@oh-my-tool/cli 0.2.0 → 0.3.1

package/README.md

@@ -9,5 +9,10 @@ ohmytool --help
 ```
 
 Requires Bun 1.4 or newer. Use `ohmytool search`, `ohmytool describe`, then
-`ohmytool run`; see the main [Oh My Tool repository](https://github.com/oh-my-tool/oh-my-tool)
-for configuration and extension installation guidance.
+`ohmytool run` for both native and MCP-backed tools. Configure MCP servers in
+`config.toml`; use `ohmytool mcp list` to inspect configured servers and
+`ohmytool mcp auth <server>` / `ohmytool mcp logout <server>` for interactive
+OAuth credentials. See the main
+[Oh My Tool repository](https://github.com/oh-my-tool/oh-my-tool) and
+[`docs/configuration.md`](../../docs/configuration.md) for configuration and
+secret-management guidance.

package/assets/skills/oh-my-tool/SKILL.md

@@ -5,7 +5,8 @@ description: Discover and invoke local, development, and enterprise tools throug
 
 # Oh My Tool — The Agent Tool Runtime
 
-Use the canonical `ohmytool` CLI to discover and execute tools exposed by installed native extensions.
+Use the canonical `ohmytool` CLI to discover and execute tools exposed by
+installed native extensions and enabled MCP servers.
 
 ## When to use
 
@@ -29,7 +30,8 @@ When you do not know the exact tool ID:
 ohmytool search "<what you need to do>"
 ```
 
-Search returns lightweight summary metadata and does not load handlers or access secrets.
+Search returns lightweight summary metadata. Native discovery reads manifests;
+MCP discovery connects to enabled servers and obtains `tools/list`.
 
 ### 2. Describe
 
@@ -43,7 +45,8 @@ Use the returned schema, constraints, risk level, and configuration requirements
 
 ### 3. Run
 
-Execute the selected tool through the runtime:
+Execute the selected tool through the runtime. Use the exact namespaced ID
+returned by search/describe for MCP tools:
 
 ```bash
 ohmytool run <tool-name> key=value
@@ -62,6 +65,11 @@ echo '{"connection":"iot-test","sql":"SELECT 1"}' | ohmytool run mysql.query --s
 - Do not guess tool arguments; use `ohmytool describe`.
 - Do not guess connection names, endpoints, credentials, tokens, or authentication details.
 - Never request or expose secrets managed by Oh My Tool.
+- Provider origin does not change the `search → describe → run` sequence.
+- Never place bearer tokens, OAuth tokens, authorization codes, client secrets,
+  or secret environment values in tool arguments.
+- If a command returns `MCP_AUTH_REQUIRED`, ask the user to run or approve
+  `ohmytool mcp auth <server-id>`; never collect credentials in chat.
 - Respect tool risk levels, policy restrictions, and environment restrictions.
 - Prefer the smallest and safest tool that can complete the task.
 - Treat runtime results as structured tool output and use them to continue the task.

package/package.json

@@ -1,9 +1,16 @@
-{
-  "name": "@oh-my-tool/cli",
-  "version": "0.2.0",
+{
+  "name": "@oh-my-tool/cli",
+  "version": "0.3.1",
   "type": "module",
   "description": "Oh My Tool CLI - local and enterprise tools for agents",
-  "keywords": ["ai", "agent", "cli", "tools", "extensions", "bun"],
+  "keywords": [
+    "ai",
+    "agent",
+    "cli",
+    "tools",
+    "extensions",
+    "bun"
+  ],
   "homepage": "https://github.com/oh-my-tool/oh-my-tool#readme",
   "repository": {
     "type": "git",
@@ -13,15 +20,17 @@
   "bugs": "https://github.com/oh-my-tool/oh-my-tool/issues",
   "bin": {
     "ohmytool": "bin/ohmytool.cjs"
-  },
-  "files": [
-    "assets",
-    "bin",
-    "src"
-  ],
+  },
+  "files": [
+    "assets",
+    "bin",
+    "src"
+  ],
   "dependencies": {
     "@clack/prompts": "^1.7.0",
-    "@oh-my-tool/sdk": "0.2.0"
+    "@modelcontextprotocol/client": "2.0.0",
+    "@oh-my-tool/sdk": "0.3.1",
+    "open": "11.0.0"
   },
   "engines": {
     "node": ">=20",

package/src/cli/commands/connections.ts

@@ -0,0 +1,98 @@
+import { loadConfig } from "../../config/config";
+import { createPaths } from "../../paths";
+import { prepareHome } from "../../migration";
+import { withRuntime } from "../context";
+
+export interface ConnectionSummary {
+  extension: string;
+  name: string;
+  environment: string;
+  host: string;
+  port: number;
+  database: string;
+  username: string;
+  tls: boolean;
+  secretConfigured: boolean;
+}
+
+export interface ConnectionListResult {
+  connections: ConnectionSummary[];
+  count: number;
+}
+
+export interface ConnectionCheck {
+  extension: string;
+  name: string;
+  status: "ok" | "error" | "unsupported";
+  code?: string;
+  durationMs?: number;
+}
+
+export interface ConnectionCheckResult {
+  checks: ConnectionCheck[];
+  count: number;
+}
+
+export interface ConfigCheckResult {
+  valid: true;
+  connectionCount: number;
+  extensionCount: number;
+}
+
+async function configuredConnections(): Promise<ConnectionListResult> {
+  const paths = createPaths();
+  await prepareHome(paths);
+  const config = loadConfig(paths.home);
+  const connections = Object.entries(config.extensions)
+    .sort(([left], [right]) => left.localeCompare(right))
+    .flatMap(([extension, value]) => Object.entries(value.connections)
+      .sort(([left], [right]) => left.localeCompare(right))
+      .map(([name, connection]) => ({
+        extension,
+        name,
+        environment: connection.environment,
+        host: connection.host,
+        port: connection.port,
+        database: connection.database,
+        username: connection.username,
+        tls: connection.tls,
+        secretConfigured: connection.secret.length > 0,
+      })));
+  return { connections, count: connections.length };
+}
+
+export async function runConnectionList(): Promise<ConnectionListResult> {
+  return configuredConnections();
+}
+
+export async function runConfigCheck(): Promise<ConfigCheckResult> {
+  const paths = createPaths();
+  await prepareHome(paths);
+  const config = loadConfig(paths.home);
+  return {
+    valid: true,
+    connectionCount: Object.values(config.extensions).reduce((count, extension) => count + Object.keys(extension.connections).length, 0),
+    extensionCount: Object.keys(config.extensions).length,
+  };
+}
+
+export async function runConnectionCheck(): Promise<ConnectionCheckResult> {
+  const list = await configuredConnections();
+  return withRuntime(async (runtime) => {
+    const checks: ConnectionCheck[] = [];
+    for (const connection of list.connections) {
+      if (connection.extension !== "redis" && connection.extension !== "mysql") {
+        checks.push({ extension: connection.extension, name: connection.name, status: "unsupported", code: "CHECK_UNSUPPORTED" });
+        continue;
+      }
+      const started = Date.now();
+      const result = await runtime.run(`${connection.extension}.ping`, { connection: connection.name });
+      checks.push(result.ok
+        ? { extension: connection.extension, name: connection.name, status: "ok", durationMs: Date.now() - started }
+        : result.error?.code === "TOOL_NOT_FOUND"
+          ? { extension: connection.extension, name: connection.name, status: "unsupported", code: "CHECK_UNSUPPORTED", durationMs: Date.now() - started }
+          : { extension: connection.extension, name: connection.name, status: "error", code: result.error?.code ?? "CHECK_FAILED", durationMs: Date.now() - started });
+    }
+    return { checks, count: checks.length };
+  }, { includeMcp: false });
+}

package/src/cli/commands/describe.ts

@@ -1,24 +1,25 @@
-import { createRuntime } from "../context";
-
-export interface DescribedTool {
-  name: string;
-  description: string;
-  risk: string;
-  inputSchema: Record<string, unknown> | undefined;
-  extension: string;
-  extensionVersion: string;
-}
-
+import { withRuntime } from "../context";
+
+export interface DescribedTool {
+  name: string;
+  description: string;
+  risk: string;
+  inputSchema: Record<string, unknown> | undefined;
+  extension: string;
+  extensionVersion: string;
+}
+
 export async function runDescribe(toolName: string): Promise<DescribedTool> {
-  const runtime = await createRuntime();
-  const descriptor = await runtime.describe(toolName);
-  return {
-    name: descriptor.id,
-    description: descriptor.description,
-    risk: descriptor.risk,
-    inputSchema: descriptor.inputSchema,
-    extension: descriptor.source.id,
-    extensionVersion: "unknown",
-  };
+  return withRuntime(async (runtime) => {
+    const descriptor = await runtime.describe(toolName);
+    return {
+      name: descriptor.id,
+      description: descriptor.description,
+      risk: descriptor.risk,
+      inputSchema: descriptor.inputSchema,
+      extension: descriptor.source.id,
+      extensionVersion: descriptor.source.version ?? "unknown",
+    };
+  });
 }
-
+

package/src/cli/commands/extension.ts

@@ -1,24 +1,24 @@
-import { discoverExtensions } from "../../extension/discovery";
-import { installLocalExtension, type InstalledRef } from "../../extension/install";
-import { homeDir } from "../context";
-
-export interface InstalledInfo {
-  id: string;
-  version: string;
-  entry: string;
-  toolCount: number;
-}
-
-export async function runExtensionList(): Promise<InstalledInfo[]> {
-  return discoverExtensions(homeDir()).map((e) => ({
-    id: e.id,
-    version: e.version,
-    entry: e.entry,
-    toolCount: e.manifest.tools.length,
-  }));
-}
-
-export async function runExtensionInstall(spec: string): Promise<InstalledRef> {
-  return installLocalExtension(homeDir(), spec);
-}
-
+import { discoverExtensions } from "../../extension/discovery";
+import { installLocalExtension, type InstalledRef } from "../../extension/install";
+import { homeDir } from "../context";
+
+export interface InstalledInfo {
+  id: string;
+  version: string;
+  entry: string;
+  toolCount: number;
+}
+
+export async function runExtensionList(): Promise<InstalledInfo[]> {
+  return discoverExtensions(homeDir()).map((e) => ({
+    id: e.id,
+    version: e.version,
+    entry: e.entry,
+    toolCount: e.manifest.tools.length,
+  }));
+}
+
+export async function runExtensionInstall(spec: string): Promise<InstalledRef> {
+  return installLocalExtension(homeDir(), spec);
+}
+

package/src/cli/commands/index.ts

@@ -1,7 +1,9 @@
-export * from "./search";
-export * from "./describe";
+export * from "./search";
+export * from "./describe";
 export * from "./run";
-export * from "./extension";
-export * from "./secret";
-export * from "./integrate";
-
+export * from "./extension";
+export * from "./secret";
+export * from "./integrate";
+export * from "./mcp";
+export * from "./connections";
+

package/src/cli/commands/integrate.ts

@@ -1,64 +1,64 @@
-import type { AgentDetection, AgentId, IntegrationResult } from "../../integration";
-import { AGENT_IDS, createIntegrationManager } from "../../integration";
-import { homeDir } from "../context";
-import { VERSION } from "../../version";
-
-export type IntegrateAction = "install" | "status" | "repair" | "uninstall";
-
-export interface IntegrateInput {
-  action: IntegrateAction;
-  agents?: AgentId[];
-  force?: boolean;
-  dryRun?: boolean;
-}
-
-export interface IntegrateOutput {
-  action: IntegrateAction;
-  dryRun: boolean;
-  detected: AgentDetection[];
-  selected: AgentId[];
-  results: IntegrationResult[];
-}
-
-type IntegrationManager = ReturnType<typeof createIntegrationManager>;
-
-export function defaultIntegrationManager(): IntegrationManager {
-  return createIntegrationManager({ omtHome: homeDir(), skillVersion: VERSION });
-}
-
-export async function runIntegrate(
-  input: IntegrateInput,
-  manager: IntegrationManager = defaultIntegrationManager(),
-): Promise<IntegrateOutput> {
-  const detected = await manager.detect();
-  const known = new Set<AgentId>(AGENT_IDS);
-  for (const id of input.agents ?? []) {
-    if (!known.has(id)) throw new Error(`Unknown agent: ${id}`);
-  }
-  const selected = input.agents?.length ? input.agents : detected.map((agent) => agent.id);
-  const detectedIds = new Set(detected.map((agent) => agent.id));
-  for (const id of selected) {
-    if (!detectedIds.has(id)) throw new Error(`Agent is not detected: ${id}`);
-  }
-
-  if (input.dryRun) {
-    return { action: input.action, dryRun: true, detected, selected, results: [] };
-  }
-
-  let results: IntegrationResult[];
-  switch (input.action) {
-    case "install":
-      results = await manager.install(selected, { force: input.force });
-      break;
-    case "status":
-      results = (await manager.status()).filter((item) => selected.includes(item.agent));
-      break;
-    case "repair":
-      results = await manager.repair(selected);
-      break;
-    case "uninstall":
-      results = await manager.uninstall(selected);
-      break;
-  }
-  return { action: input.action, dryRun: false, detected, selected, results };
-}
+import type { AgentDetection, AgentId, IntegrationResult } from "../../integration";
+import { AGENT_IDS, createIntegrationManager } from "../../integration";
+import { homeDir } from "../context";
+import { VERSION } from "../../version";
+
+export type IntegrateAction = "install" | "status" | "repair" | "uninstall";
+
+export interface IntegrateInput {
+  action: IntegrateAction;
+  agents?: AgentId[];
+  force?: boolean;
+  dryRun?: boolean;
+}
+
+export interface IntegrateOutput {
+  action: IntegrateAction;
+  dryRun: boolean;
+  detected: AgentDetection[];
+  selected: AgentId[];
+  results: IntegrationResult[];
+}
+
+type IntegrationManager = ReturnType<typeof createIntegrationManager>;
+
+export function defaultIntegrationManager(): IntegrationManager {
+  return createIntegrationManager({ omtHome: homeDir(), skillVersion: VERSION });
+}
+
+export async function runIntegrate(
+  input: IntegrateInput,
+  manager: IntegrationManager = defaultIntegrationManager(),
+): Promise<IntegrateOutput> {
+  const detected = await manager.detect();
+  const known = new Set<AgentId>(AGENT_IDS);
+  for (const id of input.agents ?? []) {
+    if (!known.has(id)) throw new Error(`Unknown agent: ${id}`);
+  }
+  const selected = input.agents?.length ? input.agents : detected.map((agent) => agent.id);
+  const detectedIds = new Set(detected.map((agent) => agent.id));
+  for (const id of selected) {
+    if (!detectedIds.has(id)) throw new Error(`Agent is not detected: ${id}`);
+  }
+
+  if (input.dryRun) {
+    return { action: input.action, dryRun: true, detected, selected, results: [] };
+  }
+
+  let results: IntegrationResult[];
+  switch (input.action) {
+    case "install":
+      results = await manager.install(selected, { force: input.force });
+      break;
+    case "status":
+      results = (await manager.status()).filter((item) => selected.includes(item.agent));
+      break;
+    case "repair":
+      results = await manager.repair(selected);
+      break;
+    case "uninstall":
+      results = await manager.uninstall(selected);
+      break;
+  }
+  return { action: input.action, dryRun: false, detected, selected, results };
+}

package/src/cli/commands/mcp.ts

@@ -0,0 +1,86 @@
+import type { SecretStore } from "@oh-my-tool/sdk";
+import type { McpHttpServerConfig, McpServerConfig } from "../../config/config";
+import { loadConfig } from "../../config/config";
+import { prepareHome } from "../../migration";
+import { createPaths } from "../../paths";
+import { RuntimeError } from "../../runtime/errors";
+import {
+  authorizeMcpServer,
+  logoutMcpServer,
+} from "../../runtime/providers/mcp/oauth-provider";
+import { SecretsManager } from "../../secrets/secrets";
+
+export interface McpCommandDependencies {
+  readonly secrets?: SecretStore;
+  readonly authorize?: typeof authorizeMcpServer;
+  readonly logout?: typeof logoutMcpServer;
+}
+
+export interface McpServerSummary {
+  readonly id: string;
+  readonly enabled: boolean;
+  readonly transport: McpServerConfig["transport"];
+  readonly namespace: string;
+  readonly auth: "none" | "bearer" | "oauth" | "disabled";
+}
+
+export interface McpListResult {
+  readonly servers: McpServerSummary[];
+}
+
+/** List configured MCP servers without connecting to them or exposing secrets. */
+export async function runMcpList(): Promise<McpListResult> {
+  const paths = createPaths();
+  await prepareHome(paths);
+  const config = loadConfig(paths.home);
+  const servers = Object.entries(config.mcp.servers)
+    .sort(([left], [right]) => left.localeCompare(right))
+    .map(([id, server]) => ({
+      id,
+      enabled: server.enabled,
+      transport: server.transport,
+      namespace: server.namespace,
+      auth: server.transport === "disabled"
+        ? "disabled" as const
+        : server.transport === "stdio"
+          ? "none" as const
+          : server.auth.type,
+    }));
+  return { servers };
+}
+
+function oauthTarget(serverId: string, config: McpServerConfig | undefined): McpHttpServerConfig {
+  if (config === undefined || !config.enabled || config.transport !== "streamable-http" || config.auth.type !== "oauth") {
+    throw new RuntimeError("MCP_OAUTH_NOT_CONFIGURED", `MCP server '${serverId}' is not an enabled OAuth Streamable HTTP server`);
+  }
+  return config;
+}
+
+async function commandContext(serverId: string, secrets?: SecretStore): Promise<{
+  config: McpHttpServerConfig;
+  secrets: SecretStore;
+}> {
+  const paths = createPaths();
+  await prepareHome(paths);
+  const config = loadConfig(paths.home);
+  return {
+    config: oauthTarget(serverId, config.mcp.servers[serverId]),
+    secrets: secrets ?? new SecretsManager(),
+  };
+}
+
+export async function runMcpAuth(
+  serverId: string,
+  dependencies: McpCommandDependencies = {},
+): Promise<{ serverId: string; authorized: true }> {
+  const context = await commandContext(serverId, dependencies.secrets);
+  return (dependencies.authorize ?? authorizeMcpServer)(serverId, context.config, context.secrets);
+}
+
+export async function runMcpLogout(
+  serverId: string,
+  dependencies: McpCommandDependencies = {},
+): Promise<{ serverId: string; loggedOut: true }> {
+  const context = await commandContext(serverId, dependencies.secrets);
+  return (dependencies.logout ?? logoutMcpServer)(serverId, context.config, context.secrets);
+}

package/src/cli/commands/run.ts

@@ -1,5 +1,5 @@
 import { coerceInput } from "../parseArgs";
-import { createRuntime } from "../context";
+import { withRuntime } from "../context";
 import type { OmtResult } from "../../core/result";
 
 export async function runTool(
@@ -13,12 +13,13 @@ export async function runTool(
   } else {
     input = coerceInput(keyValues);
   }
-  const runtime = await createRuntime();
-  const result = await runtime.run(toolName, input);
-  if (result.ok) {
-    return { ok: true, tool: toolName, data: result.output, meta: result.meta ?? {} };
-  }
-  return { ok: false, tool: toolName, error: result.error ?? { code: "EXECUTION_FAILED", message: "execution failed" } };
+  return withRuntime(async (runtime) => {
+    const result = await runtime.run(toolName, input);
+    if (result.ok) {
+      return { ok: true, tool: toolName, data: result.output, meta: result.meta ?? {} };
+    }
+    return { ok: false, tool: toolName, error: result.error ?? { code: "EXECUTION_FAILED", message: "execution failed" } };
+  }, { targetTool: toolName });
 }
 
 function readStdinJson(): Promise<Record<string, unknown>> {
@@ -29,7 +30,12 @@ function readStdinJson(): Promise<Record<string, unknown>> {
     stdin.on("data", (chunk: string) => (data += chunk));
     stdin.on("end", () => {
       try {
-        resolve(JSON.parse(data));
+        const parsed: unknown = JSON.parse(data);
+        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+          reject(new Error("stdin JSON must be an object"));
+          return;
+        }
+        resolve(parsed as Record<string, unknown>);
       } catch (e) {
         reject(e);
       }

package/src/cli/commands/search.ts

@@ -1,16 +1,17 @@
-import { createRuntime } from "../context";
+import { withRuntime } from "../context";
 
 export async function runSearch(query: string): Promise<{ tools: Array<Record<string, unknown>> }> {
-  const runtime = await createRuntime();
-  const descriptors = await runtime.search(query);
-  return {
-    tools: descriptors.map((descriptor) => ({
-      name: descriptor.id,
-      description: descriptor.description,
-      extension: descriptor.source.id,
-      risk: descriptor.risk,
-      provider: descriptor.provider,
-    })),
-  };
+  return withRuntime(async (runtime) => {
+    const descriptors = await runtime.search(query);
+    return {
+      tools: descriptors.map((descriptor) => ({
+        name: descriptor.id,
+        description: descriptor.description,
+        extension: descriptor.source.id,
+        risk: descriptor.risk,
+        provider: descriptor.provider,
+      })),
+    };
+  });
 }
-
+