v0.3.0 — Initial public release

Initial public release of the fixture-first, read-only MCP server for MikroTik RouterOS inspection and policy-backed audits.

Highlights

• Fixed read-only collectors for interfaces, bridge VLANs, routes, firewall state, DHCP/ARP, queues, WireGuard metadata, IP services, and related RouterOS state.
• Policy-backed audits for firmware, SNMP scope, STP, VLANs, trunks, route ownership, WAN failover, DNS, QoS/DSCP, mangle correlation, and backup metadata.
• Purpose-built synthetic inventory, policy, and RouterOS fixtures for safe offline use.
• Local stdio deployment with explicit loopback-only HTTP opt-in.

Security boundary

• Fixture-only dispatch by default; live access requires --live.
• No mutation tools, arbitrary RouterOS commands, or caller-supplied hosts.
• Fail-closed transport dispatch with no backend substitution.
• Verified API-SSL with pinned CA trust, hostname verification, TLS 1.2+, and no plaintext downgrade.
• Allowlisted client errors, sensitive-field redaction, deterministic connection cleanup, and bounded audit fan-out.
• Private live fixture capture requires explicit --capture-live and operator-supplied wrapper paths.

Known limitations

• Remote network deployment is unsupported; the server has no remote authentication contract.
• Write capability is intentionally out of scope and belongs in a separate service with independent credentials and approval controls.

See CHANGELOG.md for the full release notes.