@vibeinfra/mcp-server 0.2.0 → 0.3.0

package/README.md

@@ -48,16 +48,41 @@ The server speaks stdio and requires Node 18+.
 | `get_platform_capacity`      | Live sandbox usage and queue length.                                           |
 | `lookup_infrastructure_term` | The VibeInfra infrastructure/SRE glossary.                                     |
 
-### ⚡ Interactive SRE Incident Drills & Coaching
+### ⚡ Interactive SRE Incident Drills, Diagnostics & Headless Troubleshooting
 
 | Tool                         | What it does                                                                 |
 | ---------------------------- | ---------------------------------------------------------------------------- |
-| `start_drill`                | Spawns a live disposable sandbox and returns the session ID and web terminal. |
+| `start_drill`                | Spawns a live disposable sandbox and returns session ID and web terminal.    |
+| `exec_in_sandbox`            | Runs diagnostic/remediation commands (`kubectl`, `df`, `systemctl`) in sandbox. |
 | `get_drill_hint`             | Provides spoiler-free progressive guidance and diagnostic nudges.             |
 | `grade_drill`                | Runs automated system-state evaluation against the live sandbox to score fixes. |
 | `get_drill_status`           | Returns real-time telemetry, node health status, and live topology.           |
 | `stop_drill`                 | Cleanly terminates and destroys the disposable sandbox container.            |
 
+## Authentication
+
+### Zero-Config CLI Login (Recommended)
+
+Authenticate your terminal or agent host in 5 seconds without touching JSON config files:
+
+```bash
+npx -y @vibeinfra/mcp-server login
+```
+
+This opens your browser to authorize your account and securely saves your Personal Access Token to `~/.vibeinfra/credentials.json` (POSIX `0600` permissions). Subsequent runs of `@vibeinfra/mcp-server` automatically discover this token.
+
+To log out:
+```bash
+npx -y @vibeinfra/mcp-server logout
+```
+
+### 1-Click Dashboard Token
+
+You can also generate a Personal Access Token from your VibeInfra Profile:
+1. Navigate to **[https://vibeinfra.id/profile](https://vibeinfra.id/profile)**.
+2. Under **AI Agents & MCP Integration**, click **Generate Agent Token**.
+3. Click **Copy Configuration** and paste it directly into your `.mcp.json` or Cursor / Claude Code settings.
+
 ## Configuration
 
 | Environment variable     | Default                    | Purpose                              |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibeinfra/mcp-server",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Model Context Protocol server for VibeInfra — enables AI agents to browse the SRE incident catalog, start live disposable sandboxes, coach learners with hints, and grade remediations.",
   "keywords": [
     "mcp",

package/src/api.js

@@ -142,4 +142,12 @@ export class VibeInfraApi {
   getLabTopology(sessionId) {
     return this.get("/labs/topology", { session_id: sessionId });
   }
+
+  execInSandbox(sessionId, command, timeoutSec = 15) {
+    return this.post("/labs/exec", {
+      session_id: sessionId,
+      command,
+      timeout_sec: timeoutSec,
+    });
+  }
 }

package/src/cli.js

@@ -9,10 +9,34 @@
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
 import { createServer } from "./server.js";
+import { getStoredApiKey, runLogin, runLogout } from "./login.js";
+
+const command = process.argv[2];
+
+if (command === "login") {
+  try {
+    await runLogin({
+      webBaseUrl: process.env.VIBEINFRA_WEB_URL || "https://vibeinfra.id",
+    });
+    process.exit(0);
+  } catch (err) {
+    console.error("❌ Login failed:", err.message || err);
+    process.exit(1);
+  }
+}
+
+if (command === "logout") {
+  runLogout();
+  process.exit(0);
+}
+
+// Automatically resolve API key from environment or ~/.vibeinfra/credentials.json
+const resolvedApiKey = process.env.VIBEINFRA_API_KEY || getStoredApiKey();
 
 const server = createServer({
   baseUrl: process.env.VIBEINFRA_API_BASE_URL,
-  apiKey: process.env.VIBEINFRA_API_KEY,
+  apiKey: resolvedApiKey,
 });
 
 await server.connect(new StdioServerTransport());
+

package/src/login.js

@@ -0,0 +1,142 @@
+import http from "node:http";
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import crypto from "node:crypto";
+import { exec } from "node:child_process";
+
+const CONFIG_DIR = path.join(os.homedir(), ".vibeinfra");
+const CREDENTIALS_FILE = path.join(CONFIG_DIR, "credentials.json");
+
+/**
+ * Read the stored API token from ~/.vibeinfra/credentials.json
+ */
+export function getStoredApiKey() {
+  try {
+    if (fs.existsSync(CREDENTIALS_FILE)) {
+      const data = JSON.parse(fs.readFileSync(CREDENTIALS_FILE, "utf-8"));
+      if (data && data.api_key) {
+        return data.api_key;
+      }
+    }
+  } catch {
+    // Ignore unreadable or corrupted config
+  }
+  return null;
+}
+
+/**
+ * Persist the API token with strict POSIX 0600 permissions
+ */
+export function saveApiKey(apiKey) {
+  if (!fs.existsSync(CONFIG_DIR)) {
+    fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+  }
+  fs.writeFileSync(
+    CREDENTIALS_FILE,
+    JSON.stringify(
+      {
+        api_key: apiKey,
+        saved_at: new Date().toISOString(),
+      },
+      null,
+      2
+    ),
+    { mode: 0o600 }
+  );
+}
+
+/**
+ * Wipe stored credentials
+ */
+export function clearApiKey() {
+  try {
+    if (fs.existsSync(CREDENTIALS_FILE)) {
+      fs.unlinkSync(CREDENTIALS_FILE);
+    }
+  } catch {
+    // Ignore error
+  }
+}
+
+function openBrowser(url) {
+  const platform = os.platform();
+  if (platform === "darwin") {
+    exec(`open "${url}"`);
+  } else if (platform === "win32") {
+    exec(`start "" "${url}"`);
+  } else {
+    exec(`xdg-open "${url}"`);
+  }
+}
+
+/**
+ * Run interactive OAuth loopback flow
+ */
+export function runLogin({ webBaseUrl = "https://vibeinfra.id", port = 49152 } = {}) {
+  return new Promise((resolve, reject) => {
+    const stateNonce = crypto.randomBytes(16).toString("hex");
+
+    const server = http.createServer((req, res) => {
+      const reqUrl = new URL(req.url, `http://127.0.0.1:${port}`);
+
+      if (reqUrl.pathname === "/callback") {
+        const token = reqUrl.searchParams.get("token");
+        const state = reqUrl.searchParams.get("state");
+
+        if (!token || state !== stateNonce) {
+          res.writeHead(400, { "Content-Type": "text/html" });
+          res.end("<h3>Invalid authentication request or state mismatch.</h3>");
+          server.close();
+          return reject(new Error("State nonce mismatch or missing token"));
+        }
+
+        saveApiKey(token);
+
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(`
+          <!DOCTYPE html>
+          <html>
+            <head><title>VibeInfra CLI Authorized</title></head>
+            <body style="font-family: system-ui, -apple-system, sans-serif; background: #09090b; color: #fff; display: flex; align-items: center; justify-content: center; height: 100vh; margin: 0;">
+              <div style="text-align: center; max-width: 440px; padding: 2rem; border-radius: 1rem; background: #18181b; border: 1px solid #27272a;">
+                <h2 style="color: #34d399; margin-top: 0;">✓ Successfully Authorized!</h2>
+                <p style="color: #a1a1aa; font-size: 0.95rem; line-height: 1.5;">
+                  Your Personal Access Token has been saved securely to <code style="color: #e4e4e7; background: #27272a; padding: 2px 6px; border-radius: 4px;">~/.vibeinfra/credentials.json</code>.
+                </p>
+                <p style="color: #71717a; font-size: 0.85rem; margin-top: 1.5rem;">You can close this tab and return to your terminal.</p>
+              </div>
+            </body>
+          </html>
+        `);
+
+        server.close();
+        console.error("\n✅ Successfully authenticated with VibeInfra!");
+        console.error(`Token securely saved to ${CREDENTIALS_FILE} (mode 0600).\n`);
+        return resolve();
+      }
+
+      res.writeHead(404);
+      res.end("Not found");
+    });
+
+    server.on("error", (err) => {
+      reject(err);
+    });
+
+    server.listen(port, "127.0.0.1", () => {
+      const authUrl = `${webBaseUrl.replace(/\/+$/, "")}/auth/cli?port=${port}&state=${stateNonce}`;
+      console.error("\n🚀 Opening browser to authenticate with VibeInfra...");
+      console.error(`If the browser does not open automatically, visit:\n${authUrl}\n`);
+      openBrowser(authUrl);
+    });
+  });
+}
+
+/**
+ * Handle logout CLI command
+ */
+export function runLogout() {
+  clearApiKey();
+  console.error("\n👋 Successfully logged out. Removed credentials from ~/.vibeinfra/credentials.json\n");
+}

package/src/tools.js

@@ -320,6 +320,38 @@ export const tools = [
       });
     },
   },
+  {
+    name: "exec_in_sandbox",
+    config: {
+      title: "Execute shell command inside incident sandbox",
+      description:
+        "Run an arbitrary diagnostic, triage, or remediation command directly inside the live container sandbox. " +
+        "Returns stdout, stderr, and exit_code. Enables headless incident troubleshooting without opening a browser.",
+      inputSchema: {
+        session_id: z.string().describe("Active session ID returned by start_drill."),
+        command: z
+          .string()
+          .describe("Shell command to execute, e.g. 'kubectl get pods -A', 'df -h', 'systemctl status nginx'."),
+        timeout_sec: z
+          .number()
+          .optional()
+          .describe("Command execution timeout in seconds (default 15, max 30)."),
+      },
+      annotations: { readOnlyHint: false, openWorldHint: true },
+    },
+    async handler(api, { session_id: sessionId, command, timeout_sec: timeoutSec } = {}) {
+      const result = await api.execInSandbox(sessionId, command, timeoutSec);
+      return jsonContent({
+        session_id: sessionId,
+        command,
+        exit_code: result.exit_code ?? 0,
+        stdout: result.stdout ?? "",
+        stderr: result.stderr ?? "",
+        status: result.status ?? (result.exit_code === 0 ? "success" : "failed"),
+        error: result.error,
+      });
+    },
+  },
 ];
 
 export { filterCourses, summarise };