@ai-ecoverse/mcpcat 0.7.0 → 0.9.0

package/dist/kernel/mcpcat.mjs

@@ -4899,6 +4899,197 @@ var init_portable = __esm({
   }
 });
 
+// src/args/coerce.ts
+function asSchemaObject(schema) {
+  return schema ?? {};
+}
+function emptyArgObject() {
+  return /* @__PURE__ */ Object.create(null);
+}
+function isUnsafeObjectKey(key) {
+  return key === "__proto__" || key === "prototype" || key === "constructor";
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) && value !== Object.prototype;
+}
+function splitFlag(a) {
+  const eq = a.indexOf("=");
+  if (eq > 2) return { key: a.slice(2, eq), inlineValue: a.slice(eq + 1) };
+  return { key: a.slice(2), inlineValue: void 0 };
+}
+function coerceScalar(raw, type) {
+  switch (type) {
+    case "integer": {
+      if (!/^-?\d+$/.test(raw)) return { ok: false, error: `expected integer, got "${raw}"` };
+      return { ok: true, value: Number(raw) };
+    }
+    case "number": {
+      const n = Number(raw);
+      if (!Number.isFinite(n)) return { ok: false, error: `expected number, got "${raw}"` };
+      return { ok: true, value: n };
+    }
+    case "boolean": {
+      if (raw === "true" || raw === "1" || raw === "yes") return { ok: true, value: true };
+      if (raw === "false" || raw === "0" || raw === "no") return { ok: true, value: false };
+      return { ok: false, error: `expected boolean, got "${raw}"` };
+    }
+    case "object":
+      return coerceJsonObject(raw);
+    default:
+      return { ok: true, value: raw };
+  }
+}
+function coerceJsonObject(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { ok: false, error: `expected object JSON, got "${raw}"` };
+  }
+  if (!isPlainObject(parsed)) {
+    return { ok: false, error: `expected object JSON, got "${raw}"` };
+  }
+  return { ok: true, value: parsed };
+}
+function resolveToolFlag(key, properties) {
+  if (Object.hasOwn(properties, key)) {
+    return { ok: true, rootKey: key, dottedPath: null, meta: properties[key] ?? {} };
+  }
+  const dot = key.indexOf(".");
+  if (dot <= 0) return { ok: false, error: `unknown flag: --${key}` };
+  const rootKey = key.slice(0, dot);
+  const rest = key.slice(dot + 1);
+  if (!Object.hasOwn(properties, rootKey) || rest.length === 0) {
+    return { ok: false, error: `unknown flag: --${key}` };
+  }
+  const parts = rest.split(".");
+  if (isUnsafeObjectKey(rootKey) || parts.some((p) => p.length === 0 || isUnsafeObjectKey(p))) {
+    return { ok: false, error: `unknown flag: --${key}` };
+  }
+  return { ok: true, rootKey, dottedPath: parts, meta: properties[rootKey] ?? {} };
+}
+function readFlagRaw(args, i, key, inlineValue, type, dottedPath) {
+  if (inlineValue !== void 0) {
+    return { ok: true, raw: inlineValue, nextIndex: i + 1, bareBoolean: false };
+  }
+  const next = args[i + 1];
+  if (!dottedPath && type === "boolean" && (next === void 0 || next.startsWith("--"))) {
+    return { ok: true, raw: "", nextIndex: i + 1, bareBoolean: true };
+  }
+  if (next === void 0) {
+    return { ok: false, error: `flag --${key} requires a value` };
+  }
+  return { ok: true, raw: next, nextIndex: i + 2, bareBoolean: false };
+}
+function setDotted(out, rootKey, path, value) {
+  if (isUnsafeObjectKey(rootKey) || path.some((p) => p.length === 0 || isUnsafeObjectKey(p))) {
+    return { ok: false, error: `unknown flag: --${rootKey}.${path.join(".")}` };
+  }
+  const existing = Object.hasOwn(out, rootKey) ? out[rootKey] : void 0;
+  if (existing === void 0) {
+    out[rootKey] = emptyArgObject();
+  } else if (!isPlainObject(existing)) {
+    return { ok: false, error: `--${rootKey}: cannot nest into a ${typeof existing} value` };
+  }
+  let cursor = out[rootKey];
+  for (let i = 0; i < path.length - 1; i++) {
+    const seg = path[i];
+    const next = Object.hasOwn(cursor, seg) ? cursor[seg] : void 0;
+    if (next === void 0) {
+      cursor[seg] = emptyArgObject();
+    } else if (!isPlainObject(next)) {
+      return {
+        ok: false,
+        error: `--${rootKey}.${path.slice(0, i + 1).join(".")}: cannot nest into a ${typeof next} value`
+      };
+    }
+    cursor = cursor[seg];
+  }
+  cursor[path[path.length - 1]] = value;
+  return { ok: true };
+}
+function assignFlagValue(out, rootKey, dottedPath, value, isArray) {
+  if (dottedPath) return setDotted(out, rootKey, dottedPath, value);
+  if (isArray) {
+    const prev = out[rootKey];
+    if (Array.isArray(prev)) prev.push(value);
+    else out[rootKey] = [value];
+    return { ok: true };
+  }
+  const existing = out[rootKey];
+  if (isPlainObject(existing) && isPlainObject(value)) {
+    Object.assign(existing, value);
+    return { ok: true };
+  }
+  out[rootKey] = value;
+  return { ok: true };
+}
+function parseOneFlag(args, i, properties, out) {
+  const a = args[i];
+  if (a === "--") return { ok: true, nextIndex: args.length };
+  if (a.startsWith("--no-") && a.length > 5) {
+    const key2 = a.slice(5);
+    if (Object.hasOwn(properties, key2) && properties[key2]?.type === "boolean") {
+      out[key2] = false;
+      return { ok: true, nextIndex: i + 1 };
+    }
+    return { ok: false, error: `unknown flag: ${a}` };
+  }
+  if (!a.startsWith("--")) {
+    return { ok: false, error: `unexpected positional argument "${a}"` };
+  }
+  const { key, inlineValue } = splitFlag(a);
+  const resolved = resolveToolFlag(key, properties);
+  if (!resolved.ok) return resolved;
+  const { rootKey, dottedPath, meta } = resolved;
+  const declaredType = meta.type;
+  const type = declaredType ?? "string";
+  const isArray = type === "array";
+  const itemType = (isArray ? meta.items?.type : void 0) ?? "string";
+  if (dottedPath && declaredType !== void 0 && declaredType !== "object") {
+    return { ok: false, error: `unknown flag: --${key}` };
+  }
+  const taken = readFlagRaw(args, i, key, inlineValue, type, dottedPath);
+  if (!taken.ok) return taken;
+  if (taken.bareBoolean) {
+    out[rootKey] = true;
+    return { ok: true, nextIndex: taken.nextIndex };
+  }
+  const valueType = dottedPath ? "string" : isArray ? itemType : type;
+  const coerced = coerceScalar(taken.raw, valueType);
+  if (!coerced.ok) return { ok: false, error: `--${key}: ${coerced.error}` };
+  const assigned = assignFlagValue(out, rootKey, dottedPath, coerced.value, isArray);
+  if (!assigned.ok) return assigned;
+  return { ok: true, nextIndex: taken.nextIndex };
+}
+function coerceArgsBySchema(args, schema, options) {
+  const s = asSchemaObject(schema);
+  const properties = s.properties ?? {};
+  const required = new Set(Array.isArray(s.required) ? s.required : []);
+  const out = emptyArgObject();
+  let i = 0;
+  while (i < args.length) {
+    const result = parseOneFlag(args, i, properties, out);
+    if (!result.ok) return result;
+    i = result.nextIndex;
+  }
+  if (!options?.noValidate) {
+    for (const r of required) {
+      if (!Object.hasOwn(out, r)) {
+        return { ok: false, error: `missing required flag --${r}` };
+      }
+    }
+  }
+  return { ok: true, value: out };
+}
+function mergeArgs(base, flags) {
+  const result = { ...base };
+  for (const [k, v] of Object.entries(flags)) {
+    result[k] = v;
+  }
+  return result;
+}
+
 // node_modules/@earendil-works/pi-mcp/dist/protocol/jsonrpc.js
 var JSON_RPC_ERROR_CODES = {
   parseError: -32700,
@@ -6252,67 +6443,6 @@ var PlatformStdioTransport = class {
   }
 };
 
-// src/client/pi-connection.ts
-async function createPiConnection(options) {
-  const clientOptions = {
-    name: "mcpcat",
-    version: options.version ?? "0.0.0"
-  };
-  const client = new McpClient(clientOptions);
-  let transport;
-  if (options.url) {
-    transport = new StreamableHttpTransport({
-      url: options.url,
-      headers: options.headers,
-      fetch: options.fetchImpl
-    });
-  } else if (options.command) {
-    if (options.platform) {
-      transport = new PlatformStdioTransport({
-        command: options.command,
-        args: options.args,
-        env: options.env,
-        cwd: options.cwd,
-        inheritEnv: true,
-        platform: options.platform
-      });
-    } else {
-      transport = new StdioTransport({
-        command: options.command,
-        args: options.args,
-        env: options.env,
-        cwd: options.cwd,
-        inheritEnv: true,
-        stderr: "pipe"
-      });
-    }
-  } else {
-    throw new Error("PiConnection requires either a url or a command");
-  }
-  const initResult = await client.connect(transport);
-  return {
-    async info() {
-      return {
-        name: initResult.serverInfo?.name,
-        version: initResult.serverInfo?.version,
-        title: initResult.serverInfo?.title,
-        protocolVersion: initResult.protocolVersion,
-        capabilities: initResult.capabilities,
-        instructions: initResult.instructions
-      };
-    },
-    async listTools() {
-      return client.listTools();
-    },
-    async callTool(name, args) {
-      return client.callTool(name, args);
-    },
-    async close() {
-      await client.close();
-    }
-  };
-}
-
 // src/client/stateless-connection.ts
 var STATELESS_PROTOCOL_VERSION = "2026-07-28";
 var StatelessRpcError = class extends Error {
@@ -6341,6 +6471,22 @@ var InputRequiredError = class extends Error {
     this.requestJson = requestJson;
   }
 };
+var McpTimeoutError2 = class extends Error {
+  constructor(method, ms) {
+    super(`timeout after ${ms}ms waiting for ${method}`);
+    this.name = "McpTimeoutError";
+  }
+};
+var McpAuthError = class extends Error {
+  status;
+  target;
+  constructor(status, target) {
+    super(`HTTP ${status}: authentication required. Run: mcpcat login ${target}`);
+    this.name = "McpAuthError";
+    this.status = status;
+    this.target = target;
+  }
+};
 function selectSseFrame(body, targetId) {
   const text = new TextDecoder().decode(body);
   const blocks = text.replace(/\r\n/g, "\n").split(/\n\n/);
@@ -6371,25 +6517,66 @@ async function createStatelessConnection(options) {
     headers: extraHeaders,
     fetchImpl,
     timeoutMs = 6e4,
-    clientInfo = { name: "mcpcat", version: "0.0.0" }
+    clientInfo = { name: "mcpcat", version: "0.0.0" },
+    signal: externalSignal,
+    verbose
   } = options;
   let nextId2 = 1;
   let negotiatedVersion;
-  async function request(method, params) {
-    const id = nextId2++;
-    const headers = {
+  function buildHeaders(method, params) {
+    const h = {
       "Content-Type": "application/json",
       Accept: "application/json, text/event-stream",
       "Mcp-Method": method,
       ...extraHeaders
     };
-    const mcpName = mcpNameForMethod(method, params);
-    if (mcpName) {
-      headers["Mcp-Name"] = mcpName;
+    const n = mcpNameForMethod(method, params);
+    if (n) h["Mcp-Name"] = n;
+    if (negotiatedVersion) h["Mcp-Protocol-Version"] = negotiatedVersion;
+    return h;
+  }
+  function makeAbort() {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    if (externalSignal) {
+      if (externalSignal.aborted) {
+        clearTimeout(timer);
+        controller.abort();
+      } else {
+        externalSignal.addEventListener(
+          "abort",
+          () => {
+            clearTimeout(timer);
+            controller.abort();
+          },
+          { once: true }
+        );
+      }
+    }
+    return { controller, timer };
+  }
+  function logHeaders(dir, entries) {
+    if (!verbose?.enabled) return;
+    for (const [k, v] of entries) {
+      if (dir === ">") verbose.headerOut(k, v);
+      else verbose.headerIn(k, v);
     }
-    if (negotiatedVersion) {
-      headers["Mcp-Protocol-Version"] = negotiatedVersion;
+  }
+  async function handleErrorStatus(res, method) {
+    if (res.status === 401 || res.status === 403) throw new McpAuthError(res.status, url);
+    const text = await res.text();
+    let rpc;
+    try {
+      const p = JSON.parse(text);
+      if (p.error && typeof p.error.code === "number") rpc = p.error;
+    } catch {
     }
+    if (rpc) throw new StatelessRpcError(rpc.code, rpc.message, rpc.data);
+    throw new StatelessHttpError(res.status, res.statusText, method, text.slice(0, 512));
+  }
+  async function request(method, params) {
+    const id = nextId2++;
+    const headers = buildHeaders(method, params);
     const meta = {
       protocolVersion: negotiatedVersion ?? STATELESS_PROTOCOL_VERSION,
       clientInfo
@@ -6400,8 +6587,11 @@ async function createStatelessConnection(options) {
       method,
       params: { ...params, _meta: meta }
     });
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    if (verbose?.enabled) {
+      verbose.request(method, body);
+      logHeaders(">", Object.entries(headers));
+    }
+    const { controller, timer } = makeAbort();
     let res;
     try {
       res = await fetchImpl(url, {
@@ -6410,35 +6600,28 @@ async function createStatelessConnection(options) {
         body,
         signal: controller.signal
       });
+    } catch (err) {
+      clearTimeout(timer);
+      if (controller.signal.aborted && !externalSignal?.aborted) {
+        throw new McpTimeoutError2(method, timeoutMs);
+      }
+      throw err;
     } finally {
       clearTimeout(timer);
     }
-    if (res.status === 401) {
-      throw new StatelessHttpError(401, "Unauthorized", method, "");
-    }
-    if (res.status >= 400) {
-      const text = await res.text();
-      let rpcError2;
-      try {
-        const parsed = JSON.parse(text);
-        if (parsed.error && typeof parsed.error.code === "number") {
-          rpcError2 = parsed.error;
-        }
-      } catch {
-      }
-      if (rpcError2) {
-        throw new StatelessRpcError(rpcError2.code, rpcError2.message, rpcError2.data);
-      }
-      throw new StatelessHttpError(res.status, res.statusText, method, text.slice(0, 512));
+    if (verbose?.enabled) {
+      verbose.http("<", `HTTP/1.1 ${res.status} ${res.statusText}`);
+      logHeaders("<", res.headers.entries());
     }
+    if (res.status >= 400) await handleErrorStatus(res, method);
     const ct = res.headers.get("content-type") ?? "";
     let frame;
     if (ct.toLowerCase().includes("text/event-stream")) {
-      const bytes = new Uint8Array(await res.arrayBuffer());
-      frame = selectSseFrame(bytes, id);
+      frame = selectSseFrame(new Uint8Array(await res.arrayBuffer()), id);
     } else {
       frame = await res.json();
     }
+    if (verbose?.enabled) verbose.response(JSON.stringify(frame));
     if (frame.error) {
       throw new StatelessRpcError(frame.error.code, frame.error.message, frame.error.data);
     }
@@ -6458,28 +6641,26 @@ async function createStatelessConnection(options) {
   return {
     async info() {
       if (serverInfoCache) return serverInfoCache;
-      const result = discoverResult2;
+      const r = discoverResult2;
       serverInfoCache = {
-        name: result?.serverInfo?.name,
-        version: result?.serverInfo?.version,
-        title: result?.serverInfo?.title,
+        name: r?.serverInfo?.name,
+        version: r?.serverInfo?.version,
+        title: r?.serverInfo?.title,
         protocolVersion: STATELESS_PROTOCOL_VERSION,
-        capabilities: result?.capabilities ?? {},
-        instructions: result?.instructions
+        capabilities: r?.capabilities ?? {},
+        instructions: r?.instructions
       };
       return serverInfoCache;
     },
     async listTools() {
-      const result = await request("tools/list", {});
-      return result?.tools ?? [];
+      return (await request("tools/list", {}))?.tools ?? [];
     },
-    async callTool(name, args) {
+    async callTool(name, args, _callOptions) {
       const result = await request("tools/call", {
         name,
         arguments: args ?? {}
       });
-      const resultType = result.resultType ?? "complete";
-      if (resultType === "input_required") {
+      if ((result.resultType ?? "complete") === "input_required") {
         throw new InputRequiredError(
           JSON.stringify({ name, arguments: args ?? {}, result }, null, 2)
         );
@@ -6491,28 +6672,138 @@ async function createStatelessConnection(options) {
   };
 }
 
+// src/client/pi-connection.ts
+function buildStderrHandler(options) {
+  if (!options.verbose?.enabled) return void 0;
+  return (chunk) => {
+    for (const l of chunk.split("\n")) {
+      if (l.trim()) options.verbose.server(l);
+    }
+  };
+}
+function buildTransport(options) {
+  if (options.url) {
+    return new StreamableHttpTransport({
+      url: options.url,
+      headers: options.headers,
+      fetch: options.fetchImpl
+    });
+  }
+  if (!options.command) throw new Error("PiConnection requires either a url or a command");
+  if (options.platform) {
+    return new PlatformStdioTransport({
+      command: options.command,
+      args: options.args,
+      env: options.env,
+      cwd: options.cwd,
+      inheritEnv: true,
+      platform: options.platform,
+      onStderr: buildStderrHandler(options)
+    });
+  }
+  return new StdioTransport({
+    command: options.command,
+    args: options.args,
+    env: options.env,
+    cwd: options.cwd,
+    inheritEnv: true,
+    stderr: "pipe",
+    onStderr: buildStderrHandler(options)
+  });
+}
+async function createPiConnection(options) {
+  const clientOptions = {
+    name: "mcpcat",
+    version: options.version ?? "0.0.0",
+    requestTimeoutMs: options.timeoutMs
+  };
+  const client = new McpClient(clientOptions);
+  const transport = buildTransport(options);
+  if (options.verbose?.enabled) {
+    transport.onMessage((msg) => {
+      options.verbose.response(JSON.stringify(msg));
+    });
+  }
+  try {
+    let reqOpts2 = function() {
+      const o = {};
+      if (options.signal) o.signal = options.signal;
+      if (options.verbose?.enabled) {
+        o.onProgress = (p) => {
+          options.verbose.progress(`progress: ${p.message ?? ""}`);
+        };
+      }
+      return o;
+    };
+    var reqOpts = reqOpts2;
+    const initResult = await client.connect(transport);
+    return {
+      async info() {
+        return {
+          name: initResult.serverInfo?.name,
+          version: initResult.serverInfo?.version,
+          title: initResult.serverInfo?.title,
+          protocolVersion: initResult.protocolVersion,
+          capabilities: initResult.capabilities,
+          instructions: initResult.instructions
+        };
+      },
+      async listTools() {
+        return client.listTools(reqOpts2());
+      },
+      async callTool(name, args, callOptions) {
+        const o = reqOpts2();
+        if (callOptions?.onProgress) {
+          const outer = callOptions.onProgress;
+          const inner = o.onProgress;
+          o.onProgress = (p) => {
+            outer(p.progress, p.total, p.message);
+            inner?.(p);
+          };
+        }
+        return client.callTool(name, args, o);
+      },
+      async close() {
+        await client.close();
+      }
+    };
+  } catch (err) {
+    const msg = err.message ?? "";
+    if (msg.includes("401") || msg.includes("403") || msg.includes("Unauthorized")) {
+      throw new McpAuthError(401, options.url ?? options.command ?? "");
+    }
+    if (msg.includes("timeout") || msg.includes("Timeout") || msg.includes("ETIMEDOUT")) {
+      throw new McpTimeoutError2("connect", options.timeoutMs ?? 6e4);
+    }
+    throw err;
+  }
+}
+
 // src/client/connect.ts
 async function connect(platform2, options) {
+  const shared = {
+    version: options.version,
+    timeoutMs: options.timeoutMs,
+    signal: options.signal,
+    verbose: options.verbose,
+    platform: platform2
+  };
   if (options.command) {
     return createPiConnection({
       command: options.command,
       args: options.args,
       env: options.env,
       cwd: options.cwd,
-      version: options.version,
-      platform: platform2
+      ...shared
     });
   }
-  if (!options.url) {
-    throw new Error("connect requires either a url or a command");
-  }
+  if (!options.url) throw new Error("connect requires either a url or a command");
   if (options.protocolVersion && !options.protocolVersion.startsWith("2026")) {
     return createPiConnection({
       url: options.url,
       headers: options.headers,
-      version: options.version,
       fetchImpl: platform2.fetch,
-      platform: platform2
+      ...shared
     });
   }
   try {
@@ -6520,20 +6811,20 @@ async function connect(platform2, options) {
       url: options.url,
       headers: options.headers,
       fetchImpl: platform2.fetch,
-      clientInfo: { name: "mcpcat", version: options.version ?? "0.0.0" }
+      clientInfo: { name: "mcpcat", version: options.version ?? "0.0.0" },
+      timeoutMs: options.timeoutMs,
+      signal: options.signal,
+      verbose: options.verbose
     });
   } catch (err) {
     const isMethodNotFound = err instanceof StatelessRpcError && err.code === -32601 || err instanceof StatelessHttpError && err.status >= 400 && err.status < 500;
-    if (options.protocolVersion?.startsWith("2026")) {
-      throw err;
-    }
+    if (options.protocolVersion?.startsWith("2026")) throw err;
     if (isMethodNotFound) {
       return createPiConnection({
         url: options.url,
         headers: options.headers,
-        version: options.version,
         fetchImpl: platform2.fetch,
-        platform: platform2
+        ...shared
       });
     }
     throw err;
@@ -7085,6 +7376,28 @@ async function readStream(stream) {
   return new TextDecoder().decode(merged);
 }
 
+// src/config/expand.ts
+var PLACEHOLDER = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
+var PLACEHOLDER_TEST = /\$\{[A-Za-z_][A-Za-z0-9_]*\}/;
+function containsPlaceholders(value) {
+  return PLACEHOLDER_TEST.test(value);
+}
+function expandPlaceholders(value, env2) {
+  return value.replace(PLACEHOLDER, (_, name) => env2[name] ?? "");
+}
+function expandPlaceholdersStrict(value, env2) {
+  let hasUndefined = false;
+  const result = value.replace(PLACEHOLDER, (_, name) => {
+    if (env2[name] === void 0) {
+      hasUndefined = true;
+      return "";
+    }
+    return env2[name];
+  });
+  if (hasUndefined) return void 0;
+  return result;
+}
+
 // src/config/parse.ts
 var SERVER_NAME = /^[A-Za-z0-9_-]+$/;
 var EXPOSURES = ["codemode", "deferred", "direct", "hidden"];
@@ -8321,23 +8634,98 @@ async function runDiscover(platform2, args) {
   return 0;
 }
 
-// src/config/expand.ts
-var PLACEHOLDER = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
-var PLACEHOLDER_TEST = /\$\{[A-Za-z_][A-Za-z0-9_]*\}/;
-function containsPlaceholders(value) {
-  return PLACEHOLDER_TEST.test(value);
+// src/render/result.ts
+function formatBytes(n) {
+  if (n < 1024) return `${n} bytes`;
+  const kb = n / 1024;
+  if (kb < 1024) return `${kb.toFixed(1)} KB`;
+  return `${(kb / 1024).toFixed(1)} MB`;
+}
+function truncateMiddle(text, max) {
+  if (text.length <= max) return text;
+  const half = Math.floor((max - 5) / 2);
+  return `${text.slice(0, half)}
+[\u2026]
+${text.slice(-half)}`;
+}
+function renderContentBlock(block) {
+  if (block.type === "text") return block.text;
+  if (block.type === "image") {
+    const size = formatBytes(Math.ceil(block.data.length * 3 / 4));
+    return `[image: ${block.mimeType}, ${size}]`;
+  }
+  if (block.type === "audio") {
+    const audioBlock = block;
+    const size = formatBytes(Math.ceil(audioBlock.data.length * 3 / 4));
+    return `[audio: ${audioBlock.mimeType}, ${size}]`;
+  }
+  if (block.type === "resource_link") return `[resource: ${block.uri}]`;
+  if (block.type === "resource") {
+    return "text" in block.resource ? block.resource.text : `[blob: ${block.resource.uri}]`;
+  }
+  return void 0;
 }
-function expandPlaceholdersStrict(value, env2) {
-  let hasUndefined = false;
-  const result = value.replace(PLACEHOLDER, (_, name) => {
-    if (env2[name] === void 0) {
-      hasUndefined = true;
-      return "";
+function renderCallResultText(result, options) {
+  const parts = [];
+  if (result.content) {
+    for (const block of result.content) {
+      const rendered = renderContentBlock(block);
+      if (rendered !== void 0) parts.push(rendered);
     }
-    return env2[name];
-  });
-  if (hasUndefined) return void 0;
-  return result;
+  }
+  if (parts.length === 0 && result.structuredContent !== void 0) {
+    parts.push(JSON.stringify(result.structuredContent, null, 2));
+  }
+  let text = parts.join("\n");
+  if (options?.maxChars && text.length > options.maxChars) {
+    text = truncateMiddle(text, options.maxChars);
+  }
+  return text;
+}
+function renderCallResultJson(result) {
+  return JSON.stringify(result, null, 2);
+}
+async function renderCallResult(platform2, result, options) {
+  if (options?.json) {
+    const json = renderCallResultJson(result);
+    if (result.isError) {
+      await platform2.write(
+        2,
+        `${JSON.stringify({ error: { kind: "tool_error", message: json } }, null, 2)}
+`
+      );
+      return 1;
+    }
+    await platform2.write(1, `${json}
+`);
+    return 0;
+  }
+  const text = renderCallResultText(result, options);
+  if (result.isError) {
+    await platform2.write(2, `${text || "(tool reported error)"}
+`);
+    return 1;
+  }
+  if (text) {
+    await platform2.write(1, `${text}
+`);
+  }
+  return 0;
+}
+async function renderToolsJson(platform2, tools) {
+  await platform2.write(1, `${JSON.stringify({ tools }, null, 2)}
+`);
+}
+async function renderInfoJson(platform2, info) {
+  await platform2.write(1, `${JSON.stringify(info, null, 2)}
+`);
+}
+async function renderErrorJson(platform2, kind, message, code, data) {
+  const errorObj = { kind, message };
+  if (code !== void 0) errorObj.code = code;
+  if (data !== void 0) errorObj.data = data;
+  await platform2.write(2, `${JSON.stringify({ error: errorObj }, null, 2)}
+`);
 }
 
 // src/serve/catalog.ts
@@ -9140,28 +9528,230 @@ function checkHost(host, boundLoopback) {
   return { ok: false, reason: `host ${host} is not loopback` };
 }
 
-// src/serve/runtime.ts
-var CALL_TIMEOUT_MS = 12e4;
-var MAX_OUTPUT_DEFAULT = 1048576;
-var ALLOWED_ENV_KEYS = /* @__PURE__ */ new Set(["PATH", "HOME", "LANG"]);
-function parseHttpFlag(args, i) {
-  const next = args[i + 1];
-  if (!next || next.startsWith("-")) return { host: "127.0.0.1", port: 0, next: i };
-  const colonIdx = next.lastIndexOf(":");
-  if (colonIdx > 0 && colonIdx < next.length - 1) {
-    return { host: next.slice(0, colonIdx), port: Number(next.slice(colonIdx + 1)), next: i + 1 };
-  }
-  return { host: "127.0.0.1", port: Number(next), next: i + 1 };
+// src/serve/proxy.ts
+var IDEMPOTENT_METHODS = /* @__PURE__ */ new Set([
+  "initialize",
+  "server/discover",
+  "tools/list",
+  "resources/list",
+  "prompts/list",
+  "ping"
+]);
+var PROTOCOL_VERSIONS2 = ["2026-07-28", "2025-11-25", "2025-06-18"];
+var JSON_CT2 = "application/json; charset=utf-8";
+function readId2(value) {
+  const id = Object.getOwnPropertyDescriptor(value, "id")?.value;
+  if (typeof id === "string" || typeof id === "number" || id === null) return id;
+  return null;
 }
-function parseCommandTarget(arg) {
-  const eqIdx = arg.indexOf("=");
-  if (eqIdx > 0 && !arg.slice(0, eqIdx).includes("/")) {
-    return { name: arg.slice(0, eqIdx), path: arg.slice(eqIdx + 1) };
-  }
-  return { path: arg };
+function readString2(value, key) {
+  const found = Object.getOwnPropertyDescriptor(value, key)?.value;
+  return typeof found === "string" ? found : void 0;
 }
-function parseSingleFlag(args, i, opts) {
-  const arg = args[i];
+function hasOwn2(value, key) {
+  return Object.prototype.hasOwnProperty.call(value, key);
+}
+function rpcOk2(id, result) {
+  return {
+    status: 200,
+    contentType: JSON_CT2,
+    body: JSON.stringify({ jsonrpc: "2.0", id, result })
+  };
+}
+function rpcError2(id, code, message) {
+  return {
+    status: 200,
+    contentType: JSON_CT2,
+    body: JSON.stringify({ jsonrpc: "2.0", id, error: { code, message } })
+  };
+}
+function scrubValue(value, secrets) {
+  if (typeof value === "string") return scrubString(value, secrets);
+  if (Array.isArray(value)) return value.map((v) => scrubValue(v, secrets));
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = scrubValue(v, secrets);
+    }
+    return out;
+  }
+  return value;
+}
+function scrubString(s, secrets) {
+  let result = s;
+  for (const h of secrets) {
+    if (result.includes(h)) {
+      result = result.replaceAll(h, "***");
+    }
+  }
+  return result;
+}
+function translateCapabilities(info) {
+  const caps = {};
+  if (info.capabilities.tools) caps.tools = { listChanged: false };
+  if (info.capabilities.resources) caps.resources = { listChanged: false };
+  if (info.capabilities.prompts) caps.prompts = { listChanged: false };
+  return caps;
+}
+function buildServerResult(info, protocolVersion) {
+  return {
+    protocolVersion,
+    capabilities: translateCapabilities(info),
+    serverInfo: {
+      name: info.name ?? "mcpcat-proxy",
+      version: info.version ?? "0.0.0",
+      ...info.title ? { title: info.title } : {}
+    },
+    ...info.instructions ? { instructions: info.instructions } : {}
+  };
+}
+function createProxyHandler(options) {
+  let conn = null;
+  let cachedInfo = null;
+  let connecting = null;
+  const secrets = options.hiddenHeaders;
+  async function doConnect() {
+    const c = await connect(options.platform, options.connectOpts);
+    cachedInfo = await c.info();
+    return c;
+  }
+  async function getConnection() {
+    if (conn) return conn;
+    if (connecting !== null) return connecting;
+    connecting = doConnect();
+    try {
+      conn = await connecting;
+      return conn;
+    } finally {
+      connecting = null;
+    }
+  }
+  async function reconnect() {
+    if (conn) {
+      try {
+        await conn.close();
+      } catch {
+      }
+    }
+    conn = null;
+    cachedInfo = null;
+    return getConnection();
+  }
+  function scrubOk(id, result) {
+    return rpcOk2(id, scrubValue(result, secrets));
+  }
+  function scrubErr(id, code, message) {
+    return rpcError2(id, code, scrubString(message, secrets));
+  }
+  function handleInitialize(id, params) {
+    const requested = params && typeof params === "object" ? Object.getOwnPropertyDescriptor(params, "protocolVersion")?.value : void 0;
+    const pv = PROTOCOL_VERSIONS2.find((v) => v === requested) ?? PROTOCOL_VERSIONS2[0];
+    return scrubOk(id, buildServerResult(cachedInfo, pv));
+  }
+  function handleDiscover(id) {
+    return scrubOk(id, {
+      ...buildServerResult(cachedInfo, PROTOCOL_VERSIONS2[0]),
+      supportedVersions: PROTOCOL_VERSIONS2
+    });
+  }
+  async function forwardWithRetry(method, doForward, id) {
+    try {
+      return scrubOk(id, await doForward());
+    } catch (err) {
+      if (!IDEMPOTENT_METHODS.has(method)) {
+        return scrubErr(id, -32e3, err.message);
+      }
+      try {
+        await reconnect();
+        return scrubOk(id, await doForward());
+      } catch (retryErr) {
+        return scrubErr(id, -32e3, retryErr.message);
+      }
+    }
+  }
+  async function handleCall(id, params, c) {
+    const name = params && typeof params === "object" ? readString2(params, "name") : void 0;
+    if (!name) return scrubErr(id, -32602, "tools/call requires a name");
+    const args = params && typeof params === "object" ? Object.getOwnPropertyDescriptor(params, "arguments")?.value : void 0;
+    try {
+      return scrubOk(id, await c.callTool(name, args));
+    } catch (err) {
+      return scrubErr(id, -32e3, err.message);
+    }
+  }
+  async function dispatch(method, id, params) {
+    try {
+      await getConnection();
+    } catch (err) {
+      if (method === "ping") return rpcOk2(id, {});
+      return scrubErr(id, -32e3, `upstream connection failed: ${err.message}`);
+    }
+    if (method === "initialize") return handleInitialize(id, params);
+    if (method === "server/discover") return handleDiscover(id);
+    if (method === "ping") return rpcOk2(id, {});
+    if (method === "tools/list") {
+      return forwardWithRetry(
+        method,
+        async () => {
+          const tools = await (await getConnection()).listTools();
+          return { tools };
+        },
+        id
+      );
+    }
+    if (method === "tools/call") return handleCall(id, params, conn);
+    return scrubErr(id, -32601, `Method not found: ${method}`);
+  }
+  async function handle(raw) {
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      return rpcError2(null, -32700, "Parse error");
+    }
+    if (Array.isArray(parsed)) return rpcError2(null, -32600, "Batch requests are not supported");
+    if (!parsed || typeof parsed !== "object") return rpcError2(null, -32600, "Invalid request");
+    const method = readString2(parsed, "method");
+    if (!method) return rpcError2(readId2(parsed), -32600, "Invalid request");
+    if (!hasOwn2(parsed, "id")) return { status: 202, contentType: "text/plain", body: "" };
+    const id = readId2(parsed);
+    const params = Object.getOwnPropertyDescriptor(parsed, "params")?.value;
+    return dispatch(method, id, params);
+  }
+  async function shutdown() {
+    if (conn) {
+      try {
+        await conn.close();
+      } catch {
+      }
+      conn = null;
+    }
+  }
+  return { handle, shutdown };
+}
+
+// src/serve/runtime.ts
+var CALL_TIMEOUT_MS = 12e4;
+var MAX_OUTPUT_DEFAULT = 1048576;
+var ALLOWED_ENV_KEYS = /* @__PURE__ */ new Set(["PATH", "HOME", "LANG"]);
+function parseHttpFlag(args, i) {
+  const next = args[i + 1];
+  if (!next || next.startsWith("-")) return { host: "127.0.0.1", port: 0, next: i };
+  const colonIdx = next.lastIndexOf(":");
+  if (colonIdx > 0 && colonIdx < next.length - 1) {
+    return { host: next.slice(0, colonIdx), port: Number(next.slice(colonIdx + 1)), next: i + 1 };
+  }
+  return { host: "127.0.0.1", port: Number(next), next: i + 1 };
+}
+function parseCommandTarget(arg) {
+  const eqIdx = arg.indexOf("=");
+  if (eqIdx > 0 && !arg.slice(0, eqIdx).includes("/")) {
+    return { name: arg.slice(0, eqIdx), path: arg.slice(eqIdx + 1) };
+  }
+  return { path: arg };
+}
+function parseSingleFlag(args, i, opts) {
+  const arg = args[i];
   if (arg === "--stdio") {
     opts.transport = "stdio";
   } else if (arg === "--http") {
@@ -9170,26 +9760,57 @@ function parseSingleFlag(args, i, opts) {
     opts.host = parsed.host;
     opts.port = parsed.port;
     return parsed.next;
-  } else if (arg === "--bearer" && args[i + 1]) {
-    opts.bearer = args[++i];
-  } else if (arg === "--allow-origin" && args[i + 1]) {
-    opts.allowOrigins.push(args[++i]);
-  } else if (arg === "--env" && args[i + 1]) {
-    opts.envAllow.push(args[++i]);
-  } else if (arg === "--tool" && args[i + 1]) {
-    opts.toolTemplates.push(args[++i]);
-  } else if (arg === "--call-timeout" && args[i + 1]) {
-    opts.callTimeout = Number(args[++i]) * 1e3;
-  } else if (arg === "--concurrency" && args[i + 1]) {
-    opts.concurrency = Number(args[++i]);
-  } else if (arg === "--max-output" && args[i + 1]) {
-    opts.maxOutput = Number(args[++i]);
-  } else if (arg === "--cwd" && args[i + 1]) {
-    opts.cwd = args[++i];
   } else if (arg === "--json") {
     opts.json = true;
   } else if (!arg.startsWith("-")) {
     opts.commands.push(parseCommandTarget(arg));
+  } else {
+    return parseValueFlag(args, i, opts);
+  }
+  return i;
+}
+function parseValueFlag(args, i, opts) {
+  const arg = args[i];
+  if (!args[i + 1]) return i;
+  switch (arg) {
+    case "--proxy":
+      opts.proxy = args[++i];
+      break;
+    case "--bearer":
+      opts.bearer = args[++i];
+      break;
+    case "--allow-origin":
+      opts.allowOrigins.push(args[++i]);
+      break;
+    case "--env":
+      opts.envAllow.push(args[++i]);
+      break;
+    case "--tool":
+      opts.toolTemplates.push(args[++i]);
+      break;
+    case "--call-timeout":
+      opts.callTimeout = Number(args[++i]) * 1e3;
+      break;
+    case "--concurrency":
+      opts.concurrency = Number(args[++i]);
+      break;
+    case "--max-output":
+      opts.maxOutput = Number(args[++i]);
+      break;
+    case "--cwd":
+      opts.cwd = args[++i];
+      break;
+    case "-H":
+    case "--header": {
+      const hdr = args[++i];
+      const colonIdx = hdr.indexOf(":");
+      if (colonIdx > 0) {
+        opts.proxyHeaders.push([hdr.slice(0, colonIdx).trim(), hdr.slice(colonIdx + 1).trim()]);
+      }
+      break;
+    }
+    default:
+      break;
   }
   return i;
 }
@@ -9207,7 +9828,9 @@ function parseServeFlags(args) {
     maxOutput: MAX_OUTPUT_DEFAULT,
     cwd: void 0,
     json: false,
-    commands: []
+    commands: [],
+    proxy: void 0,
+    proxyHeaders: []
   };
   for (let i = 0; i < args.length; i++) {
     i = parseSingleFlag(args, i, opts);
@@ -9534,6 +10157,9 @@ async function runServe(platform2, options, version) {
     }
     resolvedBearer = expanded;
   }
+  if (options.proxy) {
+    return runProxyServe(platform2, options, version, resolvedBearer);
+  }
   const serveCwd = options.cwd ?? platform2.cwd;
   const childEnv = buildChildEnv(platform2, options.envAllow);
   const clis = [];
@@ -9572,6 +10198,240 @@ async function runServe(platform2, options, version) {
     resolvedBearer
   );
 }
+function resolveProxyStdio(target, version) {
+  const rest = target.slice(6);
+  const parts = rest.split(/\s+/).filter(Boolean);
+  return { command: parts[0], args: parts.slice(1), version };
+}
+function resolveProxyUrl(target, headers, version) {
+  const url = target.startsWith("http") ? target : `https://${target}`;
+  return { url, headers, version };
+}
+async function resolveProxyConfig(platform2, target, connectHeaders, hiddenValues, version) {
+  const config = await MergedConfigSource.load(platform2);
+  const entry = await config.get(target);
+  if (!entry) return `unknown target '${target}'`;
+  if ("url" in entry && entry.url) {
+    const merged = { ...entry.headers, ...connectHeaders };
+    if (entry.headers) {
+      for (const v of Object.values(entry.headers)) hiddenValues.add(v);
+    }
+    return { url: entry.url, headers: merged, version };
+  }
+  if ("command" in entry && entry.command) {
+    return {
+      command: entry.command,
+      args: entry.args,
+      env: entry.env,
+      cwd: entry.cwd,
+      version
+    };
+  }
+  return `target '${target}' has no url or command`;
+}
+async function buildProxyConnectOpts(platform2, options, version) {
+  const target = options.proxy;
+  const connectHeaders = {};
+  const hiddenValues = /* @__PURE__ */ new Set();
+  for (const [k, v] of options.proxyHeaders) {
+    const expanded = expandPlaceholdersStrict(v, platform2.env);
+    if (expanded === void 0) return { error: `unset variable in header '${k}'` };
+    const key = k.toLowerCase() === "authorization" ? "Authorization" : k;
+    connectHeaders[key] = expanded;
+    hiddenValues.add(expanded);
+  }
+  const isUrl = target.startsWith("http://") || target.startsWith("https://") || target.includes(".");
+  let connectOpts;
+  if (options.proxyCommand && options.proxyCommand.length > 0) {
+    connectOpts = {
+      command: options.proxyCommand[0],
+      args: options.proxyCommand.slice(1),
+      version
+    };
+  } else if (target.startsWith("stdio:")) {
+    connectOpts = resolveProxyStdio(target, version);
+  } else if (isUrl) {
+    connectOpts = resolveProxyUrl(target, connectHeaders, version);
+  } else {
+    const result = await resolveProxyConfig(
+      platform2,
+      target,
+      connectHeaders,
+      hiddenValues,
+      version
+    );
+    if (typeof result === "string") return { error: result };
+    connectOpts = result;
+  }
+  if (connectOpts.headers) {
+    for (const v of Object.values(connectOpts.headers)) {
+      if (v) hiddenValues.add(v);
+    }
+  }
+  return { connectOpts, hiddenValues };
+}
+async function runProxyServe(platform2, options, version, resolvedBearer) {
+  const built = await buildProxyConnectOpts(platform2, options, version);
+  if ("error" in built) {
+    await platform2.write(2, `mcpcat serve --proxy: ${built.error}
+`);
+    return 2;
+  }
+  const { connectOpts, hiddenValues } = built;
+  if (resolvedBearer) hiddenValues.add(resolvedBearer);
+  const proxy = createProxyHandler({
+    target: options.proxy,
+    connectOpts,
+    platform: platform2,
+    hiddenHeaders: hiddenValues
+  });
+  if (options.transport === "stdio") {
+    return runProxyStdio(platform2, proxy);
+  }
+  return runProxyHttp(platform2, options, proxy, resolvedBearer);
+}
+async function runProxyStdio(platform2, proxy) {
+  const reader = platform2.stdin.getReader();
+  let buffer = "";
+  const dec = new TextDecoder();
+  const enc = new TextEncoder();
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      buffer += dec.decode(value, { stream: true });
+      let nlIdx;
+      while ((nlIdx = buffer.indexOf("\n")) >= 0) {
+        const line = buffer.slice(0, nlIdx).trim();
+        buffer = buffer.slice(nlIdx + 1);
+        if (!line) continue;
+        const outcome = await proxy.handle(line);
+        if (outcome.status === 202) continue;
+        const writer = platform2.stdout.getWriter();
+        await writer.write(enc.encode(`${outcome.body}
+`));
+        writer.releaseLock();
+      }
+    }
+  } finally {
+    reader.releaseLock();
+    await proxy.shutdown();
+  }
+  return 0;
+}
+async function runProxyHttp(platform2, options, proxy, resolvedBearer) {
+  if (!platform2.listen) {
+    await platform2.write(2, "mcpcat serve --proxy: HTTP transport requires platform.listen\n");
+    return 3;
+  }
+  const boundLoopback = options.host === "127.0.0.1" || options.host === "localhost" || options.host === "::1";
+  if (!boundLoopback && !resolvedBearer) {
+    await platform2.write(
+      2,
+      "mcpcat serve --proxy: --bearer is required when binding off loopback\n"
+    );
+    return 2;
+  }
+  const allowedOrigins = new Set(options.allowOrigins);
+  const listener = await platform2.listen({
+    host: options.host,
+    port: options.port
+  });
+  const actualPort = listener.port;
+  const listenUrl = `http://${options.host}:${actualPort}/mcp`;
+  if (options.json) {
+    await platform2.write(1, `${JSON.stringify({ url: listenUrl })}
+`);
+  }
+  await platform2.write(2, `mcpcat serve --proxy: listening on ${listenUrl}
+`);
+  if (options.onListening) {
+    await options.onListening(actualPort);
+  }
+  let shutdownRequested = false;
+  const shutdown = () => {
+    if (shutdownRequested) return;
+    shutdownRequested = true;
+    listener.close();
+    void proxy.shutdown();
+  };
+  if (platform2.onSignal) {
+    platform2.onSignal("SIGINT", shutdown);
+    platform2.onSignal("SIGTERM", shutdown);
+  }
+  const handler = (request) => handleProxyMcpRequest(request, proxy, allowedOrigins, boundLoopback, resolvedBearer);
+  try {
+    for await (const connection of listener) {
+      if (shutdownRequested) break;
+      const conn = connection;
+      handleConnection(conn.readable, conn.writable, handler).catch(() => {
+      }).finally(() => {
+        try {
+          conn.close();
+        } catch {
+        }
+      });
+    }
+  } catch {
+    if (!shutdownRequested) throw new Error("listener closed unexpectedly");
+  }
+  return 0;
+}
+async function handleProxyMcpRequest(request, proxy, allowedOrigins, boundLoopback, resolvedBearer) {
+  if (resolvedBearer) {
+    const authHeader = request.headers.authorization;
+    const provided = authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : "";
+    if (!provided || !constantTimeEqual(provided, resolvedBearer)) {
+      return {
+        status: 401,
+        reason: "Unauthorized",
+        headers: { "content-type": "text/plain" },
+        body: "Unauthorized"
+      };
+    }
+  }
+  const originCheck = checkOrigin(request.headers.origin, allowedOrigins, boundLoopback);
+  if (!originCheck.ok) {
+    return {
+      status: 403,
+      reason: "Forbidden",
+      headers: { "content-type": "text/plain" },
+      body: originCheck.reason ?? "Forbidden"
+    };
+  }
+  const hostCheck = checkHost(request.headers.host, boundLoopback);
+  if (!hostCheck.ok) {
+    return {
+      status: 403,
+      reason: "Forbidden",
+      headers: { "content-type": "text/plain" },
+      body: hostCheck.reason ?? "Forbidden"
+    };
+  }
+  if (request.target !== "/mcp") {
+    return {
+      status: 404,
+      reason: "Not Found",
+      headers: { "content-type": "text/plain" },
+      body: "Not Found"
+    };
+  }
+  if (request.method !== "POST") {
+    return {
+      status: 405,
+      reason: "Method Not Allowed",
+      headers: { "content-type": "text/plain", allow: "POST" },
+      body: "Method Not Allowed"
+    };
+  }
+  const outcome = await proxy.handle(request.body);
+  return {
+    status: outcome.status,
+    reason: outcome.status === 200 ? "OK" : "Accepted",
+    headers: { "content-type": outcome.contentType },
+    body: outcome.body
+  };
+}
 async function runStdioServer(platform2, tools, call, serverName, version) {
   const reader = platform2.stdin.getReader();
   let buffer = "";
@@ -10078,6 +10938,14 @@ function parseAddFlagAt(flagArgs, i, flags) {
     flags.noProbe = true;
     return { next: i + 1 };
   }
+  if (arg === "--bridge") {
+    flags.bridge = true;
+    return { next: i + 1 };
+  }
+  if (arg === "--bearer" && i + 1 < flagArgs.length) {
+    flags.bearer = flagArgs[i + 1];
+    return { next: i + 2 };
+  }
   if (arg === "--config" && i + 1 < flagArgs.length) {
     flags.configFile = flagArgs[i + 1];
     return { next: i + 2 };
@@ -10114,6 +10982,7 @@ function parseAddFlags(args) {
   const flags = {
     local: false,
     noProbe: false,
+    bridge: false,
     headers: [],
     envPairs: [],
     positional: [],
@@ -10476,6 +11345,139 @@ async function runImport(platform2, args) {
   }
   return 0;
 }
+async function runBridge(platform2, args, version) {
+  if (platform2.kind === "host") {
+    await platform2.write(
+      2,
+      "mcpcat add --bridge: not available on the host.\nOn the host, add stdio entries directly with: mcpcat add <name> -- <cmd>\nTo expose a stdio server over HTTP: mcpcat serve --proxy <target> --http <port>\n"
+    );
+    return 2;
+  }
+  const flags = parseAddFlags(args);
+  if (typeof flags === "string") {
+    await platform2.write(2, `mcpcat add --bridge: ${flags}
+`);
+    return 2;
+  }
+  const name = flags.positional[0];
+  if (!name) {
+    await platform2.write(2, "mcpcat add --bridge: requires a server name\n");
+    return 2;
+  }
+  if (flags.cmdArgs.length === 0) {
+    await platform2.write(2, "mcpcat add --bridge: requires -- <command> [args...]\n");
+    return 2;
+  }
+  if (flags.bearer) {
+    await platform2.write(
+      2,
+      "mcpcat add --bridge: --bearer is not needed on the kernel loopback.\nThe kernel loopback is only reachable from inside the kernel and the agent.\n"
+    );
+    return 2;
+  }
+  const serveOptions = parseServeFlags(["--proxy", "__bridge__", "--http", "0", "--json"]);
+  serveOptions.proxyCommand = flags.cmdArgs;
+  const path = flags.configFile ?? (flags.local ? projectConfigPath(platform2) : userConfigPath(platform2));
+  serveOptions.onListening = async (actualPort) => {
+    const bridgeUrl = `http://${actualPort}.kernel.localhost/mcp`;
+    const httpConfig = { url: bridgeUrl };
+    if (flags.description) httpConfig.description = flags.description;
+    if (flags.exposure) httpConfig.exposure = flags.exposure;
+    const { replaced } = await addServer(platform2.fs, path, name, httpConfig);
+    await platform2.write(
+      1,
+      `${replaced ? "replaced" : "added"} ${name} in ${path}
+bridge does not survive a reload; runs in the foreground (start with &)
+`
+    );
+  };
+  return runServe(platform2, serveOptions, version);
+}
+
+// src/cli/exit-codes.ts
+var EXIT_OK = 0;
+var EXIT_TOOL_ERROR = 1;
+var EXIT_USAGE = 2;
+var EXIT_CONNECTION = 3;
+var EXIT_AUTH = 4;
+var EXIT_RPC_ERROR = 5;
+var EXIT_INPUT_REQUIRED = 6;
+var EXIT_TIMEOUT = 124;
+var EXIT_INTERRUPTED = 130;
+var McpcatError = class extends Error {
+  exitCode;
+  constructor(exitCode, message) {
+    super(message);
+    this.name = "McpcatError";
+    this.exitCode = exitCode;
+  }
+};
+
+// src/cli/verbose.ts
+var SENSITIVE_HEADER_RE = /^(authorization|cookie|proxy-authorization)$/i;
+var SENSITIVE_NAME_RE = /token|key|secret|password|session/i;
+function isSensitiveHeader(name) {
+  return SENSITIVE_HEADER_RE.test(name) || SENSITIVE_NAME_RE.test(name);
+}
+function redact(text, secrets) {
+  let result = text;
+  for (const secret of secrets) {
+    if (secret.length > 0) {
+      while (result.includes(secret)) {
+        result = result.replace(secret, "[REDACTED]");
+      }
+    }
+  }
+  return result;
+}
+function createVerboseLogger(platform2, enabled) {
+  const secrets = /* @__PURE__ */ new Set();
+  function write(line) {
+    const safe = redact(line, secrets);
+    platform2.write(2, `${safe}
+`).catch(() => {
+    });
+  }
+  return {
+    enabled,
+    secrets,
+    request(method, body) {
+      if (!enabled) return;
+      write(`> ${method}`);
+      for (const line of body.split("\n")) {
+        write(`> ${line}`);
+      }
+    },
+    response(body) {
+      if (!enabled) return;
+      for (const line of body.split("\n")) {
+        write(`< ${line}`);
+      }
+    },
+    http(direction, line) {
+      if (!enabled) return;
+      write(`${direction} ${line}`);
+    },
+    server(line) {
+      if (!enabled) return;
+      write(`[server] ${line}`);
+    },
+    headerOut(name, value) {
+      if (!enabled) return;
+      const display = isSensitiveHeader(name) ? "[REDACTED]" : redact(value, secrets);
+      write(`> ${name}: ${display}`);
+    },
+    headerIn(name, value) {
+      if (!enabled) return;
+      const display = isSensitiveHeader(name) ? "[REDACTED]" : redact(value, secrets);
+      write(`< ${name}: ${display}`);
+    },
+    progress(message) {
+      if (!enabled) return;
+      write(`* ${message}`);
+    }
+  };
+}
 
 // src/cli/main.ts
 var VERBS = [
@@ -10540,6 +11542,9 @@ Client verbs:
 
 Configuration verbs:
   add <name> <url>           Add a server to mcp.json
+  add <name> --bridge -- 
+    Bridge a stdio server to HTTP (kernel only,
+                             runs in foreground, does not survive reload)
   rm <name>                  Remove a server
   list                       List configured servers
   enable|disable <name>      Toggle a server
@@ -10549,7 +11554,7 @@ Configuration verbs:
   logout <target>            Remove tokens (not implemented yet)
 
 Server and code verbs:
-  serve [--stdio|--http] \u2026   Expose commands as MCP server
+  serve [--stdio|--http] \u2026   Expose commands or proxy upstream as MCP server
   code [-e src|file.js]      Run a codemode script
   grep <pattern> [target\u2026]   Search tools by name or description
   discover <url>             Find MCP servers at a URL
@@ -10591,6 +11596,8 @@ function parseFlags(args) {
   const serverTargets = [];
   let allowShell = false;
   let timeoutMs;
+  let verbose = false;
+  let silent = false;
   const positional = [];
   let trailingCommand;
   for (let i = 0; i < args.length; i++) {
@@ -10627,6 +11634,10 @@ function parseFlags(args) {
       serverTargets.push(args[++i]);
     } else if (arg === "--allow-shell") {
       allowShell = true;
+    } else if (arg === "-v" || arg === "--verbose") {
+      verbose = true;
+    } else if (arg === "--silent") {
+      silent = true;
     } else if ((arg === "-m" || arg === "--timeout") && args[i + 1]) {
       timeoutMs = Number(args[++i]) * 1e3;
     } else if (!arg.startsWith("-")) {
@@ -10647,6 +11658,8 @@ function parseFlags(args) {
     serverTargets,
     allowShell,
     timeoutMs,
+    verbose,
+    silent,
     positional,
     trailingCommand
   };
@@ -10695,7 +11708,9 @@ function parseArgs(args) {
     inlineSource: flags.inlineSource,
     serverTargets: flags.serverTargets,
     allowShell: flags.allowShell,
-    timeoutMs: flags.timeoutMs
+    timeoutMs: flags.timeoutMs,
+    verbose: flags.verbose,
+    silent: flags.silent
   };
 }
 function formatToolLine(tool) {
@@ -10719,26 +11734,6 @@ function formatToolSchema(tool) {
   }
   return lines.join("\n");
 }
-function renderCallResult(result) {
-  const parts = [];
-  if (result.content) {
-    for (const block of result.content) {
-      if (block.type === "text") parts.push(block.text);
-      else if (block.type === "image")
-        parts.push(`[image: ${block.mimeType}, ${Math.ceil(block.data.length * 3 / 4)} bytes]`);
-      else if (block.type === "resource_link") parts.push(`[resource: ${block.uri}]`);
-      else if (block.type === "resource") {
-        parts.push(
-          "text" in block.resource ? block.resource.text : `[blob: ${block.resource.uri}]`
-        );
-      }
-    }
-  }
-  if (parts.length === 0 && result.structuredContent !== void 0) {
-    parts.push(JSON.stringify(result.structuredContent, null, 2));
-  }
-  return parts.join("\n");
-}
 var NETWORK_HINT = "connection failed (use slicc-node, slicc-swift, or the browser extension for servers without CORS)";
 function transportHint(err) {
   if (err instanceof TypeError) {
@@ -10781,8 +11776,12 @@ async function readDataArg(platform2, dataArg) {
   }
   return JSON.parse(raw);
 }
-async function runInfo(platform2, conn) {
+async function runInfo(platform2, conn, json) {
   const info = await conn.info();
+  if (json) {
+    await renderInfoJson(platform2, info);
+    return EXIT_OK;
+  }
   const lines = [];
   if (info.name) lines.push(`Server: ${info.name}${info.version ? ` ${info.version}` : ""}`);
   if (info.title) lines.push(`Title: ${info.title}`);
@@ -10799,48 +11798,66 @@ async function runInfo(platform2, conn) {
   }
   await platform2.write(1, `${lines.join("\n")}
 `);
-  return 0;
+  return EXIT_OK;
 }
-async function runTools(platform2, conn) {
+async function runTools(platform2, conn, json) {
   const tools = await conn.listTools();
-  if (tools.length === 0) {
-    await platform2.write(1, "(no tools)\n");
-  } else {
-    await platform2.write(1, `${tools.map(formatToolLine).join("\n")}
-`);
+  if (json) {
+    await renderToolsJson(platform2, tools);
+    return EXIT_OK;
   }
-  return 0;
+  await platform2.write(
+    1,
+    tools.length === 0 ? "(no tools)\n" : `${tools.map(formatToolLine).join("\n")}
+`
+  );
+  return EXIT_OK;
 }
-async function runCall(platform2, conn, toolName, dataArg) {
-  let toolArgs = {};
+async function runCall(platform2, conn, toolName, dataArg, toolArgs, opts) {
+  let base = {};
   if (dataArg) {
     try {
-      toolArgs = await readDataArg(platform2, dataArg);
+      base = await readDataArg(platform2, dataArg);
     } catch (err) {
-      await platform2.write(2, `mcpcat: invalid -d argument: ${err.message}
-`);
-      return 2;
+      await writeErr(
+        platform2,
+        opts.json ?? false,
+        "usage",
+        `invalid -d argument: ${err.message}`
+      );
+      return EXIT_USAGE;
     }
   }
-  const result = await conn.callTool(toolName, toolArgs);
-  const output = renderCallResult(result);
-  if (result.isError) {
-    await platform2.write(2, `${output}
-`);
-    return 1;
+  let fin = base;
+  if (toolArgs.length > 0) {
+    const tools = await conn.listTools();
+    const tool = tools.find((t) => t.name === toolName);
+    const schema = tool?.inputSchema ?? { type: "object", properties: {} };
+    const c = coerceArgsBySchema(toolArgs, schema, { noValidate: opts.noValidate });
+    if (!c.ok) {
+      await writeErr(platform2, opts.json ?? false, "usage", c.error);
+      return EXIT_USAGE;
+    }
+    fin = mergeArgs(base, c.value);
   }
-  await platform2.write(1, `${output}
-`);
-  return 0;
+  return renderCallResult(
+    platform2,
+    await conn.callTool(toolName, fin, { onProgress: opts.onProgress }),
+    { json: opts.json }
+  );
 }
-async function runDescribe(platform2, conn, toolName, showSchema) {
+async function runDescribe(platform2, conn, toolName, showSchema, json) {
   const tools = await conn.listTools();
   if (toolName) {
     const tool = tools.find((t) => t.name === toolName);
     if (!tool) {
-      await platform2.write(2, `mcpcat: tool '${toolName}' not found
+      await writeErr(platform2, json, "usage", `tool '${toolName}' not found`);
+      return EXIT_USAGE;
+    }
+    if (json) {
+      await platform2.write(1, `${JSON.stringify(tool, null, 2)}
 `);
-      return 2;
+      return EXIT_OK;
     }
     if (showSchema && tool.inputSchema) {
       await platform2.write(1, `${JSON.stringify(tool.inputSchema, null, 2)}
@@ -10850,28 +11867,36 @@ async function runDescribe(platform2, conn, toolName, showSchema) {
 `);
     }
   } else {
+    if (json) {
+      await platform2.write(1, `${JSON.stringify({ tools }, null, 2)}
+`);
+      return EXIT_OK;
+    }
     for (const tool of tools) {
       await platform2.write(1, `${formatToolSchema(tool)}
 
 `);
     }
   }
-  return 0;
+  return EXIT_OK;
 }
-async function runVerb(platform2, parsed, conn) {
+async function runVerb(platform2, parsed, conn, onProgress) {
   switch (parsed.verb) {
     case "info":
-      return runInfo(platform2, conn);
+      return runInfo(platform2, conn, parsed.jsonOutput);
     case "tools":
-      return runTools(platform2, conn);
+      return runTools(platform2, conn, parsed.jsonOutput);
     case "call":
-      return runCall(platform2, conn, parsed.toolName, parsed.dataArg);
+      return runCall(platform2, conn, parsed.toolName, parsed.dataArg, [], {
+        json: parsed.jsonOutput,
+        onProgress
+      });
     case "describe":
-      return runDescribe(platform2, conn, parsed.toolName, parsed.showSchema);
+      return runDescribe(platform2, conn, parsed.toolName, parsed.showSchema, parsed.jsonOutput);
     default:
       await platform2.write(2, `mcpcat: unknown command '${parsed.verb}'
 `);
-      return 2;
+      return EXIT_USAGE;
   }
 }
 async function probeServer(_name, config, platform2) {
@@ -10902,10 +11927,11 @@ async function probeServer(_name, config, platform2) {
     return err.message;
   }
 }
-async function dispatchConfigVerb(platform2, verb, args) {
+async function dispatchConfigVerb(platform2, verb, args, version) {
   const rest = args.slice(1);
   switch (verb) {
     case "add":
+      if (rest.includes("--bridge")) return runBridge(platform2, rest, version);
       return runAdd(platform2, rest, probeServer);
     case "rm":
       return runRm(platform2, rest);
@@ -10948,7 +11974,7 @@ async function dispatchDiscoveryVerb(platform2, parsed, args) {
 async function dispatchServeVerb(platform2, args, version) {
   const serveArgs = args.slice(args.indexOf("serve") + 1);
   const serveOptions = parseServeFlags(serveArgs);
-  if (serveOptions.commands.length === 0 && serveOptions.toolTemplates.length === 0) {
+  if (!serveOptions.proxy && serveOptions.commands.length === 0 && serveOptions.toolTemplates.length === 0) {
     await platform2.write(2, "mcpcat serve: no commands or --tool templates given\n");
     return 2;
   }
@@ -11112,14 +12138,14 @@ async function run(platform2, version, args) {
   if (parsed.verb in CONFIG_VERBS) {
     const disc = await dispatchDiscoveryVerb(platform2, parsed, args);
     if (disc !== void 0) return disc;
-    return dispatchConfigVerb(platform2, parsed.verb, args);
+    return dispatchConfigVerb(platform2, parsed.verb, args, version);
   }
   const discResult = await dispatchDiscoveryVerb(platform2, parsed, args);
   if (discResult !== void 0) return discResult;
   if (UNIMPLEMENTED_VERBS.has(parsed.verb)) {
     await platform2.write(2, `mcpcat: '${parsed.verb}' is not implemented yet
 `);
-    return 1;
+    return EXIT_TOOL_ERROR;
   }
   if (parsed.verb === "serve") {
     return dispatchServeVerb(platform2, args, version);
@@ -11141,44 +12167,100 @@ async function run(platform2, version, args) {
 `);
     return 2;
   }
+  return runClientVerb(platform2, version, parsed);
+}
+function expandAndCollect(headers, env2) {
+  const secrets = [];
+  const result = {};
+  for (const [k, v] of Object.entries(headers)) {
+    const e = expandPlaceholders(v, env2);
+    result[k] = e;
+    if (e !== v) secrets.push(e);
+    if (v.length > 0) secrets.push(v);
+  }
+  return { expanded: result, secrets };
+}
+function classifyError(err) {
+  if (err instanceof InputRequiredError) {
+    return { code: EXIT_INPUT_REQUIRED, kind: "input_required", msg: err.requestJson };
+  }
+  if (err instanceof McpTimeoutError2) {
+    return { code: EXIT_TIMEOUT, kind: "timeout", msg: err.message };
+  }
+  if (err instanceof McpAuthError) {
+    return { code: EXIT_AUTH, kind: "auth", msg: err.message };
+  }
+  if (err instanceof McpcatError) {
+    return { code: err.exitCode, kind: "error", msg: err.message };
+  }
+  const msg = err.message ?? String(err);
+  const name = err.name ?? "";
+  if (name === "McpTimeoutError" || msg.includes("timed out") || msg.includes("timeout") || msg.includes("Timeout")) {
+    return { code: EXIT_TIMEOUT, kind: "timeout", msg };
+  }
+  return { code: EXIT_RPC_ERROR, kind: "rpc_error", msg };
+}
+async function runClientVerb(platform2, version, parsed) {
+  const { expanded, secrets } = expandAndCollect(parsed.headers, platform2.env);
+  const verbose = createVerboseLogger(platform2, parsed.verbose);
+  for (const s of secrets) verbose.secrets.add(s);
+  const timeoutMs = parsed.timeoutMs;
+  const sigintController = new AbortController();
+  let interrupted = false;
+  platform2.onSignal?.("SIGINT", () => {
+    interrupted = true;
+    sigintController.abort();
+  });
+  const showProgress = !parsed.silent && (parsed.verbose || platform2.isatty(2));
+  const onProgress = (progress, total, message) => {
+    if (!showProgress) return;
+    const pct = total ? ` ${Math.round(progress / total * 100)}%` : "";
+    const msg = message ? ` ${message}` : "";
+    platform2.write(2, `* progress:${pct}${msg}
+`).catch(() => {
+    });
+  };
   const config = await MergedConfigSource.load(platform2);
+  const target = parsed.target === "__trailing__" ? "" : parsed.target;
   let resolved;
   try {
-    resolved = await resolveTarget(
-      parsed.target === "__trailing__" ? "" : parsed.target,
-      parsed.trailingCommand,
-      config
-    );
+    resolved = await resolveTarget(target, parsed.trailingCommand, config);
   } catch (err) {
-    await platform2.write(2, `mcpcat: ${err.message}
-`);
-    return 2;
+    await writeErr(platform2, parsed.jsonOutput, "usage", err.message);
+    return EXIT_USAGE;
   }
   let conn;
   try {
     conn = await connect(platform2, {
       ...resolved,
-      headers: { ...resolved.headers, ...parsed.headers },
+      headers: { ...resolved.headers, ...expanded },
       protocolVersion: parsed.protocolVersion,
-      version
+      version,
+      timeoutMs,
+      signal: sigintController.signal,
+      verbose
     });
   } catch (err) {
+    if (err instanceof McpAuthError) {
+      await writeErr(platform2, parsed.jsonOutput, "auth", err.message);
+      return EXIT_AUTH;
+    }
     const msg = transportHint(err) ?? `connection failed: ${err.message}`;
-    await platform2.write(2, `mcpcat: ${msg}
-`);
-    return 3;
+    await writeErr(platform2, parsed.jsonOutput, "connection", msg);
+    return EXIT_CONNECTION;
   }
   try {
-    return await runVerb(platform2, parsed, conn);
+    return await runVerb(platform2, parsed, conn, onProgress);
   } catch (err) {
-    if (err instanceof InputRequiredError) {
-      await platform2.write(2, `${err.requestJson}
-`);
-      return 6;
+    if (interrupted) {
+      await platform2.write(2, "mcpcat: interrupted\n");
+      return EXIT_INTERRUPTED;
     }
-    await platform2.write(2, `mcpcat: ${err.message}
+    const e = classifyError(err);
+    if (err instanceof InputRequiredError) await platform2.write(2, `${e.msg}
 `);
-    return 5;
+    else await writeErr(platform2, parsed.jsonOutput, e.kind, e.msg);
+    return e.code;
   } finally {
     try {
       await conn.close();
@@ -11186,6 +12268,11 @@ async function run(platform2, version, args) {
     }
   }
 }
+async function writeErr(p, json, kind, msg) {
+  if (json) await renderErrorJson(p, kind, msg);
+  else await p.write(2, `mcpcat: ${msg}
+`);
+}
 
 // src/platform/kernel.ts
 function kernelFs(ctx) {
@@ -11272,6 +12359,7 @@ async function kernelListen(ctx, options) {
 function createKernelPlatform(ctx, options) {
   const encoder2 = new TextEncoder();
   return {
+    kind: "kernel",
     fetch: ctx.fetch,
     spawn: (options2) => kernelSpawn(ctx, options2),
     listen: (options2) => kernelListen(ctx, options2),
@@ -11301,7 +12389,7 @@ async function main(ctx) {
     packageDir: "/node_modules/@ai-ecoverse/mcpcat"
   });
   const args = ctx.argv.slice(1);
-  return run(platform2, "0.0.0", args);
+  return run(platform2, "0.9.0", args);
 }
 export {
   main as default