mikromcp 1.13.0 → 1.13.1

package/README.md

@@ -12,7 +12,7 @@
 
 [![CI](https://github.com/AliKarami/MikroMCP/actions/workflows/ci.yml/badge.svg)](https://github.com/AliKarami/MikroMCP/actions/workflows/ci.yml)
 [![Release](https://github.com/AliKarami/MikroMCP/actions/workflows/release.yml/badge.svg)](https://github.com/AliKarami/MikroMCP/actions/workflows/release.yml)
-[![Version](https://img.shields.io/badge/version-v1.13.0-2DD4BF)](package.json)
+[![Version](https://img.shields.io/badge/version-v1.13.1-2DD4BF)](package.json)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Node.js >= 22](https://img.shields.io/badge/node-%3E%3D22-339933)](package.json)
 [![RouterOS 7.x](https://img.shields.io/badge/RouterOS-7.x-293239)](https://help.mikrotik.com/docs/display/ROS/REST+API)

package/config/routers.example.yaml

@@ -62,7 +62,7 @@ routers:
     # sshPort: 22                  # SSH port (default 22)
     # sshUsername: "automation"    # Optional SSH/SFTP username; defaults to REST username
     # sshPrivateKeyPath: "/home/user/.ssh/id_ed25519" # Absolute path; suppresses SSH/SFTP password auth
-    # sshFingerprint: "aabbcc..."  # Pin SSH host key SHA256 fingerprint (hex)
+    # sshFingerprint: "SHA256:..." # Pin the SSH host key: SHA256:<base64> as ssh-keygen -l prints it, or hex
     # cmdAllow:                    # Strict allow-list for run_command (see above)
     #   - "/ip/route/print*"
     # cmdDeny:                     # Additional deny patterns beyond builtins
@@ -85,4 +85,4 @@ routers:
   #     envPrefix: "ROUTER_EDGE02"
   #   tags: ["branch-office", "edge"]
   #   rosVersion: "7.12"
-  #   sshFingerprint: "aabbccddeeff..."
+  #   sshFingerprint: "SHA256:..."

package/dist/main.js

@@ -154,6 +154,7 @@ var UNREACHABLE_CODES = /* @__PURE__ */ new Set([
 var TIMEOUT_CODES = /* @__PURE__ */ new Set(["UND_ERR_HEADERS_TIMEOUT", "UND_ERR_BODY_TIMEOUT"]);
 var SSH_AUTH_LEVEL = "client-authentication";
 var SSH_TIMEOUT_LEVEL = "client-timeout";
+var SSH_HOST_KEY_MISMATCH = "SSH_HOST_KEY_MISMATCH";
 function defaultRecoverability(category) {
   switch (category) {
     case "VALIDATION" /* VALIDATION */:
@@ -294,6 +295,22 @@ function enrichError(error, context) {
       cause: error
     });
   }
+  if (typeof raw === "object" && raw !== null && raw.code === SSH_HOST_KEY_MISMATCH) {
+    return new MikroMCPError({
+      category: "ROUTER_AUTH_FAILED" /* ROUTER_AUTH_FAILED */,
+      code: SSH_HOST_KEY_MISMATCH,
+      message: rawMessage,
+      details: buildDetails(
+        { transport: "ssh", expected: raw.expected, actual: raw.actual },
+        context
+      ),
+      recoverability: {
+        retryable: false,
+        suggestedAction: "A reset, Netinstall or /ip ssh regenerate-host-key changes the router's host key; so does another device on that address, or an intercepted connection. Do not copy the presented fingerprint into routers.yaml unverified: have the operator confirm the router's key over a channel they trust, then update sshFingerprint and restart the server."
+      },
+      cause: error
+    });
+  }
   if (typeof raw === "object" && raw !== null && typeof raw.statusCode === "number") {
     const statusCode = raw.statusCode;
     let category2 = categoryFromStatus(statusCode);
@@ -535,6 +552,9 @@ import { z as z3 } from "zod";
 var NUMERIC_RE = /^-?\d+(\.\d+)?$/;
 var DURATION_RE = /^\d+[wdhms](\d+[wdhms])*$/;
 var FREE_TEXT_KEYS = /* @__PURE__ */ new Set(["comment", "text"]);
+function isVersionKey(key2) {
+  return key2 === "version" || key2.endsWith("-version") || key2.endsWith("-firmware");
+}
 function parseRouterOSValue(key2, value) {
   if (key2 === ".id" || FREE_TEXT_KEYS.has(key2)) {
     return value;
@@ -545,8 +565,9 @@ function parseRouterOSValue(key2, value) {
     return value;
   }
   if (NUMERIC_RE.test(value)) {
-    const num = Number(value);
     const isInteger = !value.includes(".");
+    if (!isInteger && isVersionKey(key2)) return value;
+    const num = Number(value);
     if (isInteger ? Number.isSafeInteger(num) : Number.isFinite(num)) {
       return num;
     }
@@ -14032,9 +14053,37 @@ function getCredentials(router) {
 }
 
 // src/adapter/ssh-client.ts
-import { createHash as createHash2 } from "crypto";
 import { readFileSync as readFileSync3 } from "fs";
 import { Client } from "ssh2";
+
+// src/adapter/ssh-host-key.ts
+import { createHash as createHash2 } from "crypto";
+function pinHostKey(fingerprint2) {
+  const expected = fingerprint2.toLowerCase();
+  let refused;
+  return {
+    hostVerifier: (key2) => {
+      const digest = createHash2("sha256").update(key2).digest();
+      if (digest.toString("hex") === expected) return true;
+      refused = digest;
+      return false;
+    },
+    connectionError: (err) => {
+      if (refused === void 0) return err;
+      const actual = refused.toString("hex");
+      const openssh = `SHA256:${refused.toString("base64").replace(/=+$/, "")}`;
+      return Object.assign(
+        new Error(
+          `SSH host key does not match sshFingerprint. Expected: ${expected}, got: ${actual} (${openssh})`,
+          { cause: err }
+        ),
+        { code: "SSH_HOST_KEY_MISMATCH", expected, actual }
+      );
+    }
+  };
+}
+
+// src/adapter/ssh-client.ts
 var SshClient = class {
   constructor(config, credentials, options) {
     this.config = config;
@@ -14052,6 +14101,7 @@ var SshClient = class {
     const privateKey = this.config.sshPrivateKeyPath ? readFileSync3(this.config.sshPrivateKeyPath) : void 0;
     return new Promise((resolve, reject) => {
       const conn = new Client();
+      const pin = this.config.sshFingerprint ? pinHostKey(this.config.sshFingerprint) : void 0;
       const chunks = [];
       let outputSize = 0;
       let truncated = false;
@@ -14111,7 +14161,7 @@ var SshClient = class {
           });
         });
       });
-      conn.on("error", (err) => cleanup(err));
+      conn.on("error", (err) => cleanup(pin ? pin.connectionError(err) : err));
       const connectOptions = {
         host: this.config.host,
         port: this.config.sshPort ?? 22,
@@ -14120,13 +14170,7 @@ var SshClient = class {
       };
       if (privateKey) connectOptions.privateKey = privateKey;
       else connectOptions.password = this.credentials.password;
-      if (this.config.sshFingerprint) {
-        const expected = this.config.sshFingerprint.toLowerCase();
-        connectOptions.hostVerifier = (key2) => {
-          const actual = createHash2("sha256").update(key2).digest("hex");
-          return actual === expected;
-        };
-      }
+      if (pin) connectOptions.hostVerifier = pin.hostVerifier;
       conn.connect(connectOptions);
     });
   }
@@ -14180,7 +14224,6 @@ var FtpClient = class {
 };
 
 // src/adapter/sftp-client.ts
-import { createHash as createHash3 } from "crypto";
 import { readFileSync as readFileSync4 } from "fs";
 import { Client as Client3 } from "ssh2";
 var SftpClient = class {
@@ -14194,6 +14237,7 @@ var SftpClient = class {
     const privateKey = this.config.sshPrivateKeyPath ? readFileSync4(this.config.sshPrivateKeyPath) : void 0;
     return new Promise((resolve, reject) => {
       const conn = new Client3();
+      const pin = this.config.sshFingerprint ? pinHostKey(this.config.sshFingerprint) : void 0;
       let settled = false;
       const cleanup = (err) => {
         if (settled) return;
@@ -14213,7 +14257,7 @@ var SftpClient = class {
           });
         });
       });
-      conn.on("error", (err) => cleanup(err));
+      conn.on("error", (err) => cleanup(pin ? pin.connectionError(err) : err));
       const connectOptions = {
         host: this.config.host,
         port: this.config.sshPort ?? 22,
@@ -14222,13 +14266,7 @@ var SftpClient = class {
       };
       if (privateKey) connectOptions.privateKey = privateKey;
       else connectOptions.password = this.credentials.password;
-      if (this.config.sshFingerprint) {
-        const expected = this.config.sshFingerprint.toLowerCase();
-        connectOptions.hostVerifier = (key2) => {
-          const actual = createHash3("sha256").update(key2).digest("hex");
-          return actual === expected;
-        };
-      }
+      if (pin) connectOptions.hostVerifier = pin.hostVerifier;
       conn.connect(connectOptions);
     });
   }
@@ -14365,13 +14403,13 @@ function getStdioIdentity(stdioIdentityName, registry) {
 }
 
 // src/middleware/confirmation.ts
-import { createHmac, createHash as createHash4, timingSafeEqual } from "crypto";
+import { createHmac, createHash as createHash3, timingSafeEqual } from "crypto";
 var CONFIRMATION_TTL_MS = 5 * 60 * 1e3;
 var BYPASS_ROLES = ["admin", "superadmin"];
 var usedTokens = /* @__PURE__ */ new Map();
 function computeParamHash(params) {
   const { confirmationToken: _, ...rest } = params;
-  return createHash4("sha256").update(JSON.stringify(rest)).digest("hex");
+  return createHash3("sha256").update(JSON.stringify(rest)).digest("hex");
 }
 function sign(tool, routerId2, identityId, paramHash, expiresAtMs, secret) {
   const payload = `${tool}|${routerId2}|${identityId}|${paramHash}|${expiresAtMs}`;
@@ -14947,7 +14985,7 @@ async function executeToolCall(tool, args, deps) {
 }
 
 // src/middleware/fleet-confirmation.ts
-import { createHmac as createHmac2, createHash as createHash5, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { createHmac as createHmac2, createHash as createHash4, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var CONFIRMATION_TTL_MS2 = 5 * 60 * 1e3;
 var processSecret = randomBytes2(32).toString("hex");
 var usedTokens2 = /* @__PURE__ */ new Map();
@@ -14959,7 +14997,7 @@ function fingerprint(args) {
     params: args.params,
     identityId: args.identityId
   });
-  return createHash5("sha256").update(payload).digest("hex");
+  return createHash4("sha256").update(payload).digest("hex");
 }
 function sign2(fp, expiresAtMs, secret) {
   const mac = createHmac2("sha256", secret).update(`${fp}|${expiresAtMs}`).digest("hex");
@@ -15577,6 +15615,14 @@ function privateKeyIsShared(path) {
   if (process.platform === "win32") return false;
   return (statSync(path).mode & 63) !== 0;
 }
+var SHA256_HEX_RE = /^[0-9a-f]{64}$/;
+var OPENSSH_SHA256_RE = /^SHA256:([A-Za-z0-9+/]{43})=?$/;
+function sshFingerprintHex(value) {
+  const openssh = OPENSSH_SHA256_RE.exec(value);
+  if (openssh) return Buffer.from(openssh[1], "base64").toString("hex");
+  const hex = value.replace(/:/g, "").toLowerCase();
+  return SHA256_HEX_RE.test(hex) ? hex : null;
+}
 
 // src/config/router-registry.ts
 var log51 = createLogger("router-registry");
@@ -15605,7 +15651,17 @@ var RouterConfigSchema = z49.object({
   sshPort: z49.number().int().min(1).max(65535).optional(),
   sshUsername: z49.string().min(1).optional(),
   sshPrivateKeyPath: z49.string().min(1).refine(isAbsolute, "sshPrivateKeyPath must be absolute").optional(),
-  sshFingerprint: z49.string().optional(),
+  // Stored as lowercase hex, the form SshClient compares. A malformed value can
+  // never match a host key, so it fails here instead of on every SSH call.
+  sshFingerprint: z49.string().transform((value, ctx) => {
+    const hex = sshFingerprintHex(value);
+    if (hex !== null) return hex;
+    ctx.addIssue({
+      code: z49.ZodIssueCode.custom,
+      message: "sshFingerprint must be a SHA-256 host-key fingerprint: 64 hex characters (colons allowed) or SHA256:<base64> as ssh-keygen -l prints it"
+    });
+    return z49.NEVER;
+  }).optional(),
   cmdAllow: z49.array(z49.string()).optional(),
   cmdDeny: z49.array(z49.string()).optional(),
   maintenanceWindows: z49.array(
@@ -15740,9 +15796,9 @@ ${keyIssues.join("\n")}`);
 };
 
 // src/adapter/connection-pool.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 function credentialHash(credentials) {
-  return createHash6("sha256").update(`${credentials.username}\0${credentials.password}`).digest("hex");
+  return createHash5("sha256").update(`${credentials.username}\0${credentials.password}`).digest("hex");
 }
 function createDeviceClient(config, credentials) {
   if (config.deviceType === "swos") {
@@ -15804,7 +15860,7 @@ var ConnectionPool = class {
 };
 
 // src/version.ts
-var VERSION = "1.13.0";
+var VERSION = "1.13.1";
 
 // src/mcp/server.ts
 var SERVER_INSTRUCTIONS = [
@@ -16112,7 +16168,7 @@ async function handleMcpRequest(pathname, req, res, url, port, maxBodyBytes, mak
 
 // src/config/identity-registry.ts
 import { readFileSync as readFileSync6, existsSync as existsSync2 } from "fs";
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 import { parse as parse2 } from "yaml";
 import { z as z50 } from "zod";
 import bcrypt from "bcryptjs";
@@ -16167,7 +16223,7 @@ ${issues}`);
     }));
   }
   async findIdentityByToken(token) {
-    const cacheKey = createHash7("sha256").update(token).digest("hex");
+    const cacheKey = createHash6("sha256").update(token).digest("hex");
     const toIdentity = (stored) => ({
       id: stored.id,
       role: stored.role,
@@ -16282,7 +16338,7 @@ import { existsSync as existsSync3, readFileSync as readFileSync7 } from "fs";
 import { homedir as homedir2 } from "os";
 import * as net from "net";
 import chalk from "chalk";
-var localVersion = "1.13.0";
+var localVersion = "1.13.1";
 var results = [];
 function ok(msg) {
   console.log(chalk.green("\u2705 ") + msg);
@@ -17027,7 +17083,7 @@ async function runInit() {
 }
 
 // src/cli/index.ts
-var program = new Command().name("mikromcp").description("MikroTik RouterOS MCP server").version("1.13.0");
+var program = new Command().name("mikromcp").description("MikroTik RouterOS MCP server").version("1.13.1");
 program.command("serve", { isDefault: true }).description("Start the MCP server (default)").action(runServe);
 program.command("doctor").description("Check config, connectivity, and permissions").action(runDoctor);
 program.command("init").description("Interactive setup wizard").action(runInit);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mikromcp",
-  "version": "1.13.0",
+  "version": "1.13.1",
   "mcpName": "io.github.AliKarami/mikromcp",
   "description": "Production-grade MCP server for MikroTik RouterOS",
   "type": "module",