@aicommander/mcp 1.0.15 → 1.0.17

package/README.md

@@ -7,7 +7,7 @@ Use this package to connect any MCP client that speaks **stdio** (Codex CLI, Cla
 > Using **Claude Code**? You don't need this package — add the relay directly:
 > `claude mcp add --transport http aicommander https://aicommander.dev/mcp`
 >
-> No login or token is required to connect. Only add `--header "Authorization: Bearer <api-key>"` if you want the optional accounts/alias features — generate an **account API key** for free at [aicommander.dev](https://aicommander.dev). By default an API key only works while its owner has signed in to the dashboard within the last **24h** (a sign-in or the dashboard "Reactivate" button re-arms it; opt-out per account) — if it lapses, tool calls return a friendly "sign in to reactivate" message instead of acting.
+> No login or token is required to connect. Only add `--header "Authorization: Bearer <api-key>"` if you want the optional accounts/alias features — generate an **account API key** for free at [aicommander.dev](https://aicommander.dev). By default an API key only works while its owner has opened the dashboard within the last **24h** (just opening it — or a fresh sign-in, or the dashboard "Reactivate" button — re-arms it; opt-out per account) — if it lapses, tool calls return a friendly "open the dashboard to reactivate" message instead of acting.
 
 ## Tools
 
@@ -15,6 +15,7 @@ Use this package to connect any MCP client that speaks **stdio** (Codex CLI, Cla
 |---|---|
 | `remote_exec` | Run a shell command on one of your machines — the tool for any "connect to / remote shell / run X on" request. Name the machine by its `AIC-…` session code or (with an API key) a saved alias/hostname like `wearfits-m3`; streams stdout/stderr back. |
 | `session_status` | Check whether a machine is online/active/reachable (e.g. "is wearfits-m3 up?"). Same machine naming as above. |
+| `list_machines` | List all of your machines with their live online status (e.g. "what machines do I have?", "which of my computers are online?"). Requires an API key (`AICOMMANDER_TOKEN`); takes no arguments. |
 
 These are the canonical way to reach your machines — your AI client should use them rather than probing the local network, DNS/`.local`, or SSH. A string containing `aic-`/`AIC-` is almost certainly one of your machines.
 
@@ -24,7 +25,7 @@ Two environment variables:
 
 | Variable | Required | Default | Description |
 |---|---|---|---|
-| `AICOMMANDER_TOKEN` | no | — | **Account API key** (or OAuth access token) for the optional accounts/alias features — saved machines, aliases, account access. Generate one for free at [aicommander.dev](https://aicommander.dev). An API key stays active only while its account has signed in to the dashboard within the last 24h (default; opt-out per account); OAuth access tokens are not gated this way. |
+| `AICOMMANDER_TOKEN` | no | — | **Account API key** (or OAuth access token) for the optional accounts/alias features — saved machines, aliases, account access. Generate one for free at [aicommander.dev](https://aicommander.dev). An API key stays active only while its account has opened the dashboard within the last 24h (default; opt-out per account); OAuth access tokens are not gated this way. |
 | `AICOMMANDER_SERVER` | no | `https://aicommander.dev` | Base URL of the AI Commander relay. Defaults to the hosted service; only set this to point at a different endpoint. |
 
 ## Usage
@@ -78,6 +79,29 @@ Then just name a machine in chat — by session code or saved alias:
 
 The client routes it to `session_status` / `remote_exec` for you.
 
+## Publishing
+
+**Re-publish this package whenever you change code that ships in it** — e.g. a new
+tool, an edited tool description, or anything under `bin/`. The version in
+`package.json` / `server.json` is NOT auto-bumped, so a code change without a
+publish silently leaves npm + the registry stale (clients keep getting the old
+tools). Easy to forget — don't.
+
+Steps:
+
+1. Bump `version` in **both** `package.json` and `server.json` (keep them in sync).
+2. `npm publish` — needs npm 2FA OTP; `prepublishOnly: tsc` builds automatically.
+3. Publish to the official MCP Registry (domain ownership proven over HTTP via
+   `https://aicommander.dev/.well-known/mcp-registry-auth`, served by the Worker):
+
+   ```sh
+   mcp-publisher login http --domain=aicommander.dev \
+     --private-key=$(cat ~/.config/aicommander-mcp-publish/privkey.hex)
+   mcp-publisher publish
+   ```
+
+   The Worker must be deployed first so the well-known endpoint is live.
+
 ## License
 
 MIT

package/dist/bin/mcp.js

@@ -8,9 +8,14 @@ const SERVER_URL = process.env["AICOMMANDER_SERVER"] ?? "https://aicommander.dev
 // access. Without it the bridge works anonymously and you drive machines by their
 // session code (AIC-…) inside the code's 1-hour freshness window.
 const ACCOUNT_TOKEN = process.env["AICOMMANDER_TOKEN"];
+// The /mcp endpoint is account-bound by default (it 401s an unauthenticated caller
+// to drive the OAuth flow). This stdio bridge authenticates with a Bearer token when
+// AICOMMANDER_TOKEN is set; without one it uses the explicit anonymous opt-in
+// (?anonymous=1) so the AIC-code path keeps working.
+const MCP_URL = ACCOUNT_TOKEN ? `${SERVER_URL}/mcp` : `${SERVER_URL}/mcp?anonymous=1`;
 const server = new McpServer({
     name: "aicommander",
-    version: "1.0.15",
+    version: "1.0.17",
 }, {
     instructions: "AI Commander — remote command execution / remote shell over an outbound-only agent. " +
         "Use these tools for any SSH-style remote access: connect to a computer/machine/server, " +
@@ -66,7 +71,7 @@ server.registerTool("remote_exec", {
             .describe("Timeout in milliseconds. Default 300000 (5 min), max 3600000 (1 hr)"),
     },
 }, async ({ code, command, cwd, timeout_ms }) => {
-    const res = await fetch(`${SERVER_URL}/mcp`, {
+    const res = await fetch(MCP_URL, {
         method: "POST",
         headers: {
             "Content-Type": "application/json",
@@ -140,7 +145,7 @@ server.registerTool("session_status", {
             .describe("How the user named the machine, passed exactly as given: an AIC- session code (e.g. AIC-XYZ-1234), or — with an API key — a saved alias/hostname like 'wearfits-m3' or 'aic-wearfits'."),
     },
 }, async ({ code }) => {
-    const res = await fetch(`${SERVER_URL}/mcp`, {
+    const res = await fetch(MCP_URL, {
         method: "POST",
         headers: {
             "Content-Type": "application/json",
@@ -168,5 +173,38 @@ server.registerTool("session_status", {
         content: content,
     };
 });
+// Tool: list_machines
+server.registerTool("list_machines", {
+    description: "List ALL of the user's machines (the computers/servers linked to their AI Commander account) with each one's live status. USE THIS for fleet-wide questions rather than one named machine — e.g. \"what machines do I have?\", \"which of my computers are online?\", \"list my servers/hosts\" — or when the user wants to act on a machine but hasn't said which yet (call this first to discover the options). Requires an API key (set AICOMMANDER_TOKEN); without it there is no account to list and it returns an error — fall back to session_status with a specific AIC- code. Each entry gives the machine's alias (pass it as `code` to the other tools), whether its agent is online right now, when it was last seen, and whether the link is still awaiting the machine operator's approval. Takes no arguments.",
+    inputSchema: {},
+}, async () => {
+    const res = await fetch(MCP_URL, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            ...(ACCOUNT_TOKEN ? { Authorization: `Bearer ${ACCOUNT_TOKEN}` } : {}),
+        },
+        body: JSON.stringify({
+            jsonrpc: "2.0",
+            id: 1,
+            method: "tools/call",
+            params: { name: "list_machines", arguments: {} },
+        }),
+    });
+    if (!res.ok) {
+        const text = await res.text();
+        return {
+            content: [{ type: "text", text: `Error ${res.status}: ${text}` }],
+            isError: true,
+        };
+    }
+    const data = (await res.json());
+    const content = data?.result?.content ?? [
+        { type: "text", text: JSON.stringify(data) },
+    ];
+    return {
+        content: content,
+    };
+});
 const transport = new StdioServerTransport();
 await server.connect(transport);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aicommander/mcp",
-  "version": "1.0.15",
+  "version": "1.0.17",
   "mcpName": "dev.aicommander/mcp",
   "description": "MCP server for remote command execution — run shell/bash commands on remote machines, servers and laptops from your AI agent (Claude, Codex, any stdio MCP client). An SSH / Ansible alternative with no exposed SSH, open ports or VPN; drive machines by AIC-… session code or saved alias/hostname.",
   "keywords": [