@master4n/master-cli 3.0.3 → 3.0.4

package/README.md

@@ -9,7 +9,7 @@
 ![License](https://img.shields.io/npm/l/%40master4n%2Fmaster-cli)
 ![Owner](https://img.shields.io/badge/Owner-Master4Novice-orange?style=flat)
 
-**Master CLI for developers and AI agents.** 43 headless, JSON-first commands in
+**Master CLI for developers and AI agents.** 51 headless, JSON-first commands in
 three families: **token savers** (extract exactly what you need — one JSON field,
 a line range, a file outline — instead of dumping whole files into context),
 **exact computation** (BigInt math, semver, cron, regex, timezones — verified
@@ -54,6 +54,27 @@ npx -y @master4n/master-cli epoch 1622547800 --json
 - **Self-describing** — `mfn capabilities --json` lists every command, and
   [`llms.txt`](./llms.txt) documents the full agent contract.
 
+## MCP server (built in)
+
+For agent clients that can't run shell commands, `mfn mcp` serves the whole
+toolkit over the [Model Context Protocol](https://modelcontextprotocol.io)
+(stdio transport, zero extra dependencies):
+
+```jsonc
+// e.g. .mcp.json / claude_desktop_config.json / any MCP client
+{
+  "mcpServers": {
+    "mfn": { "command": "npx", "args": ["-y", "@master4n/master-cli", "mcp"] }
+  }
+}
+```
+
+Three tools: `mfn_capabilities` (the manifest), `mfn_run` (`{command, args[]}` —
+runs any catalogued command and returns its single JSON object, guardrails
+included), and `mfn_help` (per-command flags). `update` is deny-listed so an
+MCP-only client can never install packages. `mfn mcp --json` describes the
+server without starting it.
+
 ## Quick start
 
 ```sh
@@ -63,7 +84,7 @@ mfn -v                 # version
 mfn capabilities --json   # machine-readable manifest of all commands
 ```
 
-## Commands (50)
+## Commands (51)
 
 Run `mfn capabilities` for the grouped list, `mfn <command> --help` for flags.
 
@@ -125,6 +146,7 @@ Run `mfn capabilities` for the grouped list, `mfn <command> --help` for flags.
 | `id` / `hash` / `encode` / `random` | UUID v4/v7/nano · digests · codecs · CSPRNG | `mfn id -t uuid7 -n 3 --json` |
 | `sc` / `cts` | Fuzzy file find · directory tree | `mfn sc service --json` |
 | `capabilities` / `update` | Machine-readable manifest · self-update | `mfn capabilities --json` |
+| `mcp` | Serve every command over the Model Context Protocol (stdio) | `mfn mcp` |
 
 ### Examples
 

package/SECURITY.md

@@ -38,7 +38,7 @@ use any flag that exists:
 
 | Guardrail | Commands | What it prevents |
 | --------- | -------- | ---------------- |
-| **Sensitive-path refusal** (`SensitivePath`, exit 2) | `lines` `json` `schema` `diff` `freq` `regex -f` | Returning the CONTENT of credential stores: `~/.ssh`, `~/.aws`, `~/.gnupg`, `~/.kube`, `.env*`, `*.pem`, `*.key`, `id_rsa*`, `.npmrc`, `.netrc`, `shadow`, … An agent's context window is a log that never rotates. |
+| **Sensitive-path refusal** (`SensitivePath`, exit 2) | `lines` `json` `schema` `diff` `freq` `regex -f` `hash -f` | Returning the CONTENT of credential stores: `~/.ssh`, `~/.aws`, `~/.gnupg`, `~/.kube`, `.env*`, `*.pem`, `*.key`, `id_rsa*`, `.npmrc`, `.netrc`, `shadow`, … An agent's context window is a log that never rotates. `hash -f` is included because a digest of a low-entropy secrets file can be brute-forced offline. |
 | **Clipboard secret redaction** | `clip` (read) | Passwords/tokens pasted through the clipboard (password managers). Secret-shaped content (private-key blocks, JWTs, AWS/GitHub/Slack/Google/npm/`sk-` tokens) is withheld with `redacted:true`. |
 | **Env value scanning** | `env` | Redacts by NAME pattern (key/token/secret/…) **and** by VALUE shape — an innocently named variable holding a JWT is still redacted. `mfn env` with no names lists names only. |
 | **Dotenv never reads values** | `dotenv` | Compares KEY presence between `.env` and `.env.example`; values are never parsed, stored, or returned. |

package/bin/commands/index.d.ts

@@ -48,4 +48,5 @@ import procs from './procs';
 import disk from './disk';
 import trash from './trash';
 import dns from './dns';
-export { cts, sc, deco, date, epoch, killProcess, update, capabilities, id, hash, encode, random, port, jsonCmd, count, lines, have, sys, repo, calc, semver, caseCmd, cron, diff, env, size, ext, freq, regex, url, ip, escapeCmd, schema, outlineCmd, imports, replace, recent, pkgCmd, dotenv, wait, ports, http, base, clip, notify, openCmd, procs, disk, trash, dns, };
+import mcp from './mcp';
+export { cts, sc, deco, date, epoch, killProcess, update, capabilities, mcp, id, hash, encode, random, port, jsonCmd, count, lines, have, sys, repo, calc, semver, caseCmd, cron, diff, env, size, ext, freq, regex, url, ip, escapeCmd, schema, outlineCmd, imports, replace, recent, pkgCmd, dotenv, wait, ports, http, base, clip, notify, openCmd, procs, disk, trash, dns, };

package/bin/commands/mcp.d.ts

@@ -0,0 +1,7 @@
+declare const mcp: {
+    command: string;
+    describe: string;
+    builder: (yargs: any) => any;
+    handler: (argv: any) => Promise<void>;
+};
+export default mcp;