Router firmware, model, uptime, CPU load and memory, plus this server's version and boot time. Internet connection and external IP are in get_internet_status.

Get list of connected clients (devices) in the network. Each client includes a 'node' field (controller/extender) indicating which mesh node it is connected to.

Get list of active but unregistered (unknown) devices in the network

Devices holding a lease from the DHCP pool, with expiry time. Fixed reservations are not leases: see get_dhcp_static.

Get network interfaces status and traffic stats

Get system log entries with timestamps. Supports an optional time window via since/until ('HH:MM', 'HH:MM:SS' or 'Jul 24 08:00'). For lines about one device (by MAC, IP or name) use get_log_by_device.

Router log lines about one device: the given MAC, IP or name is expanded to all of that device's known MACs, IPs and names. No time window; for the whole log or since/until use get_log.

Get WiFi radio status: channel, bandwidth, bitrate, temperature, connected stations count

Get currently associated WiFi stations with signal strength, traffic, device name and mesh node (controller/extender)

Get traffic summary for all active network interfaces (rx/tx bytes)

Internet connections that are up: address (the external IP), uptime, default-route flag, priority. Firmware, load and uptime of the router itself are in get_system_info.

Scan and list nearby WiFi networks

Analyze WiFi channel congestion and recommend the least busy channel

Get status of all VPN interfaces (WireGuard, IPsec, L2TP, PPTP)

Web apps published via KeenDNS as the router serves them now (generated nginx config). Configured mappings with their upstreams are in get_keendns_mappings.

Ping a host from the router and return latency and packet loss

Register a device by MAC address, assign a name and optionally a static IP

Update name or static IP of a registered device

Block a device by MAC address. An unregistered device is registered as 'Blocked Device' first. Undo with unblock_client.

Unblock a device blocked by block_client, by MAC address.

Get Mesh Wi-Fi system nodes: controller and extenders with client count, firmware, uptime and connection speed

Get system log from mesh extender(s). Extenders are discovered automatically. If extender_ip is not specified, fetches logs from all active extenders.

Reboot the router. Takes effect at once and cannot be cancelled; this server is unreachable until the router has booted.

Manually trigger a router config backup right now

Back up this server's own files that no release or git pull restores (.env, watch_rules.json, the Entware init script) to the NAS. Refreshes the mcp-config/ mirror every run and writes a dated snapshot only when the content changed. Runs synchronously and reports what happened, including a round-trip md5 check of the mirror. Staging is in /tmp (RAM): nothing is written to the USB stick.

Snapshot the current router log and rsync it to the NAS backup path (RAM-only staging, no flash writes). Useful to preserve the log before a reboot.

Raw READ-ONLY query against the router's RCI tree. Performs GET /rci/show/ - it cannot write, because writing requires a POST body and this tool never sends one. Use it to explore state that has no dedicated tool yet. Useful paths: 'clock', 'schedule', 'dns-proxy', 'media', 'ntp', 'ip/hotspot', 'interface/GigabitEthernet1', 'components', 'ndns', 'update'. Blacklisted: running-config (use get_config), crypto, ppp, user.

Read the router's running-config with an optional regex filter. Secrets (md5/nthash/psk/password/private-key) are masked unless include_secrets is true. Examples: filter='ip static' for port forwarding, 'access-list' for firewall, 'ip dhcp host' for static reservations, 'ip http proxy' for KeenDNS.

Parsed show/last-change: when the config was last touched (date given both in MSK and UTC), which agent and user touched it, and the checksum - the only reliable signal that a save has actually landed on disk. The raw fail-safe block is included as-is, but its 'unsaved' field is NOT a save indicator - it can read false while a save is still in flight. Compare 'checksum' across two calls instead.

Diff running-config against startup-config, both read via RCI - a direct, checksum-independent answer to 'what is not saved yet'. Returns only_in_running and only_in_startup line lists; both empty means fully saved. Secrets are masked on both sides before comparing. Not wired into the write tools - call it on demand, not after every write.

List port forwarding / static NAT rules ('ip static') from running-config

List firewall rules: access-lists with their entries, ip firewall settings and interface access-groups

List static DHCP reservations ('ip dhcp host'). Unlike get_dhcp_leases, which only shows dynamic pool leases, this shows fixed bindings.

KeenDNS / web-access mappings from running-config ('ip http proxy'). Complements get_web_access, which reads the generated nginx config instead.

Storage overview: internal flash and USB drives with partition UUID, label, filesystem, state, free space and which subsystem uses them (e.g. opkg). Use it to check whether the Entware drive is healthy.

Entware/OPKG state: which drive is bound, the initrc path, and whether /opt is actually mounted. If opt_mounted is false, keenetic-mcp itself is running on borrowed time.

List config backup files already present on the NAS (rsync --list-only). Confirms that scheduled backups actually arrived.

DNS proxy status: upstream resolvers (with DoT SNI), the static A/AAAA records the proxy serves (parsed into domain/address), and the 'ip host' config tree that set_dns_host/remove_dns_host write to. A missing proxy-status block is reported as an error, not as an empty list.

List router schedules (e.g. the firmware auto-update window) with name, weekday/time actions and seconds until the next fire. Answers with an explicit error, never an empty list, when the schedule trees cannot be read - 'no window is configured' and 'I could not read it' must not look alike to a caller deciding whether it may reboot the router.

Create or update a port forwarding rule ('ip static'). The target is addressed by MAC: pass to_host as a MAC, or as an IP that belongs to a registered host (it is resolved, and refused if unknown). dry_run is TRUE by default - it returns the payload without sending it. A real write is saved to startup-config and verified by re-reading the tree. Protected ports (this server's own and MCP_PROTECTED_PORTS) are refused in code.

Delete a port forwarding rule, selected by index (from get_port_forwarding) or by port. Refuses ambiguous matches and protected ports. dry_run is TRUE by default. Re-create with set_port_forwarding.

Create or update a KeenDNS web-access mapping ('ip http proxy'): name -> upstream host:port, published on the ndns domain with ssl redirect. Protected names (this server's own and MCP_PROTECTED_PROXY_NAMES) are refused in code. dry_run is TRUE by default.

Delete a KeenDNS mapping by name. Protected names are refused. dry_run is TRUE by default. Re-create with set_keendns_mapping.

Create or update a static DHCP reservation ('ip dhcp host'). Refuses an IP already reserved for a different MAC. The device NAME lives in the known-host tree - use register_client/update_client for that. dry_run is TRUE by default.

Delete a static DHCP reservation by MAC. dry_run is TRUE by default. Re-create with set_dhcp_host.

Create a static DNS record ('ip host ') served by the router's own DNS proxy - the LAN half of a split-horizon setup, where the same name must resolve to an internal reverse proxy inside the network and to the WAN address outside it. A name that already resolves to a different address is refused rather than extended: 'ip host' accepts several addresses per name and would round-robin it. Remove the old record first. dry_run is TRUE by default; a real write is saved to startup-config and verified by re-reading the tree.

Delete a static DNS record ('no ip host '). The address is looked up in the config tree, because the router's removal form needs both the name and the address; pass it explicitly only to disambiguate a name that holds several. dry_run is TRUE by default. Re-create with set_dns_host.

Watcher status: whether the background event watcher is running, which rules file it read, the state of its own RCI session, and per rule - source, poll interval, cooldown, seconds to the next poll, match/sent/failed counters and the last delivery error. Use it to check that a rule is alive without waiting for the event it watches for.

Render a watcher rule's outbound HTTP call with sample event values, so the URL, headers and body can be inspected before a real event fires. Credentials in the rendered view are masked; the call itself, when sent, uses the real values. dry_run is TRUE by default and sends nothing; dry_run=false performs the call for real, which is how to prove the receiver is reachable from the router.