mikromcp 1.12.0 → 1.13.0

package/README.md

@@ -12,7 +12,7 @@
 
 [![CI](https://github.com/AliKarami/MikroMCP/actions/workflows/ci.yml/badge.svg)](https://github.com/AliKarami/MikroMCP/actions/workflows/ci.yml)
 [![Release](https://github.com/AliKarami/MikroMCP/actions/workflows/release.yml/badge.svg)](https://github.com/AliKarami/MikroMCP/actions/workflows/release.yml)
-[![Version](https://img.shields.io/badge/version-v1.12.0-2DD4BF)](package.json)
+[![Version](https://img.shields.io/badge/version-v1.13.0-2DD4BF)](package.json)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Node.js >= 22](https://img.shields.io/badge/node-%3E%3D22-339933)](package.json)
 [![RouterOS 7.x](https://img.shields.io/badge/RouterOS-7.x-293239)](https://help.mikrotik.com/docs/display/ROS/REST+API)

package/dist/main.js

@@ -137,6 +137,7 @@ var routerId = z.string().optional().describe("Router ID; omit to use the defaul
 var dryRun = z.boolean().default(false).describe("Preview changes without applying.");
 var offset = z.number().int().min(0).default(0).describe("Pagination offset.");
 var limit = z.number().int().min(1).max(500).default(100).describe("Max results to return.");
+var ruleComment = z.string().min(1);
 
 // src/domain/errors/error-enricher.ts
 import { ZodError } from "zod";
@@ -152,6 +153,7 @@ var UNREACHABLE_CODES = /* @__PURE__ */ new Set([
 ]);
 var TIMEOUT_CODES = /* @__PURE__ */ new Set(["UND_ERR_HEADERS_TIMEOUT", "UND_ERR_BODY_TIMEOUT"]);
 var SSH_AUTH_LEVEL = "client-authentication";
+var SSH_TIMEOUT_LEVEL = "client-timeout";
 function defaultRecoverability(category) {
   switch (category) {
     case "VALIDATION" /* VALIDATION */:
@@ -279,6 +281,19 @@ function enrichError(error, context) {
       cause: error
     });
   }
+  if (typeof raw === "object" && raw !== null && raw.level === SSH_TIMEOUT_LEVEL) {
+    return new MikroMCPError({
+      category: "ROUTER_UNREACHABLE" /* ROUTER_UNREACHABLE */,
+      code: "SSH_HANDSHAKE_TIMEOUT",
+      message: `The SSH connection to the router timed out: ${rawMessage}`,
+      details: buildDetails({ transport: "ssh" }, context),
+      recoverability: {
+        retryable: false,
+        suggestedAction: "Check that the router's SSH service is enabled and reachable from this host on sshPort (default 22): /ip service ssh, its available-from list, and input firewall rules."
+      },
+      cause: error
+    });
+  }
   if (typeof raw === "object" && raw !== null && typeof raw.statusCode === "number") {
     const statusCode = raw.statusCode;
     let category2 = categoryFromStatus(statusCode);
@@ -519,8 +534,9 @@ import { z as z3 } from "zod";
 // src/adapter/response-parser.ts
 var NUMERIC_RE = /^-?\d+(\.\d+)?$/;
 var DURATION_RE = /^\d+[wdhms](\d+[wdhms])*$/;
+var FREE_TEXT_KEYS = /* @__PURE__ */ new Set(["comment", "text"]);
 function parseRouterOSValue(key2, value) {
-  if (key2 === ".id") {
+  if (key2 === ".id" || FREE_TEXT_KEYS.has(key2)) {
     return value;
   }
   if (value === "true") return true;
@@ -588,7 +604,7 @@ function compactFields(record, fields) {
   return parts.join(" ");
 }
 function listContent(label, routerId2, page, total, offset2, renderItem) {
-  const range = total === 0 ? "none" : `${offset2 + 1}-${offset2 + page.length} of ${total}`;
+  const range = total === 0 ? "none" : page.length === 0 ? `none of ${total} (offset ${offset2})` : `${offset2 + 1}-${offset2 + page.length} of ${total}`;
   const header = `${label} on ${routerId2}: ${range}.`;
   if (page.length === 0) return header;
   return [header, ...page.map((item) => `  ${renderItem(item)}`)].join("\n");
@@ -1487,27 +1503,92 @@ var ADDRESS_PROPERTIES = /* @__PURE__ */ new Set([
   "to-addresses"
 ]);
 var SET_PROPERTIES = /* @__PURE__ */ new Set(["connection-state", "connection-nat-state"]);
+var PROTOCOL_NAMES = {
+  "1": "icmp",
+  "2": "igmp",
+  "3": "ggp",
+  "4": "ipencap",
+  "5": "st",
+  "6": "tcp",
+  "8": "egp",
+  "12": "pup",
+  "17": "udp",
+  "20": "hmp",
+  "22": "xns-idp",
+  "27": "rdp",
+  "29": "iso-tp4",
+  "33": "dccp",
+  "36": "xtp",
+  "37": "ddp",
+  "38": "idpr-cmtp",
+  "41": "ipv6-encap",
+  "43": "ipv6-route",
+  "44": "ipv6-frag",
+  "46": "rsvp",
+  "47": "gre",
+  "50": "ipsec-esp",
+  "51": "ipsec-ah",
+  "58": "icmpv6",
+  "59": "ipv6-nonxt",
+  "60": "ipv6-opts",
+  "73": "rspf",
+  "81": "vmtp",
+  "89": "ospf",
+  "94": "ipip",
+  "97": "etherip",
+  "98": "encap",
+  "103": "pim",
+  "112": "vrrp",
+  "115": "l2tp",
+  "132": "sctp",
+  "136": "udp-lite"
+};
+function protocolName(value) {
+  return PROTOCOL_NAMES[value] ?? value;
+}
+var FLAG_PROPERTIES = /* @__PURE__ */ new Set(["tcp-flags"]);
 function canonical(property, value) {
+  if (property === "protocol") return value === "all" ? "" : protocolName(value);
   if (ADDRESS_PROPERTIES.has(property)) return value.replace(/\/32$/, "");
   if (SET_PROPERTIES.has(property)) {
     const negated = value.startsWith("!");
     const items = new Set((negated ? value.slice(1) : value).split(",").filter(Boolean));
     return (negated ? "!" : "") + [...items].sort().join(",");
   }
+  if (FLAG_PROPERTIES.has(property)) {
+    return [...new Set(value.split(",").filter(Boolean))].sort().join(",");
+  }
   return value;
 }
 function sameRuleValue(property, stored, requested) {
   return canonical(property, normalizeWireValue(stored)) === canonical(property, normalizeWireValue(requested));
 }
-
-// src/domain/tools/firewall-tools.ts
-var log6 = createLogger("firewall-tools");
-function tableToPath(table) {
-  return table === "filter" ? "ip/firewall/filter" : "ip/firewall/nat";
+function ruleActionAddOnly(action, ruleAction, suggestedAction) {
+  return new MikroMCPError({
+    category: "VALIDATION" /* VALIDATION */,
+    code: "RULE_ACTION_ADD_ONLY",
+    message: `ruleAction applies only to add, not to ${action}.`,
+    details: { action, ruleAction },
+    recoverability: { retryable: false, suggestedAction }
+  });
 }
-function sanitizeComment3(comment) {
-  if (comment === void 0) return void 0;
-  return comment.replace(/[\x00-\x1f\x7f]/g, "");
+
+// src/domain/tools/rule-comment.ts
+function ruleCommentKey(comment) {
+  const sanitized = comment.replace(/[\x00-\x1f\x7f]/g, "");
+  if (sanitized === "") {
+    throw new MikroMCPError({
+      category: "VALIDATION" /* VALIDATION */,
+      code: "COMMENT_EMPTY",
+      message: "comment is empty after removing control characters.",
+      details: { comment },
+      recoverability: {
+        retryable: false,
+        suggestedAction: "Use a comment with printable characters."
+      }
+    });
+  }
+  return sanitized;
 }
 async function findRuleByComment(context, path, comment) {
   const results2 = await context.routerClient.get(path, {
@@ -1515,6 +1596,12 @@ async function findRuleByComment(context, path, comment) {
   });
   return results2.length > 0 ? results2[0] : void 0;
 }
+
+// src/domain/tools/firewall-tools.ts
+var log6 = createLogger("firewall-tools");
+function tableToPath(table) {
+  return table === "filter" ? "ip/firewall/filter" : "ip/firewall/nat";
+}
 var RULE_FIELDS = [
   ["srcAddress", "src-address"],
   ["dstAddress", "dst-address"],
@@ -1536,6 +1623,14 @@ var TO_PORTS_ACTIONS = /* @__PURE__ */ new Set([
   "masquerade"
 ]);
 var CONNECTION_STATE = "(established|related|new|invalid|untracked)";
+function isPortOrRange(value) {
+  const [start, end = start] = value.split("-").map(Number);
+  return start >= 1 && end <= 65535 && start <= end;
+}
+function hasNoRepeats(value) {
+  const items = value.replace(/^!/, "").split(",");
+  return new Set(items).size === items.length;
+}
 var listFirewallRulesInputSchema = z8.object({
   routerId,
   table: z8.enum(["filter", "nat"]).default("filter").describe("Firewall table to query: filter or nat"),
@@ -1575,7 +1670,7 @@ var listFirewallRulesTool = {
       if (parsed.chain !== void 0) {
         rules = rules.filter((r) => {
           const rec = r;
-          return rec.chain === parsed.chain;
+          return sameRuleValue("chain", rec.chain, parsed.chain);
         });
       }
       if (parsed.disabled !== "all") {
@@ -1633,22 +1728,22 @@ var manageFirewallRuleInputSchema = z8.object({
   action: z8.enum(["add", "remove", "disable", "enable"]).describe("Action to perform: add, remove, disable, or enable a firewall rule"),
   chain: z8.string().describe("Firewall chain (e.g. forward, input, output, srcnat, dstnat)"),
   ruleAction: z8.string().describe("RouterOS rule action (e.g. accept, drop, reject, masquerade)"),
-  srcAddress: z8.string().optional().describe("Source address or network"),
-  dstAddress: z8.string().optional().describe("Destination address or network"),
+  srcAddress: z8.string().min(1).optional().describe("Source address or network"),
+  dstAddress: z8.string().min(1).optional().describe("Destination address or network"),
   protocol: z8.enum(["tcp", "udp", "icmp", "gre", "ospf", "all"]).optional().describe("Protocol to match"),
-  srcPort: z8.string().optional().describe("Source port or range"),
-  dstPort: z8.string().optional().describe("Destination port or range"),
-  inInterface: z8.string().optional().describe("Incoming interface"),
-  outInterface: z8.string().optional().describe("Outgoing interface"),
-  inInterfaceList: z8.string().optional().describe("Incoming interface list, e.g. WAN or !LAN"),
-  outInterfaceList: z8.string().optional().describe("Outgoing interface list, e.g. WAN or !LAN"),
-  connectionState: z8.string().regex(new RegExp(`^!?${CONNECTION_STATE}(,${CONNECTION_STATE})*$`)).optional().describe(
+  srcPort: z8.string().min(1).optional().describe("Source port or range"),
+  dstPort: z8.string().min(1).optional().describe("Destination port or range"),
+  inInterface: z8.string().min(1).optional().describe("Incoming interface"),
+  outInterface: z8.string().min(1).optional().describe("Outgoing interface"),
+  inInterfaceList: z8.string().min(1).optional().describe("Incoming interface list, e.g. WAN or !LAN"),
+  outInterfaceList: z8.string().min(1).optional().describe("Outgoing interface list, e.g. WAN or !LAN"),
+  connectionState: z8.string().regex(new RegExp(`^!?${CONNECTION_STATE}(,${CONNECTION_STATE})*$`)).refine(hasNoRepeats, "Each connection state may appear only once").optional().describe(
     "Connection-tracking states, comma-separated, optionally negated: established,related or !invalid"
   ),
   connectionNatState: z8.string().regex(/^!?(srcnat|dstnat|srcnat,dstnat|dstnat,srcnat)$/).optional().describe("Connection NAT state to match, e.g. dstnat or !dstnat"),
-  toAddresses: z8.string().optional().describe("NAT target address or range (nat table only, e.g. dst-nat)"),
-  toPorts: z8.string().regex(/^\d{1,5}(-\d{1,5})?$/).optional().describe("NAT target port or range (nat table only)"),
-  comment: z8.string().max(255).optional().describe("Comment to identify the rule (used as idempotency key)"),
+  toAddresses: z8.string().min(1).optional().describe("NAT target address or range (nat table only, e.g. dst-nat)"),
+  toPorts: z8.string().regex(/^\d{1,5}(-\d{1,5})?$/).refine(isPortOrRange, "Must be a port 1-65535 or an ascending range such as 8000-8100").optional().describe("NAT target port or range (nat table only)"),
+  comment: ruleComment.max(255).optional().describe("Comment to identify the rule (used as idempotency key); omit for none"),
   disabled: z8.boolean().default(false).describe("Whether the rule should be disabled"),
   placeBefore: z8.string().optional().describe("Place the new rule before this rule ID"),
   dryRun: z8.boolean().default(false).describe("If true, validate and return planned changes without applying")
@@ -1656,7 +1751,7 @@ var manageFirewallRuleInputSchema = z8.object({
 var manageFirewallRuleTool = {
   name: "manage_firewall_rule",
   title: "Manage Firewall Rule",
-  description: "Add, remove, disable, or enable a firewall rule on a MikroTik router. Matches addresses, ports, protocol, interfaces, interface lists, and connection/NAT state; nat rules take toAddresses/toPorts (e.g. a dst-nat port forward). Uses comment as idempotency key for deduplication and identification. Supports dry-run mode.",
+  description: "Add, remove, disable, or enable a firewall rule on a MikroTik router. Matches addresses, ports, protocol, interfaces, interface lists, and connection/NAT state; nat rules take toAddresses/toPorts (e.g. a dst-nat port forward). Uses comment as idempotency key for deduplication and identification: a repeated add returns already_exists only when the match, NAT targets, and disabled state agree, otherwise CONFLICT (use enable/disable when only the disabled state differs). Supports dry-run mode.",
   inputSchema: manageFirewallRuleInputSchema,
   annotations: {
     readOnlyHint: false,
@@ -1667,7 +1762,6 @@ var manageFirewallRuleTool = {
   snapshotPaths: ["ip/firewall/filter", "ip/firewall/nat"],
   async handler(params, context) {
     const parsed = manageFirewallRuleInputSchema.parse(params);
-    const comment = sanitizeComment3(parsed.comment);
     log6.info(
       {
         routerId: context.routerId,
@@ -1679,6 +1773,7 @@ var manageFirewallRuleTool = {
     );
     const path = tableToPath(parsed.table);
     try {
+      const comment = parsed.comment === void 0 ? void 0 : ruleCommentKey(parsed.comment);
       if (parsed.action === "add") {
         const natTargets = [
           ["toAddresses", parsed.toAddresses, TO_ADDRESSES_ACTIONS],
@@ -1703,10 +1798,11 @@ var manageFirewallRuleTool = {
         if (comment !== void 0) {
           const existing = await findRuleByComment(context, path, comment);
           if (existing) {
-            const matches = existing.chain === parsed.chain && existing.action === parsed.ruleAction && sameRuleValue("protocol", existing.protocol, wantProtocol) && RULE_FIELDS.every(
+            const sameMatch = sameRuleValue("chain", existing.chain, parsed.chain) && existing.action === parsed.ruleAction && sameRuleValue("protocol", existing.protocol, wantProtocol) && RULE_FIELDS.every(
               ([key2, property]) => sameRuleValue(property, existing[property], parsed[key2])
             );
-            if (matches) {
+            const existingDisabled = isTrue(existing.disabled);
+            if (sameMatch && existingDisabled === parsed.disabled) {
               return {
                 content: `Firewall ${parsed.table} rule with comment "${comment}" already exists. No changes made.`,
                 structuredContent: { action: "already_exists", rule: existing }
@@ -1726,12 +1822,19 @@ var manageFirewallRuleTool = {
               existingDetails[property] = existing[property];
               requestedDetails[property] = parsed[key2];
             }
+            existingDetails.disabled = existingDisabled;
+            requestedDetails.disabled = parsed.disabled;
+            const toggle = parsed.disabled ? "disable" : "enable";
             throw new MikroMCPError({
               category: "CONFLICT" /* CONFLICT */,
               code: "FIREWALL_RULE_CONFLICT",
-              message: `Firewall ${parsed.table} rule with comment "${comment}" already exists but with different configuration.`,
+              message: sameMatch ? `Firewall ${parsed.table} rule with comment "${comment}" already exists but is ${existingDisabled ? "disabled" : "enabled"}.` : `Firewall ${parsed.table} rule with comment "${comment}" already exists but with different configuration.`,
               details: { existing: existingDetails, requested: requestedDetails },
-              recoverability: {
+              recoverability: sameMatch ? {
+                retryable: false,
+                suggestedAction: `Use action=${toggle} with the same comment to ${toggle} the existing rule.`,
+                alternativeTools: [`manage_firewall_rule with action=${toggle}`]
+              } : {
                 retryable: false,
                 suggestedAction: "Remove the existing rule first, then re-add with the desired configuration.",
                 alternativeTools: ["manage_firewall_rule with action=remove"]
@@ -3536,20 +3639,61 @@ var listDnsTool = {
 var manageDnsInputSchema = z14.object({
   routerId,
   action: z14.enum(["add", "remove"]).describe("Action to perform"),
-  name: z14.string().min(1).describe("Hostname for the DNS record (e.g. server.example.com)"),
+  name: z14.string().min(1).describe(
+    "Hostname for the DNS record (e.g. server.example.com); matched case-insensitively"
+  ),
   type: z14.enum(["A", "CNAME", "TXT"]).default("A").describe("DNS record type"),
-  address: z14.string().optional().describe("IP address (required for A records)"),
-  cname: z14.string().optional().describe("Target hostname (required for CNAME records)"),
-  text: z14.string().optional().describe("Text value (required for TXT records)"),
+  address: z14.string().optional().describe(
+    "IP address (required for A records; on remove, picks the record when several share the name)"
+  ),
+  cname: z14.string().optional().describe(
+    "Target hostname (required for CNAME records; on remove, picks the record when several share the name)"
+  ),
+  text: z14.string().optional().describe(
+    "Text value (required for TXT records; on remove, picks the record when several share the name)"
+  ),
   ttl: z14.string().optional().describe("TTL value (e.g. 1d, 00:05:00)"),
   comment: z14.string().max(255).optional().describe("Optional comment"),
   disabled: z14.boolean().default(false).describe("Whether the entry should be disabled"),
   dryRun
 }).strict();
+var VALUE_FIELD = { A: "address", CNAME: "cname", TXT: "text" };
+var TIME_UNIT_MS = {
+  w: 6048e5,
+  d: 864e5,
+  h: 36e5,
+  m: 6e4,
+  s: 1e3,
+  ms: 1
+};
+function ttlMillis(value) {
+  if (typeof value === "number") return Number.isFinite(value) ? value * 1e3 : void 0;
+  if (typeof value !== "string") return void 0;
+  let rest = value.trim();
+  if (/^\d+$/.test(rest)) return Number(rest) * 1e3;
+  let total = 0;
+  const clock = /(\d+):(\d{1,2}):(\d{1,2})(?:\.(\d{1,3}))?$/.exec(rest);
+  if (clock) {
+    const [, h, m, s, frac = ""] = clock;
+    total += ((Number(h) * 60 + Number(m)) * 60 + Number(s)) * 1e3 + Number(frac.padEnd(3, "0"));
+    rest = rest.slice(0, clock.index).trim();
+  }
+  if (rest === "") return clock ? total : void 0;
+  if (!/^(?:\d+(?:ms|[wdhms])\s*)+$/.test(rest)) return void 0;
+  for (const [, amount, unit] of rest.matchAll(/(\d+)(ms|[wdhms])/g)) {
+    total += Number(amount) * TIME_UNIT_MS[unit];
+  }
+  return total;
+}
+function sameTtl(stored, requested) {
+  const a = ttlMillis(stored);
+  const b = ttlMillis(requested);
+  return a !== void 0 && b !== void 0 ? a === b : normalizeWireValue(stored) === normalizeWireValue(requested);
+}
 var manageDnsTool = {
   name: "manage_dns_entry",
   title: "Manage DNS Entry",
-  description: "Add or remove a static DNS entry. Idempotent by name+type: add returns already_exists if the same record already exists.",
+  description: "Add or remove a static DNS entry, found by name (case-insensitive) and type. add returns already_exists if such a record already has the requested value and disabled state (and ttl/comment, when given), and throws CONFLICT if it differs; add never creates a second record with the same name and type. remove deletes the one matching record; when several share the name (round-robin), pass address/cname/text to pick one.",
   inputSchema: manageDnsInputSchema,
   annotations: {
     readOnlyHint: false,
@@ -3565,42 +3709,77 @@ var manageDnsTool = {
       "Managing DNS entry"
     );
     try {
-      const existing = await context.routerClient.get("ip/dns/static", {
-        filter: { name: parsed.name, type: parsed.type }
-      });
-      if (parsed.action === "add") {
-        if (existing.length > 0) {
-          return {
-            content: `DNS entry "${parsed.name}" (${parsed.type}) already exists. No changes made.`,
-            structuredContent: { action: "already_exists", entry: existing[0] }
-          };
-        }
-        if (parsed.type === "A" && !parsed.address) {
+      const valueField = VALUE_FIELD[parsed.type];
+      const value = parsed[valueField];
+      const comment = parsed.comment?.replace(/[\x00-\x1f\x7f]/g, "");
+      const valueFields = ["address", "cname", "text"];
+      for (const field of valueFields) {
+        if (field !== valueField && parsed[field] !== void 0) {
           throw new MikroMCPError({
             category: "VALIDATION" /* VALIDATION */,
-            code: "DNS_MISSING_ADDRESS",
-            message: "address is required for A records.",
-            recoverability: { retryable: false, suggestedAction: "Provide the address parameter." }
-          });
-        }
-        if (parsed.type === "CNAME" && !parsed.cname) {
-          throw new MikroMCPError({
-            category: "VALIDATION" /* VALIDATION */,
-            code: "DNS_MISSING_CNAME",
-            message: "cname is required for CNAME records.",
-            recoverability: { retryable: false, suggestedAction: "Provide the cname parameter." }
+            code: "DNS_FIELD_NOT_APPLICABLE",
+            message: `${field} does not apply to ${parsed.type} records; ${parsed.type} uses ${valueField}.`,
+            details: { field, type: parsed.type },
+            recoverability: {
+              retryable: false,
+              suggestedAction: `Drop ${field}, or set type to the record type it belongs to.`
+            }
           });
         }
-        if (parsed.type === "TXT" && !parsed.text) {
+      }
+      if (parsed.action === "add" && !value) {
+        throw new MikroMCPError({
+          category: "VALIDATION" /* VALIDATION */,
+          code: `DNS_MISSING_${valueField.toUpperCase()}`,
+          message: `${valueField} is required for ${parsed.type} records.`,
+          recoverability: {
+            retryable: false,
+            suggestedAction: `Provide the ${valueField} parameter.`
+          }
+        });
+      }
+      const wantName = parsed.name.toLowerCase();
+      const existing = (await context.routerClient.get("ip/dns/static", {
+        filter: { type: parsed.type }
+      })).filter((entry) => String(entry.name ?? "").toLowerCase() === wantName);
+      const detailsOf = (entry) => ({
+        [valueField]: entry[valueField],
+        disabled: entry.disabled,
+        ttl: entry.ttl,
+        comment: entry.comment
+      });
+      const describe = (fields) => compactFields(fields, [valueField, "disabled", "ttl", "comment"]);
+      if (parsed.action === "add") {
+        if (existing.length > 0) {
+          const match = existing.find(
+            (rec2) => normalizeWireValue(rec2[valueField]) === normalizeWireValue(value) && isTrue(rec2.disabled) === parsed.disabled && (parsed.ttl === void 0 || sameTtl(rec2.ttl, parsed.ttl)) && (comment === void 0 || normalizeWireValue(rec2.comment) === normalizeWireValue(comment))
+          );
+          if (match) {
+            return {
+              content: `DNS entry "${parsed.name}" (${parsed.type}) already exists. No changes made.`,
+              structuredContent: { action: "already_exists", entry: match }
+            };
+          }
+          const existingDetails = existing.map(detailsOf);
+          const requestedDetails = {
+            [valueField]: value,
+            disabled: parsed.disabled ? "true" : "false",
+            ttl: parsed.ttl,
+            comment
+          };
           throw new MikroMCPError({
-            category: "VALIDATION" /* VALIDATION */,
-            code: "DNS_MISSING_TEXT",
-            message: "text is required for TXT records.",
-            recoverability: { retryable: false, suggestedAction: "Provide the text parameter." }
+            category: "CONFLICT" /* CONFLICT */,
+            code: "DNS_ENTRY_CONFLICT",
+            message: `DNS entry "${parsed.name}" (${parsed.type}) already exists but with different configuration. Existing: ${existingDetails.map(describe).join("; ")}. Requested: ${describe(requestedDetails)}.`,
+            details: { existing: existingDetails, requested: requestedDetails },
+            recoverability: {
+              retryable: false,
+              suggestedAction: existing.length > 1 ? `${existing.length} records share this name. Remove each one with action=remove and its ${valueField}, then re-add. add does not create a second record with the same name and type.` : "Remove the existing entry with action=remove, then re-add it with the desired values. add does not create a second record with the same name and type.",
+              alternativeTools: ["manage_dns_entry with action=remove"]
+            }
           });
         }
         if (parsed.dryRun) {
-          const value = parsed.address ?? parsed.cname ?? parsed.text ?? "";
           return {
             content: `Dry run: Would add DNS entry "${parsed.name}" ${parsed.type} \u2192 ${value}.`,
             structuredContent: {
@@ -3615,13 +3794,11 @@ var manageDnsTool = {
         const body = {
           name: parsed.name,
           type: parsed.type,
-          disabled: parsed.disabled ? "true" : "false"
+          disabled: parsed.disabled ? "true" : "false",
+          [valueField]: value
         };
-        if (parsed.address) body.address = parsed.address;
-        if (parsed.cname) body.cname = parsed.cname;
-        if (parsed.text) body.text = parsed.text;
         if (parsed.ttl) body.ttl = parsed.ttl;
-        if (parsed.comment) body.comment = parsed.comment.replace(/[\x00-\x1f\x7f]/g, "");
+        if (comment) body.comment = comment;
         const created = await context.routerClient.create("ip/dns/static", body);
         log12.info({ name: parsed.name, id: created[".id"] }, "DNS entry created");
         return {
@@ -3629,19 +3806,36 @@ var manageDnsTool = {
           structuredContent: { action: "created", entry: created }
         };
       }
-      if (existing.length === 0) {
+      const candidates = value === void 0 ? existing : existing.filter(
+        (rec2) => normalizeWireValue(rec2[valueField]) === normalizeWireValue(value)
+      );
+      if (candidates.length === 0) {
+        const label = value === void 0 ? "" : ` with ${valueField}=${value}`;
         throw new MikroMCPError({
           category: "NOT_FOUND" /* NOT_FOUND */,
           code: "DNS_ENTRY_NOT_FOUND",
-          message: `DNS entry "${parsed.name}" (${parsed.type}) not found.`,
-          details: { name: parsed.name, type: parsed.type },
+          message: `DNS entry "${parsed.name}" (${parsed.type})${label} not found.` + (existing.length > 0 ? ` Existing: ${existing.map((rec2) => describe(detailsOf(rec2))).join("; ")}.` : ""),
+          details: { name: parsed.name, type: parsed.type, [valueField]: value },
           recoverability: {
             retryable: false,
             suggestedAction: "Verify the entry with list_dns_entries."
           }
         });
       }
-      const rec = existing[0];
+      if (candidates.length > 1) {
+        throw new MikroMCPError({
+          category: "VALIDATION" /* VALIDATION */,
+          code: "DNS_ENTRY_AMBIGUOUS",
+          message: `${candidates.length} DNS entries "${parsed.name}" (${parsed.type}) match: ${candidates.map((rec2) => describe(detailsOf(rec2))).join("; ")}.`,
+          details: { name: parsed.name, type: parsed.type, entries: candidates.map(detailsOf) },
+          recoverability: {
+            retryable: false,
+            suggestedAction: `Pass ${valueField} to pick the record to remove.`
+          }
+        });
+      }
+      const rec = candidates[0];
+      const id = rec[".id"];
       if (parsed.dryRun) {
         return {
           content: `Dry run: Would remove DNS entry "${parsed.name}" (${parsed.type}).`,
@@ -3651,7 +3845,7 @@ var manageDnsTool = {
           }
         };
       }
-      await context.routerClient.remove("ip/dns/static", rec[".id"]);
+      await context.routerClient.remove("ip/dns/static", id);
       log12.info({ name: parsed.name, type: parsed.type }, "DNS entry removed");
       return {
         content: `Removed DNS entry "${parsed.name}" (${parsed.type}).`,
@@ -3659,7 +3853,7 @@ var manageDnsTool = {
           action: "removed",
           name: parsed.name,
           type: parsed.type,
-          id: rec[".id"]
+          id
         }
       };
     } catch (err) {
@@ -3817,11 +4011,105 @@ var dnsTools = [
 import { z as z15 } from "zod";
 var log13 = createLogger("mangle-tools");
 var MANGLE_PATH = "ip/firewall/mangle";
-async function findMangleRuleByComment(context, comment) {
-  const results2 = await context.routerClient.get(MANGLE_PATH, {
-    filter: { comment }
+var MANGLE_MATCH_FIELDS = [
+  ["srcAddress", "src-address"],
+  ["dstAddress", "dst-address"],
+  ["srcAddressList", "src-address-list"],
+  ["dstAddressList", "dst-address-list"],
+  ["protocol", "protocol"],
+  ["srcPort", "src-port"],
+  ["dstPort", "dst-port"],
+  ["inInterface", "in-interface"],
+  ["outInterface", "out-interface"],
+  ["tcpFlags", "tcp-flags"]
+];
+var MANGLE_ACTIONS = [
+  "accept",
+  "passthrough",
+  "mark-routing",
+  "mark-connection",
+  "mark-packet",
+  "change-dscp",
+  "change-mss"
+];
+var ACTION_VALUE_PARAMS = [
+  ["mark-routing", "newRoutingMark", "new-routing-mark"],
+  ["mark-connection", "newConnectionMark", "new-connection-mark"],
+  ["mark-packet", "newPacketMark", "new-packet-mark"],
+  ["change-dscp", "newDscpValue", "new-dscp"],
+  ["change-mss", "newMss", "new-mss"]
+];
+function sameActionField(property, stored, requested, fallback) {
+  if (stored === void 0) return true;
+  return sameRuleValue(property, stored, requested ?? fallback);
+}
+var NO_ROUTING_MARK_CHAINS = /* @__PURE__ */ new Set(["input", "forward", "postrouting"]);
+function validationError(code, message, details, suggestedAction) {
+  return new MikroMCPError({
+    category: "VALIDATION" /* VALIDATION */,
+    code,
+    message,
+    details,
+    recoverability: { retryable: false, suggestedAction }
   });
-  return results2.length > 0 ? results2[0] : void 0;
+}
+function checkAddParams(parsed) {
+  const values = ACTION_VALUE_PARAMS.filter(([, param]) => parsed[param] !== void 0);
+  if (parsed.ruleAction === void 0 && values.length > 1) {
+    throw validationError(
+      "MANGLE_FIELD_NOT_APPLICABLE",
+      `${values.map(([, param]) => param).join(" and ")} belong to different actions (${values.map(([action]) => action).join(", ")}); a mangle rule has one action.`,
+      { params: values.map(([, param]) => param), actions: values.map(([action]) => action) },
+      "Add one rule per action, each with its own value."
+    );
+  }
+  const ruleAction = parsed.ruleAction ?? values[0]?.[0] ?? "accept";
+  for (const [action, param, property] of ACTION_VALUE_PARAMS) {
+    const given = parsed[param] !== void 0;
+    if (given && action !== ruleAction) {
+      throw validationError(
+        "MANGLE_FIELD_NOT_APPLICABLE",
+        `${param} (${property}) applies only to ruleAction ${action}, not to ${ruleAction}.`,
+        { ruleAction, param, requiredRuleAction: action },
+        `Drop ${param}, or set ruleAction to ${action}.`
+      );
+    }
+    if (!given && action === ruleAction) {
+      throw validationError(
+        "MANGLE_ACTION_VALUE_REQUIRED",
+        `ruleAction ${action} needs ${param} (${property}).`,
+        { ruleAction, param },
+        `Provide ${param}.`
+      );
+    }
+  }
+  if (ruleAction === "mark-routing" && NO_ROUTING_MARK_CHAINS.has(parsed.chain)) {
+    throw validationError(
+      "MANGLE_CHAIN_NOT_APPLICABLE",
+      `A routing mark set in chain ${parsed.chain} takes no effect; mark-routing works only in prerouting and output.`,
+      { ruleAction, chain: parsed.chain },
+      "Use chain prerouting for forwarded traffic or output for the router's own traffic."
+    );
+  }
+  const tcp = parsed.protocol !== void 0 && protocolName(parsed.protocol) === "tcp";
+  const syn = (parsed.tcpFlags ?? "").split(",").includes("syn");
+  if (ruleAction === "change-mss" && !(tcp && syn)) {
+    throw validationError(
+      "MANGLE_TCP_REQUIRED",
+      "change-mss works only on TCP SYN packets; RouterOS rejects it without protocol tcp and tcpFlags syn.",
+      { protocol: parsed.protocol, tcpFlags: parsed.tcpFlags },
+      'Set protocol to "tcp" and tcpFlags to "syn".'
+    );
+  }
+  if (parsed.tcpFlags !== void 0 && !tcp) {
+    throw validationError(
+      "MANGLE_TCP_REQUIRED",
+      `tcpFlags works only with TCP, but protocol is ${parsed.protocol ?? "not set"}.`,
+      { protocol: parsed.protocol, tcpFlags: parsed.tcpFlags },
+      'Set protocol to "tcp".'
+    );
+  }
+  return ruleAction;
 }
 var listMangleRulesInputSchema = z15.object({
   routerId,
@@ -3849,7 +4137,9 @@ var listMangleRulesTool = {
         offset: void 0
       });
       if (parsed.chain !== void 0) {
-        rules = rules.filter((r) => r.chain === parsed.chain);
+        rules = rules.filter(
+          (r) => sameRuleValue("chain", r.chain, parsed.chain)
+        );
       }
       if (parsed.action !== void 0) {
         rules = rules.filter((r) => r.action === parsed.action);
@@ -3889,7 +4179,7 @@ var listMangleRulesTool = {
 var manageMangleRuleInputSchema = z15.object({
   routerId,
   action: z15.enum(["add", "remove", "enable", "disable"]).describe("Action to perform"),
-  comment: z15.string().describe("Idempotency key \u2014 uniquely identifies this mangle rule"),
+  comment: ruleComment.describe("Idempotency key \u2014 uniquely identifies this mangle rule"),
   chain: z15.string().optional().describe("Mangle chain (required on add): prerouting, input, forward, output, postrouting"),
   dryRun,
   srcAddress: z15.string().optional().describe("Source IP/CIDR to match"),
@@ -3901,15 +4191,28 @@ var manageMangleRuleInputSchema = z15.object({
   dstPort: z15.string().optional().describe("Destination port or range"),
   inInterface: z15.string().optional().describe("Incoming interface to match"),
   outInterface: z15.string().optional().describe("Outgoing interface to match"),
-  newRoutingMark: z15.string().optional().describe("Routing mark to set"),
-  newConnectionMark: z15.string().optional().describe("Connection mark to set"),
-  newDscpValue: z15.number().int().min(0).max(63).optional().describe("DSCP value to set (0\u201363)"),
+  tcpFlags: z15.string().min(1).optional().describe(
+    'TCP flags to match, comma-separated, ! negates one (e.g. "syn"); needs protocol tcp'
+  ),
+  ruleAction: z15.enum(MANGLE_ACTIONS).optional().describe(
+    "Mangle action, add only. Omitted: the action of the new* value given (newRoutingMark \u2192 mark-routing, newConnectionMark \u2192 mark-connection, newPacketMark \u2192 mark-packet, newDscpValue \u2192 change-dscp, newMss \u2192 change-mss), else accept, the RouterOS default"
+  ),
+  newRoutingMark: z15.string().min(1).optional().describe("Routing mark to set (ruleAction mark-routing, chain prerouting or output)"),
+  newConnectionMark: z15.string().min(1).optional().describe("Connection mark to set (ruleAction mark-connection)"),
+  newPacketMark: z15.string().min(1).optional().describe("Packet mark to set (ruleAction mark-packet)"),
+  newDscpValue: z15.number().int().min(0).max(63).optional().describe("DSCP value to set, 0\u201363 (ruleAction change-dscp)"),
+  // RouterOS documents new-mss as an integer with no range; 0–65535 is the size of
+  // the TCP MSS option, and how RouterOS bounds it was not checked. clamp-to-pmtu is
+  // named in the docs and stored as such (RB5009, RouterOS 7.24.2).
+  newMss: z15.union([z15.number().int().min(0).max(65535), z15.literal("clamp-to-pmtu")]).optional().describe(
+    "MSS to set: a number or clamp-to-pmtu (ruleAction change-mss, with protocol tcp and tcpFlags syn)"
+  ),
   passthrough: z15.boolean().optional().describe("Whether to continue matching subsequent rules")
 }).strict();
 var manageMangleRuleTool = {
   name: "manage_mangle_rule",
   title: "Manage Mangle Rule",
-  description: "Add, remove, enable, or disable a firewall mangle rule. Uses comment as idempotency key. Supports dry-run mode.",
+  description: "Add, remove, enable, or disable a firewall mangle rule. ruleAction sets the action; when it is omitted, a new* value implies its own (newRoutingMark \u2192 mark-routing), otherwise accept. Each new* value is accepted only under its action. Uses comment as idempotency key: a repeated add returns already_exists only when the chain, match fields, marks, DSCP, MSS, passthrough, and the given or implied action agree, otherwise CONFLICT. Supports dry-run mode.",
   inputSchema: manageMangleRuleInputSchema,
   annotations: {
     readOnlyHint: false,
@@ -3925,6 +4228,14 @@ var manageMangleRuleTool = {
       "Managing mangle rule"
     );
     try {
+      const comment = ruleCommentKey(parsed.comment);
+      if (parsed.action !== "add" && parsed.ruleAction !== void 0) {
+        throw ruleActionAddOnly(
+          parsed.action,
+          parsed.ruleAction,
+          "Drop ruleAction; the rule is identified by its comment."
+        );
+      }
       if (parsed.action === "add") {
         if (parsed.chain === void 0) {
           throw new MikroMCPError({
@@ -3937,65 +4248,39 @@ var manageMangleRuleTool = {
             }
           });
         }
-        const existing = await findMangleRuleByComment(context, parsed.comment);
+        const ruleAction = checkAddParams(parsed);
+        const existing = await findRuleByComment(context, MANGLE_PATH, comment);
         if (existing) {
-          const sameChain = existing.chain === parsed.chain;
-          const sameSrcAddress = sameRuleValue(
-            "src-address",
-            existing["src-address"],
-            parsed.srcAddress
-          );
-          const sameDstAddress = sameRuleValue(
-            "dst-address",
-            existing["dst-address"],
-            parsed.dstAddress
-          );
-          const sameSrcAddressList = sameRuleValue(
-            "src-address-list",
-            existing["src-address-list"],
-            parsed.srcAddressList
-          );
-          const sameDstAddressList = sameRuleValue(
-            "dst-address-list",
-            existing["dst-address-list"],
-            parsed.dstAddressList
-          );
-          const sameNewRoutingMark = sameRuleValue(
-            "new-routing-mark",
-            existing["new-routing-mark"],
-            parsed.newRoutingMark
-          );
-          const sameNewConnectionMark = sameRuleValue(
-            "new-connection-mark",
-            existing["new-connection-mark"],
-            parsed.newConnectionMark
-          );
-          if (sameChain && sameSrcAddress && sameDstAddress && sameSrcAddressList && sameDstAddressList && sameNewRoutingMark && sameNewConnectionMark) {
+          const compareAction = parsed.ruleAction !== void 0 || ruleAction !== "accept";
+          const existingAction = existing.action ?? "accept";
+          const matches = (!compareAction || sameRuleValue("action", existingAction, ruleAction)) && sameRuleValue("chain", existing.chain, parsed.chain) && MANGLE_MATCH_FIELDS.every(
+            ([key2, property]) => sameRuleValue(property, existing[property], parsed[key2])
+          ) && ACTION_VALUE_PARAMS.every(
+            ([, param, property]) => sameActionField(property, existing[property], parsed[param])
+          ) && sameActionField("passthrough", existing.passthrough, parsed.passthrough, true);
+          if (matches) {
             return {
-              content: `Mangle rule with comment "${parsed.comment}" already exists. No changes made.`,
+              content: `Mangle rule with comment "${comment}" already exists. No changes made.`,
               structuredContent: { action: "already_exists", rule: existing }
             };
           }
+          const existingDetails = compareAction ? { action: existingAction, chain: existing.chain } : { chain: existing.chain };
+          const requestedDetails = compareAction ? { action: ruleAction, chain: parsed.chain } : { chain: parsed.chain };
+          for (const [key2, property] of MANGLE_MATCH_FIELDS) {
+            existingDetails[property] = existing[property];
+            requestedDetails[property] = parsed[key2];
+          }
+          for (const [, param, property] of ACTION_VALUE_PARAMS) {
+            existingDetails[property] = existing[property];
+            requestedDetails[property] = parsed[param];
+          }
+          existingDetails.passthrough = existing.passthrough;
+          requestedDetails.passthrough = parsed.passthrough ?? true;
           throw new MikroMCPError({
             category: "CONFLICT" /* CONFLICT */,
             code: "MANGLE_RULE_CONFLICT",
-            message: `Mangle rule with comment "${parsed.comment}" already exists but with different configuration.`,
-            details: {
-              existing: {
-                chain: existing.chain,
-                "src-address": existing["src-address"],
-                "dst-address": existing["dst-address"],
-                "new-routing-mark": existing["new-routing-mark"],
-                "new-connection-mark": existing["new-connection-mark"]
-              },
-              requested: {
-                chain: parsed.chain,
-                "src-address": parsed.srcAddress,
-                "dst-address": parsed.dstAddress,
-                "new-routing-mark": parsed.newRoutingMark,
-                "new-connection-mark": parsed.newConnectionMark
-              }
-            },
+            message: `Mangle rule with comment "${comment}" already exists but with different configuration.`,
+            details: { existing: existingDetails, requested: requestedDetails },
             recoverability: {
               retryable: false,
               suggestedAction: "Remove the existing mangle rule first, then re-add with the desired configuration.",
@@ -4005,7 +4290,8 @@ var manageMangleRuleTool = {
         }
         const body = {
           chain: parsed.chain,
-          comment: parsed.comment
+          action: ruleAction,
+          comment
         };
         if (parsed.srcAddress !== void 0) body["src-address"] = parsed.srcAddress;
         if (parsed.dstAddress !== void 0) body["dst-address"] = parsed.dstAddress;
@@ -4016,10 +4302,11 @@ var manageMangleRuleTool = {
         if (parsed.dstPort !== void 0) body["dst-port"] = parsed.dstPort;
         if (parsed.inInterface !== void 0) body["in-interface"] = parsed.inInterface;
         if (parsed.outInterface !== void 0) body["out-interface"] = parsed.outInterface;
-        if (parsed.newRoutingMark !== void 0) body["new-routing-mark"] = parsed.newRoutingMark;
-        if (parsed.newConnectionMark !== void 0)
-          body["new-connection-mark"] = parsed.newConnectionMark;
-        if (parsed.newDscpValue !== void 0) body["new-dscp"] = String(parsed.newDscpValue);
+        if (parsed.tcpFlags !== void 0) body["tcp-flags"] = parsed.tcpFlags;
+        for (const [, param, property] of ACTION_VALUE_PARAMS) {
+          const value = parsed[param];
+          if (value !== void 0) body[property] = String(value);
+        }
         if (parsed.passthrough !== void 0) body.passthrough = parsed.passthrough ? "yes" : "no";
         if (parsed.dryRun) {
           const diff = Object.entries(body).map(([property, after]) => ({
@@ -4028,48 +4315,48 @@ var manageMangleRuleTool = {
             after
           }));
           return {
-            content: `Dry run: Would add mangle rule in chain "${parsed.chain}" with comment "${parsed.comment}".`,
+            content: `Dry run: Would add mangle rule in chain "${parsed.chain}" with comment "${comment}".`,
             structuredContent: { action: "dry_run", diff }
           };
         }
         const created = await context.routerClient.create(MANGLE_PATH, body);
-        log13.info({ comment: parsed.comment, id: created[".id"] }, "Mangle rule added");
+        log13.info({ comment, id: created[".id"] }, "Mangle rule added");
         return {
-          content: `Added mangle rule in chain "${parsed.chain}" with comment "${parsed.comment}".`,
+          content: `Added mangle rule in chain "${parsed.chain}" with comment "${comment}".`,
           structuredContent: { action: "created", rule: created }
         };
       }
       if (parsed.action === "remove") {
-        const existing = await findMangleRuleByComment(context, parsed.comment);
+        const existing = await findRuleByComment(context, MANGLE_PATH, comment);
         if (!existing) {
           return {
-            content: `Mangle rule with comment "${parsed.comment}" does not exist. No changes made.`,
-            structuredContent: { action: "already_removed", comment: parsed.comment }
+            content: `Mangle rule with comment "${comment}" does not exist. No changes made.`,
+            structuredContent: { action: "already_removed", comment }
           };
         }
         const id = existing[".id"];
         if (parsed.dryRun) {
           return {
-            content: `Dry run: Would remove mangle rule with comment "${parsed.comment}".`,
-            structuredContent: { action: "dry_run", id, comment: parsed.comment }
+            content: `Dry run: Would remove mangle rule with comment "${comment}".`,
+            structuredContent: { action: "dry_run", id, comment }
           };
         }
         await context.routerClient.remove(MANGLE_PATH, id);
-        log13.info({ id, comment: parsed.comment }, "Mangle rule removed");
+        log13.info({ id, comment }, "Mangle rule removed");
         return {
-          content: `Removed mangle rule with comment "${parsed.comment}".`,
-          structuredContent: { action: "removed", id, comment: parsed.comment }
+          content: `Removed mangle rule with comment "${comment}".`,
+          structuredContent: { action: "removed", id, comment }
         };
       }
       if (parsed.action === "enable" || parsed.action === "disable") {
         const wantDisabled = parsed.action === "disable";
-        const existing = await findMangleRuleByComment(context, parsed.comment);
+        const existing = await findRuleByComment(context, MANGLE_PATH, comment);
         if (!existing) {
           throw new MikroMCPError({
             category: "NOT_FOUND" /* NOT_FOUND */,
             code: "MANGLE_RULE_NOT_FOUND",
-            message: `No mangle rule found with comment "${parsed.comment}".`,
-            details: { comment: parsed.comment },
+            message: `No mangle rule found with comment "${comment}".`,
+            details: { comment },
             recoverability: {
               retryable: false,
               suggestedAction: "Verify the comment using list_mangle_rules.",
@@ -4081,8 +4368,8 @@ var manageMangleRuleTool = {
         const isDisabled = isTrue(existing.disabled);
         if (isDisabled === wantDisabled) {
           return {
-            content: `Mangle rule with comment "${parsed.comment}" is already ${wantDisabled ? "disabled" : "enabled"}. No changes made.`,
-            structuredContent: { action: "no_change", id, comment: parsed.comment }
+            content: `Mangle rule with comment "${comment}" is already ${wantDisabled ? "disabled" : "enabled"}. No changes made.`,
+            structuredContent: { action: "no_change", id, comment }
           };
         }
         if (parsed.dryRun) {
@@ -4090,17 +4377,17 @@ var manageMangleRuleTool = {
             { property: "disabled", before: String(isDisabled), after: String(wantDisabled) }
           ];
           return {
-            content: `Dry run: Would ${parsed.action} mangle rule with comment "${parsed.comment}".`,
+            content: `Dry run: Would ${parsed.action} mangle rule with comment "${comment}".`,
             structuredContent: { action: "dry_run", diff }
           };
         }
         await context.routerClient.update(MANGLE_PATH, id, {
           disabled: wantDisabled ? "true" : "false"
         });
-        log13.info({ id, comment: parsed.comment, action: parsed.action }, "Mangle rule toggled");
+        log13.info({ id, comment, action: parsed.action }, "Mangle rule toggled");
         return {
-          content: `${parsed.action === "disable" ? "Disabled" : "Enabled"} mangle rule with comment "${parsed.comment}".`,
-          structuredContent: { action: "updated", id, comment: parsed.comment }
+          content: `${parsed.action === "disable" ? "Disabled" : "Enabled"} mangle rule with comment "${comment}".`,
+          structuredContent: { action: "updated", id, comment }
         };
       }
       throw new MikroMCPError({
@@ -4303,7 +4590,9 @@ var listRoutingRulesTool = {
         offset: void 0
       });
       if (parsed.table !== void 0) {
-        rules = rules.filter((r) => r.table === parsed.table);
+        rules = rules.filter(
+          (r) => sameRuleValue("table", r.table, parsed.table)
+        );
       }
       if (parsed.disabled !== void 0) {
         rules = rules.filter((r) => {
@@ -4325,7 +4614,8 @@ var listRoutingRulesTool = {
             "action",
             "table",
             "interface",
-            "disabled"
+            "disabled",
+            "inactive"
           ])
         ),
         structuredContent: { routerId: context.routerId, rules, total: rules.length }
@@ -4341,22 +4631,27 @@ var manageRoutingRuleInputSchema = z17.object({
   table: z17.string().describe(
     "Routing table name \u2014 part of the composite idempotency key; required for all actions"
   ),
+  ruleAction: z17.enum(["lookup", "lookup-only-in-table"]).optional().describe(
+    "Rule action, add only: lookup (default; when the table has no route, later rules and main still apply) or lookup-only-in-table (no fallback)"
+  ),
   srcAddress: z17.string().optional().describe("Source CIDR to match"),
   dstAddress: z17.string().optional().describe("Destination CIDR to match"),
   interface: z17.string().optional().describe("Incoming interface to match"),
-  priority: z17.number().int().min(0).max(4294967295).optional().describe("Rule priority (0\u20134294967295)"),
+  priority: z17.number().int().min(0).max(4294967295).optional().describe(
+    "Unsupported: RouterOS 7 /routing/rule has no priority (rules apply in list order); add rejects it"
+  ),
   dryRun
 }).strict();
 function findRoutingRule(rules, srcAddress, dstAddress, iface, table) {
   return rules.find((r) => {
     const rec = r;
-    return sameRuleValue("src-address", rec["src-address"], srcAddress) && sameRuleValue("dst-address", rec["dst-address"], dstAddress) && sameRuleValue("interface", rec["interface"], iface) && rec.table === table;
+    return sameRuleValue("src-address", rec["src-address"], srcAddress) && sameRuleValue("dst-address", rec["dst-address"], dstAddress) && sameRuleValue("interface", rec["interface"], iface) && sameRuleValue("table", rec.table, table);
   });
 }
 var manageRoutingRuleTool = {
   name: "manage_routing_rule",
   title: "Manage Routing Rule",
-  description: "Add, remove, enable, or disable a policy routing rule. Idempotent by srcAddress+dstAddress+interface+table composite key. Supports dry-run mode.",
+  description: "Add, remove, enable, or disable a policy routing rule. Idempotent by srcAddress+dstAddress+interface+table composite key; a repeated add with an explicit, different ruleAction is a CONFLICT. Supports dry-run mode.",
   inputSchema: manageRoutingRuleInputSchema,
   annotations: {
     readOnlyHint: false,
@@ -4372,6 +4667,25 @@ var manageRoutingRuleTool = {
       "Managing routing rule"
     );
     try {
+      if (parsed.action === "add" && parsed.priority !== void 0) {
+        throw new MikroMCPError({
+          category: "VALIDATION" /* VALIDATION */,
+          code: "PRIORITY_UNSUPPORTED",
+          message: "RouterOS 7 routing rules have no priority; they apply in list order.",
+          details: { priority: parsed.priority },
+          recoverability: {
+            retryable: false,
+            suggestedAction: "Drop priority. Rule order is the position in /routing/rule."
+          }
+        });
+      }
+      if (parsed.action !== "add" && parsed.ruleAction !== void 0) {
+        throw ruleActionAddOnly(
+          parsed.action,
+          parsed.ruleAction,
+          "Drop ruleAction; the rule is identified by srcAddress, dstAddress, interface, and table."
+        );
+      }
       const allRules = await context.routerClient.get(ROUTING_RULE_PATH, {
         limit: void 0,
         offset: void 0
@@ -4396,16 +4710,34 @@ var manageRoutingRuleTool = {
           });
         }
         if (existing) {
+          if (parsed.ruleAction !== void 0 && existing.action !== parsed.ruleAction) {
+            throw new MikroMCPError({
+              category: "CONFLICT" /* CONFLICT */,
+              code: "ROUTING_RULE_CONFLICT",
+              message: `Routing rule for table "${parsed.table}" already exists with action "${existing.action ?? "(none)"}".`,
+              details: {
+                existing: { action: existing.action },
+                requested: { action: parsed.ruleAction }
+              },
+              recoverability: {
+                retryable: false,
+                suggestedAction: "Remove the existing routing rule first, then re-add it with the desired ruleAction.",
+                alternativeTools: ["manage_routing_rule with action=remove"]
+              }
+            });
+          }
           return {
             content: `Routing rule for table "${parsed.table}" already exists. No changes made.`,
             structuredContent: { action: "already_exists", rule: existing }
           };
         }
-        const body = { table: parsed.table };
+        const body = {
+          action: parsed.ruleAction ?? "lookup",
+          table: parsed.table
+        };
         if (parsed.srcAddress !== void 0) body["src-address"] = parsed.srcAddress;
         if (parsed.dstAddress !== void 0) body["dst-address"] = parsed.dstAddress;
         if (parsed.interface !== void 0) body["interface"] = parsed.interface;
-        if (parsed.priority !== void 0) body.priority = String(parsed.priority);
         if (parsed.dryRun) {
           const diff = Object.entries(body).map(([property, after]) => ({
             property,
@@ -10068,7 +10400,7 @@ var networkServicesTools = [
 // src/domain/tools/vlan-tools.ts
 import { z as z34 } from "zod";
 var log34 = createLogger("vlan-tools");
-function sanitizeComment4(comment) {
+function sanitizeComment3(comment) {
   if (comment === void 0) return void 0;
   return comment.replace(/[\x00-\x1f\x7f]/g, "");
 }
@@ -10099,7 +10431,7 @@ var manageVlanTool = {
   snapshotPaths: ["interface/vlan"],
   async handler(params, context) {
     const parsed = manageVlanInputSchema.parse(params);
-    const comment = sanitizeComment4(parsed.comment);
+    const comment = sanitizeComment3(parsed.comment);
     log34.info(
       { routerId: context.routerId, action: parsed.action, name: parsed.name },
       "Managing VLAN"
@@ -13443,7 +13775,7 @@ function resolveField(epKey, key2) {
 function resolveWireKey(field, wire) {
   return Object.values(field.keys).find((key2) => key2 in wire);
 }
-function validationError(code, message, suggestedAction) {
+function validationError2(code, message, suggestedAction) {
   return new MikroMCPError({
     category: "VALIDATION" /* VALIDATION */,
     code,
@@ -13461,7 +13793,7 @@ function coerceValue(field, value, existing) {
 function coerceScalar(field, value, existing) {
   if (typeof value === "boolean") {
     if (field.kind === Kind.BOOL) {
-      throw validationError(
+      throw validationError2(
         "SWOS_FIELD_SHAPE_MISMATCH",
         `Field "${field.name}" is a per-port bitmask, not a single flag.`,
         "Pass the mask as a number \u2014 e.g. 1023 for all 10 ports, 0 for none."
@@ -13473,7 +13805,7 @@ function coerceScalar(field, value, existing) {
   if (field.kind === Kind.OPTION) {
     const idx = (field.options ?? []).indexOf(String(value));
     if (idx < 0) {
-      throw validationError(
+      throw validationError2(
         "SWOS_INVALID_OPTION",
         `Invalid option "${String(value)}" for field "${field.name}".`,
         `Use one of: ${(field.options ?? []).join(", ")}.`
@@ -13488,7 +13820,7 @@ function assertShapeMatches(perPort, key2, next, existing) {
   if (existing === void 0) return;
   if (Array.isArray(next) && Array.isArray(existing)) {
     if (next.length === existing.length) return;
-    throw validationError(
+    throw validationError2(
       "SWOS_FIELD_SHAPE_MISMATCH",
       `Field "${key2}" holds ${existing.length} value(s) on the wire, but ${next.length} were given.`,
       `Pass exactly ${existing.length} value(s), or a single value to apply to all of them.`
@@ -13496,7 +13828,7 @@ function assertShapeMatches(perPort, key2, next, existing) {
   }
   if (!Array.isArray(next) && !Array.isArray(existing)) return;
   if (!Array.isArray(next) && perPort) return;
-  throw validationError(
+  throw validationError2(
     "SWOS_FIELD_SHAPE_MISMATCH",
     Array.isArray(next) ? `Field "${key2}" is a single per-port bitmask on the wire, but an array was given.` : `Field "${key2}" is a per-port array on the wire, but a single value was given.`,
     Array.isArray(next) ? "Pass the bitmask as one number (e.g. 1023 for all 10 ports)." : "Pass one value per port."
@@ -13527,7 +13859,7 @@ var writeSwosBlobTool = {
         const field = resolveField(parsed.endpoint, key2);
         const targetKey = field ? resolveWireKey(field, wire) : key2;
         if (targetKey === void 0 || !(targetKey in wire)) {
-          throw validationError(
+          throw validationError2(
             "SWOS_UNKNOWN_FIELD",
             field ? `Field "${key2}" is not present in ${parsed.endpoint} on this device \u2014 its firmware does not expose it.` : `Unknown field "${key2}" for endpoint ${parsed.endpoint}.`,
             `Read the endpoint first; only keys the device actually sent can be written: ${Object.keys(wire).join(", ")}.`
@@ -14199,11 +14531,19 @@ function formatToolResult(result) {
   };
 }
 function formatError(error) {
-  const hint = error.recoverability.suggestedAction;
-  const text = `Error [${error.category}]: ${error.message}${hint ? `
-Suggested action: ${hint}` : ""}`;
+  const { suggestedAction, alternativeTools, retryAfterMs } = error.recoverability;
+  const lines = [`Error [${error.category}]: ${error.message}`];
+  if (suggestedAction) lines.push(`Suggested action: ${suggestedAction}`);
+  lines.push(`Code: ${error.code}`);
+  if (error.details && Object.keys(error.details).length > 0) {
+    lines.push(`Details: ${JSON.stringify(error.details)}`);
+  }
+  if (alternativeTools && alternativeTools.length > 0) {
+    lines.push(`Alternative tools: ${alternativeTools.join(", ")}`);
+  }
+  if (retryAfterMs !== void 0) lines.push(`Retry after: ${retryAfterMs} ms`);
   return {
-    content: [{ type: "text", text }],
+    content: [{ type: "text", text: lines.join("\n") }],
     structuredContent: error.toJSON(),
     isError: true
   };
@@ -14763,7 +15103,12 @@ var listRoutersTool = {
   }
 };
 var FLEET_TOOL_NAMES = /* @__PURE__ */ new Set(["bulk_execute", "bulk_read", "check_router_health"]);
-var BULK_READ_EXCLUDED_TOOLS = /* @__PURE__ */ new Set(["ping", "traceroute", "torch", "bandwidth_test"]);
+var BULK_READ_EXCLUDED_TOOLS = /* @__PURE__ */ new Set([
+  "ping",
+  "traceroute",
+  "torch",
+  "bandwidth_test"
+]);
 function hasItems(list) {
   return Array.isArray(list) && list.length > 0;
 }
@@ -15459,7 +15804,7 @@ var ConnectionPool = class {
 };
 
 // src/version.ts
-var VERSION = "1.12.0";
+var VERSION = "1.13.0";
 
 // src/mcp/server.ts
 var SERVER_INSTRUCTIONS = [
@@ -15937,7 +16282,7 @@ import { existsSync as existsSync3, readFileSync as readFileSync7 } from "fs";
 import { homedir as homedir2 } from "os";
 import * as net from "net";
 import chalk from "chalk";
-var localVersion = "1.12.0";
+var localVersion = "1.13.0";
 var results = [];
 function ok(msg) {
   console.log(chalk.green("\u2705 ") + msg);
@@ -16682,7 +17027,7 @@ async function runInit() {
 }
 
 // src/cli/index.ts
-var program = new Command().name("mikromcp").description("MikroTik RouterOS MCP server").version("1.12.0");
+var program = new Command().name("mikromcp").description("MikroTik RouterOS MCP server").version("1.13.0");
 program.command("serve", { isDefault: true }).description("Start the MCP server (default)").action(runServe);
 program.command("doctor").description("Check config, connectivity, and permissions").action(runDoctor);
 program.command("init").description("Interactive setup wizard").action(runInit);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mikromcp",
-  "version": "1.12.0",
+  "version": "1.13.0",
   "mcpName": "io.github.AliKarami/mikromcp",
   "description": "Production-grade MCP server for MikroTik RouterOS",
   "type": "module",