@cargo-ai/cli 1.0.31 → 1.0.33

package/build/commands/mcp.d.ts

@@ -0,0 +1,4 @@
+import type { Command } from "commander";
+import type { Api } from "../api.js";
+export declare function registerMcpCommand(parent: Command, getApi: () => Api): void;
+//# sourceMappingURL=mcp.d.ts.map

package/build/commands/mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/commands/mcp.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAerC,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,GAAG,IAAI,CAqD3E"}

package/build/commands/mcp.js

@@ -0,0 +1,192 @@
+import { createRequire } from "node:module";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { getConfig } from "../config.js";
+import { getProxyFetch } from "../proxy.js";
+import { ExitCodes, failWith, handleApiCall, info } from "./runHandler.js";
+const require = createRequire(import.meta.url);
+const { version } = require("../../package.json");
+// The prod REST API and the prod MCP server are the same backend image behind
+// two hostnames; the MCP one (mcp.getcargo.io) is tuned for long-lived streaming.
+// Point the bridge there when the CLI is talking to prod, but leave any other
+// base URL (staging, localhost) untouched — that same host serves the MCP routes.
+const PROD_API_HOST = "api.getcargo.io";
+const PROD_MCP_HOST = "mcp.getcargo.io";
+export function registerMcpCommand(parent, getApi) {
+    parent
+        .command("mcp")
+        .description("Run a local MCP server that bridges to a Cargo MCP server over stdio")
+        .option("--server <uuid>", "MCP server UUID to expose (default: CARGO_MCP_SERVER_UUID, or the workspace's only MCP server)")
+        .addHelpText("after", `
+Exposes a Cargo-hosted MCP server as a local stdio MCP server, so any stdio MCP
+client (Claude Code, Claude Desktop, Cursor, ...) can use it with the CLI's own
+credentials — no token to copy into client config.
+
+Register it with a client, e.g. Claude Code:
+  $ claude mcp add cargo -- cargo-ai mcp --server <uuid>
+
+Environment:
+  CARGO_MCP_SERVER_UUID   default --server value
+  CARGO_MCP_BASE_URL      override the MCP endpoint origin (advanced/local dev)
+
+Reads auth from the same place as every other command (CARGO_API_TOKEN or the
+credentials file). stdout carries the MCP protocol; all logs go to stderr.`)
+        .action(async (opts) => {
+        const { accessToken, baseUrl, workspaceUuid } = getConfig();
+        if (accessToken === undefined) {
+            failWith('Not authenticated. Run "cargo-ai login --token <token>" or "cargo-ai login --oauth".', { code: ExitCodes.NotAuthenticated });
+        }
+        const serverUuid = await resolveServerUuid(opts.server, getApi);
+        const endpoint = resolveMcpEndpoint(baseUrl, serverUuid);
+        const headers = {
+            authorization: `Bearer ${accessToken}`,
+            "x-cargo-origin": "cli",
+            "x-cargo-origin-version": version,
+        };
+        if (workspaceUuid !== undefined) {
+            headers["selected-workspace-uuid"] = workspaceUuid;
+        }
+        info(`Cargo MCP bridge -> ${endpoint}`);
+        await runBridge(endpoint, headers);
+    });
+}
+const resolveServerUuid = async (explicit, getApi) => {
+    if (explicit !== undefined)
+        return explicit;
+    const fromEnv = process.env["CARGO_MCP_SERVER_UUID"];
+    if (fromEnv !== undefined && fromEnv.length > 0)
+        return fromEnv;
+    const api = getApi();
+    const { mcpServers } = await handleApiCall(() => api.ai.mcpServer.all(), {
+        spinner: false,
+    });
+    if (mcpServers.length === 0) {
+        failWith("No MCP server in this workspace. Create one with 'cargo-ai ai mcp-server create --name ...', then pass --server <uuid>.", { code: ExitCodes.InvalidUsage });
+    }
+    const only = mcpServers[0];
+    if (mcpServers.length > 1 || only === undefined) {
+        failWith("Multiple MCP servers found; pass --server <uuid>.", {
+            code: ExitCodes.InvalidUsage,
+            extra: {
+                servers: mcpServers.map((server) => ({
+                    uuid: server.uuid,
+                    name: server.name,
+                })),
+            },
+        });
+    }
+    return only.uuid;
+};
+const resolveMcpEndpoint = (baseUrl, uuid) => {
+    const override = process.env["CARGO_MCP_BASE_URL"];
+    const origin = override !== undefined && override.length > 0
+        ? override
+        : mapApiHostToMcp(baseUrl);
+    return `${origin.replace(/\/+$/, "")}/v1/ai/mcpServers/${uuid}/mcp`;
+};
+const mapApiHostToMcp = (baseUrl) => {
+    try {
+        const url = new URL(baseUrl);
+        if (url.hostname === PROD_API_HOST) {
+            url.hostname = PROD_MCP_HOST;
+            return url.origin;
+        }
+        return baseUrl;
+    }
+    catch {
+        return baseUrl;
+    }
+};
+// Pipe two MCP transports message-for-message: the local stdio server (facing the
+// MCP client) and the remote streamable-HTTP client (facing Cargo). Forwarding raw
+// JSON-RPC keeps the bridge transparent — tools, resources, and long-running-tool
+// progress notifications all pass through without enumerating capabilities here.
+const runBridge = async (endpoint, headers) => {
+    // Prefer a proxied fetch when HTTPS_PROXY/HTTP_PROXY applies — Node's
+    // built-in fetch ignores those env vars, so without this the bridge would
+    // fail in proxied environments even though server discovery (Axios) works.
+    const remote = new StreamableHTTPClientTransport(new URL(endpoint), {
+        requestInit: { headers },
+        fetch: getProxyFetch(endpoint),
+    });
+    const local = new StdioServerTransport();
+    await new Promise((resolve, reject) => {
+        const state = { closed: false };
+        // Shared handlers so finish/fail can remove whichever listeners are still
+        // registered. process.once / stdin.once only drop the event that fired; the
+        // others would otherwise keep the event loop alive and hang the process
+        // after resolve()/reject().
+        const onSignal = () => {
+            finish("Cargo MCP: shutting down.");
+        };
+        const onStdinGone = () => {
+            finish("Cargo MCP: client disconnected.");
+        };
+        const teardown = () => {
+            process.removeListener("SIGINT", onSignal);
+            process.removeListener("SIGTERM", onSignal);
+            process.stdin.removeListener("end", onStdinGone);
+            process.stdin.removeListener("close", onStdinGone);
+            void remote.close().catch(() => { });
+            void local.close().catch(() => { });
+        };
+        // Client disconnect and process signals are normal ends — resolve so the
+        // command exits 0. Upstream/startup/stdio failures must reject so callers
+        // and MCP clients see a non-zero exit (CLI contract: 0 means success).
+        const finish = (reason) => {
+            if (state.closed)
+                return;
+            state.closed = true;
+            if (reason !== undefined)
+                info(reason);
+            teardown();
+            resolve();
+        };
+        const fail = (message) => {
+            if (state.closed)
+                return;
+            state.closed = true;
+            teardown();
+            reject(new Error(message));
+        };
+        // Forward raw JSON-RPC both ways. A failing transport reports the reason via
+        // onerror (which fires before the send rejection), so the reason is logged
+        // there once; these catches only need to guarantee teardown.
+        remote.onmessage = (message) => {
+            void local.send(message).catch(() => finish());
+        };
+        local.onmessage = (message) => {
+            void remote.send(message).catch(() => finish());
+        };
+        // Reject with the failure reason once. Stay silent once we're already
+        // closing: the in-flight SSE stream aborting during our own shutdown surfaces
+        // here as expected noise.
+        remote.onerror = (error) => {
+            fail(`Cargo MCP: upstream error: ${error.message}`);
+        };
+        local.onerror = (error) => {
+            fail(`Cargo MCP: stdio error: ${error.message}`);
+        };
+        remote.onclose = () => fail("Cargo MCP: upstream closed.");
+        local.onclose = () => finish("Cargo MCP: client disconnected.");
+        process.once("SIGINT", onSignal);
+        process.once("SIGTERM", onSignal);
+        // @modelcontextprotocol/sdk 1.29.0 StdioServerTransport only listens for
+        // stdin `data`/`error` — it never wires `end`/`close`, so local.onclose
+        // above does not fire when the MCP client closes the pipe without a
+        // signal. Detect stdin EOF ourselves so we tear down the upstream
+        // streamable-HTTP session instead of leaving a zombie bridge.
+        // See https://github.com/modelcontextprotocol/typescript-sdk/issues/2002
+        if (process.stdin.readableEnded === true ||
+            process.stdin.destroyed === true) {
+            onStdinGone();
+            return;
+        }
+        process.stdin.once("end", onStdinGone);
+        process.stdin.once("close", onStdinGone);
+        Promise.all([remote.start(), local.start()]).catch((error) => {
+            fail(`Cargo MCP: failed to start bridge: ${describe(error)}`);
+        });
+    });
+};
+const describe = (error) => error instanceof Error ? error.message : String(error);

package/build/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from "node:module";
-import { registerCommands as registerCdkCommands } from "@cargo-ai/cdk/cli";
+import { registerCommands as registerCdkCommands, registerManifestCommands, } from "@cargo-ai/cdk/cli";
 import { Command } from "commander";
 import { createApi } from "./api.js";
 import { registerAiCommands } from "./commands/ai/index.js";
@@ -12,6 +12,7 @@ import { registerContextCommands } from "./commands/context/index.js";
 import { registerExpressionCommands } from "./commands/expression/index.js";
 import { registerHostingCommands } from "./commands/hosting/index.js";
 import { registerInitCommand } from "./commands/init.js";
+import { registerMcpCommand } from "./commands/mcp.js";
 import { registerOrchestrationCommands } from "./commands/orchestration/index.js";
 import { registerRevenueOrganizationCommands } from "./commands/revenueOrganization/index.js";
 import { ExitCodes, failWith } from "./commands/runHandler.js";
@@ -73,9 +74,13 @@ registerSystemOfRecordIntegrationCommands(program, getApi);
 registerUserManagementCommands(program, getApi);
 registerAiCommands(program, getApi);
 registerHostingCommands(program, getApi);
+registerMcpCommand(program, getApi);
 registerCdkCommands(program
     .command("cdk")
     .description("Cargo CDK — define resources in code and deploy them (plan/deploy)"), getApi);
+registerManifestCommands(program
+    .command("manifest")
+    .description("Manifest — scaffold a GTM repo (context, infra, skills, evals, outputs) and install cookbook modules into it"));
 program
     .parseAsync()
     .then(() => maybeNotifyUpdate(version))

package/build/proxy.d.ts

@@ -14,4 +14,16 @@ import type { ClientTransport } from "@cargo-ai/api";
  * default direct-egress behavior.
  */
 export declare const getProxyTransport: (targetUrl: string) => ClientTransport | undefined;
+/**
+ * Build a `fetch` implementation that tunnels through an HTTP/HTTPS proxy
+ * when one is configured via the same env vars as {@link getProxyTransport}.
+ *
+ * Node's built-in `fetch` (and therefore MCP's `StreamableHTTPClientTransport`)
+ * does not honor `HTTPS_PROXY` / `HTTP_PROXY` on its own. Callers that need
+ * proxied egress should pass the result as the transport's `fetch` option.
+ *
+ * Returns `undefined` when no proxy applies, so the caller can keep the
+ * default global `fetch`.
+ */
+export declare const getProxyFetch: (targetUrl: string) => ((url: string | URL, init?: RequestInit) => Promise<Response>) | undefined;
 //# sourceMappingURL=proxy.d.ts.map

package/build/proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AA4CrD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,cACjB,MAAM,KAChB,eAAe,GAAG,SAoBpB,CAAC"}
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAmErD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,cACjB,MAAM,KAChB,eAAe,GAAG,SAWpB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa,cACb,MAAM,YAER,MAAM,GAAG,GAAG,SAAS,WAAW,KAAK,QAAQ,QAAQ,CAAC,aAchE,CAAC"}

package/build/proxy.js

@@ -1,5 +1,6 @@
 import { HttpProxyAgent } from "http-proxy-agent";
 import { HttpsProxyAgent } from "https-proxy-agent";
+import { fetch as undiciFetch, ProxyAgent, } from "undici";
 const getEnv = (...names) => {
     for (const name of names) {
         const value = process.env[name];
@@ -32,6 +33,21 @@ const shouldBypassProxy = (targetUrl, noProxy) => {
         return hostname === normalized || hostname.endsWith(`.${normalized}`);
     });
 };
+/**
+ * Resolve the proxy URL for a target from the standard proxy env vars
+ * (`HTTPS_PROXY`, `HTTP_PROXY`, `ALL_PROXY`, honoring `NO_PROXY`).
+ *
+ * Returns `undefined` when no proxy applies.
+ */
+const resolveProxyUrl = (targetUrl) => {
+    if (shouldBypassProxy(targetUrl, getEnv("NO_PROXY", "no_proxy"))) {
+        return undefined;
+    }
+    const isHttps = targetUrl.startsWith("https:");
+    return isHttps
+        ? getEnv("HTTPS_PROXY", "https_proxy", "ALL_PROXY", "all_proxy")
+        : getEnv("HTTP_PROXY", "http_proxy", "ALL_PROXY", "all_proxy");
+};
 /**
  * Build Axios transport overrides that tunnel requests through an
  * HTTP/HTTPS proxy when one is configured via the standard proxy env
@@ -47,13 +63,7 @@ const shouldBypassProxy = (targetUrl, noProxy) => {
  * default direct-egress behavior.
  */
 export const getProxyTransport = (targetUrl) => {
-    if (shouldBypassProxy(targetUrl, getEnv("NO_PROXY", "no_proxy"))) {
-        return undefined;
-    }
-    const isHttps = targetUrl.startsWith("https:");
-    const proxyUrl = isHttps
-        ? getEnv("HTTPS_PROXY", "https_proxy", "ALL_PROXY", "all_proxy")
-        : getEnv("HTTP_PROXY", "http_proxy", "ALL_PROXY", "all_proxy");
+    const proxyUrl = resolveProxyUrl(targetUrl);
     if (proxyUrl === undefined) {
         return undefined;
     }
@@ -63,3 +73,25 @@ export const getProxyTransport = (targetUrl) => {
         proxy: false,
     };
 };
+/**
+ * Build a `fetch` implementation that tunnels through an HTTP/HTTPS proxy
+ * when one is configured via the same env vars as {@link getProxyTransport}.
+ *
+ * Node's built-in `fetch` (and therefore MCP's `StreamableHTTPClientTransport`)
+ * does not honor `HTTPS_PROXY` / `HTTP_PROXY` on its own. Callers that need
+ * proxied egress should pass the result as the transport's `fetch` option.
+ *
+ * Returns `undefined` when no proxy applies, so the caller can keep the
+ * default global `fetch`.
+ */
+export const getProxyFetch = (targetUrl) => {
+    const proxyUrl = resolveProxyUrl(targetUrl);
+    if (proxyUrl === undefined) {
+        return undefined;
+    }
+    const agent = new ProxyAgent(proxyUrl);
+    return (url, init) => undiciFetch(url, {
+        ...init,
+        dispatcher: agent,
+    });
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cargo-ai/cli",
-  "version": "1.0.31",
+  "version": "1.0.33",
   "private": false,
   "license": "UNLICENSED",
   "description": "Command-line interface for the Cargo API",
@@ -31,14 +31,16 @@
   },
   "dependencies": {
     "@cargo-ai/api": "^1.0.40",
-    "@cargo-ai/types": "*",
-    "@cargo-ai/app-sdk": "^1.0.3",
+    "@cargo-ai/app-sdk": "^1.0.5",
     "@cargo-ai/cdk": "*",
+    "@cargo-ai/types": "*",
     "@cargo-ai/worker-sdk": "^1.0.6",
+    "@modelcontextprotocol/sdk": "1.29.0",
     "commander": "^12.1.0",
     "http-proxy-agent": "^9.1.0",
     "https-proxy-agent": "^9.1.0",
-    "tsx": "^4.19.2"
+    "tsx": "^4.19.2",
+    "undici": "^7.24.8"
   },
   "devDependencies": {
     "@cargo-ai/eslint-config": "*",