@seekrit/cli 0.2.0 → 0.4.0

package/dist/index.js

@@ -315,7 +315,7 @@ async function unwrapDek(wrapped, privateKey) {
 }
 //#endregion
 //#region package.json
-var version = "0.2.0";
+var version = "0.4.0";
 const PROJECT_FILE = "seekrit.json";
 function globalConfigPath() {
 	return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "seekrit", "config.json");
@@ -518,7 +518,17 @@ var SeekritClient = class {
 };
 //#endregion
 //#region src/io.ts
+let failThrows = false;
+/**
+* In `seekrit mcp` the process is a long-lived stdio server, so a `fail()`
+* must surface as a catchable error (→ a tool error result) rather than
+* exiting and killing every other tool. Toggled on once at MCP startup.
+*/
+function setFailThrows(value) {
+	failThrows = value;
+}
 function fail(message) {
+	if (failThrows) throw new Error(message);
 	console.error(`error: ${message}`);
 	process.exit(1);
 }
@@ -553,12 +563,19 @@ async function readStdin() {
 * Build the client context from configured credentials, or return null when
 * none are set. `seekrit run` uses this to degrade to a plain launcher instead
 * of exiting; every other command goes through `buildContext`, which fails.
+*
+* `dotenvVars` supplies `SEEKRIT_*` values read from a `.env` file. They sit
+* below the live `process.env` but above the saved config, so a project-local
+* `.env` can carry the token / API URL — matching `seekrit-run`'s
+* `flag > env > .env` credential resolution. Empty for every command but
+* `seekrit run`, which loads `.env` before authenticating.
 */
-function tryBuildContext() {
+function tryBuildContext(dotenvVars = {}) {
 	const config = readGlobalConfig();
-	const apiUrl = process.env.SEEKRIT_API_URL ?? config.apiUrl ?? "http://localhost:8787";
-	const token = process.env.SEEKRIT_TOKEN ?? config.token;
-	const devUser = process.env.SEEKRIT_DEV_USER ?? config.devUser;
+	const fromEnv = (key) => process.env[key] ?? dotenvVars[key];
+	const apiUrl = fromEnv("SEEKRIT_API_URL") ?? config.apiUrl ?? "https://api.seekrit.dev";
+	const token = fromEnv("SEEKRIT_TOKEN") ?? config.token;
+	const devUser = fromEnv("SEEKRIT_DEV_USER") ?? config.devUser;
 	let auth;
 	if (token) auth = {
 		type: "bearer",
@@ -1018,8 +1035,10 @@ async function materialize(ctx, options) {
 */
 async function materializeForRun(options) {
 	const envFiles = options.envFile ?? [".env"];
+	const dotenvVars = {};
+	overlayEnvFiles(dotenvVars, {}, envFiles);
 	try {
-		const ctx = tryBuildContext();
+		const ctx = tryBuildContext(dotenvVars);
 		if (!ctx) throw new Error("no credentials found (set SEEKRIT_TOKEN / SEEKRIT_DEV_USER or run `seekrit login`)");
 		return await materialize(ctx, options);
 	} catch (err) {
@@ -1102,16 +1121,21 @@ program.command("grant").description("give a member or service token access to a
 	console.error(`granted ${label} access to ${principalId}`);
 });
 const token = program.command("token").description("manage service tokens (CI, docker, agents)");
-token.command("create").description("create a service token bound to an app environment; prints it once").requiredOption("--name <name>", "display name, e.g. ci-deploy").option("--org <slug>").requiredOption("--app <slug>", "application to bind the token to").requiredOption("--env <slug>", "environment to bind the token to").option("--allow <group=env>", "also grant an alternate group slice (for `run --with`)", collectKv).option("--no-grant", "skip auto-granting the env + composed group keys").action(async (options) => {
+token.command("create").description("create a service token (runtime, or --admin for provisioning); prints it once").requiredOption("--name <name>", "display name, e.g. ci-deploy").option("--org <slug>").option("--app <slug>", "application to bind the token to (runtime tokens)").option("--env <slug>", "environment to bind the token to (runtime tokens)").option("--admin", "mint an org-scoped admin token that can provision structure (no env binding required)").option("--allow <group=env>", "also grant an alternate group slice (for `run --with`)", collectKv).option("--no-grant", "skip auto-granting the env + composed group keys").action(async (options) => {
 	const ctx = buildContext();
-	const target = await resolveAppEnv(ctx, options);
+	const role = options.admin ? "admin" : "member";
+	const boundToEnv = Boolean(options.app || options.env);
+	if (!options.admin && !boundToEnv) fail("runtime tokens need --app and --env (or pass --admin for an org-scoped token)");
+	if (boundToEnv && !(options.app && options.env)) fail("pass both --app and --env to bind a token to an environment");
+	const target = boundToEnv ? await resolveAppEnv(ctx, options) : { orgId: (await resolveOrg(ctx, options.org)).id };
 	const created = await createServiceToken();
 	await ctx.client.createToken(target.orgId, {
 		name: options.name,
 		tokenId: created.tokenId,
 		tokenHash: created.tokenHash,
 		publicKeyJwk: created.publicKeyJwk,
-		environmentId: target.envId
+		role,
+		environmentId: "envId" in target ? target.envId : null
 	});
 	const grantEnv = async (envId) => {
 		const dek = await getDek(ctx, target.orgId, envId);
@@ -1121,7 +1145,8 @@ token.command("create").description("create a service token bound to an app envi
 			wrappedDek: await wrapDek(dek, created.publicKeyJwk)
 		});
 	};
-	if (options.grant !== false) {
+	const granted = boundToEnv && options.grant !== false;
+	if (granted && "envId" in target) {
 		await grantEnv(target.envId);
 		const { groups } = await ctx.client.listEnvGroups(target.orgId, target.envId);
 		for (const g of groups) {
@@ -1141,7 +1166,8 @@ token.command("create").description("create a service token bound to an app envi
 			await grantEnv(slice.id);
 		}
 	}
-	console.error(`token created${options.grant !== false ? " and granted" : ""} for ${target.appSlug}/${target.envSlug} — save it now, it is not stored:`);
+	const scope = "appSlug" in target ? `${target.appSlug}/${target.envSlug}` : "org-scoped (admin)";
+	console.error(`${role} token created${granted ? " and granted" : ""} for ${scope} — save it now, it is not stored:`);
 	console.log(created.token);
 });
 token.command("list").description("list service tokens").option("--org <slug>").action(async (options) => {
@@ -1159,6 +1185,10 @@ token.command("revoke <tokenId>").description("revoke a service token").option("
 	await ctx.client.revokeToken(orgRef.id, tokenId);
 	console.error(`${tokenId} revoked`);
 });
+program.command("mcp").description("run an MCP server over stdio so AI agents can drive seekrit").action(async () => {
+	const { runMcpServer } = await import("./mcp-hxTidFyj.js");
+	await runMcpServer();
+});
 program.command("audit").description("show the org audit trail").option("--org <slug>").option("--limit <n>", "entries to fetch", "50").action(async (options) => {
 	const ctx = buildContext();
 	const orgRef = await resolveOrg(ctx, options.org);
@@ -1169,4 +1199,4 @@ program.parseAsync().catch((err) => {
 	fail(err instanceof Error ? err.message : String(err));
 });
 //#endregion
-export {};
+export { parseServiceToken as _, encryptAndSetSecret as a, getDek as c, setFailThrows as d, writeProjectConfig as f, isServiceToken as g, createServiceToken as h, resolveOrg as i, isTokenAuth as l, wrapDek as m, resolveEnvTarget as n, fetchDecryptedSecrets as o, version as p, resolveGroup as r, materializeEnv as s, resolveAppEnv as t, tryBuildContext as u, generateDek as v };

package/dist/mcp-hxTidFyj.js

@@ -0,0 +1,558 @@
+import { _ as parseServiceToken, a as encryptAndSetSecret, c as getDek, d as setFailThrows, f as writeProjectConfig, g as isServiceToken, h as createServiceToken, i as resolveOrg, l as isTokenAuth, m as wrapDek, n as resolveEnvTarget, o as fetchDecryptedSecrets, p as version, r as resolveGroup, s as materializeEnv, t as resolveAppEnv, u as tryBuildContext, v as generateDek } from "./index.js";
+import { spawn } from "node:child_process";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+//#region src/mcp.ts
+function jsonText(data) {
+	return { content: [{
+		type: "text",
+		text: typeof data === "string" ? data : JSON.stringify(data, null, 2)
+	}] };
+}
+function errText(err) {
+	return {
+		content: [{
+			type: "text",
+			text: `error: ${err instanceof Error ? err.message : String(err)}`
+		}],
+		isError: true
+	};
+}
+/** Build the client context or throw a friendly, agent-readable error. */
+function getCtx() {
+	const ctx = tryBuildContext();
+	if (!ctx) throw new Error("no credentials — set SEEKRIT_TOKEN (a skt_… token) or SEEKRIT_DEV_USER in the MCP server env, or run `seekrit login` first");
+	return ctx;
+}
+/**
+* Guard tools that decrypt: under user auth we cannot prompt for a passphrase
+* (stdin is the transport), so it must be supplied out-of-band.
+*/
+function ensureDecryptable(ctx) {
+	if (!isTokenAuth(ctx) && !process.env.SEEKRIT_PASSPHRASE) throw new Error("this operation decrypts data; set SEEKRIT_PASSPHRASE in the MCP server env, or use a service token (SEEKRIT_TOKEN)");
+}
+/**
+* The calling principal's public key JWK — needed to wrap a freshly generated
+* DEK when creating an environment. Service tokens carry their private key, so
+* we derive the public half from it; users publish theirs at key setup.
+*/
+async function principalPublicKeyJwk(ctx) {
+	if (ctx.auth.type === "bearer" && isServiceToken(ctx.auth.token)) {
+		const { privateKey } = await parseServiceToken(ctx.auth.token);
+		const { d: _d, key_ops: _ops, ext: _ext, ...pub } = await crypto.subtle.exportKey("jwk", privateKey);
+		return JSON.stringify(pub);
+	}
+	const { user } = await ctx.client.me();
+	if (!user.publicKeyJwk) throw new Error("this user has no keypair yet — run `seekrit keys setup` first");
+	return user.publicKeyJwk;
+}
+/** Run a child command with `env` and capture its output (values never returned). */
+function runChild(cmd, args, env, cwd) {
+	return new Promise((resolve, reject) => {
+		const child = spawn(cmd, args, {
+			env,
+			cwd,
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			]
+		});
+		let stdout = "";
+		let stderr = "";
+		const cap = 64e3;
+		child.stdout.on("data", (d) => {
+			if (stdout.length < cap) stdout += d.toString("utf8");
+		});
+		child.stderr.on("data", (d) => {
+			if (stderr.length < cap) stderr += d.toString("utf8");
+		});
+		child.on("error", reject);
+		child.on("close", (code) => resolve({
+			exitCode: code ?? 1,
+			stdout,
+			stderr
+		}));
+	});
+}
+/** Resolve the layered environment for run/export (token path infers the env). */
+async function materializeFor(ctx, o) {
+	let envId;
+	if (!isTokenAuth(ctx)) envId = (await resolveAppEnv(ctx, o)).envId;
+	return materializeEnv(ctx, {
+		envId,
+		with: o.with,
+		envFiles: o.envFile ?? [".env"]
+	});
+}
+const targetShape = {
+	org: z.string().optional().describe("organization slug or id (defaults to a lone org)"),
+	app: z.string().optional().describe("application slug or id (or set via configure_project)"),
+	group: z.string().optional().describe("target a group environment instead of an app"),
+	env: z.string().optional().describe("environment slug or id (a service token infers its own)")
+};
+/**
+* Resolve which environment a secret tool addresses. A service token with no
+* explicit app/group targets its own bound environment (no flags needed);
+* everyone else names app|group + env.
+*/
+async function resolveTargetEnv(ctx, o) {
+	if (isTokenAuth(ctx) && !o.app && !o.group) {
+		const { scope } = await ctx.client.resolve();
+		return {
+			orgId: scope.orgId,
+			envId: scope.envId,
+			label: `${scope.appSlug}/${scope.envSlug}`
+		};
+	}
+	return resolveEnvTarget(ctx, o);
+}
+async function runMcpServer() {
+	setFailThrows(true);
+	const server = new McpServer({
+		name: "seekrit",
+		version
+	});
+	/** Register a tool whose handler returns data (serialized) or throws (→ isError). */
+	const tool = (name, description, shape, handler) => {
+		server.registerTool(name, {
+			description,
+			inputSchema: shape
+		}, (async (args) => {
+			try {
+				return jsonText(await handler(args));
+			} catch (err) {
+				return errText(err);
+			}
+		}));
+	};
+	tool("whoami", "Show the authenticated identity, its role, and accessible orgs.", {}, async () => {
+		const ctx = getCtx();
+		if (isTokenAuth(ctx) && ctx.auth.type === "bearer") {
+			const { tokenId } = await parseServiceToken(ctx.auth.token);
+			const { orgs } = await ctx.client.listOrgs();
+			let scope = null;
+			try {
+				scope = (await ctx.client.resolve()).scope;
+			} catch {}
+			return {
+				kind: "service_token",
+				tokenId,
+				org: orgs[0]?.slug ?? null,
+				boundScope: scope
+			};
+		}
+		return {
+			kind: "user",
+			...await ctx.client.me()
+		};
+	});
+	tool("list_orgs", "List organizations the caller can access.", {}, async () => (await getCtx().client.listOrgs()).orgs);
+	tool("list_apps", "List applications in an organization.", { org: z.string().optional() }, async ({ org }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		return (await ctx.client.listApps(orgRef.id)).apps;
+	});
+	tool("list_envs", "List environments of an application.", {
+		org: z.string().optional(),
+		app: z.string()
+	}, async ({ org, app }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		const { apps } = await ctx.client.listApps(orgRef.id);
+		const appRow = apps.find((a) => a.slug === app || a.id === app);
+		if (!appRow) throw new Error(`no app "${app}" in ${orgRef.slug}`);
+		return (await ctx.client.listEnvs(orgRef.id, appRow.id)).environments;
+	});
+	tool("list_groups", "List shared groups (reusable secret bags) in an organization.", { org: z.string().optional() }, async ({ org }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		return (await ctx.client.listGroups(orgRef.id)).groups;
+	});
+	tool("list_group_envs", "List a group's environments (per-slug value sets).", {
+		org: z.string().optional(),
+		group: z.string()
+	}, async ({ org, group }) => {
+		const ctx = getCtx();
+		const g = await resolveGroup(ctx, {
+			org,
+			group
+		});
+		return (await ctx.client.listGroupEnvs(g.orgId, g.id)).environments;
+	});
+	tool("list_env_groups", "List the groups composed into an application environment (precedence order).", {
+		org: z.string().optional(),
+		app: z.string(),
+		env: z.string()
+	}, async ({ org, app, env }) => {
+		const ctx = getCtx();
+		const target = await resolveAppEnv(ctx, {
+			org,
+			app,
+			env
+		});
+		return (await ctx.client.listEnvGroups(target.orgId, target.envId)).groups;
+	});
+	tool("list_members", "List organization members and their public keys (for granting access).", { org: z.string().optional() }, async ({ org }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		return (await ctx.client.listMembers(orgRef.id)).members;
+	});
+	tool("list_secrets", "List secret names + versions in an environment (never values).", targetShape, async (o) => {
+		const ctx = getCtx();
+		const { orgId, envId } = await resolveTargetEnv(ctx, o);
+		const { secrets } = await ctx.client.listSecrets(orgId, envId);
+		return secrets.map((s) => ({
+			name: s.name,
+			version: s.version,
+			updatedAt: s.updatedAt
+		}));
+	});
+	tool("list_tokens", "List an organization's service tokens (never the secret token strings).", { org: z.string().optional() }, async ({ org }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		return (await ctx.client.listTokens(orgRef.id)).tokens;
+	});
+	tool("audit", "Read the organization's audit trail (most recent first).", {
+		org: z.string().optional(),
+		limit: z.number().int().min(1).max(200).optional(),
+		action: z.string().optional().describe("filter by action, e.g. secret.updated")
+	}, async ({ org, limit, action }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		return (await ctx.client.listAudit(orgRef.id, {
+			limit: limit ?? 50,
+			action
+		})).entries;
+	});
+	tool("create_org", "Create an organization. Requires a user session — service tokens cannot own a Stytch org.", {
+		name: z.string(),
+		slug: z.string()
+	}, async ({ name, slug }) => (await getCtx().client.createOrg({
+		name,
+		slug
+	})).org);
+	tool("create_app", "Create an application in an organization.", {
+		org: z.string().optional(),
+		name: z.string(),
+		slug: z.string()
+	}, async ({ org, name, slug }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		return (await ctx.client.createApp(orgRef.id, {
+			name,
+			slug
+		})).app;
+	});
+	tool("create_group", "Create a shared group (reusable secret bag) in an organization.", {
+		org: z.string().optional(),
+		name: z.string(),
+		slug: z.string()
+	}, async ({ org, name, slug }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		return (await ctx.client.createGroup(orgRef.id, {
+			name,
+			slug
+		})).group;
+	});
+	tool("create_env", "Create an application environment. Generates the data key locally and grants it to the caller.", {
+		org: z.string().optional(),
+		app: z.string(),
+		name: z.string(),
+		slug: z.string()
+	}, async ({ org, app, name, slug }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		const { apps } = await ctx.client.listApps(orgRef.id);
+		const appRow = apps.find((a) => a.slug === app || a.id === app);
+		if (!appRow) throw new Error(`no app "${app}" in ${orgRef.slug}`);
+		const wrappedDek = await wrapDek(generateDek(), await principalPublicKeyJwk(ctx));
+		return (await ctx.client.createEnv(orgRef.id, appRow.id, {
+			name,
+			slug,
+			wrappedDek
+		})).environment;
+	});
+	tool("create_group_env", "Create a group environment. Generates the data key locally and grants it to the caller.", {
+		org: z.string().optional(),
+		group: z.string(),
+		name: z.string(),
+		slug: z.string()
+	}, async ({ org, group, name, slug }) => {
+		const ctx = getCtx();
+		const g = await resolveGroup(ctx, {
+			org,
+			group
+		});
+		const wrappedDek = await wrapDek(generateDek(), await principalPublicKeyJwk(ctx));
+		return (await ctx.client.createGroupEnv(g.orgId, g.id, {
+			name,
+			slug,
+			wrappedDek
+		})).environment;
+	});
+	tool("compose_group", "Compose a group into an application environment (higher position wins on name clashes).", {
+		org: z.string().optional(),
+		app: z.string(),
+		env: z.string(),
+		group: z.string(),
+		position: z.number().int().min(0).optional()
+	}, async ({ org, app, env, group, position }) => {
+		const ctx = getCtx();
+		const target = await resolveAppEnv(ctx, {
+			org,
+			app,
+			env
+		});
+		const g = await resolveGroup(ctx, {
+			org,
+			group
+		});
+		return (await ctx.client.linkEnvGroup(target.orgId, target.envId, {
+			groupId: g.id,
+			position
+		})).group;
+	});
+	tool("uncompose_group", "Remove a composed group from an application environment.", {
+		org: z.string().optional(),
+		app: z.string(),
+		env: z.string(),
+		group: z.string()
+	}, async ({ org, app, env, group }) => {
+		const ctx = getCtx();
+		const target = await resolveAppEnv(ctx, {
+			org,
+			app,
+			env
+		});
+		const g = await resolveGroup(ctx, {
+			org,
+			group
+		});
+		await ctx.client.unlinkEnvGroup(target.orgId, target.envId, g.id);
+		return { ok: true };
+	});
+	tool("set_secret", "Encrypt a value locally and store it in an environment.", {
+		...targetShape,
+		name: z.string(),
+		value: z.string()
+	}, async (o) => {
+		const ctx = getCtx();
+		ensureDecryptable(ctx);
+		const { orgId, envId } = await resolveTargetEnv(ctx, o);
+		await encryptAndSetSecret(ctx, orgId, envId, o.name, o.value);
+		return {
+			ok: true,
+			name: o.name
+		};
+	});
+	tool("get_secret", "Return one secret. By default only reports presence + version; pass reveal:true to decrypt the plaintext into this response (avoid unless the value is actually needed — prefer run_command).", {
+		...targetShape,
+		name: z.string(),
+		reveal: z.boolean().optional()
+	}, async (o) => {
+		const ctx = getCtx();
+		const { orgId, envId } = await resolveTargetEnv(ctx, o);
+		if (!o.reveal) {
+			const { secrets } = await ctx.client.listSecrets(orgId, envId);
+			const row = secrets.find((s) => s.name === o.name);
+			if (!row) throw new Error(`no secret named ${o.name}`);
+			return {
+				name: row.name,
+				version: row.version,
+				revealed: false
+			};
+		}
+		ensureDecryptable(ctx);
+		const values = await fetchDecryptedSecrets(ctx, orgId, envId);
+		if (!(o.name in values)) throw new Error(`no secret named ${o.name}`);
+		return {
+			name: o.name,
+			value: values[o.name],
+			revealed: true
+		};
+	});
+	tool("delete_secret", "Delete a secret from an environment.", {
+		...targetShape,
+		name: z.string()
+	}, async (o) => {
+		const ctx = getCtx();
+		const { orgId, envId } = await resolveTargetEnv(ctx, o);
+		await ctx.client.deleteSecret(orgId, envId, o.name);
+		return {
+			ok: true,
+			name: o.name
+		};
+	});
+	tool("run_command", "Run a command with the resolved secrets injected as environment variables, and return its exit code + captured output. Secret VALUES are never returned — this is the preferred way to use secrets. process env > .env > app env > groups.", {
+		command: z.string().describe("executable to run"),
+		args: z.array(z.string()).optional(),
+		org: z.string().optional(),
+		app: z.string().optional(),
+		env: z.string().optional().describe("environment slug (token auth infers this)"),
+		with: z.record(z.string(), z.string()).optional().describe("group=env slice overrides"),
+		envFile: z.array(z.string()).optional().describe(".env files to overlay (default [.env])"),
+		cwd: z.string().optional()
+	}, async (o) => {
+		const ctx = getCtx();
+		ensureDecryptable(ctx);
+		const { values } = await materializeFor(ctx, o);
+		const childEnv = {
+			...values,
+			...process.env
+		};
+		return {
+			...await runChild(o.command, o.args ?? [], childEnv, o.cwd),
+			injectedVarCount: Object.keys(values).length
+		};
+	});
+	tool("export_env", "Write the resolved secrets to a dotenv file on disk and return the variable names written (never the values). Use to materialize a .env for local tooling.", {
+		file: z.string().describe("path to write, e.g. .env"),
+		org: z.string().optional(),
+		app: z.string().optional(),
+		env: z.string().optional(),
+		with: z.record(z.string(), z.string()).optional()
+	}, async (o) => {
+		const ctx = getCtx();
+		ensureDecryptable(ctx);
+		const { values } = await materializeFor(ctx, o);
+		const { writeFileSync } = await import("node:fs");
+		const body = Object.entries(values).map(([k, v]) => `${k}=${JSON.stringify(v)}`).join("\n");
+		writeFileSync(o.file, `${body}\n`, { mode: 384 });
+		return {
+			file: o.file,
+			names: Object.keys(values).sort()
+		};
+	});
+	tool("create_token", "Mint a service token, printed once. Runtime tokens bind to one app environment (auto-granted its keys, so a command/agent can decrypt it). Pass admin:true for an org-scoped provisioning token (create apps/groups/envs, grant, mint tokens) — admin tokens need no env binding.", {
+		name: z.string().describe("display name, e.g. ci-deploy or agent-session"),
+		org: z.string().optional(),
+		app: z.string().optional().describe("bind to this app (runtime tokens)"),
+		env: z.string().optional().describe("bind to this env (runtime tokens)"),
+		admin: z.boolean().optional().describe("mint an org-scoped admin token")
+	}, async ({ name, org, app, env, admin }) => {
+		const ctx = getCtx();
+		const role = admin ? "admin" : "member";
+		const boundToEnv = Boolean(app || env);
+		if (!admin && !boundToEnv) throw new Error("runtime tokens need app + env, or pass admin:true for an org-scoped token");
+		if (boundToEnv && !(app && env)) throw new Error("pass both app and env to bind a token");
+		const target = boundToEnv ? await resolveAppEnv(ctx, {
+			org,
+			app,
+			env
+		}) : { orgId: (await resolveOrg(ctx, org)).id };
+		const created = await createServiceToken();
+		await ctx.client.createToken(target.orgId, {
+			name,
+			tokenId: created.tokenId,
+			tokenHash: created.tokenHash,
+			publicKeyJwk: created.publicKeyJwk,
+			role,
+			environmentId: "envId" in target ? target.envId : null
+		});
+		if (boundToEnv && "envId" in target) {
+			ensureDecryptable(ctx);
+			const grantEnv = async (envId) => {
+				const dek = await getDek(ctx, target.orgId, envId);
+				await ctx.client.grantEnvKey(target.orgId, envId, {
+					principalType: "service_token",
+					principalId: created.tokenId,
+					wrappedDek: await wrapDek(dek, created.publicKeyJwk)
+				});
+			};
+			await grantEnv(target.envId);
+			const { groups } = await ctx.client.listEnvGroups(target.orgId, target.envId);
+			for (const g of groups) {
+				const { environments } = await ctx.client.listGroupEnvs(target.orgId, g.groupId);
+				const slice = environments.find((e) => e.slug === target.envSlug);
+				if (slice) await grantEnv(slice.id);
+			}
+		}
+		return {
+			token: created.token,
+			tokenId: created.tokenId,
+			role,
+			note: "save this now — the secret token string is not stored and cannot be retrieved"
+		};
+	});
+	tool("revoke_token", "Revoke a service token by id.", {
+		org: z.string().optional(),
+		tokenId: z.string()
+	}, async ({ org, tokenId }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		await ctx.client.revokeToken(orgRef.id, tokenId);
+		return {
+			ok: true,
+			tokenId
+		};
+	});
+	tool("grant_env", "Grant a member (by email) or service token (by id) access to an environment's data key. Re-wraps the DEK to the grantee — the caller must already hold the key.", {
+		...targetShape,
+		user: z.string().optional().describe("org member email"),
+		token: z.string().optional().describe("service token id (skt_…)")
+	}, async (o) => {
+		if (Boolean(o.user) === Boolean(o.token)) throw new Error("pass exactly one of user or token");
+		const ctx = getCtx();
+		ensureDecryptable(ctx);
+		const { orgId, envId, label } = await resolveTargetEnv(ctx, o);
+		const dek = await getDek(ctx, orgId, envId);
+		let principalType;
+		let principalId;
+		let publicKeyJwk;
+		if (o.user) {
+			const { members } = await ctx.client.listMembers(orgId);
+			const member = members.find((m) => m.email === o.user);
+			if (!member) throw new Error(`no member ${o.user}`);
+			if (!member.publicKeyJwk) throw new Error(`${o.user} has not completed key setup`);
+			[principalType, principalId, publicKeyJwk] = [
+				"user",
+				member.userId,
+				member.publicKeyJwk
+			];
+		} else {
+			const { tokens } = await ctx.client.listTokens(orgId);
+			const t = tokens.find((x) => x.id === o.token);
+			if (!t) throw new Error(`no service token ${o.token}`);
+			[principalType, principalId, publicKeyJwk] = [
+				"service_token",
+				t.id,
+				t.publicKeyJwk
+			];
+		}
+		await ctx.client.grantEnvKey(orgId, envId, {
+			principalType,
+			principalId,
+			wrappedDek: await wrapDek(dek, publicKeyJwk)
+		});
+		return {
+			ok: true,
+			env: label,
+			principalType,
+			principalId
+		};
+	});
+	tool("configure_project", "Link a directory to an org/app by writing seekrit.json (like `seekrit init`). The environment is chosen by the service token at runtime.", {
+		org: z.string(),
+		app: z.string(),
+		dir: z.string().optional()
+	}, async ({ org, app, dir }) => {
+		const ctx = getCtx();
+		const orgRef = await resolveOrg(ctx, org);
+		const { apps } = await ctx.client.listApps(orgRef.id);
+		const appRow = apps.find((a) => a.slug === app || a.id === app);
+		if (!appRow) throw new Error(`no app "${app}" in ${orgRef.slug}`);
+		return {
+			path: writeProjectConfig({
+				org: orgRef.slug,
+				app: appRow.slug
+			}, dir),
+			guidance: "Run commands with `seekrit run -- <cmd>` (or the seekrit-run binary) and a SEEKRIT_TOKEN bound to the desired environment; the token selects org+app+env."
+		};
+	});
+	await server.connect(new StdioServerTransport());
+}
+//#endregion
+export { runMcpServer };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {
@@ -21,7 +21,9 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "commander": "^15.0.0"
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "commander": "^15.0.0",
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@seekrit/api-client": "workspace:*",