@usex/mikrotik-mcp 5.2.0 → 5.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usex/mikrotik-mcp",
-  "version": "5.2.0",
+  "version": "5.4.0",
   "description": "MCP server for MikroTik RouterOS — 780+ tools over SSH for firewall, NAT, routing, DHCP, DNS, WireGuard, wireless, QoS and more.",
   "keywords": [
     "ai",
@@ -56,7 +56,7 @@
     "prepack": "bunup && chmod +x dist/cli.js && bun run build:ui && bun run gen",
     "auth-check": "bun run --bun src/cli.ts auth-check",
     "gen:schemas": "bun run --bun scripts/gen-schemas.ts && vp fmt --write schemas",
-    "gen:docs": "bun run --bun scripts/gen-tool-docs.ts",
+    "gen:docs": "bun run --bun scripts/gen-tool-docs.ts && vp fmt --write docs/tools-reference.md",
     "gen": "bun run --bun gen:schemas && bun run --bun gen:docs",
     "start": "bun run --bun src/cli.ts serve",
     "discover": "bun run --bun scripts/discover-macs.ts",
@@ -74,6 +74,7 @@
     "prepublish:security": "npm run security:all",
     "test": "vp test run",
     "test:watch": "vp test",
+    "test:coverage": "vp test --ui --coverage --watch",
     "release": "release-it",
     "test:types": "tsc --noEmit",
     "check": "vp check",
@@ -104,6 +105,8 @@
     "@types/react-dom": "^19.2.4",
     "@types/ssh2": "^1.15.5",
     "@types/update-notifier": "^6.0.8",
+    "@vitest/coverage-v8": "4.1.10",
+    "@vitest/ui": "4.1.10",
     "bunup": "^0.16.32",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",

package/prompts/setup-ipsec-site-to-site.md

@@ -47,8 +47,20 @@ identical on both ends):
    accepted from {{peer_address}} on the input chain, and add a NAT _bypass_
    (accept/no-nat) rule so {{local_subnet}}→{{remote_subnet}} traffic is NOT
    masqueraded. Apply firewall edits under `enable_safe_mode`.
-7. **Verify** — `get_ipsec_active_peers` and `get_ipsec_installed_sa` to confirm
-   the tunnel established; `ping` a remote host with src-address in {{local_subnet}}.
+7. **MTU / MSS** — policy-mode IPsec has no interface whose MTU you can lower, so
+   MSS clamping is the _only_ lever, and skipping it is the classic "tunnel is up
+   but large transfers hang" failure. ESP tunnel mode costs ~73 bytes (more with
+   NAT-T/UDP-4500). Add `create_mangle_rule`: `chain=forward`, `protocol=tcp`,
+   `tcp_flags=syn`, `tcp_mss=1400-65535`, `action=change-mss`,
+   `new_mss=clamp-to-pmtu` — or a fixed `new_mss=1360` when the path MTU is known
+   and PMTU discovery is unreliable. Endpoints size their MSS from their own LAN
+   MTU and set DF; without the clamp those packets are dropped in transit and the
+   ICMP "fragmentation needed" is usually filtered, so the sender never learns.
+8. **Verify** — `get_ipsec_active_peers` and `get_ipsec_installed_sa` to confirm
+   the tunnel established; `ping` a remote host with src-address in
+   {{local_subnet}}. Then repeat with size 1400 and `do-not-fragment` — small
+   pings passing while large ones fail means the MSS clamp in step 7 is missing or
+   not matching.
 
 Present the matching parameter set for the remote engineer and the exact tool
 calls before applying. Never echo the pre-shared key back in plaintext beyond

package/prompts/setup-l2tp-ipsec-roadwarrior.md

@@ -33,7 +33,19 @@ Build order:
 4. **Enable the server** — `set_l2tp_server` with `enabled=true`,
    `default_profile=l2tp-profile`, `use_ipsec=required`, and a strong
    `ipsec_secret` (this is the IPsec pre-shared key clients enter).
-   `authentication=mschap2`.
+   `authentication=mschap2`. Also set on the same call:
+   - `max_mtu`/`max_mru` = **1400** (L2TP + IPsec ESP overhead easily exceeds
+     100 bytes; leaving 1450 causes the "connects fine, transfers stall" symptom),
+   - `keepalive_timeout` = **30** — dead client sessions otherwise linger and hold
+     their pool address until the default timeout expires.
+
+   The `change_tcp_mss=yes` set on the profile in step 2 makes MSS follow the
+   negotiated MTU automatically — that is the PPP-family equivalent of a
+   `change-mss` mangle rule, and it is why L2TP does not need one. If clients
+   still stall on large transfers, add the mangle rule anyway
+   (`create_mangle_rule`: `chain=forward`, `protocol=tcp`, `tcp_flags=syn`,
+   `tcp_mss=1400-65535`, `action=change-mss`, `new_mss=clamp-to-pmtu`).
+
 5. **Firewall** — accept UDP 500, UDP 4500, UDP 1701, and IP protocol 50 (ESP)
    on the input chain from the internet; allow the {{vpn_pool}} range to reach the
    LAN/internet in the forward chain as required. Apply under `enable_safe_mode`,

package/prompts/setup-wireguard-tunnel-between-sites.md

@@ -123,11 +123,14 @@ Per side, under Safe Mode (`enable_safe_mode` `device=<name>` → edits → veri
 WireGuard adds ~60 bytes of overhead. Small pings work but large flows (TLS, file
 transfer) stall if MTU is wrong:
 
-- Set the wg interface MTU to **1420** (1412 if the WAN is PPPoE) via
+- Set the wg interface MTU to **1420** (1412 if the WAN is PPPoE, 1280 if the path
+  is unknown/multi-hop — 1280 is the always-safe floor) via
   `update_wireguard_interface`.
-- Clamp TCP MSS on the `forward` chain (`create_filter_rule` mangle
-  `action=change-mss new-mss=clamp-to-pmtu tcp-flags=syn`) or set it per the
-  interface MTU, so TCP sessions negotiate a size that fits.
+- Clamp TCP MSS with `create_mangle_rule` (**not** `create_filter_rule` — only the
+  mangle table has `change-mss`): `chain=forward`, `protocol=tcp`,
+  `tcp_flags=syn`, `tcp_mss=1400-65535`, `action=change-mss`,
+  `new_mss=clamp-to-pmtu`. WireGuard has no per-interface MSS option, so this
+  mangle rule is the only place to fix MSS.
 
 ## 8. Verify end to end
 

package/prompts/setup-wireguard-vpn.md

@@ -42,5 +42,26 @@ Steps:
 5. **Client config** — call `generate_wireguard_client_config` with the server
    public key, {{endpoint}}, the listen port, and the assigned client address, and
    present the resulting `[Interface]/[Peer]` config for the user to import.
+6. **Keepalive** — set `persistent_keepalive` to `25` on every peer
+   (`add_wireguard_peer`/`update_wireguard_peer`) and `client_keepalive=25s` in the
+   generated client config. Roaming clients sit behind NAT; a UDP mapping typically
+   expires after ~30 s of silence, after which the server cannot reach the client
+   until the client speaks first. 25 s keeps the mapping alive.
+7. **MTU / MSS** — the step most WireGuard deployments skip, and the reason a VPN
+   "works" for logins but stalls on file transfers, photo/video uploads and some
+   web pages:
+   - WireGuard adds ~60 bytes. Set the interface MTU to **1420**
+     (`update_wireguard_interface`); use **1412** on a PPPoE WAN, or **1280** when
+     the path is unknown — 1280 always fits.
+   - MTU alone is not enough. Endpoints derive their TCP MSS from _their own_ NIC
+     MTU, so a 1460-byte-MSS session still emits oversized packets with DF set;
+     mid-path routers drop rather than fragment and the ICMP "fragmentation needed"
+     is often filtered — a PMTU black hole. Clamp it with `create_mangle_rule`:
+     `chain=forward`, `protocol=tcp`, `tcp_flags=syn`, `tcp_mss=1400-65535`,
+     `action=change-mss`, `new_mss=clamp-to-pmtu`. WireGuard has no per-interface
+     MSS setting, so mangle is the only place this can be fixed.
+   - Verify: `ping` a host across the tunnel with size 1400 and `do-not-fragment`.
+     Small pings succeeding while this fails is the black-hole signature.
 
-Report the server public key, the peer you added, and the full client config.
+Report the server public key, the peer you added, the MTU/MSS/keepalive values
+applied, and the full client config.

package/schemas/README.md

@@ -7,7 +7,7 @@ edit by hand — regenerate instead.
 | File                 | Contents                                                                                   |
 | -------------------- | ------------------------------------------------------------------------------------------ |
 | `config.schema.json` | The runtime configuration object (env vars / CLI flags).                                   |
-| `tool-catalog.json`  | Every one of the 885 tools: `name`, `risk`, `title`, `description`, and input JSON Schema. |
+| `tool-catalog.json`  | Every one of the 891 tools: `name`, `risk`, `title`, `description`, and input JSON Schema. |
 | `tools/<name>.json`  | The input JSON Schema for a single tool.                                                   |
 
 `risk` is derived from the MCP tool annotations:

package/schemas/config.schema.json

@@ -686,6 +686,59 @@
       "default": false,
       "type": "boolean"
     },
+    "access": {
+      "default": {
+        "enabled": false,
+        "devices": [],
+        "denyDevices": [],
+        "tools": [],
+        "denyTools": []
+      },
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "default": false,
+          "type": "boolean"
+        },
+        "maxRisk": {
+          "type": "string",
+          "enum": ["READ", "WRITE", "WRITE_IDEMPOTENT", "DESTRUCTIVE", "DANGEROUS"]
+        },
+        "devices": {
+          "default": [],
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "denyDevices": {
+          "default": [],
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "tools": {
+          "default": [],
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "denyTools": {
+          "default": [],
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "label": {
+          "type": "string"
+        }
+      },
+      "required": ["enabled", "devices", "denyDevices", "tools", "denyTools"],
+      "additionalProperties": false
+    },
     "tools": {
       "default": {
         "enabledModules": [],
@@ -765,6 +818,7 @@
     "attacks",
     "ssh",
     "readOnly",
+    "access",
     "tools",
     "memory",
     "disableUpdateCheck"

package/schemas/tool-catalog.json

@@ -1,8 +1,8 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "version": "5.2.0",
+  "version": "5.4.0",
   "generated": "by scripts/gen-schemas.ts — do not edit by hand",
-  "toolCount": 885,
+  "toolCount": 891,
   "tools": [
     {
       "name": "find_tools",
@@ -24868,7 +24868,7 @@
         "idempotentHint": true,
         "openWorldHint": false
       },
-      "description": "Autonomously investigate a network problem across all diagnostic dimensions: connectivity (ping), interface state & error counters, routing table & BGP/OSPF neighbors, firewall rules & hit counters, NAT & connection tracking, ARP/DHCP state, DNS resolution, CPU/memory pressure, system logs, and VPN tunnel state. Correlates the evidence to deliver ranked root-cause hypotheses with confidence levels, plain-language explanations, and exact RouterOS fix commands. Pass an IP address, hostname, or symptom description as the target. For hop-by-hop path analysis use `trace_path`; for log-specific investigation use `correlate_events`; for fix commands only use `suggest_fix`.",
+      "description": "Autonomously investigate a network problem across all diagnostic dimensions: connectivity (ping), interface state & error counters, routing table & BGP/OSPF neighbors, firewall rules & hit counters, NAT & connection tracking, ARP/DHCP state, DNS resolution, CPU/memory pressure, system logs, and VPN tunnel state — including the tunnel MTU / TCP-MSS-clamp / WireGuard-keepalive checks that catch a PMTU black hole (tunnel pings fine but large transfers, uploads and some HTTPS hang). Correlates the evidence to deliver ranked root-cause hypotheses with confidence levels, plain-language explanations, and exact RouterOS fix commands. Pass an IP address, hostname, or symptom description as the target. For hop-by-hop path analysis use `trace_path`; for log-specific investigation use `correlate_events`; for fix commands only use `suggest_fix`.",
       "inputSchema": {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "type": "object",
@@ -25223,6 +25223,198 @@
         "additionalProperties": false
       }
     },
+    {
+      "name": "map_l2_fabric",
+      "title": "Map Hosts to Physical Switch Ports",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Builds a PORT-LEVEL Layer-2 map: which hosts are behind each bridge port, joined from the bridge host table (`/interface bridge host`), ARP, DHCP leases and the neighbour cache so every MAC gets a real name — hostname, RouterOS identity, IP or hardware vendor. Also classifies each port as access (one host), uplink (many hosts, or a discovered network device behind it) or hybrid. Use this to answer 'what is plugged into ether5', to find unexpected devices on the fabric, or to spot an unmanaged switch someone added. This is different from list_neighbors, which only sees MNDP/CDP/LLDP speakers — the bridge host table sees EVERY host that has passed a frame, including printers, IoT and laptops. Read-only.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "interface_filter": {
+            "description": "Only show ports whose name contains this substring.",
+            "type": "string"
+          },
+          "role": {
+            "description": "Only show ports classified with this role.",
+            "type": "string",
+            "enum": ["access", "uplink", "hybrid"]
+          },
+          "summary_only": {
+            "description": "Show per-port counts without listing individual hosts.",
+            "type": "boolean"
+          }
+        },
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "locate_host_port",
+      "title": "Find Which Port a Host Is Plugged Into",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Locates a specific host on the Layer-2 fabric and reports the exact bridge port it is reachable through. Accepts a MAC address (any separator style), an IP address, or a hostname/identity substring. This is the 'my printer is 192.168.1.40, which switch port is it on?' lookup — it resolves the IP to a MAC via ARP/DHCP and then to a port via the bridge host table. Returns every match, since a MAC can legitimately appear behind an uplink as well as on its access port. Read-only.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "query": {
+            "type": "string",
+            "description": "MAC address, IP address, or hostname/identity substring to locate."
+          }
+        },
+        "required": ["query"],
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "audit_known_vulnerabilities",
+      "title": "Audit Device Against Known RouterOS Advisories",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Cross-references the RouterOS version this device runs against published security advisories (CVEs), then RANKS each match by whether the affected surface is actually reachable — reading `/ip service` to see if the vulnerable service is enabled and whether it is restricted to a management subnet. This is the difference between 'you are behind on patches' and 'this specific hole is open to the internet right now'. Returns each matching advisory with its severity, CVSS, effective risk score, exposure, the exact version that fixes it, and the remediation steps. Read-only — reads `/system resource`, `/ip service` and `/system package`, changes nothing. Use `firmware_check` for 'is there a newer release'; use this for 'does it matter'. Set `all_devices` to audit the whole fleet at once.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "all_devices": {
+            "description": "Audit every configured device instead of just the target device.",
+            "type": "boolean"
+          },
+          "min_severity": {
+            "description": "Only report findings at or above this severity.",
+            "type": "string",
+            "enum": ["critical", "high", "medium", "low"]
+          },
+          "include_mitigated": {
+            "description": "Include advisories whose affected service is disabled (default false — these are matches on version alone and are not currently reachable).",
+            "type": "boolean"
+          }
+        },
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "list_security_advisories",
+      "title": "List the Bundled RouterOS Advisory Dataset",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Lists the RouterOS security advisories this server checks against, with their affected version ranges, severity, CVSS, exposure conditions and remediation. Contacts NO device — it is the reference dataset itself, useful for answering 'what does the audit actually cover?' and for checking whether a specific CVE is in scope before trusting a clean audit result. Use audit_known_vulnerabilities to evaluate these against a real device.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "id_filter": {
+            "description": "Match an advisory id (substring, e.g. `2023`).",
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "get_access_scope",
+      "title": "Show the Active Access Scope",
+      "risk": "read",
+      "annotations": {
+        "readOnlyHint": true,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Reports the access scope currently enforced on this session: the maximum risk tier that may be invoked, which devices may be targeted, which tool-name globs are allowed or denied, and when the scope expires. Also lists recent DENIED calls with the rule that blocked each one. Call this after an 'Access denied' result to see exactly what the boundary is instead of guessing, and before attempting a batch of writes to confirm they are permitted. Contacts no device.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "denials": {
+            "description": "How many recent denials to include (default 10, 0 to omit).",
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 200
+          }
+        },
+        "additionalProperties": false
+      }
+    },
+    {
+      "name": "narrow_access_scope",
+      "title": "Narrow This Session's Access Scope",
+      "risk": "write-idempotent",
+      "annotations": {
+        "destructiveHint": false,
+        "idempotentHint": true,
+        "openWorldHint": false
+      },
+      "description": "Voluntarily restricts what THIS session may do for the rest of its life — lower the risk ceiling, limit which devices may be targeted, restrict tool names, or set an expiry. Useful before handing control to an unattended loop, or to self-limit to read-only while investigating a production issue. This operation is STRICTLY ONE-WAY: every field can only make the scope narrower, and there is no tool that widens it again — only the operator's server configuration sets the ceiling, and restarting the session is the only way back. Values that would widen the scope are silently clamped to the current one. Contacts no device.",
+      "inputSchema": {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "type": "object",
+        "properties": {
+          "max_risk": {
+            "description": "Highest risk tier to allow from now on. Ignored if it is higher than the current ceiling. READ is the most restrictive.",
+            "type": "string",
+            "enum": ["READ", "WRITE", "WRITE_IDEMPOTENT", "DESTRUCTIVE", "DANGEROUS"]
+          },
+          "devices": {
+            "description": "Restrict to these device keys (intersected with any current restriction).",
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "deny_devices": {
+            "description": "Device keys to forbid outright (added to any existing denials).",
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "tools": {
+            "description": "Tool-name globs to permit, e.g. ['list_*','get_*','diagnose'].",
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "deny_tools": {
+            "description": "Tool-name globs to forbid (added to any existing denials).",
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "expires_in_minutes": {
+            "description": "Expire the scope after this many minutes (max 7 days).",
+            "type": "integer",
+            "exclusiveMinimum": 0,
+            "maximum": 10080
+          },
+          "label": {
+            "description": "A note recorded with the scope, shown in denials.",
+            "type": "string"
+          }
+        },
+        "additionalProperties": false
+      }
+    },
     {
       "name": "get_bandwidth_server",
       "title": "Get Bandwidth Test Server Settings",

package/schemas/tools/audit_known_vulnerabilities.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "audit_known_vulnerabilities",
+  "type": "object",
+  "properties": {
+    "all_devices": {
+      "description": "Audit every configured device instead of just the target device.",
+      "type": "boolean"
+    },
+    "min_severity": {
+      "description": "Only report findings at or above this severity.",
+      "type": "string",
+      "enum": ["critical", "high", "medium", "low"]
+    },
+    "include_mitigated": {
+      "description": "Include advisories whose affected service is disabled (default false — these are matches on version alone and are not currently reachable).",
+      "type": "boolean"
+    }
+  },
+  "additionalProperties": false
+}

package/schemas/tools/get_access_scope.json

@@ -0,0 +1,14 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "get_access_scope",
+  "type": "object",
+  "properties": {
+    "denials": {
+      "description": "How many recent denials to include (default 10, 0 to omit).",
+      "type": "integer",
+      "minimum": 0,
+      "maximum": 200
+    }
+  },
+  "additionalProperties": false
+}

package/schemas/tools/list_security_advisories.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "list_security_advisories",
+  "type": "object",
+  "properties": {
+    "id_filter": {
+      "description": "Match an advisory id (substring, e.g. `2023`).",
+      "type": "string"
+    }
+  },
+  "additionalProperties": false
+}

package/schemas/tools/locate_host_port.json

@@ -0,0 +1,13 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "locate_host_port",
+  "type": "object",
+  "properties": {
+    "query": {
+      "type": "string",
+      "description": "MAC address, IP address, or hostname/identity substring to locate."
+    }
+  },
+  "required": ["query"],
+  "additionalProperties": false
+}

package/schemas/tools/map_l2_fabric.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "map_l2_fabric",
+  "type": "object",
+  "properties": {
+    "interface_filter": {
+      "description": "Only show ports whose name contains this substring.",
+      "type": "string"
+    },
+    "role": {
+      "description": "Only show ports classified with this role.",
+      "type": "string",
+      "enum": ["access", "uplink", "hybrid"]
+    },
+    "summary_only": {
+      "description": "Show per-port counts without listing individual hosts.",
+      "type": "boolean"
+    }
+  },
+  "additionalProperties": false
+}

package/schemas/tools/narrow_access_scope.json

@@ -0,0 +1,51 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "narrow_access_scope",
+  "type": "object",
+  "properties": {
+    "max_risk": {
+      "description": "Highest risk tier to allow from now on. Ignored if it is higher than the current ceiling. READ is the most restrictive.",
+      "type": "string",
+      "enum": ["READ", "WRITE", "WRITE_IDEMPOTENT", "DESTRUCTIVE", "DANGEROUS"]
+    },
+    "devices": {
+      "description": "Restrict to these device keys (intersected with any current restriction).",
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "deny_devices": {
+      "description": "Device keys to forbid outright (added to any existing denials).",
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "tools": {
+      "description": "Tool-name globs to permit, e.g. ['list_*','get_*','diagnose'].",
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "deny_tools": {
+      "description": "Tool-name globs to forbid (added to any existing denials).",
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "expires_in_minutes": {
+      "description": "Expire the scope after this many minutes (max 7 days).",
+      "type": "integer",
+      "exclusiveMinimum": 0,
+      "maximum": 10080
+    },
+    "label": {
+      "description": "A note recorded with the scope, shown in denials.",
+      "type": "string"
+    }
+  },
+  "additionalProperties": false
+}