mikromcp 1.2.0 → 1.3.0

package/README.md

@@ -12,12 +12,12 @@
 
 [![CI](https://github.com/AliKarami/MikroMCP/actions/workflows/ci.yml/badge.svg)](https://github.com/AliKarami/MikroMCP/actions/workflows/ci.yml)
 [![Release](https://github.com/AliKarami/MikroMCP/actions/workflows/release.yml/badge.svg)](https://github.com/AliKarami/MikroMCP/actions/workflows/release.yml)
-[![Version](https://img.shields.io/badge/version-v1.2.0-EA580C)](package.json)
+[![Version](https://img.shields.io/badge/version-v1.3.0-EA580C)](package.json)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Node.js >= 22](https://img.shields.io/badge/node-%3E%3D22-339933)](package.json)
 [![RouterOS 7.x](https://img.shields.io/badge/RouterOS-7.x-293239)](https://help.mikrotik.com/docs/display/ROS/REST+API)
 [![MCP Server](https://img.shields.io/badge/MCP-server-6f42c1)](https://modelcontextprotocol.io)
-[![Tools](https://img.shields.io/badge/MCP%20tools-82-0f766e)](#available-tools)
+[![Tools](https://img.shields.io/badge/MCP%20tools-88-0f766e)](#available-tools)
 [![MikroMCP MCP server](https://glama.ai/mcp/servers/AliKarami/MikroMCP/badges/score.svg)](https://glama.ai/mcp/servers/AliKarami/MikroMCP)
 
 MikroMCP exists because raw router CLI access is the wrong abstraction for AI agents. RouterOS is powerful, but asking an LLM to improvise shell commands against production network gear is risky. MikroMCP gives agents a controlled tool surface: strict schemas, idempotent writes, dry-run previews, per-router circuit breakers, retry policies, RBAC, audit logs, snapshots, and rollback-aware change workflows.
@@ -71,7 +71,7 @@ MikroMCP exists because raw router CLI access is the wrong abstraction for AI ag
 
 ### MCP Inspector
 
-![The 82 registered MikroMCP tools with schemas](docs/assets/mcp-inspector-tools.png)
+![The 88 registered MikroMCP tools with schemas](docs/assets/mcp-inspector-tools.png)
 
 ---
 
@@ -285,7 +285,7 @@ All settings can be placed in `~/.mikromcp/.env` or passed as environment variab
 
 ## Available Tools
 
-MikroMCP currently registers **82 MCP tools**.
+MikroMCP currently registers **88 MCP tools**.
 
 | Area                    | Tools                                                                                                                                                                                                     |
 | ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -295,6 +295,7 @@ MikroMCP currently registers **82 MCP tools**.
 | DHCP Servers & Pools    | `list_dhcp_servers`, `manage_dhcp_server`, `list_ip_pools`, `manage_ip_pool`                                                                                                                              |
 | DHCP Clients            | `list_dhcp_clients`, `manage_dhcp_client`                                                                                                                                                                 |
 | IP Services             | `list_ip_services`, `manage_ip_service`                                                                                                                                                                   |
+| PPPoE & OpenVPN         | `list_pppoe_clients`, `manage_pppoe_client`, `list_ovpn_clients`, `manage_ovpn_client`, `get_ovpn_server`, `manage_ovpn_server`                                                                           |
 | Routing                 | `list_routes`, `manage_route`, `list_routing_rules`, `manage_routing_rule`, `list_routing_tables`, `manage_routing_table`                                                                                 |
 | Routing protocols       | `list_bgp_peers`, `list_ospf_neighbors`                                                                                                                                                                   |
 | Firewall                | `list_firewall_rules`, `manage_firewall_rule`, `list_mangle_rules`, `manage_mangle_rule`, `list_address_list_entries`, `manage_address_list_entry`                                                        |
@@ -421,7 +422,7 @@ AI assistants can use MikroMCP to:
 | [Configuration](https://github.com/AliKarami/MikroMCP/wiki/Configuration)                             | Router registry, credentials, all environment variables    |
 | [Connecting to Claude Desktop](https://github.com/AliKarami/MikroMCP/wiki/Connecting-to-Claude-Desktop) | Register MikroMCP in Claude Desktop                      |
 | [Connecting to AI Assistants](https://github.com/AliKarami/MikroMCP/wiki/Connecting-to-AI-Assistants) | Claude Code, Cursor, Codex, HTTP/Docker/systemd            |
-| [Available Tools](https://github.com/AliKarami/MikroMCP/wiki/Available-Tools)                         | All 82 tools — parameters and example prompts              |
+| [Available Tools](https://github.com/AliKarami/MikroMCP/wiki/Available-Tools)                         | All 88 tools — parameters and example prompts              |
 | [Architecture](https://github.com/AliKarami/MikroMCP/wiki/Architecture)                               | System layers, request pipeline, auth model                |
 | [Error Handling](https://github.com/AliKarami/MikroMCP/wiki/Error-Handling)                           | Error categories, retry engine, circuit breaker            |
 | [Running](https://github.com/AliKarami/MikroMCP/wiki/Running)                                         | Run commands, HTTP transport, troubleshooting              |

package/dist/main.js

@@ -60,7 +60,7 @@ function loadAppConfig() {
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 
 // src/mcp/tool-registry.ts
-import { z as z36 } from "zod";
+import { z as z38 } from "zod";
 
 // src/domain/tools/system-tools.ts
 import { z } from "zod";
@@ -497,9 +497,9 @@ var listInterfacesTool = {
       const paginated = interfaces.slice(parsed.offset, parsed.offset + parsed.limit);
       const results2 = paginated.map((iface) => {
         const rec = iface;
-        const isRunning = rec.running === true || rec.running === "true";
+        const isRunning2 = rec.running === true || rec.running === "true";
         const isDisabled = rec.disabled === true || rec.disabled === "true";
-        const enriched = { status: isDisabled ? "disabled" : isRunning ? "up" : "down" };
+        const enriched = { status: isDisabled ? "disabled" : isRunning2 ? "up" : "down" };
         for (const [key2, value] of Object.entries(rec)) {
           if (parsed.includeCounters || !COUNTER_PROPS.includes(key2)) {
             enriched[key2] = value;
@@ -7775,8 +7775,708 @@ var manageIpServiceTool = {
 };
 var ipServiceTools = [listIpServicesTool, manageIpServiceTool];
 
-// src/domain/tools/fleet-tools.ts
+// src/domain/tools/pppoe-tools.ts
 import { z as z35 } from "zod";
+var log36 = createLogger("pppoe-tools");
+var PPPOE_PATH = "interface/pppoe-client";
+var listPppoeClientsInputSchema = z35.object({
+  routerId: z35.string().describe("Target router identifier from the router registry"),
+  interface: z35.string().optional().describe("Filter by parent interface name (exact match)"),
+  status: z35.enum(["connected", "disconnected", "all"]).default("all").describe("Filter by running status"),
+  limit: z35.number().int().min(1).max(500).default(100).describe("Maximum number of clients to return"),
+  offset: z35.number().int().min(0).default(0).describe("Offset for pagination")
+}).strict();
+function isRunning(record) {
+  return record.running === true || record.running === "true";
+}
+var listPppoeClientsTool = {
+  name: "list_pppoe_clients",
+  title: "List PPPoE Clients",
+  description: "List PPPoE client interfaces on a MikroTik router. Shows name, parent interface, ISP username, and connection status.",
+  inputSchema: listPppoeClientsInputSchema,
+  annotations: {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  async handler(params, context) {
+    const parsed = listPppoeClientsInputSchema.parse(params);
+    log36.info({ routerId: context.routerId }, "Listing PPPoE clients");
+    try {
+      const allClients = await context.routerClient.get(PPPOE_PATH, {
+        limit: void 0,
+        offset: void 0
+      });
+      let filtered = allClients;
+      if (parsed.interface) {
+        filtered = filtered.filter((c) => c.interface === parsed.interface);
+      }
+      if (parsed.status === "connected") {
+        filtered = filtered.filter((c) => isRunning(c));
+      } else if (parsed.status === "disconnected") {
+        filtered = filtered.filter((c) => !isRunning(c));
+      }
+      const total = filtered.length;
+      const clients = filtered.slice(parsed.offset, parsed.offset + parsed.limit);
+      const hasMore = parsed.offset + parsed.limit < total;
+      const lines = [
+        `PPPoE clients on ${context.routerId}: ${total} total, showing ${clients.length} (offset ${parsed.offset})`
+      ];
+      for (const c of clients) {
+        const name = c.name ?? "unknown";
+        const iface = c.interface ?? "unknown";
+        const user = c.user ?? "-";
+        const status = isRunning(c) ? "connected" : "disconnected";
+        lines.push(`  ${name}  [${iface}]  user=${user}  ${status}`);
+      }
+      return {
+        content: lines.join("\n"),
+        structuredContent: {
+          routerId: context.routerId,
+          clients,
+          total,
+          hasMore,
+          offset: parsed.offset,
+          limit: parsed.limit
+        }
+      };
+    } catch (err) {
+      throw enrichError(err, { routerId: context.routerId, tool: "list_pppoe_clients" });
+    }
+  }
+};
+var managePppoeClientInputSchema = z35.object({
+  routerId: z35.string().describe("Target router identifier from the router registry"),
+  action: z35.enum(["add", "update", "remove"]).describe("Action to perform"),
+  name: z35.string().describe("PPPoE client interface name \u2014 idempotency key (e.g. pppoe-wan)"),
+  interface: z35.string().optional().describe("Parent interface (required for add)"),
+  user: z35.string().optional().describe("PPPoE username (required for add)"),
+  password: z35.string().optional().describe("PPPoE password (never logged)"),
+  serviceName: z35.string().optional().describe("PPPoE service name filter (leave empty to match any)"),
+  addDefaultRoute: z35.boolean().optional().describe("Add default route via PPPoE (yes/no)"),
+  dialOnDemand: z35.boolean().optional().describe("Dial on demand instead of always-on (yes/no)"),
+  dryRun: z35.boolean().default(false).describe("Preview changes without applying")
+}).strict();
+var managePppoeClientTool = {
+  name: "manage_pppoe_client",
+  title: "Manage PPPoE Client",
+  description: "Add, update, or remove a PPPoE client interface. Idempotent by name: add returns already_exists if same name+interface+user exists; throws CONFLICT if same name exists with different config. Update builds a diff of changed fields and returns no_change when nothing differs. Password is always written when provided because RouterOS does not expose it in GET.",
+  inputSchema: managePppoeClientInputSchema,
+  annotations: {
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  snapshotPaths: [PPPOE_PATH],
+  async handler(params, context) {
+    const parsed = managePppoeClientInputSchema.parse(params);
+    log36.info({ routerId: context.routerId, action: parsed.action, name: parsed.name }, "Managing PPPoE client");
+    try {
+      const allClients = await context.routerClient.get(PPPOE_PATH, {
+        limit: void 0,
+        offset: void 0
+      });
+      const existing = allClients.find((c) => c.name === parsed.name);
+      if (parsed.action === "add") {
+        if (!parsed.interface) {
+          throw new MikroMCPError({
+            category: "VALIDATION" /* VALIDATION */,
+            code: "PPPOE_CLIENT_INTERFACE_REQUIRED",
+            message: "interface is required for action add.",
+            details: { name: parsed.name },
+            recoverability: {
+              retryable: false,
+              suggestedAction: "Provide the parent interface (e.g. ether1).",
+              alternativeTools: []
+            }
+          });
+        }
+        if (!parsed.user) {
+          throw new MikroMCPError({
+            category: "VALIDATION" /* VALIDATION */,
+            code: "PPPOE_CLIENT_USER_REQUIRED",
+            message: "user is required for action add.",
+            details: { name: parsed.name },
+            recoverability: {
+              retryable: false,
+              suggestedAction: "Provide the PPPoE username.",
+              alternativeTools: []
+            }
+          });
+        }
+        if (existing) {
+          const sameConfig = existing.interface === parsed.interface && existing.user === parsed.user;
+          if (sameConfig) {
+            return {
+              content: `PPPoE client "${parsed.name}" already exists with the same configuration. No changes made.`,
+              structuredContent: { action: "already_exists", client: existing }
+            };
+          }
+          throw new MikroMCPError({
+            category: "CONFLICT" /* CONFLICT */,
+            code: "PPPOE_CLIENT_CONFLICT",
+            message: `PPPoE client "${parsed.name}" already exists with a different configuration.`,
+            details: {
+              existing: { interface: existing.interface, user: existing.user },
+              requested: { interface: parsed.interface, user: parsed.user }
+            },
+            recoverability: {
+              retryable: false,
+              suggestedAction: "Remove the existing client first or use action update.",
+              alternativeTools: ["manage_pppoe_client"]
+            }
+          });
+        }
+        const diff = [
+          { property: "name", before: null, after: parsed.name },
+          { property: "interface", before: null, after: parsed.interface },
+          { property: "user", before: null, after: parsed.user }
+        ];
+        if (parsed.serviceName !== void 0) {
+          diff.push({ property: "service-name", before: null, after: parsed.serviceName });
+        }
+        if (parsed.addDefaultRoute !== void 0) {
+          diff.push({ property: "add-default-route", before: null, after: parsed.addDefaultRoute ? "yes" : "no" });
+        }
+        if (parsed.dialOnDemand !== void 0) {
+          diff.push({ property: "dial-on-demand", before: null, after: parsed.dialOnDemand ? "yes" : "no" });
+        }
+        if (parsed.dryRun) {
+          return {
+            content: `Dry run: Would create PPPoE client "${parsed.name}" on "${parsed.interface}".`,
+            structuredContent: { action: "dry_run", diff }
+          };
+        }
+        const body = {
+          name: parsed.name,
+          interface: parsed.interface,
+          user: parsed.user
+        };
+        if (parsed.password !== void 0) body.password = parsed.password;
+        if (parsed.serviceName !== void 0) body["service-name"] = parsed.serviceName;
+        if (parsed.addDefaultRoute !== void 0) body["add-default-route"] = parsed.addDefaultRoute ? "yes" : "no";
+        if (parsed.dialOnDemand !== void 0) body["dial-on-demand"] = parsed.dialOnDemand ? "yes" : "no";
+        const created = await context.routerClient.create(PPPOE_PATH, body);
+        log36.info({ name: parsed.name, id: created[".id"] }, "PPPoE client created");
+        return {
+          content: `Created PPPoE client "${parsed.name}" on "${parsed.interface}".`,
+          structuredContent: { action: "created", client: created }
+        };
+      }
+      if (parsed.action === "update") {
+        if (!existing) {
+          throw new MikroMCPError({
+            category: "NOT_FOUND" /* NOT_FOUND */,
+            code: "PPPOE_CLIENT_NOT_FOUND",
+            message: `PPPoE client "${parsed.name}" not found.`,
+            details: { name: parsed.name },
+            recoverability: {
+              retryable: false,
+              suggestedAction: "Verify with list_pppoe_clients.",
+              alternativeTools: ["list_pppoe_clients"]
+            }
+          });
+        }
+        const updates = {};
+        const diff = [];
+        if (parsed.interface !== void 0 && existing.interface !== parsed.interface) {
+          updates.interface = parsed.interface;
+          diff.push({ property: "interface", before: existing.interface, after: parsed.interface });
+        }
+        if (parsed.user !== void 0 && existing.user !== parsed.user) {
+          updates.user = parsed.user;
+          diff.push({ property: "user", before: existing.user, after: parsed.user });
+        }
+        if (parsed.serviceName !== void 0 && existing["service-name"] !== parsed.serviceName) {
+          updates["service-name"] = parsed.serviceName;
+          diff.push({ property: "service-name", before: existing["service-name"] ?? null, after: parsed.serviceName });
+        }
+        if (parsed.addDefaultRoute !== void 0) {
+          const desired = parsed.addDefaultRoute ? "yes" : "no";
+          if (existing["add-default-route"] !== desired) {
+            updates["add-default-route"] = desired;
+            diff.push({ property: "add-default-route", before: existing["add-default-route"] ?? null, after: desired });
+          }
+        }
+        if (parsed.dialOnDemand !== void 0) {
+          const desired = parsed.dialOnDemand ? "yes" : "no";
+          if (existing["dial-on-demand"] !== desired) {
+            updates["dial-on-demand"] = desired;
+            diff.push({ property: "dial-on-demand", before: existing["dial-on-demand"] ?? null, after: desired });
+          }
+        }
+        if (parsed.password !== void 0) {
+          updates.password = parsed.password;
+        }
+        const hasUpdates = Object.keys(updates).length > 0;
+        if (!hasUpdates) {
+          return {
+            content: `PPPoE client "${parsed.name}" already matches the requested configuration. No changes made.`,
+            structuredContent: { action: "no_change", client: existing }
+          };
+        }
+        if (parsed.dryRun) {
+          return {
+            content: `Dry run: Would update PPPoE client "${parsed.name}".`,
+            structuredContent: { action: "dry_run", diff }
+          };
+        }
+        await context.routerClient.update(PPPOE_PATH, existing[".id"], updates);
+        log36.info({ name: parsed.name }, "PPPoE client updated");
+        return {
+          content: `Updated PPPoE client "${parsed.name}".`,
+          structuredContent: { action: "updated", name: parsed.name, diff }
+        };
+      }
+      if (!existing) {
+        return {
+          content: `PPPoE client "${parsed.name}" not found. Nothing to remove.`,
+          structuredContent: { action: "not_found", name: parsed.name }
+        };
+      }
+      if (parsed.dryRun) {
+        return {
+          content: `Dry run: Would remove PPPoE client "${parsed.name}".`,
+          structuredContent: {
+            action: "dry_run",
+            diff: [{ property: "name", before: parsed.name, after: null }]
+          }
+        };
+      }
+      await context.routerClient.remove(PPPOE_PATH, existing[".id"]);
+      log36.info({ name: parsed.name }, "PPPoE client removed");
+      return {
+        content: `Removed PPPoE client "${parsed.name}".`,
+        structuredContent: { action: "removed", name: parsed.name, id: existing[".id"] }
+      };
+    } catch (err) {
+      if (err instanceof MikroMCPError) throw err;
+      throw enrichError(err, { routerId: context.routerId, tool: "manage_pppoe_client" });
+    }
+  }
+};
+var pppoeTools = [listPppoeClientsTool, managePppoeClientTool];
+
+// src/domain/tools/ovpn-tools.ts
+import { z as z36 } from "zod";
+var log37 = createLogger("ovpn-tools");
+var OVPN_CLIENT_PATH = "interface/ovpn-client";
+var OVPN_SERVER_PATH = "interface/ovpn-server/server";
+var listOvpnClientsInputSchema = z36.object({
+  routerId: z36.string().describe("Target router identifier from the router registry"),
+  limit: z36.number().int().min(1).max(500).default(100).describe("Maximum number of clients to return"),
+  offset: z36.number().int().min(0).default(0).describe("Offset for pagination")
+}).strict();
+var listOvpnClientsTool = {
+  name: "list_ovpn_clients",
+  title: "List OpenVPN Clients",
+  description: "List OpenVPN client interfaces on a MikroTik router. Shows name, remote server, and connection status.",
+  inputSchema: listOvpnClientsInputSchema,
+  annotations: {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  async handler(params, context) {
+    const parsed = listOvpnClientsInputSchema.parse(params);
+    log37.info({ routerId: context.routerId }, "Listing OpenVPN clients");
+    try {
+      const allClients = await context.routerClient.get(OVPN_CLIENT_PATH, {
+        limit: void 0,
+        offset: void 0
+      });
+      const total = allClients.length;
+      const clients = allClients.slice(parsed.offset, parsed.offset + parsed.limit);
+      const hasMore = parsed.offset + parsed.limit < total;
+      return {
+        content: `OpenVPN clients on ${context.routerId}: ${total} total, showing ${clients.length} (offset ${parsed.offset})`,
+        structuredContent: {
+          routerId: context.routerId,
+          clients,
+          total,
+          hasMore,
+          offset: parsed.offset,
+          limit: parsed.limit
+        }
+      };
+    } catch (err) {
+      throw enrichError(err, { routerId: context.routerId, tool: "list_ovpn_clients" });
+    }
+  }
+};
+var manageOvpnClientInputSchema = z36.object({
+  routerId: z36.string().describe("Target router identifier from the router registry"),
+  action: z36.enum(["add", "update", "remove"]).describe("Action to perform"),
+  name: z36.string().describe("OpenVPN client interface name \u2014 idempotency key"),
+  connectTo: z36.string().optional().describe("Remote server address (required for add)"),
+  port: z36.number().int().min(1).max(65535).optional().describe("Remote port number"),
+  mode: z36.enum(["ip", "ethernet"]).optional().describe("Tunnel mode"),
+  protocol: z36.enum(["tcp-client", "udp"]).optional().describe("Transport protocol"),
+  certificate: z36.string().optional().describe("Client certificate name"),
+  user: z36.string().optional().describe("VPN username"),
+  password: z36.string().optional().describe("VPN password (never logged)"),
+  dryRun: z36.boolean().default(false).describe("Preview changes without applying")
+}).strict();
+var manageOvpnClientTool = {
+  name: "manage_ovpn_client",
+  title: "Manage OpenVPN Client",
+  description: "Add, update, or remove an OpenVPN client interface. Idempotent by name: add returns already_exists if same name+connectTo exists; throws CONFLICT if same name exists with different connectTo. Update builds a diff of changed fields and returns no_change when nothing differs. Password is always written when provided because RouterOS does not expose it in GET.",
+  inputSchema: manageOvpnClientInputSchema,
+  annotations: {
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  snapshotPaths: [OVPN_CLIENT_PATH],
+  async handler(params, context) {
+    const parsed = manageOvpnClientInputSchema.parse(params);
+    log37.info({ routerId: context.routerId, action: parsed.action, name: parsed.name }, "Managing OpenVPN client");
+    try {
+      const allClients = await context.routerClient.get(OVPN_CLIENT_PATH, {
+        limit: void 0,
+        offset: void 0
+      });
+      const existing = allClients.find((c) => c.name === parsed.name);
+      if (parsed.action === "add") {
+        if (!parsed.connectTo) {
+          throw new MikroMCPError({
+            category: "VALIDATION" /* VALIDATION */,
+            code: "OVPN_CLIENT_CONNECT_TO_REQUIRED",
+            message: "connectTo is required for action add.",
+            details: { name: parsed.name },
+            recoverability: {
+              retryable: false,
+              suggestedAction: "Provide the remote server address.",
+              alternativeTools: []
+            }
+          });
+        }
+        if (existing) {
+          const sameConfig = existing["connect-to"] === parsed.connectTo;
+          if (sameConfig) {
+            return {
+              content: `OpenVPN client "${parsed.name}" already exists with the same configuration. No changes made.`,
+              structuredContent: { action: "already_exists", client: existing }
+            };
+          }
+          throw new MikroMCPError({
+            category: "CONFLICT" /* CONFLICT */,
+            code: "OVPN_CLIENT_CONFLICT",
+            message: `OpenVPN client "${parsed.name}" already exists with a different configuration.`,
+            details: {
+              existing: { "connect-to": existing["connect-to"] },
+              requested: { "connect-to": parsed.connectTo }
+            },
+            recoverability: {
+              retryable: false,
+              suggestedAction: "Remove the existing client first or use action update.",
+              alternativeTools: ["manage_ovpn_client"]
+            }
+          });
+        }
+        const diff = [
+          { property: "name", before: null, after: parsed.name },
+          { property: "connect-to", before: null, after: parsed.connectTo }
+        ];
+        if (parsed.dryRun) {
+          return {
+            content: `Dry run: Would create OpenVPN client "${parsed.name}" connecting to "${parsed.connectTo}".`,
+            structuredContent: { action: "dry_run", diff }
+          };
+        }
+        const body = {
+          name: parsed.name,
+          "connect-to": parsed.connectTo
+        };
+        if (parsed.port !== void 0) body.port = String(parsed.port);
+        if (parsed.mode !== void 0) body.mode = parsed.mode;
+        if (parsed.protocol !== void 0) body.protocol = parsed.protocol;
+        if (parsed.certificate !== void 0) body.certificate = parsed.certificate;
+        if (parsed.user !== void 0) body.user = parsed.user;
+        if (parsed.password !== void 0) body.password = parsed.password;
+        const created = await context.routerClient.create(OVPN_CLIENT_PATH, body);
+        log37.info({ name: parsed.name, id: created[".id"] }, "OpenVPN client created");
+        return {
+          content: `Created OpenVPN client "${parsed.name}" connecting to "${parsed.connectTo}".`,
+          structuredContent: { action: "created", client: created }
+        };
+      }
+      if (parsed.action === "update") {
+        if (!existing) {
+          throw new MikroMCPError({
+            category: "NOT_FOUND" /* NOT_FOUND */,
+            code: "OVPN_CLIENT_NOT_FOUND",
+            message: `OpenVPN client "${parsed.name}" not found.`,
+            details: { name: parsed.name },
+            recoverability: {
+              retryable: false,
+              suggestedAction: "Verify with list_ovpn_clients.",
+              alternativeTools: ["list_ovpn_clients"]
+            }
+          });
+        }
+        const updates = {};
+        const diff = [];
+        if (parsed.connectTo !== void 0 && existing["connect-to"] !== parsed.connectTo) {
+          updates["connect-to"] = parsed.connectTo;
+          diff.push({ property: "connect-to", before: existing["connect-to"] ?? null, after: parsed.connectTo });
+        }
+        if (parsed.port !== void 0 && existing.port !== String(parsed.port)) {
+          updates.port = String(parsed.port);
+          diff.push({ property: "port", before: existing.port ?? null, after: String(parsed.port) });
+        }
+        if (parsed.mode !== void 0 && existing.mode !== parsed.mode) {
+          updates.mode = parsed.mode;
+          diff.push({ property: "mode", before: existing.mode ?? null, after: parsed.mode });
+        }
+        if (parsed.protocol !== void 0 && existing.protocol !== parsed.protocol) {
+          updates.protocol = parsed.protocol;
+          diff.push({ property: "protocol", before: existing.protocol ?? null, after: parsed.protocol });
+        }
+        if (parsed.certificate !== void 0 && existing.certificate !== parsed.certificate) {
+          updates.certificate = parsed.certificate;
+          diff.push({ property: "certificate", before: existing.certificate ?? null, after: parsed.certificate });
+        }
+        if (parsed.user !== void 0 && existing.user !== parsed.user) {
+          updates.user = parsed.user;
+          diff.push({ property: "user", before: existing.user ?? null, after: parsed.user });
+        }
+        if (parsed.password !== void 0) {
+          updates.password = parsed.password;
+        }
+        const hasUpdates = Object.keys(updates).length > 0;
+        if (!hasUpdates) {
+          return {
+            content: `OpenVPN client "${parsed.name}" already matches the requested configuration. No changes made.`,
+            structuredContent: { action: "no_change", client: existing }
+          };
+        }
+        if (parsed.dryRun) {
+          return {
+            content: `Dry run: Would update OpenVPN client "${parsed.name}".`,
+            structuredContent: { action: "dry_run", diff }
+          };
+        }
+        await context.routerClient.update(OVPN_CLIENT_PATH, existing[".id"], updates);
+        log37.info({ name: parsed.name }, "OpenVPN client updated");
+        return {
+          content: `Updated OpenVPN client "${parsed.name}".`,
+          structuredContent: { action: "updated", name: parsed.name, diff }
+        };
+      }
+      if (!existing) {
+        return {
+          content: `OpenVPN client "${parsed.name}" not found. Nothing to remove.`,
+          structuredContent: { action: "not_found", name: parsed.name }
+        };
+      }
+      if (parsed.dryRun) {
+        return {
+          content: `Dry run: Would remove OpenVPN client "${parsed.name}".`,
+          structuredContent: {
+            action: "dry_run",
+            diff: [{ property: "name", before: parsed.name, after: null }]
+          }
+        };
+      }
+      await context.routerClient.remove(OVPN_CLIENT_PATH, existing[".id"]);
+      log37.info({ name: parsed.name }, "OpenVPN client removed");
+      return {
+        content: `Removed OpenVPN client "${parsed.name}".`,
+        structuredContent: { action: "removed", name: parsed.name, id: existing[".id"] }
+      };
+    } catch (err) {
+      if (err instanceof MikroMCPError) throw err;
+      throw enrichError(err, { routerId: context.routerId, tool: "manage_ovpn_client" });
+    }
+  }
+};
+var getOvpnServerInputSchema = z36.object({
+  routerId: z36.string().describe("Target router identifier from the router registry")
+}).strict();
+function fetchOvpnServer(allRecords, routerId) {
+  if (allRecords.length === 0) {
+    throw new MikroMCPError({
+      category: "NOT_FOUND" /* NOT_FOUND */,
+      code: "OVPN_SERVER_NOT_FOUND",
+      message: "OpenVPN server not found. The OpenVPN package may not be installed on this router.",
+      details: { routerId },
+      recoverability: {
+        retryable: false,
+        suggestedAction: "Install the OpenVPN package via manage_package.",
+        alternativeTools: ["list_packages", "manage_package"]
+      }
+    });
+  }
+  return allRecords[0];
+}
+var getOvpnServerTool = {
+  name: "get_ovpn_server",
+  title: "Get OpenVPN Server",
+  description: "Get the OpenVPN server configuration on a MikroTik router. Throws NOT_FOUND if the OpenVPN package is not installed.",
+  inputSchema: getOvpnServerInputSchema,
+  annotations: {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  async handler(params, context) {
+    const parsed = getOvpnServerInputSchema.parse(params);
+    log37.info({ routerId: context.routerId }, "Getting OpenVPN server configuration");
+    try {
+      const records = await context.routerClient.get(OVPN_SERVER_PATH, {
+        limit: void 0,
+        offset: void 0
+      });
+      const server = fetchOvpnServer(records, parsed.routerId);
+      return {
+        content: `OpenVPN server on ${context.routerId}: enabled=${server.enabled}, port=${server.port}, protocol=${server.protocol}`,
+        structuredContent: { routerId: context.routerId, server }
+      };
+    } catch (err) {
+      if (err instanceof MikroMCPError) throw err;
+      throw enrichError(err, { routerId: context.routerId, tool: "get_ovpn_server" });
+    }
+  }
+};
+var manageOvpnServerInputSchema = z36.object({
+  routerId: z36.string().describe("Target router identifier from the router registry"),
+  action: z36.enum(["enable", "disable", "set"]).describe("Action to perform"),
+  port: z36.number().int().min(1).max(65535).optional().describe("Listening port (set action only)"),
+  mode: z36.enum(["ip", "ethernet"]).optional().describe("Tunnel mode (set action only)"),
+  protocol: z36.enum(["tcp-server", "udp"]).optional().describe("Transport protocol (set action only)"),
+  certificate: z36.string().optional().describe("Server certificate name (set action only)"),
+  cipher: z36.enum(["blowfish128", "aes128-cbc", "aes192-cbc", "aes256-cbc", "aes128-gcm", "aes256-gcm", "none"]).optional().describe("Encryption cipher (set action only)"),
+  auth: z36.enum(["md5", "sha1", "sha256", "sha512", "null"]).optional().describe("Authentication algorithm (set action only)"),
+  dryRun: z36.boolean().default(false).describe("Preview changes without applying")
+}).strict();
+var manageOvpnServerTool = {
+  name: "manage_ovpn_server",
+  title: "Manage OpenVPN Server",
+  description: "Enable, disable, or configure the OpenVPN server on a MikroTik router. The server is a singleton \u2014 there is only one per router. Throws NOT_FOUND if the OpenVPN package is not installed. For set action, at least one configuration field must be provided.",
+  inputSchema: manageOvpnServerInputSchema,
+  annotations: {
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: true,
+    openWorldHint: false
+  },
+  snapshotPaths: [OVPN_SERVER_PATH],
+  async handler(params, context) {
+    const parsed = manageOvpnServerInputSchema.parse(params);
+    log37.info({ routerId: context.routerId, action: parsed.action }, "Managing OpenVPN server");
+    try {
+      const records = await context.routerClient.get(OVPN_SERVER_PATH, {
+        limit: void 0,
+        offset: void 0
+      });
+      const server = fetchOvpnServer(records, parsed.routerId);
+      const serverId = server[".id"];
+      if (parsed.action === "enable" || parsed.action === "disable") {
+        const desiredEnabled = parsed.action === "enable";
+        const currentEnabled = server.enabled === "yes";
+        if (desiredEnabled === currentEnabled) {
+          return {
+            content: `OpenVPN server on ${context.routerId} is already ${parsed.action}d. No changes made.`,
+            structuredContent: { action: "no_change", server }
+          };
+        }
+        if (parsed.dryRun) {
+          return {
+            content: `Dry run: Would ${parsed.action} OpenVPN server on ${context.routerId}.`,
+            structuredContent: {
+              action: "dry_run",
+              diff: [{ property: "enabled", before: server.enabled, after: desiredEnabled ? "yes" : "no" }]
+            }
+          };
+        }
+        await context.routerClient.update(OVPN_SERVER_PATH, serverId, {
+          enabled: desiredEnabled ? "yes" : "no"
+        });
+        log37.info({ routerId: context.routerId, action: parsed.action }, "OpenVPN server updated");
+        return {
+          content: `OpenVPN server on ${context.routerId} ${parsed.action}d.`,
+          structuredContent: { action: parsed.action === "enable" ? "enabled" : "disabled", server }
+        };
+      }
+      const hasFields = parsed.port !== void 0 || parsed.mode !== void 0 || parsed.protocol !== void 0 || parsed.certificate !== void 0 || parsed.cipher !== void 0 || parsed.auth !== void 0;
+      if (!hasFields) {
+        throw new MikroMCPError({
+          category: "VALIDATION" /* VALIDATION */,
+          code: "OVPN_SERVER_NO_FIELDS",
+          message: "At least one field must be provided for action set.",
+          details: {},
+          recoverability: {
+            retryable: false,
+            suggestedAction: "Provide at least one of: port, mode, protocol, certificate, cipher, auth.",
+            alternativeTools: []
+          }
+        });
+      }
+      const updates = {};
+      const diff = [];
+      if (parsed.port !== void 0 && server.port !== String(parsed.port)) {
+        updates.port = String(parsed.port);
+        diff.push({ property: "port", before: server.port ?? null, after: String(parsed.port) });
+      }
+      if (parsed.mode !== void 0 && server.mode !== parsed.mode) {
+        updates.mode = parsed.mode;
+        diff.push({ property: "mode", before: server.mode ?? null, after: parsed.mode });
+      }
+      if (parsed.protocol !== void 0 && server.protocol !== parsed.protocol) {
+        updates.protocol = parsed.protocol;
+        diff.push({ property: "protocol", before: server.protocol ?? null, after: parsed.protocol });
+      }
+      if (parsed.certificate !== void 0 && server.certificate !== parsed.certificate) {
+        updates.certificate = parsed.certificate;
+        diff.push({ property: "certificate", before: server.certificate ?? null, after: parsed.certificate });
+      }
+      if (parsed.cipher !== void 0 && server.cipher !== parsed.cipher) {
+        updates.cipher = parsed.cipher;
+        diff.push({ property: "cipher", before: server.cipher ?? null, after: parsed.cipher });
+      }
+      if (parsed.auth !== void 0 && server.auth !== parsed.auth) {
+        updates.auth = parsed.auth;
+        diff.push({ property: "auth", before: server.auth ?? null, after: parsed.auth });
+      }
+      if (Object.keys(updates).length === 0) {
+        return {
+          content: `OpenVPN server on ${context.routerId} already matches the requested configuration. No changes made.`,
+          structuredContent: { action: "no_change", server }
+        };
+      }
+      if (parsed.dryRun) {
+        return {
+          content: `Dry run: Would update OpenVPN server on ${context.routerId}.`,
+          structuredContent: { action: "dry_run", diff }
+        };
+      }
+      await context.routerClient.update(OVPN_SERVER_PATH, serverId, updates);
+      log37.info({ routerId: context.routerId }, "OpenVPN server configuration updated");
+      return {
+        content: `Updated OpenVPN server configuration on ${context.routerId}.`,
+        structuredContent: { action: "updated", diff }
+      };
+    } catch (err) {
+      if (err instanceof MikroMCPError) throw err;
+      throw enrichError(err, { routerId: context.routerId, tool: "manage_ovpn_server" });
+    }
+  }
+};
+var ovpnTools = [
+  listOvpnClientsTool,
+  manageOvpnClientTool,
+  getOvpnServerTool,
+  manageOvpnServerTool
+];
+
+// src/domain/tools/fleet-tools.ts
+import { z as z37 } from "zod";
 
 // src/middleware/authz.ts
 function matchesPattern(name, pattern) {
@@ -7944,7 +8644,7 @@ var SshClient = class {
 // src/adapter/ftp-client.ts
 import { Client as Client2 } from "basic-ftp";
 import { Readable } from "stream";
-var log36 = createLogger("ftp-client");
+var log38 = createLogger("ftp-client");
 var FtpClient = class {
   #host;
   #port;
@@ -7957,7 +8657,7 @@ var FtpClient = class {
     this.#password = password;
   }
   async upload(remoteName, content) {
-    log36.info({ host: this.#host, remoteName }, "Uploading file via FTP");
+    log38.info({ host: this.#host, remoteName }, "Uploading file via FTP");
     const client = new Client2();
     try {
       await client.access({
@@ -7967,7 +8667,7 @@ var FtpClient = class {
         password: this.#password
       });
       await client.uploadFrom(Readable.from(Buffer.from(content, "utf-8")), remoteName);
-      log36.info({ host: this.#host, remoteName }, "FTP upload complete");
+      log38.info({ host: this.#host, remoteName }, "FTP upload complete");
     } finally {
       client.close();
     }
@@ -8075,17 +8775,17 @@ function checkFleetConfirmation(args, secret) {
 }
 
 // src/domain/tools/fleet-tools.ts
-var log37 = createLogger("fleet-tools");
-var checkHealthInputSchema = z35.object({
-  routerId: z35.string().describe("Target router to health-check")
+var log39 = createLogger("fleet-tools");
+var checkHealthInputSchema = z37.object({
+  routerId: z37.string().describe("Target router to health-check")
 }).strict();
-var bulkExecuteInputSchema = z35.object({
-  toolName: z35.string().describe("Name of the tool to fan out (must be a single-router tool)"),
-  routerIds: z35.array(z35.string()).optional().describe("Explicit list of router IDs to target"),
-  tags: z35.array(z35.string()).optional().describe("Target all routers with ALL of these tags (mutually exclusive with routerIds)"),
-  params: z35.record(z35.string(), z35.unknown()).describe("Params to pass to the tool (omit routerId \u2014 injected per router)"),
-  concurrency: z35.number().int().min(1).max(20).default(5).describe("Max simultaneous router calls"),
-  confirmationToken: z35.string().optional().describe(
+var bulkExecuteInputSchema = z37.object({
+  toolName: z37.string().describe("Name of the tool to fan out (must be a single-router tool)"),
+  routerIds: z37.array(z37.string()).optional().describe("Explicit list of router IDs to target"),
+  tags: z37.array(z37.string()).optional().describe("Target all routers with ALL of these tags (mutually exclusive with routerIds)"),
+  params: z37.record(z37.string(), z37.unknown()).describe("Params to pass to the tool (omit routerId \u2014 injected per router)"),
+  concurrency: z37.number().int().min(1).max(20).default(5).describe("Max simultaneous router calls"),
+  confirmationToken: z37.string().optional().describe(
     "Fleet confirmation token from a prior APPROVAL_REQUIRED response. Required to fan out a destructive tool."
   )
 }).strict();
@@ -8104,7 +8804,7 @@ function createFleetTools(baseTools2) {
     },
     async handler(params, context) {
       checkHealthInputSchema.parse(params);
-      log37.info({ routerId: context.routerId }, "Checking router health");
+      log39.info({ routerId: context.routerId }, "Checking router health");
       const startMs = Date.now();
       try {
         const resources = await context.routerClient.get("system/resource");
@@ -8166,7 +8866,7 @@ function createFleetTools(baseTools2) {
           }
         });
       }
-      log37.info(
+      log39.info(
         { toolName: parsed.toolName, concurrency: parsed.concurrency },
         "bulk_execute invoked"
       );
@@ -8213,7 +8913,7 @@ function createFleetTools(baseTools2) {
           try {
             resolved.push(context.routerRegistry.getRouter(id));
           } catch {
-            log37.warn({ routerId: id }, "bulk_execute: router not found");
+            log39.warn({ routerId: id }, "bulk_execute: router not found");
             preErrors.push({
               routerId: id,
               status: "error",
@@ -8391,7 +9091,9 @@ var baseTools = [
   ...networkServicesTools,
   ...vlanTools,
   ...dhcpClientTools,
-  ...ipServiceTools
+  ...ipServiceTools,
+  ...pppoeTools,
+  ...ovpnTools
 ];
 var allTools = [
   ...baseTools,
@@ -8790,7 +9492,7 @@ var CircuitBreaker = class {
 };
 
 // src/mcp/tool-executor.ts
-var log38 = createLogger("tool-executor");
+var log40 = createLogger("tool-executor");
 async function executeToolCall(tool, args, deps) {
   const { registry, pool, circuitBreakers, config, identityRegistry } = deps;
   const correlationId = nanoid4();
@@ -8886,9 +9588,9 @@ async function executeToolCall(tool, args, deps) {
           try {
             const meta = await takeSnapshot(toolContext.routerClient, routerId, path, config.snapshotDir);
             snapshotIds.push(meta.id);
-            log38.debug({ snapshotId: meta.id, path }, "Snapshot taken");
+            log40.debug({ snapshotId: meta.id, path }, "Snapshot taken");
           } catch (err) {
-            log38.warn({ err, path, routerId }, "Snapshot failed \u2014 proceeding without snapshot");
+            log40.warn({ err, path, routerId }, "Snapshot failed \u2014 proceeding without snapshot");
           }
         }
       }
@@ -8930,7 +9632,7 @@ async function executeToolCall(tool, args, deps) {
           durationMs: Date.now() - startMs
         }, config.auditLogPath);
       }
-      log38.info({ tool: tool.name, routerId, correlationId }, "Tool executed successfully");
+      log40.info({ tool: tool.name, routerId, correlationId }, "Tool executed successfully");
       recordToolCall(tool.name, "success");
       return formatToolResult(result);
     } catch (err) {
@@ -8939,7 +9641,7 @@ async function executeToolCall(tool, args, deps) {
         const failedRouterId = args.routerId;
         if (failedRouterId) {
           pool.removeClient(failedRouterId);
-          log38.info({ routerId: failedRouterId }, "Evicted pooled client after auth failure");
+          log40.info({ routerId: failedRouterId }, "Evicted pooled client after auth failure");
         }
       }
       if (journalId) {
@@ -8969,7 +9671,7 @@ async function executeToolCall(tool, args, deps) {
           durationMs: Date.now() - startMs
         }, config.auditLogPath);
       }
-      log38.error({ err: error, tool: tool.name, correlationId }, "Tool execution failed");
+      log40.error({ err: error, tool: tool.name, correlationId }, "Tool execution failed");
       recordToolCall(tool.name, "error");
       return formatError(error);
     }
@@ -8977,12 +9679,12 @@ async function executeToolCall(tool, args, deps) {
 }
 
 // src/mcp/tool-registry.ts
-var log39 = createLogger("tool-registry");
+var log41 = createLogger("tool-registry");
 function registerAllTools(server, registry, pool, circuitBreakers, config, identityRegistry) {
   const deps = { registry, pool, circuitBreakers, config, identityRegistry };
   for (const tool of allTools) {
     const registrationSchema = tool.annotations.destructiveHint ? tool.inputSchema.extend({
-      confirmationToken: z36.string().optional().describe(
+      confirmationToken: z38.string().optional().describe(
         "Token from a prior APPROVAL_REQUIRED response. Re-submit the identical call with this token to confirm the destructive action."
       )
     }) : tool.inputSchema;
@@ -8996,56 +9698,56 @@ function registerAllTools(server, registry, pool, circuitBreakers, config, ident
       },
       (args) => executeToolCall(tool, args, deps)
     );
-    log39.debug({ tool: tool.name }, "Registered tool");
+    log41.debug({ tool: tool.name }, "Registered tool");
   }
-  log39.info({ count: allTools.length }, "All tools registered");
+  log41.info({ count: allTools.length }, "All tools registered");
 }
 
 // src/config/router-registry.ts
 import { readFileSync as readFileSync2, existsSync } from "fs";
 import { parse } from "yaml";
-import { z as z37 } from "zod";
-var log40 = createLogger("router-registry");
-var RouterConfigSchema = z37.object({
-  host: z37.string().min(1, "host is required"),
-  port: z37.number().int().min(1).max(65535),
-  tls: z37.object({
-    enabled: z37.boolean(),
-    rejectUnauthorized: z37.boolean(),
-    ca: z37.string().optional(),
-    fingerprint: z37.string().optional()
+import { z as z39 } from "zod";
+var log42 = createLogger("router-registry");
+var RouterConfigSchema = z39.object({
+  host: z39.string().min(1, "host is required"),
+  port: z39.number().int().min(1).max(65535),
+  tls: z39.object({
+    enabled: z39.boolean(),
+    rejectUnauthorized: z39.boolean(),
+    ca: z39.string().optional(),
+    fingerprint: z39.string().optional()
   }).strict(),
-  credentials: z37.object({
-    source: z37.enum(["env", "vault"]),
-    envPrefix: z37.string().optional(),
-    vaultPath: z37.string().optional()
+  credentials: z39.object({
+    source: z39.enum(["env", "vault"]),
+    envPrefix: z39.string().optional(),
+    vaultPath: z39.string().optional()
   }).strict(),
-  tags: z37.array(z37.string()).default([]),
-  rosVersion: z37.string().min(1),
-  sshPort: z37.number().int().min(1).max(65535).optional(),
-  sshFingerprint: z37.string().optional(),
-  cmdAllow: z37.array(z37.string()).optional(),
-  cmdDeny: z37.array(z37.string()).optional(),
-  maintenanceWindows: z37.array(
-    z37.object({
-      days: z37.array(
-        z37.enum(["Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun"])
+  tags: z39.array(z39.string()).default([]),
+  rosVersion: z39.string().min(1),
+  sshPort: z39.number().int().min(1).max(65535).optional(),
+  sshFingerprint: z39.string().optional(),
+  cmdAllow: z39.array(z39.string()).optional(),
+  cmdDeny: z39.array(z39.string()).optional(),
+  maintenanceWindows: z39.array(
+    z39.object({
+      days: z39.array(
+        z39.enum(["Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun"])
       ),
-      startTime: z37.string().regex(/^\d{2}:\d{2}$/, "startTime must be HH:MM"),
-      endTime: z37.string().regex(/^\d{2}:\d{2}$/, "endTime must be HH:MM"),
-      timezone: z37.string().min(1)
+      startTime: z39.string().regex(/^\d{2}:\d{2}$/, "startTime must be HH:MM"),
+      endTime: z39.string().regex(/^\d{2}:\d{2}$/, "endTime must be HH:MM"),
+      timezone: z39.string().min(1)
     }).strict()
   ).optional()
 }).strict();
-var ConfigFileSchema = z37.object({
-  routers: z37.record(z37.string(), RouterConfigSchema)
+var ConfigFileSchema = z39.object({
+  routers: z39.record(z39.string(), RouterConfigSchema)
 }).strict();
 var RouterRegistry = class {
   routers;
   constructor(configPath) {
     this.routers = /* @__PURE__ */ new Map();
     if (!existsSync(configPath)) {
-      log40.warn({ configPath }, "Router config file not found; starting with empty registry");
+      log42.warn({ configPath }, "Router config file not found; starting with empty registry");
       return;
     }
     const raw = readFileSync2(configPath, "utf-8");
@@ -9059,14 +9761,14 @@ ${issues}`);
     for (const [id, config] of Object.entries(result.data.routers)) {
       const routerConfig = { ...config, id };
       if (routerConfig.tls.enabled && !routerConfig.tls.rejectUnauthorized) {
-        log40.warn(
+        log42.warn(
           { routerId: id },
           "TLS certificate validation is DISABLED (rejectUnauthorized=false). Set tls.fingerprint to pin the server certificate instead."
         );
       }
       this.routers.set(id, routerConfig);
     }
-    log40.info({ count: this.routers.size }, "Loaded routers from config");
+    log42.info({ count: this.routers.size }, "Loaded routers from config");
   }
   getRouter(id) {
     const router = this.routers.get(id);
@@ -9351,7 +10053,7 @@ var ConnectionPool = class {
 };
 
 // src/version.ts
-var VERSION = "1.2.0";
+var VERSION = "1.3.0";
 
 // src/mcp/server.ts
 function createServerFactory(config, identityRegistry) {
@@ -9381,7 +10083,7 @@ import { randomUUID } from "crypto";
 import { createServer } from "http";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
-var log41 = createLogger("transport-http");
+var log43 = createLogger("transport-http");
 var BodyTooLargeError = class extends Error {
   constructor() {
     super("Request body exceeds maximum allowed size");
@@ -9473,7 +10175,7 @@ async function connectHttp(makeServer, config, identityRegistry) {
       return;
     }
     if (!checkRateLimit(ip)) {
-      log41.warn({ ip }, "Rate limit exceeded");
+      log43.warn({ ip }, "Rate limit exceeded");
       res.writeHead(429, { "Content-Type": "application/json" });
       res.end(JSON.stringify({ error: "Too many requests. Retry after 60 seconds." }));
       return;
@@ -9514,7 +10216,7 @@ async function connectHttp(makeServer, config, identityRegistry) {
         }
         return;
       }
-      log41.error({ err }, "HTTP transport error");
+      log43.error({ err }, "HTTP transport error");
       if (!res.headersSent) {
         res.writeHead(500, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ error: "Internal server error" }));
@@ -9524,7 +10226,7 @@ async function connectHttp(makeServer, config, identityRegistry) {
   httpServer.on("close", () => clearInterval(sweepTimer));
   await new Promise((resolve, reject) => {
     httpServer.listen(port, bindHost, () => {
-      log41.info(
+      log43.info(
         { port, bindHost },
         "HTTP transport listening (POST /mcp for Streamable HTTP, GET /sse for legacy SSE)"
       );
@@ -9548,13 +10250,13 @@ async function handleMcpRequest(pathname, req, res, url, port, maxBodyBytes, mak
         sessionIdGenerator: () => randomUUID(),
         onsessioninitialized: (id) => {
           streamableSessions.set(id, transport2);
-          log41.info({ sessionId: id }, "Streamable HTTP session created");
+          log43.info({ sessionId: id }, "Streamable HTTP session created");
         }
       });
       transport2.onclose = () => {
         if (transport2.sessionId) {
           streamableSessions.delete(transport2.sessionId);
-          log41.info({ sessionId: transport2.sessionId }, "Streamable HTTP session closed");
+          log43.info({ sessionId: transport2.sessionId }, "Streamable HTTP session closed");
         }
       };
       await makeServer().connect(transport2);
@@ -9571,7 +10273,7 @@ async function handleMcpRequest(pathname, req, res, url, port, maxBodyBytes, mak
     sseTransport.onclose = () => {
       sseTransports.delete(sseTransport.sessionId);
     };
-    log41.info({ sessionId: sseTransport.sessionId }, "SSE client connected");
+    log43.info({ sessionId: sseTransport.sessionId }, "SSE client connected");
     await sseTransport.start();
     return;
   }
@@ -9592,23 +10294,23 @@ async function handleMcpRequest(pathname, req, res, url, port, maxBodyBytes, mak
 // src/config/identity-registry.ts
 import { readFileSync as readFileSync4, existsSync as existsSync2 } from "fs";
 import { parse as parse2 } from "yaml";
-import { z as z38 } from "zod";
+import { z as z40 } from "zod";
 import bcrypt from "bcryptjs";
-var log42 = createLogger("identity-registry");
-var IdentityConfigSchema = z38.object({
-  token: z38.string().min(1, "token hash is required"),
-  role: z38.enum(["readonly", "operator", "admin", "superadmin"]),
-  allowedRouters: z38.array(z38.string()).default([]),
-  allowedToolPatterns: z38.array(z38.string()).default([])
+var log44 = createLogger("identity-registry");
+var IdentityConfigSchema = z40.object({
+  token: z40.string().min(1, "token hash is required"),
+  role: z40.enum(["readonly", "operator", "admin", "superadmin"]),
+  allowedRouters: z40.array(z40.string()).default([]),
+  allowedToolPatterns: z40.array(z40.string()).default([])
 }).strict();
-var ConfigFileSchema2 = z38.object({
-  identities: z38.record(z38.string(), IdentityConfigSchema)
+var ConfigFileSchema2 = z40.object({
+  identities: z40.record(z40.string(), IdentityConfigSchema)
 }).strict();
 var IdentityRegistry = class {
   identities = [];
   constructor(configPath) {
     if (!existsSync2(configPath)) {
-      log42.warn(
+      log44.warn(
         { configPath },
         "Identity config file not found; starting with empty registry (stdio callers do not require it)"
       );
@@ -9631,7 +10333,7 @@ ${issues}`);
         allowedToolPatterns: config.allowedToolPatterns
       });
     }
-    log42.info({ count: this.identities.length }, "Loaded identities from config");
+    log44.info({ count: this.identities.length }, "Loaded identities from config");
   }
   getIdentities() {
     return this.identities.map(({ id, role, allowedRouters, allowedToolPatterns }) => ({
@@ -9660,7 +10362,7 @@ ${issues}`);
 // src/domain/snapshot/retention.ts
 import { readdir, stat, unlink } from "fs/promises";
 import { join as join3 } from "path";
-var log43 = createLogger("snapshot-retention");
+var log45 = createLogger("snapshot-retention");
 async function pruneSnapshots(snapshotDir, maxAgeDays) {
   const cutoffMs = Date.now() - maxAgeDays * 864e5;
   let removed = 0;
@@ -9687,21 +10389,21 @@ async function pruneSnapshots(snapshotDir, maxAgeDays) {
           removed++;
         }
       } catch (err) {
-        log43.warn({ err, filePath }, "Failed to evaluate snapshot for retention");
+        log45.warn({ err, filePath }, "Failed to evaluate snapshot for retention");
       }
     }
   }
   if (removed > 0) {
-    log43.info({ removed, maxAgeDays }, "Pruned expired snapshots");
+    log45.info({ removed, maxAgeDays }, "Pruned expired snapshots");
   }
   return removed;
 }
 
 // src/cli/serve.ts
-var log44 = createLogger("main");
+var log46 = createLogger("main");
 async function runServe() {
   const config = loadAppConfig();
-  log44.info({ transport: config.transport, logLevel: config.logLevel }, "Starting MikroMCP server");
+  log46.info({ transport: config.transport, logLevel: config.logLevel }, "Starting MikroMCP server");
   void pruneSnapshots(config.snapshotDir, config.retention.snapshotMaxAgeDays);
   const identityRegistry = new IdentityRegistry(config.identitiesPath);
   if (config.transport === "http") {
@@ -9709,7 +10411,7 @@ async function runServe() {
       (i) => i.role === "readonly" || i.role === "operator"
     );
     if (hasLimitedRoles && !config.confirmationSecret) {
-      log44.error(
+      log46.error(
         "MIKROMCP_CONFIRMATION_SECRET is required in HTTP mode when identities with role readonly or operator are configured"
       );
       process.exit(1);
@@ -9719,7 +10421,7 @@ async function runServe() {
   if (config.transport === "stdio") {
     const stdioIdentity = getStdioIdentity(config.stdioIdentity, identityRegistry);
     await withIdentity(stdioIdentity, () => connectStdio(makeServer()));
-    log44.info("MikroMCP server running via stdio");
+    log46.info("MikroMCP server running via stdio");
   } else if (config.transport === "http") {
     await connectHttp(
       makeServer,
@@ -9731,13 +10433,13 @@ async function runServe() {
       },
       identityRegistry
     );
-    log44.info(
+    log46.info(
       { port: config.port, bindHost: config.bindHost },
       "MikroMCP server running via HTTP/SSE"
     );
   }
   const shutdown = () => {
-    log44.info("Shutting down MikroMCP server");
+    log46.info("Shutting down MikroMCP server");
     pool.closeAll();
     process.exit(0);
   };
@@ -9750,7 +10452,7 @@ import { existsSync as existsSync3, readFileSync as readFileSync5 } from "fs";
 import { homedir as homedir2 } from "os";
 import * as net from "net";
 import chalk from "chalk";
-var localVersion = "1.2.0";
+var localVersion = "1.3.0";
 var results = [];
 function ok(msg) {
   console.log(chalk.green("\u2705 ") + msg);
@@ -10402,7 +11104,7 @@ async function runInit() {
 }
 
 // src/cli/index.ts
-var program = new Command().name("mikromcp").description("MikroTik RouterOS MCP server").version("1.2.0");
+var program = new Command().name("mikromcp").description("MikroTik RouterOS MCP server").version("1.3.0");
 program.command("serve", { isDefault: true }).description("Start the MCP server (default)").action(runServe);
 program.command("doctor").description("Check config, connectivity, and permissions").action(runDoctor);
 program.command("init").description("Interactive setup wizard").action(runInit);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mikromcp",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "mcpName": "io.github.AliKarami/mikromcp",
   "description": "Production-grade MCP server for MikroTik RouterOS",
   "type": "module",