@ai-ecoverse/mcpcat 0.4.0 → 0.6.0

package/dist/kernel/mcpcat.mjs

@@ -1,3 +1,5 @@
+var __mcpcat_byteLength = (s) => new TextEncoder().encode(s).length;
+
 // node_modules/@earendil-works/pi-mcp/dist/protocol/jsonrpc.js
 var JSON_RPC_ERROR_CODES = {
   parseError: -32700,
@@ -772,7 +774,7 @@ async function consumeSseStream(stream, options) {
     if (value.startsWith(" "))
       value = value.slice(1);
     if (field === "data") {
-      dataBytes += Buffer.byteLength(value) + (dataLines.length > 0 ? 1 : 0);
+      dataBytes += __mcpcat_byteLength(value) + (dataLines.length > 0 ? 1 : 0);
       if (dataBytes > maxEventBytes)
         throw new Error(`MCP SSE event exceeds ${maxEventBytes} bytes`);
       dataLines.push(value);
@@ -796,7 +798,7 @@ async function consumeSseStream(stream, options) {
         buffered = buffered.slice(newline + 1);
         newline = buffered.indexOf("\n");
       }
-      if (Buffer.byteLength(buffered) > maxEventBytes)
+      if (__mcpcat_byteLength(buffered) > maxEventBytes)
         throw new Error(`MCP SSE event exceeds ${maxEventBytes} bytes`);
     }
     buffered += decoder2.decode();
@@ -1173,6 +1175,185 @@ var StreamableHttpTransport = class extends TransportEvents {
   }
 };
 
+// src/client/platform-stdio-transport.ts
+var DEFAULT_MAX_MESSAGE_BYTES2 = 4 * 1024 * 1024;
+var DEFAULT_MAX_STDERR_BYTES2 = 64 * 1024;
+var DEFAULT_CLOSE_TIMEOUT_MS2 = 2e3;
+var STDIN_CLOSE_GRACE_MS2 = 500;
+var PlatformStdioTransport = class {
+  options;
+  process;
+  started = false;
+  closed = false;
+  closeEmitted = false;
+  stderrText = "";
+  decoder = new TextDecoder();
+  encoder = new TextEncoder();
+  messageListeners = [];
+  errorListeners = [];
+  closeListeners = [];
+  constructor(options) {
+    this.options = options;
+  }
+  get stderr() {
+    return this.stderrText;
+  }
+  onMessage(listener) {
+    this.messageListeners.push(listener);
+    return () => {
+      this.messageListeners = this.messageListeners.filter((l) => l !== listener);
+    };
+  }
+  onError(listener) {
+    this.errorListeners.push(listener);
+    return () => {
+      this.errorListeners = this.errorListeners.filter((l) => l !== listener);
+    };
+  }
+  onClose(listener) {
+    this.closeListeners.push(listener);
+    return () => {
+      this.closeListeners = this.closeListeners.filter((l) => l !== listener);
+    };
+  }
+  emitMessage(message) {
+    for (const l of [...this.messageListeners]) l(message);
+  }
+  emitError(error) {
+    for (const l of [...this.errorListeners]) l(error);
+  }
+  emitClose() {
+    if (this.closeEmitted) return;
+    this.closeEmitted = true;
+    for (const l of [...this.closeListeners]) l();
+  }
+  async start() {
+    if (this.started) throw new Error("MCP stdio transport already started");
+    if (this.closed) throw new Error("MCP connection closed");
+    this.started = true;
+    const env = this.options.inheritEnv === false ? { ...this.options.env ?? {} } : {
+      ...this.options.platform.env,
+      ...this.options.env
+    };
+    this.process = await this.options.platform.spawn({
+      argv: [this.options.command, ...this.options.args ?? []],
+      env,
+      cwd: this.options.cwd
+    });
+    void this.readStdout();
+    void this.readStderr();
+    void this.waitForExit();
+  }
+  async send(message) {
+    if (!this.started || this.closed || !this.process) throw new Error("MCP connection closed");
+    const payload = `${JSON.stringify(message)}
+`;
+    const writer = this.process.stdin.getWriter();
+    try {
+      await writer.write(this.encoder.encode(payload));
+    } finally {
+      writer.releaseLock();
+    }
+  }
+  async close() {
+    if (this.closed) return;
+    this.closed = true;
+    const proc = this.process;
+    if (!proc) {
+      this.emitClose();
+      return;
+    }
+    const closeTimeoutMs = this.options.closeTimeoutMs ?? DEFAULT_CLOSE_TIMEOUT_MS2;
+    const grace = Math.min(STDIN_CLOSE_GRACE_MS2, closeTimeoutMs);
+    const done = proc.wait().then(() => true);
+    const delay = (ms) => new Promise((r) => setTimeout(() => r(false), ms));
+    try {
+      await proc.stdin.close();
+    } catch {
+    }
+    const exited = await Promise.race([done, delay(grace)]);
+    if (!exited) {
+      proc.kill("SIGTERM");
+      const exitedAfterTerm = await Promise.race([done, delay(closeTimeoutMs)]);
+      if (!exitedAfterTerm) {
+        proc.kill("SIGKILL");
+        await done;
+      }
+    }
+    proc.kill("SIGTERM");
+    this.emitClose();
+  }
+  async readStdout() {
+    const proc = this.process;
+    if (!proc) return;
+    const reader = proc.stdout.getReader();
+    const maxBytes = this.options.maxMessageBytes ?? DEFAULT_MAX_MESSAGE_BYTES2;
+    let buffer = "";
+    try {
+      for (; ; ) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        buffer += this.decoder.decode(value, { stream: true });
+        let nlIdx = buffer.indexOf("\n");
+        while (nlIdx >= 0) {
+          const line = buffer.slice(0, nlIdx).replace(/\r$/, "");
+          buffer = buffer.slice(nlIdx + 1);
+          if (line.trim()) {
+            try {
+              this.emitMessage(parseJsonRpcMessage(JSON.parse(line)));
+            } catch (err) {
+              this.emitError(err);
+            }
+          }
+          nlIdx = buffer.indexOf("\n");
+        }
+        if (this.encoder.encode(buffer).length > maxBytes) {
+          buffer = "";
+          this.emitError(new Error(`MCP stdio message exceeds ${maxBytes} bytes`));
+        }
+      }
+      buffer += this.decoder.decode();
+      if (buffer.trim()) {
+        this.emitError(new Error("MCP stdio server closed with an incomplete JSON-RPC message"));
+      }
+    } catch (err) {
+      if (!this.closed) this.emitError(err);
+    } finally {
+      reader.releaseLock();
+    }
+  }
+  async readStderr() {
+    const proc = this.process;
+    if (!proc) return;
+    const reader = proc.stderr.getReader();
+    const maxBytes = this.options.maxStderrBytes ?? DEFAULT_MAX_STDERR_BYTES2;
+    try {
+      for (; ; ) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        const chunk = this.decoder.decode(value, { stream: true });
+        this.stderrText += chunk;
+        if (this.encoder.encode(this.stderrText).length > maxBytes) {
+          this.stderrText = this.stderrText.slice(-maxBytes);
+        }
+        this.options.onStderr?.(chunk);
+      }
+    } catch {
+    }
+  }
+  async waitForExit() {
+    const proc = this.process;
+    if (!proc) return;
+    try {
+      await proc.wait();
+    } catch {
+    }
+    if (!this.closed) {
+      this.emitClose();
+    }
+  }
+};
+
 // src/client/pi-connection.ts
 async function createPiConnection(options) {
   const clientOptions = {
@@ -1184,17 +1365,29 @@ async function createPiConnection(options) {
   if (options.url) {
     transport = new StreamableHttpTransport({
       url: options.url,
-      headers: options.headers
+      headers: options.headers,
+      fetch: options.fetchImpl
     });
   } else if (options.command) {
-    transport = new StdioTransport({
-      command: options.command,
-      args: options.args,
-      env: options.env,
-      cwd: options.cwd,
-      inheritEnv: true,
-      stderr: "pipe"
-    });
+    if (options.platform) {
+      transport = new PlatformStdioTransport({
+        command: options.command,
+        args: options.args,
+        env: options.env,
+        cwd: options.cwd,
+        inheritEnv: true,
+        platform: options.platform
+      });
+    } else {
+      transport = new StdioTransport({
+        command: options.command,
+        args: options.args,
+        env: options.env,
+        cwd: options.cwd,
+        inheritEnv: true,
+        stderr: "pipe"
+      });
+    }
   } else {
     throw new Error("PiConnection requires either a url or a command");
   }
@@ -1282,10 +1475,10 @@ async function createStatelessConnection(options) {
     timeoutMs = 6e4,
     clientInfo = { name: "mcpcat", version: "0.0.0" }
   } = options;
-  let nextId = 1;
+  let nextId2 = 1;
   let negotiatedVersion;
   async function request(method, params) {
-    const id = nextId++;
+    const id = nextId2++;
     const headers = {
       "Content-Type": "application/json",
       Accept: "application/json, text/event-stream",
@@ -1408,7 +1601,8 @@ async function connect(platform, options) {
       args: options.args,
       env: options.env,
       cwd: options.cwd,
-      version: options.version
+      version: options.version,
+      platform
     });
   }
   if (!options.url) {
@@ -1418,7 +1612,9 @@ async function connect(platform, options) {
     return createPiConnection({
       url: options.url,
       headers: options.headers,
-      version: options.version
+      version: options.version,
+      fetchImpl: platform.fetch,
+      platform
     });
   }
   try {
@@ -1437,7 +1633,9 @@ async function connect(platform, options) {
       return createPiConnection({
         url: options.url,
         headers: options.headers,
-        version: options.version
+        version: options.version,
+        fetchImpl: platform.fetch,
+        platform
       });
     }
     throw err;
@@ -1798,65 +1996,981 @@ async function loadConfig(input) {
       loadProjectServers(parsed, input.projectPath, servers, problems);
     }
   }
-  return {
-    servers: [...servers.values()],
-    problems,
-    ...autoEnableCodemode !== void 0 ? { autoEnableCodemode } : {}
-  };
-}
-
-// src/config/paths.ts
-function userConfigDir(platform) {
-  const piDir = platform.env.PI_CODING_AGENT_DIR;
-  if (piDir) return piDir;
-  const home = platform.env.HOME ?? platform.env.USERPROFILE ?? "/";
-  return `${home}/.pi/agent`;
-}
-function userConfigPath(platform) {
-  return `${userConfigDir(platform)}/mcp.json`;
-}
-function projectConfigPath(platform) {
-  return `${platform.cwd}/.pi/mcp.json`;
+  return {
+    servers: [...servers.values()],
+    problems,
+    ...autoEnableCodemode !== void 0 ? { autoEnableCodemode } : {}
+  };
+}
+
+// src/config/paths.ts
+function userConfigDir(platform) {
+  const piDir = platform.env.PI_CODING_AGENT_DIR;
+  if (piDir) return piDir;
+  const home = platform.env.HOME ?? platform.env.USERPROFILE ?? "/";
+  return `${home}/.pi/agent`;
+}
+function userConfigPath(platform) {
+  return `${userConfigDir(platform)}/mcp.json`;
+}
+function projectConfigPath(platform) {
+  return `${platform.cwd}/.pi/mcp.json`;
+}
+function stateDir(platform) {
+  if (platform.env.XDG_STATE_HOME) return `${platform.env.XDG_STATE_HOME}/mcpcat`;
+  const home = platform.env.HOME ?? platform.env.USERPROFILE ?? "/";
+  if (platform.env.LOCALAPPDATA) return `${platform.env.LOCALAPPDATA}\\mcpcat\\state`;
+  if (platform.env.SLICC_KERNEL) return `${home}/.local/state/mcpcat`;
+  return `${home}/Library/Application Support/mcpcat`;
+}
+
+// src/config/index.ts
+var MergedConfigSource = class _MergedConfigSource {
+  entries;
+  config;
+  constructor(config) {
+    this.config = config;
+    this.entries = /* @__PURE__ */ new Map();
+    for (const entry of config.servers) {
+      this.entries.set(entry.name, entry);
+    }
+  }
+  async get(name) {
+    const normalizedName = name.replace(/[-_]/g, "").toLowerCase();
+    for (const [key, entry] of this.entries) {
+      if (key.replace(/[-_]/g, "").toLowerCase() === normalizedName) {
+        return entry.config;
+      }
+    }
+    return void 0;
+  }
+  entry(name) {
+    return this.entries.get(name);
+  }
+  list() {
+    return [...this.entries.values()];
+  }
+  static async load(platform, options) {
+    const userPath = options?.configFile ?? userConfigPath(platform);
+    const projectPath = options?.configFile ? void 0 : projectConfigPath(platform);
+    const config = await loadConfig({
+      userPath,
+      projectPath,
+      trustProject: options?.trustProject ?? false,
+      fs: platform.fs
+    });
+    return new _MergedConfigSource(config);
+  }
+};
+
+// src/config/lock.ts
+var LOCK_STALE_MS = 1e4;
+var LOCK_POLL_MS = 50;
+var LOCK_MAX_WAIT_MS = 5e3;
+function isEexist(err) {
+  if (err instanceof Error && "code" in err)
+    return err.code === "EEXIST";
+  if (err instanceof Error) return err.message.includes("EEXIST");
+  return false;
+}
+async function removeStaleLock(fs, lockPath) {
+  try {
+    const s = await fs.stat(lockPath);
+    if (Date.now() - s.mtimeMs > LOCK_STALE_MS) {
+      try {
+        await fs.rmdir(lockPath);
+      } catch {
+      }
+      return true;
+    }
+  } catch {
+  }
+  return false;
+}
+async function acquireLock(fs, configPath) {
+  const lockPath = `${configPath}.lock`;
+  const start = Date.now();
+  while (true) {
+    try {
+      await fs.mkdirExclusive(lockPath);
+      break;
+    } catch (err) {
+      if (!isEexist(err)) throw err;
+      await removeStaleLock(fs, lockPath);
+    }
+    if (Date.now() - start > LOCK_MAX_WAIT_MS) {
+      throw new Error(`mcpcat: could not acquire lock ${lockPath} within ${LOCK_MAX_WAIT_MS}ms`);
+    }
+    await new Promise((r) => setTimeout(r, LOCK_POLL_MS));
+  }
+  let released = false;
+  return async () => {
+    if (released) return;
+    released = true;
+    try {
+      await fs.rmdir(lockPath);
+    } catch {
+    }
+  };
+}
+
+// src/config/edit.ts
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function detectIndent(text) {
+  const match = /^([ \t]+)\S/m.exec(text);
+  return match ? match[1] : "  ";
+}
+async function readText(fs, path) {
+  try {
+    const data = await fs.readFile(path);
+    return new TextDecoder().decode(data);
+  } catch {
+    return void 0;
+  }
+}
+async function editMcpServers(fs, path, edit) {
+  const release = await acquireLock(fs, path);
+  try {
+    const text = await readText(fs, path);
+    const parsed = text === void 0 ? {} : JSON.parse(text);
+    if (!isRecord2(parsed) || parsed.mcpServers !== void 0 && !isRecord2(parsed.mcpServers))
+      throw new Error(`${path}: expected an object with an "mcpServers" object`);
+    const servers = isRecord2(parsed.mcpServers) ? parsed.mcpServers : void 0;
+    if (!edit(servers, parsed)) return { changed: false };
+    const indent = text ? detectIndent(text) : "  ";
+    const output = `${JSON.stringify(parsed, null, indent)}
+`;
+    const dir = path.slice(0, path.lastIndexOf("/"));
+    if (dir) {
+      try {
+        await fs.mkdir(dir);
+      } catch {
+      }
+    }
+    const tmpPath = `${path}.tmp.${Date.now()}`;
+    await fs.writeFile(tmpPath, output);
+    await fs.rename(tmpPath, path);
+    return { changed: true };
+  } finally {
+    await release();
+  }
+}
+async function addServer(fs, path, name, config) {
+  let replaced = false;
+  await editMcpServers(fs, path, (servers, parsed) => {
+    const target = servers ?? {};
+    replaced = target[name] !== void 0;
+    target[name] = config;
+    parsed.mcpServers = target;
+    return true;
+  });
+  return { replaced };
+}
+async function removeServer(fs, path, name) {
+  let removed = false;
+  await editMcpServers(fs, path, (servers) => {
+    if (!servers || servers[name] === void 0) return false;
+    delete servers[name];
+    removed = true;
+    return true;
+  });
+  return removed;
+}
+async function updateServer(fs, path, name, patch) {
+  let updated = false;
+  await editMcpServers(fs, path, (servers) => {
+    if (!servers || !isRecord2(servers[name])) return false;
+    const entry = servers[name];
+    if (patch.enabled !== void 0) entry.enabled = patch.enabled;
+    if (patch.exposure !== void 0) entry.exposure = patch.exposure;
+    if (patch.toolExposure !== void 0) entry.toolExposure = patch.toolExposure;
+    updated = true;
+    return true;
+  });
+  return updated;
+}
+async function setExposure(fs, path, name, exposure, toolGlob) {
+  let updated = false;
+  await editMcpServers(fs, path, (servers) => {
+    if (!servers || !isRecord2(servers[name])) return false;
+    const entry = servers[name];
+    if (toolGlob) {
+      const te = isRecord2(entry.toolExposure) ? { ...entry.toolExposure } : {};
+      te[toolGlob] = exposure;
+      entry.toolExposure = te;
+    } else {
+      entry.exposure = exposure;
+    }
+    updated = true;
+    return true;
+  });
+  return updated;
+}
+
+// src/discovery/extract.ts
+var nextId = 1;
+function candidateId() {
+  return String(nextId++);
+}
+function resetIdCounter(start = 1) {
+  nextId = start;
+}
+function isRecord3(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function checkUrnPublisher(identifier, originHost) {
+  const urnMatch = /^urn:air:([^:]+):/.exec(identifier);
+  if (!urnMatch) return void 0;
+  const urnDomain = urnMatch[1];
+  if (domainMatch(urnDomain, originHost)) {
+    return { type: "urn-publisher", detail: `${urnDomain} matches ${originHost}` };
+  }
+  return { type: "urn-publisher-mismatch", detail: `${urnDomain} does not match ${originHost}` };
+}
+function checkTrustManifest(entry, originHost) {
+  if (!isRecord3(entry.trustManifest) || typeof entry.trustManifest.identity !== "string")
+    return void 0;
+  const identity = entry.trustManifest.identity;
+  if (domainMatch(identity, originHost)) {
+    return { type: "trust-manifest", detail: `identity ${identity} matches origin` };
+  }
+  return {
+    type: "trust-manifest-mismatch",
+    detail: `identity ${identity} does not match ${originHost}`
+  };
+}
+function extractArd(event) {
+  const candidates = [];
+  const summary = event.summary;
+  if (!isRecord3(summary)) return candidates;
+  const entries = summary.entries;
+  if (!Array.isArray(entries)) return candidates;
+  for (const entry of entries) {
+    if (!isRecord3(entry)) continue;
+    if (entry.type !== "application/mcp-server-card+json") continue;
+    const url = typeof entry.url === "string" ? entry.url : void 0;
+    if (!url) continue;
+    const trust = [];
+    const originHost = hostFromUrl(event.origin);
+    const identifier = typeof entry.identifier === "string" ? entry.identifier : void 0;
+    if (identifier) {
+      const urnSignal = checkUrnPublisher(identifier, originHost);
+      if (urnSignal) trust.push(urnSignal);
+    }
+    const tmSignal = checkTrustManifest(entry, originHost);
+    if (tmSignal) trust.push(tmSignal);
+    candidates.push({
+      id: candidateId(),
+      endpoint: url,
+      standard: "ard",
+      origin: event.origin,
+      name: typeof entry.displayName === "string" ? entry.displayName : void 0,
+      transport: "http",
+      trust,
+      status: event.status,
+      reason: event.reason,
+      discoveredAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  }
+  return candidates;
+}
+function extractAiCatalog(event) {
+  const candidates = [];
+  const summary = event.summary;
+  if (!isRecord3(summary)) return candidates;
+  const entries = summary.entries;
+  if (!Array.isArray(entries)) return candidates;
+  for (const entry of entries) {
+    if (!isRecord3(entry)) continue;
+    if (entry.type !== "application/mcp-server-card+json" && entry.type !== "mcp-server") continue;
+    const url = typeof entry.url === "string" ? entry.url : void 0;
+    if (!url) continue;
+    candidates.push({
+      id: candidateId(),
+      endpoint: url,
+      standard: "ai-catalog",
+      origin: event.origin,
+      name: typeof entry.displayName === "string" ? entry.displayName : void 0,
+      transport: "http",
+      trust: [],
+      status: event.status,
+      reason: event.reason,
+      discoveredAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  }
+  return candidates;
+}
+function extractUcp(event) {
+  const candidates = [];
+  const summary = event.summary;
+  if (!isRecord3(summary)) return candidates;
+  const services = summary.services;
+  if (!isRecord3(services)) return candidates;
+  for (const [svcName, svcValue] of Object.entries(services)) {
+    if (!Array.isArray(svcValue)) continue;
+    for (const transport of svcValue) {
+      if (!isRecord3(transport)) continue;
+      if (transport.transport !== "mcp") continue;
+      const endpoint = typeof transport.endpoint === "string" ? transport.endpoint : void 0;
+      if (!endpoint) continue;
+      candidates.push({
+        id: candidateId(),
+        endpoint,
+        standard: "ucp",
+        origin: event.origin,
+        name: svcName,
+        transport: "http",
+        trust: [],
+        status: event.status,
+        reason: event.reason,
+        discoveredAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+    }
+  }
+  return candidates;
+}
+function extractPoppy(event) {
+  const candidates = [];
+  const summary = event.summary;
+  if (!isRecord3(summary)) return candidates;
+  const apis = summary.apis;
+  if (!Array.isArray(apis)) return candidates;
+  for (const api of apis) {
+    if (!isRecord3(api)) continue;
+    if (api.type !== "mcp") continue;
+    const url = typeof api.url === "string" ? api.url : void 0;
+    if (!url) continue;
+    candidates.push({
+      id: candidateId(),
+      endpoint: url,
+      standard: "poppy",
+      origin: event.origin,
+      transport: "http",
+      trust: [],
+      status: event.status,
+      reason: event.reason,
+      discoveredAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  }
+  return candidates;
+}
+function extractNlweb(event) {
+  const summary = event.summary;
+  if (!isRecord3(summary)) return [];
+  const mcpUrl = typeof summary.mcpUrl === "string" ? summary.mcpUrl : void 0;
+  if (!mcpUrl) return [];
+  return [
+    {
+      id: candidateId(),
+      endpoint: mcpUrl,
+      standard: "nlweb",
+      origin: event.origin,
+      transport: "http",
+      trust: [],
+      status: event.status,
+      reason: event.reason,
+      discoveredAt: (/* @__PURE__ */ new Date()).toISOString()
+    }
+  ];
+}
+function extractWebmcp(event) {
+  return [
+    {
+      id: candidateId(),
+      endpoint: event.url,
+      standard: "webmcp",
+      origin: event.origin,
+      transport: "webmcp",
+      trust: [],
+      status: event.status,
+      reason: event.reason,
+      suggestion: "mcpcat serve --webmcp",
+      discoveredAt: (/* @__PURE__ */ new Date()).toISOString()
+    }
+  ];
+}
+function hostFromUrl(url) {
+  try {
+    return new URL(url).hostname;
+  } catch {
+    return "";
+  }
+}
+var TWO_LABEL_TLDS = /* @__PURE__ */ new Set([
+  "co.uk",
+  "org.uk",
+  "ac.uk",
+  "co.jp",
+  "or.jp",
+  "co.kr",
+  "co.nz",
+  "co.za",
+  "com.au",
+  "com.br",
+  "com.cn",
+  "com.mx",
+  "com.tw",
+  "net.au",
+  "org.au",
+  "co.in",
+  "com.sg",
+  "co.il"
+]);
+function registrableDomain(host) {
+  const h = host.toLowerCase().replace(/^www\./, "");
+  const parts = h.split(".");
+  if (parts.length <= 2) return h;
+  const lastTwo = parts.slice(-2).join(".");
+  if (TWO_LABEL_TLDS.has(lastTwo) && parts.length > 2) {
+    return parts.slice(-3).join(".");
+  }
+  return lastTwo;
+}
+function domainMatch(a, b) {
+  return registrableDomain(a) === registrableDomain(b);
+}
+function extractMcp(event) {
+  const summary = event.summary;
+  if (!isRecord3(summary)) return [];
+  const endpoint = typeof summary.endpoint === "string" ? summary.endpoint : void 0;
+  if (!endpoint) return [];
+  const trust = [];
+  if (Array.isArray(summary.trust)) {
+    for (const t of summary.trust) {
+      if (isRecord3(t) && typeof t.type === "string" && typeof t.detail === "string") {
+        trust.push({ type: t.type, detail: t.detail });
+      }
+    }
+  }
+  const si = isRecord3(summary.serverInfo) ? summary.serverInfo : void 0;
+  const name = si && typeof si.name === "string" ? si.name : void 0;
+  return [
+    {
+      id: candidateId(),
+      endpoint,
+      standard: "mcp",
+      origin: event.origin,
+      name,
+      transport: "http",
+      trust,
+      status: event.status,
+      reason: event.reason,
+      discoveredAt: (/* @__PURE__ */ new Date()).toISOString()
+    }
+  ];
+}
+var EXTRACTORS = {
+  ard: extractArd,
+  "ai-catalog": extractAiCatalog,
+  ucp: extractUcp,
+  poppy: extractPoppy,
+  nlweb: extractNlweb,
+  webmcp: extractWebmcp,
+  mcp: extractMcp
+};
+function extractCandidates(event) {
+  const extractor = EXTRACTORS[event.standard];
+  if (!extractor) return [];
+  return extractor(event);
+}
+function deduplicateCandidates(candidates) {
+  const seen = /* @__PURE__ */ new Set();
+  const result = [];
+  for (const c of candidates) {
+    const key = c.endpoint;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    result.push(c);
+  }
+  return result;
+}
+
+// src/discovery/inbox.ts
+function inboxPath(stateDir2) {
+  return `${stateDir2}/inbox.json`;
+}
+async function readInbox(fs, stateDir2) {
+  try {
+    const data = await fs.readFile(inboxPath(stateDir2));
+    const parsed = JSON.parse(new TextDecoder().decode(data));
+    if (parsed && Array.isArray(parsed.candidates)) return parsed;
+  } catch {
+  }
+  return { candidates: [] };
+}
+async function writeInbox(fs, stateDir2, inbox) {
+  try {
+    await fs.mkdir(stateDir2);
+  } catch {
+  }
+  const json = JSON.stringify(inbox, null, 2) + "\n";
+  await fs.writeFile(inboxPath(stateDir2), json);
+}
+async function appendCandidates(fs, stateDir2, candidates) {
+  const inbox = await readInbox(fs, stateDir2);
+  const existing = new Set(inbox.candidates.map((c) => c.endpoint));
+  for (const c of candidates) {
+    if (existing.has(c.endpoint)) continue;
+    existing.add(c.endpoint);
+    inbox.candidates.push(c);
+  }
+  await writeInbox(fs, stateDir2, inbox);
+}
+async function listCandidates(fs, stateDir2) {
+  const inbox = await readInbox(fs, stateDir2);
+  return inbox.candidates.slice().reverse();
+}
+async function getCandidate(fs, stateDir2, id) {
+  const inbox = await readInbox(fs, stateDir2);
+  return inbox.candidates.find((c) => c.id === id);
+}
+
+// src/discovery/probe.ts
+function isJsonContentType(ct) {
+  if (!ct) return false;
+  const lower = ct.toLowerCase();
+  if (lower.includes("text/html")) return false;
+  return lower.includes("json") || lower.includes("+json");
+}
+function parseLinkHeaders(headers) {
+  const links = [];
+  const raw = headers.get("link");
+  if (!raw) return links;
+  const parts = raw.split(/,(?=\s*<)/);
+  for (const part of parts) {
+    const urlMatch = /<([^>]+)>/.exec(part);
+    const relMatch = /rel\s*=\s*"?([^";,\s]+)"?/i.exec(part);
+    if (urlMatch && relMatch) {
+      links.push({ url: urlMatch[1], rel: relMatch[1].toLowerCase() });
+    }
+  }
+  return links;
+}
+function wasRedirected(requestUrl, resp) {
+  if (resp.redirected) return true;
+  if (resp.url && resp.url !== requestUrl) return true;
+  return false;
+}
+async function probeUrl(fetcher, url, accept) {
+  let resp;
+  try {
+    resp = await fetcher(url, {
+      redirect: "manual",
+      headers: accept ? { Accept: accept } : void 0,
+      credentials: "omit"
+    });
+  } catch {
+    try {
+      resp = await fetcher(url, {
+        redirect: "follow",
+        headers: accept ? { Accept: accept } : void 0,
+        credentials: "omit"
+      });
+      if (wasRedirected(url, resp)) {
+        return { ok: false, status: 301, headers: resp.headers, body: "" };
+      }
+    } catch {
+      return void 0;
+    }
+  }
+  if (resp.status !== 200)
+    return { ok: false, status: resp.status, headers: resp.headers, body: "" };
+  const ct = resp.headers.get("content-type");
+  if (!isJsonContentType(ct))
+    return { ok: false, status: resp.status, headers: resp.headers, body: "" };
+  const body = await resp.text();
+  return { ok: true, status: 200, headers: resp.headers, body };
+}
+function isRecord4(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function makeEvent(standard, origin, url, via, page, status, summary, reason) {
+  return {
+    v: 1,
+    standard,
+    origin,
+    url,
+    via,
+    page,
+    targetId: "",
+    status,
+    summary,
+    ...reason ? { reason } : {}
+  };
+}
+function tryParseJson(body) {
+  try {
+    return JSON.parse(body);
+  } catch {
+    return void 0;
+  }
+}
+function classifyArd(origin, url, via, page, body) {
+  const parsed = tryParseJson(body);
+  if (!isRecord4(parsed))
+    return makeEvent("ard", origin, url, via, page, "invalid", null, "invalid JSON");
+  if (!Array.isArray(parsed.entries))
+    return makeEvent("ard", origin, url, via, page, "invalid", null, "missing entries[]");
+  const entries = [];
+  for (const entry of parsed.entries) {
+    if (!isRecord4(entry)) continue;
+    entries.push({
+      identifier: entry.identifier,
+      displayName: entry.displayName,
+      type: entry.type,
+      url: entry.url,
+      capabilities: entry.capabilities,
+      representativeQueries: entry.representativeQueries,
+      trustManifest: entry.trustManifest
+    });
+  }
+  return makeEvent("ard", origin, url, via, page, "valid", { entries });
+}
+function classifyAiCatalog(origin, url, via, page, body) {
+  const parsed = tryParseJson(body);
+  if (!isRecord4(parsed))
+    return makeEvent("ai-catalog", origin, url, via, page, "invalid", null, "invalid JSON");
+  const entries = [];
+  const items = Array.isArray(parsed.entries) ? parsed.entries : Array.isArray(parsed.items) ? parsed.items : void 0;
+  if (!items)
+    return makeEvent("ai-catalog", origin, url, via, page, "invalid", null, "no entries or items");
+  for (const entry of items) {
+    if (!isRecord4(entry)) continue;
+    entries.push({
+      displayName: entry.displayName ?? entry.name,
+      type: entry.type,
+      url: entry.url
+    });
+  }
+  return makeEvent("ai-catalog", origin, url, via, page, "valid", { entries });
+}
+async function probeWellKnown(fetcher, origin, page) {
+  const events = [];
+  const ardUrl = `${origin}/.well-known/ard.json`;
+  const ardResult = await probeUrl(fetcher, ardUrl, "application/json");
+  if (ardResult?.ok) {
+    const ev = classifyArd(origin, ardUrl, "well-known", page, ardResult.body);
+    if (ev) events.push(ev);
+  }
+  const aiCatUrl = `${origin}/.well-known/ai-catalog.json`;
+  const aiCatResult = await probeUrl(fetcher, aiCatUrl, "application/json");
+  if (aiCatResult?.ok) {
+    const ev = classifyAiCatalog(origin, aiCatUrl, "well-known", page, aiCatResult.body);
+    if (ev) events.push(ev);
+  }
+  return events;
+}
+async function probeLinkHeaders(fetcher, targetUrl, origin, page) {
+  const events = [];
+  const targetResult = await probeUrl(fetcher, targetUrl);
+  if (!targetResult) return events;
+  const links = parseLinkHeaders(targetResult.headers);
+  for (const link of links) {
+    const resolved = new URL(link.url, targetUrl).href;
+    const classifier = link.rel === "ard" ? classifyArd : link.rel === "ai-catalog" ? classifyAiCatalog : null;
+    if (!classifier) continue;
+    const linkResult = await probeUrl(fetcher, resolved, "application/json");
+    if (linkResult?.ok) {
+      const ev = classifier(origin, resolved, "link-header", page, linkResult.body);
+      if (ev) events.push(ev);
+    }
+  }
+  return events;
+}
+function mcpJsonRpc(method, params, id = 1) {
+  return JSON.stringify({ jsonrpc: "2.0", id, method, params });
+}
+function parseServerInfo(result) {
+  const si = isRecord4(result.serverInfo) ? result.serverInfo : void 0;
+  if (!si) return void 0;
+  return {
+    name: typeof si.name === "string" ? si.name : void 0,
+    version: typeof si.version === "string" ? si.version : void 0
+  };
+}
+function checkAuthResponse(resp) {
+  if (resp.status !== 401) return void 0;
+  const wwwAuth = resp.headers.get("www-authenticate");
+  if (!wwwAuth) return void 0;
+  return { type: "auth-required", detail: wwwAuth.split(",")[0].trim() };
+}
+async function tryMcpPost(fetcher, url, body, extraHeaders) {
+  const headers = {
+    "Content-Type": "application/json",
+    Accept: "application/json",
+    ...extraHeaders
+  };
+  try {
+    const resp = await fetcher(url, {
+      method: "POST",
+      headers,
+      body,
+      redirect: "manual",
+      credentials: "omit"
+    });
+    const authSignal = checkAuthResponse(resp);
+    if (authSignal) return { url, trust: [authSignal] };
+    if (resp.status === 200) {
+      const text = await resp.text();
+      const parsed = tryParseJson(text);
+      if (isRecord4(parsed) && isRecord4(parsed.result)) {
+        return { url, serverInfo: parseServerInfo(parsed.result), trust: [] };
+      }
+    }
+  } catch {
+  }
+  return void 0;
+}
+async function probeMcpEndpoint(fetcher, url) {
+  const discoverBody = mcpJsonRpc("server/discover", {
+    protocolVersion: "2026-07-28",
+    clientInfo: { name: "mcpcat", version: "0.0.0" }
+  });
+  const hit = await tryMcpPost(fetcher, url, discoverBody, {
+    "Mcp-Method": "server/discover"
+  });
+  if (hit) return hit;
+  const initBody = mcpJsonRpc("initialize", {
+    protocolVersion: "2025-11-25",
+    clientInfo: { name: "mcpcat", version: "0.0.0" },
+    capabilities: {}
+  });
+  return tryMcpPost(fetcher, url, initBody);
+}
+async function probeMcp(fetcher, origin, page, targetUrl) {
+  const events = [];
+  const urls = [targetUrl];
+  const mcpUrl = `${origin}/mcp`;
+  if (mcpUrl !== targetUrl) urls.push(mcpUrl);
+  for (const url of urls) {
+    const hit = await probeMcpEndpoint(fetcher, url);
+    if (hit) {
+      const summary = { endpoint: hit.url };
+      if (hit.serverInfo) summary.serverInfo = hit.serverInfo;
+      if (hit.trust.length > 0) summary.trust = hit.trust;
+      events.push(makeEvent("mcp", origin, hit.url, "well-known", page, "valid", summary));
+    }
+  }
+  return events;
+}
+async function probeDiscover(platform, targetUrl) {
+  let origin;
+  try {
+    const u = new URL(targetUrl);
+    origin = u.origin;
+  } catch {
+    return { events: [] };
+  }
+  const page = targetUrl;
+  const fetcher = platform.fetch;
+  const events = [
+    ...await probeWellKnown(fetcher, origin, page),
+    ...await probeLinkHeaders(fetcher, targetUrl, origin, page),
+    ...await probeMcp(fetcher, origin, page, targetUrl)
+  ];
+  return { events };
+}
+
+// src/discovery/verbs.ts
+async function readStdin(platform) {
+  const reader = platform.stdin.getReader();
+  const chunks = [];
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    chunks.push(value);
+  }
+  reader.releaseLock();
+  const total = chunks.reduce((s, c) => s + c.length, 0);
+  const merged = new Uint8Array(total);
+  let offset = 0;
+  for (const c of chunks) {
+    merged.set(c, offset);
+    offset += c.length;
+  }
+  return new TextDecoder().decode(merged);
+}
+function parseEvents(text) {
+  const lines = text.trim().split("\n").filter((l) => l.trim().length > 0);
+  const events = [];
+  for (const line of lines) {
+    let parsed;
+    try {
+      parsed = JSON.parse(line);
+    } catch {
+      return { error: `invalid JSON: ${line.slice(0, 80)}`, code: 2 };
+    }
+    const ev = parsed;
+    if (typeof ev.v !== "number") return { error: "missing event version", code: 2 };
+    if (ev.v !== 1) return { error: `unknown event version: ${ev.v}`, code: 2 };
+    events.push(ev);
+  }
+  return events;
+}
+function formatCandidate(c) {
+  const parts = [`#${c.id}  ${c.standard}  ${c.endpoint}`];
+  if (c.name) parts[0] += `  (${c.name})`;
+  if (c.status === "invalid") parts.push(`  status: invalid \u2013 ${c.reason ?? "unknown"}`);
+  if (c.suggestion) parts.push(`  suggestion: ${c.suggestion}`);
+  for (const t of c.trust) {
+    const icon = t.type.includes("mismatch") ? "\u26A0" : "\u2713";
+    parts.push(`  ${icon} ${t.type}: ${t.detail}`);
+  }
+  return parts.join("\n");
+}
+function formatCandidateJson(c) {
+  return {
+    id: c.id,
+    endpoint: c.endpoint,
+    standard: c.standard,
+    origin: c.origin,
+    name: c.name,
+    transport: c.transport,
+    trust: c.trust,
+    status: c.status,
+    reason: c.reason,
+    suggestion: c.suggestion,
+    discoveredAt: c.discoveredAt
+  };
+}
+async function runFromDiscovery(platform, args) {
+  let source = "-";
+  for (const arg of args) {
+    if (arg !== "--from-discovery" && !arg.startsWith("-")) {
+      source = arg;
+    }
+  }
+  let text;
+  if (source === "-") {
+    text = await readStdin(platform);
+  } else {
+    try {
+      const data = await platform.fs.readFile(source);
+      text = new TextDecoder().decode(data);
+    } catch {
+      await platform.write(2, `mcpcat add --from-discovery: cannot read '${source}'
+`);
+      return 2;
+    }
+  }
+  const result = parseEvents(text);
+  if ("error" in result) {
+    await platform.write(2, `mcpcat add --from-discovery: ${result.error}
+`);
+    return result.code;
+  }
+  resetIdCounter();
+  let allCandidates = [];
+  for (const event of result) {
+    allCandidates.push(...extractCandidates(event));
+  }
+  allCandidates = deduplicateCandidates(allCandidates);
+  if (allCandidates.length === 0) {
+    await platform.write(1, "no MCP candidates found\n");
+    return 0;
+  }
+  const sd = stateDir(platform);
+  await appendCandidates(platform.fs, sd, allCandidates);
+  for (const c of allCandidates) {
+    await platform.write(1, `${formatCandidate(c)}
+`);
+  }
+  return 0;
+}
+async function runInbox(platform, args) {
+  const json = args.includes("--json");
+  const sd = stateDir(platform);
+  const candidates = await listCandidates(platform.fs, sd);
+  if (candidates.length === 0) {
+    await platform.write(1, "inbox is empty\n");
+    return 0;
+  }
+  if (json) {
+    await platform.write(1, JSON.stringify(candidates.map(formatCandidateJson), null, 2) + "\n");
+  } else {
+    for (const c of candidates) {
+      await platform.write(1, `${formatCandidate(c)}
+`);
+    }
+  }
+  return 0;
 }
-
-// src/config/index.ts
-var MergedConfigSource = class _MergedConfigSource {
-  entries;
-  config;
-  constructor(config) {
-    this.config = config;
-    this.entries = /* @__PURE__ */ new Map();
-    for (const entry of config.servers) {
-      this.entries.set(entry.name, entry);
+async function runAddCandidate(platform, name, candidateId2, configFile) {
+  const sd = stateDir(platform);
+  const candidate = await getCandidate(platform.fs, sd, candidateId2);
+  if (!candidate) {
+    await platform.write(2, `mcpcat add: candidate #${candidateId2} not found in inbox
+`);
+    return 1;
+  }
+  if (candidate.transport === "webmcp") {
+    await platform.write(
+      2,
+      `mcpcat add: WebMCP candidates cannot be added directly; use: ${candidate.suggestion}
+`
+    );
+    return 2;
+  }
+  const path = configFile ?? userConfigPath(platform);
+  const config = { url: candidate.endpoint };
+  const { replaced } = await addServer(platform.fs, path, name, config);
+  for (const t of candidate.trust) {
+    if (t.type.includes("mismatch")) {
+      await platform.write(2, `mcpcat add: warning: ${t.type}: ${t.detail}
+`);
     }
   }
-  async get(name) {
-    const normalizedName = name.replace(/[-_]/g, "").toLowerCase();
-    for (const [key, entry] of this.entries) {
-      if (key.replace(/[-_]/g, "").toLowerCase() === normalizedName) {
-        return entry.config;
-      }
+  await platform.write(1, `${replaced ? "replaced" : "added"} ${name} in ${path}
+`);
+  return 0;
+}
+async function runDiscover(platform, args) {
+  const positional = [];
+  let json = false;
+  for (const arg of args) {
+    if (arg === "--json") {
+      json = true;
+    } else if (!arg.startsWith("-")) {
+      positional.push(arg);
     }
-    return void 0;
   }
-  entry(name) {
-    return this.entries.get(name);
+  if (positional.length < 1) {
+    await platform.write(2, "mcpcat discover: requires a URL\n");
+    return 2;
   }
-  list() {
-    return [...this.entries.values()];
+  const url = positional[0];
+  if (!URL.canParse(url)) {
+    await platform.write(2, `mcpcat discover: '${url}' is not a valid URL
+`);
+    return 2;
   }
-  static async load(platform, options) {
-    const userPath = options?.configFile ?? userConfigPath(platform);
-    const projectPath = options?.configFile ? void 0 : projectConfigPath(platform);
-    const config = await loadConfig({
-      userPath,
-      projectPath,
-      trustProject: options?.trustProject ?? false,
-      fs: platform.fs
-    });
-    return new _MergedConfigSource(config);
+  const { events } = await probeDiscover(platform, url);
+  resetIdCounter();
+  let allCandidates = [];
+  for (const event of events) {
+    allCandidates.push(...extractCandidates(event));
   }
-};
+  allCandidates = deduplicateCandidates(allCandidates);
+  if (allCandidates.length > 0) {
+    const sd = stateDir(platform);
+    await appendCandidates(platform.fs, sd, allCandidates);
+  }
+  if (allCandidates.length === 0) {
+    await platform.write(1, "no MCP candidates found\n");
+    return 0;
+  }
+  if (json) {
+    await platform.write(1, JSON.stringify(allCandidates.map(formatCandidateJson), null, 2) + "\n");
+  } else {
+    for (const c of allCandidates) {
+      await platform.write(1, `${formatCandidate(c)}
+`);
+    }
+  }
+  return 0;
+}
 
 // src/config/expand.ts
 var PLACEHOLDER = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
@@ -3251,158 +4365,12 @@ async function handleMcpRequest(request, tools, call, serverName, version, allow
   };
 }
 
-// src/config/lock.ts
-var LOCK_STALE_MS = 1e4;
-var LOCK_POLL_MS = 50;
-var LOCK_MAX_WAIT_MS = 5e3;
-function isEexist(err) {
-  if (err instanceof Error && "code" in err)
-    return err.code === "EEXIST";
-  if (err instanceof Error) return err.message.includes("EEXIST");
-  return false;
-}
-async function removeStaleLock(fs, lockPath) {
-  try {
-    const s = await fs.stat(lockPath);
-    if (Date.now() - s.mtimeMs > LOCK_STALE_MS) {
-      try {
-        await fs.rmdir(lockPath);
-      } catch {
-      }
-      return true;
-    }
-  } catch {
-  }
-  return false;
-}
-async function acquireLock(fs, configPath) {
-  const lockPath = `${configPath}.lock`;
-  const start = Date.now();
-  while (true) {
-    try {
-      await fs.mkdirExclusive(lockPath);
-      break;
-    } catch (err) {
-      if (!isEexist(err)) throw err;
-      await removeStaleLock(fs, lockPath);
-    }
-    if (Date.now() - start > LOCK_MAX_WAIT_MS) {
-      throw new Error(`mcpcat: could not acquire lock ${lockPath} within ${LOCK_MAX_WAIT_MS}ms`);
-    }
-    await new Promise((r) => setTimeout(r, LOCK_POLL_MS));
-  }
-  let released = false;
-  return async () => {
-    if (released) return;
-    released = true;
-    try {
-      await fs.rmdir(lockPath);
-    } catch {
-    }
-  };
-}
-
-// src/config/edit.ts
-function isRecord2(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function detectIndent(text) {
-  const match = /^([ \t]+)\S/m.exec(text);
-  return match ? match[1] : "  ";
-}
-async function readText(fs, path) {
-  try {
-    const data = await fs.readFile(path);
-    return new TextDecoder().decode(data);
-  } catch {
-    return void 0;
-  }
-}
-async function editMcpServers(fs, path, edit) {
-  const release = await acquireLock(fs, path);
-  try {
-    const text = await readText(fs, path);
-    const parsed = text === void 0 ? {} : JSON.parse(text);
-    if (!isRecord2(parsed) || parsed.mcpServers !== void 0 && !isRecord2(parsed.mcpServers))
-      throw new Error(`${path}: expected an object with an "mcpServers" object`);
-    const servers = isRecord2(parsed.mcpServers) ? parsed.mcpServers : void 0;
-    if (!edit(servers, parsed)) return { changed: false };
-    const indent = text ? detectIndent(text) : "  ";
-    const output = `${JSON.stringify(parsed, null, indent)}
-`;
-    const dir = path.slice(0, path.lastIndexOf("/"));
-    if (dir) {
-      try {
-        await fs.mkdir(dir);
-      } catch {
-      }
-    }
-    const tmpPath = `${path}.tmp.${Date.now()}`;
-    await fs.writeFile(tmpPath, output);
-    await fs.rename(tmpPath, path);
-    return { changed: true };
-  } finally {
-    await release();
-  }
-}
-async function addServer(fs, path, name, config) {
-  let replaced = false;
-  await editMcpServers(fs, path, (servers, parsed) => {
-    const target = servers ?? {};
-    replaced = target[name] !== void 0;
-    target[name] = config;
-    parsed.mcpServers = target;
-    return true;
-  });
-  return { replaced };
-}
-async function removeServer(fs, path, name) {
-  let removed = false;
-  await editMcpServers(fs, path, (servers) => {
-    if (!servers || servers[name] === void 0) return false;
-    delete servers[name];
-    removed = true;
-    return true;
-  });
-  return removed;
-}
-async function updateServer(fs, path, name, patch) {
-  let updated = false;
-  await editMcpServers(fs, path, (servers) => {
-    if (!servers || !isRecord2(servers[name])) return false;
-    const entry = servers[name];
-    if (patch.enabled !== void 0) entry.enabled = patch.enabled;
-    if (patch.exposure !== void 0) entry.exposure = patch.exposure;
-    if (patch.toolExposure !== void 0) entry.toolExposure = patch.toolExposure;
-    updated = true;
-    return true;
-  });
-  return updated;
-}
-async function setExposure(fs, path, name, exposure, toolGlob) {
-  let updated = false;
-  await editMcpServers(fs, path, (servers) => {
-    if (!servers || !isRecord2(servers[name])) return false;
-    const entry = servers[name];
-    if (toolGlob) {
-      const te = isRecord2(entry.toolExposure) ? { ...entry.toolExposure } : {};
-      te[toolGlob] = exposure;
-      entry.toolExposure = te;
-    } else {
-      entry.exposure = exposure;
-    }
-    updated = true;
-    return true;
-  });
-  return updated;
-}
-
 // src/config/import.ts
-function isRecord3(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isStringRecord2(value) {
-  return isRecord3(value) && Object.values(value).every((v) => typeof v === "string");
+  return isRecord5(value) && Object.values(value).every((v) => typeof v === "string");
 }
 function tryParse(text) {
   try {
@@ -3432,17 +4400,17 @@ function importClaude(text, names) {
     result.errors.push(error);
     return result;
   }
-  if (!isRecord3(parsed)) {
+  if (!isRecord5(parsed)) {
     result.errors.push("expected an object");
     return result;
   }
   const mcpServers = parsed.mcpServers;
-  if (!isRecord3(mcpServers)) {
+  if (!isRecord5(mcpServers)) {
     result.errors.push('no "mcpServers" object');
     return result;
   }
   for (const [name, entry] of filterNames(Object.entries(mcpServers), names)) {
-    if (!isRecord3(entry)) {
+    if (!isRecord5(entry)) {
       result.errors.push(`${name}: not an object`);
       continue;
     }
@@ -3457,17 +4425,17 @@ function importVSCode(text, names) {
     result.errors.push(error);
     return result;
   }
-  if (!isRecord3(parsed)) {
+  if (!isRecord5(parsed)) {
     result.errors.push("expected an object");
     return result;
   }
   const servers = parsed.servers ?? parsed.mcpServers;
-  if (!isRecord3(servers)) {
+  if (!isRecord5(servers)) {
     result.errors.push('no "servers" or "mcpServers" object');
     return result;
   }
   for (const [name, entry] of filterNames(Object.entries(servers), names)) {
-    if (!isRecord3(entry)) {
+    if (!isRecord5(entry)) {
       result.errors.push(`${name}: not an object`);
       continue;
     }
@@ -3501,17 +4469,17 @@ function importSixServers(text, names) {
     result.errors.push(error);
     return result;
   }
-  if (!isRecord3(parsed)) {
+  if (!isRecord5(parsed)) {
     result.errors.push("expected an object");
     return result;
   }
   const servers = parsed.servers;
-  if (!isRecord3(servers)) {
+  if (!isRecord5(servers)) {
     result.errors.push('no "servers" object');
     return result;
   }
   for (const [name, entry] of filterNames(Object.entries(servers), names)) {
-    if (!isRecord3(entry)) {
+    if (!isRecord5(entry)) {
       result.errors.push(`${name}: not an object`);
       continue;
     }
@@ -3519,7 +4487,7 @@ function importSixServers(text, names) {
     if (typeof entry.url === "string") config.url = entry.url;
     if (isStringRecord2(entry.headers)) config.headers = entry.headers;
     if (typeof entry.exposure === "string") config.exposure = entry.exposure;
-    if (isRecord3(entry.toolExposure)) config.toolExposure = entry.toolExposure;
+    if (isRecord5(entry.toolExposure)) config.toolExposure = entry.toolExposure;
     result.servers.push({ name, config });
   }
   return result;
@@ -3536,7 +4504,7 @@ function importCodexToml(text, names) {
     if (fields.command) config.command = fields.command;
     if (fields.args) config.args = fields.args;
     if (fields.url) config.url = fields.url;
-    if (fields.env && isRecord3(fields.env)) config.env = fields.env;
+    if (fields.env && isRecord5(fields.env)) config.env = fields.env;
     result.servers.push({ name, config });
   }
   return result;
@@ -3588,7 +4556,7 @@ function convertOpenCodeLocal(entry) {
   } else if (typeof entry.command === "string") {
     config.command = entry.command;
   }
-  if (isRecord3(entry.environment)) {
+  if (isRecord5(entry.environment)) {
     const env = {};
     for (const [k, v] of Object.entries(entry.environment)) {
       if (typeof v === "string")
@@ -3611,17 +4579,17 @@ function importOpenCode(text, names) {
     result.errors.push(error);
     return result;
   }
-  if (!isRecord3(parsed)) {
+  if (!isRecord5(parsed)) {
     result.errors.push("expected an object");
     return result;
   }
   const mcpServers = parsed.mcpServers ?? parsed.mcp;
-  if (!isRecord3(mcpServers)) {
+  if (!isRecord5(mcpServers)) {
     result.errors.push("no mcp servers found");
     return result;
   }
   for (const [name, entry] of filterNames(Object.entries(mcpServers), names)) {
-    if (!isRecord3(entry)) {
+    if (!isRecord5(entry)) {
       result.errors.push(`${name}: not an object`);
       continue;
     }
@@ -3637,9 +4605,9 @@ function detectFormat(text, filename) {
   if (filename.includes(".vscode")) return "vscode";
   try {
     const parsed = JSON.parse(text);
-    if (isRecord3(parsed)) {
-      if (parsed.servers && isRecord3(parsed.servers) && parsed.version !== void 0) return "six";
-      if (parsed.servers && isRecord3(parsed.servers)) return "vscode";
+    if (isRecord5(parsed)) {
+      if (parsed.servers && isRecord5(parsed.servers) && parsed.version !== void 0) return "six";
+      if (parsed.servers && isRecord5(parsed.servers)) return "vscode";
       if (parsed.mcpServers) return "claude";
       if (parsed.mcp) return "opencode";
     }
@@ -4208,9 +5176,7 @@ var UNIMPLEMENTED_VERBS = /* @__PURE__ */ new Set([
   "task",
   "login",
   "logout",
-  "code",
-  "discover",
-  "inbox"
+  "code"
 ]);
 var CLIENT_VERBS = /* @__PURE__ */ new Set(["info", "tools", "call", "describe", "serve"]);
 function helpText(version) {
@@ -4238,8 +5204,8 @@ Configuration verbs:
 Server and code verbs:
   serve [--stdio|--http] \u2026   Expose commands as MCP server
   code [-e src|file.js]      Run a codemode script (not implemented yet)
-  discover <url>             Find MCP servers (not implemented yet)
-  inbox                      Discovery inbox (not implemented yet)
+  discover <url>             Find MCP servers at a URL
+  inbox [--json]             List discovery candidates
   help [verb]                Show help
 
 Options:
@@ -4370,6 +5336,21 @@ function renderCallResult(result) {
   }
   return parts.join("\n");
 }
+var NETWORK_HINT = "connection failed (use slicc-node, slicc-swift, or the browser extension for servers without CORS)";
+function transportHint(err) {
+  if (err instanceof TypeError) {
+    const cause = err.cause;
+    if (cause?.code === "ECONNREFUSED" || cause?.code === "ENETUNREACH") {
+      return `connection failed: ${err.message}`;
+    }
+  }
+  if (err instanceof Error && "status" in err && err.status === 502) {
+    const msg = err.message;
+    if (msg) return `${NETWORK_HINT}: ${msg}`;
+    return NETWORK_HINT;
+  }
+  return void 0;
+}
 async function readDataArg(platform, dataArg) {
   let raw;
   if (dataArg.startsWith("@-")) {
@@ -4539,6 +5520,37 @@ async function dispatchConfigVerb(platform, verb, args) {
       return 1;
   }
 }
+async function dispatchDiscoveryVerb(platform, parsed, args) {
+  if (parsed.verb === "add" && args.includes("--from-discovery")) {
+    return runFromDiscovery(platform, args.slice(1));
+  }
+  if (parsed.verb === "add" && args.includes("--candidate")) {
+    const rest = args.slice(1);
+    const nameIdx = rest.findIndex((a) => !a.startsWith("-") && a !== "--candidate");
+    const candidateIdx = rest.indexOf("--candidate");
+    if (nameIdx < 0 || candidateIdx < 0 || candidateIdx + 1 >= rest.length) {
+      await platform.write(2, "mcpcat add --candidate: requires <name> --candidate <id>\n");
+      return 2;
+    }
+    const name = rest[nameIdx];
+    const candidateId2 = rest[candidateIdx + 1];
+    const configIdx = rest.indexOf("--config");
+    const configFile = configIdx >= 0 && configIdx + 1 < rest.length ? rest[configIdx + 1] : void 0;
+    return runAddCandidate(platform, name, candidateId2, configFile);
+  }
+  if (parsed.verb === "discover") return runDiscover(platform, args.slice(1));
+  if (parsed.verb === "inbox") return runInbox(platform, args.slice(1));
+  return void 0;
+}
+async function dispatchServeVerb(platform, args, version) {
+  const serveArgs = args.slice(args.indexOf("serve") + 1);
+  const serveOptions = parseServeFlags(serveArgs);
+  if (serveOptions.commands.length === 0 && serveOptions.toolTemplates.length === 0) {
+    await platform.write(2, "mcpcat serve: no commands or --tool templates given\n");
+    return 2;
+  }
+  return runServe(platform, serveOptions, version);
+}
 async function run(platform, version, args) {
   if (args.includes("--version") || args.includes("-V")) {
     await platform.write(1, `${version}
@@ -4559,21 +5571,19 @@ async function run(platform, version, args) {
     return 2;
   }
   if (parsed.verb in CONFIG_VERBS) {
+    const disc = await dispatchDiscoveryVerb(platform, parsed, args);
+    if (disc !== void 0) return disc;
     return dispatchConfigVerb(platform, parsed.verb, args);
   }
+  const discResult = await dispatchDiscoveryVerb(platform, parsed, args);
+  if (discResult !== void 0) return discResult;
   if (UNIMPLEMENTED_VERBS.has(parsed.verb)) {
     await platform.write(2, `mcpcat: '${parsed.verb}' is not implemented yet
 `);
     return 1;
   }
   if (parsed.verb === "serve") {
-    const serveArgs = args.slice(args.indexOf("serve") + 1);
-    const serveOptions = parseServeFlags(serveArgs);
-    if (serveOptions.commands.length === 0 && serveOptions.toolTemplates.length === 0) {
-      await platform.write(2, "mcpcat serve: no commands or --tool templates given\n");
-      return 2;
-    }
-    return runServe(platform, serveOptions, version);
+    return dispatchServeVerb(platform, args, version);
   }
   if (!CLIENT_VERBS.has(parsed.verb)) {
     await platform.write(2, `mcpcat: unknown command '${parsed.verb}'
@@ -4611,7 +5621,8 @@ async function run(platform, version, args) {
       version
     });
   } catch (err) {
-    await platform.write(2, `mcpcat: connection failed: ${err.message}
+    const msg = transportHint(err) ?? `connection failed: ${err.message}`;
+    await platform.write(2, `mcpcat: ${msg}
 `);
     return 3;
   }
@@ -4664,12 +5675,22 @@ async function kernelSpawn(ctx, options) {
     stdout: "pipe",
     stderr: "pipe"
   });
+  const childPid = result.pid;
   return {
     stdin: result.stdin,
     stdout: result.stdout,
     stderr: result.stderr,
     wait: () => result.wait(),
-    kill: (signal) => result.kill(signal)
+    kill: (signal) => {
+      try {
+        ctx.kill(-childPid, signal);
+      } catch {
+      }
+      try {
+        ctx.kill(childPid, signal);
+      } catch {
+      }
+    }
   };
 }
 async function kernelListen(ctx, options) {
@@ -4735,7 +5756,7 @@ function createKernelPlatform(ctx) {
 async function main(ctx) {
   const platform = createKernelPlatform(ctx);
   const args = ctx.argv.slice(1);
-  return run(platform, "0.4.0", args);
+  return run(platform, "0.6.0", args);
 }
 export {
   main as default