@hasna/mcps 0.0.27 → 0.0.29

package/bin/index.js

@@ -12743,6 +12743,40 @@ function normalizeCandidate(value) {
   const trimmed = value?.trim();
   return trimmed ? trimmed : undefined;
 }
+function normalizeServerTransport(value, fallback = "stdio") {
+  if (value === undefined)
+    return fallback;
+  if (typeof value !== "string") {
+    throw new Error("Invalid transport type");
+  }
+  const transport = value.trim();
+  if (!transport) {
+    throw new Error("Invalid transport type");
+  }
+  if (!VALID_TRANSPORTS.has(transport)) {
+    throw new Error("Invalid transport type");
+  }
+  return transport;
+}
+function normalizeServerUrl(value) {
+  if (value === null || value === undefined)
+    return null;
+  if (typeof value !== "string") {
+    throw new Error("URL must be a valid HTTP(S) URL");
+  }
+  const trimmed = value.trim();
+  if (!trimmed)
+    return null;
+  try {
+    const parsed = new URL(trimmed);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      throw new Error("unsupported protocol");
+    }
+  } catch {
+    throw new Error("URL must be a valid HTTP(S) URL");
+  }
+  return trimmed;
+}
 function pickNameFromArgs(args) {
   if (!args || args.length === 0)
     return;
@@ -12784,9 +12818,11 @@ function addServer(opts) {
   if (!id) {
     throw new Error("Unable to generate a valid server ID");
   }
+  const transport = normalizeServerTransport(opts.transport);
+  const url = normalizeServerUrl(opts.url);
   const row = db2.prepare(`INSERT INTO servers (id, name, description, command, args, env, credential_refs, transport, url, source)
        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-       RETURNING *`).get(id, name, opts.description || null, command, JSON.stringify(opts.args || []), JSON.stringify(normalizeLiteralEnv(opts.env)), JSON.stringify(normalizeCredentialRefs(opts.credentialRefs)), opts.transport || "stdio", opts.url || null, opts.source || "local");
+       RETURNING *`).get(id, name, opts.description || null, command, JSON.stringify(opts.args || []), JSON.stringify(normalizeLiteralEnv(opts.env)), JSON.stringify(normalizeCredentialRefs(opts.credentialRefs)), transport, url, opts.source || "local");
   return parseRow(row);
 }
 function removeServer(id) {
@@ -12807,6 +12843,14 @@ function updateServer(id, updates) {
   const db2 = getDb();
   const sets = [];
   const values = [];
+  let nextTransport;
+  let nextUrl;
+  if (updates.transport !== undefined) {
+    nextTransport = normalizeServerTransport(updates.transport);
+  }
+  if (updates.url !== undefined) {
+    nextUrl = normalizeServerUrl(updates.url);
+  }
   if (updates.name !== undefined) {
     const name = normalizeCandidate(updates.name);
     if (!name) {
@@ -12841,11 +12885,11 @@ function updateServer(id, updates) {
   }
   if (updates.transport !== undefined) {
     sets.push("transport = ?");
-    values.push(updates.transport);
+    values.push(nextTransport);
   }
   if (updates.url !== undefined) {
     sets.push("url = ?");
-    values.push(updates.url);
+    values.push(nextUrl ?? null);
   }
   if (updates.enabled !== undefined) {
     sets.push("enabled = ?");
@@ -12953,9 +12997,15 @@ function getCachedTools(serverId) {
     input_schema: safeJsonParse(r.input_schema, {})
   }));
 }
+var VALID_TRANSPORTS;
 var init_registry = __esm(() => {
   init_db();
   init_credentials();
+  VALID_TRANSPORTS = new Set([
+    "stdio",
+    "sse",
+    "streamable-http"
+  ]);
 });
 
 // node_modules/zod/v3/helpers/util.js
@@ -34649,14 +34699,11 @@ function buildEnv(extra) {
   return merged;
 }
 function requireUrl(entry) {
-  if (!entry.url) {
+  const url2 = normalizeServerUrl(entry.url);
+  if (!url2) {
     throw new Error(`Server "${entry.id}" is missing a URL for ${entry.transport} transport`);
   }
-  try {
-    return new URL(entry.url);
-  } catch {
-    throw new Error(`Server "${entry.id}" has an invalid URL: ${entry.url}`);
-  }
+  return new URL(url2);
 }
 async function connectToServer(entry, options = {}) {
   if (connections.has(entry.id)) {
@@ -34688,8 +34735,10 @@ async function connectToServer(entry, options = {}) {
         });
       } else if (entry.transport === "sse") {
         transport = new SSEClientTransport(requireUrl(entry));
-      } else {
+      } else if (entry.transport === "streamable-http") {
         transport = new StreamableHTTPClientTransport(requireUrl(entry));
+      } else {
+        throw new Error(`Unsupported transport type for server "${entry.id}": ${entry.transport}`);
       }
       await client.connect(transport);
       const result = await client.listTools();
@@ -35318,6 +35367,54 @@ import { execFileSync as execFileSync2 } from "child_process";
 import { existsSync as existsSync7, readFileSync as readFileSync4, writeFileSync as writeFileSync3, mkdirSync as mkdirSync7 } from "fs";
 import { join as join10 } from "path";
 import { homedir as homedir8 } from "os";
+function formatTomlString(value) {
+  return JSON.stringify(value);
+}
+function formatTomlKey(key) {
+  return /^[A-Za-z0-9_-]+$/.test(key) ? key : formatTomlString(key);
+}
+function formatTomlEnv(env) {
+  return Object.entries(env).sort(([left], [right]) => left.localeCompare(right)).map(([key, value]) => `${formatTomlKey(key)} = ${formatTomlString(value)}`).join(`
+`);
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function codexServerHeader(id) {
+  return `[mcp_servers.${id}]`;
+}
+function codexEnvHeader(id) {
+  return `[mcp_servers.${id}.env]`;
+}
+function formatCodexEnvBlock(id, env) {
+  return `
+${codexEnvHeader(id)}
+${formatTomlEnv(env)}
+`;
+}
+function formatCodexServerBlock(entry, env) {
+  return `
+${codexServerHeader(entry.id)}
+` + `command = ${formatTomlString(entry.command)}
+` + `args = [${entry.args.map((a) => formatTomlString(a)).join(", ")}]
+` + (Object.keys(env).length > 0 ? formatCodexEnvBlock(entry.id, env) : "");
+}
+function upsertCodexEnvBlock(config2, id, env) {
+  const envBlock = formatCodexEnvBlock(id, env);
+  const envHeaderPattern = escapeRegExp(codexEnvHeader(id));
+  const envBlockPattern = new RegExp(`(?:\\r?\\n)?[ \\t]*${envHeaderPattern}[ \\t]*\\r?\\n[\\s\\S]*?(?=\\r?\\n[ \\t]*\\[|\\s*$)`);
+  if (envBlockPattern.test(config2)) {
+    return config2.replace(envBlockPattern, () => envBlock);
+  }
+  const serverHeaderPattern = escapeRegExp(codexServerHeader(id));
+  const serverBlockPattern = new RegExp(`([ \\t]*${serverHeaderPattern}[ \\t]*\\r?\\n[\\s\\S]*?)(?=\\r?\\n[ \\t]*\\[|\\s*$)`);
+  let inserted = false;
+  const updated = config2.replace(serverBlockPattern, (_match, serverBlock) => {
+    inserted = true;
+    return `${serverBlock}${envBlock}`;
+  });
+  return inserted ? updated : `${config2}${envBlock}`;
+}
 function installToClaude(entry) {
   try {
     const args = [
@@ -35345,16 +35442,15 @@ function installToCodex(entry) {
     if (!existsSync7(configDir)) {
       mkdirSync7(configDir, { recursive: true });
     }
-    const block = `
-[mcp_servers.${entry.id}]
-` + `command = ${JSON.stringify(entry.command)}
-` + `args = [${entry.args.map((a) => JSON.stringify(a)).join(", ")}]
-`;
+    const env = assertAgentInstallEnv(entry);
     const existing = existsSync7(configPath) ? readFileSync4(configPath, "utf-8") : "";
-    if (existing.includes(`[mcp_servers.${entry.id}]`)) {
+    if (existing.includes(codexServerHeader(entry.id))) {
+      if (Object.keys(env).length > 0) {
+        writeFileSync3(configPath, upsertCodexEnvBlock(existing, entry.id, env), "utf-8");
+      }
       return { agent: "codex", success: true };
     }
-    writeFileSync3(configPath, existing + block, "utf-8");
+    writeFileSync3(configPath, existing + formatCodexServerBlock(entry, env), "utf-8");
     return { agent: "codex", success: true };
   } catch (err) {
     return { agent: "codex", success: false, error: err.message };
@@ -36454,7 +36550,7 @@ var init_provider_profiles = __esm(() => {
 var require_package = __commonJS((exports, module) => {
   module.exports = {
     name: "@hasna/mcps",
-    version: "0.0.27",
+    version: "0.0.29",
     description: "Meta-MCP registry & CLI \u2014 discover, manage, and proxy MCP servers",
     type: "module",
     repository: {
@@ -45430,6 +45526,16 @@ program2.command("import").argument("<file>", "Path to the export JSON file").de
     }
     const literalEnv = normalizeLiteralEnv(s.env ?? {});
     const credentialRefs = normalizeCredentialRefs(s.credentialRefs ?? s.credential_refs ?? {});
+    let transport;
+    let url2;
+    try {
+      transport = normalizeServerTransport(s.transport);
+      url2 = normalizeServerUrl(s.url);
+    } catch (err) {
+      console.error(chalk2.red(`Invalid server in import "${s.id ?? "(unknown)"}": ${err.message}`));
+      closeDb();
+      process.exit(1);
+    }
     db2.run(`INSERT ${orReplace} INTO servers (id, name, description, command, args, env, credential_refs, transport, url, source, enabled, created_at, updated_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)`, [
       s.id,
       s.name,
@@ -45438,8 +45544,8 @@ program2.command("import").argument("<file>", "Path to the export JSON file").de
       JSON.stringify(s.args ?? []),
       JSON.stringify(literalEnv),
       JSON.stringify(credentialRefs),
-      s.transport,
-      s.url,
+      transport,
+      url2,
       s.source,
       s.enabled ? 1 : 0,
       s.created_at,

package/bin/mcp.js

@@ -30759,6 +30759,40 @@ function normalizeCandidate(value) {
   const trimmed = value?.trim();
   return trimmed ? trimmed : undefined;
 }
+function normalizeServerTransport(value, fallback = "stdio") {
+  if (value === undefined)
+    return fallback;
+  if (typeof value !== "string") {
+    throw new Error("Invalid transport type");
+  }
+  const transport = value.trim();
+  if (!transport) {
+    throw new Error("Invalid transport type");
+  }
+  if (!VALID_TRANSPORTS.has(transport)) {
+    throw new Error("Invalid transport type");
+  }
+  return transport;
+}
+function normalizeServerUrl(value) {
+  if (value === null || value === undefined)
+    return null;
+  if (typeof value !== "string") {
+    throw new Error("URL must be a valid HTTP(S) URL");
+  }
+  const trimmed = value.trim();
+  if (!trimmed)
+    return null;
+  try {
+    const parsed = new URL(trimmed);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      throw new Error("unsupported protocol");
+    }
+  } catch {
+    throw new Error("URL must be a valid HTTP(S) URL");
+  }
+  return trimmed;
+}
 function pickNameFromArgs(args) {
   if (!args || args.length === 0)
     return;
@@ -30800,9 +30834,11 @@ function addServer(opts) {
   if (!id) {
     throw new Error("Unable to generate a valid server ID");
   }
+  const transport = normalizeServerTransport(opts.transport);
+  const url2 = normalizeServerUrl(opts.url);
   const row = db2.prepare(`INSERT INTO servers (id, name, description, command, args, env, credential_refs, transport, url, source)
        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-       RETURNING *`).get(id, name, opts.description || null, command, JSON.stringify(opts.args || []), JSON.stringify(normalizeLiteralEnv(opts.env)), JSON.stringify(normalizeCredentialRefs(opts.credentialRefs)), opts.transport || "stdio", opts.url || null, opts.source || "local");
+       RETURNING *`).get(id, name, opts.description || null, command, JSON.stringify(opts.args || []), JSON.stringify(normalizeLiteralEnv(opts.env)), JSON.stringify(normalizeCredentialRefs(opts.credentialRefs)), transport, url2, opts.source || "local");
   return parseRow(row);
 }
 function removeServer(id) {
@@ -30823,6 +30859,14 @@ function updateServer(id, updates) {
   const db2 = getDb();
   const sets = [];
   const values = [];
+  let nextTransport;
+  let nextUrl;
+  if (updates.transport !== undefined) {
+    nextTransport = normalizeServerTransport(updates.transport);
+  }
+  if (updates.url !== undefined) {
+    nextUrl = normalizeServerUrl(updates.url);
+  }
   if (updates.name !== undefined) {
     const name = normalizeCandidate(updates.name);
     if (!name) {
@@ -30857,11 +30901,11 @@ function updateServer(id, updates) {
   }
   if (updates.transport !== undefined) {
     sets.push("transport = ?");
-    values.push(updates.transport);
+    values.push(nextTransport);
   }
   if (updates.url !== undefined) {
     sets.push("url = ?");
-    values.push(updates.url);
+    values.push(nextUrl ?? null);
   }
   if (updates.enabled !== undefined) {
     sets.push("enabled = ?");
@@ -30914,9 +30958,15 @@ function getCachedTools(serverId) {
     input_schema: safeJsonParse(r.input_schema, {})
   }));
 }
+var VALID_TRANSPORTS;
 var init_registry = __esm(() => {
   init_db();
   init_credentials();
+  VALID_TRANSPORTS = new Set([
+    "stdio",
+    "sse",
+    "streamable-http"
+  ]);
 });
 
 // src/lib/local-command-consent.ts
@@ -31484,6 +31534,54 @@ import { execFileSync } from "child_process";
 import { existsSync as existsSync10, readFileSync as readFileSync5, writeFileSync as writeFileSync3, mkdirSync as mkdirSync7 } from "fs";
 import { join as join11 } from "path";
 import { homedir as homedir8 } from "os";
+function formatTomlString(value) {
+  return JSON.stringify(value);
+}
+function formatTomlKey(key) {
+  return /^[A-Za-z0-9_-]+$/.test(key) ? key : formatTomlString(key);
+}
+function formatTomlEnv(env) {
+  return Object.entries(env).sort(([left], [right]) => left.localeCompare(right)).map(([key, value]) => `${formatTomlKey(key)} = ${formatTomlString(value)}`).join(`
+`);
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function codexServerHeader(id) {
+  return `[mcp_servers.${id}]`;
+}
+function codexEnvHeader(id) {
+  return `[mcp_servers.${id}.env]`;
+}
+function formatCodexEnvBlock(id, env) {
+  return `
+${codexEnvHeader(id)}
+${formatTomlEnv(env)}
+`;
+}
+function formatCodexServerBlock(entry, env) {
+  return `
+${codexServerHeader(entry.id)}
+` + `command = ${formatTomlString(entry.command)}
+` + `args = [${entry.args.map((a) => formatTomlString(a)).join(", ")}]
+` + (Object.keys(env).length > 0 ? formatCodexEnvBlock(entry.id, env) : "");
+}
+function upsertCodexEnvBlock(config2, id, env) {
+  const envBlock = formatCodexEnvBlock(id, env);
+  const envHeaderPattern = escapeRegExp(codexEnvHeader(id));
+  const envBlockPattern = new RegExp(`(?:\\r?\\n)?[ \\t]*${envHeaderPattern}[ \\t]*\\r?\\n[\\s\\S]*?(?=\\r?\\n[ \\t]*\\[|\\s*$)`);
+  if (envBlockPattern.test(config2)) {
+    return config2.replace(envBlockPattern, () => envBlock);
+  }
+  const serverHeaderPattern = escapeRegExp(codexServerHeader(id));
+  const serverBlockPattern = new RegExp(`([ \\t]*${serverHeaderPattern}[ \\t]*\\r?\\n[\\s\\S]*?)(?=\\r?\\n[ \\t]*\\[|\\s*$)`);
+  let inserted = false;
+  const updated = config2.replace(serverBlockPattern, (_match, serverBlock) => {
+    inserted = true;
+    return `${serverBlock}${envBlock}`;
+  });
+  return inserted ? updated : `${config2}${envBlock}`;
+}
 function installToClaude(entry) {
   try {
     const args = [
@@ -31511,16 +31609,15 @@ function installToCodex(entry) {
     if (!existsSync10(configDir)) {
       mkdirSync7(configDir, { recursive: true });
     }
-    const block = `
-[mcp_servers.${entry.id}]
-` + `command = ${JSON.stringify(entry.command)}
-` + `args = [${entry.args.map((a) => JSON.stringify(a)).join(", ")}]
-`;
+    const env = assertAgentInstallEnv(entry);
     const existing = existsSync10(configPath) ? readFileSync5(configPath, "utf-8") : "";
-    if (existing.includes(`[mcp_servers.${entry.id}]`)) {
+    if (existing.includes(codexServerHeader(entry.id))) {
+      if (Object.keys(env).length > 0) {
+        writeFileSync3(configPath, upsertCodexEnvBlock(existing, entry.id, env), "utf-8");
+      }
       return { agent: "codex", success: true };
     }
-    writeFileSync3(configPath, existing + block, "utf-8");
+    writeFileSync3(configPath, existing + formatCodexServerBlock(entry, env), "utf-8");
     return { agent: "codex", success: true };
   } catch (err) {
     return { agent: "codex", success: false, error: err.message };
@@ -34452,14 +34549,11 @@ function buildEnv(extra) {
   return merged;
 }
 function requireUrl(entry) {
-  if (!entry.url) {
+  const url2 = normalizeServerUrl(entry.url);
+  if (!url2) {
     throw new Error(`Server "${entry.id}" is missing a URL for ${entry.transport} transport`);
   }
-  try {
-    return new URL(entry.url);
-  } catch {
-    throw new Error(`Server "${entry.id}" has an invalid URL: ${entry.url}`);
-  }
+  return new URL(url2);
 }
 async function connectToServer(entry, options = {}) {
   if (connections.has(entry.id)) {
@@ -34491,8 +34585,10 @@ async function connectToServer(entry, options = {}) {
         });
       } else if (entry.transport === "sse") {
         transport = new SSEClientTransport(requireUrl(entry));
-      } else {
+      } else if (entry.transport === "streamable-http") {
         transport = new StreamableHTTPClientTransport(requireUrl(entry));
+      } else {
+        throw new Error(`Unsupported transport type for server "${entry.id}": ${entry.transport}`);
       }
       await client.connect(transport);
       const result = await client.listTools();

package/dist/index.js

@@ -17441,6 +17441,11 @@ function credentialRefPlaceholders(refs) {
 }
 
 // src/lib/registry.ts
+var VALID_TRANSPORTS = new Set([
+  "stdio",
+  "sse",
+  "streamable-http"
+]);
 function parseRow(row) {
   return {
     id: row.id,
@@ -17476,6 +17481,40 @@ function normalizeCandidate(value) {
   const trimmed = value?.trim();
   return trimmed ? trimmed : undefined;
 }
+function normalizeServerTransport(value, fallback = "stdio") {
+  if (value === undefined)
+    return fallback;
+  if (typeof value !== "string") {
+    throw new Error("Invalid transport type");
+  }
+  const transport = value.trim();
+  if (!transport) {
+    throw new Error("Invalid transport type");
+  }
+  if (!VALID_TRANSPORTS.has(transport)) {
+    throw new Error("Invalid transport type");
+  }
+  return transport;
+}
+function normalizeServerUrl(value) {
+  if (value === null || value === undefined)
+    return null;
+  if (typeof value !== "string") {
+    throw new Error("URL must be a valid HTTP(S) URL");
+  }
+  const trimmed = value.trim();
+  if (!trimmed)
+    return null;
+  try {
+    const parsed = new URL(trimmed);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      throw new Error("unsupported protocol");
+    }
+  } catch {
+    throw new Error("URL must be a valid HTTP(S) URL");
+  }
+  return trimmed;
+}
 function pickNameFromArgs(args) {
   if (!args || args.length === 0)
     return;
@@ -17517,9 +17556,11 @@ function addServer(opts) {
   if (!id) {
     throw new Error("Unable to generate a valid server ID");
   }
+  const transport = normalizeServerTransport(opts.transport);
+  const url = normalizeServerUrl(opts.url);
   const row = db2.prepare(`INSERT INTO servers (id, name, description, command, args, env, credential_refs, transport, url, source)
        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-       RETURNING *`).get(id, name, opts.description || null, command, JSON.stringify(opts.args || []), JSON.stringify(normalizeLiteralEnv(opts.env)), JSON.stringify(normalizeCredentialRefs(opts.credentialRefs)), opts.transport || "stdio", opts.url || null, opts.source || "local");
+       RETURNING *`).get(id, name, opts.description || null, command, JSON.stringify(opts.args || []), JSON.stringify(normalizeLiteralEnv(opts.env)), JSON.stringify(normalizeCredentialRefs(opts.credentialRefs)), transport, url, opts.source || "local");
   return parseRow(row);
 }
 function removeServer(id) {
@@ -17540,6 +17581,14 @@ function updateServer(id, updates) {
   const db2 = getDb();
   const sets = [];
   const values = [];
+  let nextTransport;
+  let nextUrl;
+  if (updates.transport !== undefined) {
+    nextTransport = normalizeServerTransport(updates.transport);
+  }
+  if (updates.url !== undefined) {
+    nextUrl = normalizeServerUrl(updates.url);
+  }
   if (updates.name !== undefined) {
     const name = normalizeCandidate(updates.name);
     if (!name) {
@@ -17574,11 +17623,11 @@ function updateServer(id, updates) {
   }
   if (updates.transport !== undefined) {
     sets.push("transport = ?");
-    values.push(updates.transport);
+    values.push(nextTransport);
   }
   if (updates.url !== undefined) {
     sets.push("url = ?");
-    values.push(updates.url);
+    values.push(nextUrl ?? null);
   }
   if (updates.enabled !== undefined) {
     sets.push("enabled = ?");
@@ -25998,14 +26047,11 @@ function buildEnv(extra) {
   return merged;
 }
 function requireUrl(entry) {
-  if (!entry.url) {
+  const url2 = normalizeServerUrl(entry.url);
+  if (!url2) {
     throw new Error(`Server "${entry.id}" is missing a URL for ${entry.transport} transport`);
   }
-  try {
-    return new URL(entry.url);
-  } catch {
-    throw new Error(`Server "${entry.id}" has an invalid URL: ${entry.url}`);
-  }
+  return new URL(url2);
 }
 async function connectToServer(entry, options = {}) {
   if (connections.has(entry.id)) {
@@ -26037,8 +26083,10 @@ async function connectToServer(entry, options = {}) {
         });
       } else if (entry.transport === "sse") {
         transport = new SSEClientTransport(requireUrl(entry));
-      } else {
+      } else if (entry.transport === "streamable-http") {
         transport = new StreamableHTTPClientTransport(requireUrl(entry));
+      } else {
+        throw new Error(`Unsupported transport type for server "${entry.id}": ${entry.transport}`);
       }
       await client.connect(transport);
       const result = await client.listTools();
@@ -26586,6 +26634,54 @@ import { execFileSync as execFileSync2 } from "child_process";
 import { existsSync as existsSync9, readFileSync as readFileSync4, writeFileSync as writeFileSync3, mkdirSync as mkdirSync7 } from "fs";
 import { join as join10 } from "path";
 import { homedir as homedir8 } from "os";
+function formatTomlString(value) {
+  return JSON.stringify(value);
+}
+function formatTomlKey(key) {
+  return /^[A-Za-z0-9_-]+$/.test(key) ? key : formatTomlString(key);
+}
+function formatTomlEnv(env) {
+  return Object.entries(env).sort(([left], [right]) => left.localeCompare(right)).map(([key, value]) => `${formatTomlKey(key)} = ${formatTomlString(value)}`).join(`
+`);
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function codexServerHeader(id) {
+  return `[mcp_servers.${id}]`;
+}
+function codexEnvHeader(id) {
+  return `[mcp_servers.${id}.env]`;
+}
+function formatCodexEnvBlock(id, env) {
+  return `
+${codexEnvHeader(id)}
+${formatTomlEnv(env)}
+`;
+}
+function formatCodexServerBlock(entry, env) {
+  return `
+${codexServerHeader(entry.id)}
+` + `command = ${formatTomlString(entry.command)}
+` + `args = [${entry.args.map((a) => formatTomlString(a)).join(", ")}]
+` + (Object.keys(env).length > 0 ? formatCodexEnvBlock(entry.id, env) : "");
+}
+function upsertCodexEnvBlock(config2, id, env) {
+  const envBlock = formatCodexEnvBlock(id, env);
+  const envHeaderPattern = escapeRegExp(codexEnvHeader(id));
+  const envBlockPattern = new RegExp(`(?:\\r?\\n)?[ \\t]*${envHeaderPattern}[ \\t]*\\r?\\n[\\s\\S]*?(?=\\r?\\n[ \\t]*\\[|\\s*$)`);
+  if (envBlockPattern.test(config2)) {
+    return config2.replace(envBlockPattern, () => envBlock);
+  }
+  const serverHeaderPattern = escapeRegExp(codexServerHeader(id));
+  const serverBlockPattern = new RegExp(`([ \\t]*${serverHeaderPattern}[ \\t]*\\r?\\n[\\s\\S]*?)(?=\\r?\\n[ \\t]*\\[|\\s*$)`);
+  let inserted = false;
+  const updated = config2.replace(serverBlockPattern, (_match, serverBlock) => {
+    inserted = true;
+    return `${serverBlock}${envBlock}`;
+  });
+  return inserted ? updated : `${config2}${envBlock}`;
+}
 function installToClaude(entry) {
   try {
     const args = [
@@ -26613,16 +26709,15 @@ function installToCodex(entry) {
     if (!existsSync9(configDir)) {
       mkdirSync7(configDir, { recursive: true });
     }
-    const block = `
-[mcp_servers.${entry.id}]
-` + `command = ${JSON.stringify(entry.command)}
-` + `args = [${entry.args.map((a) => JSON.stringify(a)).join(", ")}]
-`;
+    const env = assertAgentInstallEnv(entry);
     const existing = existsSync9(configPath) ? readFileSync4(configPath, "utf-8") : "";
-    if (existing.includes(`[mcp_servers.${entry.id}]`)) {
+    if (existing.includes(codexServerHeader(entry.id))) {
+      if (Object.keys(env).length > 0) {
+        writeFileSync3(configPath, upsertCodexEnvBlock(existing, entry.id, env), "utf-8");
+      }
       return { agent: "codex", success: true };
     }
-    writeFileSync3(configPath, existing + block, "utf-8");
+    writeFileSync3(configPath, existing + formatCodexServerBlock(entry, env), "utf-8");
     return { agent: "codex", success: true };
   } catch (err) {
     return { agent: "codex", success: false, error: err.message };

package/dist/lib/registry.d.ts

@@ -1,4 +1,7 @@
 import type { CredentialReference, McpServerEntry, AddServerOptions } from "../types.js";
+export declare const VALID_TRANSPORTS: Set<"stdio" | "sse" | "streamable-http">;
+export declare function normalizeServerTransport(value: unknown, fallback?: McpServerEntry["transport"]): McpServerEntry["transport"];
+export declare function normalizeServerUrl(value: unknown): string | null;
 export declare function addServer(opts: AddServerOptions): McpServerEntry;
 export declare function removeServer(id: string): void;
 export declare function listServers(): McpServerEntry[];

package/dist/mcp/index.js

@@ -30759,6 +30759,40 @@ function normalizeCandidate(value) {
   const trimmed = value?.trim();
   return trimmed ? trimmed : undefined;
 }
+function normalizeServerTransport(value, fallback = "stdio") {
+  if (value === undefined)
+    return fallback;
+  if (typeof value !== "string") {
+    throw new Error("Invalid transport type");
+  }
+  const transport = value.trim();
+  if (!transport) {
+    throw new Error("Invalid transport type");
+  }
+  if (!VALID_TRANSPORTS.has(transport)) {
+    throw new Error("Invalid transport type");
+  }
+  return transport;
+}
+function normalizeServerUrl(value) {
+  if (value === null || value === undefined)
+    return null;
+  if (typeof value !== "string") {
+    throw new Error("URL must be a valid HTTP(S) URL");
+  }
+  const trimmed = value.trim();
+  if (!trimmed)
+    return null;
+  try {
+    const parsed = new URL(trimmed);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      throw new Error("unsupported protocol");
+    }
+  } catch {
+    throw new Error("URL must be a valid HTTP(S) URL");
+  }
+  return trimmed;
+}
 function pickNameFromArgs(args) {
   if (!args || args.length === 0)
     return;
@@ -30800,9 +30834,11 @@ function addServer(opts) {
   if (!id) {
     throw new Error("Unable to generate a valid server ID");
   }
+  const transport = normalizeServerTransport(opts.transport);
+  const url2 = normalizeServerUrl(opts.url);
   const row = db2.prepare(`INSERT INTO servers (id, name, description, command, args, env, credential_refs, transport, url, source)
        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-       RETURNING *`).get(id, name, opts.description || null, command, JSON.stringify(opts.args || []), JSON.stringify(normalizeLiteralEnv(opts.env)), JSON.stringify(normalizeCredentialRefs(opts.credentialRefs)), opts.transport || "stdio", opts.url || null, opts.source || "local");
+       RETURNING *`).get(id, name, opts.description || null, command, JSON.stringify(opts.args || []), JSON.stringify(normalizeLiteralEnv(opts.env)), JSON.stringify(normalizeCredentialRefs(opts.credentialRefs)), transport, url2, opts.source || "local");
   return parseRow(row);
 }
 function removeServer(id) {
@@ -30823,6 +30859,14 @@ function updateServer(id, updates) {
   const db2 = getDb();
   const sets = [];
   const values = [];
+  let nextTransport;
+  let nextUrl;
+  if (updates.transport !== undefined) {
+    nextTransport = normalizeServerTransport(updates.transport);
+  }
+  if (updates.url !== undefined) {
+    nextUrl = normalizeServerUrl(updates.url);
+  }
   if (updates.name !== undefined) {
     const name = normalizeCandidate(updates.name);
     if (!name) {
@@ -30857,11 +30901,11 @@ function updateServer(id, updates) {
   }
   if (updates.transport !== undefined) {
     sets.push("transport = ?");
-    values.push(updates.transport);
+    values.push(nextTransport);
   }
   if (updates.url !== undefined) {
     sets.push("url = ?");
-    values.push(updates.url);
+    values.push(nextUrl ?? null);
   }
   if (updates.enabled !== undefined) {
     sets.push("enabled = ?");
@@ -30914,9 +30958,15 @@ function getCachedTools(serverId) {
     input_schema: safeJsonParse(r.input_schema, {})
   }));
 }
+var VALID_TRANSPORTS;
 var init_registry = __esm(() => {
   init_db();
   init_credentials();
+  VALID_TRANSPORTS = new Set([
+    "stdio",
+    "sse",
+    "streamable-http"
+  ]);
 });
 
 // src/lib/local-command-consent.ts
@@ -31484,6 +31534,54 @@ import { execFileSync } from "child_process";
 import { existsSync as existsSync10, readFileSync as readFileSync5, writeFileSync as writeFileSync3, mkdirSync as mkdirSync7 } from "fs";
 import { join as join11 } from "path";
 import { homedir as homedir8 } from "os";
+function formatTomlString(value) {
+  return JSON.stringify(value);
+}
+function formatTomlKey(key) {
+  return /^[A-Za-z0-9_-]+$/.test(key) ? key : formatTomlString(key);
+}
+function formatTomlEnv(env) {
+  return Object.entries(env).sort(([left], [right]) => left.localeCompare(right)).map(([key, value]) => `${formatTomlKey(key)} = ${formatTomlString(value)}`).join(`
+`);
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function codexServerHeader(id) {
+  return `[mcp_servers.${id}]`;
+}
+function codexEnvHeader(id) {
+  return `[mcp_servers.${id}.env]`;
+}
+function formatCodexEnvBlock(id, env) {
+  return `
+${codexEnvHeader(id)}
+${formatTomlEnv(env)}
+`;
+}
+function formatCodexServerBlock(entry, env) {
+  return `
+${codexServerHeader(entry.id)}
+` + `command = ${formatTomlString(entry.command)}
+` + `args = [${entry.args.map((a) => formatTomlString(a)).join(", ")}]
+` + (Object.keys(env).length > 0 ? formatCodexEnvBlock(entry.id, env) : "");
+}
+function upsertCodexEnvBlock(config2, id, env) {
+  const envBlock = formatCodexEnvBlock(id, env);
+  const envHeaderPattern = escapeRegExp(codexEnvHeader(id));
+  const envBlockPattern = new RegExp(`(?:\\r?\\n)?[ \\t]*${envHeaderPattern}[ \\t]*\\r?\\n[\\s\\S]*?(?=\\r?\\n[ \\t]*\\[|\\s*$)`);
+  if (envBlockPattern.test(config2)) {
+    return config2.replace(envBlockPattern, () => envBlock);
+  }
+  const serverHeaderPattern = escapeRegExp(codexServerHeader(id));
+  const serverBlockPattern = new RegExp(`([ \\t]*${serverHeaderPattern}[ \\t]*\\r?\\n[\\s\\S]*?)(?=\\r?\\n[ \\t]*\\[|\\s*$)`);
+  let inserted = false;
+  const updated = config2.replace(serverBlockPattern, (_match, serverBlock) => {
+    inserted = true;
+    return `${serverBlock}${envBlock}`;
+  });
+  return inserted ? updated : `${config2}${envBlock}`;
+}
 function installToClaude(entry) {
   try {
     const args = [
@@ -31511,16 +31609,15 @@ function installToCodex(entry) {
     if (!existsSync10(configDir)) {
       mkdirSync7(configDir, { recursive: true });
     }
-    const block = `
-[mcp_servers.${entry.id}]
-` + `command = ${JSON.stringify(entry.command)}
-` + `args = [${entry.args.map((a) => JSON.stringify(a)).join(", ")}]
-`;
+    const env = assertAgentInstallEnv(entry);
     const existing = existsSync10(configPath) ? readFileSync5(configPath, "utf-8") : "";
-    if (existing.includes(`[mcp_servers.${entry.id}]`)) {
+    if (existing.includes(codexServerHeader(entry.id))) {
+      if (Object.keys(env).length > 0) {
+        writeFileSync3(configPath, upsertCodexEnvBlock(existing, entry.id, env), "utf-8");
+      }
       return { agent: "codex", success: true };
     }
-    writeFileSync3(configPath, existing + block, "utf-8");
+    writeFileSync3(configPath, existing + formatCodexServerBlock(entry, env), "utf-8");
     return { agent: "codex", success: true };
   } catch (err) {
     return { agent: "codex", success: false, error: err.message };
@@ -34452,14 +34549,11 @@ function buildEnv(extra) {
   return merged;
 }
 function requireUrl(entry) {
-  if (!entry.url) {
+  const url2 = normalizeServerUrl(entry.url);
+  if (!url2) {
     throw new Error(`Server "${entry.id}" is missing a URL for ${entry.transport} transport`);
   }
-  try {
-    return new URL(entry.url);
-  } catch {
-    throw new Error(`Server "${entry.id}" has an invalid URL: ${entry.url}`);
-  }
+  return new URL(url2);
 }
 async function connectToServer(entry, options = {}) {
   if (connections.has(entry.id)) {
@@ -34491,8 +34585,10 @@ async function connectToServer(entry, options = {}) {
         });
       } else if (entry.transport === "sse") {
         transport = new SSEClientTransport(requireUrl(entry));
-      } else {
+      } else if (entry.transport === "streamable-http") {
         transport = new StreamableHTTPClientTransport(requireUrl(entry));
+      } else {
+        throw new Error(`Unsupported transport type for server "${entry.id}": ${entry.transport}`);
       }
       await client.connect(transport);
       const result = await client.listTools();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/mcps",
-  "version": "0.0.27",
+  "version": "0.0.29",
   "description": "Meta-MCP registry & CLI — discover, manage, and proxy MCP servers",
   "type": "module",
   "repository": {