence.filter((e) => e.dimension === "vpn" && e.severity === "warning"),
+      fixes: mtu.keepaliveOff.map((p) => `/interface wireguard peers set [find public-key="${p.publicKey}"] persistent-keepalive=25s`),
+      dimensions: ["vpn"]
+    });
+  }
   const flapping = data.interfaces.filter((i) => i.linkDowns > 5 && i.running);
   if (flapping.length > 0 && data.ping && data.ping.lossPct > 0 && data.ping.lossPct < 100) {
     causes.push({
@@ -28797,7 +28933,9 @@ async function collectInterfaces(ctx) {
     rxErrors: num(r["rx-error"]),
     linkDowns: num(r["link-downs"]),
     lastLinkDownTime: r["last-link-down-time"],
-    mtu: num(r.mtu) || 1500
+    mtu: num(r.mtu) || 1500,
+    actualMtu: num(r["actual-mtu"]) || undefined,
+    clampTcpMss: r["clamp-tcp-mss"] === undefined ? undefined : isYes(r["clamp-tcp-mss"])
   }));
 }
 async function collectRoutes(ctx) {
@@ -28930,9 +29068,35 @@ async function collectTunnels(ctx) {
     txErrors: num(r["tx-error"]),
     rxErrors: num(r["rx-error"]),
     linkDowns: num(r["link-downs"]),
-    mtu: num(r.mtu) || 1500
+    mtu: num(r.mtu) || 1500,
+    actualMtu: num(r["actual-mtu"]) || undefined,
+    clampTcpMss: r["clamp-tcp-mss"] === undefined ? undefined : isYes(r["clamp-tcp-mss"])
+  }));
+}
+async function collectMangleRules(ctx) {
+  const raw = await safe("/ip firewall mangle print detail", ctx);
+  if (!raw)
+    return [];
+  return parseRecords(raw).rows.map(parseFirewallRow);
+}
+async function collectWireguardPeers(ctx) {
+  const raw = await safe("/interface wireguard peers print detail", ctx);
+  if (!raw || isEmpty(raw))
+    return [];
+  return parseRecords(raw).rows.map((r) => ({
+    interface: r.interface ?? "",
+    publicKey: r["public-key"] ?? "",
+    endpoint: r["endpoint-address"] || undefined,
+    persistentKeepalive: num(r["persistent-keepalive"]),
+    disabled: (r.flags ?? "").includes("X") || r.disabled === "true"
   }));
 }
+async function collectPppProfilesMissingMssClamp(ctx) {
+  const raw = await safe("/ppp profile print detail", ctx);
+  if (!raw || isEmpty(raw))
+    return [];
+  return parseRecords(raw).rows.filter((r) => !isYes(r["change-tcp-mss"])).map((r) => r.name ?? "").filter(Boolean);
+}
 async function collectDiagnosticData(target, ctx, dimensions) {
   const dims = new Set(dimensions ?? ALL_DIMENSIONS);
   const [
@@ -28950,7 +29114,10 @@ async function collectDiagnosticData(target, ctx, dimensions) {
     dnsSettingsParts,
     resourceRaw,
     logs,
-    tunnels
+    tunnels,
+    mangleRules,
+    wireguardPeers,
+    pppProfilesMissingMssClamp
   ] = await Promise.all([
     dims.has("connectivity") ? safe(`/ping ${quoteValue(target)} count=5`, ctx) : Promise.resolve(""),
     dims.has("interfaces") ? collectInterfaces(ctx) : Promise.resolve([]),
@@ -28970,7 +29137,10 @@ async function collectDiagnosticData(target, ctx, dimensions) {
     ]) : Promise.resolve(["", "", ""]),
     dims.has("resources") ? safe("/system resource print", ctx) : Promise.resolve(""),
     dims.has("logs") ? collectLogs(target, ctx) : Promise.resolve([]),
-    dims.has("vpn") ? collectTunnels(ctx) : Promise.resolve([])
+    dims.has("vpn") ? collectTunnels(ctx) : Promise.resolve([]),
+    dims.has("vpn") || dims.has("firewall") ? collectMangleRules(ctx) : Promise.resolve([]),
+    dims.has("vpn") ? collectWireguardPeers(ctx) : Promise.resolve([]),
+    dims.has("vpn") ? collectPppProfilesMissingMssClamp(ctx) : Promise.resolve([])
   ]);
   const ping = pingResult ? parsePingSummary(pingResult) ?? undefined : undefined;
   const [dnsServersRaw, dnsDynamicRaw, dnsAllowRemoteRaw] = dnsSettingsParts;
@@ -29002,7 +29172,10 @@ async function collectDiagnosticData(target, ctx, dimensions) {
     uptime: resKv.uptime ?? "",
     rosVersion: resKv.version ?? "",
     relevantLogs: logs,
-    tunnelInterfaces: tunnels
+    tunnelInterfaces: tunnels,
+    mangleRules,
+    wireguardPeers,
+    pppProfilesMissingMssClamp
   };
 }
 var dimensionEnum = z94.enum(ALL_DIMENSIONS).describe("Diagnostic dimension to investigate.");
@@ -29011,7 +29184,7 @@ var rootCauseTools = [
     name: "diagnose",
     title: "Intelligent Root-Cause Diagnosis",
     annotations: READ,
-    description: "Autonomously investigate a network problem across all diagnostic dimensions: " + "connectivity (ping), interface state & error counters, routing table & BGP/OSPF " + "neighbors, firewall rules & hit counters, NAT & connection tracking, ARP/DHCP " + "state, DNS resolution, CPU/memory pressure, system logs, and VPN tunnel state. " + "Correlates the evidence to deliver ranked root-cause hypotheses with confidence " + "levels, plain-language explanations, and exact RouterOS fix commands. " + "Pass an IP address, hostname, or symptom description as the target. " + "For hop-by-hop path analysis use `trace_path`; for log-specific investigation " + "use `correlate_events`; for fix commands only use `suggest_fix`.",
+    description: "Autonomously investigate a network problem across all diagnostic dimensions: " + "connectivity (ping), interface state & error counters, routing table & BGP/OSPF " + "neighbors, firewall rules & hit counters, NAT & connection tracking, ARP/DHCP " + "state, DNS resolution, CPU/memory pressure, system logs, and VPN tunnel state \u2014 " + "including the tunnel MTU / TCP-MSS-clamp / WireGuard-keepalive checks that catch a " + "PMTU black hole (tunnel pings fine but large transfers, uploads and some HTTPS hang). " + "Correlates the evidence to deliver ranked root-cause hypotheses with confidence " + "levels, plain-language explanations, and exact RouterOS fix commands. " + "Pass an IP address, hostname, or symptom description as the target. " + "For hop-by-hop path analysis use `trace_path`; for log-specific investigation " + "use `correlate_events`; for fix commands only use `suggest_fix`.",
     inputSchema: {
       target: z94.string().describe("The target to investigate \u2014 an IP address (e.g. '8.8.8.8'), hostname " + "(e.g. 'google.com'), or network/subnet (e.g. '10.0.0.0/24')."),
       dimensions: z94.array(dimensionEnum).optional().describe(`Limit investigation to specific dimensions. ` + `Omit to check all: ${ALL_DIMENSIONS.join(", ")}`),
@@ -34834,7 +35007,7 @@ var riskByTool = null;
 async function riskIndex() {
   if (riskByTool)
     return riskByTool;
-  const { moduleCatalog } = await import("./cli-s9fc4c7j.js");
+  const { moduleCatalog } = await import("./cli-f80vccvs.js");
   const index = new Map;
   for (const mod of moduleCatalog) {
     for (const tool of mod.tools)

package/dist/shared/{cli-s9fc4c7j.js → cli-f80vccvs.js}

@@ -4,7 +4,7 @@ import {
   allToolModules,
   moduleCatalog,
   selectToolModules
-} from "./cli-mqb3rqfy.js";
+} from "./cli-54yv0kd3.js";
 export {
   selectToolModules,
   moduleCatalog,

package/dist/shared/{library-xgy70fsf.js → library-4a4mfnxf.js}

@@ -4,7 +4,7 @@ import {
   allToolModules,
   moduleCatalog,
   selectToolModules
-} from "./library-tq8phch8.js";
+} from "./library-s7s3s14v.js";
 export {
   selectToolModules,
   moduleCatalog,

package/dist/shared/{library-tq8phch8.js → library-s7s3s14v.js}

@@ -10607,7 +10607,7 @@ var cache2 = null;
 async function gateway() {
   if (cache2)
     return cache2;
-  const { moduleCatalog } = await import("./library-xgy70fsf.js");
+  const { moduleCatalog } = await import("./library-4a4mfnxf.js");
   const forIndex = [];
   const byName = new Map;
   for (const mod of moduleCatalog) {
@@ -28176,6 +28176,8 @@ function analyzeRootCause(data) {
       summary: `All ${data.tunnelInterfaces.length} tunnel(s) running`
     });
   }
+  const mtuFindings = analyzeTunnelMtu(data);
+  evidence.push(...mtuFindings.evidence);
   correlateRootCauses(data, evidence, rootCauses);
   if (data.ping && data.ping.lossPct === 0) {
     const contradicted = new Set([
@@ -28210,6 +28212,105 @@ function analyzeRootCause(data) {
     dimensionSummary
   };
 }
+var TUNNEL_OVERHEAD = [
+  { match: "gre", bytes: 24, label: "GRE", path: "/interface gre" },
+  { match: "ipip", bytes: 20, label: "IPIP", path: "/interface ipip" },
+  { match: "eoip", bytes: 42, label: "EoIP", path: "/interface eoip" },
+  { match: "vxlan", bytes: 50, label: "VXLAN", path: "/interface vxlan" },
+  { match: "wg", bytes: 60, label: "WireGuard", path: "/interface wireguard" },
+  { match: "l2tp", bytes: 100, label: "L2TP" },
+  { match: "pptp", bytes: 100, label: "PPTP" },
+  { match: "sstp", bytes: 100, label: "SSTP" },
+  { match: "ovpn", bytes: 100, label: "OpenVPN" }
+];
+var PPP_FAMILY = /l2tp|pptp|sstp|ovpn|pppoe/;
+function tunnelOverhead(type) {
+  const t = type.toLowerCase();
+  return TUNNEL_OVERHEAD.find((o) => t.includes(o.match));
+}
+function analyzeTunnelMtu(data) {
+  const evidence = [];
+  const unclamped = [];
+  const oversizedMtu = [];
+  const tunnels = data.tunnelInterfaces.filter((t) => !t.disabled);
+  const clampRules = data.mangleRules.filter((r) => r.action === "change-mss" && !r.disabled);
+  const globalClamp = clampRules.some((r) => r.chain === "forward" || r.chain === "postrouting" || r.chain === "output");
+  const strandedClamp = clampRules.length > 0 && !globalClamp;
+  const pppoeWan = data.interfaces.some((i) => i.type.toLowerCase().includes("pppoe"));
+  const pathBudget = pppoeWan ? 1492 : 1500;
+  const pppClampedEverywhere = data.pppProfilesMissingMssClamp.length === 0;
+  for (const t of tunnels) {
+    const overhead = tunnelOverhead(t.type);
+    if (!overhead)
+      continue;
+    const effective = t.actualMtu ?? t.mtu;
+    const budget = pathBudget - overhead.bytes;
+    if (effective > budget) {
+      oversizedMtu.push({ iface: t, effective, budget, label: overhead.label });
+      evidence.push({
+        dimension: "vpn",
+        severity: "warning",
+        summary: `Tunnel ${t.name} MTU ${effective} exceeds the ${budget}-byte budget for ` + `${overhead.label} (${overhead.bytes} B overhead${pppoeWan ? " + PPPoE 8 B" : ""})`,
+        detail: "Packets at this size need fragmentation the transit path will not perform, " + "so they are dropped silently.",
+        reference: t.name
+      });
+    }
+    const covered = t.clampTcpMss === true || globalClamp || PPP_FAMILY.test(t.type.toLowerCase()) && pppClampedEverywhere;
+    if (!covered) {
+      unclamped.push(t);
+      evidence.push({
+        dimension: "vpn",
+        severity: "warning",
+        summary: `Tunnel ${t.name} (${overhead.label}) has no TCP MSS clamp`,
+        detail: "Hosts derive their MSS from their own LAN MTU and set DF, so full-size " + "segments enter the tunnel and are dropped in transit. Small flows (ping, " + "logins) work; large ones (file transfer, photo/video upload, TLS) stall.",
+        reference: t.name
+      });
+    }
+  }
+  if (strandedClamp) {
+    evidence.push({
+      dimension: "vpn",
+      severity: "warning",
+      summary: `A change-mss rule exists but only in chain '${clampRules[0].chain}' \u2014 ` + "transit traffic is clamped in forward/postrouting, not there"
+    });
+  }
+  if (data.pppProfilesMissingMssClamp.length > 0 && tunnels.some((t) => PPP_FAMILY.test(t.type))) {
+    evidence.push({
+      dimension: "vpn",
+      severity: "warning",
+      summary: `PPP profile(s) without change-tcp-mss: ${data.pppProfilesMissingMssClamp.join(", ")}`,
+      detail: "PPP-family tunnels (L2TP/PPTP/SSTP/OpenVPN/PPPoE) clamp MSS through their " + "profile. Sessions using these profiles are unprotected."
+    });
+  }
+  const keepaliveOff = data.wireguardPeers.filter((p) => !p.disabled && p.persistentKeepalive <= 0);
+  if (keepaliveOff.length > 0) {
+    evidence.push({
+      dimension: "vpn",
+      severity: "warning",
+      summary: `${keepaliveOff.length} WireGuard peer(s) have persistent-keepalive off`,
+      detail: "NAT and stateful firewalls drop idle UDP mappings after ~30 s. Without " + "keepalive the peer becomes unreachable from this side until it transmits.",
+      reference: keepaliveOff[0].interface
+    });
+  }
+  if (tunnels.length > 0 && unclamped.length === 0 && oversizedMtu.length === 0 && keepaliveOff.length === 0) {
+    evidence.push({
+      dimension: "vpn",
+      severity: "ok",
+      summary: `MTU/MSS sane on all ${tunnels.length} tunnel(s)`
+    });
+  }
+  return { evidence, unclamped, oversizedMtu, keepaliveOff };
+}
+function suggestedMtu(type, pppoeWan) {
+  const o = tunnelOverhead(type);
+  return o ? (pppoeWan ? 1492 : 1500) - o.bytes : undefined;
+}
+function mtuFixCommand(iface, mtu) {
+  const o = tunnelOverhead(iface.type);
+  if (o?.path)
+    return `${o.path} set [find name="${iface.name}"] mtu=${mtu}`;
+  return `# ${iface.name} (${o?.label ?? iface.type}): set max-mtu=${mtu} max-mru=${mtu} on the ` + "client interface, or on the server settings for an inbound session";
+}
 function correlateRootCauses(data, evidence, causes) {
   const criticals = evidence.filter((e) => e.severity === "critical");
   const warnings = evidence.filter((e) => e.severity === "warning");
@@ -28340,6 +28441,41 @@ function correlateRootCauses(data, evidence, causes) {
       dimensions: ["vpn"]
     });
   }
+  const mtu = analyzeTunnelMtu(data);
+  const pppoeWan = data.interfaces.some((i) => i.type.toLowerCase().includes("pppoe"));
+  if (mtu.unclamped.length > 0 || mtu.oversizedMtu.length > 0) {
+    const names = [
+      ...new Set([...mtu.unclamped, ...mtu.oversizedMtu.map((o) => o.iface)].map((t) => t.name))
+    ];
+    const bothProblems = mtu.unclamped.length > 0 && mtu.oversizedMtu.length > 0;
+    const pingOk = data.ping?.lossPct === 0;
+    causes.push({
+      cause: "MTU/MSS black hole on tunnel",
+      explanation: `Tunnel(s) ${names.join(", ")} carry traffic larger than the path can deliver. ` + "Encapsulation shrinks the usable MTU, but hosts still negotiate a TCP MSS from " + "their own LAN MTU and set the don't-fragment bit; transit routers drop the " + "oversized packets and the ICMP 'fragmentation needed' reply is commonly filtered, " + "so the sender never learns to back off. The result is a tunnel that pings clean " + "and passes logins while file transfers, media uploads and some HTTPS sites hang.",
+      confidence: bothProblems || pingOk ? "high" : "medium",
+      evidence: mtu.evidence.filter((e) => e.severity === "warning"),
+      fixes: [
+        ...mtu.oversizedMtu.map((o) => mtuFixCommand(o.iface, suggestedMtu(o.iface.type, pppoeWan) ?? o.budget)),
+        ...mtu.unclamped.length > 0 ? [
+          "# Clamp TCP MSS for every forwarded flow (covers all tunnel types):",
+          "/ip firewall mangle add chain=forward protocol=tcp tcp-flags=syn " + 'tcp-mss=1400-65535 action=change-mss new-mss=clamp-to-pmtu comment="clamp MSS to PMTU"',
+          "# PPP-family tunnels (L2TP/PPTP/SSTP/OVPN) can clamp via their profile instead:",
+          "/ppp profile set [find] change-tcp-mss=yes"
+        ] : []
+      ],
+      dimensions: ["vpn", "firewall"]
+    });
+  }
+  if (mtu.keepaliveOff.length > 0) {
+    causes.push({
+      cause: "WireGuard peer unreachable after idle (no persistent-keepalive)",
+      explanation: `${mtu.keepaliveOff.length} enabled peer(s) have persistent-keepalive off: ` + `${mtu.keepaliveOff.map((p) => `${p.interface}/${p.publicKey.slice(0, 12)}\u2026`).join(", ")}. ` + "WireGuard is silent when idle, so the NAT/firewall mapping the peer punched " + "expires (typically ~30 s) and this side can no longer initiate. The tunnel " + "appears to work whenever the peer starts the traffic and to be down otherwise.",
+      confidence: "medium",
+      evidence: evidence.filter((e) => e.dimension === "vpn" && e.severity === "warning"),
+      fixes: mtu.keepaliveOff.map((p) => `/interface wireguard peers set [find public-key="${p.publicKey}"] persistent-keepalive=25s`),
+      dimensions: ["vpn"]
+    });
+  }
   const flapping = data.interfaces.filter((i) => i.linkDowns > 5 && i.running);
   if (flapping.length > 0 && data.ping && data.ping.lossPct > 0 && data.ping.lossPct < 100) {
     causes.push({
@@ -28545,7 +28681,9 @@ async function collectInterfaces(ctx) {
     rxErrors: num(r["rx-error"]),
     linkDowns: num(r["link-downs"]),
     lastLinkDownTime: r["last-link-down-time"],
-    mtu: num(r.mtu) || 1500
+    mtu: num(r.mtu) || 1500,
+    actualMtu: num(r["actual-mtu"]) || undefined,
+    clampTcpMss: r["clamp-tcp-mss"] === undefined ? undefined : isYes(r["clamp-tcp-mss"])
   }));
 }
 async function collectRoutes(ctx) {
@@ -28678,9 +28816,35 @@ async function collectTunnels(ctx) {
     txErrors: num(r["tx-error"]),
     rxErrors: num(r["rx-error"]),
     linkDowns: num(r["link-downs"]),
-    mtu: num(r.mtu) || 1500
+    mtu: num(r.mtu) || 1500,
+    actualMtu: num(r["actual-mtu"]) || undefined,
+    clampTcpMss: r["clamp-tcp-mss"] === undefined ? undefined : isYes(r["clamp-tcp-mss"])
+  }));
+}
+async function collectMangleRules(ctx) {
+  const raw = await safe("/ip firewall mangle print detail", ctx);
+  if (!raw)
+    return [];
+  return parseRecords(raw).rows.map(parseFirewallRow);
+}
+async function collectWireguardPeers(ctx) {
+  const raw = await safe("/interface wireguard peers print detail", ctx);
+  if (!raw || isEmpty(raw))
+    return [];
+  return parseRecords(raw).rows.map((r) => ({
+    interface: r.interface ?? "",
+    publicKey: r["public-key"] ?? "",
+    endpoint: r["endpoint-address"] || undefined,
+    persistentKeepalive: num(r["persistent-keepalive"]),
+    disabled: (r.flags ?? "").includes("X") || r.disabled === "true"
   }));
 }
+async function collectPppProfilesMissingMssClamp(ctx) {
+  const raw = await safe("/ppp profile print detail", ctx);
+  if (!raw || isEmpty(raw))
+    return [];
+  return parseRecords(raw).rows.filter((r) => !isYes(r["change-tcp-mss"])).map((r) => r.name ?? "").filter(Boolean);
+}
 async function collectDiagnosticData(target, ctx, dimensions) {
   const dims = new Set(dimensions ?? ALL_DIMENSIONS);
   const [
@@ -28698,7 +28862,10 @@ async function collectDiagnosticData(target, ctx, dimensions) {
     dnsSettingsParts,
     resourceRaw,
     logs,
-    tunnels
+    tunnels,
+    mangleRules,
+    wireguardPeers,
+    pppProfilesMissingMssClamp
   ] = await Promise.all([
     dims.has("connectivity") ? safe(`/ping ${quoteValue(target)} count=5`, ctx) : Promise.resolve(""),
     dims.has("interfaces") ? collectInterfaces(ctx) : Promise.resolve([]),
@@ -28718,7 +28885,10 @@ async function collectDiagnosticData(target, ctx, dimensions) {
     ]) : Promise.resolve(["", "", ""]),
     dims.has("resources") ? safe("/system resource print", ctx) : Promise.resolve(""),
     dims.has("logs") ? collectLogs(target, ctx) : Promise.resolve([]),
-    dims.has("vpn") ? collectTunnels(ctx) : Promise.resolve([])
+    dims.has("vpn") ? collectTunnels(ctx) : Promise.resolve([]),
+    dims.has("vpn") || dims.has("firewall") ? collectMangleRules(ctx) : Promise.resolve([]),
+    dims.has("vpn") ? collectWireguardPeers(ctx) : Promise.resolve([]),
+    dims.has("vpn") ? collectPppProfilesMissingMssClamp(ctx) : Promise.resolve([])
   ]);
   const ping = pingResult ? parsePingSummary(pingResult) ?? undefined : undefined;
   const [dnsServersRaw, dnsDynamicRaw, dnsAllowRemoteRaw] = dnsSettingsParts;
@@ -28750,7 +28920,10 @@ async function collectDiagnosticData(target, ctx, dimensions) {
     uptime: resKv.uptime ?? "",
     rosVersion: resKv.version ?? "",
     relevantLogs: logs,
-    tunnelInterfaces: tunnels
+    tunnelInterfaces: tunnels,
+    mangleRules,
+    wireguardPeers,
+    pppProfilesMissingMssClamp
   };
 }
 var dimensionEnum = z94.enum(ALL_DIMENSIONS).describe("Diagnostic dimension to investigate.");
@@ -28759,7 +28932,7 @@ var rootCauseTools = [
     name: "diagnose",
     title: "Intelligent Root-Cause Diagnosis",
     annotations: READ,
-    description: "Autonomously investigate a network problem across all diagnostic dimensions: " + "connectivity (ping), interface state & error counters, routing table & BGP/OSPF " + "neighbors, firewall rules & hit counters, NAT & connection tracking, ARP/DHCP " + "state, DNS resolution, CPU/memory pressure, system logs, and VPN tunnel state. " + "Correlates the evidence to deliver ranked root-cause hypotheses with confidence " + "levels, plain-language explanations, and exact RouterOS fix commands. " + "Pass an IP address, hostname, or symptom description as the target. " + "For hop-by-hop path analysis use `trace_path`; for log-specific investigation " + "use `correlate_events`; for fix commands only use `suggest_fix`.",
+    description: "Autonomously investigate a network problem across all diagnostic dimensions: " + "connectivity (ping), interface state & error counters, routing table & BGP/OSPF " + "neighbors, firewall rules & hit counters, NAT & connection tracking, ARP/DHCP " + "state, DNS resolution, CPU/memory pressure, system logs, and VPN tunnel state \u2014 " + "including the tunnel MTU / TCP-MSS-clamp / WireGuard-keepalive checks that catch a " + "PMTU black hole (tunnel pings fine but large transfers, uploads and some HTTPS hang). " + "Correlates the evidence to deliver ranked root-cause hypotheses with confidence " + "levels, plain-language explanations, and exact RouterOS fix commands. " + "Pass an IP address, hostname, or symptom description as the target. " + "For hop-by-hop path analysis use `trace_path`; for log-specific investigation " + "use `correlate_events`; for fix commands only use `suggest_fix`.",
     inputSchema: {
       target: z94.string().describe("The target to investigate \u2014 an IP address (e.g. '8.8.8.8'), hostname " + "(e.g. 'google.com'), or network/subnet (e.g. '10.0.0.0/24')."),
       dimensions: z94.array(dimensionEnum).optional().describe(`Limit investigation to specific dimensions. ` + `Omit to check all: ${ALL_DIMENSIONS.join(", ")}`),
@@ -34334,7 +34507,7 @@ var riskByTool = null;
 async function riskIndex() {
   if (riskByTool)
     return riskByTool;
-  const { moduleCatalog } = await import("./library-xgy70fsf.js");
+  const { moduleCatalog } = await import("./library-4a4mfnxf.js");
   const index = new Map;
   for (const mod of moduleCatalog) {
     for (const tool of mod.tools)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usex/mikrotik-mcp",
-  "version": "5.2.0",
+  "version": "5.3.0",
   "description": "MCP server for MikroTik RouterOS — 780+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   "keywords": [
     "ai",
@@ -74,6 +74,7 @@
     "prepublish:security": "npm run security:all",
     "test": "vp test run",
     "test:watch": "vp test",
+    "test:coverage": "vp test --ui --coverage --watch",
     "release": "release-it",
     "test:types": "tsc --noEmit",
     "check": "vp check",
@@ -104,6 +105,8 @@
     "@types/react-dom": "^19.2.4",
     "@types/ssh2": "^1.15.5",
     "@types/update-notifier": "^6.0.8",
+    "@vitest/coverage-v8": "4.1.10",
+    "@vitest/ui": "4.1.10",
     "bunup": "^0.16.32",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",

package/prompts/setup-ipsec-site-to-site.md

@@ -47,8 +47,20 @@ identical on both ends):
    accepted from {{peer_address}} on the input chain, and add a NAT _bypass_
    (accept/no-nat) rule so {{local_subnet}}→{{remote_subnet}} traffic is NOT
    masqueraded. Apply firewall edits under `enable_safe_mode`.
-7. **Verify** — `get_ipsec_active_peers` and `get_ipsec_installed_sa` to confirm
-   the tunnel established; `ping` a remote host with src-address in {{local_subnet}}.
+7. **MTU / MSS** — policy-mode IPsec has no interface whose MTU you can lower, so
+   MSS clamping is the _only_ lever, and skipping it is the classic "tunnel is up
+   but large transfers hang" failure. ESP tunnel mode costs ~73 bytes (more with
+   NAT-T/UDP-4500). Add `create_mangle_rule`: `chain=forward`, `protocol=tcp`,
+   `tcp_flags=syn`, `tcp_mss=1400-65535`, `action=change-mss`,
+   `new_mss=clamp-to-pmtu` — or a fixed `new_mss=1360` when the path MTU is known
+   and PMTU discovery is unreliable. Endpoints size their MSS from their own LAN
+   MTU and set DF; without the clamp those packets are dropped in transit and the
+   ICMP "fragmentation needed" is usually filtered, so the sender never learns.
+8. **Verify** — `get_ipsec_active_peers` and `get_ipsec_installed_sa` to confirm
+   the tunnel established; `ping` a remote host with src-address in
+   {{local_subnet}}. Then repeat with size 1400 and `do-not-fragment` — small
+   pings passing while large ones fail means the MSS clamp in step 7 is missing or
+   not matching.
 
 Present the matching parameter set for the remote engineer and the exact tool
 calls before applying. Never echo the pre-shared key back in plaintext beyond

package/prompts/setup-l2tp-ipsec-roadwarrior.md

@@ -33,7 +33,19 @@ Build order:
 4. **Enable the server** — `set_l2tp_server` with `enabled=true`,
    `default_profile=l2tp-profile`, `use_ipsec=required`, and a strong
    `ipsec_secret` (this is the IPsec pre-shared key clients enter).
-   `authentication=mschap2`.
+   `authentication=mschap2`. Also set on the same call:
+   - `max_mtu`/`max_mru` = **1400** (L2TP + IPsec ESP overhead easily exceeds
+     100 bytes; leaving 1450 causes the "connects fine, transfers stall" symptom),
+   - `keepalive_timeout` = **30** — dead client sessions otherwise linger and hold
+     their pool address until the default timeout expires.
+
+   The `change_tcp_mss=yes` set on the profile in step 2 makes MSS follow the
+   negotiated MTU automatically — that is the PPP-family equivalent of a
+   `change-mss` mangle rule, and it is why L2TP does not need one. If clients
+   still stall on large transfers, add the mangle rule anyway
+   (`create_mangle_rule`: `chain=forward`, `protocol=tcp`, `tcp_flags=syn`,
+   `tcp_mss=1400-65535`, `action=change-mss`, `new_mss=clamp-to-pmtu`).
+
 5. **Firewall** — accept UDP 500, UDP 4500, UDP 1701, and IP protocol 50 (ESP)
    on the input chain from the internet; allow the {{vpn_pool}} range to reach the
    LAN/internet in the forward chain as required. Apply under `enable_safe_mode`,

package/prompts/setup-wireguard-tunnel-between-sites.md

@@ -123,11 +123,14 @@ Per side, under Safe Mode (`enable_safe_mode` `device=<name>` → edits → veri
 WireGuard adds ~60 bytes of overhead. Small pings work but large flows (TLS, file
 transfer) stall if MTU is wrong:
 
-- Set the wg interface MTU to **1420** (1412 if the WAN is PPPoE) via
+- Set the wg interface MTU to **1420** (1412 if the WAN is PPPoE, 1280 if the path
+  is unknown/multi-hop — 1280 is the always-safe floor) via
   `update_wireguard_interface`.
-- Clamp TCP MSS on the `forward` chain (`create_filter_rule` mangle
-  `action=change-mss new-mss=clamp-to-pmtu tcp-flags=syn`) or set it per the
-  interface MTU, so TCP sessions negotiate a size that fits.
+- Clamp TCP MSS with `create_mangle_rule` (**not** `create_filter_rule` — only the
+  mangle table has `change-mss`): `chain=forward`, `protocol=tcp`,
+  `tcp_flags=syn`, `tcp_mss=1400-65535`, `action=change-mss`,
+  `new_mss=clamp-to-pmtu`. WireGuard has no per-interface MSS option, so this
+  mangle rule is the only place to fix MSS.
 
 ## 8. Verify end to end
 

package/prompts/setup-wireguard-vpn.md

@@ -42,5 +42,26 @@ Steps:
 5. **Client config** — call `generate_wireguard_client_config` with the server
    public key, {{endpoint}}, the listen port, and the assigned client address, and
    present the resulting `[Interface]/[Peer]` config for the user to import.
+6. **Keepalive** — set `persistent_keepalive` to `25` on every peer
+   (`add_wireguard_peer`/`update_wireguard_peer`) and `client_keepalive=25s` in the
+   generated client config. Roaming clients sit behind NAT; a UDP mapping typically
+   expires after ~30 s of silence, after which the server cannot reach the client
+   until the client speaks first. 25 s keeps the mapping alive.
+7. **MTU / MSS** — the step most WireGuard deployments skip, and the reason a VPN
+   "works" for logins but stalls on file transfers, photo/video uploads and some
+   web pages:
+   - WireGuard adds ~60 bytes. Set the interface MTU to **1420**
+     (`update_wireguard_interface`); use **1412** on a PPPoE WAN, or **1280** when
+     the path is unknown — 1280 always fits.
+   - MTU alone is not enough. Endpoints derive their TCP MSS from _their own_ NIC
+     MTU, so a 1460-byte-MSS session still emits oversized packets with DF set;
+     mid-path routers drop rather than fragment and the ICMP "fragmentation needed"
+     is often filtered — a PMTU black hole. Clamp it with `create_mangle_rule`:
+     `chain=forward`, `protocol=tcp`, `tcp_flags=syn`, `tcp_mss=1400-65535`,
+     `action=change-mss`, `new_mss=clamp-to-pmtu`. WireGuard has no per-interface
+     MSS setting, so mangle is the only place this can be fixed.
+   - Verify: `ping` a host across the tunnel with size 1400 and `do-not-fragment`.
+     Small pings succeeding while this fails is the black-hole signature.
 
-Report the server public key, the peer you added, and the full client config.
+Report the server public key, the peer you added, the MTU/MSS/keepalive values
+applied, and the full client config.

package/schemas/tool-catalog.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "version": "5.2.0",
+  "version": "5.3.0",
   "generated": "by scripts/gen-schemas.ts — do not edit by hand",
   "toolCount": 885,
   "tools": [
@@ -24868,7 +24868,7 @@
         "idempotentHint": true,
         "openWorldHint": false
       },
-      "description": "Autonomously investigate a network problem across all diagnostic dimensions: connectivity (ping), interface state & error counters, routing table & BGP/OSPF neighbors, firewall rules & hit counters, NAT & connection tracking, ARP/DHCP state, DNS resolution, CPU/memory pressure, system logs, and VPN tunnel state. Correlates the evidence to deliver ranked root-cause hypotheses with confidence levels, plain-language explanations, and exact RouterOS fix commands. Pass an IP address, hostname, or symptom description as the target. For hop-by-hop path analysis use `trace_path`; for log-specific investigation use `correlate_events`; for fix commands only use `suggest_fix`.",
+      "description": "Autonomously investigate a network problem across all diagnostic dimensions: connectivity (ping), interface state & error counters, routing table & BGP/OSPF neighbors, firewall rules & hit counters, NAT & connection tracking, ARP/DHCP state, DNS resolution, CPU/memory pressure, system logs, and VPN tunnel state — including the tunnel MTU / TCP-MSS-clamp / WireGuard-keepalive checks that catch a PMTU black hole (tunnel pings fine but large transfers, uploads and some HTTPS hang). Correlates the evidence to deliver ranked root-cause hypotheses with confidence levels, plain-language explanations, and exact RouterOS fix commands. Pass an IP address, hostname, or symptom description as the target. For hop-by-hop path analysis use `trace_path`; for log-specific investigation use `correlate_events`; for fix commands only use `suggest_fix`.",
       "inputSchema": {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "type": "object",