@gleanwork/mcp-server-tester 0.12.0

package/dist/cli/index.js

@@ -0,0 +1,2785 @@
+#!/usr/bin/env node
+import { Command } from 'commander';
+import { render, useApp, useInput, Box, Text } from 'ink';
+import React, { useState, useEffect, useCallback, useRef } from 'react';
+import { TextInput, Select, ConfirmInput } from '@inkjs/ui';
+import * as fs from 'fs/promises';
+import { mkdir, writeFile, stat, readFile } from 'fs/promises';
+import * as path from 'path';
+import { resolve, join, dirname } from 'path';
+import { spawn } from 'child_process';
+import InkSpinner from 'ink-spinner';
+import { jsxs, jsx, Fragment } from 'react/jsx-runtime';
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import { z } from 'zod';
+import createDebug from 'debug';
+import { homedir } from 'os';
+import * as http from 'http';
+import * as oauth from 'oauth4webapi';
+
+function Spinner({ label }) {
+  return /* @__PURE__ */ jsxs(Box, { children: [
+    /* @__PURE__ */ jsx(Text, { color: "cyan", children: /* @__PURE__ */ jsx(InkSpinner, { type: "dots" }) }),
+    /* @__PURE__ */ jsxs(Text, { children: [
+      " ",
+      label
+    ] })
+  ] });
+}
+var icons = {
+  success: "\u2713",
+  // checkmark
+  error: "\u2717",
+  // x mark
+  info: "\u2139",
+  // info
+  warning: "\u26A0"
+  // warning
+};
+var colors = {
+  success: "green",
+  error: "red",
+  info: "cyan",
+  warning: "yellow"
+};
+function StatusMessage({ status, children }) {
+  return /* @__PURE__ */ jsxs(Text, { color: colors[status], children: [
+    icons[status],
+    " ",
+    children
+  ] });
+}
+function JsonPreview({ data, maxLines = 15 }) {
+  const formatted = JSON.stringify(data, null, 2);
+  const lines = formatted.split("\n");
+  const truncated = lines.length > maxLines;
+  const displayLines = truncated ? lines.slice(0, maxLines) : lines;
+  return /* @__PURE__ */ jsxs(
+    Box,
+    {
+      flexDirection: "column",
+      borderStyle: "round",
+      borderColor: "gray",
+      paddingX: 1,
+      children: [
+        displayLines.map((line, i) => /* @__PURE__ */ jsx(Text, { dimColor: true, children: line }, i)),
+        truncated && /* @__PURE__ */ jsxs(Text, { dimColor: true, italic: true, children: [
+          "... (",
+          lines.length - maxLines,
+          " more lines)"
+        ] })
+      ]
+    }
+  );
+}
+
+// src/cli/templates/index.ts
+function getPlaywrightConfigTemplate(answers) {
+  const mcpConfig = answers.transport === "stdio" ? `{
+          transport: 'stdio' as const,
+          command: '${answers.serverCommand?.split(" ")[0] || "node"}',
+          args: [${answers.serverCommand?.split(" ").slice(1).map((arg) => `'${arg}'`).join(", ") || "'server.js'"}],
+          capabilities: {
+            roots: { listChanged: true },
+          },
+        }` : `{
+          transport: 'http' as const,
+          serverUrl: '${answers.serverUrl || "http://localhost:3000/mcp"}',
+          capabilities: {
+            roots: { listChanged: true },
+          },
+        }`;
+  return `import { defineConfig } from '@playwright/test';
+
+/**
+ * Playwright configuration for MCP evaluation tests
+ *
+ * @see https://playwright.dev/docs/test-configuration
+ */
+export default defineConfig({
+  testDir: './tests',
+  fullyParallel: true,
+  forbidOnly: !!process.env.CI,
+  retries: process.env.CI ? 2 : 0,
+  workers: process.env.CI ? 1 : undefined,
+
+  // Reporters: HTML and MCP Eval Reporter
+  reporter: [
+    ['html'],
+    ['@gleanwork/mcp-server-tester/reporters/mcpReporter', {
+      outputDir: '.mcp-test-results',
+      autoOpen: true,
+      historyLimit: 10
+    }]
+  ],
+
+  use: {
+    trace: 'on-first-retry',
+  },
+
+  projects: [
+    {
+      name: 'mcp-tests',
+      testMatch: /.*\\.spec\\.ts/,
+      use: {
+        // MCP server configuration
+        mcpConfig: ${mcpConfig},
+      },
+    },
+  ],
+});
+`;
+}
+function getTestFileTemplate(_answers) {
+  return `import { test, expect } from '@gleanwork/mcp-server-tester/fixtures/mcp';
+import {
+  runConformanceChecks,
+  loadEvalDataset,
+  runEvalDataset,
+} from '@gleanwork/mcp-server-tester';
+
+test.describe('MCP Server Tests', () => {
+  test('should connect to MCP server', async ({ mcp }) => {
+    const serverInfo = mcp.getServerInfo();
+    expect(serverInfo).toBeTruthy();
+  });
+
+  test('should list available tools', async ({ mcp }) => {
+    const tools = await mcp.listTools();
+    expect(tools.length).toBeGreaterThan(0);
+  });
+
+  test('should run conformance checks', async ({ mcp }) => {
+    const result = await runConformanceChecks(mcp, {
+      validateSchemas: true,
+      checkServerInfo: true,
+    });
+
+    expect(result.pass).toBe(true);
+  });
+
+  test('should run eval dataset', async ({ mcp }, testInfo) => {
+    // Load dataset (the dataset JSON uses the 'expect' block for assertions)
+    const dataset = await loadEvalDataset('./data/example-dataset.json');
+
+    // Run evals - the runner uses validators internally based on 'expect' block
+    const result = await runEvalDataset(
+      { dataset },
+      { mcp, testInfo, expect }
+    );
+
+    expect(result.passed).toBeGreaterThan(0);
+  });
+});
+`;
+}
+function getDatasetTemplate(_answers) {
+  return `{
+  "name": "example-eval-dataset",
+  "description": "Example evaluation dataset for MCP server testing",
+  "cases": [
+    {
+      "id": "example-case-1",
+      "description": "Example test case - replace with your actual tool",
+      "toolName": "your_tool_name",
+      "args": {
+        "param1": "value1"
+      },
+      "expect": {
+        "containsText": ["expected text"],
+        "isError": false
+      }
+    }
+  ],
+  "metadata": {
+    "version": "1.0",
+    "author": "@gleanwork/mcp-server-tester",
+    "created": "${(/* @__PURE__ */ new Date()).toISOString().split("T")[0]}"
+  }
+}
+`;
+}
+function getGitignoreTemplate() {
+  return `# Dependencies
+node_modules/
+
+# Test results
+test-results/
+playwright-report/
+playwright/.cache/
+.mcp-test-results/
+
+# Build output
+dist/
+
+# Environment variables
+.env
+.env.local
+
+# OS files
+.DS_Store
+Thumbs.db
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+`;
+}
+function getPackageJsonTemplate(projectName) {
+  return `{
+  "name": "${projectName}",
+  "version": "1.0.0",
+  "description": "MCP server evaluation tests",
+  "type": "module",
+  "scripts": {
+    "test": "playwright test",
+    "test:ui": "playwright test --ui",
+    "test:headed": "playwright test --headed",
+    "report": "playwright show-report"
+  },
+  "keywords": [
+    "mcp",
+    "playwright",
+    "testing",
+    "evals"
+  ],
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.4",
+    "@playwright/test": "^1.49.0",
+    "@gleanwork/mcp-server-tester": "^0.9.0",
+    "zod": "^3.24.1"
+  },
+  "devDependencies": {
+    "typescript": "^5.7.2"
+  }
+}
+`;
+}
+function getTsconfigTemplate() {
+  return `{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "lib": ["ES2022"],
+    "moduleResolution": "node",
+    "resolveJsonModule": true,
+    "allowJs": true,
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "types": ["node", "@playwright/test"]
+  },
+  "include": ["tests/**/*"],
+  "exclude": ["node_modules"]
+}
+`;
+}
+function InitApp({ options }) {
+  const { exit } = useApp();
+  const [step, setStep] = useState("projectName");
+  const [projectName, setProjectName] = useState(
+    options.name || "my-mcp-tests"
+  );
+  const [transportType, setTransportType] = useState("stdio");
+  const [serverCommand, setServerCommand] = useState("node server.js");
+  const [serverUrl, setServerUrl] = useState("http://localhost:3000/mcp");
+  const [installDeps, setInstallDeps] = useState(true);
+  const [targetDir] = useState(resolve(options.dir || "."));
+  const [projectPath, setProjectPath] = useState("");
+  const [error, setError] = useState(null);
+  useEffect(() => {
+    setProjectPath(join(targetDir, projectName));
+  }, [targetDir, projectName]);
+  useInput((input, key) => {
+    if (key.ctrl && input === "c") {
+      exit();
+    }
+  });
+  useEffect(() => {
+    if (step === "done" || step === "error") {
+      exit();
+    }
+  }, [step, exit]);
+  const createProject = useCallback(async () => {
+    setStep("creating");
+    try {
+      await mkdir(projectPath, { recursive: true });
+      await mkdir(join(projectPath, "tests"), { recursive: true });
+      await mkdir(join(projectPath, "data"), { recursive: true });
+      const answers = {
+        projectName,
+        transport: transportType,
+        serverCommand: transportType === "stdio" ? serverCommand : void 0,
+        serverUrl: transportType === "http" ? serverUrl : void 0,
+        installDeps
+      };
+      const files = [
+        {
+          path: "playwright.config.ts",
+          content: getPlaywrightConfigTemplate(answers)
+        },
+        {
+          path: "tests/mcp.spec.ts",
+          content: getTestFileTemplate(answers)
+        },
+        {
+          path: "data/example-dataset.json",
+          content: getDatasetTemplate(answers)
+        },
+        {
+          path: ".gitignore",
+          content: getGitignoreTemplate()
+        },
+        {
+          path: "package.json",
+          content: getPackageJsonTemplate(projectName)
+        },
+        {
+          path: "tsconfig.json",
+          content: getTsconfigTemplate()
+        }
+      ];
+      for (const file of files) {
+        await writeFile(join(projectPath, file.path), file.content);
+      }
+      if (installDeps) {
+        setStep("installing");
+        await installDependencies();
+      } else {
+        setStep("done");
+      }
+    } catch (err) {
+      setError(err instanceof Error ? err.message : String(err));
+      setStep("error");
+    }
+  }, [
+    projectPath,
+    projectName,
+    transportType,
+    serverCommand,
+    serverUrl,
+    installDeps
+  ]);
+  const installDependencies = useCallback(async () => {
+    return new Promise((resolvePromise, reject) => {
+      const npm = spawn("npm", ["install"], {
+        cwd: projectPath,
+        stdio: "pipe"
+      });
+      let stderrOutput = "";
+      npm.stderr?.on("data", (data) => {
+        stderrOutput += data.toString();
+      });
+      npm.on("close", (code) => {
+        if (code === 0) {
+          setStep("done");
+          resolvePromise();
+        } else {
+          const errorMsg = stderrOutput.trim() ? `npm install failed: ${stderrOutput.trim().split("\n")[0]}` : `npm install exited with code ${code}`;
+          setError(errorMsg);
+          setStep("error");
+          reject(new Error(errorMsg));
+        }
+      });
+      npm.on("error", (err) => {
+        setError(err.message);
+        setStep("error");
+        reject(err);
+      });
+    });
+  }, [projectPath]);
+  const checkAndCreate = useCallback(async () => {
+    let dirExists = false;
+    try {
+      await stat(projectPath);
+      dirExists = true;
+    } catch {
+    }
+    if (dirExists) {
+      setStep("confirmOverwrite");
+    } else {
+      await createProject();
+    }
+  }, [projectPath, createProject]);
+  return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", padding: 1, children: [
+    step === "projectName" && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx(Text, { children: "Project name:" }),
+      /* @__PURE__ */ jsx(
+        TextInput,
+        {
+          defaultValue: projectName,
+          onSubmit: (value) => {
+            if (value.length === 0) return;
+            setProjectName(value);
+            setStep("transportType");
+          }
+        }
+      )
+    ] }),
+    step === "transportType" && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx(Text, { children: "MCP transport type:" }),
+      /* @__PURE__ */ jsx(
+        Select,
+        {
+          options: [
+            { label: "stdio (local server process)", value: "stdio" },
+            { label: "http (remote server)", value: "http" }
+          ],
+          onChange: (value) => {
+            setTransportType(value);
+            setStep(value === "stdio" ? "serverCommand" : "serverUrl");
+          }
+        }
+      )
+    ] }),
+    step === "serverCommand" && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx(Text, { children: "Server command (for stdio):" }),
+      /* @__PURE__ */ jsx(
+        TextInput,
+        {
+          defaultValue: serverCommand,
+          onSubmit: (value) => {
+            setServerCommand(value);
+            setStep("installDeps");
+          }
+        }
+      )
+    ] }),
+    step === "serverUrl" && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx(Text, { children: "Server URL (for http):" }),
+      /* @__PURE__ */ jsx(
+        TextInput,
+        {
+          defaultValue: serverUrl,
+          onSubmit: (value) => {
+            setServerUrl(value);
+            setStep("installDeps");
+          }
+        }
+      )
+    ] }),
+    step === "installDeps" && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx(Text, { children: "Install dependencies now?" }),
+      /* @__PURE__ */ jsx(
+        ConfirmInput,
+        {
+          onConfirm: () => {
+            setInstallDeps(true);
+            checkAndCreate();
+          },
+          onCancel: () => {
+            setInstallDeps(false);
+            checkAndCreate();
+          }
+        }
+      )
+    ] }),
+    step === "confirmOverwrite" && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs(Text, { color: "yellow", children: [
+        "Directory ",
+        projectName,
+        " already exists. Overwrite?"
+      ] }),
+      /* @__PURE__ */ jsx(
+        ConfirmInput,
+        {
+          onConfirm: () => createProject(),
+          onCancel: () => {
+            exit();
+          }
+        }
+      )
+    ] }),
+    step === "creating" && /* @__PURE__ */ jsx(Spinner, { label: "Creating project structure..." }),
+    step === "installing" && /* @__PURE__ */ jsx(Spinner, { label: "Installing dependencies..." }),
+    step === "done" && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx(StatusMessage, { status: "success", children: "Project initialized successfully!" }),
+      /* @__PURE__ */ jsx(Text, { children: " " }),
+      /* @__PURE__ */ jsx(Text, { color: "cyan", children: "Next steps:" }),
+      /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+        " cd ",
+        projectName
+      ] }),
+      !installDeps && /* @__PURE__ */ jsx(Text, { dimColor: true, children: " npm install" }),
+      /* @__PURE__ */ jsx(Text, { dimColor: true, children: " npm test" }),
+      /* @__PURE__ */ jsx(Text, { children: " " }),
+      /* @__PURE__ */ jsx(Text, { color: "cyan", children: "To generate a dataset:" }),
+      /* @__PURE__ */ jsx(Text, { dimColor: true, children: " npx mcp-server-tester generate" })
+    ] }),
+    step === "error" && error && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx(StatusMessage, { status: "error", children: error }),
+      /* @__PURE__ */ jsx(Text, { dimColor: true, children: "Press Ctrl+C to exit" })
+    ] })
+  ] });
+}
+
+// src/cli/commands/init/index.ts
+async function init(options) {
+  const { waitUntilExit } = render(React.createElement(InitApp, { options }));
+  await waitUntilExit();
+}
+var MCPHostCapabilitiesSchema = z.object({
+  sampling: z.record(z.unknown()).optional(),
+  roots: z.object({
+    listChanged: z.boolean()
+  }).optional()
+});
+var MCPOAuthConfigSchema = z.object({
+  serverUrl: z.string().url("serverUrl must be a valid URL"),
+  scopes: z.array(z.string()).optional(),
+  resource: z.string().url().optional(),
+  authStatePath: z.string().optional(),
+  clientId: z.string().optional(),
+  clientSecret: z.string().optional(),
+  redirectUri: z.string().url().optional()
+});
+var MCPAuthConfigSchema = z.object({
+  accessToken: z.string().optional(),
+  oauth: MCPOAuthConfigSchema.optional()
+}).refine(
+  (data) => !(data.accessToken && data.oauth),
+  "Cannot specify both accessToken and oauth configuration"
+);
+var StdioConfigSchema = z.object({
+  transport: z.literal("stdio"),
+  command: z.string().min(1, "command is required for stdio transport"),
+  args: z.array(z.string()).optional(),
+  cwd: z.string().optional(),
+  capabilities: MCPHostCapabilitiesSchema.optional(),
+  connectTimeoutMs: z.number().positive().optional(),
+  requestTimeoutMs: z.number().positive().optional(),
+  quiet: z.boolean().optional()
+});
+var HttpConfigSchema = z.object({
+  transport: z.literal("http"),
+  serverUrl: z.string().url("serverUrl must be a valid URL"),
+  headers: z.record(z.string()).optional(),
+  capabilities: MCPHostCapabilitiesSchema.optional(),
+  connectTimeoutMs: z.number().positive().optional(),
+  requestTimeoutMs: z.number().positive().optional(),
+  auth: MCPAuthConfigSchema.optional()
+});
+var MCPConfigSchema = z.discriminatedUnion("transport", [
+  StdioConfigSchema,
+  HttpConfigSchema
+]);
+function validateMCPConfig(config) {
+  return MCPConfigSchema.parse(config);
+}
+function isStdioConfig(config) {
+  return config.transport === "stdio" && typeof config.command === "string";
+}
+function isHttpConfig(config) {
+  return config.transport === "http" && typeof config.serverUrl === "string";
+}
+var NAMESPACE = "mcp-server-tester";
+var debugClient = createDebug(`${NAMESPACE}:client`);
+createDebug(`${NAMESPACE}:oauth`);
+createDebug(`${NAMESPACE}:eval`);
+
+// src/mcp/clientFactory.ts
+async function createMCPClientForConfig(config, options) {
+  const validatedConfig = validateMCPConfig(config);
+  const client = new Client(
+    {
+      name: "@gleanwork/mcp-server-tester",
+      version: "0.1.0"
+    },
+    {
+      capabilities: validatedConfig.capabilities ?? {}
+    }
+  );
+  if (isStdioConfig(validatedConfig)) {
+    const transport = new StdioClientTransport({
+      command: validatedConfig.command,
+      args: validatedConfig.args ?? [],
+      ...validatedConfig.cwd && { cwd: validatedConfig.cwd },
+      // Suppress server stderr when quiet mode is enabled
+      ...validatedConfig.quiet && { stderr: "ignore" }
+    });
+    debugClient("Connecting via stdio: %O", {
+      command: validatedConfig.command,
+      args: validatedConfig.args,
+      cwd: validatedConfig.cwd
+    });
+    await client.connect(transport);
+  } else if (isHttpConfig(validatedConfig)) {
+    const headers = { ...validatedConfig.headers };
+    if (validatedConfig.auth?.accessToken && true) {
+      headers.Authorization = `Bearer ${validatedConfig.auth.accessToken}`;
+    }
+    const transport = new StreamableHTTPClientTransport(
+      new URL(validatedConfig.serverUrl),
+      {
+        requestInit: Object.keys(headers).length > 0 ? { headers } : void 0,
+        // Pass auth provider for OAuth flow - MCP SDK handles it automatically
+        authProvider: options?.authProvider
+      }
+    );
+    debugClient("Connecting via HTTP: %O", {
+      serverUrl: validatedConfig.serverUrl,
+      headers: Object.keys(headers).length > 0 ? Object.keys(headers) : void 0,
+      hasAuthProvider: false
+    });
+    await client.connect(transport);
+  }
+  debugClient("Connected successfully");
+  const serverInfo = client.getServerVersion();
+  if (serverInfo) {
+    debugClient("Server info: %O", serverInfo);
+  }
+  return client;
+}
+async function closeMCPClient(client) {
+  try {
+    await client.close();
+  } catch (error) {
+    console.error("[MCP] Error closing client:", error);
+    throw error;
+  }
+}
+var ENV_VAR_NAMES = {
+  accessToken: "MCP_ACCESS_TOKEN",
+  refreshToken: "MCP_REFRESH_TOKEN",
+  tokenType: "MCP_TOKEN_TYPE",
+  expiresAt: "MCP_TOKEN_EXPIRES_AT"
+};
+var DEFAULT_EXPIRY_BUFFER_MS = 6e4;
+function generateServerKey(serverUrl) {
+  const url = new URL(serverUrl);
+  let key = url.hostname;
+  if (url.port) {
+    key += `_${url.port}`;
+  }
+  if (url.pathname && url.pathname !== "/") {
+    const cleanPath = url.pathname.replace(/^\/+|\/+$/g, "").replace(/\//g, "_");
+    if (cleanPath) {
+      key += `_${cleanPath}`;
+    }
+  }
+  return key.replace(/[^a-zA-Z0-9_.-]/g, "_");
+}
+function getStateDir(serverUrl, customDir) {
+  const serverKey = generateServerKey(serverUrl);
+  if (customDir) {
+    return path.join(customDir, serverKey);
+  }
+  if (process.platform === "win32") {
+    const localAppData = process.env.LOCALAPPDATA;
+    if (localAppData) {
+      return path.join(localAppData, "mcp-tests", serverKey);
+    }
+    return path.join(homedir(), "AppData", "Local", "mcp-tests", serverKey);
+  }
+  if (process.platform === "linux" && process.env.XDG_STATE_HOME) {
+    return path.join(process.env.XDG_STATE_HOME, "mcp-tests", serverKey);
+  }
+  return path.join(homedir(), ".local", "state", "mcp-tests", serverKey);
+}
+function getBaseStateDir() {
+  if (process.platform === "win32") {
+    const localAppData = process.env.LOCALAPPDATA;
+    if (localAppData) {
+      return path.join(localAppData, "mcp-tests");
+    }
+    return path.join(homedir(), "AppData", "Local", "mcp-tests");
+  }
+  if (process.platform === "linux" && process.env.XDG_STATE_HOME) {
+    return path.join(process.env.XDG_STATE_HOME, "mcp-tests");
+  }
+  return path.join(homedir(), ".local", "state", "mcp-tests");
+}
+async function listKnownServers() {
+  const baseDir = getBaseStateDir();
+  const servers = [];
+  try {
+    const entries = await fs.readdir(baseDir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      const serverKey = entry.name;
+      const tokensPath = path.join(baseDir, serverKey, "tokens.json");
+      let hasTokens = false;
+      try {
+        await fs.access(tokensPath);
+        hasTokens = true;
+      } catch {
+      }
+      const parts = serverKey.split("_");
+      const hostname = parts[0];
+      const rest = parts.slice(1).join("/");
+      const url = `https://${hostname}/${rest}`;
+      servers.push({ key: serverKey, url, hasTokens });
+    }
+  } catch {
+  }
+  return servers;
+}
+function loadTokensFromEnv() {
+  const accessToken = process.env[ENV_VAR_NAMES.accessToken];
+  if (!accessToken) {
+    return null;
+  }
+  const expiresAtStr = process.env[ENV_VAR_NAMES.expiresAt];
+  const expiresAt = expiresAtStr ? parseInt(expiresAtStr, 10) : void 0;
+  return {
+    accessToken,
+    refreshToken: process.env[ENV_VAR_NAMES.refreshToken],
+    tokenType: process.env[ENV_VAR_NAMES.tokenType] ?? "Bearer",
+    expiresAt: expiresAt && !isNaN(expiresAt) ? expiresAt : void 0
+  };
+}
+function createFileOAuthStorage(config) {
+  return new FileOAuthStorage(config);
+}
+var FileOAuthStorage = class {
+  stateDir;
+  constructor(config) {
+    this.stateDir = getStateDir(config.serverUrl, config.stateDir);
+  }
+  get serverMetadataPath() {
+    return path.join(this.stateDir, "server.json");
+  }
+  get clientPath() {
+    return path.join(this.stateDir, "client.json");
+  }
+  get tokensPath() {
+    return path.join(this.stateDir, "tokens.json");
+  }
+  async loadServerMetadata() {
+    return this.loadFile(this.serverMetadataPath);
+  }
+  async saveServerMetadata(metadata) {
+    await this.atomicWrite(this.serverMetadataPath, metadata);
+  }
+  async loadClient() {
+    return this.loadFile(this.clientPath);
+  }
+  async saveClient(client) {
+    await this.atomicWrite(this.clientPath, client);
+  }
+  async loadTokens() {
+    return this.loadFile(this.tokensPath);
+  }
+  async saveTokens(tokens) {
+    await this.atomicWrite(this.tokensPath, tokens);
+  }
+  async deleteTokens() {
+    await this.deleteFile(this.tokensPath);
+  }
+  async hasValidToken(bufferMs = DEFAULT_EXPIRY_BUFFER_MS) {
+    const tokens = await this.loadTokens();
+    if (!tokens?.accessToken) {
+      return false;
+    }
+    if (!tokens.expiresAt) {
+      return true;
+    }
+    return tokens.expiresAt > Date.now() + bufferMs;
+  }
+  /**
+   * Load a JSON file, returning null if not found
+   */
+  async loadFile(filePath) {
+    try {
+      const content = await fs.readFile(filePath, "utf-8");
+      return JSON.parse(content);
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        return null;
+      }
+      throw error;
+    }
+  }
+  /**
+   * Write data atomically: write to .tmp file, then rename
+   * Files are created with 0o600 permissions (user read/write only)
+   */
+  async atomicWrite(filePath, data) {
+    await fs.mkdir(this.stateDir, { recursive: true, mode: 448 });
+    const tmpPath = `${filePath}.tmp`;
+    const content = JSON.stringify(data, null, 2);
+    await fs.writeFile(tmpPath, content, { encoding: "utf-8", mode: 384 });
+    await fs.rename(tmpPath, filePath);
+  }
+  /**
+   * Delete a file, ignoring errors if the file doesn't exist
+   */
+  async deleteFile(filePath) {
+    try {
+      await fs.unlink(filePath);
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        throw error;
+      }
+    }
+  }
+};
+async function generatePKCE() {
+  const codeVerifier = oauth.generateRandomCodeVerifier();
+  const codeChallenge = await oauth.calculatePKCECodeChallenge(codeVerifier);
+  return {
+    codeVerifier,
+    codeChallenge
+  };
+}
+function generateState() {
+  return oauth.generateRandomState();
+}
+function buildAuthorizationUrl(config) {
+  const authorizationEndpoint = config.authServer.server.authorization_endpoint;
+  if (!authorizationEndpoint) {
+    throw new Error(
+      "Authorization server does not have an authorization_endpoint"
+    );
+  }
+  const authorizationUrl = new URL(authorizationEndpoint);
+  authorizationUrl.searchParams.set("client_id", config.clientId);
+  authorizationUrl.searchParams.set("redirect_uri", config.redirectUri);
+  authorizationUrl.searchParams.set("response_type", "code");
+  authorizationUrl.searchParams.set("scope", config.scopes.join(" "));
+  authorizationUrl.searchParams.set("code_challenge", config.codeChallenge);
+  authorizationUrl.searchParams.set("code_challenge_method", "S256");
+  authorizationUrl.searchParams.set("state", config.state);
+  if (config.resource) {
+    authorizationUrl.searchParams.set("resource", config.resource);
+  }
+  return authorizationUrl;
+}
+async function exchangeCodeForTokens(config) {
+  const client = {
+    client_id: config.clientId,
+    token_endpoint_auth_method: config.clientSecret ? "client_secret_basic" : "none"
+  };
+  const clientAuth = config.clientSecret ? oauth.ClientSecretBasic(config.clientSecret) : oauth.None();
+  const callbackUrl = new URL(config.redirectUri);
+  callbackUrl.searchParams.set("code", config.code);
+  callbackUrl.searchParams.set("state", config.state);
+  const validatedParams = oauth.validateAuthResponse(
+    config.authServer.server,
+    client,
+    callbackUrl,
+    config.state
+  );
+  const response = await oauth.authorizationCodeGrantRequest(
+    config.authServer.server,
+    client,
+    clientAuth,
+    validatedParams,
+    config.redirectUri,
+    config.codeVerifier
+  );
+  const result = await oauth.processAuthorizationCodeResponse(
+    config.authServer.server,
+    client,
+    response
+  );
+  return {
+    accessToken: result.access_token,
+    tokenType: result.token_type,
+    expiresIn: result.expires_in,
+    refreshToken: result.refresh_token,
+    scope: result.scope
+  };
+}
+async function refreshAccessToken(config) {
+  const client = {
+    client_id: config.clientId,
+    token_endpoint_auth_method: config.clientSecret ? "client_secret_basic" : "none"
+  };
+  const clientAuth = config.clientSecret ? oauth.ClientSecretBasic(config.clientSecret) : oauth.None();
+  const response = await oauth.refreshTokenGrantRequest(
+    config.authServer.server,
+    client,
+    clientAuth,
+    config.refreshToken
+  );
+  if (!response.ok) {
+    const contentType = response.headers.get("content-type") ?? "";
+    let errorMessage = `Token refresh failed: ${response.status} ${response.statusText}`;
+    try {
+      if (contentType.includes("application/json")) {
+        const errorBody = await response.clone().json();
+        if (errorBody.error) {
+          errorMessage = `Token refresh failed: ${errorBody.error}`;
+          if (errorBody.error_description) {
+            errorMessage += ` - ${errorBody.error_description}`;
+          }
+        }
+      } else {
+        const textBody = await response.clone().text();
+        if (textBody) {
+          errorMessage = `Token refresh failed: ${response.status} - ${textBody}`;
+        }
+      }
+    } catch {
+    }
+    throw new Error(errorMessage);
+  }
+  const result = await oauth.processRefreshTokenResponse(
+    config.authServer.server,
+    client,
+    response
+  );
+  return {
+    accessToken: result.access_token,
+    tokenType: result.token_type,
+    expiresIn: result.expires_in,
+    refreshToken: result.refresh_token,
+    scope: result.scope
+  };
+}
+var MCP_PROTOCOL_VERSION = "2025-06-18";
+async function discoverProtectedResource(mcpServerUrl) {
+  const url = new URL(mcpServerUrl);
+  const origin = url.origin;
+  const pathname = url.pathname;
+  const pathAwareUrl = `${origin}/.well-known/oauth-protected-resource${pathname}`;
+  try {
+    const metadata = await fetchProtectedResourceMetadata(pathAwareUrl);
+    return {
+      metadata,
+      discoveryUrl: pathAwareUrl,
+      usedPathAwareDiscovery: true
+    };
+  } catch (error) {
+    if (error instanceof DiscoveryError && error.status === 404) {
+      const baseUrl = `${origin}/.well-known/oauth-protected-resource`;
+      const metadata = await fetchProtectedResourceMetadata(baseUrl);
+      return {
+        metadata,
+        discoveryUrl: baseUrl,
+        usedPathAwareDiscovery: false
+      };
+    }
+    throw error;
+  }
+}
+var DiscoveryError = class extends Error {
+  constructor(message, status, url) {
+    super(message);
+    this.status = status;
+    this.url = url;
+    this.name = "DiscoveryError";
+  }
+};
+async function fetchProtectedResourceMetadata(discoveryUrl) {
+  const response = await fetch(discoveryUrl, {
+    method: "GET",
+    headers: {
+      Accept: "application/json",
+      "MCP-Protocol-Version": MCP_PROTOCOL_VERSION
+    }
+  });
+  if (!response.ok) {
+    throw new DiscoveryError(
+      `Protected resource discovery failed: ${response.status} ${response.statusText}`,
+      response.status,
+      discoveryUrl
+    );
+  }
+  const metadata = await response.json();
+  if (!metadata.resource) {
+    throw new DiscoveryError(
+      'Invalid protected resource metadata: missing required "resource" field',
+      void 0,
+      discoveryUrl
+    );
+  }
+  return metadata;
+}
+async function discoverAuthorizationServer(authServerUrl) {
+  const issuer = new URL(authServerUrl);
+  const response = await oauth.discoveryRequest(issuer, {
+    algorithm: "oauth2",
+    headers: new Headers({
+      "MCP-Protocol-Version": MCP_PROTOCOL_VERSION
+    })
+  });
+  const metadata = await oauth.processDiscoveryResponse(issuer, response);
+  return {
+    server: metadata,
+    issuer: authServerUrl
+  };
+}
+
+// src/auth/cli.ts
+var debug = createDebug("mcp-server-tester:cli-oauth");
+var DEFAULT_TIMEOUT_MS = 3e5;
+var DEFAULT_CLIENT_NAME = "@gleanwork/mcp-server-tester";
+var DEFAULT_METADATA_TTL_MS = 24 * 60 * 60 * 1e3;
+var CLIOAuthClient = class {
+  config;
+  storage;
+  constructor(config) {
+    this.config = config;
+    this.storage = createFileOAuthStorage({
+      serverUrl: config.mcpServerUrl,
+      stateDir: config.stateDir
+    });
+  }
+  /**
+   * Get a valid access token, authenticating if necessary
+   *
+   * Token resolution priority:
+   * 1. Check environment variables (for CI/CD)
+   * 2. Check file storage for cached tokens
+   * 3. Try to refresh if expired but refresh token exists
+   * 4. Run full OAuth flow if needed
+   */
+  async getAccessToken() {
+    const envTokens = loadTokensFromEnv();
+    if (envTokens) {
+      debug("Using tokens from environment variables");
+      return {
+        accessToken: envTokens.accessToken,
+        tokenType: envTokens.tokenType,
+        expiresAt: envTokens.expiresAt,
+        refreshed: false,
+        fromEnv: true
+      };
+    }
+    const storedTokens = await this.storage.loadTokens();
+    if (storedTokens?.accessToken) {
+      const isValid = await this.storage.hasValidToken();
+      if (isValid) {
+        debug("Using cached tokens from storage");
+        return {
+          accessToken: storedTokens.accessToken,
+          tokenType: storedTokens.tokenType,
+          expiresAt: storedTokens.expiresAt,
+          refreshed: false,
+          fromEnv: false
+        };
+      }
+      if (storedTokens.refreshToken) {
+        debug("Token expired, attempting refresh");
+        try {
+          const refreshedTokens = await this.refreshStoredToken(storedTokens);
+          return {
+            accessToken: refreshedTokens.accessToken,
+            tokenType: refreshedTokens.tokenType,
+            expiresAt: refreshedTokens.expiresAt,
+            refreshed: true,
+            fromEnv: false
+          };
+        } catch (error) {
+          debug("Token refresh failed, will re-authenticate:", error);
+        }
+      }
+    }
+    debug("Performing full OAuth authentication");
+    return this.authenticate();
+  }
+  /**
+   * Try to get a valid access token without triggering browser auth
+   *
+   * Returns null if no valid token is available (no stored tokens,
+   * expired without refresh token, or refresh failed). Unlike getAccessToken(),
+   * this will NOT open a browser for authentication.
+   *
+   * Use this for CLI commands that should prompt the user to run `login`
+   * instead of automatically starting the OAuth flow.
+   */
+  async tryGetAccessToken() {
+    const envTokens = loadTokensFromEnv();
+    if (envTokens) {
+      debug("Using tokens from environment variables");
+      return {
+        accessToken: envTokens.accessToken,
+        tokenType: envTokens.tokenType,
+        expiresAt: envTokens.expiresAt,
+        refreshed: false,
+        fromEnv: true
+      };
+    }
+    const storedTokens = await this.storage.loadTokens();
+    if (storedTokens?.accessToken) {
+      const isValid = await this.storage.hasValidToken();
+      if (isValid) {
+        debug("Using cached tokens from storage");
+        return {
+          accessToken: storedTokens.accessToken,
+          tokenType: storedTokens.tokenType,
+          expiresAt: storedTokens.expiresAt,
+          refreshed: false,
+          fromEnv: false
+        };
+      }
+      if (storedTokens.refreshToken) {
+        debug("Token expired, attempting refresh");
+        try {
+          const refreshedTokens = await this.refreshStoredToken(storedTokens);
+          return {
+            accessToken: refreshedTokens.accessToken,
+            tokenType: refreshedTokens.tokenType,
+            expiresAt: refreshedTokens.expiresAt,
+            refreshed: true,
+            fromEnv: false
+          };
+        } catch (error) {
+          debug("Token refresh failed:", error);
+          return null;
+        }
+      }
+    }
+    debug("No valid token available");
+    return null;
+  }
+  /**
+   * Force a new authentication flow
+   */
+  async authenticate() {
+    const { protectedResource, authServer } = await this.discoverServers();
+    const client = await this.getOrRegisterClient(authServer);
+    const { tokens, requestedScopes } = await this.performOAuthFlow(
+      authServer,
+      client,
+      protectedResource
+    );
+    return {
+      accessToken: tokens.accessToken,
+      tokenType: tokens.tokenType,
+      expiresAt: tokens.expiresAt,
+      refreshed: false,
+      fromEnv: false,
+      requestedScopes
+    };
+  }
+  /**
+   * Check if stored credentials exist (may be expired)
+   */
+  async hasStoredCredentials() {
+    const tokens = await this.storage.loadTokens();
+    return tokens?.accessToken !== void 0;
+  }
+  /**
+   * Clear stored credentials
+   */
+  async clearCredentials() {
+    await this.storage.deleteTokens();
+    debug("Cleared stored credentials");
+  }
+  /**
+   * Discover protected resource and authorization server
+   */
+  async discoverServers() {
+    const cachedMetadata = await this.storage.loadServerMetadata();
+    if (cachedMetadata) {
+      const age = Date.now() - cachedMetadata.discoveredAt;
+      if (age < DEFAULT_METADATA_TTL_MS) {
+        debug("Using cached server metadata (age: %dms)", age);
+        debug(
+          "Cached protected resource scopes: %O",
+          cachedMetadata.protectedResource.scopes_supported
+        );
+        debug(
+          "Cached auth server scopes: %O",
+          cachedMetadata.authServer.server.scopes_supported
+        );
+        return {
+          protectedResource: cachedMetadata.protectedResource,
+          authServer: cachedMetadata.authServer
+        };
+      }
+      debug("Cached server metadata is stale (age: %dms), re-discovering", age);
+    }
+    debug("Discovering protected resource:", this.config.mcpServerUrl);
+    const prResult = await discoverProtectedResource(this.config.mcpServerUrl);
+    debug("Found protected resource:", prResult.metadata.resource);
+    debug(
+      "Protected resource scopes_supported: %O",
+      prResult.metadata.scopes_supported
+    );
+    const authServerUrl = prResult.metadata.authorization_servers?.[0];
+    if (!authServerUrl) {
+      throw new Error(
+        "No authorization servers found in protected resource metadata"
+      );
+    }
+    debug("Discovering authorization server:", authServerUrl);
+    const authServer = await discoverAuthorizationServer(authServerUrl);
+    debug("Found authorization server:", authServer.issuer);
+    debug(
+      "Auth server scopes_supported: %O",
+      authServer.server.scopes_supported
+    );
+    const metadata = {
+      authServer,
+      protectedResource: prResult.metadata,
+      discoveredAt: Date.now()
+    };
+    await this.storage.saveServerMetadata(metadata);
+    return {
+      protectedResource: prResult.metadata,
+      authServer
+    };
+  }
+  /**
+   * Get existing client or register new one via DCR
+   */
+  async getOrRegisterClient(authServer) {
+    if (this.config.clientId) {
+      debug("Using pre-configured client ID");
+      return {
+        clientId: this.config.clientId,
+        clientSecret: this.config.clientSecret
+      };
+    }
+    const cachedClient = await this.storage.loadClient();
+    if (cachedClient?.clientId) {
+      debug("Using cached client registration");
+      return cachedClient;
+    }
+    debug("Registering new client via DCR");
+    const client = await this.registerClient(authServer);
+    await this.storage.saveClient(client);
+    return client;
+  }
+  /**
+   * Register a new client via Dynamic Client Registration
+   */
+  async registerClient(authServer) {
+    const registrationEndpoint = authServer.server.registration_endpoint;
+    if (!registrationEndpoint) {
+      throw new Error(
+        "Authorization server does not support Dynamic Client Registration. Please provide a clientId in the configuration."
+      );
+    }
+    const redirectUri = "http://127.0.0.1:0/callback";
+    const response = await fetch(registrationEndpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "MCP-Protocol-Version": MCP_PROTOCOL_VERSION
+      },
+      body: JSON.stringify({
+        redirect_uris: [redirectUri],
+        token_endpoint_auth_method: "none",
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+        client_name: this.config.clientName ?? DEFAULT_CLIENT_NAME
+      })
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      throw new Error(
+        `Dynamic Client Registration failed: ${response.status} ${response.statusText}
+${errorText}`
+      );
+    }
+    const data = await response.json();
+    debug("Client registered:", data.client_id);
+    return {
+      clientId: data.client_id,
+      clientSecret: data.client_secret,
+      clientIdIssuedAt: data.client_id_issued_at,
+      clientSecretExpiresAt: data.client_secret_expires_at
+    };
+  }
+  /**
+   * Perform the full OAuth authorization flow
+   */
+  async performOAuthFlow(authServer, client, protectedResource) {
+    const pkce = await generatePKCE();
+    const state = generateState();
+    const { port, codePromise, close } = await this.startCallbackServer(state);
+    const redirectUri = `http://127.0.0.1:${port}/callback`;
+    try {
+      const requestedScopes = this.config.scopes ?? protectedResource.scopes_supported ?? authServer.server.scopes_supported ?? ["openid"];
+      debug("Scope resolution:");
+      debug("  - User config scopes: %O", this.config.scopes);
+      debug(
+        "  - Protected resource scopes_supported: %O",
+        protectedResource.scopes_supported
+      );
+      debug(
+        "  - Auth server scopes_supported: %O",
+        authServer.server.scopes_supported
+      );
+      debug("  - Final requested scopes: %O", requestedScopes);
+      const authUrl = buildAuthorizationUrl({
+        authServer,
+        clientId: client.clientId,
+        redirectUri,
+        scopes: requestedScopes,
+        codeChallenge: pkce.codeChallenge,
+        state,
+        resource: protectedResource.resource
+      });
+      debug("Authorization URL: %s", authUrl.toString());
+      debug("Authorization URL params:");
+      debug("  - client_id: %s", authUrl.searchParams.get("client_id"));
+      debug("  - redirect_uri: %s", authUrl.searchParams.get("redirect_uri"));
+      debug("  - scope: %s", authUrl.searchParams.get("scope"));
+      debug("  - resource: %s", authUrl.searchParams.get("resource"));
+      await this.openBrowserOrPrintUrl(authUrl);
+      debug("Waiting for OAuth callback...");
+      const code = await codePromise;
+      debug("Received authorization code");
+      const tokenResult = await exchangeCodeForTokens({
+        authServer,
+        clientId: client.clientId,
+        clientSecret: client.clientSecret,
+        code,
+        state,
+        codeVerifier: pkce.codeVerifier,
+        redirectUri
+      });
+      const tokens = this.tokenResultToStoredTokens(
+        tokenResult,
+        client.clientId
+      );
+      await this.storage.saveTokens(tokens);
+      return { tokens, requestedScopes };
+    } finally {
+      close();
+    }
+  }
+  /**
+   * Refresh an expired token
+   *
+   * Uses the clientId stored with the tokens (if available) to ensure
+   * the refresh request uses the same client that obtained the original tokens.
+   * This is important because refresh tokens are bound to the client_id.
+   */
+  async refreshStoredToken(storedTokens) {
+    if (!storedTokens.refreshToken) {
+      throw new Error("No refresh token available");
+    }
+    const metadata = await this.storage.loadServerMetadata();
+    if (!metadata) {
+      throw new Error("No cached server metadata for refresh");
+    }
+    let clientId;
+    let clientSecret;
+    if (storedTokens.clientId) {
+      debug("Using clientId from stored tokens for refresh");
+      clientId = storedTokens.clientId;
+      const storedClient = await this.storage.loadClient();
+      if (storedClient?.clientId === clientId) {
+        clientSecret = storedClient.clientSecret;
+      }
+    } else {
+      debug(
+        "No clientId in stored tokens, falling back to stored client (legacy behavior)"
+      );
+      const client = await this.getOrRegisterClient(metadata.authServer);
+      clientId = client.clientId;
+      clientSecret = client.clientSecret;
+    }
+    const tokenResult = await refreshAccessToken({
+      authServer: metadata.authServer,
+      clientId,
+      clientSecret,
+      refreshToken: storedTokens.refreshToken
+    });
+    const tokens = this.tokenResultToStoredTokens(tokenResult, clientId);
+    await this.storage.saveTokens(tokens);
+    return tokens;
+  }
+  /**
+   * Start local callback server
+   */
+  async startCallbackServer(expectedState) {
+    const timeoutMs = this.config.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    return new Promise((resolve3, reject) => {
+      const server = http.createServer();
+      const connections = /* @__PURE__ */ new Set();
+      server.on("connection", (socket) => {
+        connections.add(socket);
+        socket.on("close", () => connections.delete(socket));
+      });
+      const forceClose = () => {
+        for (const socket of connections) {
+          socket.destroy();
+        }
+        server.close();
+      };
+      let codeResolve;
+      let codeReject;
+      const codePromise = new Promise((res, rej) => {
+        codeResolve = res;
+        codeReject = rej;
+      });
+      const timeout = setTimeout(() => {
+        forceClose();
+        codeReject(new Error(`OAuth flow timed out after ${timeoutMs}ms`));
+      }, timeoutMs);
+      server.on("request", (req, res) => {
+        const url = new URL(
+          req.url ?? "/",
+          `http://127.0.0.1:${server.address().port}`
+        );
+        if (url.pathname !== "/callback") {
+          res.writeHead(404);
+          res.end("Not Found");
+          return;
+        }
+        const error = url.searchParams.get("error");
+        if (error) {
+          const errorDescription = url.searchParams.get("error_description");
+          clearTimeout(timeout);
+          res.writeHead(400, { "Content-Type": "text/html" });
+          res.end(this.errorHtml(error, errorDescription ?? void 0));
+          codeReject(
+            new Error(
+              `OAuth error: ${error}${errorDescription ? ` - ${errorDescription}` : ""}`
+            )
+          );
+          return;
+        }
+        const state = url.searchParams.get("state");
+        if (state !== expectedState) {
+          clearTimeout(timeout);
+          res.writeHead(400, { "Content-Type": "text/html" });
+          res.end(this.errorHtml("invalid_state", "State parameter mismatch"));
+          codeReject(new Error("OAuth state mismatch - possible CSRF attack"));
+          return;
+        }
+        const code = url.searchParams.get("code");
+        if (!code) {
+          clearTimeout(timeout);
+          res.writeHead(400, { "Content-Type": "text/html" });
+          res.end(
+            this.errorHtml("missing_code", "No authorization code received")
+          );
+          codeReject(new Error("No authorization code in callback"));
+          return;
+        }
+        clearTimeout(timeout);
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(this.successHtml());
+        codeResolve(code);
+      });
+      const preferredPort = this.config.callbackPort ?? 0;
+      server.listen(preferredPort, "127.0.0.1", () => {
+        const address = server.address();
+        debug("Callback server listening on port", address.port);
+        resolve3({ port: address.port, codePromise, close: forceClose });
+      });
+      server.on("error", (err) => {
+        reject(err);
+      });
+    });
+  }
+  /**
+   * Open browser or print URL for headless environments
+   */
+  async openBrowserOrPrintUrl(url) {
+    if (isHeadless()) {
+      console.log("\n" + "=".repeat(60));
+      console.log(
+        "Please open the following URL in your browser to authenticate:"
+      );
+      console.log("\n" + url.toString() + "\n");
+      console.log("=".repeat(60) + "\n");
+      return;
+    }
+    try {
+      const open = await import('open');
+      await open.default(url.toString());
+      debug("Opened browser for authentication");
+    } catch (error) {
+      debug("Failed to open browser:", error);
+      console.log("\nFailed to open browser automatically.");
+      console.log("Please open the following URL manually:\n");
+      console.log(url.toString() + "\n");
+    }
+  }
+  /**
+   * Convert TokenResult to StoredTokens
+   *
+   * @param result - Token result from exchange or refresh
+   * @param clientId - Client ID that was used to obtain these tokens
+   */
+  tokenResultToStoredTokens(result, clientId) {
+    return {
+      accessToken: result.accessToken,
+      tokenType: result.tokenType,
+      refreshToken: result.refreshToken,
+      expiresAt: result.expiresIn ? Date.now() + result.expiresIn * 1e3 : void 0,
+      clientId
+    };
+  }
+  /**
+   * HTML page for successful authentication
+   */
+  successHtml() {
+    return `
+<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="UTF-8">
+  <title>Authentication Successful</title>
+  <style>
+    body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+           display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0;
+           background: #f8fafc; }
+    .container { text-align: center; background: white; padding: 48px 64px; border-radius: 8px;
+                 border: 1px solid #e2e8f0; box-shadow: 0 1px 3px rgba(0,0,0,0.1); }
+    .icon { width: 48px; height: 48px; margin: 0 auto 24px; background: #dcfce7; border-radius: 50%;
+            display: flex; align-items: center; justify-content: center; }
+    .icon svg { width: 24px; height: 24px; color: #16a34a; }
+    h1 { color: #0f172a; margin: 0 0 8px 0; font-size: 20px; font-weight: 600; }
+    p { color: #64748b; margin: 0; font-size: 14px; }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <div class="icon">
+      <svg fill="none" stroke="currentColor" viewBox="0 0 24 24">
+        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M5 13l4 4L19 7"/>
+      </svg>
+    </div>
+    <h1>Authentication Successful</h1>
+    <p>You can close this window and return to the terminal.</p>
+  </div>
+</body>
+</html>`;
+  }
+  /**
+   * HTML page for authentication error
+   */
+  errorHtml(error, description) {
+    return `
+<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="UTF-8">
+  <title>Authentication Failed</title>
+  <style>
+    body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+           display: flex; justify-content: center; align-items: center; height: 100vh; margin: 0;
+           background: #f8fafc; }
+    .container { text-align: center; background: white; padding: 48px 64px; border-radius: 8px;
+                 border: 1px solid #e2e8f0; box-shadow: 0 1px 3px rgba(0,0,0,0.1); }
+    .icon { width: 48px; height: 48px; margin: 0 auto 24px; background: #fee2e2; border-radius: 50%;
+            display: flex; align-items: center; justify-content: center; }
+    .icon svg { width: 24px; height: 24px; color: #dc2626; }
+    h1 { color: #0f172a; margin: 0 0 8px 0; font-size: 20px; font-weight: 600; }
+    p { color: #64748b; margin: 0 0 8px 0; font-size: 14px; }
+    code { background: #f1f5f9; padding: 2px 8px; border-radius: 4px; color: #dc2626; font-size: 13px; }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <div class="icon">
+      <svg fill="none" stroke="currentColor" viewBox="0 0 24 24">
+        <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12"/>
+      </svg>
+    </div>
+    <h1>Authentication Failed</h1>
+    <p>Error: <code>${escapeHtml(error)}</code></p>
+    ${description ? `<p>${escapeHtml(description)}</p>` : ""}
+  </div>
+</body>
+</html>`;
+  }
+};
+function isHeadless() {
+  if (process.env.CI) {
+    return true;
+  }
+  if (!process.stdin.isTTY) {
+    return true;
+  }
+  if (process.platform === "linux" && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY) {
+    return true;
+  }
+  return false;
+}
+function escapeHtml(text) {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#039;");
+}
+
+// src/mcp/response.ts
+function normalizeToolResponse(result) {
+  const isError = result.isError ?? false;
+  const contentBlocks = [];
+  const textParts = [];
+  if (Array.isArray(result.content)) {
+    for (const block of result.content) {
+      if (block == null || typeof block !== "object") {
+        continue;
+      }
+      const b = block;
+      const contentBlock = {
+        type: typeof b.type === "string" ? b.type : "unknown"
+      };
+      if (typeof b.text === "string") {
+        contentBlock.text = b.text;
+        textParts.push(b.text);
+      }
+      if (b.data !== void 0) {
+        contentBlock.data = b.data;
+      }
+      if (typeof b.mimeType === "string") {
+        contentBlock.mimeType = b.mimeType;
+      }
+      contentBlocks.push(contentBlock);
+    }
+  }
+  let structuredContent = null;
+  if (result.structuredContent !== void 0) {
+    structuredContent = result.structuredContent;
+    if (textParts.length === 0) {
+      if (typeof result.structuredContent === "string") {
+        textParts.push(result.structuredContent);
+      } else if (result.structuredContent != null) {
+        textParts.push(JSON.stringify(result.structuredContent));
+      }
+    }
+  }
+  const text = textParts.join("\n");
+  return {
+    text,
+    raw: result,
+    isError,
+    contentBlocks,
+    structuredContent
+  };
+}
+function extractText(response) {
+  if (response == null) {
+    return "";
+  }
+  if (typeof response === "string") {
+    return response;
+  }
+  if (isNormalizedResponse(response)) {
+    return response.text;
+  }
+  if (isCallToolResult(response)) {
+    return normalizeToolResponse(response).text;
+  }
+  if (Array.isArray(response)) {
+    return extractTextFromContentArray(response);
+  }
+  if (typeof response === "object") {
+    const r = response;
+    if (Array.isArray(r.content)) {
+      return extractTextFromContentArray(r.content);
+    }
+    if (typeof r.content === "string") {
+      return r.content;
+    }
+    if (r.structuredContent !== void 0) {
+      if (typeof r.structuredContent === "string") {
+        return r.structuredContent;
+      }
+      return JSON.stringify(r.structuredContent);
+    }
+    if (typeof r.text === "string") {
+      return r.text;
+    }
+    return JSON.stringify(r);
+  }
+  if (typeof response === "number" || typeof response === "boolean" || typeof response === "bigint") {
+    return String(response);
+  }
+  return "";
+}
+function isNormalizedResponse(value) {
+  if (value == null || typeof value !== "object") {
+    return false;
+  }
+  const v = value;
+  return typeof v.text === "string" && typeof v.isError === "boolean" && Array.isArray(v.contentBlocks) && v.raw !== void 0;
+}
+function isCallToolResult(value) {
+  if (value == null || typeof value !== "object") {
+    return false;
+  }
+  const v = value;
+  return Array.isArray(v.content) || typeof v.isError === "boolean";
+}
+function extractTextFromContentArray(content) {
+  const textParts = [];
+  for (const block of content) {
+    if (block == null || typeof block !== "object") {
+      continue;
+    }
+    const b = block;
+    if (b.type === "text" && typeof b.text === "string") {
+      textParts.push(b.text);
+    }
+  }
+  if (textParts.length > 0) {
+    return textParts.join("\n");
+  }
+  return JSON.stringify(content);
+}
+
+// src/cli/utils/expectationSuggester.ts
+function suggestExpectations(response, tool) {
+  const suggestions = {
+    textContains: [],
+    regex: []
+  };
+  const text = extractText(response);
+  suggestions.textContains = suggestTextContains(text);
+  suggestions.regex = suggestRegexPatterns(text);
+  return suggestions;
+}
+function suggestTextContains(text, _tool) {
+  const suggestions = [];
+  const headerMatches = text.matchAll(/^(#{1,6})\s+(.+)$/gm);
+  for (const match of headerMatches) {
+    suggestions.push(`${match[1]} ${match[2]}`);
+  }
+  const boldMatches = text.matchAll(/\*\*([^*]+)\*\*/g);
+  const boldTexts = Array.from(boldMatches, (m) => m[0]);
+  if (boldTexts.length > 0 && boldTexts.length <= 5) {
+    suggestions.push(...boldTexts.slice(0, 3));
+  }
+  const kvMatches = text.matchAll(/^([A-Z][a-z\s]+):\s*(.+)$/gm);
+  const kvPairs = Array.from(kvMatches, (m) => m[0]);
+  if (kvPairs.length > 0 && kvPairs.length <= 5) {
+    suggestions.push(...kvPairs.slice(0, 3));
+  }
+  if (suggestions.length === 0 && text.length > 10) {
+    const firstLine = text.split("\n")[0];
+    if (firstLine && firstLine.length > 0) {
+      suggestions.push(firstLine.substring(0, 50));
+    }
+  }
+  return [...new Set(suggestions)];
+}
+function suggestRegexPatterns(text, _tool) {
+  const patterns = [];
+  if (/^#{1,6}\s+/m.test(text)) {
+    patterns.push("^#{1,6}\\s+\\w+");
+  }
+  if (/\d{4}-\d{2}-\d{2}/.test(text)) {
+    patterns.push("\\d{4}-\\d{2}-\\d{2}");
+  }
+  if (/\d{1,2}:\d{2}(:\d{2})?/.test(text)) {
+    patterns.push("\\d{1,2}:\\d{2}");
+  }
+  if (/\d+°[CF]/.test(text)) {
+    patterns.push("\\d+\xB0[CF]");
+  }
+  if (/https?:\/\/[^\s]+/.test(text)) {
+    patterns.push("https?://[\\w.-]+");
+  }
+  if (/[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/.test(text)) {
+    patterns.push("[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}");
+  }
+  if (/\d+(\.\d+)?%/.test(text)) {
+    patterns.push("\\d+(\\.\\d+)?%");
+  }
+  if (/[$£€]\d+(\.\d{2})?/.test(text)) {
+    patterns.push("[$\xA3\u20AC]\\d+(\\.\\d{2})?");
+  }
+  if (/\*\*[^*]+\*\*/.test(text)) {
+    patterns.push("\\*\\*\\w+:\\*\\*");
+  }
+  if (/^[-*]\s+/m.test(text)) {
+    patterns.push("^[-*]\\s+[\\w\\s]+");
+  }
+  if (/^\d+\.\s+/m.test(text)) {
+    patterns.push("^\\d+\\.\\s+");
+  }
+  if (/\(\d{3}\)\s*\d{3}-\d{4}|\d{3}-\d{3}-\d{4}|\d{10}/.test(text)) {
+    patterns.push("\\d{3}[-.]?\\d{3}[-.]?\\d{4}");
+  }
+  if (/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/.test(text)) {
+    patterns.push("\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}");
+  }
+  return [...new Set(patterns)];
+}
+function isAuthError(error) {
+  const message = error instanceof Error ? error.message : String(error);
+  return message.includes("401") || message.includes("Authorization") || message.includes("Unauthorized") || message.includes("authentication required");
+}
+function GenerateApp({ options }) {
+  const { exit } = useApp();
+  const [step, setStep] = useState(
+    options.config ? "connecting" : "loadingServers"
+  );
+  const [knownServers, setKnownServers] = useState([]);
+  const [mcpConfig, setMcpConfig] = useState(null);
+  const [client, setClient] = useState(null);
+  const [tools, setTools] = useState([]);
+  const [selectedTool, setSelectedTool] = useState(null);
+  const [response, setResponse] = useState(null);
+  const [callError, setCallError] = useState(null);
+  const [schemaProperties, setSchemaProperties] = useState(
+    []
+  );
+  const [currentPropertyIndex, setCurrentPropertyIndex] = useState(0);
+  const [argValues, setArgValues] = useState({});
+  const [dataset, setDataset] = useState({
+    name: "my-mcp-evals",
+    description: "Generated eval dataset",
+    cases: []
+  });
+  const [outputPath] = useState(resolve(options.output || "data/dataset.json"));
+  const [currentCase, setCurrentCase] = useState({});
+  const [suggestions, setSuggestions] = useState({ textContains: [], regex: [] });
+  const [error, setError] = useState(null);
+  const isMountedRef = useRef(true);
+  useEffect(() => {
+    if (step === "loadingServers") {
+      loadKnownServers();
+    }
+    async function loadKnownServers() {
+      const servers = await listKnownServers();
+      const authenticatedServers = servers.filter((s) => s.hasTokens);
+      setKnownServers(authenticatedServers);
+      if (authenticatedServers.length > 0) {
+        setStep("selectServer");
+      } else {
+        setStep("configTransport");
+      }
+    }
+  }, [step]);
+  useEffect(() => {
+    if (options.config) {
+      loadConfig(options.config);
+    }
+  }, [options.config]);
+  async function loadConfig(configPath) {
+    try {
+      const content = await readFile(resolve(configPath), "utf-8");
+      const config = JSON.parse(content);
+      setMcpConfig(validateMCPConfig(config));
+      setStep("connecting");
+    } catch (err) {
+      setError(
+        `Failed to load config: ${err instanceof Error ? err.message : String(err)}`
+      );
+      setStep("error");
+    }
+  }
+  useEffect(() => {
+    if (step === "connecting" && mcpConfig) {
+      connectToServer();
+    }
+    async function connectToServer() {
+      if (!mcpConfig) return;
+      try {
+        let configWithAuth = mcpConfig;
+        if (isHttpConfig(mcpConfig)) {
+          const oauthClient = new CLIOAuthClient({
+            mcpServerUrl: mcpConfig.serverUrl
+          });
+          const tokenResult = await oauthClient.tryGetAccessToken();
+          if (tokenResult) {
+            configWithAuth = {
+              ...mcpConfig,
+              auth: { accessToken: tokenResult.accessToken }
+            };
+          }
+        }
+        const c = await createMCPClientForConfig(configWithAuth);
+        if (!isMountedRef.current) {
+          await closeMCPClient(c);
+          return;
+        }
+        const result = await c.listTools();
+        if (!isMountedRef.current) {
+          await closeMCPClient(c);
+          return;
+        }
+        setClient(c);
+        setTools(result.tools || []);
+        let fileExists = false;
+        try {
+          await stat(outputPath);
+          fileExists = true;
+        } catch {
+        }
+        if (fileExists) {
+          setStep("appendPrompt");
+        } else {
+          setStep("datasetName");
+        }
+      } catch (err) {
+        if (isMountedRef.current) {
+          if (isAuthError(err)) {
+            setStep("authRequired");
+          } else {
+            setError(
+              `Failed to connect: ${err instanceof Error ? err.message : String(err)}`
+            );
+            setStep("error");
+          }
+        }
+      }
+    }
+  }, [step, mcpConfig, outputPath]);
+  async function callTool(finalArgs) {
+    if (!client || !selectedTool) return;
+    try {
+      const result = await client.callTool({
+        name: selectedTool.name,
+        arguments: finalArgs
+      });
+      const responseData = result.structuredContent ?? result.content;
+      setResponse(responseData);
+      setCallError(null);
+      const sugg = suggestExpectations(responseData, selectedTool);
+      setSuggestions(sugg);
+      setCurrentCase({
+        toolName: selectedTool.name,
+        args: finalArgs
+      });
+      setStep("reviewResponse");
+    } catch (err) {
+      setCallError(err instanceof Error ? err.message : String(err));
+      setStep("reviewResponse");
+    }
+  }
+  async function saveDataset() {
+    try {
+      const serialized = {
+        name: dataset.name,
+        description: dataset.description,
+        cases: dataset.cases,
+        metadata: {
+          version: "1.0",
+          created: (/* @__PURE__ */ new Date()).toISOString().split("T")[0]
+        }
+      };
+      await mkdir(dirname(outputPath), { recursive: true });
+      await writeFile(outputPath, JSON.stringify(serialized, null, 2));
+      setStep("done");
+    } catch (err) {
+      setError(
+        `Failed to save: ${err instanceof Error ? err.message : String(err)}`
+      );
+      setStep("error");
+    }
+  }
+  useEffect(() => {
+    return () => {
+      isMountedRef.current = false;
+      if (client) {
+        closeMCPClient(client).catch(() => {
+        });
+      }
+    };
+  }, [client]);
+  const handleExit = useCallback(() => {
+    if (client) {
+      closeMCPClient(client).then(() => exit()).catch(() => exit());
+    } else {
+      exit();
+    }
+  }, [client, exit]);
+  useInput((input, key) => {
+    if (key.ctrl && input === "c") {
+      handleExit();
+    }
+  });
+  useEffect(() => {
+    if (step === "done" || step === "error" || step === "authRequired") {
+      handleExit();
+    }
+  }, [step, handleExit]);
+  useEffect(() => {
+    if (step === "useTextContains" && suggestions.textContains.length === 0) {
+      setStep("useRegex");
+    }
+  }, [step, suggestions.textContains.length]);
+  useEffect(() => {
+    if (step === "useRegex" && suggestions.regex.length === 0) {
+      setStep("useExact");
+    }
+  }, [step, suggestions.regex.length]);
+  return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", padding: 1, children: [
+    step === "loadingServers" && /* @__PURE__ */ jsx(Spinner, { label: "Loading known servers..." }),
+    step === "selectServer" && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx(Text, { children: "Select MCP server:" }),
+      /* @__PURE__ */ jsx(
+        Select,
+        {
+          visibleOptionCount: 10,
+          options: [
+            ...knownServers.map((s) => ({
+              label: s.url,
+              value: s.url
+            })),
+            { label: "Other (configure manually)", value: "__other__" }
+          ],
+          onChange: (value) => {
+            if (value === "__other__") {
+              setStep("configTransport");
+            } else {
+              setMcpConfig(
+                validateMCPConfig({
+                  transport: "http",
+                  serverUrl: value,
+                  capabilities: { roots: { listChanged: true } }
+                })
+              );
+              setStep("connecting");
+            }
+          }
+        }
+      )
+    ] }),
+    step === "configTransport" && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx(Text, { children: "Select MCP transport type:" }),
+      /* @__PURE__ */ jsx(
+        Select,
+        {
+          options: [
+            { label: "stdio (local server process)", value: "stdio" },
+            { label: "http (remote server)", value: "http" }
+          ],
+          onChange: (value) => {
+            setStep(value === "stdio" ? "configStdio" : "configHttp");
+          }
+        }
+      )
+    ] }),
+    step === "configStdio" && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx(Text, { children: "Server command (e.g., node server.js):" }),
+      /* @__PURE__ */ jsx(
+        TextInput,
+        {
+          defaultValue: "node server.js",
+          onSubmit: (value) => {
+            const [command, ...cmdArgs] = value.split(" ");
+            setMcpConfig(
+              validateMCPConfig({
+                transport: "stdio",
+                command,
+                args: cmdArgs,
+                capabilities: { roots: { listChanged: true } }
+              })
+            );
+            setStep("connecting");
+          }
+        }
+      )
+    ] }),
+    step === "configHttp" && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx(Text, { children: "Server URL:" }),
+      /* @__PURE__ */ jsx(
+        TextInput,
+        {
+          defaultValue: "http://localhost:3000/mcp",
+          onSubmit: (value) => {
+            setMcpConfig(
+              validateMCPConfig({
+                transport: "http",
+                serverUrl: value,
+                capabilities: { roots: { listChanged: true } }
+              })
+            );
+            setStep("connecting");
+          }
+        }
+      )
+    ] }),
+    step === "connecting" && /* @__PURE__ */ jsx(Spinner, { label: "Connecting to MCP server..." }),
+    step === "authRequired" && mcpConfig && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx(StatusMessage, { status: "error", children: "Authentication required" }),
+      /* @__PURE__ */ jsx(Text, { children: " " }),
+      /* @__PURE__ */ jsx(Text, { children: "This server requires OAuth authentication." }),
+      "serverUrl" in mcpConfig && /* @__PURE__ */ jsxs(Fragment, { children: [
+        /* @__PURE__ */ jsxs(Text, { children: [
+          "Run:",
+          " ",
+          /* @__PURE__ */ jsxs(Text, { color: "cyan", children: [
+            "mcp-server-tester login ",
+            mcpConfig.serverUrl
+          ] })
+        ] }),
+        /* @__PURE__ */ jsx(Text, { children: " " }),
+        /* @__PURE__ */ jsx(Text, { dimColor: true, children: "Then retry: mcp-server-tester generate" })
+      ] }),
+      "command" in mcpConfig && /* @__PURE__ */ jsx(Text, { dimColor: true, children: "Note: stdio servers typically don't require OAuth authentication." })
+    ] }),
+    step === "appendPrompt" && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs(StatusMessage, { status: "success", children: [
+        "Connected! Found ",
+        tools.length,
+        " tools"
+      ] }),
+      /* @__PURE__ */ jsx(Text, { children: " " }),
+      /* @__PURE__ */ jsxs(Text, { children: [
+        "Dataset file exists at ",
+        outputPath,
+        ". Append to it?"
+      ] }),
+      /* @__PURE__ */ jsx(
+        ConfirmInput,
+        {
+          onConfirm: async () => {
+            try {
+              const content = await readFile(outputPath, "utf-8");
+              const existing = JSON.parse(content);
+              setDataset({
+                name: existing.name,
+                description: existing.description,
+                cases: existing.cases,
+                metadata: existing.metadata
+              });
+              setStep("selectTool");
+            } catch {
+              setStep("datasetName");
+            }
+          },
+          onCancel: () => setStep("datasetName")
+        }
+      )
+    ] }),
+    step === "datasetName" && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+      client && /* @__PURE__ */ jsxs(StatusMessage, { status: "success", children: [
+        "Connected! Found ",
+        tools.length,
+        " tools"
+      ] }),
+      /* @__PURE__ */ jsx(Text, { children: " " }),
+      /* @__PURE__ */ jsx(Text, { children: "Dataset name:" }),
+      /* @__PURE__ */ jsx(
+        TextInput,
+        {
+          defaultValue: "my-mcp-evals",
+          onSubmit: (value) => {
+            setDataset((d) => ({ ...d, name: value }));
+            setStep("selectTool");
+          }
+        }
+      )
+    ] }),
+    step === "selectTool" && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx(Text, { dimColor: true, children: "--- New Test Case ---" }),
+      /* @__PURE__ */ jsx(Text, { children: " " }),
+      /* @__PURE__ */ jsx(Text, { children: "Select tool to test:" }),
+      /* @__PURE__ */ jsx(
+        Select,
+        {
+          visibleOptionCount: 15,
+          options: tools.map((t) => ({
+            label: t.name,
+            value: t.name
+          })),
+          onChange: (value) => {
+            const tool = tools.find((t) => t.name === value);
+            setSelectedTool(tool || null);
+            if (tool?.inputSchema) {
+              const schema = tool.inputSchema;
+              const props = schema.properties ?? {};
+              const required = schema.required ?? [];
+              const properties = Object.entries(props).map(
+                ([name, prop]) => ({
+                  name,
+                  type: prop.type ?? "string",
+                  description: prop.description,
+                  required: required.includes(name)
+                })
+              );
+              setSchemaProperties(properties);
+              setCurrentPropertyIndex(0);
+              setArgValues({});
+              if (properties.length > 0) {
+                setStep("enterArgField");
+              } else {
+                setStep("enterRawArgs");
+              }
+            } else {
+              setSchemaProperties([]);
+              setArgValues({});
+              setStep("enterRawArgs");
+            }
+          }
+        }
+      )
+    ] }),
+    step === "enterArgField" && schemaProperties.length > 0 && /* @__PURE__ */ jsx(Box, { flexDirection: "column", children: (() => {
+      const prop = schemaProperties[currentPropertyIndex];
+      if (!prop) return null;
+      return /* @__PURE__ */ jsxs(Fragment, { children: [
+        /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+          "Field ",
+          currentPropertyIndex + 1,
+          " of ",
+          schemaProperties.length
+        ] }),
+        /* @__PURE__ */ jsxs(Text, { children: [
+          /* @__PURE__ */ jsx(Text, { bold: true, children: prop.name }),
+          /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+            " (",
+            prop.type,
+            ")"
+          ] }),
+          prop.required && /* @__PURE__ */ jsx(Text, { color: "red", children: "*" })
+        ] }),
+        prop.description && /* @__PURE__ */ jsx(Text, { dimColor: true, children: prop.description }),
+        /* @__PURE__ */ jsx(
+          TextInput,
+          {
+            defaultValue: "",
+            onSubmit: (value) => {
+              if (prop.required && value.trim() === "") {
+                return;
+              }
+              let parsedValue = value;
+              if (prop.type === "number" || prop.type === "integer") {
+                parsedValue = value === "" ? void 0 : Number(value);
+              } else if (prop.type === "boolean") {
+                parsedValue = value.toLowerCase() === "true";
+              } else if (prop.type === "array" || prop.type === "object") {
+                try {
+                  parsedValue = value === "" ? void 0 : JSON.parse(value);
+                } catch {
+                  parsedValue = value;
+                }
+              } else {
+                parsedValue = value === "" ? void 0 : value;
+              }
+              const finalArgs = { ...argValues };
+              if (parsedValue !== void 0) {
+                finalArgs[prop.name] = parsedValue;
+              }
+              setArgValues(finalArgs);
+              if (currentPropertyIndex < schemaProperties.length - 1) {
+                setCurrentPropertyIndex(currentPropertyIndex + 1);
+              } else {
+                setStep("callingTool");
+                setTimeout(() => callTool(finalArgs), 0);
+              }
+            }
+          },
+          prop.name
+        )
+      ] });
+    })() }),
+    step === "enterRawArgs" && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx(Text, { children: "Tool arguments (JSON):" }),
+      selectedTool?.description && /* @__PURE__ */ jsx(Text, { dimColor: true, children: selectedTool.description }),
+      /* @__PURE__ */ jsx(
+        TextInput,
+        {
+          defaultValue: "{}",
+          onSubmit: (value) => {
+            try {
+              const parsed = JSON.parse(value);
+              setArgValues(parsed);
+              setStep("callingTool");
+              setTimeout(() => callTool(parsed), 0);
+            } catch {
+            }
+          }
+        }
+      )
+    ] }),
+    step === "callingTool" && /* @__PURE__ */ jsx(Spinner, { label: `Calling ${selectedTool?.name}...` }),
+    step === "reviewResponse" && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+      callError ? /* @__PURE__ */ jsxs(StatusMessage, { status: "error", children: [
+        "Tool call failed: ",
+        callError
+      ] }) : /* @__PURE__ */ jsxs(Fragment, { children: [
+        /* @__PURE__ */ jsx(StatusMessage, { status: "success", children: "Tool called successfully" }),
+        /* @__PURE__ */ jsx(Text, { children: " " }),
+        /* @__PURE__ */ jsx(Text, { dimColor: true, children: "Response preview:" }),
+        /* @__PURE__ */ jsx(JsonPreview, { data: response, maxLines: 10 }),
+        suggestions.textContains.length > 0 && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", marginTop: 1, children: [
+          /* @__PURE__ */ jsx(Text, { color: "cyan", children: "Suggested expectations:" }),
+          /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+            "Text contains:",
+            " ",
+            suggestions.textContains.map((t) => `"${t}"`).join(", ")
+          ] })
+        ] })
+      ] }),
+      /* @__PURE__ */ jsx(Text, { children: " " }),
+      /* @__PURE__ */ jsx(Text, { children: "Press Enter to continue..." }),
+      /* @__PURE__ */ jsx(
+        TextInput,
+        {
+          defaultValue: "",
+          onSubmit: () => {
+            if (callError) {
+              setStep("askContinue");
+            } else {
+              setStep("caseId");
+            }
+          }
+        }
+      )
+    ] }),
+    step === "caseId" && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx(Text, { children: "Test case ID:" }),
+      /* @__PURE__ */ jsx(
+        TextInput,
+        {
+          defaultValue: `${selectedTool?.name}-${dataset.cases.length + 1}`,
+          onSubmit: (value) => {
+            setCurrentCase((c) => ({ ...c, id: value }));
+            setStep("caseDescription");
+          }
+        }
+      )
+    ] }),
+    step === "caseDescription" && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx(Text, { children: "Description (optional, press Enter to skip):" }),
+      /* @__PURE__ */ jsx(
+        TextInput,
+        {
+          defaultValue: "",
+          onSubmit: (value) => {
+            setCurrentCase((c) => ({
+              ...c,
+              description: value || void 0
+            }));
+            if (options.snapshot) {
+              const newCase = {
+                id: currentCase.id,
+                description: value || void 0,
+                toolName: currentCase.toolName,
+                args: currentCase.args,
+                expect: { snapshot: currentCase.id }
+              };
+              setDataset((d) => ({ ...d, cases: [...d.cases, newCase] }));
+              setStep("askContinue");
+            } else {
+              setStep("useTextContains");
+            }
+          }
+        }
+      )
+    ] }),
+    step === "useTextContains" && suggestions.textContains.length > 0 && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx(Text, { children: "Add text contains expectations?" }),
+      /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+        "(",
+        suggestions.textContains.map((t) => `"${t}"`).join(", "),
+        ")"
+      ] }),
+      /* @__PURE__ */ jsx(
+        ConfirmInput,
+        {
+          onConfirm: () => {
+            setCurrentCase((c) => ({
+              ...c,
+              expect: {
+                ...c.expect,
+                containsText: suggestions.textContains
+              }
+            }));
+            setStep("useRegex");
+          },
+          onCancel: () => setStep("useRegex")
+        }
+      )
+    ] }),
+    step === "useRegex" && suggestions.regex.length > 0 && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx(Text, { children: "Add regex expectations?" }),
+      /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+        "(",
+        suggestions.regex.map((r) => `/${r}/`).join(", "),
+        ")"
+      ] }),
+      /* @__PURE__ */ jsx(
+        ConfirmInput,
+        {
+          onConfirm: () => {
+            setCurrentCase((c) => ({
+              ...c,
+              expect: {
+                ...c.expect,
+                matchesPattern: suggestions.regex
+              }
+            }));
+            setStep("useExact");
+          },
+          onCancel: () => setStep("useExact")
+        }
+      )
+    ] }),
+    step === "useExact" && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx(Text, { children: "Add exact match expectation?" }),
+      /* @__PURE__ */ jsx(
+        ConfirmInput,
+        {
+          onConfirm: () => {
+            setCurrentCase((c) => ({
+              ...c,
+              expect: {
+                ...c.expect,
+                response
+              }
+            }));
+            setStep("useSnapshot");
+          },
+          onCancel: () => setStep("useSnapshot")
+        }
+      )
+    ] }),
+    step === "useSnapshot" && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx(Text, { children: "Use Playwright snapshot testing?" }),
+      /* @__PURE__ */ jsx(
+        ConfirmInput,
+        {
+          onConfirm: () => {
+            const newCase = {
+              id: currentCase.id,
+              description: currentCase.description,
+              toolName: currentCase.toolName,
+              args: currentCase.args,
+              expect: {
+                ...currentCase.expect,
+                snapshot: currentCase.id
+              }
+            };
+            setDataset((d) => ({ ...d, cases: [...d.cases, newCase] }));
+            setStep("askContinue");
+          },
+          onCancel: () => {
+            const newCase = {
+              id: currentCase.id,
+              description: currentCase.description,
+              toolName: currentCase.toolName,
+              args: currentCase.args,
+              expect: currentCase.expect
+            };
+            setDataset((d) => ({ ...d, cases: [...d.cases, newCase] }));
+            setStep("askContinue");
+          }
+        }
+      )
+    ] }),
+    step === "askContinue" && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsxs(StatusMessage, { status: "success", children: [
+        'Added test case "',
+        currentCase.id,
+        '"'
+      ] }),
+      /* @__PURE__ */ jsxs(Text, { children: [
+        "Total cases: ",
+        dataset.cases.length
+      ] }),
+      /* @__PURE__ */ jsx(Text, { children: " " }),
+      /* @__PURE__ */ jsx(Text, { children: "Add another test case?" }),
+      /* @__PURE__ */ jsx(
+        ConfirmInput,
+        {
+          onConfirm: () => {
+            setCurrentCase({});
+            setSelectedTool(null);
+            setSchemaProperties([]);
+            setCurrentPropertyIndex(0);
+            setArgValues({});
+            setResponse(null);
+            setCallError(null);
+            setSuggestions({ textContains: [], regex: [] });
+            setStep("selectTool");
+          },
+          onCancel: () => {
+            setStep("saving");
+            setTimeout(() => saveDataset(), 0);
+          }
+        }
+      )
+    ] }),
+    step === "saving" && /* @__PURE__ */ jsx(Spinner, { label: "Saving dataset..." }),
+    step === "done" && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx(StatusMessage, { status: "success", children: "Dataset generation complete!" }),
+      /* @__PURE__ */ jsx(Text, { children: " " }),
+      /* @__PURE__ */ jsxs(Text, { color: "cyan", children: [
+        "Total test cases: ",
+        dataset.cases.length
+      ] }),
+      /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+        "Output: ",
+        outputPath
+      ] }),
+      /* @__PURE__ */ jsx(Text, { children: " " }),
+      /* @__PURE__ */ jsx(Text, { color: "cyan", children: "Next steps:" }),
+      /* @__PURE__ */ jsx(Text, { dimColor: true, children: " npx playwright test" }),
+      dataset.cases.some((c) => c.expect?.snapshot) && /* @__PURE__ */ jsxs(Fragment, { children: [
+        /* @__PURE__ */ jsx(Text, { children: " " }),
+        /* @__PURE__ */ jsx(Text, { color: "cyan", children: "Snapshot testing:" }),
+        /* @__PURE__ */ jsx(Text, { dimColor: true, children: " First run will capture snapshots" }),
+        /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+          " ",
+          "Update: npx playwright test --update-snapshots"
+        ] })
+      ] })
+    ] }),
+    step === "error" && error && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx(StatusMessage, { status: "error", children: error }),
+      /* @__PURE__ */ jsx(Text, { dimColor: true, children: "Press Ctrl+C to exit" })
+    ] })
+  ] });
+}
+
+// src/cli/commands/generate/index.ts
+async function generate(options) {
+  const { waitUntilExit } = render(
+    React.createElement(GenerateApp, { options })
+  );
+  await waitUntilExit();
+}
+function LoginApp({ serverUrl, options }) {
+  const { exit } = useApp();
+  const [step, setStep] = useState("validating");
+  const [result, setResult] = useState(null);
+  const [error, setError] = useState(null);
+  const [stateDir, setStateDir] = useState("");
+  useInput((input, key) => {
+    if (key.ctrl && input === "c") {
+      exit();
+    }
+  });
+  const authenticate = useCallback(async () => {
+    try {
+      new URL(serverUrl);
+    } catch {
+      setError(`Invalid URL: ${serverUrl}`);
+      setStep("error");
+      return;
+    }
+    const scopes = options.scopes ? options.scopes.split(",").map((s) => s.trim()) : void 0;
+    const client = new CLIOAuthClient({
+      mcpServerUrl: serverUrl,
+      stateDir: options.stateDir,
+      scopes
+    });
+    try {
+      if (options.force) {
+        setStep("clearing");
+        await client.clearCredentials();
+      }
+      setStep("authenticating");
+      const authResult = await client.getAccessToken();
+      setResult({
+        fromEnv: authResult.fromEnv,
+        refreshed: authResult.refreshed,
+        requestedScopes: authResult.requestedScopes,
+        expiresAt: authResult.expiresAt
+      });
+      setStateDir(getStateDir(serverUrl, options.stateDir));
+      setStep("done");
+    } catch (err) {
+      setError(err instanceof Error ? err.message : String(err));
+      setStep("error");
+    }
+  }, [serverUrl, options]);
+  useEffect(() => {
+    authenticate();
+  }, [authenticate]);
+  useEffect(() => {
+    if (step === "done" || step === "error") {
+      exit();
+    }
+  }, [step, exit]);
+  return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", padding: 1, children: [
+    step === "validating" && /* @__PURE__ */ jsx(Spinner, { label: "Validating server URL..." }),
+    step === "clearing" && /* @__PURE__ */ jsx(Spinner, { label: "Clearing existing credentials..." }),
+    step === "authenticating" && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+      /* @__PURE__ */ jsx(Spinner, { label: `Authenticating with ${serverUrl}...` }),
+      /* @__PURE__ */ jsx(Text, { dimColor: true, children: "A browser window may open for OAuth login" })
+    ] }),
+    step === "done" && result && /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+      result.fromEnv ? /* @__PURE__ */ jsx(StatusMessage, { status: "info", children: "Using token from environment variables." }) : result.refreshed ? /* @__PURE__ */ jsx(StatusMessage, { status: "success", children: "Token refreshed successfully." }) : /* @__PURE__ */ jsx(StatusMessage, { status: "success", children: "Authentication successful!" }),
+      result.requestedScopes && result.requestedScopes.length > 0 && /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+        "Scopes: ",
+        result.requestedScopes.join(", ")
+      ] }),
+      result.expiresAt ? /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+        "Token expires: ",
+        new Date(result.expiresAt).toLocaleString()
+      ] }) : /* @__PURE__ */ jsx(Text, { dimColor: true, children: "Token has no expiration." }),
+      !result.fromEnv && stateDir && /* @__PURE__ */ jsxs(Fragment, { children: [
+        /* @__PURE__ */ jsx(Text, { children: " " }),
+        /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+          "Tokens stored in: ",
+          stateDir
+        ] })
+      ] })
+    ] }),
+    step === "error" && error && /* @__PURE__ */ jsx(Box, { flexDirection: "column", children: /* @__PURE__ */ jsxs(StatusMessage, { status: "error", children: [
+      "Authentication failed: ",
+      error
+    ] }) })
+  ] });
+}
+
+// src/cli/commands/login/index.ts
+async function login(serverUrl, options) {
+  const { waitUntilExit } = render(
+    React.createElement(LoginApp, { serverUrl, options })
+  );
+  await waitUntilExit();
+}
+function TokenApp({ serverUrl, options }) {
+  const { exit } = useApp();
+  const [step, setStep] = useState("loading");
+  const [tokens, setTokens] = useState(null);
+  const [error, setError] = useState(null);
+  const [stateDir, setStateDir] = useState("");
+  useEffect(() => {
+    async function loadTokens() {
+      try {
+        new URL(serverUrl);
+      } catch {
+        setError(`Invalid URL: ${serverUrl}`);
+        setStep("error");
+        return;
+      }
+      const storage = createFileOAuthStorage({
+        serverUrl,
+        stateDir: options.stateDir
+      });
+      const loadedTokens = await storage.loadTokens();
+      if (!loadedTokens) {
+        setStateDir(getStateDir(serverUrl, options.stateDir));
+        setError("No tokens found");
+        setStep("error");
+        return;
+      }
+      setTokens(loadedTokens);
+      setStep("success");
+    }
+    loadTokens();
+  }, [serverUrl, options.stateDir]);
+  useEffect(() => {
+    if (step === "success" || step === "error") {
+      exit();
+    }
+  }, [step, exit]);
+  const format = options.format ?? "env";
+  if (step === "loading") {
+    return null;
+  }
+  if (step === "error") {
+    if (error === "No tokens found") {
+      return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", padding: 1, children: [
+        /* @__PURE__ */ jsxs(StatusMessage, { status: "error", children: [
+          "No tokens found for ",
+          serverUrl
+        ] }),
+        /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+          "Expected location: ",
+          stateDir,
+          "/tokens.json"
+        ] }),
+        /* @__PURE__ */ jsx(Text, { children: " " }),
+        /* @__PURE__ */ jsxs(Text, { dimColor: true, children: [
+          "Run 'mcp-server-tester login ",
+          serverUrl,
+          "' to authenticate first."
+        ] })
+      ] });
+    }
+    return /* @__PURE__ */ jsx(Box, { flexDirection: "column", padding: 1, children: /* @__PURE__ */ jsx(StatusMessage, { status: "error", children: error }) });
+  }
+  if (step === "success" && tokens) {
+    switch (format) {
+      case "env":
+        return /* @__PURE__ */ jsx(EnvFormat, { tokens });
+      case "json":
+        return /* @__PURE__ */ jsx(JsonFormat, { tokens });
+      case "gh":
+        return /* @__PURE__ */ jsx(GhFormat, { tokens });
+    }
+  }
+  return null;
+}
+function EnvFormat({ tokens }) {
+  return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsxs(Text, { children: [
+      ENV_VAR_NAMES.accessToken,
+      "=",
+      tokens.accessToken
+    ] }),
+    tokens.refreshToken && /* @__PURE__ */ jsxs(Text, { children: [
+      ENV_VAR_NAMES.refreshToken,
+      "=",
+      tokens.refreshToken
+    ] }),
+    /* @__PURE__ */ jsxs(Text, { children: [
+      ENV_VAR_NAMES.tokenType,
+      "=",
+      tokens.tokenType
+    ] }),
+    tokens.expiresAt && /* @__PURE__ */ jsxs(Text, { children: [
+      ENV_VAR_NAMES.expiresAt,
+      "=",
+      tokens.expiresAt
+    ] })
+  ] });
+}
+function JsonFormat({ tokens }) {
+  const output = {
+    [ENV_VAR_NAMES.accessToken]: tokens.accessToken,
+    [ENV_VAR_NAMES.tokenType]: tokens.tokenType
+  };
+  if (tokens.refreshToken) {
+    output[ENV_VAR_NAMES.refreshToken] = tokens.refreshToken;
+  }
+  if (tokens.expiresAt) {
+    output[ENV_VAR_NAMES.expiresAt] = tokens.expiresAt;
+  }
+  return /* @__PURE__ */ jsx(Text, { children: JSON.stringify(output, null, 2) });
+}
+function GhFormat({ tokens }) {
+  return /* @__PURE__ */ jsxs(Box, { flexDirection: "column", children: [
+    /* @__PURE__ */ jsx(Text, { dimColor: true, children: "# Run these commands to set GitHub Actions secrets:" }),
+    /* @__PURE__ */ jsxs(Text, { children: [
+      "gh secret set ",
+      ENV_VAR_NAMES.accessToken,
+      ' --body "',
+      tokens.accessToken,
+      '"'
+    ] }),
+    tokens.refreshToken && /* @__PURE__ */ jsxs(Text, { children: [
+      "gh secret set ",
+      ENV_VAR_NAMES.refreshToken,
+      ' --body "',
+      tokens.refreshToken,
+      '"'
+    ] }),
+    /* @__PURE__ */ jsxs(Text, { children: [
+      "gh secret set ",
+      ENV_VAR_NAMES.tokenType,
+      ' --body "',
+      tokens.tokenType,
+      '"'
+    ] }),
+    tokens.expiresAt && /* @__PURE__ */ jsxs(Text, { children: [
+      "gh secret set ",
+      ENV_VAR_NAMES.expiresAt,
+      ' --body "',
+      tokens.expiresAt,
+      '"'
+    ] })
+  ] });
+}
+
+// src/cli/commands/token/index.ts
+async function token(serverUrl, options) {
+  const { waitUntilExit } = render(
+    React.createElement(TokenApp, { serverUrl, options })
+  );
+  await waitUntilExit();
+}
+
+// src/cli/index.ts
+var program = new Command();
+program.name("mcp-server-tester").description("CLI tools for MCP server evaluation and testing").version("0.1.0");
+program.command("init").description("Initialize a new MCP evaluation project").option("-n, --name <name>", "Project name").option("-d, --dir <directory>", "Target directory", ".").action(init);
+program.command("generate").alias("gen").description("Generate eval dataset by interacting with MCP server").option("-c, --config <path>", "Path to MCP config").option("-o, --output <path>", "Output dataset path", "data/dataset.json").option("-s, --snapshot", "Use Playwright snapshot testing for all cases").action(generate);
+program.command("login").description("Authenticate with an MCP server via OAuth").argument("<server-url>", "MCP server URL to authenticate with").option("--force", "Force re-authentication even if valid token exists").option("--state-dir <dir>", "Custom directory for token storage").option(
+  "--scopes <scopes>",
+  "Comma-separated list of scopes to request (default: all from server)"
+).action(login);
+program.command("token").description("Output stored OAuth tokens for CI/CD use").argument("<server-url>", "MCP server URL to get tokens for").option(
+  "-f, --format <format>",
+  "Output format: env, json, or gh (default: env)",
+  "env"
+).option("--state-dir <dir>", "Custom directory for token storage").action(token);
+program.parse();