@cruxy/cli 0.26.0 → 0.28.0

package/dist/cli/commands/mcp.js

@@ -1,9 +1,11 @@
 import path from "node:path";
 import { Command } from "commander";
-import { loadConfig } from "../../config/index.js";
-import { shouldUseColor } from "../../errors/index.js";
+import { loadConfig, writeMcpCredential } from "../../config/index.js";
+import { defaultOnboardingIO } from "../../onboarding/index.js";
+import { interactiveRequired, shouldUseColor } from "../../errors/index.js";
 import { themeForColor } from "../../theme/index.js";
-import { fileMcpTrustStore, fingerprintMcpServers, isMcpTrusted, } from "../../mcp/index.js";
+import { fileMcpTrustStore, fingerprintMcpServers, isMcpTrusted, resolveMcpEndpoints, } from "../../mcp/index.js";
+import { BlockedHostError, defaultResolveHost, HostUnresolvedError, } from "../../net/ip-guard.js";
 import { logger } from "../../utils/logger.js";
 /**
  * `cruxy mcp` — inspect and control MCP server integration (C.27). `list` shows
@@ -36,11 +38,16 @@ export function mcpCommand() {
         for (const [name, cfg] of Object.entries(servers)) {
             logger.print(`  ${t.strong(name)} ${t.muted(describeServer(cfg))}`);
         }
+        if (trusted && Object.values(servers).some((c) => c.url)) {
+            // JC-D: url servers are also bound to their resolved IP set, re-checked at
+            // connect; a changed IP set re-gates even though the static status is "trusted".
+            logger.print(t.muted("\n  note: url servers are re-verified against their trusted IP set on connect"));
+        }
     });
     cmd
         .command("trust [path]")
         .description("trust this repo's MCP integrations (they run with your full privileges)")
-        .action((target) => {
+        .action(async (target) => {
         const t = themeForColor(shouldUseColor(process.stdout));
         const { config } = loadConfig();
         const servers = config.mcp.servers;
@@ -50,17 +57,91 @@ export function mcpCommand() {
             logger.print(t.muted(`no MCP servers configured under ${root}`));
             return;
         }
-        logger.print(t.danger(t.strong(`trusting ${names.length} MCP server${names.length === 1 ? "" : "s"} — these run their own code UNSANDBOXED with your privileges:`)));
+        const hasStdio = Object.values(servers).some((c) => c.command);
+        const hasUrl = Object.values(servers).some((c) => c.url);
+        logger.print(t.danger(t.strong(`trusting ${names.length} MCP server${names.length === 1 ? "" : "s"} for ${root}:`)));
         for (const [name, cfg] of Object.entries(servers)) {
             logger.print(`  ${t.strong(name)} ${t.muted(describeServer(cfg))}`);
         }
+        if (hasStdio) {
+            logger.print(t.muted("  stdio servers run their code UNSANDBOXED with your full privileges."));
+        }
+        if (hasUrl) {
+            logger.print(t.muted("  url servers receive your tool arguments over the network; trust binds\n" +
+                "  the URL + its current IP set (weaker than a local binary — see docs)."));
+            // C.27c: a server that also RECEIVES a credential is a bigger grant —
+            // name it so the grant is explicit at trust time.
+            for (const [name, cfg] of Object.entries(servers)) {
+                if (!cfg.credentialRef && !cfg.headers)
+                    continue;
+                const what = cfg.credentialRef
+                    ? `your "${cfg.credentialRef}" credential`
+                    : "your configured auth headers";
+                logger.print(t.danger(`  "${name}" will RECEIVE ${what} on every request.`));
+            }
+        }
+        // JC-D: capture + SSRF-validate each url server's endpoint set and bind it
+        // into the decision. A refused URL (SSRF/scheme) fails closed — no record.
+        let endpoints = {};
+        try {
+            endpoints = await resolveMcpEndpoints(servers, defaultResolveHost);
+        }
+        catch (err) {
+            if (err instanceof BlockedHostError ||
+                err instanceof HostUnresolvedError) {
+                logger.print(t.danger(`refused to trust — a url server could not be validated: ${err.message}`));
+                return;
+            }
+            throw err;
+        }
         fileMcpTrustStore().record({
             root,
             fingerprint: fingerprintMcpServers(servers),
             at: new Date().toISOString(),
+            endpoints,
         });
         logger.print(`${t.success("trusted")} — cruxy will connect these servers for ${root}. ` +
-            t.muted("changing the config will require re-trusting."));
+            t.muted("changing the config (or a url's IP set) requires re-trusting."));
+    });
+    cmd
+        .command("login <server>")
+        .description("set a bearer credential for a remote MCP integration (owner-only in ~/.cruxy)")
+        .action(async (server) => {
+        const t = themeForColor(shouldUseColor(process.stdout));
+        const { config } = loadConfig();
+        const cfg = config.mcp.servers[server];
+        if (!cfg) {
+            logger.print(t.danger(`no MCP server "${server}" is configured (mcp.servers)`));
+            process.exitCode = 1;
+            return;
+        }
+        if (!cfg.url) {
+            logger.print(t.danger(`server "${server}" is a stdio server — it has no bearer credential ` +
+                "(stdio servers take secrets via `env`)"));
+            process.exitCode = 1;
+            return;
+        }
+        // The store is keyed by the credential NAME the config references; default
+        // to the server id when the config names none.
+        const ref = cfg.credentialRef ?? server;
+        if (!process.stdin.isTTY) {
+            // Never read a secret from a pipe silently — same discipline as onboarding.
+            throw interactiveRequired(`a credential for MCP server "${server}"`, [
+                "run this in an interactive terminal",
+            ]);
+        }
+        const io = defaultOnboardingIO(shouldUseColor(process.stderr));
+        io.write(`${t.strong(`credential for "${server}"`)} ${t.muted(`(stored as "${ref}" in ~/.cruxy/credentials.json, 0600)`)}\n`);
+        io.write(`${t.muted("paste the bearer token (input hidden): ")}`);
+        const token = (await io.readSecret()).trim();
+        if (!token) {
+            logger.print(t.warning("no token entered — nothing was stored"));
+            process.exitCode = 1;
+            return;
+        }
+        writeMcpCredential(ref, token);
+        logger.print(`${t.success("stored")} — cruxy will send this credential to "${server}" over https only. ` +
+            t.muted("re-run to rotate; the value is never shown or logged."));
     });
     cmd
         .command("untrust [path]")
@@ -83,5 +164,23 @@ function describeServer(cfg) {
     if (cfg.command) {
         return `(stdio: ${[cfg.command, ...(cfg.args ?? [])].join(" ")})`;
     }
-    return cfg.url ? `(url: ${cfg.url})` : "(no transport)";
+    if (!cfg.url)
+        return "(no transport)";
+    return `(url: ${cfg.url}${describeAuth(cfg)})`;
+}
+/**
+ * A REDACTED auth descriptor for display (C.27c) — names the credential and
+ * counts raw headers, but NEVER prints a header value or a token. Display
+ * redaction is defense-in-depth; the load-bearing guard is that project config
+ * can't carry a value at all.
+ */
+function describeAuth(cfg) {
+    const parts = [];
+    if (cfg.credentialRef)
+        parts.push(`credential: ${cfg.credentialRef}`);
+    const headerCount = cfg.headers ? Object.keys(cfg.headers).length : 0;
+    if (headerCount > 0) {
+        parts.push(`${headerCount} header${headerCount === 1 ? "" : "s"} (redacted)`);
+    }
+    return parts.length ? `, ${parts.join(", ")}` : "";
 }

package/dist/config/credentials.d.ts

@@ -2,6 +2,15 @@
 export declare function credentialsPath(): string;
 /** The stored key for `provider`, or `undefined`. Never throws. */
 export declare function readCredential(provider: string, file?: string): string | undefined;
+/**
+ * The stored MCP bearer token for credential name `ref`, or `undefined` (C.27c).
+ * Reads ONLY this owner-only store — never the environment, never any config file
+ * — so a project config that merely NAMES a credential can never widen where the
+ * secret is sourced from. Never throws.
+ */
+export declare function readMcpCredential(ref: string, file?: string): string | undefined;
+/** Persist MCP bearer token for credential name `ref`. Same 0600/0700 as keys. */
+export declare function writeMcpCredential(ref: string, token: string, file?: string): void;
 /**
  * Persist `key` for `provider`, merging into any existing store. The file is
  * written `0600` and its directory `0700` so the secret is owner-only — enforced

package/dist/config/credentials.js

@@ -39,12 +39,40 @@ export function readCredential(provider, file = credentialsPath()) {
     const key = store?.keys[provider];
     return typeof key === "string" && key !== "" ? key : undefined;
 }
+/**
+ * The stored MCP bearer token for credential name `ref`, or `undefined` (C.27c).
+ * Reads ONLY this owner-only store — never the environment, never any config file
+ * — so a project config that merely NAMES a credential can never widen where the
+ * secret is sourced from. Never throws.
+ */
+export function readMcpCredential(ref, file = credentialsPath()) {
+    const store = readStore(file);
+    const token = store?.mcp?.[ref];
+    return typeof token === "string" && token !== "" ? token : undefined;
+}
+/** Persist MCP bearer token for credential name `ref`. Same 0600/0700 as keys. */
+export function writeMcpCredential(ref, token, file = credentialsPath()) {
+    writeInto(file, (store) => {
+        store.mcp ??= {};
+        store.mcp[ref] = token;
+    });
+}
 /**
  * Persist `key` for `provider`, merging into any existing store. The file is
  * written `0600` and its directory `0700` so the secret is owner-only — enforced
  * with an explicit `chmod` after write (mkdir/write modes are umask-masked).
  */
 export function writeCredential(provider, key, file = credentialsPath()) {
+    writeInto(file, (store) => {
+        store.keys[provider] = key;
+    });
+}
+/**
+ * Merge `mutate` into the store and persist it owner-only: dir `0700`, file
+ * `0600`, enforced with an explicit `chmod` after write (mkdir/write modes are
+ * umask-masked). The one write path shared by every credential namespace.
+ */
+function writeInto(file, mutate) {
     const dir = dirname(file);
     mkdirSync(dir, { recursive: true, mode: 0o700 });
     try {
@@ -55,7 +83,7 @@ export function writeCredential(provider, key, file = credentialsPath()) {
     }
     const store = readStore(file) ?? { version: CREDENTIALS_VERSION, keys: {} };
     store.version = CREDENTIALS_VERSION;
-    store.keys[provider] = key;
+    mutate(store);
     writeFileSync(file, JSON.stringify(store, null, 2) + "\n", {
         encoding: "utf8",
         mode: 0o600,

package/dist/config/manager.js

@@ -1,6 +1,6 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
-import { configInvalid, configParse } from "../errors/index.js";
+import { configInvalid, configParse, mcpProjectHeaders, } from "../errors/index.js";
 import { CruxyConfigSchema } from "./schema.js";
 import { globalConfigPath, findProjectConfig } from "./paths.js";
 import { readCredential } from "./credentials.js";
@@ -36,6 +36,29 @@ function readJsonFile(path) {
         throw err;
     }
 }
+/**
+ * §0 credential-safety gate (C.27c): a project-scope config file must not set raw
+ * `mcp.servers.<id>.headers`. A live header value is a secret, and this file is a
+ * possibly-cloned repo, so a raw header here is REFUSED — loudly, naming the
+ * server — never merged and never silently dropped (a silent drop would let the
+ * repo believe auth is wired up when it is not). Only user-scope config
+ * (`~/.cruxy/config.json`) may carry raw headers; every other file (a discovered
+ * project config, or an explicit `--config` that may point into a repo) is
+ * project scope. A project config may still NAME a credential via `credentialRef`.
+ */
+function rejectProjectScopeHeaders(obj, file) {
+    const mcp = obj.mcp;
+    if (!isPlainObject(mcp))
+        return;
+    const servers = mcp.servers;
+    if (!isPlainObject(servers))
+        return;
+    for (const [id, server] of Object.entries(servers)) {
+        if (isPlainObject(server) && "headers" in server) {
+            throw mcpProjectHeaders(id, file);
+        }
+    }
+}
 /** Overrides sourced from environment variables. */
 function envOverrides() {
     const out = {};
@@ -67,13 +90,17 @@ export function loadConfig(opts = {}) {
         sources.global = gPath;
     }
     if (opts.configPath) {
-        merged = deepMerge(merged, readJsonFile(opts.configPath));
+        const obj = readJsonFile(opts.configPath);
+        rejectProjectScopeHeaders(obj, opts.configPath);
+        merged = deepMerge(merged, obj);
         sources.explicit = opts.configPath;
     }
     else {
         const pPath = findProjectConfig(opts.cwd);
         if (pPath) {
-            merged = deepMerge(merged, readJsonFile(pPath));
+            const obj = readJsonFile(pPath);
+            rejectProjectScopeHeaders(obj, pPath);
+            merged = deepMerge(merged, obj);
             sources.project = pPath;
         }
     }

package/dist/config/schema.d.ts

@@ -649,13 +649,19 @@ export declare const UsageConfigSchema: z.ZodObject<{
 }>;
 export type UsageConfig = z.infer<typeof UsageConfigSchema>;
 /**
- * One MCP server entry (C.27). A `command` (+ optional `args`/`env`) is a stdio
- * server cruxy spawns as a child process; a `url` names a remote server. Exactly
- * one transport must be given. Trusting a stdio server runs its code UNSANDBOXED
- * with your privileges, which is why connection is gated by an explicit,
- * fingerprinted trust decision (see `mcp/trust.ts`).
+ * One MCP server entry. A `command` (+ optional `args`/`env`) is a stdio server
+ * cruxy spawns as a child process (C.27); a `url` names a remote server reached
+ * over Streamable HTTP (C.27b). Exactly one transport must be given.
+ *
+ * Both are gated by an explicit, fingerprinted trust decision (`mcp/trust.ts`),
+ * but the escalation differs: a stdio server runs its code UNSANDBOXED with your
+ * privileges, while a `url` server runs remotely — cruxy sends it your tool
+ * arguments over the network (https + cert-validated + pinned to a public IP; http
+ * only for a loopback dev server) and treats its responses as untrusted data. A
+ * url's trust also binds its resolved IP set at trust time, so a later IP-set
+ * change re-gates (weaker than a local binary fingerprint — see `mcp/types.ts`).
  */
-export declare const McpServerSchema: z.ZodEffects<z.ZodObject<{
+export declare const McpServerSchema: z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
     /** stdio transport: the server program to spawn. */
     command: z.ZodOptional<z.ZodString>;
     /** Arguments for `command`. */
@@ -664,26 +670,78 @@ export declare const McpServerSchema: z.ZodEffects<z.ZodObject<{
     env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
     /** Remote transport: the server URL (mutually exclusive with `command`). */
     url: z.ZodOptional<z.ZodString>;
+    /**
+     * Remote auth (C.27c, url only): the NAME of a bearer credential, resolved
+     * solely from `~/.cruxy/credentials.json` (0600) as `Authorization: Bearer …`.
+     * This field holds a NAME, never the secret — a project config may name a
+     * credential it does not contain, so the value never lives in-repo. Resolution
+     * never consults the environment or any config file. Requires an `https` URL.
+     */
+    credentialRef: z.ZodOptional<z.ZodString>;
+    /**
+     * Remote auth (C.27c, url only): raw request headers sent to the endpoint.
+     * A LIVE header value is a secret, so this is accepted ONLY from user-scope
+     * config (`~/.cruxy/config.json`) — the loader REJECTS it from project-scope
+     * config (a cloned repo must not inject live headers). Prefer `credentialRef`.
+     * Requires an `https` URL; reserved framing headers cannot be overridden.
+     */
+    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
 }, "strict", z.ZodTypeAny, {
     args: string[];
     env: Record<string, string>;
     command?: string | undefined;
+    credentialRef?: string | undefined;
+    url?: string | undefined;
+    headers?: Record<string, string> | undefined;
+}, {
+    command?: string | undefined;
+    credentialRef?: string | undefined;
+    url?: string | undefined;
+    args?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    headers?: Record<string, string> | undefined;
+}>, {
+    args: string[];
+    env: Record<string, string>;
+    command?: string | undefined;
+    credentialRef?: string | undefined;
     url?: string | undefined;
+    headers?: Record<string, string> | undefined;
 }, {
     command?: string | undefined;
+    credentialRef?: string | undefined;
     url?: string | undefined;
     args?: string[] | undefined;
     env?: Record<string, string> | undefined;
+    headers?: Record<string, string> | undefined;
 }>, {
     args: string[];
     env: Record<string, string>;
     command?: string | undefined;
+    credentialRef?: string | undefined;
     url?: string | undefined;
+    headers?: Record<string, string> | undefined;
 }, {
     command?: string | undefined;
+    credentialRef?: string | undefined;
     url?: string | undefined;
     args?: string[] | undefined;
     env?: Record<string, string> | undefined;
+    headers?: Record<string, string> | undefined;
+}>, {
+    args: string[];
+    env: Record<string, string>;
+    command?: string | undefined;
+    credentialRef?: string | undefined;
+    url?: string | undefined;
+    headers?: Record<string, string> | undefined;
+}, {
+    command?: string | undefined;
+    credentialRef?: string | undefined;
+    url?: string | undefined;
+    args?: string[] | undefined;
+    env?: Record<string, string> | undefined;
+    headers?: Record<string, string> | undefined;
 }>;
 export type McpServerConfig = z.infer<typeof McpServerSchema>;
 /**
@@ -704,7 +762,7 @@ export declare const McpConfigSchema: z.ZodObject<{
     enabled: z.ZodDefault<z.ZodBoolean>;
     /** Named MCP servers, keyed by a short server id used as the tool prefix
      * (`mcp__<server>__<tool>`) and in the trust prompt. */
-    servers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEffects<z.ZodObject<{
+    servers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
         /** stdio transport: the server program to spawn. */
         command: z.ZodOptional<z.ZodString>;
         /** Arguments for `command`. */
@@ -713,26 +771,78 @@ export declare const McpConfigSchema: z.ZodObject<{
         env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
         /** Remote transport: the server URL (mutually exclusive with `command`). */
         url: z.ZodOptional<z.ZodString>;
+        /**
+         * Remote auth (C.27c, url only): the NAME of a bearer credential, resolved
+         * solely from `~/.cruxy/credentials.json` (0600) as `Authorization: Bearer …`.
+         * This field holds a NAME, never the secret — a project config may name a
+         * credential it does not contain, so the value never lives in-repo. Resolution
+         * never consults the environment or any config file. Requires an `https` URL.
+         */
+        credentialRef: z.ZodOptional<z.ZodString>;
+        /**
+         * Remote auth (C.27c, url only): raw request headers sent to the endpoint.
+         * A LIVE header value is a secret, so this is accepted ONLY from user-scope
+         * config (`~/.cruxy/config.json`) — the loader REJECTS it from project-scope
+         * config (a cloned repo must not inject live headers). Prefer `credentialRef`.
+         * Requires an `https` URL; reserved framing headers cannot be overridden.
+         */
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     }, "strict", z.ZodTypeAny, {
         args: string[];
         env: Record<string, string>;
         command?: string | undefined;
+        credentialRef?: string | undefined;
         url?: string | undefined;
+        headers?: Record<string, string> | undefined;
     }, {
         command?: string | undefined;
+        credentialRef?: string | undefined;
         url?: string | undefined;
         args?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
     }>, {
         args: string[];
         env: Record<string, string>;
         command?: string | undefined;
+        credentialRef?: string | undefined;
         url?: string | undefined;
+        headers?: Record<string, string> | undefined;
     }, {
         command?: string | undefined;
+        credentialRef?: string | undefined;
         url?: string | undefined;
         args?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+    }>, {
+        args: string[];
+        env: Record<string, string>;
+        command?: string | undefined;
+        credentialRef?: string | undefined;
+        url?: string | undefined;
+        headers?: Record<string, string> | undefined;
+    }, {
+        command?: string | undefined;
+        credentialRef?: string | undefined;
+        url?: string | undefined;
+        args?: string[] | undefined;
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
+    }>, {
+        args: string[];
+        env: Record<string, string>;
+        command?: string | undefined;
+        credentialRef?: string | undefined;
+        url?: string | undefined;
+        headers?: Record<string, string> | undefined;
+    }, {
+        command?: string | undefined;
+        credentialRef?: string | undefined;
+        url?: string | undefined;
+        args?: string[] | undefined;
+        env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
     }>>>;
     /** Fail a server's `initialize` handshake (its tools are skipped) if it does
      * not complete within this many ms. */
@@ -756,7 +866,9 @@ export declare const McpConfigSchema: z.ZodObject<{
         args: string[];
         env: Record<string, string>;
         command?: string | undefined;
+        credentialRef?: string | undefined;
         url?: string | undefined;
+        headers?: Record<string, string> | undefined;
     }>;
     enabled: boolean;
     maxToolsPerServer: number;
@@ -767,9 +879,11 @@ export declare const McpConfigSchema: z.ZodObject<{
     requestTimeout?: number | undefined;
     servers?: Record<string, {
         command?: string | undefined;
+        credentialRef?: string | undefined;
         url?: string | undefined;
         args?: string[] | undefined;
         env?: Record<string, string> | undefined;
+        headers?: Record<string, string> | undefined;
     }> | undefined;
     enabled?: boolean | undefined;
     maxToolsPerServer?: number | undefined;
@@ -1380,7 +1494,7 @@ export declare const CruxyConfigSchema: z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
         /** Named MCP servers, keyed by a short server id used as the tool prefix
          * (`mcp__<server>__<tool>`) and in the trust prompt. */
-        servers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEffects<z.ZodObject<{
+        servers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
             /** stdio transport: the server program to spawn. */
             command: z.ZodOptional<z.ZodString>;
             /** Arguments for `command`. */
@@ -1389,26 +1503,78 @@ export declare const CruxyConfigSchema: z.ZodObject<{
             env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
             /** Remote transport: the server URL (mutually exclusive with `command`). */
             url: z.ZodOptional<z.ZodString>;
+            /**
+             * Remote auth (C.27c, url only): the NAME of a bearer credential, resolved
+             * solely from `~/.cruxy/credentials.json` (0600) as `Authorization: Bearer …`.
+             * This field holds a NAME, never the secret — a project config may name a
+             * credential it does not contain, so the value never lives in-repo. Resolution
+             * never consults the environment or any config file. Requires an `https` URL.
+             */
+            credentialRef: z.ZodOptional<z.ZodString>;
+            /**
+             * Remote auth (C.27c, url only): raw request headers sent to the endpoint.
+             * A LIVE header value is a secret, so this is accepted ONLY from user-scope
+             * config (`~/.cruxy/config.json`) — the loader REJECTS it from project-scope
+             * config (a cloned repo must not inject live headers). Prefer `credentialRef`.
+             * Requires an `https` URL; reserved framing headers cannot be overridden.
+             */
+            headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         }, "strict", z.ZodTypeAny, {
             args: string[];
             env: Record<string, string>;
             command?: string | undefined;
+            credentialRef?: string | undefined;
+            url?: string | undefined;
+            headers?: Record<string, string> | undefined;
+        }, {
+            command?: string | undefined;
+            credentialRef?: string | undefined;
+            url?: string | undefined;
+            args?: string[] | undefined;
+            env?: Record<string, string> | undefined;
+            headers?: Record<string, string> | undefined;
+        }>, {
+            args: string[];
+            env: Record<string, string>;
+            command?: string | undefined;
+            credentialRef?: string | undefined;
+            url?: string | undefined;
+            headers?: Record<string, string> | undefined;
+        }, {
+            command?: string | undefined;
+            credentialRef?: string | undefined;
+            url?: string | undefined;
+            args?: string[] | undefined;
+            env?: Record<string, string> | undefined;
+            headers?: Record<string, string> | undefined;
+        }>, {
+            args: string[];
+            env: Record<string, string>;
+            command?: string | undefined;
+            credentialRef?: string | undefined;
             url?: string | undefined;
+            headers?: Record<string, string> | undefined;
         }, {
             command?: string | undefined;
+            credentialRef?: string | undefined;
             url?: string | undefined;
             args?: string[] | undefined;
             env?: Record<string, string> | undefined;
+            headers?: Record<string, string> | undefined;
         }>, {
             args: string[];
             env: Record<string, string>;
             command?: string | undefined;
+            credentialRef?: string | undefined;
             url?: string | undefined;
+            headers?: Record<string, string> | undefined;
         }, {
             command?: string | undefined;
+            credentialRef?: string | undefined;
             url?: string | undefined;
             args?: string[] | undefined;
             env?: Record<string, string> | undefined;
+            headers?: Record<string, string> | undefined;
         }>>>;
         /** Fail a server's `initialize` handshake (its tools are skipped) if it does
          * not complete within this many ms. */
@@ -1432,7 +1598,9 @@ export declare const CruxyConfigSchema: z.ZodObject<{
             args: string[];
             env: Record<string, string>;
             command?: string | undefined;
+            credentialRef?: string | undefined;
             url?: string | undefined;
+            headers?: Record<string, string> | undefined;
         }>;
         enabled: boolean;
         maxToolsPerServer: number;
@@ -1443,9 +1611,11 @@ export declare const CruxyConfigSchema: z.ZodObject<{
         requestTimeout?: number | undefined;
         servers?: Record<string, {
             command?: string | undefined;
+            credentialRef?: string | undefined;
             url?: string | undefined;
             args?: string[] | undefined;
             env?: Record<string, string> | undefined;
+            headers?: Record<string, string> | undefined;
         }> | undefined;
         enabled?: boolean | undefined;
         maxToolsPerServer?: number | undefined;
@@ -1633,7 +1803,9 @@ export declare const CruxyConfigSchema: z.ZodObject<{
             args: string[];
             env: Record<string, string>;
             command?: string | undefined;
+            credentialRef?: string | undefined;
             url?: string | undefined;
+            headers?: Record<string, string> | undefined;
         }>;
         enabled: boolean;
         maxToolsPerServer: number;
@@ -1781,9 +1953,11 @@ export declare const CruxyConfigSchema: z.ZodObject<{
         requestTimeout?: number | undefined;
         servers?: Record<string, {
             command?: string | undefined;
+            credentialRef?: string | undefined;
             url?: string | undefined;
             args?: string[] | undefined;
             env?: Record<string, string> | undefined;
+            headers?: Record<string, string> | undefined;
         }> | undefined;
         enabled?: boolean | undefined;
         maxToolsPerServer?: number | undefined;