@ai-ecoverse/mcpcat 0.3.0 → 0.4.0

package/dist/kernel/mcpcat.mjs

@@ -738,7 +738,7 @@ var DEFAULT_RECONNECT_MAX_DELAY_MS = 3e4;
 var DEFAULT_RECONNECT_MAX_RETRIES = 5;
 async function consumeSseStream(stream, options) {
   const reader = stream.getReader();
-  const decoder = new TextDecoder();
+  const decoder2 = new TextDecoder();
   let buffered = "";
   let eventName;
   let eventId;
@@ -789,7 +789,7 @@ async function consumeSseStream(stream, options) {
       const { done, value } = await reader.read();
       if (done)
         break;
-      buffered += decoder.decode(value, { stream: true });
+      buffered += decoder2.decode(value, { stream: true });
       let newline = buffered.indexOf("\n");
       while (newline >= 0) {
         processLine(buffered.slice(0, newline));
@@ -799,7 +799,7 @@ async function consumeSseStream(stream, options) {
       if (Buffer.byteLength(buffered) > maxEventBytes)
         throw new Error(`MCP SSE event exceeds ${maxEventBytes} bytes`);
     }
-    buffered += decoder.decode();
+    buffered += decoder2.decode();
     if (buffered)
       processLine(buffered);
     dispatch();
@@ -1327,16 +1327,16 @@ async function createStatelessConnection(options) {
     }
     if (res.status >= 400) {
       const text = await res.text();
-      let rpcError;
+      let rpcError2;
       try {
         const parsed = JSON.parse(text);
         if (parsed.error && typeof parsed.error.code === "number") {
-          rpcError = parsed.error;
+          rpcError2 = parsed.error;
         }
       } catch {
       }
-      if (rpcError) {
-        throw new StatelessRpcError(rpcError.code, rpcError.message, rpcError.data);
+      if (rpcError2) {
+        throw new StatelessRpcError(rpcError2.code, rpcError2.message, rpcError2.data);
       }
       throw new StatelessHttpError(res.status, res.statusText, method, text.slice(0, 512));
     }
@@ -1353,10 +1353,10 @@ async function createStatelessConnection(options) {
     }
     return frame.result;
   }
-  const discoverResult = await request("server/discover", {
+  const discoverResult2 = await request("server/discover", {
     protocolVersion: STATELESS_PROTOCOL_VERSION
   });
-  const supported = Array.isArray(discoverResult?.supportedVersions) ? discoverResult.supportedVersions.filter((v) => typeof v === "string") : [];
+  const supported = Array.isArray(discoverResult2?.supportedVersions) ? discoverResult2.supportedVersions.filter((v) => typeof v === "string") : [];
   if (!supported.includes(STATELESS_PROTOCOL_VERSION)) {
     throw new Error(
       `Server does not support ${STATELESS_PROTOCOL_VERSION} (advertised: ${supported.join(", ") || "none"})`
@@ -1367,7 +1367,7 @@ async function createStatelessConnection(options) {
   return {
     async info() {
       if (serverInfoCache) return serverInfoCache;
-      const result = discoverResult;
+      const result = discoverResult2;
       serverInfoCache = {
         name: result?.serverInfo?.name,
         version: result?.serverInfo?.version,
@@ -1858,6 +1858,1399 @@ var MergedConfigSource = class _MergedConfigSource {
   }
 };
 
+// src/config/expand.ts
+var PLACEHOLDER = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
+var PLACEHOLDER_TEST = /\$\{[A-Za-z_][A-Za-z0-9_]*\}/;
+function containsPlaceholders(value) {
+  return PLACEHOLDER_TEST.test(value);
+}
+function expandPlaceholdersStrict(value, env) {
+  let hasUndefined = false;
+  const result = value.replace(PLACEHOLDER, (_, name) => {
+    if (env[name] === void 0) {
+      hasUndefined = true;
+      return "";
+    }
+    return env[name];
+  });
+  if (hasUndefined) return void 0;
+  return result;
+}
+
+// src/serve/catalog.ts
+var NAME_RE = /^[A-Za-z][\w-]*$/;
+function sanitizeName(raw) {
+  const cleaned = raw.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+  return cleaned || "cli";
+}
+function cliPrefix(help, filePath, explicit) {
+  if (explicit) return sanitizeName(explicit);
+  const fromUsage = usageProgramName(help);
+  if (fromUsage) return sanitizeName(fromUsage);
+  const base = filePath.split("/").pop() ?? filePath;
+  return sanitizeName(base.replace(/\.jsh$/i, ""));
+}
+function parseHelp(help) {
+  const block = commandsFromBlock(help);
+  const program = usageProgramName(help);
+  const commands = mergeCommandLists(block.commands, usageCommands(help, program));
+  return {
+    ...program ? { program } : {},
+    commands: applyScopedFlags(commands, block.scoped),
+    globalFlags: block.globalFlags
+  };
+}
+function isGroupCandidate(command) {
+  return command.path.length === 1 && command.positionals.length === 0 && command.flags.length === 0;
+}
+function nestGroup(commands, group, nested, topNames) {
+  const children = attachGlobalFlags(nested.commands, nested.globalFlags);
+  if (children.length === 0) return null;
+  const childNames = children.map((child) => child.path[0] ?? "");
+  const same = childNames.length === topNames.size && childNames.every((name) => topNames.has(name));
+  if (same) return null;
+  const nestedCommands = children.map((child) => ({ ...child, path: childPath(group, child) }));
+  return commands.filter((command) => command.path[0] !== group).concat(nestedCommands);
+}
+function attachGlobalFlags(commands, globalFlags) {
+  if (globalFlags.length === 0) return commands;
+  return commands.map((command) => ({ ...command, flags: mergeFlags(command.flags, globalFlags) }));
+}
+function parseMcpOverride(stdout) {
+  let value;
+  try {
+    value = JSON.parse(stdout);
+  } catch {
+    return null;
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const commandsValue = Object.getOwnPropertyDescriptor(value, "commands")?.value;
+  if (!Array.isArray(commandsValue)) return null;
+  const commands = [];
+  for (const entry of commandsValue) {
+    const command = readMcpCommand(entry);
+    if (command) commands.push(command);
+  }
+  if (commands.length === 0) return null;
+  return { commands, globalFlags: [] };
+}
+function buildTools(prefix, commands) {
+  const tools = [
+    {
+      name: `${prefix}_help`,
+      description: `Show ${prefix} help.`,
+      inputSchema: objectSchema({}),
+      cli: prefix,
+      kind: "help",
+      commandPath: []
+    },
+    {
+      name: `${prefix}_invoke`,
+      description: `Run ${prefix} with an argv array (one element per argument) and optional stdin. A non-zero exit is a tool error.`,
+      inputSchema: invokeSchema(),
+      cli: prefix,
+      kind: "invoke",
+      commandPath: []
+    }
+  ];
+  for (const command of commands) {
+    const leaf = command.path.join("_");
+    tools.push({
+      name: `${prefix}_${leaf}`,
+      description: command.description || `Run ${prefix} ${command.path.join(" ")}`,
+      inputSchema: commandSchema(command),
+      cli: prefix,
+      kind: "command",
+      commandPath: command.path
+    });
+  }
+  return tools;
+}
+function readToolArguments(input) {
+  if (input === void 0 || input === null) return { fields: [] };
+  if (typeof input !== "object" || Array.isArray(input)) {
+    return { fields: [], error: "arguments must be an object" };
+  }
+  const fields = [];
+  let stdin;
+  let passthrough;
+  let argv;
+  for (const key of Object.keys(input)) {
+    const value = Object.getOwnPropertyDescriptor(input, key)?.value;
+    const read = readArgument(key, value);
+    if (read.error) return { fields, error: read.error };
+    if (read.stdin !== void 0) stdin = read.stdin;
+    else if (read.passthrough) passthrough = read.passthrough;
+    else if (read.argv) argv = read.argv;
+    else if (read.field) fields.push(read.field);
+  }
+  return {
+    fields,
+    ...stdin !== void 0 ? { stdin } : {},
+    ...passthrough ? { passthrough } : {},
+    ...argv ? { argv } : {}
+  };
+}
+function argvForCommand(command, args) {
+  if (args.error) return { error: args.error };
+  const argv = [...command.path];
+  for (const positional of command.positionals) {
+    const found = args.fields.find((field) => field.name === positional.name);
+    if (!found) {
+      if (positional.required) return { error: `missing ${positional.name}` };
+      continue;
+    }
+    if (typeof found.value !== "string" && typeof found.value !== "number") {
+      return { error: `${positional.name} must be a string` };
+    }
+    argv.push(String(found.value));
+  }
+  const flags = appendFlags(command.flags, args.fields);
+  if ("error" in flags) return flags;
+  argv.push(...flags.argv);
+  if (args.passthrough) argv.push(...args.passthrough);
+  return { argv, ...args.stdin !== void 0 ? { stdin: args.stdin } : {} };
+}
+function appendFlags(flags, fields) {
+  const argv = [];
+  for (const flag of flags) {
+    const found = fields.find((field) => field.name === flag.name);
+    if (!found || found.value === false) continue;
+    const encoded = encodeFlag(flag, found.value);
+    if ("error" in encoded) return encoded;
+    argv.push(...encoded.argv);
+  }
+  return { argv };
+}
+function encodeFlag(flag, value) {
+  if (flag.type === "boolean") {
+    return value === true ? { argv: [`--${flag.name}`] } : { argv: [] };
+  }
+  if (flag.type === "string[]") {
+    if (!Array.isArray(value)) return { error: `${flag.name} must be an array of strings` };
+    const argv = [];
+    for (const item of value) argv.push(`--${flag.name}`, item);
+    return { argv };
+  }
+  if (typeof value !== "string" && typeof value !== "number") {
+    return { error: `${flag.name} must be a string` };
+  }
+  return { argv: [`--${flag.name}`, String(value)] };
+}
+function commandsFromBlock(help) {
+  let section = "none";
+  const commands = [];
+  const globalFlags = [];
+  const scoped = [];
+  for (const rawLine of help.split("\n")) {
+    const line = rawLine.replace(/\t/g, "  ");
+    const header = classifyHeader(line);
+    if (header) {
+      section = header.kind === "other" ? "none" : header.kind;
+      if (header.kind === "scoped" && header.name) scoped.push({ name: header.name, flags: [] });
+      continue;
+    }
+    pushSectionLine(section, line, commands, globalFlags, scoped);
+  }
+  return { commands, globalFlags, scoped };
+}
+function pushSectionLine(section, line, commands, globalFlags, scoped) {
+  if (section === "commands") {
+    const command = parseCommandLine(line);
+    if (command) commands.push(command);
+    return;
+  }
+  const flag = parseFlagLine(line);
+  if (!flag) return;
+  if (section === "options") globalFlags.push(flag);
+  if (section === "scoped") scoped[scoped.length - 1]?.flags.push(flag);
+}
+function classifyHeader(line) {
+  const text = line.trim();
+  if (/^commands:?$/i.test(text)) return { kind: "commands" };
+  if (/^options:?$/i.test(text)) return { kind: "options" };
+  const flags = /^([A-Za-z][\w-]*)\s+flags:?$/i.exec(text);
+  if (flags?.[1]) return { kind: "scoped", name: flags[1].toLowerCase() };
+  if (/^[A-Z][A-Z0-9 ]+:$/.test(text)) return { kind: "other" };
+  return null;
+}
+function parseCommandLine(line) {
+  if (!/^\s{2,}\S/.test(line)) return null;
+  const parts = line.trim().split(/\s{2,}/);
+  if (parts.length < 2) return null;
+  const tokens = tokenize(parts[0] ?? "");
+  const name = tokens[0] ?? "";
+  if (!NAME_RE.test(name) || name.startsWith("-")) return null;
+  const spec = emptySpec();
+  for (const token of tokens.slice(1)) parseUsageToken(token, spec);
+  return {
+    path: [name],
+    description: parts.slice(1).join(" ").trim(),
+    positionals: spec.positionals,
+    flags: spec.flags
+  };
+}
+function usageProgramName(help) {
+  for (const raw of help.split("\n")) {
+    if (!/^[\s>*]*usage:/i.test(raw)) continue;
+    const tokens = tokenize(raw);
+    const name = tokens[0];
+    if (name && NAME_RE.test(name)) return name;
+  }
+  return void 0;
+}
+function usageCommands(help, program) {
+  const commands = [];
+  for (const raw of help.split("\n")) {
+    const command = usageCommand(raw, program);
+    if (command) commands.push(command);
+  }
+  return commands;
+}
+function isCommandSlot(token) {
+  const inner = token.replace(/^\[|\]$/g, "").replace(/^<|>$/g, "").toLowerCase();
+  return inner === "command" || inner === "cmd" || inner === "subcommand" || inner === "verb";
+}
+function usageCommand(raw, program) {
+  const line = raw.trim();
+  const tokens = tokenize(line);
+  if (tokens.length < 2) return null;
+  const isUsage = /^usage:/i.test(line);
+  if (!isUsage && tokens[0] !== program) return null;
+  const path = [];
+  let index = 1;
+  while (index < tokens.length && path.length < 2 && NAME_RE.test(tokens[index] ?? "")) {
+    path.push(tokens[index] ?? "");
+    index++;
+  }
+  if (path.length === 0) return null;
+  if (isCommandSlot(tokens[index] ?? "")) return null;
+  const spec = emptySpec();
+  for (const token of tokens.slice(index)) parseUsageToken(token, spec);
+  return { path, description: "", positionals: spec.positionals, flags: spec.flags };
+}
+function emptySpec() {
+  return { positionals: [], flags: [] };
+}
+function parseUsageToken(token, into) {
+  const optional = token.startsWith("[") && token.endsWith("]");
+  const inner = optional ? token.slice(1, -1).trim() : token;
+  if (inner.startsWith("--")) {
+    const flag = parseFlagToken(inner);
+    if (flag) into.flags.push(flag);
+    return;
+  }
+  if (inner.startsWith("<") && inner.endsWith(">")) {
+    into.positionals.push({
+      name: cleanName(inner.slice(1, -1)),
+      required: !optional,
+      description: ""
+    });
+    return;
+  }
+  if (NAME_RE.test(inner)) {
+    into.positionals.push({ name: cleanName(inner), required: !optional, description: "" });
+  }
+}
+function parseFlagToken(inner) {
+  const match = /^--([A-Za-z][\w-]*)(?:(?:=|\s+)(\S+))?$/.exec(inner.trim());
+  if (!match?.[1]) return null;
+  const value = match[2] ?? "";
+  if (!value) return { name: match[1], type: "boolean", description: "" };
+  return { name: match[1], type: value.includes("...") ? "string[]" : "string", description: "" };
+}
+function parseFlagLine(line) {
+  const trimmed = line.trim();
+  if (!trimmed.includes("--")) return null;
+  const match = /--([A-Za-z][\w-]*)(?:=(\S+)|(?:\s+(<[^>]+>|\[[^\]]+\]|[A-Z][A-Z0-9_-]+)))?/.exec(
+    trimmed
+  );
+  if (!match?.[1]) return null;
+  const value = match[2] || match[3] || "";
+  const repeatable = /\brepeat|\.\.\.|one or more/i.test(trimmed);
+  const description = flagDescription(trimmed);
+  if (!value && !repeatable) return { name: match[1], type: "boolean", description };
+  return { name: match[1], type: repeatable ? "string[]" : "string", description };
+}
+function flagDescription(line) {
+  const parts = line.trim().split(/\s{2,}/);
+  return parts.length > 1 ? parts.slice(1).join(" ").trim() : "";
+}
+function tokenize(line) {
+  const source = line.trim().replace(/^usage:\s*/i, "");
+  const tokens = [];
+  let index = 0;
+  while (index < source.length) {
+    if (source[index] === " ") {
+      index++;
+      continue;
+    }
+    const closer = source[index] === "[" ? "]" : source[index] === "<" ? ">" : "";
+    if (closer) {
+      const end = source.indexOf(closer, index);
+      if (end === -1) {
+        tokens.push(source.slice(index));
+        break;
+      }
+      tokens.push(source.slice(index, end + 1));
+      index = end + 1;
+      continue;
+    }
+    const next = source.indexOf(" ", index);
+    if (next === -1) {
+      tokens.push(source.slice(index));
+      break;
+    }
+    tokens.push(source.slice(index, next));
+    index = next;
+  }
+  return tokens;
+}
+function mergeCommandLists(primary, extra) {
+  const merged = primary.map((command) => ({ ...command }));
+  for (const command of extra) {
+    const existing = merged.find((item) => samePath(item.path, command.path));
+    if (!existing) {
+      merged.push(command);
+      continue;
+    }
+    if (existing.positionals.length === 0) existing.positionals = command.positionals;
+    if (!existing.description) existing.description = command.description;
+    existing.flags = mergeFlags(existing.flags, command.flags);
+  }
+  return merged;
+}
+function applyScopedFlags(commands, scoped) {
+  return commands.map((command) => {
+    const extra = scoped.find((scope) => scope.name === (command.path[0] ?? "").toLowerCase());
+    if (!extra) return command;
+    return { ...command, flags: mergeFlags(command.flags, extra.flags) };
+  });
+}
+function mergeFlags(left, right) {
+  const merged = [...left];
+  for (const flag of right) {
+    if (!merged.some((existing) => existing.name === flag.name)) merged.push(flag);
+  }
+  return merged;
+}
+function samePath(left, right) {
+  return left.length === right.length && left.every((part, index) => part === right[index]);
+}
+function childPath(group, child) {
+  if (child.path[0] === group) return child.path.slice(0, 2);
+  return [group, child.path[0] ?? ""].filter((part) => part.length > 0).slice(0, 2);
+}
+function cleanName(raw) {
+  const cleaned = raw.replace(/[^A-Za-z0-9_-]+/g, "").replace(/^-+/, "");
+  return cleaned || "arg";
+}
+function readMcpCommand(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const name = ownString(value, "name");
+  if (!name) return null;
+  const path = name.split(/\s+/).filter((part) => NAME_RE.test(part)).slice(0, 2);
+  if (path.length === 0) return null;
+  return {
+    path,
+    description: ownString(value, "description") ?? "",
+    positionals: readMcpPositionals(Object.getOwnPropertyDescriptor(value, "positionals")?.value),
+    flags: readMcpFlags(Object.getOwnPropertyDescriptor(value, "flags")?.value)
+  };
+}
+function readMcpPositionals(value) {
+  if (!Array.isArray(value)) return [];
+  const positionals = [];
+  for (const entry of value) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
+    const name = ownString(entry, "name");
+    if (!name) continue;
+    const required = Object.getOwnPropertyDescriptor(entry, "required")?.value;
+    positionals.push({ name, required: required !== false, description: "" });
+  }
+  return positionals;
+}
+function readMcpFlags(value) {
+  if (!Array.isArray(value)) return [];
+  const flags = [];
+  for (const entry of value) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
+    const name = ownString(entry, "name");
+    const type = ownString(entry, "type");
+    if (!name || type !== "boolean" && type !== "string" && type !== "string[]") continue;
+    flags.push({ name, type, description: "" });
+  }
+  return flags;
+}
+function ownString(value, key) {
+  const found = Object.getOwnPropertyDescriptor(value, key)?.value;
+  return typeof found === "string" && found.length > 0 ? found : void 0;
+}
+function objectSchema(properties, required) {
+  return {
+    type: "object",
+    properties,
+    additionalProperties: false,
+    ...required && required.length > 0 ? { required } : {}
+  };
+}
+function invokeSchema() {
+  return objectSchema(
+    {
+      argv: {
+        type: "array",
+        items: { type: "string" },
+        description: "Arguments, one element per argument. Never a shell string."
+      },
+      stdin: { type: "string", description: "Optional standard input." }
+    },
+    ["argv"]
+  );
+}
+function commandSchema(command) {
+  const properties = {};
+  const required = [];
+  for (const positional of command.positionals) {
+    properties[positional.name] = {
+      type: "string",
+      description: positional.description || positional.name
+    };
+    if (positional.required) required.push(positional.name);
+  }
+  for (const flag of command.flags) {
+    properties[flag.name] = flagProperty(flag);
+  }
+  properties.stdin = { type: "string", description: "Optional standard input." };
+  properties.passthrough = {
+    type: "array",
+    items: { type: "string" },
+    description: "Extra arguments appended as-is."
+  };
+  return objectSchema(properties, required);
+}
+function flagProperty(flag) {
+  if (flag.type === "boolean")
+    return { type: "boolean", description: flag.description || flag.name };
+  if (flag.type === "string[]") {
+    return { type: "array", items: { type: "string" }, description: flag.description || flag.name };
+  }
+  return { type: "string", description: flag.description || flag.name };
+}
+function readArgument(key, value) {
+  if (key === "stdin") {
+    return typeof value === "string" ? { stdin: value } : { error: "stdin must be a string" };
+  }
+  if (key === "passthrough") return readStringArray(value, "passthrough");
+  if (key === "argv") {
+    const read = readStringArray(value, "argv");
+    return read.passthrough ? { argv: read.passthrough } : read;
+  }
+  if (!isArgValue(value)) return { error: `${key} has an unsupported type` };
+  return { field: { name: key, value } };
+}
+function readStringArray(value, label) {
+  if (!Array.isArray(value) || !value.every((item) => typeof item === "string")) {
+    return { error: `${label} must be an array of strings` };
+  }
+  return { passthrough: value };
+}
+function isArgValue(value) {
+  if (typeof value === "string" || typeof value === "boolean" || typeof value === "number")
+    return true;
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function parseToolTemplate(spec) {
+  const colonIdx = spec.indexOf(":");
+  if (colonIdx <= 0) return null;
+  const name = spec.slice(0, colonIdx).trim();
+  const template = spec.slice(colonIdx + 1).trim();
+  if (!name || !template) return null;
+  const placeholders = [];
+  const re = /\{(\w+)\}/g;
+  let m;
+  while ((m = re.exec(template)) !== null) {
+    if (!placeholders.includes(m[1])) placeholders.push(m[1]);
+  }
+  const properties = {};
+  for (const ph of placeholders) {
+    properties[ph] = { type: "string", description: ph };
+  }
+  return {
+    name,
+    description: template,
+    inputSchema: {
+      type: "object",
+      properties,
+      required: placeholders,
+      additionalProperties: false
+    },
+    cli: "",
+    kind: "command",
+    commandPath: []
+  };
+}
+function templateToArgv(template, args) {
+  let expanded = template;
+  for (const [key, value] of Object.entries(args)) {
+    expanded = expanded.replaceAll(`{${key}}`, value);
+  }
+  return expanded.split(/\s+/).filter(Boolean);
+}
+
+// src/serve/http.ts
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+var MAX_HEADER_SIZE = 16384;
+var MAX_BODY_SIZE = 10485760;
+async function readUntil(reader, buf, bufLen, sentinel, maxSize) {
+  for (; ; ) {
+    const text = decoder.decode(new Uint8Array(buf.buffer, buf.byteOffset, bufLen));
+    const pos = text.indexOf(sentinel);
+    if (pos >= 0) return { buf, bufLen, pos };
+    if (bufLen >= maxSize) return null;
+    const { done, value } = await reader.read();
+    if (done) return null;
+    if (bufLen + value.length > buf.length) {
+      const newBuf = new Uint8Array(Math.max(buf.length * 2, bufLen + value.length));
+      newBuf.set(new Uint8Array(buf.buffer, buf.byteOffset, bufLen));
+      buf = newBuf;
+    }
+    buf.set(value, bufLen);
+    bufLen += value.length;
+  }
+}
+async function readExact(reader, buf, bufLen, needed) {
+  while (bufLen < needed) {
+    const { done, value } = await reader.read();
+    if (done) return null;
+    if (bufLen + value.length > buf.length) {
+      const newBuf = new Uint8Array(Math.max(buf.length * 2, bufLen + value.length));
+      newBuf.set(new Uint8Array(buf.buffer, buf.byteOffset, bufLen));
+      buf = newBuf;
+    }
+    buf.set(value, bufLen);
+    bufLen += value.length;
+  }
+  return { buf, bufLen };
+}
+function parseRequestLine(buf, endPos) {
+  const headText = decoder.decode(new Uint8Array(buf.buffer, buf.byteOffset, endPos));
+  const lines = headText.split("\r\n");
+  const requestLine = lines[0];
+  if (!requestLine) return null;
+  const parts = requestLine.split(" ");
+  if (parts.length < 2) return null;
+  const method = parts[0];
+  const target = parts[1];
+  const headers = {};
+  for (let i = 1; i < lines.length; i++) {
+    const line = lines[i];
+    if (!line) continue;
+    const colonIdx = line.indexOf(":");
+    if (colonIdx <= 0) continue;
+    headers[line.slice(0, colonIdx).trim().toLowerCase()] = line.slice(colonIdx + 1).trim();
+  }
+  return { method, target, headers, headerEnd: endPos + 4 };
+}
+async function handleConnection(readable, writable, handler) {
+  const reader = readable.getReader();
+  const writer = writable.getWriter();
+  let buf = new Uint8Array(4096);
+  let bufLen = 0;
+  try {
+    for (; ; ) {
+      const headerResult = await readUntil(reader, buf, bufLen, "\r\n\r\n", MAX_HEADER_SIZE);
+      if (!headerResult) break;
+      buf = headerResult.buf;
+      bufLen = headerResult.bufLen;
+      const parsed = parseRequestLine(buf, headerResult.pos);
+      if (!parsed) {
+        await writeResponse(writer, {
+          status: 400,
+          reason: "Bad Request",
+          headers: { "content-type": "text/plain" },
+          body: "Bad Request"
+        });
+        break;
+      }
+      const contentLength = Number(parsed.headers["content-length"] ?? 0);
+      if (contentLength > MAX_BODY_SIZE) {
+        await writeResponse(writer, {
+          status: 413,
+          reason: "Payload Too Large",
+          headers: { "content-type": "text/plain" },
+          body: "Payload Too Large"
+        });
+        break;
+      }
+      const bodyStart = parsed.headerEnd;
+      const totalNeeded = bodyStart + contentLength;
+      const bodyResult = await readExact(reader, buf, bufLen, totalNeeded);
+      if (!bodyResult && contentLength > 0) break;
+      if (bodyResult) {
+        buf = bodyResult.buf;
+        bufLen = bodyResult.bufLen;
+      }
+      const bodyBytes = buf.slice(bodyStart, bodyStart + contentLength);
+      const body = decoder.decode(bodyBytes);
+      const request = {
+        method: parsed.method,
+        target: parsed.target,
+        headers: parsed.headers,
+        body
+      };
+      const response = await handler(request);
+      await writeResponse(writer, response);
+      const connectionHeader = (parsed.headers.connection ?? "").toLowerCase();
+      if (connectionHeader === "close") break;
+      const consumed = bodyStart + contentLength;
+      const remaining = bufLen - consumed;
+      if (remaining > 0) {
+        const newBuf = new Uint8Array(Math.max(4096, remaining));
+        newBuf.set(new Uint8Array(buf.buffer, buf.byteOffset + consumed, remaining));
+        buf = newBuf;
+        bufLen = remaining;
+      } else {
+        buf = new Uint8Array(4096);
+        bufLen = 0;
+      }
+    }
+  } finally {
+    reader.releaseLock();
+    try {
+      await writer.close();
+    } catch {
+    }
+  }
+}
+async function writeResponse(writer, response) {
+  const bodyLength = new TextEncoder().encode(response.body).length;
+  const headers = { ...response.headers, "content-length": String(bodyLength) };
+  const lines = [`HTTP/1.1 ${response.status} ${response.reason}`];
+  for (const [name, value] of Object.entries(headers)) {
+    lines.push(`${name}: ${value}`);
+  }
+  lines.push("", "");
+  const headBytes = encoder.encode(lines.join("\r\n"));
+  await writer.write(headBytes);
+  if (response.body.length > 0) {
+    const bodyBytes = encoder.encode(response.body);
+    await writer.write(bodyBytes);
+  }
+}
+
+// src/serve/jsonrpc.ts
+var PROTOCOL_VERSIONS = ["2026-07-28", "2025-11-25", "2025-06-18"];
+var OUTPUT_CAP = 1048576;
+var JSON_CT = "application/json; charset=utf-8";
+async function handleJsonRpc(raw, tools, call, serverName, serverVersion) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return rpcError(null, -32700, "Parse error");
+  }
+  if (Array.isArray(parsed)) return rpcError(null, -32600, "Batch requests are not supported");
+  if (!parsed || typeof parsed !== "object") return rpcError(null, -32600, "Invalid request");
+  const method = readString(parsed, "method");
+  if (!method) return rpcError(readId(parsed), -32600, "Invalid request");
+  if (!hasOwn(parsed, "id")) return { status: 202, contentType: "text/plain", body: "" };
+  const id = readId(parsed);
+  const params = Object.getOwnPropertyDescriptor(parsed, "params")?.value;
+  if (method === "initialize")
+    return rpcOk(id, initializeResult(params, serverName, serverVersion));
+  if (method === "server/discover") return rpcOk(id, discoverResult(serverName, serverVersion));
+  if (method === "tools/list") return rpcOk(id, { tools });
+  if (method === "ping") return rpcOk(id, {});
+  if (method === "tools/call") return toolCall(id, params, tools, call);
+  return rpcError(id, -32601, `Method not found: ${method}`);
+}
+async function toolCall(id, params, tools, call) {
+  const name = params && typeof params === "object" ? readString(params, "name") : void 0;
+  if (!name) return rpcError(id, -32602, "tools/call requires a name");
+  if (!tools.some((tool) => tool.name === name))
+    return rpcError(id, -32602, `Unknown tool: ${name}`);
+  const args = params && typeof params === "object" ? Object.getOwnPropertyDescriptor(params, "arguments")?.value : void 0;
+  try {
+    const result = await call(name, args);
+    return rpcOk(id, toolResult(result));
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "tool call failed";
+    return rpcError(id, -32e3, message);
+  }
+}
+function toolResult(result) {
+  const stdout = cap(result.stdout);
+  const stderr = cap(result.stderr);
+  const text = stderr ? stdout ? `${stdout}
+${stderr}` : stderr : stdout;
+  return {
+    content: [{ type: "text", text }],
+    isError: result.exitCode !== 0,
+    structuredContent: { stdout, stderr, exitCode: result.exitCode }
+  };
+}
+function initializeResult(params, serverName, serverVersion) {
+  const requested = params && typeof params === "object" ? readString(params, "protocolVersion") : void 0;
+  const protocolVersion = PROTOCOL_VERSIONS.find((version) => version === requested) ?? PROTOCOL_VERSIONS[0];
+  return {
+    protocolVersion,
+    capabilities: { tools: { listChanged: false } },
+    serverInfo: { name: serverName, version: serverVersion }
+  };
+}
+function discoverResult(serverName, serverVersion) {
+  return {
+    protocolVersion: PROTOCOL_VERSIONS[0],
+    supportedVersions: PROTOCOL_VERSIONS,
+    capabilities: { tools: { listChanged: false } },
+    serverInfo: { name: serverName, version: serverVersion }
+  };
+}
+function cap(value) {
+  if (value.length <= OUTPUT_CAP) return value;
+  const half = Math.floor(OUTPUT_CAP / 2);
+  const cut = value.length - OUTPUT_CAP;
+  return `${value.slice(0, half)}
+\u2026 ${cut} characters cut \u2026
+${value.slice(value.length - half)}`;
+}
+function rpcOk(id, result) {
+  return {
+    status: 200,
+    contentType: JSON_CT,
+    body: JSON.stringify({ jsonrpc: "2.0", id, result })
+  };
+}
+function rpcError(id, code, message) {
+  return {
+    status: 200,
+    contentType: JSON_CT,
+    body: JSON.stringify({ jsonrpc: "2.0", id, error: { code, message } })
+  };
+}
+function readId(value) {
+  const id = Object.getOwnPropertyDescriptor(value, "id")?.value;
+  if (typeof id === "string" || typeof id === "number" || id === null) return id;
+  return null;
+}
+function readString(value, key) {
+  const found = Object.getOwnPropertyDescriptor(value, key)?.value;
+  return typeof found === "string" ? found : void 0;
+}
+function hasOwn(value, key) {
+  return Object.prototype.hasOwnProperty.call(value, key);
+}
+
+// src/serve/origin.ts
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+function isLoopbackOrigin(origin) {
+  try {
+    const url = new URL(origin);
+    const hostname = url.hostname;
+    if (LOOPBACK_HOSTS.has(hostname)) return true;
+    if (hostname === "::1") return true;
+    if (hostname.endsWith(".localhost")) return true;
+    return false;
+  } catch {
+    return false;
+  }
+}
+function isLoopbackHost(host) {
+  const hostname = host.replace(/:\d+$/, "");
+  if (LOOPBACK_HOSTS.has(hostname)) return true;
+  if (hostname === "::1") return true;
+  if (hostname.endsWith(".localhost")) return true;
+  return false;
+}
+function checkOrigin(origin, allowedOrigins, boundLoopback) {
+  if (origin === void 0) return { ok: true };
+  if (allowedOrigins.has(origin)) return { ok: true };
+  if (isLoopbackOrigin(origin)) return { ok: true };
+  if (!boundLoopback) return { ok: true };
+  return { ok: false, reason: `origin ${origin} is not allowed` };
+}
+function checkHost(host, boundLoopback) {
+  if (!boundLoopback) return { ok: true };
+  if (!host) return { ok: false, reason: "missing Host header" };
+  if (isLoopbackHost(host)) return { ok: true };
+  return { ok: false, reason: `host ${host} is not loopback` };
+}
+
+// src/serve/runtime.ts
+var CALL_TIMEOUT_MS = 12e4;
+var MAX_OUTPUT_DEFAULT = 1048576;
+var ALLOWED_ENV_KEYS = /* @__PURE__ */ new Set(["PATH", "HOME", "LANG"]);
+function parseHttpFlag(args, i) {
+  const next = args[i + 1];
+  if (!next || next.startsWith("-")) return { host: "127.0.0.1", port: 0, next: i };
+  const colonIdx = next.lastIndexOf(":");
+  if (colonIdx > 0 && colonIdx < next.length - 1) {
+    return { host: next.slice(0, colonIdx), port: Number(next.slice(colonIdx + 1)), next: i + 1 };
+  }
+  return { host: "127.0.0.1", port: Number(next), next: i + 1 };
+}
+function parseCommandTarget(arg) {
+  const eqIdx = arg.indexOf("=");
+  if (eqIdx > 0 && !arg.slice(0, eqIdx).includes("/")) {
+    return { name: arg.slice(0, eqIdx), path: arg.slice(eqIdx + 1) };
+  }
+  return { path: arg };
+}
+function parseSingleFlag(args, i, opts) {
+  const arg = args[i];
+  if (arg === "--stdio") {
+    opts.transport = "stdio";
+  } else if (arg === "--http") {
+    opts.transport = "http";
+    const parsed = parseHttpFlag(args, i);
+    opts.host = parsed.host;
+    opts.port = parsed.port;
+    return parsed.next;
+  } else if (arg === "--bearer" && args[i + 1]) {
+    opts.bearer = args[++i];
+  } else if (arg === "--allow-origin" && args[i + 1]) {
+    opts.allowOrigins.push(args[++i]);
+  } else if (arg === "--env" && args[i + 1]) {
+    opts.envAllow.push(args[++i]);
+  } else if (arg === "--tool" && args[i + 1]) {
+    opts.toolTemplates.push(args[++i]);
+  } else if (arg === "--call-timeout" && args[i + 1]) {
+    opts.callTimeout = Number(args[++i]) * 1e3;
+  } else if (arg === "--concurrency" && args[i + 1]) {
+    opts.concurrency = Number(args[++i]);
+  } else if (arg === "--max-output" && args[i + 1]) {
+    opts.maxOutput = Number(args[++i]);
+  } else if (arg === "--cwd" && args[i + 1]) {
+    opts.cwd = args[++i];
+  } else if (arg === "--json") {
+    opts.json = true;
+  } else if (!arg.startsWith("-")) {
+    opts.commands.push(parseCommandTarget(arg));
+  }
+  return i;
+}
+function parseServeFlags(args) {
+  const opts = {
+    transport: "stdio",
+    host: "127.0.0.1",
+    port: 0,
+    bearer: void 0,
+    allowOrigins: [],
+    envAllow: [],
+    toolTemplates: [],
+    callTimeout: CALL_TIMEOUT_MS,
+    concurrency: 1,
+    maxOutput: MAX_OUTPUT_DEFAULT,
+    cwd: void 0,
+    json: false,
+    commands: []
+  };
+  for (let i = 0; i < args.length; i++) {
+    i = parseSingleFlag(args, i, opts);
+  }
+  return opts;
+}
+function expandBearerToken(template, env) {
+  if (!containsPlaceholders(template)) return void 0;
+  return expandPlaceholdersStrict(template, env);
+}
+function constantTimeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let mismatch = 0;
+  for (let i = 0; i < a.length; i++) {
+    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return mismatch === 0;
+}
+function buildChildEnv(platform, envAllow) {
+  const env = {};
+  for (const key of ALLOWED_ENV_KEYS) {
+    if (platform.env[key]) env[key] = platform.env[key];
+  }
+  for (const entry of envAllow) {
+    const eqIdx = entry.indexOf("=");
+    if (eqIdx > 0) {
+      env[entry.slice(0, eqIdx)] = entry.slice(eqIdx + 1);
+    } else if (platform.env[entry]) {
+      env[entry] = platform.env[entry];
+    }
+  }
+  return env;
+}
+function capOutput(value, limit) {
+  if (value.length <= limit) return value;
+  const half = Math.floor(limit / 2);
+  const cut = value.length - limit;
+  return `${value.slice(0, half)}
+\u2026 ${cut} characters cut \u2026
+${value.slice(value.length - half)}`;
+}
+var inflightProcs = /* @__PURE__ */ new Set();
+async function runCommand(platform, cmdPath, argv, childEnv, stdin, timeoutMs, maxOutput, cwd) {
+  let proc;
+  try {
+    proc = await platform.spawn({
+      argv: [cmdPath, ...argv],
+      env: childEnv,
+      cwd
+    });
+  } catch (err) {
+    return { stdout: "", stderr: `spawn failed: ${err.message}`, exitCode: 127 };
+  }
+  inflightProcs.add(proc);
+  if (stdin !== void 0) {
+    const writer = proc.stdin.getWriter();
+    await writer.write(new TextEncoder().encode(stdin));
+    await writer.close();
+  } else {
+    try {
+      await proc.stdin.getWriter().close();
+    } catch {
+    }
+  }
+  const stdoutChunks = [];
+  const stderrChunks = [];
+  const readStream = async (stream, into) => {
+    const r = stream.getReader();
+    try {
+      for (; ; ) {
+        const { done, value } = await r.read();
+        if (done) break;
+        into.push(value);
+      }
+    } finally {
+      r.releaseLock();
+    }
+  };
+  const timer = new Promise(
+    (resolve) => setTimeout(() => resolve("timeout"), timeoutMs)
+  );
+  const work = Promise.all([
+    readStream(proc.stdout, stdoutChunks),
+    readStream(proc.stderr, stderrChunks),
+    proc.wait()
+  ]);
+  const result = await Promise.race([work, timer]);
+  if (result === "timeout") {
+    proc.kill("SIGTERM");
+    await new Promise((resolve) => setTimeout(resolve, 5e3));
+    try {
+      proc.kill("SIGKILL");
+    } catch {
+    }
+    inflightProcs.delete(proc);
+    return { stdout: "", stderr: "timed out", exitCode: 124 };
+  }
+  inflightProcs.delete(proc);
+  const [, , exitResult] = result;
+  const dec = new TextDecoder();
+  return {
+    stdout: capOutput(dec.decode(concat(stdoutChunks)), maxOutput),
+    stderr: capOutput(dec.decode(concat(stderrChunks)), maxOutput),
+    exitCode: exitResult.status
+  };
+}
+function concat(chunks) {
+  const total = chunks.reduce((s, c) => s + c.length, 0);
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const c of chunks) {
+    out.set(c, offset);
+    offset += c.length;
+  }
+  return out;
+}
+async function killInflight() {
+  for (const proc of inflightProcs) {
+    try {
+      proc.kill("SIGTERM");
+    } catch {
+    }
+  }
+  if (inflightProcs.size > 0) {
+    await new Promise((resolve) => setTimeout(resolve, 5e3));
+    for (const proc of inflightProcs) {
+      try {
+        proc.kill("SIGKILL");
+      } catch {
+      }
+    }
+  }
+  inflightProcs.clear();
+}
+async function runHelpForCli(platform, filePath, childEnv, cwd) {
+  const dashed = await runCommand(
+    platform,
+    filePath,
+    ["--help"],
+    childEnv,
+    void 0,
+    1e4,
+    MAX_OUTPUT_DEFAULT,
+    cwd
+  );
+  if (dashed.exitCode === 0 && dashed.stdout.trim()) return dashed.stdout;
+  const plain = await runCommand(
+    platform,
+    filePath,
+    ["help"],
+    childEnv,
+    void 0,
+    1e4,
+    MAX_OUTPUT_DEFAULT,
+    cwd
+  );
+  if (plain.exitCode === 0 && plain.stdout.trim()) return plain.stdout;
+  return dashed.stdout.trim() ? dashed.stdout : "";
+}
+async function expandGroupCommands(platform, filePath, commands, childEnv, cwd) {
+  const topNames = new Set(commands.map((c) => c.path[0] ?? ""));
+  let current = commands;
+  for (const command of commands) {
+    if (!isGroupCandidate(command)) continue;
+    const group = command.path[0] ?? "";
+    const nested = await runCommand(
+      platform,
+      filePath,
+      [group, "--help"],
+      childEnv,
+      void 0,
+      1e4,
+      MAX_OUTPUT_DEFAULT,
+      cwd
+    );
+    if (nested.exitCode !== 0 || !nested.stdout.trim()) continue;
+    const replaced = nestGroup(current, group, parseHelp(nested.stdout), topNames);
+    if (replaced) current = replaced;
+  }
+  return current;
+}
+async function discoverCli(platform, filePath, explicitName, childEnv, cwd) {
+  const mcp = await runCommand(
+    platform,
+    filePath,
+    ["--mcp"],
+    childEnv,
+    void 0,
+    1e4,
+    MAX_OUTPUT_DEFAULT,
+    cwd
+  );
+  const override = mcp.exitCode === 0 ? parseMcpOverride(mcp.stdout) : null;
+  const helpText2 = override ? "" : await runHelpForCli(platform, filePath, childEnv, cwd);
+  if (!override && !helpText2.trim()) {
+    throw new Error(`${filePath} did not print help or --mcp descriptor`);
+  }
+  const parsed = override ?? parseHelp(helpText2);
+  let commands = parsed.commands;
+  if (!override) {
+    commands = attachGlobalFlags(commands, parsed.globalFlags);
+    commands = await expandGroupCommands(platform, filePath, commands, childEnv, cwd);
+  }
+  return { name: cliPrefix(helpText2, filePath, explicitName), path: filePath, commands };
+}
+function createToolExecutor(platform, clis, allTools, childEnv, options, serveCwd) {
+  const rpcTools = allTools.map((t) => ({
+    name: t.name,
+    description: t.description,
+    inputSchema: t.inputSchema
+  }));
+  const queues = /* @__PURE__ */ new Map();
+  function enqueue(key, job) {
+    const previous = queues.get(key) ?? Promise.resolve();
+    const run2 = previous.then(job, job);
+    queues.set(
+      key,
+      run2.then(
+        () => void 0,
+        () => void 0
+      )
+    );
+    return run2;
+  }
+  function invokeTemplateTool(tool, args) {
+    const templateArgs = {};
+    if (args && typeof args === "object") {
+      for (const [k, v] of Object.entries(args)) {
+        templateArgs[k] = String(v);
+      }
+    }
+    const argv = templateToArgv(tool.description, templateArgs);
+    return enqueue(
+      "__template__",
+      () => runCommand(
+        platform,
+        argv[0],
+        argv.slice(1),
+        childEnv,
+        void 0,
+        options.callTimeout,
+        options.maxOutput,
+        serveCwd
+      )
+    );
+  }
+  async function executeTool(tool, cli, args) {
+    if (tool.kind === "help") {
+      const result = await runCommand(
+        platform,
+        cli.path,
+        ["--help"],
+        childEnv,
+        void 0,
+        options.callTimeout,
+        options.maxOutput,
+        serveCwd
+      );
+      if (result.exitCode === 0) return result;
+      return runCommand(
+        platform,
+        cli.path,
+        ["help"],
+        childEnv,
+        void 0,
+        options.callTimeout,
+        options.maxOutput,
+        serveCwd
+      );
+    }
+    if (tool.kind === "invoke") {
+      const parsed2 = readToolArguments(args ?? {});
+      if (parsed2.error) return { stdout: "", stderr: parsed2.error, exitCode: 2 };
+      if (!parsed2.argv) return { stdout: "", stderr: "argv is required", exitCode: 2 };
+      return runCommand(
+        platform,
+        cli.path,
+        parsed2.argv,
+        childEnv,
+        parsed2.stdin,
+        options.callTimeout,
+        options.maxOutput,
+        serveCwd
+      );
+    }
+    const parsed = readToolArguments(args ?? {});
+    const command = cli.commands.find((c) => c.path.join("_") === tool.commandPath.join("_"));
+    if (!command) return { stdout: "", stderr: `unknown command ${tool.name}`, exitCode: 2 };
+    const planned = argvForCommand(command, parsed);
+    if ("error" in planned) return { stdout: "", stderr: planned.error, exitCode: 2 };
+    return runCommand(
+      platform,
+      cli.path,
+      planned.argv,
+      childEnv,
+      planned.stdin,
+      options.callTimeout,
+      options.maxOutput,
+      serveCwd
+    );
+  }
+  async function invoke(name, args) {
+    const tool = allTools.find((t) => t.name === name);
+    if (!tool) return { stdout: "", stderr: `unknown tool ${name}`, exitCode: 1 };
+    if (tool.cli === "" && tool.commandPath.length === 0) {
+      return invokeTemplateTool(tool, args);
+    }
+    const cli = clis.find((c) => c.name === tool.cli);
+    if (!cli) return { stdout: "", stderr: `unknown cli ${tool.cli}`, exitCode: 1 };
+    return enqueue(cli.name, () => executeTool(tool, cli, args));
+  }
+  return { invoke, rpcTools };
+}
+async function runServe(platform, options, version) {
+  let resolvedBearer;
+  if (options.bearer) {
+    const expanded = expandBearerToken(options.bearer, platform.env);
+    if (!expanded) {
+      await platform.write(
+        2,
+        "mcpcat serve: --bearer requires a ${NAME} variable reference, not a literal token. Use --bearer '${MY_TOKEN}' and set MY_TOKEN in the environment.\n"
+      );
+      return 2;
+    }
+    resolvedBearer = expanded;
+  }
+  const serveCwd = options.cwd ?? platform.cwd;
+  const childEnv = buildChildEnv(platform, options.envAllow);
+  const clis = [];
+  for (const cmd of options.commands) {
+    try {
+      const cli = await discoverCli(platform, cmd.path, cmd.name, childEnv, serveCwd);
+      clis.push(cli);
+    } catch (err) {
+      await platform.write(2, `mcpcat serve: ${err.message}
+`);
+      return 2;
+    }
+  }
+  const allTools = clis.flatMap((cli) => buildTools(cli.name, cli.commands));
+  for (const spec of options.toolTemplates) {
+    const tool = parseToolTemplate(spec);
+    if (!tool) {
+      await platform.write(2, `mcpcat serve: invalid --tool spec: ${spec}
+`);
+      return 2;
+    }
+    allTools.push(tool);
+  }
+  const executor = createToolExecutor(platform, clis, allTools, childEnv, options, serveCwd);
+  const serverName = "mcpcat-serve";
+  if (options.transport === "stdio") {
+    return runStdioServer(platform, executor.rpcTools, executor.invoke, serverName, version);
+  }
+  return runHttpServer(
+    platform,
+    options,
+    executor.rpcTools,
+    executor.invoke,
+    serverName,
+    version,
+    resolvedBearer
+  );
+}
+async function runStdioServer(platform, tools, call, serverName, version) {
+  const reader = platform.stdin.getReader();
+  let buffer = "";
+  const dec = new TextDecoder();
+  const enc = new TextEncoder();
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      buffer += dec.decode(value, { stream: true });
+      let nlIdx;
+      while ((nlIdx = buffer.indexOf("\n")) >= 0) {
+        const line = buffer.slice(0, nlIdx).trim();
+        buffer = buffer.slice(nlIdx + 1);
+        if (!line) continue;
+        const outcome = await handleJsonRpc(line, tools, call, serverName, version);
+        if (outcome.status === 202) continue;
+        const writer = platform.stdout.getWriter();
+        await writer.write(enc.encode(`${outcome.body}
+`));
+        writer.releaseLock();
+      }
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  return 0;
+}
+async function runHttpServer(platform, options, tools, call, serverName, version, resolvedBearer) {
+  if (!platform.listen) {
+    await platform.write(2, "mcpcat serve: HTTP transport requires platform.listen\n");
+    return 3;
+  }
+  const boundLoopback = options.host === "127.0.0.1" || options.host === "localhost" || options.host === "::1";
+  if (!boundLoopback && !resolvedBearer) {
+    await platform.write(2, "mcpcat serve: --bearer is required when binding off loopback\n");
+    return 2;
+  }
+  const allowedOrigins = new Set(options.allowOrigins);
+  const listener = await platform.listen({ host: options.host, port: options.port });
+  const actualPort = listener.port;
+  const listenUrl = `http://${options.host}:${actualPort}/mcp`;
+  if (options.json) {
+    await platform.write(1, `${JSON.stringify({ url: listenUrl })}
+`);
+  }
+  await platform.write(2, `mcpcat serve: listening on ${listenUrl}
+`);
+  let shutdownRequested = false;
+  const shutdown = () => {
+    if (shutdownRequested) return;
+    shutdownRequested = true;
+    listener.close();
+    void killInflight();
+  };
+  if (platform.onSignal) {
+    platform.onSignal("SIGINT", shutdown);
+    platform.onSignal("SIGTERM", shutdown);
+  }
+  const handler = (request) => handleMcpRequest(
+    request,
+    tools,
+    call,
+    serverName,
+    version,
+    allowedOrigins,
+    boundLoopback,
+    resolvedBearer
+  );
+  try {
+    for await (const connection of listener) {
+      if (shutdownRequested) break;
+      const conn = connection;
+      handleConnection(conn.readable, conn.writable, handler).catch(() => {
+      }).finally(() => {
+        try {
+          conn.close();
+        } catch {
+        }
+      });
+    }
+  } catch {
+    if (!shutdownRequested) throw new Error("listener closed unexpectedly");
+  }
+  return 0;
+}
+async function handleMcpRequest(request, tools, call, serverName, version, allowedOrigins, boundLoopback, resolvedBearer) {
+  if (resolvedBearer) {
+    const authHeader = request.headers.authorization;
+    const provided = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : "";
+    if (!provided || !constantTimeEqual(provided, resolvedBearer)) {
+      return {
+        status: 401,
+        reason: "Unauthorized",
+        headers: { "content-type": "text/plain" },
+        body: "Unauthorized"
+      };
+    }
+  }
+  const originCheck = checkOrigin(request.headers.origin, allowedOrigins, boundLoopback);
+  if (!originCheck.ok) {
+    return {
+      status: 403,
+      reason: "Forbidden",
+      headers: { "content-type": "text/plain" },
+      body: originCheck.reason ?? "Forbidden"
+    };
+  }
+  const hostCheck = checkHost(request.headers.host, boundLoopback);
+  if (!hostCheck.ok) {
+    return {
+      status: 403,
+      reason: "Forbidden",
+      headers: { "content-type": "text/plain" },
+      body: hostCheck.reason ?? "Forbidden"
+    };
+  }
+  if (request.target !== "/mcp") {
+    return {
+      status: 404,
+      reason: "Not Found",
+      headers: { "content-type": "text/plain" },
+      body: "Not Found"
+    };
+  }
+  if (request.method !== "POST") {
+    return {
+      status: 405,
+      reason: "Method Not Allowed",
+      headers: { "content-type": "text/plain", allow: "POST" },
+      body: "Method Not Allowed"
+    };
+  }
+  const outcome = await handleJsonRpc(request.body, tools, call, serverName, version);
+  return {
+    status: outcome.status,
+    reason: outcome.status === 200 ? "OK" : "Accepted",
+    headers: { "content-type": outcome.contentType },
+    body: outcome.body
+  };
+}
+
 // src/config/lock.ts
 var LOCK_STALE_MS = 1e4;
 var LOCK_POLL_MS = 50;
@@ -2275,12 +3668,12 @@ function importFile(text, filename, names) {
 
 // src/config/warnings.ts
 var SECRET_HEADER = /authorization|cookie|token|key|secret|password|session/i;
-var PLACEHOLDER = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
+var PLACEHOLDER2 = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
 var SCHEME = /^\s*(?:bearer|basic|token|apikey|api-key)\s+/i;
 var SECRET_PARAM = /token|key|secret|password|signature|sig|auth|code/i;
 function literalSecret(header, value) {
   if (!SECRET_HEADER.test(header)) return false;
-  return value.replace(PLACEHOLDER, "").replace(SCHEME, "").trim() !== "";
+  return value.replace(PLACEHOLDER2, "").replace(SCHEME, "").trim() !== "";
 }
 function urlHasSecret(url) {
   if (!URL.canParse(url)) return void 0;
@@ -2815,12 +4208,11 @@ var UNIMPLEMENTED_VERBS = /* @__PURE__ */ new Set([
   "task",
   "login",
   "logout",
-  "serve",
   "code",
   "discover",
   "inbox"
 ]);
-var CLIENT_VERBS = /* @__PURE__ */ new Set(["info", "tools", "call", "describe"]);
+var CLIENT_VERBS = /* @__PURE__ */ new Set(["info", "tools", "call", "describe", "serve"]);
 function helpText(version) {
   return `mcpcat ${version} \u2013 a curl for the Model Context Protocol
 
@@ -2844,7 +4236,7 @@ Configuration verbs:
   logout <target>            Remove tokens (not implemented yet)
 
 Server and code verbs:
-  serve [--stdio|--http] \u2026   Expose commands as MCP server (not implemented yet)
+  serve [--stdio|--http] \u2026   Expose commands as MCP server
   code [-e src|file.js]      Run a codemode script (not implemented yet)
   discover <url>             Find MCP servers (not implemented yet)
   inbox                      Discovery inbox (not implemented yet)
@@ -3174,6 +4566,15 @@ async function run(platform, version, args) {
 `);
     return 1;
   }
+  if (parsed.verb === "serve") {
+    const serveArgs = args.slice(args.indexOf("serve") + 1);
+    const serveOptions = parseServeFlags(serveArgs);
+    if (serveOptions.commands.length === 0 && serveOptions.toolTemplates.length === 0) {
+      await platform.write(2, "mcpcat serve: no commands or --tool templates given\n");
+      return 2;
+    }
+    return runServe(platform, serveOptions, version);
+  }
   if (!CLIENT_VERBS.has(parsed.verb)) {
     await platform.write(2, `mcpcat: unknown command '${parsed.verb}'
 `);
@@ -3271,11 +4672,46 @@ async function kernelSpawn(ctx, options) {
     kill: (signal) => result.kill(signal)
   };
 }
+async function kernelListen(ctx, options) {
+  const raw = await ctx.net.listen({ port: options.port, host: options.host });
+  let closed = false;
+  async function accept() {
+    const conn = await raw.accept();
+    return {
+      readable: conn.readable,
+      writable: conn.writable,
+      remoteAddress: conn.remote.host,
+      close() {
+        conn.close();
+      }
+    };
+  }
+  return {
+    get port() {
+      return raw.port;
+    },
+    accept,
+    close() {
+      closed = true;
+      raw.close();
+    },
+    async *[Symbol.asyncIterator]() {
+      while (!closed) {
+        try {
+          yield await accept();
+        } catch {
+          break;
+        }
+      }
+    }
+  };
+}
 function createKernelPlatform(ctx) {
-  const encoder = new TextEncoder();
+  const encoder2 = new TextEncoder();
   return {
     fetch: ctx.fetch,
     spawn: (options) => kernelSpawn(ctx, options),
+    listen: (options) => kernelListen(ctx, options),
     fs: kernelFs(ctx),
     env: ctx.env,
     cwd: ctx.cwd,
@@ -3284,10 +4720,13 @@ function createKernelPlatform(ctx) {
     stdout: ctx.stdout,
     stderr: ctx.stderr,
     async write(fd, data) {
-      await ctx.write(fd, typeof data === "string" ? encoder.encode(data) : data);
+      await ctx.write(fd, typeof data === "string" ? encoder2.encode(data) : data);
     },
     exit(code) {
       ctx.exit(code);
+    },
+    onSignal(signal, handler) {
+      ctx.signals.on(signal, handler);
     }
   };
 }
@@ -3296,7 +4735,7 @@ function createKernelPlatform(ctx) {
 async function main(ctx) {
   const platform = createKernelPlatform(ctx);
   const args = ctx.argv.slice(1);
-  return run(platform, "0.3.0", args);
+  return run(platform, "0.4.0", args);
 }
 export {
   main as default