@cubis/foundry 0.3.35 → 0.3.36

package/bin/cubis.js

@@ -151,6 +151,7 @@ const POSTMAN_API_KEY_ENV_VAR = "POSTMAN_API_KEY";
 const POSTMAN_MCP_URL = "https://mcp.postman.com/minimal";
 const POSTMAN_API_BASE_URL = "https://api.getpostman.com";
 const POSTMAN_SKILL_ID = "postman";
+const STITCH_SKILL_ID = "stitch";
 const STITCH_MCP_SERVER_ID = "StitchMCP";
 const STITCH_API_KEY_ENV_VAR = "STITCH_API_KEY";
 const STITCH_MCP_URL = "https://stitch.googleapis.com/mcp";
@@ -3803,7 +3804,8 @@ async function resolvePostmanInstallSelection({
     );
   }
 
-  const enabled = Boolean(options.postman) || hasWorkspaceOption;
+  const stitchRequested = Boolean(options.stitch);
+  const enabled = Boolean(options.postman) || hasWorkspaceOption || stitchRequested;
   if (!enabled) return { enabled: false };
 
   const envApiKey = normalizePostmanApiKey(process.env[POSTMAN_API_KEY_ENV_VAR]);
@@ -3816,7 +3818,7 @@ async function resolvePostmanInstallSelection({
     : null;
   let mcpScope = requestedMcpScope || normalizeMcpScope(scope, "project");
   const warnings = [];
-  const stitchEnabled = platform === "antigravity";
+  const stitchEnabled = platform === "antigravity" || stitchRequested;
   const envStitchApiKey = normalizePostmanApiKey(
     process.env[STITCH_API_KEY_ENV_VAR],
   );
@@ -5721,6 +5723,10 @@ function withInstallOptions(command) {
       "--postman",
       "optional: install Postman skill and generate cbx_config.json",
     )
+    .option(
+      "--stitch",
+      "optional: include Stitch MCP profile/config alongside Postman",
+    )
     .option(
       "--postman-api-key <key>",
       "deprecated: inline key mode is disabled. Use env vars + profiles.",
@@ -5757,6 +5763,10 @@ function withInstallOptions(command) {
       "MCP image update policy: pinned|latest",
       DEFAULT_MCP_UPDATE_POLICY,
     )
+    .option(
+      "--mcp-tool-sync",
+      "enable automatic MCP tool catalog sync (default: enabled)",
+    )
     .option("--no-mcp-tool-sync", "disable automatic MCP tool catalog sync")
     .option(
       "--terminal-integration",
@@ -6079,7 +6089,11 @@ async function runWorkflowInstall(options) {
       scope,
       overwrite: Boolean(options.overwrite),
       profilePathsOverride: artifactProfilePaths,
-      extraSkillIds: postmanSelection.enabled ? [POSTMAN_SKILL_ID] : [],
+      extraSkillIds: postmanSelection.enabled
+        ? postmanSelection.stitchEnabled
+          ? [POSTMAN_SKILL_ID, STITCH_SKILL_ID]
+          : [POSTMAN_SKILL_ID]
+        : [],
       skillProfile: skillInstallOptions.skillProfile,
       terminalVerifierSelection,
       dryRun,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cubis/foundry",
-  "version": "0.3.35",
+  "version": "0.3.36",
   "description": "Cubis Foundry CLI for workflow-first AI agent environments",
   "type": "module",
   "bin": {

package/workflows/skills/postman/SKILL.md

@@ -0,0 +1,17 @@
+---
+name: postman
+description: Automate API testing and collection management with Postman MCP. Use for workspace, collection, environment, and mock operations.
+---
+
+# Postman MCP
+
+Use this skill when you need to work with Postman through MCP tools.
+
+## Required Environment Variables
+
+- `POSTMAN_API_KEY_<PROFILE>` for authenticated Postman access.
+
+## Notes
+
+- Use environment variables for secrets. Do not inline API keys.
+- Prefer tool discovery (`getEnabledTools`) before making assumptions about available tool sets.

package/workflows/skills/skills_index.json

@@ -741,6 +741,16 @@
       "visual testing"
     ]
   },
+  {
+    "id": "postman",
+    "name": "postman",
+    "canonical_id": "postman",
+    "deprecated": false,
+    "replaced_by": null,
+    "path": ".agents/skills/postman/SKILL.md",
+    "description": "Automate API testing and collection management with Postman MCP. Use for workspace, collection, environment, and mock operations.",
+    "triggers": []
+  },
   {
     "id": "powershell-windows",
     "name": "powershell-windows",
@@ -980,6 +990,16 @@
     "description": "Runs CodeQL-based static security analysis (database build, query pack selection, and SARIF results) for vulnerability discovery and audits. Not for custom QL authoring or CI/CD setup.",
     "triggers": []
   },
+  {
+    "id": "stitch",
+    "name": "stitch",
+    "canonical_id": "stitch",
+    "deprecated": false,
+    "replaced_by": null,
+    "path": ".agents/skills/stitch/SKILL.md",
+    "description": "Automate Stitch workflows through Stitch MCP using mcp-remote transport.",
+    "triggers": []
+  },
   {
     "id": "stripe-best-practices",
     "name": "stripe-best-practices",

package/workflows/skills/stitch/SKILL.md

@@ -0,0 +1,17 @@
+---
+name: stitch
+description: Automate Stitch workflows through Stitch MCP using mcp-remote transport.
+---
+
+# Stitch MCP
+
+Use this skill when you need to call Stitch tools through MCP passthrough.
+
+## Required Environment Variables
+
+- `STITCH_API_KEY_<PROFILE>` for Stitch API-key mode.
+
+## Notes
+
+- Stitch transport uses `mcp-remote` to `https://stitch.googleapis.com/mcp`.
+- Inject `X-Goog-Api-Key` from environment at runtime. Do not store raw keys in config files.

package/workflows/workflows/agent-environment-setup/platforms/copilot/skills/postman/SKILL.md

@@ -0,0 +1,17 @@
+---
+name: postman
+description: Automate API testing and collection management with Postman MCP. Use for workspace, collection, environment, and mock operations.
+---
+
+# Postman MCP
+
+Use this skill when you need to work with Postman through MCP tools.
+
+## Required Environment Variables
+
+- `POSTMAN_API_KEY_<PROFILE>` for authenticated Postman access.
+
+## Notes
+
+- Use environment variables for secrets. Do not inline API keys.
+- Prefer tool discovery (`getEnabledTools`) before making assumptions about available tool sets.

package/workflows/workflows/agent-environment-setup/platforms/copilot/skills/stitch/SKILL.md

@@ -0,0 +1,17 @@
+---
+name: stitch
+description: Automate Stitch workflows through Stitch MCP using mcp-remote transport.
+---
+
+# Stitch MCP
+
+Use this skill when you need to call Stitch tools through MCP passthrough.
+
+## Required Environment Variables
+
+- `STITCH_API_KEY_<PROFILE>` for Stitch API-key mode.
+
+## Notes
+
+- Stitch transport uses `mcp-remote` to `https://stitch.googleapis.com/mcp`.
+- Inject `X-Goog-Api-Key` from environment at runtime. Do not store raw keys in config files.

package/workflows/workflows/agent-environment-setup/platforms/cursor/skills/postman/SKILL.md

@@ -0,0 +1,17 @@
+---
+name: postman
+description: Automate API testing and collection management with Postman MCP. Use for workspace, collection, environment, and mock operations.
+---
+
+# Postman MCP
+
+Use this skill when you need to work with Postman through MCP tools.
+
+## Required Environment Variables
+
+- `POSTMAN_API_KEY_<PROFILE>` for authenticated Postman access.
+
+## Notes
+
+- Use environment variables for secrets. Do not inline API keys.
+- Prefer tool discovery (`getEnabledTools`) before making assumptions about available tool sets.

package/workflows/workflows/agent-environment-setup/platforms/cursor/skills/stitch/SKILL.md

@@ -0,0 +1,17 @@
+---
+name: stitch
+description: Automate Stitch workflows through Stitch MCP using mcp-remote transport.
+---
+
+# Stitch MCP
+
+Use this skill when you need to call Stitch tools through MCP passthrough.
+
+## Required Environment Variables
+
+- `STITCH_API_KEY_<PROFILE>` for Stitch API-key mode.
+
+## Notes
+
+- Stitch transport uses `mcp-remote` to `https://stitch.googleapis.com/mcp`.
+- Inject `X-Goog-Api-Key` from environment at runtime. Do not store raw keys in config files.

package/workflows/workflows/agent-environment-setup/platforms/windsurf/skills/postman/SKILL.md

@@ -0,0 +1,17 @@
+---
+name: postman
+description: Automate API testing and collection management with Postman MCP. Use for workspace, collection, environment, and mock operations.
+---
+
+# Postman MCP
+
+Use this skill when you need to work with Postman through MCP tools.
+
+## Required Environment Variables
+
+- `POSTMAN_API_KEY_<PROFILE>` for authenticated Postman access.
+
+## Notes
+
+- Use environment variables for secrets. Do not inline API keys.
+- Prefer tool discovery (`getEnabledTools`) before making assumptions about available tool sets.

package/workflows/workflows/agent-environment-setup/platforms/windsurf/skills/stitch/SKILL.md

@@ -0,0 +1,17 @@
+---
+name: stitch
+description: Automate Stitch workflows through Stitch MCP using mcp-remote transport.
+---
+
+# Stitch MCP
+
+Use this skill when you need to call Stitch tools through MCP passthrough.
+
+## Required Environment Variables
+
+- `STITCH_API_KEY_<PROFILE>` for Stitch API-key mode.
+
+## Notes
+
+- Stitch transport uses `mcp-remote` to `https://stitch.googleapis.com/mcp`.
+- Inject `X-Goog-Api-Key` from environment at runtime. Do not store raw keys in config files.