@agilemonster/mcp-server 1.0.15 → 1.0.21

package/dist/guidelines.d.ts

@@ -1 +1 @@
-export declare const AGENT_GUIDELINES_MARKDOWN = "# Autonomous AI Agent Operational Guidelines (Agile Monster)\n\nThis document provides mandatory operational protocols for AI coding assistants (**Cursor, Claude Code, Antigravity, Codex, Hermes Agent, Windsurf, Aider**) working inside repositories integrated with **Agile Monster** (https://app.agilemonster.com).\n\n---\n\n## \uD83E\uDDED Core Principles\n\n1. **The Agile Monster Board is the Source of Truth**: \n   All non-trivial feature additions, bug fixes, refactors, and deployments must correspond to a task on the project's Agile Monster board.\n2. **One Active Assignee**: \n   Work on cards assigned specifically to your agent provider (`cursor`, `claude_code`, `antigravity`, `codex`, `hermes`, `windsurf`, `aider`, or `custom`). Never claim or alter tasks assigned to other agents or human teammates without explicit user direction.\n3. **No Hallucinated Requirements**: \n   When a specification, API schema, or environment variable is ambiguous, stop and ask the user rather than guessing.\n4. **Human Verification Gate**: \n   Autonomous agents must **never** close a task directly to `Done`. You must submit work for human testing and verification using `agilemonster_submit_for_review`.\n\n---\n\n## \uD83D\uDD04 Task Lifecycle Protocol\n\nFollow this exact sequential protocol when working on any task:\n\n1. **Context & Discovery**:\n   - Inspect `.agilemonster.json` in the project root if present.\n   - Run `agilemonster_get_context` to retrieve the board ID, list columns (`Backlog`, `In Progress`, `Review`, `Done`), and active tasks.\n\n2. **Task Intake**:\n   - Check which tasks are queued for your agent using `agilemonster_list_my_tasks({ \"status\": \"queued\" })`.\n   - Confirm the card is assigned to your provider before proceeding.\n\n3. **Claiming the Task**:\n   - Before editing files or running build tools, claim the task:\n     `agilemonster_claim_task({ \"card_id\": \"<card_uuid>\" })`\n   - This moves the card status to `in_progress` and logs an activity event on the board.\n\n4. **Implementation, Questions & Progress**:\n   - **When Blocked or Unclear**: Call `agilemonster_ask_question({ \"card_id\": \"<card_uuid>\", \"question\": \"...\" })`. This sets status to `waiting_for_input` so the user is alerted.\n   - **Logging Progress**: For non-trivial milestones, call `agilemonster_add_progress({ \"card_id\": \"<card_uuid>\", \"update\": \"...\", \"tokens_used\": 1500, \"cost_usd\": 0.003 })`.\n   - **Cost Safeguards**: Use `agilemonster_set_budget` and `agilemonster_record_spend` to protect against runaway billing loops.\n\n5. **Submission for Human Review & Testing**:\n   - When code is implemented, compiled, and tested locally:\n   - Call `agilemonster_submit_for_review({ \"card_id\": \"<card_uuid>\", \"summary\": \"...\", \"verification_steps\": \"...\" })`.\n   - This automatically moves the card to the board's **Testing / QA / Review** column, reassigns the card back to the human who requested it, sets `agent_status` to `review`, and posts step-by-step verification instructions.\n   - Never mark the card directly as \"Done\". The user will verify your test steps and sign off.\n\n6. **Suggest Follow-Up Tasks**:\n   - Proactively suggest follow-up cards (deploy to test/staging, deploy to production, add integration tests) using:\n     `agilemonster_create_followup_tasks({ \"card_id\": \"<card_uuid>\", \"tasks\": [...] })`.\n";
+export declare const AGENT_GUIDELINES_MARKDOWN = "# Autonomous AI Agent Operational Guidelines (Agile Monster)\n\nThis document provides mandatory operational protocols for AI coding assistants (**Cursor, Claude Code, Antigravity, Codex, Hermes Agent, Windsurf, Aider**) working inside repositories integrated with **Agile Monster** (https://app.agilemonster.com).\n\n---\n\n## \uD83E\uDDED Core Principles\n\n1. **The Agile Monster Board is the Source of Truth**: \n   All non-trivial feature additions, bug fixes, refactors, and deployments must correspond to a task on the project's Agile Monster board.\n2. **One Active Assignee**: \n   Work on cards assigned specifically to your agent provider (`cursor`, `claude_code`, `antigravity`, `codex`, `hermes`, `windsurf`, `aider`, or `custom`). Never claim or alter tasks assigned to other agents or human teammates without explicit user direction.\n3. **No Hallucinated Requirements**: \n   When a specification, API schema, or environment variable is ambiguous, stop and ask the user rather than guessing.\n4. **Human Verification Gate**: \n   Autonomous agents must **never** close a task directly to `Done`. You must submit work for human testing and verification using `agilemonster_submit_for_review`.\n\n---\n\n## \uD83D\uDD04 Task Lifecycle Protocol\n\nFollow this exact sequential protocol when working on any task:\n\n1. **Context & Discovery**:\n   - Inspect `.agilemonster.json` in the project root if present.\n   - Run `agilemonster_get_context` to retrieve the board ID, list columns (`Backlog`, `In Progress`, `Review`, `Done`), and active tasks.\n\n2. **Task Intake**:\n   - Check which tasks are queued for your agent using `agilemonster_list_my_tasks({ \"status\": \"queued\" })`.\n   - Confirm the card is assigned to your provider before proceeding.\n\n3. **Claiming the Task**:\n   - Before editing files or running build tools, claim the task:\n     `agilemonster_claim_task({ \"card_id\": \"<card_uuid>\" })`\n   - This moves the card status to `in_progress` and logs an activity event on the board.\n\n4. **Implementation, Questions & Progress**:\n   - **When Blocked or Unclear**: Call `agilemonster_ask_question({ \"card_id\": \"<card_uuid>\", \"question\": \"...\" })`. This sets status to `waiting_for_input` so the user is alerted.\n   - **Logging Progress**: For non-trivial milestones, call `agilemonster_add_progress({ \"card_id\": \"<card_uuid>\", \"update\": \"...\", \"tokens_used\": 1500, \"cost_usd\": 0.003 })`.\n   - **Cost Safeguards**: Use `agilemonster_set_budget` and `agilemonster_record_spend` to protect against runaway billing loops.\n\n5. **Submission for Human Review & Testing**:\n   - When code is implemented, compiled, and tested locally:\n   - Call `agilemonster_submit_for_review({ \"card_id\": \"<card_uuid>\", \"summary\": \"...\", \"verification_steps\": \"...\" })`.\n   - This automatically moves the card to the board's **Testing / QA / Review** column, reassigns the card back to the human who requested it, sets `agent_status` to `review`, and posts step-by-step verification instructions.\n   - Never mark the card directly as \"Done\". The user will verify your test steps and sign off.\n\n6. **Suggest Follow-Up Tasks**:\n   - Proactively suggest follow-up cards (deploy to test/staging, deploy to production, add integration tests) using:\n     `agilemonster_create_followup_tasks({ \"card_id\": \"<card_uuid>\", \"tasks\": [...] })`.\n\n7. **Deployment Memory (keeps web-started cards as informed as you are)**:\n   - Before deploying or writing a deployment note, call `agilemonster_get_deploy_profile({})`. It returns the route this project really uses (GitHub Actions, local Docker Compose, deploy script, cloud CLI, manual), the exact command, the evidence, and what happened on recent deployments. Do not guess.\n   - After every deployment you run or observe, call `agilemonster_record_deployment({ \"method\": \"...\", \"command\": \"...\", \"live_url\": \"...\", \"success\": true })`. On failure pass `\"success\": false` and `\"error\"`.\n   - When the user tells you how the project is deployed, record it with `\"pin\": true` and put anything a future agent must know in `\"notes\"`.\n   - This is how tasks created from the Agile Monster web app (which run in the background, without your IDE context) learn to deploy the same proven way you did.\n";

package/dist/guidelines.js

@@ -48,4 +48,10 @@ Follow this exact sequential protocol when working on any task:
 6. **Suggest Follow-Up Tasks**:
    - Proactively suggest follow-up cards (deploy to test/staging, deploy to production, add integration tests) using:
      \`agilemonster_create_followup_tasks({ "card_id": "<card_uuid>", "tasks": [...] })\`.
+
+7. **Deployment Memory (keeps web-started cards as informed as you are)**:
+   - Before deploying or writing a deployment note, call \`agilemonster_get_deploy_profile({})\`. It returns the route this project really uses (GitHub Actions, local Docker Compose, deploy script, cloud CLI, manual), the exact command, the evidence, and what happened on recent deployments. Do not guess.
+   - After every deployment you run or observe, call \`agilemonster_record_deployment({ "method": "...", "command": "...", "live_url": "...", "success": true })\`. On failure pass \`"success": false\` and \`"error"\`.
+   - When the user tells you how the project is deployed, record it with \`"pin": true\` and put anything a future agent must know in \`"notes"\`.
+   - This is how tasks created from the Agile Monster web app (which run in the background, without your IDE context) learn to deploy the same proven way you did.
 `;

package/dist/ide-config.d.ts

@@ -0,0 +1,44 @@
+export declare const SERVER_NAME = "agilemonster";
+export interface McpServerEntry {
+    command: string;
+    args: string[];
+    env: Record<string, string>;
+}
+export declare function serverEntry(apiKey: string): McpServerEntry;
+export type WriteOutcome = 'written' | 'unreadable';
+/** Remove // and block comments and trailing commas, leaving string contents alone. */
+export declare function stripJsonComments(text: string): string;
+/** Parse a config file's text. `strict` is false when it only parsed after removing comments. */
+export declare function parseConfigJson(raw: string): {
+    value: any;
+    strict: boolean;
+} | null;
+/**
+ * Add or refresh our server under `rootKey` in a JSON config file. `removeFrom` names a root key an older
+ * version of this package wrote to by mistake; our entry is removed from there.
+ */
+export declare function mergeJsonMcpConfig(file: string, rootKey: string, entry: object, removeFrom?: string): WriteOutcome;
+/** Codex CLI keeps MCP servers in TOML tables: [mcp_servers.<name>] with an env sub-table. */
+export declare function upsertCodexToml(existing: string, entry: McpServerEntry): string;
+export declare function writeCodexConfig(file: string, entry: McpServerEntry): WriteOutcome;
+export interface IdeTarget {
+    /** Names accepted for --ide / provider */
+    ids: string[];
+    label: string;
+    /** Path shown to the user */
+    display: string;
+    file: string;
+    /** Written for "all" only when this exists, so configs are not created for tools that are not installed */
+    presentIf: string | null;
+    write: (file: string, apiKey: string) => WriteOutcome;
+}
+/** Every client this package can configure, and where each keeps its MCP servers. */
+export declare function ideTargets(cwd: string, homedir: string): IdeTarget[];
+export interface IdeResult {
+    label: string;
+    display: string;
+    outcome: WriteOutcome | 'error';
+    error?: string;
+}
+/** Configure one named client, or with "all" every project-level client plus the installed global ones. */
+export declare function configureIdeTargets(apiKey: string, selectedIde: string | undefined, cwd: string, homedir: string): IdeResult[];

package/dist/ide-config.js

@@ -0,0 +1,250 @@
+/**
+ * Writes the Agile Monster entry into an agent's or IDE's MCP configuration without disturbing anything else
+ * in that file. Each client has its own file, root key and format; the rules that apply to all of them:
+ *
+ * - merge, never replace: the user's other MCP servers stay;
+ * - a file that cannot be understood is left exactly as it is (it used to be overwritten);
+ * - a file with comments or trailing commas (JSONC) is read correctly, and backed up before it is rewritten.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+export const SERVER_NAME = 'agilemonster';
+const PACKAGE_SPEC = '@agilemonster/mcp-server@latest';
+const API_URL = 'https://api.agilemonster.com';
+export function serverEntry(apiKey) {
+    return {
+        command: 'npx',
+        args: ['-y', PACKAGE_SPEC],
+        env: { AGILEMONSTER_API_KEY: apiKey, AGILEMONSTER_API_URL: API_URL },
+    };
+}
+/** Remove // and block comments and trailing commas, leaving string contents alone. */
+export function stripJsonComments(text) {
+    let out = '';
+    let i = 0;
+    let inString = false;
+    while (i < text.length) {
+        const ch = text[i];
+        const next = text[i + 1];
+        if (inString) {
+            out += ch;
+            if (ch === '\\' && i + 1 < text.length) {
+                out += next;
+                i += 2;
+                continue;
+            }
+            if (ch === '"')
+                inString = false;
+            i++;
+            continue;
+        }
+        if (ch === '"') {
+            inString = true;
+            out += ch;
+            i++;
+            continue;
+        }
+        if (ch === '/' && next === '/') {
+            while (i < text.length && text[i] !== '\n')
+                i++;
+            continue;
+        }
+        if (ch === '/' && next === '*') {
+            const end = text.indexOf('*/', i + 2);
+            i = end === -1 ? text.length : end + 2;
+            continue;
+        }
+        if (ch === ',') {
+            // A comma followed only by whitespace/comments and a closing bracket is a trailing comma
+            let j = i + 1;
+            for (;;) {
+                while (j < text.length && /\s/.test(text[j]))
+                    j++;
+                if (text[j] === '/' && text[j + 1] === '/') {
+                    while (j < text.length && text[j] !== '\n')
+                        j++;
+                    continue;
+                }
+                if (text[j] === '/' && text[j + 1] === '*') {
+                    const end = text.indexOf('*/', j + 2);
+                    j = end === -1 ? text.length : end + 2;
+                    continue;
+                }
+                break;
+            }
+            if (text[j] === '}' || text[j] === ']') {
+                i++;
+                continue;
+            }
+        }
+        out += ch;
+        i++;
+    }
+    return out;
+}
+/** Parse a config file's text. `strict` is false when it only parsed after removing comments. */
+export function parseConfigJson(raw) {
+    const text = raw.replace(/^/, '');
+    if (text.trim() === '')
+        return { value: {}, strict: true };
+    try {
+        return { value: JSON.parse(text), strict: true };
+    }
+    catch {
+        try {
+            return { value: JSON.parse(stripJsonComments(text)), strict: false };
+        }
+        catch {
+            return null;
+        }
+    }
+}
+/**
+ * Add or refresh our server under `rootKey` in a JSON config file. `removeFrom` names a root key an older
+ * version of this package wrote to by mistake; our entry is removed from there.
+ */
+export function mergeJsonMcpConfig(file, rootKey, entry, removeFrom) {
+    let config = {};
+    if (fs.existsSync(file)) {
+        const raw = fs.readFileSync(file, 'utf8');
+        const parsed = parseConfigJson(raw);
+        if (!parsed || typeof parsed.value !== 'object' || parsed.value === null || Array.isArray(parsed.value)) {
+            return 'unreadable';
+        }
+        config = parsed.value;
+        if (!parsed.strict) {
+            // Rewriting drops the comments, so keep the original next to it
+            fs.writeFileSync(`${file}.bak`, raw, 'utf8');
+        }
+    }
+    else {
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+    }
+    if (typeof config[rootKey] !== 'object' || config[rootKey] === null || Array.isArray(config[rootKey])) {
+        config[rootKey] = {};
+    }
+    config[rootKey][SERVER_NAME] = entry;
+    if (removeFrom && removeFrom !== rootKey && config[removeFrom] && typeof config[removeFrom] === 'object') {
+        delete config[removeFrom][SERVER_NAME];
+        if (Object.keys(config[removeFrom]).length === 0)
+            delete config[removeFrom];
+    }
+    fs.writeFileSync(file, `${JSON.stringify(config, null, 2)}\n`, 'utf8');
+    return 'written';
+}
+/** Codex CLI keeps MCP servers in TOML tables: [mcp_servers.<name>] with an env sub-table. */
+export function upsertCodexToml(existing, entry) {
+    const ours = new RegExp(`^\\s*\\[\\s*mcp_servers\\.${SERVER_NAME}(\\.[^\\]]+)?\\s*\\]\\s*(#.*)?$`);
+    const anyTable = /^\s*\[/;
+    const kept = [];
+    let skipping = false;
+    for (const line of existing.split(/\r?\n/)) {
+        if (ours.test(line)) {
+            skipping = true;
+            continue;
+        }
+        if (skipping && anyTable.test(line))
+            skipping = false;
+        if (!skipping)
+            kept.push(line);
+    }
+    const before = kept.join('\n').trimEnd();
+    const q = (v) => JSON.stringify(v);
+    const block = [
+        `[mcp_servers.${SERVER_NAME}]`,
+        `command = ${q(entry.command)}`,
+        `args = [${entry.args.map(q).join(', ')}]`,
+        '',
+        `[mcp_servers.${SERVER_NAME}.env]`,
+        ...Object.entries(entry.env).map(([k, v]) => `${k} = ${q(v)}`),
+        '',
+    ].join('\n');
+    return `${before ? `${before}\n\n` : ''}${block}`;
+}
+export function writeCodexConfig(file, entry) {
+    const existing = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : '';
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, upsertCodexToml(existing, entry), 'utf8');
+    return 'written';
+}
+/** Every client this package can configure, and where each keeps its MCP servers. */
+export function ideTargets(cwd, homedir) {
+    const json = (rootKey, extra = {}, removeFrom) => (file, apiKey) => mergeJsonMcpConfig(file, rootKey, { ...extra, ...serverEntry(apiKey) }, removeFrom);
+    const targets = [
+        {
+            ids: ['cursor'],
+            label: 'Cursor',
+            display: '.cursor/mcp.json',
+            file: path.join(cwd, '.cursor', 'mcp.json'),
+            presentIf: null,
+            write: json('mcpServers'),
+        },
+        {
+            ids: ['claude', 'claude_code', 'claude-code'],
+            label: 'Claude Code',
+            display: '.mcp.json',
+            file: path.join(cwd, '.mcp.json'),
+            presentIf: null,
+            write: json('mcpServers'),
+        },
+        {
+            // VS Code (Copilot agent mode) reads "servers", not "mcpServers"; earlier versions wrote the wrong key
+            ids: ['vscode', 'vs_code', 'copilot', 'github_copilot'],
+            label: 'VS Code',
+            display: '.vscode/mcp.json',
+            file: path.join(cwd, '.vscode', 'mcp.json'),
+            presentIf: path.join(cwd, '.vscode'),
+            write: json('servers', { type: 'stdio' }, 'mcpServers'),
+        },
+    ];
+    if (homedir) {
+        targets.push({
+            ids: ['windsurf'],
+            label: 'Windsurf',
+            display: '~/.codeium/windsurf/mcp_config.json',
+            file: path.join(homedir, '.codeium', 'windsurf', 'mcp_config.json'),
+            presentIf: path.join(homedir, '.codeium', 'windsurf'),
+            write: json('mcpServers'),
+        }, {
+            ids: ['antigravity', 'gemini'],
+            label: 'Antigravity',
+            display: '~/.gemini/config/mcp_config.json',
+            file: path.join(homedir, '.gemini', 'config', 'mcp_config.json'),
+            presentIf: path.join(homedir, '.gemini'),
+            write: json('mcpServers'),
+        }, {
+            ids: ['gemini_cli', 'gemini-cli', 'gemini'],
+            label: 'Gemini CLI',
+            display: '~/.gemini/settings.json',
+            file: path.join(homedir, '.gemini', 'settings.json'),
+            presentIf: path.join(homedir, '.gemini', 'settings.json'),
+            write: json('mcpServers'),
+        }, {
+            ids: ['codex', 'codex_cli', 'codex-cli'],
+            label: 'Codex CLI',
+            display: '~/.codex/config.toml',
+            file: path.join(homedir, '.codex', 'config.toml'),
+            presentIf: path.join(homedir, '.codex'),
+            write: (file, apiKey) => writeCodexConfig(file, serverEntry(apiKey)),
+        });
+    }
+    return targets;
+}
+/** Configure one named client, or with "all" every project-level client plus the installed global ones. */
+export function configureIdeTargets(apiKey, selectedIde, cwd, homedir) {
+    const ide = (selectedIde || 'all').toLowerCase().trim();
+    const results = [];
+    for (const target of ideTargets(cwd, homedir)) {
+        const named = target.ids.includes(ide);
+        const implied = ide === 'all' && (target.presentIf === null || fs.existsSync(target.presentIf));
+        if (!named && !implied)
+            continue;
+        try {
+            results.push({ label: target.label, display: target.display, outcome: target.write(target.file, apiKey) });
+        }
+        catch (e) {
+            results.push({ label: target.label, display: target.display, outcome: 'error', error: e?.message || String(e) });
+        }
+    }
+    return results;
+}

package/dist/orchestrator.d.ts

@@ -28,5 +28,6 @@ export declare class AgileMonsterOrchestrator {
         board?: string;
     }): Promise<void>;
     configureIdes(apiKey: string, selectedIde?: string): void;
+    /** Keep the files that hold the personal API key out of commits. */
     private ensureGitignore;
 }

package/dist/orchestrator.js

@@ -3,6 +3,9 @@ import fs from 'node:fs';
 import { execSync } from 'node:child_process';
 import { AgileMonsterClient } from './client.js';
 import { AGENT_GUIDELINES_MARKDOWN } from './guidelines.js';
+import { configureIdeTargets } from './ide-config.js';
+import { ensureLocalGitExcludes } from './deploy-runner.js';
+import { stripRemoteCredentials } from './redact.js';
 export class AgileMonsterOrchestrator {
     client;
     constructor(client = new AgileMonsterClient()) {
@@ -114,32 +117,15 @@ export class AgileMonsterOrchestrator {
             })
                 .toString()
                 .trim();
-            return out || undefined;
+            // A token embedded in the remote URL must never be sent to the server
+            return stripRemoteCredentials(out) || undefined;
         }
         catch {
             return undefined;
         }
     }
     detectInstalledIdes() {
-        const homedir = process.env.HOME || process.env.USERPROFILE || '';
-        const detected = [];
-        if (fs.existsSync(path.resolve(process.cwd(), '.cursor')) ||
-            (homedir && fs.existsSync(path.join(homedir, '.cursor')))) {
-            detected.push('cursor');
-        }
-        if (fs.existsSync(path.resolve(process.cwd(), '.mcp.json')) ||
-            (homedir && fs.existsSync(path.join(homedir, '.claude')))) {
-            detected.push('claude_code');
-        }
-        if (homedir && fs.existsSync(path.join(homedir, '.gemini'))) {
-            detected.push('antigravity');
-        }
-        if (homedir && fs.existsSync(path.join(homedir, '.codeium', 'windsurf'))) {
-            detected.push('windsurf');
-        }
-        if (fs.existsSync(path.resolve(process.cwd(), '.vscode'))) {
-            detected.push('codex');
-        }
+        const detected = AgileMonsterClient.detectInstalledAgents();
         return detected.length > 0 ? detected : ['cursor', 'claude_code', 'antigravity'];
     }
     async initInteractive(options) {
@@ -343,162 +329,29 @@ export class AgileMonsterOrchestrator {
     }
     configureIdes(apiKey, selectedIde) {
         const homedir = process.env.HOME || process.env.USERPROFILE || '';
-        const ide = (selectedIde || 'all').toLowerCase();
-        // 1. Cursor (.cursor/mcp.json)
-        if (ide === 'all' || ide === 'cursor') {
-            try {
-                const cursorDir = path.resolve(process.cwd(), '.cursor');
-                const cursorMcpPath = path.join(cursorDir, 'mcp.json');
-                if (!fs.existsSync(cursorDir))
-                    fs.mkdirSync(cursorDir, { recursive: true });
-                let existing = { mcpServers: {} };
-                if (fs.existsSync(cursorMcpPath)) {
-                    try {
-                        existing = JSON.parse(fs.readFileSync(cursorMcpPath, 'utf8'));
-                    }
-                    catch { }
-                }
-                existing.mcpServers = existing.mcpServers || {};
-                existing.mcpServers.agilemonster = {
-                    command: 'npx',
-                    args: ['-y', '@agilemonster/mcp-server@latest'],
-                    env: {
-                        AGILEMONSTER_API_KEY: apiKey,
-                        AGILEMONSTER_API_URL: 'https://api.agilemonster.com',
-                    },
-                };
-                fs.writeFileSync(cursorMcpPath, JSON.stringify(existing, null, 2), 'utf8');
-                console.log(`🤖 Configured Cursor in: .cursor/mcp.json`);
-            }
-            catch (e) {
-                console.warn(`Could not write Cursor config: ${e.message}`);
-            }
-        }
-        // 2. Claude Code (.mcp.json)
-        if (ide === 'all' || ide === 'claude' || ide === 'claude_code') {
-            try {
-                const claudeMcpPath = path.resolve(process.cwd(), '.mcp.json');
-                let existing = { mcpServers: {} };
-                if (fs.existsSync(claudeMcpPath)) {
-                    try {
-                        existing = JSON.parse(fs.readFileSync(claudeMcpPath, 'utf8'));
-                    }
-                    catch { }
-                }
-                existing.mcpServers = existing.mcpServers || {};
-                existing.mcpServers.agilemonster = {
-                    command: 'npx',
-                    args: ['-y', '@agilemonster/mcp-server@latest'],
-                    env: {
-                        AGILEMONSTER_API_KEY: apiKey,
-                        AGILEMONSTER_API_URL: 'https://api.agilemonster.com',
-                    },
-                };
-                fs.writeFileSync(claudeMcpPath, JSON.stringify(existing, null, 2), 'utf8');
-                console.log(`🤖 Configured Claude Code in: .mcp.json`);
-            }
-            catch (e) {
-                console.warn(`Could not write Claude Code config: ${e.message}`);
+        for (const r of configureIdeTargets(apiKey, selectedIde, process.cwd(), homedir)) {
+            if (r.outcome === 'written') {
+                console.log(`🤖 Configured ${r.label} in: ${r.display}`);
             }
-        }
-        // 3. Windsurf (~/.codeium/windsurf/mcp_config.json)
-        if ((ide === 'all' || ide === 'windsurf') && homedir) {
-            try {
-                const windsurfDir = path.join(homedir, '.codeium', 'windsurf');
-                const windsurfMcpPath = path.join(windsurfDir, 'mcp_config.json');
-                if (fs.existsSync(windsurfDir) || ide === 'windsurf') {
-                    if (!fs.existsSync(windsurfDir))
-                        fs.mkdirSync(windsurfDir, { recursive: true });
-                    let existing = { mcpServers: {} };
-                    if (fs.existsSync(windsurfMcpPath)) {
-                        try {
-                            existing = JSON.parse(fs.readFileSync(windsurfMcpPath, 'utf8'));
-                        }
-                        catch { }
-                    }
-                    existing.mcpServers = existing.mcpServers || {};
-                    existing.mcpServers.agilemonster = {
-                        command: 'npx',
-                        args: ['-y', '@agilemonster/mcp-server@latest'],
-                        env: {
-                            AGILEMONSTER_API_KEY: apiKey,
-                            AGILEMONSTER_API_URL: 'https://api.agilemonster.com',
-                        },
-                    };
-                    fs.writeFileSync(windsurfMcpPath, JSON.stringify(existing, null, 2), 'utf8');
-                    console.log(`🤖 Configured Windsurf in: ~/.codeium/windsurf/mcp_config.json`);
-                }
-            }
-            catch { }
-        }
-        // 4. Antigravity / Gemini (~/.gemini/config/mcp_config.json)
-        if ((ide === 'all' || ide === 'antigravity' || ide === 'gemini') && homedir) {
-            try {
-                const antigravityDir = path.join(homedir, '.gemini', 'config');
-                const antigravityMcpPath = path.join(antigravityDir, 'mcp_config.json');
-                if (!fs.existsSync(antigravityDir))
-                    fs.mkdirSync(antigravityDir, { recursive: true });
-                let existing = { mcpServers: {} };
-                if (fs.existsSync(antigravityMcpPath)) {
-                    try {
-                        const raw = fs.readFileSync(antigravityMcpPath, 'utf8').trim();
-                        if (raw)
-                            existing = JSON.parse(raw);
-                    }
-                    catch { }
-                }
-                existing.mcpServers = existing.mcpServers || {};
-                existing.mcpServers.agilemonster = {
-                    command: 'npx',
-                    args: ['-y', '@agilemonster/mcp-server@latest'],
-                    env: {
-                        AGILEMONSTER_API_KEY: apiKey,
-                        AGILEMONSTER_API_URL: 'https://api.agilemonster.com',
-                    },
-                };
-                fs.writeFileSync(antigravityMcpPath, JSON.stringify(existing, null, 2), 'utf8');
-                console.log(`🤖 Configured Antigravity in: ~/.gemini/config/mcp_config.json`);
+            else if (r.outcome === 'unreadable') {
+                console.warn(`⚠️  ${r.label}: ${r.display} could not be read as JSON, so it was left untouched. ` +
+                    `Add the "agilemonster" server to it by hand (see the README).`);
             }
-            catch { }
-        }
-        // 5. VS Code (.vscode/mcp.json)
-        if (ide === 'all' || ide === 'vscode' || ide === 'codex') {
-            try {
-                const vscodeDir = path.resolve(process.cwd(), '.vscode');
-                const vscodeMcpPath = path.join(vscodeDir, 'mcp.json');
-                if (fs.existsSync(vscodeDir) || ide === 'vscode') {
-                    if (!fs.existsSync(vscodeDir))
-                        fs.mkdirSync(vscodeDir, { recursive: true });
-                    let existing = { mcpServers: {} };
-                    if (fs.existsSync(vscodeMcpPath)) {
-                        try {
-                            existing = JSON.parse(fs.readFileSync(vscodeMcpPath, 'utf8'));
-                        }
-                        catch { }
-                    }
-                    existing.mcpServers = existing.mcpServers || {};
-                    existing.mcpServers.agilemonster = {
-                        command: 'npx',
-                        args: ['-y', '@agilemonster/mcp-server@latest'],
-                        env: {
-                            AGILEMONSTER_API_KEY: apiKey,
-                            AGILEMONSTER_API_URL: 'https://api.agilemonster.com',
-                        },
-                    };
-                    fs.writeFileSync(vscodeMcpPath, JSON.stringify(existing, null, 2), 'utf8');
-                    console.log(`🤖 Configured VS Code in: .vscode/mcp.json`);
-                }
+            else {
+                console.warn(`Could not write ${r.label} config (${r.display}): ${r.error}`);
             }
-            catch { }
         }
     }
+    /** Keep the files that hold the personal API key out of commits. */
     ensureGitignore() {
+        // Per-clone exclude list: works whether or not the project has a .gitignore
+        ensureLocalGitExcludes(process.cwd());
         try {
             const gitignorePath = path.resolve(process.cwd(), '.gitignore');
             if (!fs.existsSync(gitignorePath))
                 return;
             const content = fs.readFileSync(gitignorePath, 'utf8');
-            const entries = ['.agilemonster.json', '.cursor/mcp.json', '.mcp.json'];
+            const entries = ['.agilemonster.json', '.cursor/mcp.json', '.mcp.json', '.vscode/mcp.json'];
             const missing = entries.filter((e) => !content.split(/\r?\n/).includes(e));
             if (missing.length > 0) {
                 const prefix = content.endsWith('\n') ? '' : '\n';

package/dist/redact.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Keeps credentials out of anything the MCP server hands back to an agent. Tool results and resources end up
+ * in model context, chat transcripts and IDE logs, so the API key must never appear in them, whichever tool
+ * produced the text and wherever the key came from (project config, env, a server response, an error).
+ */
+export declare function redactSecrets(text: string, secrets?: Array<string | undefined | null>): string;
+/** The secrets this process knows about, for exact-match masking. */
+export declare function knownSecrets(apiKey?: string): string[];
+/** Mask every text part of a tool result or resource read, leaving its shape untouched. */
+export declare function redactResult<T>(result: T, secrets?: Array<string | undefined | null>): T;
+/**
+ * A git remote as it may leave this machine: `https://user:token@host/...` and `https://token@host/...`
+ * lose their credentials; the ssh login name (`git@host:...`) is not a secret and stays.
+ */
+export declare function stripRemoteCredentials(remote: string | null | undefined): string;

package/dist/redact.js

@@ -0,0 +1,58 @@
+/**
+ * Keeps credentials out of anything the MCP server hands back to an agent. Tool results and resources end up
+ * in model context, chat transcripts and IDE logs, so the API key must never appear in them, whichever tool
+ * produced the text and wherever the key came from (project config, env, a server response, an error).
+ */
+const MASK = '***';
+/** Agile Monster API keys, e.g. am_live_<hex>. The prefix is kept so a reader can tell what was removed. */
+const AM_KEY_PATTERN = /\b(am_(?:live|test)_)[A-Za-z0-9]{8,}\b/g;
+/** Credentials embedded in a URL: https://user:token@host/... (a git remote with a personal access token). */
+const URL_CREDENTIALS_PATTERN = /\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@:]+:[^\s/@]+@/gi;
+/** `Authorization: Bearer <token>` as it shows up in echoed requests and error dumps. */
+const BEARER_PATTERN = /\b(Bearer\s+)[A-Za-z0-9._~+/=-]{12,}/g;
+export function redactSecrets(text, secrets = []) {
+    if (!text)
+        return text;
+    let out = text;
+    for (const secret of secrets) {
+        const value = (secret || '').trim();
+        // Short values would mask ordinary words; real keys are far longer
+        if (value.length >= 8) {
+            out = out.split(value).join(MASK);
+        }
+    }
+    return out
+        .replace(AM_KEY_PATTERN, `$1${MASK}`)
+        .replace(URL_CREDENTIALS_PATTERN, `$1${MASK}@`)
+        .replace(BEARER_PATTERN, `$1${MASK}`);
+}
+/** The secrets this process knows about, for exact-match masking. */
+export function knownSecrets(apiKey) {
+    return [apiKey, process.env.AGILEMONSTER_API_KEY, process.env.AM_API_KEY].filter((v) => typeof v === 'string' && v.trim() !== '');
+}
+/** Mask every text part of a tool result or resource read, leaving its shape untouched. */
+export function redactResult(result, secrets = []) {
+    const fix = (part) => part && typeof part === 'object' && typeof part.text === 'string'
+        ? { ...part, text: redactSecrets(part.text, secrets) }
+        : part;
+    const r = result;
+    if (!r || typeof r !== 'object')
+        return result;
+    if (Array.isArray(r.content))
+        return { ...r, content: r.content.map(fix) };
+    if (Array.isArray(r.contents))
+        return { ...r, contents: r.contents.map(fix) };
+    return result;
+}
+/**
+ * A git remote as it may leave this machine: `https://user:token@host/...` and `https://token@host/...`
+ * lose their credentials; the ssh login name (`git@host:...`) is not a secret and stays.
+ */
+export function stripRemoteCredentials(remote) {
+    const value = (remote || '').trim();
+    if (!value)
+        return '';
+    return value
+        .replace(/^(https?:\/\/)[^/@\s]+@/i, '$1')
+        .replace(/^([a-z][a-z0-9+.-]*:\/\/[^/@:\s]+):[^/@\s]+@/i, '$1@');
+}