@hellocrossman/mcp-sdk 0.3.5 → 0.4.1

package/dist/cjs/cli.js

@@ -175,8 +175,29 @@ function checkIsESM(filePath, root) {
         return false;
     }
 }
-function alreadySetup(content) {
-    return content.includes("createMcpServer") || content.includes("@hellocrossman/mcp-sdk");
+function alreadySetup(root) {
+    const mcpServerFile = path_1.default.join(root, "mcp-server.ts");
+    const mcpServerFileJs = path_1.default.join(root, "mcp-server.js");
+    if (fs_1.default.existsSync(mcpServerFile) || fs_1.default.existsSync(mcpServerFileJs))
+        return true;
+    const serverMcpFile = path_1.default.join(root, "server", "mcp-server.ts");
+    const serverMcpFileJs = path_1.default.join(root, "server", "mcp-server.js");
+    if (fs_1.default.existsSync(serverMcpFile) || fs_1.default.existsSync(serverMcpFileJs))
+        return true;
+    return false;
+}
+function findExistingMcpServerFile(root) {
+    const candidates = [
+        path_1.default.join(root, "mcp-server.ts"),
+        path_1.default.join(root, "mcp-server.js"),
+        path_1.default.join(root, "server", "mcp-server.ts"),
+        path_1.default.join(root, "server", "mcp-server.js"),
+    ];
+    for (const f of candidates) {
+        if (fs_1.default.existsSync(f))
+            return f;
+    }
+    return null;
 }
 function checkPgInstalled(root) {
     return fs_1.default.existsSync(path_1.default.join(root, "node_modules", "pg"));
@@ -243,13 +264,81 @@ function stripExistingMcpConfig(content) {
     result = result.replace(/\n{3,}/g, "\n\n");
     return result;
 }
+function findAppExport(content, varName) {
+    const namedExportRe = new RegExp(`export\\s+(?:const|let|var)\\s+${varName}\\s*=`);
+    if (namedExportRe.test(content))
+        return varName;
+    if (/export\s+default\s+app\b/.test(content))
+        return "default";
+    const moduleExportsRe = new RegExp(`module\\.exports\\s*=\\s*${varName}`);
+    if (moduleExportsRe.test(content))
+        return "default";
+    const exportsRe = new RegExp(`module\\.exports\\.${varName}\\s*=`);
+    if (exportsRe.test(content))
+        return varName;
+    return varName;
+}
+function findEntryFiles(root, appFile) {
+    const entries = [];
+    const appFileRel = path_1.default.relative(root, appFile);
+    const appBaseName = path_1.default.basename(appFile, path_1.default.extname(appFile));
+    const appDir = path_1.default.dirname(appFile);
+    const searchDirs = [appDir, root, path_1.default.join(root, "server"), path_1.default.join(root, "src")];
+    const seen = new Set();
+    for (const dir of searchDirs) {
+        if (!fs_1.default.existsSync(dir) || !fs_1.default.statSync(dir).isDirectory())
+            continue;
+        const files = fs_1.default.readdirSync(dir).filter((f) => /\.(ts|js|mjs)$/.test(f));
+        for (const file of files) {
+            const fullPath = path_1.default.join(dir, file);
+            if (seen.has(fullPath) || fullPath === appFile)
+                continue;
+            seen.add(fullPath);
+            try {
+                const content = fs_1.default.readFileSync(fullPath, "utf-8");
+                const hasListen = LISTEN_PATTERN.test(content);
+                const importsApp = content.includes(`./${appBaseName}`) ||
+                    content.includes(`'./${appFileRel}'`) ||
+                    content.includes(`"./${appFileRel}"`) ||
+                    content.includes(`from './${appBaseName}'`) ||
+                    content.includes(`from "./${appBaseName}"`) ||
+                    content.includes(`require('./${appBaseName}')`) ||
+                    content.includes(`require("./${appBaseName}")`);
+                if (hasListen || importsApp) {
+                    entries.push(fullPath);
+                }
+            }
+            catch { }
+        }
+    }
+    if (entries.length === 0) {
+        entries.push(appFile);
+    }
+    return entries;
+}
 async function stepDetectApp(state, prompt, specifiedFile, force) {
-    printStep(1, 5, "Detecting Express app");
-    let entryFile = null;
+    printStep(1, 7, "Detecting Express app");
+    if (alreadySetup(state.root)) {
+        if (force) {
+            const existingFile = findExistingMcpServerFile(state.root);
+            if (existingFile) {
+                console.log(`  ${c("yellow", "~")} Found existing ${c("bold", path_1.default.relative(state.root, existingFile))}`);
+                console.log(`  ${c("dim", "  Will regenerate with fresh scan...")}`);
+            }
+        }
+        else {
+            const existingFile = findExistingMcpServerFile(state.root);
+            const relPath = existingFile ? path_1.default.relative(state.root, existingFile) : "mcp-server.ts";
+            console.log(`  ${c("green", "+")} MCP SDK is already set up (${c("bold", relPath)})`);
+            console.log(`  ${c("dim", "  Run with")} ${c("cyan", "--force")} ${c("dim", "to re-scan and reconfigure.")}`);
+            return false;
+        }
+    }
+    let appFile = null;
     if (specifiedFile) {
         const resolved = path_1.default.resolve(state.root, specifiedFile);
         if (fs_1.default.existsSync(resolved)) {
-            entryFile = resolved;
+            appFile = resolved;
         }
         else {
             console.log(`  ${c("yellow", "!")} File not found: ${specifiedFile}`);
@@ -257,11 +346,11 @@ async function stepDetectApp(state, prompt, specifiedFile, force) {
         }
     }
     else {
-        entryFile = findExpressEntryFile(state.root);
+        appFile = findExpressEntryFile(state.root);
     }
-    if (entryFile && !specifiedFile) {
-        const relPath = path_1.default.relative(state.root, entryFile);
-        const content = fs_1.default.readFileSync(entryFile, "utf-8");
+    if (appFile && !specifiedFile) {
+        const relPath = path_1.default.relative(state.root, appFile);
+        const content = fs_1.default.readFileSync(appFile, "utf-8");
         const hasCreation = APP_VAR_PATTERN.test(content);
         const hasListen = LISTEN_PATTERN.test(content);
         const signals = [];
@@ -277,7 +366,7 @@ async function stepDetectApp(state, prompt, specifiedFile, force) {
             if (custom) {
                 const resolved = path_1.default.resolve(state.root, custom);
                 if (fs_1.default.existsSync(resolved)) {
-                    entryFile = resolved;
+                    appFile = resolved;
                 }
                 else {
                     console.log(`  ${c("yellow", "!")} File not found: ${custom}`);
@@ -289,13 +378,13 @@ async function stepDetectApp(state, prompt, specifiedFile, force) {
             }
         }
     }
-    if (!entryFile) {
+    if (!appFile) {
         console.log(`  ${c("yellow", "!")} Could not find an Express app file.`);
         const custom = await prompt.ask(`  Enter the path to your Express app file: `);
         if (custom) {
             const resolved = path_1.default.resolve(state.root, custom);
             if (fs_1.default.existsSync(resolved)) {
-                entryFile = resolved;
+                appFile = resolved;
             }
             else {
                 console.log(`  ${c("yellow", "!")} File not found: ${custom}`);
@@ -306,31 +395,23 @@ async function stepDetectApp(state, prompt, specifiedFile, force) {
             return false;
         }
     }
-    let content = fs_1.default.readFileSync(entryFile, "utf-8");
-    if (alreadySetup(content)) {
-        if (force) {
-            console.log(`  ${c("yellow", "~")} Found existing MCP config in ${path_1.default.relative(state.root, entryFile)}`);
-            console.log(`  ${c("dim", "  Removing old configuration for re-scan...")}`);
-            content = stripExistingMcpConfig(content);
-            fs_1.default.writeFileSync(entryFile, content);
-            console.log(`  ${c("green", "+")} Old config removed. Starting fresh.`);
-        }
-        else {
-            console.log(`  ${c("green", "+")} MCP SDK is already set up in ${path_1.default.relative(state.root, entryFile)}`);
-            console.log(`  ${c("dim", "  Run with")} ${c("cyan", "--force")} ${c("dim", "to re-scan and reconfigure.")}`);
-            return false;
-        }
-    }
+    const content = fs_1.default.readFileSync(appFile, "utf-8");
     const appMatch = content.match(APP_VAR_PATTERN);
-    state.entryFile = entryFile;
+    state.appFile = appFile;
     state.appVarName = appMatch ? appMatch[1] : "app";
-    state.isESM = checkIsESM(entryFile, state.root);
+    state.appExportName = findAppExport(content, state.appVarName);
+    state.isESM = checkIsESM(appFile, state.root);
+    const entryFiles = findEntryFiles(state.root, appFile);
+    state.entryFiles = entryFiles;
     console.log(`  ${c("dim", `  Variable: ${state.appVarName}, Module: ${state.isESM ? "ESM" : "CommonJS"}`)}`);
+    if (entryFiles.length > 0 && entryFiles[0] !== appFile) {
+        console.log(`  ${c("dim", `  Entry files: ${entryFiles.map((f) => path_1.default.relative(state.root, f)).join(", ")}`)}`);
+    }
     return true;
 }
 async function stepScanRoutes(state) {
-    printStep(2, 5, "Scanning API routes");
-    state.routes = (0, route_scan_js_1.scanAllRoutes)(state.entryFile, state.routePrefix);
+    printStep(2, 7, "Scanning API routes");
+    state.routes = (0, route_scan_js_1.scanAllRoutes)(state.appFile, state.routePrefix);
     if (state.routes.length === 0) {
         console.log(`  ${c("dim", "  No routes found under")} ${state.routePrefix}`);
         console.log(`  ${c("dim", "  Routes will be discovered at runtime when your app starts.")}`);
@@ -355,7 +436,7 @@ async function stepScanRoutes(state) {
     }
 }
 async function stepScanDatabase(state, prompt) {
-    printStep(3, 5, "Database discovery");
+    printStep(3, 7, "Database discovery");
     const wantDb = await prompt.confirm(`  Scan your database for tables to expose as tools?`);
     if (!wantDb) {
         state.databaseEnabled = false;
@@ -443,7 +524,7 @@ async function stepScanDatabase(state, prompt) {
     }
 }
 async function stepEnrichAndReview(state, prompt) {
-    printStep(4, 5, "AI enrichment & tool review");
+    printStep(4, 7, "AI enrichment & tool review");
     if (state.tools.length === 0) {
         console.log(`  ${c("dim", "  No tools discovered. Routes will be discovered at runtime.")}`);
         state.enrichmentEnabled = true;
@@ -507,10 +588,477 @@ async function stepEnrichAndReview(state, prompt) {
         state.includeWrites = wantWrites;
     }
 }
+async function stepCustomTools(state, prompt) {
+    printStep(5, 7, "Custom tools (optional)");
+    console.log(`  ${c("dim", "Auto-discovered tools give broad coverage.")}`);
+    console.log(`  ${c("dim", "Custom tools let you define purpose-built queries")}`);
+    console.log(`  ${c("dim", "for specific business questions.\n")}`);
+    const wantCustom = await prompt.confirm(`  Define custom tools?`, false);
+    if (!wantCustom) {
+        console.log(`  ${c("dim", "  Skipping custom tools.")}`);
+        return;
+    }
+    const availableRoutes = state.routes.map((r) => `${r.method} ${r.path}`);
+    const availableTables = state.dbTables.map((t) => t.name);
+    while (true) {
+        console.log();
+        const name = await prompt.ask(`  ${c("cyan", "Tool name")} ${c("dim", "(e.g. get_traffic_overview):")} `);
+        if (!name)
+            break;
+        const toolName = name.replace(/[^a-zA-Z0-9_]/g, "_").toLowerCase();
+        const description = await prompt.ask(`  ${c("cyan", "Description")} ${c("dim", "(what does this tool do?):")} `);
+        if (!description)
+            break;
+        const params = [];
+        console.log(`\n  ${c("dim", "Define input parameters (press Enter with no name to finish):")}`);
+        while (true) {
+            const paramName = await prompt.ask(`    ${c("cyan", "Parameter name:")} `);
+            if (!paramName)
+                break;
+            const paramDesc = await prompt.ask(`    ${c("cyan", "Description:")} `);
+            console.log(`    ${c("dim", "Type: 1) string  2) number  3) boolean")}`);
+            const typeChoice = await prompt.ask(`    ${c("cyan", "Type")} ${c("dim", "(1/2/3, default: 1):")} `);
+            const paramType = typeChoice === "2" ? "number" : typeChoice === "3" ? "boolean" : "string";
+            const isRequired = await prompt.confirm(`    Required?`);
+            params.push({ name: paramName, type: paramType, description: paramDesc || paramName, required: isRequired });
+            console.log(`    ${c("green", "+")} Added parameter: ${c("bold", paramName)} (${paramType})`);
+        }
+        console.log(`\n  ${c("dim", "How should this tool get its data?")}`);
+        console.log(`    ${c("cyan", "1.")} Call an existing API route`);
+        console.log(`    ${c("cyan", "2.")} Run a database query`);
+        const sourceChoice = await prompt.ask(`  ${c("dim", ">")} `);
+        const customTool = {
+            name: toolName,
+            description,
+            params,
+            dataSource: sourceChoice === "2" ? "database" : "route",
+        };
+        if (sourceChoice === "2" && availableTables.length > 0) {
+            console.log(`\n  ${c("dim", "Available tables:")}`);
+            availableTables.forEach((t, i) => console.log(`    ${c("cyan", `${i + 1}.`)} ${t}`));
+            const tableChoice = await prompt.ask(`  ${c("dim", "Table number or name:")} `);
+            const tableIndex = parseInt(tableChoice) - 1;
+            customTool.tableName = availableTables[tableIndex] || tableChoice;
+            const tableInfo = state.dbTables.find((t) => t.name === customTool.tableName);
+            if (tableInfo) {
+                const scopeColumns = tableInfo.columns
+                    .filter((col) => /user_id|project_id|account_id|org_id|team_id|owner_id/.test(col.name))
+                    .map((col) => col.name);
+                if (scopeColumns.length > 0) {
+                    console.log(`\n  ${c("dim", "User scoping - filter results by:")}`);
+                    scopeColumns.forEach((col, i) => console.log(`    ${c("cyan", `${i + 1}.`)} ${col}`));
+                    console.log(`    ${c("cyan", `${scopeColumns.length + 1}.`)} No scoping (public data)`);
+                    const scopeChoice = await prompt.ask(`  ${c("dim", ">")} `);
+                    const scopeIndex = parseInt(scopeChoice) - 1;
+                    if (scopeIndex >= 0 && scopeIndex < scopeColumns.length) {
+                        customTool.scopeColumn = scopeColumns[scopeIndex];
+                    }
+                }
+            }
+        }
+        else if (sourceChoice !== "2" && availableRoutes.length > 0) {
+            console.log(`\n  ${c("dim", "Available routes:")}`);
+            availableRoutes.forEach((r, i) => console.log(`    ${c("cyan", `${i + 1}.`)} ${r}`));
+            const routeChoice = await prompt.ask(`  ${c("dim", "Route number:")} `);
+            const routeIndex = parseInt(routeChoice) - 1;
+            if (routeIndex >= 0 && routeIndex < state.routes.length) {
+                customTool.routeMethod = state.routes[routeIndex].method;
+                customTool.routePath = state.routes[routeIndex].path;
+            }
+        }
+        state.customTools.push(customTool);
+        console.log(`\n  ${c("green", "+")} Added custom tool: ${c("bold", toolName)}`);
+        const addMore = await prompt.confirm(`\n  Add another custom tool?`, false);
+        if (!addMore)
+            break;
+    }
+    if (state.customTools.length > 0) {
+        console.log(`\n  ${c("green", "+")} ${state.customTools.length} custom tool${state.customTools.length === 1 ? "" : "s"} defined.`);
+    }
+}
+const AUTH_PROVIDERS = [
+    {
+        id: "supabase",
+        label: "Supabase",
+        packages: ["@supabase/supabase-js", "@supabase/ssr", "@supabase/auth-helpers-express"],
+        filePatterns: [/supabase\.auth/, /createClient.*supabase/],
+    },
+    {
+        id: "clerk",
+        label: "Clerk",
+        packages: ["@clerk/clerk-sdk-node", "@clerk/express", "@clerk/nextjs", "@clerk/backend"],
+        filePatterns: [/clerkMiddleware/, /requireAuth/, /clerkClient/],
+    },
+    {
+        id: "auth0",
+        label: "Auth0",
+        packages: ["express-oauth2-jwt-bearer", "auth0", "@auth0/nextjs-auth0", "express-openid-connect"],
+        filePatterns: [/auth0/, /express-oauth2-jwt-bearer/],
+    },
+    {
+        id: "jwt",
+        label: "Custom JWT",
+        packages: ["jsonwebtoken", "jose"],
+        filePatterns: [/jwt\.verify/, /jwt\.sign/, /jose.*jwtVerify/],
+    },
+];
+function detectAuthProvider(root) {
+    let pkgDeps = {};
+    try {
+        const pkg = JSON.parse(fs_1.default.readFileSync(path_1.default.join(root, "package.json"), "utf-8"));
+        pkgDeps = { ...pkg.dependencies, ...pkg.devDependencies };
+    }
+    catch {
+        return null;
+    }
+    for (const provider of AUTH_PROVIDERS) {
+        const hasPackage = provider.packages.some((p) => p in pkgDeps);
+        if (hasPackage) {
+            return { provider: provider.id, confidence: "high" };
+        }
+    }
+    const srcDirs = ["server", "src", "lib", "."];
+    for (const dir of srcDirs) {
+        const dirPath = path_1.default.join(root, dir);
+        if (!fs_1.default.existsSync(dirPath) || !fs_1.default.statSync(dirPath).isDirectory())
+            continue;
+        try {
+            const files = fs_1.default.readdirSync(dirPath).filter((f) => /\.(ts|js|mjs)$/.test(f));
+            for (const file of files) {
+                const content = fs_1.default.readFileSync(path_1.default.join(dirPath, file), "utf-8");
+                for (const provider of AUTH_PROVIDERS) {
+                    if (provider.filePatterns.some((p) => p.test(content))) {
+                        return { provider: provider.id, confidence: "medium" };
+                    }
+                }
+            }
+        }
+        catch { }
+    }
+    return null;
+}
+async function stepAuth(state, prompt) {
+    printStep(6, 7, "Authentication");
+    console.log(`  ${c("dim", "MCP clients like Claude Desktop require OAuth for remote servers.")}`);
+    console.log(`  ${c("dim", "The SDK can generate the OAuth bridge using your existing auth.\n")}`);
+    const detected = detectAuthProvider(state.root);
+    let selectedProvider;
+    if (detected) {
+        const providerLabel = AUTH_PROVIDERS.find((p) => p.id === detected.provider)?.label || detected.provider;
+        const confidence = detected.confidence === "high" ? "found in dependencies" : "detected in code";
+        console.log(`  ${c("green", "+")} Detected: ${c("bold", providerLabel)} ${c("dim", `(${confidence})`)}`);
+        console.log();
+        const useDetected = await prompt.confirm(`  Use ${providerLabel} for MCP authentication?`);
+        if (useDetected) {
+            selectedProvider = detected.provider;
+        }
+        else {
+            selectedProvider = await promptAuthChoice(prompt);
+        }
+    }
+    else {
+        console.log(`  ${c("dim", "  No auth provider auto-detected.")}`);
+        console.log();
+        selectedProvider = await promptAuthChoice(prompt);
+    }
+    state.authProvider = selectedProvider;
+    if (selectedProvider === "none") {
+        console.log(`\n  ${c("dim", "  Skipping auth. MCP endpoint will be open (good for local dev).")}`);
+    }
+    else {
+        const label = AUTH_PROVIDERS.find((p) => p.id === selectedProvider)?.label || selectedProvider;
+        console.log(`\n  ${c("green", "+")} Auth configured: ${c("bold", label)}`);
+        if (selectedProvider === "supabase") {
+            console.log(`  ${c("dim", "  Requires SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY env vars.")}`);
+        }
+        else if (selectedProvider === "clerk") {
+            console.log(`  ${c("dim", "  Requires CLERK_SECRET_KEY env var.")}`);
+        }
+        else if (selectedProvider === "auth0") {
+            console.log(`  ${c("dim", "  Requires AUTH0_ISSUER_BASE_URL and AUTH0_AUDIENCE env vars.")}`);
+        }
+        else if (selectedProvider === "jwt") {
+            console.log(`  ${c("dim", "  Requires JWT_SECRET env var.")}`);
+        }
+        else if (selectedProvider === "apikey") {
+            console.log(`  ${c("dim", "  Requires MCP_API_KEY env var.")}`);
+        }
+    }
+}
+async function promptAuthChoice(prompt) {
+    console.log(`  Which auth provider do you use?`);
+    console.log();
+    console.log(`    ${c("cyan", "1.")} Supabase`);
+    console.log(`    ${c("cyan", "2.")} Clerk`);
+    console.log(`    ${c("cyan", "3.")} Auth0`);
+    console.log(`    ${c("cyan", "4.")} Custom JWT (jsonwebtoken, jose)`);
+    console.log(`    ${c("cyan", "5.")} API keys (simple Bearer token)`);
+    console.log(`    ${c("cyan", "6.")} None / skip auth`);
+    console.log();
+    const choice = await prompt.ask(`  ${c("dim", "Enter 1-6:")} `);
+    switch (choice) {
+        case "1": return "supabase";
+        case "2": return "clerk";
+        case "3": return "auth0";
+        case "4": return "jwt";
+        case "5": return "apikey";
+        case "6":
+        default: return "none";
+    }
+}
+function generateAuthCode(state) {
+    const lines = [];
+    switch (state.authProvider) {
+        case "supabase":
+            if (state.isESM) {
+                lines.push(`import { createClient } from '@supabase/supabase-js';`);
+            }
+            else {
+                lines.push(`const { createClient } = require('@supabase/supabase-js');`);
+            }
+            lines.push(``);
+            lines.push(`const supabase = createClient(`);
+            lines.push(`  process.env.SUPABASE_URL!,`);
+            lines.push(`  process.env.SUPABASE_SERVICE_ROLE_KEY!`);
+            lines.push(`);`);
+            lines.push(``);
+            lines.push(`const mcpAuth = {`);
+            lines.push(`  async verifyToken(token: string) {`);
+            lines.push(`    const { data: { user }, error } = await supabase.auth.getUser(token);`);
+            lines.push(`    if (error || !user) return null;`);
+            lines.push(`    return { userId: user.id, email: user.email };`);
+            lines.push(`  },`);
+            lines.push(`  issuer: process.env.SUPABASE_URL,`);
+            lines.push(`};`);
+            break;
+        case "clerk":
+            if (state.isESM) {
+                lines.push(`import { createClerkClient } from '@clerk/backend';`);
+            }
+            else {
+                lines.push(`const { createClerkClient } = require('@clerk/backend');`);
+            }
+            lines.push(``);
+            lines.push(`const clerk = createClerkClient({ secretKey: process.env.CLERK_SECRET_KEY! });`);
+            lines.push(``);
+            lines.push(`const mcpAuth = {`);
+            lines.push(`  async verifyToken(token: string) {`);
+            lines.push(`    try {`);
+            lines.push(`      const session = await clerk.sessions.verifySession(token, token);`);
+            lines.push(`      return { userId: session.userId };`);
+            lines.push(`    } catch {`);
+            lines.push(`      return null;`);
+            lines.push(`    }`);
+            lines.push(`  },`);
+            lines.push(`};`);
+            break;
+        case "auth0":
+            if (state.isESM) {
+                lines.push(`import { createRemoteJWKSet, jwtVerify } from 'jose';`);
+            }
+            else {
+                lines.push(`const { createRemoteJWKSet, jwtVerify } = require('jose');`);
+            }
+            lines.push(``);
+            lines.push(`const AUTH0_DOMAIN = process.env.AUTH0_ISSUER_BASE_URL!;`);
+            lines.push(`const AUTH0_AUDIENCE = process.env.AUTH0_AUDIENCE || '';`);
+            lines.push(`const JWKS = createRemoteJWKSet(new URL(\`\${AUTH0_DOMAIN}.well-known/jwks.json\`));`);
+            lines.push(``);
+            lines.push(`const mcpAuth = {`);
+            lines.push(`  async verifyToken(token: string) {`);
+            lines.push(`    try {`);
+            lines.push(`      const { payload } = await jwtVerify(token, JWKS, {`);
+            lines.push(`        issuer: AUTH0_DOMAIN,`);
+            lines.push(`        audience: AUTH0_AUDIENCE || undefined,`);
+            lines.push(`      });`);
+            lines.push(`      if (!payload.sub) return null;`);
+            lines.push(`      return { userId: payload.sub };`);
+            lines.push(`    } catch {`);
+            lines.push(`      return null;`);
+            lines.push(`    }`);
+            lines.push(`  },`);
+            lines.push(`  issuer: process.env.AUTH0_ISSUER_BASE_URL,`);
+            lines.push(`};`);
+            break;
+        case "jwt":
+            if (state.isESM) {
+                lines.push(`import jwt from 'jsonwebtoken';`);
+            }
+            else {
+                lines.push(`const jwt = require('jsonwebtoken');`);
+            }
+            lines.push(``);
+            lines.push(`const mcpAuth = {`);
+            lines.push(`  async verifyToken(token: string) {`);
+            lines.push(`    try {`);
+            lines.push(`      const decoded = jwt.verify(token, process.env.JWT_SECRET!) as any;`);
+            lines.push(`      return { userId: decoded.sub || decoded.userId || decoded.id };`);
+            lines.push(`    } catch {`);
+            lines.push(`      return null;`);
+            lines.push(`    }`);
+            lines.push(`  },`);
+            lines.push(`};`);
+            break;
+        case "apikey":
+            lines.push(`const mcpAuth = {`);
+            lines.push(`  async verifyToken(token: string) {`);
+            lines.push(`    if (token === process.env.MCP_API_KEY) {`);
+            lines.push(`      return { userId: 'api-key-user' };`);
+            lines.push(`    }`);
+            lines.push(`    return null;`);
+            lines.push(`  },`);
+            lines.push(`};`);
+            break;
+        default:
+            break;
+    }
+    return lines;
+}
+function generateCustomToolsFile(state) {
+    const lines = [];
+    lines.push(`// Custom tools for your MCP server`);
+    lines.push(`// Hand-crafted tools that persist across re-scans`);
+    lines.push(`// Edit this file to customize tool behavior`);
+    lines.push(``);
+    if (state.isESM) {
+        lines.push(`import type { Express } from 'express';`);
+    }
+    lines.push(``);
+    lines.push(`export interface CustomToolDefinition {`);
+    lines.push(`  name: string;`);
+    lines.push(`  description: string;`);
+    lines.push(`  inputSchema: Record<string, unknown>;`);
+    lines.push(`  handler: (args: Record<string, unknown>) => Promise<unknown>;`);
+    lines.push(`}`);
+    lines.push(``);
+    lines.push(`export function getCustomTools(app: ${state.isESM ? "Express" : "any"}, dbUrl?: string): CustomToolDefinition[] {`);
+    lines.push(`  const tools: CustomToolDefinition[] = [];`);
+    lines.push(``);
+    for (const tool of state.customTools) {
+        const properties = [];
+        const required = [];
+        for (const param of tool.params) {
+            properties.push(`        ${param.name}: { type: "${param.type}", description: "${param.description.replace(/"/g, '\\"')}" }`);
+            if (param.required)
+                required.push(`"${param.name}"`);
+        }
+        lines.push(`  tools.push({`);
+        lines.push(`    name: "${tool.name}",`);
+        lines.push(`    description: "${tool.description.replace(/"/g, '\\"')}",`);
+        lines.push(`    inputSchema: {`);
+        lines.push(`      type: "object",`);
+        lines.push(`      properties: {`);
+        lines.push(properties.join(",\n"));
+        lines.push(`      },`);
+        if (required.length > 0) {
+            lines.push(`      required: [${required.join(", ")}],`);
+        }
+        lines.push(`    },`);
+        if (tool.dataSource === "database" && tool.tableName) {
+            lines.push(`    handler: async (args) => {`);
+            lines.push(`      if (!dbUrl) return { error: "No database connection configured" };`);
+            lines.push(`      const pg = await import("pg");`);
+            lines.push(`      const client = new pg.default.Client({ connectionString: dbUrl });`);
+            lines.push(`      try {`);
+            lines.push(`        await client.connect();`);
+            if (tool.scopeColumn) {
+                lines.push(`        const scopeValue = args.${tool.scopeColumn} as string;`);
+                lines.push(`        if (!scopeValue) return { error: "${tool.scopeColumn} is required for scoped queries" };`);
+                lines.push(`        const result = await client.query(\`SELECT * FROM ${tool.tableName} WHERE ${tool.scopeColumn} = $1 LIMIT 100\`, [scopeValue]);`);
+            }
+            else {
+                lines.push(`        const result = await client.query(\`SELECT * FROM ${tool.tableName} LIMIT 100\`);`);
+            }
+            lines.push(`        return result.rows;`);
+            lines.push(`      } finally {`);
+            lines.push(`        await client.end();`);
+            lines.push(`      }`);
+            lines.push(`    },`);
+        }
+        else if (tool.dataSource === "route" && tool.routePath) {
+            lines.push(`    handler: async (args) => {`);
+            lines.push(`      // TODO: Implement route-based handler`);
+            lines.push(`      // This tool maps to ${tool.routeMethod} ${tool.routePath}`);
+            lines.push(`      return { message: "Implement this handler to call your API" };`);
+            lines.push(`    },`);
+        }
+        else {
+            lines.push(`    handler: async (args) => {`);
+            lines.push(`      // TODO: Implement custom handler`);
+            lines.push(`      return { message: "Implement this handler" };`);
+            lines.push(`    },`);
+        }
+        lines.push(`  });`);
+        lines.push(``);
+    }
+    lines.push(`  return tools;`);
+    lines.push(`}`);
+    lines.push(``);
+    return lines.join("\n");
+}
+function validateGeneratedFiles(mcpServerPath, entryFiles) {
+    const errors = [];
+    const allFiles = [mcpServerPath, ...entryFiles];
+    for (const filePath of allFiles) {
+        if (!fs_1.default.existsSync(filePath))
+            continue;
+        const content = fs_1.default.readFileSync(filePath, "utf-8");
+        const relPath = path_1.default.basename(filePath);
+        let openBraces = 0;
+        let openParens = 0;
+        let openBrackets = 0;
+        let inString = null;
+        let inTemplateString = false;
+        for (let i = 0; i < content.length; i++) {
+            const ch = content[i];
+            const prev = i > 0 ? content[i - 1] : "";
+            if (inString) {
+                if (ch === inString && prev !== "\\")
+                    inString = null;
+                continue;
+            }
+            if (inTemplateString) {
+                if (ch === "`" && prev !== "\\")
+                    inTemplateString = false;
+                continue;
+            }
+            if (ch === "'" || ch === '"') {
+                inString = ch;
+                continue;
+            }
+            if (ch === "`") {
+                inTemplateString = true;
+                continue;
+            }
+            if (ch === "/" && content[i + 1] === "/") {
+                while (i < content.length && content[i] !== "\n")
+                    i++;
+                continue;
+            }
+            if (ch === "{")
+                openBraces++;
+            else if (ch === "}")
+                openBraces--;
+            else if (ch === "(")
+                openParens++;
+            else if (ch === ")")
+                openParens--;
+            else if (ch === "[")
+                openBrackets++;
+            else if (ch === "]")
+                openBrackets--;
+        }
+        if (openBraces !== 0)
+            errors.push(`${relPath}: Unbalanced braces (${openBraces > 0 ? "missing }" : "extra }"})`);
+        if (openParens !== 0)
+            errors.push(`${relPath}: Unbalanced parentheses (${openParens > 0 ? "missing )" : "extra )"})`);
+        if (openBrackets !== 0)
+            errors.push(`${relPath}: Unbalanced brackets (${openBrackets > 0 ? "missing ]" : "extra ]"})`);
+    }
+    return errors;
+}
 async function stepGenerate(state) {
-    printStep(5, 5, "Generating MCP server");
-    const content = fs_1.default.readFileSync(state.entryFile, "utf-8");
-    const importLine = state.isESM ? IMPORT_LINE_ESM : IMPORT_LINE_CJS;
+    printStep(7, 7, "Generating MCP server");
     const disabledRoutePaths = state.tools
         .filter((t) => t.source === "route" && !t.enabled)
         .map((t) => t.path);
@@ -528,7 +1076,7 @@ async function stepGenerate(state) {
             disabledTables.add(tableName);
     }
     const configParts = [];
-    configParts.push(`app: ${state.appVarName}`);
+    configParts.push(`app`);
     if (disabledRoutes.length > 0) {
         configParts.push(`excludeRoutes: ${JSON.stringify(disabledRoutes)}`);
     }
@@ -546,38 +1094,133 @@ async function stepGenerate(state) {
     if (!state.enrichmentEnabled) {
         configParts.push(`enrichment: false`);
     }
-    let setupCode;
+    const appFileDir = path_1.default.dirname(state.appFile);
+    const appFileBase = path_1.default.basename(state.appFile, path_1.default.extname(state.appFile));
+    const ext = state.isESM ? ".ts" : ".js";
+    const mcpServerPath = path_1.default.join(appFileDir, `mcp-server${ext}`);
+    const mcpServerRel = path_1.default.relative(state.root, mcpServerPath);
+    const hasCustomTools = state.customTools.length > 0;
+    const customToolsPath = path_1.default.join(appFileDir, `mcp-custom-tools${ext}`);
+    const customToolsExists = fs_1.default.existsSync(customToolsPath);
+    const importAppPath = `./${appFileBase}`;
+    let fileLines = [];
+    fileLines.push(`// Auto-generated by @hellocrossman/mcp-sdk`);
+    fileLines.push(`// This file connects your Express app to AI assistants (Claude, ChatGPT, Cursor)`);
+    fileLines.push(`// Safe to regenerate with: npx @hellocrossman/mcp-sdk init --force`);
+    fileLines.push(``);
+    if (state.isESM) {
+        if (state.appExportName === "default") {
+            fileLines.push(`import app from '${importAppPath}';`);
+        }
+        else if (state.appExportName === "app") {
+            fileLines.push(`import { app } from '${importAppPath}';`);
+        }
+        else {
+            fileLines.push(`import { ${state.appExportName} as app } from '${importAppPath}';`);
+        }
+        fileLines.push(`import { createMcpServer } from '@hellocrossman/mcp-sdk';`);
+        if (hasCustomTools || customToolsExists) {
+            fileLines.push(`import { getCustomTools } from './mcp-custom-tools';`);
+        }
+    }
+    else {
+        if (state.appExportName === "default") {
+            fileLines.push(`const app = require('${importAppPath}');`);
+        }
+        else if (state.appExportName === "app") {
+            fileLines.push(`const { app } = require('${importAppPath}');`);
+        }
+        else {
+            fileLines.push(`const { ${state.appExportName}: app } = require('${importAppPath}');`);
+        }
+        fileLines.push(`const { createMcpServer } = require('@hellocrossman/mcp-sdk');`);
+        if (hasCustomTools || customToolsExists) {
+            fileLines.push(`const { getCustomTools } = require('./mcp-custom-tools');`);
+        }
+    }
+    fileLines.push(``);
+    if (hasCustomTools || customToolsExists) {
+        configParts.push(`customTools: getCustomTools(app, process.env.DATABASE_URL)`);
+    }
+    if (state.authProvider !== "none") {
+        const authLines = generateAuthCode(state);
+        fileLines.push(...authLines);
+        fileLines.push(``);
+        configParts.push(`auth: mcpAuth`);
+    }
+    let configStr;
     if (configParts.length <= 2) {
-        setupCode = `createMcpServer({ ${configParts.join(", ")} });`;
+        configStr = `createMcpServer({ ${configParts.join(", ")} });`;
     }
     else {
         const indent = "  ";
-        setupCode = `createMcpServer({\n${configParts.map((p) => `${indent}${p},`).join("\n")}\n});`;
+        configStr = `createMcpServer({\n${configParts.map((p) => `${indent}${p},`).join("\n")}\n});`;
     }
-    const lines = content.split("\n");
-    let lastImportIndex = -1;
-    for (let i = 0; i < lines.length; i++) {
-        if (/^import\s/.test(lines[i]) || /^const\s.*=\s*require/.test(lines[i])) {
-            lastImportIndex = i;
-        }
+    fileLines.push(configStr);
+    fileLines.push(``);
+    if (hasCustomTools) {
+        const customToolsContent = generateCustomToolsFile(state);
+        fs_1.default.writeFileSync(customToolsPath, customToolsContent);
     }
-    lines.splice(lastImportIndex + 1, 0, importLine);
-    let listenIndex = -1;
-    for (let i = lines.length - 1; i >= 0; i--) {
-        if (LISTEN_PATTERN.test(lines[i])) {
-            listenIndex = i;
-            break;
+    const mcpServerContent = fileLines.join("\n");
+    const backups = [];
+    backups.push({ path: mcpServerPath, content: fs_1.default.existsSync(mcpServerPath) ? fs_1.default.readFileSync(mcpServerPath, "utf-8") : null });
+    fs_1.default.writeFileSync(mcpServerPath, mcpServerContent);
+    let addedImportTo = [];
+    const modifiedEntries = [];
+    for (const entryFile of state.entryFiles) {
+        const entryContent = fs_1.default.readFileSync(entryFile, "utf-8");
+        if (entryContent.includes("mcp-server")) {
+            addedImportTo.push(path_1.default.relative(state.root, entryFile));
+            continue;
         }
+        backups.push({ path: entryFile, content: entryContent });
+        const entryDir = path_1.default.dirname(entryFile);
+        const importPath = `./${path_1.default.relative(entryDir, mcpServerPath).replace(/\.(ts|js)$/, "")}`;
+        const isEntryESM = checkIsESM(entryFile, state.root);
+        const importStatement = isEntryESM
+            ? `import '${importPath}';`
+            : `require('${importPath}');`;
+        const entryLines = entryContent.split("\n");
+        let lastImportIndex = -1;
+        for (let i = 0; i < entryLines.length; i++) {
+            if (/^import\s/.test(entryLines[i]) || /^const\s.*=\s*require/.test(entryLines[i]) || /^require\s*\(/.test(entryLines[i])) {
+                lastImportIndex = i;
+            }
+        }
+        const comment = `// MCP server - exposes your API to AI assistants`;
+        if (lastImportIndex >= 0) {
+            entryLines.splice(lastImportIndex + 1, 0, comment, importStatement);
+        }
+        else {
+            entryLines.unshift(comment, importStatement, "");
+        }
+        const newEntryContent = entryLines.join("\n");
+        fs_1.default.writeFileSync(entryFile, newEntryContent);
+        modifiedEntries.push({ path: entryFile, newContent: newEntryContent });
+        addedImportTo.push(path_1.default.relative(state.root, entryFile));
     }
-    const commentLine = `// MCP server - exposes your API to AI assistants (Claude, ChatGPT, Cursor)`;
-    if (listenIndex >= 0) {
-        lines.splice(listenIndex, 0, "", commentLine, setupCode);
-    }
-    else {
-        lines.push("", commentLine, setupCode);
+    const validationErrors = validateGeneratedFiles(mcpServerPath, modifiedEntries.map((e) => e.path));
+    if (validationErrors.length > 0) {
+        console.log(`\n  ${c("yellow", "!")} Validation failed. Reverting changes...`);
+        for (const err of validationErrors) {
+            console.log(`    ${c("dim", "-")} ${err}`);
+        }
+        for (const backup of backups) {
+            if (backup.content === null) {
+                try {
+                    fs_1.default.unlinkSync(backup.path);
+                }
+                catch { }
+            }
+            else {
+                fs_1.default.writeFileSync(backup.path, backup.content);
+            }
+        }
+        console.log(`  ${c("green", "+")} Changes reverted. Your files are unchanged.`);
+        console.log(`  ${c("dim", "  Please report this issue at:")} ${c("cyan", "https://github.com/hellocrossman/mcp-sdk/issues")}`);
+        return;
     }
-    fs_1.default.writeFileSync(state.entryFile, lines.join("\n"));
-    const relPath = path_1.default.relative(state.root, state.entryFile);
     const enabledCount = state.tools.filter((t) => t.enabled).length;
     console.log();
     console.log(c("green", `   +------------------------------+`));
@@ -586,13 +1229,22 @@ async function stepGenerate(state) {
     console.log(c("green", `   |                              |`));
     console.log(c("green", `   +------------------------------+`));
     console.log();
-    console.log(`   ${c("green", "\u2713")} Updated ${c("bold", relPath)}`);
+    console.log(`   ${c("green", "\u2713")} Created ${c("bold", mcpServerRel)}`);
+    if (hasCustomTools) {
+        console.log(`   ${c("green", "\u2713")} Created ${c("bold", path_1.default.relative(state.root, customToolsPath))}`);
+    }
+    for (const entry of addedImportTo) {
+        console.log(`   ${c("green", "\u2713")} Updated ${c("bold", entry)}`);
+    }
     console.log();
     console.log(`   ${c("dim", "Configuration")}`);
     console.log(`   ${c("dim", "\u2502")} Tools enabled     ${c("bold", String(enabledCount))}`);
+    console.log(`   ${c("dim", "\u2502")} Custom tools      ${state.customTools.length > 0 ? c("green", `${state.customTools.length} defined`) : c("dim", "none")}`);
     console.log(`   ${c("dim", "\u2502")} Database          ${state.databaseEnabled ? c("green", "enabled") : c("dim", "disabled")}`);
     console.log(`   ${c("dim", "\u2502")} AI enrichment     ${state.enrichmentEnabled ? c("green", "enabled") : c("dim", "disabled")}`);
     console.log(`   ${c("dim", "\u2502")} Write operations  ${state.includeWrites ? c("green", "enabled") : c("dim", "disabled")}`);
+    const authLabel = state.authProvider === "none" ? c("dim", "disabled") : c("green", AUTH_PROVIDERS.find((p) => p.id === state.authProvider)?.label || state.authProvider);
+    console.log(`   ${c("dim", "\u2502")} Authentication    ${authLabel}`);
     console.log();
     console.log(`   ${c("bold", "What's next?")}`);
     console.log();
@@ -661,16 +1313,20 @@ async function runWizard(specifiedFile, force) {
     const prompt = createPrompt();
     const state = {
         root: findProjectRoot(),
-        entryFile: "",
+        appFile: "",
         appVarName: "app",
+        appExportName: "app",
+        entryFiles: [],
         isESM: false,
         routePrefix: "/api",
         routes: [],
         dbTables: [],
         tools: [],
+        customTools: [],
         databaseEnabled: true,
         enrichmentEnabled: true,
         includeWrites: false,
+        authProvider: "none",
     };
     try {
         const found = await stepDetectApp(state, prompt, specifiedFile, force);
@@ -681,6 +1337,8 @@ async function runWizard(specifiedFile, force) {
         await stepScanRoutes(state);
         await stepScanDatabase(state, prompt);
         await stepEnrichAndReview(state, prompt);
+        await stepCustomTools(state, prompt);
+        await stepAuth(state, prompt);
         await stepGenerate(state);
     }
     catch (err) {