@ai-ecoverse/mcpcat 0.2.0 → 0.4.0

package/dist/host/mcpcat.mjs

@@ -1273,7 +1273,7 @@ var DEFAULT_RECONNECT_MAX_DELAY_MS = 3e4;
 var DEFAULT_RECONNECT_MAX_RETRIES = 5;
 async function consumeSseStream(stream, options) {
   const reader = stream.getReader();
-  const decoder = new TextDecoder();
+  const decoder2 = new TextDecoder();
   let buffered = "";
   let eventName;
   let eventId;
@@ -1324,7 +1324,7 @@ async function consumeSseStream(stream, options) {
       const { done, value } = await reader.read();
       if (done)
         break;
-      buffered += decoder.decode(value, { stream: true });
+      buffered += decoder2.decode(value, { stream: true });
       let newline = buffered.indexOf("\n");
       while (newline >= 0) {
         processLine(buffered.slice(0, newline));
@@ -1334,7 +1334,7 @@ async function consumeSseStream(stream, options) {
       if (Buffer.byteLength(buffered) > maxEventBytes)
         throw new Error(`MCP SSE event exceeds ${maxEventBytes} bytes`);
     }
-    buffered += decoder.decode();
+    buffered += decoder2.decode();
     if (buffered)
       processLine(buffered);
     dispatch();
@@ -1862,16 +1862,16 @@ async function createStatelessConnection(options) {
     }
     if (res.status >= 400) {
       const text = await res.text();
-      let rpcError;
+      let rpcError2;
       try {
         const parsed = JSON.parse(text);
         if (parsed.error && typeof parsed.error.code === "number") {
-          rpcError = parsed.error;
+          rpcError2 = parsed.error;
         }
       } catch {
       }
-      if (rpcError) {
-        throw new StatelessRpcError(rpcError.code, rpcError.message, rpcError.data);
+      if (rpcError2) {
+        throw new StatelessRpcError(rpcError2.code, rpcError2.message, rpcError2.data);
       }
       throw new StatelessHttpError(res.status, res.statusText, method, text.slice(0, 512));
     }
@@ -1888,10 +1888,10 @@ async function createStatelessConnection(options) {
     }
     return frame.result;
   }
-  const discoverResult = await request("server/discover", {
+  const discoverResult2 = await request("server/discover", {
     protocolVersion: STATELESS_PROTOCOL_VERSION
   });
-  const supported = Array.isArray(discoverResult?.supportedVersions) ? discoverResult.supportedVersions.filter((v) => typeof v === "string") : [];
+  const supported = Array.isArray(discoverResult2?.supportedVersions) ? discoverResult2.supportedVersions.filter((v) => typeof v === "string") : [];
   if (!supported.includes(STATELESS_PROTOCOL_VERSION)) {
     throw new Error(
       `Server does not support ${STATELESS_PROTOCOL_VERSION} (advertised: ${supported.join(", ") || "none"})`
@@ -1902,7 +1902,7 @@ async function createStatelessConnection(options) {
   return {
     async info() {
       if (serverInfoCache) return serverInfoCache;
-      const result = discoverResult;
+      const result = discoverResult2;
       serverInfoCache = {
         name: result?.serverInfo?.name,
         version: result?.serverInfo?.version,
@@ -2073,32 +2073,2626 @@ function configToTarget(entry) {
   throw new Error("config entry has neither url nor command");
 }
 
-// src/config/source.ts
-function createConfigSource(platform2) {
-  const home = platform2.env.HOME ?? platform2.env.USERPROFILE ?? "";
-  const piDir = platform2.env.PI_CODING_AGENT_DIR ?? `${home}/.pi/agent`;
-  const configPath = `${piDir}/mcp.json`;
+// src/config/parse.ts
+var SERVER_NAME = /^[A-Za-z0-9_-]+$/;
+var EXPOSURES = ["codemode", "deferred", "direct", "hidden"];
+var EXPOSURE_ALIASES = { "codemode-deferred": "codemode" };
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isStringRecord(value) {
+  return isRecord(value) && Object.values(value).every((v) => typeof v === "string");
+}
+function isExposure(value) {
+  return typeof value === "string" && EXPOSURES.includes(value);
+}
+function resolveAlias(value) {
+  return typeof value === "string" ? EXPOSURE_ALIASES[value] ?? value : value;
+}
+function resolveAliases(value) {
+  const out = { ...value };
+  if (out.exposure !== void 0) out.exposure = resolveAlias(out.exposure);
+  if (isRecord(out.toolExposure)) {
+    out.toolExposure = Object.fromEntries(
+      Object.entries(out.toolExposure).map(([k, v]) => [k, resolveAlias(v)])
+    );
+  }
+  return out;
+}
+function fail(server, message, field) {
+  return { server, ...field ? { field } : {}, message };
+}
+function validateCommon(name, value) {
+  const exposures = EXPOSURES.map((e) => `"${e}"`).join(", ");
+  if (value.exposure !== void 0 && !isExposure(value.exposure))
+    return fail(name, `exposure must be one of ${exposures}`, "exposure");
+  if (value.toolExposure !== void 0) {
+    if (!isRecord(value.toolExposure))
+      return fail(name, "toolExposure must map tool names to exposures", "toolExposure");
+    for (const [tool, exp] of Object.entries(value.toolExposure))
+      if (!isExposure(exp))
+        return fail(
+          name,
+          `toolExposure "${tool}" must be one of ${exposures}`,
+          `toolExposure.${tool}`
+        );
+  }
+  if (value.enabled !== void 0 && typeof value.enabled !== "boolean")
+    return fail(name, "enabled must be a boolean", "enabled");
+  if (value.description !== void 0 && typeof value.description !== "string")
+    return fail(name, "description must be a string", "description");
+  if (value.timeout !== void 0 && (typeof value.timeout !== "number" || !(value.timeout > 0)))
+    return fail(name, "timeout must be a positive number of seconds", "timeout");
+  return void 0;
+}
+function validateOAuthFields(name, oauth) {
+  if (oauth.clientId !== void 0 && typeof oauth.clientId !== "string")
+    return fail(name, "oauth.clientId must be a string", "oauth.clientId");
+  if (oauth.clientSecret !== void 0 && typeof oauth.clientSecret !== "string")
+    return fail(name, "oauth.clientSecret must be a string", "oauth.clientSecret");
+  const port = oauth.callbackPort;
+  if (port !== void 0 && (typeof port !== "number" || !Number.isInteger(port) || port < 1 || port > 65535))
+    return fail(name, "oauth.callbackPort must be a port number", "oauth.callbackPort");
+  if (oauth.callbackUrl !== void 0 && typeof oauth.callbackUrl !== "string")
+    return fail(name, "oauth.callbackUrl must be a string", "oauth.callbackUrl");
+  if (oauth.scope !== void 0 && typeof oauth.scope !== "string")
+    return fail(name, "oauth.scope must be a string", "oauth.scope");
+  if (oauth.clientName !== void 0 && (typeof oauth.clientName !== "string" || !oauth.clientName.trim()))
+    return fail(name, "oauth.clientName must be a non-empty string", "oauth.clientName");
+  return void 0;
+}
+function validateOAuthExtras(name, oauth) {
+  if (oauth.clientRegistration !== void 0 && oauth.clientRegistration !== "dcr" && oauth.clientRegistration !== "cimd")
+    return fail(
+      name,
+      'oauth.clientRegistration must be "dcr" or "cimd"',
+      "oauth.clientRegistration"
+    );
+  if (oauth.authServerMetadataUrl !== void 0) {
+    const url = typeof oauth.authServerMetadataUrl === "string" && URL.canParse(oauth.authServerMetadataUrl) ? new URL(oauth.authServerMetadataUrl) : void 0;
+    if (!url || url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)))
+      return fail(
+        name,
+        "oauth.authServerMetadataUrl must be an https URL",
+        "oauth.authServerMetadataUrl"
+      );
+  }
+  return void 0;
+}
+function validateOAuth(name, value) {
+  const { oauth } = value;
+  if (oauth === void 0) return void 0;
+  if (!isRecord(oauth)) return fail(name, "oauth must be an object", "oauth");
+  return validateOAuthFields(name, oauth) ?? validateOAuthExtras(name, oauth);
+}
+function validateHttpServer(name, value) {
+  if (typeof value.url !== "string" || value.type !== void 0 && value.type !== "http" && value.type !== "streamable-http")
+    return void 0;
+  if (!URL.canParse(value.url) || !/^https?:$/.test(new URL(value.url).protocol))
+    return fail(name, "url must be an http or https URL", "url");
+  if (value.headers !== void 0 && !isStringRecord(value.headers))
+    return fail(name, "headers must map names to strings", "headers");
+  const oauthErr = validateOAuth(name, value);
+  if (oauthErr) return oauthErr;
+  return value;
+}
+function validateStdioServer(name, value) {
+  if (typeof value.command !== "string" || value.type !== void 0 && value.type !== "stdio")
+    return void 0;
+  if (value.args !== void 0 && !(Array.isArray(value.args) && value.args.every((a) => typeof a === "string")))
+    return fail(name, "args must be an array of strings", "args");
+  if (value.env !== void 0 && !isStringRecord(value.env))
+    return fail(name, "env must map names to strings", "env");
+  if (value.cwd !== void 0 && typeof value.cwd !== "string")
+    return fail(name, "cwd must be a string", "cwd");
+  return value;
+}
+function validateServer(name, raw) {
+  if (!SERVER_NAME.test(name))
+    return fail(name, `invalid server name "${name}" (use letters, digits, "_" and "-")`);
+  if (!isRecord(raw)) return fail(name, "must be an object");
+  const value = resolveAliases(raw);
+  if (value.type === "sse")
+    return fail(name, "legacy SSE transport is not supported; use the streamable HTTP URL", "type");
+  const common = validateCommon(name, value);
+  if (common) return common;
+  const httpResult = validateHttpServer(name, value);
+  if (httpResult) return httpResult;
+  const stdioResult = validateStdioServer(name, value);
+  if (stdioResult) return stdioResult;
+  if (value.type !== void 0 && !["http", "streamable-http", "stdio"].includes(value.type))
+    return fail(name, 'type must be "stdio", "http", or "streamable-http"', "type");
+  return fail(name, 'needs a "url" or "command"');
+}
+function isOverride(value) {
+  return value.command === void 0 && value.url === void 0 && value.type === void 0;
+}
+function canonical(name) {
+  return name.replace(/-/g, "_");
+}
+function parseMcpJson(text) {
+  const result = { servers: [], overrides: [], problems: [] };
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (error) {
+    result.problems.push({ message: `not valid JSON: ${error.message}` });
+    return result;
+  }
+  if (!isRecord(parsed) || parsed.mcpServers !== void 0 && !isRecord(parsed.mcpServers)) {
+    result.problems.push({ message: "mcpServers must be an object" });
+    return result;
+  }
+  if (typeof parsed.autoEnableCodemode === "boolean")
+    result.autoEnableCodemode = parsed.autoEnableCodemode;
+  else if (parsed.autoEnableCodemode !== void 0)
+    result.problems.push({ message: "autoEnableCodemode must be a boolean" });
+  const seen = /* @__PURE__ */ new Set();
+  for (const [name, raw] of Object.entries(parsed.mcpServers ?? {})) {
+    if (!SERVER_NAME.test(name)) {
+      result.problems.push(
+        fail(name, `invalid server name "${name}" (use letters, digits, "_" and "-")`)
+      );
+      continue;
+    }
+    if (seen.has(canonical(name))) {
+      result.problems.push(
+        fail(name, 'names that differ only in "-" and "_" count as the same server')
+      );
+      continue;
+    }
+    seen.add(canonical(name));
+    if (isRecord(raw) && isOverride(raw)) {
+      result.overrides.push({ name, raw });
+      continue;
+    }
+    const checked = validateServer(name, raw);
+    if ("message" in checked) {
+      result.problems.push(checked);
+      continue;
+    }
+    result.servers.push({ name, config: checked });
+  }
+  return result;
+}
+
+// src/config/merge.ts
+var OVERRIDE_KEYS = /* @__PURE__ */ new Set(["enabled", "exposure", "toolExposure"]);
+async function readFile(fs, path) {
+  try {
+    const data = await fs.readFile(path);
+    return new TextDecoder().decode(data);
+  } catch {
+    return void 0;
+  }
+}
+function applyOverride(servers, problems, name, override, projectPath) {
+  const raw = override;
+  const base = servers.get(name);
+  const extra = Object.keys(raw).filter((k) => !OVERRIDE_KEYS.has(k));
+  if (!base) {
+    problems.push({
+      server: name,
+      message: 'needs "command" or "url", or a user server to override'
+    });
+    return;
+  }
+  if (extra.length > 0) {
+    problems.push({
+      server: name,
+      message: "an override can only set enabled, exposure, toolExposure"
+    });
+    return;
+  }
+  const merged = { ...base.config, ...raw };
+  servers.set(name, { ...base, config: merged, override: projectPath });
+}
+function applyProjectEntry(servers, problems, name, config, projectPath) {
+  const clash = [...servers.keys()].find(
+    (other) => other !== name && canonical(other) === canonical(name)
+  );
+  if (clash) {
+    problems.push({
+      server: name,
+      message: `conflicts with "${clash}" (names differ only in "-"/"_")`
+    });
+    return;
+  }
+  servers.set(name, { name, config, source: projectPath, scope: "project" });
+}
+function loadUserServers(parsed, userPath, servers, problems) {
+  for (const p of parsed.problems) problems.push(p);
+  for (const { name, config } of parsed.servers) {
+    servers.set(name, { name, config, source: userPath, scope: "user" });
+  }
+}
+function loadProjectServers(parsed, projectPath, servers, problems) {
+  for (const p of parsed.problems) problems.push(p);
+  for (const { name, raw } of parsed.overrides) {
+    applyOverride(servers, problems, name, raw, projectPath);
+  }
+  for (const { name, config } of parsed.servers) {
+    applyProjectEntry(servers, problems, name, config, projectPath);
+  }
+}
+async function loadConfig(input) {
+  const servers = /* @__PURE__ */ new Map();
+  const problems = [];
+  let autoEnableCodemode;
+  const userText = await readFile(input.fs, input.userPath);
+  if (userText !== void 0) {
+    const parsed = parseMcpJson(userText);
+    if (parsed.autoEnableCodemode !== void 0) autoEnableCodemode = parsed.autoEnableCodemode;
+    loadUserServers(parsed, input.userPath, servers, problems);
+  }
+  if (input.projectPath && input.trustProject) {
+    const projectText = await readFile(input.fs, input.projectPath);
+    if (projectText !== void 0) {
+      const parsed = parseMcpJson(projectText);
+      if (parsed.autoEnableCodemode !== void 0) autoEnableCodemode = parsed.autoEnableCodemode;
+      loadProjectServers(parsed, input.projectPath, servers, problems);
+    }
+  }
+  return {
+    servers: [...servers.values()],
+    problems,
+    ...autoEnableCodemode !== void 0 ? { autoEnableCodemode } : {}
+  };
+}
+
+// src/config/paths.ts
+function userConfigDir(platform2) {
+  const piDir = platform2.env.PI_CODING_AGENT_DIR;
+  if (piDir) return piDir;
+  const home = platform2.env.HOME ?? platform2.env.USERPROFILE ?? "/";
+  return `${home}/.pi/agent`;
+}
+function userConfigPath(platform2) {
+  return `${userConfigDir(platform2)}/mcp.json`;
+}
+function projectConfigPath(platform2) {
+  return `${platform2.cwd}/.pi/mcp.json`;
+}
+
+// src/config/index.ts
+var MergedConfigSource = class _MergedConfigSource {
+  entries;
+  config;
+  constructor(config) {
+    this.config = config;
+    this.entries = /* @__PURE__ */ new Map();
+    for (const entry of config.servers) {
+      this.entries.set(entry.name, entry);
+    }
+  }
+  async get(name) {
+    const normalizedName = name.replace(/[-_]/g, "").toLowerCase();
+    for (const [key, entry] of this.entries) {
+      if (key.replace(/[-_]/g, "").toLowerCase() === normalizedName) {
+        return entry.config;
+      }
+    }
+    return void 0;
+  }
+  entry(name) {
+    return this.entries.get(name);
+  }
+  list() {
+    return [...this.entries.values()];
+  }
+  static async load(platform2, options) {
+    const userPath = options?.configFile ?? userConfigPath(platform2);
+    const projectPath = options?.configFile ? void 0 : projectConfigPath(platform2);
+    const config = await loadConfig({
+      userPath,
+      projectPath,
+      trustProject: options?.trustProject ?? false,
+      fs: platform2.fs
+    });
+    return new _MergedConfigSource(config);
+  }
+};
+
+// src/config/expand.ts
+var PLACEHOLDER = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
+var PLACEHOLDER_TEST = /\$\{[A-Za-z_][A-Za-z0-9_]*\}/;
+function containsPlaceholders(value) {
+  return PLACEHOLDER_TEST.test(value);
+}
+function expandPlaceholdersStrict(value, env) {
+  let hasUndefined = false;
+  const result = value.replace(PLACEHOLDER, (_, name) => {
+    if (env[name] === void 0) {
+      hasUndefined = true;
+      return "";
+    }
+    return env[name];
+  });
+  if (hasUndefined) return void 0;
+  return result;
+}
+
+// src/serve/catalog.ts
+var NAME_RE = /^[A-Za-z][\w-]*$/;
+function sanitizeName(raw) {
+  const cleaned = raw.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+  return cleaned || "cli";
+}
+function cliPrefix(help, filePath, explicit) {
+  if (explicit) return sanitizeName(explicit);
+  const fromUsage = usageProgramName(help);
+  if (fromUsage) return sanitizeName(fromUsage);
+  const base = filePath.split("/").pop() ?? filePath;
+  return sanitizeName(base.replace(/\.jsh$/i, ""));
+}
+function parseHelp(help) {
+  const block = commandsFromBlock(help);
+  const program = usageProgramName(help);
+  const commands = mergeCommandLists(block.commands, usageCommands(help, program));
+  return {
+    ...program ? { program } : {},
+    commands: applyScopedFlags(commands, block.scoped),
+    globalFlags: block.globalFlags
+  };
+}
+function isGroupCandidate(command) {
+  return command.path.length === 1 && command.positionals.length === 0 && command.flags.length === 0;
+}
+function nestGroup(commands, group, nested, topNames) {
+  const children = attachGlobalFlags(nested.commands, nested.globalFlags);
+  if (children.length === 0) return null;
+  const childNames = children.map((child) => child.path[0] ?? "");
+  const same = childNames.length === topNames.size && childNames.every((name) => topNames.has(name));
+  if (same) return null;
+  const nestedCommands = children.map((child) => ({ ...child, path: childPath(group, child) }));
+  return commands.filter((command) => command.path[0] !== group).concat(nestedCommands);
+}
+function attachGlobalFlags(commands, globalFlags) {
+  if (globalFlags.length === 0) return commands;
+  return commands.map((command) => ({ ...command, flags: mergeFlags(command.flags, globalFlags) }));
+}
+function parseMcpOverride(stdout) {
+  let value;
+  try {
+    value = JSON.parse(stdout);
+  } catch {
+    return null;
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const commandsValue = Object.getOwnPropertyDescriptor(value, "commands")?.value;
+  if (!Array.isArray(commandsValue)) return null;
+  const commands = [];
+  for (const entry of commandsValue) {
+    const command = readMcpCommand(entry);
+    if (command) commands.push(command);
+  }
+  if (commands.length === 0) return null;
+  return { commands, globalFlags: [] };
+}
+function buildTools(prefix, commands) {
+  const tools = [
+    {
+      name: `${prefix}_help`,
+      description: `Show ${prefix} help.`,
+      inputSchema: objectSchema({}),
+      cli: prefix,
+      kind: "help",
+      commandPath: []
+    },
+    {
+      name: `${prefix}_invoke`,
+      description: `Run ${prefix} with an argv array (one element per argument) and optional stdin. A non-zero exit is a tool error.`,
+      inputSchema: invokeSchema(),
+      cli: prefix,
+      kind: "invoke",
+      commandPath: []
+    }
+  ];
+  for (const command of commands) {
+    const leaf = command.path.join("_");
+    tools.push({
+      name: `${prefix}_${leaf}`,
+      description: command.description || `Run ${prefix} ${command.path.join(" ")}`,
+      inputSchema: commandSchema(command),
+      cli: prefix,
+      kind: "command",
+      commandPath: command.path
+    });
+  }
+  return tools;
+}
+function readToolArguments(input) {
+  if (input === void 0 || input === null) return { fields: [] };
+  if (typeof input !== "object" || Array.isArray(input)) {
+    return { fields: [], error: "arguments must be an object" };
+  }
+  const fields = [];
+  let stdin;
+  let passthrough;
+  let argv;
+  for (const key of Object.keys(input)) {
+    const value = Object.getOwnPropertyDescriptor(input, key)?.value;
+    const read = readArgument(key, value);
+    if (read.error) return { fields, error: read.error };
+    if (read.stdin !== void 0) stdin = read.stdin;
+    else if (read.passthrough) passthrough = read.passthrough;
+    else if (read.argv) argv = read.argv;
+    else if (read.field) fields.push(read.field);
+  }
+  return {
+    fields,
+    ...stdin !== void 0 ? { stdin } : {},
+    ...passthrough ? { passthrough } : {},
+    ...argv ? { argv } : {}
+  };
+}
+function argvForCommand(command, args2) {
+  if (args2.error) return { error: args2.error };
+  const argv = [...command.path];
+  for (const positional of command.positionals) {
+    const found = args2.fields.find((field) => field.name === positional.name);
+    if (!found) {
+      if (positional.required) return { error: `missing ${positional.name}` };
+      continue;
+    }
+    if (typeof found.value !== "string" && typeof found.value !== "number") {
+      return { error: `${positional.name} must be a string` };
+    }
+    argv.push(String(found.value));
+  }
+  const flags = appendFlags(command.flags, args2.fields);
+  if ("error" in flags) return flags;
+  argv.push(...flags.argv);
+  if (args2.passthrough) argv.push(...args2.passthrough);
+  return { argv, ...args2.stdin !== void 0 ? { stdin: args2.stdin } : {} };
+}
+function appendFlags(flags, fields) {
+  const argv = [];
+  for (const flag of flags) {
+    const found = fields.find((field) => field.name === flag.name);
+    if (!found || found.value === false) continue;
+    const encoded = encodeFlag(flag, found.value);
+    if ("error" in encoded) return encoded;
+    argv.push(...encoded.argv);
+  }
+  return { argv };
+}
+function encodeFlag(flag, value) {
+  if (flag.type === "boolean") {
+    return value === true ? { argv: [`--${flag.name}`] } : { argv: [] };
+  }
+  if (flag.type === "string[]") {
+    if (!Array.isArray(value)) return { error: `${flag.name} must be an array of strings` };
+    const argv = [];
+    for (const item of value) argv.push(`--${flag.name}`, item);
+    return { argv };
+  }
+  if (typeof value !== "string" && typeof value !== "number") {
+    return { error: `${flag.name} must be a string` };
+  }
+  return { argv: [`--${flag.name}`, String(value)] };
+}
+function commandsFromBlock(help) {
+  let section = "none";
+  const commands = [];
+  const globalFlags = [];
+  const scoped = [];
+  for (const rawLine of help.split("\n")) {
+    const line = rawLine.replace(/\t/g, "  ");
+    const header = classifyHeader(line);
+    if (header) {
+      section = header.kind === "other" ? "none" : header.kind;
+      if (header.kind === "scoped" && header.name) scoped.push({ name: header.name, flags: [] });
+      continue;
+    }
+    pushSectionLine(section, line, commands, globalFlags, scoped);
+  }
+  return { commands, globalFlags, scoped };
+}
+function pushSectionLine(section, line, commands, globalFlags, scoped) {
+  if (section === "commands") {
+    const command = parseCommandLine(line);
+    if (command) commands.push(command);
+    return;
+  }
+  const flag = parseFlagLine(line);
+  if (!flag) return;
+  if (section === "options") globalFlags.push(flag);
+  if (section === "scoped") scoped[scoped.length - 1]?.flags.push(flag);
+}
+function classifyHeader(line) {
+  const text = line.trim();
+  if (/^commands:?$/i.test(text)) return { kind: "commands" };
+  if (/^options:?$/i.test(text)) return { kind: "options" };
+  const flags = /^([A-Za-z][\w-]*)\s+flags:?$/i.exec(text);
+  if (flags?.[1]) return { kind: "scoped", name: flags[1].toLowerCase() };
+  if (/^[A-Z][A-Z0-9 ]+:$/.test(text)) return { kind: "other" };
+  return null;
+}
+function parseCommandLine(line) {
+  if (!/^\s{2,}\S/.test(line)) return null;
+  const parts = line.trim().split(/\s{2,}/);
+  if (parts.length < 2) return null;
+  const tokens = tokenize(parts[0] ?? "");
+  const name = tokens[0] ?? "";
+  if (!NAME_RE.test(name) || name.startsWith("-")) return null;
+  const spec = emptySpec();
+  for (const token of tokens.slice(1)) parseUsageToken(token, spec);
+  return {
+    path: [name],
+    description: parts.slice(1).join(" ").trim(),
+    positionals: spec.positionals,
+    flags: spec.flags
+  };
+}
+function usageProgramName(help) {
+  for (const raw of help.split("\n")) {
+    if (!/^[\s>*]*usage:/i.test(raw)) continue;
+    const tokens = tokenize(raw);
+    const name = tokens[0];
+    if (name && NAME_RE.test(name)) return name;
+  }
+  return void 0;
+}
+function usageCommands(help, program) {
+  const commands = [];
+  for (const raw of help.split("\n")) {
+    const command = usageCommand(raw, program);
+    if (command) commands.push(command);
+  }
+  return commands;
+}
+function isCommandSlot(token) {
+  const inner = token.replace(/^\[|\]$/g, "").replace(/^<|>$/g, "").toLowerCase();
+  return inner === "command" || inner === "cmd" || inner === "subcommand" || inner === "verb";
+}
+function usageCommand(raw, program) {
+  const line = raw.trim();
+  const tokens = tokenize(line);
+  if (tokens.length < 2) return null;
+  const isUsage = /^usage:/i.test(line);
+  if (!isUsage && tokens[0] !== program) return null;
+  const path = [];
+  let index = 1;
+  while (index < tokens.length && path.length < 2 && NAME_RE.test(tokens[index] ?? "")) {
+    path.push(tokens[index] ?? "");
+    index++;
+  }
+  if (path.length === 0) return null;
+  if (isCommandSlot(tokens[index] ?? "")) return null;
+  const spec = emptySpec();
+  for (const token of tokens.slice(index)) parseUsageToken(token, spec);
+  return { path, description: "", positionals: spec.positionals, flags: spec.flags };
+}
+function emptySpec() {
+  return { positionals: [], flags: [] };
+}
+function parseUsageToken(token, into) {
+  const optional = token.startsWith("[") && token.endsWith("]");
+  const inner = optional ? token.slice(1, -1).trim() : token;
+  if (inner.startsWith("--")) {
+    const flag = parseFlagToken(inner);
+    if (flag) into.flags.push(flag);
+    return;
+  }
+  if (inner.startsWith("<") && inner.endsWith(">")) {
+    into.positionals.push({
+      name: cleanName(inner.slice(1, -1)),
+      required: !optional,
+      description: ""
+    });
+    return;
+  }
+  if (NAME_RE.test(inner)) {
+    into.positionals.push({ name: cleanName(inner), required: !optional, description: "" });
+  }
+}
+function parseFlagToken(inner) {
+  const match = /^--([A-Za-z][\w-]*)(?:(?:=|\s+)(\S+))?$/.exec(inner.trim());
+  if (!match?.[1]) return null;
+  const value = match[2] ?? "";
+  if (!value) return { name: match[1], type: "boolean", description: "" };
+  return { name: match[1], type: value.includes("...") ? "string[]" : "string", description: "" };
+}
+function parseFlagLine(line) {
+  const trimmed = line.trim();
+  if (!trimmed.includes("--")) return null;
+  const match = /--([A-Za-z][\w-]*)(?:=(\S+)|(?:\s+(<[^>]+>|\[[^\]]+\]|[A-Z][A-Z0-9_-]+)))?/.exec(
+    trimmed
+  );
+  if (!match?.[1]) return null;
+  const value = match[2] || match[3] || "";
+  const repeatable = /\brepeat|\.\.\.|one or more/i.test(trimmed);
+  const description = flagDescription(trimmed);
+  if (!value && !repeatable) return { name: match[1], type: "boolean", description };
+  return { name: match[1], type: repeatable ? "string[]" : "string", description };
+}
+function flagDescription(line) {
+  const parts = line.trim().split(/\s{2,}/);
+  return parts.length > 1 ? parts.slice(1).join(" ").trim() : "";
+}
+function tokenize(line) {
+  const source = line.trim().replace(/^usage:\s*/i, "");
+  const tokens = [];
+  let index = 0;
+  while (index < source.length) {
+    if (source[index] === " ") {
+      index++;
+      continue;
+    }
+    const closer = source[index] === "[" ? "]" : source[index] === "<" ? ">" : "";
+    if (closer) {
+      const end = source.indexOf(closer, index);
+      if (end === -1) {
+        tokens.push(source.slice(index));
+        break;
+      }
+      tokens.push(source.slice(index, end + 1));
+      index = end + 1;
+      continue;
+    }
+    const next = source.indexOf(" ", index);
+    if (next === -1) {
+      tokens.push(source.slice(index));
+      break;
+    }
+    tokens.push(source.slice(index, next));
+    index = next;
+  }
+  return tokens;
+}
+function mergeCommandLists(primary, extra) {
+  const merged = primary.map((command) => ({ ...command }));
+  for (const command of extra) {
+    const existing = merged.find((item) => samePath(item.path, command.path));
+    if (!existing) {
+      merged.push(command);
+      continue;
+    }
+    if (existing.positionals.length === 0) existing.positionals = command.positionals;
+    if (!existing.description) existing.description = command.description;
+    existing.flags = mergeFlags(existing.flags, command.flags);
+  }
+  return merged;
+}
+function applyScopedFlags(commands, scoped) {
+  return commands.map((command) => {
+    const extra = scoped.find((scope) => scope.name === (command.path[0] ?? "").toLowerCase());
+    if (!extra) return command;
+    return { ...command, flags: mergeFlags(command.flags, extra.flags) };
+  });
+}
+function mergeFlags(left, right) {
+  const merged = [...left];
+  for (const flag of right) {
+    if (!merged.some((existing) => existing.name === flag.name)) merged.push(flag);
+  }
+  return merged;
+}
+function samePath(left, right) {
+  return left.length === right.length && left.every((part, index) => part === right[index]);
+}
+function childPath(group, child) {
+  if (child.path[0] === group) return child.path.slice(0, 2);
+  return [group, child.path[0] ?? ""].filter((part) => part.length > 0).slice(0, 2);
+}
+function cleanName(raw) {
+  const cleaned = raw.replace(/[^A-Za-z0-9_-]+/g, "").replace(/^-+/, "");
+  return cleaned || "arg";
+}
+function readMcpCommand(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const name = ownString(value, "name");
+  if (!name) return null;
+  const path = name.split(/\s+/).filter((part) => NAME_RE.test(part)).slice(0, 2);
+  if (path.length === 0) return null;
+  return {
+    path,
+    description: ownString(value, "description") ?? "",
+    positionals: readMcpPositionals(Object.getOwnPropertyDescriptor(value, "positionals")?.value),
+    flags: readMcpFlags(Object.getOwnPropertyDescriptor(value, "flags")?.value)
+  };
+}
+function readMcpPositionals(value) {
+  if (!Array.isArray(value)) return [];
+  const positionals = [];
+  for (const entry of value) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
+    const name = ownString(entry, "name");
+    if (!name) continue;
+    const required = Object.getOwnPropertyDescriptor(entry, "required")?.value;
+    positionals.push({ name, required: required !== false, description: "" });
+  }
+  return positionals;
+}
+function readMcpFlags(value) {
+  if (!Array.isArray(value)) return [];
+  const flags = [];
+  for (const entry of value) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
+    const name = ownString(entry, "name");
+    const type = ownString(entry, "type");
+    if (!name || type !== "boolean" && type !== "string" && type !== "string[]") continue;
+    flags.push({ name, type, description: "" });
+  }
+  return flags;
+}
+function ownString(value, key) {
+  const found = Object.getOwnPropertyDescriptor(value, key)?.value;
+  return typeof found === "string" && found.length > 0 ? found : void 0;
+}
+function objectSchema(properties, required) {
+  return {
+    type: "object",
+    properties,
+    additionalProperties: false,
+    ...required && required.length > 0 ? { required } : {}
+  };
+}
+function invokeSchema() {
+  return objectSchema(
+    {
+      argv: {
+        type: "array",
+        items: { type: "string" },
+        description: "Arguments, one element per argument. Never a shell string."
+      },
+      stdin: { type: "string", description: "Optional standard input." }
+    },
+    ["argv"]
+  );
+}
+function commandSchema(command) {
+  const properties = {};
+  const required = [];
+  for (const positional of command.positionals) {
+    properties[positional.name] = {
+      type: "string",
+      description: positional.description || positional.name
+    };
+    if (positional.required) required.push(positional.name);
+  }
+  for (const flag of command.flags) {
+    properties[flag.name] = flagProperty(flag);
+  }
+  properties.stdin = { type: "string", description: "Optional standard input." };
+  properties.passthrough = {
+    type: "array",
+    items: { type: "string" },
+    description: "Extra arguments appended as-is."
+  };
+  return objectSchema(properties, required);
+}
+function flagProperty(flag) {
+  if (flag.type === "boolean")
+    return { type: "boolean", description: flag.description || flag.name };
+  if (flag.type === "string[]") {
+    return { type: "array", items: { type: "string" }, description: flag.description || flag.name };
+  }
+  return { type: "string", description: flag.description || flag.name };
+}
+function readArgument(key, value) {
+  if (key === "stdin") {
+    return typeof value === "string" ? { stdin: value } : { error: "stdin must be a string" };
+  }
+  if (key === "passthrough") return readStringArray(value, "passthrough");
+  if (key === "argv") {
+    const read = readStringArray(value, "argv");
+    return read.passthrough ? { argv: read.passthrough } : read;
+  }
+  if (!isArgValue(value)) return { error: `${key} has an unsupported type` };
+  return { field: { name: key, value } };
+}
+function readStringArray(value, label) {
+  if (!Array.isArray(value) || !value.every((item) => typeof item === "string")) {
+    return { error: `${label} must be an array of strings` };
+  }
+  return { passthrough: value };
+}
+function isArgValue(value) {
+  if (typeof value === "string" || typeof value === "boolean" || typeof value === "number")
+    return true;
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function parseToolTemplate(spec) {
+  const colonIdx = spec.indexOf(":");
+  if (colonIdx <= 0) return null;
+  const name = spec.slice(0, colonIdx).trim();
+  const template = spec.slice(colonIdx + 1).trim();
+  if (!name || !template) return null;
+  const placeholders = [];
+  const re = /\{(\w+)\}/g;
+  let m;
+  while ((m = re.exec(template)) !== null) {
+    if (!placeholders.includes(m[1])) placeholders.push(m[1]);
+  }
+  const properties = {};
+  for (const ph of placeholders) {
+    properties[ph] = { type: "string", description: ph };
+  }
+  return {
+    name,
+    description: template,
+    inputSchema: {
+      type: "object",
+      properties,
+      required: placeholders,
+      additionalProperties: false
+    },
+    cli: "",
+    kind: "command",
+    commandPath: []
+  };
+}
+function templateToArgv(template, args2) {
+  let expanded = template;
+  for (const [key, value] of Object.entries(args2)) {
+    expanded = expanded.replaceAll(`{${key}}`, value);
+  }
+  return expanded.split(/\s+/).filter(Boolean);
+}
+
+// src/serve/http.ts
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+var MAX_HEADER_SIZE = 16384;
+var MAX_BODY_SIZE = 10485760;
+async function readUntil(reader, buf, bufLen, sentinel, maxSize) {
+  for (; ; ) {
+    const text = decoder.decode(new Uint8Array(buf.buffer, buf.byteOffset, bufLen));
+    const pos = text.indexOf(sentinel);
+    if (pos >= 0) return { buf, bufLen, pos };
+    if (bufLen >= maxSize) return null;
+    const { done, value } = await reader.read();
+    if (done) return null;
+    if (bufLen + value.length > buf.length) {
+      const newBuf = new Uint8Array(Math.max(buf.length * 2, bufLen + value.length));
+      newBuf.set(new Uint8Array(buf.buffer, buf.byteOffset, bufLen));
+      buf = newBuf;
+    }
+    buf.set(value, bufLen);
+    bufLen += value.length;
+  }
+}
+async function readExact(reader, buf, bufLen, needed) {
+  while (bufLen < needed) {
+    const { done, value } = await reader.read();
+    if (done) return null;
+    if (bufLen + value.length > buf.length) {
+      const newBuf = new Uint8Array(Math.max(buf.length * 2, bufLen + value.length));
+      newBuf.set(new Uint8Array(buf.buffer, buf.byteOffset, bufLen));
+      buf = newBuf;
+    }
+    buf.set(value, bufLen);
+    bufLen += value.length;
+  }
+  return { buf, bufLen };
+}
+function parseRequestLine(buf, endPos) {
+  const headText = decoder.decode(new Uint8Array(buf.buffer, buf.byteOffset, endPos));
+  const lines = headText.split("\r\n");
+  const requestLine = lines[0];
+  if (!requestLine) return null;
+  const parts = requestLine.split(" ");
+  if (parts.length < 2) return null;
+  const method = parts[0];
+  const target = parts[1];
+  const headers = {};
+  for (let i = 1; i < lines.length; i++) {
+    const line = lines[i];
+    if (!line) continue;
+    const colonIdx = line.indexOf(":");
+    if (colonIdx <= 0) continue;
+    headers[line.slice(0, colonIdx).trim().toLowerCase()] = line.slice(colonIdx + 1).trim();
+  }
+  return { method, target, headers, headerEnd: endPos + 4 };
+}
+async function handleConnection(readable, writable, handler) {
+  const reader = readable.getReader();
+  const writer = writable.getWriter();
+  let buf = new Uint8Array(4096);
+  let bufLen = 0;
+  try {
+    for (; ; ) {
+      const headerResult = await readUntil(reader, buf, bufLen, "\r\n\r\n", MAX_HEADER_SIZE);
+      if (!headerResult) break;
+      buf = headerResult.buf;
+      bufLen = headerResult.bufLen;
+      const parsed = parseRequestLine(buf, headerResult.pos);
+      if (!parsed) {
+        await writeResponse(writer, {
+          status: 400,
+          reason: "Bad Request",
+          headers: { "content-type": "text/plain" },
+          body: "Bad Request"
+        });
+        break;
+      }
+      const contentLength = Number(parsed.headers["content-length"] ?? 0);
+      if (contentLength > MAX_BODY_SIZE) {
+        await writeResponse(writer, {
+          status: 413,
+          reason: "Payload Too Large",
+          headers: { "content-type": "text/plain" },
+          body: "Payload Too Large"
+        });
+        break;
+      }
+      const bodyStart = parsed.headerEnd;
+      const totalNeeded = bodyStart + contentLength;
+      const bodyResult = await readExact(reader, buf, bufLen, totalNeeded);
+      if (!bodyResult && contentLength > 0) break;
+      if (bodyResult) {
+        buf = bodyResult.buf;
+        bufLen = bodyResult.bufLen;
+      }
+      const bodyBytes = buf.slice(bodyStart, bodyStart + contentLength);
+      const body = decoder.decode(bodyBytes);
+      const request = {
+        method: parsed.method,
+        target: parsed.target,
+        headers: parsed.headers,
+        body
+      };
+      const response = await handler(request);
+      await writeResponse(writer, response);
+      const connectionHeader = (parsed.headers.connection ?? "").toLowerCase();
+      if (connectionHeader === "close") break;
+      const consumed = bodyStart + contentLength;
+      const remaining = bufLen - consumed;
+      if (remaining > 0) {
+        const newBuf = new Uint8Array(Math.max(4096, remaining));
+        newBuf.set(new Uint8Array(buf.buffer, buf.byteOffset + consumed, remaining));
+        buf = newBuf;
+        bufLen = remaining;
+      } else {
+        buf = new Uint8Array(4096);
+        bufLen = 0;
+      }
+    }
+  } finally {
+    reader.releaseLock();
+    try {
+      await writer.close();
+    } catch {
+    }
+  }
+}
+async function writeResponse(writer, response) {
+  const bodyLength = new TextEncoder().encode(response.body).length;
+  const headers = { ...response.headers, "content-length": String(bodyLength) };
+  const lines = [`HTTP/1.1 ${response.status} ${response.reason}`];
+  for (const [name, value] of Object.entries(headers)) {
+    lines.push(`${name}: ${value}`);
+  }
+  lines.push("", "");
+  const headBytes = encoder.encode(lines.join("\r\n"));
+  await writer.write(headBytes);
+  if (response.body.length > 0) {
+    const bodyBytes = encoder.encode(response.body);
+    await writer.write(bodyBytes);
+  }
+}
+
+// src/serve/jsonrpc.ts
+var PROTOCOL_VERSIONS = ["2026-07-28", "2025-11-25", "2025-06-18"];
+var OUTPUT_CAP = 1048576;
+var JSON_CT = "application/json; charset=utf-8";
+async function handleJsonRpc(raw, tools, call, serverName, serverVersion) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return rpcError(null, -32700, "Parse error");
+  }
+  if (Array.isArray(parsed)) return rpcError(null, -32600, "Batch requests are not supported");
+  if (!parsed || typeof parsed !== "object") return rpcError(null, -32600, "Invalid request");
+  const method = readString(parsed, "method");
+  if (!method) return rpcError(readId(parsed), -32600, "Invalid request");
+  if (!hasOwn(parsed, "id")) return { status: 202, contentType: "text/plain", body: "" };
+  const id = readId(parsed);
+  const params = Object.getOwnPropertyDescriptor(parsed, "params")?.value;
+  if (method === "initialize")
+    return rpcOk(id, initializeResult(params, serverName, serverVersion));
+  if (method === "server/discover") return rpcOk(id, discoverResult(serverName, serverVersion));
+  if (method === "tools/list") return rpcOk(id, { tools });
+  if (method === "ping") return rpcOk(id, {});
+  if (method === "tools/call") return toolCall(id, params, tools, call);
+  return rpcError(id, -32601, `Method not found: ${method}`);
+}
+async function toolCall(id, params, tools, call) {
+  const name = params && typeof params === "object" ? readString(params, "name") : void 0;
+  if (!name) return rpcError(id, -32602, "tools/call requires a name");
+  if (!tools.some((tool) => tool.name === name))
+    return rpcError(id, -32602, `Unknown tool: ${name}`);
+  const args2 = params && typeof params === "object" ? Object.getOwnPropertyDescriptor(params, "arguments")?.value : void 0;
+  try {
+    const result = await call(name, args2);
+    return rpcOk(id, toolResult(result));
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "tool call failed";
+    return rpcError(id, -32e3, message);
+  }
+}
+function toolResult(result) {
+  const stdout = cap(result.stdout);
+  const stderr = cap(result.stderr);
+  const text = stderr ? stdout ? `${stdout}
+${stderr}` : stderr : stdout;
+  return {
+    content: [{ type: "text", text }],
+    isError: result.exitCode !== 0,
+    structuredContent: { stdout, stderr, exitCode: result.exitCode }
+  };
+}
+function initializeResult(params, serverName, serverVersion) {
+  const requested = params && typeof params === "object" ? readString(params, "protocolVersion") : void 0;
+  const protocolVersion = PROTOCOL_VERSIONS.find((version) => version === requested) ?? PROTOCOL_VERSIONS[0];
+  return {
+    protocolVersion,
+    capabilities: { tools: { listChanged: false } },
+    serverInfo: { name: serverName, version: serverVersion }
+  };
+}
+function discoverResult(serverName, serverVersion) {
+  return {
+    protocolVersion: PROTOCOL_VERSIONS[0],
+    supportedVersions: PROTOCOL_VERSIONS,
+    capabilities: { tools: { listChanged: false } },
+    serverInfo: { name: serverName, version: serverVersion }
+  };
+}
+function cap(value) {
+  if (value.length <= OUTPUT_CAP) return value;
+  const half = Math.floor(OUTPUT_CAP / 2);
+  const cut = value.length - OUTPUT_CAP;
+  return `${value.slice(0, half)}
+\u2026 ${cut} characters cut \u2026
+${value.slice(value.length - half)}`;
+}
+function rpcOk(id, result) {
+  return {
+    status: 200,
+    contentType: JSON_CT,
+    body: JSON.stringify({ jsonrpc: "2.0", id, result })
+  };
+}
+function rpcError(id, code2, message) {
   return {
-    async get(name) {
+    status: 200,
+    contentType: JSON_CT,
+    body: JSON.stringify({ jsonrpc: "2.0", id, error: { code: code2, message } })
+  };
+}
+function readId(value) {
+  const id = Object.getOwnPropertyDescriptor(value, "id")?.value;
+  if (typeof id === "string" || typeof id === "number" || id === null) return id;
+  return null;
+}
+function readString(value, key) {
+  const found = Object.getOwnPropertyDescriptor(value, key)?.value;
+  return typeof found === "string" ? found : void 0;
+}
+function hasOwn(value, key) {
+  return Object.prototype.hasOwnProperty.call(value, key);
+}
+
+// src/serve/origin.ts
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+function isLoopbackOrigin(origin) {
+  try {
+    const url = new URL(origin);
+    const hostname = url.hostname;
+    if (LOOPBACK_HOSTS.has(hostname)) return true;
+    if (hostname === "::1") return true;
+    if (hostname.endsWith(".localhost")) return true;
+    return false;
+  } catch {
+    return false;
+  }
+}
+function isLoopbackHost(host) {
+  const hostname = host.replace(/:\d+$/, "");
+  if (LOOPBACK_HOSTS.has(hostname)) return true;
+  if (hostname === "::1") return true;
+  if (hostname.endsWith(".localhost")) return true;
+  return false;
+}
+function checkOrigin(origin, allowedOrigins, boundLoopback) {
+  if (origin === void 0) return { ok: true };
+  if (allowedOrigins.has(origin)) return { ok: true };
+  if (isLoopbackOrigin(origin)) return { ok: true };
+  if (!boundLoopback) return { ok: true };
+  return { ok: false, reason: `origin ${origin} is not allowed` };
+}
+function checkHost(host, boundLoopback) {
+  if (!boundLoopback) return { ok: true };
+  if (!host) return { ok: false, reason: "missing Host header" };
+  if (isLoopbackHost(host)) return { ok: true };
+  return { ok: false, reason: `host ${host} is not loopback` };
+}
+
+// src/serve/runtime.ts
+var CALL_TIMEOUT_MS = 12e4;
+var MAX_OUTPUT_DEFAULT = 1048576;
+var ALLOWED_ENV_KEYS = /* @__PURE__ */ new Set(["PATH", "HOME", "LANG"]);
+function parseHttpFlag(args2, i) {
+  const next = args2[i + 1];
+  if (!next || next.startsWith("-")) return { host: "127.0.0.1", port: 0, next: i };
+  const colonIdx = next.lastIndexOf(":");
+  if (colonIdx > 0 && colonIdx < next.length - 1) {
+    return { host: next.slice(0, colonIdx), port: Number(next.slice(colonIdx + 1)), next: i + 1 };
+  }
+  return { host: "127.0.0.1", port: Number(next), next: i + 1 };
+}
+function parseCommandTarget(arg) {
+  const eqIdx = arg.indexOf("=");
+  if (eqIdx > 0 && !arg.slice(0, eqIdx).includes("/")) {
+    return { name: arg.slice(0, eqIdx), path: arg.slice(eqIdx + 1) };
+  }
+  return { path: arg };
+}
+function parseSingleFlag(args2, i, opts) {
+  const arg = args2[i];
+  if (arg === "--stdio") {
+    opts.transport = "stdio";
+  } else if (arg === "--http") {
+    opts.transport = "http";
+    const parsed = parseHttpFlag(args2, i);
+    opts.host = parsed.host;
+    opts.port = parsed.port;
+    return parsed.next;
+  } else if (arg === "--bearer" && args2[i + 1]) {
+    opts.bearer = args2[++i];
+  } else if (arg === "--allow-origin" && args2[i + 1]) {
+    opts.allowOrigins.push(args2[++i]);
+  } else if (arg === "--env" && args2[i + 1]) {
+    opts.envAllow.push(args2[++i]);
+  } else if (arg === "--tool" && args2[i + 1]) {
+    opts.toolTemplates.push(args2[++i]);
+  } else if (arg === "--call-timeout" && args2[i + 1]) {
+    opts.callTimeout = Number(args2[++i]) * 1e3;
+  } else if (arg === "--concurrency" && args2[i + 1]) {
+    opts.concurrency = Number(args2[++i]);
+  } else if (arg === "--max-output" && args2[i + 1]) {
+    opts.maxOutput = Number(args2[++i]);
+  } else if (arg === "--cwd" && args2[i + 1]) {
+    opts.cwd = args2[++i];
+  } else if (arg === "--json") {
+    opts.json = true;
+  } else if (!arg.startsWith("-")) {
+    opts.commands.push(parseCommandTarget(arg));
+  }
+  return i;
+}
+function parseServeFlags(args2) {
+  const opts = {
+    transport: "stdio",
+    host: "127.0.0.1",
+    port: 0,
+    bearer: void 0,
+    allowOrigins: [],
+    envAllow: [],
+    toolTemplates: [],
+    callTimeout: CALL_TIMEOUT_MS,
+    concurrency: 1,
+    maxOutput: MAX_OUTPUT_DEFAULT,
+    cwd: void 0,
+    json: false,
+    commands: []
+  };
+  for (let i = 0; i < args2.length; i++) {
+    i = parseSingleFlag(args2, i, opts);
+  }
+  return opts;
+}
+function expandBearerToken(template, env) {
+  if (!containsPlaceholders(template)) return void 0;
+  return expandPlaceholdersStrict(template, env);
+}
+function constantTimeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let mismatch = 0;
+  for (let i = 0; i < a.length; i++) {
+    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return mismatch === 0;
+}
+function buildChildEnv(platform2, envAllow) {
+  const env = {};
+  for (const key of ALLOWED_ENV_KEYS) {
+    if (platform2.env[key]) env[key] = platform2.env[key];
+  }
+  for (const entry of envAllow) {
+    const eqIdx = entry.indexOf("=");
+    if (eqIdx > 0) {
+      env[entry.slice(0, eqIdx)] = entry.slice(eqIdx + 1);
+    } else if (platform2.env[entry]) {
+      env[entry] = platform2.env[entry];
+    }
+  }
+  return env;
+}
+function capOutput(value, limit) {
+  if (value.length <= limit) return value;
+  const half = Math.floor(limit / 2);
+  const cut = value.length - limit;
+  return `${value.slice(0, half)}
+\u2026 ${cut} characters cut \u2026
+${value.slice(value.length - half)}`;
+}
+var inflightProcs = /* @__PURE__ */ new Set();
+async function runCommand(platform2, cmdPath, argv, childEnv, stdin, timeoutMs, maxOutput, cwd) {
+  let proc;
+  try {
+    proc = await platform2.spawn({
+      argv: [cmdPath, ...argv],
+      env: childEnv,
+      cwd
+    });
+  } catch (err) {
+    return { stdout: "", stderr: `spawn failed: ${err.message}`, exitCode: 127 };
+  }
+  inflightProcs.add(proc);
+  if (stdin !== void 0) {
+    const writer = proc.stdin.getWriter();
+    await writer.write(new TextEncoder().encode(stdin));
+    await writer.close();
+  } else {
+    try {
+      await proc.stdin.getWriter().close();
+    } catch {
+    }
+  }
+  const stdoutChunks = [];
+  const stderrChunks = [];
+  const readStream = async (stream, into) => {
+    const r = stream.getReader();
+    try {
+      for (; ; ) {
+        const { done, value } = await r.read();
+        if (done) break;
+        into.push(value);
+      }
+    } finally {
+      r.releaseLock();
+    }
+  };
+  const timer = new Promise(
+    (resolve) => setTimeout(() => resolve("timeout"), timeoutMs)
+  );
+  const work = Promise.all([
+    readStream(proc.stdout, stdoutChunks),
+    readStream(proc.stderr, stderrChunks),
+    proc.wait()
+  ]);
+  const result = await Promise.race([work, timer]);
+  if (result === "timeout") {
+    proc.kill("SIGTERM");
+    await new Promise((resolve) => setTimeout(resolve, 5e3));
+    try {
+      proc.kill("SIGKILL");
+    } catch {
+    }
+    inflightProcs.delete(proc);
+    return { stdout: "", stderr: "timed out", exitCode: 124 };
+  }
+  inflightProcs.delete(proc);
+  const [, , exitResult] = result;
+  const dec = new TextDecoder();
+  return {
+    stdout: capOutput(dec.decode(concat(stdoutChunks)), maxOutput),
+    stderr: capOutput(dec.decode(concat(stderrChunks)), maxOutput),
+    exitCode: exitResult.status
+  };
+}
+function concat(chunks) {
+  const total = chunks.reduce((s, c) => s + c.length, 0);
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const c of chunks) {
+    out.set(c, offset);
+    offset += c.length;
+  }
+  return out;
+}
+async function killInflight() {
+  for (const proc of inflightProcs) {
+    try {
+      proc.kill("SIGTERM");
+    } catch {
+    }
+  }
+  if (inflightProcs.size > 0) {
+    await new Promise((resolve) => setTimeout(resolve, 5e3));
+    for (const proc of inflightProcs) {
       try {
-        const exists = await platform2.fs.exists(configPath);
-        if (!exists) return void 0;
-        const data = await platform2.fs.readFile(configPath);
-        const text = new TextDecoder().decode(data);
-        const parsed = JSON.parse(text);
-        if (!parsed.mcpServers) return void 0;
-        const normalizedName = name.replace(/[-_]/g, "").toLowerCase();
-        for (const [key, value] of Object.entries(parsed.mcpServers)) {
-          if (key.replace(/[-_]/g, "").toLowerCase() === normalizedName) {
-            return value;
-          }
+        proc.kill("SIGKILL");
+      } catch {
+      }
+    }
+  }
+  inflightProcs.clear();
+}
+async function runHelpForCli(platform2, filePath, childEnv, cwd) {
+  const dashed = await runCommand(
+    platform2,
+    filePath,
+    ["--help"],
+    childEnv,
+    void 0,
+    1e4,
+    MAX_OUTPUT_DEFAULT,
+    cwd
+  );
+  if (dashed.exitCode === 0 && dashed.stdout.trim()) return dashed.stdout;
+  const plain = await runCommand(
+    platform2,
+    filePath,
+    ["help"],
+    childEnv,
+    void 0,
+    1e4,
+    MAX_OUTPUT_DEFAULT,
+    cwd
+  );
+  if (plain.exitCode === 0 && plain.stdout.trim()) return plain.stdout;
+  return dashed.stdout.trim() ? dashed.stdout : "";
+}
+async function expandGroupCommands(platform2, filePath, commands, childEnv, cwd) {
+  const topNames = new Set(commands.map((c) => c.path[0] ?? ""));
+  let current = commands;
+  for (const command of commands) {
+    if (!isGroupCandidate(command)) continue;
+    const group = command.path[0] ?? "";
+    const nested = await runCommand(
+      platform2,
+      filePath,
+      [group, "--help"],
+      childEnv,
+      void 0,
+      1e4,
+      MAX_OUTPUT_DEFAULT,
+      cwd
+    );
+    if (nested.exitCode !== 0 || !nested.stdout.trim()) continue;
+    const replaced = nestGroup(current, group, parseHelp(nested.stdout), topNames);
+    if (replaced) current = replaced;
+  }
+  return current;
+}
+async function discoverCli(platform2, filePath, explicitName, childEnv, cwd) {
+  const mcp = await runCommand(
+    platform2,
+    filePath,
+    ["--mcp"],
+    childEnv,
+    void 0,
+    1e4,
+    MAX_OUTPUT_DEFAULT,
+    cwd
+  );
+  const override = mcp.exitCode === 0 ? parseMcpOverride(mcp.stdout) : null;
+  const helpText2 = override ? "" : await runHelpForCli(platform2, filePath, childEnv, cwd);
+  if (!override && !helpText2.trim()) {
+    throw new Error(`${filePath} did not print help or --mcp descriptor`);
+  }
+  const parsed = override ?? parseHelp(helpText2);
+  let commands = parsed.commands;
+  if (!override) {
+    commands = attachGlobalFlags(commands, parsed.globalFlags);
+    commands = await expandGroupCommands(platform2, filePath, commands, childEnv, cwd);
+  }
+  return { name: cliPrefix(helpText2, filePath, explicitName), path: filePath, commands };
+}
+function createToolExecutor(platform2, clis, allTools, childEnv, options, serveCwd) {
+  const rpcTools = allTools.map((t) => ({
+    name: t.name,
+    description: t.description,
+    inputSchema: t.inputSchema
+  }));
+  const queues = /* @__PURE__ */ new Map();
+  function enqueue(key, job) {
+    const previous = queues.get(key) ?? Promise.resolve();
+    const run2 = previous.then(job, job);
+    queues.set(
+      key,
+      run2.then(
+        () => void 0,
+        () => void 0
+      )
+    );
+    return run2;
+  }
+  function invokeTemplateTool(tool, args2) {
+    const templateArgs = {};
+    if (args2 && typeof args2 === "object") {
+      for (const [k, v] of Object.entries(args2)) {
+        templateArgs[k] = String(v);
+      }
+    }
+    const argv = templateToArgv(tool.description, templateArgs);
+    return enqueue(
+      "__template__",
+      () => runCommand(
+        platform2,
+        argv[0],
+        argv.slice(1),
+        childEnv,
+        void 0,
+        options.callTimeout,
+        options.maxOutput,
+        serveCwd
+      )
+    );
+  }
+  async function executeTool(tool, cli, args2) {
+    if (tool.kind === "help") {
+      const result = await runCommand(
+        platform2,
+        cli.path,
+        ["--help"],
+        childEnv,
+        void 0,
+        options.callTimeout,
+        options.maxOutput,
+        serveCwd
+      );
+      if (result.exitCode === 0) return result;
+      return runCommand(
+        platform2,
+        cli.path,
+        ["help"],
+        childEnv,
+        void 0,
+        options.callTimeout,
+        options.maxOutput,
+        serveCwd
+      );
+    }
+    if (tool.kind === "invoke") {
+      const parsed2 = readToolArguments(args2 ?? {});
+      if (parsed2.error) return { stdout: "", stderr: parsed2.error, exitCode: 2 };
+      if (!parsed2.argv) return { stdout: "", stderr: "argv is required", exitCode: 2 };
+      return runCommand(
+        platform2,
+        cli.path,
+        parsed2.argv,
+        childEnv,
+        parsed2.stdin,
+        options.callTimeout,
+        options.maxOutput,
+        serveCwd
+      );
+    }
+    const parsed = readToolArguments(args2 ?? {});
+    const command = cli.commands.find((c) => c.path.join("_") === tool.commandPath.join("_"));
+    if (!command) return { stdout: "", stderr: `unknown command ${tool.name}`, exitCode: 2 };
+    const planned = argvForCommand(command, parsed);
+    if ("error" in planned) return { stdout: "", stderr: planned.error, exitCode: 2 };
+    return runCommand(
+      platform2,
+      cli.path,
+      planned.argv,
+      childEnv,
+      planned.stdin,
+      options.callTimeout,
+      options.maxOutput,
+      serveCwd
+    );
+  }
+  async function invoke(name, args2) {
+    const tool = allTools.find((t) => t.name === name);
+    if (!tool) return { stdout: "", stderr: `unknown tool ${name}`, exitCode: 1 };
+    if (tool.cli === "" && tool.commandPath.length === 0) {
+      return invokeTemplateTool(tool, args2);
+    }
+    const cli = clis.find((c) => c.name === tool.cli);
+    if (!cli) return { stdout: "", stderr: `unknown cli ${tool.cli}`, exitCode: 1 };
+    return enqueue(cli.name, () => executeTool(tool, cli, args2));
+  }
+  return { invoke, rpcTools };
+}
+async function runServe(platform2, options, version) {
+  let resolvedBearer;
+  if (options.bearer) {
+    const expanded = expandBearerToken(options.bearer, platform2.env);
+    if (!expanded) {
+      await platform2.write(
+        2,
+        "mcpcat serve: --bearer requires a ${NAME} variable reference, not a literal token. Use --bearer '${MY_TOKEN}' and set MY_TOKEN in the environment.\n"
+      );
+      return 2;
+    }
+    resolvedBearer = expanded;
+  }
+  const serveCwd = options.cwd ?? platform2.cwd;
+  const childEnv = buildChildEnv(platform2, options.envAllow);
+  const clis = [];
+  for (const cmd of options.commands) {
+    try {
+      const cli = await discoverCli(platform2, cmd.path, cmd.name, childEnv, serveCwd);
+      clis.push(cli);
+    } catch (err) {
+      await platform2.write(2, `mcpcat serve: ${err.message}
+`);
+      return 2;
+    }
+  }
+  const allTools = clis.flatMap((cli) => buildTools(cli.name, cli.commands));
+  for (const spec of options.toolTemplates) {
+    const tool = parseToolTemplate(spec);
+    if (!tool) {
+      await platform2.write(2, `mcpcat serve: invalid --tool spec: ${spec}
+`);
+      return 2;
+    }
+    allTools.push(tool);
+  }
+  const executor = createToolExecutor(platform2, clis, allTools, childEnv, options, serveCwd);
+  const serverName = "mcpcat-serve";
+  if (options.transport === "stdio") {
+    return runStdioServer(platform2, executor.rpcTools, executor.invoke, serverName, version);
+  }
+  return runHttpServer(
+    platform2,
+    options,
+    executor.rpcTools,
+    executor.invoke,
+    serverName,
+    version,
+    resolvedBearer
+  );
+}
+async function runStdioServer(platform2, tools, call, serverName, version) {
+  const reader = platform2.stdin.getReader();
+  let buffer = "";
+  const dec = new TextDecoder();
+  const enc = new TextEncoder();
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      buffer += dec.decode(value, { stream: true });
+      let nlIdx;
+      while ((nlIdx = buffer.indexOf("\n")) >= 0) {
+        const line = buffer.slice(0, nlIdx).trim();
+        buffer = buffer.slice(nlIdx + 1);
+        if (!line) continue;
+        const outcome = await handleJsonRpc(line, tools, call, serverName, version);
+        if (outcome.status === 202) continue;
+        const writer = platform2.stdout.getWriter();
+        await writer.write(enc.encode(`${outcome.body}
+`));
+        writer.releaseLock();
+      }
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  return 0;
+}
+async function runHttpServer(platform2, options, tools, call, serverName, version, resolvedBearer) {
+  if (!platform2.listen) {
+    await platform2.write(2, "mcpcat serve: HTTP transport requires platform.listen\n");
+    return 3;
+  }
+  const boundLoopback = options.host === "127.0.0.1" || options.host === "localhost" || options.host === "::1";
+  if (!boundLoopback && !resolvedBearer) {
+    await platform2.write(2, "mcpcat serve: --bearer is required when binding off loopback\n");
+    return 2;
+  }
+  const allowedOrigins = new Set(options.allowOrigins);
+  const listener = await platform2.listen({ host: options.host, port: options.port });
+  const actualPort = listener.port;
+  const listenUrl = `http://${options.host}:${actualPort}/mcp`;
+  if (options.json) {
+    await platform2.write(1, `${JSON.stringify({ url: listenUrl })}
+`);
+  }
+  await platform2.write(2, `mcpcat serve: listening on ${listenUrl}
+`);
+  let shutdownRequested = false;
+  const shutdown = () => {
+    if (shutdownRequested) return;
+    shutdownRequested = true;
+    listener.close();
+    void killInflight();
+  };
+  if (platform2.onSignal) {
+    platform2.onSignal("SIGINT", shutdown);
+    platform2.onSignal("SIGTERM", shutdown);
+  }
+  const handler = (request) => handleMcpRequest(
+    request,
+    tools,
+    call,
+    serverName,
+    version,
+    allowedOrigins,
+    boundLoopback,
+    resolvedBearer
+  );
+  try {
+    for await (const connection of listener) {
+      if (shutdownRequested) break;
+      const conn = connection;
+      handleConnection(conn.readable, conn.writable, handler).catch(() => {
+      }).finally(() => {
+        try {
+          conn.close();
+        } catch {
         }
-        return void 0;
+      });
+    }
+  } catch {
+    if (!shutdownRequested) throw new Error("listener closed unexpectedly");
+  }
+  return 0;
+}
+async function handleMcpRequest(request, tools, call, serverName, version, allowedOrigins, boundLoopback, resolvedBearer) {
+  if (resolvedBearer) {
+    const authHeader = request.headers.authorization;
+    const provided = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : "";
+    if (!provided || !constantTimeEqual(provided, resolvedBearer)) {
+      return {
+        status: 401,
+        reason: "Unauthorized",
+        headers: { "content-type": "text/plain" },
+        body: "Unauthorized"
+      };
+    }
+  }
+  const originCheck = checkOrigin(request.headers.origin, allowedOrigins, boundLoopback);
+  if (!originCheck.ok) {
+    return {
+      status: 403,
+      reason: "Forbidden",
+      headers: { "content-type": "text/plain" },
+      body: originCheck.reason ?? "Forbidden"
+    };
+  }
+  const hostCheck = checkHost(request.headers.host, boundLoopback);
+  if (!hostCheck.ok) {
+    return {
+      status: 403,
+      reason: "Forbidden",
+      headers: { "content-type": "text/plain" },
+      body: hostCheck.reason ?? "Forbidden"
+    };
+  }
+  if (request.target !== "/mcp") {
+    return {
+      status: 404,
+      reason: "Not Found",
+      headers: { "content-type": "text/plain" },
+      body: "Not Found"
+    };
+  }
+  if (request.method !== "POST") {
+    return {
+      status: 405,
+      reason: "Method Not Allowed",
+      headers: { "content-type": "text/plain", allow: "POST" },
+      body: "Method Not Allowed"
+    };
+  }
+  const outcome = await handleJsonRpc(request.body, tools, call, serverName, version);
+  return {
+    status: outcome.status,
+    reason: outcome.status === 200 ? "OK" : "Accepted",
+    headers: { "content-type": outcome.contentType },
+    body: outcome.body
+  };
+}
+
+// src/config/lock.ts
+var LOCK_STALE_MS = 1e4;
+var LOCK_POLL_MS = 50;
+var LOCK_MAX_WAIT_MS = 5e3;
+function isEexist(err) {
+  if (err instanceof Error && "code" in err)
+    return err.code === "EEXIST";
+  if (err instanceof Error) return err.message.includes("EEXIST");
+  return false;
+}
+async function removeStaleLock(fs, lockPath) {
+  try {
+    const s = await fs.stat(lockPath);
+    if (Date.now() - s.mtimeMs > LOCK_STALE_MS) {
+      try {
+        await fs.rmdir(lockPath);
       } catch {
-        return void 0;
+      }
+      return true;
+    }
+  } catch {
+  }
+  return false;
+}
+async function acquireLock(fs, configPath) {
+  const lockPath = `${configPath}.lock`;
+  const start = Date.now();
+  while (true) {
+    try {
+      await fs.mkdirExclusive(lockPath);
+      break;
+    } catch (err) {
+      if (!isEexist(err)) throw err;
+      await removeStaleLock(fs, lockPath);
+    }
+    if (Date.now() - start > LOCK_MAX_WAIT_MS) {
+      throw new Error(`mcpcat: could not acquire lock ${lockPath} within ${LOCK_MAX_WAIT_MS}ms`);
+    }
+    await new Promise((r) => setTimeout(r, LOCK_POLL_MS));
+  }
+  let released = false;
+  return async () => {
+    if (released) return;
+    released = true;
+    try {
+      await fs.rmdir(lockPath);
+    } catch {
+    }
+  };
+}
+
+// src/config/edit.ts
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function detectIndent(text) {
+  const match = /^([ \t]+)\S/m.exec(text);
+  return match ? match[1] : "  ";
+}
+async function readText(fs, path) {
+  try {
+    const data = await fs.readFile(path);
+    return new TextDecoder().decode(data);
+  } catch {
+    return void 0;
+  }
+}
+async function editMcpServers(fs, path, edit) {
+  const release = await acquireLock(fs, path);
+  try {
+    const text = await readText(fs, path);
+    const parsed = text === void 0 ? {} : JSON.parse(text);
+    if (!isRecord2(parsed) || parsed.mcpServers !== void 0 && !isRecord2(parsed.mcpServers))
+      throw new Error(`${path}: expected an object with an "mcpServers" object`);
+    const servers = isRecord2(parsed.mcpServers) ? parsed.mcpServers : void 0;
+    if (!edit(servers, parsed)) return { changed: false };
+    const indent = text ? detectIndent(text) : "  ";
+    const output = `${JSON.stringify(parsed, null, indent)}
+`;
+    const dir = path.slice(0, path.lastIndexOf("/"));
+    if (dir) {
+      try {
+        await fs.mkdir(dir);
+      } catch {
+      }
+    }
+    const tmpPath = `${path}.tmp.${Date.now()}`;
+    await fs.writeFile(tmpPath, output);
+    await fs.rename(tmpPath, path);
+    return { changed: true };
+  } finally {
+    await release();
+  }
+}
+async function addServer(fs, path, name, config) {
+  let replaced = false;
+  await editMcpServers(fs, path, (servers, parsed) => {
+    const target = servers ?? {};
+    replaced = target[name] !== void 0;
+    target[name] = config;
+    parsed.mcpServers = target;
+    return true;
+  });
+  return { replaced };
+}
+async function removeServer(fs, path, name) {
+  let removed = false;
+  await editMcpServers(fs, path, (servers) => {
+    if (!servers || servers[name] === void 0) return false;
+    delete servers[name];
+    removed = true;
+    return true;
+  });
+  return removed;
+}
+async function updateServer(fs, path, name, patch) {
+  let updated = false;
+  await editMcpServers(fs, path, (servers) => {
+    if (!servers || !isRecord2(servers[name])) return false;
+    const entry = servers[name];
+    if (patch.enabled !== void 0) entry.enabled = patch.enabled;
+    if (patch.exposure !== void 0) entry.exposure = patch.exposure;
+    if (patch.toolExposure !== void 0) entry.toolExposure = patch.toolExposure;
+    updated = true;
+    return true;
+  });
+  return updated;
+}
+async function setExposure(fs, path, name, exposure, toolGlob) {
+  let updated = false;
+  await editMcpServers(fs, path, (servers) => {
+    if (!servers || !isRecord2(servers[name])) return false;
+    const entry = servers[name];
+    if (toolGlob) {
+      const te = isRecord2(entry.toolExposure) ? { ...entry.toolExposure } : {};
+      te[toolGlob] = exposure;
+      entry.toolExposure = te;
+    } else {
+      entry.exposure = exposure;
+    }
+    updated = true;
+    return true;
+  });
+  return updated;
+}
+
+// src/config/import.ts
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isStringRecord2(value) {
+  return isRecord3(value) && Object.values(value).every((v) => typeof v === "string");
+}
+function tryParse(text) {
+  try {
+    return { parsed: JSON.parse(text) };
+  } catch (e) {
+    return { parsed: void 0, error: `not valid JSON: ${e.message}` };
+  }
+}
+function filterNames(entries, names) {
+  const result = [];
+  for (const [name, value] of entries) {
+    if (names && names.length > 0 && !names.includes(name)) continue;
+    result.push([name, value]);
+  }
+  return result;
+}
+function replaceInputVars(value) {
+  return value.replace(
+    /\$\{input:([^}]+)\}/g,
+    (_, name) => `\${${name.toUpperCase().replace(/[^A-Z0-9]/g, "_")}}`
+  );
+}
+function importClaude(text, names) {
+  const result = { servers: [], errors: [] };
+  const { parsed, error } = tryParse(text);
+  if (error) {
+    result.errors.push(error);
+    return result;
+  }
+  if (!isRecord3(parsed)) {
+    result.errors.push("expected an object");
+    return result;
+  }
+  const mcpServers = parsed.mcpServers;
+  if (!isRecord3(mcpServers)) {
+    result.errors.push('no "mcpServers" object');
+    return result;
+  }
+  for (const [name, entry] of filterNames(Object.entries(mcpServers), names)) {
+    if (!isRecord3(entry)) {
+      result.errors.push(`${name}: not an object`);
+      continue;
+    }
+    result.servers.push({ name, config: entry });
+  }
+  return result;
+}
+function importVSCode(text, names) {
+  const result = { servers: [], errors: [] };
+  const { parsed, error } = tryParse(text);
+  if (error) {
+    result.errors.push(error);
+    return result;
+  }
+  if (!isRecord3(parsed)) {
+    result.errors.push("expected an object");
+    return result;
+  }
+  const servers = parsed.servers ?? parsed.mcpServers;
+  if (!isRecord3(servers)) {
+    result.errors.push('no "servers" or "mcpServers" object');
+    return result;
+  }
+  for (const [name, entry] of filterNames(Object.entries(servers), names)) {
+    if (!isRecord3(entry)) {
+      result.errors.push(`${name}: not an object`);
+      continue;
+    }
+    result.servers.push({ name, config: convertVSCodeEntry(entry) });
+  }
+  return result;
+}
+function convertVSCodeEntry(entry) {
+  const config = {};
+  for (const [key, value] of Object.entries(entry)) {
+    if (key === "type" || key === "command" || key === "args" || key === "cwd" || key === "url") {
+      config[key] = value;
+    } else if (key === "headers" && isStringRecord2(value)) {
+      const headers = {};
+      for (const [h, v] of Object.entries(value)) headers[h] = replaceInputVars(v);
+      config.headers = headers;
+    } else if (key === "env" && isStringRecord2(value)) {
+      const env = {};
+      for (const [k, v] of Object.entries(value)) env[k] = replaceInputVars(v);
+      config.env = env;
+    } else {
+      config[key] = value;
+    }
+  }
+  return config;
+}
+function importSixServers(text, names) {
+  const result = { servers: [], errors: [] };
+  const { parsed, error } = tryParse(text);
+  if (error) {
+    result.errors.push(error);
+    return result;
+  }
+  if (!isRecord3(parsed)) {
+    result.errors.push("expected an object");
+    return result;
+  }
+  const servers = parsed.servers;
+  if (!isRecord3(servers)) {
+    result.errors.push('no "servers" object');
+    return result;
+  }
+  for (const [name, entry] of filterNames(Object.entries(servers), names)) {
+    if (!isRecord3(entry)) {
+      result.errors.push(`${name}: not an object`);
+      continue;
+    }
+    const config = {};
+    if (typeof entry.url === "string") config.url = entry.url;
+    if (isStringRecord2(entry.headers)) config.headers = entry.headers;
+    if (typeof entry.exposure === "string") config.exposure = entry.exposure;
+    if (isRecord3(entry.toolExposure)) config.toolExposure = entry.toolExposure;
+    result.servers.push({ name, config });
+  }
+  return result;
+}
+function importCodexToml(text, names) {
+  const result = { servers: [], errors: [] };
+  const sections = parseTomlSections(text);
+  for (const [sectionName, fields] of sections) {
+    const prefix = "mcp_servers.";
+    if (!sectionName.startsWith(prefix)) continue;
+    const name = sectionName.slice(prefix.length);
+    if (names && names.length > 0 && !names.includes(name)) continue;
+    const config = {};
+    if (fields.command) config.command = fields.command;
+    if (fields.args) config.args = fields.args;
+    if (fields.url) config.url = fields.url;
+    if (fields.env && isRecord3(fields.env)) config.env = fields.env;
+    result.servers.push({ name, config });
+  }
+  return result;
+}
+function parseTomlSections(text) {
+  const sections = [];
+  let current;
+  let currentName = "";
+  for (const line of text.split("\n")) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith("#") || trimmed === "") continue;
+    const sectionMatch = /^\[([^\]]+)\]/.exec(trimmed);
+    if (sectionMatch) {
+      if (current) sections.push([currentName, current]);
+      currentName = sectionMatch[1].trim();
+      current = {};
+      continue;
+    }
+    if (!current) continue;
+    const kvMatch = /^(\w+)\s*=\s*(.+)/.exec(trimmed);
+    if (kvMatch) {
+      current[kvMatch[1]] = parseTomlValue(kvMatch[2].trim());
+    }
+  }
+  if (current) sections.push([currentName, current]);
+  return sections;
+}
+function parseTomlValue(raw) {
+  if (raw.startsWith('"') && raw.endsWith('"')) return raw.slice(1, -1);
+  if (raw.startsWith("'") && raw.endsWith("'")) return raw.slice(1, -1);
+  if (raw.startsWith("[")) {
+    try {
+      return JSON.parse(raw.replace(/'/g, '"'));
+    } catch {
+      return raw;
+    }
+  }
+  if (raw === "true") return true;
+  if (raw === "false") return false;
+  const num = Number(raw);
+  if (!Number.isNaN(num)) return num;
+  return raw;
+}
+function convertOpenCodeLocal(entry) {
+  const config = {};
+  if (Array.isArray(entry.command) && entry.command.length > 0) {
+    config.command = entry.command[0];
+    if (entry.command.length > 1) config.args = entry.command.slice(1);
+  } else if (typeof entry.command === "string") {
+    config.command = entry.command;
+  }
+  if (isRecord3(entry.environment)) {
+    const env = {};
+    for (const [k, v] of Object.entries(entry.environment)) {
+      if (typeof v === "string")
+        env[k] = v.replace(/\{env:([^}]+)\}/g, (_, n) => `\${${n}}`);
+    }
+    config.env = env;
+  }
+  return config;
+}
+function convertOpenCodeRemote(entry) {
+  const config = {};
+  config.url = entry.url;
+  if (isStringRecord2(entry.headers)) config.headers = entry.headers;
+  return config;
+}
+function importOpenCode(text, names) {
+  const result = { servers: [], errors: [] };
+  const { parsed, error } = tryParse(text);
+  if (error) {
+    result.errors.push(error);
+    return result;
+  }
+  if (!isRecord3(parsed)) {
+    result.errors.push("expected an object");
+    return result;
+  }
+  const mcpServers = parsed.mcpServers ?? parsed.mcp;
+  if (!isRecord3(mcpServers)) {
+    result.errors.push("no mcp servers found");
+    return result;
+  }
+  for (const [name, entry] of filterNames(Object.entries(mcpServers), names)) {
+    if (!isRecord3(entry)) {
+      result.errors.push(`${name}: not an object`);
+      continue;
+    }
+    const isLocal = entry.type === "local" || entry.command;
+    const config = isLocal ? convertOpenCodeLocal(entry) : convertOpenCodeRemote(entry);
+    result.servers.push({ name, config });
+  }
+  return result;
+}
+function detectFormat(text, filename) {
+  if (filename.endsWith(".toml")) return "codex";
+  if (filename.includes("servers.json")) return "six";
+  if (filename.includes(".vscode")) return "vscode";
+  try {
+    const parsed = JSON.parse(text);
+    if (isRecord3(parsed)) {
+      if (parsed.servers && isRecord3(parsed.servers) && parsed.version !== void 0) return "six";
+      if (parsed.servers && isRecord3(parsed.servers)) return "vscode";
+      if (parsed.mcpServers) return "claude";
+      if (parsed.mcp) return "opencode";
+    }
+  } catch {
+  }
+  if (text.includes("[mcp_servers.")) return "codex";
+  return "claude";
+}
+function importFile(text, filename, names) {
+  const format = detectFormat(text, filename);
+  switch (format) {
+    case "claude":
+      return importClaude(text, names);
+    case "vscode":
+      return importVSCode(text, names);
+    case "six":
+      return importSixServers(text, names);
+    case "codex":
+      return importCodexToml(text, names);
+    case "opencode":
+      return importOpenCode(text, names);
+    default:
+      return importClaude(text, names);
+  }
+}
+
+// src/config/warnings.ts
+var SECRET_HEADER = /authorization|cookie|token|key|secret|password|session/i;
+var PLACEHOLDER2 = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
+var SCHEME = /^\s*(?:bearer|basic|token|apikey|api-key)\s+/i;
+var SECRET_PARAM = /token|key|secret|password|signature|sig|auth|code/i;
+function literalSecret(header, value) {
+  if (!SECRET_HEADER.test(header)) return false;
+  return value.replace(PLACEHOLDER2, "").replace(SCHEME, "").trim() !== "";
+}
+function urlHasSecret(url) {
+  if (!URL.canParse(url)) return void 0;
+  const parsed = new URL(url);
+  if (parsed.username || parsed.password) return "url";
+  for (const name of parsed.searchParams.keys()) if (SECRET_PARAM.test(name)) return `url ?${name}`;
+  return void 0;
+}
+var SLICC_OAUTH_REFUSED = {
+  clientSecret: "a client secret would have to live in mcp.json; SLICC signs in as a public client",
+  callbackPort: "SLICC signs in through its own page, not a loopback port",
+  callbackUrl: "SLICC signs in through its own page, not a loopback URL",
+  clientRegistration: "SLICC registers dynamically or uses oauth.clientId"
+};
+function checkAgentWarnings(name, config) {
+  const warnings = [];
+  if ("command" in config && config.command) {
+    warnings.push({
+      server: name,
+      message: "stdio servers need slicc-kernel#68, so the agent will skip this entry",
+      advice: "use mcpcat serve --proxy to bridge it as HTTP"
+    });
+  }
+  if ("headers" in config && config.headers) {
+    for (const [h, v] of Object.entries(config.headers)) {
+      if (v.trim().startsWith("!")) {
+        warnings.push({
+          server: name,
+          message: `headers.${h} runs a command, which the agent can't do`,
+          advice: "use ${NAME} and set the value in Settings > MCP servers"
+        });
+      }
+      if (literalSecret(h, v)) {
+        warnings.push({
+          server: name,
+          message: `headers.${h} holds a literal secret`,
+          advice: "write ${NAME} instead, and add the value in Settings > MCP servers"
+        });
+      }
+    }
+  }
+  if ("url" in config && config.url) {
+    const secret = urlHasSecret(config.url);
+    if (secret) {
+      warnings.push({
+        server: name,
+        message: `${secret} holds a literal secret`,
+        advice: "put it in a header as ${NAME}"
+      });
+    }
+  }
+  if ("oauth" in config && config.oauth) {
+    for (const key of Object.keys(config.oauth)) {
+      const reason = SLICC_OAUTH_REFUSED[key];
+      if (reason) {
+        warnings.push({
+          server: name,
+          message: `oauth.${key} is not supported by the agent: ${reason}`,
+          advice: `remove oauth.${key}`
+        });
       }
     }
+  }
+  return warnings;
+}
+
+// src/cli/config-verbs.ts
+function parseHeader(hdr) {
+  const colonIdx = hdr.indexOf(":");
+  if (colonIdx < 1) return `invalid header '${hdr}'`;
+  return [hdr.slice(0, colonIdx).trim(), hdr.slice(colonIdx + 1).trim()];
+}
+function parseEnvPair(pair) {
+  const eqIdx = pair.indexOf("=");
+  if (eqIdx < 1) return `invalid --env '${pair}'`;
+  return [pair.slice(0, eqIdx), pair.slice(eqIdx + 1)];
+}
+function parseAddFlagAt(flagArgs, i, flags) {
+  const arg = flagArgs[i];
+  if (arg === "-l" || arg === "--local") {
+    flags.local = true;
+    return { next: i + 1 };
+  }
+  if (arg === "--no-probe") {
+    flags.noProbe = true;
+    return { next: i + 1 };
+  }
+  if (arg === "--config" && i + 1 < flagArgs.length) {
+    flags.configFile = flagArgs[i + 1];
+    return { next: i + 2 };
+  }
+  if (arg === "--description" && i + 1 < flagArgs.length) {
+    flags.description = flagArgs[i + 1];
+    return { next: i + 2 };
+  }
+  if (arg === "--exposure" && i + 1 < flagArgs.length) {
+    flags.exposure = flagArgs[i + 1];
+    return { next: i + 2 };
+  }
+  if ((arg === "-H" || arg === "--header") && i + 1 < flagArgs.length) {
+    const result = parseHeader(flagArgs[i + 1]);
+    if (typeof result === "string") return { next: i + 2, error: result };
+    flags.headers.push(result);
+    return { next: i + 2 };
+  }
+  if (arg === "--env" && i + 1 < flagArgs.length) {
+    const result = parseEnvPair(flagArgs[i + 1]);
+    if (typeof result === "string") return { next: i + 2, error: result };
+    flags.envPairs.push(result);
+    return { next: i + 2 };
+  }
+  if (arg === "--cwd" && i + 1 < flagArgs.length) {
+    flags.cwd = flagArgs[i + 1];
+    return { next: i + 2 };
+  }
+  if (arg.startsWith("-")) return { next: i + 1, error: `unknown option '${arg}'` };
+  flags.positional.push(arg);
+  return { next: i + 1 };
+}
+function parseAddFlags(args2) {
+  const flags = {
+    local: false,
+    noProbe: false,
+    headers: [],
+    envPairs: [],
+    positional: [],
+    cmdArgs: []
   };
+  const dashDashIdx = args2.indexOf("--");
+  const flagArgs = dashDashIdx >= 0 ? args2.slice(0, dashDashIdx) : args2;
+  flags.cmdArgs = dashDashIdx >= 0 ? args2.slice(dashDashIdx + 1) : [];
+  let i = 0;
+  while (i < flagArgs.length) {
+    const step = parseAddFlagAt(flagArgs, i, flags);
+    if (step.error) return step.error;
+    i = step.next;
+  }
+  return flags;
+}
+function buildStdioConfig(flags) {
+  const config = {
+    command: flags.cmdArgs[0],
+    ...flags.cmdArgs.length > 1 ? { args: flags.cmdArgs.slice(1) } : {}
+  };
+  if (flags.envPairs.length > 0) {
+    const env = {};
+    for (const [k, v] of flags.envPairs) env[k] = v;
+    config.env = env;
+  }
+  if (flags.cwd) config.cwd = flags.cwd;
+  if (flags.description) config.description = flags.description;
+  if (flags.exposure) config.exposure = flags.exposure;
+  return config;
+}
+function buildHttpConfig(urlStr, flags) {
+  const config = { url: urlStr };
+  if (flags.headers.length > 0) {
+    const hdrs = {};
+    for (const [k, v] of flags.headers) {
+      if (literalSecret(k, v)) return `header '${k}' holds a literal secret; use \${NAME} instead`;
+      hdrs[k] = v;
+    }
+    config.headers = hdrs;
+  }
+  if (flags.description) config.description = flags.description;
+  if (flags.exposure) config.exposure = flags.exposure;
+  return config;
+}
+async function runAdd(platform2, args2, probe) {
+  const flags = parseAddFlags(args2);
+  if (typeof flags === "string") {
+    await platform2.write(2, `mcpcat add: ${flags}
+`);
+    return 2;
+  }
+  if (flags.positional.length < 1) {
+    await platform2.write(2, "mcpcat add: requires a server name\n");
+    return 2;
+  }
+  let name;
+  let config;
+  if (flags.cmdArgs.length > 0) {
+    name = flags.positional[0];
+    config = buildStdioConfig(flags);
+  } else if (flags.positional.length >= 2) {
+    let urlStr;
+    if (URL.canParse(flags.positional[0]) && !URL.canParse(flags.positional[1])) {
+      urlStr = flags.positional[0];
+      name = flags.positional[1];
+    } else {
+      name = flags.positional[0];
+      urlStr = flags.positional[1];
+    }
+    if (!URL.canParse(urlStr)) {
+      await platform2.write(2, `mcpcat add: '${urlStr}' is not a valid URL
+`);
+      return 2;
+    }
+    const secret = urlHasSecret(urlStr);
+    if (secret) {
+      await platform2.write(
+        2,
+        `mcpcat add: ${secret} holds a literal secret; use \${NAME} in a header instead
+`
+      );
+      return 2;
+    }
+    const httpResult = buildHttpConfig(urlStr, flags);
+    if (typeof httpResult === "string") {
+      await platform2.write(2, `mcpcat add: ${httpResult}
+`);
+      return 2;
+    }
+    config = httpResult;
+  } else {
+    await platform2.write(2, "mcpcat add: requires a URL or -- <command>\n");
+    return 2;
+  }
+  const validation = validateServer(name, config);
+  if ("message" in validation) {
+    await platform2.write(2, `mcpcat add: ${validation.message}
+`);
+    return 2;
+  }
+  const path = flags.configFile ?? (flags.local ? projectConfigPath(platform2) : userConfigPath(platform2));
+  const { replaced } = await addServer(platform2.fs, path, name, config);
+  const warnings = checkAgentWarnings(name, config);
+  for (const w of warnings) {
+    await platform2.write(2, `mcpcat add: warning: ${w.message}; ${w.advice}
+`);
+  }
+  await platform2.write(1, `${replaced ? "replaced" : "added"} ${name} in ${path}
+`);
+  if (!flags.noProbe && probe) {
+    const reason = await probe(name, config, platform2);
+    if (reason) {
+      await platform2.write(2, `mcpcat add: probe failed: ${reason}
+`);
+      return 3;
+    }
+  }
+  return 0;
+}
+async function runRm(platform2, args2) {
+  let configFile;
+  let local = false;
+  const names = [];
+  for (let i = 0; i < args2.length; i++) {
+    const arg = args2[i];
+    if (arg === "--config" && i + 1 < args2.length) {
+      configFile = args2[++i];
+      continue;
+    }
+    if (arg === "-l" || arg === "--local") {
+      local = true;
+      continue;
+    }
+    if (arg === "--logout") continue;
+    if (arg.startsWith("-")) {
+      await platform2.write(2, `mcpcat rm: unknown option '${arg}'
+`);
+      return 2;
+    }
+    names.push(arg);
+  }
+  if (names.length === 0) {
+    await platform2.write(2, "mcpcat rm: requires a server name\n");
+    return 2;
+  }
+  const path = configFile ?? (local ? projectConfigPath(platform2) : userConfigPath(platform2));
+  for (const name of names) {
+    const removed = await removeServer(platform2.fs, path, name);
+    if (!removed) {
+      await platform2.write(2, `mcpcat rm: '${name}' not found in ${path}
+`);
+      return 1;
+    }
+    await platform2.write(1, `removed ${name} from ${path}
+`);
+  }
+  return 0;
+}
+function formatListEntry(entry) {
+  const c = entry.config;
+  const transport = "url" in c ? "http" : "stdio";
+  const target = "url" in c ? c.url : c.command;
+  const enabled = "enabled" in c && c.enabled === false ? " (disabled)" : "";
+  const exp = c.exposure ? ` [${c.exposure}]` : "";
+  return `${entry.name}  ${transport}  ${target}${enabled}${exp}  (${entry.source})`;
+}
+async function printListJson(platform2, config) {
+  const entries = {};
+  for (const entry of config.servers) {
+    entries[entry.name] = {
+      ...entry.config,
+      source: entry.source,
+      ...entry.scope ? { scope: entry.scope } : {},
+      ...entry.override ? { override: entry.override } : {}
+    };
+  }
+  await platform2.write(1, `${JSON.stringify(entries, null, 2)}
+`);
+}
+async function printListText(platform2, config) {
+  if (config.servers.length === 0 && config.problems.length === 0) {
+    await platform2.write(1, "no servers configured\n");
+    return;
+  }
+  for (const entry of config.servers) {
+    await platform2.write(1, `${formatListEntry(entry)}
+`);
+  }
+}
+async function runList(platform2, args2) {
+  let json = false;
+  let configFile;
+  let trustProject = false;
+  for (let i = 0; i < args2.length; i++) {
+    const arg = args2[i];
+    if (arg === "--json") {
+      json = true;
+      continue;
+    }
+    if (arg === "--config" && i + 1 < args2.length) {
+      configFile = args2[++i];
+      continue;
+    }
+    if (arg === "--trust-project") {
+      trustProject = true;
+    }
+  }
+  const source = await MergedConfigSource.load(platform2, { trustProject, configFile });
+  const { config } = source;
+  if (json) {
+    await printListJson(platform2, config);
+  } else {
+    await printListText(platform2, config);
+  }
+  let hasProblems = false;
+  for (const p of config.problems) {
+    hasProblems = true;
+    const prefix = p.server ? `${p.server}: ` : "";
+    await platform2.write(2, `mcpcat list: ${prefix}${p.message}
+`);
+  }
+  return hasProblems ? 1 : 0;
+}
+async function runEnable(platform2, args2, enable) {
+  let configFile;
+  let local = false;
+  const names = [];
+  for (let i = 0; i < args2.length; i++) {
+    const arg = args2[i];
+    if (arg === "--config" && i + 1 < args2.length) {
+      configFile = args2[++i];
+      continue;
+    }
+    if (arg === "-l" || arg === "--local") {
+      local = true;
+      continue;
+    }
+    if (arg.startsWith("-")) continue;
+    names.push(arg);
+  }
+  if (names.length === 0) {
+    await platform2.write(2, `mcpcat ${enable ? "enable" : "disable"}: requires a server name
+`);
+    return 2;
+  }
+  const path = configFile ?? (local ? projectConfigPath(platform2) : userConfigPath(platform2));
+  for (const name of names) {
+    const ok = await updateServer(platform2.fs, path, name, { enabled: enable });
+    if (!ok) {
+      await platform2.write(
+        2,
+        `mcpcat ${enable ? "enable" : "disable"}: '${name}' not found in ${path}
+`
+      );
+      return 1;
+    }
+    await platform2.write(1, `${enable ? "enabled" : "disabled"} ${name} in ${path}
+`);
+  }
+  return 0;
+}
+async function runExposure(platform2, args2) {
+  let configFile;
+  let local = false;
+  let toolGlob;
+  const positional = [];
+  for (let i = 0; i < args2.length; i++) {
+    const arg = args2[i];
+    if (arg === "--config" && i + 1 < args2.length) {
+      configFile = args2[++i];
+      continue;
+    }
+    if (arg === "-l" || arg === "--local") {
+      local = true;
+      continue;
+    }
+    if (arg === "--tool" && i + 1 < args2.length) {
+      toolGlob = args2[++i];
+      continue;
+    }
+    if (arg.startsWith("-")) continue;
+    positional.push(arg);
+  }
+  if (positional.length < 2) {
+    await platform2.write(2, "mcpcat exposure: requires <name> <mode>\n");
+    return 2;
+  }
+  const [name, mode] = positional;
+  const validModes = ["codemode", "deferred", "direct", "hidden"];
+  if (!validModes.includes(mode)) {
+    await platform2.write(2, `mcpcat exposure: mode must be one of ${validModes.join(", ")}
+`);
+    return 2;
+  }
+  const path = configFile ?? (local ? projectConfigPath(platform2) : userConfigPath(platform2));
+  const ok = await setExposure(platform2.fs, path, name, mode, toolGlob);
+  if (!ok) {
+    await platform2.write(2, `mcpcat exposure: '${name}' not found in ${path}
+`);
+    return 1;
+  }
+  const what = toolGlob ? `${name} tool ${toolGlob}` : name;
+  await platform2.write(1, `set ${what} to ${mode} in ${path}
+`);
+  return 0;
+}
+async function runImport(platform2, args2) {
+  let configFile;
+  let local = false;
+  const positional = [];
+  for (let i = 0; i < args2.length; i++) {
+    const arg = args2[i];
+    if (arg === "--config" && i + 1 < args2.length) {
+      configFile = args2[++i];
+      continue;
+    }
+    if (arg === "-l" || arg === "--local") {
+      local = true;
+      continue;
+    }
+    if (arg.startsWith("-")) continue;
+    positional.push(arg);
+  }
+  if (positional.length < 1) {
+    await platform2.write(2, "mcpcat import: requires a file path\n");
+    return 2;
+  }
+  const filePath = positional[0];
+  const names = positional.slice(1);
+  let text;
+  try {
+    const data = await platform2.fs.readFile(filePath);
+    text = new TextDecoder().decode(data);
+  } catch {
+    await platform2.write(2, `mcpcat import: cannot read '${filePath}'
+`);
+    return 2;
+  }
+  const result = importFile(text, filePath, names.length > 0 ? names : void 0);
+  for (const err of result.errors) {
+    await platform2.write(2, `mcpcat import: ${err}
+`);
+  }
+  if (result.servers.length === 0) {
+    await platform2.write(2, "mcpcat import: no servers found\n");
+    return 1;
+  }
+  const destPath = configFile ?? (local ? projectConfigPath(platform2) : userConfigPath(platform2));
+  for (const { name, config } of result.servers) {
+    const validation = validateServer(name, config);
+    if ("message" in validation) {
+      await platform2.write(2, `mcpcat import: ${name}: ${validation.message}
+`);
+      continue;
+    }
+    const { replaced } = await addServer(platform2.fs, destPath, name, config);
+    await platform2.write(1, `${replaced ? "replaced" : "imported"} ${name}
+`);
+  }
+  return 0;
 }
 
 // src/cli/main.ts
@@ -2130,6 +4724,15 @@ var VERBS = [
   "inbox",
   "help"
 ];
+var CONFIG_VERBS = {
+  add: true,
+  rm: true,
+  list: true,
+  enable: true,
+  disable: true,
+  exposure: true,
+  import: true
+};
 var UNIMPLEMENTED_VERBS = /* @__PURE__ */ new Set([
   "resources",
   "read",
@@ -2138,21 +4741,13 @@ var UNIMPLEMENTED_VERBS = /* @__PURE__ */ new Set([
   "grep",
   "complete",
   "task",
-  "add",
-  "rm",
-  "list",
-  "enable",
-  "disable",
-  "exposure",
-  "import",
   "login",
   "logout",
-  "serve",
   "code",
   "discover",
   "inbox"
 ]);
-var CLIENT_VERBS = /* @__PURE__ */ new Set(["info", "tools", "call", "describe"]);
+var CLIENT_VERBS = /* @__PURE__ */ new Set(["info", "tools", "call", "describe", "serve"]);
 function helpText(version) {
   return `mcpcat ${version} \u2013 a curl for the Model Context Protocol
 
@@ -2166,17 +4761,17 @@ Client verbs:
   describe <target> [tool]   Tool schema and help
 
 Configuration verbs:
-  add <name> <url>           Add a server to mcp.json (not implemented yet)
-  rm <name>                  Remove a server (not implemented yet)
-  list                       List configured servers (not implemented yet)
-  enable|disable <name>      Toggle a server (not implemented yet)
-  exposure <name> <mode>     Set exposure mode (not implemented yet)
-  import <file>              Import from other configs (not implemented yet)
+  add <name> <url>           Add a server to mcp.json
+  rm <name>                  Remove a server
+  list                       List configured servers
+  enable|disable <name>      Toggle a server
+  exposure <name> <mode>     Set exposure mode
+  import <file>              Import from other configs
   login <target>             OAuth sign-in (not implemented yet)
   logout <target>            Remove tokens (not implemented yet)
 
 Server and code verbs:
-  serve [--stdio|--http] \u2026   Expose commands as MCP server (not implemented yet)
+  serve [--stdio|--http] \u2026   Expose commands as MCP server
   code [-e src|file.js]      Run a codemode script (not implemented yet)
   discover <url>             Find MCP servers (not implemented yet)
   inbox                      Discovery inbox (not implemented yet)
@@ -2430,6 +5025,55 @@ async function runVerb(platform2, parsed, conn) {
       return 2;
   }
 }
+async function probeServer(_name, config, platform2) {
+  try {
+    const opts = { version: "probe" };
+    if ("url" in config && config.url) {
+      opts.url = config.url;
+      if ("headers" in config) opts.headers = config.headers;
+    } else if ("command" in config && config.command) {
+      opts.command = config.command;
+      if ("args" in config) opts.args = config.args;
+      if ("env" in config) opts.env = config.env;
+      if ("cwd" in config) opts.cwd = config.cwd;
+    } else {
+      return void 0;
+    }
+    const conn = await connect(platform2, opts);
+    try {
+      await conn.info();
+    } finally {
+      try {
+        await conn.close();
+      } catch {
+      }
+    }
+    return void 0;
+  } catch (err) {
+    return err.message;
+  }
+}
+async function dispatchConfigVerb(platform2, verb, args2) {
+  const rest = args2.slice(1);
+  switch (verb) {
+    case "add":
+      return runAdd(platform2, rest, probeServer);
+    case "rm":
+      return runRm(platform2, rest);
+    case "list":
+      return runList(platform2, rest);
+    case "enable":
+      return runEnable(platform2, rest, true);
+    case "disable":
+      return runEnable(platform2, rest, false);
+    case "exposure":
+      return runExposure(platform2, rest);
+    case "import":
+      return runImport(platform2, rest);
+    default:
+      return 1;
+  }
+}
 async function run(platform2, version, args2) {
   if (args2.includes("--version") || args2.includes("-V")) {
     await platform2.write(1, `${version}
@@ -2449,11 +5093,23 @@ async function run(platform2, version, args2) {
     await platform2.write(2, "mcpcat: no verb or target given\n");
     return 2;
   }
+  if (parsed.verb in CONFIG_VERBS) {
+    return dispatchConfigVerb(platform2, parsed.verb, args2);
+  }
   if (UNIMPLEMENTED_VERBS.has(parsed.verb)) {
     await platform2.write(2, `mcpcat: '${parsed.verb}' is not implemented yet
 `);
     return 1;
   }
+  if (parsed.verb === "serve") {
+    const serveArgs = args2.slice(args2.indexOf("serve") + 1);
+    const serveOptions = parseServeFlags(serveArgs);
+    if (serveOptions.commands.length === 0 && serveOptions.toolTemplates.length === 0) {
+      await platform2.write(2, "mcpcat serve: no commands or --tool templates given\n");
+      return 2;
+    }
+    return runServe(platform2, serveOptions, version);
+  }
   if (!CLIENT_VERBS.has(parsed.verb)) {
     await platform2.write(2, `mcpcat: unknown command '${parsed.verb}'
 `);
@@ -2468,7 +5124,7 @@ async function run(platform2, version, args2) {
 `);
     return 2;
   }
-  const config = createConfigSource(platform2);
+  const config = await MergedConfigSource.load(platform2);
   let resolved;
   try {
     resolved = await resolveTarget(
@@ -2516,7 +5172,8 @@ async function run(platform2, version, args2) {
 // src/platform/host.ts
 import { spawn as cpSpawn } from "node:child_process";
 import { constants } from "node:fs";
-import { access, mkdir, readFile, rename, stat, writeFile } from "node:fs/promises";
+import { access, mkdir, readFile as readFile2, rename, rmdir, stat, writeFile } from "node:fs/promises";
+import { createServer } from "node:net";
 import { Readable, Writable } from "node:stream";
 import * as tty from "node:tty";
 function nodeSpawn(options) {
@@ -2559,7 +5216,7 @@ function signalNumber(sig) {
 }
 var hostFs = {
   async readFile(path) {
-    return new Uint8Array(await readFile(path));
+    return new Uint8Array(await readFile2(path));
   },
   async writeFile(path, data) {
     await writeFile(path, data);
@@ -2581,6 +5238,12 @@ var hostFs = {
     } catch {
       return false;
     }
+  },
+  async mkdirExclusive(path) {
+    await mkdir(path, { recursive: false });
+  },
+  async rmdir(path) {
+    await rmdir(path);
   }
 };
 function createStdinStream() {
@@ -2592,11 +5255,77 @@ function createStdoutStream() {
 function createStderrStream() {
   return Writable.toWeb(process.stderr);
 }
+function nodeListen(options) {
+  return new Promise((resolve, reject) => {
+    const server = createServer();
+    const pending = [];
+    const ready = [];
+    let closed = false;
+    server.on("connection", (socket) => {
+      const conn = {
+        readable: Readable.toWeb(socket),
+        writable: Writable.toWeb(socket),
+        remoteAddress: socket.remoteAddress ?? "",
+        close() {
+          socket.destroy();
+        }
+      };
+      const waiter = pending.shift();
+      if (waiter) {
+        waiter.resolve(conn);
+      } else {
+        ready.push(conn);
+      }
+    });
+    server.on("error", (err) => {
+      if (!closed) reject(err);
+      for (const waiter of pending) waiter.reject(err);
+      pending.length = 0;
+    });
+    server.listen(options.port, options.host ?? "127.0.0.1", () => {
+      const addr = server.address();
+      const actualPort = typeof addr === "object" && addr ? addr.port : options.port;
+      const listener = {
+        get port() {
+          return actualPort;
+        },
+        accept() {
+          const queued = ready.shift();
+          if (queued) return Promise.resolve(queued);
+          return new Promise((res, rej) => {
+            if (closed) {
+              rej(new Error("listener closed"));
+              return;
+            }
+            pending.push({ resolve: res, reject: rej });
+          });
+        },
+        close() {
+          closed = true;
+          server.close();
+          for (const waiter of pending) waiter.reject(new Error("listener closed"));
+          pending.length = 0;
+        },
+        async *[Symbol.asyncIterator]() {
+          while (!closed) {
+            try {
+              yield await this.accept();
+            } catch {
+              break;
+            }
+          }
+        }
+      };
+      resolve(listener);
+    });
+  });
+}
 function createHostPlatform() {
-  const encoder = new TextEncoder();
+  const encoder2 = new TextEncoder();
   return {
     fetch: globalThis.fetch,
     spawn: nodeSpawn,
+    listen: nodeListen,
     fs: hostFs,
     env: process.env,
     cwd: process.cwd(),
@@ -2607,7 +5336,7 @@ function createHostPlatform() {
     stdout: createStdoutStream(),
     stderr: createStderrStream(),
     async write(fd, data) {
-      const bytes = typeof data === "string" ? encoder.encode(data) : data;
+      const bytes = typeof data === "string" ? encoder2.encode(data) : data;
       const stream = fd === 1 ? process.stdout : process.stderr;
       return new Promise((resolve, reject) => {
         stream.write(bytes, (err) => err ? reject(err) : resolve());
@@ -2615,6 +5344,9 @@ function createHostPlatform() {
     },
     exit(code2) {
       process.exit(code2);
+    },
+    onSignal(signal, handler) {
+      process.on(signal, handler);
     }
   };
 }
@@ -2622,5 +5354,5 @@ function createHostPlatform() {
 // src/host.ts
 var platform = createHostPlatform();
 var args = process.argv.slice(2);
-var code = await run(platform, "0.2.0", args);
+var code = await run(platform, "0.4.0", args);
 process.exit(code);