mikromcp 1.10.0 → 1.11.0

package/README.md

@@ -12,7 +12,7 @@
 
 [![CI](https://github.com/AliKarami/MikroMCP/actions/workflows/ci.yml/badge.svg)](https://github.com/AliKarami/MikroMCP/actions/workflows/ci.yml)
 [![Release](https://github.com/AliKarami/MikroMCP/actions/workflows/release.yml/badge.svg)](https://github.com/AliKarami/MikroMCP/actions/workflows/release.yml)
-[![Version](https://img.shields.io/badge/version-v1.10.0-2DD4BF)](package.json)
+[![Version](https://img.shields.io/badge/version-v1.11.0-2DD4BF)](package.json)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Node.js >= 22](https://img.shields.io/badge/node-%3E%3D22-339933)](package.json)
 [![RouterOS 7.x](https://img.shields.io/badge/RouterOS-7.x-293239)](https://help.mikrotik.com/docs/display/ROS/REST+API)

package/config/routers.example.yaml

@@ -61,6 +61,8 @@ routers:
     tags: ["datacenter", "core"]
     rosVersion: "7.14"
     # sshPort: 22                  # SSH port (default 22)
+    # sshUsername: "automation"    # Optional SSH/SFTP username; defaults to REST username
+    # sshPrivateKeyPath: "/home/user/.ssh/id_ed25519" # Absolute path; suppresses SSH/SFTP password auth
     # sshFingerprint: "aabbcc..."  # Pin SSH host key SHA256 fingerprint (hex)
     # cmdAllow:                    # Strict allow-list for run_command (see above)
     #   - "/ip/route/print*"

package/dist/main.js

@@ -1705,13 +1705,51 @@ var firewallTools = [listFirewallRulesTool, manageFirewallRuleTool];
 
 // src/domain/tools/diagnostic-tools.ts
 import { z as z9 } from "zod";
+
+// src/adapter/routeros-command.ts
+var ROUTEROS_COMMAND = /^\/[a-z][a-z0-9-]*(?: [a-z][a-z0-9-]*)+$/;
+var ROUTEROS_PARAMETER = /^[a-z][a-z0-9-]*$/;
+var CONTROL_CHARACTER = /[\u0000-\u001f\u007f]/;
+function isRouterOsCommandString(value) {
+  return !CONTROL_CHARACTER.test(value);
+}
+function quoteRouterOsString(value) {
+  if (!isRouterOsCommandString(value)) {
+    throw new Error("RouterOS command values must not contain control characters");
+  }
+  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\$/g, "\\$");
+  return `"${escaped}"`;
+}
+function buildRouterOsCommand(command, parameters) {
+  if (!ROUTEROS_COMMAND.test(command)) {
+    throw new Error("Invalid RouterOS command");
+  }
+  const parts = [command];
+  for (const [name, value] of Object.entries(parameters)) {
+    if (!ROUTEROS_PARAMETER.test(name)) {
+      throw new Error("Invalid RouterOS parameter");
+    }
+    if (typeof value === "number") {
+      if (!Number.isSafeInteger(value)) {
+        throw new Error("RouterOS numeric command values must be safe integers");
+      }
+      parts.push(`${name}=${value}`);
+    } else {
+      parts.push(`${name}=${quoteRouterOsString(value)}`);
+    }
+  }
+  return parts.join(" ");
+}
+
+// src/domain/tools/diagnostic-tools.ts
 var log7 = createLogger("diagnostic-tools");
+var routerOsCommandString = z9.string().refine(isRouterOsCommandString, "Must not contain control characters");
 var pingInputSchema = z9.object({
   routerId,
-  address: z9.string().describe("Target IP address or hostname to ping"),
+  address: routerOsCommandString.describe("Target IP address or hostname to ping"),
   count: z9.number().int().min(1).max(20).default(4).describe("Number of ICMP echo requests (1\u201320)"),
   size: z9.number().int().min(14).max(65535).default(56).describe("Packet size in bytes (14\u201365535)"),
-  routingTable: z9.string().optional().describe("Routing table to use for the ping")
+  routingTable: routerOsCommandString.optional().describe("Routing table to use for the ping")
 }).strict();
 var pingTool = {
   name: "ping",
@@ -1728,13 +1766,15 @@ var pingTool = {
     const parsed = pingInputSchema.parse(params);
     log7.info({ routerId: context.routerId, address: parsed.address }, "Pinging");
     try {
-      const parts = [
-        `/tool ping address=${parsed.address}`,
-        `count=${parsed.count}`,
-        `size=${parsed.size}`
-      ];
-      if (parsed.routingTable !== void 0) parts.push(`routing-table=${parsed.routingTable}`);
-      const output = await context.sshClient.execute(parts.join(" "));
+      const parameters = {
+        address: parsed.address,
+        count: parsed.count,
+        size: parsed.size
+      };
+      if (parsed.routingTable !== void 0) parameters["routing-table"] = parsed.routingTable;
+      const output = await context.sshClient.execute(
+        buildRouterOsCommand("/tool ping", parameters)
+      );
       const s = output.match(/sent=(\d+)/)?.[1] ?? String(parsed.count);
       const r = output.match(/received=(\d+)/)?.[1] ?? "0";
       const loss = output.match(/packet-loss=(\S+)/)?.[1] ?? "100%";
@@ -1762,7 +1802,7 @@ var pingTool = {
 };
 var tracerouteInputSchema = z9.object({
   routerId,
-  address: z9.string().describe("Target IP address or hostname to trace"),
+  address: routerOsCommandString.describe("Target IP address or hostname to trace"),
   count: z9.number().int().min(1).max(5).default(3).describe("Probes per hop (1\u20135)"),
   maxHops: z9.number().int().min(1).max(30).default(15).describe("Maximum number of hops (1\u201330)")
 }).strict();
@@ -1781,12 +1821,13 @@ var tracerouteTool = {
     const parsed = tracerouteInputSchema.parse(params);
     log7.info({ routerId: context.routerId, address: parsed.address }, "Tracerouting");
     try {
-      const parts = [
-        `/tool traceroute address=${parsed.address}`,
-        `count=${parsed.count}`,
-        `max-hops=${parsed.maxHops}`
-      ];
-      const output = await context.sshClient.execute(parts.join(" "));
+      const output = await context.sshClient.execute(
+        buildRouterOsCommand("/tool traceroute", {
+          address: parsed.address,
+          count: parsed.count,
+          "max-hops": parsed.maxHops
+        })
+      );
       const hopLines = output.split("\n").filter((l) => /^\s*\d+\s+\S+/.test(l));
       const hops = hopLines.map((line) => {
         const cols = line.trim().split(/\s+/);
@@ -1817,10 +1858,10 @@ var tracerouteTool = {
 };
 var torchInputSchema = z9.object({
   routerId,
-  interface: z9.string().describe("Interface name to monitor (e.g. ether1, bridge1)"),
+  interface: routerOsCommandString.describe("Interface name to monitor (e.g. ether1, bridge1)"),
   duration: z9.number().int().min(1).max(30).default(5).describe("Capture duration in seconds (1\u201330)"),
-  srcAddress: z9.string().optional().describe("Filter by source IP address"),
-  dstAddress: z9.string().optional().describe("Filter by destination IP address")
+  srcAddress: routerOsCommandString.optional().describe("Filter by source IP address"),
+  dstAddress: routerOsCommandString.optional().describe("Filter by destination IP address")
 }).strict();
 function parseTorchOutput(output) {
   const flows = [];
@@ -1853,10 +1894,13 @@ var torchTool = {
     const parsed = torchInputSchema.parse(params);
     log7.info({ routerId: context.routerId, interface: parsed.interface }, "Running torch");
     try {
-      const parts = [`/tool torch interface=${parsed.interface}`];
-      if (parsed.srcAddress !== void 0) parts.push(`src-address=${parsed.srcAddress}`);
-      if (parsed.dstAddress !== void 0) parts.push(`dst-address=${parsed.dstAddress}`);
-      const raw = await context.sshClient.execute(parts.join(" "), (parsed.duration + 1) * 1e3);
+      const parameters = { interface: parsed.interface };
+      if (parsed.srcAddress !== void 0) parameters["src-address"] = parsed.srcAddress;
+      if (parsed.dstAddress !== void 0) parameters["dst-address"] = parsed.dstAddress;
+      const raw = await context.sshClient.execute(
+        buildRouterOsCommand("/tool torch", parameters),
+        (parsed.duration + 1) * 1e3
+      );
       const clean = raw.replace(/\x1b\[[0-9;]*[a-zA-Z]/g, "");
       const flows = parseTorchOutput(clean);
       const lines = [
@@ -5134,7 +5178,7 @@ var uploadFileInputSchema = z22.object({
   routerId,
   name: z22.string().describe("Target filename on the router (e.g. flash/my-script.rsc)"),
   content: z22.string().describe("File content to upload (text)"),
-  dryRun: z22.boolean().default(false).describe("Validate FTP connectivity without writing the file")
+  dryRun: z22.boolean().default(false).describe("Validate SFTP or FTP connectivity without writing the target file")
 }).strict();
 var uploadFileTool = {
   name: "upload_file",
@@ -13289,6 +13333,7 @@ function getCredentials(router) {
 
 // src/adapter/ssh-client.ts
 import { createHash as createHash2 } from "crypto";
+import { readFileSync as readFileSync3 } from "fs";
 import { Client } from "ssh2";
 var SshClient = class {
   constructor(config, credentials, options) {
@@ -13304,6 +13349,7 @@ var SshClient = class {
   async execute(command, overrideTimeoutMs) {
     const timeoutMs = overrideTimeoutMs ?? this.commandTimeoutMs;
     const maxOutputBytes = this.maxOutputBytes;
+    const privateKey = this.config.sshPrivateKeyPath ? readFileSync3(this.config.sshPrivateKeyPath) : void 0;
     return new Promise((resolve, reject) => {
       const conn = new Client();
       const chunks = [];
@@ -13369,10 +13415,11 @@ var SshClient = class {
       const connectOptions = {
         host: this.config.host,
         port: this.config.sshPort ?? 22,
-        username: this.credentials.username,
-        password: this.credentials.password,
+        username: this.config.sshUsername ?? this.credentials.username,
         readyTimeout: 1e4
       };
+      if (privateKey) connectOptions.privateKey = privateKey;
+      else connectOptions.password = this.credentials.password;
       if (this.config.sshFingerprint) {
         const expected = this.config.sshFingerprint.toLowerCase();
         connectOptions.hostVerifier = (key2) => {
@@ -13434,6 +13481,7 @@ var FtpClient = class {
 
 // src/adapter/sftp-client.ts
 import { createHash as createHash3 } from "crypto";
+import { readFileSync as readFileSync4 } from "fs";
 import { Client as Client3 } from "ssh2";
 var SftpClient = class {
   constructor(config, credentials) {
@@ -13443,6 +13491,7 @@ var SftpClient = class {
   config;
   credentials;
   async upload(remoteName, content) {
+    const privateKey = this.config.sshPrivateKeyPath ? readFileSync4(this.config.sshPrivateKeyPath) : void 0;
     return new Promise((resolve, reject) => {
       const conn = new Client3();
       let settled = false;
@@ -13468,10 +13517,11 @@ var SftpClient = class {
       const connectOptions = {
         host: this.config.host,
         port: this.config.sshPort ?? 22,
-        username: this.credentials.username,
-        password: this.credentials.password,
+        username: this.config.sshUsername ?? this.credentials.username,
         readyTimeout: 1e4
       };
+      if (privateKey) connectOptions.privateKey = privateKey;
+      else connectOptions.password = this.credentials.password;
       if (this.config.sshFingerprint) {
         const expected = this.config.sshFingerprint.toLowerCase();
         connectOptions.hostVerifier = (key2) => {
@@ -14754,7 +14804,8 @@ function registerAllTools(server, registry, pool, circuitBreakers, config, ident
 }
 
 // src/config/router-registry.ts
-import { readFileSync as readFileSync3, existsSync } from "fs";
+import { readFileSync as readFileSync5, existsSync } from "fs";
+import { isAbsolute } from "path";
 import { parse } from "yaml";
 import { z as z49 } from "zod";
 var log51 = createLogger("router-registry");
@@ -14781,6 +14832,8 @@ var RouterConfigSchema = z49.object({
   tags: z49.array(z49.string()).default([]),
   rosVersion: z49.string().min(1).optional(),
   sshPort: z49.number().int().min(1).max(65535).optional(),
+  sshUsername: z49.string().min(1).optional(),
+  sshPrivateKeyPath: z49.string().min(1).refine(isAbsolute, "sshPrivateKeyPath must be absolute").optional(),
   sshFingerprint: z49.string().optional(),
   cmdAllow: z49.array(z49.string()).optional(),
   cmdDeny: z49.array(z49.string()).optional(),
@@ -14832,7 +14885,7 @@ var RouterRegistry = class {
       log51.warn({ configPath }, "Router config file not found; starting with empty registry");
       return;
     }
-    const raw = readFileSync3(configPath, "utf-8");
+    const raw = readFileSync5(configPath, "utf-8");
     const parsed = parse(raw);
     const result = ConfigFileSchema.safeParse(parsed);
     if (!result.success) {
@@ -14960,7 +15013,7 @@ var ConnectionPool = class {
 };
 
 // src/version.ts
-var VERSION = "1.10.0";
+var VERSION = "1.11.0";
 
 // src/mcp/server.ts
 var SERVER_INSTRUCTIONS = [
@@ -15267,7 +15320,7 @@ async function handleMcpRequest(pathname, req, res, url, port, maxBodyBytes, mak
 }
 
 // src/config/identity-registry.ts
-import { readFileSync as readFileSync4, existsSync as existsSync2 } from "fs";
+import { readFileSync as readFileSync6, existsSync as existsSync2 } from "fs";
 import { createHash as createHash7 } from "crypto";
 import { parse as parse2 } from "yaml";
 import { z as z50 } from "zod";
@@ -15295,7 +15348,7 @@ var IdentityRegistry = class {
       );
       return;
     }
-    const raw = readFileSync4(configPath, "utf-8");
+    const raw = readFileSync6(configPath, "utf-8");
     const parsed = parse2(raw);
     const result = ConfigFileSchema2.safeParse(parsed);
     if (!result.success) {
@@ -15434,11 +15487,11 @@ async function runServe() {
 }
 
 // src/cli/doctor.ts
-import { existsSync as existsSync3, readFileSync as readFileSync5 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync7 } from "fs";
 import { homedir as homedir2 } from "os";
 import * as net from "net";
 import chalk from "chalk";
-var localVersion = "1.10.0";
+var localVersion = "1.11.0";
 var results = [];
 function ok(msg) {
   console.log(chalk.green("\u2705 ") + msg);
@@ -15651,7 +15704,7 @@ function checkClaudeDesktop() {
     return;
   }
   try {
-    const raw = readFileSync5(configPath, "utf-8");
+    const raw = readFileSync7(configPath, "utf-8");
     const config = JSON.parse(raw);
     const servers = config.mcpServers ?? {};
     if ("mikromcp" in servers || "mikrotik-mcp-server" in servers) {
@@ -15750,7 +15803,7 @@ async function runDoctor() {
 // src/cli/init.ts
 import { input, confirm, select } from "@inquirer/prompts";
 import { randomBytes as randomBytes2 } from "crypto";
-import { existsSync as existsSync4, readFileSync as readFileSync6, writeFileSync, mkdirSync, copyFileSync } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync8, writeFileSync, mkdirSync, copyFileSync } from "fs";
 import { homedir as homedir3 } from "os";
 import { join as join4 } from "path";
 import { parse as yamlParse, Document, visit } from "yaml";
@@ -15974,7 +16027,7 @@ function writeRoutersYaml(data) {
   };
   let parsed = { routers: {} };
   if (existsSync4(filePath)) {
-    const raw = readFileSync6(filePath, "utf-8");
+    const raw = readFileSync8(filePath, "utf-8");
     parsed = yamlParse(raw) ?? { routers: {} };
     if (!parsed.routers) parsed.routers = {};
   }
@@ -15993,7 +16046,7 @@ function writeIdentitiesYaml(data) {
   };
   let parsed = { identities: {} };
   if (existsSync4(filePath)) {
-    const raw = readFileSync6(filePath, "utf-8");
+    const raw = readFileSync8(filePath, "utf-8");
     parsed = yamlParse(raw) ?? { identities: {} };
     if (!parsed.identities) parsed.identities = {};
   }
@@ -16059,7 +16112,7 @@ function registerClaudeDesktop() {
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
   const backupPath = `${configPath}.backup-${timestamp}`;
   copyFileSync(configPath, backupPath);
-  const raw = readFileSync6(configPath, "utf-8");
+  const raw = readFileSync8(configPath, "utf-8");
   const config = JSON.parse(raw);
   if (!config.mcpServers || typeof config.mcpServers !== "object") {
     config.mcpServers = {};
@@ -16168,7 +16221,7 @@ async function runInit() {
 }
 
 // src/cli/index.ts
-var program = new Command().name("mikromcp").description("MikroTik RouterOS MCP server").version("1.10.0");
+var program = new Command().name("mikromcp").description("MikroTik RouterOS MCP server").version("1.11.0");
 program.command("serve", { isDefault: true }).description("Start the MCP server (default)").action(runServe);
 program.command("doctor").description("Check config, connectivity, and permissions").action(runDoctor);
 program.command("init").description("Interactive setup wizard").action(runInit);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mikromcp",
-  "version": "1.10.0",
+  "version": "1.11.0",
   "mcpName": "io.github.AliKarami/mikromcp",
   "description": "Production-grade MCP server for MikroTik RouterOS",
   "type": "module",