@lanes-sh/link 0.1.0 → 0.1.2

package/README.md

@@ -1,15 +1,15 @@
 # Lanes Link
 
-**One secure endpoint between your AI agents and your real accounts, knowledge, and secrets.**
+**One secure endpoint between your AI agents and all your connections, memory, skills, and secrets.**
 
 Connect your mail, calendar, files, and notes once, and add the memory and skills that only you
 have. Every agent you use — Claude, ChatGPT, and anything else that speaks MCP — reaches them
-through a single MCP endpoint that you own and run. Open source, self-hosted, no vendor sitting in
+through a single MCP endpoint that you own and run. Open source, self-hostable, no vendor sitting in
 the middle of your data.
 
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="docs/images/lanes-link-dark.svg">
-  <img alt="Claude, ChatGPT, and any MCP client reach one Lanes Link endpoint, which you run on your own machine or your own cloud. The profiles it serves sit inside that boundary: Work, holding Gmail, Calendar, and Docs; and Personal, holding Gmail, Memory, and Skills." src="docs/images/lanes-link-light.svg">
+  <img alt="Claude, Codex, and Gemini all reach one Lanes Link endpoint, which you run yourself. Beneath it sit the profiles it serves: personal, holding Gmail, Memory, and Skills; and work, holding Gmail, Calendar, and Docs." src="docs/images/lanes-link-light.svg">
 </picture>
 
 ## Why

package/instructions/skills/lanes-link/SKILL.md

@@ -5,7 +5,7 @@ description: Use when the user refers to their own accounts, knowledge, procedur
 
 # Lanes Link
 
-A self-hosted gateway to one person's own context: the accounts they have
+A self-hostable gateway to one person's own context: the accounts they have
 connected, the knowledge they have accumulated, the procedures they have
 written down, and their secrets. One endpoint serves every profile in a
 workspace under one token, and each call names which profile it means.

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@lanes-sh/link",
-  "version": "0.1.0",
-  "description": "A self-hosted MCP gateway for your accounts, memory, skills, and secrets",
+  "version": "0.1.2",
+  "description": "A self-hostable MCP gateway for all your connections, memory, skills, and secrets",
   "license": "Apache-2.0",
-  "homepage": "https://github.com/lanes-sh/link#readme",
+  "homepage": "https://lanes.sh/link",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/lanes-sh/link.git"

package/src/cli/commands/operate/outputs.ts

@@ -1,6 +1,6 @@
 import { listProfiles } from '#profile';
 import { fileURLToPath } from 'node:url';
-import { deployedUrl, endpointUrl } from '../../endpoint-url.ts';
+import { deployedUrl, endpointHealth, localUrl } from '../../endpoint-url.ts';
 import { announce, heading, print, style, warn } from '../../output.ts';
 import { ensureProfileToken, openRuntime, type GlobalFlags } from '../../runtime.ts';
 
@@ -9,11 +9,6 @@ export interface OutputsFlags extends GlobalFlags {
   readonly json?: boolean | undefined;
 }
 
-interface Health {
-  readonly profile: string;
-  readonly profiles: readonly string[];
-}
-
 /**
  * What an agent harness needs to reach this endpoint.
  *
@@ -34,9 +29,11 @@ export async function outputs(flags: OutputsFlags): Promise<void> {
     const { token } = await ensureProfileToken(runtime.credentials, runtime.config.auth.token_ref);
     const declared = runtime.config.targets[runtime.target]?.deploy;
     const deployed = await deployedUrl(declared);
-    const url = deployed ?? (await endpointUrl(runtime.config, runtime.target));
+    // Not `endpointUrl`, which would ask the platform a second time for an
+    // answer this line already has.
+    const url = deployed ?? localUrl(runtime.config);
 
-    const live = await health(url, token);
+    const live = await endpointHealth(url, token);
     const mine = live?.profile === runtime.resolution.profile;
 
     // Live if it is up, otherwise what `start` would serve: the whole
@@ -174,33 +171,3 @@ async function tokenInvocation(
   return { command: `bun run ${entry} link token show --raw${suffix}`, onPath: false };
 }
 
-/**
- * Ask the endpoint who it is.
- *
- * The profile name is checked by the caller, not just the port: two workspaces
- * can assign the same port, and reporting "running" because something
- * unrelated answers would send someone to register an endpoint serving another
- * workspace's accounts.
- *
- * The token is sent because `/health` names profiles only to a caller that
- * holds one. Anonymously it answers `{status: "ok"}` and nothing else — that
- * list is what this endpoint holds, and a deployed URL is readable by anyone.
- * An endpoint that answers without naming itself is therefore reported as
- * something else's, which is the honest reading: this token does not open it.
- */
-async function health(url: string, token: string): Promise<Health | null> {
-  try {
-    const probe = new URL(url);
-    probe.pathname = '/health';
-    const response = await fetch(probe, {
-      headers: { authorization: `Bearer ${token}` },
-      signal: AbortSignal.timeout(700),
-    });
-    if (!response.ok) return null;
-
-    const body = (await response.json()) as Partial<Health>;
-    return body.profile ? { profile: body.profile, profiles: body.profiles ?? [body.profile] } : null;
-  } catch {
-    return null;
-  }
-}

package/src/cli/commands/operate/tools.ts

@@ -0,0 +1,343 @@
+import { capabilityIdForToolName } from '#server/mcp';
+import { deployedUrl, endpointHealth, localUrl } from '../../endpoint-url.ts';
+import { announce, emit, heading, print, style, warn } from '../../output.ts';
+import { ensureProfileToken, openRuntime, type GlobalFlags } from '../../runtime.ts';
+
+export interface ToolsFlags extends GlobalFlags {
+  readonly json?: boolean | undefined;
+}
+
+/**
+ * What a client is actually being told, asked over the wire.
+ *
+ * Not derived from the config, and that is the whole reason this exists.
+ * `doctor` answers whether the credentials resolve and `outputs` answers where
+ * the endpoint is; neither answers the question that follows a client showing
+ * the wrong tools, which is what the endpoint would hand it right now. Working
+ * that out previously meant hand-rolling a `tools/list` with `curl` and a token
+ * pulled out of the secret store, and reading a byte count out of a request log
+ * to guess at the answer.
+ *
+ * The `listChanged` line is here for the same reason. A client refreshes by
+ * asking again, and a server that claims it will announce changes gives it a
+ * reason not to — so a surface that looks stale in a client and current here is
+ * explained by that flag more often than by anything else (ADR-032).
+ */
+export async function tools(flags: ToolsFlags): Promise<void> {
+  const runtime = await openRuntime(flags);
+
+  try {
+    const { token } = await ensureProfileToken(runtime.credentials, runtime.config.auth.token_ref);
+    const declared = runtime.config.targets[runtime.target]?.deploy;
+    const deployed = await deployedUrl(declared);
+    // Not `endpointUrl`, which asks the platform a second time for an answer
+    // this line already has.
+    const url = deployed ?? localUrl(runtime.config);
+
+    // Before trusting anything the surface says: two workspaces can assign the
+    // same port, and `secrets push` makes their tokens match, so a `--target
+    // cloud` whose deployment could not be located answers from loopback with a
+    // token that works. Reporting that as the deployed endpoint's surface is
+    // the failure `endpoint-url.ts` calls "silent in the worst way".
+    const live = await endpointHealth(url, token);
+    const mine = live?.profile === runtime.resolution.profile;
+
+    const surface = await askEndpoint(url, token);
+    const providers = [...new Set(runtime.registry.capabilities().map(({ id }) => id))];
+
+    await emit(
+      flags.json,
+      {
+        url,
+        target: runtime.target,
+        // Both, because `--target cloud` reaching loopback is indistinguishable
+        // from success without them.
+        deployed: deployed !== null,
+        answering: mine,
+        ...surfaceJson(surface),
+      },
+      () => {
+        announce(runtime.resolution);
+
+        heading('Endpoint');
+        print(`  ${url}  ${reachability(mine, deployed !== null, surface)}`);
+
+        if (declared && !deployed) {
+          // The case the ownership probe cannot catch on its own: the address
+          // is loopback because the platform could not be asked, not because
+          // this target is local.
+          print(
+            warn(
+              `could not ask ${declared.platform} where "${declared.service}" is — this is the local endpoint, not the deployed one`,
+            ),
+          );
+        } else if (live && !mine) {
+          print(warn(`something else is serving this port: profile "${live.profile}"`));
+        }
+
+        if (!surface.reachable) {
+          print(fail(surface));
+          return;
+        }
+
+        heading(`Advertised to a client (${surface.names.length})`);
+        for (const [provider, names] of groupByProvider(surface.names, providers)) {
+          print(`  ${style.bold(provider)}  ${style.dim(`${names.length}`)}`);
+          for (const name of names) print(`    ${name}`);
+        }
+
+        heading('How a client sees it');
+        print(`  payload:      ${kb(surface.bytes)} for the whole list`);
+        print(`  listChanged:  ${listChangedLine(surface.listChanged)}`);
+        print(
+          style.dim(
+            '  Tools only — a skill is a prompt, and is not counted here or by `connect`.',
+          ),
+        );
+      },
+    );
+
+    // Non-zero for the same reason `doctor` does it: a command whose whole job
+    // is to answer a question exits failing when it could not answer.
+    if (!surface.reachable) process.exitCode = 1;
+  } finally {
+    await runtime.close();
+  }
+}
+
+/**
+ * What is at this address, in one word.
+ *
+ * The refusal case is why this is not just `mine`. `/health` is asked with the
+ * same token, so an endpoint belonging to another workspace fails that probe
+ * too — and reporting "not running" above a refusal that begins "it is
+ * answering" is the command contradicting itself in two consecutive lines.
+ */
+function reachability(mine: boolean, deployed: boolean, surface: Surface): string {
+  if (mine) return style.green(deployed ? 'deployed' : 'running');
+  if (surface.refused) return style.yellow('answering, but not for this token');
+  return style.dim(deployed ? 'not answering' : 'not running');
+}
+
+/**
+ * Why the surface could not be read, said as the thing that happened.
+ *
+ * Refused and unreachable are different problems with different fixes, and
+ * folding them together sends someone to check whether the endpoint is up when
+ * it answered them perfectly well and declined their token.
+ */
+function fail(surface: Surface): string {
+  if (surface.refused) {
+    return (
+      warn(`the endpoint refused this token: ${surface.reason}`) +
+      `\n${style.dim('  It is answering. Either the token was rotated without re-registering, or\n  this address belongs to another workspace.')}`
+    );
+  }
+
+  return (
+    warn(`could not ask it: ${surface.reason}`) +
+    `\n${style.dim('  Nothing here reads the config to guess instead — an endpoint that cannot\n  be asked is exactly the case where a guess would be believed.')}`
+  );
+}
+
+interface Surface {
+  readonly reachable: boolean;
+  readonly reason?: string;
+  /** It answered, and declined. Distinct from not answering at all. */
+  readonly refused?: boolean;
+  readonly names: readonly string[];
+  readonly bytes: number;
+  readonly listChanged?: boolean | undefined;
+}
+
+/**
+ * `tools` as a count, matching `/reload` and `connect`; the names beside it.
+ *
+ * One key, one meaning. `ReloadResult.tools` and `PublishOutcome.tools` are both
+ * numbers, and the count is what `docs/connect.md` tells an operator to compare
+ * against their client — shipping the same key here as an array would make
+ * `.tools > 5` true for a single tool.
+ */
+function surfaceJson(surface: Surface): Record<string, unknown> {
+  return {
+    reachable: surface.reachable,
+    ...(surface.reason !== undefined ? { reason: surface.reason } : {}),
+    ...(surface.refused !== undefined ? { refused: surface.refused } : {}),
+    tools: surface.names.length,
+    names: surface.names,
+    bytes: surface.bytes,
+    ...(surface.listChanged !== undefined ? { listChanged: surface.listChanged } : {}),
+  };
+}
+
+/**
+ * One `initialize`, one `tools/list`, exactly as a 2025-era client sends them.
+ *
+ * Deliberately hand-rolled rather than run through an MCP client library: the
+ * subject is what the endpoint puts on the wire, and a library that negotiated
+ * a newer revision would answer a different question than the one asked.
+ */
+export async function askEndpoint(url: string, token: string): Promise<Surface> {
+  const post = async (body: unknown): Promise<{ text: string; result: Record<string, unknown> }> => {
+    const response = await fetch(url, {
+      method: 'POST',
+      headers: {
+        'content-type': 'application/json',
+        // Both, and not one: the streamable HTTP transport answers 406 to a
+        // client that will not accept an event stream, whatever it then sends.
+        accept: 'application/json, text/event-stream',
+        authorization: `Bearer ${token}`,
+      },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(30_000),
+    });
+
+    const text = await response.text();
+    if (!response.ok) throw new Refusal(response.status, text);
+
+    return { text, result: parse(text) };
+  };
+
+  try {
+    const init = await post({
+      jsonrpc: '2.0',
+      id: 1,
+      method: 'initialize',
+      params: {
+        protocolVersion: '2025-06-18',
+        capabilities: {},
+        clientInfo: { name: 'lanes-link-cli', version: '0.0.0' },
+      },
+    });
+
+    const capabilities = init.result['capabilities'] as
+      | { tools?: { listChanged?: boolean } }
+      | undefined;
+
+    const listed = await post({ jsonrpc: '2.0', id: 2, method: 'tools/list', params: {} });
+    const names = ((listed.result['tools'] as Array<{ name?: string }> | undefined) ?? [])
+      .map((tool) => tool.name ?? '')
+      .filter((name) => name.length > 0)
+      .sort();
+
+    return {
+      reachable: true,
+      names,
+      bytes: Buffer.byteLength(listed.text),
+      listChanged: capabilities?.tools?.listChanged,
+    };
+  } catch (error) {
+    if (error instanceof Refusal) {
+      return { reachable: false, refused: error.refused, reason: error.message, names: [], bytes: 0 };
+    }
+
+    return {
+      reachable: false,
+      reason: error instanceof Error ? error.message : String(error),
+      names: [],
+      bytes: 0,
+    };
+  }
+}
+
+/** An endpoint that answered and would not serve this call. */
+class Refusal extends Error {
+  readonly refused: boolean;
+
+  constructor(status: number, body: string) {
+    // The transport puts the actionable reason in a JSON-RPC error body for
+    // 400/406/415, and discarding it leaves only a number to act on.
+    const detail = errorMessage(body);
+    super(detail ? `${status} — ${detail}` : `answered ${status}`);
+    this.refused = status === 401 || status === 403;
+  }
+}
+
+function errorMessage(body: string): string | null {
+  try {
+    const parsed = JSON.parse(body) as { error?: { message?: string } | string };
+    if (typeof parsed.error === 'string') return parsed.error;
+    return parsed.error?.message ?? null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The JSON payload of a response that may or may not be framed as SSE.
+ *
+ * Three shapes reach here and all three are legal. A plain JSON body; an event
+ * stream whose payload line is `data: {…}`; and one where the space after the
+ * colon is absent, which the spec permits. The stream may also open with
+ * comment lines — the transport arms a keep-alive on every POST, so a handler
+ * that runs long enough emits `: keepalive` before anything else — so the
+ * payload is found by scanning rather than by inspecting the first characters.
+ */
+export function parse(text: string): Record<string, unknown> {
+  const data = text.split('\n').find((line) => line.startsWith('data:'));
+  const body = data === undefined ? text : data.slice('data:'.length).trim();
+
+  const message = JSON.parse(body) as {
+    result?: Record<string, unknown>;
+    error?: { message?: string };
+  };
+
+  if (message.error) throw new Error(message.error.message ?? 'the endpoint returned an error');
+  return message.result ?? {};
+}
+
+/**
+ * Group by provider, resolving each wire name back to the capability it is.
+ *
+ * A wire name is the capability id with its dots replaced (`naming.ts`), so
+ * `icloud_mail.send_message` arrives as `icloud_mail_send_message` and there is
+ * nothing left in the string to say where the provider ends. Splitting on the
+ * first underscore would file it under `icloud`, which is not a provider.
+ *
+ * `capabilityIdForToolName` answers it exactly against a set of known ids, and
+ * falls back to that first-underscore split when it recognises none — which is
+ * reachable here, because the registry is the *invoking profile's* while the
+ * endpoint may serve several, and under `--target cloud` may run an image this
+ * checkout does not have. So the fallback is detected rather than trusted: a
+ * name that resolves to nothing known is grouped as unattributed, because a
+ * guessed heading with a confident count is worse than an honest "these did not
+ * match anything I know about".
+ */
+export function groupByProvider(
+  names: readonly string[],
+  capabilityIds: readonly string[],
+): Map<string, string[]> {
+  const known = new Set(capabilityIds);
+  const grouped = new Map<string, string[]>();
+
+  for (const name of names) {
+    const id = capabilityIdForToolName(name, capabilityIds);
+    const provider = known.has(id) ? id.slice(0, id.indexOf('.')) : UNATTRIBUTED;
+
+    const bucket = grouped.get(provider);
+    if (bucket) bucket.push(name);
+    else grouped.set(provider, [name]);
+  }
+
+  return new Map([...grouped].sort(([a], [b]) => a.localeCompare(b)));
+}
+
+/** Named rather than spelled inline, so the output and the test agree. */
+export const UNATTRIBUTED = '(not in this profile)';
+
+function kb(bytes: number): string {
+  return bytes < 1024 ? `${bytes} B` : `${(bytes / 1024).toFixed(1)} KB`;
+}
+
+function listChangedLine(declared: boolean | undefined): string {
+  if (declared === undefined) return style.dim('not declared');
+  if (declared === false) {
+    return `false  ${style.dim('— a client re-reads this list rather than waiting to be told')}`;
+  }
+
+  // Worth a warning rather than a value, because it is the shape of a bug that
+  // presents as "the endpoint is wrong" when the endpoint is right: a client
+  // that trusts the promise keeps the list it first fetched, for as long as it
+  // is registered.
+  return style.yellow('true') + style.dim('  — but nothing here sends the notification');
+}

package/src/cli/commands/operate.ts

@@ -20,6 +20,7 @@
 export { check, doctor, plan } from './operate/inspect.ts';
 export { status } from './operate/status.ts';
 export { outputs, type OutputsFlags } from './operate/outputs.ts';
+export { tools, type ToolsFlags } from './operate/tools.ts';
 export { start } from './operate/serve.ts';
 export { auditTail, auditVerify, markdownCell } from './operate/audit.ts';
 export { attachFile } from './operate/attach.ts';

package/src/cli/endpoint-url.ts

@@ -17,7 +17,52 @@ import type { Config, DeployConfig } from '#profile';
  */
 export async function endpointUrl(config: Config, target: string): Promise<string> {
   const deployed = await deployedUrl(config.targets[target]?.deploy);
-  return deployed ?? `http://${config.instance.host}:${config.instance.port}/mcp`;
+  return deployed ?? localUrl(config);
+}
+
+/**
+ * Where `lanes link start` would listen, from config alone.
+ *
+ * Split out so a caller that has already asked `deployedUrl` can name the
+ * fallback without asking again — `endpointUrl` is the two together, and going
+ * through it after a null costs a second `gcloud run services describe` that is
+ * already known to answer nothing.
+ */
+export function localUrl(config: Config): string {
+  return `http://${config.instance.host}:${config.instance.port}/mcp`;
+}
+
+/**
+ * Who is answering at this URL, if anyone.
+ *
+ * Shared for the reason `endpointUrl` above is: two workspaces can assign the
+ * same port, so an endpoint answering is not the same as *this* profile's
+ * endpoint answering. A command that skips this check reports another
+ * workspace's surface under this profile's heading.
+ *
+ * Anonymous would be enough to prove a socket is bound, but the profile list is
+ * behind the token, and the profile is the whole point of asking.
+ */
+export async function endpointHealth(url: string, token: string): Promise<EndpointHealth | null> {
+  try {
+    const probe = new URL(url);
+    probe.pathname = '/health';
+    const response = await fetch(probe, {
+      headers: { authorization: `Bearer ${token}` },
+      signal: AbortSignal.timeout(700),
+    });
+    if (!response.ok) return null;
+
+    const body = (await response.json()) as Partial<EndpointHealth>;
+    return body.profile ? { profile: body.profile, profiles: body.profiles ?? [body.profile] } : null;
+  } catch {
+    return null;
+  }
+}
+
+export interface EndpointHealth {
+  readonly profile: string;
+  readonly profiles: readonly string[];
 }
 
 /**

package/src/cli/lanes.ts

@@ -18,7 +18,7 @@ import { version } from './version.ts';
  */
 
 const AREAS: Record<string, string> = {
-  link: 'a self-hosted MCP gateway for your accounts, memory, skills, and secrets',
+  link: 'a self-hostable MCP gateway for all your connections, memory, skills, and secrets',
 };
 
 function areasUsage(): string {

package/src/cli/main.ts

@@ -14,6 +14,7 @@ import {
   status,
   tokenRotate,
   tokenShow,
+  tools,
 } from './commands/operate.ts';
 import { profileAdd, profileDefault, profileList } from './commands/profile.ts';
 import { removeProfile as profileRemove } from './commands/profile/remove.ts';
@@ -250,6 +251,13 @@ export async function run(argv: readonly string[]): Promise<void> {
     case 'outputs':
       return outputs({ ...global, show, json });
 
+    // Beside `outputs` because it answers the next question. `outputs` says
+    // where the endpoint is; this says what it would hand a client that asked
+    // right now — which is the only way to tell a stale client from a wrong
+    // endpoint without reading request sizes out of a log.
+    case 'tools':
+      return tools({ ...global, json });
+
     // Undocumented alias for `mcp skill`, which is where it moved when `skills`
     // arrived. Anyone who learned the old spelling keeps it.
     case 'skill':

package/src/cli/publish.ts

@@ -29,6 +29,14 @@ export interface PublishOutcome {
   readonly published?: string;
   /** Whether a running endpoint confirmed it is now serving the edit. */
   readonly served: boolean;
+  /**
+   * How many tools the endpoint advertises now, when it answered.
+   *
+   * Reported rather than inferred, for the same reason `served` is: the number
+   * that matters is the one the endpoint would hand a client, and only the
+   * endpoint knows it.
+   */
+  readonly tools?: number;
   /** The endpoint that was told, or would have been. */
   readonly url?: string;
   /** Why it is not being served yet, in a form fit to print. */
@@ -142,7 +150,11 @@ async function notifyReload(input: {
       return { served: false, url, reason: `the endpoint answered ${response.status}` };
     }
 
-    const body = (await response.json()) as { reloaded?: unknown; reason?: unknown };
+    const body = (await response.json()) as {
+      reloaded?: unknown;
+      reason?: unknown;
+      tools?: unknown;
+    };
     if (body.reloaded !== true) {
       return {
         served: false,
@@ -154,7 +166,11 @@ async function notifyReload(input: {
       };
     }
 
-    return { served: true, url };
+    return {
+      served: true,
+      url,
+      ...(typeof body.tools === 'number' ? { tools: body.tools } : {}),
+    };
   } catch {
     // Nothing listening, scaled to zero, or unreachable from here — all of
     // which resolve themselves the next time the endpoint starts, because the
@@ -175,7 +191,34 @@ function message(error: unknown): string {
  * is now: the endpoint either answered or it did not.
  */
 export function nextAfterEdit(outcome: PublishOutcome): string {
-  if (outcome.served) return 'Serving it now — the endpoint has re-read its config.';
+  if (outcome.served) {
+    const served = 'Serving it now — the endpoint has re-read its config.';
+    if (outcome.tools === undefined) return served;
+
+    // The second half of the truth, and the half an operator is actually
+    // looking at. The endpoint re-reading its config is not the same event as
+    // the client in front of them learning about it: a client fetches
+    // `tools/list` when it connects and holds the answer, and this endpoint
+    // cannot tell it otherwise — it is stateless, so there is no stream on
+    // which to send `notifications/tools/list_changed`, and it no longer claims
+    // there is (ADR-032).
+    //
+    // So the tool count goes here, where the change happened, and so does the
+    // one action that picks it up. Without this line the command reports
+    // success and the operator watches a connector that never changes.
+    //
+    // Worded for either direction, because `policy deny` prints this too and a
+    // deny is the case this file already calls "the one kind of staleness worth
+    // being strict about". "Pick them up" was written for a `connect` and read
+    // as nonsense after a deny, where the client is holding one tool too many
+    // rather than one too few — and where the stale entry is a tool the model
+    // will keep calling until it is gone.
+    return (
+      `${served}\n` +
+      `  ${outcome.tools} tools are advertised now. A client connected before this is still\n` +
+      `  holding the list it fetched then — reconnect it to match.`
+    );
+  }
 
   // Naming the URL, because the likeliest reason nothing answered is that the
   // endpoint is somewhere else: `lanes link start --port` moves the socket

package/src/cli/usage.ts

@@ -16,7 +16,7 @@ import { style } from './output.ts';
 /** How this CLI is invoked — the `link` area of the `lanes` command. */
 export const PROGRAM = 'lanes link';
 
-export const USAGE = `${style.bold(PROGRAM)} — a self-hosted MCP gateway for your accounts, memory, skills, and secrets
+export const USAGE = `${style.bold(PROGRAM)} — a self-hostable MCP gateway for all your connections, memory, skills, and secrets
 
 ${style.bold('Everyday')}
   ${PROGRAM} setup plan [--json]        what each provider needs, and which are connected
@@ -84,6 +84,7 @@ ${style.bold('Deploying')}
 ${style.bold('Inspection')}
   ${PROGRAM} check                      static validation, no external calls
   ${PROGRAM} doctor [--json]            credentials resolve, stores reachable
+  ${PROGRAM} tools [--json]             what the endpoint advertises to a client
   ${PROGRAM} plan                       what reconcile would change
   ${PROGRAM} audit tail [--limit N] [--denied-only] [--format md]
   ${PROGRAM} audit verify           has anything in the log been altered or removed