@mcpcloud/cli 0.23.0 → 0.24.0-next-20260917193810

package/README.md

@@ -353,7 +353,7 @@ _Generated from the live command tree by `bun run docs:readme` — do not edit b
 | `mcp api-keys create` | Create a new API key (the secret is shown once) |
 | `mcp api-keys describe <apiKey>` | Show one API key (accepts id or name; status, expiry, last used) — never the secret |
 | `mcp api-keys list` | List active API keys for the current user |
-| `mcp api-keys revoke <apiKey>` | Permanently revoke an API key (accepts id or name) |
+| `mcp api-keys revoke <apiKey>` | Permanently revoke an API key (accepts id or name). Needs --confirm "<key name>". |
 | `mcp api-keys rotate <apiKey>` | Mint a replacement key and grace-expire the old one (24h window; accepts id or name). The new secret is shown once. |
 
 ### `mcp audit` — Workspace audit log (admin/owner only)
@@ -505,6 +505,9 @@ _Generated from the live command tree by `bun run docs:readme` — do not edit b
 | `mcp servers deps add <server> <child>` | Compose <child>'s tools into <server>. Both accept an id, name or slug. |
 | `mcp servers deps list [server]` | List the servers this one composes. |
 | `mcp servers deps rm <server> <dependencyId>` | Remove a composed dependency (id from `deps list`). |
+| `mcp servers end-user` | Read and set a server's end-user plane: the access switch and the tool allowlist customers may call. |
+| `mcp servers end-user get <server>` | Show the end-user access configuration: switch, connect page, allowed tools, branding and sign-in federation. |
+| `mcp servers end-user set <server>` | Enable or disable end-user access, and/or replace the tool allowlist. |
 | `mcp servers env` | Manage server runtime environment bindings (encrypted secrets injected by the proxy). |
 | `mcp servers env get <server> <bindingName>` | Show metadata for one env binding. Plaintext is never returned — values are write-only. |
 | `mcp servers env list <server>` | List a server's env bindings (metadata only; values are never returned). |

package/dist/index.js

@@ -6133,8 +6133,120 @@ function registerServerShapingCommands(servers) {
   }));
 }
 
+// src/commands/servers-end-user.ts
+import { readFileSync as readFileSync5 } from "node:fs";
+var END_USER_PATH = "/api/v1/server/end-user-access";
+async function readEndUserAccess(serverRef, opts) {
+  const orgId = await resolveOrgId(opts.org);
+  const serverId = await resolveServerId(serverRef, orgId, undefined);
+  return await api.get(END_USER_PATH, {
+    organizationId: orgId,
+    serverId
+  });
+}
+function printEndUserAccess(data) {
+  printKeyValue({
+    server: `${data.server.name} (${data.server.id})`,
+    access: data.endUserAccess,
+    "connect page": data.connectPageUrl ?? "—",
+    "allowed tools": data.allowedTools.length > 0 ? `${data.allowedTools.length}: ${data.allowedTools.join(", ")}` : "none — end users can call nothing",
+    "display name": data.branding?.displayName ?? "—",
+    logo: data.branding?.logoUrl ?? "—",
+    accent: data.branding?.accentColor ?? "—",
+    support: data.branding?.supportUrl ?? "—",
+    "sign-in federation": data.signIn.configured ? `${data.signIn.status} (${data.signIn.issuer}, keys via ${data.signIn.keySource})` : "not configured",
+    "sign-in url": data.signIn.signInUrl ?? "—"
+  });
+}
+function parseToolList(raw) {
+  const text = raw.startsWith("@") ? readFileSync5(raw.slice(1), "utf8") : raw;
+  const trimmed = text.trim();
+  if (trimmed.startsWith("[")) {
+    const parsed = JSON.parse(trimmed);
+    if (!Array.isArray(parsed) || parsed.some((entry) => typeof entry !== "string")) {
+      throw new Error("--allow-tools JSON must be an array of tool names.");
+    }
+    return parsed;
+  }
+  return trimmed.split(",").map((entry) => entry.trim()).filter(Boolean);
+}
+async function listServerToolNames(orgId, projectId, serverId) {
+  const { rows } = await fetchAllPagesWithEnvelope("/api/v1/project/tools", { organizationId: orgId, projectId }, "tools");
+  return rows.filter((row) => row.serverId === serverId).map((row) => row.name).sort((left, right) => left.localeCompare(right));
+}
+function registerServerEndUserCommands(servers) {
+  const endUser = servers.command("end-user").alias("end-users").description("Read and set a server's end-user plane: the access switch and the tool allowlist customers may call.");
+  endUser.command("get <server>").description("Show the end-user access configuration: switch, connect page, allowed tools, branding and sign-in federation.").option("--org <organizationId>", "Organization ID").addHelpText("after", [
+    "",
+    "End users are deny-by-default, so `allowed tools` is exhaustive — a",
+    "tool missing from it cannot be called by a customer, whatever the",
+    "server's own access mode says.",
+    "",
+    "Examples:",
+    "  $ mcp servers end-user get srv_123",
+    "  $ mcp --json servers end-user get srv_123 | jq '.allowedTools'"
+  ].join(`
+`)).action(runAction(async (serverRef, opts) => {
+    const data = await readEndUserAccess(serverRef, opts);
+    if (isJsonMode()) {
+      printJson(data);
+      return;
+    }
+    printEndUserAccess(data);
+  }));
+  endUser.command("set <server>").description("Enable or disable end-user access, and/or replace the tool allowlist.").option("--org <organizationId>", "Organization ID").option("--enable", "Turn end-user access on").option("--disable", "Turn end-user access off").option("--allow-tools <list>", "Replace the allowlist with these tool names (comma-separated, or @path to a JSON array)").option("--allow-all-tools", "Replace the allowlist with every tool currently on the server — re-run after adding tools, since the list is a replacement, not a merge").addHelpText("after", [
+    "",
+    "The allowlist is REPLACED, never merged: what you pass is what end",
+    "users may call afterwards. That is what makes it safe to run on every",
+    "CI pass — the allowlist ends up matching the contract rather than",
+    "accumulating whatever was granted along the way.",
+    "",
+    "Leave --enable / --disable off to change only the allowlist; the",
+    "switch is read first and left where it is.",
+    "",
+    "Examples:",
+    "  $ mcp servers end-user set srv_123 --enable --allow-all-tools",
+    "  $ mcp servers end-user set srv_123 --allow-tools listbooks,getbook",
+    "  $ mcp --ci servers end-user set srv_123 --allow-tools @allowed.json"
+  ].join(`
+`)).action(runAction(async (serverRef, opts) => {
+    if (opts.enable && opts.disable) {
+      throw new Error("--enable and --disable are mutually exclusive.");
+    }
+    if (opts.allowTools && opts.allowAllTools) {
+      throw new Error("--allow-tools and --allow-all-tools are mutually exclusive.");
+    }
+    const current = await readEndUserAccess(serverRef, opts);
+    const orgId = await resolveOrgId(opts.org);
+    const enabled = opts.enable ? true : opts.disable ? false : current.endUserAccess === "enabled";
+    let allowedTools = null;
+    if (opts.allowTools) {
+      allowedTools = parseToolList(opts.allowTools);
+    } else if (opts.allowAllTools) {
+      allowedTools = await listServerToolNames(orgId, current.server.projectId, current.server.id);
+    }
+    await api.put(END_USER_PATH, {
+      organizationId: orgId,
+      projectId: current.server.projectId,
+      serverId: current.server.id,
+      enabled,
+      ...allowedTools === null ? {} : { allowedTools }
+    });
+    const updated = await readEndUserAccess(serverRef, opts);
+    if (isJsonMode()) {
+      printJson(updated);
+      return;
+    }
+    printSuccess(`End-user access ${updated.endUserAccess} for ${updated.server.name}.`);
+    printEndUserAccess(updated);
+    if (updated.endUserAccess === "enabled" && updated.connectPageUrl) {
+      printInfo(`  Customers connect at ${updated.connectPageUrl}`);
+    }
+  }));
+}
+
 // src/commands/servers-env.ts
-import { existsSync as existsSync3, readFileSync as readFileSync5 } from "node:fs";
+import { existsSync as existsSync3, readFileSync as readFileSync6 } from "node:fs";
 import { resolve } from "node:path";
 function registerServerEnvCommands(servers) {
   const env = servers.command("env").description("Manage server runtime environment bindings (encrypted secrets injected by the proxy).");
@@ -6283,7 +6395,7 @@ async function resolveSetValue(args) {
       printError(`--from-file path not found: ${path}`);
       throw new CliExitError(1);
     }
-    return readFileSync5(path, "utf-8");
+    return readFileSync6(path, "utf-8");
   }
   return await readStdin();
 }
@@ -6762,7 +6874,7 @@ function registerServerSandboxVariableCommands(servers) {
 }
 
 // src/lib/mcp-invoke.ts
-import { existsSync as existsSync4, readFileSync as readFileSync6 } from "node:fs";
+import { existsSync as existsSync4, readFileSync as readFileSync7 } from "node:fs";
 import { resolve as resolve2 } from "node:path";
 var DEFAULT_TIMEOUT_MS3 = 60000;
 var invokeRequestId = 1;
@@ -6984,7 +7096,7 @@ async function parseToolArguments(opts) {
     if (!existsSync4(filePath)) {
       return { ok: false, reason: "file-not-found", path: filePath };
     }
-    source = readFileSync6(filePath, "utf-8");
+    source = readFileSync7(filePath, "utf-8");
   } else {
     source = raw;
   }
@@ -7410,6 +7522,7 @@ function registerServerGetCommand(servers) {
       url: s.deploymentUrl ?? "—",
       "tool surface": describeToolSurface(s),
       "upstream keys": s.upstreamApiKeyMode ?? "shared",
+      upstream: "mcp deployments get latest --server <server>",
       "end-user access": s.endUserAccess ?? "disabled",
       ...s.endUserAccess === "enabled" && s.connectPageUrl ? { "connect page": s.connectPageUrl } : {},
       git: gitLink ? `${gitLink.owner}/${gitLink.name}@${gitLink.branch} (mcp servers git status)` : "—",
@@ -7538,7 +7651,7 @@ function formatDeploymentExposure(deployment) {
 import { createHash as createHash2 } from "node:crypto";
 import {
   existsSync as existsSync5,
-  readFileSync as readFileSync7,
+  readFileSync as readFileSync8,
   watch as fsWatch
 } from "node:fs";
 import { dirname as dirname3 } from "node:path";
@@ -7592,7 +7705,7 @@ function summarizeDiff(diff) {
 `) };
 }
 function readSpecFile(specPath) {
-  const content = readFileSync7(specPath, "utf-8");
+  const content = readFileSync8(specPath, "utf-8");
   return { content, hash: hashSpecContent(content) };
 }
 function watchSpecFile(options) {
@@ -7612,7 +7725,7 @@ function watchSpecFile(options) {
       return;
     let content;
     try {
-      content = readFileSync7(options.specPath, "utf-8");
+      content = readFileSync8(options.specPath, "utf-8");
     } catch {
       return;
     }
@@ -8441,7 +8554,7 @@ function registerServerMutationCommands(servers) {
 }
 
 // src/lib/spec-pipeline.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync8, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync9, writeFileSync as writeFileSync3 } from "node:fs";
 import { dirname as dirname4, join as join5, resolve as resolve5 } from "node:path";
 var SOURCE_TYPES = ["openapi", "graphql", "url"];
 function isHttpUrl(value) {
@@ -8474,7 +8587,7 @@ async function readSpecSource(spec, override, options = {}) {
     if (!existsSync7(filePath)) {
       throw new Error(`Spec file not found: ${filePath}`);
     }
-    content = readFileSync8(filePath, "utf-8");
+    content = readFileSync9(filePath, "utf-8");
     pathHint = filePath;
   }
   if (!content.trim()) {
@@ -8654,7 +8767,7 @@ function registerServerSpecCommands(servers) {
 }
 
 // src/commands/servers-test-authoring.ts
-import { readFileSync as readFileSync9 } from "node:fs";
+import { readFileSync as readFileSync10 } from "node:fs";
 var EXECUTION_PROFILES = [
   "mockBindings",
   "previewBindings",
@@ -8672,9 +8785,9 @@ function parseTimeoutMs(value, fallbackMs) {
 }
 function readValueOption(raw) {
   if (raw === "@-")
-    return readFileSync9(0, "utf8");
+    return readFileSync10(0, "utf8");
   if (raw.startsWith("@"))
-    return readFileSync9(raw.slice(1), "utf8");
+    return readFileSync10(raw.slice(1), "utf8");
   return raw;
 }
 async function resolveServerAndProject(serverRef, org) {
@@ -9035,6 +9148,7 @@ function registerServerTestCommands(servers) {
 function registerServerCommands(program) {
   const servers = program.command("servers").description("Manage MCP servers");
   registerServerDepsCommands(servers);
+  registerServerEndUserCommands(servers);
   registerServerGitCommands(servers);
   registerServerCommitCommand(servers);
   registerServerPromptCommands(servers);
@@ -9214,14 +9328,14 @@ function registerServerCommands(program) {
 }
 
 // src/commands/tools-diff.ts
-import { existsSync as existsSync11, readFileSync as readFileSync13 } from "node:fs";
+import { existsSync as existsSync11, readFileSync as readFileSync14 } from "node:fs";
 import { relative } from "node:path";
 
 // src/lib/dev/handlers-sync.ts
 import {
   existsSync as existsSync10,
   mkdirSync as mkdirSync7,
-  readFileSync as readFileSync12,
+  readFileSync as readFileSync13,
   statSync,
   writeFileSync as writeFileSync6
 } from "node:fs";
@@ -9229,7 +9343,7 @@ import { createHash as createHash3 } from "node:crypto";
 import { dirname as dirname5, join as join8 } from "node:path";
 
 // src/lib/dev/state.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync5, readFileSync as readFileSync11, writeFileSync as writeFileSync4 } from "node:fs";
 import { join as join6, resolve as resolve6 } from "node:path";
 function cachedStateMatchesTarget(cached, target) {
   return cached !== null && cached.serverId === target.serverId && cached.organizationId === target.organizationId;
@@ -9258,7 +9372,7 @@ function readState(cwd) {
   if (!existsSync8(path))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync10(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync11(path, "utf-8"));
     if (!parsed || typeof parsed !== "object")
       return null;
     const s = parsed;
@@ -9299,7 +9413,7 @@ function ensureGitignore(cwd) {
 import {
   existsSync as existsSync9,
   mkdirSync as mkdirSync6,
-  readFileSync as readFileSync11,
+  readFileSync as readFileSync12,
   readdirSync,
   rmSync,
   writeFileSync as writeFileSync5
@@ -9513,7 +9627,7 @@ function readToolsState(devRootDir, serverId) {
   if (!existsSync9(file))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync11(file, "utf-8"));
+    const parsed = JSON.parse(readFileSync12(file, "utf-8"));
     if (!parsed || typeof parsed !== "object")
       return null;
     const s = parsed;
@@ -9593,7 +9707,7 @@ function readLocalTool(devRootDir, serverId, toolName) {
   const stateEntry = state?.tools[toolName];
   if (!stateEntry)
     return null;
-  const view = parseToolMarkdown(readFileSync11(filePath, "utf-8"));
+  const view = parseToolMarkdown(readFileSync12(filePath, "utf-8"));
   return {
     view,
     cloudId: stateEntry.id,
@@ -9742,7 +9856,7 @@ async function pushLocalHandlerEdit(args) {
   if (!resolved) {
     return { kind: "unknown-tool", slug: args.slug };
   }
-  const source = readFileSync12(filePath, "utf-8");
+  const source = readFileSync13(filePath, "utf-8");
   const hash = hashSource(source);
   if (lastPushedHash.get(filePath) === hash) {
     return { kind: "noop" };
@@ -9901,7 +10015,7 @@ function inspectLocalHandler(args) {
   if (!existsSync10(filePath))
     return { kind: "no-local-file" };
   const cached = lastPushedHash.get(filePath);
-  const onDisk = hashSource(readFileSync12(filePath, "utf-8"));
+  const onDisk = hashSource(readFileSync13(filePath, "utf-8"));
   if (cached !== undefined) {
     return cached === onDisk ? { kind: "matches-cache" } : { kind: "differs-from-cache" };
   }
@@ -10046,7 +10160,7 @@ function buildMetadataDiff(args) {
   let local = null;
   let parseError = null;
   try {
-    local = parseToolMarkdown(readFileSync13(filePath, "utf-8"));
+    local = parseToolMarkdown(readFileSync14(filePath, "utf-8"));
   } catch (err) {
     parseError = err instanceof Error ? err.message : String(err);
   }
@@ -10089,7 +10203,7 @@ async function buildHandlerDiff(args) {
   const slug = handlerSlugFromToolName(args.toolName);
   const filePath = `${serverBundleHandlersDir(args.devRootDir)}/${slug}.ts`;
   const hasLocal = existsSync11(filePath);
-  const localContent = hasLocal ? readFileSync13(filePath, "utf-8") : null;
+  const localContent = hasLocal ? readFileSync14(filePath, "utf-8") : null;
   const localPath = hasLocal ? relative(args.cwd, filePath) || filePath : null;
   const changed = hasLocal ? localContent !== cloudResult.snapshot.content : true;
   return {
@@ -10204,7 +10318,7 @@ import { join as join10, relative as relative2 } from "node:path";
 
 // src/lib/editor-shell.ts
 import { spawn as spawn2 } from "node:child_process";
-import { existsSync as existsSync12, readFileSync as readFileSync14 } from "node:fs";
+import { existsSync as existsSync12, readFileSync as readFileSync15 } from "node:fs";
 import { platform as platform2 } from "node:os";
 import { delimiter, join as join9 } from "node:path";
 var DEFAULT_FALLBACKS = ["vi"];
@@ -10290,7 +10404,7 @@ async function runEditor(args) {
       message: `${command} exited with code ${exitCode}. The file may be unsaved; re-run after fixing.`
     };
   }
-  const contents = readFileSync14(args.filePath, "utf-8");
+  const contents = readFileSync15(args.filePath, "utf-8");
   return { ok: true, contents, command };
 }
 
@@ -11533,13 +11647,13 @@ function isAgentKey(value) {
 }
 
 // src/commands/skills-lifecycle.ts
-import { readFileSync as readFileSync15 } from "node:fs";
+import { readFileSync as readFileSync16 } from "node:fs";
 function readValueOption2(raw) {
   if (raw === "@-") {
-    return readFileSync15(0, "utf8");
+    return readFileSync16(0, "utf8");
   }
   if (raw.startsWith("@")) {
-    return readFileSync15(raw.slice(1), "utf8");
+    return readFileSync16(raw.slice(1), "utf8");
   }
   return raw;
 }
@@ -11889,7 +12003,7 @@ function registerSkillMutationCommands(skills) {
 }
 
 // src/commands/skills-test-authoring.ts
-import { readFileSync as readFileSync16 } from "node:fs";
+import { readFileSync as readFileSync17 } from "node:fs";
 var FIXTURE_MODES = [
   "baseline",
   "validationFailure",
@@ -11898,9 +12012,9 @@ var FIXTURE_MODES = [
 ];
 function readValueOption3(raw) {
   if (raw === "@-")
-    return readFileSync16(0, "utf8");
+    return readFileSync17(0, "utf8");
   if (raw.startsWith("@"))
-    return readFileSync16(raw.slice(1), "utf8");
+    return readFileSync17(raw.slice(1), "utf8");
   return raw;
 }
 function parseAssertionsOption(raw) {
@@ -12953,14 +13067,14 @@ function registerSkillCommands(program) {
 }
 
 // src/lib/dev/prepare.ts
-import { existsSync as existsSync21, readFileSync as readFileSync20, writeFileSync as writeFileSync12 } from "node:fs";
+import { existsSync as existsSync21, readFileSync as readFileSync21, writeFileSync as writeFileSync12 } from "node:fs";
 import { join as join18, relative as relative6, resolve as resolve8 } from "node:path";
 
 // src/lib/dev/bundle-sync.ts
 import {
   existsSync as existsSync15,
   mkdirSync as mkdirSync9,
-  readFileSync as readFileSync17,
+  readFileSync as readFileSync18,
   rmSync as rmSync2,
   writeFileSync as writeFileSync8
 } from "node:fs";
@@ -13097,7 +13211,7 @@ import { spawnSync } from "node:child_process";
 import {
   existsSync as existsSync16,
   mkdirSync as mkdirSync10,
-  readFileSync as readFileSync18,
+  readFileSync as readFileSync19,
   writeFileSync as writeFileSync9
 } from "node:fs";
 import { dirname as dirname8, join as join13 } from "node:path";
@@ -13192,7 +13306,7 @@ function isGitAvailable() {
 }
 function applyLocalExcludes(repoDir) {
   const excludePath = join13(repoDir, ".git", "info", "exclude");
-  const existing = existsSync16(excludePath) ? readFileSync18(excludePath, "utf-8") : "";
+  const existing = existsSync16(excludePath) ? readFileSync19(excludePath, "utf-8") : "";
   const next = mergeLocalExcludes(existing);
   if (next === null)
     return;
@@ -28578,7 +28692,7 @@ import {
   appendFileSync as appendFileSync2,
   existsSync as existsSync19,
   mkdirSync as mkdirSync13,
-  readFileSync as readFileSync19,
+  readFileSync as readFileSync20,
   readdirSync as readdirSync2,
   renameSync,
   statSync as statSync2
@@ -28630,7 +28744,7 @@ function readAll(dir) {
   for (const path of [...listRotatedFiles(dir), activeFilePath(dir)]) {
     if (!existsSync19(path))
       continue;
-    out.push(...parseLines(readFileSync19(path, "utf-8")));
+    out.push(...parseLines(readFileSync20(path, "utf-8")));
   }
   return out;
 }
@@ -28782,9 +28896,9 @@ function printEnvBindingHint(dest, envPath, cwd) {
   let example = "";
   let envJson = "{}";
   try {
-    example = readFileSync20(examplePath, "utf-8");
+    example = readFileSync21(examplePath, "utf-8");
     if (existsSync21(envPath))
-      envJson = readFileSync20(envPath, "utf-8");
+      envJson = readFileSync21(envPath, "utf-8");
   } catch {
     return;
   }
@@ -28957,7 +29071,7 @@ async function prepareDev(opts) {
 
 // src/lib/dev/tree-sync.ts
 import { createHash as createHash4 } from "node:crypto";
-import { existsSync as existsSync22, mkdirSync as mkdirSync14, readdirSync as readdirSync3, readFileSync as readFileSync21, writeFileSync as writeFileSync13 } from "node:fs";
+import { existsSync as existsSync22, mkdirSync as mkdirSync14, readdirSync as readdirSync3, readFileSync as readFileSync22, writeFileSync as writeFileSync13 } from "node:fs";
 import { join as join19 } from "node:path";
 var AUTHORING_GUIDE_FILE = "AGENTS.md";
 var STRUCTURAL_FRONTMATTER_KEYS = [
@@ -28979,7 +29093,7 @@ function listToolFiles(devRootDir, serverId) {
 }
 function readToolFile(devRootDir, serverId, toolName) {
   const file = join19(serverToolsDir(devRootDir, serverId), `${toolName}.md`);
-  const raw = readFileSync21(file, "utf-8");
+  const raw = readFileSync22(file, "utf-8");
   try {
     return { raw, view: parseToolMarkdown(raw) };
   } catch (err) {
@@ -29099,7 +29213,7 @@ function listHandlerFiles(devRootDir) {
     return [];
   return readdirSync3(dir).filter((entry) => entry.endsWith(".ts") && !entry.endsWith(".definition.ts")).sort().map((entry) => ({
     slug: entry.slice(0, -3),
-    source: readFileSync21(join19(dir, entry), "utf-8")
+    source: readFileSync22(join19(dir, entry), "utf-8")
   }));
 }
 function writeHandlerManifest(args) {
@@ -29127,7 +29241,7 @@ function recordHandlerPushed(args) {
     serverId: args.serverId,
     version: 1
   };
-  manifest.handlers[args.slug] = hashSource2(readFileSync21(file, "utf-8"));
+  manifest.handlers[args.slug] = hashSource2(readFileSync22(file, "utf-8"));
   writeFileSync13(handlerManifestPath(args.devRootDir, args.serverId), JSON.stringify(manifest, null, 2), "utf-8");
 }
 function readHandlerManifest(devRootDir, serverId) {
@@ -29135,7 +29249,7 @@ function readHandlerManifest(devRootDir, serverId) {
   if (!existsSync22(file))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync21(file, "utf-8"));
+    const parsed = JSON.parse(readFileSync22(file, "utf-8"));
     return parsed.version === 1 && parsed.handlers ? parsed : null;
   } catch {
     return null;
@@ -29642,8 +29756,24 @@ function registerApiKeyCommands(program) {
       "old key valid until": data.rotatedFrom ? formatDate(data.rotatedFrom.gracePeriodEndsAt) : "—"
     });
   }));
-  apiKeys.command("revoke <apiKey>").description("Permanently revoke an API key (accepts id or name)").action(runAction(async (apiKeyRef) => {
+  apiKeys.command("revoke <apiKey>").description('Permanently revoke an API key (accepts id or name). Needs --confirm "<key name>".').option("--confirm <name>", "The key's exact name, to confirm. Required — revocation is immediate and cannot be undone.").addHelpText("after", [
+    "",
+    "Revocation takes effect at once and cannot be reversed: every caller",
+    "holding this secret starts failing, including CI. To replace a key",
+    "without a gap, use `mcp api-keys rotate` instead — it mints the new",
+    "secret and grace-expires this one over 24h.",
+    "",
+    "Example:",
+    '  $ mcp api-keys revoke ci-build --confirm "ci-build"'
+  ].join(`
+`)).action(runAction(async (apiKeyRef, opts) => {
     const apiKeyId = await resolveApiKeyId(apiKeyRef);
+    const current = await api.get("/api/v1/api-keys", { apiKeyId });
+    assertConfirmMatches({
+      entityKind: "API key",
+      entityName: current.apiKey.name,
+      confirm: opts.confirm
+    });
     const data = await api.delete("/api/v1/api-keys", { apiKeyId });
     if (isJsonMode()) {
       printJson(data);
@@ -30133,7 +30263,7 @@ import { isAbsolute as isAbsolute4, relative as relative7, resolve as resolve10
 import {
   existsSync as existsSync23,
   mkdirSync as mkdirSync15,
-  readFileSync as readFileSync22,
+  readFileSync as readFileSync23,
   readdirSync as readdirSync4,
   unlinkSync,
   writeFileSync as writeFileSync14
@@ -30177,7 +30307,7 @@ function listSessions() {
       continue;
     const path = join21(dir, entry);
     try {
-      const parsed = JSON.parse(readFileSync22(path, "utf-8"));
+      const parsed = JSON.parse(readFileSync23(path, "utf-8"));
       if (typeof parsed.pid !== "number") {
         unlinkSync(path);
         continue;
@@ -31545,19 +31675,19 @@ import { homedir as homedir4 } from "node:os";
 import { join as join26 } from "node:path";
 
 // src/lib/dev/agent-connectors/json-config-utils.ts
-import { existsSync as existsSync29, mkdirSync as mkdirSync16, readFileSync as readFileSync23, writeFileSync as writeFileSync15 } from "node:fs";
+import { existsSync as existsSync29, mkdirSync as mkdirSync16, readFileSync as readFileSync24, writeFileSync as writeFileSync15 } from "node:fs";
 import { dirname as dirname10, join as join25, basename } from "node:path";
 function readJsonFile(path) {
   if (!existsSync29(path))
     return { ok: true, value: {} };
   try {
-    const raw = readFileSync23(path, "utf-8");
+    const raw = readFileSync24(path, "utf-8");
     if (!raw.trim())
       return { ok: true, value: {} };
     return { ok: true, value: JSON.parse(raw) };
   } catch {
     try {
-      return { ok: false, raw: readFileSync23(path, "utf-8") };
+      return { ok: false, raw: readFileSync24(path, "utf-8") };
     } catch {
       return { ok: false };
     }
@@ -31579,7 +31709,7 @@ function backupConfig(args) {
   const filename = `${args.agentId}__${basename(args.configPath)}.bak`;
   const backupPath = join25(args.backupsDir, filename);
   if (!existsSync29(backupPath)) {
-    const raw = readFileSync23(args.configPath, "utf-8");
+    const raw = readFileSync24(args.configPath, "utf-8");
     writeFileSync15(backupPath, raw, "utf-8");
   }
   return { backupPath, existed: true };
@@ -31590,7 +31720,7 @@ function restoreFromBackup(args) {
   if (!existsSync29(backupPath)) {
     return { restored: false };
   }
-  const raw = readFileSync23(backupPath, "utf-8");
+  const raw = readFileSync24(backupPath, "utf-8");
   mkdirSync16(dirname10(args.configPath), { recursive: true });
   writeFileSync15(args.configPath, raw, "utf-8");
   return { restored: true };
@@ -31679,7 +31809,7 @@ var claudeCodeConnector = {
 import {
   existsSync as existsSync31,
   mkdirSync as mkdirSync17,
-  readFileSync as readFileSync24,
+  readFileSync as readFileSync25,
   unlinkSync as unlinkSync3,
   writeFileSync as writeFileSync17
 } from "node:fs";
@@ -31738,7 +31868,7 @@ var codexConnector = {
     });
     let existing = "";
     if (existsSync31(path)) {
-      existing = readFileSync24(path, "utf-8");
+      existing = readFileSync25(path, "utf-8");
     }
     const conflict = findSectionRange(existing, args.name) !== null;
     let next = existing;
@@ -31760,7 +31890,7 @@ var codexConnector = {
   async remove(args) {
     const path = configPath2();
     if (existsSync31(path)) {
-      const existing = readFileSync24(path, "utf-8");
+      const existing = readFileSync25(path, "utf-8");
       const range = findSectionRange(existing, args.name);
       if (range) {
         const next = existing.slice(0, range.start) + existing.slice(range.end);
@@ -31773,7 +31903,7 @@ var codexConnector = {
       agentId: this.id
     });
     if (!restored.restored && existsSync31(path)) {
-      const after = readFileSync24(path, "utf-8");
+      const after = readFileSync25(path, "utf-8");
       if (!after.trim()) {
         try {
           unlinkSync3(path);
@@ -33071,6 +33201,10 @@ function registerDeploymentCommands(program) {
       hostname: d.hostname ?? "—",
       exposure: formatDeploymentExposure(d),
       "access mode": d.accessMode,
+      environment: d.environment ?? "production",
+      upstream: d.upstream?.baseUrl ?? "(spec default)",
+      "key header": d.upstream?.apiKeyHeader ?? "—",
+      "key prefix": d.upstream?.apiKeyPrefix ?? "—",
       status: d.status,
       version: d.version,
       "deployed at": d.deployedAt ? formatDate(d.deployedAt) : "—",
@@ -33252,12 +33386,12 @@ async function confirmRollback(deploymentId) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync37, statSync as statSync6, readFileSync as readFileSync26 } from "node:fs";
+import { existsSync as existsSync37, statSync as statSync6, readFileSync as readFileSync27 } from "node:fs";
 import { homedir as homedir9, platform as platform6 } from "node:os";
 import { join as join32, delimiter as delimiter3 } from "node:path";
 
 // src/lib/version-check.ts
-import { existsSync as existsSync36, mkdirSync as mkdirSync18, readFileSync as readFileSync25, writeFileSync as writeFileSync21 } from "node:fs";
+import { existsSync as existsSync36, mkdirSync as mkdirSync18, readFileSync as readFileSync26, writeFileSync as writeFileSync21 } from "node:fs";
 import { join as join31 } from "node:path";
 var CACHE_TTL_MS = 24 * 60 * 60 * 1000;
 var FETCH_TIMEOUT_MS2 = 2000;
@@ -33272,7 +33406,7 @@ function readCache() {
   if (!existsSync36(cacheFile()))
     return null;
   try {
-    const raw = JSON.parse(readFileSync25(cacheFile(), "utf-8"));
+    const raw = JSON.parse(readFileSync26(cacheFile(), "utf-8"));
     if (typeof raw.latest !== "string" || typeof raw.fetchedAt !== "number")
       return null;
     return { latest: raw.latest, fetchedAt: raw.fetchedAt };
@@ -33418,7 +33552,7 @@ function checkConfigFile() {
     } catch {}
   }
   try {
-    JSON.parse(readFileSync26(path, "utf-8"));
+    JSON.parse(readFileSync27(path, "utf-8"));
   } catch (err) {
     return {
       name: "Config file",
@@ -34300,7 +34434,7 @@ function registerInstallationCommands(program) {
 }
 
 // src/commands/invoke.ts
-import { existsSync as existsSync38, readFileSync as readFileSync27 } from "node:fs";
+import { existsSync as existsSync38, readFileSync as readFileSync28 } from "node:fs";
 import { join as join33 } from "node:path";
 
 // src/lib/dev/local-invoke.ts
@@ -34393,9 +34527,9 @@ function selectCodeModeInvocation(args) {
 }
 function readCodeOption(raw) {
   if (raw === "@-")
-    return readFileSync27(0, "utf-8");
+    return readFileSync28(0, "utf-8");
   if (raw.startsWith("@"))
-    return readFileSync27(raw.slice(1), "utf-8");
+    return readFileSync28(raw.slice(1), "utf-8");
   return raw;
 }
 function parseTimeoutMs4(value, fallbackMs) {
@@ -34677,7 +34811,7 @@ async function runLocalInvoke(args) {
     throw new CliExitError(1);
   }
   const env = {
-    ...args.envFile ? parseEnvFile(readFileSync27(args.envFile, "utf-8")) : {},
+    ...args.envFile ? parseEnvFile(readFileSync28(args.envFile, "utf-8")) : {},
     ...parseEnvPairs(args.envPairs)
   };
   const port = await findAvailablePort({ range: 40, start: 43117 });
@@ -35669,7 +35803,7 @@ import {
   existsSync as existsSync39,
   mkdirSync as mkdirSync19,
   readdirSync as readdirSync5,
-  readFileSync as readFileSync28,
+  readFileSync as readFileSync29,
   rmSync as rmSync3,
   statSync as statSync7
 } from "node:fs";
@@ -35689,7 +35823,7 @@ function readManifestFromPackageDir(packageDir) {
     return null;
   let pkg;
   try {
-    pkg = JSON.parse(readFileSync28(pkgPath, "utf-8"));
+    pkg = JSON.parse(readFileSync29(pkgPath, "utf-8"));
   } catch {
     return null;
   }
@@ -37424,7 +37558,7 @@ function displayValueFor(field, value) {
 import {
   existsSync as existsSync40,
   mkdirSync as mkdirSync20,
-  readFileSync as readFileSync29,
+  readFileSync as readFileSync30,
   writeFileSync as writeFileSync22
 } from "node:fs";
 import { join as join35 } from "node:path";
@@ -37506,7 +37640,7 @@ function readTuiState() {
     return {};
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync29(path, "utf-8"));
+    parsed = JSON.parse(readFileSync30(path, "utf-8"));
   } catch {
     return {};
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcpcloud/cli",
-  "version": "0.23.0",
+  "version": "0.24.0-next-20260917193810",
   "description": "The official CLI for MCPCloud — manage projects, servers, skills, and API keys from the terminal",
   "type": "module",
   "bin": {