@ai-ecoverse/mcpcat 0.5.0 → 0.6.0

package/dist/host/mcpcat.mjs

@@ -2008,10 +2008,10 @@ async function createStatelessConnection(options) {
     timeoutMs = 6e4,
     clientInfo = { name: "mcpcat", version: "0.0.0" }
   } = options;
-  let nextId = 1;
+  let nextId2 = 1;
   let negotiatedVersion;
   async function request(method, params) {
-    const id = nextId++;
+    const id = nextId2++;
     const headers = {
       "Content-Type": "application/json",
       Accept: "application/json, text/event-stream",
@@ -2549,6 +2549,13 @@ function userConfigPath(platform2) {
 function projectConfigPath(platform2) {
   return `${platform2.cwd}/.pi/mcp.json`;
 }
+function stateDir(platform2) {
+  if (platform2.env.XDG_STATE_HOME) return `${platform2.env.XDG_STATE_HOME}/mcpcat`;
+  const home = platform2.env.HOME ?? platform2.env.USERPROFILE ?? "/";
+  if (platform2.env.LOCALAPPDATA) return `${platform2.env.LOCALAPPDATA}\\mcpcat\\state`;
+  if (platform2.env.SLICC_KERNEL) return `${home}/.local/state/mcpcat`;
+  return `${home}/Library/Application Support/mcpcat`;
+}
 
 // src/config/index.ts
 var MergedConfigSource = class _MergedConfigSource {
@@ -2589,6 +2596,915 @@ var MergedConfigSource = class _MergedConfigSource {
   }
 };
 
+// src/config/lock.ts
+var LOCK_STALE_MS = 1e4;
+var LOCK_POLL_MS = 50;
+var LOCK_MAX_WAIT_MS = 5e3;
+function isEexist(err) {
+  if (err instanceof Error && "code" in err)
+    return err.code === "EEXIST";
+  if (err instanceof Error) return err.message.includes("EEXIST");
+  return false;
+}
+async function removeStaleLock(fs, lockPath) {
+  try {
+    const s = await fs.stat(lockPath);
+    if (Date.now() - s.mtimeMs > LOCK_STALE_MS) {
+      try {
+        await fs.rmdir(lockPath);
+      } catch {
+      }
+      return true;
+    }
+  } catch {
+  }
+  return false;
+}
+async function acquireLock(fs, configPath) {
+  const lockPath = `${configPath}.lock`;
+  const start = Date.now();
+  while (true) {
+    try {
+      await fs.mkdirExclusive(lockPath);
+      break;
+    } catch (err) {
+      if (!isEexist(err)) throw err;
+      await removeStaleLock(fs, lockPath);
+    }
+    if (Date.now() - start > LOCK_MAX_WAIT_MS) {
+      throw new Error(`mcpcat: could not acquire lock ${lockPath} within ${LOCK_MAX_WAIT_MS}ms`);
+    }
+    await new Promise((r) => setTimeout(r, LOCK_POLL_MS));
+  }
+  let released = false;
+  return async () => {
+    if (released) return;
+    released = true;
+    try {
+      await fs.rmdir(lockPath);
+    } catch {
+    }
+  };
+}
+
+// src/config/edit.ts
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function detectIndent(text) {
+  const match = /^([ \t]+)\S/m.exec(text);
+  return match ? match[1] : "  ";
+}
+async function readText(fs, path) {
+  try {
+    const data = await fs.readFile(path);
+    return new TextDecoder().decode(data);
+  } catch {
+    return void 0;
+  }
+}
+async function editMcpServers(fs, path, edit) {
+  const release = await acquireLock(fs, path);
+  try {
+    const text = await readText(fs, path);
+    const parsed = text === void 0 ? {} : JSON.parse(text);
+    if (!isRecord2(parsed) || parsed.mcpServers !== void 0 && !isRecord2(parsed.mcpServers))
+      throw new Error(`${path}: expected an object with an "mcpServers" object`);
+    const servers = isRecord2(parsed.mcpServers) ? parsed.mcpServers : void 0;
+    if (!edit(servers, parsed)) return { changed: false };
+    const indent = text ? detectIndent(text) : "  ";
+    const output = `${JSON.stringify(parsed, null, indent)}
+`;
+    const dir = path.slice(0, path.lastIndexOf("/"));
+    if (dir) {
+      try {
+        await fs.mkdir(dir);
+      } catch {
+      }
+    }
+    const tmpPath = `${path}.tmp.${Date.now()}`;
+    await fs.writeFile(tmpPath, output);
+    await fs.rename(tmpPath, path);
+    return { changed: true };
+  } finally {
+    await release();
+  }
+}
+async function addServer(fs, path, name, config) {
+  let replaced = false;
+  await editMcpServers(fs, path, (servers, parsed) => {
+    const target = servers ?? {};
+    replaced = target[name] !== void 0;
+    target[name] = config;
+    parsed.mcpServers = target;
+    return true;
+  });
+  return { replaced };
+}
+async function removeServer(fs, path, name) {
+  let removed = false;
+  await editMcpServers(fs, path, (servers) => {
+    if (!servers || servers[name] === void 0) return false;
+    delete servers[name];
+    removed = true;
+    return true;
+  });
+  return removed;
+}
+async function updateServer(fs, path, name, patch) {
+  let updated = false;
+  await editMcpServers(fs, path, (servers) => {
+    if (!servers || !isRecord2(servers[name])) return false;
+    const entry = servers[name];
+    if (patch.enabled !== void 0) entry.enabled = patch.enabled;
+    if (patch.exposure !== void 0) entry.exposure = patch.exposure;
+    if (patch.toolExposure !== void 0) entry.toolExposure = patch.toolExposure;
+    updated = true;
+    return true;
+  });
+  return updated;
+}
+async function setExposure(fs, path, name, exposure, toolGlob) {
+  let updated = false;
+  await editMcpServers(fs, path, (servers) => {
+    if (!servers || !isRecord2(servers[name])) return false;
+    const entry = servers[name];
+    if (toolGlob) {
+      const te = isRecord2(entry.toolExposure) ? { ...entry.toolExposure } : {};
+      te[toolGlob] = exposure;
+      entry.toolExposure = te;
+    } else {
+      entry.exposure = exposure;
+    }
+    updated = true;
+    return true;
+  });
+  return updated;
+}
+
+// src/discovery/extract.ts
+var nextId = 1;
+function candidateId() {
+  return String(nextId++);
+}
+function resetIdCounter(start = 1) {
+  nextId = start;
+}
+function isRecord3(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function checkUrnPublisher(identifier, originHost) {
+  const urnMatch = /^urn:air:([^:]+):/.exec(identifier);
+  if (!urnMatch) return void 0;
+  const urnDomain = urnMatch[1];
+  if (domainMatch(urnDomain, originHost)) {
+    return { type: "urn-publisher", detail: `${urnDomain} matches ${originHost}` };
+  }
+  return { type: "urn-publisher-mismatch", detail: `${urnDomain} does not match ${originHost}` };
+}
+function checkTrustManifest(entry, originHost) {
+  if (!isRecord3(entry.trustManifest) || typeof entry.trustManifest.identity !== "string")
+    return void 0;
+  const identity = entry.trustManifest.identity;
+  if (domainMatch(identity, originHost)) {
+    return { type: "trust-manifest", detail: `identity ${identity} matches origin` };
+  }
+  return {
+    type: "trust-manifest-mismatch",
+    detail: `identity ${identity} does not match ${originHost}`
+  };
+}
+function extractArd(event) {
+  const candidates = [];
+  const summary = event.summary;
+  if (!isRecord3(summary)) return candidates;
+  const entries = summary.entries;
+  if (!Array.isArray(entries)) return candidates;
+  for (const entry of entries) {
+    if (!isRecord3(entry)) continue;
+    if (entry.type !== "application/mcp-server-card+json") continue;
+    const url = typeof entry.url === "string" ? entry.url : void 0;
+    if (!url) continue;
+    const trust = [];
+    const originHost = hostFromUrl(event.origin);
+    const identifier = typeof entry.identifier === "string" ? entry.identifier : void 0;
+    if (identifier) {
+      const urnSignal = checkUrnPublisher(identifier, originHost);
+      if (urnSignal) trust.push(urnSignal);
+    }
+    const tmSignal = checkTrustManifest(entry, originHost);
+    if (tmSignal) trust.push(tmSignal);
+    candidates.push({
+      id: candidateId(),
+      endpoint: url,
+      standard: "ard",
+      origin: event.origin,
+      name: typeof entry.displayName === "string" ? entry.displayName : void 0,
+      transport: "http",
+      trust,
+      status: event.status,
+      reason: event.reason,
+      discoveredAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  }
+  return candidates;
+}
+function extractAiCatalog(event) {
+  const candidates = [];
+  const summary = event.summary;
+  if (!isRecord3(summary)) return candidates;
+  const entries = summary.entries;
+  if (!Array.isArray(entries)) return candidates;
+  for (const entry of entries) {
+    if (!isRecord3(entry)) continue;
+    if (entry.type !== "application/mcp-server-card+json" && entry.type !== "mcp-server") continue;
+    const url = typeof entry.url === "string" ? entry.url : void 0;
+    if (!url) continue;
+    candidates.push({
+      id: candidateId(),
+      endpoint: url,
+      standard: "ai-catalog",
+      origin: event.origin,
+      name: typeof entry.displayName === "string" ? entry.displayName : void 0,
+      transport: "http",
+      trust: [],
+      status: event.status,
+      reason: event.reason,
+      discoveredAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  }
+  return candidates;
+}
+function extractUcp(event) {
+  const candidates = [];
+  const summary = event.summary;
+  if (!isRecord3(summary)) return candidates;
+  const services = summary.services;
+  if (!isRecord3(services)) return candidates;
+  for (const [svcName, svcValue] of Object.entries(services)) {
+    if (!Array.isArray(svcValue)) continue;
+    for (const transport of svcValue) {
+      if (!isRecord3(transport)) continue;
+      if (transport.transport !== "mcp") continue;
+      const endpoint = typeof transport.endpoint === "string" ? transport.endpoint : void 0;
+      if (!endpoint) continue;
+      candidates.push({
+        id: candidateId(),
+        endpoint,
+        standard: "ucp",
+        origin: event.origin,
+        name: svcName,
+        transport: "http",
+        trust: [],
+        status: event.status,
+        reason: event.reason,
+        discoveredAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+    }
+  }
+  return candidates;
+}
+function extractPoppy(event) {
+  const candidates = [];
+  const summary = event.summary;
+  if (!isRecord3(summary)) return candidates;
+  const apis = summary.apis;
+  if (!Array.isArray(apis)) return candidates;
+  for (const api of apis) {
+    if (!isRecord3(api)) continue;
+    if (api.type !== "mcp") continue;
+    const url = typeof api.url === "string" ? api.url : void 0;
+    if (!url) continue;
+    candidates.push({
+      id: candidateId(),
+      endpoint: url,
+      standard: "poppy",
+      origin: event.origin,
+      transport: "http",
+      trust: [],
+      status: event.status,
+      reason: event.reason,
+      discoveredAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  }
+  return candidates;
+}
+function extractNlweb(event) {
+  const summary = event.summary;
+  if (!isRecord3(summary)) return [];
+  const mcpUrl = typeof summary.mcpUrl === "string" ? summary.mcpUrl : void 0;
+  if (!mcpUrl) return [];
+  return [
+    {
+      id: candidateId(),
+      endpoint: mcpUrl,
+      standard: "nlweb",
+      origin: event.origin,
+      transport: "http",
+      trust: [],
+      status: event.status,
+      reason: event.reason,
+      discoveredAt: (/* @__PURE__ */ new Date()).toISOString()
+    }
+  ];
+}
+function extractWebmcp(event) {
+  return [
+    {
+      id: candidateId(),
+      endpoint: event.url,
+      standard: "webmcp",
+      origin: event.origin,
+      transport: "webmcp",
+      trust: [],
+      status: event.status,
+      reason: event.reason,
+      suggestion: "mcpcat serve --webmcp",
+      discoveredAt: (/* @__PURE__ */ new Date()).toISOString()
+    }
+  ];
+}
+function hostFromUrl(url) {
+  try {
+    return new URL(url).hostname;
+  } catch {
+    return "";
+  }
+}
+var TWO_LABEL_TLDS = /* @__PURE__ */ new Set([
+  "co.uk",
+  "org.uk",
+  "ac.uk",
+  "co.jp",
+  "or.jp",
+  "co.kr",
+  "co.nz",
+  "co.za",
+  "com.au",
+  "com.br",
+  "com.cn",
+  "com.mx",
+  "com.tw",
+  "net.au",
+  "org.au",
+  "co.in",
+  "com.sg",
+  "co.il"
+]);
+function registrableDomain(host) {
+  const h = host.toLowerCase().replace(/^www\./, "");
+  const parts = h.split(".");
+  if (parts.length <= 2) return h;
+  const lastTwo = parts.slice(-2).join(".");
+  if (TWO_LABEL_TLDS.has(lastTwo) && parts.length > 2) {
+    return parts.slice(-3).join(".");
+  }
+  return lastTwo;
+}
+function domainMatch(a, b) {
+  return registrableDomain(a) === registrableDomain(b);
+}
+function extractMcp(event) {
+  const summary = event.summary;
+  if (!isRecord3(summary)) return [];
+  const endpoint = typeof summary.endpoint === "string" ? summary.endpoint : void 0;
+  if (!endpoint) return [];
+  const trust = [];
+  if (Array.isArray(summary.trust)) {
+    for (const t of summary.trust) {
+      if (isRecord3(t) && typeof t.type === "string" && typeof t.detail === "string") {
+        trust.push({ type: t.type, detail: t.detail });
+      }
+    }
+  }
+  const si = isRecord3(summary.serverInfo) ? summary.serverInfo : void 0;
+  const name = si && typeof si.name === "string" ? si.name : void 0;
+  return [
+    {
+      id: candidateId(),
+      endpoint,
+      standard: "mcp",
+      origin: event.origin,
+      name,
+      transport: "http",
+      trust,
+      status: event.status,
+      reason: event.reason,
+      discoveredAt: (/* @__PURE__ */ new Date()).toISOString()
+    }
+  ];
+}
+var EXTRACTORS = {
+  ard: extractArd,
+  "ai-catalog": extractAiCatalog,
+  ucp: extractUcp,
+  poppy: extractPoppy,
+  nlweb: extractNlweb,
+  webmcp: extractWebmcp,
+  mcp: extractMcp
+};
+function extractCandidates(event) {
+  const extractor = EXTRACTORS[event.standard];
+  if (!extractor) return [];
+  return extractor(event);
+}
+function deduplicateCandidates(candidates) {
+  const seen = /* @__PURE__ */ new Set();
+  const result = [];
+  for (const c of candidates) {
+    const key = c.endpoint;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    result.push(c);
+  }
+  return result;
+}
+
+// src/discovery/inbox.ts
+function inboxPath(stateDir2) {
+  return `${stateDir2}/inbox.json`;
+}
+async function readInbox(fs, stateDir2) {
+  try {
+    const data = await fs.readFile(inboxPath(stateDir2));
+    const parsed = JSON.parse(new TextDecoder().decode(data));
+    if (parsed && Array.isArray(parsed.candidates)) return parsed;
+  } catch {
+  }
+  return { candidates: [] };
+}
+async function writeInbox(fs, stateDir2, inbox) {
+  try {
+    await fs.mkdir(stateDir2);
+  } catch {
+  }
+  const json = JSON.stringify(inbox, null, 2) + "\n";
+  await fs.writeFile(inboxPath(stateDir2), json);
+}
+async function appendCandidates(fs, stateDir2, candidates) {
+  const inbox = await readInbox(fs, stateDir2);
+  const existing = new Set(inbox.candidates.map((c) => c.endpoint));
+  for (const c of candidates) {
+    if (existing.has(c.endpoint)) continue;
+    existing.add(c.endpoint);
+    inbox.candidates.push(c);
+  }
+  await writeInbox(fs, stateDir2, inbox);
+}
+async function listCandidates(fs, stateDir2) {
+  const inbox = await readInbox(fs, stateDir2);
+  return inbox.candidates.slice().reverse();
+}
+async function getCandidate(fs, stateDir2, id) {
+  const inbox = await readInbox(fs, stateDir2);
+  return inbox.candidates.find((c) => c.id === id);
+}
+
+// src/discovery/probe.ts
+function isJsonContentType(ct) {
+  if (!ct) return false;
+  const lower = ct.toLowerCase();
+  if (lower.includes("text/html")) return false;
+  return lower.includes("json") || lower.includes("+json");
+}
+function parseLinkHeaders(headers) {
+  const links = [];
+  const raw = headers.get("link");
+  if (!raw) return links;
+  const parts = raw.split(/,(?=\s*<)/);
+  for (const part of parts) {
+    const urlMatch = /<([^>]+)>/.exec(part);
+    const relMatch = /rel\s*=\s*"?([^";,\s]+)"?/i.exec(part);
+    if (urlMatch && relMatch) {
+      links.push({ url: urlMatch[1], rel: relMatch[1].toLowerCase() });
+    }
+  }
+  return links;
+}
+function wasRedirected(requestUrl, resp) {
+  if (resp.redirected) return true;
+  if (resp.url && resp.url !== requestUrl) return true;
+  return false;
+}
+async function probeUrl(fetcher, url, accept) {
+  let resp;
+  try {
+    resp = await fetcher(url, {
+      redirect: "manual",
+      headers: accept ? { Accept: accept } : void 0,
+      credentials: "omit"
+    });
+  } catch {
+    try {
+      resp = await fetcher(url, {
+        redirect: "follow",
+        headers: accept ? { Accept: accept } : void 0,
+        credentials: "omit"
+      });
+      if (wasRedirected(url, resp)) {
+        return { ok: false, status: 301, headers: resp.headers, body: "" };
+      }
+    } catch {
+      return void 0;
+    }
+  }
+  if (resp.status !== 200)
+    return { ok: false, status: resp.status, headers: resp.headers, body: "" };
+  const ct = resp.headers.get("content-type");
+  if (!isJsonContentType(ct))
+    return { ok: false, status: resp.status, headers: resp.headers, body: "" };
+  const body = await resp.text();
+  return { ok: true, status: 200, headers: resp.headers, body };
+}
+function isRecord4(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function makeEvent(standard, origin, url, via, page, status, summary, reason) {
+  return {
+    v: 1,
+    standard,
+    origin,
+    url,
+    via,
+    page,
+    targetId: "",
+    status,
+    summary,
+    ...reason ? { reason } : {}
+  };
+}
+function tryParseJson(body) {
+  try {
+    return JSON.parse(body);
+  } catch {
+    return void 0;
+  }
+}
+function classifyArd(origin, url, via, page, body) {
+  const parsed = tryParseJson(body);
+  if (!isRecord4(parsed))
+    return makeEvent("ard", origin, url, via, page, "invalid", null, "invalid JSON");
+  if (!Array.isArray(parsed.entries))
+    return makeEvent("ard", origin, url, via, page, "invalid", null, "missing entries[]");
+  const entries = [];
+  for (const entry of parsed.entries) {
+    if (!isRecord4(entry)) continue;
+    entries.push({
+      identifier: entry.identifier,
+      displayName: entry.displayName,
+      type: entry.type,
+      url: entry.url,
+      capabilities: entry.capabilities,
+      representativeQueries: entry.representativeQueries,
+      trustManifest: entry.trustManifest
+    });
+  }
+  return makeEvent("ard", origin, url, via, page, "valid", { entries });
+}
+function classifyAiCatalog(origin, url, via, page, body) {
+  const parsed = tryParseJson(body);
+  if (!isRecord4(parsed))
+    return makeEvent("ai-catalog", origin, url, via, page, "invalid", null, "invalid JSON");
+  const entries = [];
+  const items = Array.isArray(parsed.entries) ? parsed.entries : Array.isArray(parsed.items) ? parsed.items : void 0;
+  if (!items)
+    return makeEvent("ai-catalog", origin, url, via, page, "invalid", null, "no entries or items");
+  for (const entry of items) {
+    if (!isRecord4(entry)) continue;
+    entries.push({
+      displayName: entry.displayName ?? entry.name,
+      type: entry.type,
+      url: entry.url
+    });
+  }
+  return makeEvent("ai-catalog", origin, url, via, page, "valid", { entries });
+}
+async function probeWellKnown(fetcher, origin, page) {
+  const events = [];
+  const ardUrl = `${origin}/.well-known/ard.json`;
+  const ardResult = await probeUrl(fetcher, ardUrl, "application/json");
+  if (ardResult?.ok) {
+    const ev = classifyArd(origin, ardUrl, "well-known", page, ardResult.body);
+    if (ev) events.push(ev);
+  }
+  const aiCatUrl = `${origin}/.well-known/ai-catalog.json`;
+  const aiCatResult = await probeUrl(fetcher, aiCatUrl, "application/json");
+  if (aiCatResult?.ok) {
+    const ev = classifyAiCatalog(origin, aiCatUrl, "well-known", page, aiCatResult.body);
+    if (ev) events.push(ev);
+  }
+  return events;
+}
+async function probeLinkHeaders(fetcher, targetUrl, origin, page) {
+  const events = [];
+  const targetResult = await probeUrl(fetcher, targetUrl);
+  if (!targetResult) return events;
+  const links = parseLinkHeaders(targetResult.headers);
+  for (const link of links) {
+    const resolved = new URL(link.url, targetUrl).href;
+    const classifier = link.rel === "ard" ? classifyArd : link.rel === "ai-catalog" ? classifyAiCatalog : null;
+    if (!classifier) continue;
+    const linkResult = await probeUrl(fetcher, resolved, "application/json");
+    if (linkResult?.ok) {
+      const ev = classifier(origin, resolved, "link-header", page, linkResult.body);
+      if (ev) events.push(ev);
+    }
+  }
+  return events;
+}
+function mcpJsonRpc(method, params, id = 1) {
+  return JSON.stringify({ jsonrpc: "2.0", id, method, params });
+}
+function parseServerInfo(result) {
+  const si = isRecord4(result.serverInfo) ? result.serverInfo : void 0;
+  if (!si) return void 0;
+  return {
+    name: typeof si.name === "string" ? si.name : void 0,
+    version: typeof si.version === "string" ? si.version : void 0
+  };
+}
+function checkAuthResponse(resp) {
+  if (resp.status !== 401) return void 0;
+  const wwwAuth = resp.headers.get("www-authenticate");
+  if (!wwwAuth) return void 0;
+  return { type: "auth-required", detail: wwwAuth.split(",")[0].trim() };
+}
+async function tryMcpPost(fetcher, url, body, extraHeaders) {
+  const headers = {
+    "Content-Type": "application/json",
+    Accept: "application/json",
+    ...extraHeaders
+  };
+  try {
+    const resp = await fetcher(url, {
+      method: "POST",
+      headers,
+      body,
+      redirect: "manual",
+      credentials: "omit"
+    });
+    const authSignal = checkAuthResponse(resp);
+    if (authSignal) return { url, trust: [authSignal] };
+    if (resp.status === 200) {
+      const text = await resp.text();
+      const parsed = tryParseJson(text);
+      if (isRecord4(parsed) && isRecord4(parsed.result)) {
+        return { url, serverInfo: parseServerInfo(parsed.result), trust: [] };
+      }
+    }
+  } catch {
+  }
+  return void 0;
+}
+async function probeMcpEndpoint(fetcher, url) {
+  const discoverBody = mcpJsonRpc("server/discover", {
+    protocolVersion: "2026-07-28",
+    clientInfo: { name: "mcpcat", version: "0.0.0" }
+  });
+  const hit = await tryMcpPost(fetcher, url, discoverBody, {
+    "Mcp-Method": "server/discover"
+  });
+  if (hit) return hit;
+  const initBody = mcpJsonRpc("initialize", {
+    protocolVersion: "2025-11-25",
+    clientInfo: { name: "mcpcat", version: "0.0.0" },
+    capabilities: {}
+  });
+  return tryMcpPost(fetcher, url, initBody);
+}
+async function probeMcp(fetcher, origin, page, targetUrl) {
+  const events = [];
+  const urls = [targetUrl];
+  const mcpUrl = `${origin}/mcp`;
+  if (mcpUrl !== targetUrl) urls.push(mcpUrl);
+  for (const url of urls) {
+    const hit = await probeMcpEndpoint(fetcher, url);
+    if (hit) {
+      const summary = { endpoint: hit.url };
+      if (hit.serverInfo) summary.serverInfo = hit.serverInfo;
+      if (hit.trust.length > 0) summary.trust = hit.trust;
+      events.push(makeEvent("mcp", origin, hit.url, "well-known", page, "valid", summary));
+    }
+  }
+  return events;
+}
+async function probeDiscover(platform2, targetUrl) {
+  let origin;
+  try {
+    const u = new URL(targetUrl);
+    origin = u.origin;
+  } catch {
+    return { events: [] };
+  }
+  const page = targetUrl;
+  const fetcher = platform2.fetch;
+  const events = [
+    ...await probeWellKnown(fetcher, origin, page),
+    ...await probeLinkHeaders(fetcher, targetUrl, origin, page),
+    ...await probeMcp(fetcher, origin, page, targetUrl)
+  ];
+  return { events };
+}
+
+// src/discovery/verbs.ts
+async function readStdin(platform2) {
+  const reader = platform2.stdin.getReader();
+  const chunks = [];
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    chunks.push(value);
+  }
+  reader.releaseLock();
+  const total = chunks.reduce((s, c) => s + c.length, 0);
+  const merged = new Uint8Array(total);
+  let offset = 0;
+  for (const c of chunks) {
+    merged.set(c, offset);
+    offset += c.length;
+  }
+  return new TextDecoder().decode(merged);
+}
+function parseEvents(text) {
+  const lines = text.trim().split("\n").filter((l) => l.trim().length > 0);
+  const events = [];
+  for (const line of lines) {
+    let parsed;
+    try {
+      parsed = JSON.parse(line);
+    } catch {
+      return { error: `invalid JSON: ${line.slice(0, 80)}`, code: 2 };
+    }
+    const ev = parsed;
+    if (typeof ev.v !== "number") return { error: "missing event version", code: 2 };
+    if (ev.v !== 1) return { error: `unknown event version: ${ev.v}`, code: 2 };
+    events.push(ev);
+  }
+  return events;
+}
+function formatCandidate(c) {
+  const parts = [`#${c.id}  ${c.standard}  ${c.endpoint}`];
+  if (c.name) parts[0] += `  (${c.name})`;
+  if (c.status === "invalid") parts.push(`  status: invalid \u2013 ${c.reason ?? "unknown"}`);
+  if (c.suggestion) parts.push(`  suggestion: ${c.suggestion}`);
+  for (const t of c.trust) {
+    const icon = t.type.includes("mismatch") ? "\u26A0" : "\u2713";
+    parts.push(`  ${icon} ${t.type}: ${t.detail}`);
+  }
+  return parts.join("\n");
+}
+function formatCandidateJson(c) {
+  return {
+    id: c.id,
+    endpoint: c.endpoint,
+    standard: c.standard,
+    origin: c.origin,
+    name: c.name,
+    transport: c.transport,
+    trust: c.trust,
+    status: c.status,
+    reason: c.reason,
+    suggestion: c.suggestion,
+    discoveredAt: c.discoveredAt
+  };
+}
+async function runFromDiscovery(platform2, args2) {
+  let source = "-";
+  for (const arg of args2) {
+    if (arg !== "--from-discovery" && !arg.startsWith("-")) {
+      source = arg;
+    }
+  }
+  let text;
+  if (source === "-") {
+    text = await readStdin(platform2);
+  } else {
+    try {
+      const data = await platform2.fs.readFile(source);
+      text = new TextDecoder().decode(data);
+    } catch {
+      await platform2.write(2, `mcpcat add --from-discovery: cannot read '${source}'
+`);
+      return 2;
+    }
+  }
+  const result = parseEvents(text);
+  if ("error" in result) {
+    await platform2.write(2, `mcpcat add --from-discovery: ${result.error}
+`);
+    return result.code;
+  }
+  resetIdCounter();
+  let allCandidates = [];
+  for (const event of result) {
+    allCandidates.push(...extractCandidates(event));
+  }
+  allCandidates = deduplicateCandidates(allCandidates);
+  if (allCandidates.length === 0) {
+    await platform2.write(1, "no MCP candidates found\n");
+    return 0;
+  }
+  const sd = stateDir(platform2);
+  await appendCandidates(platform2.fs, sd, allCandidates);
+  for (const c of allCandidates) {
+    await platform2.write(1, `${formatCandidate(c)}
+`);
+  }
+  return 0;
+}
+async function runInbox(platform2, args2) {
+  const json = args2.includes("--json");
+  const sd = stateDir(platform2);
+  const candidates = await listCandidates(platform2.fs, sd);
+  if (candidates.length === 0) {
+    await platform2.write(1, "inbox is empty\n");
+    return 0;
+  }
+  if (json) {
+    await platform2.write(1, JSON.stringify(candidates.map(formatCandidateJson), null, 2) + "\n");
+  } else {
+    for (const c of candidates) {
+      await platform2.write(1, `${formatCandidate(c)}
+`);
+    }
+  }
+  return 0;
+}
+async function runAddCandidate(platform2, name, candidateId2, configFile) {
+  const sd = stateDir(platform2);
+  const candidate = await getCandidate(platform2.fs, sd, candidateId2);
+  if (!candidate) {
+    await platform2.write(2, `mcpcat add: candidate #${candidateId2} not found in inbox
+`);
+    return 1;
+  }
+  if (candidate.transport === "webmcp") {
+    await platform2.write(
+      2,
+      `mcpcat add: WebMCP candidates cannot be added directly; use: ${candidate.suggestion}
+`
+    );
+    return 2;
+  }
+  const path = configFile ?? userConfigPath(platform2);
+  const config = { url: candidate.endpoint };
+  const { replaced } = await addServer(platform2.fs, path, name, config);
+  for (const t of candidate.trust) {
+    if (t.type.includes("mismatch")) {
+      await platform2.write(2, `mcpcat add: warning: ${t.type}: ${t.detail}
+`);
+    }
+  }
+  await platform2.write(1, `${replaced ? "replaced" : "added"} ${name} in ${path}
+`);
+  return 0;
+}
+async function runDiscover(platform2, args2) {
+  const positional = [];
+  let json = false;
+  for (const arg of args2) {
+    if (arg === "--json") {
+      json = true;
+    } else if (!arg.startsWith("-")) {
+      positional.push(arg);
+    }
+  }
+  if (positional.length < 1) {
+    await platform2.write(2, "mcpcat discover: requires a URL\n");
+    return 2;
+  }
+  const url = positional[0];
+  if (!URL.canParse(url)) {
+    await platform2.write(2, `mcpcat discover: '${url}' is not a valid URL
+`);
+    return 2;
+  }
+  const { events } = await probeDiscover(platform2, url);
+  resetIdCounter();
+  let allCandidates = [];
+  for (const event of events) {
+    allCandidates.push(...extractCandidates(event));
+  }
+  allCandidates = deduplicateCandidates(allCandidates);
+  if (allCandidates.length > 0) {
+    const sd = stateDir(platform2);
+    await appendCandidates(platform2.fs, sd, allCandidates);
+  }
+  if (allCandidates.length === 0) {
+    await platform2.write(1, "no MCP candidates found\n");
+    return 0;
+  }
+  if (json) {
+    await platform2.write(1, JSON.stringify(allCandidates.map(formatCandidateJson), null, 2) + "\n");
+  } else {
+    for (const c of allCandidates) {
+      await platform2.write(1, `${formatCandidate(c)}
+`);
+    }
+  }
+  return 0;
+}
+
 // src/config/expand.ts
 var PLACEHOLDER = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
 var PLACEHOLDER_TEST = /\$\{[A-Za-z_][A-Za-z0-9_]*\}/;
@@ -3982,158 +4898,12 @@ async function handleMcpRequest(request, tools, call, serverName, version, allow
   };
 }
 
-// src/config/lock.ts
-var LOCK_STALE_MS = 1e4;
-var LOCK_POLL_MS = 50;
-var LOCK_MAX_WAIT_MS = 5e3;
-function isEexist(err) {
-  if (err instanceof Error && "code" in err)
-    return err.code === "EEXIST";
-  if (err instanceof Error) return err.message.includes("EEXIST");
-  return false;
-}
-async function removeStaleLock(fs, lockPath) {
-  try {
-    const s = await fs.stat(lockPath);
-    if (Date.now() - s.mtimeMs > LOCK_STALE_MS) {
-      try {
-        await fs.rmdir(lockPath);
-      } catch {
-      }
-      return true;
-    }
-  } catch {
-  }
-  return false;
-}
-async function acquireLock(fs, configPath) {
-  const lockPath = `${configPath}.lock`;
-  const start = Date.now();
-  while (true) {
-    try {
-      await fs.mkdirExclusive(lockPath);
-      break;
-    } catch (err) {
-      if (!isEexist(err)) throw err;
-      await removeStaleLock(fs, lockPath);
-    }
-    if (Date.now() - start > LOCK_MAX_WAIT_MS) {
-      throw new Error(`mcpcat: could not acquire lock ${lockPath} within ${LOCK_MAX_WAIT_MS}ms`);
-    }
-    await new Promise((r) => setTimeout(r, LOCK_POLL_MS));
-  }
-  let released = false;
-  return async () => {
-    if (released) return;
-    released = true;
-    try {
-      await fs.rmdir(lockPath);
-    } catch {
-    }
-  };
-}
-
-// src/config/edit.ts
-function isRecord2(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function detectIndent(text) {
-  const match = /^([ \t]+)\S/m.exec(text);
-  return match ? match[1] : "  ";
-}
-async function readText(fs, path) {
-  try {
-    const data = await fs.readFile(path);
-    return new TextDecoder().decode(data);
-  } catch {
-    return void 0;
-  }
-}
-async function editMcpServers(fs, path, edit) {
-  const release = await acquireLock(fs, path);
-  try {
-    const text = await readText(fs, path);
-    const parsed = text === void 0 ? {} : JSON.parse(text);
-    if (!isRecord2(parsed) || parsed.mcpServers !== void 0 && !isRecord2(parsed.mcpServers))
-      throw new Error(`${path}: expected an object with an "mcpServers" object`);
-    const servers = isRecord2(parsed.mcpServers) ? parsed.mcpServers : void 0;
-    if (!edit(servers, parsed)) return { changed: false };
-    const indent = text ? detectIndent(text) : "  ";
-    const output = `${JSON.stringify(parsed, null, indent)}
-`;
-    const dir = path.slice(0, path.lastIndexOf("/"));
-    if (dir) {
-      try {
-        await fs.mkdir(dir);
-      } catch {
-      }
-    }
-    const tmpPath = `${path}.tmp.${Date.now()}`;
-    await fs.writeFile(tmpPath, output);
-    await fs.rename(tmpPath, path);
-    return { changed: true };
-  } finally {
-    await release();
-  }
-}
-async function addServer(fs, path, name, config) {
-  let replaced = false;
-  await editMcpServers(fs, path, (servers, parsed) => {
-    const target = servers ?? {};
-    replaced = target[name] !== void 0;
-    target[name] = config;
-    parsed.mcpServers = target;
-    return true;
-  });
-  return { replaced };
-}
-async function removeServer(fs, path, name) {
-  let removed = false;
-  await editMcpServers(fs, path, (servers) => {
-    if (!servers || servers[name] === void 0) return false;
-    delete servers[name];
-    removed = true;
-    return true;
-  });
-  return removed;
-}
-async function updateServer(fs, path, name, patch) {
-  let updated = false;
-  await editMcpServers(fs, path, (servers) => {
-    if (!servers || !isRecord2(servers[name])) return false;
-    const entry = servers[name];
-    if (patch.enabled !== void 0) entry.enabled = patch.enabled;
-    if (patch.exposure !== void 0) entry.exposure = patch.exposure;
-    if (patch.toolExposure !== void 0) entry.toolExposure = patch.toolExposure;
-    updated = true;
-    return true;
-  });
-  return updated;
-}
-async function setExposure(fs, path, name, exposure, toolGlob) {
-  let updated = false;
-  await editMcpServers(fs, path, (servers) => {
-    if (!servers || !isRecord2(servers[name])) return false;
-    const entry = servers[name];
-    if (toolGlob) {
-      const te = isRecord2(entry.toolExposure) ? { ...entry.toolExposure } : {};
-      te[toolGlob] = exposure;
-      entry.toolExposure = te;
-    } else {
-      entry.exposure = exposure;
-    }
-    updated = true;
-    return true;
-  });
-  return updated;
-}
-
 // src/config/import.ts
-function isRecord3(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isStringRecord2(value) {
-  return isRecord3(value) && Object.values(value).every((v) => typeof v === "string");
+  return isRecord5(value) && Object.values(value).every((v) => typeof v === "string");
 }
 function tryParse(text) {
   try {
@@ -4163,17 +4933,17 @@ function importClaude(text, names) {
     result.errors.push(error);
     return result;
   }
-  if (!isRecord3(parsed)) {
+  if (!isRecord5(parsed)) {
     result.errors.push("expected an object");
     return result;
   }
   const mcpServers = parsed.mcpServers;
-  if (!isRecord3(mcpServers)) {
+  if (!isRecord5(mcpServers)) {
     result.errors.push('no "mcpServers" object');
     return result;
   }
   for (const [name, entry] of filterNames(Object.entries(mcpServers), names)) {
-    if (!isRecord3(entry)) {
+    if (!isRecord5(entry)) {
       result.errors.push(`${name}: not an object`);
       continue;
     }
@@ -4188,17 +4958,17 @@ function importVSCode(text, names) {
     result.errors.push(error);
     return result;
   }
-  if (!isRecord3(parsed)) {
+  if (!isRecord5(parsed)) {
     result.errors.push("expected an object");
     return result;
   }
   const servers = parsed.servers ?? parsed.mcpServers;
-  if (!isRecord3(servers)) {
+  if (!isRecord5(servers)) {
     result.errors.push('no "servers" or "mcpServers" object');
     return result;
   }
   for (const [name, entry] of filterNames(Object.entries(servers), names)) {
-    if (!isRecord3(entry)) {
+    if (!isRecord5(entry)) {
       result.errors.push(`${name}: not an object`);
       continue;
     }
@@ -4232,17 +5002,17 @@ function importSixServers(text, names) {
     result.errors.push(error);
     return result;
   }
-  if (!isRecord3(parsed)) {
+  if (!isRecord5(parsed)) {
     result.errors.push("expected an object");
     return result;
   }
   const servers = parsed.servers;
-  if (!isRecord3(servers)) {
+  if (!isRecord5(servers)) {
     result.errors.push('no "servers" object');
     return result;
   }
   for (const [name, entry] of filterNames(Object.entries(servers), names)) {
-    if (!isRecord3(entry)) {
+    if (!isRecord5(entry)) {
       result.errors.push(`${name}: not an object`);
       continue;
     }
@@ -4250,7 +5020,7 @@ function importSixServers(text, names) {
     if (typeof entry.url === "string") config.url = entry.url;
     if (isStringRecord2(entry.headers)) config.headers = entry.headers;
     if (typeof entry.exposure === "string") config.exposure = entry.exposure;
-    if (isRecord3(entry.toolExposure)) config.toolExposure = entry.toolExposure;
+    if (isRecord5(entry.toolExposure)) config.toolExposure = entry.toolExposure;
     result.servers.push({ name, config });
   }
   return result;
@@ -4267,7 +5037,7 @@ function importCodexToml(text, names) {
     if (fields.command) config.command = fields.command;
     if (fields.args) config.args = fields.args;
     if (fields.url) config.url = fields.url;
-    if (fields.env && isRecord3(fields.env)) config.env = fields.env;
+    if (fields.env && isRecord5(fields.env)) config.env = fields.env;
     result.servers.push({ name, config });
   }
   return result;
@@ -4319,7 +5089,7 @@ function convertOpenCodeLocal(entry) {
   } else if (typeof entry.command === "string") {
     config.command = entry.command;
   }
-  if (isRecord3(entry.environment)) {
+  if (isRecord5(entry.environment)) {
     const env = {};
     for (const [k, v] of Object.entries(entry.environment)) {
       if (typeof v === "string")
@@ -4342,17 +5112,17 @@ function importOpenCode(text, names) {
     result.errors.push(error);
     return result;
   }
-  if (!isRecord3(parsed)) {
+  if (!isRecord5(parsed)) {
     result.errors.push("expected an object");
     return result;
   }
   const mcpServers = parsed.mcpServers ?? parsed.mcp;
-  if (!isRecord3(mcpServers)) {
+  if (!isRecord5(mcpServers)) {
     result.errors.push("no mcp servers found");
     return result;
   }
   for (const [name, entry] of filterNames(Object.entries(mcpServers), names)) {
-    if (!isRecord3(entry)) {
+    if (!isRecord5(entry)) {
       result.errors.push(`${name}: not an object`);
       continue;
     }
@@ -4368,9 +5138,9 @@ function detectFormat(text, filename) {
   if (filename.includes(".vscode")) return "vscode";
   try {
     const parsed = JSON.parse(text);
-    if (isRecord3(parsed)) {
-      if (parsed.servers && isRecord3(parsed.servers) && parsed.version !== void 0) return "six";
-      if (parsed.servers && isRecord3(parsed.servers)) return "vscode";
+    if (isRecord5(parsed)) {
+      if (parsed.servers && isRecord5(parsed.servers) && parsed.version !== void 0) return "six";
+      if (parsed.servers && isRecord5(parsed.servers)) return "vscode";
       if (parsed.mcpServers) return "claude";
       if (parsed.mcp) return "opencode";
     }
@@ -4939,9 +5709,7 @@ var UNIMPLEMENTED_VERBS = /* @__PURE__ */ new Set([
   "task",
   "login",
   "logout",
-  "code",
-  "discover",
-  "inbox"
+  "code"
 ]);
 var CLIENT_VERBS = /* @__PURE__ */ new Set(["info", "tools", "call", "describe", "serve"]);
 function helpText(version) {
@@ -4969,8 +5737,8 @@ Configuration verbs:
 Server and code verbs:
   serve [--stdio|--http] \u2026   Expose commands as MCP server
   code [-e src|file.js]      Run a codemode script (not implemented yet)
-  discover <url>             Find MCP servers (not implemented yet)
-  inbox                      Discovery inbox (not implemented yet)
+  discover <url>             Find MCP servers at a URL
+  inbox [--json]             List discovery candidates
   help [verb]                Show help
 
 Options:
@@ -5285,6 +6053,37 @@ async function dispatchConfigVerb(platform2, verb, args2) {
       return 1;
   }
 }
+async function dispatchDiscoveryVerb(platform2, parsed, args2) {
+  if (parsed.verb === "add" && args2.includes("--from-discovery")) {
+    return runFromDiscovery(platform2, args2.slice(1));
+  }
+  if (parsed.verb === "add" && args2.includes("--candidate")) {
+    const rest = args2.slice(1);
+    const nameIdx = rest.findIndex((a) => !a.startsWith("-") && a !== "--candidate");
+    const candidateIdx = rest.indexOf("--candidate");
+    if (nameIdx < 0 || candidateIdx < 0 || candidateIdx + 1 >= rest.length) {
+      await platform2.write(2, "mcpcat add --candidate: requires <name> --candidate <id>\n");
+      return 2;
+    }
+    const name = rest[nameIdx];
+    const candidateId2 = rest[candidateIdx + 1];
+    const configIdx = rest.indexOf("--config");
+    const configFile = configIdx >= 0 && configIdx + 1 < rest.length ? rest[configIdx + 1] : void 0;
+    return runAddCandidate(platform2, name, candidateId2, configFile);
+  }
+  if (parsed.verb === "discover") return runDiscover(platform2, args2.slice(1));
+  if (parsed.verb === "inbox") return runInbox(platform2, args2.slice(1));
+  return void 0;
+}
+async function dispatchServeVerb(platform2, args2, version) {
+  const serveArgs = args2.slice(args2.indexOf("serve") + 1);
+  const serveOptions = parseServeFlags(serveArgs);
+  if (serveOptions.commands.length === 0 && serveOptions.toolTemplates.length === 0) {
+    await platform2.write(2, "mcpcat serve: no commands or --tool templates given\n");
+    return 2;
+  }
+  return runServe(platform2, serveOptions, version);
+}
 async function run(platform2, version, args2) {
   if (args2.includes("--version") || args2.includes("-V")) {
     await platform2.write(1, `${version}
@@ -5305,21 +6104,19 @@ async function run(platform2, version, args2) {
     return 2;
   }
   if (parsed.verb in CONFIG_VERBS) {
+    const disc = await dispatchDiscoveryVerb(platform2, parsed, args2);
+    if (disc !== void 0) return disc;
     return dispatchConfigVerb(platform2, parsed.verb, args2);
   }
+  const discResult = await dispatchDiscoveryVerb(platform2, parsed, args2);
+  if (discResult !== void 0) return discResult;
   if (UNIMPLEMENTED_VERBS.has(parsed.verb)) {
     await platform2.write(2, `mcpcat: '${parsed.verb}' is not implemented yet
 `);
     return 1;
   }
   if (parsed.verb === "serve") {
-    const serveArgs = args2.slice(args2.indexOf("serve") + 1);
-    const serveOptions = parseServeFlags(serveArgs);
-    if (serveOptions.commands.length === 0 && serveOptions.toolTemplates.length === 0) {
-      await platform2.write(2, "mcpcat serve: no commands or --tool templates given\n");
-      return 2;
-    }
-    return runServe(platform2, serveOptions, version);
+    return dispatchServeVerb(platform2, args2, version);
   }
   if (!CLIENT_VERBS.has(parsed.verb)) {
     await platform2.write(2, `mcpcat: unknown command '${parsed.verb}'
@@ -5580,5 +6377,5 @@ function createHostPlatform() {
 // src/host.ts
 var platform = createHostPlatform();
 var args = process.argv.slice(2);
-var code = await run(platform, "0.5.0", args);
+var code = await run(platform, "0.6.0", args);
 process.exit(code);