@myspec/mcp-server 0.2.1-next.87 → 0.3.0-next.89

package/README.md

@@ -64,8 +64,9 @@ value, including the dot** and paste it back into the terminal. Two traps:
 without a person present (a server, a container, a CI job, a shared machine),
 use an API token instead.
 
-> Needs **`@myspec/mcp-server` 0.2.0 or newer** (`npm view @myspec/mcp-server
-> version`). Earlier builds ignore the `apiToken` field and report that they are
+> `MYSPEC_API_TOKEN` needs **`@myspec/mcp-server` 0.3.0 or newer**; the
+> `apiToken` file field needs **0.2.0 or newer** (`npm view @myspec/mcp-server
+> version`). Earlier builds ignore the setting entirely and report that they are
 > not signed in, without mentioning the version.
 
 **1. Create the token.** In the MySpec webapp, open the avatar menu → **API
@@ -73,8 +74,48 @@ tokens** → **Create token**. Choose the organization it should act in, whether
 it may write or only read, and an expiry. The token is shown **once**; it
 cannot be retrieved afterwards.
 
-**2. Configure it.** Credentials live in two files under `~/.myspec/`, both of
-which the server needs:
+**2. Configure it.** Either way works; the environment variable needs no files.
+
+#### Option A — `MYSPEC_API_TOKEN` (recommended)
+
+Put it in your MCP client's `env` block:
+
+```json
+{
+  "mcpServers": {
+    "myspec": {
+      "command": "npx",
+      "args": ["-y", "@myspec/mcp-server"],
+      "env": { "MYSPEC_API_TOKEN": "msp_pat_…" }
+    }
+  }
+}
+```
+
+or register it in one command:
+
+```bash
+claude mcp add --scope user myspec \
+  --env MYSPEC_API_TOKEN=msp_pat_… \
+  -- npx -y @myspec/mcp-server
+```
+
+Nothing else is required — no `login`, no files. **For a non-production token,
+set `MYSPEC_USER_AUTH_URL` too** (e.g. `https://dev-auth.myspec.dev`); a dev
+token against the production default fails with a bare 401 that reads like a bad
+token.
+
+The server writes `~/.myspec/settings.json` so restarts skip endpoint discovery.
+It never writes the token to disk, so unsetting the variable removes the
+credential and leaves any saved sign-in exactly as it was.
+
+> One trade-off: an environment variable is visible in process listings and is
+> inherited by child processes. On a shared machine, Option B's `0600` file is
+> the tighter choice.
+
+#### Option B — credentials files
+
+Two files under `~/.myspec/`, both of which the server needs:
 
 `~/.myspec/oauth_creds.json` — the secret, **mode 0600** (the store refuses any
 file readable by group or other):
@@ -97,8 +138,11 @@ chmod 600 ~/.myspec/oauth_creds.json
 automatically on first use, and an API-token credential needs no `user` block —
 the owner is resolved server-side at exchange.
 
-There is **no environment variable for an API token** — these files are the
-only way to configure one.
+#### Precedence
+
+`MYSPEC_API_TOKEN` > `apiToken` in `oauth_creds.json` > the refresh token saved
+by `login`. Whichever API token wins is used **exclusively**: if it is rejected
+the run fails rather than quietly falling back to another identity.
 
 **3. Verify it.** The token is exchanged for a short-lived access token on
 every run, so a token that works here works in the server:
@@ -134,12 +178,14 @@ doing so does not change the token value, so nothing needs reconfiguring.
 
 If a token does not work and you need the deployment running again now:
 
-1. **Delete the `apiToken` field** from `~/.myspec/oauth_creds.json`. Emptying
+1. **Unset `MYSPEC_API_TOKEN`** if it is set — it wins over the file, so
+   editing the file changes nothing while the variable is in place.
+2. **Delete the `apiToken` field** from `~/.myspec/oauth_creds.json`. Emptying
    it is not enough and neither is adding a refresh token alongside it: when an
    `apiToken` is present it is used exclusively, and a rejected one fails the
    run rather than falling back — silently downgrading to a different identity
    would be worse than stopping.
-2. Restore the previous credential — restore a backup of the credentials file
+3. Restore the previous credential — restore a backup of the credentials file
    if you took one, or run `login` again.
 
 Do **not** use `logout` to roll back. It deletes the whole credentials file,
@@ -212,12 +258,12 @@ npx @myspec/mcp-server reverse --root . --agent-url ws://localhost:3001/mcp/reve
 |---|---|
 | `--root <dir>` | Directory to grant read access to (default: current working directory). All tool paths resolve relative to this root; nothing outside it is reachable. |
 | `--agent-url <url>` / `MYSPEC_AI_AGENT_WS_URL` | ai-agent WebSocket URL override; skips webapp discovery entirely. |
-| `--access-token <jwt>` / `MYSPEC_ACCESS_TOKEN` | Use a static access token for local testing instead of the saved credentials. Otherwise `reverse` uses the refresh token from `npx @myspec/mcp-server login` and auto-refreshes. |
+| `--access-token <jwt>` / `MYSPEC_ACCESS_TOKEN` | Use a static access token for local testing instead of the saved credentials. It overrides `MYSPEC_API_TOKEN` too (with a warning) and cannot be refreshed. Otherwise `reverse` uses `MYSPEC_API_TOKEN`, else the saved `apiToken`, else the refresh token from `npx @myspec/mcp-server login`, and auto-refreshes. |
 
 Local state is stored under `~/.myspec/` (alongside the on-disk cache root), split into two files:
 
 - `settings.json` — non-secret config: the auth-server URL you logged in with, plus the derived webapp URL and the discovered platform / ai-agent URLs (refreshed on every successful discovery).
-- `oauth_creds.json` — the OAuth tokens (access/refresh/expiry) and your user identity, written mode `0600`.
+- `oauth_creds.json` — the OAuth tokens (access/refresh/expiry) and your user identity, written mode `0600`. A session configured through `MYSPEC_API_TOKEN` never writes this file — it writes `settings.json` only.
 
 `logout` removes `oauth_creds.json`; `settings.json` is left in place.
 
@@ -225,6 +271,7 @@ Local state is stored under `~/.myspec/` (alongside the on-disk cache root), spl
 
 | Variable | Purpose |
 |---|---|
+| `MYSPEC_API_TOKEN` | Long-lived MySpec API token (`msp_pat_…`) for unattended use. Takes precedence over anything in `~/.myspec/oauth_creds.json` and is never written to disk. Needs 0.3.0+. |
 | `MYSPEC_USER_AUTH_URL` | user-auth base URL (default `https://auth.myspec.dev`). The webapp URL is derived from it; the platform / ai-agent URLs are discovered via the webapp. |
 | `MYSPEC_DOWNLOAD_ROOT` | Absolute path used by `read_spec_file` as its on-disk cache root (default: `~/.myspec`). Tools never write outside this root. |
 | `MYSPEC_AI_AGENT_WS_URL` | ai-agent WebSocket URL for `reverse`; skips the webapp discovery call |

package/dist/index.js

@@ -11,7 +11,7 @@ import readline from "readline";
 
 // src/errors.ts
 var NeedsLoginError = class extends Error {
-  constructor(message = "Not authenticated. Run `npx @myspec/mcp-server login` to sign in.") {
+  constructor(message = "Not authenticated. Set MYSPEC_API_TOKEN to a MySpec API token, or run `npx @myspec/mcp-server login` to sign in.") {
     super(message);
     this.name = "NeedsLoginError";
   }
@@ -296,16 +296,7 @@ function createFileCredentialsStore(paths = {}) {
       };
     },
     async save(creds) {
-      await writeJsonFile(
-        settingsPath,
-        {
-          userAuthUrl: creds.userAuthUrl,
-          platformUrl: creds.platformUrl,
-          webappUrl: creds.webappUrl,
-          aiAgentMcpReverseUrl: creds.aiAgentMcpReverseUrl
-        },
-        { secret: false }
-      );
+      await writeSettingsFile(settingsPath, creds);
       await writeJsonFile(
         oauthCredsPath,
         {
@@ -326,6 +317,18 @@ function createFileCredentialsStore(paths = {}) {
     }
   };
 }
+async function writeSettingsFile(target, creds) {
+  await writeJsonFile(
+    target,
+    {
+      userAuthUrl: creds.userAuthUrl,
+      platformUrl: creds.platformUrl,
+      webappUrl: creds.webappUrl,
+      aiAgentMcpReverseUrl: creds.aiAgentMcpReverseUrl
+    },
+    { secret: false }
+  );
+}
 async function loadOauthCreds(target) {
   try {
     if (process.platform !== "win32") {
@@ -376,17 +379,133 @@ async function unlinkIfExists(target) {
     }
   }
 }
+var API_TOKEN_PREFIX = "msp_pat_";
+function isUnusableAsHeaderValue(value) {
+  for (const char of value) {
+    const code = char.codePointAt(0) ?? 0;
+    if (code <= 32 || code === 127) {
+      return true;
+    }
+  }
+  return false;
+}
+function defaultWarn(message) {
+  process.stderr.write(message + "\n");
+}
+function readEnvApiToken(userAuthUrl, env = process.env, warn = defaultWarn) {
+  const raw = env.MYSPEC_API_TOKEN;
+  if (!raw) {
+    return null;
+  }
+  const apiToken = raw.trim();
+  if (!apiToken) {
+    return null;
+  }
+  if (isUnusableAsHeaderValue(apiToken)) {
+    warn(
+      "myspec-mcp: MYSPEC_API_TOKEN contains whitespace or control characters and cannot be sent as a header \u2014 it is being ignored. Check for a line break in the value (a wrapped paste into .mcp.json is the usual cause)."
+    );
+    return null;
+  }
+  return { apiToken, userAuthUrl };
+}
+function hasEnvApiToken(env = process.env) {
+  return Boolean(env.MYSPEC_API_TOKEN);
+}
+function createEnvApiTokenStore(opts) {
+  const { fileStore, envConfig } = opts;
+  if (!envConfig) {
+    return fileStore;
+  }
+  const settingsPath = opts.settingsPath ?? defaultSettingsPath();
+  const warn = opts.warn ?? defaultWarn;
+  const warned = /* @__PURE__ */ new Set();
+  const warnOnce = (key, message) => {
+    if (warned.has(key)) {
+      return;
+    }
+    warned.add(key);
+    warn(message);
+  };
+  if (!envConfig.apiToken.startsWith(API_TOKEN_PREFIX)) {
+    warnOnce(
+      "prefix",
+      `myspec-mcp: MYSPEC_API_TOKEN does not start with \`${API_TOKEN_PREFIX}\`, so it is probably not a MySpec API token. Create one in the MySpec webapp under the avatar menu, API tokens.`
+    );
+  }
+  return {
+    // Not a filesystem path — the credential has no file. Only ever printed.
+    path: () => "MYSPEC_API_TOKEN (environment)",
+    async load() {
+      const fromFile = await fileStore.load().catch((err) => {
+        const message = err instanceof Error ? err.message : String(err);
+        warnOnce(
+          "file-unreadable",
+          `myspec-mcp: using MYSPEC_API_TOKEN; the existing credentials file could not be read (${message})`
+        );
+        return null;
+      });
+      if (fromFile && (fromFile.apiToken !== void 0 || fromFile.refreshToken !== void 0)) {
+        warnOnce(
+          "shadowed",
+          `myspec-mcp: MYSPEC_API_TOKEN is set and takes precedence over the credentials in ${fileStore.path()}.`
+        );
+      }
+      const cached = fromFile ?? await loadSettings(settingsPath).catch(() => null);
+      const sameEnvironment = cached?.userAuthUrl === envConfig.userAuthUrl;
+      return {
+        accessToken: "",
+        apiToken: envConfig.apiToken,
+        expiresAt: 0,
+        userAuthUrl: envConfig.userAuthUrl,
+        // `sameEnvironment` implies `cached` is non-null: a null cached record
+        // compares undefined against a string.
+        ...sameEnvironment && cached.platformUrl ? { platformUrl: cached.platformUrl } : {},
+        ...sameEnvironment && cached.webappUrl ? { webappUrl: cached.webappUrl } : {},
+        ...sameEnvironment && cached.aiAgentMcpReverseUrl ? { aiAgentMcpReverseUrl: cached.aiAgentMcpReverseUrl } : {}
+      };
+    },
+    async save(creds) {
+      let existing;
+      try {
+        existing = await loadSettings(settingsPath);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        warnOnce(
+          "settings-unreadable",
+          `myspec-mcp: leaving ${settingsPath} alone \u2014 it could not be read (${message}).`
+        );
+        return;
+      }
+      if (existing && existing.userAuthUrl !== envConfig.userAuthUrl) {
+        warnOnce(
+          "settings-mismatch",
+          `myspec-mcp: leaving ${settingsPath} alone \u2014 it names ${existing.userAuthUrl}, but MYSPEC_API_TOKEN is being used against ${envConfig.userAuthUrl}. Overwriting it would break the sign-in saved for that environment.`
+        );
+        return;
+      }
+      await writeSettingsFile(settingsPath, creds);
+    },
+    clear() {
+      warnOnce(
+        "clear",
+        "myspec-mcp: credentials come from MYSPEC_API_TOKEN; nothing was cleared. Unset the variable to stop using it."
+      );
+      return Promise.resolve();
+    }
+  };
+}
 function assertNoEnvAccessToken(env = process.env) {
   if (env.MYSPEC_REFRESH_TOKEN) {
     process.stderr.write(
-      "myspec-mcp: MYSPEC_REFRESH_TOKEN is set but no longer supported and is being ignored. Set an `apiToken` in ~/.myspec/oauth_creds.json, or run `npx @myspec/mcp-server login`. See docs/runbooks/mcp-api-token-migration.md\n"
+      "myspec-mcp: MYSPEC_REFRESH_TOKEN is set but no longer supported and is being ignored. Set MYSPEC_API_TOKEN to a MySpec API token instead (or an `apiToken` in ~/.myspec/oauth_creds.json), or run `npx @myspec/mcp-server login`. See docs/runbooks/mcp-api-token-migration.md\n"
     );
   }
   if (!env.MYSPEC_ACCESS_TOKEN && !env.MYSPEC_ACCESS_TOKEN_EXPIRES_AT) {
     return;
   }
   throw new ConfigError(
-    "MYSPEC_ACCESS_TOKEN / MYSPEC_ACCESS_TOKEN_EXPIRES_AT are not supported. Run `npx @myspec/mcp-server login`, or put a long-lived API token in the `apiToken` field of your credentials file, and unset these variables."
+    "MYSPEC_ACCESS_TOKEN / MYSPEC_ACCESS_TOKEN_EXPIRES_AT are not supported. Set MYSPEC_API_TOKEN to a long-lived MySpec API token instead (or put one in the `apiToken` field of your credentials file), or run `npx @myspec/mcp-server login`, and unset these variables."
   );
 }
 function parseOauthCreds(value) {
@@ -528,7 +647,7 @@ var TokenManager = class {
     }
     if (!creds.refreshToken) {
       throw new NeedsLoginError(
-        "No credential is configured. Either run `npx @myspec/mcp-server login` to sign in interactively, or add a long-lived API token to the `apiToken` field of your credentials file \u2014 create one in the MySpec webapp under the avatar menu, API tokens."
+        "No credential is configured. Either set MYSPEC_API_TOKEN to a long-lived API token (or put one in the `apiToken` field of your credentials file) \u2014 create one in the MySpec webapp under the avatar menu, API tokens \u2014 or run `npx @myspec/mcp-server login` to sign in interactively."
       );
     }
     try {
@@ -560,7 +679,7 @@ var TokenManager = class {
     if (response.status === 401 || response.status === 403) {
       const reason = response.status === 403 ? "the token owner no longer has access to its organization" : "the token is invalid, disabled, or expired";
       const rejection = new ApiTokenRejectedError(
-        `API token exchange failed: ${reason}. Create a new API token in MySpec and write it to the apiToken field of your credentials file.`
+        `API token exchange failed: ${reason}. Create a new API token in MySpec and set it as MYSPEC_API_TOKEN (or write it to the apiToken field of your credentials file).`
       );
       this.apiTokenRejection = rejection;
       throw rejection;
@@ -570,7 +689,7 @@ var TokenManager = class {
       throw new HttpStatusError(
         response.status,
         body,
-        `Token exchange failed: ${url} returned 404, so no exchange endpoint is there. This URL comes from userAuthUrl in ~/.myspec/settings.json \u2014 check it names the environment the token was created in, and rewrite it with \`npx @myspec/mcp-server login --user-auth-url <url>\`. Note that --user-auth-url and MYSPEC_USER_AUTH_URL do not redirect the exchange on their own, and userAuthUrl in oauth_creds.json is ignored entirely.`
+        `Token exchange failed: ${url} returned 404, so no exchange endpoint is there. Check that URL names the environment the token was created in. With MYSPEC_API_TOKEN it comes from MYSPEC_USER_AUTH_URL (or --user-auth-url), defaulting to https://auth.myspec.dev. Otherwise it comes from userAuthUrl in ~/.myspec/settings.json, which only \`npx @myspec/mcp-server login --user-auth-url <url>\` rewrites \u2014 the flag and the variable do not redirect a file-configured exchange on their own, and userAuthUrl in oauth_creds.json is ignored entirely.`
       );
     }
     if (!response.ok) {
@@ -920,6 +1039,11 @@ async function runLogin(options, deps = {}) {
   const log = deps.log ?? ((message) => {
     process.stderr.write(message + "\n");
   });
+  if (hasEnvApiToken(deps.env)) {
+    log(
+      "myspec-mcp: MYSPEC_API_TOKEN is set and takes precedence \u2014 this login will not take effect until you unset it."
+    );
+  }
   const openBrowser = async (url) => {
     const mod = await import("open");
     await mod.default(url);
@@ -1059,11 +1183,15 @@ async function discoverAfterLogin(credentials, webappUrl, discover = discoverCon
 }
 
 // src/cli/logout.ts
-async function runLogout() {
+var ENV_TOKEN_STILL_SET = "MYSPEC_API_TOKEN is still set in this environment and will keep being used \u2014 remove it from your MCP client config (or shell) to stop.\n";
+async function runLogout(env = process.env) {
   const store = createFileCredentialsStore();
+  const usingEnvToken = hasEnvApiToken(env);
   const existing = await store.load();
   if (!existing) {
-    process.stderr.write("No credentials to clear.\n");
+    process.stderr.write(
+      usingEnvToken ? `No credentials file to clear. ${ENV_TOKEN_STILL_SET}` : "No credentials to clear.\n"
+    );
     return;
   }
   const config = resolveConfig({ storedUserAuthUrl: existing.userAuthUrl });
@@ -1097,10 +1225,16 @@ async function runLogout() {
     process.stderr.write(
       "Signed out. The configured API token was kept \u2014 delete the `apiToken` field in ~/.myspec/oauth_creds.json to remove it.\n"
     );
+    if (usingEnvToken) {
+      process.stderr.write(ENV_TOKEN_STILL_SET);
+    }
     return;
   }
   await store.clear();
   process.stderr.write("Signed out and cleared local credentials.\n");
+  if (usingEnvToken) {
+    process.stderr.write(ENV_TOKEN_STILL_SET);
+  }
 }
 
 // src/platform/client.ts
@@ -5155,10 +5289,11 @@ function printHelp() {
     "                          The agent WebSocket URL is discovered from the webapp",
     "                          (GET /api/v1/config) using your saved credentials;",
     "                          override with --agent-url <url> or MYSPEC_AI_AGENT_WS_URL.",
-    "                          Uses the apiToken from ~/.myspec/oauth_creds.json if one",
-    "                          is set, otherwise the refresh_token saved by `login`, to",
-    "                          obtain & auto-refresh access tokens. Override with",
-    "                          --access-token <jwt> or MYSPEC_ACCESS_TOKEN for local testing.",
+    "                          Uses MYSPEC_API_TOKEN if set, else the apiToken from",
+    "                          ~/.myspec/oauth_creds.json, else the refresh_token saved",
+    "                          by `login`, to obtain & auto-refresh access tokens.",
+    "                          Override with --access-token <jwt> or MYSPEC_ACCESS_TOKEN",
+    "                          for local testing.",
     "  --version               Print version",
     "  --help                  Print this help",
     "",
@@ -5170,6 +5305,11 @@ function printHelp() {
     "                          via the webapp and saved to ~/.myspec/settings.json.",
     "",
     "Environment:",
+    "  MYSPEC_API_TOKEN        Long-lived MySpec API token (msp_pat_...). Set it in your",
+    "                          MCP client's `env` block to configure the server with no",
+    "                          credential files. Takes precedence over anything saved by",
+    "                          `login`; create one in the webapp under avatar menu > API",
+    "                          tokens.",
     "  MYSPEC_USER_AUTH_URL    user-auth base URL (default https://auth.myspec.dev)",
     "  MYSPEC_AI_AGENT_WS_URL  ai-agent WebSocket URL for `reverse` (skips discovery)"
   ];
@@ -5236,7 +5376,11 @@ async function resolveReverseAgentUrl(sources) {
     return { agentUrl: explicitAgentUrl };
   }
   const stored = await sources.loadStored().catch(() => null);
-  const config = resolveConfig({ env, storedUserAuthUrl: stored?.userAuthUrl });
+  const config = resolveConfig({
+    env,
+    cliUserAuthUrl: sources.cliUserAuthUrl,
+    storedUserAuthUrl: stored?.userAuthUrl
+  });
   const endpoint = configEndpoint(config.webappUrl);
   try {
     const discovered = await sources.discover(config.webappUrl);
@@ -5263,9 +5407,41 @@ async function resolveReverseAgentUrl(sources) {
     throw err;
   }
 }
+async function buildCredentialsStore(opts = {}) {
+  const env = opts.env ?? process.env;
+  const fileStore = opts.fileStore ?? createFileCredentialsStore();
+  const usingEnvApiToken = hasEnvApiToken(env);
+  const tolerate = opts.toleratesUnreadableFile ?? usingEnvApiToken;
+  const stored = tolerate ? await fileStore.load().catch(() => null) : await fileStore.load();
+  const config = resolveConfig({
+    env,
+    cliUserAuthUrl: opts.cliUserAuthUrl,
+    storedUserAuthUrl: stored?.userAuthUrl
+  });
+  return {
+    store: createEnvApiTokenStore({
+      fileStore,
+      envConfig: readEnvApiToken(config.userAuthUrl, env)
+    }),
+    config,
+    usingEnvApiToken
+  };
+}
+function warnIfStaticTokenShadowsApiToken(inlineToken, env = process.env, warn = (message) => {
+  process.stderr.write(message + "\n");
+}) {
+  if (!inlineToken || !hasEnvApiToken(env)) {
+    return;
+  }
+  warn(
+    "myspec-mcp reverse: MYSPEC_ACCESS_TOKEN (or --access-token) overrides MYSPEC_API_TOKEN; using the static access token, which cannot be refreshed."
+  );
+}
 async function runReverseCommand(flags) {
   const root = flagString(flags, "root") ?? process.cwd();
+  const cliUserAuthUrl = flagString(flags, "user-auth-url");
   const inlineToken = flagString(flags, "access-token") ?? process.env.MYSPEC_ACCESS_TOKEN;
+  warnIfStaticTokenShadowsApiToken(inlineToken);
   let getAccessToken;
   let onAuthFailed;
   let forceRefresh;
@@ -5280,7 +5456,11 @@ async function runReverseCommand(flags) {
     persist = void 0;
   } else {
     assertNoEnvAccessToken();
-    const store = createFileCredentialsStore();
+    const built = await buildCredentialsStore({
+      cliUserAuthUrl,
+      toleratesUnreadableFile: true
+    });
+    const store = built.store;
     const tokenManager = new TokenManager({ store });
     getAccessToken = () => tokenManager.getValidAccessToken();
     onAuthFailed = async () => {
@@ -5292,6 +5472,10 @@ async function runReverseCommand(flags) {
   }
   const resolved = await resolveReverseAgentUrl({
     flagAgentUrl: flagString(flags, "agent-url"),
+    // Passed through so --user-auth-url means the same thing on both paths.
+    // buildCredentialsStore validates it above; without this, discovery would
+    // keep using settings.json and the flag would be validated but ignored.
+    cliUserAuthUrl,
     loadStored,
     persist,
     discover: (webappUrl) => {
@@ -5349,17 +5533,15 @@ function createPlatformUrlResolver(deps) {
 }
 async function runServe(flags) {
   assertNoEnvAccessToken();
-  const store = createFileCredentialsStore();
+  const { store, config } = await buildCredentialsStore({
+    cliUserAuthUrl: flagString(flags, "user-auth-url")
+  });
   const initial = await store.load();
   if (!initial) {
     process.stderr.write(
-      "myspec-mcp: starting unauthenticated. Run `npx @myspec/mcp-server login`, or configure an API token, to enable tools.\n"
+      "myspec-mcp: starting unauthenticated. Set MYSPEC_API_TOKEN to a MySpec API token, or run `npx @myspec/mcp-server login`, to enable tools.\n"
     );
   }
-  const config = resolveConfig({
-    cliUserAuthUrl: flagString(flags, "user-auth-url"),
-    storedUserAuthUrl: initial?.userAuthUrl
-  });
   const tokenManager = new TokenManager({ store });
   const client = new PlatformClient({
     resolveBaseUrl: createPlatformUrlResolver({
@@ -5395,14 +5577,16 @@ if (isCliEntry()) {
       process.exit(2);
     }
     const message = err instanceof Error ? err.stack ?? err.message : String(err);
-    process.stderr.write(message + "\n");
+    process.stderr.write(redactSensitive(message) + "\n");
     process.exit(1);
   });
 }
 export {
   REVERSE_DISCOVERY_HINT,
+  buildCredentialsStore,
   createPlatformUrlResolver,
   main,
   resolveReverseAgentUrl,
-  runServe
+  runServe,
+  warnIfStaticTokenShadowsApiToken
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@myspec/mcp-server",
-  "version": "0.2.1-next.87",
+  "version": "0.3.0-next.89",
   "description": "MySpec MCP server — exposes MySpec platform projects, files and attachments to MCP-aware clients via OAuth-authenticated access tokens.",
   "type": "module",
   "repository": {