@yawlabs/mcp 0.58.3 → 0.59.0

package/dist/index.js

@@ -302,7 +302,7 @@ function unionBlocked(files) {
   }
   return touched ? [...set] : void 0;
 }
-async function loadMcphConfig(opts = {}) {
+async function loadYawMcpConfig(opts = {}) {
   const cwd = resolve(opts.cwd ?? process.cwd());
   const home = resolve(opts.home ?? homedir());
   const env = opts.env ?? process.env;
@@ -390,7 +390,7 @@ function toProfile(config) {
   return result;
 }
 async function loadEffectiveProfile(cwd, home) {
-  const config = await loadMcphConfig({ cwd, home });
+  const config = await loadYawMcpConfig({ cwd, home });
   return toProfile(config);
 }
 function isAllowed(rules, namespace) {
@@ -542,7 +542,7 @@ async function runBundlesCommand(opts = {}) {
     }
     return { exitCode: 0, lines };
   }
-  const config = await loadMcphConfig({
+  const config = await loadYawMcpConfig({
     cwd: opts.cwd,
     home: opts.home,
     env: opts.env
@@ -636,13 +636,15 @@ var COMPLETION_USAGE = `Usage: yaw-mcp completion <bash|zsh|fish|powershell>
   location for your shell:
 
     bash        yaw-mcp completion bash       > ~/.local/share/bash-completion/completions/yaw-mcp
-    zsh         yaw-mcp completion zsh        > "\${fpath[1]}/_mcph"    (must be on $fpath)
+    zsh         yaw-mcp completion zsh        > "\${fpath[1]}/_yaw-mcp"    (must be on $fpath)
     fish        yaw-mcp completion fish       > ~/.config/fish/completions/yaw-mcp.fish
     powershell  yaw-mcp completion powershell >> $PROFILE`;
 var INSTALL_CLIENTS = ["claude-code", "claude-desktop", "cursor", "vscode"];
 var SUBCOMMAND_SPEC = [
+  // Setup -- connect a client to yaw-mcp.
   {
     name: "install",
+    description: "Connect an MCP client to yaw-mcp",
     positional: [...INSTALL_CLIENTS],
     flags: [
       "--scope",
@@ -657,14 +659,59 @@ var SUBCOMMAND_SPEC = [
       "--all"
     ]
   },
-  { name: "doctor", flags: ["--json", "--help"] },
-  { name: "servers", flags: ["--json", "--help"] },
-  { name: "bundles", positional: ["list", "match"], flags: ["--json", "--help"] },
-  { name: "compliance", flags: ["--publish", "--help"] },
-  { name: "reset-learning", flags: ["--help"] },
-  { name: "completion", positional: ["bash", "zsh", "fish", "powershell"], flags: ["--help"] },
-  { name: "upgrade", flags: ["--run", "--json", "--help"] },
-  { name: "help", flags: [] }
+  // Local servers -- manage ~/.yaw-mcp/bundles.json (no account).
+  {
+    name: "add",
+    description: "Add a catalog server to bundles.json",
+    positional: ["<slug>"],
+    flags: ["--env", "--dry-run", "--json", "--catalog", "--help"]
+  },
+  { name: "remove", description: "Remove a local server", positional: ["<slug-or-namespace>"], flags: ["--help"] },
+  { name: "list", description: "List the servers yaw-mcp loads locally", flags: ["--json", "--help"] },
+  {
+    name: "try",
+    description: "Wire a one-off trial of a catalog server",
+    positional: ["<slug>"],
+    flags: ["--client", "--ttl", "--env", "--dry-run", "--base", "--help"]
+  },
+  { name: "try-cleanup", description: "Remove a wired trial", positional: ["<slug>"], flags: ["--base", "--help"] },
+  // Inspection.
+  { name: "doctor", description: "Print diagnostic of yaw-mcp setup", flags: ["--json", "--help"] },
+  { name: "servers", description: "List servers in your yaw.sh/mcp dashboard", flags: ["--json", "--help"] },
+  {
+    name: "bundles",
+    description: "Browse curated multi-server bundles",
+    positional: ["list", "match"],
+    flags: ["--json", "--help"]
+  },
+  // Maintenance.
+  { name: "upgrade", description: "Upgrade @yawlabs/mcp to the latest version", flags: ["--run", "--json", "--help"] },
+  { name: "reset-learning", description: "Clear cross-session learning history", flags: ["--help"] },
+  {
+    name: "completion",
+    description: "Print a shell completion script",
+    positional: ["bash", "zsh", "fish", "powershell"],
+    flags: ["--help"]
+  },
+  // Account / sync (Pro + Team).
+  { name: "login", description: "Authenticate with a Yaw MCP account", flags: ["--key", "--json", "--help"] },
+  { name: "logout", description: "Sign out of your account", flags: ["--json", "--help"] },
+  {
+    name: "sync",
+    description: "Sync bundles across machines",
+    positional: ["push", "pull", "status"],
+    flags: ["--key", "--json", "--help"]
+  },
+  { name: "stats", description: "Show usage statistics", flags: ["--key", "--limit", "--days", "--json", "--help"] },
+  {
+    name: "secrets",
+    description: "Manage stored secrets",
+    positional: ["set", "get", "list", "remove", "lock", "push", "pull"],
+    flags: ["--key", "--value", "--stdin", "--json", "--help"]
+  },
+  // Other.
+  { name: "compliance", description: "Run the compliance suite against a server", flags: ["--publish", "--help"] },
+  { name: "help", description: "Show usage", flags: [] }
 ];
 function parseCompletionArgs(argv) {
   if (argv.includes("--help") || argv.includes("-h")) {
@@ -737,7 +784,7 @@ ${posClause}
   return `# bash completion for yaw-mcp \u2014 generated by \`yaw-mcp completion bash\`
 # Install: save this to ~/.local/share/bash-completion/completions/yaw-mcp
 #          or source it from your .bashrc.
-_mcph() {
+_yaw-mcp() {
   local cur prev words cword
   cur="\${COMP_WORDS[COMP_CWORD]}"
   cword=$COMP_CWORD
@@ -751,24 +798,11 @@ _mcph() {
 ${cases}
   esac
 }
-complete -F _mcph yaw-mcp
+complete -F _yaw-mcp yaw-mcp
 `;
 }
 function renderZsh() {
-  const subcommandDescriptions = {
-    install: "Auto-edit an MCP client's config",
-    doctor: "Print diagnostic of yaw-mcp setup",
-    servers: "List servers in your yaw.sh/mcp dashboard",
-    bundles: "Browse curated multi-server bundles",
-    compliance: "Run the compliance suite against a server",
-    "reset-learning": "Clear cross-session learning history",
-    completion: "Print a shell completion script",
-    upgrade: "Upgrade @yawlabs/mcp to the latest version",
-    help: "Show usage"
-  };
-  const subcommandList = SUBCOMMAND_SPEC.map((s) => `    '${s.name}:${subcommandDescriptions[s.name] ?? ""}'`).join(
-    "\n"
-  );
+  const subcommandList = SUBCOMMAND_SPEC.map((s) => `    '${s.name}:${s.description}'`).join("\n");
   const argsCases = SUBCOMMAND_SPEC.map((spec) => {
     const lines = [`      ${spec.name})`];
     if (spec.positional) {
@@ -781,10 +815,10 @@ function renderZsh() {
   }).join("\n");
   return `#compdef yaw-mcp
 # zsh completion for yaw-mcp \u2014 generated by \`yaw-mcp completion zsh\`
-# Install: save this to a file on your $fpath named _mcph
-#          (e.g., ~/.zsh/completions/_mcph), then rebuild completions:
+# Install: save this to a file on your $fpath named _yaw-mcp
+#          (e.g., ~/.zsh/completions/_yaw-mcp), then rebuild completions:
 #            autoload -U compinit && compinit
-_mcph() {
+_yaw-mcp() {
   local context state line
   _arguments -C \\
     '1: :->cmd' \\
@@ -802,7 +836,7 @@ ${argsCases}
       ;;
   esac
 }
-_mcph "$@"
+_yaw-mcp "$@"
 `;
 }
 function renderFish() {
@@ -821,7 +855,8 @@ complete -c yaw-mcp -f`;
       }
     }
     for (const f of spec.flags) {
-      const long = f.replace(/^--/, "");
+      if (!f.startsWith("--")) continue;
+      const long = f.slice(2);
       flagLines.push(`complete -c yaw-mcp -n "__fish_seen_subcommand_from ${spec.name}" -l ${long}`);
     }
   }
@@ -1457,9 +1492,12 @@ function buildLaunchEntry(opts) {
   if (opts.token) entry.env = { YAW_MCP_TOKEN: opts.token };
   return entry;
 }
-var ENTRY_NAME = "yaw-mcp";
-var LEGACY_ENTRY_NAME = "mcp.hosting";
-var CLAUDE_CODE_ALLOW_PATTERN = "mcp__yaw_mcp__*";
+var ENTRY_NAME = "mcp";
+var LEGACY_ENTRY_NAMES = ["mcp.hosting", "mcph", "yaw-mcp"];
+function findLegacyEntry(container) {
+  return LEGACY_ENTRY_NAMES.find((n) => n in container) ?? null;
+}
+var CLAUDE_CODE_ALLOW_PATTERN = "mcp__mcp__*";
 function resolveClaudeCodeSettingsPath(scope, opts) {
   const { home, projectDir, claudeConfigDir } = opts;
   const cfgDir = claudeConfigDir && claudeConfigDir.length > 0 ? claudeConfigDir : null;
@@ -1599,6 +1637,101 @@ import { homedir as homedir4, hostname, userInfo } from "os";
 import { join as join5, resolve as resolve3 } from "path";
 import { request as request5 } from "undici";
 
+// src/catalog.ts
+var DEFAULT_CATALOG_URL = "https://yaw.sh/data/mcp-catalog.json";
+var FETCH_TIMEOUT_MS = 1e4;
+var ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function tokenizeCommand(cmd) {
+  const out = [];
+  let cur = "";
+  let has = false;
+  let quote = null;
+  for (const ch of cmd) {
+    if (quote) {
+      if (ch === quote) quote = null;
+      else cur += ch;
+      has = true;
+    } else if (ch === '"' || ch === "'") {
+      quote = ch;
+      has = true;
+    } else if (ch === " " || ch === "	" || ch === "\n" || ch === "\r") {
+      if (has) {
+        out.push(cur);
+        cur = "";
+        has = false;
+      }
+    } else {
+      cur += ch;
+      has = true;
+    }
+  }
+  if (has) out.push(cur);
+  return out;
+}
+async function defaultFetchCatalog(url = DEFAULT_CATALOG_URL) {
+  const ac = new AbortController();
+  const timer = setTimeout(() => ac.abort(), FETCH_TIMEOUT_MS);
+  let body;
+  try {
+    const res = await fetch(url, { signal: ac.signal, headers: { accept: "application/json" } });
+    if (!res.ok) {
+      throw new Error(`the Yaw MCP catalog at ${url} returned HTTP ${res.status}.`);
+    }
+    body = await res.json();
+  } catch (err) {
+    if (err instanceof Error && err.name === "AbortError") {
+      throw new Error(`timed out fetching the Yaw MCP catalog at ${url}.`);
+    }
+    throw err instanceof Error ? err : new Error(String(err));
+  } finally {
+    clearTimeout(timer);
+  }
+  const servers = body?.servers;
+  if (!Array.isArray(servers)) {
+    throw new Error(`the Yaw MCP catalog at ${url} was not in the expected shape.`);
+  }
+  return servers.filter(
+    (s) => typeof s === "object" && s !== null && typeof s.slug === "string"
+  );
+}
+async function resolveCatalogSlug(slug, opts = {}) {
+  const url = opts.catalogUrl ?? DEFAULT_CATALOG_URL;
+  const fetchCatalog = opts.fetchCatalog ?? defaultFetchCatalog;
+  const servers = await fetchCatalog(url);
+  const entry = servers.find((s) => s.slug === slug);
+  if (!entry) {
+    throw new Error(
+      `no server with slug "${slug}" in the Yaw MCP catalog. Browse https://yaw.sh/mcp/catalog/ for the list.`
+    );
+  }
+  const install = entry.install ?? {};
+  const runtime = typeof install.runtime === "string" ? install.runtime.toLowerCase() : "";
+  if (install.url || install.type === "remote" || /^(remote|https?|sse|url)$/.test(runtime)) {
+    throw new Error(`"${slug}" is a remote server -- add it from the Yaw MCP dashboard, not the local CLI.`);
+  }
+  const cmdStr = typeof install.command === "string" ? install.command.trim() : "";
+  if (!cmdStr) {
+    throw new Error(`catalog entry "${slug}" has no install command.`);
+  }
+  const tokens = tokenizeCommand(cmdStr);
+  if (tokens.length === 0) {
+    throw new Error(`catalog entry "${slug}" install command was empty.`);
+  }
+  const [command, ...args] = tokens;
+  const requiredEnvKeys = Array.isArray(entry.requiredEnv) ? entry.requiredEnv.map((e) => e && typeof e === "object" ? e.key : void 0).filter((k) => typeof k === "string" && ENV_KEY_RE.test(k)) : [];
+  const source = typeof entry.repo === "string" ? entry.repo : typeof entry.homepage === "string" ? entry.homepage : void 0;
+  return {
+    slug,
+    name: typeof entry.name === "string" && entry.name.trim() ? entry.name.trim() : slug,
+    command,
+    args,
+    requiredEnvKeys,
+    description: typeof entry.description === "string" ? entry.description : void 0,
+    source,
+    docUrl: source
+  };
+}
+
 // src/install-cmd.ts
 import { existsSync } from "fs";
 import { chmod, readFile as readFile3 } from "fs/promises";
@@ -1675,7 +1808,7 @@ ${USAGE}`);
   log2(`File:   ${resolved.absolute}`);
   let token5 = opts.token ?? null;
   if (!token5) {
-    const cfg = await loadMcphConfig({ home: opts.home, cwd: process.cwd(), env: {} });
+    const cfg = await loadYawMcpConfig({ home: opts.home, cwd: process.cwd(), env: {} });
     token5 = cfg.token;
   }
   if (!token5) {
@@ -1687,7 +1820,7 @@ ${USAGE}`);
   const containerPath = resolved.containerPath;
   let existing = {};
   let existingHasEntry = false;
-  let legacyPresent = false;
+  let legacyEntry = null;
   if (existsSync(resolved.absolute)) {
     let raw;
     try {
@@ -1717,7 +1850,7 @@ ${USAGE}`);
     if (typeof container === "object" && container !== null && !Array.isArray(container)) {
       const c = container;
       existingHasEntry = ENTRY_NAME in c;
-      legacyPresent = LEGACY_ENTRY_NAME in c;
+      legacyEntry = findLegacyEntry(c);
     }
   }
   if (existingHasEntry) {
@@ -1747,16 +1880,16 @@ ${USAGE}`);
   const merged = mergeClientConfig(existing, containerPath, newEntry);
   const clientJson = `${JSON.stringify(merged, null, 2)}
 `;
-  const writeMcphConfig = !opts.skipMcphConfig && token5 !== null;
+  const writeYawMcpConfig = !opts.skipYawMcpConfig && token5 !== null;
   const home = opts.home ?? homedir3();
-  const mcphConfigPath = join4(home, CONFIG_DIRNAME, CONFIG_FILENAME);
-  const mcphConfigComposed = writeMcphConfig ? await composeMcphConfig(mcphConfigPath, token5) : { json: "" };
-  if ("backupPath" in mcphConfigComposed && mcphConfigComposed.backupPath) {
+  const yawMcpConfigPath = join4(home, CONFIG_DIRNAME, CONFIG_FILENAME);
+  const yawMcpConfigComposed = writeYawMcpConfig ? await composeYawMcpConfig(yawMcpConfigPath, token5) : { json: "" };
+  if ("backupPath" in yawMcpConfigComposed && yawMcpConfigComposed.backupPath) {
     log2(
-      `yaw-mcp install: existing ${mcphConfigPath} was malformed; original bytes backed up to ${mcphConfigComposed.backupPath} before overwriting.`
+      `yaw-mcp install: existing ${yawMcpConfigPath} was malformed; original bytes backed up to ${yawMcpConfigComposed.backupPath} before overwriting.`
     );
   }
-  const mcphConfigJson = mcphConfigComposed.json;
+  const yawMcpConfigJson = yawMcpConfigComposed.json;
   const settingsPatch = opts.clientId === "claude-code" ? await prepareClaudeCodeSettingsPatch({
     scope,
     home,
@@ -1766,40 +1899,40 @@ ${USAGE}`);
   }) : null;
   if (opts.dryRun) {
     log2("\n--- dry run: would write the following ---");
-    if (writeMcphConfig) log2(`# ${mcphConfigPath}
-${mcphConfigJson}`);
+    if (writeYawMcpConfig) log2(`# ${yawMcpConfigPath}
+${yawMcpConfigJson}`);
     log2(`
 # ${resolved.absolute}
 ${clientJson}`);
     if (settingsPatch?.changed) log2(`# ${settingsPatch.path}
 ${settingsPatch.nextJson}`);
-    if (legacyPresent) {
+    if (legacyEntry) {
       log2(
-        `Note: legacy "${LEGACY_ENTRY_NAME}" entry at ${resolved.absolute} would remain \u2014 remove it to avoid running yaw-mcp twice.`
+        `Note: legacy "${legacyEntry}" entry at ${resolved.absolute} would remain \u2014 remove it to avoid running yaw-mcp twice.`
       );
     }
     const wouldWrite = [];
-    if (writeMcphConfig) wouldWrite.push(mcphConfigPath);
+    if (writeYawMcpConfig) wouldWrite.push(yawMcpConfigPath);
     wouldWrite.push(resolved.absolute);
     if (settingsPatch?.changed) wouldWrite.push(settingsPatch.path);
     return { written: [], wouldWrite, messages, exitCode: 0 };
   }
   const written = [];
-  if (writeMcphConfig) {
+  if (writeYawMcpConfig) {
     try {
-      await atomicWriteFile(mcphConfigPath, mcphConfigJson);
+      await atomicWriteFile(yawMcpConfigPath, yawMcpConfigJson);
       if (process.platform !== "win32") {
         try {
-          await chmod(mcphConfigPath, 384);
+          await chmod(yawMcpConfigPath, 384);
         } catch {
         }
       }
     } catch (e) {
-      err(`yaw-mcp install: failed to write ${mcphConfigPath}: ${e.message}`);
+      err(`yaw-mcp install: failed to write ${yawMcpConfigPath}: ${e.message}`);
       return { written: [], wouldWrite: [], messages, exitCode: 1 };
     }
-    log2(`Wrote ${mcphConfigPath}`);
-    written.push(mcphConfigPath);
+    log2(`Wrote ${yawMcpConfigPath}`);
+    written.push(yawMcpConfigPath);
   }
   try {
     await atomicWriteFile(resolved.absolute, clientJson);
@@ -1821,9 +1954,9 @@ ${settingsPatch.nextJson}`);
     }
   }
   if (target.notes) log2(`Note: ${target.notes}`);
-  if (legacyPresent) {
+  if (legacyEntry) {
     log2(
-      `Note: legacy "${LEGACY_ENTRY_NAME}" entry remains at ${resolved.absolute}. Remove it to avoid running yaw-mcp twice.`
+      `Note: legacy "${legacyEntry}" entry remains at ${resolved.absolute}. Remove it to avoid running yaw-mcp twice.`
     );
   }
   log2(`
@@ -1861,14 +1994,14 @@ async function prepareClaudeCodeSettingsPatch(opts) {
   return { path: path3, nextJson: `${JSON.stringify(merged, null, 2)}
 `, changed: true };
 }
-var LEGACY_CLAUDE_CODE_ALLOW_PATTERN = "mcp__mcp_hosting__*";
+var LEGACY_CLAUDE_CODE_ALLOW_PATTERNS = ["mcp__mcp_hosting__*", "mcp__yaw_mcp__*"];
 function mergePermissionsAllow(existing, patterns) {
   const out = { ...existing };
   const prev = out.permissions;
   const perms = typeof prev === "object" && prev !== null && !Array.isArray(prev) ? { ...prev } : {};
   const prevAllow = perms.allow;
   const allow = Array.isArray(prevAllow) ? prevAllow.filter(
-    (x) => typeof x === "string" && x !== LEGACY_CLAUDE_CODE_ALLOW_PATTERN
+    (x) => typeof x === "string" && !LEGACY_CLAUDE_CODE_ALLOW_PATTERNS.includes(x)
   ) : [];
   for (const p of patterns) {
     if (!allow.includes(p)) allow.push(p);
@@ -1943,7 +2076,7 @@ function removeFromClientConfig(existing, containerPath, entryName) {
   parent[leafKey] = container;
   return out;
 }
-async function composeMcphConfig(path3, token5) {
+async function composeYawMcpConfig(path3, token5) {
   let existing = {};
   let backupPath;
   if (existsSync(path3)) {
@@ -2019,7 +2152,7 @@ function parseInstallArgs(argv) {
         opts.dryRun = true;
         break;
       case "--no-yaw-mcp-config":
-        opts.skipMcphConfig = true;
+        opts.skipYawMcpConfig = true;
         break;
       case "--list":
         opts.listOnly = true;
@@ -2070,7 +2203,7 @@ async function runInstallList(opts, log2) {
     path: displayPath(p.path, home),
     status: statusFor(p)
   }));
-  const installed = probes.filter((p) => p.hasMcphEntry).length;
+  const installed = probes.filter((p) => p.hasMcpEntry).length;
   const available = probes.filter((p) => !p.unavailable).length;
   log2(`${installed}/${available} client scopes have yaw-mcp configured on ${os}.`);
   log2("");
@@ -2095,7 +2228,7 @@ async function runInstallList(opts, log2) {
 function statusFor(p) {
   if (p.unavailable) return "unavailable";
   if (p.malformed) return "malformed";
-  if (p.hasMcphEntry) return "installed";
+  if (p.hasMcpEntry) return "installed";
   if (p.exists) return "other-entries";
   return "not installed";
 }
@@ -2197,8 +2330,9 @@ var TRY_USAGE = `Usage: yaw-mcp try <slug> [flags]
                        Required env vars not supplied here AND not in your
                        shell's env block the trial with an explainer.
   --dry-run            Print what would happen without writing anything.
-  --base <url>         Override the explore endpoint base (default:
-                       $YAW_MCP_BASE_URL or https://yaw.sh/mcp).`;
+  --base <url>         Base URL for the signup/telemetry links (default:
+                       $YAW_MCP_BASE_URL or https://yaw.sh/mcp). The catalog
+                       itself is set via $YAW_MCP_CATALOG_URL.`;
 var TRY_CLEANUP_USAGE = `Usage: yaw-mcp try-cleanup <slug>
 
   Remove a previously-wired trial: peels the yaw-mcp-try-<slug> entry out of
@@ -2348,44 +2482,16 @@ async function loadOrCreateAnonId(home = homedir4()) {
   }
   return id;
 }
-async function defaultFetchExplore(baseUrl, slug) {
-  const url = `${baseUrl.replace(/\/$/, "")}/api/explore/${encodeURIComponent(slug)}`;
-  const ac = new AbortController();
-  const timer = setTimeout(() => ac.abort(), 1e4);
-  try {
-    const res = await fetch(url, { signal: ac.signal, headers: { accept: "application/json" } });
-    if (res.status === 404) {
-      throw new Error(`yaw-mcp try: no server with slug "${slug}" \u2014 check ${baseUrl}/explore for the catalog.`);
-    }
-    if (!res.ok) {
-      throw new Error(`yaw-mcp try: ${url} returned HTTP ${res.status}`);
-    }
-    const body = await res.json();
-    return validateExploreResponse(body, slug);
-  } finally {
-    clearTimeout(timer);
-  }
-}
-function validateExploreResponse(body, slug) {
-  if (!body || typeof body !== "object") {
-    throw new Error(`yaw-mcp try: /api/explore/${slug} returned a non-object response.`);
-  }
-  const b = body;
-  if (typeof b.slug !== "string" || typeof b.name !== "string" || typeof b.command !== "string") {
-    throw new Error(`yaw-mcp try: /api/explore/${slug} missing required string fields (slug/name/command).`);
-  }
-  if (!Array.isArray(b.args) || !b.args.every((x) => typeof x === "string")) {
-    throw new Error(`yaw-mcp try: /api/explore/${slug} has invalid args (expected string[]).`);
-  }
-  const req = Array.isArray(b.requiredEnvVars) ? b.requiredEnvVars.filter((x) => typeof x === "string") : [];
+async function defaultFetchExplore(_baseUrl, slug) {
+  const resolved = await resolveCatalogSlug(slug, { catalogUrl: process.env.YAW_MCP_CATALOG_URL });
   const out = {
-    slug: b.slug,
-    name: b.name,
-    command: b.command,
-    args: b.args,
-    requiredEnvVars: req
+    slug: resolved.slug,
+    name: resolved.name,
+    command: resolved.command,
+    args: resolved.args,
+    requiredEnvVars: resolved.requiredEnvKeys
   };
-  if (typeof b.docUrl === "string") out.docUrl = b.docUrl;
+  if (resolved.docUrl) out.docUrl = resolved.docUrl;
   return out;
 }
 async function defaultPostEvent(baseUrl, body) {
@@ -2771,7 +2877,7 @@ function selectFlakyNamespaces(entries, limit) {
 }
 
 // src/doctor-cmd.ts
-var VERSION = true ? "0.58.3" : "dev";
+var VERSION = true ? "0.59.0" : "dev";
 async function runDoctor(opts = {}) {
   if (opts.json) return runDoctorJson(opts);
   const lines = [];
@@ -2789,7 +2895,7 @@ async function runDoctor(opts = {}) {
   print(`yaw-mcp version: ${VERSION}`);
   print(`platform: ${os}`);
   print("");
-  const config = await loadMcphConfig({ cwd, home, env });
+  const config = await loadYawMcpConfig({ cwd, home, env });
   print("CONFIG FILES");
   if (config.loadedFiles.length === 0) {
     print("  (none \u2014 using defaults + env)");
@@ -2852,10 +2958,8 @@ async function runDoctor(opts = {}) {
   let exitCode = 0;
   if (config.token === null) {
     print("DIAGNOSIS");
-    print("  Local mode (Free) \u2014 no account token resolved. yaw-mcp runs fine and serves");
+    print("  Local mode (Free) -- fully functional, no account needed. yaw-mcp serves");
     print("  whatever servers are configured locally in ~/.yaw-mcp/bundles.json.");
-    print("  Sign in with `yaw-mcp login` (or set YAW_MCP_TOKEN) to add account-synced");
-    print("  servers and compliance grades.");
   } else if (config.warnings.length > 0) {
     exitCode = 2;
     print("DIAGNOSIS");
@@ -2876,7 +2980,7 @@ async function runDoctorJson(opts) {
   const os = opts.os ?? CURRENT_OS;
   const env = opts.env ?? process.env;
   const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-  const config = await loadMcphConfig({ cwd, home, env });
+  const config = await loadYawMcpConfig({ cwd, home, env });
   const claudeConfigDir = env.CLAUDE_CONFIG_DIR && env.CLAUDE_CONFIG_DIR.length > 0 ? env.CLAUDE_CONFIG_DIR : void 0;
   const clients = probeClients({ home, os, cwd, claudeConfigDir });
   const envVarNames = [
@@ -2930,7 +3034,7 @@ async function runDoctorJson(opts) {
   let exitCode = 0;
   let summary;
   if (config.token === null) {
-    summary = "Local mode (Free) \u2014 running without an account token. Sign in with `yaw-mcp login` for account-synced servers.";
+    summary = "Local mode (Free) -- fully functional, no account needed.";
   } else if (config.warnings.length > 0) {
     exitCode = 2;
     summary = "Token present, but warnings need attention.";
@@ -3116,12 +3220,12 @@ function schemaSuffix(f) {
 function renderClientStatus(c, installCmd) {
   if (c.unavailable) return "unavailable on this OS";
   if (c.malformed) return "exists but JSON is malformed \u2014 fix or rerun `yaw-mcp install`";
-  if (c.hasMcphEntry && c.hasLegacyEntry) {
-    return `OK \u2014 has "${ENTRY_NAME}" entry; legacy "${LEGACY_ENTRY_NAME}" entry also present \u2014 remove it to avoid running yaw-mcp twice`;
+  if (c.hasMcpEntry && c.hasLegacyEntry) {
+    return `OK \u2014 has "${ENTRY_NAME}" entry; legacy "${c.legacyEntryName}" entry also present \u2014 remove it to avoid running yaw-mcp twice`;
   }
-  if (c.hasMcphEntry) return `OK \u2014 has "${ENTRY_NAME}" entry`;
+  if (c.hasMcpEntry) return `OK \u2014 has "${ENTRY_NAME}" entry`;
   if (c.hasLegacyEntry) {
-    return `legacy "${LEGACY_ENTRY_NAME}" entry present \u2014 run \`${installCmd}\` to migrate, then remove the legacy entry by hand`;
+    return `legacy "${c.legacyEntryName}" entry present \u2014 run \`${installCmd}\` to migrate, then remove the legacy entry by hand`;
   }
   if (c.exists) return `present, no "${ENTRY_NAME}" entry \u2014 run \`${installCmd}\``;
   return `not configured \u2014 run \`${installCmd}\``;
@@ -3136,8 +3240,9 @@ function probeClients(opts) {
         scope: target.scopes[0].scope,
         path: "(n/a)",
         exists: false,
-        hasMcphEntry: false,
+        hasMcpEntry: false,
         hasLegacyEntry: false,
+        legacyEntryName: null,
         malformed: false,
         unavailable: true
       });
@@ -3158,8 +3263,9 @@ function probeClients(opts) {
         continue;
       }
       const exists3 = existsSync3(resolved.absolute);
-      let hasMcphEntry = false;
+      let hasMcpEntry = false;
       let hasLegacyEntry = false;
+      let legacyEntryName = null;
       let malformed = false;
       if (exists3) {
         try {
@@ -3170,8 +3276,9 @@ function probeClients(opts) {
             if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
               const container = walkContainer(parsed, resolved.containerPath);
               if (container) {
-                hasMcphEntry = ENTRY_NAME in container;
-                hasLegacyEntry = LEGACY_ENTRY_NAME in container;
+                hasMcpEntry = ENTRY_NAME in container;
+                legacyEntryName = findLegacyEntry(container);
+                hasLegacyEntry = legacyEntryName !== null;
               }
             } else {
               malformed = true;
@@ -3186,8 +3293,9 @@ function probeClients(opts) {
         scope: scope.scope,
         path: resolved.absolute,
         exists: exists3,
-        hasMcphEntry,
+        hasMcpEntry,
         hasLegacyEntry,
+        legacyEntryName,
         malformed,
         unavailable: false
       });
@@ -3214,8 +3322,9 @@ async function probeClientsAsync(opts) {
         scope: target.scopes[0].scope,
         path: "(n/a)",
         exists: false,
-        hasMcphEntry: false,
+        hasMcpEntry: false,
         hasLegacyEntry: false,
+        legacyEntryName: null,
         malformed: false,
         unavailable: true
       });
@@ -3231,8 +3340,9 @@ async function probeClientsAsync(opts) {
         claudeConfigDir: opts.claudeConfigDir
       });
       const exists3 = existsSync3(resolved.absolute);
-      let hasMcphEntry = false;
+      let hasMcpEntry = false;
       let hasLegacyEntry = false;
+      let legacyEntryName = null;
       let malformed = false;
       if (exists3) {
         try {
@@ -3242,8 +3352,9 @@ async function probeClientsAsync(opts) {
             if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
               const container = walkContainer(parsed, resolved.containerPath);
               if (container) {
-                hasMcphEntry = ENTRY_NAME in container;
-                hasLegacyEntry = LEGACY_ENTRY_NAME in container;
+                hasMcpEntry = ENTRY_NAME in container;
+                legacyEntryName = findLegacyEntry(container);
+                hasLegacyEntry = legacyEntryName !== null;
               }
             } else {
               malformed = true;
@@ -3258,8 +3369,9 @@ async function probeClientsAsync(opts) {
         scope: scope.scope,
         path: resolved.absolute,
         exists: exists3,
-        hasMcphEntry,
+        hasMcpEntry,
         hasLegacyEntry,
+        legacyEntryName,
         malformed,
         unavailable: false
       });
@@ -3441,10 +3553,470 @@ function closestNames(query, candidates, limit) {
   return scored.slice(0, limit).map((s) => s.name);
 }
 
+// src/local-add-cmd.ts
+import { homedir as homedir7 } from "os";
+
+// src/local-bundles.ts
+import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync4 } from "fs";
+import { readFile as readFile6 } from "fs/promises";
+import { homedir as homedir6 } from "os";
+import { join as join7 } from "path";
+var BUNDLES_FILENAME = "bundles.json";
+var CURRENT_BUNDLES_SCHEMA_VERSION = 1;
+function localBundlesPath(configDir) {
+  return join7(configDir, BUNDLES_FILENAME);
+}
+var NAMESPACE_RE = /^[a-z][a-z0-9_]{0,29}$/;
+function validateEntry(entry, warnings) {
+  if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+    warnings.push("bundles.json: skipping non-object server entry");
+    return null;
+  }
+  const e = entry;
+  const namespace = typeof e.namespace === "string" ? e.namespace : "";
+  if (!namespace || !NAMESPACE_RE.test(namespace)) {
+    warnings.push(`bundles.json: skipping server with invalid namespace ${JSON.stringify(namespace)}`);
+    return null;
+  }
+  const name = typeof e.name === "string" && e.name.length > 0 ? e.name : namespace;
+  const type = e.type === "remote" ? "remote" : "local";
+  const transport = e.transport === "streamable-http" || e.transport === "sse" || e.transport === "stdio" ? e.transport : void 0;
+  const command = typeof e.command === "string" ? e.command : void 0;
+  const args = Array.isArray(e.args) ? e.args.filter((a) => typeof a === "string") : void 0;
+  const env = e.env && typeof e.env === "object" && !Array.isArray(e.env) ? Object.fromEntries(
+    Object.entries(e.env).filter(([, v]) => typeof v === "string")
+  ) : void 0;
+  const url = typeof e.url === "string" ? e.url : void 0;
+  const description = typeof e.description === "string" ? e.description : void 0;
+  const isActive = e.isActive !== false;
+  const id = typeof e.id === "string" && e.id.length > 0 ? e.id : `local-${namespace}`;
+  return {
+    id,
+    name,
+    namespace,
+    type,
+    transport,
+    command,
+    args,
+    env,
+    url,
+    isActive,
+    description
+  };
+}
+async function readBundlesAt(path3, warnings) {
+  let raw;
+  try {
+    raw = await readFile6(path3, "utf8");
+  } catch {
+    return { exists: false, file: null };
+  }
+  let parsed;
+  try {
+    parsed = parseJsonc(raw);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    warnings.push(`${path3}: invalid JSON (${msg}) -- file ignored`);
+    log("warn", "bundles.json is not valid JSON; ignoring", { path: path3, error: msg });
+    return { exists: true, file: null };
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    warnings.push(`${path3}: root must be a JSON object -- file ignored`);
+    return { exists: true, file: null };
+  }
+  const obj = parsed;
+  const version = typeof obj.version === "number" ? obj.version : void 0;
+  if (version !== void 0 && version > CURRENT_BUNDLES_SCHEMA_VERSION) {
+    warnings.push(
+      `${path3}: schema version ${version} is newer than this yaw-mcp (${CURRENT_BUNDLES_SCHEMA_VERSION}); upgrade with \`npm i -g @yawlabs/mcp@latest\`. Loading best-effort.`
+    );
+  }
+  const rawServers = obj.servers;
+  if (!Array.isArray(rawServers)) {
+    warnings.push(`${path3}: 'servers' must be an array -- file ignored`);
+    return { exists: true, file: null };
+  }
+  return {
+    exists: true,
+    file: { version, servers: rawServers }
+  };
+}
+function hashContent(servers) {
+  const h = createHash2("sha256");
+  h.update(JSON.stringify(servers));
+  return `local-${h.digest("hex").slice(0, 16)}`;
+}
+async function loadLocalBundles(opts = {}) {
+  const cwd = opts.cwd ?? process.cwd();
+  const home = opts.home ?? homedir6();
+  const warnings = [];
+  const projectDir = await findProjectConfigDir(cwd, home).catch(() => null);
+  const projectPath = projectDir ? localBundlesPath(projectDir) : null;
+  const globalPath = localBundlesPath(join7(home, CONFIG_DIRNAME));
+  const projectResult = projectPath ? await readBundlesAt(projectPath, warnings) : { exists: false, file: null };
+  let file;
+  let sourcePath;
+  if (projectResult.exists) {
+    file = projectResult.file;
+    sourcePath = projectPath;
+  } else {
+    const globalResult = await readBundlesAt(globalPath, warnings);
+    file = globalResult.file;
+    sourcePath = globalResult.exists ? globalPath : null;
+  }
+  if (!file) {
+    return { config: null, path: sourcePath, warnings };
+  }
+  const servers = [];
+  for (const raw of file.servers) {
+    const validated = validateEntry(raw, warnings);
+    if (validated) servers.push(validated);
+  }
+  return {
+    config: {
+      servers,
+      configVersion: hashContent(servers)
+    },
+    path: sourcePath,
+    warnings
+  };
+}
+function deriveNamespace(name) {
+  let ns = name.toLowerCase().replace(/[^a-z0-9]+/g, "");
+  if (ns.length === 0) return "server";
+  if (!/^[a-z]/.test(ns)) ns = `s${ns}`;
+  if (ns.length > 30) ns = ns.slice(0, 30);
+  return ns;
+}
+async function readRawUserBundles(home) {
+  const path3 = localBundlesPath(userConfigDir(home));
+  if (!existsSync4(path3)) {
+    return { version: CURRENT_BUNDLES_SCHEMA_VERSION, servers: [] };
+  }
+  const warnings = [];
+  const r = await readBundlesAt(path3, warnings);
+  if (!r.file) {
+    const detail = warnings.length > 0 ? ` (${warnings.join("; ")})` : "";
+    throw new Error(`${path3} is malformed${detail}; fix it by hand before adding servers.`);
+  }
+  return { version: r.file.version ?? CURRENT_BUNDLES_SCHEMA_VERSION, servers: r.file.servers };
+}
+async function upsertUserBundle(entry, opts = {}) {
+  const home = opts.home ?? homedir6();
+  const path3 = localBundlesPath(userConfigDir(home));
+  const file = await readRawUserBundles(home);
+  const idx = file.servers.findIndex(
+    (s) => s?.namespace === entry.namespace || entry.name != null && s?.name === entry.name
+  );
+  const replaced = idx >= 0;
+  if (replaced) file.servers[idx] = entry;
+  else file.servers.push(entry);
+  file.version = file.version ?? CURRENT_BUNDLES_SCHEMA_VERSION;
+  await atomicWriteFile(path3, `${JSON.stringify(file, null, 2)}
+`);
+  return { path: path3, replaced };
+}
+async function removeUserBundle(namespace, opts = {}) {
+  const home = opts.home ?? homedir6();
+  const path3 = localBundlesPath(userConfigDir(home));
+  if (!existsSync4(path3)) return { path: path3, removed: false };
+  const file = await readRawUserBundles(home);
+  const before = file.servers.length;
+  file.servers = file.servers.filter((s) => s?.namespace !== namespace);
+  if (file.servers.length === before) return { path: path3, removed: false };
+  file.version = file.version ?? CURRENT_BUNDLES_SCHEMA_VERSION;
+  await atomicWriteFile(path3, `${JSON.stringify(file, null, 2)}
+`);
+  return { path: path3, removed: true };
+}
+async function findShadowingProjectBundles(cwd, home = homedir6()) {
+  const projectDir = await findProjectConfigDir(cwd, home).catch(() => null);
+  if (!projectDir) return null;
+  const projectPath = localBundlesPath(projectDir);
+  return existsSync4(projectPath) ? projectPath : null;
+}
+
+// src/local-add-cmd.ts
+var SLUG_RE = /^[a-z0-9][a-z0-9-]{0,63}$/;
+var ADD_USAGE = `Usage: yaw-mcp add <slug> [flags]
+
+  Resolve <slug> from the yaw.sh/mcp catalog and add it to your local
+  ~/.yaw-mcp/bundles.json so yaw-mcp loads it (no account needed).
+
+  This is NOT the same as \`yaw-mcp install\` -- install wires the yaw-mcp
+  aggregator into an AI client; add adds an MCP server to yaw-mcp itself.
+
+  --env KEY=value   Provide a required env var's value. Repeatable. Required
+                    vars not given here AND not in your shell block the add.
+  --dry-run         Print what would be written without writing.
+  --json            Emit the written entry as JSON (implies success on stdout).
+  --catalog <url>   Override the catalog URL (default the public catalog).`;
+function parseEnvFlag(v, bag) {
+  if (!v || !v.includes("=")) return "--env requires KEY=value";
+  const eq = v.indexOf("=");
+  const key = v.slice(0, eq);
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) return `--env: invalid KEY "${key}"`;
+  bag[key] = v.slice(eq + 1);
+  return null;
+}
+function parseAddArgs(argv) {
+  if (argv.length === 0) return { ok: false, error: ADD_USAGE };
+  const positional = [];
+  const opts = {};
+  const env = {};
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    const next = () => argv[++i];
+    switch (a) {
+      case "--env": {
+        const e = parseEnvFlag(next(), env);
+        if (e) return { ok: false, error: e };
+        break;
+      }
+      case "--dry-run":
+        opts.dryRun = true;
+        break;
+      case "--json":
+        opts.json = true;
+        break;
+      case "--catalog": {
+        const v = next();
+        if (!v) return { ok: false, error: "--catalog requires a URL" };
+        opts.catalogUrl = v;
+        break;
+      }
+      case "-h":
+      case "--help":
+        return { ok: false, error: ADD_USAGE };
+      default:
+        if (a.startsWith("--")) return { ok: false, error: `Unknown flag: ${a}
+${ADD_USAGE}` };
+        positional.push(a);
+    }
+  }
+  if (positional.length !== 1) {
+    return { ok: false, error: `Expected exactly one server slug, got ${positional.length}.
+${ADD_USAGE}` };
+  }
+  opts.slug = positional[0];
+  if (Object.keys(env).length > 0) opts.envOverrides = env;
+  return { ok: true, options: opts };
+}
+async function runAdd(opts) {
+  const out = opts.out ?? ((s) => process.stdout.write(s));
+  const err = opts.err ?? ((s) => process.stderr.write(s));
+  const print = (s = "") => out(`${s}
+`);
+  const printErr = (s) => err(`${s}
+`);
+  if (!opts.slug) {
+    printErr(ADD_USAGE);
+    return { exitCode: 2, written: [] };
+  }
+  const slug = opts.slug;
+  if (!SLUG_RE.test(slug)) {
+    printErr(`yaw-mcp add: invalid slug "${slug}" (lowercase letters, digits, and dashes only).`);
+    return { exitCode: 2, written: [] };
+  }
+  const env = opts.env ?? process.env;
+  const home = opts.home ?? homedir7();
+  const cwd = opts.cwd ?? process.cwd();
+  let server;
+  try {
+    server = await resolveCatalogSlug(slug, {
+      catalogUrl: opts.catalogUrl ?? env.YAW_MCP_CATALOG_URL,
+      fetchCatalog: opts.fetchCatalog
+    });
+  } catch (e) {
+    printErr(`yaw-mcp add: ${e.message}`);
+    return { exitCode: 1, written: [] };
+  }
+  const namespace = deriveNamespace(server.name);
+  const supplied = { ...env, ...opts.envOverrides ?? {} };
+  const missing = server.requiredEnvKeys.filter((k) => !supplied[k] || supplied[k] === "");
+  if (missing.length > 0) {
+    printErr(`yaw-mcp add: ${server.name} needs the following env var(s) before it can run:`);
+    for (const k of missing) printErr(`  - ${k}`);
+    printErr("");
+    printErr("Provide them with --env KEY=value (repeatable) or your shell, then re-run:");
+    printErr(`  yaw-mcp add ${slug} ${missing.map((k) => `--env ${k}=...`).join(" ")}`);
+    if (server.docUrl) printErr(`Docs: ${server.docUrl}`);
+    return { exitCode: 1, written: [] };
+  }
+  const entryEnv = {};
+  for (const k of server.requiredEnvKeys) entryEnv[k] = "";
+  for (const [k, v] of Object.entries(opts.envOverrides ?? {})) entryEnv[k] = v;
+  const entry = {
+    id: `local-${namespace}`,
+    name: server.name,
+    namespace,
+    type: "local",
+    transport: "stdio",
+    command: server.command,
+    args: server.args,
+    env: Object.keys(entryEnv).length > 0 ? entryEnv : void 0,
+    isActive: true,
+    description: server.description
+  };
+  if (opts.dryRun) {
+    if (opts.json) {
+      print(JSON.stringify({ ok: true, dryRun: true, namespace, entry }, null, 2));
+    } else {
+      print(`yaw-mcp add (dry-run): would write ${server.name} as namespace "${namespace}"`);
+      print(`  command: ${entry.command} ${(entry.args ?? []).join(" ")}`);
+      if (entry.env) print(`  env keys: ${Object.keys(entry.env).join(", ")}`);
+    }
+    return { exitCode: 0, written: [] };
+  }
+  let res;
+  try {
+    res = await upsertUserBundle(entry, { home });
+  } catch (e) {
+    printErr(`yaw-mcp add: ${e.message}`);
+    return { exitCode: 1, written: [] };
+  }
+  if (opts.json) {
+    print(JSON.stringify({ ok: true, namespace, path: res.path, replaced: res.replaced, entry }, null, 2));
+  } else {
+    print(`${res.replaced ? "Updated" : "Added"} ${server.name} (namespace "${namespace}") in ${res.path}`);
+    print("Restart your MCP client (or yaw-mcp) to pick it up.");
+  }
+  const shadow = await findShadowingProjectBundles(cwd, home).catch(() => null);
+  if (shadow) {
+    printErr(
+      `Note: ${shadow} overrides your user-global bundles.json, so this entry won't load until you add it there or remove that file.`
+    );
+  }
+  return { exitCode: 0, written: [res.path] };
+}
+var REMOVE_USAGE = `Usage: yaw-mcp remove <slug-or-namespace>
+
+  Remove a server from your local ~/.yaw-mcp/bundles.json. Accepts either the
+  catalog slug it was added with (e.g. "brave-search") or its namespace as
+  shown by \`yaw-mcp list\` (e.g. "bravesearch"). No-op if it isn't present.`;
+var REMOVE_TARGET_RE = /^[a-z0-9][a-z0-9_-]{0,63}$/i;
+function parseRemoveArgs(argv) {
+  if (argv.length === 0) return { ok: false, error: REMOVE_USAGE };
+  const positional = [];
+  for (const a of argv) {
+    if (a === "-h" || a === "--help") return { ok: false, error: REMOVE_USAGE };
+    if (a.startsWith("--")) return { ok: false, error: `Unknown flag: ${a}
+${REMOVE_USAGE}` };
+    positional.push(a);
+  }
+  if (positional.length !== 1) {
+    return { ok: false, error: `Expected exactly one slug or namespace.
+${REMOVE_USAGE}` };
+  }
+  return { ok: true, options: { target: positional[0] } };
+}
+async function runRemove(opts) {
+  const out = opts.out ?? ((s) => process.stdout.write(s));
+  const err = opts.err ?? ((s) => process.stderr.write(s));
+  const print = (s = "") => out(`${s}
+`);
+  const printErr = (s) => err(`${s}
+`);
+  if (!opts.target) {
+    printErr(REMOVE_USAGE);
+    return { exitCode: 2, written: [] };
+  }
+  if (!REMOVE_TARGET_RE.test(opts.target)) {
+    printErr(`yaw-mcp remove: "${opts.target}" isn't a valid slug or namespace.`);
+    return { exitCode: 2, written: [] };
+  }
+  const home = opts.home ?? homedir7();
+  const cwd = opts.cwd ?? process.cwd();
+  const derived = deriveNamespace(opts.target);
+  const candidates = derived === opts.target ? [opts.target] : [opts.target, derived];
+  let res = null;
+  let matched = "";
+  try {
+    for (const ns of candidates) {
+      res = await removeUserBundle(ns, { home });
+      if (res.removed) {
+        matched = ns;
+        break;
+      }
+    }
+  } catch (e) {
+    printErr(`yaw-mcp remove: ${e.message}`);
+    return { exitCode: 1, written: [] };
+  }
+  if (!res || !res.removed) {
+    print(`yaw-mcp remove: no server matching "${opts.target}" in ${res?.path ?? "bundles.json"} (nothing to do).`);
+    const shadow2 = await findShadowingProjectBundles(cwd, home).catch(() => null);
+    if (shadow2) {
+      printErr(
+        `Note: a project-local ${shadow2} is in effect; \`remove\` only manages your user-global bundles.json, so a server defined there must be removed from that file directly.`
+      );
+    }
+    return { exitCode: 0, written: [] };
+  }
+  print(`Removed "${matched}" from ${res.path}. Restart your MCP client to apply.`);
+  const shadow = await findShadowingProjectBundles(cwd, home).catch(() => null);
+  if (shadow) {
+    printErr(
+      `Note: ${shadow} shadows your user-global bundles.json; a server defined there is unaffected by this removal.`
+    );
+  }
+  return { exitCode: 0, written: [res.path] };
+}
+var LIST_USAGE = `Usage: yaw-mcp list [--json]
+
+  List the MCP servers yaw-mcp loads locally from bundles.json (the
+  project-local file wins over user-global). --json for machine output.`;
+function parseListArgs(argv) {
+  const opts = {};
+  for (const a of argv) {
+    if (a === "-h" || a === "--help") return { ok: false, error: LIST_USAGE };
+    if (a === "--json") {
+      opts.json = true;
+      continue;
+    }
+    return { ok: false, error: `Unknown argument: ${a}
+${LIST_USAGE}` };
+  }
+  return { ok: true, options: opts };
+}
+async function runList(opts) {
+  const out = opts.out ?? ((s) => process.stdout.write(s));
+  const print = (s = "") => out(`${s}
+`);
+  const home = opts.home ?? homedir7();
+  const cwd = opts.cwd ?? process.cwd();
+  const loaded = await loadLocalBundles({ home, cwd });
+  const servers = loaded.config?.servers ?? [];
+  if (opts.json) {
+    print(JSON.stringify({ path: loaded.path, servers }, null, 2));
+    return { exitCode: 0, written: [] };
+  }
+  if (servers.length === 0) {
+    print("No local servers configured. Add one with `yaw-mcp add <slug>`");
+    print("(browse the catalog at https://yaw.sh/mcp/catalog/).");
+    return { exitCode: 0, written: [] };
+  }
+  const rows = [...servers].sort((a, b) => a.namespace.localeCompare(b.namespace));
+  const cols = [
+    ["NAMESPACE", (s) => s.namespace],
+    ["NAME", (s) => s.name],
+    ["STATUS", (s) => s.isActive ? "active" : "disabled"],
+    ["LAUNCH", (s) => [s.command, ...s.args ?? []].filter(Boolean).join(" ") || s.url || ""]
+  ];
+  const widths = cols.map(([h, get]) => Math.max(h.length, ...rows.map((r) => get(r).length)));
+  const fmt = (cells) => cells.map((c, i) => c.padEnd(widths[i])).join("  ").trimEnd();
+  print(fmt(cols.map(([h]) => h)));
+  for (const r of rows) print(fmt(cols.map(([, get]) => get(r))));
+  if (loaded.path) print(`
+${servers.length} server${servers.length === 1 ? "" : "s"} in ${loaded.path}`);
+  return { exitCode: 0, written: [] };
+}
+
 // src/login-cmd.ts
 var LOGIN_USAGE = `Usage: yaw-mcp login --key <license-key>
 
-  Sign in to your Yaw Team or Yaw MCP Pro account. Your license
+  Sign in to your Yaw Team account. Your license
   key was emailed after purchase.
 
   --key <license-key>   Required. The license key from your purchase email.
@@ -3520,7 +4092,7 @@ async function runLogin(opts, io = {
 // src/logout-cmd.ts
 var LOGOUT_USAGE = `Usage: yaw-mcp logout
 
-  Sign out of your Yaw Team or Yaw MCP Pro account. Clears the
+  Sign out of your Yaw Team account. Clears the
   local session cookie at ~/.yaw-mcp/team-session.json. Free mode
   resumes on the next yaw-mcp invocation if no YAW_MCP_TOKEN is set.
 
@@ -3559,15 +4131,18 @@ async function runLogout(opts = {}, io = {
 }
 
 // src/nag.ts
-import { readFile as readFile6 } from "fs/promises";
-import { homedir as homedir6 } from "os";
-import { join as join7 } from "path";
+import { readFile as readFile7 } from "fs/promises";
+import { homedir as homedir8 } from "os";
+import { join as join8 } from "path";
 var NAG_STATE_FILENAME = "nag-state.json";
 var MIN_THRESHOLD = 2;
 var MAX_THRESHOLD = 4;
 var FLOOR_MS = 36 * 60 * 60 * 1e3;
 var NAG_ELIGIBLE_SUBCOMMANDS = /* @__PURE__ */ new Set([
   "install",
+  "add",
+  "remove",
+  "list",
   "doctor",
   "servers",
   "bundles",
@@ -3585,15 +4160,15 @@ var NAG_ELIGIBLE_SUBCOMMANDS = /* @__PURE__ */ new Set([
 function emptyNagState() {
   return { touchPoints: 0, nextThreshold: MIN_THRESHOLD, lastShownAt: 0 };
 }
-function nagStatePath(home = homedir6()) {
-  return join7(home, CONFIG_DIRNAME, NAG_STATE_FILENAME);
+function nagStatePath(home = homedir8()) {
+  return join8(home, CONFIG_DIRNAME, NAG_STATE_FILENAME);
 }
 function isFileNotFound2(err) {
   return !!err && typeof err === "object" && "code" in err && err.code === "ENOENT";
 }
 async function loadNagState(filePath = nagStatePath()) {
   try {
-    const raw = await readFile6(filePath, "utf8");
+    const raw = await readFile7(filePath, "utf8");
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed !== "object") return emptyNagState();
     const p = parsed;
@@ -3651,33 +4226,27 @@ async function showNagInterstitial(opts = {}) {
   const stdin = opts.stdin ?? process.stdin;
   const tty = opts.isTTY ?? (stdout.isTTY === true && stdin.isTTY === true);
   if (!tty) return;
-  const lines = [
+  const content = [
+    "Yaw MCP -- support the project",
     "",
-    "+----------------------------------------------------------+",
-    "|                    Yaw MCP -- support the project        |",
-    "+----------------------------------------------------------+",
-    "|                                                          |",
-    "|  You're using Yaw MCP free.                              |",
-    "|                                                          |",
-    "|  Pro ($5/mo or $50/yr) adds:                             |",
-    "|    * sync bundles + secrets across machines              |",
-    "|    * encrypted secret vault (never logged)               |",
-    "|    * 90-day analytics on AI tool usage                   |",
-    "|    * `yaw-mcp stats` command                             |",
-    "|                                                          |",
-    "|  Yaw Team ($15/seat/mo or $150/seat/yr) adds:         |",
-    "|    * everything in Pro, per seat                         |",
-    "|    * shared team bundles                                 |",
-    "|    * shared org secrets                                  |",
-    "|    * per-seat audit log                                  |",
-    "|    * SSO                                                 |",
-    "|                                                          |",
-    "|  Learn more:  https://yaw.sh/mcp                         |",
-    "|                                                          |",
-    "|  Press Enter to continue (Ctrl-C to quit).               |",
-    "+----------------------------------------------------------+",
-    ""
+    "You're using Yaw MCP free -- all features included.",
+    "",
+    "Working with a team? Yaw Team ($15/seat/mo or",
+    "$150/seat/yr) adds:",
+    "  * shared team bundles across every seat",
+    "  * shared org secrets",
+    "  * per-seat audit log",
+    "  * SSO",
+    "",
+    "Learn more:  https://yaw.sh/mcp",
+    "",
+    "Press Enter to continue (Ctrl-C to quit)."
   ];
+  const PAD = 2;
+  const inner = Math.max(...content.map((l) => l.length));
+  const border = `+${"-".repeat(inner + PAD * 2)}+`;
+  const boxed = content.map((l) => `|${" ".repeat(PAD)}${l.padEnd(inner)}${" ".repeat(PAD)}|`);
+  const lines = ["", border, ...boxed, border, ""];
   stdout.write(`${lines.join("\n")}
 `);
   await new Promise((resolve5) => {
@@ -3699,8 +4268,8 @@ async function showNagInterstitial(opts = {}) {
 
 // src/reset-learning-cmd.ts
 import { unlink as unlink2 } from "fs/promises";
-import { homedir as homedir7 } from "os";
-import { join as join8 } from "path";
+import { homedir as homedir9 } from "os";
+import { join as join9 } from "path";
 var RESET_LEARNING_USAGE = `Usage: yaw-mcp reset-learning
 
   Delete ~/.yaw-mcp/state.json so cross-session learning starts fresh.
@@ -3722,7 +4291,7 @@ ${RESET_LEARNING_USAGE}`
   return { kind: "ok", options: {} };
 }
 async function runResetLearning(opts = {}) {
-  const home = opts.home ?? homedir7();
+  const home = opts.home ?? homedir9();
   const env = opts.env ?? process.env;
   const write = opts.out ?? ((s) => process.stdout.write(s));
   const writeErr = opts.err ?? ((s) => process.stderr.write(s));
@@ -3737,7 +4306,7 @@ async function runResetLearning(opts = {}) {
     writeErr(`${s}
 `);
   };
-  const filePath = join8(userConfigDir(home), STATE_FILENAME);
+  const filePath = join9(userConfigDir(home), STATE_FILENAME);
   const raw = env.YAW_MCP_DISABLE_PERSISTENCE;
   const disabled = raw !== void 0 && raw !== "" && (raw === "1" || raw.toLowerCase() === "true");
   if (disabled) {
@@ -3770,16 +4339,16 @@ function isFileNotFound3(err) {
 }
 
 // src/secrets-cmd.ts
-import { existsSync as existsSync5 } from "fs";
+import { existsSync as existsSync6 } from "fs";
 import { mkdir as mkdir3 } from "fs/promises";
-import { homedir as homedir9 } from "os";
+import { homedir as homedir11 } from "os";
 import { dirname as dirname3 } from "path";
 
 // src/secrets-vault.ts
-import { existsSync as existsSync4 } from "fs";
-import { chmod as chmod3, readFile as readFile7 } from "fs/promises";
-import { homedir as homedir8 } from "os";
-import { dirname as dirname2, join as join9 } from "path";
+import { existsSync as existsSync5 } from "fs";
+import { chmod as chmod3, readFile as readFile8 } from "fs/promises";
+import { homedir as homedir10 } from "os";
+import { dirname as dirname2, join as join10 } from "path";
 
 // src/secrets-crypto.ts
 import { createCipheriv, createDecipheriv, randomBytes, scrypt as scryptCb } from "crypto";
@@ -3837,8 +4406,8 @@ function decryptEntry(entry, key) {
 // src/secrets-vault.ts
 var SECRETS_FILENAME = "secrets.json";
 var SECRETS_SCHEMA_VERSION = 1;
-function vaultPath(home = homedir8()) {
-  return join9(home, CONFIG_DIRNAME, SECRETS_FILENAME);
+function vaultPath(home = homedir10()) {
+  return join10(home, CONFIG_DIRNAME, SECRETS_FILENAME);
 }
 function emptyVault() {
   return {
@@ -3848,10 +4417,10 @@ function emptyVault() {
   };
 }
 async function loadVault(path3) {
-  if (!existsSync4(path3)) return null;
+  if (!existsSync5(path3)) return null;
   let raw;
   try {
-    raw = await readFile7(path3, "utf8");
+    raw = await readFile8(path3, "utf8");
   } catch (err) {
     log("warn", "Failed to read vault", { path: path3, error: err instanceof Error ? err.message : String(err) });
     return null;
@@ -4105,13 +4674,13 @@ async function readStdinValue(io) {
 }
 async function ensureVaultDir(path3) {
   const dir = dirname3(path3);
-  if (!existsSync5(dir)) await mkdir3(dir, { recursive: true });
+  if (!existsSync6(dir)) await mkdir3(dir, { recursive: true });
 }
 async function runSecrets(opts, io = {
   out: (s) => process.stdout.write(s),
   err: (s) => process.stderr.write(s)
 }) {
-  const home = opts.home ?? homedir9();
+  const home = opts.home ?? homedir11();
   const path3 = vaultPath(home);
   if (opts.action === "lock") {
     lock();
@@ -4129,7 +4698,7 @@ async function runSecrets(opts, io = {
   if (opts.action === "list") {
     const vault2 = await loadVault(path3);
     const keys = vault2 ? listKeys(vault2) : [];
-    if (opts.json) io.out(`${JSON.stringify({ ok: true, vault: existsSync5(path3), keys }, null, 2)}
+    if (opts.json) io.out(`${JSON.stringify({ ok: true, vault: existsSync6(path3), keys }, null, 2)}
 `);
     else if (!vault2) io.out(`No vault at ${path3}. Run \`yaw-mcp secrets set <name>\` to create one.
 `);
@@ -4144,7 +4713,7 @@ async function runSecrets(opts, io = {
     return { exitCode: 0 };
   }
   let vault = await loadVault(path3) ?? newVault();
-  const isFresh = !existsSync5(path3);
+  const isFresh = !existsSync6(path3);
   const passphrase = await resolvePassphrase(opts);
   if (passphrase === null) {
     const msg = "Passphrase required. Set YAW_MCP_VAULT_PASSPHRASE or run from a TTY so we can prompt.";
@@ -4239,7 +4808,7 @@ async function runSecrets(opts, io = {
 }
 var MCP_SECRETS_RESOURCE = "mcp_secrets";
 async function runSecretsPush(opts, io) {
-  const home = opts.home ?? homedir9();
+  const home = opts.home ?? homedir11();
   const path3 = vaultPath(home);
   const session = await getSession({ home, baseUrl: opts.baseUrl });
   if (!session) {
@@ -4302,7 +4871,7 @@ async function runSecretsPush(opts, io) {
   }
 }
 async function runSecretsPull(opts, io) {
-  const home = opts.home ?? homedir9();
+  const home = opts.home ?? homedir11();
   const path3 = vaultPath(home);
   const session = await getSession({ home, baseUrl: opts.baseUrl });
   if (!session) {
@@ -4358,7 +4927,7 @@ async function runSecretsPull(opts, io) {
 
 // src/server.ts
 import { readFile as readFile10 } from "fs/promises";
-import { homedir as homedir11 } from "os";
+import { homedir as homedir12 } from "os";
 import { isAbsolute, relative, resolve as resolve4 } from "path";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -4558,7 +5127,7 @@ Or re-run with --run to upgrade in place.`);
   return { exitCode: 3, lines };
 }
 function readCurrentVersion() {
-  return true ? "0.58.3" : "dev";
+  return true ? "0.59.0" : "dev";
 }
 
 // src/auto-upgrade.ts
@@ -4606,7 +5175,7 @@ function defaultSpawn2(cmd, args) {
 async function maybeAutoUpgrade(deps = {}) {
   const optOut = process.env.YAW_MCP_AUTO_UPGRADE;
   if (optOut === "0" || optOut?.toLowerCase() === "false") return;
-  const current = deps.currentVersion ?? (true ? "0.58.3" : "dev");
+  const current = deps.currentVersion ?? (true ? "0.59.0" : "dev");
   if (current === "dev") return;
   const method = detectInstallMethod(deps.argvPath ?? process.argv[1]);
   const latest = await (deps.fetchLatestImpl ?? fetchLatestVersion2)();
@@ -4977,13 +5546,13 @@ function stepBindingKey(step, index) {
 }
 
 // src/guide.ts
-import { readFile as readFile8 } from "fs/promises";
+import { readFile as readFile9 } from "fs/promises";
 var GUIDE_READ_TIMEOUT_MS = 1e3;
 async function readGuide(path3, scope) {
   let raw;
   try {
     raw = await Promise.race([
-      readFile8(path3, "utf8"),
+      readFile9(path3, "utf8"),
       new Promise(
         (_, reject) => setTimeout(() => reject(new Error("guide read timeout")), GUIDE_READ_TIMEOUT_MS)
       )
@@ -5133,7 +5702,7 @@ async function reportHeartbeat(clientName, clientVersion, isRefresh = false) {
       lastLoggedFailureStatus = null;
       lastLoggedErrorMessage = null;
       if (!isRefresh) {
-        log("info", "Reported AI client connect to mcp.hosting", {
+        log("info", "Reported AI client connect to Yaw MCP", {
           clientName: clientName ?? null,
           clientVersion: clientVersion ?? null
         });
@@ -5265,137 +5834,11 @@ var LearningStore = class {
   }
 };
 
-// src/local-bundles.ts
-import { createHash as createHash2 } from "crypto";
-import { readFile as readFile9 } from "fs/promises";
-import { homedir as homedir10 } from "os";
-import { join as join10 } from "path";
-var BUNDLES_FILENAME = "bundles.json";
-var CURRENT_BUNDLES_SCHEMA_VERSION = 1;
-function localBundlesPath(configDir) {
-  return join10(configDir, BUNDLES_FILENAME);
-}
-var NAMESPACE_RE = /^[a-z][a-z0-9_]{0,29}$/;
-function validateEntry(entry, warnings) {
-  if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
-    warnings.push("bundles.json: skipping non-object server entry");
-    return null;
-  }
-  const e = entry;
-  const namespace = typeof e.namespace === "string" ? e.namespace : "";
-  if (!namespace || !NAMESPACE_RE.test(namespace)) {
-    warnings.push(`bundles.json: skipping server with invalid namespace ${JSON.stringify(namespace)}`);
-    return null;
-  }
-  const name = typeof e.name === "string" && e.name.length > 0 ? e.name : namespace;
-  const type = e.type === "remote" ? "remote" : "local";
-  const transport = e.transport === "streamable-http" || e.transport === "sse" || e.transport === "stdio" ? e.transport : void 0;
-  const command = typeof e.command === "string" ? e.command : void 0;
-  const args = Array.isArray(e.args) ? e.args.filter((a) => typeof a === "string") : void 0;
-  const env = e.env && typeof e.env === "object" && !Array.isArray(e.env) ? Object.fromEntries(
-    Object.entries(e.env).filter(([, v]) => typeof v === "string")
-  ) : void 0;
-  const url = typeof e.url === "string" ? e.url : void 0;
-  const description = typeof e.description === "string" ? e.description : void 0;
-  const isActive = e.isActive !== false;
-  const id = typeof e.id === "string" && e.id.length > 0 ? e.id : `local-${namespace}`;
-  return {
-    id,
-    name,
-    namespace,
-    type,
-    transport,
-    command,
-    args,
-    env,
-    url,
-    isActive,
-    description
-  };
-}
-async function readBundlesAt(path3, warnings) {
-  let raw;
-  try {
-    raw = await readFile9(path3, "utf8");
-  } catch {
-    return { exists: false, file: null };
-  }
-  let parsed;
-  try {
-    parsed = parseJsonc(raw);
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    warnings.push(`${path3}: invalid JSON (${msg}) -- file ignored`);
-    log("warn", "bundles.json is not valid JSON; ignoring", { path: path3, error: msg });
-    return { exists: true, file: null };
-  }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    warnings.push(`${path3}: root must be a JSON object -- file ignored`);
-    return { exists: true, file: null };
-  }
-  const obj = parsed;
-  const version = typeof obj.version === "number" ? obj.version : void 0;
-  if (version !== void 0 && version > CURRENT_BUNDLES_SCHEMA_VERSION) {
-    warnings.push(
-      `${path3}: schema version ${version} is newer than this yaw-mcp (${CURRENT_BUNDLES_SCHEMA_VERSION}); upgrade with \`npm i -g @yawlabs/mcp@latest\`. Loading best-effort.`
-    );
-  }
-  const rawServers = obj.servers;
-  if (!Array.isArray(rawServers)) {
-    warnings.push(`${path3}: 'servers' must be an array -- file ignored`);
-    return { exists: true, file: null };
-  }
-  return {
-    exists: true,
-    file: { version, servers: rawServers }
-  };
-}
-function hashContent(servers) {
-  const h = createHash2("sha256");
-  h.update(JSON.stringify(servers));
-  return `local-${h.digest("hex").slice(0, 16)}`;
-}
-async function loadLocalBundles(opts = {}) {
-  const cwd = opts.cwd ?? process.cwd();
-  const home = opts.home ?? homedir10();
-  const warnings = [];
-  const projectDir = await findProjectConfigDir(cwd, home).catch(() => null);
-  const projectPath = projectDir ? localBundlesPath(projectDir) : null;
-  const globalPath = localBundlesPath(join10(home, CONFIG_DIRNAME));
-  const projectResult = projectPath ? await readBundlesAt(projectPath, warnings) : { exists: false, file: null };
-  let file;
-  let sourcePath;
-  if (projectResult.exists) {
-    file = projectResult.file;
-    sourcePath = projectPath;
-  } else {
-    const globalResult = await readBundlesAt(globalPath, warnings);
-    file = globalResult.file;
-    sourcePath = globalResult.exists ? globalPath : null;
-  }
-  if (!file) {
-    return { config: null, path: sourcePath, warnings };
-  }
-  const servers = [];
-  for (const raw of file.servers) {
-    const validated = validateEntry(raw, warnings);
-    if (validated) servers.push(validated);
-  }
-  return {
-    config: {
-      servers,
-      configVersion: hashContent(servers)
-    },
-    path: sourcePath,
-    warnings
-  };
-}
-
 // src/meta-tools.ts
 var META_TOOLS = {
   discover: {
     name: "mcp_connect_discover",
-    description: 'List the MCP servers installed on the user\'s mcp.hosting account and ready to use. Call this when browsing what\'s available or when the task isn\'t specific yet. If the task is already clear ("file a github issue", "query postgres", "post to slack"), prefer `mcp_connect_dispatch` \u2014 it picks the right server and loads its tools in one call. Load only the servers the CURRENT task needs; each one adds tools to your context. Shows names, namespaces, tool counts, a token-cost estimate per server (e.g. "22 tools, ~2.8k tokens") so you can budget context before activating \u2014 tilde values are estimates based on cached tool metadata, unprefixed values reflect live tool schemas. Scored servers carry an inline `[A]`\u2013`[F]` compliance grade from the mcp.hosting test suite \u2014 treat it as a trust signal and prefer higher-graded alternatives when otherwise equivalent (ungraded servers are unmarked, not penalized). Also surfaces whether each server is loaded, any local CLI it shadows (prefer the MCP tools over the CLI when a shadow is listed), and usage hints ("used Nx" or "often loaded with X") when the signals are present (counts persist across yaw-mcp restarts). Recurring packs that have been loaded together \u22652 times get their own block at the top with a ready-to-run `activate` call \u2014 skip the extra `mcp_connect_suggest` round-trip when the signal is already there. If a `yaw-mcp://guide` resource is listed, read it FIRST: it carries project/user-specific routing rules and credential conventions that override generic defaults.',
+    description: 'List the MCP servers installed on the user\'s Yaw MCP account and ready to use. Call this when browsing what\'s available or when the task isn\'t specific yet. If the task is already clear ("file a github issue", "query postgres", "post to slack"), prefer `mcp_connect_dispatch` \u2014 it picks the right server and loads its tools in one call. Load only the servers the CURRENT task needs; each one adds tools to your context. Shows names, namespaces, tool counts, a token-cost estimate per server (e.g. "22 tools, ~2.8k tokens") so you can budget context before activating \u2014 tilde values are estimates based on cached tool metadata, unprefixed values reflect live tool schemas. Scored servers carry an inline `[A]`\u2013`[F]` compliance grade from the Yaw MCP test suite \u2014 treat it as a trust signal and prefer higher-graded alternatives when otherwise equivalent (ungraded servers are unmarked, not penalized). Also surfaces whether each server is loaded, any local CLI it shadows (prefer the MCP tools over the CLI when a shadow is listed), and usage hints ("used Nx" or "often loaded with X") when the signals are present (counts persist across yaw-mcp restarts). Recurring packs that have been loaded together \u22652 times get their own block at the top with a ready-to-run `activate` call \u2014 skip the extra `mcp_connect_suggest` round-trip when the signal is already there. If a `yaw-mcp://guide` resource is listed, read it FIRST: it carries project/user-specific routing rules and credential conventions that override generic defaults.',
     inputSchema: {
       type: "object",
       properties: {
@@ -5531,7 +5974,7 @@ var META_TOOLS = {
   },
   install: {
     name: "mcp_connect_install",
-    description: 'Install a new MCP server on the user\'s mcp.hosting account so it shows up in `mcp_connect_discover` and is ready to use. Call this when the user asks to install/add a server they don\'t already have (check `mcp_connect_discover` first \u2014 if the namespace is already listed, the server is already installed; use `mcp_connect_activate` to load its tools into this session). Fill the install spec from your knowledge of the server: for most official Model Context Protocol servers this is `{ type: "local", command: "npx", args: ["-y", "@modelcontextprotocol/server-<name>"] }`; for uvx/python it\'s `{ command: "uvx", args: ["mcp-server-<name>"] }`; for remote HTTP it\'s `{ type: "remote", url: "https://..." }`. Namespace must match /^[a-z][a-z0-9_]{0,29}$/ and must not collide with one the user already has. If the server needs secrets (API tokens, etc.) pass them in `env` \u2014 they are stored encrypted and never logged. On 403 with `code: "plan_limit_exceeded"` the user is on the free tier cap (3 servers); surface the returned error body verbatim so they see the upgrade URL. After install yaw-mcp auto-refreshes its server list \u2014 the new namespace becomes callable without a restart.',
+    description: 'Install a new MCP server on the user\'s Yaw MCP account so it shows up in `mcp_connect_discover` and is ready to use. Call this when the user asks to install/add a server they don\'t already have (check `mcp_connect_discover` first \u2014 if the namespace is already listed, the server is already installed; use `mcp_connect_activate` to load its tools into this session). Fill the install spec from your knowledge of the server: for most official Model Context Protocol servers this is `{ type: "local", command: "npx", args: ["-y", "@modelcontextprotocol/server-<name>"] }`; for uvx/python it\'s `{ command: "uvx", args: ["mcp-server-<name>"] }`; for remote HTTP it\'s `{ type: "remote", url: "https://..." }`. Namespace must match /^[a-z][a-z0-9_]{0,29}$/ and must not collide with one the user already has. If the server needs secrets (API tokens, etc.) pass them in `env` \u2014 they are stored encrypted and never logged. On 403 with `code: "plan_limit_exceeded"` the user is on the free tier cap (3 servers); surface the returned error body verbatim so they see the upgrade URL. After install yaw-mcp auto-refreshes its server list \u2014 the new namespace becomes callable without a restart.',
     inputSchema: {
       type: "object",
       properties: {
@@ -6522,7 +6965,7 @@ async function probe(name, p) {
         // node/npx/uvx arrive as `npx.cmd` in PATH, and native spawn
         // with shell:false only resolves .exe. Without this, probes
         // falsely report `npx: false` on every Windows machine and
-        // mcp.hosting's Test button pre-flight short-circuits with
+        // Yaw MCP's Test button pre-flight short-circuits with
         // "npx not detected" even though upstream activation (which
         // goes through cross-spawn in the MCP SDK) would work fine.
         // All probe args are fixed `--version` strings with no shell
@@ -6602,7 +7045,7 @@ async function reportRuntimes() {
     if (res.statusCode >= 400 && res.statusCode !== 404) {
       log("warn", "Runtime report failed", { status: res.statusCode });
     } else {
-      log("info", "Reported runtimes to mcp.hosting", { runtimes });
+      log("info", "Reported runtimes to Yaw MCP", { runtimes });
     }
   } catch (err) {
     log("warn", "Runtime report error", { error: err?.message });
@@ -7001,7 +7444,7 @@ function categorizeSpawnError(err) {
 }
 async function connectToUpstream(config, onDisconnect, onListChanged) {
   const client = new Client(
-    { name: "yaw-mcp", version: true ? "0.58.3" : "dev" },
+    { name: "yaw-mcp", version: true ? "0.59.0" : "dev" },
     { capabilities: {} }
   );
   let transport;
@@ -7310,7 +7753,7 @@ var ConnectServer = class _ConnectServer {
     this.apiUrl = apiUrl5;
     this.token = token5;
     this.server = new Server(
-      { name: "yaw-mcp", version: true ? "0.58.3" : "dev" },
+      { name: "yaw-mcp", version: true ? "0.59.0" : "dev" },
       {
         capabilities: {
           tools: { listChanged: true },
@@ -7375,7 +7818,7 @@ var ConnectServer = class _ConnectServer {
   activationFailures = /* @__PURE__ */ new Map();
   // Session-scoped credential overrides supplied by the user via MCP
   // elicitation when a server's stderr indicated a missing env var.
-  // Cleared on shutdown — persistence belongs in the mcp.hosting
+  // Cleared on shutdown — persistence belongs in the Yaw MCP
   // dashboard, these are a "get me running now" shortcut.
   elicitedEnv = /* @__PURE__ */ new Map();
   // In-flight activation promises, keyed by namespace. Dedupes
@@ -8841,7 +9284,7 @@ ${activeCount} loaded in this session, ${totalTools} tools in context${tokenSumm
     }
     const ALLOWED_FILENAMES = ["claude_desktop_config.json", "mcp.json", "settings.json", "mcp_config.json"];
     try {
-      const resolved = filepath.startsWith("~/") || filepath.startsWith("~\\") ? resolve4(homedir11(), filepath.slice(2)) : resolve4(filepath);
+      const resolved = filepath.startsWith("~/") || filepath.startsWith("~\\") ? resolve4(homedir12(), filepath.slice(2)) : resolve4(filepath);
       const resolvedBasename = resolved.split(/[/\\]/).pop() || "";
       if (!ALLOWED_FILENAMES.includes(resolvedBasename)) {
         return {
@@ -8858,7 +9301,7 @@ ${activeCount} loaded in this session, ${totalTools} tools in context${tokenSumm
         const rel = relative(base, p);
         return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
       };
-      if (!isUnder(homedir11(), resolved) && !isUnder(process.cwd(), resolved)) {
+      if (!isUnder(homedir12(), resolved) && !isUnder(process.cwd(), resolved)) {
         return {
           content: [
             { type: "text", text: "Import path must be under your home directory or the current working directory." }
@@ -8948,7 +9391,7 @@ Use mcp_connect_discover to see imported servers.`
       return { content: [{ type: "text", text: `Import error: ${err.message}` }], isError: true };
     }
   }
-  // Install a new MCP server on the user's mcp.hosting account. Validates
+  // Install a new MCP server on the user's Yaw MCP account. Validates
   // via the shared buildInstallPayload helper so local/remote + namespace
   // shape errors fail here with a clear message instead of burning a
   // round-trip to the backend. On 403 plan-limit we forward the structured
@@ -9512,7 +9955,7 @@ async function runServersCommand(opts = {}) {
     writeErr(`${s}
 `);
   };
-  const config = await loadMcphConfig({
+  const config = await loadYawMcpConfig({
     cwd: opts.cwd,
     home: opts.home,
     env: opts.env
@@ -9592,18 +10035,18 @@ function truncateVersion(v) {
 }
 
 // src/stats-cmd.ts
-import { homedir as homedir12 } from "os";
+import { homedir as homedir13 } from "os";
 var STATS_USAGE = `Usage: yaw-mcp stats [--json] [--limit N] [--days N]
 
-  Print a digest of recent AI tool calls recorded against your Yaw MCP
-  Pro or Yaw Team account.
+  Print a digest of recent AI tool calls recorded against your Yaw
+  Team account.
 
   --limit N   Show the most recent N events (default 50, max 1000).
   --days N    Restrict to events from the last N days (default 7).
   --json      Emit machine-readable JSON (the full event list + summary).
 
   Requires sign-in: \`yaw-mcp login --key <license-key>\`. Free users
-  get a pointer to Pro instead -- analytics requires an account.`;
+  get a pointer to Yaw Team instead -- analytics requires an account.`;
 function parseStatsArgs(argv) {
   const opts = {};
   for (let i = 0; i < argv.length; i++) {
@@ -9707,10 +10150,10 @@ async function runStats(opts, io = {
   out: (s) => process.stdout.write(s),
   err: (s) => process.stderr.write(s)
 }) {
-  const home = opts.home ?? homedir12();
+  const home = opts.home ?? homedir13();
   const session = await getSession({ home, baseUrl: opts.baseUrl });
   if (!session) {
-    const msg = "Not signed in. Yaw MCP analytics requires a Pro or Yaw Team account.\n  - Pro: $5/mo or $50/yr -- https://yaw.sh/mcp#pricing\n  - Yaw Team: $15/seat/mo (includes Yaw Terminal team features)\nSign in with: yaw-mcp login --key <license-key>";
+    const msg = "Not signed in. Yaw MCP analytics requires a Yaw Team account.\n  - Yaw Team: $15/seat/mo or $150/seat/yr -- https://yaw.sh/mcp\nSign in with: yaw-mcp login --key <license-key>";
     if (opts.json) io.err(`${JSON.stringify({ ok: false, error: "Not signed in.", upsell: msg })}
 `);
     else io.err(`yaw-mcp stats: ${msg}
@@ -9764,14 +10207,14 @@ async function runStats(opts, io = {
 }
 
 // src/sync-cmd.ts
-import { existsSync as existsSync6 } from "fs";
+import { existsSync as existsSync7 } from "fs";
 import { mkdir as mkdir4, readFile as readFile11 } from "fs/promises";
-import { homedir as homedir13 } from "os";
+import { homedir as homedir14 } from "os";
 import { dirname as dirname4, join as join11 } from "path";
 var SYNC_USAGE = `Usage: yaw-mcp sync <push|pull|status> [--json]
 
   Replicate ~/.yaw-mcp/bundles.json across machines via your Yaw
-  Team or Yaw MCP Pro account.
+  Team account.
 
   push    Strip env values from the local bundles and upload the
           schema to mcp_bundles. Env values stay machine-local.
@@ -9814,7 +10257,7 @@ function bundlesPath(home) {
 }
 async function readLocalBundles(home) {
   const path3 = bundlesPath(home);
-  if (!existsSync6(path3)) return { version: 1, servers: [] };
+  if (!existsSync7(path3)) return { version: 1, servers: [] };
   const raw = await readFile11(path3, "utf8");
   const parsed = JSON.parse(raw);
   if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.servers)) {
@@ -9852,7 +10295,7 @@ async function runSync(opts, io = {
   out: (s) => process.stdout.write(s),
   err: (s) => process.stderr.write(s)
 }) {
-  const home = opts.home ?? homedir13();
+  const home = opts.home ?? homedir14();
   const session = await getSession({ home, baseUrl: opts.baseUrl });
   if (!session) {
     const msg = "Not signed in. Run `yaw-mcp login --key <license-key>` first.";
@@ -9995,6 +10438,9 @@ function handleSyncError(err, opts, io) {
 var KNOWN_SUBCOMMANDS = [
   "compliance",
   "install",
+  "add",
+  "remove",
+  "list",
   "doctor",
   "reset-learning",
   "servers",
@@ -10020,7 +10466,7 @@ if (subcommand && NAG_ELIGIBLE_SUBCOMMANDS.has(subcommand) && process.env.YAW_MC
   let inAccountMode = envHasToken;
   if (!inAccountMode) {
     try {
-      const cfg = await loadMcphConfig();
+      const cfg = await loadYawMcpConfig();
       inAccountMode = Boolean(cfg.token);
     } catch {
       inAccountMode = false;
@@ -10129,6 +10575,30 @@ if (subcommand === "compliance") {
     process.exit(2);
   }
   runTryCleanup(parsed.options).then((r) => process.exit(r.exitCode));
+} else if (subcommand === "add") {
+  const parsed = parseAddArgs(process.argv.slice(3));
+  if (!parsed.ok) {
+    process.stderr.write(`${parsed.error}
+`);
+    process.exit(2);
+  }
+  runAdd(parsed.options).then((r) => process.exit(r.exitCode));
+} else if (subcommand === "remove") {
+  const parsed = parseRemoveArgs(process.argv.slice(3));
+  if (!parsed.ok) {
+    process.stderr.write(`${parsed.error}
+`);
+    process.exit(2);
+  }
+  runRemove(parsed.options).then((r) => process.exit(r.exitCode));
+} else if (subcommand === "list") {
+  const parsed = parseListArgs(process.argv.slice(3));
+  if (!parsed.ok) {
+    process.stderr.write(`${parsed.error}
+`);
+    process.exit(2);
+  }
+  runList(parsed.options).then((r) => process.exit(r.exitCode));
 } else if (subcommand === "login") {
   const parsed = parseLoginArgs(process.argv.slice(3));
   if (!parsed.ok) {
@@ -10178,16 +10648,26 @@ if (subcommand === "compliance") {
     2. Install yaw-mcp     yaw-mcp install claude-code --token mcp_pat_...
     3. Verify setup     yaw-mcp doctor
 
-  Setup:
-    install <client>         Configure one MCP client to launch yaw-mcp.
-                             <client> is one of: claude-code, claude-desktop,
-                             cursor, vscode.
+  Setup (connect a client to yaw-mcp):
+    install <client>         Connect one MCP client to yaw-mcp. This wires the
+                             aggregator into the client; it does NOT add a
+                             server (for that, see \`add\` below). <client> is
+                             one of: claude-code, claude-desktop, cursor, vscode.
     install --list           List which MCP clients are installed on this
                              machine (read-only; no writes).
     install --all            Configure every installed MCP client in one go.
-    try <slug>               Wire a one-off trial of an upstream MCP server
-                             into your AI client. No account needed; expires
-                             after --ttl (default 1h). Doctor GCs it after.
+
+  Local servers (no account):
+    add <slug>               Add an MCP server from the yaw.sh/mcp catalog to
+                             your local ~/.yaw-mcp/bundles.json so yaw-mcp loads
+                             it. Pass required env with --env KEY=value.
+    remove <slug>            Remove a server (by slug or namespace) from
+                             bundles.json.
+    list                     List the servers yaw-mcp loads locally.
+    try <slug>               Wire a one-off trial of a catalog MCP server
+                             directly into your AI client (bypassing yaw-mcp).
+                             No account needed; expires after --ttl (default
+                             1h). Doctor GCs it after.
     try-cleanup <slug>       Remove a wired trial early.
 
   Inspection:
@@ -10208,6 +10688,17 @@ if (subcommand === "compliance") {
                              fish, or powershell. Redirect to your
                              completions directory to install.
 
+  Account / sync (Pro + Team):
+    login                    Authenticate this machine with a Yaw MCP account
+                             (Pro/Team). --key <license> to pass the key inline.
+    logout                   Sign this machine out of the account.
+    sync <push|pull|status>  Replicate your local bundles.json to/from the
+                             account store (env values stripped on push).
+    secrets <action>         Manage synced secret VALUES: set, get, list,
+                             remove, lock, push, pull.
+    stats                    Show your account usage statistics
+                             (--limit, --days, --json).
+
   Other:
     compliance <target>      Run the 88-test compliance suite against an MCP
                              server. --publish posts the report to
@@ -10238,8 +10729,10 @@ if (subcommand === "compliance") {
                                upgraded in the background).
     YAW_MCP_PRUNE_RESPONSES       Set to \`0\` to disable response pruning.
     YAW_MCP_DISABLE_PERSISTENCE   Disable cross-session learning state.
-    YAW_MCP_BASE_URL              Override the host \`yaw-mcp try\` queries for
-                               /api/explore/:slug (default https://yaw.sh/mcp).
+    YAW_MCP_CATALOG_URL          Override the catalog \`add\`/\`try\` resolve slugs
+                               against (default https://yaw.sh/data/mcp-catalog.json).
+    YAW_MCP_BASE_URL              Base URL for \`yaw-mcp try\` signup/telemetry
+                               links (default https://yaw.sh/mcp).
 
   Config resolution (highest precedence first):
     1. YAW_MCP_TOKEN / YAW_MCP_URL env vars
@@ -10257,7 +10750,7 @@ if (subcommand === "compliance") {
 `);
   process.exit(0);
 } else if (subcommand === "--version" || subcommand === "-V") {
-  process.stdout.write(`yaw-mcp ${true ? "0.58.3" : "dev"}
+  process.stdout.write(`yaw-mcp ${true ? "0.59.0" : "dev"}
 `);
   process.exit(0);
 } else if (subcommand && !subcommand.startsWith("-")) {
@@ -10271,7 +10764,7 @@ if (subcommand === "compliance") {
   runServer();
 }
 async function runServer() {
-  const config = await loadMcphConfig();
+  const config = await loadYawMcpConfig();
   for (const w of config.warnings) {
     log("warn", "Config warning", { warning: w });
   }