@koda-sl/baker-cli 0.111.0 → 0.112.1

package/README.md

@@ -2487,6 +2487,24 @@ Permissions enforced server-side:
 
 ---
 
+### `baker mcp list | add | remove`
+
+Manage **custom MCP servers** — point the agent at any remote HTTPS MCP endpoint. Registered tools appear as `mcp__<name>__*` on the next chat message.
+
+```bash
+baker mcp list
+baker mcp add --name weather --url https://mcp.example.com/mcp
+baker mcp add --name acme --url https://acme.dev/mcp --header "Authorization: Bearer sk-…"
+baker mcp add --name mine --url https://my.dev/mcp --scope user
+baker mcp remove --name weather
+```
+
+- `--url` must be HTTPS and public; loopback / private / cloud-metadata hosts are rejected.
+- `--scope company` (default) shares with every chat in the company; `--scope org` needs an admin API key; `--scope user` binds to the current message sender (requires running inside a chat turn — the bridge supplies the sender via `BAKER_ACTING_USER_ID`).
+- Repeat `--header "Key: Value"` for multiple auth headers. Header values are stored server-side and ride the MCP transport — `list` returns only the header keys, never the values.
+
+---
+
 ### `baker schema [command]`
 
 Inspect command argument schemas for AI agent introspection.
@@ -3822,6 +3840,8 @@ The two scaffold passes are billed (the full `video_deconstruct` is the heavy on
 
 #### `baker canvas scaffold-static-ad <image> [flags]`
 
+`<image>` is a **local path or an `http(s)` URL** (e.g. a presigned S3 link from ad-dna). A URL is passed straight into the `original` ingest node as `source: "url"` — do not `curl` it to a file first. Note a presigned URL embedded in the emitted canvas will **expire** (the `original` node is composition-only, so a later re-run just skips it); pass a stable URL or a local file if you need the canvas to stay runnable. For the URL case, `--out` defaults to the current directory — pass `--out` to scaffold two URL sources into distinct files, or the second run overwrites the first.
+
 Turn a source/inspiration image into a **runnable, self-validated static-ad canvas** — the static counterpart of `scaffold-video`. Like the video scaffold, this runs **billed Gemini passes** up front:
 
 1. **`image_describe`** (`~google/gemini-pro-latest`) — reverse-engineers the image into a blueprint JSON, written next to the canvas as **`prompt.json`**. This is the editable "prompt": you rewrite it by hand into the ad you want (palette, copy, claims, subjects). It feeds the generator directly — there is **no automatic brand-transform step**. The blueprint also names the **`winning_mechanisms`** — the special sauce that makes the ad a candidate winner, each tagged `kind` (verbal: rhyme/pun/rhythm; visual: unexpected crop, visual gag, juxtaposition, pattern interrupt, before/after; structural: hook order/reveal) with a `device` and `why_it_works` — so your rewrite rebuilds the mechanism that makes the ad win instead of adapting only the surface and losing it.
@@ -3841,7 +3861,7 @@ baker canvas run ./static-ad.canvas.json
 | Flag | Default | Effect |
 |---|---|---|
 | `--context <text>` | — | Known provenance (advertiser, category, market) to ground the describe. |
-| `--out <path>` | `<image-dir>/static-ad.canvas.json` | Where to write the canvas (`prompt.json` is written alongside). |
+| `--out <path>` | `<image-dir>/static-ad.canvas.json` (cwd when `<image>` is a URL) | Where to write the canvas (`prompt.json` is written alongside). |
 | `--describe-model <id>` | registry default (`~google/gemini-pro-latest`) | Override the `image_describe` model. |
 | `--select-model <id>` | registry default (`~google/gemini-flash-latest`) | Override the element-selection `text_generate` model. |
 | `--layout-model <id>` | registry default (`~google/gemini-flash-latest`) | Override the global-layout `text_generate` model. |