@kwonye/mcpx 0.1.74 → 0.1.77

package/dist/cli.js

@@ -2,48 +2,71 @@
 import {
   APP_VERSION,
   STATUS_CLIENTS,
-  SecretsManager,
-  addServer,
   applyAuthReference,
   buildStatusReport,
   checkForUpdates,
   defaultAuthSecretName,
+  deleteSkill,
+  extractRequiredInputs,
+  fetchRegistryServerDetail,
   getAdapters,
-  getConfigPath,
   getDaemonStatus,
-  getManagedIndexPath,
+  getGatewayUrl,
+  getSkill,
   getStagedCliPath,
   getStagedUpdate,
   listAuthBindings,
-  loadConfig,
+  listSkills,
   loadManagedIndex,
+  mapRegistryToSpec,
   maybePrefixBearer,
   performRollback,
   performUpdate,
   probeHttpAuthRequirement,
   readDaemonLogs,
-  readSecretValueFromStdin,
   removeAuthReference,
-  removeServer,
   resolveAuthTarget,
   restartDaemon,
   runBackgroundUpdate,
   runDaemonForeground,
-  saveConfig,
+  saveSkill,
   secretRefName,
-  setServerEnabled,
+  selectBestPackage,
   startDaemon,
   stopDaemon,
   syncAllClients,
   toSecretRef
-} from "./cli-33pamqwn.js";
+} from "./cli-f16kphtq.js";
+import {
+  loadConfig,
+  loadMergedConfig,
+  loadProjectConfig,
+  resolveActiveConfig,
+  saveConfig,
+  saveProjectConfig
+} from "./cli-7bsf6akp.js";
 import {
+  SecretsManager,
+  addServer,
+  ensureGatewayToken,
+  readSecretValueFromStdin,
+  registerProject,
+  removeServer,
+  setServerEnabled
+} from "./cli-s4py8ckf.js";
+import {
+  getConfigPath,
+  getManagedIndexPath
+} from "./cli-fsf33sgp.js";
+import {
+  __require,
   isServerEnabled
-} from "./cli-q8de7zb0.js";
+} from "./cli-s4gspqdf.js";
 
 // src/cli.ts
 import { Command } from "commander";
 import fs from "node:fs";
+import path from "node:path";
 import { execFileSync } from "node:child_process";
 import { pathToFileURL } from "node:url";
 import { emitKeypressEvents } from "node:readline";
@@ -802,7 +825,79 @@ function parseCompatibilityArgs(argv) {
   };
 }
 
+// src/core/proxy.ts
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+async function runStdioProxy(serverName) {
+  const config = loadConfig();
+  const secrets = new SecretsManager;
+  const localToken = ensureGatewayToken(config, secrets);
+  const gatewayUrl = getGatewayUrl(config);
+  if (process.env.MCPX_SKIP_DAEMON_AUTOSTART !== "1") {
+    const status = getDaemonStatus(config);
+    if (!status.running) {
+      const cliPath = process.argv[1] ?? "";
+      await startDaemon(config, cliPath, secrets);
+    }
+  }
+  const upstreamUrl = new URL(`${gatewayUrl}?upstream=${encodeURIComponent(serverName)}`);
+  const httpTransport = new StreamableHTTPClientTransport(upstreamUrl, {
+    requestInit: {
+      headers: { Authorization: `Bearer ${localToken}` }
+    }
+  });
+  const stdioTransport = new StdioServerTransport;
+  let closed = false;
+  const shutdown = async (code = 0) => {
+    if (closed)
+      return;
+    closed = true;
+    try {
+      await httpTransport.close();
+    } catch {}
+    try {
+      await stdioTransport.close();
+    } catch {}
+    process.exit(code);
+  };
+  stdioTransport.onmessage = (msg) => {
+    httpTransport.send(msg).catch((err) => {
+      process.stderr.write(`[mcpx proxy] gateway send failed: ${err.message}
+`);
+    });
+  };
+  httpTransport.onmessage = (msg) => {
+    stdioTransport.send(msg).catch((err) => {
+      process.stderr.write(`[mcpx proxy] stdio send failed: ${err.message}
+`);
+    });
+  };
+  httpTransport.onerror = (err) => {
+    process.stderr.write(`[mcpx proxy] gateway error: ${err.message}
+`);
+  };
+  stdioTransport.onerror = (err) => {
+    process.stderr.write(`[mcpx proxy] stdio error: ${err.message}
+`);
+  };
+  httpTransport.onclose = () => {
+    shutdown(0);
+  };
+  stdioTransport.onclose = () => {
+    shutdown(0);
+  };
+  process.on("SIGTERM", () => {
+    shutdown(0);
+  });
+  process.on("SIGINT", () => {
+    shutdown(0);
+  });
+  await httpTransport.start();
+  await stdioTransport.start();
+}
+
 // src/cli.ts
+var __dirname = "/home/runner/work/mcpx/mcpx/cli/src";
 var VALID_CLIENTS = STATUS_CLIENTS;
 function parseKeyValueFlag(value, label) {
   const split = value.indexOf("=");
@@ -969,10 +1064,11 @@ async function ensureDaemonIfEnabled(cliPath, secrets) {
   }
   await startDaemon(config, cliPath, secrets);
 }
-async function autoSyncManagedEntries(config) {
+async function autoSyncManagedEntries(config, cliPath) {
   const secrets = new SecretsManager;
-  await ensureDaemonIfEnabled(process.argv[1] ?? "", secrets);
-  const summary = syncAllClients(config, secrets);
+  await ensureDaemonIfEnabled(cliPath, secrets);
+  const mergedConfig = loadMergedConfig();
+  const summary = syncAllClients(mergedConfig, secrets);
   printSyncSummary(summary, false);
   ensureExitCodeForSyncFailures(summary.hasErrors);
 }
@@ -981,9 +1077,13 @@ function isNegativeChoice(value) {
   return normalized === "n" || normalized === "no";
 }
 async function maybeAutoConfigureAuthForAddedServer(serverName, spec, secrets) {
-  if (spec.transport !== "http") {
-    return;
+  if (spec.transport === "http") {
+    await maybeConfigureHttpAuth(serverName, spec, secrets);
+  } else {
+    await maybeConfigureStdioAuth(serverName, spec, secrets);
   }
+}
+async function maybeConfigureHttpAuth(serverName, spec, secrets) {
   const probe = await probeHttpAuthRequirement(spec, secrets);
   if (!probe.authRequired) {
     return;
@@ -1056,9 +1156,48 @@ async function maybeAutoConfigureAuthForAddedServer(serverName, spec, secrets) {
 `);
   }
 }
-function loadStatusReport() {
-  const config = loadConfig();
-  return buildStatusReport(config, loadManagedIndex(), getDaemonStatus(config));
+async function maybeConfigureStdioAuth(serverName, spec, secrets) {
+  const binds = listAuthBindings(spec);
+  const plainEnvVars = binds.filter((b) => b.kind === "env" && !secretRefName(b.value));
+  if (plainEnvVars.length === 0) {
+    return;
+  }
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    process.stdout.write(`Server "${serverName}" has plain-text env vars. Run \`mcpx auth set ${serverName} --env KEY=VALUE --value "<token>"\` to store them securely.
+`);
+    return;
+  }
+  process.stdout.write(`Server "${serverName}" has ${plainEnvVars.length} env var(s) stored in plain text.
+`);
+  const rl = createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+  try {
+    const shouldMigrate = await promptLine(rl, "Store them in the system keychain instead? (Y/n): ");
+    if (isNegativeChoice(shouldMigrate)) {
+      process.stdout.write(`Skipping keychain migration.
+`);
+      return;
+    }
+    for (const binding of plainEnvVars) {
+      const target = { kind: "env", key: binding.key };
+      const secretName = defaultAuthSecretName(serverName, target);
+      secrets.setSecret(secretName, binding.value);
+      applyAuthReference(spec, target, toSecretRef(secretName));
+      process.stdout.write(`Stored ${binding.key} as secret://${secretName}
+`);
+    }
+  } catch (error) {
+    process.stdout.write(`Keychain migration skipped: ${error.message}
+`);
+  } finally {
+    rl.close();
+  }
+}
+async function loadStatusReport() {
+  const config = loadMergedConfig();
+  return await buildStatusReport(config, loadManagedIndex(), getDaemonStatus(config));
 }
 function daemonEmoji(running) {
   return running ? "✅" : "⚠️";
@@ -1115,6 +1254,16 @@ function printSyncedConfigBullets(server, indent) {
 `);
   }
 }
+function formatTokenApprox(tokens) {
+  if (tokens === 0)
+    return "0";
+  if (tokens > 0 && tokens < 500)
+    return "<1k";
+  const thousands = Math.round(tokens / 1000);
+  if (thousands === 0)
+    return "<1k";
+  return `~${thousands}k`;
+}
 function printStatusReportText(report) {
   process.stdout.write(`Gateway URL: ${report.gatewayUrl}
 `);
@@ -1122,12 +1271,17 @@ function printStatusReportText(report) {
 `);
   process.stdout.write(`Upstream servers: ${report.upstreamCount}
 `);
+  if (report.daemon.running) {
+    process.stdout.write(`Global active tokens: ${formatTokenApprox(report.totalGlobalTokens ?? 0)}
+`);
+  }
   if (report.servers.length === 0) {
     process.stdout.write(`⚠️ No upstream servers configured.
 `);
   } else {
     for (const server of report.servers) {
-      process.stdout.write(`- ${serverHealthEmoji(server)} ${server.name} (${server.transport})
+      const tokenSuffix = server.enabled && server.tokenCount ? ` [tokens: ${formatTokenApprox(server.tokenCount.total)} (tools: ${server.tokenCount.tools}, resources: ${server.tokenCount.resources}, prompts: ${server.tokenCount.prompts})]` : "";
+      process.stdout.write(`- ${serverHealthEmoji(server)} ${server.name} (${server.transport})${tokenSuffix}
 `);
       process.stdout.write(`  state: ${server.enabled ? "enabled" : "disabled"}
 `);
@@ -1142,6 +1296,15 @@ function printStatusReportText(report) {
       printSyncedConfigBullets(server, "  ");
     }
   }
+  if (report.projects && Object.keys(report.projects).length > 0 && report.daemon.running) {
+    process.stdout.write(`Project active tokens:
+`);
+    for (const project of Object.values(report.projects)) {
+      const projectTokens = report.totalProjectTokens?.[project.path] ?? 0;
+      process.stdout.write(`- ${project.name}: ${formatTokenApprox(projectTokens)} tokens (${project.path})
+`);
+    }
+  }
   process.stdout.write(`Client sync states:
 `);
   for (const client of STATUS_CLIENTS) {
@@ -1392,16 +1555,16 @@ async function clearServerAuthInteractively(rl, serverName) {
   }
   saveConfig(config);
 }
-async function reconnectGatewayAndSync() {
+async function reconnectGatewayAndSync(cliPath) {
   const config = loadConfig();
   const secrets = new SecretsManager;
-  const restart = await restartDaemon(config, process.argv[1] ?? "", secrets);
+  const restart = await restartDaemon(config, cliPath, secrets);
   process.stdout.write(`${restart.message} pid=${restart.pid} port=${restart.port}
 `);
   const summary = syncAllClients(config, secrets);
   printSyncSummary(summary, false);
 }
-async function setServerEnabledInteractively(rl, serverName, enabled) {
+async function setServerEnabledInteractively(rl, serverName, enabled, cliPath) {
   const action = enabled ? "enable" : "disable";
   const confirmation = await promptLine(rl, `Type "${serverName}" to ${action} this MCP (blank to cancel): `);
   if (confirmation !== serverName) {
@@ -1409,6 +1572,31 @@ async function setServerEnabledInteractively(rl, serverName, enabled) {
 `);
     return false;
   }
+  if (serverName.includes(".")) {
+    const parts = serverName.split(".");
+    const projectName = parts[0];
+    const baseServerName = parts.slice(1).join(".");
+    const globalConfigForProjects = loadConfig();
+    if (globalConfigForProjects.projects) {
+      const projectEntry = Object.values(globalConfigForProjects.projects).find((p) => p.name === projectName);
+      if (projectEntry) {
+        const localPath = path.join(projectEntry.path, ".mcpx.json");
+        if (fs.existsSync(localPath)) {
+          const projectConfig = loadProjectConfig(localPath);
+          if (projectConfig.servers[baseServerName]) {
+            setServerEnabled(projectConfig, baseServerName, enabled);
+            saveProjectConfig(projectConfig, localPath);
+            process.stdout.write(`${enabled ? "Enabled" : "Disabled"} server: ${serverName}
+`);
+            process.stdout.write(`Auto-syncing managed gateway entries across all supported clients...
+`);
+            await autoSyncManagedEntries(loadMergedConfig(), cliPath);
+            return true;
+          }
+        }
+      }
+    }
+  }
   const config = loadConfig();
   setServerEnabled(config, serverName, enabled);
   saveConfig(config);
@@ -1416,7 +1604,7 @@ async function setServerEnabledInteractively(rl, serverName, enabled) {
 `);
   process.stdout.write(`Auto-syncing managed gateway entries across all supported clients...
 `);
-  await autoSyncManagedEntries(config);
+  await autoSyncManagedEntries(loadMergedConfig(), cliPath);
   return true;
 }
 function buildServerActionTitle(server) {
@@ -1451,9 +1639,9 @@ function buildServerMenuDetail(server) {
   const authSummary = server.authBindings.length > 0 ? "\uD83D\uDD10 auth configured • " : "";
   return `${authSummary}${syncSummary}${errorSummary}`;
 }
-async function runServerActionsMenu(rl, serverName) {
+async function runServerActionsMenu(rl, serverName, cliPath) {
   while (true) {
-    const report = loadStatusReport();
+    const report = await loadStatusReport();
     const server = report.servers.find((entry) => entry.name === serverName);
     if (!server) {
       process.stdout.write(`Server "${serverName}" no longer exists.
@@ -1479,12 +1667,12 @@ async function runServerActionsMenu(rl, serverName) {
       } else if (action === 2) {
         await clearServerAuthInteractively(rl, serverName);
       } else if (action === 3) {
-        const updated = await setServerEnabledInteractively(rl, serverName, !server.enabled);
+        const updated = await setServerEnabledInteractively(rl, serverName, !server.enabled, cliPath);
         if (updated) {
           return;
         }
       } else if (action === 4) {
-        await reconnectGatewayAndSync();
+        await reconnectGatewayAndSync(cliPath);
       }
     } catch (error) {
       process.stdout.write(`${error.message}
@@ -1493,14 +1681,14 @@ async function runServerActionsMenu(rl, serverName) {
     await promptLine(rl, "Press Enter to continue...");
   }
 }
-async function runInteractiveStatusMenu() {
+async function runInteractiveStatusMenu(cliPath) {
   const rl = createInterface({
     input: process.stdin,
     output: process.stdout
   });
   try {
     while (true) {
-      const report = loadStatusReport();
+      const report = await loadStatusReport();
       if (report.servers.length === 0) {
         clearTerminalScreen();
         process.stdout.write(`mcpx status
@@ -1530,54 +1718,177 @@ async function runInteractiveStatusMenu() {
       if (!server) {
         continue;
       }
-      await runServerActionsMenu(rl, server.name);
+      await runServerActionsMenu(rl, server.name, cliPath);
     }
   } finally {
     rl.close();
   }
 }
-function registerEnabledCommand(parent, enabled) {
-  parent.command(enabled ? "enable <name>" : "disable <name>").description(`${enabled ? "Enable" : "Disable"} an upstream MCP server`).action(async (name) => {
-    const config = loadConfig();
-    setServerEnabled(config, name, enabled);
-    saveConfig(config);
-    process.stdout.write(`${enabled ? "Enabled" : "Disabled"} server: ${name}
+function registerEnabledCommand(parent, enabled, cliPath) {
+  parent.command(enabled ? "enable <name>" : "disable <name>").option("-g, --global", "Force target the global configuration").option("-l, --local", "Force target (or initialize) a local `.mcpx.json` configuration").description(`${enabled ? "Enable" : "Disable"} an upstream MCP server`).action(async (name, options) => {
+    const context = resolveActiveConfig({ global: options.global, local: options.local });
+    setServerEnabled(context.config, name, enabled);
+    context.save();
+    if (context.type === "project" && context.projectPath) {
+      const globalConfig = loadConfig();
+      registerProject(globalConfig, context.projectPath);
+      saveConfig(globalConfig);
+    }
+    process.stdout.write(`${enabled ? "Enabled" : "Disabled"} server: ${name} (${context.type} config)
 `);
     process.stdout.write(`Auto-syncing managed gateway entries across all supported clients...
 `);
-    await autoSyncManagedEntries(config);
+    const mergedConfig = loadMergedConfig();
+    await autoSyncManagedEntries(mergedConfig, cliPath);
   });
 }
-function registerAddCommand(parent) {
-  parent.command("add [values...]").allowUnknownOption(true).option("--transport <transport>", "MCP transport (auto|http|stdio)", "auto").option("--header <header>", "Header entry in KEY=VALUE form", (value, previous = []) => [...previous, value], []).option("--env <env>", "Env entry in KEY=VALUE form for stdio upstreams", (value, previous = []) => [...previous, value], []).option("--cwd <cwd>", "Working directory for stdio upstream").option("--force", "Overwrite existing server with same name").description("Add an upstream MCP server").action(async (values, options) => {
-    const config = loadConfig();
-    const parsed = parseAddServerSpec(values ?? [], options);
-    addServer(config, parsed.name, parsed.spec, options.force ?? false);
-    await maybeAutoConfigureAuthForAddedServer(parsed.name, parsed.spec, new SecretsManager);
-    saveConfig(config);
-    process.stdout.write(`Added server: ${parsed.name} (${parsed.spec.transport})
+function registerAddCommand(parent, cliPath) {
+  parent.command("add [values...]").allowUnknownOption(true).option("--transport <transport>", "MCP transport (auto|http|stdio)", "auto").option("--header <header>", "Header entry in KEY=VALUE form", (value, previous = []) => [...previous, value], []).option("--env <env>", "Env entry in KEY=VALUE form for stdio upstreams", (value, previous = []) => [...previous, value], []).option("--cwd <cwd>", "Working directory for stdio upstream").option("--force", "Overwrite existing server with same name").option("-g, --global", "Force saving to global configuration").option("-l, --local", "Force saving to local project configuration").description("Add an upstream MCP server").action(async (values, options) => {
+    const context = resolveActiveConfig({ global: options.global, local: options.local });
+    const safeValues = values ?? [];
+    const secrets = new SecretsManager;
+    if (safeValues.length === 1 && safeValues[0]?.includes("/")) {
+      const registryName = safeValues[0];
+      const shortName = registryName.split("/").pop() ?? registryName;
+      process.stdout.write(`Fetching "${registryName}" from registry...
+`);
+      const detail = await fetchRegistryServerDetail(registryName);
+      const option = selectBestPackage(detail.packages, detail.remotes);
+      const requiredInputs = extractRequiredInputs(option);
+      const resolvedValues = {};
+      if (requiredInputs.length > 0) {
+        if (!process.stdin.isTTY || !process.stdout.isTTY) {
+          throw new Error(`Server "${registryName}" requires inputs: ${requiredInputs.map((i) => `${i.name} (${i.kind})`).join(", ")}. Run in an interactive terminal.`);
+        }
+        const rl = createInterface({ input: process.stdin, output: process.stdout });
+        try {
+          for (const input of requiredInputs) {
+            const promptText = input.description ? `${input.name} (${input.kind}): ${input.description}
+Value: ` : `${input.name} (${input.kind}): `;
+            const value = await promptLine(rl, promptText);
+            if (!value) {
+              process.stdout.write(`Skipping ${input.name} (empty value).
+`);
+              continue;
+            }
+            resolvedValues[input.name] = value;
+          }
+        } finally {
+          rl.close();
+        }
+      } else {
+        process.stdout.write(`No required inputs.
+`);
+      }
+      let spec = mapRegistryToSpec(shortName, option, resolvedValues);
+      for (const input of requiredInputs) {
+        if (!input.isSecret)
+          continue;
+        const rawValue = resolvedValues[input.name];
+        if (!rawValue)
+          continue;
+        const secretName = `auth_${shortName.toLowerCase().replace(/[^a-z0-9._-]/g, "_")}_${input.kind}_${input.name.toLowerCase().replace(/[^a-z0-9._-]/g, "_")}`;
+        secrets.setSecret(secretName, rawValue);
+        if (input.kind === "header" && spec.transport === "http") {
+          const headers = { ...spec.headers ?? {} };
+          headers[input.name] = `secret://${secretName}`;
+          spec.headers = Object.keys(headers).length > 0 ? headers : undefined;
+        } else if (input.kind === "env" && spec.transport === "stdio") {
+          const env = { ...spec.env ?? {} };
+          env[input.name] = `secret://${secretName}`;
+          spec.env = Object.keys(env).length > 0 ? env : undefined;
+        }
+      }
+      let resolvedServerName = shortName;
+      if (context.type === "project") {
+        const globalConfig = loadConfig();
+        registerProject(globalConfig, context.projectPath, context.config.name);
+        saveConfig(globalConfig);
+        const projectName = context.config.name || path.basename(context.projectPath);
+        resolvedServerName = `${projectName}.${shortName}`;
+      }
+      addServer(context.config, shortName, spec, options.force ?? false);
+      context.save();
+      process.stdout.write(`Added server: ${shortName} (${spec.transport}) from registry "${registryName}" ${context.type === "project" ? `to project: ${context.projectPath}` : "globally"}
 `);
+    } else {
+      const parsed = parseAddServerSpec(safeValues, options);
+      let resolvedServerName = parsed.name;
+      if (context.type === "project") {
+        const globalConfig = loadConfig();
+        registerProject(globalConfig, context.projectPath, context.config.name);
+        saveConfig(globalConfig);
+        const projectName = context.config.name || path.basename(context.projectPath);
+        resolvedServerName = `${projectName}.${parsed.name}`;
+      }
+      addServer(context.config, parsed.name, parsed.spec, options.force ?? false);
+      await maybeAutoConfigureAuthForAddedServer(resolvedServerName, parsed.spec, secrets);
+      context.save();
+      process.stdout.write(`Added server: ${parsed.name} (${parsed.spec.transport}) ${context.type === "project" ? `to project: ${context.projectPath}` : "globally"}
+`);
+    }
     process.stdout.write(`Auto-syncing managed gateway entries across all supported clients...
 `);
-    await autoSyncManagedEntries(config);
+    const mergedConfig = loadMergedConfig();
+    await autoSyncManagedEntries(mergedConfig, cliPath);
   });
 }
-function registerRemoveCommand(parent) {
-  parent.command("remove <name>").option("--force", "Do not error if server does not exist").description("Remove an upstream MCP server").action(async (name, options) => {
-    const config = loadConfig();
-    removeServer(config, name, options.force ?? false);
-    saveConfig(config);
-    process.stdout.write(`Removed server: ${name}
+function registerRemoveCommand(parent, cliPath) {
+  parent.command("remove <name>").option("--force", "Do not error if server does not exist").option("-g, --global", "Force target global configuration").option("-l, --local", "Force target local project configuration").description("Remove an upstream MCP server").action(async (name, options) => {
+    const context = resolveActiveConfig({ global: options.global, local: options.local });
+    removeServer(context.config, name, options.force ?? false);
+    context.save();
+    process.stdout.write(`Removed server: ${name} ${context.type === "project" ? `from project: ${context.projectPath}` : "globally"}
 `);
     process.stdout.write(`Auto-syncing managed gateway entries across all supported clients...
 `);
-    await autoSyncManagedEntries(config);
+    const mergedConfig = loadMergedConfig();
+    await autoSyncManagedEntries(mergedConfig, cliPath);
   });
 }
 function registerListCommand(parent) {
-  parent.command("list").option("--json", "Output JSON").description("List configured upstream MCP servers").action((options) => {
-    const config = loadConfig();
-    const servers = Object.entries(config.servers).map(([name, spec]) => ({ name, ...spec }));
+  parent.command("list").option("--json", "Output JSON").option("-g, --global", "Force target global configuration").option("-l, --local", "Force target local project configuration").description("List configured upstream MCP servers").action((options) => {
+    let servers = [];
+    if (options.global || options.local) {
+      const context = resolveActiveConfig({ global: options.global, local: options.local });
+      servers = Object.entries(context.config.servers).map(([name, spec]) => ({
+        name,
+        ...spec,
+        projectName: context.type === "project" ? context.config.name || path.basename(context.projectPath) : undefined
+      }));
+    } else {
+      const mergedConfig = loadMergedConfig();
+      const globalConfig = loadConfig();
+      const projectNamesMap = new Map;
+      if (globalConfig.projects) {
+        for (const [projectPath, entry] of Object.entries(globalConfig.projects)) {
+          const localPath = path.join(projectPath, ".mcpx.json");
+          if (fs.existsSync(localPath)) {
+            try {
+              const localConfig = loadProjectConfig(localPath);
+              const pName = localConfig.name || entry.name || path.basename(projectPath);
+              projectNamesMap.set(pName, projectPath);
+            } catch {}
+          }
+        }
+      }
+      servers = Object.entries(mergedConfig.servers).map(([name, spec]) => {
+        let projectName;
+        let baseName = name;
+        for (const pName of projectNamesMap.keys()) {
+          if (name.startsWith(`${pName}.`)) {
+            projectName = pName;
+            baseName = name.slice(pName.length + 1);
+            break;
+          }
+        }
+        return {
+          name: baseName,
+          ...spec,
+          projectName
+        };
+      });
+    }
     if (options.json) {
       process.stdout.write(`${JSON.stringify({ servers }, null, 2)}
 `);
@@ -1590,31 +1901,32 @@ function registerListCommand(parent) {
     }
     for (const server of servers) {
       const state = isServerEnabled(server) ? "enabled" : "disabled";
+      const scope = server.projectName ? `project: ${server.projectName}` : "global";
       if (server.transport === "http") {
-        process.stdout.write(`- ${server.name} (${state}, http) ${server.url}
+        process.stdout.write(`- ${server.name} (${state}, http, ${scope}) ${server.url}
 `);
       } else {
         const args = (server.args ?? []).join(" ");
-        process.stdout.write(`- ${server.name} (${state}, stdio) ${server.command}${args ? ` ${args}` : ""}
+        process.stdout.write(`- ${server.name} (${state}, stdio, ${scope}) ${server.command}${args ? ` ${args}` : ""}
 `);
       }
     }
   });
 }
-function registerSyncCommand(program) {
+function registerSyncCommand(program, cliPath) {
   program.command("sync [clients...]").option("--client <id>", "Limit sync to specific client(s), comma-separated or repeated", (value, prev = []) => [...prev, value], []).option("--json", "Output JSON").description("Sync gateway configuration to supported clients (e.g. `mcpx sync claude`)").action(async (clients, options) => {
-    const config = loadConfig();
+    const config = loadMergedConfig();
     const targetClients = parseClientList([...clients ?? [], ...options.client ?? []]);
     const secrets = new SecretsManager;
-    await ensureDaemonIfEnabled(process.argv[1] ?? "", secrets);
+    await ensureDaemonIfEnabled(cliPath, secrets);
     const summary = syncAllClients(config, secrets, targetClients);
     printSyncSummary(summary, options.json ?? false);
     ensureExitCodeForSyncFailures(summary.hasErrors);
   });
 }
-function registerStatusCommand(program) {
+function registerStatusCommand(program, cliPath) {
   program.command("status").option("--no-interactive", "Disable interactive status menu").option("--json", "Output JSON").description("Show gateway, daemon, MCP inventory, and client sync status").action(async (options) => {
-    const report = loadStatusReport();
+    const report = await loadStatusReport();
     if (options.json) {
       process.stdout.write(`${JSON.stringify(report, null, 2)}
 `);
@@ -1622,7 +1934,7 @@ function registerStatusCommand(program) {
     }
     const interactive = (options.interactive ?? true) && process.stdin.isTTY && process.stdout.isTTY;
     if (interactive) {
-      await runInteractiveStatusMenu();
+      await runInteractiveStatusMenu(cliPath);
       return;
     }
     printStatusReportText(report);
@@ -1643,15 +1955,22 @@ function registerDoctorCommand(program) {
       status: fs.existsSync(getManagedIndexPath()) ? "ok" : "warn",
       details: getManagedIndexPath()
     });
-    if (process.platform === "darwin") {
+    try {
+      const keytar = __require(path.join(__dirname, "..", "node_modules", "keytar", "lib", "keytar.js"));
       try {
-        execFileSync("security", ["help"], { stdio: "ignore" });
-        checks.push({ check: "macos_keychain", status: "ok", details: "security CLI available" });
-      } catch {
-        checks.push({ check: "macos_keychain", status: "fail", details: "security CLI unavailable" });
+        keytar.getPassword("mcpx-doctor-check", "__probe__");
+      } catch {}
+      checks.push({ check: "keyring", status: "ok", details: "keytar native addon loaded" });
+    } catch {
+      if (process.platform === "linux") {
+        checks.push({ check: "keyring", status: "warn", details: "keytar native addon unavailable; install libsecret-1-dev and reinstall dependencies" });
+      } else if (process.platform === "win32") {
+        checks.push({ check: "keyring", status: "warn", details: "keytar native addon unavailable; rebuild keytar with 'npx node-gyp rebuild' in app/node_modules/keytar" });
+      } else if (process.platform === "darwin") {
+        checks.push({ check: "keyring", status: "warn", details: "keytar native addon unavailable; reinstall dependencies or check Xcode CLI tools" });
+      } else {
+        checks.push({ check: "keyring", status: "warn", details: "keytar native addon unavailable" });
       }
-    } else {
-      checks.push({ check: "macos_keychain", status: "warn", details: "Non-macOS platform; keychain integration unavailable" });
     }
     const daemon = getDaemonStatus(config);
     checks.push({
@@ -1856,6 +2175,39 @@ function registerAuthCommands(program) {
     process.stdout.write("Run `mcpx sync <client>` (or `mcpx sync`) to update managed `mcpx` entries with the new token.\n");
   });
 }
+function registerSkillsCommands(program) {
+  const skill = program.command("skill").description("Manage shared agent skills");
+  skill.command("ls").description("List all skills").action(() => {
+    const skills = listSkills();
+    if (skills.length === 0) {
+      process.stdout.write(`No skills found.
+`);
+      return;
+    }
+    for (const s of skills) {
+      process.stdout.write(`- ${s.id}
+`);
+    }
+  });
+  skill.command("add <id>").description("Add a new skill").action(async (id) => {
+    const existing = getSkill(id);
+    if (existing) {
+      process.stderr.write(`Skill "${id}" already exists.
+`);
+      process.exit(1);
+    }
+    saveSkill(id, `# ${id}
+
+Add your instructions here.`);
+    process.stdout.write(`Skill "${id}" created.
+`);
+  });
+  skill.command("rm <id>").description("Remove a skill").action((id) => {
+    deleteSkill(id);
+    process.stdout.write(`Skill "${id}" removed.
+`);
+  });
+}
 function registerClientsCommands(program) {
   const clients = program.command("clients").description("Client adapter utilities");
   clients.command("list").option("--json", "Output JSON").description("List supported clients and detected config paths").action((options) => {
@@ -1933,12 +2285,77 @@ function registerUpdateCommand(program) {
     }
   });
 }
-function registerMcpCompat(program) {
+function registerProjectCommands(program, cliPath) {
+  const projectCmd = program.command("project").description("Manage project-based MCP configurations");
+  projectCmd.command("init [name]").description("Initialize a local .mcpx.json configuration in the current directory").action(async (name) => {
+    const targetPath = path.join(process.cwd(), ".mcpx.json");
+    if (fs.existsSync(targetPath)) {
+      process.stderr.write(`Local project configuration already exists at: ${targetPath}
+`);
+      process.exit(1);
+    }
+    const projectName = name?.trim() || path.basename(process.cwd());
+    const localConfig = {
+      name: projectName,
+      servers: {}
+    };
+    const { saveProjectConfig: saveProjectConfig2 } = await import("./config-kayej21q.js");
+    saveProjectConfig2(localConfig, targetPath);
+    process.stdout.write(`Initialized project configuration at: ${targetPath}
+`);
+    const { registerProject: registerProject2 } = await import("./registry-1s14wd58.js");
+    const globalConfig = loadConfig();
+    registerProject2(globalConfig, process.cwd(), projectName);
+    saveConfig(globalConfig);
+    process.stdout.write(`Registered project "${projectName}" globally.
+`);
+  });
+  projectCmd.command("list").description("List all globally registered project paths").action(() => {
+    const globalConfig = loadConfig();
+    const projects = Object.entries(globalConfig.projects ?? {});
+    if (projects.length === 0) {
+      process.stdout.write(`No projects currently registered.
+`);
+      return;
+    }
+    process.stdout.write(`Registered Projects:
+`);
+    for (const [projectPath, entry] of projects) {
+      process.stdout.write(`- ${entry.name}: ${projectPath}
+`);
+    }
+  });
+  projectCmd.command("remove <path>").description("Unregister a project path from the global configuration").action(async (projectPath) => {
+    const resolvedPath = path.resolve(projectPath);
+    const globalConfig = loadConfig();
+    if (!globalConfig.projects || !globalConfig.projects[resolvedPath]) {
+      process.stderr.write(`No registered project found at path: ${resolvedPath}
+`);
+      process.exit(1);
+    }
+    const entry = globalConfig.projects[resolvedPath];
+    const { unregisterProject: unregisterProject2 } = await import("./registry-1s14wd58.js");
+    unregisterProject2(globalConfig, resolvedPath);
+    saveConfig(globalConfig);
+    process.stdout.write(`Unregistered project "${entry.name}" (${resolvedPath}) from the global configuration.
+`);
+    process.stdout.write(`Auto-syncing managed gateway entries across all supported clients...
+`);
+    const mergedConfig = loadMergedConfig();
+    await autoSyncManagedEntries(mergedConfig, cliPath);
+  });
+}
+function registerProxyCommand(program) {
+  program.command("proxy <name>").description("Run a stdio MCP proxy bridging to the local mcpx HTTP gateway for the given upstream server").action(async (name) => {
+    await runStdioProxy(name);
+  });
+}
+function registerMcpCompat(program, cliPath) {
   const mcp = program.command("mcp").description("Compatibility namespace for MCP commands");
-  registerAddCommand(mcp);
-  registerRemoveCommand(mcp);
-  registerEnabledCommand(mcp, true);
-  registerEnabledCommand(mcp, false);
+  registerAddCommand(mcp, cliPath);
+  registerRemoveCommand(mcp, cliPath);
+  registerEnabledCommand(mcp, true, cliPath);
+  registerEnabledCommand(mcp, false, cliPath);
   registerListCommand(mcp);
 }
 async function runCli(argv = process.argv) {
@@ -1973,25 +2390,29 @@ async function runCli(argv = process.argv) {
       argv = [argv[0], argv[1], "add", ...compat.normalizedArgs];
     }
   }
+  const cliPath = argv[1] ?? "";
   const program = new Command;
   program.name("mcpx").description("HTTP-first MCP gateway and multi-client installer").version(APP_VERSION);
-  registerAddCommand(program);
-  registerRemoveCommand(program);
-  registerEnabledCommand(program, true);
-  registerEnabledCommand(program, false);
+  registerAddCommand(program, cliPath);
+  registerRemoveCommand(program, cliPath);
+  registerEnabledCommand(program, true, cliPath);
+  registerEnabledCommand(program, false, cliPath);
   registerListCommand(program);
-  registerSyncCommand(program);
-  registerStatusCommand(program);
+  registerSyncCommand(program, cliPath);
+  registerStatusCommand(program, cliPath);
   registerDoctorCommand(program);
   registerDaemonCommands(program);
   registerSecretsCommands(program);
   registerAuthCommands(program);
   registerClientsCommands(program);
-  registerMcpCompat(program);
+  registerSkillsCommands(program);
+  registerProxyCommand(program);
+  registerMcpCompat(program, cliPath);
   registerUpdateCommand(program);
+  registerProjectCommands(program, cliPath);
   await program.parseAsync(argv);
 }
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+if (process.argv[1] && import.meta.url === pathToFileURL(fs.realpathSync(process.argv[1])).href) {
   runCli().catch((error) => {
     process.stderr.write(`${error.message}
 `);