@kwonye/mcpx 0.1.75 → 0.1.79

package/dist/{cli-e9hdd44n.js → cli-w4m7471h.js}

@@ -1,238 +1,46 @@
 import {
-  isServerEnabled,
-  normalizeServerSpecEnabled
-} from "./cli-q8de7zb0.js";
-
-// src/core/paths.ts
-import os from "node:os";
-import path from "node:path";
-import fs from "node:fs";
-function envOrDefault(value, fallback) {
-  if (value && value.trim().length > 0) {
-    return value;
-  }
-  return fallback;
-}
-function homeDir() {
-  return process.env.HOME ?? os.homedir();
-}
-function getConfigRoot() {
-  return envOrDefault(process.env.MCPX_CONFIG_HOME ?? process.env.XDG_CONFIG_HOME, path.join(homeDir(), ".config"));
-}
-function getDataRoot() {
-  return envOrDefault(process.env.MCPX_DATA_HOME ?? process.env.XDG_DATA_HOME, path.join(homeDir(), ".local", "share"));
-}
-function getStateRoot() {
-  return envOrDefault(process.env.MCPX_STATE_HOME ?? process.env.XDG_STATE_HOME, path.join(homeDir(), ".local", "state"));
-}
-function getConfigPath() {
-  return path.join(getConfigRoot(), "mcpx", "config.json");
-}
-function getSkillsDir() {
-  return path.join(getConfigRoot(), "mcpx", "skills");
-}
-function getManagedIndexPath() {
-  return path.join(getDataRoot(), "mcpx", "managed-index.json");
-}
-function getSecretNamesPath() {
-  return path.join(getDataRoot(), "mcpx", "secret-names.json");
-}
-function getRuntimeDir() {
-  return path.join(getStateRoot(), "mcpx", "runtime");
-}
-function getLogDir() {
-  return path.join(getStateRoot(), "mcpx", "logs");
-}
-function getPidPath() {
-  return path.join(getRuntimeDir(), "daemon.pid");
-}
-function getLogPath() {
-  return path.join(getLogDir(), "daemon.log");
-}
-function getUpdatesDir() {
-  return path.join(getDataRoot(), "mcpx", "updates");
-}
-function getStagedVersionPath() {
-  return path.join(getUpdatesDir(), "staged-version.json");
-}
-function getUpdateLockPath() {
-  return path.join(getUpdatesDir(), ".update.lock");
-}
-function ensureDir(dirPath) {
-  fs.mkdirSync(dirPath, { recursive: true });
-}
-function ensureParentDir(filePath) {
-  fs.mkdirSync(path.dirname(filePath), { recursive: true });
-}
-
-// src/core/config.ts
-import { z } from "zod";
-
-// src/util/fs.ts
-import fs2 from "node:fs";
-import path2 from "node:path";
-import crypto from "node:crypto";
-function readJsonFile(filePath, fallback) {
-  if (!fs2.existsSync(filePath)) {
-    return fallback;
-  }
-  try {
-    const raw = fs2.readFileSync(filePath, "utf8");
-    return JSON.parse(raw);
-  } catch {
-    return fallback;
-  }
-}
-function writeJsonAtomic(filePath, data) {
-  fs2.mkdirSync(path2.dirname(filePath), { recursive: true });
-  const tempPath = `${filePath}.tmp-${process.pid}-${Date.now()}`;
-  const content = `${JSON.stringify(data, null, 2)}
-`;
-  fs2.writeFileSync(tempPath, content, { mode: 384 });
-  fs2.renameSync(tempPath, filePath);
-}
-function sha256(value) {
-  return crypto.createHash("sha256").update(value).digest("hex");
-}
-
-// src/core/config.ts
-var clientStateSchema = z.object({
-  status: z.enum(["SYNCED", "UNSUPPORTED_HTTP", "ERROR", "SKIPPED"]),
-  lastSyncAt: z.string().optional(),
-  message: z.string().optional(),
-  configPath: z.string().optional()
-});
-var httpServerSchema = z.object({
-  transport: z.literal("http"),
-  url: z.url(),
-  headers: z.record(z.string(), z.string()).optional(),
-  enabled: z.boolean().default(true)
-});
-var stdioServerSchema = z.object({
-  transport: z.literal("stdio"),
-  command: z.string().min(1),
-  args: z.array(z.string()).optional(),
-  env: z.record(z.string(), z.string()).optional(),
-  cwd: z.string().min(1).optional(),
-  enabled: z.boolean().default(true)
-});
-var serverSchema = z.discriminatedUnion("transport", [httpServerSchema, stdioServerSchema]);
-var configSchema = z.object({
-  schemaVersion: z.literal(1).default(1),
-  gateway: z.object({
-    port: z.number().int().min(1).max(65535).default(37373),
-    tokenRef: z.string().default("secret://local_gateway_token"),
-    autoStart: z.boolean().default(true)
-  }).default({
-    port: 37373,
-    tokenRef: "secret://local_gateway_token",
-    autoStart: true
-  }),
-  servers: z.record(z.string(), serverSchema).default({}),
-  clients: z.record(z.string(), clientStateSchema).default({})
-});
-function defaultConfig() {
-  return {
-    schemaVersion: 1,
-    gateway: {
-      port: 37373,
-      tokenRef: "secret://local_gateway_token",
-      autoStart: true
-    },
-    servers: {},
-    clients: {}
-  };
-}
-function loadConfig(configPath = getConfigPath()) {
-  const raw = readJsonFile(configPath, defaultConfig());
-  const parsed = configSchema.safeParse(raw);
-  if (!parsed.success) {
-    return defaultConfig();
-  }
-  const clientEntries = {};
-  for (const [key, value] of Object.entries(parsed.data.clients)) {
-    if (["claude", "claude-desktop", "codex", "cursor", "cline", "opencode", "kiro", "vscode", "qwen"].includes(key)) {
-      clientEntries[key] = value;
-    }
-  }
-  const servers = Object.fromEntries(Object.entries(parsed.data.servers).map(([name, spec]) => [name, normalizeServerSpecEnabled(spec)]));
-  return {
-    schemaVersion: 1,
-    gateway: parsed.data.gateway,
-    servers,
-    clients: clientEntries
-  };
-}
-function saveConfig(config, configPath = getConfigPath()) {
-  config.servers = Object.fromEntries(Object.entries(config.servers).map(([name, spec]) => [name, normalizeServerSpecEnabled(spec)]));
-  writeJsonAtomic(configPath, config);
-}
-
-// src/core/registry.ts
-function validateServerName(name) {
-  if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]{0,62}$/.test(name)) {
-    throw new Error("Invalid server name. Use 1-63 chars: letters, numbers, '.', '-', '_' and start with alphanumeric.");
-  }
-}
-function addServer(config, name, spec, force = false) {
-  validateServerName(name);
-  if (config.servers[name] && !force) {
-    throw new Error(`Server "${name}" already exists. Use --force to overwrite.`);
-  }
-  config.servers[name] = normalizeServerSpecEnabled(spec);
-}
-function removeServer(config, name, force = false) {
-  if (!config.servers[name] && !force) {
-    throw new Error(`Server "${name}" does not exist.`);
-  }
-  delete config.servers[name];
-}
-function updateServer(config, name, spec) {
-  validateServerName(name);
-  if (!config.servers[name]) {
-    throw new Error(`Server "${name}" does not exist.`);
-  }
-  config.servers[name] = normalizeServerSpecEnabled(spec);
-}
-function setServerEnabled(config, name, enabled) {
-  const existing = config.servers[name];
-  if (!existing) {
-    throw new Error(`Server "${name}" does not exist.`);
-  }
-  config.servers[name] = {
-    ...existing,
-    enabled
-  };
-}
-function getGatewayTokenSecretName(config) {
-  if (!config.gateway.tokenRef.startsWith("secret://")) {
-    return "local_gateway_token";
-  }
-  return config.gateway.tokenRef.slice("secret://".length) || "local_gateway_token";
-}
-function ensureGatewayToken(config, secrets) {
-  const secretName = getGatewayTokenSecretName(config);
-  const existing = secrets.getSecret(secretName);
-  if (existing) {
-    return existing;
-  }
-  return secrets.rotateLocalToken(secretName);
-}
+  loadConfig,
+  loadMergedConfig,
+  saveConfig
+} from "./cli-7edpy4nk.js";
+import {
+  SecretsManager,
+  ensureGatewayToken,
+  getGatewayTokenSecretName
+} from "./cli-s4py8ckf.js";
+import {
+  ensureDir,
+  ensureParentDir,
+  getLogPath,
+  getManagedIndexPath,
+  getPidPath,
+  getSkillsDir,
+  getStagedVersionPath,
+  getUpdateLockPath,
+  getUpdatesDir,
+  homeDir,
+  readJsonFile,
+  sha256,
+  writeJsonAtomic
+} from "./cli-fsf33sgp.js";
+import {
+  isServerEnabled
+} from "./cli-s4gspqdf.js";
 
 // src/core/skills.ts
-import fs3 from "node:fs";
-import path3 from "node:path";
+import fs from "node:fs";
+import path from "node:path";
 function listSkills() {
   const skillsDir = getSkillsDir();
-  if (!fs3.existsSync(skillsDir)) {
+  if (!fs.existsSync(skillsDir)) {
     return [];
   }
-  const files = fs3.readdirSync(skillsDir);
+  const files = fs.readdirSync(skillsDir);
   const skills = [];
   for (const file of files) {
     if (file.endsWith(".md")) {
-      const id = path3.basename(file, ".md");
-      const content = fs3.readFileSync(path3.join(skillsDir, file), "utf-8");
+      const id = path.basename(file, ".md");
+      const content = fs.readFileSync(path.join(skillsDir, file), "utf-8");
       skills.push({ id, content });
     }
   }
@@ -240,134 +48,52 @@ function listSkills() {
 }
 function getSkill(id) {
   const skillsDir = getSkillsDir();
-  const filePath = path3.join(skillsDir, `${id}.md`);
-  if (!fs3.existsSync(filePath)) {
+  const filePath = path.join(skillsDir, `${id}.md`);
+  if (!fs.existsSync(filePath)) {
     return null;
   }
-  const content = fs3.readFileSync(filePath, "utf-8");
+  const content = fs.readFileSync(filePath, "utf-8");
   return { id, content };
 }
 function saveSkill(id, content) {
   const skillsDir = getSkillsDir();
   ensureDir(skillsDir);
-  const filePath = path3.join(skillsDir, `${id}.md`);
-  fs3.writeFileSync(filePath, content, "utf-8");
+  const filePath = path.join(skillsDir, `${id}.md`);
+  fs.writeFileSync(filePath, content, "utf-8");
 }
 function deleteSkill(id) {
   const skillsDir = getSkillsDir();
-  const filePath = path3.join(skillsDir, `${id}.md`);
-  if (fs3.existsSync(filePath)) {
-    fs3.unlinkSync(filePath);
-  }
-}
-
-// src/core/secrets.ts
-import { execFileSync } from "node:child_process";
-import crypto2 from "node:crypto";
-import fs4 from "node:fs";
-function parseSecretRef(ref) {
-  if (!ref.startsWith("secret://")) {
-    return null;
-  }
-  const name = ref.slice("secret://".length);
-  return name.length > 0 ? name : null;
-}
-
-class SecretsManager {
-  service;
-  nameIndexPath;
-  constructor(service = "mcpx", nameIndexPath = getSecretNamesPath()) {
-    this.service = service;
-    this.nameIndexPath = nameIndexPath;
-  }
-  loadNameIndex() {
-    return readJsonFile(this.nameIndexPath, { names: [] });
-  }
-  saveNameIndex(index) {
-    const deduped = Array.from(new Set(index.names)).sort();
-    writeJsonAtomic(this.nameIndexPath, { names: deduped });
-  }
-  trackSecretName(name) {
-    const index = this.loadNameIndex();
-    if (!index.names.includes(name)) {
-      index.names.push(name);
-      this.saveNameIndex(index);
-    }
-  }
-  untrackSecretName(name) {
-    const index = this.loadNameIndex();
-    index.names = index.names.filter((entry) => entry !== name);
-    this.saveNameIndex(index);
-  }
-  listSecretNames() {
-    return this.loadNameIndex().names;
-  }
-  setSecret(name, value) {
-    if (process.platform !== "darwin") {
-      throw new Error("OS keychain integration is currently implemented for macOS only.");
-    }
-    execFileSync("security", ["add-generic-password", "-U", "-a", name, "-s", this.service, "-w", value], {
-      stdio: "ignore"
-    });
-    this.trackSecretName(name);
-  }
-  removeSecret(name) {
-    if (process.platform === "darwin") {
-      try {
-        execFileSync("security", ["delete-generic-password", "-a", name, "-s", this.service], {
-          stdio: "ignore"
-        });
-      } catch {}
-    }
-    this.untrackSecretName(name);
-  }
-  getSecret(name) {
-    const envOverride = process.env[`MCPX_SECRET_${name}`];
-    if (envOverride && envOverride.length > 0) {
-      return envOverride;
-    }
-    if (process.platform !== "darwin") {
-      return null;
-    }
-    try {
-      return execFileSync("security", ["find-generic-password", "-w", "-a", name, "-s", this.service], {
-        encoding: "utf8"
-      }).trim();
-    } catch {
-      return null;
-    }
-  }
-  resolveMaybeSecret(value) {
-    const secretName = parseSecretRef(value);
-    if (!secretName) {
-      return value;
-    }
-    const secret = this.getSecret(secretName);
-    if (!secret) {
-      throw new Error(`Secret not found: ${secretName}`);
-    }
-    return secret;
-  }
-  rotateLocalToken(secretName = "local_gateway_token") {
-    const token = crypto2.randomBytes(32).toString("base64url");
-    this.setSecret(secretName, token);
-    return token;
+  const filePath = path.join(skillsDir, `${id}.md`);
+  if (fs.existsSync(filePath)) {
+    fs.unlinkSync(filePath);
   }
 }
-function readSecretValueFromStdin() {
-  if (process.stdin.isTTY) {
-    throw new Error("No value provided. Use --value or pipe a value via stdin.");
-  }
-  const content = fs4.readFileSync(process.stdin.fd, "utf8").trim();
-  if (content.length === 0) {
-    throw new Error("Empty secret value provided.");
-  }
-  return content;
-}
 
 // src/core/auth-probe.ts
 var JSON_RPC_VERSION = "2.0";
 var DEFAULT_AUTH_PROBE_TIMEOUT_MS = 8000;
+var AUTH_KEYWORDS = [
+  "unauthorized",
+  "unauthenticated",
+  "forbidden",
+  "authentication",
+  "authorization",
+  "api key",
+  "api_key",
+  "apikey",
+  "credentials",
+  "access denied",
+  "auth required",
+  "x-api-key",
+  "invalid key",
+  "missing header",
+  "not authenticated",
+  "auth token"
+];
+function isAuthRelatedMessage(message) {
+  const lower = message.toLowerCase();
+  return AUTH_KEYWORDS.some((kw) => lower.includes(kw));
+}
 function resolveHeaders(spec, secrets) {
   const headers = {
     "content-type": "application/json",
@@ -378,6 +104,13 @@ function resolveHeaders(spec, secrets) {
   }
   return headers;
 }
+function isOAuthLikelyChallenge(wwwAuthenticate) {
+  if (!wwwAuthenticate) {
+    return false;
+  }
+  const lower = wwwAuthenticate.toLowerCase();
+  return lower.includes("bearer") || lower.includes("authorization_uri") || lower.includes("resource_metadata");
+}
 async function probeHttpAuthRequirement(spec, secrets, timeoutMs = DEFAULT_AUTH_PROBE_TIMEOUT_MS) {
   const timeoutController = new AbortController;
   const timeoutHandle = setTimeout(() => timeoutController.abort(), timeoutMs);
@@ -395,12 +128,30 @@ async function probeHttpAuthRequirement(spec, secrets, timeoutMs = DEFAULT_AUTH_
       signal: timeoutController.signal
     });
     if (response.status === 401 || response.status === 403) {
+      const wwwAuthenticate = response.headers.get("www-authenticate");
       return {
         authRequired: true,
+        oauthLikely: isOAuthLikelyChallenge(wwwAuthenticate),
         status: response.status,
-        wwwAuthenticate: response.headers.get("www-authenticate") ?? undefined
+        wwwAuthenticate: wwwAuthenticate ?? undefined
       };
     }
+    if (response.status === 200) {
+      try {
+        const body = await response.json();
+        const err = body?.error;
+        if (err && typeof err === "object" && !("result" in body)) {
+          const message = typeof err.message === "string" ? err.message : "";
+          if (message && isAuthRelatedMessage(message)) {
+            return {
+              authRequired: true,
+              status: response.status,
+              error: `JSON-RPC error: ${message}`
+            };
+          }
+        }
+      } catch {}
+    }
     return {
       authRequired: false,
       status: response.status
@@ -416,9 +167,132 @@ async function probeHttpAuthRequirement(spec, secrets, timeoutMs = DEFAULT_AUTH_
   }
 }
 
+// src/core/registry-client.ts
+var REGISTRY_BASE = "https://registry.modelcontextprotocol.io";
+async function fetchRegistryServerDetail(name) {
+  const encoded = encodeURIComponent(name);
+  const response = await fetch(`${REGISTRY_BASE}/v0.1/servers/${encoded}/versions/latest`, {
+    headers: { accept: "application/json" }
+  });
+  if (!response.ok) {
+    throw new Error(`Registry API error: ${response.status}`);
+  }
+  const data = await response.json();
+  return data.server;
+}
+var PACKAGE_PRIORITY = {
+  npm: 1,
+  pypi: 2,
+  nuget: 3,
+  oci: 4,
+  mcpb: 5
+};
+var RUNTIME_HINT = {
+  npm: "npx",
+  pypi: "uvx",
+  nuget: "dnx"
+};
+function selectBestPackage(packages = [], remotes = []) {
+  const stdioPkgs = packages.filter((p) => p.transport.type === "stdio").sort((a, b) => (PACKAGE_PRIORITY[a.registryType] ?? 99) - (PACKAGE_PRIORITY[b.registryType] ?? 99));
+  if (stdioPkgs.length > 0) {
+    return { kind: "package", package: stdioPkgs[0] };
+  }
+  const httpRemotes = remotes.filter((r) => r.type === "streamable-http" || r.type === "sse");
+  if (httpRemotes.length > 0) {
+    return { kind: "remote", remote: httpRemotes[0] };
+  }
+  if (packages.length > 0) {
+    return { kind: "package", package: packages[0] };
+  }
+  if (remotes.length > 0) {
+    return { kind: "remote", remote: remotes[0] };
+  }
+  throw new Error("Server has no packages or remotes");
+}
+function extractRequiredInputs(option) {
+  const inputs = [];
+  if (option.kind === "package" && option.package?.environmentVariables) {
+    for (const env of option.package.environmentVariables) {
+      if (env.isRequired && !env.default) {
+        inputs.push({
+          name: env.name,
+          description: env.description,
+          isSecret: env.isSecret ?? false,
+          kind: "env"
+        });
+      }
+    }
+    for (const arg of option.package.packageArguments ?? []) {
+      if (arg.isRequired && !arg.value && !arg.default) {
+        inputs.push({
+          name: arg.name ?? arg.valueHint ?? "arg",
+          description: arg.description,
+          isSecret: false,
+          kind: "arg"
+        });
+      }
+    }
+  }
+  if (option.kind === "remote" && option.remote?.headers) {
+    for (const header of option.remote.headers) {
+      if (header.isRequired && !header.default) {
+        inputs.push({
+          name: header.name,
+          description: header.description,
+          isSecret: header.isSecret ?? false,
+          kind: "header"
+        });
+      }
+    }
+  }
+  return inputs;
+}
+function mapRegistryToSpec(_name, option, resolvedValues) {
+  if (option.kind === "remote") {
+    const headers = {};
+    for (const header of option.remote?.headers ?? []) {
+      const value = resolvedValues[header.name] ?? header.default;
+      if (value)
+        headers[header.name] = value;
+    }
+    return {
+      transport: "http",
+      url: option.remote.url,
+      ...Object.keys(headers).length > 0 ? { headers } : {}
+    };
+  }
+  const pkg = option.package;
+  const runtime = pkg.runtimeHint ?? RUNTIME_HINT[pkg.registryType] ?? "npx";
+  const args = [];
+  const identifier = pkg.version ? `${pkg.identifier}@${pkg.version}` : pkg.identifier;
+  args.push(identifier);
+  for (const arg of pkg.packageArguments ?? []) {
+    const value = arg.value ?? resolvedValues[arg.name ?? arg.valueHint ?? ""] ?? arg.default;
+    if (!value)
+      continue;
+    if (arg.type === "named" && arg.name) {
+      args.push(arg.name, value);
+    } else {
+      args.push(value);
+    }
+  }
+  const env = {};
+  for (const envVar of pkg.environmentVariables ?? []) {
+    const value = resolvedValues[envVar.name] ?? envVar.default;
+    if (value)
+      env[envVar.name] = value;
+  }
+  return {
+    transport: "stdio",
+    command: runtime,
+    args,
+    ...Object.keys(env).length > 0 ? { env } : {}
+  };
+}
+
 // src/adapters/claude.ts
-import path4 from "node:path";
-import { z as z2 } from "zod";
+import path2 from "node:path";
+import { z } from "zod";
 
 // src/adapters/utils/index.ts
 function getManagedEntryNames(managedIndex, clientId) {
@@ -546,22 +420,22 @@ function syncMcpExcludedArray(raw, managedNames, managedEntries) {
 }
 
 // src/adapters/claude.ts
-var stringMapSchema = z2.record(z2.string(), z2.string());
-var claudeEntrySchema = z2.object({
-  type: z2.string().optional(),
-  url: z2.string().min(1).optional(),
+var stringMapSchema = z.record(z.string(), z.string());
+var claudeEntrySchema = z.object({
+  type: z.string().optional(),
+  url: z.string().min(1).optional(),
   headers: stringMapSchema.optional(),
-  command: z2.string().min(1).optional(),
-  args: z2.array(z2.string()).optional(),
+  command: z.string().min(1).optional(),
+  args: z.array(z.string()).optional(),
   env: stringMapSchema.optional(),
-  cwd: z2.string().min(1).optional(),
-  disabled: z2.boolean().optional()
+  cwd: z.string().min(1).optional(),
+  disabled: z.boolean().optional()
 }).passthrough();
 
 class ClaudeAdapter {
   id = "claude";
   detectConfigPath() {
-    return path4.join(homeDir(), ".claude.json");
+    return path2.join(homeDir(), ".claude.json");
   }
   supportsHttp() {
     return true;
@@ -637,20 +511,22 @@ class ClaudeAdapter {
     try {
       const raw = readJsonFile(configPath, {});
       const managedNames = options.managedEntries.map((entry) => entry.name);
-      const serverEntries = Object.fromEntries(options.managedEntries.map((entry) => [entry.name, {
+      const enabledEntries = options.managedEntries.filter((entry) => entry.enabled);
+      const serverEntries = Object.fromEntries(enabledEntries.map((entry) => [entry.name, {
         type: "http",
         url: entry.url,
         headers: entry.headers
       }]));
+      const enabledManagedNames = enabledEntries.map((entry) => entry.name);
       const topLevelServers = raw.mcpServers ?? {};
       removeSourceEntries(topLevelServers, options.sourceEntriesToRemove);
-      for (const name of managedNames) {
+      for (const name of enabledManagedNames) {
         const topLevelConflict = ensureManagedEntryWritable(options.managedIndex, this.id, name, topLevelServers[name]);
         if (topLevelConflict) {
           return errorResult(this.id, configPath, topLevelConflict);
         }
       }
-      pruneStaleManagedEntries(options.managedIndex, this.id, topLevelServers, managedNames);
+      pruneStaleManagedEntries(options.managedIndex, this.id, topLevelServers, enabledManagedNames);
       for (const [name, entry] of Object.entries(serverEntries)) {
         topLevelServers[name] = entry;
       }
@@ -673,24 +549,24 @@ class ClaudeAdapter {
 }
 
 // src/adapters/claude-desktop.ts
-import { execFileSync as execFileSync2 } from "node:child_process";
-import path5 from "node:path";
-import { z as z3 } from "zod";
-var stringMapSchema2 = z3.record(z3.string(), z3.string());
-var claudeDesktopEntrySchema = z3.object({
-  type: z3.string().optional(),
-  url: z3.string().min(1).optional(),
+import { execFileSync } from "node:child_process";
+import path3 from "node:path";
+import { z as z2 } from "zod";
+var stringMapSchema2 = z2.record(z2.string(), z2.string());
+var claudeDesktopEntrySchema = z2.object({
+  type: z2.string().optional(),
+  url: z2.string().min(1).optional(),
   headers: stringMapSchema2.optional(),
-  command: z3.string().min(1).optional(),
-  args: z3.array(z3.string()).optional(),
+  command: z2.string().min(1).optional(),
+  args: z2.array(z2.string()).optional(),
   env: stringMapSchema2.optional(),
-  cwd: z3.string().min(1).optional(),
-  disabled: z3.boolean().optional()
+  cwd: z2.string().min(1).optional(),
+  disabled: z2.boolean().optional()
 }).passthrough();
 function buildProxyEntry(entry) {
   const upstreamName = entry.name.replace(/ \(mcpx\)$/, "");
   try {
-    const mcpxPath = execFileSync2("which", ["mcpx"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    const mcpxPath = execFileSync("which", ["mcpx"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
     if (mcpxPath)
       return { command: mcpxPath, args: ["proxy", upstreamName] };
   } catch {}
@@ -700,7 +576,13 @@ function buildProxyEntry(entry) {
 class ClaudeDesktopAdapter {
   id = "claude-desktop";
   detectConfigPath() {
-    return path5.join(homeDir(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
+    if (process.platform === "linux") {
+      return path3.join(homeDir(), ".config", "Claude", "claude_desktop_config.json");
+    }
+    if (process.platform === "win32") {
+      return path3.join(process.env.APPDATA ?? "", "Claude", "claude_desktop_config.json");
+    }
+    return path3.join(homeDir(), "Library", "Application Support", "Claude", "claude_desktop_config.json");
   }
   supportsHttp() {
     return true;
@@ -786,9 +668,9 @@ class ClaudeDesktopAdapter {
       }
       raw.mcpServers = topLevelServers;
       writeJsonAtomic(configPath, raw);
-      setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(options.managedEntries.map((entry) => {
+      setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(enabledEntries.map((entry) => {
         const { command, args } = buildProxyEntry(entry);
-        return [entry.name, JSON.stringify({ command, args, enabled: entry.enabled })];
+        return [entry.name, JSON.stringify({ command, args })];
       })));
       return okResult(this.id, configPath);
     } catch (error) {
@@ -798,31 +680,31 @@ class ClaudeDesktopAdapter {
 }
 
 // src/adapters/codex.ts
-import path6 from "node:path";
-import fs5 from "node:fs";
+import path4 from "node:path";
+import fs2 from "node:fs";
 import { parse, stringify } from "@iarna/toml";
-import { z as z4 } from "zod";
-var stringMapSchema3 = z4.preprocess((value) => {
+import { z as z3 } from "zod";
+var stringMapSchema3 = z3.preprocess((value) => {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     return value;
   }
   return Object.fromEntries(Object.entries(value));
-}, z4.record(z4.string(), z4.string()));
-var codexEntrySchema = z4.object({
-  enabled: z4.boolean().optional(),
-  url: z4.string().min(1).optional(),
+}, z3.record(z3.string(), z3.string()));
+var codexEntrySchema = z3.object({
+  enabled: z3.boolean().optional(),
+  url: z3.string().min(1).optional(),
   headers: stringMapSchema3.optional(),
   http_headers: stringMapSchema3.optional(),
-  command: z4.string().min(1).optional(),
-  args: z4.array(z4.string()).optional(),
+  command: z3.string().min(1).optional(),
+  args: z3.array(z3.string()).optional(),
   env: stringMapSchema3.optional(),
-  cwd: z4.string().min(1).optional()
+  cwd: z3.string().min(1).optional()
 }).passthrough();
 
 class CodexAdapter {
   id = "codex";
   detectConfigPath() {
-    return path6.join(homeDir(), ".codex", "config.toml");
+    return path4.join(homeDir(), ".codex", "config.toml");
   }
   supportsHttp() {
     return true;
@@ -830,10 +712,10 @@ class CodexAdapter {
   scanForImports(_config, managedIndex) {
     const configPath = this.detectConfigPath();
     const result = emptyImportScan(this.id, configPath ?? undefined);
-    if (!configPath || !fs5.existsSync(configPath)) {
+    if (!configPath || !fs2.existsSync(configPath)) {
       return result;
     }
-    const existing = fs5.readFileSync(configPath, "utf8");
+    const existing = fs2.readFileSync(configPath, "utf8");
     const doc = existing.trim().length > 0 ? parse(existing) : {};
     const mcpServers = doc.mcp_servers ?? {};
     for (const [name, rawEntry] of Object.entries(mcpServers)) {
@@ -888,7 +770,7 @@ class CodexAdapter {
       return errorResult(this.id, undefined, "Unable to resolve Codex config.toml path.");
     }
     try {
-      const existing = fs5.existsSync(configPath) ? fs5.readFileSync(configPath, "utf8") : "";
+      const existing = fs2.existsSync(configPath) ? fs2.readFileSync(configPath, "utf8") : "";
       const doc = existing.trim().length > 0 ? parse(existing) : {};
       const mcpServers = doc.mcp_servers ?? {};
       removeSourceEntries(mcpServers, options.sourceEntriesToRemove);
@@ -909,10 +791,10 @@ class CodexAdapter {
         mcpServers[name] = entry;
       }
       doc.mcp_servers = mcpServers;
-      fs5.mkdirSync(path6.dirname(configPath), { recursive: true });
+      fs2.mkdirSync(path4.dirname(configPath), { recursive: true });
       const tmpPath = `${configPath}.tmp-${process.pid}-${Date.now()}`;
-      fs5.writeFileSync(tmpPath, stringify(doc), { mode: 384 });
-      fs5.renameSync(tmpPath, configPath);
+      fs2.writeFileSync(tmpPath, stringify(doc), { mode: 384 });
+      fs2.renameSync(tmpPath, configPath);
       setManagedEntries(options.managedIndex, this.id, configPath, Object.fromEntries(Object.entries(serverEntries).map(([name, entry]) => [name, JSON.stringify(entry)])));
       return okResult(this.id, configPath);
     } catch (error) {
@@ -922,24 +804,30 @@ class CodexAdapter {
 }
 
 // src/adapters/cursor.ts
-import path7 from "node:path";
-import { z as z5 } from "zod";
-var stringMapSchema4 = z5.record(z5.string(), z5.string());
-var cursorEntrySchema = z5.object({
-  type: z5.string().optional(),
-  url: z5.string().min(1).optional(),
+import path5 from "node:path";
+import { z as z4 } from "zod";
+var stringMapSchema4 = z4.record(z4.string(), z4.string());
+var cursorEntrySchema = z4.object({
+  type: z4.string().optional(),
+  url: z4.string().min(1).optional(),
   headers: stringMapSchema4.optional(),
-  command: z5.string().min(1).optional(),
-  args: z5.array(z5.string()).optional(),
+  command: z4.string().min(1).optional(),
+  args: z4.array(z4.string()).optional(),
   env: stringMapSchema4.optional(),
-  cwd: z5.string().min(1).optional(),
-  disabled: z5.boolean().optional()
+  cwd: z4.string().min(1).optional(),
+  disabled: z4.boolean().optional()
 }).passthrough();
 
 class CursorAdapter {
   id = "cursor";
   detectConfigPath() {
-    return path7.join(homeDir(), "Library", "Application Support", "Cursor", "User", "mcp.json");
+    if (process.platform === "linux") {
+      return path5.join(homeDir(), ".config", "Cursor", "User", "mcp.json");
+    }
+    if (process.platform === "win32") {
+      return path5.join(process.env.APPDATA ?? "", "Cursor", "User", "mcp.json");
+    }
+    return path5.join(homeDir(), "Library", "Application Support", "Cursor", "User", "mcp.json");
   }
   supportsHttp() {
     return true;
@@ -1045,24 +933,36 @@ class CursorAdapter {
 }
 
 // src/adapters/cline.ts
-import path8 from "node:path";
-import fs6 from "node:fs";
-import { z as z6 } from "zod";
-var stringMapSchema5 = z6.record(z6.string(), z6.string());
-var clineEntrySchema = z6.object({
-  transportType: z6.string().optional(),
-  url: z6.string().min(1).optional(),
+import path6 from "node:path";
+import fs3 from "node:fs";
+import { z as z5 } from "zod";
+var stringMapSchema5 = z5.record(z5.string(), z5.string());
+var clineEntrySchema = z5.object({
+  transportType: z5.string().optional(),
+  url: z5.string().min(1).optional(),
   headers: stringMapSchema5.optional(),
-  command: z6.string().min(1).optional(),
-  args: z6.array(z6.string()).optional(),
+  command: z5.string().min(1).optional(),
+  args: z5.array(z5.string()).optional(),
   env: stringMapSchema5.optional(),
-  cwd: z6.string().min(1).optional(),
-  disabled: z6.boolean().optional()
+  cwd: z5.string().min(1).optional(),
+  disabled: z5.boolean().optional()
 }).passthrough();
 function getCandidatePaths() {
+  if (process.platform === "linux") {
+    return [
+      path6.join(homeDir(), ".config", "Code", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json"),
+      path6.join(homeDir(), ".config", "Cursor", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json")
+    ];
+  }
+  if (process.platform === "win32") {
+    return [
+      path6.join(process.env.APPDATA ?? "", "Code", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json"),
+      path6.join(process.env.APPDATA ?? "", "Cursor", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json")
+    ];
+  }
   return [
-    path8.join(homeDir(), "Library", "Application Support", "Code", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json"),
-    path8.join(homeDir(), "Library", "Application Support", "Cursor", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json")
+    path6.join(homeDir(), "Library", "Application Support", "Code", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json"),
+    path6.join(homeDir(), "Library", "Application Support", "Cursor", "User", "globalStorage", "saoudrizwan.claude-dev", "settings", "cline_mcp_settings.json")
   ];
 }
 
@@ -1071,7 +971,7 @@ class ClineAdapter {
   detectConfigPath() {
     const candidates = getCandidatePaths();
     for (const candidate of candidates) {
-      if (fs6.existsSync(candidate)) {
+      if (fs3.existsSync(candidate)) {
         return candidate;
       }
     }
@@ -1083,7 +983,7 @@ class ClineAdapter {
   scanForImports(_config, managedIndex) {
     const configPath = this.detectConfigPath();
     const result = emptyImportScan(this.id, configPath ?? undefined);
-    if (!configPath || !fs6.existsSync(configPath)) {
+    if (!configPath || !fs3.existsSync(configPath)) {
       return result;
     }
     const raw = readJsonFile(configPath, {});
@@ -1141,6 +1041,9 @@ class ClineAdapter {
     if (!configPath) {
       return errorResult(this.id, undefined, "Unable to resolve Cline MCP config path.");
     }
+    if (!fs3.existsSync(configPath)) {
+      return okResult(this.id, configPath, "Cline config not found; skipping sync.");
+    }
     try {
       const raw = readJsonFile(configPath, {});
       const servers = {
@@ -1178,24 +1081,24 @@ class ClineAdapter {
 }
 
 // src/adapters/kiro.ts
-import fs7 from "node:fs";
-import path9 from "node:path";
-import { z as z7 } from "zod";
-var stringMapSchema6 = z7.record(z7.string(), z7.string());
-var kiroEntrySchema = z7.object({
-  url: z7.string().min(1).optional(),
+import fs4 from "node:fs";
+import path7 from "node:path";
+import { z as z6 } from "zod";
+var stringMapSchema6 = z6.record(z6.string(), z6.string());
+var kiroEntrySchema = z6.object({
+  url: z6.string().min(1).optional(),
   headers: stringMapSchema6.optional(),
-  command: z7.string().min(1).optional(),
-  args: z7.array(z7.string()).optional(),
+  command: z6.string().min(1).optional(),
+  args: z6.array(z6.string()).optional(),
   env: stringMapSchema6.optional(),
-  cwd: z7.string().min(1).optional(),
-  disabled: z7.boolean().optional()
+  cwd: z6.string().min(1).optional(),
+  disabled: z6.boolean().optional()
 }).passthrough();
 
 class KiroAdapter {
   id = "kiro";
   detectConfigPath() {
-    return path9.join(homeDir(), ".kiro", "settings", "mcp.json");
+    return path7.join(homeDir(), ".kiro", "settings", "mcp.json");
   }
   supportsHttp() {
     return true;
@@ -1295,46 +1198,46 @@ class KiroAdapter {
     }
   }
   syncSkills(skills) {
-    const skillsDir = path9.join(homeDir(), ".kiro", "skills");
-    if (!fs7.existsSync(skillsDir)) {
-      fs7.mkdirSync(skillsDir, { recursive: true });
+    const skillsDir = path7.join(homeDir(), ".kiro", "skills");
+    if (!fs4.existsSync(skillsDir)) {
+      fs4.mkdirSync(skillsDir, { recursive: true });
     }
-    const existingFiles = fs7.readdirSync(skillsDir);
+    const existingFiles = fs4.readdirSync(skillsDir);
     const managedIds = new Set(skills.map((s) => s.id));
     for (const file of existingFiles) {
       if (file.endsWith(".md")) {
-        const id = path9.basename(file, ".md");
+        const id = path7.basename(file, ".md");
         if (!managedIds.has(id)) {
-          fs7.unlinkSync(path9.join(skillsDir, file));
+          fs4.unlinkSync(path7.join(skillsDir, file));
         }
       }
     }
     for (const skill of skills) {
-      const targetPath = path9.join(skillsDir, `${skill.id}.md`);
-      fs7.writeFileSync(targetPath, skill.content, "utf-8");
+      const targetPath = path7.join(skillsDir, `${skill.id}.md`);
+      fs4.writeFileSync(targetPath, skill.content, "utf-8");
     }
   }
 }
 
 // src/adapters/opencode.ts
-import path10 from "node:path";
-import { z as z8 } from "zod";
-var stringMapSchema7 = z8.record(z8.string(), z8.string());
-var openCodeEntrySchema = z8.object({
-  type: z8.string().optional(),
-  url: z8.string().min(1).optional(),
+import path8 from "node:path";
+import { z as z7 } from "zod";
+var stringMapSchema7 = z7.record(z7.string(), z7.string());
+var openCodeEntrySchema = z7.object({
+  type: z7.string().optional(),
+  url: z7.string().min(1).optional(),
   headers: stringMapSchema7.optional(),
-  command: z8.string().min(1).optional(),
-  args: z8.array(z8.string()).optional(),
+  command: z7.string().min(1).optional(),
+  args: z7.array(z7.string()).optional(),
   env: stringMapSchema7.optional(),
-  cwd: z8.string().min(1).optional(),
-  enabled: z8.boolean().optional()
+  cwd: z7.string().min(1).optional(),
+  enabled: z7.boolean().optional()
 }).passthrough();
 
 class OpenCodeAdapter {
   id = "opencode";
   detectConfigPath() {
-    return path10.join(homeDir(), ".config", "opencode", "opencode.json");
+    return path8.join(homeDir(), ".config", "opencode", "opencode.json");
   }
   supportsHttp() {
     return true;
@@ -1437,24 +1340,30 @@ class OpenCodeAdapter {
 }
 
 // src/adapters/vscode.ts
-import path11 from "node:path";
-import { z as z9 } from "zod";
-var stringMapSchema8 = z9.record(z9.string(), z9.string());
-var vscodeEntrySchema = z9.object({
-  type: z9.string().optional(),
-  url: z9.string().min(1).optional(),
+import path9 from "node:path";
+import { z as z8 } from "zod";
+var stringMapSchema8 = z8.record(z8.string(), z8.string());
+var vscodeEntrySchema = z8.object({
+  type: z8.string().optional(),
+  url: z8.string().min(1).optional(),
   headers: stringMapSchema8.optional(),
-  command: z9.string().min(1).optional(),
-  args: z9.array(z9.string()).optional(),
+  command: z8.string().min(1).optional(),
+  args: z8.array(z8.string()).optional(),
   env: stringMapSchema8.optional(),
-  cwd: z9.string().min(1).optional(),
-  disabled: z9.boolean().optional()
+  cwd: z8.string().min(1).optional(),
+  disabled: z8.boolean().optional()
 }).passthrough();
 
 class VsCodeAdapter {
   id = "vscode";
   detectConfigPath() {
-    return path11.join(homeDir(), "Library", "Application Support", "Code", "User", "mcp.json");
+    if (process.platform === "linux") {
+      return path9.join(homeDir(), ".config", "Code", "User", "mcp.json");
+    }
+    if (process.platform === "win32") {
+      return path9.join(process.env.APPDATA ?? "", "Code", "User", "mcp.json");
+    }
+    return path9.join(homeDir(), "Library", "Application Support", "Code", "User", "mcp.json");
   }
   supportsHttp() {
     return true;
@@ -1560,24 +1469,24 @@ class VsCodeAdapter {
 }
 
 // src/adapters/qwen.ts
-import fs8 from "node:fs";
-import path12 from "node:path";
-import { z as z10 } from "zod";
-var stringMapSchema9 = z10.record(z10.string(), z10.string());
-var qwenEntrySchema = z10.object({
-  httpUrl: z10.string().min(1).optional(),
+import fs5 from "node:fs";
+import path10 from "node:path";
+import { z as z9 } from "zod";
+var stringMapSchema9 = z9.record(z9.string(), z9.string());
+var qwenEntrySchema = z9.object({
+  httpUrl: z9.string().min(1).optional(),
   headers: stringMapSchema9.optional(),
-  command: z10.string().min(1).optional(),
-  args: z10.array(z10.string()).optional(),
+  command: z9.string().min(1).optional(),
+  args: z9.array(z9.string()).optional(),
   env: stringMapSchema9.optional(),
-  cwd: z10.string().min(1).optional(),
-  disabled: z10.boolean().optional()
+  cwd: z9.string().min(1).optional(),
+  disabled: z9.boolean().optional()
 }).passthrough();
 
 class QwenAdapter {
   id = "qwen";
   detectConfigPath() {
-    return path12.join(homeDir(), ".qwen", "settings.json");
+    return path10.join(homeDir(), ".qwen", "settings.json");
   }
   supportsHttp() {
     return true;
@@ -1674,23 +1583,23 @@ class QwenAdapter {
     }
   }
   syncSkills(skills) {
-    const skillsDir = path12.join(homeDir(), ".qwen", "skills");
-    if (!fs8.existsSync(skillsDir)) {
-      fs8.mkdirSync(skillsDir, { recursive: true });
+    const skillsDir = path10.join(homeDir(), ".qwen", "skills");
+    if (!fs5.existsSync(skillsDir)) {
+      fs5.mkdirSync(skillsDir, { recursive: true });
     }
-    const existingFiles = fs8.readdirSync(skillsDir);
+    const existingFiles = fs5.readdirSync(skillsDir);
     const managedIds = new Set(skills.map((s) => s.id));
     for (const file of existingFiles) {
       if (file.endsWith(".md")) {
-        const id = path12.basename(file, ".md");
+        const id = path10.basename(file, ".md");
         if (!managedIds.has(id)) {
-          fs8.unlinkSync(path12.join(skillsDir, file));
+          fs5.unlinkSync(path10.join(skillsDir, file));
         }
       }
     }
     for (const skill of skills) {
-      const targetPath = path12.join(skillsDir, `${skill.id}.md`);
-      fs8.writeFileSync(targetPath, skill.content, "utf-8");
+      const targetPath = path10.join(skillsDir, `${skill.id}.md`);
+      fs5.writeFileSync(targetPath, skill.content, "utf-8");
     }
   }
 }
@@ -1746,6 +1655,9 @@ function buildManagedEntries(config, gatewayUrl, localToken) {
     enabled: isServerEnabled(spec)
   }));
 }
+function isClientInternalServerCommand(candidate) {
+  return candidate.spec.transport === "stdio" && /\.app\/Contents\//.test(candidate.spec.command ?? "");
+}
 function syncAllClients(config, secrets, targetClients) {
   const adapters = getAdapters();
   const managedIndexPath = getManagedIndexPath();
@@ -1764,6 +1676,16 @@ function syncAllClients(config, secrets, targetClients) {
       const scan = adapter.scanForImports(config, managedIndex);
       imports.skipped.push(...scan.skipped);
       for (const candidate of scan.candidates) {
+        if (isClientInternalServerCommand(candidate)) {
+          imports.skipped.push({
+            clientId: candidate.clientId,
+            configPath: candidate.configPath,
+            sourceEntryName: candidate.sourceEntryName,
+            serverName: candidate.serverName,
+            reason: "client-internal server"
+          });
+          continue;
+        }
         const existing = config.servers[candidate.serverName];
         if (!existing) {
           config.servers[candidate.serverName] = candidate.spec;
@@ -1963,13 +1885,299 @@ function maybePrefixBearer(target, value, raw = false) {
   return `Bearer ${value}`;
 }
 
+// src/core/spawn-env.ts
+import os from "node:os";
+import path11 from "node:path";
+import fs6 from "node:fs";
+function existingNvmCurrentBin() {
+  const nvmDir = process.env.NVM_DIR ?? path11.join(os.homedir(), ".nvm");
+  const current = path11.join(nvmDir, "current", "bin");
+  return fs6.existsSync(current) ? current : null;
+}
+function buildEnrichedPath(current = process.env.PATH ?? "") {
+  const candidates = [
+    ...current.split(":"),
+    "/opt/homebrew/bin",
+    "/usr/local/bin",
+    path11.join(os.homedir(), ".bun", "bin"),
+    path11.join(os.homedir(), ".local", "bin"),
+    existingNvmCurrentBin()
+  ].filter((entry) => Boolean(entry));
+  const seen = new Set;
+  const entries = [];
+  for (const candidate of candidates) {
+    if (!candidate || seen.has(candidate)) {
+      continue;
+    }
+    seen.add(candidate);
+    entries.push(candidate);
+  }
+  return entries.join(":");
+}
+
+// src/core/oauth.ts
+import http from "node:http";
+import crypto from "node:crypto";
+import {
+  auth,
+  discoverOAuthServerInfo,
+  refreshAuthorization
+} from "@modelcontextprotocol/sdk/client/auth.js";
+function oauthSecretName(serverName, suffix) {
+  return `oauth_${serverName.toLowerCase().replace(/[^a-z0-9._-]/g, "_")}_${suffix}`;
+}
+function readJsonSecret(secrets, name) {
+  const raw = secrets.getSecret(name);
+  if (!raw) {
+    return;
+  }
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return;
+  }
+}
+function writeJsonSecret(secrets, name, value) {
+  secrets.setSecret(name, JSON.stringify(value));
+}
+function isOAuthReference(value) {
+  return value.startsWith("oauth://");
+}
+function oauthReferenceServerName(value) {
+  if (!isOAuthReference(value)) {
+    throw new Error(`Not an OAuth reference: ${value}`);
+  }
+  return decodeURIComponent(value.slice("oauth://".length));
+}
+function tokensAreExpiring(tokens) {
+  if (!tokens.tokens.expires_in) {
+    return false;
+  }
+  const expiresAt = tokens.obtainedAt + tokens.tokens.expires_in * 1000;
+  return Date.now() >= expiresAt - 60000;
+}
+
+class McpxOAuthProvider {
+  #serverName;
+  #secrets;
+  #redirectUrlValue;
+  #stateValue;
+  constructor(serverName, secrets, redirectUrl, state = crypto.randomUUID()) {
+    this.#serverName = serverName;
+    this.#secrets = secrets;
+    this.#redirectUrlValue = redirectUrl;
+    this.#stateValue = state;
+  }
+  get redirectUrl() {
+    return this.#redirectUrlValue;
+  }
+  get clientMetadata() {
+    if (!this.#redirectUrlValue) {
+      return {
+        redirect_uris: [],
+        token_endpoint_auth_method: "none",
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+        client_name: "mcpx"
+      };
+    }
+    return {
+      redirect_uris: [this.#redirectUrlValue],
+      token_endpoint_auth_method: "none",
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      client_name: "mcpx"
+    };
+  }
+  state() {
+    return this.#stateValue;
+  }
+  clientInformation() {
+    return readJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "client"));
+  }
+  saveClientInformation(clientInformation) {
+    writeJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "client"), clientInformation);
+  }
+  tokens() {
+    return readJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "tokens"))?.tokens;
+  }
+  saveTokens(tokens) {
+    writeJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "tokens"), {
+      tokens,
+      obtainedAt: Date.now()
+    });
+  }
+  redirectToAuthorization(_authorizationUrl) {}
+  saveCodeVerifier(codeVerifier) {
+    this.#secrets.setSecret(oauthSecretName(this.#serverName, "verifier"), codeVerifier);
+  }
+  codeVerifier() {
+    const verifier = this.#secrets.getSecret(oauthSecretName(this.#serverName, "verifier"));
+    if (!verifier) {
+      throw new Error(`Missing OAuth code verifier for "${this.#serverName}".`);
+    }
+    return verifier;
+  }
+  saveDiscoveryState(state) {
+    writeJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "discovery"), state);
+  }
+  discoveryState() {
+    return readJsonSecret(this.#secrets, oauthSecretName(this.#serverName, "discovery"));
+  }
+  invalidateCredentials(scope) {
+    const suffixes = scope === "all" ? ["client", "tokens", "verifier", "discovery"] : [scope];
+    for (const suffix of suffixes) {
+      this.#secrets.removeSecret(oauthSecretName(this.#serverName, suffix));
+    }
+  }
+}
+
+class InteractiveOAuthProvider extends McpxOAuthProvider {
+  #openUrl;
+  constructor(serverName, secrets, redirectUrl, state, openUrl) {
+    super(serverName, secrets, redirectUrl, state);
+    this.#openUrl = openUrl;
+  }
+  async redirectToAuthorization(authorizationUrl) {
+    await this.#openUrl(authorizationUrl.toString());
+  }
+}
+function listen(server) {
+  return new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      if (!address || typeof address === "string") {
+        reject(new Error("Failed to start OAuth callback server."));
+        return;
+      }
+      resolve(address.port);
+    });
+  });
+}
+function closeServer(server) {
+  return new Promise((resolve) => {
+    server.close(() => resolve());
+  });
+}
+function waitForAuthorizationCode(server, expectedState, timeoutMs = 120000) {
+  return new Promise((resolve, reject) => {
+    const timeout = setTimeout(() => {
+      reject(new Error(`OAuth login timed out after ${timeoutMs}ms.`));
+    }, timeoutMs);
+    server.on("request", (request, response) => {
+      const url = new URL(request.url ?? "/", "http://127.0.0.1");
+      const code = url.searchParams.get("code");
+      const state = url.searchParams.get("state");
+      const error = url.searchParams.get("error");
+      response.setHeader("content-type", "text/html; charset=utf-8");
+      if (error) {
+        response.statusCode = 400;
+        response.end("<html><body><h1>mcpx OAuth failed</h1><p>You can close this window.</p></body></html>");
+        clearTimeout(timeout);
+        reject(new Error(`OAuth authorization failed: ${error}`));
+        return;
+      }
+      if (!code) {
+        response.statusCode = 400;
+        response.end("<html><body><h1>Missing OAuth code</h1><p>You can close this window.</p></body></html>");
+        return;
+      }
+      if (state !== expectedState) {
+        response.statusCode = 400;
+        response.end("<html><body><h1>OAuth state mismatch</h1><p>You can close this window.</p></body></html>");
+        clearTimeout(timeout);
+        reject(new Error("OAuth state mismatch."));
+        return;
+      }
+      response.end("<html><body><h1>mcpx OAuth complete</h1><p>You can close this window.</p></body></html>");
+      clearTimeout(timeout);
+      resolve(code);
+    });
+  });
+}
+function bindOAuthReference(config, serverName) {
+  const spec = config.servers[serverName];
+  if (!spec) {
+    throw new Error(`Server "${serverName}" not found.`);
+  }
+  if (spec.transport !== "http") {
+    throw new Error(`OAuth login only supports HTTP servers.`);
+  }
+  spec.headers = {
+    ...spec.headers ?? {},
+    Authorization: `oauth://${encodeURIComponent(serverName)}`
+  };
+}
+async function runOAuthLogin(serverName, spec, secrets, openUrl, configPath) {
+  const state = crypto.randomUUID();
+  const callbackServer = http.createServer();
+  const port = await listen(callbackServer);
+  const redirectUrl = `http://127.0.0.1:${port}/callback`;
+  const provider = new InteractiveOAuthProvider(serverName, secrets, redirectUrl, state, openUrl);
+  const codePromise = waitForAuthorizationCode(callbackServer, state);
+  try {
+    const initial = await auth(provider, {
+      serverUrl: spec.url
+    });
+    if (initial !== "REDIRECT") {
+      throw new Error(`Expected OAuth redirect for "${serverName}", got ${initial}.`);
+    }
+    const authorizationCode = await codePromise;
+    const result = await auth(provider, {
+      serverUrl: spec.url,
+      authorizationCode
+    });
+    if (result !== "AUTHORIZED") {
+      throw new Error(`OAuth login did not authorize "${serverName}".`);
+    }
+    const config = loadConfig(configPath);
+    bindOAuthReference(config, serverName);
+    saveConfig(config, configPath);
+    syncAllClients(config, secrets);
+    return { serverName, authorized: true };
+  } finally {
+    await closeServer(callbackServer);
+  }
+}
+async function getOAuthAccessToken(serverName, spec, secrets, options = {}) {
+  const stored = readJsonSecret(secrets, oauthSecretName(serverName, "tokens"));
+  if (!stored) {
+    throw new Error(`No OAuth tokens stored for "${serverName}". Run mcpx auth login ${serverName}.`);
+  }
+  if (!options.forceRefresh && !tokensAreExpiring(stored)) {
+    return stored.tokens.access_token;
+  }
+  if (!stored.tokens.refresh_token) {
+    if (!options.forceRefresh) {
+      return stored.tokens.access_token;
+    }
+    throw new Error(`No OAuth refresh token stored for "${serverName}". Re-authentication required.`);
+  }
+  const provider = new McpxOAuthProvider(serverName, secrets);
+  const clientInformation = provider.clientInformation();
+  if (!clientInformation) {
+    throw new Error(`No OAuth client information stored for "${serverName}". Re-authentication required.`);
+  }
+  const cachedDiscovery = provider.discoveryState();
+  const serverInfo = cachedDiscovery ?? await discoverOAuthServerInfo(spec.url);
+  const refreshed = await refreshAuthorization(serverInfo.authorizationServerUrl, {
+    metadata: serverInfo.authorizationServerMetadata,
+    clientInformation,
+    refreshToken: stored.tokens.refresh_token,
+    resource: serverInfo.resourceMetadata?.resource ? new URL(serverInfo.resourceMetadata.resource) : undefined
+  });
+  provider.saveTokens(refreshed);
+  return refreshed.access_token;
+}
+
 // src/version.ts
 var APP_VERSION = "0.1.3";
 
 // src/core/update.ts
-import fs9 from "node:fs";
-import path13 from "node:path";
-import { execFileSync as execFileSync3 } from "node:child_process";
+import fs7 from "node:fs";
+import path12 from "node:path";
+import { execFileSync as execFileSync2 } from "node:child_process";
 function compareVersions(a, b) {
   const partsA = a.split(".").map(Number);
   const partsB = b.split(".").map(Number);
@@ -1985,7 +2193,7 @@ function compareVersions(a, b) {
 }
 async function checkForUpdates() {
   try {
-    const output = execFileSync3("npm", ["view", "@kwonye/mcpx", "version"], {
+    const output = execFileSync2("npm", ["view", "@kwonye/mcpx", "version"], {
       encoding: "utf8",
       stdio: ["pipe", "pipe", "pipe"]
     }).trim();
@@ -2007,17 +2215,17 @@ async function checkForUpdates() {
 }
 function getStagedUpdate() {
   const stagedPath = getStagedVersionPath();
-  if (!fs9.existsSync(stagedPath)) {
+  if (!fs7.existsSync(stagedPath)) {
     return null;
   }
   try {
-    const raw = fs9.readFileSync(stagedPath, "utf8");
+    const raw = fs7.readFileSync(stagedPath, "utf8");
     const info = JSON.parse(raw);
     if (!info.version || !info.cliPath) {
       return null;
     }
-    const absoluteCliPath = path13.isAbsolute(info.cliPath) ? info.cliPath : path13.join(getUpdatesDir(), info.cliPath);
-    if (!fs9.existsSync(absoluteCliPath)) {
+    const absoluteCliPath = path12.isAbsolute(info.cliPath) ? info.cliPath : path12.join(getUpdatesDir(), info.cliPath);
+    if (!fs7.existsSync(absoluteCliPath)) {
       return null;
     }
     return {
@@ -2033,15 +2241,15 @@ function stageUpdate(version, cliPath) {
   ensureDir(updatesDir);
   const stagedInfo = {
     version,
-    cliPath: path13.isAbsolute(cliPath) ? path13.relative(updatesDir, cliPath) : cliPath,
+    cliPath: path12.isAbsolute(cliPath) ? path12.relative(updatesDir, cliPath) : cliPath,
     stagedAt: new Date().toISOString()
   };
-  fs9.writeFileSync(getStagedVersionPath(), JSON.stringify(stagedInfo, null, 2), "utf8");
+  fs7.writeFileSync(getStagedVersionPath(), JSON.stringify(stagedInfo, null, 2), "utf8");
 }
 function clearStagedUpdate() {
   const stagedPath = getStagedVersionPath();
-  if (fs9.existsSync(stagedPath)) {
-    fs9.unlinkSync(stagedPath);
+  if (fs7.existsSync(stagedPath)) {
+    fs7.unlinkSync(stagedPath);
   }
 }
 function getStagedCliPath() {
@@ -2050,31 +2258,31 @@ function getStagedCliPath() {
 }
 function removeOldVersions(keepCount = 2) {
   const updatesDir = getUpdatesDir();
-  if (!fs9.existsSync(updatesDir)) {
+  if (!fs7.existsSync(updatesDir)) {
     return;
   }
-  const entries = fs9.readdirSync(updatesDir, { withFileTypes: true });
+  const entries = fs7.readdirSync(updatesDir, { withFileTypes: true });
   const versionDirs = entries.filter((entry) => entry.isDirectory() && entry.name.startsWith("v")).map((entry) => entry.name).sort((a, b) => compareVersions(b.slice(1), a.slice(1)));
   if (versionDirs.length <= keepCount) {
     return;
   }
   for (const oldVersion of versionDirs.slice(keepCount)) {
-    const oldPath = path13.join(updatesDir, oldVersion);
+    const oldPath = path12.join(updatesDir, oldVersion);
     try {
-      fs9.rmSync(oldPath, { recursive: true, force: true });
+      fs7.rmSync(oldPath, { recursive: true, force: true });
     } catch {}
   }
 }
 
 // src/core/update-manager.ts
-import fs10 from "node:fs";
-import path14 from "node:path";
+import fs8 from "node:fs";
+import path13 from "node:path";
 import { execSync, spawn } from "node:child_process";
 function acquireLock() {
   const lockPath = getUpdateLockPath();
   try {
-    ensureDir(path14.dirname(lockPath));
-    fs10.writeFileSync(lockPath, `${process.pid}
+    ensureDir(path13.dirname(lockPath));
+    fs8.writeFileSync(lockPath, `${process.pid}
 `, { flag: "wx" });
     return true;
   } catch {
@@ -2084,25 +2292,25 @@ function acquireLock() {
 function releaseLock() {
   const lockPath = getUpdateLockPath();
   try {
-    fs10.unlinkSync(lockPath);
+    fs8.unlinkSync(lockPath);
   } catch {}
 }
 function isUpdateInProgress() {
   const lockPath = getUpdateLockPath();
-  if (!fs10.existsSync(lockPath)) {
+  if (!fs8.existsSync(lockPath)) {
     return false;
   }
   try {
-    const raw = fs10.readFileSync(lockPath, "utf8").trim();
+    const raw = fs8.readFileSync(lockPath, "utf8").trim();
     const pid = Number(raw);
     if (!Number.isFinite(pid) || pid <= 0) {
-      fs10.unlinkSync(lockPath);
+      fs8.unlinkSync(lockPath);
       return false;
     }
     process.kill(pid, 0);
     return true;
   } catch {
-    fs10.unlinkSync(lockPath);
+    fs8.unlinkSync(lockPath);
     return false;
   }
 }
@@ -2113,8 +2321,8 @@ async function downloadAndStageUpdate() {
   }
   const targetVersion = updateStatus.latestVersion;
   const updatesDir = getUpdatesDir();
-  const versionDir = path14.join(updatesDir, `v${targetVersion}`);
-  if (fs10.existsSync(versionDir)) {
+  const versionDir = path13.join(updatesDir, `v${targetVersion}`);
+  if (fs8.existsSync(versionDir)) {
     const existingStaged = getStagedUpdate();
     if (existingStaged?.version === targetVersion) {
       return { success: false, error: `Version ${targetVersion} already staged` };
@@ -2126,8 +2334,8 @@ async function downloadAndStageUpdate() {
       cwd: versionDir,
       stdio: ["pipe", "pipe", "pipe"]
     });
-    const tarballPath = path14.join(versionDir, `kwonye-mcpx-${targetVersion}.tgz`);
-    if (!fs10.existsSync(tarballPath)) {
+    const tarballPath = path13.join(versionDir, `kwonye-mcpx-${targetVersion}.tgz`);
+    if (!fs8.existsSync(tarballPath)) {
       throw new Error("Downloaded tarball not found");
     }
     execSync(`tar -xzf ${tarballPath} --strip-components=1`, {
@@ -2138,8 +2346,8 @@ async function downloadAndStageUpdate() {
       cwd: versionDir,
       stdio: ["pipe", "pipe", "pipe"]
     });
-    const cliPath = path14.join(versionDir, "dist", "cli.js");
-    if (!fs10.existsSync(cliPath)) {
+    const cliPath = path13.join(versionDir, "dist", "cli.js");
+    if (!fs8.existsSync(cliPath)) {
       throw new Error("CLI entry point not found in downloaded package");
     }
     stageUpdate(targetVersion, cliPath);
@@ -2147,7 +2355,7 @@ async function downloadAndStageUpdate() {
     return { success: true, version: targetVersion };
   } catch (error) {
     try {
-      fs10.rmSync(versionDir, { recursive: true, force: true });
+      fs8.rmSync(versionDir, { recursive: true, force: true });
     } catch {}
     return {
       success: false,
@@ -2225,14 +2433,14 @@ function performRollback() {
 }
 
 // src/core/daemon.ts
-import fs11 from "node:fs";
+import fs9 from "node:fs";
 import net from "node:net";
 import { spawn as spawn2 } from "node:child_process";
 
 // src/gateway/server.ts
-import http from "node:http";
-import { URL } from "node:url";
-import crypto3 from "node:crypto";
+import http2 from "node:http";
+import { URL as URL2 } from "node:url";
+import crypto2 from "node:crypto";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import {
   StdioClientTransport,
@@ -2321,16 +2529,16 @@ function getWellKnownPrefix(pathname) {
   return null;
 }
 function getUpstreamPathSuffixForWellKnown(upstream) {
-  const upstreamUrl = new URL(upstream.spec.url);
+  const upstreamUrl = new URL2(upstream.spec.url);
   if (upstreamUrl.pathname === "/") {
     return "";
   }
   return upstreamUrl.pathname.endsWith("/") ? upstreamUrl.pathname.slice(0, -1) : upstreamUrl.pathname;
 }
 function buildWellKnownUpstreamUrl(upstream, prefix) {
-  const upstreamUrl = new URL(upstream.spec.url);
+  const upstreamUrl = new URL2(upstream.spec.url);
   const suffix = getUpstreamPathSuffixForWellKnown(upstream);
-  return new URL(`${prefix}${suffix}`, upstreamUrl.origin);
+  return new URL2(`${prefix}${suffix}`, upstreamUrl.origin);
 }
 function getLocalOriginFromRequest(request) {
   return `http://${request.headers.host ?? "127.0.0.1"}`;
@@ -2346,7 +2554,7 @@ function appendUpstreamQuery(url, upstream) {
   if (!upstream) {
     return url;
   }
-  const parsed = new URL(url);
+  const parsed = new URL2(url);
   parsed.searchParams.set("upstream", upstream);
   return parsed.toString();
 }
@@ -2411,6 +2619,62 @@ async function callUpstream(upstream, method, params, id, secrets, runtime, pass
   }
   return callHttpUpstream(upstream, method, params, id, secrets, passthroughAuthorizationHeader);
 }
+async function getUpstreamTokenCounts(config, secrets, runtime) {
+  if (!runtime.tokenCache) {
+    runtime.tokenCache = new Map;
+  }
+  const results = {};
+  const upstreams = listUpstreams(config);
+  for (const upstream of upstreams) {
+    const fingerprint = specFingerprint(upstream.spec);
+    const cached = runtime.tokenCache.get(upstream.name);
+    if (cached?.fingerprint === fingerprint) {
+      results[upstream.name] = cached.count;
+      continue;
+    }
+    let toolsCount = 0;
+    let resourcesCount = 0;
+    let promptsCount = 0;
+    const errors = [];
+    try {
+      const toolsResult = await callUpstream(upstream, "tools/list", {}, "token-tools", secrets, runtime);
+      if (toolsResult && toolsResult.tools) {
+        toolsCount = Math.ceil(JSON.stringify(toolsResult.tools).length / 4);
+      }
+    } catch (error) {
+      errors.push(`tools/list: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    try {
+      const resourcesResult = await callUpstream(upstream, "resources/list", {}, "token-resources", secrets, runtime);
+      if (resourcesResult && resourcesResult.resources) {
+        resourcesCount = Math.ceil(JSON.stringify(resourcesResult.resources).length / 4);
+      }
+    } catch (error) {
+      errors.push(`resources/list: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    try {
+      const promptsResult = await callUpstream(upstream, "prompts/list", {}, "token-prompts", secrets, runtime);
+      if (promptsResult && promptsResult.prompts) {
+        promptsCount = Math.ceil(JSON.stringify(promptsResult.prompts).length / 4);
+      }
+    } catch (error) {
+      errors.push(`prompts/list: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const total = toolsCount + resourcesCount + promptsCount;
+    const countObj = {
+      tools: toolsCount,
+      resources: resourcesCount,
+      prompts: promptsCount,
+      total,
+      error: errors.length > 0 ? errors.join("; ") : undefined
+    };
+    if (errors.length === 0) {
+      runtime.tokenCache.set(upstream.name, { fingerprint, count: countObj });
+    }
+    results[upstream.name] = countObj;
+  }
+  return results;
+}
 function getConfiguredTimeoutMs() {
   const configuredTimeout = Number(process.env.MCPX_UPSTREAM_TIMEOUT_MS ?? DEFAULT_UPSTREAM_TIMEOUT_MS);
   return Number.isFinite(configuredTimeout) && configuredTimeout > 0 ? configuredTimeout : DEFAULT_UPSTREAM_TIMEOUT_MS;
@@ -2431,11 +2695,9 @@ function specFingerprint(spec) {
   return JSON.stringify(spec);
 }
 function resolveStdioEnv(spec, secrets) {
-  if (!spec.env || Object.keys(spec.env).length === 0) {
-    return;
-  }
   const env = getDefaultEnvironment();
-  for (const [key, value] of Object.entries(spec.env)) {
+  env.PATH = buildEnrichedPath(env.PATH);
+  for (const [key, value] of Object.entries(spec.env ?? {})) {
     env[key] = secrets.resolveMaybeSecret(value);
   }
   return env;
@@ -2544,12 +2806,21 @@ async function callStdioUpstream(upstream, method, params, secrets, runtime) {
   }
 }
 async function callHttpUpstream(upstream, method, params, id, secrets, passthroughAuthorizationHeader) {
+  return callHttpUpstreamOnce(upstream, method, params, id, secrets, passthroughAuthorizationHeader, false);
+}
+async function callHttpUpstreamOnce(upstream, method, params, id, secrets, passthroughAuthorizationHeader, forceOAuthRefresh) {
   const headers = {
     "content-type": "application/json",
     accept: "application/json, text/event-stream"
   };
   for (const [key, value] of Object.entries(upstream.spec.headers ?? {})) {
-    headers[key] = secrets.resolveMaybeSecret(value);
+    if (key.toLowerCase() === "authorization" && isOAuthReference(value)) {
+      const oauthServerName = oauthReferenceServerName(value);
+      const accessToken = await getOAuthAccessToken(oauthServerName, upstream.spec, secrets, { forceRefresh: forceOAuthRefresh });
+      headers[key] = `Bearer ${accessToken}`;
+    } else {
+      headers[key] = secrets.resolveMaybeSecret(value);
+    }
   }
   if (passthroughAuthorizationHeader) {
     headers.Authorization = passthroughAuthorizationHeader;
@@ -2581,6 +2852,9 @@ async function callHttpUpstream(upstream, method, params, id, secrets, passthrou
   }
   if (!response.ok) {
     const responseText = await response.text();
+    if (!forceOAuthRefresh && (response.status === 401 || response.status === 403) && Object.values(upstream.spec.headers ?? {}).some((value) => isOAuthReference(value))) {
+      return callHttpUpstreamOnce(upstream, method, params, id, secrets, passthroughAuthorizationHeader, true);
+    }
     throw new UpstreamHttpError(upstream.name, response.status, responseText, response.headers.get("www-authenticate") ?? undefined);
   }
   let payload = null;
@@ -2719,6 +2993,15 @@ async function handleListTools(config, secrets, runtime, upstreamFilter, clientA
   for (const upstream of upstreams) {
     try {
       const result = await callUpstream(upstream, "tools/list", {}, `list-tools-${upstream.name}`, secrets, runtime, clientAuthorizationHeader);
+      if (!runtime.tokenCache) {
+        runtime.tokenCache = new Map;
+      }
+      const cached = runtime.tokenCache.get(upstream.name);
+      const existing = cached?.fingerprint === specFingerprint(upstream.spec) ? cached.count : { tools: 0, resources: 0, prompts: 0, total: 0 };
+      existing.tools = Math.ceil(JSON.stringify(result.tools ?? []).length / 4);
+      existing.total = existing.tools + existing.resources + existing.prompts;
+      delete existing.error;
+      runtime.tokenCache.set(upstream.name, { fingerprint: specFingerprint(upstream.spec), count: existing });
       for (const tool of result.tools ?? []) {
         const name = typeof tool.name === "string" ? tool.name : "tool";
         tools.push({
@@ -2727,9 +3010,10 @@ async function handleListTools(config, secrets, runtime, upstreamFilter, clientA
         });
       }
     } catch (error) {
-      if (upstreams.length === 1 && isAuthChallenge(error)) {
+      if (upstreams.length === 1) {
         throw error;
       }
+      runtime.upstreamErrors?.set(upstream.name, error instanceof Error ? error.message : String(error));
     }
   }
   return { tools };
@@ -2742,6 +3026,15 @@ async function handleListResources(config, secrets, runtime, upstreamFilter, cli
   for (const upstream of upstreams) {
     try {
       const result = await callUpstream(upstream, "resources/list", {}, `list-resources-${upstream.name}`, secrets, runtime, clientAuthorizationHeader);
+      if (!runtime.tokenCache) {
+        runtime.tokenCache = new Map;
+      }
+      const cached = runtime.tokenCache.get(upstream.name);
+      const existing = cached?.fingerprint === specFingerprint(upstream.spec) ? cached.count : { tools: 0, resources: 0, prompts: 0, total: 0 };
+      existing.resources = Math.ceil(JSON.stringify(result.resources ?? []).length / 4);
+      existing.total = existing.tools + existing.resources + existing.prompts;
+      delete existing.error;
+      runtime.tokenCache.set(upstream.name, { fingerprint: specFingerprint(upstream.spec), count: existing });
       for (const resource of result.resources ?? []) {
         const originalUri = typeof resource.uri === "string" ? resource.uri : "";
         const originalName = typeof resource.name === "string" ? resource.name : originalUri;
@@ -2752,9 +3045,10 @@ async function handleListResources(config, secrets, runtime, upstreamFilter, cli
         });
       }
     } catch (error) {
-      if (upstreams.length === 1 && isAuthChallenge(error)) {
+      if (upstreams.length === 1) {
         throw error;
       }
+      runtime.upstreamErrors?.set(upstream.name, error instanceof Error ? error.message : String(error));
     }
   }
   return { resources };
@@ -2767,6 +3061,15 @@ async function handleListPrompts(config, secrets, runtime, upstreamFilter, clien
   for (const upstream of upstreams) {
     try {
       const result = await callUpstream(upstream, "prompts/list", {}, `list-prompts-${upstream.name}`, secrets, runtime, clientAuthorizationHeader);
+      if (!runtime.tokenCache) {
+        runtime.tokenCache = new Map;
+      }
+      const cached = runtime.tokenCache.get(upstream.name);
+      const existing = cached?.fingerprint === specFingerprint(upstream.spec) ? cached.count : { tools: 0, resources: 0, prompts: 0, total: 0 };
+      existing.prompts = Math.ceil(JSON.stringify(result.prompts ?? []).length / 4);
+      existing.total = existing.tools + existing.resources + existing.prompts;
+      delete existing.error;
+      runtime.tokenCache.set(upstream.name, { fingerprint: specFingerprint(upstream.spec), count: existing });
       for (const prompt of result.prompts ?? []) {
         const name = typeof prompt.name === "string" ? prompt.name : "prompt";
         prompts.push({
@@ -2775,9 +3078,10 @@ async function handleListPrompts(config, secrets, runtime, upstreamFilter, clien
         });
       }
     } catch (error) {
-      if (upstreams.length === 1 && isAuthChallenge(error)) {
+      if (upstreams.length === 1) {
         throw error;
       }
+      runtime.upstreamErrors?.set(upstream.name, error instanceof Error ? error.message : String(error));
     }
   }
   return { prompts };
@@ -2908,11 +3212,20 @@ async function handleRequestObject(request, secrets, runtime, upstreamFilter, cl
   if (request.method === "ping") {
     return makeResult(id, { ok: true });
   }
-  const config = loadConfig();
+  const config = loadMergedConfig();
   if (upstreamFilter && listUpstreams(config, upstreamFilter).length === 0) {
     return makeError(id, -32602, `Unknown upstream: ${upstreamFilter}`);
   }
   await reconcileStdioConnections(config, runtime);
+  if (request.method === "custom/tokenCounts") {
+    const result = await getUpstreamTokenCounts(config, secrets, runtime);
+    return makeResult(id, result);
+  }
+  if (request.method === "custom/refreshTokenCounts") {
+    runtime.tokenCache?.clear();
+    const result = await getUpstreamTokenCounts(config, secrets, runtime);
+    return makeResult(id, result);
+  }
   if (request.method === "tools/list") {
     const result = await handleListTools(config, secrets, runtime, upstreamFilter, clientAuthorizationHeader);
     return makeResult(id, result);
@@ -2942,7 +3255,7 @@ async function maybeHandleWellKnownOAuthRequest(request, response, requestUrl, s
     response.end(JSON.stringify({ error: "method_not_allowed" }));
     return true;
   }
-  const config = loadConfig();
+  const config = loadMergedConfig();
   const requestedUpstream = getRequestedUpstream(requestUrl);
   const upstream = getScopedHttpUpstream(config, requestedUpstream);
   if (!upstream) {
@@ -2999,12 +3312,13 @@ async function maybeHandleWellKnownOAuthRequest(request, response, requestUrl, s
 function createGatewayServer(options) {
   const debug = process.env.MCPX_GATEWAY_DEBUG === "1";
   const runtime = {
-    stdioConnections: new Map
+    stdioConnections: new Map,
+    upstreamErrors: new Map
   };
-  const server = http.createServer(async (request, response) => {
-    let requestUrl = new URL(request.url ?? "/", `http://${request.headers.host ?? "127.0.0.1"}`);
+  const server = http2.createServer(async (request, response) => {
+    let requestUrl = new URL2(request.url ?? "/", `http://${request.headers.host ?? "127.0.0.1"}`);
     try {
-      requestUrl = new URL(request.url ?? "/", `http://${request.headers.host ?? "127.0.0.1"}`);
+      requestUrl = new URL2(request.url ?? "/", `http://${request.headers.host ?? "127.0.0.1"}`);
       const upstreamFilter = getRequestedUpstream(requestUrl);
       if (debug) {
         console.error(`[mcpx gateway] ${request.method ?? "?"} ${requestUrl.pathname} auth=${request.headers.authorization ? "yes" : "no"} accept=${request.headers.accept ?? ""}`);
@@ -3115,7 +3429,7 @@ function createGatewayServer(options) {
         response.setHeader("content-type", "application/json");
       }
       if (hasInitialize) {
-        const sessionId = crypto3.randomUUID();
+        const sessionId = crypto2.randomUUID();
         response.setHeader("mcp-session-id", sessionId);
         response.setHeader("MCP-Session-Id", sessionId);
       }
@@ -3145,7 +3459,11 @@ function createGatewayServer(options) {
           const localResourceMetadataUrl = appendUpstreamQuery(`${getLocalOriginFromRequest(request)}/.well-known/oauth-protected-resource`, getRequestedUpstream(requestUrl));
           response.setHeader("www-authenticate", rewriteWwwAuthenticateResourceMetadata(error.wwwAuthenticate, localResourceMetadataUrl));
         }
-        response.end(error.bodyText.length > 0 ? error.bodyText : JSON.stringify({ error: "upstream_auth_required" }));
+        response.end(JSON.stringify(makeError(null, -32001, "Upstream authentication required.", {
+          status: error.status,
+          body: error.bodyText,
+          wwwAuthenticate: error.wwwAuthenticate
+        })));
         if (debug) {
           console.error(`[mcpx gateway] -> ${error.status} upstream auth challenge`);
         }
@@ -3171,10 +3489,10 @@ function createGatewayServer(options) {
 
 // src/core/daemon.ts
 function readPidFromFile(pidPath = getPidPath()) {
-  if (!fs11.existsSync(pidPath)) {
+  if (!fs9.existsSync(pidPath)) {
     return null;
   }
-  const raw = fs11.readFileSync(pidPath, "utf8").trim();
+  const raw = fs9.readFileSync(pidPath, "utf8").trim();
   if (!raw) {
     return null;
   }
@@ -3221,6 +3539,29 @@ async function resolveGatewayPort(config) {
   }
   throw new Error(`No available local port found near ${config.gateway.port}.`);
 }
+async function waitForGatewayReady(port, token, timeoutMs = 5000) {
+  const deadline = Date.now() + timeoutMs;
+  let lastError;
+  while (Date.now() < deadline) {
+    try {
+      const response = await fetch(`http://127.0.0.1:${port}/mcp`, {
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${token}`
+        },
+        signal: AbortSignal.timeout(500)
+      });
+      if (response.ok) {
+        return;
+      }
+      lastError = new Error(`Gateway returned HTTP ${response.status}.`);
+    } catch (error) {
+      lastError = error;
+    }
+    await new Promise((resolve) => setTimeout(resolve, 100));
+  }
+  throw new Error(`Gateway did not become ready within ${timeoutMs}ms: ${lastError instanceof Error ? lastError.message : String(lastError)}`);
+}
 function getDaemonStatus(config) {
   const pidPath = getPidPath();
   const pid = readPidFromFile(pidPath);
@@ -3253,16 +3594,16 @@ async function startDaemon(config, cliPath, secrets) {
       };
     }
     try {
-      fs11.unlinkSync(getPidPath());
+      fs9.unlinkSync(getPidPath());
     } catch {}
   }
   const port = await resolveGatewayPort(config);
-  ensureGatewayToken(config, secrets);
+  const token = ensureGatewayToken(config, secrets);
   const pidPath = getPidPath();
   const logPath = getLogPath();
   ensureParentDir(pidPath);
   ensureParentDir(logPath);
-  const logFd = fs11.openSync(logPath, "a", 384);
+  const logFd = fs9.openSync(logPath, "a", 384);
   const child = spawn2(process.execPath, [cliPath, "daemon", "run", "--port", String(port)], {
     detached: true,
     stdio: ["ignore", logFd, logFd],
@@ -3272,9 +3613,10 @@ async function startDaemon(config, cliPath, secrets) {
     }
   });
   child.unref();
-  fs11.writeFileSync(pidPath, `${child.pid}
+  fs9.writeFileSync(pidPath, `${child.pid}
 `, { mode: 384 });
   startBackgroundUpdateCheck();
+  await waitForGatewayReady(port, token);
   return {
     started: true,
     pid: child.pid ?? -1,
@@ -3295,7 +3637,7 @@ function stopDaemon() {
     process.kill(pid, "SIGTERM");
   } catch {}
   try {
-    fs11.unlinkSync(pidPath);
+    fs9.unlinkSync(pidPath);
   } catch {}
   return {
     stopped: true,
@@ -3308,10 +3650,10 @@ async function restartDaemon(config, cliPath, secrets) {
 }
 function readDaemonLogs(maxLines = 200) {
   const logPath = getLogPath();
-  if (!fs11.existsSync(logPath)) {
+  if (!fs9.existsSync(logPath)) {
     return "";
   }
-  const lines = fs11.readFileSync(logPath, "utf8").split(`
+  const lines = fs9.readFileSync(logPath, "utf8").split(`
 `);
   return lines.slice(Math.max(lines.length - maxLines, 0)).join(`
 `);
@@ -3380,26 +3722,75 @@ function buildAuthBindings(spec) {
     secretName: secretRefName(binding.value) ?? undefined
   }));
 }
-function buildStatusReport(config, managedIndex, daemon = getDaemonStatus(config)) {
+async function fetchTokenCounts(gatewayUrl, token) {
+  try {
+    const res = await fetch(gatewayUrl, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${token}`
+      },
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        id: "status-tokens",
+        method: "custom/tokenCounts",
+        params: {}
+      }),
+      signal: AbortSignal.timeout(4000)
+    });
+    if (!res.ok) {
+      return {};
+    }
+    const data = await res.json();
+    return data?.result ?? {};
+  } catch (error) {
+    return {};
+  }
+}
+async function buildStatusReport(config, managedIndex, daemon = getDaemonStatus(config)) {
+  const secrets = new SecretsManager;
+  const token = ensureGatewayToken(config, secrets);
+  const gatewayUrl = getGatewayUrl(config);
+  let tokenCounts = {};
+  if (daemon.running) {
+    tokenCounts = await fetchTokenCounts(gatewayUrl, token);
+  }
+  const projectEntries = Object.values(config.projects ?? {});
+  let totalGlobalTokens = 0;
+  const totalProjectTokens = {};
   const serverNames = Object.keys(config.servers).sort((left, right) => left.localeCompare(right));
   const servers = serverNames.map((name) => {
     const spec = config.servers[name];
-    return {
+    const tokenCount = tokenCounts[name];
+    const serverEntry = {
       name,
       enabled: isServerEnabled(spec),
       transport: spec.transport,
       target: describeServerTarget(spec),
       authBindings: buildAuthBindings(spec),
-      clients: buildClientMappings(config, managedIndex, name)
+      clients: buildClientMappings(config, managedIndex, name),
+      tokenCount
     };
+    if (serverEntry.enabled && tokenCount) {
+      const matchingProject = projectEntries.find((p) => name.startsWith(`${p.name}.`));
+      if (matchingProject) {
+        totalProjectTokens[matchingProject.path] = (totalProjectTokens[matchingProject.path] ?? 0) + tokenCount.total;
+      } else {
+        totalGlobalTokens += tokenCount.total;
+      }
+    }
+    return serverEntry;
   });
   return {
-    gatewayUrl: getGatewayUrl(config),
+    gatewayUrl,
     daemon,
     upstreamCount: servers.length,
     servers,
-    clients: config.clients
+    clients: config.clients,
+    projects: config.projects,
+    totalGlobalTokens,
+    totalProjectTokens
   };
 }
 
-export { getConfigPath, getManagedIndexPath, defaultConfig, loadConfig, saveConfig, addServer, removeServer, updateServer, setServerEnabled, ensureGatewayToken, listSkills, getSkill, saveSkill, deleteSkill, SecretsManager, readSecretValueFromStdin, probeHttpAuthRequirement, getAdapters, loadManagedIndex, getGatewayUrl, syncAllClients, toSecretRef, secretRefName, defaultAuthSecretName, resolveAuthTarget, applyAuthReference, removeAuthReference, listAuthBindings, maybePrefixBearer, APP_VERSION, compareVersions, checkForUpdates, getStagedUpdate, clearStagedUpdate, getStagedCliPath, startBackgroundUpdateCheck, runBackgroundUpdate, performUpdate, performRollback, getDaemonStatus, startDaemon, stopDaemon, restartDaemon, readDaemonLogs, runDaemonForeground, STATUS_CLIENTS, buildStatusReport };
+export { listSkills, getSkill, saveSkill, deleteSkill, probeHttpAuthRequirement, fetchRegistryServerDetail, selectBestPackage, extractRequiredInputs, mapRegistryToSpec, getAdapters, loadManagedIndex, getGatewayUrl, syncAllClients, toSecretRef, secretRefName, defaultAuthSecretName, resolveAuthTarget, applyAuthReference, removeAuthReference, listAuthBindings, maybePrefixBearer, buildEnrichedPath, isOAuthReference, oauthReferenceServerName, runOAuthLogin, getOAuthAccessToken, APP_VERSION, compareVersions, checkForUpdates, getStagedUpdate, clearStagedUpdate, getStagedCliPath, startBackgroundUpdateCheck, runBackgroundUpdate, performUpdate, performRollback, getDaemonStatus, startDaemon, stopDaemon, restartDaemon, readDaemonLogs, runDaemonForeground, STATUS_CLIENTS, buildStatusReport };