@motherbase/cli 0.2.4 → 0.2.5

package/src/commands/local.js

@@ -1,273 +1,273 @@
-'use strict';
-
-// Local self-host workflow: thin wrappers over `docker compose`, plus `init`
-// scaffolding.
-//
-// `init` used to write a `.env` and nothing else, which left a directory that
-// `motherbase start` could not start: `docker compose up` in a folder with no
-// compose file is a raw Docker error, and that was the first thing a new user
-// saw. It now writes a self-contained stack that runs.
-
-const crypto = require('crypto');
-const fs = require('fs');
-const path = require('path');
-const { spawn } = require('child_process');
-const ui = require('../ui');
-const { CliError } = require('../context');
-
-const COMPOSE_FILE = 'docker-compose.yml';
-const ENV_FILE = '.env';
-
-// Where the images are built from when the caller has no checkout. Docker
-// Compose accepts a git URL as a build context, so a scaffolded directory needs
-// nothing but Docker: no clone, no registry, no published image. The first `up`
-// pays for the build; every one after that is cached.
-const DEFAULT_REPO = 'https://github.com/JulienGuinot/BoilerPlate-Backend.git';
-const DEFAULT_REF = 'master';
-
-function dockerCompose(composeArgs) {
-  return new Promise((resolve, reject) => {
-    const child = spawn('docker', ['compose', ...composeArgs], { stdio: 'inherit', windowsHide: true });
-    child.on('error', err => reject(new CliError(`failed to run docker: ${err.message}`)));
-    child.on('close', code => (code === 0 ? resolve() : reject(new CliError(`docker compose exited with code ${code}`))));
-  });
-}
-
-/**
- * Refuse to run compose from a directory that has no stack, and say what to do.
- * Without this the user gets Docker's own "no configuration file provided",
- * which does not mention `motherbase init`.
- */
-function assertStack(ctx) {
-  const file = path.join(ctx.cwd, COMPOSE_FILE);
-  if (!fs.existsSync(file)) {
-    throw new CliError(
-      `no ${COMPOSE_FILE} here. Run \`motherbase init\` first, or cd into a directory that has one.`,
-    );
-  }
-}
-
-const hex = n => crypto.randomBytes(n).toString('hex');
-const b64 = n => crypto.randomBytes(n).toString('base64');
-
-function renderEnv(context) {
-  return [
-    '# Generated by `motherbase init`. Secrets below are unique to this install.',
-    '# Keep this file out of version control.',
-    '',
-    `PORT=${context.port}`,
-    `BASE_HOST=localhost:${context.port}`,
-    'NODE_ENV=production',
-    '',
-    '# Secrets. Regenerating any of these invalidates what it protects:',
-    '# JWT_SECRET signs sessions, CONFIG_ENCRYPTION_KEY encrypts Studio-managed',
-    '# secrets (SMTP, OAuth credentials) at rest.',
-    `JWT_SECRET=${hex(32)}`,
-    `CONFIG_ENCRYPTION_KEY=${b64(32)}`,
-    `POSTGRES_PASSWORD=${hex(16)}`,
-    `S3_ACCESS_KEY_ID=${hex(8)}`,
-    `S3_SECRET_ACCESS_KEY=${hex(20)}`,
-    '',
-    'S3_BUCKET=uploads',
-    'S3_PUBLIC_BUCKET=public',
-    'S3_REGION=us-east-1',
-    '',
-    '# Host ports. Change these if something already listens on them.',
-    `POSTGRES_PORT=${context.postgresPort}`,
-    'MINIO_PORT=59000',
-    'MINIO_CONSOLE_PORT=59001',
-    '',
-    '# First operator account, created on first boot.',
-    `SEED_ADMIN_EMAIL=${context.adminEmail}`,
-    `SEED_ADMIN_PASSWORD=${context.adminPassword}`,
-    '',
-  ].join('\n');
-}
-
-function renderCompose(context) {
-  const buildContext = `${context.repo}#${context.ref}`;
-  return `# Generated by \`motherbase init\`.
-#
-# Images are built from the public repository, so this directory needs Docker and
-# nothing else: no checkout, no registry login. The first \`up\` builds them, which
-# takes a few minutes; after that the layers are cached.
-#
-# Working from a checkout instead? Replace both \`context:\` values with the path
-# to it and the build becomes local and incremental.
-services:
-  db:
-    build:
-      context: ${buildContext}
-      dockerfile: deploy/postgres.Dockerfile
-    command: ['postgres', '-c', 'shared_preload_libraries=pg_cron,pg_stat_statements', '-c', 'cron.database_name=app']
-    restart: unless-stopped
-    environment:
-      POSTGRES_USER: postgres
-      POSTGRES_PASSWORD: \${POSTGRES_PASSWORD}
-      POSTGRES_DB: app
-    ports:
-      # Loopback only: reachable by psql, Prisma, Drizzle or a BI client on this
-      # machine, and by nothing on the network.
-      - '127.0.0.1:\${POSTGRES_PORT:-55432}:5432'
-    volumes:
-      - db_data:/var/lib/postgresql/data
-    healthcheck:
-      test: ['CMD-SHELL', 'pg_isready -U postgres']
-      interval: 5s
-      timeout: 5s
-      retries: 10
-
-  minio:
-    image: alpine/minio:RELEASE.2025-10-15T17-29-55Z
-    restart: unless-stopped
-    user: "0:0"
-    command: server /data --console-address ":9001"
-    environment:
-      MINIO_ROOT_USER: \${S3_ACCESS_KEY_ID}
-      MINIO_ROOT_PASSWORD: \${S3_SECRET_ACCESS_KEY}
-    ports:
-      - '127.0.0.1:\${MINIO_PORT:-59000}:9000'
-      - '127.0.0.1:\${MINIO_CONSOLE_PORT:-59001}:9001'
-    volumes:
-      - minio_data:/data
-    healthcheck:
-      test: ['CMD-SHELL', 'wget -qO- http://localhost:9000/minio/health/live >/dev/null']
-      interval: 5s
-      timeout: 5s
-      retries: 10
-
-  # One-shot: a private bucket and a separate anonymously-downloadable one.
-  createbuckets:
-    image: minio/mc:RELEASE.2025-08-13T08-35-41Z
-    depends_on:
-      minio:
-        condition: service_healthy
-    entrypoint: >
-      /bin/sh -c "
-      mc alias set local http://minio:9000 \${S3_ACCESS_KEY_ID} \${S3_SECRET_ACCESS_KEY};
-      mc mb --ignore-existing local/\${S3_BUCKET:-uploads};
-      mc anonymous set none local/\${S3_BUCKET:-uploads};
-      mc mb --ignore-existing local/\${S3_PUBLIC_BUCKET:-public};
-      mc anonymous set download local/\${S3_PUBLIC_BUCKET:-public};
-      echo 'buckets ready';
-      "
-
-  api:
-    build:
-      context: ${buildContext}
-    restart: unless-stopped
-    depends_on:
-      db:
-        condition: service_healthy
-      minio:
-        condition: service_healthy
-      createbuckets:
-        condition: service_completed_successfully
-    env_file:
-      - ${ENV_FILE}
-    # Container-internal wiring, overriding the localhost values in .env so the
-    # same file works for both host tooling and the containers.
-    environment:
-      NODE_ENV: production
-      PORT: 5001
-      DATABASE_URL: postgresql://postgres:\${POSTGRES_PASSWORD}@db:5432/app?schema=public
-      STORAGE_DRIVER: s3
-      S3_ENDPOINT: http://minio:9000
-      DB_PORT: \${POSTGRES_PORT:-55432}
-    ports:
-      - '\${PORT:-5001}:5001'
-
-volumes:
-  db_data:
-  minio_data:
-`;
-}
-
-const init = {
-  summary: 'Scaffold a runnable local stack (compose file, .env, generated secrets)',
-  usage: 'motherbase init [dir] [--port 5001] [--repo URL] [--ref BRANCH] [--force]',
-  async run(ctx, args, flags = {}) {
-    const dir = args[0] || '.';
-    const target = path.resolve(ctx.cwd, dir);
-    fs.mkdirSync(target, { recursive: true });
-
-    const context = {
-      port: Number(flags.port) || 5001,
-      postgresPort: Number(flags['postgres-port']) || 55432,
-      repo: flags.repo || DEFAULT_REPO,
-      ref: flags.ref || DEFAULT_REF,
-      adminEmail: flags['admin-email'] || 'admin@example.com',
-      // Generated, never a placeholder: a scaffold that ships `change-me` is a
-      // scaffold that reaches production with `change-me`.
-      adminPassword: flags['admin-password'] || crypto.randomBytes(12).toString('base64url'),
-    };
-
-    const written = [];
-    const skipped = [];
-    for (const [name, render] of [[ENV_FILE, renderEnv], [COMPOSE_FILE, renderCompose]]) {
-      const file = path.join(target, name);
-      // Never silently overwrite: .env holds the only copy of secrets that
-      // existing data was encrypted with.
-      if (fs.existsSync(file) && !flags.force) {
-        skipped.push(name);
-        continue;
-      }
-      fs.writeFileSync(file, render(context), name === ENV_FILE ? { mode: 0o600 } : undefined);
-      written.push(name);
-    }
-
-    ui.success(`Initialized Motherbase project at ${target}`);
-    if (written.length) ui.info(`wrote ${written.join(', ')}`);
-    if (skipped.length) {
-      ui.warn(`kept existing ${skipped.join(', ')} (use --force to overwrite, which discards their secrets)`);
-    }
-    if (written.includes(ENV_FILE)) {
-      ui.print('');
-      ui.print(`  Studio:   http://localhost:${context.port}`);
-      ui.print(`  Sign in:  ${context.adminEmail} / ${context.adminPassword}`);
-      ui.print('');
-      ui.print('  Next:');
-      if (dir !== '.') ui.print(`    cd ${dir}`);
-      ui.print('    motherbase start        # first run builds the images, give it a few minutes');
-      ui.print('');
-    }
-  },
-};
-
-const start = {
-  summary: 'Start the local docker compose stack',
-  usage: 'motherbase start',
-  async run(ctx) {
-    assertStack(ctx);
-    await dockerCompose(['up', '-d']);
-  },
-};
-
-const stop = {
-  summary: 'Stop the local docker compose stack',
-  usage: 'motherbase stop',
-  async run(ctx) {
-    assertStack(ctx);
-    await dockerCompose(['down']);
-  },
-};
-
-const deploy = {
-  summary: 'Rebuild and start the local docker compose stack',
-  usage: 'motherbase deploy',
-  async run(ctx) {
-    assertStack(ctx);
-    await dockerCompose(['up', '-d', '--build']);
-  },
-};
-
-const logs = {
-  summary: 'Follow logs from the local docker compose stack',
-  usage: 'motherbase logs [service...]',
-  async run(ctx, args) {
-    assertStack(ctx);
-    await dockerCompose(['logs', '-f', ...args]);
-  },
-};
-
-module.exports = { init, start, stop, deploy, logs, renderEnv, renderCompose };
+'use strict';
+
+// Local self-host workflow: thin wrappers over `docker compose`, plus `init`
+// scaffolding.
+//
+// `init` used to write a `.env` and nothing else, which left a directory that
+// `motherbase start` could not start: `docker compose up` in a folder with no
+// compose file is a raw Docker error, and that was the first thing a new user
+// saw. It now writes a self-contained stack that runs.
+
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+const { spawn } = require('child_process');
+const ui = require('../ui');
+const { CliError } = require('../context');
+
+const COMPOSE_FILE = 'docker-compose.yml';
+const ENV_FILE = '.env';
+
+// Where the images are built from when the caller has no checkout. Docker
+// Compose accepts a git URL as a build context, so a scaffolded directory needs
+// nothing but Docker: no clone, no registry, no published image. The first `up`
+// pays for the build; every one after that is cached.
+const DEFAULT_REPO = 'https://github.com/JulienGuinot/BoilerPlate-Backend.git';
+const DEFAULT_REF = 'master';
+
+function dockerCompose(composeArgs) {
+  return new Promise((resolve, reject) => {
+    const child = spawn('docker', ['compose', ...composeArgs], { stdio: 'inherit', windowsHide: true });
+    child.on('error', err => reject(new CliError(`failed to run docker: ${err.message}`)));
+    child.on('close', code => (code === 0 ? resolve() : reject(new CliError(`docker compose exited with code ${code}`))));
+  });
+}
+
+/**
+ * Refuse to run compose from a directory that has no stack, and say what to do.
+ * Without this the user gets Docker's own "no configuration file provided",
+ * which does not mention `motherbase init`.
+ */
+function assertStack(ctx) {
+  const file = path.join(ctx.cwd, COMPOSE_FILE);
+  if (!fs.existsSync(file)) {
+    throw new CliError(
+      `no ${COMPOSE_FILE} here. Run \`motherbase init\` first, or cd into a directory that has one.`,
+    );
+  }
+}
+
+const hex = n => crypto.randomBytes(n).toString('hex');
+const b64 = n => crypto.randomBytes(n).toString('base64');
+
+function renderEnv(context) {
+  return [
+    '# Generated by `motherbase init`. Secrets below are unique to this install.',
+    '# Keep this file out of version control.',
+    '',
+    `PORT=${context.port}`,
+    `BASE_HOST=localhost:${context.port}`,
+    'NODE_ENV=production',
+    '',
+    '# Secrets. Regenerating any of these invalidates what it protects:',
+    '# JWT_SECRET signs sessions, CONFIG_ENCRYPTION_KEY encrypts Studio-managed',
+    '# secrets (SMTP, OAuth credentials) at rest.',
+    `JWT_SECRET=${hex(32)}`,
+    `CONFIG_ENCRYPTION_KEY=${b64(32)}`,
+    `POSTGRES_PASSWORD=${hex(16)}`,
+    `S3_ACCESS_KEY_ID=${hex(8)}`,
+    `S3_SECRET_ACCESS_KEY=${hex(20)}`,
+    '',
+    'S3_BUCKET=uploads',
+    'S3_PUBLIC_BUCKET=public',
+    'S3_REGION=us-east-1',
+    '',
+    '# Host ports. Change these if something already listens on them.',
+    `POSTGRES_PORT=${context.postgresPort}`,
+    'MINIO_PORT=59000',
+    'MINIO_CONSOLE_PORT=59001',
+    '',
+    '# First operator account, created on first boot.',
+    `SEED_ADMIN_EMAIL=${context.adminEmail}`,
+    `SEED_ADMIN_PASSWORD=${context.adminPassword}`,
+    '',
+  ].join('\n');
+}
+
+function renderCompose(context) {
+  const buildContext = `${context.repo}#${context.ref}`;
+  return `# Generated by \`motherbase init\`.
+#
+# Images are built from the public repository, so this directory needs Docker and
+# nothing else: no checkout, no registry login. The first \`up\` builds them, which
+# takes a few minutes; after that the layers are cached.
+#
+# Working from a checkout instead? Replace both \`context:\` values with the path
+# to it and the build becomes local and incremental.
+services:
+  db:
+    build:
+      context: ${buildContext}
+      dockerfile: deploy/postgres.Dockerfile
+    command: ['postgres', '-c', 'shared_preload_libraries=pg_cron,pg_stat_statements', '-c', 'cron.database_name=app']
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: \${POSTGRES_PASSWORD}
+      POSTGRES_DB: app
+    ports:
+      # Loopback only: reachable by psql, Prisma, Drizzle or a BI client on this
+      # machine, and by nothing on the network.
+      - '127.0.0.1:\${POSTGRES_PORT:-55432}:5432'
+    volumes:
+      - db_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ['CMD-SHELL', 'pg_isready -U postgres']
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+  minio:
+    image: alpine/minio:RELEASE.2025-10-15T17-29-55Z
+    restart: unless-stopped
+    user: "0:0"
+    command: server /data --console-address ":9001"
+    environment:
+      MINIO_ROOT_USER: \${S3_ACCESS_KEY_ID}
+      MINIO_ROOT_PASSWORD: \${S3_SECRET_ACCESS_KEY}
+    ports:
+      - '127.0.0.1:\${MINIO_PORT:-59000}:9000'
+      - '127.0.0.1:\${MINIO_CONSOLE_PORT:-59001}:9001'
+    volumes:
+      - minio_data:/data
+    healthcheck:
+      test: ['CMD-SHELL', 'wget -qO- http://localhost:9000/minio/health/live >/dev/null']
+      interval: 5s
+      timeout: 5s
+      retries: 10
+
+  # One-shot: a private bucket and a separate anonymously-downloadable one.
+  createbuckets:
+    image: quay.io/minio/mc:RELEASE.2025-08-13T08-35-41Z
+    depends_on:
+      minio:
+        condition: service_healthy
+    entrypoint: >
+      /bin/sh -c "
+      mc alias set local http://minio:9000 \${S3_ACCESS_KEY_ID} \${S3_SECRET_ACCESS_KEY};
+      mc mb --ignore-existing local/\${S3_BUCKET:-uploads};
+      mc anonymous set none local/\${S3_BUCKET:-uploads};
+      mc mb --ignore-existing local/\${S3_PUBLIC_BUCKET:-public};
+      mc anonymous set download local/\${S3_PUBLIC_BUCKET:-public};
+      echo 'buckets ready';
+      "
+
+  api:
+    build:
+      context: ${buildContext}
+    restart: unless-stopped
+    depends_on:
+      db:
+        condition: service_healthy
+      minio:
+        condition: service_healthy
+      createbuckets:
+        condition: service_completed_successfully
+    env_file:
+      - ${ENV_FILE}
+    # Container-internal wiring, overriding the localhost values in .env so the
+    # same file works for both host tooling and the containers.
+    environment:
+      NODE_ENV: production
+      PORT: 5001
+      DATABASE_URL: postgresql://postgres:\${POSTGRES_PASSWORD}@db:5432/app?schema=public
+      STORAGE_DRIVER: s3
+      S3_ENDPOINT: http://minio:9000
+      DB_PORT: \${POSTGRES_PORT:-55432}
+    ports:
+      - '\${PORT:-5001}:5001'
+
+volumes:
+  db_data:
+  minio_data:
+`;
+}
+
+const init = {
+  summary: 'Scaffold a runnable local stack (compose file, .env, generated secrets)',
+  usage: 'motherbase init [dir] [--port 5001] [--repo URL] [--ref BRANCH] [--force]',
+  async run(ctx, args, flags = {}) {
+    const dir = args[0] || '.';
+    const target = path.resolve(ctx.cwd, dir);
+    fs.mkdirSync(target, { recursive: true });
+
+    const context = {
+      port: Number(flags.port) || 5001,
+      postgresPort: Number(flags['postgres-port']) || 55432,
+      repo: flags.repo || DEFAULT_REPO,
+      ref: flags.ref || DEFAULT_REF,
+      adminEmail: flags['admin-email'] || 'admin@example.com',
+      // Generated, never a placeholder: a scaffold that ships `change-me` is a
+      // scaffold that reaches production with `change-me`.
+      adminPassword: flags['admin-password'] || crypto.randomBytes(12).toString('base64url'),
+    };
+
+    const written = [];
+    const skipped = [];
+    for (const [name, render] of [[ENV_FILE, renderEnv], [COMPOSE_FILE, renderCompose]]) {
+      const file = path.join(target, name);
+      // Never silently overwrite: .env holds the only copy of secrets that
+      // existing data was encrypted with.
+      if (fs.existsSync(file) && !flags.force) {
+        skipped.push(name);
+        continue;
+      }
+      fs.writeFileSync(file, render(context), name === ENV_FILE ? { mode: 0o600 } : undefined);
+      written.push(name);
+    }
+
+    ui.success(`Initialized Motherbase project at ${target}`);
+    if (written.length) ui.info(`wrote ${written.join(', ')}`);
+    if (skipped.length) {
+      ui.warn(`kept existing ${skipped.join(', ')} (use --force to overwrite, which discards their secrets)`);
+    }
+    if (written.includes(ENV_FILE)) {
+      ui.print('');
+      ui.print(`  Studio:   http://localhost:${context.port}`);
+      ui.print(`  Sign in:  ${context.adminEmail} / ${context.adminPassword}`);
+      ui.print('');
+      ui.print('  Next:');
+      if (dir !== '.') ui.print(`    cd ${dir}`);
+      ui.print('    motherbase start        # first run builds the images, give it a few minutes');
+      ui.print('');
+    }
+  },
+};
+
+const start = {
+  summary: 'Start the local docker compose stack',
+  usage: 'motherbase start',
+  async run(ctx) {
+    assertStack(ctx);
+    await dockerCompose(['up', '-d']);
+  },
+};
+
+const stop = {
+  summary: 'Stop the local docker compose stack',
+  usage: 'motherbase stop',
+  async run(ctx) {
+    assertStack(ctx);
+    await dockerCompose(['down']);
+  },
+};
+
+const deploy = {
+  summary: 'Rebuild and start the local docker compose stack',
+  usage: 'motherbase deploy',
+  async run(ctx) {
+    assertStack(ctx);
+    await dockerCompose(['up', '-d', '--build']);
+  },
+};
+
+const logs = {
+  summary: 'Follow logs from the local docker compose stack',
+  usage: 'motherbase logs [service...]',
+  async run(ctx, args) {
+    assertStack(ctx);
+    await dockerCompose(['logs', '-f', ...args]);
+  },
+};
+
+module.exports = { init, start, stop, deploy, logs, renderEnv, renderCompose };

package/src/commands/mcp.js

@@ -1,43 +1,61 @@
-'use strict';
-
-// `motherbase mcp` — expose the linked project to an AI agent over the Model
-// Context Protocol.
-//
-// The transport is stdio, which is how an MCP client launches a server: it spawns
-// this process and talks JSON-RPC over its stdin/stdout. Nothing is printed to
-// stdout except protocol messages, so diagnostics go to stderr.
-
-const { serve, toolServer } = require('../mcp/protocol');
-const { buildTools } = require('../mcp/tools');
-
-const pkg = require('../../package.json');
-
-const mcp = {
-  summary: 'Serve the linked project to an AI agent over MCP (stdio)',
-  usage: 'motherbase mcp [--write]',
-  async run(ctx, _args, flags = {}) {
-    // Resolve the project up front. Failing here is a clear CLI error; failing
-    // on the first tool call is an opaque one inside someone's agent.
-    ctx.requireProject();
-
-    const write = Boolean(flags.write);
-    const tools = buildTools(ctx, { write });
-
-    process.stderr.write(
-      `motherbase mcp: ${tools.length} tools, ${write ? 'read and write' : 'read only'}. `
-        + `Project: ${ctx.projectName || ctx.projectId || 'direct'}\n`,
-    );
-    if (!write) {
-      process.stderr.write('  Pass --write to expose apply_migration and raw SQL writes.\n');
-    }
-
-    await serve({
-      input: process.stdin,
-      output: process.stdout,
-      handlers: toolServer({ name: 'motherbase', version: pkg.version, tools }),
-      onError: err => process.stderr.write(`motherbase mcp: ${err && err.message ? err.message : err}\n`),
-    });
-  },
-};
-
-module.exports = mcp;
+'use strict';
+
+// `motherbase mcp`: expose the linked project, and the console's organizations
+// and projects, to an AI agent over the Model Context Protocol.
+//
+// The transport is stdio, which is how an MCP client launches a server: it spawns
+// this process and talks JSON-RPC over its stdin/stdout. Nothing is printed to
+// stdout except protocol messages, so diagnostics go to stderr.
+
+const { serve, toolServer } = require('../mcp/protocol');
+const { buildTools } = require('../mcp/tools');
+const { CliError } = require('../context');
+
+const pkg = require('../../package.json');
+
+/** Whether a `require*()` resolves, without surfacing its error. */
+function reaches(resolve) {
+  try {
+    resolve();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+const mcp = {
+  summary: 'Serve the linked project and console to an AI agent over MCP (stdio)',
+  usage: 'motherbase mcp [--write]',
+  async run(ctx, _args, flags = {}) {
+    // Resolve what this session reaches up front. Failing here is a clear CLI
+    // error; failing on the first tool call is an opaque one inside someone's agent.
+    const scope = { project: reaches(() => ctx.requireProject()), console: reaches(() => ctx.requireConsole()) };
+    if (!scope.project && !scope.console) {
+      throw new CliError(
+        'Nothing to serve. Run `motherbase login` for the organization and project tools, and `motherbase link` '
+          + '(or set MOTHERBASE_URL + MOTHERBASE_ADMIN_TOKEN) for the database tools.',
+      );
+    }
+
+    const write = Boolean(flags.write);
+    const tools = buildTools(ctx, { write, ...scope });
+
+    process.stderr.write(
+      `motherbase mcp: ${tools.length} tools, ${write ? 'read and write' : 'read only'}. `
+        + `Project: ${scope.project ? ctx.projectName || ctx.projectId || 'direct' : 'none linked'}. `
+        + `Console: ${scope.console ? ctx.consoleUrl : 'not logged in'}\n`,
+    );
+    if (!write) {
+      process.stderr.write('  Pass --write to expose apply_migration, raw SQL writes, function deploys and project lifecycle.\n');
+    }
+
+    await serve({
+      input: process.stdin,
+      output: process.stdout,
+      handlers: toolServer({ name: 'motherbase', version: pkg.version, tools }),
+      onError: err => process.stderr.write(`motherbase mcp: ${err && err.message ? err.message : err}\n`),
+    });
+  },
+};
+
+module.exports = mcp;