@aion0/forge 0.10.47 → 0.10.49

package/cli/mw.mjs

@@ -764,13 +764,13 @@ function migrateDataDir() {
   if (!existsSync3(oldSettings) || existsSync3(newSettings)) return;
   console.log("[forge] Migrating data from ~/.forge/ to ~/.forge/data/...");
   if (!existsSync3(dataDir2)) mkdirSync2(dataDir2, { recursive: true });
-  for (const file of MIGRATE_FILES) {
-    const src = join3(configDir, file);
-    const dest = join3(dataDir2, file);
+  for (const file2 of MIGRATE_FILES) {
+    const src = join3(configDir, file2);
+    const dest = join3(dataDir2, file2);
     if (existsSync3(src) && !existsSync3(dest)) {
       try {
         copyFileSync(src, dest);
-        console.log(`  ${file}`);
+        console.log(`  ${file2}`);
       } catch {
       }
     }
@@ -823,16 +823,414 @@ var init_dirs = __esm({
   }
 });
 
+// lib/api-keys.ts
+import { existsSync as existsSync4, readFileSync as readFileSync2, writeFileSync as writeFileSync2, mkdirSync as mkdirSync3, renameSync as renameSync2, rmSync as rmSync2, statSync as statSync2 } from "node:fs";
+import { join as join4 } from "node:path";
+import { randomBytes, createHash, timingSafeEqual } from "node:crypto";
+function file() {
+  return join4(getDataDir(), "api-keys.json");
+}
+function load() {
+  try {
+    const fp = file();
+    if (!existsSync4(fp)) {
+      _cache = null;
+      return [];
+    }
+    const mtimeMs = statSync2(fp).mtimeMs;
+    if (_cache && _cache.mtimeMs === mtimeMs) return _cache.keys;
+    const parsed = JSON.parse(readFileSync2(fp, "utf-8"));
+    const keys = Array.isArray(parsed) ? parsed : [];
+    _cache = { mtimeMs, keys };
+    return keys;
+  } catch {
+    return [];
+  }
+}
+function persist(keys) {
+  const dir = getDataDir();
+  mkdirSync3(dir, { recursive: true });
+  const tmp = join4(dir, `.api-keys.${randomBytes(6).toString("hex")}.tmp`);
+  try {
+    writeFileSync2(tmp, JSON.stringify(keys, null, 2), { mode: 384 });
+    renameSync2(tmp, file());
+    _cache = null;
+  } catch (e) {
+    try {
+      rmSync2(tmp, { force: true });
+    } catch {
+    }
+    throw e;
+  }
+}
+function sha256(s) {
+  return createHash("sha256").update(s).digest("hex");
+}
+function createApiKey(name) {
+  const key = `${KEY_PREFIX}${randomBytes(24).toString("base64url")}`;
+  const record = {
+    id: randomBytes(6).toString("hex"),
+    name: name.trim() || "agent key",
+    prefix: `${key.slice(0, KEY_PREFIX.length + 6)}\u2026`,
+    hash: sha256(key),
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    lastUsedAt: null
+  };
+  const keys = load();
+  keys.push(record);
+  persist(keys);
+  return { key, record: toPublic(record) };
+}
+function listApiKeys() {
+  return load().map(toPublic);
+}
+function revokeApiKey(id) {
+  const keys = load();
+  const idx = keys.findIndex((k) => k.id === id);
+  if (idx < 0) return false;
+  keys.splice(idx, 1);
+  persist(keys);
+  return true;
+}
+var KEY_PREFIX, _cache, toPublic;
+var init_api_keys = __esm({
+  "lib/api-keys.ts"() {
+    "use strict";
+    init_dirs();
+    KEY_PREFIX = "forge_sk_";
+    _cache = null;
+    toPublic = (r) => ({
+      id: r.id,
+      name: r.name,
+      prefix: r.prefix,
+      createdAt: r.createdAt,
+      lastUsedAt: r.lastUsedAt
+    });
+  }
+});
+
+// cli/mcp-install.ts
+var mcp_install_exports = {};
+__export(mcp_install_exports, {
+  mcpInstallCommand: () => mcpInstallCommand
+});
+import { spawnSync as spawnSync2 } from "node:child_process";
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, existsSync as existsSync5, mkdirSync as mkdirSync4 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { join as join5 } from "node:path";
+function savedKey() {
+  const env = (process.env.FORGE_API_KEY || process.env.FORGE_API_TOKEN || "").trim();
+  if (env) return env;
+  try {
+    if (existsSync5(keyFile())) return readFileSync3(keyFile(), "utf-8").trim();
+  } catch {
+  }
+  return "";
+}
+function ensureKey(remote) {
+  const existing = savedKey();
+  if (existing) return existing;
+  if (remote) throw new Error("remote install needs a key \u2014 set FORGE_API_KEY (mint one in the remote's Settings \u2192 API Key)");
+  const { key } = createApiKey("claude-code");
+  mkdirSync4(join5(homedir3(), ".forge"), { recursive: true });
+  writeFileSync3(keyFile(), key, { mode: 384 });
+  console.error(`[forge mcp install] minted a local API key \u2192 ${keyFile()}`);
+  return key;
+}
+async function mcpInstallCommand(args2) {
+  const name = opt(args2, "--name") || "forge";
+  const scope = opt(args2, "--scope");
+  const remote = opt(args2, "--remote");
+  const useHttp = args2.includes("--http");
+  const printOnly = args2.includes("--print");
+  const port = opt(args2, "--port");
+  const base = (remote || process.env.MW_URL || `http://localhost:${port || "8403"}`).replace(/\/$/, "");
+  if (!printOnly && !remote && !savedKey() && !process.env.FORGE_DATA_DIR && (process.env.MW_URL || port && port !== "8403")) {
+    throw new Error("targeting a non-default instance \u2014 set FORGE_DATA_DIR to its data dir so the key is minted into the store that server reads");
+  }
+  const key = printOnly ? savedKey() : ensureKey(remote);
+  const add = ["mcp", "add"];
+  if (scope) add.push("--scope", scope);
+  if (useHttp) {
+    add.push("--transport", "http", name, `${base}/api/mcp`);
+    if (key) add.push("--header", `Authorization: Bearer ${key}`);
+    else if (printOnly) add.push("--header", "Authorization: Bearer forge_sk_YOUR_KEY");
+  } else {
+    if (remote || process.env.MW_URL) add.push("--env", `MW_URL=${base}`);
+    add.push(name, "--", "forge", "mcp");
+  }
+  const pretty = `claude ${add.map((a) => a.includes(" ") ? JSON.stringify(a) : a).join(" ")}`;
+  if (printOnly) {
+    console.log(pretty);
+    return;
+  }
+  const r = spawnSync2("claude", add, { stdio: "inherit" });
+  if (r.error && r.error.code === "ENOENT") {
+    console.error("[forge mcp install] the `claude` CLI is not on PATH. Run this yourself:\n");
+    console.log(`  ${pretty}
+`);
+    return;
+  }
+  if (r.status && r.status !== 0) process.exit(r.status);
+  console.error(`
+[forge mcp install] added '${name}'. Run /mcp in a Claude Code session to confirm.`);
+}
+var opt, keyFile;
+var init_mcp_install = __esm({
+  "cli/mcp-install.ts"() {
+    "use strict";
+    init_api_keys();
+    opt = (args2, name) => {
+      const i = args2.indexOf(name);
+      return i >= 0 ? args2[i + 1] : void 0;
+    };
+    keyFile = () => join5(homedir3(), ".forge", "mcp-key");
+  }
+});
+
+// cli/mcp-proxy.ts
+var mcp_proxy_exports = {};
+__export(mcp_proxy_exports, {
+  mcpProxyCommand: () => mcpProxyCommand
+});
+import { createInterface } from "node:readline";
+import { readFileSync as readFileSync4, existsSync as existsSync6 } from "node:fs";
+import { homedir as homedir4 } from "node:os";
+import { join as join6 } from "node:path";
+function resolveCredential() {
+  const env = process.env.FORGE_API_KEY || process.env.FORGE_API_TOKEN;
+  if (env) return env.trim();
+  try {
+    const f = join6(homedir4(), ".forge", "mcp-key");
+    if (existsSync6(f)) return readFileSync4(f, "utf-8").trim();
+  } catch {
+  }
+  return "";
+}
+async function mcpProxyCommand(_args, deps = {}) {
+  const input = deps.input ?? process.stdin;
+  const out = deps.writeOut ?? ((s) => {
+    process.stdout.write(s);
+  });
+  const logErr = deps.logErr ?? ((s) => {
+    process.stderr.write(s);
+  });
+  const doFetch = deps.fetchImpl ?? fetch;
+  const base = (process.env.MW_URL || "http://localhost:8403").replace(/\/$/, "");
+  const endpoint = `${base}/api/mcp`;
+  const credential = resolveCredential();
+  const applyAuth = (headers) => {
+    if (!credential) return;
+    if (credential.startsWith("forge_sk_")) headers["authorization"] = `Bearer ${credential}`;
+    else headers["x-forge-token"] = credential;
+  };
+  const err = (m) => logErr(`[forge mcp] ${m}
+`);
+  err(`proxy \u2192 ${endpoint}`);
+  let sessionId = "";
+  let protocolVersion = "";
+  let initFrame = "";
+  const writeFrame = (text) => out(text.endsWith("\n") ? text : text + "\n");
+  const emit = (obj) => out(JSON.stringify(obj) + "\n");
+  const rpcError = (id, message, code = -32e3) => emit({ jsonrpc: "2.0", id, error: { code, message } });
+  const post = (frame, useSession) => {
+    const headers = {
+      "content-type": "application/json",
+      accept: "application/json, text/event-stream"
+    };
+    applyAuth(headers);
+    if (useSession && sessionId) headers["mcp-session-id"] = sessionId;
+    if (protocolVersion) headers["mcp-protocol-version"] = protocolVersion;
+    return doFetch(endpoint, { method: "POST", headers, body: frame });
+  };
+  const adoptSession = (res) => {
+    const sid = res.headers.get("mcp-session-id");
+    if (sid) sessionId = sid;
+  };
+  const learnProtocol = (text) => {
+    try {
+      const v = JSON.parse(text)?.result?.protocolVersion;
+      if (typeof v === "string") protocolVersion = v;
+    } catch {
+    }
+  };
+  const errorMessage = (status, text) => {
+    try {
+      const m = JSON.parse(text)?.error?.message;
+      if (typeof m === "string") return m;
+    } catch {
+    }
+    return `Forge server returned HTTP ${status}`;
+  };
+  const sessionDead = (status, text) => status === 404 || status === 400 && /not initialized|session not found/i.test(text);
+  async function recover(frame, id, hasId) {
+    err("session expired \u2014 re-initializing");
+    sessionId = "";
+    protocolVersion = "";
+    let initRes;
+    try {
+      initRes = await post(initFrame, false);
+    } catch (e) {
+      if (hasId) rpcError(id, `forge mcp: re-init failed: ${e.message}`);
+      return;
+    }
+    adoptSession(initRes);
+    if (!initRes.ok) {
+      if (hasId) rpcError(id, "forge mcp: re-initialization failed");
+      return;
+    }
+    learnProtocol(await initRes.text());
+    try {
+      await post('{"jsonrpc":"2.0","method":"notifications/initialized"}', true);
+    } catch {
+    }
+    let retry;
+    try {
+      retry = await post(frame, true);
+    } catch (e) {
+      if (hasId) rpcError(id, `forge mcp: ${e.message}`);
+      return;
+    }
+    adoptSession(retry);
+    if (retry.status === 202) return;
+    const rtext = await retry.text();
+    if (retry.ok) {
+      if (rtext) writeFrame(rtext);
+      return;
+    }
+    if (hasId) rpcError(id, errorMessage(retry.status, rtext));
+  }
+  const rl = createInterface({ input, crlfDelay: Infinity });
+  for await (const line of rl) {
+    const frame = line.trim();
+    if (!frame) continue;
+    let msg;
+    try {
+      msg = JSON.parse(frame);
+    } catch {
+      err("dropping non-JSON stdin line");
+      continue;
+    }
+    const hasId = !!msg && "id" in msg && msg.id !== null && msg.id !== void 0;
+    const id = hasId ? msg.id : void 0;
+    if (msg?.method === "initialize") initFrame = frame;
+    let res;
+    try {
+      res = await post(frame, true);
+    } catch (e) {
+      err(`request failed: ${e.message}`);
+      if (hasId) rpcError(id, `forge mcp: ${e.message}`);
+      continue;
+    }
+    adoptSession(res);
+    if (res.status === 202) continue;
+    const text = await res.text();
+    if (res.ok) {
+      learnProtocol(text);
+      if (text) writeFrame(text);
+      continue;
+    }
+    if (sessionDead(res.status, text) && initFrame && msg?.method !== "initialize") {
+      await recover(frame, id, hasId);
+      continue;
+    }
+    if (hasId) rpcError(id, errorMessage(res.status, text));
+    else err(`server ${res.status} on notification (dropped)`);
+  }
+  if (sessionId) {
+    try {
+      const headers = { "mcp-session-id": sessionId };
+      applyAuth(headers);
+      if (protocolVersion) headers["mcp-protocol-version"] = protocolVersion;
+      await doFetch(endpoint, { method: "DELETE", headers });
+    } catch {
+    }
+  }
+}
+var init_mcp_proxy = __esm({
+  "cli/mcp-proxy.ts"() {
+    "use strict";
+  }
+});
+
+// cli/key.ts
+var key_exports = {};
+__export(key_exports, {
+  keyCommand: () => keyCommand
+});
+import { writeFileSync as writeFileSync4, mkdirSync as mkdirSync5 } from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import { join as join7 } from "node:path";
+async function keyCommand(args2) {
+  const sub = args2[0];
+  const positional = args2.slice(1).filter((a) => !a.startsWith("--"));
+  if (sub === "list") {
+    const keys = listApiKeys();
+    if (!keys.length) {
+      console.log("No API keys. Create one: forge key create <name>");
+      return;
+    }
+    for (const k of keys) {
+      const used = k.lastUsedAt ? k.lastUsedAt.slice(0, 10) : "never";
+      console.log(`  ${k.id}  ${String(k.prefix).padEnd(20)} ${k.name}  (created ${k.createdAt?.slice(0, 10)}, last used ${used})`);
+    }
+    return;
+  }
+  if (sub === "create") {
+    const name = positional[0] || "agent key";
+    const { key } = createApiKey(name);
+    console.log(`
+\u2713 API key created (${name}):
+
+  ${key}
+`);
+    console.log("  Copy it now \u2014 it will not be shown again.");
+    if (args2.includes("--save")) {
+      const dir = join7(homedir5(), ".forge");
+      mkdirSync5(dir, { recursive: true });
+      const f = join7(dir, "mcp-key");
+      writeFileSync4(f, key, { mode: 384 });
+      console.log(`  Saved to ${f} \u2014 forge mcp will read it automatically.`);
+    } else {
+      console.log("  Use it:  export FORGE_API_KEY=<key>   (or rerun with --save)");
+    }
+    return;
+  }
+  if (sub === "revoke") {
+    const id = positional[0];
+    if (!id) {
+      console.log("Usage: forge key revoke <id>");
+      process.exit(1);
+    }
+    console.log(revokeApiKey(id) ? `\u2713 Revoked key ${id}` : `Key ${id} not found`);
+    return;
+  }
+  console.log(`forge key \u2014 manage API keys (service/agent credentials, incl. MCP)
+
+  forge key create [name] [--save]   Mint a key (--save writes it to ~/.forge/mcp-key)
+  forge key list                     List keys
+  forge key revoke <id>              Revoke a key
+
+  No admin password \u2014 operates on the local key store directly.
+  Set FORGE_DATA_DIR to target a non-default instance.`);
+}
+var init_key = __esm({
+  "cli/key.ts"() {
+    "use strict";
+    init_api_keys();
+  }
+});
+
 // cli/mw.ts
 var _cliPort = process.argv.find((a, i) => i > 0 && process.argv[i - 1] === "--port");
 var BASE2 = process.env.MW_URL || `http://localhost:${_cliPort || "3000"}`;
 var [, , cmd, ...args] = process.argv;
 async function checkForUpdate() {
   try {
-    const { readFileSync: readFileSync2 } = await import("node:fs");
-    const { join: join4, dirname } = await import("node:path");
+    const { readFileSync: readFileSync5 } = await import("node:fs");
+    const { join: join8, dirname } = await import("node:path");
     const { fileURLToPath } = await import("node:url");
-    const pkg = JSON.parse(readFileSync2(join4(dirname(fileURLToPath(import.meta.url)), "..", "package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync5(join8(dirname(fileURLToPath(import.meta.url)), "..", "package.json"), "utf-8"));
     const current = pkg.version;
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), 3e3);
@@ -866,11 +1264,11 @@ async function api3(path, opts) {
 }
 async function main() {
   if (cmd === "--version" || cmd === "-v") {
-    const { readFileSync: readFileSync2 } = await import("node:fs");
-    const { join: join4, dirname } = await import("node:path");
+    const { readFileSync: readFileSync5 } = await import("node:fs");
+    const { join: join8, dirname } = await import("node:path");
     const { fileURLToPath } = await import("node:url");
     try {
-      const pkg = JSON.parse(readFileSync2(join4(dirname(fileURLToPath(import.meta.url)), "..", "package.json"), "utf-8"));
+      const pkg = JSON.parse(readFileSync5(join8(dirname(fileURLToPath(import.meta.url)), "..", "package.json"), "utf-8"));
       console.log(`@aion0/forge v${pkg.version}`);
     } catch {
       console.log("forge (version unknown)");
@@ -878,20 +1276,20 @@ async function main() {
     process.exit(0);
   }
   if (cmd === "--reset-password") {
-    const { spawnSync: spawnSync2 } = await import("node:child_process");
-    const { join: join4, dirname } = await import("node:path");
+    const { spawnSync: spawnSync3 } = await import("node:child_process");
+    const { join: join8, dirname } = await import("node:path");
     const { fileURLToPath } = await import("node:url");
-    const serverScript = join4(dirname(fileURLToPath(import.meta.url)), "..", "bin", "forge-server.mjs");
+    const serverScript = join8(dirname(fileURLToPath(import.meta.url)), "..", "bin", "forge-server.mjs");
     const passthru = process.argv.slice(3);
-    spawnSync2("node", [serverScript, "--reset-password", ...passthru], { stdio: "inherit" });
+    spawnSync3("node", [serverScript, "--reset-password", ...passthru], { stdio: "inherit" });
     process.exit(0);
   }
   if (cmd === "--add-enterprise-key") {
-    const { spawnSync: spawnSync2 } = await import("node:child_process");
-    const { join: join4, dirname } = await import("node:path");
+    const { spawnSync: spawnSync3 } = await import("node:child_process");
+    const { join: join8, dirname } = await import("node:path");
     const { fileURLToPath } = await import("node:url");
-    const serverScript = join4(dirname(fileURLToPath(import.meta.url)), "..", "bin", "forge-server.mjs");
-    const r = spawnSync2("node", [serverScript, "--add-enterprise-key", ...args], { stdio: "inherit" });
+    const serverScript = join8(dirname(fileURLToPath(import.meta.url)), "..", "bin", "forge-server.mjs");
+    const r = spawnSync3("node", [serverScript, "--add-enterprise-key", ...args], { stdio: "inherit" });
     process.exit(r.status ?? 1);
   }
   switch (cmd) {
@@ -913,6 +1311,21 @@ async function main() {
       await worktreeCommand2(args);
       break;
     }
+    case "mcp": {
+      if (args[0] === "install") {
+        const { mcpInstallCommand: mcpInstallCommand2 } = await Promise.resolve().then(() => (init_mcp_install(), mcp_install_exports));
+        await mcpInstallCommand2(args.slice(1));
+        break;
+      }
+      const { mcpProxyCommand: mcpProxyCommand2 } = await Promise.resolve().then(() => (init_mcp_proxy(), mcp_proxy_exports));
+      await mcpProxyCommand2(args);
+      break;
+    }
+    case "key": {
+      const { keyCommand: keyCommand2 } = await Promise.resolve().then(() => (init_key(), key_exports));
+      await keyCommand2(args);
+      break;
+    }
     case "task":
     case "t": {
       const newSession = args.includes("--new");
@@ -1193,14 +1606,14 @@ Resume in CLI:`);
     }
     case "tunnel_code":
     case "tcode": {
-      const { readFileSync: readFileSync2, existsSync: existsSync4 } = await import("node:fs");
-      const { join: join4 } = await import("node:path");
+      const { readFileSync: readFileSync5, existsSync: existsSync7 } = await import("node:fs");
+      const { join: join8 } = await import("node:path");
       const { getDataDir: _gdd } = await Promise.resolve().then(() => (init_dirs(), dirs_exports));
       const dataDir2 = _gdd();
-      const codeFile = join4(dataDir2, "session-code.json");
+      const codeFile = join8(dataDir2, "session-code.json");
       try {
-        if (existsSync4(codeFile)) {
-          const data = JSON.parse(readFileSync2(codeFile, "utf-8"));
+        if (existsSync7(codeFile)) {
+          const data = JSON.parse(readFileSync5(codeFile, "utf-8"));
           if (data.code) {
             console.log(`Session code: ${data.code}`);
           } else {
@@ -1212,7 +1625,7 @@ Resume in CLI:`);
       } catch {
       }
       try {
-        const tunnelState = JSON.parse(readFileSync2(join4(dataDir2, "tunnel-state.json"), "utf-8"));
+        const tunnelState = JSON.parse(readFileSync5(join8(dataDir2, "tunnel-state.json"), "utf-8"));
         if (tunnelState.url) console.log(`Tunnel URL: ${tunnelState.url}`);
       } catch {
       }
@@ -1259,9 +1672,9 @@ ${projects.length} projects`);
     }
     case "server": {
       const { execSync: execSync2 } = await import("node:child_process");
-      const { join: join4, dirname } = await import("node:path");
+      const { join: join8, dirname } = await import("node:path");
       const { fileURLToPath } = await import("node:url");
-      const serverScript = join4(dirname(fileURLToPath(import.meta.url)), "..", "bin", "forge-server.mjs");
+      const serverScript = join8(dirname(fileURLToPath(import.meta.url)), "..", "bin", "forge-server.mjs");
       const sub = args[0] || "start";
       const serverArgs = args.slice(1);
       const flagMap = {
@@ -1334,31 +1747,31 @@ ${task.gitDiff.slice(0, 2e3)}`);
     case "upgrade": {
       const { execSync: execSync2 } = await import("node:child_process");
       const { lstatSync } = await import("node:fs");
-      const { join: join4, dirname } = await import("node:path");
+      const { join: join8, dirname } = await import("node:path");
       const { fileURLToPath } = await import("node:url");
       const cliDir = dirname(fileURLToPath(import.meta.url));
       let isLinked = false;
       try {
-        isLinked = lstatSync(join4(cliDir, "..")).isSymbolicLink();
+        isLinked = lstatSync(join8(cliDir, "..")).isSymbolicLink();
       } catch {
       }
       if (isLinked) {
         console.log("[forge] Installed via npm link (local source)");
         console.log("[forge] Pull latest and rebuild:");
-        console.log("  cd " + join4(cliDir, ".."));
+        console.log("  cd " + join8(cliDir, ".."));
         console.log("  git pull && pnpm install && pnpm build");
       } else {
         console.log("[forge] Upgrading from npm...");
         try {
-          const { homedir: homedir3 } = await import("node:os");
+          const { homedir: homedir6 } = await import("node:os");
           execSync2("npm install -g @aion0/forge@latest --prefer-online", {
             stdio: "inherit",
-            cwd: homedir3()
+            cwd: homedir6()
           });
           try {
-            const { readFileSync: readFileSync2 } = await import("node:fs");
-            const globalRoot = execSync2("npm root -g", { encoding: "utf-8", cwd: homedir3() }).trim();
-            const pkg = JSON.parse(readFileSync2(join4(globalRoot, "@aion0", "forge", "package.json"), "utf-8"));
+            const { readFileSync: readFileSync5 } = await import("node:fs");
+            const globalRoot = execSync2("npm root -g", { encoding: "utf-8", cwd: homedir6() }).trim();
+            const pkg = JSON.parse(readFileSync5(join8(globalRoot, "@aion0", "forge", "package.json"), "utf-8"));
             console.log(`[forge] Upgraded to v${pkg.version}. Run: forge server restart`);
           } catch {
             console.log("[forge] Upgraded. Run: forge server restart");
@@ -1409,6 +1822,11 @@ Usage:
   forge cancel <id>              Cancel a task
   forge retry <id>               Retry a failed task
 
+  forge mcp install              Add the Forge management MCP to Claude Code
+  forge key create [name]        Create an API key (for agents/MCP)
+  forge key list                 List API keys
+  forge key revoke <id>          Revoke an API key
+
   forge run <flow>               Run a workflow
   forge flows                    List workflows
   forge projects                 List projects
@@ -1428,7 +1846,7 @@ Options for 'forge server start':
 Shortcuts: c=chat, j=jobs, wt=worktree, t=task, ls=tasks, w=watch, s=status, l=log, f=flows, p=projects, pw=password`);
   }
 }
-var skipUpdateCheck = ["upgrade", "uninstall", "--version", "-v", "--reset-password", "--add-enterprise-key"];
+var skipUpdateCheck = ["upgrade", "uninstall", "--version", "-v", "--reset-password", "--add-enterprise-key", "mcp", "key"];
 main().then(() => {
   if (!skipUpdateCheck.includes(cmd)) return checkForUpdate();
 }).catch((err) => {

package/cli/mw.ts

@@ -120,6 +120,26 @@ async function main() {
       break;
     }
 
+    case 'mcp': {
+      // `forge mcp install` adds the server to Claude Code; bare `forge mcp` is
+      // the stdio<->HTTP proxy the client spawns (transport-only, see mcp/README.md).
+      if (args[0] === 'install') {
+        const { mcpInstallCommand } = await import('./mcp-install');
+        await mcpInstallCommand(args.slice(1));
+        break;
+      }
+      const { mcpProxyCommand } = await import('./mcp-proxy');
+      await mcpProxyCommand(args);
+      break;
+    }
+
+    case 'key': {
+      // Manage API keys (service/agent credentials, incl. MCP auth).
+      const { keyCommand } = await import('./key');
+      await keyCommand(args);
+      break;
+    }
+
     case 'task':
     case 't': {
       // Parse --new flag to force a fresh session
@@ -617,6 +637,11 @@ Usage:
   forge cancel <id>              Cancel a task
   forge retry <id>               Retry a failed task
 
+  forge mcp install              Add the Forge management MCP to Claude Code
+  forge key create [name]        Create an API key (for agents/MCP)
+  forge key list                 List API keys
+  forge key revoke <id>          Revoke an API key
+
   forge run <flow>               Run a workflow
   forge flows                    List workflows
   forge projects                 List projects
@@ -637,7 +662,7 @@ Shortcuts: c=chat, j=jobs, wt=worktree, t=task, ls=tasks, w=watch, s=status, l=l
   }
 }
 
-const skipUpdateCheck = ['upgrade', 'uninstall', '--version', '-v', '--reset-password', '--add-enterprise-key'];
+const skipUpdateCheck = ['upgrade', 'uninstall', '--version', '-v', '--reset-password', '--add-enterprise-key', 'mcp', 'key'];
 main().then(() => { if (!skipUpdateCheck.includes(cmd)) return checkForUpdate(); }).catch(err => {
   console.error(err.message);
   process.exit(1);