@usex/mikrotik-mcp 5.5.0 → 5.7.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (37) hide show
  1. package/README.md +39 -20
  2. package/dist/cli.js +48117 -616
  3. package/dist/index.d.ts +10 -3
  4. package/dist/index.js +55 -55
  5. package/dist/shared/cli-569n3azr.js +13 -0
  6. package/dist/shared/library-3602qc6e.js +11 -0
  7. package/dist/shared/{cli-cvq8pxvn.js → library-v0tysa18.js} +24160 -23632
  8. package/dist/ui/aaa.html +39 -54
  9. package/dist/ui/connected-devices.html +39 -54
  10. package/dist/ui/dashboard.html +39 -54
  11. package/dist/ui/firewall-audit.html +39 -54
  12. package/dist/ui/firewall.html +40 -55
  13. package/dist/ui/interfaces.html +39 -54
  14. package/dist/ui/observability.html +62 -62
  15. package/dist/ui/records.html +40 -55
  16. package/package.json +19 -18
  17. package/schemas/README.md +1 -1
  18. package/schemas/config.schema.json +79 -0
  19. package/schemas/tool-catalog.json +523 -7
  20. package/schemas/tools/add_ospf_interface_template.json +9 -1
  21. package/schemas/tools/audit_service_contracts.json +7 -0
  22. package/schemas/tools/create_investigation.json +42 -0
  23. package/schemas/tools/create_service_contract.json +53 -0
  24. package/schemas/tools/get_investigation.json +14 -0
  25. package/schemas/tools/inspect_flow_path.json +50 -0
  26. package/schemas/tools/list_client_flow_candidates.json +14 -0
  27. package/schemas/tools/list_investigations.json +7 -0
  28. package/schemas/tools/list_service_contracts.json +7 -0
  29. package/schemas/tools/list_service_probe_targets.json +7 -0
  30. package/schemas/tools/run_service_contract.json +14 -0
  31. package/schemas/tools/service_contract_history.json +14 -0
  32. package/schemas/tools/start_rollout.json +21 -0
  33. package/schemas/tools/trace_round_trip.json +129 -0
  34. package/schemas/tools/update_wireguard_peer.json +4 -0
  35. package/dist/shared/cli-qqwjbjnv.js +0 -13
  36. package/dist/shared/library-241wsfpw.js +0 -13
  37. package/dist/shared/library-5p5mk963.js +0 -45394
package/README.md CHANGED
@@ -1,20 +1,20 @@
1
1
  <div align="center">
2
2
  <img src="assets/logo.svg" alt="@usex/mikrotik-mcp" width="440" />
3
- <p><strong>Drive one or more MikroTik routers in plain language — 885 risk-annotated tools your AI can call, over SSH.</strong><br/>
3
+ <p><strong>Drive one or more MikroTik routers in plain language — 901 risk-annotated tools your AI can call, over SSH.</strong><br/>
4
4
  Firewall · routing · DHCP/DNS · wireless · QoS · a complete VPN suite · transactional Safe Mode · live attack detection · and an observability dashboard that watches every call.</p>
5
5
 
6
6
  <p>
7
7
  <a href="LICENSE"><img alt="License: MIT" src="https://img.shields.io/badge/License-MIT-7C3AED.svg"></a>
8
8
  <img alt="Runtime: Bun" src="https://img.shields.io/badge/runtime-Bun%20%E2%89%A5%201.3-06B6D4.svg">
9
9
  <img alt="TypeScript" src="https://img.shields.io/badge/TypeScript-strict-6366F1.svg">
10
- <img alt="MCP" src="https://img.shields.io/badge/MCP-885%20tools-1F2937.svg">
10
+ <img alt="MCP" src="https://img.shields.io/badge/MCP-901%20tools-1F2937.svg">
11
11
  <a href="docs/"><img alt="Docs" src="https://img.shields.io/badge/docs-reference-7C3AED.svg"></a>
12
12
  </p>
13
13
  </div>
14
14
 
15
15
  ---
16
16
 
17
- `@usex/mikrotik-mcp` turns **MikroTik RouterOS** into **885 [Model Context Protocol](https://modelcontextprotocol.io)
17
+ `@usex/mikrotik-mcp` turns **MikroTik RouterOS** into **901 [Model Context Protocol](https://modelcontextprotocol.io)
18
18
  tools** any MCP client (Claude Desktop, Claude Code, Cursor, …) can call to read and
19
19
  configure your router by talking to it. It reaches the device over **plain SSH** — no
20
20
  agent, no package to install on RouterOS — runs on **[Bun](https://bun.sh)**, and
@@ -46,7 +46,26 @@ Then just ask:
46
46
 
47
47
  ## Highlights
48
48
 
49
- - 🧰 **885 tools, one per RouterOS scope** — L2 (bridge, VLAN, wireless, PoE),
49
+ - **Round-trip path lab** — model explicit forward/reverse static IPv4 paths across
50
+ fresh snapshots, with per-hop evidence and declared asymmetry. NAT or unsupported
51
+ state stops with UNKNOWN; modelled forwarding is not live connectivity.
52
+ A guided three-step editor selects routers, dated captures and interfaces without
53
+ writing JSON, with an optional mirrored return path and plain-language result labels.
54
+ [Guide](docs/round-trip-paths.md)
55
+ - **Service health contracts** — approved DNS/TCP/TLS/HTTPS endpoint checks from the
56
+ MCP host, optional fresh-export packet regressions, historical evidence, explicit
57
+ scheduled enrollment and fail-closed rollout gates. Disabled until targets are
58
+ approved. [Guide](docs/service-contracts.md)
59
+ - **Client/service investigations** — save multi-router DHCP/ARP/bridge and network
60
+ evidence with timestamps, explicit unknowns and next experiments. Router ICMP
61
+ success never masquerades as verified application health.
62
+ [Guide](docs/client-investigations.md) · [Delivery tracker](docs/enterprise-roadmap.md)
63
+ - **Exported client-flow paths** — select a recent TCP/UDP flow and visualize its
64
+ reported ingress/exit, with named VPN-interface lookup and colored JSON evidence.
65
+ Uses existing NetFlow/IPFIX exports; never enables capture or changes router settings.
66
+ Missing telemetry remains unknown, not a fabricated blocking hop.
67
+ [Flow-path guide](docs/client-flow-paths.md)
68
+ - 🧰 **901 tools, one per RouterOS scope** — L2 (bridge, VLAN, wireless, PoE),
50
69
  L3 (addressing, routing, DHCP, DNS), security (firewall, NAT, address-lists,
51
70
  certificates), QoS, and system ops (users, logs, backups, scheduler).
52
71
  - 🛡️ **Attack detection** — reads every device's log, correlates brute force,
@@ -348,24 +367,24 @@ Full reference: **[docs/observability.md](docs/observability.md)**.
348
367
 
349
368
  ## The tool catalog
350
369
 
351
- **885 tools across 137 modules.** Full, always-current reference (parameters + risk per
370
+ **901 tools across 143 modules.** Full, always-current reference (parameters + risk per
352
371
  tool) is generated from source: **[docs/tools-reference.md](docs/tools-reference.md)**.
353
372
 
354
- | Group | Tools | Modules |
355
- | ------------------------ | ----: | ----------------------------------------------------------------------------------------------------------------- |
356
- | **System & Ops** | 182 | system, network tools, scheduler/scripts, users, logs, backup, Safe Mode, transactions, rollout, scheduled audits |
357
- | **Security** | 125 | firewall filter, NAT, address-lists, certificates, IP services, hardening, policy-as-code, attack detection |
358
- | **VPN & Tunneling** | 108 | WireGuard, IPsec, PPP, L2TP, PPTP, SSTP, OpenVPN, GRE/IPIP/EoIP/VXLAN |
359
- | **Dynamic Routing** | 99 | router-id, tables, rules, next-hops, filters, BFD, BGP, OSPF, RIP, PIM-SM, IGMP proxy, GMP, RPKI |
360
- | **IPv6** | 90 | addressing, DHCPv6, ND, neighbours, pools, routes, firewall filter/NAT/mangle/raw |
361
- | **Tools** | 67 | ping, traceroute, bandwidth test, sniffer, traffic generator, RoMON, Wake-on-LAN, SMS |
362
- | **Addressing & Routing** | 62 | IP addresses, IP pools, routing, DHCP, DNS |
363
- | **Interfaces** | 56 | interfaces, VLAN, bridge, wireless, PoE |
364
- | **AAA** | 34 | RADIUS, User Manager, 802.1X |
365
- | **QoS** | 23 | queue types, queue trees, simple queues |
366
- | **Switch** | 18 | switch settings, ports, rules, port isolation |
367
- | **Discovery & Meta** | 9 | tool gateway (find/describe/invoke), server pulse, capability probe |
368
- | **Memory** | 9 | persistent knowledge graph |
373
+ | Group | Tools | Modules |
374
+ | ------------------------ | ----: | ------------------------------------------------------------------------------------------------------------------------------ |
375
+ | **System & Ops** | 194 | system, network tools, investigations, service contracts, round-trip paths, Safe Mode, transactions, rollout, scheduled audits |
376
+ | **Security** | 127 | firewall filter, NAT, address-lists, certificates, IP services, hardening, policy-as-code, attack detection |
377
+ | **VPN & Tunneling** | 108 | WireGuard, IPsec, PPP, L2TP, PPTP, SSTP, OpenVPN, GRE/IPIP/EoIP/VXLAN |
378
+ | **Dynamic Routing** | 99 | router-id, tables, rules, next-hops, filters, BFD, BGP, OSPF, RIP, PIM-SM, IGMP proxy, GMP, RPKI |
379
+ | **IPv6** | 90 | addressing, DHCPv6, ND, neighbours, pools, routes, firewall filter/NAT/mangle/raw |
380
+ | **Tools** | 67 | ping, traceroute, bandwidth test, sniffer, traffic generator, RoMON, Wake-on-LAN, SMS |
381
+ | **Addressing & Routing** | 62 | IP addresses, IP pools, routing, DHCP, DNS |
382
+ | **Interfaces** | 56 | interfaces, VLAN, bridge, wireless, PoE |
383
+ | **AAA** | 34 | RADIUS, User Manager, 802.1X |
384
+ | **QoS** | 23 | queue types, queue trees, simple queues |
385
+ | **Switch** | 18 | switch settings, ports, rules, port isolation |
386
+ | **Discovery & Meta** | 11 | tool gateway (find/describe/invoke), server pulse, capability probe |
387
+ | **Memory** | 9 | persistent knowledge graph |
369
388
 
370
389
  ## Beyond the catalog
371
390