@koda-sl/baker-cli 0.484.0 → 0.486.0

package/dist/{fonts-I434ILTG.js → fonts-DIVC6DP2.js}

@@ -5,9 +5,9 @@ import {
   fontsCommand,
   fontsFetchCommand,
   lookupGoogleCss
-} from "./chunk-CS5JF52J.js";
-import "./chunk-K2JTERIO.js";
-import "./chunk-IX2QLW6G.js";
+} from "./chunk-HDTR5DNA.js";
+import "./chunk-RSYOUKIQ.js";
+import "./chunk-OEYVPXQZ.js";
 import "./chunk-JYALBYN7.js";
 import "./chunk-5WMTPYKT.js";
 import "./chunk-23H4ZJRP.js";
@@ -33,4 +33,4 @@ export {
   fontsFetchCommand,
   lookupGoogleCss
 };
-//# sourceMappingURL=fonts-I434ILTG.js.map
+//# sourceMappingURL=fonts-DIVC6DP2.js.map

package/dist/{get-MGDY5JYZ.js → get-ZI6RB6K5.js}

@@ -3,8 +3,8 @@ import {
   failValidation,
   isTempScheduledAgentId,
   validateScheduledAgentRef
-} from "./chunk-ADSNY4KZ.js";
-import "./chunk-CM6FCSWN.js";
+} from "./chunk-DVA4DOBH.js";
+import "./chunk-LCMIAWUZ.js";
 import {
   CHAT_READ_ARG
 } from "./chunk-PFBQERWX.js";
@@ -76,4 +76,4 @@ var getCommand = defineCommand({
 export {
   getCommand
 };
-//# sourceMappingURL=get-MGDY5JYZ.js.map
+//# sourceMappingURL=get-ZI6RB6K5.js.map

package/dist/{landing-EJGYTI5W.js → landing-6OJYUEWP.js}

@@ -17,7 +17,7 @@ Subcommands:
   },
   subCommands: {
     inspiration: () => import("./inspiration-XQYHBJY2.js").then((m) => m.inspirationCommand),
-    critique: () => import("./critique-N5OL42C6.js").then((m) => m.critiqueCommand),
+    critique: () => import("./critique-2UMC3GJP.js").then((m) => m.critiqueCommand),
     variant: () => import("./variant-5TRRSYBB.js").then((m) => m.variantCommand),
     export: () => import("./export-OLDI32HM.js").then((m) => m.exportCommand)
   }
@@ -25,4 +25,4 @@ Subcommands:
 export {
   landingCommand
 };
-//# sourceMappingURL=landing-EJGYTI5W.js.map
+//# sourceMappingURL=landing-6OJYUEWP.js.map

package/dist/{list-SZH6TH74.js → list-VY4UTTRG.js}

@@ -1,7 +1,7 @@
 import {
   failApi
-} from "./chunk-ADSNY4KZ.js";
-import "./chunk-CM6FCSWN.js";
+} from "./chunk-DVA4DOBH.js";
+import "./chunk-LCMIAWUZ.js";
 import {
   CHAT_READ_ARG
 } from "./chunk-PFBQERWX.js";
@@ -61,4 +61,4 @@ var listCommand = defineCommand({
 export {
   listCommand
 };
-//# sourceMappingURL=list-SZH6TH74.js.map
+//# sourceMappingURL=list-VY4UTTRG.js.map

package/dist/{make-ZYEFMAR6.js → make-2XZBKFJC.js}

@@ -1,6 +1,6 @@
 import {
   scaffoldDelivery
-} from "./chunk-Z5SOZUUB.js";
+} from "./chunk-F4WLKHUS.js";
 import {
   buildSearchBody
 } from "./chunk-MXWOYFI2.js";
@@ -17,13 +17,13 @@ import {
 import {
   makeSeriesAd,
   seriesMadeEnvelope
-} from "./chunk-27DJRM3F.js";
+} from "./chunk-GPY2JEXL.js";
 import "./chunk-XZ4YMCZK.js";
 import {
   runBaker
-} from "./chunk-MGIOV72F.js";
+} from "./chunk-GIECLBJ3.js";
 import "./chunk-UWXDNVS5.js";
-import "./chunk-Q4WWS3UQ.js";
+import "./chunk-7SHNGCJ2.js";
 import {
   parseDefinitionDelivery,
   parseDefinitionSourceFields,
@@ -35,7 +35,7 @@ import {
   reroutedOnSpec,
   thinkingOutline,
   withThinking
-} from "./chunk-AXDKLXCG.js";
+} from "./chunk-CTJPTSD4.js";
 import "./chunk-ABXTGAG7.js";
 import {
   audienceQuery,
@@ -89,8 +89,8 @@ import {
   checkIdeas,
   sourcesClaims
 } from "./chunk-G2LGMWNG.js";
-import "./chunk-K2JTERIO.js";
-import "./chunk-IX2QLW6G.js";
+import "./chunk-RSYOUKIQ.js";
+import "./chunk-OEYVPXQZ.js";
 import "./chunk-JYALBYN7.js";
 import "./chunk-BITS62MF.js";
 import "./chunk-FNA277HP.js";
@@ -1350,4 +1350,4 @@ export {
   startsFromIdea,
   unbuiltReference
 };
-//# sourceMappingURL=make-ZYEFMAR6.js.map
+//# sourceMappingURL=make-2XZBKFJC.js.map

package/dist/{mcp-T6SAG4XB.js → mcp-MTFBVKLX.js}

@@ -47,7 +47,7 @@ var mcpCatalogResponseSchema = z.object({
 });
 
 // src/commands/mcp/index.ts
-import { defineCommand } from "citty";
+import { defineCommand as defineCommand2 } from "citty";
 
 // src/commands/mcp/catalog.ts
 var PREFER_VENDOR_HINT = 'The vendor\'s own MCP server comes before any app here. If you have not yet, WebSearch "<vendor> MCP server" and WebFetch its official docs for the remote https address and how it signs in, then ask for it with request_connection `{ server: { name, url, auth, keyHeader } }`. Only when the vendor has none, ask for an app from this catalog with request_connection `{ app: "<slug>", reason }` \u2014 the user connects it in the chat and its tools load right after, in this same turn.';
@@ -71,6 +71,250 @@ function catalogHints(apps, { platforms = [] } = {}) {
   return hints;
 }
 
+// ../api/src/mcp-tools.ts
+import { z as z2 } from "zod";
+var MCP_TOOLS_DEFAULT_LIMIT = 10;
+var MCP_TOOL_DESCRIPTION_MAX = 200;
+var mcpToolSlugSchema = z2.string().trim().min(1, "Provide --tool").max(120).regex(/^[A-Za-z0-9_]+$/, "A tool is named like GMAIL_FETCH_EMAILS \u2014 find one with `baker mcp tools --search`").transform((slug) => slug.toUpperCase());
+var mcpAppSlugSchema = z2.string().trim().min(1).max(60).regex(/^[a-z0-9_-]+$/i, "Name the app as `baker mcp connected` lists it, e.g. gmail").transform((slug) => slug.toLowerCase());
+var mcpToolsRequestSchema = z2.object({
+  search: z2.string().trim().min(1).max(200).optional(),
+  app: mcpAppSlugSchema.optional(),
+  limit: z2.coerce.number().int().min(1).max(50).default(MCP_TOOLS_DEFAULT_LIMIT)
+}).refine((request) => request.search !== void 0 || request.app !== void 0, {
+  message: "Provide --search, --app, or both"
+});
+var mcpToolSummarySchema = z2.object({
+  tool: z2.string(),
+  app: z2.string(),
+  name: z2.string(),
+  description: z2.string().max(MCP_TOOL_DESCRIPTION_MAX),
+  /** Only read-only tools run through `baker mcp execute`. */
+  readOnly: z2.boolean()
+});
+var mcpToolsResponseSchema = z2.object({
+  tools: z2.array(mcpToolSummarySchema),
+  /** The connected apps the search ran over. */
+  apps: z2.array(z2.string())
+});
+var mcpToolRequestSchema = z2.object({
+  tool: mcpToolSlugSchema,
+  full: z2.boolean().default(false)
+});
+var mcpToolInputSchema = z2.object({
+  name: z2.string(),
+  type: z2.string(),
+  required: z2.boolean(),
+  description: z2.string().optional(),
+  enum: z2.array(z2.unknown()).optional(),
+  default: z2.unknown().optional()
+});
+var mcpToolResponseSchema = z2.object({
+  tool: z2.string(),
+  app: z2.string(),
+  name: z2.string(),
+  description: z2.string(),
+  readOnly: z2.boolean(),
+  inputs: z2.array(mcpToolInputSchema),
+  /** The raw JSON schemas, with `--full` only. */
+  inputSchema: z2.unknown().optional(),
+  outputSchema: z2.unknown().optional()
+});
+var mcpExecuteRequestSchema = z2.object({
+  tool: mcpToolSlugSchema,
+  arguments: z2.record(z2.string(), z2.unknown()).default({}),
+  actingUserId: z2.string().optional()
+});
+var mcpExecuteResponseSchema = z2.object({
+  tool: z2.string(),
+  app: z2.string(),
+  /** Whose connection answered: `company` is the one a published Report reads. */
+  scope: z2.enum(["user", "user_org", "company", "org"]),
+  account: z2.string().nullable(),
+  /** What the tool returned, as the app returned it. */
+  data: z2.unknown()
+});
+
+// src/commands/mcp/execute.ts
+import { defineCommand } from "citty";
+var EXECUTE_TIMEOUT_MS = 12e4;
+function fail(err) {
+  if (err instanceof ApiError) {
+    writeJson({ ok: false, error: { code: err.code, message: err.message } });
+    process.exit(1);
+  }
+  writeJson({ ok: false, error: { code: "NETWORK_ERROR", message: "Unexpected error" } });
+  process.exit(1);
+}
+function invalid(message) {
+  return fail(new ApiError("VALIDATION_ERROR", message));
+}
+function actingUserId() {
+  return getEnv().BAKER_ACTING_USER_ID;
+}
+function executeHints(ran) {
+  const hints = [];
+  if (ran.scope !== "company") {
+    hints.push(
+      `This answer came from a ${ran.scope === "org" ? "connection shared by the organization" : "connection of the person sending this message"}. A published report reads only apps connected for the whole company, so ${ran.tool} will answer "not connected" there: ask the user to connect ${ran.app} for the whole company before building a report on it.`
+    );
+  }
+  hints.push(
+    `In a report endpoint: runReportBaker(event, ["mcp", "execute", "--tool", "${ran.tool}", "--data", JSON.stringify(args)]) \u2014 return only the fields the page shows.`
+  );
+  return hints;
+}
+var toolsArgs = {
+  search: {
+    type: "string",
+    description: 'What the tool should do, e.g. "fetch emails", "read sheet rows"',
+    required: false
+  },
+  app: {
+    type: "string",
+    description: "Only this connected app, as `baker mcp connected` lists it (gmail)",
+    required: false
+  },
+  limit: { type: "string", description: "Max tools to return, 1-50 (default 10)", required: false }
+};
+registerSchema({
+  command: "mcp.tools",
+  description: 'Find a connected app\'s tools to run with `baker mcp execute`. Searches the apps this chat reaches (or --app). Each tool: tool (slug), app, name, description, readOnly (only read-only tools run). Example: baker mcp tools --app googlesheets --search "read rows"',
+  args: toolsArgs
+});
+var toolsCommand = defineCommand({
+  meta: {
+    name: "tools",
+    description: `Find a connected app's tools to run from the command line with \`baker mcp execute\`.
+
+Start here:
+  baker mcp tools --search "fetch unread emails"          # across every connected app
+  baker mcp tools --app googlesheets --search "read rows"
+  baker mcp tools --app hubspot --limit 20                # an app's tools, no search
+
+Each tool: tool (the slug execute takes), app, name, description, readOnly.
+Only readOnly tools run through execute; a tool that changes things is the chat's own mcp__composio_* tool.`
+  },
+  args: toolsArgs,
+  run: async ({ args }) => {
+    const parsed = mcpToolsRequestSchema.safeParse({ search: args.search, app: args.app, limit: args.limit });
+    if (!parsed.success) {
+      invalid(parsed.error.issues[0]?.message ?? "Invalid arguments");
+    }
+    try {
+      const user = actingUserId();
+      const data = await apiGet("/api/mcp/tools", {
+        ...parsed.data.search ? { search: parsed.data.search } : {},
+        ...parsed.data.app ? { app: parsed.data.app } : {},
+        limit: String(parsed.data.limit),
+        ...user ? { actingUserId: user } : {}
+      });
+      const hints = data.apps.length === 0 ? [
+        "No app is connected here. Check `baker mcp connected`; connect one with request_connection, from the chat."
+      ] : [
+        "Run one with `baker mcp execute --tool <TOOL> --get-schema` first to see its inputs, then `--data '<json>'`.",
+        ...data.tools.some((tool) => !tool.readOnly) ? [
+          "readOnly: false tools cannot run through execute \u2014 they change things; use the chat's mcp__composio_* tool."
+        ] : []
+      ];
+      writeJson({ ok: true, data, hints });
+    } catch (err) {
+      fail(err);
+    }
+  }
+});
+var executeArgs = {
+  tool: { type: "string", description: "Tool slug from `baker mcp tools`, e.g. GMAIL_FETCH_EMAILS", required: true },
+  data: {
+    type: "string",
+    description: `The tool's arguments as a JSON object, e.g. '{"max_results":10}'`,
+    required: false
+  },
+  "get-schema": { type: "boolean", description: "Show the tool's inputs instead of running it", required: false },
+  full: {
+    type: "boolean",
+    description: "With --get-schema: the raw input and output JSON schemas too",
+    required: false
+  }
+};
+registerSchema({
+  command: "mcp.execute",
+  description: `Run one read-only tool of a connected app and print what it returned as JSON \u2014 for a report's data endpoint, a script, or keeping the answer. \`--get-schema\` shows its inputs first. A published report reaches only apps connected for the whole company. Example: baker mcp execute --tool GOOGLESHEETS_BATCH_GET --data '{"spreadsheet_id":"\u2026","ranges":["A1:D50"]}'`,
+  args: executeArgs
+});
+function parseData(raw) {
+  if (raw === void 0 || raw === "") {
+    return {};
+  }
+  let value;
+  try {
+    value = JSON.parse(String(raw));
+  } catch {
+    invalid(`--data must be a JSON object, e.g. '{"max_results":10}' (keys and strings in double quotes).`);
+  }
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    invalid(`--data must be a JSON object, e.g. '{"max_results":10}'.`);
+  }
+  return value;
+}
+var executeCommand = defineCommand({
+  meta: {
+    name: "execute",
+    description: `Run one read-only tool of a connected app; prints what it returned as JSON.
+
+The same tools as the chat's mcp__composio_* servers, answered on stdout so a report's data endpoint,
+a script or a file can keep it. Find the tool with \`baker mcp tools\`, read its inputs, then run it:
+  baker mcp execute --tool GOOGLESHEETS_BATCH_GET --get-schema
+  baker mcp execute --tool GOOGLESHEETS_BATCH_GET --data '{"spreadsheet_id":"1AbC\u2026","ranges":["Sheet1!A1:D50"]}'
+  baker mcp execute --tool GMAIL_FETCH_EMAILS --data '{"query":"is:unread newer_than:7d","max_results":20}' > /tmp/inbox.json
+
+Reads only: a tool that changes things (send, create, update) is refused \u2014 use the chat's own tool for it.
+A published report runs as nobody, so it reaches only apps connected for the whole company; a
+person's own connection answers in their chat and nowhere else.`
+  },
+  args: executeArgs,
+  run: async ({ args }) => {
+    if (args["get-schema"]) {
+      const parsed2 = mcpToolRequestSchema.safeParse({ tool: args.tool, full: args.full === true });
+      if (!parsed2.success) {
+        invalid(parsed2.error.issues[0]?.message ?? "Invalid arguments");
+      }
+      try {
+        const data = await apiGet("/api/mcp/tool", {
+          tool: parsed2.data.tool,
+          ...parsed2.data.full ? { full: "true" } : {}
+        });
+        writeJson({
+          ok: true,
+          data,
+          hints: data.readOnly ? [`Run it: baker mcp execute --tool ${data.tool} --data '<json object of the inputs above>'`] : [
+            `${data.tool} changes things, so execute refuses it. In a chat, use the app's own mcp__composio_* tool.`
+          ]
+        });
+      } catch (err) {
+        fail(err);
+      }
+      return;
+    }
+    const parsed = mcpExecuteRequestSchema.safeParse({
+      tool: args.tool,
+      arguments: parseData(args.data),
+      actingUserId: actingUserId()
+    });
+    if (!parsed.success) {
+      invalid(parsed.error.issues[0]?.message ?? "Invalid arguments");
+    }
+    try {
+      const data = await apiPost("/api/mcp/execute", parsed.data, {
+        timeoutMs: EXECUTE_TIMEOUT_MS
+      });
+      writeJson({ ok: true, data, hints: executeHints(data) });
+    } catch (err) {
+      fail(err);
+    }
+  }
+});
+
 // src/commands/mcp/platforms.ts
 function readsKey(label) {
   const [first = "", ...rest] = label.split(" ");
@@ -93,7 +337,7 @@ function parseScope(raw) {
   }
   return scope;
 }
-function actingUserId() {
+function actingUserId2() {
   return getEnv().BAKER_ACTING_USER_ID;
 }
 function customEntry(server) {
@@ -124,7 +368,7 @@ function parseHeaders(raw, rawArgs) {
   }
   return Object.keys(headers).length > 0 ? headers : void 0;
 }
-function fail(err) {
+function fail2(err) {
   if (err instanceof ApiError) {
     writeJson({ ok: false, error: { code: err.code, message: err.message } });
     process.exit(1);
@@ -138,7 +382,7 @@ registerSchema({
   description: "List everything this chat can reach: managed integrations (Attio, Slack, Gmail, Google Sheets, \u2026), custom MCP servers, and the platforms the company signed in to (HubSpot, Google Ads, GA4, Search Console, Tag Manager) which you read through their own `baker` commands. Start here when the user mentions an external tool or platform.",
   args: {}
 });
-var connectedCommand = defineCommand({
+var connectedCommand = defineCommand2({
   meta: {
     name: "connected",
     description: `Everything this chat can reach \u2014 managed integrations, custom MCP servers, and connected platforms.
@@ -150,7 +394,7 @@ A tool or platform the user names that is NOT listed anywhere here is simply not
   },
   run: async () => {
     try {
-      const user = actingUserId();
+      const user = actingUserId2();
       const data = await apiGet("/api/mcp/connected", user ? { actingUserId: user } : void 0);
       const managed = data.managed.map((c) => ({
         toolkit: c.toolkitSlug,
@@ -185,7 +429,7 @@ A tool or platform the user names that is NOT listed anywhere here is simply not
         hints
       });
     } catch (err) {
-      fail(err);
+      fail2(err);
     }
   }
 });
@@ -198,7 +442,7 @@ registerSchema({
   description: "Search the managed apps you can ask the user to connect when a vendor has no MCP server of its own. Each app says how the user connects it (sign-in | key) and whether this chat already reaches it. Example: baker mcp catalog --search notion",
   args: catalogArgs
 });
-var catalogCommand = defineCommand({
+var catalogCommand = defineCommand2({
   meta: {
     name: "catalog",
     description: `Managed apps you can ask the user to connect when a vendor has no MCP server of its own.
@@ -221,7 +465,7 @@ Prefer the vendor's own MCP server when it publishes one; a catalog app is the f
       process.exit(1);
     }
     try {
-      const user = actingUserId();
+      const user = actingUserId2();
       const data = await apiGet("/api/mcp/catalog", {
         search: parsed.data.search,
         limit: String(parsed.data.limit),
@@ -236,7 +480,7 @@ Prefer the vendor's own MCP server when it publishes one; a catalog app is the f
         hints: catalogHints(data.apps, { platforms: data.platforms ?? [] })
       });
     } catch (err) {
-      fail(err);
+      fail2(err);
     }
   }
 });
@@ -245,11 +489,11 @@ registerSchema({
   description: "List the custom MCP servers this company's chats see (org + company + your own user scope).",
   args: {}
 });
-var listCommand = defineCommand({
+var listCommand = defineCommand2({
   meta: { name: "list", description: "List custom MCP servers visible to this company's chats." },
   run: async () => {
     try {
-      const user = actingUserId();
+      const user = actingUserId2();
       const data = await apiGet(
         "/api/mcp/custom",
         user ? { actingUserId: user } : void 0
@@ -264,7 +508,7 @@ var listCommand = defineCommand({
         } : {}
       });
     } catch (err) {
-      fail(err);
+      fail2(err);
     }
   }
 });
@@ -282,7 +526,7 @@ registerSchema({
     header: { type: "string", description: 'Auth header "Key: Value" (repeatable)', required: false }
   }
 });
-var addCommand = defineCommand({
+var addCommand = defineCommand2({
   meta: {
     name: "add",
     description: `Register a custom MCP server. Tools appear as mcp__<name>__* on the NEXT message.
@@ -309,7 +553,7 @@ Examples:
   run: async ({ args, rawArgs }) => {
     try {
       const scope = parseScope(args.scope);
-      const user = actingUserId();
+      const user = actingUserId2();
       const headers = parseHeaders(args.header, rawArgs);
       const data = await apiPost("/api/mcp/custom", {
         name: args.name,
@@ -327,7 +571,7 @@ Examples:
         ]
       });
     } catch (err) {
-      fail(err);
+      fail2(err);
     }
   }
 });
@@ -336,7 +580,7 @@ registerSchema({
   description: "Remove a company custom MCP server by name.",
   args: { name: { type: "string", description: "Server name to remove", required: true } }
 });
-var removeCommand = defineCommand({
+var removeCommand = defineCommand2({
   meta: {
     name: "remove",
     description: `Remove a company custom MCP server by name.
@@ -347,14 +591,14 @@ Example:
   args: { name: { type: "string", description: "Server name to remove", required: true } },
   run: async ({ args }) => {
     try {
-      const user = actingUserId();
+      const user = actingUserId2();
       const data = await apiPost("/api/mcp/custom/remove", {
         name: args.name,
         ...user ? { actingUserId: user } : {}
       });
       writeJson({ ok: true, data });
     } catch (err) {
-      fail(err);
+      fail2(err);
     }
   }
 });
@@ -366,7 +610,7 @@ registerSchema({
   description: "Check a custom MCP server now (the dashboard's 'Check now') and store the result. Use after the user fixed its address or sign-in, or when its tools failed this turn.",
   args: serverNameArgs
 });
-var verifyCommand = defineCommand({
+var verifyCommand = defineCommand2({
   meta: {
     name: "verify",
     description: `Check a custom MCP server now and store the result.
@@ -376,9 +620,9 @@ Example:
   },
   args: serverNameArgs,
   run: async ({ args }) => {
-    const parsed = customMcpServerNameRequestSchema.safeParse({ name: args.name, actingUserId: actingUserId() });
+    const parsed = customMcpServerNameRequestSchema.safeParse({ name: args.name, actingUserId: actingUserId2() });
     if (!parsed.success) {
-      fail(new ApiError("VALIDATION_ERROR", parsed.error.issues[0]?.message ?? "Invalid arguments"));
+      fail2(new ApiError("VALIDATION_ERROR", parsed.error.issues[0]?.message ?? "Invalid arguments"));
     }
     try {
       const data = await apiPost("/api/mcp/custom/verify", parsed.data);
@@ -390,7 +634,7 @@ Example:
         ]
       });
     } catch (err) {
-      fail(err);
+      fail2(err);
     }
   }
 });
@@ -399,7 +643,7 @@ registerSchema({
   description: "Switch a custom MCP server off so its tools stop loading; its address and sign-in are kept. Turning it back on is done by a person in the dashboard, never by the agent.",
   args: serverNameArgs
 });
-var disableCommand = defineCommand({
+var disableCommand = defineCommand2({
   meta: {
     name: "disable",
     description: `Switch a custom MCP server off (its tools stop loading). Only a person can turn it back on, in the dashboard.
@@ -409,9 +653,9 @@ Example:
   },
   args: serverNameArgs,
   run: async ({ args }) => {
-    const parsed = customMcpServerNameRequestSchema.safeParse({ name: args.name, actingUserId: actingUserId() });
+    const parsed = customMcpServerNameRequestSchema.safeParse({ name: args.name, actingUserId: actingUserId2() });
     if (!parsed.success) {
-      fail(new ApiError("VALIDATION_ERROR", parsed.error.issues[0]?.message ?? "Invalid arguments"));
+      fail2(new ApiError("VALIDATION_ERROR", parsed.error.issues[0]?.message ?? "Invalid arguments"));
     }
     try {
       const data = await apiPost("/api/mcp/custom/disable", parsed.data);
@@ -423,11 +667,11 @@ Example:
         ]
       });
     } catch (err) {
-      fail(err);
+      fail2(err);
     }
   }
 });
-var mcpCommand = defineCommand({
+var mcpCommand = defineCommand2({
   meta: {
     name: "mcp",
     description: `Third-party tools for this company \u2014 see what's connected, register custom HTTPS MCP endpoints.
@@ -439,6 +683,11 @@ Start here:
   baker mcp connected   # everything this chat can reach: managed integrations, custom servers, connected platforms
   baker mcp catalog --search notion   # managed apps you can connect when a vendor has no MCP server of its own
 
+Run a connected app's read-only tool from the command line (JSON on stdout \u2014 for reports and scripts):
+  baker mcp tools --app googlesheets --search "read rows"
+  baker mcp execute --tool GOOGLESHEETS_BATCH_GET --get-schema
+  baker mcp execute --tool GOOGLESHEETS_BATCH_GET --data '{"spreadsheet_id":"\u2026","ranges":["A1:D50"]}'
+
 Examples:
   baker mcp add --name weather --url https://mcp.example.com/mcp
   baker mcp add --name acme --url https://acme.dev/mcp --header "Authorization: Bearer sk-\u2026"
@@ -450,6 +699,8 @@ Full guide: __tooling__/docs/tools/baker/mcp.md`
   subCommands: {
     connected: connectedCommand,
     catalog: catalogCommand,
+    tools: toolsCommand,
+    execute: executeCommand,
     list: listCommand,
     add: addCommand,
     remove: removeCommand,
@@ -460,4 +711,4 @@ Full guide: __tooling__/docs/tools/baker/mcp.md`
 export {
   mcpCommand
 };
-//# sourceMappingURL=mcp-T6SAG4XB.js.map
+//# sourceMappingURL=mcp-MTFBVKLX.js.map