@wirecat/cli-core 0.469.0 → 0.471.0

package/dist/cli/messenger/mcp-command.js

@@ -14,50 +14,123 @@ import { grantsAuthority, LOCAL_READ, LOCAL_WRITE, REMOTE_WRITE } from "../effec
 import { itemOf, renderAnswer } from "../envelope.js";
 import { MCP_HTTP_DEFAULT_PORT, mcpServerCommand } from "../mcp-server-command.js";
 import { rootOf } from "../profile.js";
-import { namedProfile } from "../settings.js";
+import { NoProfileHere, namedProfile } from "../settings.js";
 import { nextStep } from "../steps.js";
 import { recalledAccount } from "./accounts.js";
 import { messengerContext } from "./context.js";
 const DEFAULT_PORT = MCP_HTTP_DEFAULT_PORT;
-/** The token file of `<tool> mcp serve --http` for every profile: no profile name can start with `_`. */
+/** The token file of `<tool> mcp serve --http --profiles all`: no profile name can start with `_`. */
 export const ALL_PROFILES = "_all";
+/** `--profiles all`; a profile named `all` is served alone, as `<tool> all mcp serve`. */
+export const EVERY_PROFILE = "all";
+/**
+ * The profile or profiles an MCP server is for, always named (NEED-1881, WC-MCP-9): a leading profile, or
+ * `--profiles` with a list or `all`. Neither, or both, is refused with the profiles on this computer. `--profiles`
+ * takes the place of `<PREFIX>_PROFILE`; under `<PREFIX>_PROFILE_LOCK` it may name the locked profile only
+ * (WC-ACCT-5).
+ */
+export const servedProfiles = (self, messenger, { settings, env }, given, words) => {
+    const { app } = messenger;
+    const here = settings.profilesHere;
+    const listed = `profiles here: ${here.length > 0 ? here.join(", ") : "none"}`;
+    const named = namedProfile(settings);
+    if (given === undefined && named !== undefined)
+        return { profile: named };
+    if (given !== undefined && settings.sources.profile === "first word")
+        throw new CliError("validation_error", `name one profile or --profiles, not both: \`${app.command} ${named} ${words}\` or \`${app.command} ${words} ` +
+            `--profiles ${given}\``, { profiles: here });
+    if (given === undefined) {
+        if (here.length === 0)
+            throw new NoProfileHere(app);
+        throw new CliError("validation_error", `name the profiles to serve: \`${app.command} <profile> ${words}\`, or \`${app.command} ${words} --profiles ` +
+            `<a,b>\` or \`--profiles all\` — ${listed}`, { profiles: here });
+    }
+    const names = [...new Set(given.split(",").map((one) => one.trim()))].filter(Boolean).sort();
+    const lock = env[envName(app, "PROFILE_LOCK")]?.trim();
+    if (lock && names.some((one) => one !== lock))
+        throw new CliError("permission_error", `this process is locked to profile ${lock} (${envName(app, "PROFILE_LOCK")}) — --profiles may name only ${lock}`);
+    if (lock)
+        return { set: { option: lock, profiles: () => [lock], key: `_${lock}` } };
+    if (names.length === 1 && names[0] === EVERY_PROFILE) {
+        const every = () => messenger.resolveSettings(self.optsWithGlobals(), { env, needsProfile: false, readOnly: true }).profilesHere;
+        return { set: { option: EVERY_PROFILE, profiles: every, key: ALL_PROFILES } };
+    }
+    if (names.length === 0 || names.includes(EVERY_PROFILE))
+        throw new CliError("validation_error", `--profiles takes profile names, comma-separated, or \`all\` alone for every profile — a profile named all ` +
+            `is served as \`${app.command} all ${words}\`; ${listed}`, { profiles: here });
+    const unknown = names.filter((one) => !here.includes(one));
+    if (unknown.length > 0)
+        throw new CliError("validation_error", `no profile named ${unknown.map((one) => `"${one}"`).join(", ")} — ${listed}`, { profiles: here });
+    return { set: { option: names.join(","), profiles: () => names, key: `_${names.join(",")}` } };
+};
+const withProfiles = (command) => command.option("--profiles <names|all>", "serve several profiles from one server instead of one: names, comma-separated, or all for every profile");
 /** Where `mcp serve --http` keeps the hashes of the tokens it issued — per profile, in the state folder. */
 export const httpTokenFile = (app, profile, env) => join(resolvePaths({ appName: app.appName, prefix: app.envPrefix, env }).state, "mcp-http", `${profile}.json`);
-const withFlags = (command) => command.option("--permission <key=level>", "make a permission stricter for this server only, like messages.send=deny; it never loosens the profile; repeat for more keys", (value, previous = []) => [...previous, value]);
-export const mcpCommand = (messenger) => {
-    const { app } = messenger;
+const withFlags = (command, example) => command.option("--permission <key=level>", `make a permission stricter for this server only, like ${example}; it never loosens the profile; repeat for more keys`, (value, previous = []) => [...previous, value]);
+const messengerHost = (messenger) => ({
+    app: messenger.app,
+    name: messenger.name ?? messenger.app.command,
+    resolveSettings: messenger.resolveSettings,
+    ...(messenger.profileState ? { profileState: messenger.profileState } : {}),
+    context: (self, options) => messengerContext(self, messenger, options),
+    permissionExample: "messages.send=deny",
+    serveStdio: async (self, context) => {
+        // Loaded here, not at the top: every other command would otherwise pay for the SDK.
+        const { serveOverStdio } = await import("../../mcp/server.js");
+        await serveOverStdio(self, context, messenger, {});
+    },
+    serveHttp: async (self, context, http) => {
+        const { serveOverHttpUntilStopped } = await import("../../mcp/server.js");
+        await serveOverHttpUntilStopped(self, context, messenger, {}, http);
+    },
+    instructions: async (profiles) => {
+        const { instructions } = await import("../../mcp/instructions.js");
+        return instructions({
+            command: messenger.app.command,
+            name: messenger.name ?? messenger.app.command,
+            profile: profiles,
+            writes: [],
+        });
+    },
+    signedIn: (self, profile, env) => (messenger.accountOf?.(self) ?? recalledAccount(messenger.app, messenger.provider, profile, env)) !== undefined,
+});
+export const mcpCommand = (messenger) => mcpGroup(messengerHost(messenger));
+export const mcpGroup = (host) => {
+    const { app } = host;
+    const flagged = (command) => withFlags(command, host.permissionExample);
     const command = annotate(new Command("mcp"), { effects: LOCAL_READ, mcp: false })
         .summary("serve this profile's commands to an AI agent, and set that up")
         .description(`serve this profile to an agent over MCP and set it up — \`claude mcp add ${app.command} -- ${app.command} <profile> mcp serve\``);
-    command.addCommand(withFlags(annotate(new Command("serve"), {
+    command.addCommand(withProfiles(flagged(annotate(new Command("serve"), {
         effects: REMOTE_WRITE,
         lifetime: "persistent",
         mcp: false,
         examples: [
             `${app.command} personal mcp serve`,
+            `${app.command} mcp serve --profiles work,personal`,
             `${app.command} personal mcp serve --http --public-url https://laptop.example.ts.net`,
         ],
     })
         .summary("serve this profile's commands to an AI agent")
-        .description(`serve this profile to an agent over MCP, on stdin and stdout — \`claude mcp add ${app.command} -- ${app.command} <profile> mcp serve\`; with no profile, \`${app.command} mcp serve\` serves every profile and each tool asks which`))
+        .description(`serve this profile to an agent over MCP, on stdin and stdout — \`claude mcp add ${app.command} -- ${app.command} <profile> mcp serve\`; \`${app.command} mcp serve --profiles a,b\` or \`--profiles all\` serves those profiles from one server and each tool asks which`)))
         .option("--http", "serve over HTTP on 127.0.0.1 for ChatGPT and Claude in the browser, behind your tunnel; the profile's permissions decide")
         .option("--port <port>", `the local port for --http (default ${DEFAULT_PORT})`)
         .option("--public-url <url>", "the tunnel's https address the browser apps use, e.g. https://<name>.ts.net or https://<name>.ts.net/tg")
         .action(async function () {
         const flags = this.optsWithGlobals();
-        const context = messengerContext(this, messenger, { needsProfile: false });
-        const profile = namedProfile(context.settings);
-        if (profile === undefined)
-            return serveEveryProfile(this, context, messenger, flags);
+        const context = host.context(this, { needsProfile: false });
+        const served = servedProfiles(this, host, context, flags.profiles, "mcp serve");
+        if ("set" in served)
+            return serveProfiles(this, context, host, flags, served.set);
+        const { profile } = served;
         if (flags.http) {
             const publicUrl = publicUrlOf(flags.publicUrl, {
                 missing: "--http",
                 reaches: `the browser apps reach ${app.command}`,
                 path: true,
             });
-            const { serveOverHttpUntilStopped } = await import("../../mcp/server.js");
             const tokenFile = httpTokenFile(app, profile, context.env);
-            await serveOverHttpUntilStopped(this, context, messenger, {}, {
+            await host.serveHttp(this, context, {
                 publicUrl,
                 port: portOf(flags.port, DEFAULT_PORT),
                 tokenFile,
@@ -66,74 +139,84 @@ export const mcpCommand = (messenger) => {
             });
             return;
         }
-        // Loaded here, not at the top: every other command would otherwise pay for the SDK.
-        const { serveOverStdio } = await import("../../mcp/server.js");
-        await serveOverStdio(this, context, messenger, {});
+        await host.serveStdio(this, context);
     }));
-    command.addCommand(annotate(new Command("revoke"), {
+    command.addCommand(withProfiles(annotate(new Command("revoke"), {
         effects: LOCAL_WRITE,
         mcp: false,
-        examples: [`${app.command} personal mcp revoke`],
+        examples: [`${app.command} personal mcp revoke`, `${app.command} mcp revoke --profiles all`],
     })
         .summary("forget every login given to a browser app")
-        .description(`forget every login \`mcp serve --http\` gave a browser app, of this profile or, with no profile, of the server of every profile; each app must log in again`)
-        .action(async function () {
-        const context = messengerContext(this, messenger, { needsProfile: false });
-        const profile = namedProfile(context.settings);
+        .description("forget every login `mcp serve --http` gave a browser app, of this profile or of the server `--profiles` names; each app must log in again")).action(async function () {
+        const context = host.context(this, { needsProfile: false });
+        const served = servedProfiles(this, host, context, this.opts().profiles, "mcp revoke");
         const { revokeAll } = await import("../../mcp/http/oauth.js");
-        revokeAll(httpTokenFile(app, profile ?? ALL_PROFILES, context.env));
-        renderAnswer(this, context, itemOf({ revoked: true, profile: profile ?? null }));
+        revokeAll(httpTokenFile(app, "set" in served ? served.set.key : served.profile, context.env));
+        renderAnswer(this, context, itemOf("set" in served
+            ? { revoked: true, profile: null, profiles: served.set.option }
+            : { revoked: true, profile: served.profile }));
     }));
     command.addCommand(mcpServerCommand({
         example: `${app.command} personal`,
         permission: true,
+        profiles: true,
         target: (self) => {
-            const { settings, env } = messengerContext(self, messenger, { needsProfile: false });
-            if (namedProfile(settings) === undefined)
+            const context = host.context(self, { needsProfile: false });
+            const { env } = context;
+            const served = servedProfiles(self, host, context, self.opts().profiles, `mcp server ${self.name()}`);
+            if ("set" in served) {
+                const { set } = served;
                 return {
                     invocation: app.command,
+                    profiles: { option: set.option, key: set.key, label: profileSetLabel(set) },
                     envPrefix: app.envPrefix,
                     env,
-                    tokenFile: httpTokenFile(app, ALL_PROFILES, env),
-                    argv: ["mcp", "serve", "--http"],
+                    tokenFile: httpTokenFile(app, set.key, env),
+                    argv: ["mcp", "serve", "--http", "--profiles", set.option],
                     version: app.version,
                 };
+            }
+            const { profile } = served;
             return {
-                invocation: `${app.command} ${settings.profile}`,
-                profile: settings.profile,
+                invocation: `${app.command} ${profile}`,
+                profile,
                 envPrefix: app.envPrefix,
                 env,
-                tokenFile: httpTokenFile(app, settings.profile, env),
+                tokenFile: httpTokenFile(app, profile, env),
                 argv: ["mcp", "serve", "--http"],
-                childEnv: { [`${app.envPrefix}_PROFILE`]: settings.profile },
+                childEnv: { [`${app.envPrefix}_PROFILE`]: profile },
                 version: app.version,
             };
         },
-        answer: (self, item, lines) => renderAnswer(self, messengerContext(self, messenger, { needsProfile: false }), itemOf(item), () => lines.join("\n")),
+        answer: (self, item, lines) => renderAnswer(self, host.context(self, { needsProfile: false }), itemOf(item), () => lines.join("\n")),
         system: (self) => environmentOf(self).system,
     }));
-    command.addCommand(withFlags(annotate(new Command("config"), {
+    command.addCommand(withProfiles(flagged(annotate(new Command("config"), {
         effects: LOCAL_READ,
-        examples: [`${app.command} personal mcp config`],
+        examples: [`${app.command} personal mcp config`, `${app.command} mcp config --profiles all`],
     })
-        .summary("print the local MCP configuration, of this profile or of every profile")
-        .description("print the mcpServers entry for Claude Desktop, Cursor and others, with full paths; writes nothing")).action(async function () {
+        .summary("print the local MCP configuration of this profile, or of those --profiles names")
+        .description("print the mcpServers entry for Claude Desktop, Cursor and others, with full paths; writes nothing"))).action(async function () {
         const flags = this.optsWithGlobals();
-        const context = messengerContext(this, messenger, { needsProfile: false });
-        const { settings, env } = context;
+        const context = host.context(this, { needsProfile: false });
+        const { env } = context;
         const given = environmentOf(this).mcp ?? {};
-        const named = namedProfile(settings);
+        const served = servedProfiles(this, host, context, flags.profiles, "mcp config");
         const entry = serverEntry(app, {
-            ...(named === undefined ? {} : { profile: named }),
+            ...("set" in served ? { profiles: served.set.option } : { profile: served.profile }),
             flags,
             execPath: given.execPath ?? process.execPath,
             scriptPath: given.scriptPath ?? realpathSync(process.argv[1] ?? ""),
             env,
         });
         // Pasted into a file, so a person gets the client's own JSON, indented; a script finds it under `config`.
-        renderAnswer(this, context, itemOf({ config: entry.config }, { next: entry.nodeBound ? [nextStep("mcp.config", { args: {} })] : [] }), () => JSON.stringify(entry.config, null, 2));
+        renderAnswer(this, context, itemOf({ config: entry.config }, {
+            next: entry.nodeBound
+                ? [nextStep("mcp.config", { args: { profiles: "set" in served ? served.set.option : undefined } })]
+                : [],
+        }), () => JSON.stringify(entry.config, null, 2));
     }));
-    command.addCommand(withFlags(grantsAuthority(annotate(new Command("add"), {
+    command.addCommand(flagged(grantsAuthority(annotate(new Command("add"), {
         effects: LOCAL_WRITE,
         examples: [`${app.command} personal mcp add codex --allow-writes`],
     }))
@@ -142,7 +225,7 @@ export const mcpCommand = (messenger) => {
         .option("--allow-writes", "acknowledge that this profile offers writing tools")).action(async function (client) {
         if (client !== "codex" && client !== "claude-code")
             throw new CliError("validation_error", "choose codex or claude-code");
-        const context = messengerContext(this, messenger);
+        const context = host.context(this);
         const { settings, env } = context;
         const given = environmentOf(this).mcp ?? {};
         const configuration = serverEntry(app, {
@@ -167,11 +250,11 @@ export const mcpCommand = (messenger) => {
             throw new CliError("validation_error", error instanceof Error ? error.message : "MCP setup failed");
         }
     }));
-    command.addCommand(withFlags(annotate(new Command("check"), {
+    command.addCommand(flagged(annotate(new Command("check"), {
         effects: LOCAL_READ,
         examples: [`${app.command} personal mcp check`],
     }).description("check this profile's local MCP handshake and tool list")).action(async function () {
-        const context = messengerContext(this, messenger);
+        const context = host.context(this);
         const { settings, env } = context;
         const given = environmentOf(this).mcp ?? {};
         const configuration = serverEntry(app, {
@@ -190,8 +273,8 @@ export const mcpCommand = (messenger) => {
             const { tools, potentialWrites } = await probeStdio(entry, {
                 start: stderr.start,
             });
-            const account = messenger.accountOf?.(this) ?? recalledAccount(app, messenger.provider, settings.profile, env);
-            if (!account) {
+            const signedIn = host.signedIn(this, settings.profile, env);
+            if (signedIn === false) {
                 const setup = rootOf(this).commands.some((one) => one.name() === "setup")
                     ? ` — log in with \`${app.command} ${settings.profile} setup\``
                     : "";
@@ -199,9 +282,9 @@ export const mcpCommand = (messenger) => {
                     `tools will fail${setup}`);
             }
             renderAnswer(this, context, itemOf({
-                healthy: account !== undefined,
+                healthy: signedIn !== false,
                 profile: settings.profile,
-                signed_in: account !== undefined,
+                signed_in: signedIn ?? null,
                 tools: tools.length,
                 potential_writes: potentialWrites.length,
             }));
@@ -213,42 +296,44 @@ export const mcpCommand = (messenger) => {
     }));
     return command;
 };
+/** How the startup and status lines name a set, so the owner sees which accounts an agent reaches. */
+export const profileSetLabel = (set) => {
+    const names = set.profiles().join(", ");
+    if (set.option === EVERY_PROFILE)
+        return `every profile (${names || "none yet"})`;
+    return set.profiles().length === 1 ? `profile ${names}` : `profiles ${names}`;
+};
 /**
- * `<tool> mcp serve` with no profile: every profile on this computer, each call in that profile's own
- * `<tool> <profile> mcp serve`
- * (`src/mcp/all-profiles.ts`). Nothing picks a profile: each tool takes one, and the agent is told to ask.
+ * `<tool> mcp serve --profiles <names|all>`: those profiles from one server, each call in that profile's own
+ * `<tool> <profile> mcp serve` (`src/mcp/all-profiles.ts`). Nothing picks a profile: each tool takes one, and the
+ * agent is told to ask.
  */
-const serveEveryProfile = async (self, context, messenger, flags) => {
-    const { app } = messenger;
+const serveProfiles = async (self, context, host, flags, set) => {
+    const { app } = host;
     const { env } = context;
-    const tokenFile = httpTokenFile(app, ALL_PROFILES, env);
-    const state = (profile) => messenger.profileState?.(profile, env) ?? "signed-in";
-    // Read again for each session, so a profile set up while the server runs appears. A bot has its own server.
-    const profiles = () => messenger
-        .resolveSettings(self.optsWithGlobals(), { env, needsProfile: false, readOnly: true })
-        .profilesHere.filter((profile) => state(profile) !== "bot");
+    const tokenFile = httpTokenFile(app, set.key, env);
+    const state = (profile) => host.profileState?.(profile, env) ?? "signed-in";
+    const bots = set.option === EVERY_PROFILE ? [] : set.profiles().filter((profile) => state(profile) === "bot");
+    if (bots.length > 0)
+        throw new CliError("validation_error", `${bots.join(", ")} ${bots.length === 1 ? "is a bot profile" : "are bot profiles"}, served by \`${app.command} <profile> bot mcp serve\``);
+    // `all` reads the profiles again for each session, so one set up while the server runs appears.
+    const profiles = () => set.profiles().filter((profile) => state(profile) !== "bot");
     if (profiles().length === 0)
-        throw new CliError("configuration_error", `no ${app.command} profile on this computer yet — set one up, then run \`${app.command} mcp serve\` again`);
+        throw new CliError("configuration_error", `no ${app.command} profile on this computer yet — set one up, then run \`${app.command} mcp serve --profiles all\` again`);
     const given = environmentOf(self).mcp ?? {};
     const execPath = given.execPath ?? process.execPath;
     const scriptPath = given.scriptPath ?? realpathSync(process.argv[1] ?? "");
     const tightened = (flags.permission ?? []).flatMap((entry) => ["--permission", entry]);
-    const { instructions } = await import("../../mcp/instructions.js");
     const options = {
         command: app.command,
         version: app.version,
-        name: messenger.name ?? app.command,
+        name: host.name,
         profiles,
         signedIn: (profile) => state(profile) === "signed-in",
         signIn: (profile) => `profile ${profile} is not signed in — run \`${app.command} ${profile} setup\`, or sign in from WireCat Desktop, ` +
             "then try again. If the owner did not choose this profile, ask which one.",
         child: (profile) => ({ command: execPath, args: [scriptPath, profile, "mcp", "serve", ...tightened], env }),
-        instructions: instructions({
-            command: app.command,
-            name: messenger.name ?? app.command,
-            profile: profiles(),
-            writes: [],
-        }),
+        instructions: await host.instructions(profiles()),
         note: (line) => context.renderer.note(line),
     };
     if (flags.http) {
@@ -268,13 +353,13 @@ const serveEveryProfile = async (self, context, messenger, flags) => {
             version: app.version,
             onCode: (code, expires) => context.renderer.note(env[mcpHttpMarker(app.envPrefix)] === undefined
                 ? `login code for a new browser app: ${code} (until ${expires.toTimeString().slice(0, 5)}; a new one after each login)`
-                : `a new login code for a browser app: \`${app.command} mcp server status\``),
+                : `a new login code for a browser app: \`${app.command} mcp server status --profiles ${set.option}\``),
         }).catch((error) => {
             if (error.code === "EADDRINUSE")
                 throw new CliError("configuration_error", `port ${port} is in use — pass another with --port`);
             throw error;
         });
-        context.renderer.note(`serving every profile on ${listening.url.href} — point your tunnel at it; connectors use ${mcpUrlOf(publicUrl).href}`);
+        context.renderer.note(`serving ${profileSetLabel(set)} on ${listening.url.href} — point your tunnel at it; connectors use ${mcpUrlOf(publicUrl).href}`);
         await new Promise((resolve) => {
             process.once("SIGINT", resolve);
             process.once("SIGTERM", resolve);
@@ -283,6 +368,7 @@ const serveEveryProfile = async (self, context, messenger, flags) => {
         return;
     }
     const { serveAllProfilesOverStdio } = await import("../../mcp/all-profiles.js");
+    context.renderer.note(`serving ${profileSetLabel(set)} over MCP on stdin and stdout`);
     const { stdin, stdout, signal } = environmentOf(self);
     await serveAllProfilesOverStdio(options, {
         ...(stdin ? { stdin: stdin } : {}),
@@ -331,6 +417,14 @@ export const redactTail = (text, home) => {
     const lines = out.split("\n").filter((line) => line.trim() !== "");
     return lines.slice(-TAIL_LINES).join("\n").slice(-TAIL_BYTES);
 };
+/** `tg-work`; `tg` for every profile; `tg-personal-work` for a list, a name every client accepts. */
+const serverName = (app, profile, profiles) => {
+    if (profile !== undefined)
+        return `${app.command}-${profile}`;
+    if (profiles === EVERY_PROFILE)
+        return app.command;
+    return `${app.command}-${(profiles ?? "").split(",").join("-")}`;
+};
 const VERSION_MANAGER = /[\\/](\.nvm|nvm|\.fnm|fnm|fnm_multishells|\.volta|volta|\.asdf|mise)[\\/]/i;
 /**
  * `node` and the script by full path, on every platform: a client started from the desktop does
@@ -340,10 +434,13 @@ const VERSION_MANAGER = /[\\/](\.nvm|nvm|\.fnm|fnm|fnm_multishells|\.volta|volta
  * store. So is `XDG_RUNTIME_DIR`: the keyring is reached through it, and an MCP client that starts
  * servers with a trimmed environment leaves it out (measured 2026-09-28). Credentials are never copied.
  */
-export const serverEntry = (app, { profile, flags = {}, execPath, scriptPath, env, }) => {
+export const serverEntry = (app, { profile, profiles, flags = {}, execPath, scriptPath, env, }) => {
+    if ((profile === undefined) === (profiles === undefined))
+        throw new CliError("validation_error", "an MCP entry serves one profile or the profiles --profiles names");
+    const words = profile === undefined ? `mcp config --profiles ${profiles}` : `${profile} mcp config`;
     if (installerOf(scriptPath) === "npx") {
         throw new CliError("validation_error", `this ${app.command} runs from npx's cache, which gets cleared, and the path would stop working — ` +
-            `install it globally, then run \`${app.command} ${profile === undefined ? "" : `${profile} `}mcp config\` again`);
+            `install it globally, then run \`${app.command} ${words}\` again`);
     }
     const names = [
         ...["CONFIG_DIR", "STATE_DIR", "CACHE_DIR"].map((name) => envName(app, name)),
@@ -360,12 +457,13 @@ export const serverEntry = (app, { profile, flags = {}, execPath, scriptPath, en
             ...(profile === undefined ? [] : [profile]),
             "mcp",
             "serve",
+            ...(profiles === undefined ? [] : ["--profiles", profiles]),
             ...(flags.permission ?? []).flatMap((entry) => ["--permission", entry]),
         ],
         ...(Object.keys(directories).length > 0 ? { env: directories } : {}),
     };
     return {
-        config: { mcpServers: { [profile === undefined ? app.command : `${app.command}-${profile}`]: server } },
+        config: { mcpServers: { [serverName(app, profile, profiles)]: server } },
         /** The path belongs to one Node version of a version manager; switching Node breaks the entry. */
         nodeBound: VERSION_MANAGER.test(execPath),
     };