podkop-mcp

Check MCP configuration, SSH connectivity, backend and capabilities. Use this first when something does not work: it explains missing environment variables, SSH key problems and the detected Podkop/Forkop version without changing the router.

Return service, sing-box, DNS and version status of the router.

Return sing-box features compiled into the installed Forkop core (read-only).

Validate a Forkop config file on the router without applying it (read-only).

Return the status of the last Forkop installer run (read-only).

Return the last Forkop installer log, redacted (read-only).

Return model, OpenWrt version, kernel, load, memory, disk and WAN info.

Run read-only health checks: sing-box, nftables, FakeIP and DNS. ``full=true`` additionally runs the global network check, which can take up to a minute because it tests real connectivity.

Return recent router logs, filtered and redacted. ``source`` selects Forkop/Podkop journal, sing-box journal or the whole system log. Secrets in URLs are masked before returning.

Run a read-only Forkop/Podkop CLI command from the allowlist. Mutating commands (start, stop, reload, list_update, subscription_update, component actions) are rejected: use dedicated tools so that backups and rollback are applied. Output is redacted unless reveal_secrets=true.

Return the full UCI configuration as structured JSON. Secrets (subscription URLs, proxy strings, keys) are masked unless reveal_secrets=true. The structure is identical for Forkop 1.x/2.x and Podkop; use podkop_sections_list for a compact view.

Export the UCI config as text (backup-style). ``raw`` requires reveal_secrets=true because it contains proxy URLs and keys. By default the masked export from Forkop is returned.

Read a single UCI option or section by path, e.g. forkop.main.domain.

Set a UCI option or list. Dry-run by default; apply=true writes, backs up and reloads. ``value_type=auto`` sets a list when ``value`` is a list, otherwise an option. The tool preserves the backend package and never touches other OpenWrt packages.

Delete a UCI option. Dry-run by default; apply=true writes with backup.

Create a config backup on the router (dry-run by default).

List config backups stored on the router.

Restore a config backup by id. Dry-run shows the action; apply=true restores and reloads.

List routing sections with action, enabled flag, domain counts and lists. This is the fastest overview of what Forkop/Podkop is doing. Child UCI sections (subscriptions, URLTest groups, links) are counted; set include_children=true to return them too.

Return all options of one section plus its child items.

Create a new routing section. Dry-run by default. Minimal defaults are backend-specific: Forkop gets enabled=1 and the requested action; Podkop gets connection_type=proxy. For zapret2 on Forkop 1.x you must pass nfqws2_opt in options, otherwise the generated config will be rejected by the core.

Create a Forkop 2.x tunnel child (WARP/WireGuard/OpenVPN/...). Dry-run by default. ``kind`` is one of warp, wireguard, amneziawg, tailscale, openvpn-client, openconnect, json. Extra backend options are passed through; secrets in preview are masked.

Create a generic Forkop 2.x child (urltest/fallback_group/link/interface/json/tunnel_peer). This is a low-level escape hatch for new 2.0 entities; domain tools and podkop_subscription_add remain the safe high-level paths. Dry-run by default.

Update selected options of a section (partial update). Dry-run by default. Use podkop_domains_add/remove for domain lists: this tool writes raw values but does not normalize domain syntax.

Delete a section. Child items are deleted when cascade=true. Deleting the main section is refused unless allow_main=true; it is usually a configuration error. Dry-run by default.

Enable or disable a section without deleting it.

List domains of one section, normalized plus the raw stored value. Works for all backends: Forkop 1.x keeps domain as one space-separated string, Forkop 2.x keeps one entry per line in destinations, Podkop uses the user_domains UCI list. Use the returned storage/option values to understand why entries are written the way they are.

Add domains to a section preserving the backend storage type. Forkop 1.x keeps section.domain as a single string: the tool never turns it into a UCI list (that would break domain_suffix matching). Forkop 2.x writes multiline destinations, Podkop uses the user_domains list. Duplicates are reported and not written again; invalid entries raise an error. Dry-run by default: the diff and UCI preview are returned and the router is untouched. With apply=true the config is written, the service is reloaded and, if verify=true, the first added domain is resolved via the router DNS to confirm it maps to a FakeIP address.

Remove domains from a section, keeping the storage type intact. Domains that are not present are reported in not_found and do not make the call fail. Dry-run by default.

Replace the whole domain set of a section. Every entry is validated first; on Forkop 2.x comments and blank lines of the existing destinations block are preserved. Use podkop_domains_add or podkop_domains_remove for incremental changes. Dry-run by default.

Find where a domain is covered by section entries. Checks every top-level section and returns exact matches with the entry kind (domain, zone, full, keyword, regex, ip). possible_lists shows community lists selected in sections: their content lives on the router as rule-sets, so the server cannot match a domain against them.

Suggest hosts seen in live connections but not covered by any section. Groups hosts from the Clash API by traffic, skips IP addresses, localhost and already covered hosts. With only_direct=true (default) only hosts whose chain is direct are suggested, i.e. traffic that currently bypasses the proxy and may need a rule. Feed the result to podkop_domains_add (suggested_section is usually main).

Check one domain: DNS resolution, FakeIP, section coverage, HTTPS probe. Resolves the domain through the router DNS (127.0.0.1) without touching the configuration. fakeip=true means the domain maps to 198.18.x.x or fc00::/18 (sing-box FakeIP ranges) and therefore goes through the proxy. probe_http runs a curl HEAD request on the router; curl failures are reported in http_error instead of raising.

Return selected and available community lists of sections. With section: the selected lists of that section plus the built-in catalogue of known names. Without section: a map for every top-level section. Names outside the catalogue are reported in unknown (custom rule-sets are allowed and never removed automatically).

Add or remove community lists of one section as a UCI list. Names must match ^[a-z0-9_]+$; duplicates are dropped and the order of existing lists is preserved. The whole list is written at once, so no per-item add_list/del_list calls are issued. Names outside the built-in catalogue are reported in unknown but accepted. Dry-run by default; apply=true writes the config, creates a backup and reloads the service.

List routing sections with subscriptions, urltest groups, links and tunnels. Subscription URLs and proxy strings are masked unless reveal_secrets=true. This is a read-only map of how connections are configured; use podkop_subscription_* to modify them.

Add a subscription to a section. Dry-run by default; apply=true writes. Accepts http(s):// URLs or local absolute paths (max 4096 chars). Forkop creates a child section {section}_sub_N with sensible defaults; Podkop writes subscription_url inline into the section.

Delete a subscription by name, 1-based index, tag or raw URL. When ``section`` is given, only its children are considered. Podkop removes the subscription_url option instead. Dry-run by default.

Refresh subscription cache on the router (apply must be true). Uses async update with status polling when the backend supports it, otherwise runs the blocking subscription_update command. Bounded by ``timeout`` seconds.

List Clash proxy groups and nodes with delays. With ``group``, returns that group's members (all) and its current selection (now). Read-only.

Select a proxy inside a Clash group (runtime change, not config). Dry-run shows what would be selected. apply=true performs the switch; on Forkop 1.x this raises BackendError because runtime selection is not supported there — that is expected behaviour.

Run read-only proxy check and report selected-group delays. Calls check_proxy via CLI when available; falls back to reporting delays of currently selected proxies from Clash API history.

Return a monitoring snapshot: service, system, proxies, connections, traffic. Collects everything available in one call; each part fails independently (errors are reported in check_errors instead of raising). Read-only and safe to call repeatedly.

List live connections with optional filters (host, source_ip, chain). ``host`` and ``chain`` are case-insensitive substrings; ``source_ip`` matches exactly or as a network prefix ("192.0.2." matches all clients in that subnet). Read-only.

Measure traffic rate by sampling Clash connections twice. Returns download/upload bps, per-connection deltas and the top consumers. ``sample_seconds`` is clamped to 0.5..10 s. Read-only; the call blocks for the sampling interval.

Start, stop, restart, reload or toggle autostart of Podkop/Forkop. Dry-run by default. ``stop`` is refused in read-only mode. Use podkop_apply-style tools for config changes; this tool only controls the service lifecycle.

Update built-in lists and/or subscriptions. This changes the router's downloaded rule sets and subscription cache, so apply=true is required. Long operations are bounded by ``timeout``.