@audienti/cli 0.1.31 → 0.1.32

package/.mcp.json

@@ -0,0 +1,13 @@
+{
+  "mcpServers": {
+    "audienti": {
+      "title": "Audienti",
+      "description": "Bridge MCP clients to Audienti's app-hosted /mcp endpoint for accounts, plays, prospects, lists, analytics, and operator workflows.",
+      "cwd": ".",
+      "command": "node",
+      "args": [
+        "./bin/audienti-mcp.js"
+      ]
+    }
+  }
+}

package/CHANGELOG.md

@@ -4,6 +4,13 @@ All notable changes to the Audienti CLI are documented here.
 
 ## [Unreleased]
 
+## [0.1.32] - 2026-08-11
+
+### Added
+
+- Add `audienti auth login` for browser-based local authentication through a loopback callback.
+- Add the `audienti-mcp` stdio bridge and Codex MCP manifest for Audienti's app-hosted MCP endpoint, including stage analytics and cohort list creation.
+
 ## [0.1.31] - 2026-08-10
 
 ### Added

package/README.md

@@ -1,9 +1,10 @@
 # Audienti CLI
 
 Audienti CLI is the agent-first command-line client for the Audienti production
-API. It lets local coding agents and operators inspect accounts, create and
-manage plays, import prospects, build lists, manage task reminders, and work
-supported operator flows.
+API and the local bridge for Audienti's app-hosted MCP endpoint. It lets local
+coding agents and operators inspect accounts,
+create and manage plays, import prospects, build lists, manage task reminders,
+and work supported operator flows.
 
 ## Install
 
@@ -25,16 +26,26 @@ For one-off use, run `npx @audienti/cli --help`.
 
 ## Authenticate
 
-Create an Audienti API token through the product, then configure this machine:
+Authenticate through the browser, then configure the default account context:
 
 ```bash
-audienti auth token <token>
+audienti auth login
 audienti accounts list --json
 audienti accounts select <acct_id>
 audienti users list
 audienti users select <account_user_id|email|name|me>
 ```
 
+`audienti auth login` opens Audienti in your browser, creates an API token from
+your signed-in web session, sends it back to a temporary `127.0.0.1` callback,
+and stores it in the local CLI config after validating it.
+
+If you already have a token, you can still configure it directly:
+
+```bash
+audienti auth token <token>
+```
+
 The CLI writes its local configuration to `~/.config/audienti/config.json` with
 owner-only permissions. Do not place a production token in an agent prompt,
 repository file, issue, or CI secret.
@@ -55,6 +66,71 @@ Use `--json` whenever another program or agent will consume the result. Inspect
 the target state before mutations, and use the command-specific help before
 creating, changing, or deleting data.
 
+## MCP
+
+Audienti serves MCP from the app at `/mcp`. The package ships a small stdio
+bridge for MCP hosts that need a local command:
+
+```bash
+audienti-mcp
+```
+
+Use it this way:
+
+1. Install the package.
+2. Run `audienti auth login`.
+3. Run `audienti accounts select <acct_id>`.
+4. Configure your MCP host with the packaged `.mcp.json`, or point it at the
+   `audienti-mcp` command.
+5. In the MCP host, list tools and call the account-scoped tool you need.
+
+The bridge reads the same `~/.config/audienti/config.json` as the CLI, forwards
+MCP JSON-RPC messages to the app, and injects the selected account when a tool
+call does not include `account_id`. If you want a tool to run against a
+different account, pass `account_id` in that tool call.
+
+MCP clients that can call HTTP directly may use the hosted endpoint instead of
+the stdio bridge:
+
+```bash
+curl https://app.audienti.com/mcp \
+  -H "Authorization: Bearer $AUDIENTI_API_TOKEN" \
+  -H "Content-Type: application/json" \
+  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'
+```
+
+Example tool call:
+
+```json
+{
+  "jsonrpc": "2.0",
+  "id": 2,
+  "method": "tools/call",
+  "params": {
+    "name": "analytics.stages",
+    "arguments": {
+      "account_id": "acct_...",
+      "query": {
+        "interval": "weekly",
+        "cohort_start_date": "2026-07-01",
+        "cohort_end_date": "2026-07-31"
+      }
+    }
+  }
+}
+```
+
+Useful MCP tools to start with:
+
+- `auth.me` confirms the token identity.
+- `accounts.list` shows accessible accounts.
+- `setup.play_preflight` returns LinkedIn connected-account readiness and setup
+  or mapping URLs.
+- `offers.create`, `icps.create`, and `motions.create` set up the offer, ICP,
+  and play.
+- `analytics.stages` returns stage conversion cohorts and stage aging.
+- `analytics.cohort_lists.create` materializes event cohorts as reusable lists.
+
 Common inspection commands:
 
 ```bash

package/bin/audienti-mcp.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+
+import { runMcpServer } from "../src/mcp.js";
+
+await runMcpServer();

package/package.json

@@ -1,15 +1,17 @@
 {
   "name": "@audienti/cli",
-  "version": "0.1.31",
+  "version": "0.1.32",
   "description": "Agent-first command-line client for Audienti.",
   "type": "module",
   "bin": {
-    "audienti": "./bin/audienti.js"
+    "audienti": "./bin/audienti.js",
+    "audienti-mcp": "./bin/audienti-mcp.js"
   },
   "files": [
     "bin/",
     "src/",
     "skills/",
+    ".mcp.json",
     "install",
     "README.md",
     "LICENSE",

package/skills/audienti/SKILL.md

@@ -1,12 +1,14 @@
 ---
 name: audienti
-description: Use when the user wants to operate Audienti through the production CLI, including account selection, plays, prospect imports, lists, message previews, or supported operator outcomes.
+description: Use when the user wants to operate Audienti through the production CLI or app-hosted MCP endpoint, including account selection, plays, prospect imports, lists, message previews, analytics, or supported operator outcomes.
 ---
 
-# Audienti CLI
+# Audienti CLI and MCP
 
-Use the installed `audienti` command as the production contract. Do not build a
-parallel wrapper or call undocumented API endpoints.
+Use the installed `audienti` command or Audienti's app-hosted MCP endpoint as
+the production contract. The packaged `audienti-mcp` command is only a local
+stdio bridge for MCP hosts. Do not build a parallel wrapper or call
+undocumented API endpoints.
 
 ## Setup
 
@@ -23,9 +25,15 @@ curl -fsSL https://cli.audienti.com/install | bash
 ```
 
 3. Authentication is explicit and per machine. Do not ask a user to paste a
-production token into chat, a repository file, an issue, or a CI secret. Use
-the existing `audienti auth token` flow only after the user supplies a token
-through an approved secure channel.
+production token into chat, a repository file, an issue, or a CI secret. Prefer
+browser login:
+
+```bash
+audienti auth login
+```
+
+Use `audienti auth token` only after the user supplies a token through an
+approved secure channel.
 
 4. Start with discovery, not mutation:
 
@@ -35,6 +43,39 @@ audienti accounts list --json
 audienti help agent-workflows
 ```
 
+For MCP hosts, configure the packaged `.mcp.json` or run:
+
+```bash
+audienti-mcp
+```
+
+The bridge reads the same local config as the CLI and forwards MCP JSON-RPC to
+the app-hosted `/mcp` endpoint. Before starting the bridge, select account
+context:
+
+```bash
+audienti auth login
+audienti accounts list --json
+audienti accounts select <acct_id>
+audienti users select me
+```
+
+If the MCP host can call HTTP directly, use `POST /mcp` with the same bearer
+token as the API. Call `tools/list` first, then call named tools with
+`tools/call`. Account-scoped tools accept `account_id`; the local bridge injects
+the selected CLI account when it is omitted.
+
+Useful MCP tools:
+
+- `auth.me` confirms the token identity.
+- `accounts.list` shows accessible accounts.
+- `setup.play_preflight` returns connected-account readiness and setup or
+  mapping URLs.
+- `offers.create`, `icps.create`, and `motions.create` set up the offer, ICP,
+  and play.
+- `analytics.stages` returns stage conversion cohorts and stage aging.
+- `analytics.cohort_lists.create` materializes event cohorts as reusable lists.
+
 ## Operating Rules
 
 - Use `--json` whenever another agent or tool will consume the response.

package/src/api-client.js

@@ -40,6 +40,13 @@ export class AudientiClient {
     return this.requestJson("/api/v1/accounts.json");
   }
 
+  mcp(message) {
+    return this.requestJson("/mcp", {
+      method: "POST",
+      body: message
+    });
+  }
+
   users(accountId) {
     return this.requestJson(accountPath(accountId, ["users"]));
   }

package/src/cli.js

@@ -1,4 +1,7 @@
 import { parseArgs } from "node:util";
+import { createServer } from "node:http";
+import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { basename, join } from "node:path";
 import { ApiError, AudientiClient, DEFAULT_HOST, normalizeHost } from "./api-client.js";
@@ -17,6 +20,7 @@ const DEFAULT_LIST_LIMIT = 20;
 const API_MAX_LIST_LIMIT = 100;
 const DEFAULT_LOOKUP_TIMEOUT_SECONDS = 60;
 const DEFAULT_LOOKUP_POLL_INTERVAL_SECONDS = 2;
+const DEFAULT_AUTH_LOGIN_TIMEOUT_SECONDS = 180;
 const DEFAULT_WRITER_TEST_RUN_TIMEOUT_SECONDS = 180;
 const DEFAULT_WRITER_TEST_RUN_POLL_INTERVAL_SECONDS = 2;
 const PACKAGE_NAME = "@audienti/cli";
@@ -182,6 +186,7 @@ async function dispatch(argv, context) {
   const normalizedResource = normalizeResource(resource);
 
   if (normalizedResource === "auth" && action === "token") return authToken(rest, context);
+  if (normalizedResource === "auth" && action === "login") return authLogin(rest, context);
   if (normalizedResource === "auth" && action === "status") return authStatus(rest, context, { accountOverride });
   if (normalizedResource === "auth" && action === "logout") return authLogout(rest, context);
   if (normalizedResource === "config" && action === "list") return configList(rest, context);
@@ -406,12 +411,148 @@ async function authToken(args, context) {
   writeLine(context.stdout, "Run `audienti accounts list` to choose an account.");
 }
 
+async function authLogin(args, context) {
+  const { values, positionals } = parseCommandArgs(args, {
+    ...jsonOptions(),
+    host: { type: "string" },
+    "timeout-seconds": { type: "string" },
+    "no-open": { type: "boolean" }
+  });
+
+  if (positionals.length > 0) {
+    throw new CommandError("Usage: audienti auth login [--host https://app.audienti.com] [--timeout-seconds <n>] [--no-open] [--json]");
+  }
+
+  const host = normalizeHost(values.host || DEFAULT_HOST);
+  const timeoutSeconds = normalizeOptionalPositiveInteger(values["timeout-seconds"], "--timeout-seconds") || DEFAULT_AUTH_LOGIN_TIMEOUT_SECONDS;
+  const state = randomBytes(24).toString("hex");
+  const callback = await createAuthCallbackServer({ state, context });
+  const authUrl = new URL("/cli/auth", host);
+  authUrl.searchParams.set("redirect_uri", callback.redirectUri);
+  authUrl.searchParams.set("state", state);
+
+  if (values.json) {
+    writeJson(context.stdout, {
+      kind: "auth_login_start",
+      auth_url: authUrl.toString(),
+      callback_url: callback.redirectUri,
+      timeout_seconds: timeoutSeconds
+    });
+  } else {
+    writeLine(context.stdout, "Open this URL to authenticate Audienti CLI:");
+    writeLine(context.stdout, authUrl.toString());
+  }
+
+  if (!values["no-open"]) openBrowser(authUrl.toString(), context);
+
+  let payload;
+  try {
+    payload = await callback.wait(timeoutSeconds);
+  } finally {
+    await callback.close();
+  }
+
+  const client = new AudientiClient({ host: payload.host || host, token: payload.token, fetchImpl: context.fetchImpl });
+  const user = await client.me();
+  await writeConfig({
+    host: client.host,
+    token: payload.token,
+    accountId: payload.account_id || undefined,
+    accountName: payload.account_name || undefined
+  }, { env: context.env });
+
+  const result = {
+    kind: "auth_login_complete",
+    host: client.host,
+    user: user?.name || payload.user_name || payload.user_email || user?.email || null,
+    account_id: payload.account_id || null,
+    account_name: payload.account_name || null
+  };
+
+  if (values.json) return writeJson(context.stdout, result);
+
+  writeLine(context.stdout, `Authenticated to ${client.host} as ${result.user || "current user"}.`);
+  if (result.account_id) writeLine(context.stdout, `Selected account ${result.account_name || result.account_id} (${result.account_id}).`);
+  if (!result.account_id) writeLine(context.stdout, "Run `audienti accounts list` to choose an account.");
+}
+
+async function createAuthCallbackServer({ state, context }) {
+  let resolvePayload;
+  let rejectPayload;
+  const waitPromise = new Promise((resolve, reject) => {
+    resolvePayload = resolve;
+    rejectPayload = reject;
+  });
+
+  const server = createServer((request, response) => {
+    const url = new URL(request.url, "http://127.0.0.1");
+    if (url.pathname !== "/callback") {
+      response.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
+      response.end("Not found.");
+      return;
+    }
+
+    const payload = Object.fromEntries(url.searchParams.entries());
+    if (payload.state !== state) {
+      response.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" });
+      response.end("Audienti CLI authentication failed: state mismatch.");
+      rejectPayload(new CommandError("Browser authentication state mismatch."));
+      return;
+    }
+
+    if (!payload.token) {
+      response.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" });
+      response.end("Audienti CLI authentication failed: missing token.");
+      rejectPayload(new CommandError("Browser authentication callback did not include a token."));
+      return;
+    }
+
+    response.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+    response.end("<!doctype html><title>Audienti CLI authenticated</title><p>Audienti CLI is authenticated. You can close this window.</p>");
+    resolvePayload(payload);
+  });
+
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", resolve);
+  });
+
+  const { port } = server.address();
+
+  return {
+    redirectUri: `http://127.0.0.1:${port}/callback`,
+    wait(timeoutSeconds) {
+      let timeoutId;
+      const timeoutPromise = new Promise((_, reject) => {
+        timeoutId = setTimeout(() => reject(new CommandError(`Timed out waiting for browser authentication after ${timeoutSeconds} seconds.`)), timeoutSeconds * 1000);
+      });
+
+      return Promise.race([waitPromise, timeoutPromise]).finally(() => clearTimeout(timeoutId));
+    },
+    close() {
+      return new Promise((resolve) => server.close(() => resolve()));
+    }
+  };
+}
+
+function openBrowser(url, context) {
+  const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+
+  try {
+    const child = spawn(command, args, { detached: true, stdio: "ignore" });
+    child.unref();
+  } catch (error) {
+    writeLine(context.stderr, `Could not open browser automatically: ${error.message}`);
+  }
+}
+
 async function authStatus(args, context, { accountOverride } = {}) {
   assertNoPositionals(args, "Usage: audienti auth status [--account <acct_id>]");
 
   const config = await readConfig({ env: context.env });
   if (!config.token) {
-    writeLine(context.stdout, "Not authenticated. Run `audienti auth token <token>`.");
+    writeLine(context.stdout, "Not authenticated. Run `audienti auth login`.");
     return 1;
   }
 
@@ -2833,7 +2974,7 @@ function assertNoPositionals(args, usageText) {
 async function requireAuthenticatedConfig(context) {
   const config = await readConfig({ env: context.env });
   if (!config.token) {
-    throw new CommandError("Not authenticated. Run `audienti auth token <token>`.");
+    throw new CommandError("Not authenticated. Run `audienti auth login` or `audienti auth token <token>`.");
   }
 
   return config;
@@ -5982,6 +6123,7 @@ const HELP_TOPICS = new Map([
     "  audienti <command> [options]",
     "",
     "Start:",
+    "  audienti auth login                 Sign in through the browser",
     "  audienti auth token <token>         Save an API token",
     "  audienti accounts list             See accounts available to this token",
     "  audienti accounts select <acct_id>  Use one account by default",
@@ -6121,6 +6263,7 @@ const HELP_TOPICS = new Map([
 
   ["auth", [
     "Usage:",
+    "  audienti auth login [--host <url>] [--timeout-seconds <n>] [--no-open] [--json]",
     "  audienti auth token <token> [--host <url>]",
     "  audienti auth status",
     "  audienti auth logout",
@@ -6128,11 +6271,32 @@ const HELP_TOPICS = new Map([
     "Status: implemented",
     "",
     "Commands:",
+    "  audienti auth login          Open Audienti in a browser and save the returned token",
     "  audienti auth token <token>  Validate and save a bearer API token",
     "  audienti auth status         Check live auth and show selected account",
     "  audienti auth logout         Delete local CLI auth config",
     "",
-    "Run `audienti auth token help` for token input shape."
+    "Run `audienti auth login help` for browser authentication."
+  ].join("\n")],
+
+  ["auth login", [
+    "Usage:",
+    "  audienti auth login [--host <url>] [--timeout-seconds <n>] [--no-open] [--json]",
+    "",
+    "Status: implemented",
+    "",
+    "Options:",
+    "  --host <url>           Audienti host. Default: https://app.audienti.com",
+    "  --timeout-seconds <n>  Wait budget before the command fails. Default: 180",
+    "  --no-open              Print the URL without opening a browser",
+    "  --json                 Print machine-readable start and completion payloads",
+    "",
+    "Flow:",
+    "  Starts a temporary 127.0.0.1 callback server, opens /cli/auth in the browser,",
+    "  and saves the returned API token to ~/.config/audienti/config.json after validation.",
+    "",
+    "Example:",
+    "  audienti auth login --host https://app.audienti.com"
   ].join("\n")],
 
   ["auth token", [
@@ -8911,7 +9075,7 @@ const HELP_TOPICS = new Map([
     "  Give a local coding agent the shortest safe path through the common Audienti production workflows.",
     "",
     "1. Authenticate and select an account",
-    "  audienti auth token <token>",
+    "  audienti auth login",
     "  audienti accounts list",
     "  audienti accounts select <acct_id>",
     "  audienti users list",

package/src/mcp.js

@@ -0,0 +1,103 @@
+import { ApiError, AudientiClient, DEFAULT_HOST } from "./api-client.js";
+import { readConfig } from "./config.js";
+
+export async function runMcpServer({
+  input = process.stdin,
+  output = process.stdout,
+  env = process.env,
+  fetchImpl = globalThis.fetch
+} = {}) {
+  input.setEncoding("utf8");
+
+  let buffer = "";
+  for await (const chunk of input) {
+    buffer += chunk;
+    const lines = buffer.split(/\r?\n/);
+    buffer = lines.pop() || "";
+
+    for (const line of lines) {
+      if (!line.trim()) continue;
+      const response = await handleRawMessage(line, { env, fetchImpl });
+      if (response) output.write(`${JSON.stringify(response)}\n`);
+    }
+  }
+}
+
+export async function handleRawMessage(line, options = {}) {
+  try {
+    return handleMcpRequest(JSON.parse(line), options);
+  } catch (error) {
+    return errorResponse(null, -32700, error.message);
+  }
+}
+
+export async function handleMcpRequest(message, { env = process.env, fetchImpl = globalThis.fetch } = {}) {
+  if (!message || message.jsonrpc !== "2.0") {
+    return errorResponse(message?.id ?? null, -32600, "Invalid JSON-RPC request.");
+  }
+
+  if (message.id === undefined || message.id === null) return null;
+
+  try {
+    return await remoteMcpResponse(message, { env, fetchImpl });
+  } catch (error) {
+    return errorResponse(message.id, -32603, toolErrorMessage(error), toolErrorPayload(error));
+  }
+}
+
+async function remoteMcpResponse(message, { env = process.env, fetchImpl = globalThis.fetch } = {}) {
+  const config = await readConfig({ env });
+  if (!config.token) throw new Error("Not authenticated. Run `audienti auth login` or `audienti auth token <token>`.");
+
+  const client = new AudientiClient({
+    host: config.host || DEFAULT_HOST,
+    token: config.token,
+    fetchImpl
+  });
+
+  return client.mcp(withSelectedAccount(message, config));
+}
+
+function withSelectedAccount(message, config) {
+  if (message.method !== "tools/call" || !config.accountId) return message;
+
+  const params = message.params || {};
+  const args = params.arguments || {};
+  if (args.account_id) return message;
+
+  return {
+    ...message,
+    params: {
+      ...params,
+      arguments: {
+        ...args,
+        account_id: config.accountId
+      }
+    }
+  };
+}
+
+function errorResponse(id, code, message, data) {
+  return {
+    jsonrpc: "2.0",
+    id,
+    error: {
+      code,
+      message,
+      ...(data === undefined ? {} : { data })
+    }
+  };
+}
+
+function toolErrorMessage(error) {
+  if (error instanceof ApiError && error.status) return `${error.message} (HTTP ${error.status})`;
+  return error.message;
+}
+
+function toolErrorPayload(error) {
+  return {
+    error: error.message,
+    status: error instanceof ApiError ? error.status || null : null,
+    body: error instanceof ApiError ? error.body || null : null
+  };
+}