@oh-my-tool/cli 0.2.0 → 0.3.0

package/README.md

@@ -9,5 +9,10 @@ ohmytool --help
 ```
 
 Requires Bun 1.4 or newer. Use `ohmytool search`, `ohmytool describe`, then
-`ohmytool run`; see the main [Oh My Tool repository](https://github.com/oh-my-tool/oh-my-tool)
-for configuration and extension installation guidance.
+`ohmytool run` for both native and MCP-backed tools. Configure MCP servers in
+`config.toml`; use `ohmytool mcp list` to inspect configured servers and
+`ohmytool mcp auth <server>` / `ohmytool mcp logout <server>` for interactive
+OAuth credentials. See the main
+[Oh My Tool repository](https://github.com/oh-my-tool/oh-my-tool) and
+[`docs/configuration.md`](../../docs/configuration.md) for configuration and
+secret-management guidance.

package/assets/skills/oh-my-tool/SKILL.md

@@ -5,7 +5,8 @@ description: Discover and invoke local, development, and enterprise tools throug
 
 # Oh My Tool — The Agent Tool Runtime
 
-Use the canonical `ohmytool` CLI to discover and execute tools exposed by installed native extensions.
+Use the canonical `ohmytool` CLI to discover and execute tools exposed by
+installed native extensions and enabled MCP servers.
 
 ## When to use
 
@@ -29,7 +30,8 @@ When you do not know the exact tool ID:
 ohmytool search "<what you need to do>"
 ```
 
-Search returns lightweight summary metadata and does not load handlers or access secrets.
+Search returns lightweight summary metadata. Native discovery reads manifests;
+MCP discovery connects to enabled servers and obtains `tools/list`.
 
 ### 2. Describe
 
@@ -43,7 +45,8 @@ Use the returned schema, constraints, risk level, and configuration requirements
 
 ### 3. Run
 
-Execute the selected tool through the runtime:
+Execute the selected tool through the runtime. Use the exact namespaced ID
+returned by search/describe for MCP tools:
 
 ```bash
 ohmytool run <tool-name> key=value
@@ -62,6 +65,11 @@ echo '{"connection":"iot-test","sql":"SELECT 1"}' | ohmytool run mysql.query --s
 - Do not guess tool arguments; use `ohmytool describe`.
 - Do not guess connection names, endpoints, credentials, tokens, or authentication details.
 - Never request or expose secrets managed by Oh My Tool.
+- Provider origin does not change the `search → describe → run` sequence.
+- Never place bearer tokens, OAuth tokens, authorization codes, client secrets,
+  or secret environment values in tool arguments.
+- If a command returns `MCP_AUTH_REQUIRED`, ask the user to run or approve
+  `ohmytool mcp auth <server-id>`; never collect credentials in chat.
 - Respect tool risk levels, policy restrictions, and environment restrictions.
 - Prefer the smallest and safest tool that can complete the task.
 - Treat runtime results as structured tool output and use them to continue the task.

package/package.json

@@ -1,6 +1,6 @@
-{
-  "name": "@oh-my-tool/cli",
-  "version": "0.2.0",
+{
+  "name": "@oh-my-tool/cli",
+  "version": "0.3.0",
   "type": "module",
   "description": "Oh My Tool CLI - local and enterprise tools for agents",
   "keywords": ["ai", "agent", "cli", "tools", "extensions", "bun"],
@@ -13,15 +13,17 @@
   "bugs": "https://github.com/oh-my-tool/oh-my-tool/issues",
   "bin": {
     "ohmytool": "bin/ohmytool.cjs"
-  },
-  "files": [
-    "assets",
-    "bin",
-    "src"
-  ],
+  },
+  "files": [
+    "assets",
+    "bin",
+    "src"
+  ],
   "dependencies": {
     "@clack/prompts": "^1.7.0",
-    "@oh-my-tool/sdk": "0.2.0"
+    "@modelcontextprotocol/client": "2.0.0",
+    "@oh-my-tool/sdk": "0.3.0",
+    "open": "11.0.0"
   },
   "engines": {
     "node": ">=20",

package/src/cli/commands/describe.ts

@@ -1,24 +1,25 @@
-import { createRuntime } from "../context";
-
-export interface DescribedTool {
-  name: string;
-  description: string;
-  risk: string;
-  inputSchema: Record<string, unknown> | undefined;
-  extension: string;
-  extensionVersion: string;
-}
-
+import { withRuntime } from "../context";
+
+export interface DescribedTool {
+  name: string;
+  description: string;
+  risk: string;
+  inputSchema: Record<string, unknown> | undefined;
+  extension: string;
+  extensionVersion: string;
+}
+
 export async function runDescribe(toolName: string): Promise<DescribedTool> {
-  const runtime = await createRuntime();
-  const descriptor = await runtime.describe(toolName);
-  return {
-    name: descriptor.id,
-    description: descriptor.description,
-    risk: descriptor.risk,
-    inputSchema: descriptor.inputSchema,
-    extension: descriptor.source.id,
-    extensionVersion: "unknown",
-  };
+  return withRuntime(async (runtime) => {
+    const descriptor = await runtime.describe(toolName);
+    return {
+      name: descriptor.id,
+      description: descriptor.description,
+      risk: descriptor.risk,
+      inputSchema: descriptor.inputSchema,
+      extension: descriptor.source.id,
+      extensionVersion: "unknown",
+    };
+  });
 }
-
+

package/src/cli/commands/extension.ts

@@ -1,24 +1,24 @@
-import { discoverExtensions } from "../../extension/discovery";
-import { installLocalExtension, type InstalledRef } from "../../extension/install";
-import { homeDir } from "../context";
-
-export interface InstalledInfo {
-  id: string;
-  version: string;
-  entry: string;
-  toolCount: number;
-}
-
-export async function runExtensionList(): Promise<InstalledInfo[]> {
-  return discoverExtensions(homeDir()).map((e) => ({
-    id: e.id,
-    version: e.version,
-    entry: e.entry,
-    toolCount: e.manifest.tools.length,
-  }));
-}
-
-export async function runExtensionInstall(spec: string): Promise<InstalledRef> {
-  return installLocalExtension(homeDir(), spec);
-}
-
+import { discoverExtensions } from "../../extension/discovery";
+import { installLocalExtension, type InstalledRef } from "../../extension/install";
+import { homeDir } from "../context";
+
+export interface InstalledInfo {
+  id: string;
+  version: string;
+  entry: string;
+  toolCount: number;
+}
+
+export async function runExtensionList(): Promise<InstalledInfo[]> {
+  return discoverExtensions(homeDir()).map((e) => ({
+    id: e.id,
+    version: e.version,
+    entry: e.entry,
+    toolCount: e.manifest.tools.length,
+  }));
+}
+
+export async function runExtensionInstall(spec: string): Promise<InstalledRef> {
+  return installLocalExtension(homeDir(), spec);
+}
+

package/src/cli/commands/index.ts

@@ -1,7 +1,8 @@
-export * from "./search";
-export * from "./describe";
+export * from "./search";
+export * from "./describe";
 export * from "./run";
-export * from "./extension";
-export * from "./secret";
-export * from "./integrate";
-
+export * from "./extension";
+export * from "./secret";
+export * from "./integrate";
+export * from "./mcp";
+

package/src/cli/commands/integrate.ts

@@ -1,64 +1,64 @@
-import type { AgentDetection, AgentId, IntegrationResult } from "../../integration";
-import { AGENT_IDS, createIntegrationManager } from "../../integration";
-import { homeDir } from "../context";
-import { VERSION } from "../../version";
-
-export type IntegrateAction = "install" | "status" | "repair" | "uninstall";
-
-export interface IntegrateInput {
-  action: IntegrateAction;
-  agents?: AgentId[];
-  force?: boolean;
-  dryRun?: boolean;
-}
-
-export interface IntegrateOutput {
-  action: IntegrateAction;
-  dryRun: boolean;
-  detected: AgentDetection[];
-  selected: AgentId[];
-  results: IntegrationResult[];
-}
-
-type IntegrationManager = ReturnType<typeof createIntegrationManager>;
-
-export function defaultIntegrationManager(): IntegrationManager {
-  return createIntegrationManager({ omtHome: homeDir(), skillVersion: VERSION });
-}
-
-export async function runIntegrate(
-  input: IntegrateInput,
-  manager: IntegrationManager = defaultIntegrationManager(),
-): Promise<IntegrateOutput> {
-  const detected = await manager.detect();
-  const known = new Set<AgentId>(AGENT_IDS);
-  for (const id of input.agents ?? []) {
-    if (!known.has(id)) throw new Error(`Unknown agent: ${id}`);
-  }
-  const selected = input.agents?.length ? input.agents : detected.map((agent) => agent.id);
-  const detectedIds = new Set(detected.map((agent) => agent.id));
-  for (const id of selected) {
-    if (!detectedIds.has(id)) throw new Error(`Agent is not detected: ${id}`);
-  }
-
-  if (input.dryRun) {
-    return { action: input.action, dryRun: true, detected, selected, results: [] };
-  }
-
-  let results: IntegrationResult[];
-  switch (input.action) {
-    case "install":
-      results = await manager.install(selected, { force: input.force });
-      break;
-    case "status":
-      results = (await manager.status()).filter((item) => selected.includes(item.agent));
-      break;
-    case "repair":
-      results = await manager.repair(selected);
-      break;
-    case "uninstall":
-      results = await manager.uninstall(selected);
-      break;
-  }
-  return { action: input.action, dryRun: false, detected, selected, results };
-}
+import type { AgentDetection, AgentId, IntegrationResult } from "../../integration";
+import { AGENT_IDS, createIntegrationManager } from "../../integration";
+import { homeDir } from "../context";
+import { VERSION } from "../../version";
+
+export type IntegrateAction = "install" | "status" | "repair" | "uninstall";
+
+export interface IntegrateInput {
+  action: IntegrateAction;
+  agents?: AgentId[];
+  force?: boolean;
+  dryRun?: boolean;
+}
+
+export interface IntegrateOutput {
+  action: IntegrateAction;
+  dryRun: boolean;
+  detected: AgentDetection[];
+  selected: AgentId[];
+  results: IntegrationResult[];
+}
+
+type IntegrationManager = ReturnType<typeof createIntegrationManager>;
+
+export function defaultIntegrationManager(): IntegrationManager {
+  return createIntegrationManager({ omtHome: homeDir(), skillVersion: VERSION });
+}
+
+export async function runIntegrate(
+  input: IntegrateInput,
+  manager: IntegrationManager = defaultIntegrationManager(),
+): Promise<IntegrateOutput> {
+  const detected = await manager.detect();
+  const known = new Set<AgentId>(AGENT_IDS);
+  for (const id of input.agents ?? []) {
+    if (!known.has(id)) throw new Error(`Unknown agent: ${id}`);
+  }
+  const selected = input.agents?.length ? input.agents : detected.map((agent) => agent.id);
+  const detectedIds = new Set(detected.map((agent) => agent.id));
+  for (const id of selected) {
+    if (!detectedIds.has(id)) throw new Error(`Agent is not detected: ${id}`);
+  }
+
+  if (input.dryRun) {
+    return { action: input.action, dryRun: true, detected, selected, results: [] };
+  }
+
+  let results: IntegrationResult[];
+  switch (input.action) {
+    case "install":
+      results = await manager.install(selected, { force: input.force });
+      break;
+    case "status":
+      results = (await manager.status()).filter((item) => selected.includes(item.agent));
+      break;
+    case "repair":
+      results = await manager.repair(selected);
+      break;
+    case "uninstall":
+      results = await manager.uninstall(selected);
+      break;
+  }
+  return { action: input.action, dryRun: false, detected, selected, results };
+}

package/src/cli/commands/mcp.ts

@@ -0,0 +1,86 @@
+import type { SecretStore } from "@oh-my-tool/sdk";
+import type { McpHttpServerConfig, McpServerConfig } from "../../config/config";
+import { loadConfig } from "../../config/config";
+import { prepareHome } from "../../migration";
+import { createPaths } from "../../paths";
+import { RuntimeError } from "../../runtime/errors";
+import {
+  authorizeMcpServer,
+  logoutMcpServer,
+} from "../../runtime/providers/mcp/oauth-provider";
+import { SecretsManager } from "../../secrets/secrets";
+
+export interface McpCommandDependencies {
+  readonly secrets?: SecretStore;
+  readonly authorize?: typeof authorizeMcpServer;
+  readonly logout?: typeof logoutMcpServer;
+}
+
+export interface McpServerSummary {
+  readonly id: string;
+  readonly enabled: boolean;
+  readonly transport: McpServerConfig["transport"];
+  readonly namespace: string;
+  readonly auth: "none" | "bearer" | "oauth" | "disabled";
+}
+
+export interface McpListResult {
+  readonly servers: McpServerSummary[];
+}
+
+/** List configured MCP servers without connecting to them or exposing secrets. */
+export async function runMcpList(): Promise<McpListResult> {
+  const paths = createPaths();
+  await prepareHome(paths);
+  const config = loadConfig(paths.home);
+  const servers = Object.entries(config.mcp.servers)
+    .sort(([left], [right]) => left.localeCompare(right))
+    .map(([id, server]) => ({
+      id,
+      enabled: server.enabled,
+      transport: server.transport,
+      namespace: server.namespace,
+      auth: server.transport === "disabled"
+        ? "disabled" as const
+        : server.transport === "stdio"
+          ? "none" as const
+          : server.auth.type,
+    }));
+  return { servers };
+}
+
+function oauthTarget(serverId: string, config: McpServerConfig | undefined): McpHttpServerConfig {
+  if (config === undefined || !config.enabled || config.transport !== "streamable-http" || config.auth.type !== "oauth") {
+    throw new RuntimeError("MCP_OAUTH_NOT_CONFIGURED", `MCP server '${serverId}' is not an enabled OAuth Streamable HTTP server`);
+  }
+  return config;
+}
+
+async function commandContext(serverId: string, secrets?: SecretStore): Promise<{
+  config: McpHttpServerConfig;
+  secrets: SecretStore;
+}> {
+  const paths = createPaths();
+  await prepareHome(paths);
+  const config = loadConfig(paths.home);
+  return {
+    config: oauthTarget(serverId, config.mcp.servers[serverId]),
+    secrets: secrets ?? new SecretsManager(),
+  };
+}
+
+export async function runMcpAuth(
+  serverId: string,
+  dependencies: McpCommandDependencies = {},
+): Promise<{ serverId: string; authorized: true }> {
+  const context = await commandContext(serverId, dependencies.secrets);
+  return (dependencies.authorize ?? authorizeMcpServer)(serverId, context.config, context.secrets);
+}
+
+export async function runMcpLogout(
+  serverId: string,
+  dependencies: McpCommandDependencies = {},
+): Promise<{ serverId: string; loggedOut: true }> {
+  const context = await commandContext(serverId, dependencies.secrets);
+  return (dependencies.logout ?? logoutMcpServer)(serverId, context.config, context.secrets);
+}

package/src/cli/commands/run.ts

@@ -1,5 +1,5 @@
 import { coerceInput } from "../parseArgs";
-import { createRuntime } from "../context";
+import { withRuntime } from "../context";
 import type { OmtResult } from "../../core/result";
 
 export async function runTool(
@@ -13,12 +13,13 @@ export async function runTool(
   } else {
     input = coerceInput(keyValues);
   }
-  const runtime = await createRuntime();
-  const result = await runtime.run(toolName, input);
-  if (result.ok) {
-    return { ok: true, tool: toolName, data: result.output, meta: result.meta ?? {} };
-  }
-  return { ok: false, tool: toolName, error: result.error ?? { code: "EXECUTION_FAILED", message: "execution failed" } };
+  return withRuntime(async (runtime) => {
+    const result = await runtime.run(toolName, input);
+    if (result.ok) {
+      return { ok: true, tool: toolName, data: result.output, meta: result.meta ?? {} };
+    }
+    return { ok: false, tool: toolName, error: result.error ?? { code: "EXECUTION_FAILED", message: "execution failed" } };
+  });
 }
 
 function readStdinJson(): Promise<Record<string, unknown>> {

package/src/cli/commands/search.ts

@@ -1,16 +1,17 @@
-import { createRuntime } from "../context";
+import { withRuntime } from "../context";
 
 export async function runSearch(query: string): Promise<{ tools: Array<Record<string, unknown>> }> {
-  const runtime = await createRuntime();
-  const descriptors = await runtime.search(query);
-  return {
-    tools: descriptors.map((descriptor) => ({
-      name: descriptor.id,
-      description: descriptor.description,
-      extension: descriptor.source.id,
-      risk: descriptor.risk,
-      provider: descriptor.provider,
-    })),
-  };
+  return withRuntime(async (runtime) => {
+    const descriptors = await runtime.search(query);
+    return {
+      tools: descriptors.map((descriptor) => ({
+        name: descriptor.id,
+        description: descriptor.description,
+        extension: descriptor.source.id,
+        risk: descriptor.risk,
+        provider: descriptor.provider,
+      })),
+    };
+  });
 }
-
+

package/src/cli/commands/secret.ts

@@ -1,72 +1,72 @@
-import { SecretsManager } from "../../secrets/secrets";
-import type { SecretStore } from "@oh-my-tool/sdk";
-
-export interface SecretSetResult {
-  ok: true;
-  name: string;
-}
-
-export async function runSecretSet(
-  name: string,
-  value: string,
-  store?: SecretStore,
-): Promise<SecretSetResult> {
-  const mgr = new SecretsManager(store);
-  await mgr.set(name, value);
-  return { ok: true, name };
-}
-
-export interface SecretListResult {
-  names: string[];
-  supported: boolean;
-  hint?: string;
-}
-
-/** 从 cmdkey /list 输出解析 oh-my-tool 命名空间下的 secret 名（不返回值）。 */
-export function parseSecretNamesFromCmdkey(output: string): string[] {
-  const names = new Set<string>();
-  const re = /oh-my-tool\/([A-Za-z0-9:._@-]+)/g;
-  let m: RegExpExecArray | null;
-  while ((m = re.exec(output)) !== null) {
-    names.add(m[1]);
-  }
-  return [...names].sort();
-}
-
-type CmdkeyExec = (args: string[]) => Promise<string>;
-
+import { SecretsManager } from "../../secrets/secrets";
+import type { SecretStore } from "@oh-my-tool/sdk";
+
+export interface SecretSetResult {
+  ok: true;
+  name: string;
+}
+
+export async function runSecretSet(
+  name: string,
+  value: string,
+  store?: SecretStore,
+): Promise<SecretSetResult> {
+  const mgr = new SecretsManager(store);
+  await mgr.set(name, value);
+  return { ok: true, name };
+}
+
+export interface SecretListResult {
+  names: string[];
+  supported: boolean;
+  hint?: string;
+}
+
+/** 从 cmdkey /list 输出解析 oh-my-tool 命名空间下的 secret 名（不返回值）。 */
+export function parseSecretNamesFromCmdkey(output: string): string[] {
+  const names = new Set<string>();
+  const re = /oh-my-tool\/([A-Za-z0-9:._@-]+)/g;
+  let m: RegExpExecArray | null;
+  while ((m = re.exec(output)) !== null) {
+    names.add(m[1]);
+  }
+  return [...names].sort();
+}
+
+type CmdkeyExec = (args: string[]) => Promise<string>;
+
 async function defaultCmdkeyList(): Promise<string> {
   const proc = Bun.spawn(["cmdkey", "/list"], { stdout: "pipe", stderr: "pipe" });
   const output = await Bun.readableStreamToArrayBuffer(proc.stdout);
   const out = new TextDecoder().decode(output);
-  const code = await proc.exited;
-  if (code !== 0) throw new Error(`cmdkey /list exited ${code}`);
-  return out;
-}
-
-/**
- * 列出已设置的 secret 名（只列名、不显值）。
- * Bun.secrets 无枚举 API，Windows 下通过 cmdkey 解析 oh-my-tool/ 前缀；
- * 非 Windows 不支持枚举，返回 supported=false。
- */
-export async function runSecretList(
-  exec: CmdkeyExec = defaultCmdkeyList,
-): Promise<SecretListResult> {
-  if (process.platform !== "win32") {
-    return {
-      names: [],
-      supported: false,
-      hint: "Bun.secrets 无枚举 API；secret list 仅在 Windows（通过 cmdkey）支持",
-    };
-  }
-  try {
-    const out = await exec(["cmdkey", "/list"]);
-    return { names: parseSecretNamesFromCmdkey(out), supported: true };
-  } catch (e) {
-    return {
-      names: [],
-      supported: false,
-      hint: `cmdkey 调用失败: ${e instanceof Error ? e.message : String(e)}`,
-    };
-  }
-}
+  const code = await proc.exited;
+  if (code !== 0) throw new Error(`cmdkey /list exited ${code}`);
+  return out;
+}
+
+/**
+ * 列出已设置的 secret 名（只列名、不显值）。
+ * Bun.secrets 无枚举 API，Windows 下通过 cmdkey 解析 oh-my-tool/ 前缀；
+ * 非 Windows 不支持枚举，返回 supported=false。
+ */
+export async function runSecretList(
+  exec: CmdkeyExec = defaultCmdkeyList,
+): Promise<SecretListResult> {
+  if (process.platform !== "win32") {
+    return {
+      names: [],
+      supported: false,
+      hint: "Bun.secrets 无枚举 API；secret list 仅在 Windows（通过 cmdkey）支持",
+    };
+  }
+  try {
+    const out = await exec(["cmdkey", "/list"]);
+    return { names: parseSecretNamesFromCmdkey(out), supported: true };
+  } catch (e) {
+    return {
+      names: [],
+      supported: false,
+      hint: `cmdkey 调用失败: ${e instanceof Error ? e.message : String(e)}`,
+    };
+  }
+}