@kwonye/mcpx 0.1.67 → 0.1.73

package/dist/cli.js

@@ -1,1254 +1,2003 @@
 #!/usr/bin/env node
-/**
- * mcpx CLI - HTTP-first Model Context Protocol gateway
- */
+import {
+  APP_VERSION,
+  STATUS_CLIENTS,
+  SecretsManager,
+  addServer,
+  applyAuthReference,
+  buildStatusReport,
+  checkForUpdates,
+  defaultAuthSecretName,
+  getAdapters,
+  getConfigPath,
+  getDaemonStatus,
+  getManagedIndexPath,
+  getStagedCliPath,
+  getStagedUpdate,
+  listAuthBindings,
+  loadConfig,
+  loadManagedIndex,
+  maybePrefixBearer,
+  performRollback,
+  performUpdate,
+  probeHttpAuthRequirement,
+  readDaemonLogs,
+  readSecretValueFromStdin,
+  removeAuthReference,
+  removeServer,
+  resolveAuthTarget,
+  restartDaemon,
+  runBackgroundUpdate,
+  runDaemonForeground,
+  saveConfig,
+  secretRefName,
+  setServerEnabled,
+  startDaemon,
+  stopDaemon,
+  syncAllClients,
+  toSecretRef
+} from "./cli-7rggq938.js";
+import {
+  isServerEnabled
+} from "./cli-q8de7zb0.js";
+
+// src/cli.ts
 import { Command } from "commander";
 import fs from "node:fs";
 import { execFileSync } from "node:child_process";
 import { pathToFileURL } from "node:url";
 import { emitKeypressEvents } from "node:readline";
 import { createInterface } from "node:readline/promises";
-import { loadConfig, saveConfig } from "./core/config.js";
-import { addServer, removeServer, setServerEnabled } from "./core/registry.js";
-import { SecretsManager, readSecretValueFromStdin } from "./core/secrets.js";
-import { probeHttpAuthRequirement } from "./core/auth-probe.js";
-import { syncAllClients } from "./core/sync.js";
-import { isServerEnabled } from "./types.js";
-import { parseCompatibilityArgs } from "./compat/index.js";
-import { applyAuthReference, defaultAuthSecretName, listAuthBindings, maybePrefixBearer, removeAuthReference, resolveAuthTarget, secretRefName, toSecretRef } from "./core/server-auth.js";
-import { getAdapters } from "./adapters/index.js";
-import { getDaemonStatus, readDaemonLogs, restartDaemon, runDaemonForeground, startDaemon, stopDaemon } from "./core/daemon.js";
-import { getConfigPath, getManagedIndexPath } from "./core/paths.js";
-import { loadManagedIndex } from "./core/managed-index.js";
-import { STATUS_CLIENTS, buildStatusReport } from "./core/status.js";
-import { APP_VERSION } from "./version.js";
-import { getStagedCliPath, getStagedUpdate, checkForUpdates } from "./core/update.js";
-import { performUpdate, performRollback, runBackgroundUpdate } from "./core/update-manager.js";
-const VALID_CLIENTS = STATUS_CLIENTS;
+
+// src/compat/claude.ts
+function parseClaudeFlags(argv) {
+  const headers = [];
+  const envVars = [];
+  let hasScope = false;
+  let hasTransportSSE = false;
+  let hasJsonInput = false;
+  let hasDesktopImport = false;
+  const separatorIndex = argv.indexOf("--");
+  const flagRegion = separatorIndex === -1 ? argv : argv.slice(0, separatorIndex);
+  for (let i = 0;i < flagRegion.length; i++) {
+    const arg = flagRegion[i];
+    if (arg === "--header" || arg === "-H") {
+      const value = flagRegion[i + 1];
+      if (value && !value.startsWith("-")) {
+        headers.push(value);
+        i++;
+      } else {
+        headers.push("");
+      }
+    } else if (arg === "--env" || arg === "-e") {
+      const value = flagRegion[i + 1];
+      if (value && !value.startsWith("-")) {
+        envVars.push(value);
+        i++;
+      } else {
+        envVars.push("");
+      }
+    } else if (arg === "--scope") {
+      hasScope = true;
+    } else if (arg === "--transport") {
+      const value = flagRegion[i + 1];
+      if (value && value.toLowerCase() === "sse") {
+        hasTransportSSE = true;
+      }
+      i++;
+    } else if (arg === "--" || arg.startsWith("-")) {}
+  }
+  hasJsonInput = argv.some((arg) => arg === "--json" || arg.startsWith("{"));
+  hasDesktopImport = argv.some((arg) => arg === "--from-desktop" || arg.includes("claude_desktop_config"));
+  return {
+    headers,
+    envVars,
+    hasScope,
+    hasTransportSSE,
+    hasJsonInput,
+    hasDesktopImport
+  };
+}
+function extractPositionalArgs(argv) {
+  const separatorIndex = argv.indexOf("--");
+  if (separatorIndex === -1) {
+    const positional = [];
+    let skipNext = false;
+    for (let i = 0;i < argv.length; i++) {
+      if (skipNext) {
+        skipNext = false;
+        continue;
+      }
+      const arg = argv[i];
+      if (arg === "--header" || arg === "-H" || arg === "--env" || arg === "-e" || arg === "--transport" || arg === "--scope") {
+        skipNext = true;
+        continue;
+      }
+      if (arg.startsWith("-")) {
+        continue;
+      }
+      positional.push(arg);
+    }
+    return positional;
+  } else {
+    const beforeSeparator = argv.slice(0, separatorIndex);
+    const afterSeparator = argv.slice(separatorIndex + 1);
+    const positional = [];
+    let skipNext = false;
+    for (let i = 0;i < beforeSeparator.length; i++) {
+      if (skipNext) {
+        skipNext = false;
+        continue;
+      }
+      const arg = beforeSeparator[i];
+      if (arg === "--header" || arg === "-H" || arg === "--env" || arg === "-e" || arg === "--transport" || arg === "--scope") {
+        skipNext = true;
+        continue;
+      }
+      if (arg.startsWith("-")) {
+        continue;
+      }
+      positional.push(arg);
+    }
+    return [...positional, "--", ...afterSeparator];
+  }
+}
+function validateClaudeArgs(flags) {
+  if (flags.hasScope) {
+    return "Claude --scope is not supported. Use global `mcpx add` for project-wide servers.";
+  }
+  if (flags.hasTransportSSE) {
+    return "Claude --transport sse is not supported. Use `mcpx add <name> <url>` for HTTP/SSE servers.";
+  }
+  if (flags.hasJsonInput) {
+    return "Claude JSON import is not supported. Use `mcpx add` directly or `mcpx code --add-mcp '<json>'` for VS Code format.";
+  }
+  if (flags.hasDesktopImport) {
+    return "Claude desktop config import is not supported. Use `mcpx add` to add servers individually.";
+  }
+  return null;
+}
+function parseClaudeArgs(argv) {
+  if (argv.length === 0) {
+    return {
+      normalizedArgs: [],
+      error: "Usage: mcpx claude mcp add <name> <url|command> [options...]"
+    };
+  }
+  const flags = parseClaudeFlags(argv);
+  const validationError = validateClaudeArgs(flags);
+  if (validationError) {
+    return {
+      normalizedArgs: [],
+      error: validationError
+    };
+  }
+  const convertedHeaders = flags.headers.map((header) => {
+    const colonIndex = header.indexOf(":");
+    if (colonIndex > 0) {
+      const key = header.slice(0, colonIndex).trim();
+      const value = header.slice(colonIndex + 1).trim();
+      return `${key}=${value}`;
+    }
+    return header;
+  });
+  const positional = extractPositionalArgs(argv);
+  const separatorIndex = positional.indexOf("--");
+  if (separatorIndex === -1) {
+    if (positional.length < 2) {
+      return {
+        normalizedArgs: [],
+        error: "HTTP mode requires: claude mcp add <name> <url>"
+      };
+    }
+    const [name, url, ...rest] = positional;
+    const normalized = [name, url];
+    for (const header of convertedHeaders) {
+      normalized.push("--header", header);
+    }
+    if (rest.length > 0) {
+      normalized.push(...rest);
+    }
+    return { normalizedArgs: normalized };
+  } else {
+    const beforeSeparator = positional.slice(0, separatorIndex);
+    const afterSeparator = positional.slice(separatorIndex + 1);
+    if (beforeSeparator.length < 1) {
+      return {
+        normalizedArgs: [],
+        error: "stdio mode requires: claude mcp add <name> -- <command> [args...]"
+      };
+    }
+    if (afterSeparator.length === 0) {
+      return {
+        normalizedArgs: [],
+        error: "stdio mode requires a command after `--`: claude mcp add <name> -- <command> [args...]"
+      };
+    }
+    const name = beforeSeparator[0];
+    const normalized = [name];
+    if (afterSeparator.length > 0) {
+      normalized.push(afterSeparator[0]);
+      if (afterSeparator.length > 1) {
+        normalized.push(...afterSeparator.slice(1));
+      }
+    }
+    for (const envVar of flags.envVars) {
+      normalized.push("--env", envVar);
+    }
+    for (const header of convertedHeaders) {
+      normalized.push("--header", header);
+    }
+    return { normalizedArgs: normalized };
+  }
+}
+
+// src/compat/codex.ts
+function parseCodexFlags(argv) {
+  const envVars = [];
+  let hasUrlFlag = false;
+  let hasHttpSemantics = false;
+  const separatorIndex = argv.indexOf("--");
+  const flagRegion = separatorIndex === -1 ? argv : argv.slice(0, separatorIndex);
+  for (let i = 0;i < flagRegion.length; i++) {
+    const arg = flagRegion[i];
+    if (arg === "--env" || arg === "-e") {
+      const value = flagRegion[i + 1];
+      if (value && !value.startsWith("-")) {
+        envVars.push(value);
+        i++;
+      } else {
+        envVars.push("");
+      }
+    } else if (arg === "--url") {
+      hasUrlFlag = true;
+      hasHttpSemantics = true;
+    } else if (arg === "--http") {
+      hasHttpSemantics = true;
+    } else if (arg.startsWith("-") && arg !== "--") {}
+  }
+  return {
+    envVars,
+    hasUrlFlag,
+    hasHttpSemantics
+  };
+}
+function extractCodexPositionalArgs(argv) {
+  const separatorIndex = argv.indexOf("--");
+  if (separatorIndex === -1) {
+    const positional = [];
+    let skipNext = false;
+    for (let i = 0;i < argv.length; i++) {
+      if (skipNext) {
+        skipNext = false;
+        continue;
+      }
+      const arg = argv[i];
+      if (arg === "--env" || arg === "-e" || arg === "--url" || arg === "--http") {
+        skipNext = true;
+        continue;
+      }
+      if (arg.startsWith("-")) {
+        continue;
+      }
+      positional.push(arg);
+    }
+    return positional;
+  } else {
+    const beforeSeparator = argv.slice(0, separatorIndex);
+    const afterSeparator = argv.slice(separatorIndex + 1);
+    const positional = [];
+    let skipNext = false;
+    for (let i = 0;i < beforeSeparator.length; i++) {
+      if (skipNext) {
+        skipNext = false;
+        continue;
+      }
+      const arg = beforeSeparator[i];
+      if (arg === "--env" || arg === "-e" || arg === "--url" || arg === "--http") {
+        skipNext = true;
+        continue;
+      }
+      if (arg.startsWith("-")) {
+        continue;
+      }
+      positional.push(arg);
+    }
+    return [...positional, "--", ...afterSeparator];
+  }
+}
+function validateCodexArgs(flags, hasSeparator) {
+  if (flags.hasHttpSemantics) {
+    return "Codex HTTP semantics are not supported. Use `mcpx add <name> <url>` for HTTP MCP servers.";
+  }
+  if (!hasSeparator) {
+    return "Codex stdio mode requires `--` separator: codex mcp add <name> [--env KEY=VALUE] -- <command> [args...]";
+  }
+  return null;
+}
+function parseCodexArgs(argv) {
+  if (argv.length === 0) {
+    return {
+      normalizedArgs: [],
+      error: "Usage: mcpx codex mcp add <name> [--env KEY=VALUE ...] -- <command> [args...]"
+    };
+  }
+  const flags = parseCodexFlags(argv);
+  const hasSeparator = argv.includes("--");
+  const validationError = validateCodexArgs(flags, hasSeparator);
+  if (validationError) {
+    return {
+      normalizedArgs: [],
+      error: validationError
+    };
+  }
+  const positional = extractCodexPositionalArgs(argv);
+  const separatorIndex = positional.indexOf("--");
+  const beforeSeparator = positional.slice(0, separatorIndex);
+  const afterSeparator = positional.slice(separatorIndex + 1);
+  if (beforeSeparator.length < 1) {
+    return {
+      normalizedArgs: [],
+      error: "stdio mode requires: codex mcp add <name> -- <command> [args...]"
+    };
+  }
+  if (afterSeparator.length === 0) {
+    return {
+      normalizedArgs: [],
+      error: "stdio mode requires a command after `--`: codex mcp add <name> -- <command> [args...]"
+    };
+  }
+  const name = beforeSeparator[0];
+  const normalized = [name];
+  if (afterSeparator.length > 0) {
+    normalized.push(afterSeparator[0]);
+    if (afterSeparator.length > 1) {
+      normalized.push(...afterSeparator.slice(1));
+    }
+  }
+  for (const envVar of flags.envVars) {
+    normalized.push("--env", envVar);
+  }
+  return { normalizedArgs: normalized };
+}
+
+// src/compat/vscode.ts
+var VS_CODE_ONLY_FIELDS = [
+  "sandbox",
+  "scope",
+  "container",
+  "containerId",
+  "workspaceFolder",
+  "lifecycle",
+  "alwaysAllow",
+  "disabled"
+];
+function validateVSCodeConfig(config) {
+  for (const field of VS_CODE_ONLY_FIELDS) {
+    if (config[field] !== undefined) {
+      return `VS Code field "${field}" is not supported. Use global \`mcpx add\` for advanced configuration.`;
+    }
+  }
+  if (!config.name) {
+    return "VS Code config must include 'name' field.";
+  }
+  if (!config.url && !config.command) {
+    return "VS Code config must include either 'url' (HTTP) or 'command' (stdio) field.";
+  }
+  if (config.url && config.command) {
+    return "VS Code config cannot have both 'url' and 'command'. Specify one transport type.";
+  }
+  if (config.type !== undefined && config.type !== "http" && config.type !== "stdio") {
+    return `Invalid 'type' value: ${config.type}. Must be 'http' or 'stdio'.`;
+  }
+  if (config.env !== undefined) {
+    if (typeof config.env !== "object" || config.env === null || Array.isArray(config.env)) {
+      return "'env' must be a key-value object.";
+    }
+    for (const [key, value] of Object.entries(config.env)) {
+      if (typeof value !== "string") {
+        return `'env["${key}"]' must be a string value.`;
+      }
+    }
+  }
+  if (config.headers !== undefined) {
+    if (typeof config.headers !== "object" || config.headers === null || Array.isArray(config.headers)) {
+      return "'headers' must be a key-value object.";
+    }
+    for (const [key, value] of Object.entries(config.headers)) {
+      if (typeof value !== "string") {
+        return `'headers["${key}"]' must be a string value.`;
+      }
+    }
+  }
+  if (config.args !== undefined) {
+    if (!Array.isArray(config.args)) {
+      return "'args' must be an array.";
+    }
+    for (let i = 0;i < config.args.length; i++) {
+      if (typeof config.args[i] !== "string") {
+        return `'args[${i}]' must be a string.`;
+      }
+    }
+  }
+  return null;
+}
+function normalizeVSCodeConfig(config) {
+  const normalized = [config.name];
+  if (config.url) {
+    normalized.push(config.url);
+    if (config.headers) {
+      for (const [key, value] of Object.entries(config.headers)) {
+        normalized.push("--header", `${key}=${value}`);
+      }
+    }
+  } else if (config.command) {
+    normalized.push(config.command);
+    if (config.args && config.args.length > 0) {
+      normalized.push(...config.args);
+    }
+    if (config.env) {
+      for (const [key, value] of Object.entries(config.env)) {
+        normalized.push("--env", `${key}=${value}`);
+      }
+    }
+  }
+  return normalized;
+}
+function parseVSCodeArgs(jsonPayload) {
+  if (!jsonPayload) {
+    return {
+      normalizedArgs: [],
+      error: "Usage: mcpx code --add-mcp '<json>'"
+    };
+  }
+  let config;
+  try {
+    config = JSON.parse(jsonPayload);
+  } catch (parseError) {
+    return {
+      normalizedArgs: [],
+      error: `Invalid JSON: ${parseError.message}`
+    };
+  }
+  if (Array.isArray(config)) {
+    return {
+      normalizedArgs: [],
+      error: "Array of servers not supported. Use `mcpx add` for each server individually."
+    };
+  }
+  const validationError = validateVSCodeConfig(config);
+  if (validationError) {
+    return {
+      normalizedArgs: [],
+      error: validationError
+    };
+  }
+  const normalized = normalizeVSCodeConfig(config);
+  return { normalizedArgs: normalized };
+}
+
+// src/compat/qwen.ts
+function parseQwenFlags(argv) {
+  const headers = [];
+  const envVars = [];
+  let transport;
+  let timeout;
+  let trust = false;
+  const includeTools = [];
+  const excludeTools = [];
+  let description;
+  let hasScope = false;
+  const separatorIndex = argv.indexOf("--");
+  const flagRegion = separatorIndex === -1 ? argv : argv.slice(0, separatorIndex);
+  for (let i = 0;i < flagRegion.length; i++) {
+    const arg = flagRegion[i];
+    if (arg === "--header" || arg === "-H") {
+      const value = flagRegion[i + 1];
+      if (value && !value.startsWith("-")) {
+        headers.push(value);
+        i++;
+      }
+    } else if (arg === "--env" || arg === "-e") {
+      const value = flagRegion[i + 1];
+      if (value && !value.startsWith("-")) {
+        envVars.push(value);
+        i++;
+      }
+    } else if (arg === "--transport" || arg === "-t") {
+      const value = flagRegion[i + 1];
+      if (value && (value === "stdio" || value === "http" || value === "sse")) {
+        transport = value;
+      }
+      i++;
+    } else if (arg === "--scope" || arg === "-s") {
+      hasScope = true;
+      i++;
+    } else if (arg === "--timeout") {
+      timeout = flagRegion[i + 1];
+      i++;
+    } else if (arg === "--trust") {
+      trust = true;
+    } else if (arg === "--include-tools") {
+      const value = flagRegion[i + 1];
+      if (value) {
+        includeTools.push(...value.split(",").map((t) => t.trim()));
+        i++;
+      }
+    } else if (arg === "--exclude-tools") {
+      const value = flagRegion[i + 1];
+      if (value) {
+        excludeTools.push(...value.split(",").map((t) => t.trim()));
+        i++;
+      }
+    } else if (arg === "--description") {
+      description = flagRegion[i + 1];
+      i++;
+    }
+  }
+  return {
+    headers,
+    envVars,
+    transport,
+    timeout,
+    trust,
+    includeTools,
+    excludeTools,
+    description,
+    hasScope
+  };
+}
+function extractPositionalArgs2(argv) {
+  const separatorIndex = argv.indexOf("--");
+  if (separatorIndex === -1) {
+    const positional = [];
+    let skipNext = false;
+    let foundCommand = false;
+    for (let i = 0;i < argv.length; i++) {
+      if (skipNext) {
+        skipNext = false;
+        continue;
+      }
+      const arg = argv[i];
+      if (arg === "--header" || arg === "-H" || arg === "--env" || arg === "-e" || arg === "--transport" || arg === "-t" || arg === "--scope" || arg === "-s" || arg === "--timeout" || arg === "--trust" || arg === "--include-tools" || arg === "--exclude-tools" || arg === "--description") {
+        skipNext = true;
+        continue;
+      }
+      if (!foundCommand && arg.startsWith("--") && !arg.includes("=")) {
+        continue;
+      }
+      if (!foundCommand && positional.length === 1) {
+        foundCommand = true;
+      }
+      positional.push(arg);
+    }
+    return positional;
+  } else {
+    const beforeSeparator = argv.slice(0, separatorIndex);
+    const afterSeparator = argv.slice(separatorIndex + 1);
+    const positional = [];
+    let skipNext = false;
+    let foundCommand = false;
+    for (let i = 0;i < beforeSeparator.length; i++) {
+      if (skipNext) {
+        skipNext = false;
+        continue;
+      }
+      const arg = beforeSeparator[i];
+      if (arg === "--header" || arg === "-H" || arg === "--env" || arg === "-e" || arg === "--transport" || arg === "-t" || arg === "--scope" || arg === "-s" || arg === "--timeout" || arg === "--trust" || arg === "--include-tools" || arg === "--exclude-tools" || arg === "--description") {
+        skipNext = true;
+        continue;
+      }
+      if (!foundCommand && arg.startsWith("--") && !arg.includes("=")) {
+        continue;
+      }
+      if (!foundCommand && positional.length === 1) {
+        foundCommand = true;
+      }
+      positional.push(arg);
+    }
+    return [...positional, "--", ...afterSeparator];
+  }
+}
+function validateQwenArgs(flags) {
+  if (flags.hasScope) {
+    return "Qwen --scope is not supported. Use global `mcpx add` for project-wide servers.";
+  }
+  if (flags.trust) {
+    return "Qwen --trust is not supported. Use `mcpx auth` to configure auth after adding the server.";
+  }
+  if (flags.includeTools.length > 0 || flags.excludeTools.length > 0) {
+    return "Qwen --include-tools/--exclude-tools are not supported. Use `mcpx add` directly for advanced configuration.";
+  }
+  if (flags.timeout) {
+    return "Qwen --timeout is not supported. Configure timeouts in the server config after adding.";
+  }
+  if (flags.transport === "sse") {
+    return "Qwen --transport sse is not supported. Use `mcpx add <name> <url>` for HTTP/SSE servers.";
+  }
+  return null;
+}
+function parseQwenArgs(argv) {
+  if (argv.length === 0) {
+    return {
+      normalizedArgs: [],
+      error: "Usage: mcpx qwen mcp add <name> <commandOrUrl> [options...]"
+    };
+  }
+  const flags = parseQwenFlags(argv);
+  const validationError = validateQwenArgs(flags);
+  if (validationError) {
+    return {
+      normalizedArgs: [],
+      error: validationError
+    };
+  }
+  const convertedHeaders = flags.headers.map((header) => {
+    const colonIndex = header.indexOf(":");
+    if (colonIndex > 0) {
+      const key = header.slice(0, colonIndex).trim();
+      const value = header.slice(colonIndex + 1).trim();
+      return `${key}=${value}`;
+    }
+    return header;
+  });
+  const positional = extractPositionalArgs2(argv);
+  const separatorIndex = positional.indexOf("--");
+  const secondPositional = positional[1];
+  const isHttpUrl = secondPositional && (secondPositional.startsWith("http://") || secondPositional.startsWith("https://"));
+  const isHttpMode = flags.transport === "http" || flags.transport === undefined && isHttpUrl;
+  if (isHttpMode && separatorIndex === -1) {
+    if (positional.length < 2) {
+      return {
+        normalizedArgs: [],
+        error: "HTTP mode requires: qwen mcp add <name> <url>"
+      };
+    }
+    const [name, url, ...rest] = positional;
+    const normalized = [name, url];
+    for (const header of convertedHeaders) {
+      normalized.push("--header", header);
+    }
+    if (flags.transport === "http") {
+      normalized.push("--transport", "http");
+    }
+    if (rest.length > 0) {
+      normalized.push(...rest);
+    }
+    return { normalizedArgs: normalized };
+  } else {
+    const beforeSeparator = separatorIndex === -1 ? positional : positional.slice(0, separatorIndex);
+    const afterSeparator = separatorIndex === -1 ? [] : positional.slice(separatorIndex + 1);
+    if (beforeSeparator.length < 1) {
+      return {
+        normalizedArgs: [],
+        error: "stdio mode requires: qwen mcp add <name> <command> [args...]"
+      };
+    }
+    const name = beforeSeparator[0];
+    const command = beforeSeparator[1];
+    if (!command) {
+      return {
+        normalizedArgs: [],
+        error: "stdio mode requires a command: qwen mcp add <name> <command> [args...]"
+      };
+    }
+    const normalized = [name, command];
+    const commandArgs = beforeSeparator.slice(2);
+    if (commandArgs.length > 0) {
+      normalized.push(...commandArgs);
+    }
+    if (afterSeparator.length > 0) {
+      normalized.push("--", ...afterSeparator);
+    }
+    for (const envVar of flags.envVars) {
+      normalized.push("--env", envVar);
+    }
+    for (const header of convertedHeaders) {
+      normalized.push("--header", header);
+    }
+    return { normalizedArgs: normalized };
+  }
+}
+
+// src/compat/unsupported.ts
+var UNSUPPORTED_CLIENTS = {
+  "cursor-agent": "Cursor MCP management uses a different interface. Use `mcpx add <name> <url|command>` directly to add MCP servers to mcpx.",
+  cline: "Cline uses config-based MCP setup. Use `mcpx add <name> <url|command>` to add servers to mcpx, then sync to Cline.",
+  kiro: "Kiro uses one-click/config-based MCP setup. Use `mcpx add <name> <url|command>` to add servers to mcpx, then sync to Kiro.",
+  opencode: "OpenCode uses generic mcpx integration. Use `mcpx add <name> <url|command>` to add servers directly."
+};
+var UNSUPPORTED_PREFIXES = Object.keys(UNSUPPORTED_CLIENTS);
+function detectUnsupportedClient(argv) {
+  if (argv.length === 0) {
+    return null;
+  }
+  const firstArg = argv[0];
+  for (const prefix of UNSUPPORTED_PREFIXES) {
+    if (firstArg === prefix || firstArg.startsWith(`${prefix}-`) || firstArg.startsWith(`${prefix}_`)) {
+      return {
+        client: firstArg,
+        error: `${UNSUPPORTED_CLIENTS[prefix]}
+
+Example: mcpx add my-server https://example.com/mcp`
+      };
+    }
+  }
+  return null;
+}
+
+// src/compat/index.ts
+function parseCompatibilityArgs(argv) {
+  const unsupported = detectUnsupportedClient(argv);
+  if (unsupported) {
+    return {
+      client: unsupported.client,
+      normalizedArgs: null,
+      error: unsupported.error
+    };
+  }
+  if (argv[0] === "claude" && argv[1] === "mcp" && argv[2] === "add") {
+    const claudeArgs = argv.slice(3);
+    const result = parseClaudeArgs(claudeArgs);
+    if (result.error) {
+      return {
+        client: "claude",
+        normalizedArgs: null,
+        error: result.error
+      };
+    }
+    return {
+      client: "claude",
+      normalizedArgs: result.normalizedArgs
+    };
+  }
+  if (argv[0] === "codex" && argv[1] === "mcp" && argv[2] === "add") {
+    const codexArgs = argv.slice(3);
+    const result = parseCodexArgs(codexArgs);
+    if (result.error) {
+      return {
+        client: "codex",
+        normalizedArgs: null,
+        error: result.error
+      };
+    }
+    return {
+      client: "codex",
+      normalizedArgs: result.normalizedArgs
+    };
+  }
+  if (argv[0] === "code" && argv[1] === "--add-mcp") {
+    const jsonPayload = argv[2];
+    const result = parseVSCodeArgs(jsonPayload);
+    if (result.error) {
+      return {
+        client: "vscode",
+        normalizedArgs: null,
+        error: result.error
+      };
+    }
+    return {
+      client: "vscode",
+      normalizedArgs: result.normalizedArgs
+    };
+  }
+  if (argv[0] === "qwen" && argv[1] === "mcp" && argv[2] === "add") {
+    const qwenArgs = argv.slice(3);
+    const result = parseQwenArgs(qwenArgs);
+    if (result.error) {
+      return {
+        client: "qwen",
+        normalizedArgs: null,
+        error: result.error
+      };
+    }
+    return {
+      client: "qwen",
+      normalizedArgs: result.normalizedArgs
+    };
+  }
+  return {
+    client: null,
+    normalizedArgs: null
+  };
+}
+
+// src/cli.ts
+var VALID_CLIENTS = STATUS_CLIENTS;
 function parseKeyValueFlag(value, label) {
-    const split = value.indexOf("=");
-    if (split <= 0 || split >= value.length - 1) {
-        throw new Error(`Invalid ${label} format: ${value}. Use KEY=VALUE.`);
-    }
-    return [value.slice(0, split), value.slice(split + 1)];
+  const split = value.indexOf("=");
+  if (split <= 0 || split >= value.length - 1) {
+    throw new Error(`Invalid ${label} format: ${value}. Use KEY=VALUE.`);
+  }
+  return [value.slice(0, split), value.slice(split + 1)];
 }
 function parseHeader(header) {
-    return parseKeyValueFlag(header, "header");
+  return parseKeyValueFlag(header, "header");
 }
 function parseEnvVar(envVar) {
-    return parseKeyValueFlag(envVar, "env");
+  return parseKeyValueFlag(envVar, "env");
 }
 function isHttpUrl(value) {
-    try {
-        const parsed = new URL(value);
-        return parsed.protocol === "http:" || parsed.protocol === "https:";
-    }
-    catch {
-        return false;
-    }
+  try {
+    const parsed = new URL(value);
+    return parsed.protocol === "http:" || parsed.protocol === "https:";
+  } catch {
+    return false;
+  }
 }
 function normalizeTransport(transport) {
-    const normalized = transport?.trim().toLowerCase() || "auto";
-    if (normalized !== "auto" && normalized !== "http" && normalized !== "stdio") {
-        throw new Error("Invalid --transport value. Supported: auto, http, stdio.");
-    }
-    return normalized;
+  const normalized = transport?.trim().toLowerCase() || "auto";
+  if (normalized !== "auto" && normalized !== "http" && normalized !== "stdio") {
+    throw new Error("Invalid --transport value. Supported: auto, http, stdio.");
+  }
+  return normalized;
 }
 function parseAddServerSpec(values, options) {
-    if (values.length < 2) {
-        throw new Error("Usage: mcpx add [--transport auto|http|stdio] <name> <url|command> [args...]");
-    }
-    const name = values[0] ?? "";
-    const target = values[1] ?? "";
-    const trailing = values.slice(2);
-    const requestedTransport = normalizeTransport(options.transport);
-    const transport = requestedTransport === "auto"
-        ? (isHttpUrl(target) && trailing.length === 0 ? "http" : "stdio")
-        : requestedTransport;
-    if (transport === "http") {
-        if (values.length !== 2) {
-            throw new Error("HTTP upstream usage: mcpx add <name> --transport http <url>");
-        }
-        if (!isHttpUrl(target)) {
-            throw new Error(`Invalid HTTP URL: ${target}`);
-        }
-        if ((options.env ?? []).length > 0 || options.cwd) {
-            throw new Error("--env/--cwd are only valid for stdio transport.");
-        }
-        const headers = {};
-        for (const item of options.header ?? []) {
-            const [key, value] = parseHeader(item);
-            headers[key] = value;
-        }
-        const spec = {
-            transport: "http",
-            url: target,
-            headers: Object.keys(headers).length > 0 ? headers : undefined
-        };
-        return { name, spec };
-    }
-    if ((options.header ?? []).length > 0) {
-        throw new Error("--header is only valid for HTTP transport.");
-    }
-    const env = {};
-    for (const item of options.env ?? []) {
-        const [key, value] = parseEnvVar(item);
-        env[key] = value;
-    }
-    const spec = {
-        transport: "stdio",
-        command: target,
-        args: trailing.length > 0 ? trailing : undefined,
-        env: Object.keys(env).length > 0 ? env : undefined,
-        cwd: options.cwd?.trim() || undefined
+  if (values.length < 2) {
+    throw new Error("Usage: mcpx add [--transport auto|http|stdio] <name> <url|command> [args...]");
+  }
+  const name = values[0] ?? "";
+  const target = values[1] ?? "";
+  const trailing = values.slice(2);
+  const requestedTransport = normalizeTransport(options.transport);
+  const transport = requestedTransport === "auto" ? isHttpUrl(target) && trailing.length === 0 ? "http" : "stdio" : requestedTransport;
+  if (transport === "http") {
+    if (values.length !== 2) {
+      throw new Error("HTTP upstream usage: mcpx add <name> --transport http <url>");
+    }
+    if (!isHttpUrl(target)) {
+      throw new Error(`Invalid HTTP URL: ${target}`);
+    }
+    if ((options.env ?? []).length > 0 || options.cwd) {
+      throw new Error("--env/--cwd are only valid for stdio transport.");
+    }
+    const headers = {};
+    for (const item of options.header ?? []) {
+      const [key, value] = parseHeader(item);
+      headers[key] = value;
+    }
+    const spec2 = {
+      transport: "http",
+      url: target,
+      headers: Object.keys(headers).length > 0 ? headers : undefined
     };
-    return { name, spec };
+    return { name, spec: spec2 };
+  }
+  if ((options.header ?? []).length > 0) {
+    throw new Error("--header is only valid for HTTP transport.");
+  }
+  const env = {};
+  for (const item of options.env ?? []) {
+    const [key, value] = parseEnvVar(item);
+    env[key] = value;
+  }
+  const spec = {
+    transport: "stdio",
+    command: target,
+    args: trailing.length > 0 ? trailing : undefined,
+    env: Object.keys(env).length > 0 ? env : undefined,
+    cwd: options.cwd?.trim() || undefined
+  };
+  return { name, spec };
 }
 function getServerSpecOrThrow(config, serverName) {
-    const spec = config.servers[serverName];
-    if (!spec) {
-        throw new Error(`Server "${serverName}" does not exist.`);
-    }
-    return spec;
+  const spec = config.servers[serverName];
+  if (!spec) {
+    throw new Error(`Server "${serverName}" does not exist.`);
+  }
+  return spec;
 }
 function redactAuthValue(value) {
-    if (value.startsWith("secret://")) {
-        return value;
-    }
-    return "<inline>";
+  if (value.startsWith("secret://")) {
+    return value;
+  }
+  return "<inline>";
 }
 function parseClientList(values) {
-    if (!values || values.length === 0) {
-        return undefined;
-    }
-    const normalized = values.flatMap((value) => value.split(",")).map((value) => value.trim()).filter(Boolean);
-    const unique = Array.from(new Set(normalized));
-    for (const client of unique) {
-        if (!VALID_CLIENTS.includes(client)) {
-            throw new Error(`Unknown client: ${client}. Valid clients: ${VALID_CLIENTS.join(", ")}`);
-        }
-    }
-    return unique;
+  if (!values || values.length === 0) {
+    return;
+  }
+  const normalized = values.flatMap((value) => value.split(",")).map((value) => value.trim()).filter(Boolean);
+  const unique = Array.from(new Set(normalized));
+  for (const client of unique) {
+    if (!VALID_CLIENTS.includes(client)) {
+      throw new Error(`Unknown client: ${client}. Valid clients: ${VALID_CLIENTS.join(", ")}`);
+    }
+  }
+  return unique;
 }
 function ensureExitCodeForSyncFailures(hasErrors) {
-    if (hasErrors) {
-        process.exitCode = 2;
-    }
+  if (hasErrors) {
+    process.exitCode = 2;
+  }
 }
 function printSyncSummary(summary, asJson = false) {
-    if (asJson) {
-        process.stdout.write(`${JSON.stringify(summary, null, 2)}\n`);
-        return;
-    }
-    if (summary.imports.imported.length > 0
-        || summary.imports.duplicates.length > 0
-        || summary.imports.skipped.length > 0
-        || summary.imports.conflicts.length > 0
-        || summary.imports.errors.length > 0) {
-        process.stdout.write("Imports:\n");
-        for (const entry of summary.imports.imported) {
-            process.stdout.write(`- imported ${entry.serverName} from ${entry.clientId}`);
-            if (entry.sourceEntryName !== entry.serverName) {
-                process.stdout.write(` (${entry.sourceEntryName})`);
-            }
-            process.stdout.write("\n");
-        }
-        for (const entry of summary.imports.duplicates) {
-            process.stdout.write(`- adopted existing ${entry.serverName} from ${entry.clientId}\n`);
-        }
-        for (const entry of summary.imports.skipped) {
-            process.stdout.write(`- skipped ${entry.serverName} from ${entry.clientId} - ${entry.reason}\n`);
-        }
-        for (const entry of summary.imports.conflicts) {
-            process.stdout.write(`- conflict ${entry.serverName} from ${entry.clientId} - ${entry.message}\n`);
-        }
-        for (const entry of summary.imports.errors) {
-            process.stdout.write(`- import error ${entry.clientId} - ${entry.message}\n`);
-        }
-    }
-    process.stdout.write(`Gateway: ${summary.gatewayUrl}\n`);
-    for (const result of summary.results) {
-        process.stdout.write(`- ${result.clientId}: ${result.status}`);
-        if (result.configPath) {
-            process.stdout.write(` (${result.configPath})`);
-        }
-        if (result.message) {
-            process.stdout.write(` - ${result.message}`);
-        }
-        process.stdout.write("\n");
-    }
+  if (asJson) {
+    process.stdout.write(`${JSON.stringify(summary, null, 2)}
+`);
+    return;
+  }
+  if (summary.imports.imported.length > 0 || summary.imports.duplicates.length > 0 || summary.imports.skipped.length > 0 || summary.imports.conflicts.length > 0 || summary.imports.errors.length > 0) {
+    process.stdout.write(`Imports:
+`);
+    for (const entry of summary.imports.imported) {
+      process.stdout.write(`- imported ${entry.serverName} from ${entry.clientId}`);
+      if (entry.sourceEntryName !== entry.serverName) {
+        process.stdout.write(` (${entry.sourceEntryName})`);
+      }
+      process.stdout.write(`
+`);
+    }
+    for (const entry of summary.imports.duplicates) {
+      process.stdout.write(`- adopted existing ${entry.serverName} from ${entry.clientId}
+`);
+    }
+    for (const entry of summary.imports.skipped) {
+      process.stdout.write(`- skipped ${entry.serverName} from ${entry.clientId} - ${entry.reason}
+`);
+    }
+    for (const entry of summary.imports.conflicts) {
+      process.stdout.write(`- conflict ${entry.serverName} from ${entry.clientId} - ${entry.message}
+`);
+    }
+    for (const entry of summary.imports.errors) {
+      process.stdout.write(`- import error ${entry.clientId} - ${entry.message}
+`);
+    }
+  }
+  process.stdout.write(`Gateway: ${summary.gatewayUrl}
+`);
+  for (const result of summary.results) {
+    process.stdout.write(`- ${result.clientId}: ${result.status}`);
+    if (result.configPath) {
+      process.stdout.write(` (${result.configPath})`);
+    }
+    if (result.message) {
+      process.stdout.write(` - ${result.message}`);
+    }
+    process.stdout.write(`
+`);
+  }
 }
 async function ensureDaemonIfEnabled(cliPath, secrets) {
-    if (process.env.MCPX_SKIP_DAEMON_AUTOSTART === "1") {
-        return;
-    }
-    const config = loadConfig();
-    if (!config.gateway.autoStart) {
-        return;
-    }
-    await startDaemon(config, cliPath, secrets);
+  if (process.env.MCPX_SKIP_DAEMON_AUTOSTART === "1") {
+    return;
+  }
+  const config = loadConfig();
+  if (!config.gateway.autoStart) {
+    return;
+  }
+  await startDaemon(config, cliPath, secrets);
 }
 async function autoSyncManagedEntries(config) {
-    const secrets = new SecretsManager();
-    await ensureDaemonIfEnabled(process.argv[1] ?? "", secrets);
-    const summary = syncAllClients(config, secrets);
-    printSyncSummary(summary, false);
-    ensureExitCodeForSyncFailures(summary.hasErrors);
+  const secrets = new SecretsManager;
+  await ensureDaemonIfEnabled(process.argv[1] ?? "", secrets);
+  const summary = syncAllClients(config, secrets);
+  printSyncSummary(summary, false);
+  ensureExitCodeForSyncFailures(summary.hasErrors);
 }
 function isNegativeChoice(value) {
-    const normalized = value.trim().toLowerCase();
-    return normalized === "n" || normalized === "no";
+  const normalized = value.trim().toLowerCase();
+  return normalized === "n" || normalized === "no";
 }
 async function maybeAutoConfigureAuthForAddedServer(serverName, spec, secrets) {
-    if (spec.transport !== "http") {
-        return;
-    }
-    const probe = await probeHttpAuthRequirement(spec, secrets);
-    if (!probe.authRequired) {
-        return;
-    }
-    process.stdout.write(`Upstream "${serverName}" responded with ${probe.status ?? 401} and appears to require auth.\n`);
-    if (probe.wwwAuthenticate) {
-        process.stdout.write(`WWW-Authenticate: ${probe.wwwAuthenticate}\n`);
-    }
-    if (!process.stdin.isTTY || !process.stdout.isTTY) {
-        process.stdout.write(`Run \`mcpx auth set ${serverName} --header Authorization --value \"<token>\"\` to configure auth.\n`);
-        return;
-    }
-    const rl = createInterface({
-        input: process.stdin,
-        output: process.stdout
-    });
-    try {
-        const shouldConfigure = await promptLine(rl, "Configure auth now? (Y/n): ");
-        if (isNegativeChoice(shouldConfigure)) {
-            process.stdout.write("Skipping auth setup.\n");
-            return;
-        }
-        const currentHeaderBinding = listAuthBindings(spec)
-            .find((binding) => binding.kind === "header");
-        const headerName = await promptLineWithDefault(rl, "Header name", currentHeaderBinding?.key ?? "Authorization");
-        if (!headerName) {
-            process.stdout.write("Skipping auth setup (empty header name).\n");
-            return;
-        }
-        const authValueInput = await promptLine(rl, "Auth value/token (blank to skip): ");
-        if (!authValueInput) {
-            process.stdout.write("Skipping auth setup.\n");
-            return;
-        }
-        const target = resolveAuthTarget(spec, headerName, undefined);
-        const authValue = maybePrefixBearer(target, authValueInput, false);
-        const existingValue = listAuthBindings(spec)
-            .find((binding) => binding.kind === target.kind && binding.key === target.key)?.value;
-        const defaultSecret = secretRefName(existingValue ?? "") ?? defaultAuthSecretName(serverName, target);
-        const secretName = await promptLineWithDefault(rl, "Secret name", defaultSecret);
-        if (!secretName) {
-            process.stdout.write("Skipping auth setup (empty secret name).\n");
-            return;
-        }
-        secrets.setSecret(secretName, authValue);
-        applyAuthReference(spec, target, toSecretRef(secretName));
-        process.stdout.write(`Configured auth via ${target.kind}:${target.key} using secret://${secretName}.\n`);
-    }
-    catch (error) {
-        process.stdout.write(`Auto auth setup skipped: ${error.message}\n`);
-        return;
-    }
-    finally {
-        rl.close();
-    }
-    const verify = await probeHttpAuthRequirement(spec, secrets);
-    if (verify.authRequired) {
-        process.stdout.write("Auth is configured, but upstream still reports auth required. Re-auth may be needed.\n");
-    }
-    else if (verify.error) {
-        process.stdout.write(`Auth check after setup could not be completed: ${verify.error}\n`);
-    }
-    else {
-        process.stdout.write("Auth check passed.\n");
+  if (spec.transport !== "http") {
+    return;
+  }
+  const probe = await probeHttpAuthRequirement(spec, secrets);
+  if (!probe.authRequired) {
+    return;
+  }
+  process.stdout.write(`Upstream "${serverName}" responded with ${probe.status ?? 401} and appears to require auth.
+`);
+  if (probe.wwwAuthenticate) {
+    process.stdout.write(`WWW-Authenticate: ${probe.wwwAuthenticate}
+`);
+  }
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    process.stdout.write(`Run \`mcpx auth set ${serverName} --header Authorization --value "<token>"\` to configure auth.
+`);
+    return;
+  }
+  const rl = createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+  try {
+    const shouldConfigure = await promptLine(rl, "Configure auth now? (Y/n): ");
+    if (isNegativeChoice(shouldConfigure)) {
+      process.stdout.write(`Skipping auth setup.
+`);
+      return;
+    }
+    const currentHeaderBinding = listAuthBindings(spec).find((binding) => binding.kind === "header");
+    const headerName = await promptLineWithDefault(rl, "Header name", currentHeaderBinding?.key ?? "Authorization");
+    if (!headerName) {
+      process.stdout.write(`Skipping auth setup (empty header name).
+`);
+      return;
+    }
+    const authValueInput = await promptLine(rl, "Auth value/token (blank to skip): ");
+    if (!authValueInput) {
+      process.stdout.write(`Skipping auth setup.
+`);
+      return;
+    }
+    const target = resolveAuthTarget(spec, headerName, undefined);
+    const authValue = maybePrefixBearer(target, authValueInput, false);
+    const existingValue = listAuthBindings(spec).find((binding) => binding.kind === target.kind && binding.key === target.key)?.value;
+    const defaultSecret = secretRefName(existingValue ?? "") ?? defaultAuthSecretName(serverName, target);
+    const secretName = await promptLineWithDefault(rl, "Secret name", defaultSecret);
+    if (!secretName) {
+      process.stdout.write(`Skipping auth setup (empty secret name).
+`);
+      return;
     }
+    secrets.setSecret(secretName, authValue);
+    applyAuthReference(spec, target, toSecretRef(secretName));
+    process.stdout.write(`Configured auth via ${target.kind}:${target.key} using secret://${secretName}.
+`);
+  } catch (error) {
+    process.stdout.write(`Auto auth setup skipped: ${error.message}
+`);
+    return;
+  } finally {
+    rl.close();
+  }
+  const verify = await probeHttpAuthRequirement(spec, secrets);
+  if (verify.authRequired) {
+    process.stdout.write(`Auth is configured, but upstream still reports auth required. Re-auth may be needed.
+`);
+  } else if (verify.error) {
+    process.stdout.write(`Auth check after setup could not be completed: ${verify.error}
+`);
+  } else {
+    process.stdout.write(`Auth check passed.
+`);
+  }
 }
 function loadStatusReport() {
-    const config = loadConfig();
-    return buildStatusReport(config, loadManagedIndex(), getDaemonStatus(config));
+  const config = loadConfig();
+  return buildStatusReport(config, loadManagedIndex(), getDaemonStatus(config));
 }
 function daemonEmoji(running) {
-    return running ? "✅" : "⚠️";
+  return running ? "✅" : "⚠️";
 }
 function clientStatusEmoji(status) {
-    if (status === "SYNCED") {
-        return "✅";
-    }
-    if (status === "ERROR") {
-        return "❌";
-    }
-    if (status === "UNSUPPORTED_HTTP") {
-        return "⚠️";
-    }
-    return "⏭️";
+  if (status === "SYNCED") {
+    return "✅";
+  }
+  if (status === "ERROR") {
+    return "❌";
+  }
+  if (status === "UNSUPPORTED_HTTP") {
+    return "⚠️";
+  }
+  return "⏭️";
 }
 function serverHealthEmoji(server) {
-    if (!server.enabled) {
-        return "⏸️";
-    }
-    const managed = server.clients.filter((client) => client.managed);
-    if (managed.length === 0) {
-        return "⚠️";
-    }
-    if (managed.some((client) => client.status === "ERROR")) {
-        return "❌";
-    }
-    if (managed.some((client) => client.status === "UNSUPPORTED_HTTP")) {
-        return "⚠️";
-    }
-    return "✅";
+  if (!server.enabled) {
+    return "⏸️";
+  }
+  const managed = server.clients.filter((client) => client.managed);
+  if (managed.length === 0) {
+    return "⚠️";
+  }
+  if (managed.some((client) => client.status === "ERROR")) {
+    return "❌";
+  }
+  if (managed.some((client) => client.status === "UNSUPPORTED_HTTP")) {
+    return "⚠️";
+  }
+  return "✅";
 }
 function formatDaemonState(status) {
-    if (status.running) {
-        return `running (pid ${status.pid})`;
-    }
-    return "stopped";
+  if (status.running) {
+    return `running (pid ${status.pid})`;
+  }
+  return "stopped";
 }
 function formatAuthSummary(authBindings) {
-    return authBindings.map((binding) => `${binding.kind}:${binding.key}`).join(", ");
+  return authBindings.map((binding) => `${binding.kind}:${binding.key}`).join(", ");
 }
 function listSyncedClientLabels(server) {
-    return server.clients
-        .filter((client) => client.managed)
-        .map((client) => (`${clientStatusEmoji(client.status)} ${client.configPath ? `${client.clientId} (${client.configPath})` : client.clientId}${client.status === "SYNCED" ? "" : ` [${client.status}]`}`));
+  return server.clients.filter((client) => client.managed).map((client) => `${clientStatusEmoji(client.status)} ${client.configPath ? `${client.clientId} (${client.configPath})` : client.clientId}${client.status === "SYNCED" ? "" : ` [${client.status}]`}`);
 }
 function printSyncedConfigBullets(server, indent) {
-    const synced = listSyncedClientLabels(server);
-    if (synced.length === 0) {
-        process.stdout.write(`${indent}- ⚠️ none\n`);
-        return;
-    }
-    for (const entry of synced) {
-        process.stdout.write(`${indent}- ${entry}\n`);
-    }
+  const synced = listSyncedClientLabels(server);
+  if (synced.length === 0) {
+    process.stdout.write(`${indent}- ⚠️ none
+`);
+    return;
+  }
+  for (const entry of synced) {
+    process.stdout.write(`${indent}- ${entry}
+`);
+  }
 }
 function printStatusReportText(report) {
-    process.stdout.write(`Gateway URL: ${report.gatewayUrl}\n`);
-    process.stdout.write(`Daemon: ${daemonEmoji(report.daemon.running)} ${formatDaemonState(report.daemon)}\n`);
-    process.stdout.write(`Upstream servers: ${report.upstreamCount}\n`);
-    if (report.servers.length === 0) {
-        process.stdout.write("⚠️ No upstream servers configured.\n");
-    }
-    else {
-        for (const server of report.servers) {
-            process.stdout.write(`- ${serverHealthEmoji(server)} ${server.name} (${server.transport})\n`);
-            process.stdout.write(`  state: ${server.enabled ? "enabled" : "disabled"}\n`);
-            process.stdout.write(`  target: ${server.target}\n`);
-            if (server.authBindings.length > 0) {
-                process.stdout.write(`  auth: 🔐 ${formatAuthSummary(server.authBindings)}\n`);
-            }
-            process.stdout.write("  synced configs:\n");
-            printSyncedConfigBullets(server, "  ");
-        }
-    }
-    process.stdout.write("Client sync states:\n");
-    for (const client of STATUS_CLIENTS) {
-        const state = report.clients[client];
-        if (!state) {
-            process.stdout.write(`- ${clientStatusEmoji("SKIPPED")} ${client}: SKIPPED\n`);
-        }
-        else {
-            process.stdout.write(`- ${clientStatusEmoji(state.status)} ${client}: ${state.status}${state.message ? ` - ${state.message}` : ""}\n`);
-        }
-    }
+  process.stdout.write(`Gateway URL: ${report.gatewayUrl}
+`);
+  process.stdout.write(`Daemon: ${daemonEmoji(report.daemon.running)} ${formatDaemonState(report.daemon)}
+`);
+  process.stdout.write(`Upstream servers: ${report.upstreamCount}
+`);
+  if (report.servers.length === 0) {
+    process.stdout.write(`⚠️ No upstream servers configured.
+`);
+  } else {
+    for (const server of report.servers) {
+      process.stdout.write(`- ${serverHealthEmoji(server)} ${server.name} (${server.transport})
+`);
+      process.stdout.write(`  state: ${server.enabled ? "enabled" : "disabled"}
+`);
+      process.stdout.write(`  target: ${server.target}
+`);
+      if (server.authBindings.length > 0) {
+        process.stdout.write(`  auth: \uD83D\uDD10 ${formatAuthSummary(server.authBindings)}
+`);
+      }
+      process.stdout.write(`  synced configs:
+`);
+      printSyncedConfigBullets(server, "  ");
+    }
+  }
+  process.stdout.write(`Client sync states:
+`);
+  for (const client of STATUS_CLIENTS) {
+    const state = report.clients[client];
+    if (!state) {
+      process.stdout.write(`- ${clientStatusEmoji("SKIPPED")} ${client}: SKIPPED
+`);
+    } else {
+      process.stdout.write(`- ${clientStatusEmoji(state.status)} ${client}: ${state.status}${state.message ? ` - ${state.message}` : ""}
+`);
+    }
+  }
 }
 async function promptLine(rl, prompt) {
-    return (await rl.question(prompt)).trim();
+  return (await rl.question(prompt)).trim();
 }
 async function promptLineWithDefault(rl, prompt, defaultValue) {
-    const suffix = defaultValue ? ` [${defaultValue}]` : "";
-    const value = (await rl.question(`${prompt}${suffix}: `)).trim();
-    return value || defaultValue;
+  const suffix = defaultValue ? ` [${defaultValue}]` : "";
+  const value = (await rl.question(`${prompt}${suffix}: `)).trim();
+  return value || defaultValue;
 }
 function parseSelection(value, max) {
-    const numeric = Number(value);
-    if (!Number.isInteger(numeric) || numeric < 1 || numeric > max) {
-        return null;
-    }
-    return numeric - 1;
+  const numeric = Number(value);
+  if (!Number.isInteger(numeric) || numeric < 1 || numeric > max) {
+    return null;
+  }
+  return numeric - 1;
 }
 function clearTerminalScreen() {
-    process.stdout.write("\x1b[2J\x1b[H");
+  process.stdout.write("\x1B[2J\x1B[H");
 }
 function renderMenuScreen(titleLines, options, selectedIndex, cancelHint) {
-    clearTerminalScreen();
+  clearTerminalScreen();
+  for (const line of titleLines) {
+    process.stdout.write(`${line}
+`);
+  }
+  process.stdout.write(`
+`);
+  options.forEach((option, index) => {
+    const cursor = index === selectedIndex ? "❯" : " ";
+    process.stdout.write(`${cursor} ${index + 1}. ${option.label}
+`);
+    if (option.detail) {
+      process.stdout.write(`   ${option.detail}
+`);
+    }
+  });
+  process.stdout.write(`
+↑/↓ to navigate • Space/Enter to select • Esc/${cancelHint} to cancel
+`);
+}
+async function promptMenuSelection(rl, titleLines, options, cancelHint = "q") {
+  if (options.length === 0) {
+    return null;
+  }
+  const stdin = process.stdin;
+  const canUseKeyNavigation = process.stdin.isTTY && process.stdout.isTTY && typeof stdin.setRawMode === "function";
+  if (!canUseKeyNavigation) {
     for (const line of titleLines) {
-        process.stdout.write(`${line}\n`);
+      process.stdout.write(`${line}
+`);
     }
-    process.stdout.write("\n");
+    process.stdout.write(`
+`);
     options.forEach((option, index) => {
-        const cursor = index === selectedIndex ? "❯" : " ";
-        process.stdout.write(`${cursor} ${index + 1}. ${option.label}\n`);
-        if (option.detail) {
-            process.stdout.write(`   ${option.detail}\n`);
-        }
+      process.stdout.write(`${index + 1}. ${option.label}
+`);
+      if (option.detail) {
+        process.stdout.write(`   ${option.detail}
+`);
+      }
     });
-    process.stdout.write(`\n↑/↓ to navigate • Space/Enter to select • Esc/${cancelHint} to cancel\n`);
-}
-async function promptMenuSelection(rl, titleLines, options, cancelHint = "q") {
-    if (options.length === 0) {
-        return null;
-    }
-    const stdin = process.stdin;
-    const canUseKeyNavigation = process.stdin.isTTY && process.stdout.isTTY && typeof stdin.setRawMode === "function";
-    if (!canUseKeyNavigation) {
-        for (const line of titleLines) {
-            process.stdout.write(`${line}\n`);
-        }
-        process.stdout.write("\n");
-        options.forEach((option, index) => {
-            process.stdout.write(`${index + 1}. ${option.label}\n`);
-            if (option.detail) {
-                process.stdout.write(`   ${option.detail}\n`);
-            }
-        });
-        const selected = parseSelection(await promptLine(rl, `Select option (1-${options.length}, blank to cancel): `), options.length);
-        return selected;
-    }
-    return new Promise((resolve) => {
-        let index = 0;
-        let settled = false;
-        rl.pause();
-        const cleanup = () => {
-            stdin.off("keypress", onKeypress);
-            try {
-                stdin.setRawMode(false);
-            }
-            catch {
-                // ignore cleanup errors
-            }
-            rl.resume();
-        };
-        const done = (value) => {
-            if (settled) {
-                return;
-            }
-            settled = true;
-            cleanup();
-            process.stdout.write("\n");
-            resolve(value);
-        };
-        const onKeypress = (_chunk, key) => {
-            if (key.ctrl && key.name === "c") {
-                done(null);
-                return;
-            }
-            if (key.name === "up" || key.name === "k") {
-                index = (index - 1 + options.length) % options.length;
-                renderMenuScreen(titleLines, options, index, cancelHint);
-                return;
-            }
-            if (key.name === "down" || key.name === "j") {
-                index = (index + 1) % options.length;
-                renderMenuScreen(titleLines, options, index, cancelHint);
-                return;
-            }
-            if (key.name === "return" || key.name === "space") {
-                done(index);
-                return;
-            }
-            if (key.name === "escape" || key.name === "q") {
-                done(null);
-                return;
-            }
-            if (key.sequence && /^[1-9]$/.test(key.sequence)) {
-                const numeric = Number(key.sequence);
-                if (numeric >= 1 && numeric <= options.length) {
-                    done(numeric - 1);
-                }
-            }
-        };
-        emitKeypressEvents(stdin);
-        stdin.setRawMode(true);
-        stdin.resume();
-        stdin.on("keypress", onKeypress);
+    const selected = parseSelection(await promptLine(rl, `Select option (1-${options.length}, blank to cancel): `), options.length);
+    return selected;
+  }
+  return new Promise((resolve) => {
+    let index = 0;
+    let settled = false;
+    rl.pause();
+    const cleanup = () => {
+      stdin.off("keypress", onKeypress);
+      try {
+        stdin.setRawMode(false);
+      } catch {}
+      rl.resume();
+    };
+    const done = (value) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      cleanup();
+      process.stdout.write(`
+`);
+      resolve(value);
+    };
+    const onKeypress = (_chunk, key) => {
+      if (key.ctrl && key.name === "c") {
+        done(null);
+        return;
+      }
+      if (key.name === "up" || key.name === "k") {
+        index = (index - 1 + options.length) % options.length;
         renderMenuScreen(titleLines, options, index, cancelHint);
-    });
+        return;
+      }
+      if (key.name === "down" || key.name === "j") {
+        index = (index + 1) % options.length;
+        renderMenuScreen(titleLines, options, index, cancelHint);
+        return;
+      }
+      if (key.name === "return" || key.name === "space") {
+        done(index);
+        return;
+      }
+      if (key.name === "escape" || key.name === "q") {
+        done(null);
+        return;
+      }
+      if (key.sequence && /^[1-9]$/.test(key.sequence)) {
+        const numeric = Number(key.sequence);
+        if (numeric >= 1 && numeric <= options.length) {
+          done(numeric - 1);
+        }
+      }
+    };
+    emitKeypressEvents(stdin);
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.on("keypress", onKeypress);
+    renderMenuScreen(titleLines, options, index, cancelHint);
+  });
 }
 async function chooseAuthBinding(rl, bindings, prompt) {
-    if (bindings.length === 0) {
-        return null;
-    }
-    if (bindings.length === 1) {
-        return bindings[0];
-    }
-    const selected = await promptMenuSelection(rl, ["Auth bindings", prompt], bindings.map((binding) => ({
-        label: `${binding.kind}:${binding.key}`,
-        detail: binding.secretName ? `source: secret://${binding.secretName}` : "source: <inline>"
-    })), "q");
-    if (selected === null) {
-        return null;
-    }
-    return bindings[selected] ?? null;
+  if (bindings.length === 0) {
+    return null;
+  }
+  if (bindings.length === 1) {
+    return bindings[0];
+  }
+  const selected = await promptMenuSelection(rl, ["Auth bindings", prompt], bindings.map((binding) => ({
+    label: `${binding.kind}:${binding.key}`,
+    detail: binding.secretName ? `source: secret://${binding.secretName}` : "source: <inline>"
+  })), "q");
+  if (selected === null) {
+    return null;
+  }
+  return bindings[selected] ?? null;
 }
 async function configureServerAuthInteractively(rl, serverName, reauthOnly = false) {
-    const config = loadConfig();
-    const spec = getServerSpecOrThrow(config, serverName);
-    const existingBindings = listAuthBindings(spec);
-    let targetKind;
-    let targetKey;
-    let existingValue;
-    if (reauthOnly) {
-        const selected = await chooseAuthBinding(rl, existingBindings.map((binding) => ({
-            kind: binding.kind,
-            key: binding.key,
-            value: binding.value,
-            secretName: secretRefName(binding.value) ?? undefined
-        })), "Choose binding to re-authenticate");
-        if (!selected) {
-            process.stdout.write("No auth binding selected.\n");
-            return;
-        }
-        targetKind = selected.kind;
-        targetKey = selected.key;
-        existingValue = selected.value;
-    }
-    else if (spec.transport === "http") {
-        targetKind = "header";
-        targetKey = await promptLineWithDefault(rl, "Header name", existingBindings.find((binding) => binding.kind === "header")?.key ?? "Authorization");
-    }
-    else {
-        targetKind = "env";
-        targetKey = await promptLineWithDefault(rl, "Env var name", existingBindings.find((binding) => binding.kind === "env")?.key ?? "");
-    }
-    if (!targetKey) {
-        process.stdout.write("Auth key cannot be empty.\n");
-        return;
-    }
-    const target = targetKind === "header"
-        ? resolveAuthTarget(spec, targetKey, undefined)
-        : resolveAuthTarget(spec, undefined, targetKey);
-    if (!existingValue) {
-        existingValue = existingBindings.find((binding) => binding.kind === target.kind && binding.key === target.key)?.value;
-    }
-    const token = await promptLine(rl, "Auth value/token (blank to cancel): ");
-    if (!token) {
-        process.stdout.write("Cancelled.\n");
-        return;
-    }
-    const authValue = maybePrefixBearer(target, token, false);
-    const defaultSecret = secretRefName(existingValue ?? "") ?? defaultAuthSecretName(serverName, target);
-    const secretName = await promptLineWithDefault(rl, "Secret name", defaultSecret);
-    if (!secretName) {
-        process.stdout.write("Secret name cannot be empty.\n");
-        return;
-    }
-    const secrets = new SecretsManager();
-    secrets.setSecret(secretName, authValue);
-    applyAuthReference(spec, target, toSecretRef(secretName));
-    saveConfig(config);
-    process.stdout.write(`Configured auth for "${serverName}" at ${target.kind}:${target.key} using secret://${secretName}.\n`);
+  const config = loadConfig();
+  const spec = getServerSpecOrThrow(config, serverName);
+  const existingBindings = listAuthBindings(spec);
+  let targetKind;
+  let targetKey;
+  let existingValue;
+  if (reauthOnly) {
+    const selected = await chooseAuthBinding(rl, existingBindings.map((binding) => ({
+      kind: binding.kind,
+      key: binding.key,
+      value: binding.value,
+      secretName: secretRefName(binding.value) ?? undefined
+    })), "Choose binding to re-authenticate");
+    if (!selected) {
+      process.stdout.write(`No auth binding selected.
+`);
+      return;
+    }
+    targetKind = selected.kind;
+    targetKey = selected.key;
+    existingValue = selected.value;
+  } else if (spec.transport === "http") {
+    targetKind = "header";
+    targetKey = await promptLineWithDefault(rl, "Header name", existingBindings.find((binding) => binding.kind === "header")?.key ?? "Authorization");
+  } else {
+    targetKind = "env";
+    targetKey = await promptLineWithDefault(rl, "Env var name", existingBindings.find((binding) => binding.kind === "env")?.key ?? "");
+  }
+  if (!targetKey) {
+    process.stdout.write(`Auth key cannot be empty.
+`);
+    return;
+  }
+  const target = targetKind === "header" ? resolveAuthTarget(spec, targetKey, undefined) : resolveAuthTarget(spec, undefined, targetKey);
+  if (!existingValue) {
+    existingValue = existingBindings.find((binding) => binding.kind === target.kind && binding.key === target.key)?.value;
+  }
+  const token = await promptLine(rl, "Auth value/token (blank to cancel): ");
+  if (!token) {
+    process.stdout.write(`Cancelled.
+`);
+    return;
+  }
+  const authValue = maybePrefixBearer(target, token, false);
+  const defaultSecret = secretRefName(existingValue ?? "") ?? defaultAuthSecretName(serverName, target);
+  const secretName = await promptLineWithDefault(rl, "Secret name", defaultSecret);
+  if (!secretName) {
+    process.stdout.write(`Secret name cannot be empty.
+`);
+    return;
+  }
+  const secrets = new SecretsManager;
+  secrets.setSecret(secretName, authValue);
+  applyAuthReference(spec, target, toSecretRef(secretName));
+  saveConfig(config);
+  process.stdout.write(`Configured auth for "${serverName}" at ${target.kind}:${target.key} using secret://${secretName}.
+`);
 }
 async function clearServerAuthInteractively(rl, serverName) {
-    const config = loadConfig();
-    const spec = getServerSpecOrThrow(config, serverName);
-    const bindings = listAuthBindings(spec).map((binding) => ({
-        kind: binding.kind,
-        key: binding.key,
-        value: binding.value,
-        secretName: secretRefName(binding.value) ?? undefined
-    }));
-    const selected = await chooseAuthBinding(rl, bindings, "Choose binding to clear");
-    if (!selected) {
-        process.stdout.write("No auth binding selected.\n");
-        return;
-    }
-    const removed = removeAuthReference(spec, {
-        kind: selected.kind,
-        key: selected.key
-    });
-    if (!removed) {
-        process.stdout.write(`No auth binding found for ${selected.kind}:${selected.key}.\n`);
-        return;
-    }
-    const secretName = secretRefName(removed);
-    if (secretName) {
-        const shouldDelete = (await promptLine(rl, `Delete keychain secret "${secretName}" too? (y/N): `)).toLowerCase();
-        if (shouldDelete === "y" || shouldDelete === "yes") {
-            new SecretsManager().removeSecret(secretName);
-            process.stdout.write(`Removed binding and deleted ${secretName}.\n`);
-        }
-        else {
-            process.stdout.write("Removed binding.\n");
-        }
-    }
-    else {
-        process.stdout.write("Removed inline binding.\n");
-    }
-    saveConfig(config);
+  const config = loadConfig();
+  const spec = getServerSpecOrThrow(config, serverName);
+  const bindings = listAuthBindings(spec).map((binding) => ({
+    kind: binding.kind,
+    key: binding.key,
+    value: binding.value,
+    secretName: secretRefName(binding.value) ?? undefined
+  }));
+  const selected = await chooseAuthBinding(rl, bindings, "Choose binding to clear");
+  if (!selected) {
+    process.stdout.write(`No auth binding selected.
+`);
+    return;
+  }
+  const removed = removeAuthReference(spec, {
+    kind: selected.kind,
+    key: selected.key
+  });
+  if (!removed) {
+    process.stdout.write(`No auth binding found for ${selected.kind}:${selected.key}.
+`);
+    return;
+  }
+  const secretName = secretRefName(removed);
+  if (secretName) {
+    const shouldDelete = (await promptLine(rl, `Delete keychain secret "${secretName}" too? (y/N): `)).toLowerCase();
+    if (shouldDelete === "y" || shouldDelete === "yes") {
+      new SecretsManager().removeSecret(secretName);
+      process.stdout.write(`Removed binding and deleted ${secretName}.
+`);
+    } else {
+      process.stdout.write(`Removed binding.
+`);
+    }
+  } else {
+    process.stdout.write(`Removed inline binding.
+`);
+  }
+  saveConfig(config);
 }
 async function reconnectGatewayAndSync() {
-    const config = loadConfig();
-    const secrets = new SecretsManager();
-    const restart = await restartDaemon(config, process.argv[1] ?? "", secrets);
-    process.stdout.write(`${restart.message} pid=${restart.pid} port=${restart.port}\n`);
-    const summary = syncAllClients(config, secrets);
-    printSyncSummary(summary, false);
+  const config = loadConfig();
+  const secrets = new SecretsManager;
+  const restart = await restartDaemon(config, process.argv[1] ?? "", secrets);
+  process.stdout.write(`${restart.message} pid=${restart.pid} port=${restart.port}
+`);
+  const summary = syncAllClients(config, secrets);
+  printSyncSummary(summary, false);
 }
 async function setServerEnabledInteractively(rl, serverName, enabled) {
-    const action = enabled ? "enable" : "disable";
-    const confirmation = await promptLine(rl, `Type "${serverName}" to ${action} this MCP (blank to cancel): `);
-    if (confirmation !== serverName) {
-        process.stdout.write("Cancelled.\n");
-        return false;
-    }
-    const config = loadConfig();
-    setServerEnabled(config, serverName, enabled);
-    saveConfig(config);
-    process.stdout.write(`${enabled ? "Enabled" : "Disabled"} server: ${serverName}\n`);
-    process.stdout.write("Auto-syncing managed gateway entries across all supported clients...\n");
-    await autoSyncManagedEntries(config);
-    return true;
+  const action = enabled ? "enable" : "disable";
+  const confirmation = await promptLine(rl, `Type "${serverName}" to ${action} this MCP (blank to cancel): `);
+  if (confirmation !== serverName) {
+    process.stdout.write(`Cancelled.
+`);
+    return false;
+  }
+  const config = loadConfig();
+  setServerEnabled(config, serverName, enabled);
+  saveConfig(config);
+  process.stdout.write(`${enabled ? "Enabled" : "Disabled"} server: ${serverName}
+`);
+  process.stdout.write(`Auto-syncing managed gateway entries across all supported clients...
+`);
+  await autoSyncManagedEntries(config);
+  return true;
 }
 function buildServerActionTitle(server) {
-    const lines = [
-        `${serverHealthEmoji(server)} ${server.name} MCP Server`,
-        `State: ${server.enabled ? "enabled" : "disabled"}`,
-        `Transport: ${server.transport}`,
-        `Target: ${server.target}`,
-        "Synced configs:"
-    ];
-    if (server.authBindings.length > 0) {
-        lines.splice(3, 0, `Auth: 🔐 ${formatAuthSummary(server.authBindings)}`);
-    }
-    const synced = listSyncedClientLabels(server);
-    if (synced.length === 0) {
-        lines.push("  - ⚠️ none");
-    }
-    else {
-        for (const entry of synced) {
-            lines.push(`  - ${entry}`);
-        }
+  const lines = [
+    `${serverHealthEmoji(server)} ${server.name} MCP Server`,
+    `State: ${server.enabled ? "enabled" : "disabled"}`,
+    `Transport: ${server.transport}`,
+    `Target: ${server.target}`,
+    "Synced configs:"
+  ];
+  if (server.authBindings.length > 0) {
+    lines.splice(3, 0, `Auth: \uD83D\uDD10 ${formatAuthSummary(server.authBindings)}`);
+  }
+  const synced = listSyncedClientLabels(server);
+  if (synced.length === 0) {
+    lines.push("  - ⚠️ none");
+  } else {
+    for (const entry of synced) {
+      lines.push(`  - ${entry}`);
     }
-    return lines;
+  }
+  return lines;
 }
 function buildServerMenuDetail(server) {
-    if (!server.enabled) {
-        return "⏸️ disabled";
-    }
-    const managed = server.clients.filter((client) => client.managed);
-    const errorCount = managed.filter((client) => client.status === "ERROR").length;
-    const syncSummary = managed.length > 0
-        ? `✅ ${managed.length} synced config${managed.length === 1 ? "" : "s"}`
-        : "⚠️ not synced";
-    const errorSummary = errorCount > 0 ? ` • ❌ ${errorCount} error` : "";
-    const authSummary = server.authBindings.length > 0 ? "🔐 auth configured • " : "";
-    return `${authSummary}${syncSummary}${errorSummary}`;
+  if (!server.enabled) {
+    return "⏸️ disabled";
+  }
+  const managed = server.clients.filter((client) => client.managed);
+  const errorCount = managed.filter((client) => client.status === "ERROR").length;
+  const syncSummary = managed.length > 0 ? `✅ ${managed.length} synced config${managed.length === 1 ? "" : "s"}` : "⚠️ not synced";
+  const errorSummary = errorCount > 0 ? ` • ❌ ${errorCount} error` : "";
+  const authSummary = server.authBindings.length > 0 ? "\uD83D\uDD10 auth configured • " : "";
+  return `${authSummary}${syncSummary}${errorSummary}`;
 }
 async function runServerActionsMenu(rl, serverName) {
-    while (true) {
-        const report = loadStatusReport();
-        const server = report.servers.find((entry) => entry.name === serverName);
-        if (!server) {
-            process.stdout.write(`Server "${serverName}" no longer exists.\n`);
-            return;
-        }
-        const action = await promptMenuSelection(rl, buildServerActionTitle(server), [
-            { label: "🔐 Configure auth", detail: "Set or update auth binding for this MCP." },
-            { label: "♻️ Re-authenticate", detail: "Replace token for an existing auth binding." },
-            { label: "🧹 Clear authentication", detail: "Remove a specific auth binding." },
-            { label: server.enabled ? "⏸️ Disable" : "▶️ Enable", detail: "Toggle this MCP across mcpx and all synced clients." },
-            { label: "🔄 Reconnect", detail: "Restart daemon and sync all managed client entries." },
-            { label: "← Back", detail: "Return to MCP list." }
-        ], "q");
-        if (action === null || action === 5) {
-            return;
-        }
-        try {
-            if (action === 0) {
-                await configureServerAuthInteractively(rl, serverName, false);
-            }
-            else if (action === 1) {
-                await configureServerAuthInteractively(rl, serverName, true);
-            }
-            else if (action === 2) {
-                await clearServerAuthInteractively(rl, serverName);
-            }
-            else if (action === 3) {
-                const updated = await setServerEnabledInteractively(rl, serverName, !server.enabled);
-                if (updated) {
-                    return;
-                }
-            }
-            else if (action === 4) {
-                await reconnectGatewayAndSync();
-            }
-        }
-        catch (error) {
-            process.stdout.write(`${error.message}\n`);
-        }
-        await promptLine(rl, "Press Enter to continue...");
+  while (true) {
+    const report = loadStatusReport();
+    const server = report.servers.find((entry) => entry.name === serverName);
+    if (!server) {
+      process.stdout.write(`Server "${serverName}" no longer exists.
+`);
+      return;
+    }
+    const action = await promptMenuSelection(rl, buildServerActionTitle(server), [
+      { label: "\uD83D\uDD10 Configure auth", detail: "Set or update auth binding for this MCP." },
+      { label: "♻️ Re-authenticate", detail: "Replace token for an existing auth binding." },
+      { label: "\uD83E\uDDF9 Clear authentication", detail: "Remove a specific auth binding." },
+      { label: server.enabled ? "⏸️ Disable" : "▶️ Enable", detail: "Toggle this MCP across mcpx and all synced clients." },
+      { label: "\uD83D\uDD04 Reconnect", detail: "Restart daemon and sync all managed client entries." },
+      { label: "← Back", detail: "Return to MCP list." }
+    ], "q");
+    if (action === null || action === 5) {
+      return;
     }
+    try {
+      if (action === 0) {
+        await configureServerAuthInteractively(rl, serverName, false);
+      } else if (action === 1) {
+        await configureServerAuthInteractively(rl, serverName, true);
+      } else if (action === 2) {
+        await clearServerAuthInteractively(rl, serverName);
+      } else if (action === 3) {
+        const updated = await setServerEnabledInteractively(rl, serverName, !server.enabled);
+        if (updated) {
+          return;
+        }
+      } else if (action === 4) {
+        await reconnectGatewayAndSync();
+      }
+    } catch (error) {
+      process.stdout.write(`${error.message}
+`);
+    }
+    await promptLine(rl, "Press Enter to continue...");
+  }
 }
 async function runInteractiveStatusMenu() {
-    const rl = createInterface({
-        input: process.stdin,
-        output: process.stdout
-    });
-    try {
-        while (true) {
-            const report = loadStatusReport();
-            if (report.servers.length === 0) {
-                clearTerminalScreen();
-                process.stdout.write("mcpx status\n");
-                process.stdout.write(`Gateway: ${report.gatewayUrl}\n`);
-                process.stdout.write(`Daemon: ${daemonEmoji(report.daemon.running)} ${formatDaemonState(report.daemon)}\n`);
-                process.stdout.write("⚠️ No upstream servers configured.\n");
-                return;
-            }
-            const selection = await promptMenuSelection(rl, [
-                "mcpx status",
-                `Gateway: ${report.gatewayUrl}`,
-                `Daemon: ${daemonEmoji(report.daemon.running)} ${formatDaemonState(report.daemon)}`,
-                `MCP servers: ${report.upstreamCount}`,
-                "Choose an MCP to manage:"
-            ], report.servers.map((server) => ({
-                label: `${serverHealthEmoji(server)} ${server.name} (${server.transport})`,
-                detail: buildServerMenuDetail(server)
-            })), "q");
-            if (selection === null) {
-                return;
-            }
-            const server = report.servers[selection];
-            if (!server) {
-                continue;
-            }
-            await runServerActionsMenu(rl, server.name);
-        }
-    }
-    finally {
-        rl.close();
-    }
+  const rl = createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+  try {
+    while (true) {
+      const report = loadStatusReport();
+      if (report.servers.length === 0) {
+        clearTerminalScreen();
+        process.stdout.write(`mcpx status
+`);
+        process.stdout.write(`Gateway: ${report.gatewayUrl}
+`);
+        process.stdout.write(`Daemon: ${daemonEmoji(report.daemon.running)} ${formatDaemonState(report.daemon)}
+`);
+        process.stdout.write(`⚠️ No upstream servers configured.
+`);
+        return;
+      }
+      const selection = await promptMenuSelection(rl, [
+        "mcpx status",
+        `Gateway: ${report.gatewayUrl}`,
+        `Daemon: ${daemonEmoji(report.daemon.running)} ${formatDaemonState(report.daemon)}`,
+        `MCP servers: ${report.upstreamCount}`,
+        "Choose an MCP to manage:"
+      ], report.servers.map((server2) => ({
+        label: `${serverHealthEmoji(server2)} ${server2.name} (${server2.transport})`,
+        detail: buildServerMenuDetail(server2)
+      })), "q");
+      if (selection === null) {
+        return;
+      }
+      const server = report.servers[selection];
+      if (!server) {
+        continue;
+      }
+      await runServerActionsMenu(rl, server.name);
+    }
+  } finally {
+    rl.close();
+  }
 }
 function registerEnabledCommand(parent, enabled) {
-    parent
-        .command(enabled ? "enable <name>" : "disable <name>")
-        .description(`${enabled ? "Enable" : "Disable"} an upstream MCP server`)
-        .action(async (name) => {
-        const config = loadConfig();
-        setServerEnabled(config, name, enabled);
-        saveConfig(config);
-        process.stdout.write(`${enabled ? "Enabled" : "Disabled"} server: ${name}\n`);
-        process.stdout.write("Auto-syncing managed gateway entries across all supported clients...\n");
-        await autoSyncManagedEntries(config);
-    });
+  parent.command(enabled ? "enable <name>" : "disable <name>").description(`${enabled ? "Enable" : "Disable"} an upstream MCP server`).action(async (name) => {
+    const config = loadConfig();
+    setServerEnabled(config, name, enabled);
+    saveConfig(config);
+    process.stdout.write(`${enabled ? "Enabled" : "Disabled"} server: ${name}
+`);
+    process.stdout.write(`Auto-syncing managed gateway entries across all supported clients...
+`);
+    await autoSyncManagedEntries(config);
+  });
 }
 function registerAddCommand(parent) {
-    parent
-        .command("add [values...]")
-        .allowUnknownOption(true)
-        .option("--transport <transport>", "MCP transport (auto|http|stdio)", "auto")
-        .option("--header <header>", "Header entry in KEY=VALUE form", (value, previous = []) => [...previous, value], [])
-        .option("--env <env>", "Env entry in KEY=VALUE form for stdio upstreams", (value, previous = []) => [...previous, value], [])
-        .option("--cwd <cwd>", "Working directory for stdio upstream")
-        .option("--force", "Overwrite existing server with same name")
-        .description("Add an upstream MCP server")
-        .action(async (values, options) => {
-        const config = loadConfig();
-        const parsed = parseAddServerSpec(values ?? [], options);
-        addServer(config, parsed.name, parsed.spec, options.force ?? false);
-        await maybeAutoConfigureAuthForAddedServer(parsed.name, parsed.spec, new SecretsManager());
-        saveConfig(config);
-        process.stdout.write(`Added server: ${parsed.name} (${parsed.spec.transport})\n`);
-        process.stdout.write("Auto-syncing managed gateway entries across all supported clients...\n");
-        await autoSyncManagedEntries(config);
-    });
+  parent.command("add [values...]").allowUnknownOption(true).option("--transport <transport>", "MCP transport (auto|http|stdio)", "auto").option("--header <header>", "Header entry in KEY=VALUE form", (value, previous = []) => [...previous, value], []).option("--env <env>", "Env entry in KEY=VALUE form for stdio upstreams", (value, previous = []) => [...previous, value], []).option("--cwd <cwd>", "Working directory for stdio upstream").option("--force", "Overwrite existing server with same name").description("Add an upstream MCP server").action(async (values, options) => {
+    const config = loadConfig();
+    const parsed = parseAddServerSpec(values ?? [], options);
+    addServer(config, parsed.name, parsed.spec, options.force ?? false);
+    await maybeAutoConfigureAuthForAddedServer(parsed.name, parsed.spec, new SecretsManager);
+    saveConfig(config);
+    process.stdout.write(`Added server: ${parsed.name} (${parsed.spec.transport})
+`);
+    process.stdout.write(`Auto-syncing managed gateway entries across all supported clients...
+`);
+    await autoSyncManagedEntries(config);
+  });
 }
 function registerRemoveCommand(parent) {
-    parent
-        .command("remove <name>")
-        .option("--force", "Do not error if server does not exist")
-        .description("Remove an upstream MCP server")
-        .action(async (name, options) => {
-        const config = loadConfig();
-        removeServer(config, name, options.force ?? false);
-        saveConfig(config);
-        process.stdout.write(`Removed server: ${name}\n`);
-        process.stdout.write("Auto-syncing managed gateway entries across all supported clients...\n");
-        await autoSyncManagedEntries(config);
-    });
+  parent.command("remove <name>").option("--force", "Do not error if server does not exist").description("Remove an upstream MCP server").action(async (name, options) => {
+    const config = loadConfig();
+    removeServer(config, name, options.force ?? false);
+    saveConfig(config);
+    process.stdout.write(`Removed server: ${name}
+`);
+    process.stdout.write(`Auto-syncing managed gateway entries across all supported clients...
+`);
+    await autoSyncManagedEntries(config);
+  });
 }
 function registerListCommand(parent) {
-    parent
-        .command("list")
-        .option("--json", "Output JSON")
-        .description("List configured upstream MCP servers")
-        .action((options) => {
-        const config = loadConfig();
-        const servers = Object.entries(config.servers).map(([name, spec]) => ({ name, ...spec }));
-        if (options.json) {
-            process.stdout.write(`${JSON.stringify({ servers }, null, 2)}\n`);
-            return;
-        }
-        if (servers.length === 0) {
-            process.stdout.write("No upstream servers configured.\n");
-            return;
-        }
-        for (const server of servers) {
-            const state = isServerEnabled(server) ? "enabled" : "disabled";
-            if (server.transport === "http") {
-                process.stdout.write(`- ${server.name} (${state}, http) ${server.url}\n`);
-            }
-            else {
-                const args = (server.args ?? []).join(" ");
-                process.stdout.write(`- ${server.name} (${state}, stdio) ${server.command}${args ? ` ${args}` : ""}\n`);
-            }
-        }
-    });
+  parent.command("list").option("--json", "Output JSON").description("List configured upstream MCP servers").action((options) => {
+    const config = loadConfig();
+    const servers = Object.entries(config.servers).map(([name, spec]) => ({ name, ...spec }));
+    if (options.json) {
+      process.stdout.write(`${JSON.stringify({ servers }, null, 2)}
+`);
+      return;
+    }
+    if (servers.length === 0) {
+      process.stdout.write(`No upstream servers configured.
+`);
+      return;
+    }
+    for (const server of servers) {
+      const state = isServerEnabled(server) ? "enabled" : "disabled";
+      if (server.transport === "http") {
+        process.stdout.write(`- ${server.name} (${state}, http) ${server.url}
+`);
+      } else {
+        const args = (server.args ?? []).join(" ");
+        process.stdout.write(`- ${server.name} (${state}, stdio) ${server.command}${args ? ` ${args}` : ""}
+`);
+      }
+    }
+  });
 }
 function registerSyncCommand(program) {
-    program
-        .command("sync [clients...]")
-        .option("--client <id>", "Limit sync to specific client(s), comma-separated or repeated", (value, prev = []) => [...prev, value], [])
-        .option("--json", "Output JSON")
-        .description("Sync gateway configuration to supported clients (e.g. `mcpx sync claude`)")
-        .action(async (clients, options) => {
-        const config = loadConfig();
-        const targetClients = parseClientList([...(clients ?? []), ...(options.client ?? [])]);
-        const secrets = new SecretsManager();
-        await ensureDaemonIfEnabled(process.argv[1] ?? "", secrets);
-        const summary = syncAllClients(config, secrets, targetClients);
-        printSyncSummary(summary, options.json ?? false);
-        ensureExitCodeForSyncFailures(summary.hasErrors);
-    });
+  program.command("sync [clients...]").option("--client <id>", "Limit sync to specific client(s), comma-separated or repeated", (value, prev = []) => [...prev, value], []).option("--json", "Output JSON").description("Sync gateway configuration to supported clients (e.g. `mcpx sync claude`)").action(async (clients, options) => {
+    const config = loadConfig();
+    const targetClients = parseClientList([...clients ?? [], ...options.client ?? []]);
+    const secrets = new SecretsManager;
+    await ensureDaemonIfEnabled(process.argv[1] ?? "", secrets);
+    const summary = syncAllClients(config, secrets, targetClients);
+    printSyncSummary(summary, options.json ?? false);
+    ensureExitCodeForSyncFailures(summary.hasErrors);
+  });
 }
 function registerStatusCommand(program) {
-    program
-        .command("status")
-        .option("--no-interactive", "Disable interactive status menu")
-        .option("--json", "Output JSON")
-        .description("Show gateway, daemon, MCP inventory, and client sync status")
-        .action(async (options) => {
-        const report = loadStatusReport();
-        if (options.json) {
-            process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
-            return;
-        }
-        const interactive = (options.interactive ?? true) && process.stdin.isTTY && process.stdout.isTTY;
-        if (interactive) {
-            await runInteractiveStatusMenu();
-            return;
-        }
-        printStatusReportText(report);
-    });
+  program.command("status").option("--no-interactive", "Disable interactive status menu").option("--json", "Output JSON").description("Show gateway, daemon, MCP inventory, and client sync status").action(async (options) => {
+    const report = loadStatusReport();
+    if (options.json) {
+      process.stdout.write(`${JSON.stringify(report, null, 2)}
+`);
+      return;
+    }
+    const interactive = (options.interactive ?? true) && process.stdin.isTTY && process.stdout.isTTY;
+    if (interactive) {
+      await runInteractiveStatusMenu();
+      return;
+    }
+    printStatusReportText(report);
+  });
 }
 function registerDoctorCommand(program) {
-    program
-        .command("doctor")
-        .option("--json", "Output JSON")
-        .description("Run local health checks")
-        .action((options) => {
-        const config = loadConfig();
-        const adapters = getAdapters();
-        const checks = [];
-        checks.push({
-            check: "config_path",
-            status: fs.existsSync(getConfigPath()) ? "ok" : "warn",
-            details: getConfigPath()
-        });
-        checks.push({
-            check: "managed_index_path",
-            status: fs.existsSync(getManagedIndexPath()) ? "ok" : "warn",
-            details: getManagedIndexPath()
-        });
-        if (process.platform === "darwin") {
-            try {
-                execFileSync("security", ["help"], { stdio: "ignore" });
-                checks.push({ check: "macos_keychain", status: "ok", details: "security CLI available" });
-            }
-            catch {
-                checks.push({ check: "macos_keychain", status: "fail", details: "security CLI unavailable" });
-            }
-        }
-        else {
-            checks.push({ check: "macos_keychain", status: "warn", details: "Non-macOS platform; keychain integration unavailable" });
-        }
-        const daemon = getDaemonStatus(config);
+  program.command("doctor").option("--json", "Output JSON").description("Run local health checks").action((options) => {
+    const config = loadConfig();
+    const adapters = getAdapters();
+    const checks = [];
+    checks.push({
+      check: "config_path",
+      status: fs.existsSync(getConfigPath()) ? "ok" : "warn",
+      details: getConfigPath()
+    });
+    checks.push({
+      check: "managed_index_path",
+      status: fs.existsSync(getManagedIndexPath()) ? "ok" : "warn",
+      details: getManagedIndexPath()
+    });
+    if (process.platform === "darwin") {
+      try {
+        execFileSync("security", ["help"], { stdio: "ignore" });
+        checks.push({ check: "macos_keychain", status: "ok", details: "security CLI available" });
+      } catch {
+        checks.push({ check: "macos_keychain", status: "fail", details: "security CLI unavailable" });
+      }
+    } else {
+      checks.push({ check: "macos_keychain", status: "warn", details: "Non-macOS platform; keychain integration unavailable" });
+    }
+    const daemon = getDaemonStatus(config);
+    checks.push({
+      check: "daemon",
+      status: daemon.running ? "ok" : "warn",
+      details: daemon.running ? `pid ${daemon.pid}` : "not running"
+    });
+    for (const adapter of adapters) {
+      const configPath = adapter.detectConfigPath();
+      if (!configPath) {
         checks.push({
-            check: "daemon",
-            status: daemon.running ? "ok" : "warn",
-            details: daemon.running ? `pid ${daemon.pid}` : "not running"
+          check: `client_${adapter.id}`,
+          status: "warn",
+          details: "no known config path"
         });
-        for (const adapter of adapters) {
-            const configPath = adapter.detectConfigPath();
-            if (!configPath) {
-                checks.push({
-                    check: `client_${adapter.id}`,
-                    status: "warn",
-                    details: "no known config path"
-                });
-                continue;
-            }
-            checks.push({
-                check: `client_${adapter.id}`,
-                status: adapter.supportsHttp() ? "ok" : "warn",
-                details: `${configPath}${adapter.supportsHttp() ? "" : " (HTTP unsupported)"}`
-            });
-        }
-        if (options.json) {
-            process.stdout.write(`${JSON.stringify({ checks }, null, 2)}\n`);
-            return;
-        }
-        for (const item of checks) {
-            process.stdout.write(`[${item.status.toUpperCase()}] ${item.check}: ${item.details}\n`);
-        }
-        if (checks.some((item) => item.status === "fail")) {
-            process.exitCode = 1;
-        }
-    });
+        continue;
+      }
+      checks.push({
+        check: `client_${adapter.id}`,
+        status: adapter.supportsHttp() ? "ok" : "warn",
+        details: `${configPath}${adapter.supportsHttp() ? "" : " (HTTP unsupported)"}`
+      });
+    }
+    if (options.json) {
+      process.stdout.write(`${JSON.stringify({ checks }, null, 2)}
+`);
+      return;
+    }
+    for (const item of checks) {
+      process.stdout.write(`[${item.status.toUpperCase()}] ${item.check}: ${item.details}
+`);
+    }
+    if (checks.some((item) => item.status === "fail")) {
+      process.exitCode = 1;
+    }
+  });
 }
 function registerDaemonCommands(program) {
-    const daemon = program.command("daemon").description("Manage mcpx local gateway daemon");
-    daemon
-        .command("start")
-        .description("Start background daemon")
-        .action(async () => {
-        const config = loadConfig();
-        const result = await startDaemon(config, process.argv[1] ?? "", new SecretsManager());
-        process.stdout.write(`${result.message} pid=${result.pid} port=${result.port}\n`);
-    });
-    daemon
-        .command("stop")
-        .description("Stop background daemon")
-        .action(() => {
-        const result = stopDaemon();
-        process.stdout.write(`${result.message}\n`);
-    });
-    daemon
-        .command("restart")
-        .description("Restart background daemon")
-        .action(async () => {
-        const config = loadConfig();
-        const result = await restartDaemon(config, process.argv[1] ?? "", new SecretsManager());
-        process.stdout.write(`mcpx daemon restarted. pid=${result.pid} port=${result.port}\n`);
-    });
-    daemon
-        .command("status")
-        .description("Show daemon status")
-        .action(() => {
-        const status = getDaemonStatus(loadConfig());
-        if (status.running) {
-            process.stdout.write(`running pid=${status.pid} port=${status.port}\n`);
-        }
-        else {
-            process.stdout.write("stopped\n");
-        }
-    });
-    daemon
-        .command("logs")
-        .option("--lines <n>", "Number of lines", "200")
-        .description("Show recent daemon logs")
-        .action((options) => {
-        const lines = Number(options.lines);
-        process.stdout.write(`${readDaemonLogs(Number.isFinite(lines) ? lines : 200)}\n`);
-    });
-    daemon
-        .command("run")
-        .option("--port <port>", "Port override")
-        .description("Run gateway in foreground (used by daemon manager)")
-        .action(async (options) => {
-        const config = loadConfig();
-        const port = options.port ? Number(options.port) : config.gateway.port;
-        if (!Number.isFinite(port) || port < 1 || port > 65535) {
-            throw new Error(`Invalid port: ${options.port}`);
-        }
-        process.stdout.write(`Starting mcpx gateway on http://127.0.0.1:${port}/mcp\n`);
-        await runDaemonForeground(config, port, new SecretsManager());
-    });
+  const daemon = program.command("daemon").description("Manage mcpx local gateway daemon");
+  daemon.command("start").description("Start background daemon").action(async () => {
+    const config = loadConfig();
+    const result = await startDaemon(config, process.argv[1] ?? "", new SecretsManager);
+    process.stdout.write(`${result.message} pid=${result.pid} port=${result.port}
+`);
+  });
+  daemon.command("stop").description("Stop background daemon").action(() => {
+    const result = stopDaemon();
+    process.stdout.write(`${result.message}
+`);
+  });
+  daemon.command("restart").description("Restart background daemon").action(async () => {
+    const config = loadConfig();
+    const result = await restartDaemon(config, process.argv[1] ?? "", new SecretsManager);
+    process.stdout.write(`mcpx daemon restarted. pid=${result.pid} port=${result.port}
+`);
+  });
+  daemon.command("status").description("Show daemon status").action(() => {
+    const status = getDaemonStatus(loadConfig());
+    if (status.running) {
+      process.stdout.write(`running pid=${status.pid} port=${status.port}
+`);
+    } else {
+      process.stdout.write(`stopped
+`);
+    }
+  });
+  daemon.command("logs").option("--lines <n>", "Number of lines", "200").description("Show recent daemon logs").action((options) => {
+    const lines = Number(options.lines);
+    process.stdout.write(`${readDaemonLogs(Number.isFinite(lines) ? lines : 200)}
+`);
+  });
+  daemon.command("run").option("--port <port>", "Port override").description("Run gateway in foreground (used by daemon manager)").action(async (options) => {
+    const config = loadConfig();
+    const port = options.port ? Number(options.port) : config.gateway.port;
+    if (!Number.isFinite(port) || port < 1 || port > 65535) {
+      throw new Error(`Invalid port: ${options.port}`);
+    }
+    process.stdout.write(`Starting mcpx gateway on http://127.0.0.1:${port}/mcp
+`);
+    await runDaemonForeground(config, port, new SecretsManager);
+  });
 }
 function registerSecretsCommands(program) {
-    const secret = program.command("secret").description("Manage keychain-backed secrets");
-    secret
-        .command("set <name>")
-        .option("--value <value>", "Secret value")
-        .description("Set secret in OS keychain")
-        .action((name, options) => {
-        const value = options.value ?? readSecretValueFromStdin();
-        new SecretsManager().setSecret(name, value);
-        process.stdout.write(`Secret set: ${name}\n`);
-    });
-    secret
-        .command("rm <name>")
-        .description("Remove secret from OS keychain")
-        .action((name) => {
-        new SecretsManager().removeSecret(name);
-        process.stdout.write(`Secret removed: ${name}\n`);
-    });
-    secret
-        .command("ls")
-        .description("List secret names tracked by mcpx")
-        .action(() => {
-        const names = new SecretsManager().listSecretNames();
-        if (names.length === 0) {
-            process.stdout.write("No tracked secrets.\n");
-            return;
-        }
-        for (const name of names) {
-            process.stdout.write(`${name}\n`);
-        }
-    });
+  const secret = program.command("secret").description("Manage keychain-backed secrets");
+  secret.command("set <name>").option("--value <value>", "Secret value").description("Set secret in OS keychain").action((name, options) => {
+    const value = options.value ?? readSecretValueFromStdin();
+    new SecretsManager().setSecret(name, value);
+    process.stdout.write(`Secret set: ${name}
+`);
+  });
+  secret.command("rm <name>").description("Remove secret from OS keychain").action((name) => {
+    new SecretsManager().removeSecret(name);
+    process.stdout.write(`Secret removed: ${name}
+`);
+  });
+  secret.command("ls").description("List secret names tracked by mcpx").action(() => {
+    const names = new SecretsManager().listSecretNames();
+    if (names.length === 0) {
+      process.stdout.write(`No tracked secrets.
+`);
+      return;
+    }
+    for (const name of names) {
+      process.stdout.write(`${name}
+`);
+    }
+  });
 }
 function registerAuthCommands(program) {
-    const auth = program.command("auth").description("Auth utilities");
-    auth
-        .command("set <server>")
-        .option("--header <name>", "HTTP header name (default for HTTP servers: Authorization)")
-        .option("--env <name>", "Env var name (required for stdio servers)")
-        .option("--value <value>", "Auth value/token (if omitted, read from stdin)")
-        .option("--secret-name <name>", "Override keychain secret name")
-        .option("--raw", "Do not auto-prefix Authorization values with Bearer")
-        .description("Store auth in keychain and bind it to an upstream server")
-        .action((server, options) => {
-        const config = loadConfig();
-        const spec = getServerSpecOrThrow(config, server);
-        const target = resolveAuthTarget(spec, options.header, options.env);
-        const provided = options.value ?? readSecretValueFromStdin();
-        const authValue = maybePrefixBearer(target, provided, options.raw ?? false);
-        const secretName = options.secretName?.trim() || defaultAuthSecretName(server, target);
-        const secrets = new SecretsManager();
-        secrets.setSecret(secretName, authValue);
-        applyAuthReference(spec, target, toSecretRef(secretName));
-        saveConfig(config);
-        process.stdout.write(`Configured auth for server "${server}" via ${target.kind} "${target.key}".\n`);
-        process.stdout.write(`Stored secret: ${secretName}\n`);
-    });
-    auth
-        .command("rm <server>")
-        .option("--header <name>", "HTTP header name (default for HTTP servers: Authorization)")
-        .option("--env <name>", "Env var name (required for stdio servers)")
-        .option("--delete-secret", "Delete referenced keychain secret when removing binding")
-        .description("Remove auth binding from an upstream server")
-        .action((server, options) => {
-        const config = loadConfig();
-        const spec = getServerSpecOrThrow(config, server);
-        const target = resolveAuthTarget(spec, options.header, options.env);
-        const removedValue = removeAuthReference(spec, target);
-        if (!removedValue) {
-            process.stdout.write(`No auth binding found for server "${server}" at ${target.kind} "${target.key}".\n`);
-            return;
-        }
-        if (options.deleteSecret) {
-            const secretName = secretRefName(removedValue);
-            if (secretName) {
-                new SecretsManager().removeSecret(secretName);
-                process.stdout.write(`Removed binding and deleted secret: ${secretName}\n`);
-            }
-            else {
-                process.stdout.write("Removed binding. Value was inline (no keychain secret deleted).\n");
-            }
-        }
-        else {
-            process.stdout.write("Removed binding.\n");
-        }
-        saveConfig(config);
-    });
-    auth
-        .command("show [server]")
-        .option("--json", "Output JSON")
-        .description("Show configured upstream auth bindings (secret refs only, values redacted)")
-        .action((server, options) => {
-        const config = loadConfig();
-        const names = server ? [server] : Object.keys(config.servers);
-        const output = names.map((name) => {
-            const spec = getServerSpecOrThrow(config, name);
-            const bindings = listAuthBindings(spec).map((binding) => ({
-                kind: binding.kind,
-                key: binding.key,
-                value: redactAuthValue(binding.value)
-            }));
-            return {
-                server: name,
-                transport: spec.transport,
-                bindings
-            };
-        });
-        if (options.json) {
-            process.stdout.write(`${JSON.stringify({ auth: output }, null, 2)}\n`);
-            return;
-        }
-        if (output.length === 0) {
-            process.stdout.write("No upstream servers configured.\n");
-            return;
-        }
-        for (const serverEntry of output) {
-            process.stdout.write(`- ${serverEntry.server} (${serverEntry.transport})\n`);
-            if (serverEntry.bindings.length === 0) {
-                process.stdout.write("  (no auth bindings)\n");
-                continue;
-            }
-            for (const binding of serverEntry.bindings) {
-                process.stdout.write(`  ${binding.kind}:${binding.key} = ${binding.value}\n`);
-            }
-        }
-    });
-    auth
-        .command("rotate-local-token")
-        .description("Rotate bearer token used for local client->mcpx auth")
-        .action(async () => {
-        const secrets = new SecretsManager();
-        secrets.rotateLocalToken("local_gateway_token");
-        const config = loadConfig();
-        await restartDaemon(config, process.argv[1] ?? "", secrets);
-        process.stdout.write("Rotated local gateway token and restarted daemon.\n");
-        process.stdout.write("No client configs were modified.\n");
-        process.stdout.write("Run `mcpx sync <client>` (or `mcpx sync`) to update managed `mcpx` entries with the new token.\n");
+  const auth = program.command("auth").description("Auth utilities");
+  auth.command("set <server>").option("--header <name>", "HTTP header name (default for HTTP servers: Authorization)").option("--env <name>", "Env var name (required for stdio servers)").option("--value <value>", "Auth value/token (if omitted, read from stdin)").option("--secret-name <name>", "Override keychain secret name").option("--raw", "Do not auto-prefix Authorization values with Bearer").description("Store auth in keychain and bind it to an upstream server").action((server, options) => {
+    const config = loadConfig();
+    const spec = getServerSpecOrThrow(config, server);
+    const target = resolveAuthTarget(spec, options.header, options.env);
+    const provided = options.value ?? readSecretValueFromStdin();
+    const authValue = maybePrefixBearer(target, provided, options.raw ?? false);
+    const secretName = options.secretName?.trim() || defaultAuthSecretName(server, target);
+    const secrets = new SecretsManager;
+    secrets.setSecret(secretName, authValue);
+    applyAuthReference(spec, target, toSecretRef(secretName));
+    saveConfig(config);
+    process.stdout.write(`Configured auth for server "${server}" via ${target.kind} "${target.key}".
+`);
+    process.stdout.write(`Stored secret: ${secretName}
+`);
+  });
+  auth.command("rm <server>").option("--header <name>", "HTTP header name (default for HTTP servers: Authorization)").option("--env <name>", "Env var name (required for stdio servers)").option("--delete-secret", "Delete referenced keychain secret when removing binding").description("Remove auth binding from an upstream server").action((server, options) => {
+    const config = loadConfig();
+    const spec = getServerSpecOrThrow(config, server);
+    const target = resolveAuthTarget(spec, options.header, options.env);
+    const removedValue = removeAuthReference(spec, target);
+    if (!removedValue) {
+      process.stdout.write(`No auth binding found for server "${server}" at ${target.kind} "${target.key}".
+`);
+      return;
+    }
+    if (options.deleteSecret) {
+      const secretName = secretRefName(removedValue);
+      if (secretName) {
+        new SecretsManager().removeSecret(secretName);
+        process.stdout.write(`Removed binding and deleted secret: ${secretName}
+`);
+      } else {
+        process.stdout.write(`Removed binding. Value was inline (no keychain secret deleted).
+`);
+      }
+    } else {
+      process.stdout.write(`Removed binding.
+`);
+    }
+    saveConfig(config);
+  });
+  auth.command("show [server]").option("--json", "Output JSON").description("Show configured upstream auth bindings (secret refs only, values redacted)").action((server, options) => {
+    const config = loadConfig();
+    const names = server ? [server] : Object.keys(config.servers);
+    const output = names.map((name) => {
+      const spec = getServerSpecOrThrow(config, name);
+      const bindings = listAuthBindings(spec).map((binding) => ({
+        kind: binding.kind,
+        key: binding.key,
+        value: redactAuthValue(binding.value)
+      }));
+      return {
+        server: name,
+        transport: spec.transport,
+        bindings
+      };
     });
+    if (options.json) {
+      process.stdout.write(`${JSON.stringify({ auth: output }, null, 2)}
+`);
+      return;
+    }
+    if (output.length === 0) {
+      process.stdout.write(`No upstream servers configured.
+`);
+      return;
+    }
+    for (const serverEntry of output) {
+      process.stdout.write(`- ${serverEntry.server} (${serverEntry.transport})
+`);
+      if (serverEntry.bindings.length === 0) {
+        process.stdout.write(`  (no auth bindings)
+`);
+        continue;
+      }
+      for (const binding of serverEntry.bindings) {
+        process.stdout.write(`  ${binding.kind}:${binding.key} = ${binding.value}
+`);
+      }
+    }
+  });
+  auth.command("rotate-local-token").description("Rotate bearer token used for local client->mcpx auth").action(async () => {
+    const secrets = new SecretsManager;
+    secrets.rotateLocalToken("local_gateway_token");
+    const config = loadConfig();
+    await restartDaemon(config, process.argv[1] ?? "", secrets);
+    process.stdout.write(`Rotated local gateway token and restarted daemon.
+`);
+    process.stdout.write(`No client configs were modified.
+`);
+    process.stdout.write("Run `mcpx sync <client>` (or `mcpx sync`) to update managed `mcpx` entries with the new token.\n");
+  });
 }
 function registerClientsCommands(program) {
-    const clients = program.command("clients").description("Client adapter utilities");
-    clients
-        .command("list")
-        .option("--json", "Output JSON")
-        .description("List supported clients and detected config paths")
-        .action((options) => {
-        const payload = getAdapters().map((adapter) => ({
-            id: adapter.id,
-            supportsHttp: adapter.supportsHttp(),
-            configPath: adapter.detectConfigPath()
-        }));
-        if (options.json) {
-            process.stdout.write(`${JSON.stringify({ clients: payload }, null, 2)}\n`);
-            return;
-        }
-        for (const client of payload) {
-            process.stdout.write(`- ${client.id}: ${client.supportsHttp ? "HTTP" : "NO_HTTP"} ${client.configPath ?? "(unknown path)"}\n`);
-        }
-    });
+  const clients = program.command("clients").description("Client adapter utilities");
+  clients.command("list").option("--json", "Output JSON").description("List supported clients and detected config paths").action((options) => {
+    const payload = getAdapters().map((adapter) => ({
+      id: adapter.id,
+      supportsHttp: adapter.supportsHttp(),
+      configPath: adapter.detectConfigPath()
+    }));
+    if (options.json) {
+      process.stdout.write(`${JSON.stringify({ clients: payload }, null, 2)}
+`);
+      return;
+    }
+    for (const client of payload) {
+      process.stdout.write(`- ${client.id}: ${client.supportsHttp ? "HTTP" : "NO_HTTP"} ${client.configPath ?? "(unknown path)"}
+`);
+    }
+  });
 }
 function registerUpdateCommand(program) {
-    const update = program.command("update").description("Check for and install updates");
-    update
-        .command("check")
-        .option("--json", "Output JSON")
-        .description("Check for available updates")
-        .action(async (options) => {
-        const status = await checkForUpdates();
-        if (options.json) {
-            process.stdout.write(`${JSON.stringify(status, null, 2)}\n`);
-            return;
-        }
-        process.stdout.write(`Current: ${status.currentVersion}\n`);
-        if (status.latestVersion) {
-            process.stdout.write(`Latest:  ${status.latestVersion}\n`);
-            if (status.updateAvailable) {
-                process.stdout.write("Status:  Update available. Run `mcpx update` to install.\n");
-            }
-            else {
-                process.stdout.write("Status:  Up to date.\n");
-            }
-        }
-        else {
-            process.stdout.write(`Status:  Unable to check for updates.${status.error ? ` (${status.error})` : ""}\n`);
-        }
-    });
-    update
-        .command("install")
-        .description("Download and stage the latest update")
-        .action(async () => {
-        process.stdout.write("Checking for updates...\n");
-        const result = await performUpdate();
-        process.stdout.write(`${result.message}\n`);
-        if (!result.success) {
-            process.exitCode = 1;
-        }
-    });
-    update
-        .command("rollback")
-        .description("Roll back to the previously installed version")
-        .action(() => {
-        const result = performRollback();
-        process.stdout.write(`${result.message}\n`);
-        if (!result.success) {
-            process.exitCode = 1;
-        }
-    });
-    update
-        .command("status")
-        .description("Show current update status")
-        .action(() => {
-        const staged = getStagedUpdate();
-        if (staged) {
-            process.stdout.write(`Staged version: ${staged.version}\n`);
-            process.stdout.write(`Staged at: ${staged.stagedAt}\n`);
-            process.stdout.write("Status: Will activate on next run.\n");
-        }
-        else {
-            process.stdout.write("No staged updates.\n");
-        }
-    });
+  const update = program.command("update").description("Check for and install updates");
+  update.command("check").option("--json", "Output JSON").description("Check for available updates").action(async (options) => {
+    const status = await checkForUpdates();
+    if (options.json) {
+      process.stdout.write(`${JSON.stringify(status, null, 2)}
+`);
+      return;
+    }
+    process.stdout.write(`Current: ${status.currentVersion}
+`);
+    if (status.latestVersion) {
+      process.stdout.write(`Latest:  ${status.latestVersion}
+`);
+      if (status.updateAvailable) {
+        process.stdout.write("Status:  Update available. Run `mcpx update` to install.\n");
+      } else {
+        process.stdout.write(`Status:  Up to date.
+`);
+      }
+    } else {
+      process.stdout.write(`Status:  Unable to check for updates.${status.error ? ` (${status.error})` : ""}
+`);
+    }
+  });
+  update.command("install").description("Download and stage the latest update").action(async () => {
+    process.stdout.write(`Checking for updates...
+`);
+    const result = await performUpdate();
+    process.stdout.write(`${result.message}
+`);
+    if (!result.success) {
+      process.exitCode = 1;
+    }
+  });
+  update.command("rollback").description("Roll back to the previously installed version").action(() => {
+    const result = performRollback();
+    process.stdout.write(`${result.message}
+`);
+    if (!result.success) {
+      process.exitCode = 1;
+    }
+  });
+  update.command("status").description("Show current update status").action(() => {
+    const staged = getStagedUpdate();
+    if (staged) {
+      process.stdout.write(`Staged version: ${staged.version}
+`);
+      process.stdout.write(`Staged at: ${staged.stagedAt}
+`);
+      process.stdout.write(`Status: Will activate on next run.
+`);
+    } else {
+      process.stdout.write(`No staged updates.
+`);
+    }
+  });
 }
 function registerMcpCompat(program) {
-    const mcp = program.command("mcp").description("Compatibility namespace for MCP commands");
-    registerAddCommand(mcp);
-    registerRemoveCommand(mcp);
-    registerEnabledCommand(mcp, true);
-    registerEnabledCommand(mcp, false);
-    registerListCommand(mcp);
-}
-export async function runCli(argv = process.argv) {
-    if (process.env.MCPX_UPDATE_CHILD === "1") {
-        await runBackgroundUpdate();
-        return;
-    }
-    const rawArgs = argv.slice(2);
-    const isUpdateCommand = rawArgs[0] === "update";
-    if (!isUpdateCommand) {
-        const stagedCliPath = getStagedCliPath();
-        const stagedInfo = getStagedUpdate();
-        if (stagedCliPath && stagedInfo && stagedCliPath !== argv[1]) {
-            execFileSync(process.execPath, [stagedCliPath, ...rawArgs], {
-                stdio: "inherit",
-                env: {
-                    ...process.env,
-                    MCPX_USING_STAGED: "1"
-                }
-            });
-            return;
-        }
-    }
-    // Check for client-native compatibility patterns before Commander parses
-    if (rawArgs.length > 0) {
-        const compat = parseCompatibilityArgs(rawArgs);
-        // If unsupported client detected, show error and exit
-        if (compat.error && compat.client !== null) {
-            process.stderr.write(`Error: ${compat.error}\n`);
-            process.exit(1);
-        }
-        // If valid compatibility command, normalize and inject into add flow
-        if (compat.normalizedArgs !== null) {
-            // Replace argv with normalized args for the add command
-            // mcpx add <normalizedArgs...>
-            argv = [argv[0], argv[1], "add", ...compat.normalizedArgs];
-        }
-    }
-    const program = new Command();
-    program.name("mcpx").description("HTTP-first MCP gateway and multi-client installer").version(APP_VERSION);
-    registerAddCommand(program);
-    registerRemoveCommand(program);
-    registerEnabledCommand(program, true);
-    registerEnabledCommand(program, false);
-    registerListCommand(program);
-    registerSyncCommand(program);
-    registerStatusCommand(program);
-    registerDoctorCommand(program);
-    registerDaemonCommands(program);
-    registerSecretsCommands(program);
-    registerAuthCommands(program);
-    registerClientsCommands(program);
-    registerMcpCompat(program);
-    registerUpdateCommand(program);
-    await program.parseAsync(argv);
+  const mcp = program.command("mcp").description("Compatibility namespace for MCP commands");
+  registerAddCommand(mcp);
+  registerRemoveCommand(mcp);
+  registerEnabledCommand(mcp, true);
+  registerEnabledCommand(mcp, false);
+  registerListCommand(mcp);
+}
+async function runCli(argv = process.argv) {
+  if (process.env.MCPX_UPDATE_CHILD === "1") {
+    await runBackgroundUpdate();
+    return;
+  }
+  const rawArgs = argv.slice(2);
+  const isUpdateCommand = rawArgs[0] === "update";
+  if (!isUpdateCommand) {
+    const stagedCliPath = getStagedCliPath();
+    const stagedInfo = getStagedUpdate();
+    if (stagedCliPath && stagedInfo && stagedCliPath !== argv[1]) {
+      execFileSync(process.execPath, [stagedCliPath, ...rawArgs], {
+        stdio: "inherit",
+        env: {
+          ...process.env,
+          MCPX_USING_STAGED: "1"
+        }
+      });
+      return;
+    }
+  }
+  if (rawArgs.length > 0) {
+    const compat = parseCompatibilityArgs(rawArgs);
+    if (compat.error && compat.client !== null) {
+      process.stderr.write(`Error: ${compat.error}
+`);
+      process.exit(1);
+    }
+    if (compat.normalizedArgs !== null) {
+      argv = [argv[0], argv[1], "add", ...compat.normalizedArgs];
+    }
+  }
+  const program = new Command;
+  program.name("mcpx").description("HTTP-first MCP gateway and multi-client installer").version(APP_VERSION);
+  registerAddCommand(program);
+  registerRemoveCommand(program);
+  registerEnabledCommand(program, true);
+  registerEnabledCommand(program, false);
+  registerListCommand(program);
+  registerSyncCommand(program);
+  registerStatusCommand(program);
+  registerDoctorCommand(program);
+  registerDaemonCommands(program);
+  registerSecretsCommands(program);
+  registerAuthCommands(program);
+  registerClientsCommands(program);
+  registerMcpCompat(program);
+  registerUpdateCommand(program);
+  await program.parseAsync(argv);
 }
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
-    void runCli().catch((error) => {
-        process.stderr.write(`${error.message}\n`);
-        process.exit(1);
-    });
+  runCli().catch((error) => {
+    process.stderr.write(`${error.message}
+`);
+    process.exit(1);
+  });
 }
-//# sourceMappingURL=cli.js.map
+export {
+  runCli
+};