@mrciphersmith/keryx 0.3.34 → 0.3.36

package/README.md

@@ -740,7 +740,10 @@ advertised surface stays a fixed cost instead of growing with your server
 list. Every call goes through the same approval prompt as `shell_exec`, a
 server is spawned without keryx's own credentials in its environment, and
 `--scope project` writes a `.keryx/mcp-servers.json` you can commit while
-`keryx mcp disable` stays personal to you.
+`keryx mcp disable` stays personal to you. In `--trust` mode you can trust one
+exact tool for the session (never one its server marks `destructiveHint`);
+`/mcp trust list` and `/mcp trust revoke <server__tool>|all` show and remove
+those grants.
 
 Remote servers work the same way — `keryx mcp add linear --transport http
 <url> --header 'Authorization: Bearer ${LINEAR_TOKEN}'` — and if that

package/dist/cli.js

@@ -13447,7 +13447,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@mrciphersmith/keryx",
-    version: "0.3.34",
+    version: "0.3.36",
     description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
     private: false,
     publishConfig: {
@@ -71950,7 +71950,7 @@ ${shown.join(`
         result = precomputedResult;
       } else {
         try {
-          result = await executeCall(call, toolByName, io.requestApproval, io.permissionMode, io.readOnly, io.onAutoApproved, hasInvocationCapacity, reserveInvocation, invocationBudget.maxCalls, signal, deps.busLeases, deps.hardDeny === undefined ? undefined : { check: deps.hardDeny, onDenied: io.onUnattendedDenial }, deps.hooks, untrustedOrigin, io.trustedMcpTools, io.mcpToolFingerprint);
+          result = await executeCall(call, toolByName, io.requestApproval, io.permissionMode, io.readOnly, io.onAutoApproved, hasInvocationCapacity, reserveInvocation, invocationBudget.maxCalls, signal, deps.busLeases, deps.hardDeny === undefined ? undefined : { check: deps.hardDeny, onDenied: io.onUnattendedDenial }, deps.hooks, untrustedOrigin, io.trustedMcpTools, io.mcpToolFingerprint, io.mcpToolDestructive);
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
           result = { output: `${call.name} failed: ${message}`, isError: true };
@@ -72520,7 +72520,7 @@ function composeWithHook(toolName, rawDecision, hookResult, interactive) {
   }
   return { decision, hookTightened: true, hookAsked, ...denyMessage !== undefined ? { denyMessage } : {} };
 }
-async function executeCall(call, toolByName, requestApproval, permissionMode, readOnly, onAutoApproved, hasInvocationCapacity, reserveInvocation, maxToolCalls, signal, busLeases, hardDeny, hooks, untrustedOrigin = false, trustedMcpTools, mcpToolFingerprint) {
+async function executeCall(call, toolByName, requestApproval, permissionMode, readOnly, onAutoApproved, hasInvocationCapacity, reserveInvocation, maxToolCalls, signal, busLeases, hardDeny, hooks, untrustedOrigin = false, trustedMcpTools, mcpToolFingerprint, mcpToolDestructive) {
   const tool = toolByName.get(call.name);
   if (tool === undefined) {
     return { output: `unknown tool: ${call.name}`, isError: true };
@@ -72583,11 +72583,14 @@ async function executeCall(call, toolByName, requestApproval, permissionMode, re
     const gated = composeWithHook(call.name, rawDecision, hookResult, hookInteractive);
     const mcpFqn = call.name === "use_tool" && typeof input.tool_name === "string" ? input.tool_name : undefined;
     const currentMcpFingerprint = mcpFqn !== undefined ? mcpToolFingerprint?.(mcpFqn) : undefined;
-    if (mcpFqn !== undefined && trustedMcpTools?.has(mcpFqn) === true && trustedMcpTools.get(mcpFqn) !== currentMcpFingerprint) {
+    const mcpDestructive = mcpFqn !== undefined && mcpToolDestructive?.(mcpFqn) === true;
+    if (mcpFqn !== undefined && trustedMcpTools?.has(mcpFqn) === true && (mcpDestructive || trustedMcpTools.get(mcpFqn) !== currentMcpFingerprint)) {
       trustedMcpTools.delete(mcpFqn);
     }
-    const trustedMcp = mode === "trust" && mcpFqn !== undefined && trustedMcpTools?.has(mcpFqn) === true;
-    const mcpTrustEligible = mcpFqn !== undefined && mode === "trust" && !gated.hookAsked && currentMcpFingerprint !== undefined;
+    const mcpGranted = mcpFqn !== undefined && trustedMcpTools?.has(mcpFqn) === true;
+    const trustedMcp = mode === "trust" && mcpGranted;
+    const mcpTrustPossible = mcpFqn !== undefined && mode === "trust" && !gated.hookAsked && currentMcpFingerprint !== undefined;
+    const mcpTrustEligible = mcpTrustPossible && !mcpDestructive;
     if (gated.decision === "deny") {
       return {
         output: gated.hookTightened ? gated.denyMessage : `tool "${call.name}" is not permitted while read-only mode (/plan) is on`,
@@ -72595,7 +72598,7 @@ async function executeCall(call, toolByName, requestApproval, permissionMode, re
       };
     }
     if (gated.decision === "auto" && !untrustedOrigin || trustedMcp && !untrustedOrigin && !gated.hookAsked && !isReadOnly) {
-      onAutoApproved?.(call.name, call.input, { destructive, credentials });
+      onAutoApproved?.(call.name, call.input, { destructive, credentials, ...trustedMcp ? { mcpTrusted: true } : {} });
     } else {
       const fingerprint = toolCallHash(call.name, call.input);
       const response = requestApproval === undefined ? false : await requestApproval(call.name, call.input, {
@@ -72606,7 +72609,8 @@ async function executeCall(call, toolByName, requestApproval, permissionMode, re
         ...publishLease && publishLeaseHolder !== undefined ? { publishLeaseDetail: `held by @${publishLeaseHolder.name} \u2014 "${publishLeaseHolder.reason}"` } : {},
         ...gated.hookAsked ? { hookAsk: true } : {},
         ...untrustedOrigin ? { untrustedOrigin: true } : {},
-        ...mcpTrustEligible ? untrustedOrigin ? { mcpTrustWithheld: true } : { mcpTrustAvailable: true } : {}
+        ...mcpTrustPossible ? mcpDestructive ? { mcpTrustWithheld: true, mcpTrustWithheldReason: "destructive" } : untrustedOrigin ? { mcpTrustWithheld: true, mcpTrustWithheldReason: "untrusted-origin" } : { mcpTrustAvailable: true } : {},
+        ...mcpGranted ? { mcpTrusted: true } : {}
       });
       if (!isApprovalFor(response, fingerprint)) {
         return { output: untrustedOrigin ? untrustedDenial : "command not approved by the user; not executed", isError: true };
@@ -81625,7 +81629,7 @@ function renderUseToolApprovalLines(description, meta) {
   const lines = [
     description.title,
     `  server: ${description.server}`,
-    `  tool:   ${description.tool}`,
+    `  tool:   ${description.tool}${meta?.mcpTrusted === true ? ` ${TRUSTED_MARKER}` : ""}`,
     ...description.argumentLines.map((line) => `  ${line}`)
   ];
   if (description.argumentsTruncated) {
@@ -81637,19 +81641,25 @@ function renderUseToolApprovalLines(description, meta) {
   for (const notice of untrustedOriginNotices(meta)) {
     lines.push(`  ${notice}`);
   }
+  for (const notice of destructiveTrustNotices(meta)) {
+    lines.push(`  ${notice}`);
+  }
   return lines;
 }
 function untrustedOriginNotices(meta) {
   if (meta?.untrustedOrigin !== true)
     return [];
   const notices = ["\u26A0 follows untrusted external content \u2014 that content cannot authorize this call"];
-  if (meta.mcpTrustWithheld === true) {
+  if (meta.mcpTrustWithheld === true && meta.mcpTrustWithheldReason !== "destructive") {
     notices.push("trust for this session is not offered: this turn contains external content");
   }
   return notices;
 }
-function mcpTrustOffered(meta, resolvable) {
-  return meta?.mcpTrustAvailable === true && meta.untrustedOrigin !== true && meta.fingerprint !== undefined && resolvable;
+function destructiveTrustNotices(meta) {
+  return meta?.mcpTrustWithheld === true && meta.mcpTrustWithheldReason === "destructive" ? ["trust for this session is not offered: this tool is marked destructive (destructiveHint) by its server"] : [];
+}
+function mcpTrustOffered(meta, resolvable, destructive = false) {
+  return meta?.mcpTrustAvailable === true && meta.untrustedOrigin !== true && meta.mcpTrustWithheldReason !== "destructive" && !destructive && meta.fingerprint !== undefined && resolvable;
 }
 function summariseUseToolApproval(description) {
   return `${description.tool} on ${description.server}`;
@@ -81660,10 +81670,10 @@ function isMcpToolCall(tool) {
 function isApprovalYes(answer) {
   return /^y(es)?$/i.test(answer.trim());
 }
-async function promptUseToolApproval(io, input, meta, resolve, style, gutter = "") {
+async function promptUseToolApproval(io, input, meta, resolve, style, gutter = "", destructive) {
   const paint = style ?? { yellow: (t) => t, dim: (t) => t, green: (t) => t, red: (t) => t };
   const described = describeUseToolApproval(input, resolve);
-  const canTrust = mcpTrustOffered(meta, resolve?.(described.fqn) !== undefined);
+  const canTrust = mcpTrustOffered(meta, resolve?.(described.fqn) !== undefined, destructive?.(described.fqn) === true);
   const lines = renderUseToolApprovalLines(described, meta);
   io.out(`
 `);
@@ -81709,7 +81719,70 @@ function catalogFingerprintResolver(catalog) {
     return entry === undefined ? undefined : toolDefinitionFingerprint(entry);
   };
 }
-var FQN_SEPARATOR = "__", MAX_ARGUMENT_CHARS = 400, MAX_ARGUMENT_KEYS = 40, MAX_IDENTIFIER_CHARS = 80, APPROVAL_ALLOW_ID = "allow";
+function catalogDestructiveResolver(catalog) {
+  return (fqn) => catalog?.entries.find((candidate) => candidate.fqn === fqn)?.annotations?.destructiveHint === true;
+}
+function parseMcpTrustCommand(line) {
+  const parts = line.trim().split(/\s+/);
+  if (parts[0] !== "/mcp" || parts[1] !== "trust")
+    return;
+  const sub = parts[2];
+  const rest = parts.slice(3);
+  if (sub === "list") {
+    return rest.length === 0 ? { kind: "list" } : { kind: "usage", reason: "`/mcp trust list` takes no argument" };
+  }
+  if (sub === "revoke") {
+    if (rest.length === 0)
+      return { kind: "usage", reason: "`/mcp trust revoke` needs a tool name or `all`" };
+    if (rest.length > 1)
+      return { kind: "usage", reason: "`/mcp trust revoke` takes ONE tool name or `all`" };
+    const target = rest[0] ?? "";
+    return target === "all" ? { kind: "revoke-all" } : { kind: "revoke", target };
+  }
+  return { kind: "usage", reason: sub === undefined ? "`/mcp trust` needs a subcommand" : `unknown subcommand \`${sanitiseIdentifier(sub, 40)}\`` };
+}
+function catalogTrustStaleness(catalog) {
+  return (fqn, granted) => {
+    const entry = catalog?.entries.find((candidate) => candidate.fqn === fqn);
+    if (entry === undefined)
+      return "gone";
+    if (entry.annotations?.destructiveHint === true)
+      return "destructive";
+    return toolDefinitionFingerprint(entry) === granted ? undefined : "changed";
+  };
+}
+function renderTrustedToolLines(trusted, resolve, staleness) {
+  if (trusted === undefined || trusted.size === 0)
+    return ["No MCP tools are trusted in this session."];
+  const lines = [`Trusted MCP tools this session (${trusted.size}):`];
+  for (const [fqn, granted] of [...trusted.entries()].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) {
+    const { server } = resolve?.(fqn) ?? splitFqn(fqn);
+    const stale = staleness?.(fqn, granted);
+    const tail = stale === undefined ? TRUSTED_MARKER : `(will ask again: ${stale})`;
+    lines.push(`  ${sanitiseIdentifier(fqn)}  server: ${sanitiseIdentifier(server)}  ${tail}`);
+  }
+  return lines;
+}
+function runMcpTrustCommand(command, trusted, resolve, staleness) {
+  switch (command.kind) {
+    case "usage":
+      return [`${command.reason}. Usage: ${MCP_TRUST_USAGE}`];
+    case "list":
+      return renderTrustedToolLines(trusted, resolve, staleness);
+    case "revoke-all": {
+      const count = trusted?.size ?? 0;
+      trusted?.clear();
+      return [count === 0 ? "No MCP tools were trusted; nothing to revoke." : `Revoked trust for ${count} MCP tool(s); each asks again on its next call.`];
+    }
+    case "revoke": {
+      if (trusted?.delete(command.target) === true) {
+        return [`Revoked trust for ${sanitiseIdentifier(command.target)}; it asks again on its next call.`];
+      }
+      return [`${sanitiseIdentifier(command.target)} is not trusted in this session; nothing changed. Use the full server__tool name (see /mcp trust list).`];
+    }
+  }
+}
+var TRUSTED_MARKER = "[trusted]", FQN_SEPARATOR = "__", MAX_ARGUMENT_CHARS = 400, MAX_ARGUMENT_KEYS = 40, MAX_IDENTIFIER_CHARS = 80, APPROVAL_ALLOW_ID = "allow", MCP_TRUST_USAGE = "/mcp trust list | /mcp trust revoke <server__tool> | /mcp trust revoke all";
 var init_approval_render = __esm(() => {
   init_catalog4();
   init_config9();
@@ -87658,7 +87731,13 @@ var init_codex_cli = __esm(() => {
     /unknown option/i,
     /^\s*usage:\s*codex/i
   ];
-  AUTH_PATTERNS2 = [/\b401\b/, /unauthorized/i, /not logged/i];
+  AUTH_PATTERNS2 = [
+    /\b401\b/,
+    /unauthorized/i,
+    /not logged/i,
+    /access token could not be refreshed/i,
+    /log out and sign in again/i
+  ];
   LIMIT_PATTERNS2 = [/rate limit/i, /usage limit/i, /quota/i];
   codexCliCodec = {
     id: "codex-cli",
@@ -92116,7 +92195,7 @@ var init_help_groups = __esm(() => {
       kind: "slash",
       name: "/mcp",
       group: "External agents, ACP and MCP",
-      summary: "MCP servers keryx is connected to \u2014 status, connect/disconnect."
+      summary: "MCP servers keryx is connected to \u2014 status, connect/disconnect; /mcp trust list, /mcp trust revoke <server__tool> or all (session trust)."
     },
     {
       kind: "slash",
@@ -97789,7 +97868,7 @@ var init_agent_commands = __esm(() => {
     },
     {
       name: "/mcp",
-      description: "MCP servers keryx is connected to \u2014 status, connect/disconnect",
+      description: "MCP servers keryx is connected to \u2014 status, connect/disconnect; /mcp trust list, /mcp trust revoke <server__tool> or all",
       modes: AGENT_ONLY
     },
     {
@@ -112869,6 +112948,7 @@ function buildConsumerModel(input) {
       target: targetOf(server, home),
       credentials: credentialNames(server),
       detail,
+      ...input.trustedByServer?.get(server.name) ? { trustedTools: input.trustedByServer.get(server.name) } : {},
       action: status === "needs-approval" ? `keryx mcp trust ${server.name}` : status === "needs_auth" ? "set the variable named above, then restart the session" : undefined
     };
   });
@@ -112880,6 +112960,9 @@ function buildConsumerModel(input) {
   project: ${collapseHome2(input.projectFile, home)}`
   };
 }
+function trustedNote(row) {
+  return row.trustedTools !== undefined && row.trustedTools > 0 ? `  ${TRUSTED_MARKER} ${row.trustedTools} tool(s)` : "";
+}
 function consumerActionFor(status) {
   if (status === "connected")
     return "disconnect";
@@ -112915,7 +112998,7 @@ function formatConsumerModalRow(row, isSelected, status, width) {
     action = "";
   }
   const creds = row.credentials.length > 0 ? `  [reads ${row.credentials.join(", ")}]` : "";
-  return wrapHangingRow(`${mark} ${name} ${source} ${transport} ${glyph}`, `${tools}${action}  ${row.target}${creds}`, width).join(`
+  return wrapHangingRow(`${mark} ${name} ${source} ${transport} ${glyph}`, `${tools}${action}  ${row.target}${creds}${trustedNote(row)}`, width).join(`
 `);
 }
 function formatConsumerModalLines(model, selected, status) {
@@ -117525,6 +117608,7 @@ function createForegroundAgentIoFacade(owner, token, io) {
     permissionMode: () => accepts() ? io.permissionMode?.() ?? "ask" : "ask",
     ...io.trustedMcpTools === undefined ? {} : { trustedMcpTools: io.trustedMcpTools },
     ...io.mcpToolFingerprint === undefined ? {} : { mcpToolFingerprint: io.mcpToolFingerprint },
+    ...io.mcpToolDestructive === undefined ? {} : { mcpToolDestructive: io.mcpToolDestructive },
     readOnly: () => !accepts() || (io.readOnly?.() ?? false)
   };
 }
@@ -128462,10 +128546,11 @@ async function launchTuiAgentShell(opts) {
       }
       if (isMcpToolCall(tool)) {
         const described = describeUseToolApproval(inputJson, catalogResolver(deps.mcpRuntime?.()?.catalog()));
-        const canTrustMcp = mcpTrustOffered(meta, catalogResolver(deps.mcpRuntime?.()?.catalog())(described.fqn) !== undefined);
+        const canTrustMcp = mcpTrustOffered(meta, catalogResolver(deps.mcpRuntime?.()?.catalog())(described.fqn) !== undefined, catalogDestructiveResolver(deps.mcpRuntime?.()?.catalog())(described.fqn));
+        const trustedTag = meta?.mcpTrusted === true ? ` ${TRUSTED_MARKER}` : "";
         transcript.add(new otui.TextRenderable(r, {
           id: `ap${uid++}`,
-          content: otui.t`${roleChunk(otui, "attention", `\u2699 ${described.server} wants to run ${described.tool}`)}`
+          content: otui.t`${roleChunk(otui, "attention", `\u2699 ${described.server} wants to run ${described.tool}${trustedTag}`)}`
         }));
         for (const line of described.argumentLines) {
           transcript.add(new otui.TextRenderable(r, { id: `ap${uid++}`, content: otui.t`${dimChunk(otui, `  ${line}`)}` }));
@@ -128476,7 +128561,7 @@ async function launchTuiAgentShell(opts) {
             content: otui.t`${dimChunk(otui, `  \u2026 arguments truncated at ${MAX_ARGUMENT_CHARS} characters`)}`
           }));
         }
-        for (const notice of untrustedOriginNotices(meta)) {
+        for (const notice of [...untrustedOriginNotices(meta), ...destructiveTrustNotices(meta)]) {
           transcript.add(new otui.TextRenderable(r, { id: `ap${uid++}`, content: otui.t`${dimChunk(otui, `  ${notice}`)}` }));
         }
         chrome.hideMenu();
@@ -128499,7 +128584,7 @@ async function launchTuiAgentShell(opts) {
         setMainAgent("running", allowed ? "write" : "denied");
         transcript.add(new otui.TextRenderable(r, {
           id: `ap${uid++}`,
-          content: allowed ? otui.t`${roleChunk(otui, "ok", `\u25C7 ${described.fqn} approved`)}` : otui.t`${roleChunk(otui, "error", `\u25C7 ${described.fqn} denied`)}`
+          content: allowed ? otui.t`${roleChunk(otui, "ok", `\u25C7 ${described.fqn}${trustedTag} approved`)}` : otui.t`${roleChunk(otui, "error", `\u25C7 ${described.fqn}${trustedTag} denied`)}`
         }));
         return verdict;
       }
@@ -128702,6 +128787,7 @@ async function launchTuiAgentShell(opts) {
     io.permissionMode = () => permissionMode;
     io.trustedMcpTools = new Map;
     io.mcpToolFingerprint = (fqn) => catalogFingerprintResolver(deps.mcpRuntime?.()?.catalog())(fqn);
+    io.mcpToolDestructive = (fqn) => catalogDestructiveResolver(deps.mcpRuntime?.()?.catalog())(fqn);
     let readOnly = false;
     io.readOnly = () => readOnly;
     const paintModeRow = () => {
@@ -128710,8 +128796,8 @@ async function launchTuiAgentShell(opts) {
     };
     paintModeRow();
     io.onAutoApproved = (tool, input, meta) => {
-      const preview = tool === "shell_exec" ? parseShellExecCommand(input) : tool;
-      const label = meta.destructive ? `\u25C7 auto-approved (${permissionMode}) [destructive]` : `\u25C7 auto-approved (${permissionMode})`;
+      const preview = tool === "shell_exec" ? parseShellExecCommand(input) : isMcpToolCall(tool) ? `${tool} ${describeUseToolApproval(input, catalogResolver(deps.mcpRuntime?.()?.catalog())).fqn}` : tool;
+      const label = `\u25C7 auto-approved (${permissionMode})` + (meta.destructive ? " [destructive]" : "") + (meta.mcpTrusted === true ? ` ${TRUSTED_MARKER}` : "");
       transcript.add(new otui.TextRenderable(r, {
         id: `ap${uid++}`,
         content: otui.t`${roleChunk(otui, "attention", label)} ${dimChunk(otui, preview)}`
@@ -129082,6 +129168,7 @@ Staying in the current session.
         return false;
       }
       resetSessionSurface();
+      io.trustedMcpTools?.clear();
       liveSession = opened.handle;
       history = [];
       archive = [];
@@ -129403,13 +129490,32 @@ Staying in the current session.
       client.send(parsed.toLabel, parsed.kind === "ask" ? "question" : "notice", parsed.text).then((result) => io.onSystem?.(`bus: sent (#${result.seq}) to ${parsed.toLabel}
 `)).catch(reportRefusal);
     };
+    const runMcpTrustLine = (line) => {
+      const parsed = parseMcpTrustCommand(line);
+      if (parsed === undefined)
+        return false;
+      const catalog = deps.mcpRuntime?.()?.catalog();
+      const lines = runMcpTrustCommand(parsed, io.trustedMcpTools, catalogResolver(catalog), catalogTrustStaleness(catalog));
+      io.onSystem?.(`${lines.join(`
+`)}
+`);
+      return true;
+    };
     const showMcpConsumer = () => {
       const cwd = inspectorCwd();
       const snapshot = () => {
         const live = deps.mcpRuntime?.();
         if (live === undefined)
           return;
+        const resolve = catalogResolver(live.catalog());
+        const trustedByServer = new Map;
+        for (const fqn of io.trustedMcpTools?.keys() ?? []) {
+          const server = resolve(fqn)?.server;
+          if (server !== undefined)
+            trustedByServer.set(server, (trustedByServer.get(server) ?? 0) + 1);
+        }
         return buildConsumerModel({
+          trustedByServer,
           configured: live.configured(),
           states: live.servers(),
           problems: live.problems(),
@@ -130095,7 +130201,8 @@ Staying in the current session.
             return;
           }
           case "mcp-consumer": {
-            showMcpConsumer();
+            if (!runMcpTrustLine(line))
+              showMcpConsumer();
             return;
           }
           case "game": {
@@ -130416,7 +130523,8 @@ Staying in the current session.
           return;
         }
         if (isMcpConsumerCommand(command.name)) {
-          showMcpConsumer();
+          if (!runMcpTrustLine(line))
+            showMcpConsumer();
           return;
         }
         if (isMcpToolsCommand(command.name)) {
@@ -133265,7 +133373,7 @@ ${GUTTER}${style.dim("[y/N] ")}`);
         return meta?.fingerprint !== undefined ? { approved: true, fingerprint: meta.fingerprint } : true;
       }
       if (isMcpToolCall(tool)) {
-        return await promptUseToolApproval({ out, readLine: async () => await readLine() }, input, meta, catalogResolver(deps.mcpRuntime?.()?.catalog()), style, GUTTER);
+        return await promptUseToolApproval({ out, readLine: async () => await readLine() }, input, meta, catalogResolver(deps.mcpRuntime?.()?.catalog()), style, GUTTER, catalogDestructiveResolver(deps.mcpRuntime?.()?.catalog()));
       }
       if (tool !== "shell_exec") {
         const preview = input.length > 120 ? `${input.slice(0, 117)}\u2026` : input;
@@ -133385,14 +133493,16 @@ ${text.trim()}`;
   agentIo.permissionMode = () => permissionMode;
   agentIo.trustedMcpTools = new Map;
   agentIo.mcpToolFingerprint = (fqn) => catalogFingerprintResolver(deps.mcpRuntime?.()?.catalog())(fqn);
+  agentIo.mcpToolDestructive = (fqn) => catalogDestructiveResolver(deps.mcpRuntime?.()?.catalog())(fqn);
   let reasoningSessionOverride;
   let readOnly = false;
   agentIo.readOnly = () => readOnly;
   agentIo.onAutoApproved = (tool, input, meta) => {
     stopSpinner();
-    const preview = tool === "shell_exec" ? parseShellExecCommand(input) : tool;
+    const preview = tool === "shell_exec" ? parseShellExecCommand(input) : isMcpToolCall(tool) ? `${tool} ${describeUseToolApproval(input, catalogResolver(deps.mcpRuntime?.()?.catalog())).fqn}` : tool;
     const flag = meta.destructive ? style.yellow(" [destructive]") : "";
-    out(`${GUTTER}${style.yellow(`\u25C7 auto-approved (${permissionMode})`)}${flag} ${style.dim(preview)}
+    const trustedFlag = meta.mcpTrusted === true ? style.yellow(` ${TRUSTED_MARKER}`) : "";
+    out(`${GUTTER}${style.yellow(`\u25C7 auto-approved (${permissionMode})`)}${flag}${trustedFlag} ${style.dim(preview)}
 `);
   };
   let live;
@@ -133918,6 +134028,11 @@ ${GUTTER}${turnSeparator()}
             agentIo.onSystem?.(`Usage: /plan [on|off]
 `);
           }
+        } else if (command === "/mcp") {
+          const trust = parseMcpTrustCommand(line);
+          agentIo.onSystem?.(trust === undefined ? "The MCP server view is TUI-only here; `keryx mcp list` shows servers. Session trust: /mcp trust list | revoke <server__tool> | revoke all\n" : `${runMcpTrustCommand(trust, agentIo.trustedMcpTools, catalogResolver(deps.mcpRuntime?.()?.catalog()), catalogTrustStaleness(deps.mcpRuntime?.()?.catalog())).join(`
+`)}
+`);
         } else if (command === "/search-provider") {
           const args = parseSearchProviderArgs2(parts.slice(1));
           const all = searchProviderController.configurable();
@@ -134894,6 +135009,7 @@ var init_shell = __esm(() => {
     "/mode",
     "/reasoning",
     "/plan",
+    "/mcp",
     "/exit"
   ];
   SPINNER_FRAMES2 = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];

package/dist/core.js

@@ -38473,7 +38473,7 @@ var HELP_GROUPS = [
     kind: "slash",
     name: "/mcp",
     group: "External agents, ACP and MCP",
-    summary: "MCP servers keryx is connected to \u2014 status, connect/disconnect."
+    summary: "MCP servers keryx is connected to \u2014 status, connect/disconnect; /mcp trust list, /mcp trust revoke <server__tool> or all (session trust)."
   },
   {
     kind: "slash",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrciphersmith/keryx",
-  "version": "0.3.34",
+  "version": "0.3.36",
   "description": "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   "private": false,
   "publishConfig": {