@yawlabs/mcp 0.58.4 → 0.59.1

package/dist/index.js

@@ -302,7 +302,7 @@ function unionBlocked(files) {
   }
   return touched ? [...set] : void 0;
 }
-async function loadMcphConfig(opts = {}) {
+async function loadYawMcpConfig(opts = {}) {
   const cwd = resolve(opts.cwd ?? process.cwd());
   const home = resolve(opts.home ?? homedir());
   const env = opts.env ?? process.env;
@@ -390,7 +390,7 @@ function toProfile(config) {
   return result;
 }
 async function loadEffectiveProfile(cwd, home) {
-  const config = await loadMcphConfig({ cwd, home });
+  const config = await loadYawMcpConfig({ cwd, home });
   return toProfile(config);
 }
 function isAllowed(rules, namespace) {
@@ -542,7 +542,7 @@ async function runBundlesCommand(opts = {}) {
     }
     return { exitCode: 0, lines };
   }
-  const config = await loadMcphConfig({
+  const config = await loadYawMcpConfig({
     cwd: opts.cwd,
     home: opts.home,
     env: opts.env
@@ -636,13 +636,15 @@ var COMPLETION_USAGE = `Usage: yaw-mcp completion <bash|zsh|fish|powershell>
   location for your shell:
 
     bash        yaw-mcp completion bash       > ~/.local/share/bash-completion/completions/yaw-mcp
-    zsh         yaw-mcp completion zsh        > "\${fpath[1]}/_mcph"    (must be on $fpath)
+    zsh         yaw-mcp completion zsh        > "\${fpath[1]}/_yaw-mcp"    (must be on $fpath)
     fish        yaw-mcp completion fish       > ~/.config/fish/completions/yaw-mcp.fish
     powershell  yaw-mcp completion powershell >> $PROFILE`;
 var INSTALL_CLIENTS = ["claude-code", "claude-desktop", "cursor", "vscode"];
 var SUBCOMMAND_SPEC = [
+  // Setup -- connect a client to yaw-mcp.
   {
     name: "install",
+    description: "Connect an MCP client to yaw-mcp",
     positional: [...INSTALL_CLIENTS],
     flags: [
       "--scope",
@@ -657,14 +659,59 @@ var SUBCOMMAND_SPEC = [
       "--all"
     ]
   },
-  { name: "doctor", flags: ["--json", "--help"] },
-  { name: "servers", flags: ["--json", "--help"] },
-  { name: "bundles", positional: ["list", "match"], flags: ["--json", "--help"] },
-  { name: "compliance", flags: ["--publish", "--help"] },
-  { name: "reset-learning", flags: ["--help"] },
-  { name: "completion", positional: ["bash", "zsh", "fish", "powershell"], flags: ["--help"] },
-  { name: "upgrade", flags: ["--run", "--json", "--help"] },
-  { name: "help", flags: [] }
+  // Local servers -- manage ~/.yaw-mcp/bundles.json (no account).
+  {
+    name: "add",
+    description: "Add a catalog server to bundles.json",
+    positional: ["<slug>"],
+    flags: ["--env", "--dry-run", "--json", "--catalog", "--help"]
+  },
+  { name: "remove", description: "Remove a local server", positional: ["<slug-or-namespace>"], flags: ["--help"] },
+  { name: "list", description: "List the servers yaw-mcp loads locally", flags: ["--json", "--help"] },
+  {
+    name: "try",
+    description: "Wire a one-off trial of a catalog server",
+    positional: ["<slug>"],
+    flags: ["--client", "--ttl", "--env", "--dry-run", "--base", "--help"]
+  },
+  { name: "try-cleanup", description: "Remove a wired trial", positional: ["<slug>"], flags: ["--base", "--help"] },
+  // Inspection.
+  { name: "doctor", description: "Print diagnostic of yaw-mcp setup", flags: ["--json", "--help"] },
+  { name: "servers", description: "List servers in your yaw.sh/mcp dashboard", flags: ["--json", "--help"] },
+  {
+    name: "bundles",
+    description: "Browse curated multi-server bundles",
+    positional: ["list", "match"],
+    flags: ["--json", "--help"]
+  },
+  // Maintenance.
+  { name: "upgrade", description: "Upgrade @yawlabs/mcp to the latest version", flags: ["--run", "--json", "--help"] },
+  { name: "reset-learning", description: "Clear cross-session learning history", flags: ["--help"] },
+  {
+    name: "completion",
+    description: "Print a shell completion script",
+    positional: ["bash", "zsh", "fish", "powershell"],
+    flags: ["--help"]
+  },
+  // Account / sync (Pro + Team).
+  { name: "login", description: "Authenticate with a Yaw MCP account", flags: ["--key", "--json", "--help"] },
+  { name: "logout", description: "Sign out of your account", flags: ["--json", "--help"] },
+  {
+    name: "sync",
+    description: "Sync bundles across machines",
+    positional: ["push", "pull", "status"],
+    flags: ["--key", "--json", "--help"]
+  },
+  { name: "stats", description: "Show usage statistics", flags: ["--key", "--limit", "--days", "--json", "--help"] },
+  {
+    name: "secrets",
+    description: "Manage stored secrets",
+    positional: ["set", "get", "list", "remove", "lock", "push", "pull"],
+    flags: ["--key", "--value", "--stdin", "--json", "--help"]
+  },
+  // Other.
+  { name: "compliance", description: "Run the compliance suite against a server", flags: ["--publish", "--help"] },
+  { name: "help", description: "Show usage", flags: [] }
 ];
 function parseCompletionArgs(argv) {
   if (argv.includes("--help") || argv.includes("-h")) {
@@ -737,7 +784,7 @@ ${posClause}
   return `# bash completion for yaw-mcp \u2014 generated by \`yaw-mcp completion bash\`
 # Install: save this to ~/.local/share/bash-completion/completions/yaw-mcp
 #          or source it from your .bashrc.
-_mcph() {
+_yaw-mcp() {
   local cur prev words cword
   cur="\${COMP_WORDS[COMP_CWORD]}"
   cword=$COMP_CWORD
@@ -751,24 +798,11 @@ _mcph() {
 ${cases}
   esac
 }
-complete -F _mcph yaw-mcp
+complete -F _yaw-mcp yaw-mcp
 `;
 }
 function renderZsh() {
-  const subcommandDescriptions = {
-    install: "Auto-edit an MCP client's config",
-    doctor: "Print diagnostic of yaw-mcp setup",
-    servers: "List servers in your yaw.sh/mcp dashboard",
-    bundles: "Browse curated multi-server bundles",
-    compliance: "Run the compliance suite against a server",
-    "reset-learning": "Clear cross-session learning history",
-    completion: "Print a shell completion script",
-    upgrade: "Upgrade @yawlabs/mcp to the latest version",
-    help: "Show usage"
-  };
-  const subcommandList = SUBCOMMAND_SPEC.map((s) => `    '${s.name}:${subcommandDescriptions[s.name] ?? ""}'`).join(
-    "\n"
-  );
+  const subcommandList = SUBCOMMAND_SPEC.map((s) => `    '${s.name}:${s.description}'`).join("\n");
   const argsCases = SUBCOMMAND_SPEC.map((spec) => {
     const lines = [`      ${spec.name})`];
     if (spec.positional) {
@@ -781,10 +815,10 @@ function renderZsh() {
   }).join("\n");
   return `#compdef yaw-mcp
 # zsh completion for yaw-mcp \u2014 generated by \`yaw-mcp completion zsh\`
-# Install: save this to a file on your $fpath named _mcph
-#          (e.g., ~/.zsh/completions/_mcph), then rebuild completions:
+# Install: save this to a file on your $fpath named _yaw-mcp
+#          (e.g., ~/.zsh/completions/_yaw-mcp), then rebuild completions:
 #            autoload -U compinit && compinit
-_mcph() {
+_yaw-mcp() {
   local context state line
   _arguments -C \\
     '1: :->cmd' \\
@@ -802,7 +836,7 @@ ${argsCases}
       ;;
   esac
 }
-_mcph "$@"
+_yaw-mcp "$@"
 `;
 }
 function renderFish() {
@@ -821,7 +855,8 @@ complete -c yaw-mcp -f`;
       }
     }
     for (const f of spec.flags) {
-      const long = f.replace(/^--/, "");
+      if (!f.startsWith("--")) continue;
+      const long = f.slice(2);
       flagLines.push(`complete -c yaw-mcp -n "__fish_seen_subcommand_from ${spec.name}" -l ${long}`);
     }
   }
@@ -1457,9 +1492,12 @@ function buildLaunchEntry(opts) {
   if (opts.token) entry.env = { YAW_MCP_TOKEN: opts.token };
   return entry;
 }
-var ENTRY_NAME = "yaw-mcp";
-var LEGACY_ENTRY_NAME = "mcp.hosting";
-var CLAUDE_CODE_ALLOW_PATTERN = "mcp__yaw_mcp__*";
+var ENTRY_NAME = "mcp";
+var LEGACY_ENTRY_NAMES = ["mcp.hosting", "mcph", "yaw-mcp"];
+function findLegacyEntry(container) {
+  return LEGACY_ENTRY_NAMES.find((n) => n in container) ?? null;
+}
+var CLAUDE_CODE_ALLOW_PATTERN = "mcp__mcp__*";
 function resolveClaudeCodeSettingsPath(scope, opts) {
   const { home, projectDir, claudeConfigDir } = opts;
   const cfgDir = claudeConfigDir && claudeConfigDir.length > 0 ? claudeConfigDir : null;
@@ -1599,6 +1637,101 @@ import { homedir as homedir4, hostname, userInfo } from "os";
 import { join as join5, resolve as resolve3 } from "path";
 import { request as request5 } from "undici";
 
+// src/catalog.ts
+var DEFAULT_CATALOG_URL = "https://yaw.sh/data/mcp-catalog.json";
+var FETCH_TIMEOUT_MS = 1e4;
+var ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function tokenizeCommand(cmd) {
+  const out = [];
+  let cur = "";
+  let has = false;
+  let quote = null;
+  for (const ch of cmd) {
+    if (quote) {
+      if (ch === quote) quote = null;
+      else cur += ch;
+      has = true;
+    } else if (ch === '"' || ch === "'") {
+      quote = ch;
+      has = true;
+    } else if (ch === " " || ch === "	" || ch === "\n" || ch === "\r") {
+      if (has) {
+        out.push(cur);
+        cur = "";
+        has = false;
+      }
+    } else {
+      cur += ch;
+      has = true;
+    }
+  }
+  if (has) out.push(cur);
+  return out;
+}
+async function defaultFetchCatalog(url = DEFAULT_CATALOG_URL) {
+  const ac = new AbortController();
+  const timer = setTimeout(() => ac.abort(), FETCH_TIMEOUT_MS);
+  let body;
+  try {
+    const res = await fetch(url, { signal: ac.signal, headers: { accept: "application/json" } });
+    if (!res.ok) {
+      throw new Error(`the Yaw MCP catalog at ${url} returned HTTP ${res.status}.`);
+    }
+    body = await res.json();
+  } catch (err) {
+    if (err instanceof Error && err.name === "AbortError") {
+      throw new Error(`timed out fetching the Yaw MCP catalog at ${url}.`);
+    }
+    throw err instanceof Error ? err : new Error(String(err));
+  } finally {
+    clearTimeout(timer);
+  }
+  const servers = body?.servers;
+  if (!Array.isArray(servers)) {
+    throw new Error(`the Yaw MCP catalog at ${url} was not in the expected shape.`);
+  }
+  return servers.filter(
+    (s) => typeof s === "object" && s !== null && typeof s.slug === "string"
+  );
+}
+async function resolveCatalogSlug(slug, opts = {}) {
+  const url = opts.catalogUrl ?? DEFAULT_CATALOG_URL;
+  const fetchCatalog = opts.fetchCatalog ?? defaultFetchCatalog;
+  const servers = await fetchCatalog(url);
+  const entry = servers.find((s) => s.slug === slug);
+  if (!entry) {
+    throw new Error(
+      `no server with slug "${slug}" in the Yaw MCP catalog. Browse https://yaw.sh/mcp/catalog/ for the list.`
+    );
+  }
+  const install = entry.install ?? {};
+  const runtime = typeof install.runtime === "string" ? install.runtime.toLowerCase() : "";
+  if (install.url || install.type === "remote" || /^(remote|https?|sse|url)$/.test(runtime)) {
+    throw new Error(`"${slug}" is a remote server -- add it from the Yaw MCP dashboard, not the local CLI.`);
+  }
+  const cmdStr = typeof install.command === "string" ? install.command.trim() : "";
+  if (!cmdStr) {
+    throw new Error(`catalog entry "${slug}" has no install command.`);
+  }
+  const tokens = tokenizeCommand(cmdStr);
+  if (tokens.length === 0) {
+    throw new Error(`catalog entry "${slug}" install command was empty.`);
+  }
+  const [command, ...args] = tokens;
+  const requiredEnvKeys = Array.isArray(entry.requiredEnv) ? entry.requiredEnv.map((e) => e && typeof e === "object" ? e.key : void 0).filter((k) => typeof k === "string" && ENV_KEY_RE.test(k)) : [];
+  const source = typeof entry.repo === "string" ? entry.repo : typeof entry.homepage === "string" ? entry.homepage : void 0;
+  return {
+    slug,
+    name: typeof entry.name === "string" && entry.name.trim() ? entry.name.trim() : slug,
+    command,
+    args,
+    requiredEnvKeys,
+    description: typeof entry.description === "string" ? entry.description : void 0,
+    source,
+    docUrl: source
+  };
+}
+
 // src/install-cmd.ts
 import { existsSync } from "fs";
 import { chmod, readFile as readFile3 } from "fs/promises";
@@ -1675,7 +1808,7 @@ ${USAGE}`);
   log2(`File:   ${resolved.absolute}`);
   let token5 = opts.token ?? null;
   if (!token5) {
-    const cfg = await loadMcphConfig({ home: opts.home, cwd: process.cwd(), env: {} });
+    const cfg = await loadYawMcpConfig({ home: opts.home, cwd: process.cwd(), env: {} });
     token5 = cfg.token;
   }
   if (!token5) {
@@ -1687,7 +1820,7 @@ ${USAGE}`);
   const containerPath = resolved.containerPath;
   let existing = {};
   let existingHasEntry = false;
-  let legacyPresent = false;
+  let legacyEntry = null;
   if (existsSync(resolved.absolute)) {
     let raw;
     try {
@@ -1717,7 +1850,7 @@ ${USAGE}`);
     if (typeof container === "object" && container !== null && !Array.isArray(container)) {
       const c = container;
       existingHasEntry = ENTRY_NAME in c;
-      legacyPresent = LEGACY_ENTRY_NAME in c;
+      legacyEntry = findLegacyEntry(c);
     }
   }
   if (existingHasEntry) {
@@ -1747,16 +1880,16 @@ ${USAGE}`);
   const merged = mergeClientConfig(existing, containerPath, newEntry);
   const clientJson = `${JSON.stringify(merged, null, 2)}
 `;
-  const writeMcphConfig = !opts.skipMcphConfig && token5 !== null;
+  const writeYawMcpConfig = !opts.skipYawMcpConfig && token5 !== null;
   const home = opts.home ?? homedir3();
-  const mcphConfigPath = join4(home, CONFIG_DIRNAME, CONFIG_FILENAME);
-  const mcphConfigComposed = writeMcphConfig ? await composeMcphConfig(mcphConfigPath, token5) : { json: "" };
-  if ("backupPath" in mcphConfigComposed && mcphConfigComposed.backupPath) {
+  const yawMcpConfigPath = join4(home, CONFIG_DIRNAME, CONFIG_FILENAME);
+  const yawMcpConfigComposed = writeYawMcpConfig ? await composeYawMcpConfig(yawMcpConfigPath, token5) : { json: "" };
+  if ("backupPath" in yawMcpConfigComposed && yawMcpConfigComposed.backupPath) {
     log2(
-      `yaw-mcp install: existing ${mcphConfigPath} was malformed; original bytes backed up to ${mcphConfigComposed.backupPath} before overwriting.`
+      `yaw-mcp install: existing ${yawMcpConfigPath} was malformed; original bytes backed up to ${yawMcpConfigComposed.backupPath} before overwriting.`
     );
   }
-  const mcphConfigJson = mcphConfigComposed.json;
+  const yawMcpConfigJson = yawMcpConfigComposed.json;
   const settingsPatch = opts.clientId === "claude-code" ? await prepareClaudeCodeSettingsPatch({
     scope,
     home,
@@ -1766,40 +1899,40 @@ ${USAGE}`);
   }) : null;
   if (opts.dryRun) {
     log2("\n--- dry run: would write the following ---");
-    if (writeMcphConfig) log2(`# ${mcphConfigPath}
-${mcphConfigJson}`);
+    if (writeYawMcpConfig) log2(`# ${yawMcpConfigPath}
+${yawMcpConfigJson}`);
     log2(`
 # ${resolved.absolute}
 ${clientJson}`);
     if (settingsPatch?.changed) log2(`# ${settingsPatch.path}
 ${settingsPatch.nextJson}`);
-    if (legacyPresent) {
+    if (legacyEntry) {
       log2(
-        `Note: legacy "${LEGACY_ENTRY_NAME}" entry at ${resolved.absolute} would remain \u2014 remove it to avoid running yaw-mcp twice.`
+        `Note: legacy "${legacyEntry}" entry at ${resolved.absolute} would remain \u2014 remove it to avoid running yaw-mcp twice.`
       );
     }
     const wouldWrite = [];
-    if (writeMcphConfig) wouldWrite.push(mcphConfigPath);
+    if (writeYawMcpConfig) wouldWrite.push(yawMcpConfigPath);
     wouldWrite.push(resolved.absolute);
     if (settingsPatch?.changed) wouldWrite.push(settingsPatch.path);
     return { written: [], wouldWrite, messages, exitCode: 0 };
   }
   const written = [];
-  if (writeMcphConfig) {
+  if (writeYawMcpConfig) {
     try {
-      await atomicWriteFile(mcphConfigPath, mcphConfigJson);
+      await atomicWriteFile(yawMcpConfigPath, yawMcpConfigJson);
       if (process.platform !== "win32") {
         try {
-          await chmod(mcphConfigPath, 384);
+          await chmod(yawMcpConfigPath, 384);
         } catch {
         }
       }
     } catch (e) {
-      err(`yaw-mcp install: failed to write ${mcphConfigPath}: ${e.message}`);
+      err(`yaw-mcp install: failed to write ${yawMcpConfigPath}: ${e.message}`);
       return { written: [], wouldWrite: [], messages, exitCode: 1 };
     }
-    log2(`Wrote ${mcphConfigPath}`);
-    written.push(mcphConfigPath);
+    log2(`Wrote ${yawMcpConfigPath}`);
+    written.push(yawMcpConfigPath);
   }
   try {
     await atomicWriteFile(resolved.absolute, clientJson);
@@ -1821,9 +1954,9 @@ ${settingsPatch.nextJson}`);
     }
   }
   if (target.notes) log2(`Note: ${target.notes}`);
-  if (legacyPresent) {
+  if (legacyEntry) {
     log2(
-      `Note: legacy "${LEGACY_ENTRY_NAME}" entry remains at ${resolved.absolute}. Remove it to avoid running yaw-mcp twice.`
+      `Note: legacy "${legacyEntry}" entry remains at ${resolved.absolute}. Remove it to avoid running yaw-mcp twice.`
     );
   }
   log2(`
@@ -1861,14 +1994,14 @@ async function prepareClaudeCodeSettingsPatch(opts) {
   return { path: path3, nextJson: `${JSON.stringify(merged, null, 2)}
 `, changed: true };
 }
-var LEGACY_CLAUDE_CODE_ALLOW_PATTERN = "mcp__mcp_hosting__*";
+var LEGACY_CLAUDE_CODE_ALLOW_PATTERNS = ["mcp__mcp_hosting__*", "mcp__yaw_mcp__*"];
 function mergePermissionsAllow(existing, patterns) {
   const out = { ...existing };
   const prev = out.permissions;
   const perms = typeof prev === "object" && prev !== null && !Array.isArray(prev) ? { ...prev } : {};
   const prevAllow = perms.allow;
   const allow = Array.isArray(prevAllow) ? prevAllow.filter(
-    (x) => typeof x === "string" && x !== LEGACY_CLAUDE_CODE_ALLOW_PATTERN
+    (x) => typeof x === "string" && !LEGACY_CLAUDE_CODE_ALLOW_PATTERNS.includes(x)
   ) : [];
   for (const p of patterns) {
     if (!allow.includes(p)) allow.push(p);
@@ -1943,7 +2076,7 @@ function removeFromClientConfig(existing, containerPath, entryName) {
   parent[leafKey] = container;
   return out;
 }
-async function composeMcphConfig(path3, token5) {
+async function composeYawMcpConfig(path3, token5) {
   let existing = {};
   let backupPath;
   if (existsSync(path3)) {
@@ -2019,7 +2152,7 @@ function parseInstallArgs(argv) {
         opts.dryRun = true;
         break;
       case "--no-yaw-mcp-config":
-        opts.skipMcphConfig = true;
+        opts.skipYawMcpConfig = true;
         break;
       case "--list":
         opts.listOnly = true;
@@ -2070,7 +2203,7 @@ async function runInstallList(opts, log2) {
     path: displayPath(p.path, home),
     status: statusFor(p)
   }));
-  const installed = probes.filter((p) => p.hasMcphEntry).length;
+  const installed = probes.filter((p) => p.hasMcpEntry).length;
   const available = probes.filter((p) => !p.unavailable).length;
   log2(`${installed}/${available} client scopes have yaw-mcp configured on ${os}.`);
   log2("");
@@ -2095,7 +2228,7 @@ async function runInstallList(opts, log2) {
 function statusFor(p) {
   if (p.unavailable) return "unavailable";
   if (p.malformed) return "malformed";
-  if (p.hasMcphEntry) return "installed";
+  if (p.hasMcpEntry) return "installed";
   if (p.exists) return "other-entries";
   return "not installed";
 }
@@ -2197,8 +2330,9 @@ var TRY_USAGE = `Usage: yaw-mcp try <slug> [flags]
                        Required env vars not supplied here AND not in your
                        shell's env block the trial with an explainer.
   --dry-run            Print what would happen without writing anything.
-  --base <url>         Override the explore endpoint base (default:
-                       $YAW_MCP_BASE_URL or https://yaw.sh/mcp).`;
+  --base <url>         Base URL for the signup/telemetry links (default:
+                       $YAW_MCP_BASE_URL or https://yaw.sh/mcp). The catalog
+                       itself is set via $YAW_MCP_CATALOG_URL.`;
 var TRY_CLEANUP_USAGE = `Usage: yaw-mcp try-cleanup <slug>
 
   Remove a previously-wired trial: peels the yaw-mcp-try-<slug> entry out of
@@ -2348,44 +2482,16 @@ async function loadOrCreateAnonId(home = homedir4()) {
   }
   return id;
 }
-async function defaultFetchExplore(baseUrl, slug) {
-  const url = `${baseUrl.replace(/\/$/, "")}/api/explore/${encodeURIComponent(slug)}`;
-  const ac = new AbortController();
-  const timer = setTimeout(() => ac.abort(), 1e4);
-  try {
-    const res = await fetch(url, { signal: ac.signal, headers: { accept: "application/json" } });
-    if (res.status === 404) {
-      throw new Error(`yaw-mcp try: no server with slug "${slug}" \u2014 check ${baseUrl}/explore for the catalog.`);
-    }
-    if (!res.ok) {
-      throw new Error(`yaw-mcp try: ${url} returned HTTP ${res.status}`);
-    }
-    const body = await res.json();
-    return validateExploreResponse(body, slug);
-  } finally {
-    clearTimeout(timer);
-  }
-}
-function validateExploreResponse(body, slug) {
-  if (!body || typeof body !== "object") {
-    throw new Error(`yaw-mcp try: /api/explore/${slug} returned a non-object response.`);
-  }
-  const b = body;
-  if (typeof b.slug !== "string" || typeof b.name !== "string" || typeof b.command !== "string") {
-    throw new Error(`yaw-mcp try: /api/explore/${slug} missing required string fields (slug/name/command).`);
-  }
-  if (!Array.isArray(b.args) || !b.args.every((x) => typeof x === "string")) {
-    throw new Error(`yaw-mcp try: /api/explore/${slug} has invalid args (expected string[]).`);
-  }
-  const req = Array.isArray(b.requiredEnvVars) ? b.requiredEnvVars.filter((x) => typeof x === "string") : [];
+async function defaultFetchExplore(_baseUrl, slug) {
+  const resolved = await resolveCatalogSlug(slug, { catalogUrl: process.env.YAW_MCP_CATALOG_URL });
   const out = {
-    slug: b.slug,
-    name: b.name,
-    command: b.command,
-    args: b.args,
-    requiredEnvVars: req
+    slug: resolved.slug,
+    name: resolved.name,
+    command: resolved.command,
+    args: resolved.args,
+    requiredEnvVars: resolved.requiredEnvKeys
   };
-  if (typeof b.docUrl === "string") out.docUrl = b.docUrl;
+  if (resolved.docUrl) out.docUrl = resolved.docUrl;
   return out;
 }
 async function defaultPostEvent(baseUrl, body) {
@@ -2771,7 +2877,7 @@ function selectFlakyNamespaces(entries, limit) {
 }
 
 // src/doctor-cmd.ts
-var VERSION = true ? "0.58.4" : "dev";
+var VERSION = true ? "0.59.1" : "dev";
 async function runDoctor(opts = {}) {
   if (opts.json) return runDoctorJson(opts);
   const lines = [];
@@ -2789,7 +2895,7 @@ async function runDoctor(opts = {}) {
   print(`yaw-mcp version: ${VERSION}`);
   print(`platform: ${os}`);
   print("");
-  const config = await loadMcphConfig({ cwd, home, env });
+  const config = await loadYawMcpConfig({ cwd, home, env });
   print("CONFIG FILES");
   if (config.loadedFiles.length === 0) {
     print("  (none \u2014 using defaults + env)");
@@ -2874,7 +2980,7 @@ async function runDoctorJson(opts) {
   const os = opts.os ?? CURRENT_OS;
   const env = opts.env ?? process.env;
   const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-  const config = await loadMcphConfig({ cwd, home, env });
+  const config = await loadYawMcpConfig({ cwd, home, env });
   const claudeConfigDir = env.CLAUDE_CONFIG_DIR && env.CLAUDE_CONFIG_DIR.length > 0 ? env.CLAUDE_CONFIG_DIR : void 0;
   const clients = probeClients({ home, os, cwd, claudeConfigDir });
   const envVarNames = [
@@ -3114,12 +3220,12 @@ function schemaSuffix(f) {
 function renderClientStatus(c, installCmd) {
   if (c.unavailable) return "unavailable on this OS";
   if (c.malformed) return "exists but JSON is malformed \u2014 fix or rerun `yaw-mcp install`";
-  if (c.hasMcphEntry && c.hasLegacyEntry) {
-    return `OK \u2014 has "${ENTRY_NAME}" entry; legacy "${LEGACY_ENTRY_NAME}" entry also present \u2014 remove it to avoid running yaw-mcp twice`;
+  if (c.hasMcpEntry && c.hasLegacyEntry) {
+    return `OK \u2014 has "${ENTRY_NAME}" entry; legacy "${c.legacyEntryName}" entry also present \u2014 remove it to avoid running yaw-mcp twice`;
   }
-  if (c.hasMcphEntry) return `OK \u2014 has "${ENTRY_NAME}" entry`;
+  if (c.hasMcpEntry) return `OK \u2014 has "${ENTRY_NAME}" entry`;
   if (c.hasLegacyEntry) {
-    return `legacy "${LEGACY_ENTRY_NAME}" entry present \u2014 run \`${installCmd}\` to migrate, then remove the legacy entry by hand`;
+    return `legacy "${c.legacyEntryName}" entry present \u2014 run \`${installCmd}\` to migrate, then remove the legacy entry by hand`;
   }
   if (c.exists) return `present, no "${ENTRY_NAME}" entry \u2014 run \`${installCmd}\``;
   return `not configured \u2014 run \`${installCmd}\``;
@@ -3134,8 +3240,9 @@ function probeClients(opts) {
         scope: target.scopes[0].scope,
         path: "(n/a)",
         exists: false,
-        hasMcphEntry: false,
+        hasMcpEntry: false,
         hasLegacyEntry: false,
+        legacyEntryName: null,
         malformed: false,
         unavailable: true
       });
@@ -3156,8 +3263,9 @@ function probeClients(opts) {
         continue;
       }
       const exists3 = existsSync3(resolved.absolute);
-      let hasMcphEntry = false;
+      let hasMcpEntry = false;
       let hasLegacyEntry = false;
+      let legacyEntryName = null;
       let malformed = false;
       if (exists3) {
         try {
@@ -3168,8 +3276,9 @@ function probeClients(opts) {
             if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
               const container = walkContainer(parsed, resolved.containerPath);
               if (container) {
-                hasMcphEntry = ENTRY_NAME in container;
-                hasLegacyEntry = LEGACY_ENTRY_NAME in container;
+                hasMcpEntry = ENTRY_NAME in container;
+                legacyEntryName = findLegacyEntry(container);
+                hasLegacyEntry = legacyEntryName !== null;
               }
             } else {
               malformed = true;
@@ -3184,8 +3293,9 @@ function probeClients(opts) {
         scope: scope.scope,
         path: resolved.absolute,
         exists: exists3,
-        hasMcphEntry,
+        hasMcpEntry,
         hasLegacyEntry,
+        legacyEntryName,
         malformed,
         unavailable: false
       });
@@ -3212,8 +3322,9 @@ async function probeClientsAsync(opts) {
         scope: target.scopes[0].scope,
         path: "(n/a)",
         exists: false,
-        hasMcphEntry: false,
+        hasMcpEntry: false,
         hasLegacyEntry: false,
+        legacyEntryName: null,
         malformed: false,
         unavailable: true
       });
@@ -3229,8 +3340,9 @@ async function probeClientsAsync(opts) {
         claudeConfigDir: opts.claudeConfigDir
       });
       const exists3 = existsSync3(resolved.absolute);
-      let hasMcphEntry = false;
+      let hasMcpEntry = false;
       let hasLegacyEntry = false;
+      let legacyEntryName = null;
       let malformed = false;
       if (exists3) {
         try {
@@ -3240,8 +3352,9 @@ async function probeClientsAsync(opts) {
             if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
               const container = walkContainer(parsed, resolved.containerPath);
               if (container) {
-                hasMcphEntry = ENTRY_NAME in container;
-                hasLegacyEntry = LEGACY_ENTRY_NAME in container;
+                hasMcpEntry = ENTRY_NAME in container;
+                legacyEntryName = findLegacyEntry(container);
+                hasLegacyEntry = legacyEntryName !== null;
               }
             } else {
               malformed = true;
@@ -3256,8 +3369,9 @@ async function probeClientsAsync(opts) {
         scope: scope.scope,
         path: resolved.absolute,
         exists: exists3,
-        hasMcphEntry,
+        hasMcpEntry,
         hasLegacyEntry,
+        legacyEntryName,
         malformed,
         unavailable: false
       });
@@ -3439,6 +3553,466 @@ function closestNames(query, candidates, limit) {
   return scored.slice(0, limit).map((s) => s.name);
 }
 
+// src/local-add-cmd.ts
+import { homedir as homedir7 } from "os";
+
+// src/local-bundles.ts
+import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync4 } from "fs";
+import { readFile as readFile6 } from "fs/promises";
+import { homedir as homedir6 } from "os";
+import { join as join7 } from "path";
+var BUNDLES_FILENAME = "bundles.json";
+var CURRENT_BUNDLES_SCHEMA_VERSION = 1;
+function localBundlesPath(configDir) {
+  return join7(configDir, BUNDLES_FILENAME);
+}
+var NAMESPACE_RE = /^[a-z][a-z0-9_]{0,29}$/;
+function validateEntry(entry, warnings) {
+  if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+    warnings.push("bundles.json: skipping non-object server entry");
+    return null;
+  }
+  const e = entry;
+  const namespace = typeof e.namespace === "string" ? e.namespace : "";
+  if (!namespace || !NAMESPACE_RE.test(namespace)) {
+    warnings.push(`bundles.json: skipping server with invalid namespace ${JSON.stringify(namespace)}`);
+    return null;
+  }
+  const name = typeof e.name === "string" && e.name.length > 0 ? e.name : namespace;
+  const type = e.type === "remote" ? "remote" : "local";
+  const transport = e.transport === "streamable-http" || e.transport === "sse" || e.transport === "stdio" ? e.transport : void 0;
+  const command = typeof e.command === "string" ? e.command : void 0;
+  const args = Array.isArray(e.args) ? e.args.filter((a) => typeof a === "string") : void 0;
+  const env = e.env && typeof e.env === "object" && !Array.isArray(e.env) ? Object.fromEntries(
+    Object.entries(e.env).filter(([, v]) => typeof v === "string")
+  ) : void 0;
+  const url = typeof e.url === "string" ? e.url : void 0;
+  const description = typeof e.description === "string" ? e.description : void 0;
+  const isActive = e.isActive !== false;
+  const id = typeof e.id === "string" && e.id.length > 0 ? e.id : `local-${namespace}`;
+  return {
+    id,
+    name,
+    namespace,
+    type,
+    transport,
+    command,
+    args,
+    env,
+    url,
+    isActive,
+    description
+  };
+}
+async function readBundlesAt(path3, warnings) {
+  let raw;
+  try {
+    raw = await readFile6(path3, "utf8");
+  } catch {
+    return { exists: false, file: null };
+  }
+  let parsed;
+  try {
+    parsed = parseJsonc(raw);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    warnings.push(`${path3}: invalid JSON (${msg}) -- file ignored`);
+    log("warn", "bundles.json is not valid JSON; ignoring", { path: path3, error: msg });
+    return { exists: true, file: null };
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    warnings.push(`${path3}: root must be a JSON object -- file ignored`);
+    return { exists: true, file: null };
+  }
+  const obj = parsed;
+  const version = typeof obj.version === "number" ? obj.version : void 0;
+  if (version !== void 0 && version > CURRENT_BUNDLES_SCHEMA_VERSION) {
+    warnings.push(
+      `${path3}: schema version ${version} is newer than this yaw-mcp (${CURRENT_BUNDLES_SCHEMA_VERSION}); upgrade with \`npm i -g @yawlabs/mcp@latest\`. Loading best-effort.`
+    );
+  }
+  const rawServers = obj.servers;
+  if (!Array.isArray(rawServers)) {
+    warnings.push(`${path3}: 'servers' must be an array -- file ignored`);
+    return { exists: true, file: null };
+  }
+  return {
+    exists: true,
+    file: { version, servers: rawServers }
+  };
+}
+function hashContent(servers) {
+  const h = createHash2("sha256");
+  h.update(JSON.stringify(servers));
+  return `local-${h.digest("hex").slice(0, 16)}`;
+}
+async function loadLocalBundles(opts = {}) {
+  const cwd = opts.cwd ?? process.cwd();
+  const home = opts.home ?? homedir6();
+  const warnings = [];
+  const projectDir = await findProjectConfigDir(cwd, home).catch(() => null);
+  const projectPath = projectDir ? localBundlesPath(projectDir) : null;
+  const globalPath = localBundlesPath(join7(home, CONFIG_DIRNAME));
+  const projectResult = projectPath ? await readBundlesAt(projectPath, warnings) : { exists: false, file: null };
+  let file;
+  let sourcePath;
+  if (projectResult.exists) {
+    file = projectResult.file;
+    sourcePath = projectPath;
+  } else {
+    const globalResult = await readBundlesAt(globalPath, warnings);
+    file = globalResult.file;
+    sourcePath = globalResult.exists ? globalPath : null;
+  }
+  if (!file) {
+    return { config: null, path: sourcePath, warnings };
+  }
+  const servers = [];
+  for (const raw of file.servers) {
+    const validated = validateEntry(raw, warnings);
+    if (validated) servers.push(validated);
+  }
+  return {
+    config: {
+      servers,
+      configVersion: hashContent(servers)
+    },
+    path: sourcePath,
+    warnings
+  };
+}
+function deriveNamespace(name) {
+  let ns = name.toLowerCase().replace(/[^a-z0-9]+/g, "");
+  if (ns.length === 0) return "server";
+  if (!/^[a-z]/.test(ns)) ns = `s${ns}`;
+  if (ns.length > 30) ns = ns.slice(0, 30);
+  return ns;
+}
+async function readRawUserBundles(home) {
+  const path3 = localBundlesPath(userConfigDir(home));
+  if (!existsSync4(path3)) {
+    return { version: CURRENT_BUNDLES_SCHEMA_VERSION, servers: [] };
+  }
+  const warnings = [];
+  const r = await readBundlesAt(path3, warnings);
+  if (!r.file) {
+    const detail = warnings.length > 0 ? ` (${warnings.join("; ")})` : "";
+    throw new Error(`${path3} is malformed${detail}; fix it by hand before adding servers.`);
+  }
+  return { version: r.file.version ?? CURRENT_BUNDLES_SCHEMA_VERSION, servers: r.file.servers };
+}
+async function upsertUserBundle(entry, opts = {}) {
+  const home = opts.home ?? homedir6();
+  const path3 = localBundlesPath(userConfigDir(home));
+  const file = await readRawUserBundles(home);
+  const idx = file.servers.findIndex(
+    (s) => s?.namespace === entry.namespace || entry.name != null && s?.name === entry.name
+  );
+  const replaced = idx >= 0;
+  if (replaced) file.servers[idx] = entry;
+  else file.servers.push(entry);
+  file.version = file.version ?? CURRENT_BUNDLES_SCHEMA_VERSION;
+  await atomicWriteFile(path3, `${JSON.stringify(file, null, 2)}
+`);
+  return { path: path3, replaced };
+}
+async function removeUserBundle(namespace, opts = {}) {
+  const home = opts.home ?? homedir6();
+  const path3 = localBundlesPath(userConfigDir(home));
+  if (!existsSync4(path3)) return { path: path3, removed: false };
+  const file = await readRawUserBundles(home);
+  const before = file.servers.length;
+  file.servers = file.servers.filter((s) => s?.namespace !== namespace);
+  if (file.servers.length === before) return { path: path3, removed: false };
+  file.version = file.version ?? CURRENT_BUNDLES_SCHEMA_VERSION;
+  await atomicWriteFile(path3, `${JSON.stringify(file, null, 2)}
+`);
+  return { path: path3, removed: true };
+}
+async function findShadowingProjectBundles(cwd, home = homedir6()) {
+  const projectDir = await findProjectConfigDir(cwd, home).catch(() => null);
+  if (!projectDir) return null;
+  const projectPath = localBundlesPath(projectDir);
+  return existsSync4(projectPath) ? projectPath : null;
+}
+
+// src/local-add-cmd.ts
+var SLUG_RE = /^[a-z0-9][a-z0-9-]{0,63}$/;
+var ADD_USAGE = `Usage: yaw-mcp add <slug> [flags]
+
+  Resolve <slug> from the yaw.sh/mcp catalog and add it to your local
+  ~/.yaw-mcp/bundles.json so yaw-mcp loads it (no account needed).
+
+  This is NOT the same as \`yaw-mcp install\` -- install wires the yaw-mcp
+  aggregator into an AI client; add adds an MCP server to yaw-mcp itself.
+
+  --env KEY=value   Provide a required env var's value. Repeatable. Required
+                    vars not given here AND not in your shell block the add.
+  --dry-run         Print what would be written without writing.
+  --json            Emit the written entry as JSON (implies success on stdout).
+  --catalog <url>   Override the catalog URL (default the public catalog).`;
+function parseEnvFlag(v, bag) {
+  if (!v || !v.includes("=")) return "--env requires KEY=value";
+  const eq = v.indexOf("=");
+  const key = v.slice(0, eq);
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) return `--env: invalid KEY "${key}"`;
+  bag[key] = v.slice(eq + 1);
+  return null;
+}
+function parseAddArgs(argv) {
+  if (argv.length === 0) return { ok: false, error: ADD_USAGE };
+  const positional = [];
+  const opts = {};
+  const env = {};
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    const next = () => argv[++i];
+    switch (a) {
+      case "--env": {
+        const e = parseEnvFlag(next(), env);
+        if (e) return { ok: false, error: e };
+        break;
+      }
+      case "--dry-run":
+        opts.dryRun = true;
+        break;
+      case "--json":
+        opts.json = true;
+        break;
+      case "--catalog": {
+        const v = next();
+        if (!v) return { ok: false, error: "--catalog requires a URL" };
+        opts.catalogUrl = v;
+        break;
+      }
+      case "-h":
+      case "--help":
+        return { ok: false, error: ADD_USAGE };
+      default:
+        if (a.startsWith("--")) return { ok: false, error: `Unknown flag: ${a}
+${ADD_USAGE}` };
+        positional.push(a);
+    }
+  }
+  if (positional.length !== 1) {
+    return { ok: false, error: `Expected exactly one server slug, got ${positional.length}.
+${ADD_USAGE}` };
+  }
+  opts.slug = positional[0];
+  if (Object.keys(env).length > 0) opts.envOverrides = env;
+  return { ok: true, options: opts };
+}
+async function runAdd(opts) {
+  const out = opts.out ?? ((s) => process.stdout.write(s));
+  const err = opts.err ?? ((s) => process.stderr.write(s));
+  const print = (s = "") => out(`${s}
+`);
+  const printErr = (s) => err(`${s}
+`);
+  if (!opts.slug) {
+    printErr(ADD_USAGE);
+    return { exitCode: 2, written: [] };
+  }
+  const slug = opts.slug;
+  if (!SLUG_RE.test(slug)) {
+    printErr(`yaw-mcp add: invalid slug "${slug}" (lowercase letters, digits, and dashes only).`);
+    return { exitCode: 2, written: [] };
+  }
+  const env = opts.env ?? process.env;
+  const home = opts.home ?? homedir7();
+  const cwd = opts.cwd ?? process.cwd();
+  let server;
+  try {
+    server = await resolveCatalogSlug(slug, {
+      catalogUrl: opts.catalogUrl ?? env.YAW_MCP_CATALOG_URL,
+      fetchCatalog: opts.fetchCatalog
+    });
+  } catch (e) {
+    printErr(`yaw-mcp add: ${e.message}`);
+    return { exitCode: 1, written: [] };
+  }
+  const namespace = deriveNamespace(server.name);
+  const supplied = { ...env, ...opts.envOverrides ?? {} };
+  const missing = server.requiredEnvKeys.filter((k) => !supplied[k] || supplied[k] === "");
+  if (missing.length > 0) {
+    printErr(`yaw-mcp add: ${server.name} needs the following env var(s) before it can run:`);
+    for (const k of missing) printErr(`  - ${k}`);
+    printErr("");
+    printErr("Provide them with --env KEY=value (repeatable) or your shell, then re-run:");
+    printErr(`  yaw-mcp add ${slug} ${missing.map((k) => `--env ${k}=...`).join(" ")}`);
+    if (server.docUrl) printErr(`Docs: ${server.docUrl}`);
+    return { exitCode: 1, written: [] };
+  }
+  const entryEnv = {};
+  for (const k of server.requiredEnvKeys) entryEnv[k] = "";
+  for (const [k, v] of Object.entries(opts.envOverrides ?? {})) entryEnv[k] = v;
+  const entry = {
+    id: `local-${namespace}`,
+    name: server.name,
+    namespace,
+    type: "local",
+    transport: "stdio",
+    command: server.command,
+    args: server.args,
+    env: Object.keys(entryEnv).length > 0 ? entryEnv : void 0,
+    isActive: true,
+    description: server.description
+  };
+  if (opts.dryRun) {
+    if (opts.json) {
+      print(JSON.stringify({ ok: true, dryRun: true, namespace, entry }, null, 2));
+    } else {
+      print(`yaw-mcp add (dry-run): would write ${server.name} as namespace "${namespace}"`);
+      print(`  command: ${entry.command} ${(entry.args ?? []).join(" ")}`);
+      if (entry.env) print(`  env keys: ${Object.keys(entry.env).join(", ")}`);
+    }
+    return { exitCode: 0, written: [] };
+  }
+  let res;
+  try {
+    res = await upsertUserBundle(entry, { home });
+  } catch (e) {
+    printErr(`yaw-mcp add: ${e.message}`);
+    return { exitCode: 1, written: [] };
+  }
+  if (opts.json) {
+    print(JSON.stringify({ ok: true, namespace, path: res.path, replaced: res.replaced, entry }, null, 2));
+  } else {
+    print(`${res.replaced ? "Updated" : "Added"} ${server.name} (namespace "${namespace}") in ${res.path}`);
+    print("Restart your MCP client (or yaw-mcp) to pick it up.");
+  }
+  const shadow = await findShadowingProjectBundles(cwd, home).catch(() => null);
+  if (shadow) {
+    printErr(
+      `Note: ${shadow} overrides your user-global bundles.json, so this entry won't load until you add it there or remove that file.`
+    );
+  }
+  return { exitCode: 0, written: [res.path] };
+}
+var REMOVE_USAGE = `Usage: yaw-mcp remove <slug-or-namespace>
+
+  Remove a server from your local ~/.yaw-mcp/bundles.json. Accepts either the
+  catalog slug it was added with (e.g. "brave-search") or its namespace as
+  shown by \`yaw-mcp list\` (e.g. "bravesearch"). No-op if it isn't present.`;
+var REMOVE_TARGET_RE = /^[a-z0-9][a-z0-9_-]{0,63}$/i;
+function parseRemoveArgs(argv) {
+  if (argv.length === 0) return { ok: false, error: REMOVE_USAGE };
+  const positional = [];
+  for (const a of argv) {
+    if (a === "-h" || a === "--help") return { ok: false, error: REMOVE_USAGE };
+    if (a.startsWith("--")) return { ok: false, error: `Unknown flag: ${a}
+${REMOVE_USAGE}` };
+    positional.push(a);
+  }
+  if (positional.length !== 1) {
+    return { ok: false, error: `Expected exactly one slug or namespace.
+${REMOVE_USAGE}` };
+  }
+  return { ok: true, options: { target: positional[0] } };
+}
+async function runRemove(opts) {
+  const out = opts.out ?? ((s) => process.stdout.write(s));
+  const err = opts.err ?? ((s) => process.stderr.write(s));
+  const print = (s = "") => out(`${s}
+`);
+  const printErr = (s) => err(`${s}
+`);
+  if (!opts.target) {
+    printErr(REMOVE_USAGE);
+    return { exitCode: 2, written: [] };
+  }
+  if (!REMOVE_TARGET_RE.test(opts.target)) {
+    printErr(`yaw-mcp remove: "${opts.target}" isn't a valid slug or namespace.`);
+    return { exitCode: 2, written: [] };
+  }
+  const home = opts.home ?? homedir7();
+  const cwd = opts.cwd ?? process.cwd();
+  const derived = deriveNamespace(opts.target);
+  const candidates = derived === opts.target ? [opts.target] : [opts.target, derived];
+  let res = null;
+  let matched = "";
+  try {
+    for (const ns of candidates) {
+      res = await removeUserBundle(ns, { home });
+      if (res.removed) {
+        matched = ns;
+        break;
+      }
+    }
+  } catch (e) {
+    printErr(`yaw-mcp remove: ${e.message}`);
+    return { exitCode: 1, written: [] };
+  }
+  if (!res || !res.removed) {
+    print(`yaw-mcp remove: no server matching "${opts.target}" in ${res?.path ?? "bundles.json"} (nothing to do).`);
+    const shadow2 = await findShadowingProjectBundles(cwd, home).catch(() => null);
+    if (shadow2) {
+      printErr(
+        `Note: a project-local ${shadow2} is in effect; \`remove\` only manages your user-global bundles.json, so a server defined there must be removed from that file directly.`
+      );
+    }
+    return { exitCode: 0, written: [] };
+  }
+  print(`Removed "${matched}" from ${res.path}. Restart your MCP client to apply.`);
+  const shadow = await findShadowingProjectBundles(cwd, home).catch(() => null);
+  if (shadow) {
+    printErr(
+      `Note: ${shadow} shadows your user-global bundles.json; a server defined there is unaffected by this removal.`
+    );
+  }
+  return { exitCode: 0, written: [res.path] };
+}
+var LIST_USAGE = `Usage: yaw-mcp list [--json]
+
+  List the MCP servers yaw-mcp loads locally from bundles.json (the
+  project-local file wins over user-global). --json for machine output.`;
+function parseListArgs(argv) {
+  const opts = {};
+  for (const a of argv) {
+    if (a === "-h" || a === "--help") return { ok: false, error: LIST_USAGE };
+    if (a === "--json") {
+      opts.json = true;
+      continue;
+    }
+    return { ok: false, error: `Unknown argument: ${a}
+${LIST_USAGE}` };
+  }
+  return { ok: true, options: opts };
+}
+async function runList(opts) {
+  const out = opts.out ?? ((s) => process.stdout.write(s));
+  const print = (s = "") => out(`${s}
+`);
+  const home = opts.home ?? homedir7();
+  const cwd = opts.cwd ?? process.cwd();
+  const loaded = await loadLocalBundles({ home, cwd });
+  const servers = loaded.config?.servers ?? [];
+  if (opts.json) {
+    print(JSON.stringify({ path: loaded.path, servers }, null, 2));
+    return { exitCode: 0, written: [] };
+  }
+  if (servers.length === 0) {
+    print("No local servers configured. Add one with `yaw-mcp add <slug>`");
+    print("(browse the catalog at https://yaw.sh/mcp/catalog/).");
+    return { exitCode: 0, written: [] };
+  }
+  const rows = [...servers].sort((a, b) => a.namespace.localeCompare(b.namespace));
+  const cols = [
+    ["NAMESPACE", (s) => s.namespace],
+    ["NAME", (s) => s.name],
+    ["STATUS", (s) => s.isActive ? "active" : "disabled"],
+    ["LAUNCH", (s) => [s.command, ...s.args ?? []].filter(Boolean).join(" ") || s.url || ""]
+  ];
+  const widths = cols.map(([h, get]) => Math.max(h.length, ...rows.map((r) => get(r).length)));
+  const fmt = (cells) => cells.map((c, i) => c.padEnd(widths[i])).join("  ").trimEnd();
+  print(fmt(cols.map(([h]) => h)));
+  for (const r of rows) print(fmt(cols.map(([, get]) => get(r))));
+  if (loaded.path) print(`
+${servers.length} server${servers.length === 1 ? "" : "s"} in ${loaded.path}`);
+  return { exitCode: 0, written: [] };
+}
+
 // src/login-cmd.ts
 var LOGIN_USAGE = `Usage: yaw-mcp login --key <license-key>
 
@@ -3557,15 +4131,18 @@ async function runLogout(opts = {}, io = {
 }
 
 // src/nag.ts
-import { readFile as readFile6 } from "fs/promises";
-import { homedir as homedir6 } from "os";
-import { join as join7 } from "path";
+import { readFile as readFile7 } from "fs/promises";
+import { homedir as homedir8 } from "os";
+import { join as join8 } from "path";
 var NAG_STATE_FILENAME = "nag-state.json";
 var MIN_THRESHOLD = 2;
 var MAX_THRESHOLD = 4;
 var FLOOR_MS = 36 * 60 * 60 * 1e3;
 var NAG_ELIGIBLE_SUBCOMMANDS = /* @__PURE__ */ new Set([
   "install",
+  "add",
+  "remove",
+  "list",
   "doctor",
   "servers",
   "bundles",
@@ -3583,15 +4160,15 @@ var NAG_ELIGIBLE_SUBCOMMANDS = /* @__PURE__ */ new Set([
 function emptyNagState() {
   return { touchPoints: 0, nextThreshold: MIN_THRESHOLD, lastShownAt: 0 };
 }
-function nagStatePath(home = homedir6()) {
-  return join7(home, CONFIG_DIRNAME, NAG_STATE_FILENAME);
+function nagStatePath(home = homedir8()) {
+  return join8(home, CONFIG_DIRNAME, NAG_STATE_FILENAME);
 }
 function isFileNotFound2(err) {
   return !!err && typeof err === "object" && "code" in err && err.code === "ENOENT";
 }
 async function loadNagState(filePath = nagStatePath()) {
   try {
-    const raw = await readFile6(filePath, "utf8");
+    const raw = await readFile7(filePath, "utf8");
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed !== "object") return emptyNagState();
     const p = parsed;
@@ -3691,8 +4268,8 @@ async function showNagInterstitial(opts = {}) {
 
 // src/reset-learning-cmd.ts
 import { unlink as unlink2 } from "fs/promises";
-import { homedir as homedir7 } from "os";
-import { join as join8 } from "path";
+import { homedir as homedir9 } from "os";
+import { join as join9 } from "path";
 var RESET_LEARNING_USAGE = `Usage: yaw-mcp reset-learning
 
   Delete ~/.yaw-mcp/state.json so cross-session learning starts fresh.
@@ -3714,7 +4291,7 @@ ${RESET_LEARNING_USAGE}`
   return { kind: "ok", options: {} };
 }
 async function runResetLearning(opts = {}) {
-  const home = opts.home ?? homedir7();
+  const home = opts.home ?? homedir9();
   const env = opts.env ?? process.env;
   const write = opts.out ?? ((s) => process.stdout.write(s));
   const writeErr = opts.err ?? ((s) => process.stderr.write(s));
@@ -3729,7 +4306,7 @@ async function runResetLearning(opts = {}) {
     writeErr(`${s}
 `);
   };
-  const filePath = join8(userConfigDir(home), STATE_FILENAME);
+  const filePath = join9(userConfigDir(home), STATE_FILENAME);
   const raw = env.YAW_MCP_DISABLE_PERSISTENCE;
   const disabled = raw !== void 0 && raw !== "" && (raw === "1" || raw.toLowerCase() === "true");
   if (disabled) {
@@ -3762,16 +4339,16 @@ function isFileNotFound3(err) {
 }
 
 // src/secrets-cmd.ts
-import { existsSync as existsSync5 } from "fs";
+import { existsSync as existsSync6 } from "fs";
 import { mkdir as mkdir3 } from "fs/promises";
-import { homedir as homedir9 } from "os";
+import { homedir as homedir11 } from "os";
 import { dirname as dirname3 } from "path";
 
 // src/secrets-vault.ts
-import { existsSync as existsSync4 } from "fs";
-import { chmod as chmod3, readFile as readFile7 } from "fs/promises";
-import { homedir as homedir8 } from "os";
-import { dirname as dirname2, join as join9 } from "path";
+import { existsSync as existsSync5 } from "fs";
+import { chmod as chmod3, readFile as readFile8 } from "fs/promises";
+import { homedir as homedir10 } from "os";
+import { dirname as dirname2, join as join10 } from "path";
 
 // src/secrets-crypto.ts
 import { createCipheriv, createDecipheriv, randomBytes, scrypt as scryptCb } from "crypto";
@@ -3829,8 +4406,8 @@ function decryptEntry(entry, key) {
 // src/secrets-vault.ts
 var SECRETS_FILENAME = "secrets.json";
 var SECRETS_SCHEMA_VERSION = 1;
-function vaultPath(home = homedir8()) {
-  return join9(home, CONFIG_DIRNAME, SECRETS_FILENAME);
+function vaultPath(home = homedir10()) {
+  return join10(home, CONFIG_DIRNAME, SECRETS_FILENAME);
 }
 function emptyVault() {
   return {
@@ -3840,10 +4417,10 @@ function emptyVault() {
   };
 }
 async function loadVault(path3) {
-  if (!existsSync4(path3)) return null;
+  if (!existsSync5(path3)) return null;
   let raw;
   try {
-    raw = await readFile7(path3, "utf8");
+    raw = await readFile8(path3, "utf8");
   } catch (err) {
     log("warn", "Failed to read vault", { path: path3, error: err instanceof Error ? err.message : String(err) });
     return null;
@@ -4097,13 +4674,13 @@ async function readStdinValue(io) {
 }
 async function ensureVaultDir(path3) {
   const dir = dirname3(path3);
-  if (!existsSync5(dir)) await mkdir3(dir, { recursive: true });
+  if (!existsSync6(dir)) await mkdir3(dir, { recursive: true });
 }
 async function runSecrets(opts, io = {
   out: (s) => process.stdout.write(s),
   err: (s) => process.stderr.write(s)
 }) {
-  const home = opts.home ?? homedir9();
+  const home = opts.home ?? homedir11();
   const path3 = vaultPath(home);
   if (opts.action === "lock") {
     lock();
@@ -4121,7 +4698,7 @@ async function runSecrets(opts, io = {
   if (opts.action === "list") {
     const vault2 = await loadVault(path3);
     const keys = vault2 ? listKeys(vault2) : [];
-    if (opts.json) io.out(`${JSON.stringify({ ok: true, vault: existsSync5(path3), keys }, null, 2)}
+    if (opts.json) io.out(`${JSON.stringify({ ok: true, vault: existsSync6(path3), keys }, null, 2)}
 `);
     else if (!vault2) io.out(`No vault at ${path3}. Run \`yaw-mcp secrets set <name>\` to create one.
 `);
@@ -4136,7 +4713,7 @@ async function runSecrets(opts, io = {
     return { exitCode: 0 };
   }
   let vault = await loadVault(path3) ?? newVault();
-  const isFresh = !existsSync5(path3);
+  const isFresh = !existsSync6(path3);
   const passphrase = await resolvePassphrase(opts);
   if (passphrase === null) {
     const msg = "Passphrase required. Set YAW_MCP_VAULT_PASSPHRASE or run from a TTY so we can prompt.";
@@ -4231,7 +4808,7 @@ async function runSecrets(opts, io = {
 }
 var MCP_SECRETS_RESOURCE = "mcp_secrets";
 async function runSecretsPush(opts, io) {
-  const home = opts.home ?? homedir9();
+  const home = opts.home ?? homedir11();
   const path3 = vaultPath(home);
   const session = await getSession({ home, baseUrl: opts.baseUrl });
   if (!session) {
@@ -4294,7 +4871,7 @@ async function runSecretsPush(opts, io) {
   }
 }
 async function runSecretsPull(opts, io) {
-  const home = opts.home ?? homedir9();
+  const home = opts.home ?? homedir11();
   const path3 = vaultPath(home);
   const session = await getSession({ home, baseUrl: opts.baseUrl });
   if (!session) {
@@ -4350,7 +4927,7 @@ async function runSecretsPull(opts, io) {
 
 // src/server.ts
 import { readFile as readFile10 } from "fs/promises";
-import { homedir as homedir11 } from "os";
+import { homedir as homedir12 } from "os";
 import { isAbsolute, relative, resolve as resolve4 } from "path";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -4550,7 +5127,7 @@ Or re-run with --run to upgrade in place.`);
   return { exitCode: 3, lines };
 }
 function readCurrentVersion() {
-  return true ? "0.58.4" : "dev";
+  return true ? "0.59.1" : "dev";
 }
 
 // src/auto-upgrade.ts
@@ -4598,7 +5175,7 @@ function defaultSpawn2(cmd, args) {
 async function maybeAutoUpgrade(deps = {}) {
   const optOut = process.env.YAW_MCP_AUTO_UPGRADE;
   if (optOut === "0" || optOut?.toLowerCase() === "false") return;
-  const current = deps.currentVersion ?? (true ? "0.58.4" : "dev");
+  const current = deps.currentVersion ?? (true ? "0.59.1" : "dev");
   if (current === "dev") return;
   const method = detectInstallMethod(deps.argvPath ?? process.argv[1]);
   const latest = await (deps.fetchLatestImpl ?? fetchLatestVersion2)();
@@ -4969,13 +5546,13 @@ function stepBindingKey(step, index) {
 }
 
 // src/guide.ts
-import { readFile as readFile8 } from "fs/promises";
+import { readFile as readFile9 } from "fs/promises";
 var GUIDE_READ_TIMEOUT_MS = 1e3;
 async function readGuide(path3, scope) {
   let raw;
   try {
     raw = await Promise.race([
-      readFile8(path3, "utf8"),
+      readFile9(path3, "utf8"),
       new Promise(
         (_, reject) => setTimeout(() => reject(new Error("guide read timeout")), GUIDE_READ_TIMEOUT_MS)
       )
@@ -5257,132 +5834,6 @@ var LearningStore = class {
   }
 };
 
-// src/local-bundles.ts
-import { createHash as createHash2 } from "crypto";
-import { readFile as readFile9 } from "fs/promises";
-import { homedir as homedir10 } from "os";
-import { join as join10 } from "path";
-var BUNDLES_FILENAME = "bundles.json";
-var CURRENT_BUNDLES_SCHEMA_VERSION = 1;
-function localBundlesPath(configDir) {
-  return join10(configDir, BUNDLES_FILENAME);
-}
-var NAMESPACE_RE = /^[a-z][a-z0-9_]{0,29}$/;
-function validateEntry(entry, warnings) {
-  if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
-    warnings.push("bundles.json: skipping non-object server entry");
-    return null;
-  }
-  const e = entry;
-  const namespace = typeof e.namespace === "string" ? e.namespace : "";
-  if (!namespace || !NAMESPACE_RE.test(namespace)) {
-    warnings.push(`bundles.json: skipping server with invalid namespace ${JSON.stringify(namespace)}`);
-    return null;
-  }
-  const name = typeof e.name === "string" && e.name.length > 0 ? e.name : namespace;
-  const type = e.type === "remote" ? "remote" : "local";
-  const transport = e.transport === "streamable-http" || e.transport === "sse" || e.transport === "stdio" ? e.transport : void 0;
-  const command = typeof e.command === "string" ? e.command : void 0;
-  const args = Array.isArray(e.args) ? e.args.filter((a) => typeof a === "string") : void 0;
-  const env = e.env && typeof e.env === "object" && !Array.isArray(e.env) ? Object.fromEntries(
-    Object.entries(e.env).filter(([, v]) => typeof v === "string")
-  ) : void 0;
-  const url = typeof e.url === "string" ? e.url : void 0;
-  const description = typeof e.description === "string" ? e.description : void 0;
-  const isActive = e.isActive !== false;
-  const id = typeof e.id === "string" && e.id.length > 0 ? e.id : `local-${namespace}`;
-  return {
-    id,
-    name,
-    namespace,
-    type,
-    transport,
-    command,
-    args,
-    env,
-    url,
-    isActive,
-    description
-  };
-}
-async function readBundlesAt(path3, warnings) {
-  let raw;
-  try {
-    raw = await readFile9(path3, "utf8");
-  } catch {
-    return { exists: false, file: null };
-  }
-  let parsed;
-  try {
-    parsed = parseJsonc(raw);
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    warnings.push(`${path3}: invalid JSON (${msg}) -- file ignored`);
-    log("warn", "bundles.json is not valid JSON; ignoring", { path: path3, error: msg });
-    return { exists: true, file: null };
-  }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    warnings.push(`${path3}: root must be a JSON object -- file ignored`);
-    return { exists: true, file: null };
-  }
-  const obj = parsed;
-  const version = typeof obj.version === "number" ? obj.version : void 0;
-  if (version !== void 0 && version > CURRENT_BUNDLES_SCHEMA_VERSION) {
-    warnings.push(
-      `${path3}: schema version ${version} is newer than this yaw-mcp (${CURRENT_BUNDLES_SCHEMA_VERSION}); upgrade with \`npm i -g @yawlabs/mcp@latest\`. Loading best-effort.`
-    );
-  }
-  const rawServers = obj.servers;
-  if (!Array.isArray(rawServers)) {
-    warnings.push(`${path3}: 'servers' must be an array -- file ignored`);
-    return { exists: true, file: null };
-  }
-  return {
-    exists: true,
-    file: { version, servers: rawServers }
-  };
-}
-function hashContent(servers) {
-  const h = createHash2("sha256");
-  h.update(JSON.stringify(servers));
-  return `local-${h.digest("hex").slice(0, 16)}`;
-}
-async function loadLocalBundles(opts = {}) {
-  const cwd = opts.cwd ?? process.cwd();
-  const home = opts.home ?? homedir10();
-  const warnings = [];
-  const projectDir = await findProjectConfigDir(cwd, home).catch(() => null);
-  const projectPath = projectDir ? localBundlesPath(projectDir) : null;
-  const globalPath = localBundlesPath(join10(home, CONFIG_DIRNAME));
-  const projectResult = projectPath ? await readBundlesAt(projectPath, warnings) : { exists: false, file: null };
-  let file;
-  let sourcePath;
-  if (projectResult.exists) {
-    file = projectResult.file;
-    sourcePath = projectPath;
-  } else {
-    const globalResult = await readBundlesAt(globalPath, warnings);
-    file = globalResult.file;
-    sourcePath = globalResult.exists ? globalPath : null;
-  }
-  if (!file) {
-    return { config: null, path: sourcePath, warnings };
-  }
-  const servers = [];
-  for (const raw of file.servers) {
-    const validated = validateEntry(raw, warnings);
-    if (validated) servers.push(validated);
-  }
-  return {
-    config: {
-      servers,
-      configVersion: hashContent(servers)
-    },
-    path: sourcePath,
-    warnings
-  };
-}
-
 // src/meta-tools.ts
 var META_TOOLS = {
   discover: {
@@ -6993,7 +7444,7 @@ function categorizeSpawnError(err) {
 }
 async function connectToUpstream(config, onDisconnect, onListChanged) {
   const client = new Client(
-    { name: "yaw-mcp", version: true ? "0.58.4" : "dev" },
+    { name: "yaw-mcp", version: true ? "0.59.1" : "dev" },
     { capabilities: {} }
   );
   let transport;
@@ -7302,7 +7753,7 @@ var ConnectServer = class _ConnectServer {
     this.apiUrl = apiUrl5;
     this.token = token5;
     this.server = new Server(
-      { name: "yaw-mcp", version: true ? "0.58.4" : "dev" },
+      { name: "yaw-mcp", version: true ? "0.59.1" : "dev" },
       {
         capabilities: {
           tools: { listChanged: true },
@@ -8833,7 +9284,7 @@ ${activeCount} loaded in this session, ${totalTools} tools in context${tokenSumm
     }
     const ALLOWED_FILENAMES = ["claude_desktop_config.json", "mcp.json", "settings.json", "mcp_config.json"];
     try {
-      const resolved = filepath.startsWith("~/") || filepath.startsWith("~\\") ? resolve4(homedir11(), filepath.slice(2)) : resolve4(filepath);
+      const resolved = filepath.startsWith("~/") || filepath.startsWith("~\\") ? resolve4(homedir12(), filepath.slice(2)) : resolve4(filepath);
       const resolvedBasename = resolved.split(/[/\\]/).pop() || "";
       if (!ALLOWED_FILENAMES.includes(resolvedBasename)) {
         return {
@@ -8850,7 +9301,7 @@ ${activeCount} loaded in this session, ${totalTools} tools in context${tokenSumm
         const rel = relative(base, p);
         return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
       };
-      if (!isUnder(homedir11(), resolved) && !isUnder(process.cwd(), resolved)) {
+      if (!isUnder(homedir12(), resolved) && !isUnder(process.cwd(), resolved)) {
         return {
           content: [
             { type: "text", text: "Import path must be under your home directory or the current working directory." }
@@ -9504,7 +9955,7 @@ async function runServersCommand(opts = {}) {
     writeErr(`${s}
 `);
   };
-  const config = await loadMcphConfig({
+  const config = await loadYawMcpConfig({
     cwd: opts.cwd,
     home: opts.home,
     env: opts.env
@@ -9584,7 +10035,7 @@ function truncateVersion(v) {
 }
 
 // src/stats-cmd.ts
-import { homedir as homedir12 } from "os";
+import { homedir as homedir13 } from "os";
 var STATS_USAGE = `Usage: yaw-mcp stats [--json] [--limit N] [--days N]
 
   Print a digest of recent AI tool calls recorded against your Yaw
@@ -9699,7 +10150,7 @@ async function runStats(opts, io = {
   out: (s) => process.stdout.write(s),
   err: (s) => process.stderr.write(s)
 }) {
-  const home = opts.home ?? homedir12();
+  const home = opts.home ?? homedir13();
   const session = await getSession({ home, baseUrl: opts.baseUrl });
   if (!session) {
     const msg = "Not signed in. Yaw MCP analytics requires a Yaw Team account.\n  - Yaw Team: $15/seat/mo or $150/seat/yr -- https://yaw.sh/mcp\nSign in with: yaw-mcp login --key <license-key>";
@@ -9756,9 +10207,9 @@ async function runStats(opts, io = {
 }
 
 // src/sync-cmd.ts
-import { existsSync as existsSync6 } from "fs";
+import { existsSync as existsSync7 } from "fs";
 import { mkdir as mkdir4, readFile as readFile11 } from "fs/promises";
-import { homedir as homedir13 } from "os";
+import { homedir as homedir14 } from "os";
 import { dirname as dirname4, join as join11 } from "path";
 var SYNC_USAGE = `Usage: yaw-mcp sync <push|pull|status> [--json]
 
@@ -9806,7 +10257,7 @@ function bundlesPath(home) {
 }
 async function readLocalBundles(home) {
   const path3 = bundlesPath(home);
-  if (!existsSync6(path3)) return { version: 1, servers: [] };
+  if (!existsSync7(path3)) return { version: 1, servers: [] };
   const raw = await readFile11(path3, "utf8");
   const parsed = JSON.parse(raw);
   if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.servers)) {
@@ -9844,7 +10295,7 @@ async function runSync(opts, io = {
   out: (s) => process.stdout.write(s),
   err: (s) => process.stderr.write(s)
 }) {
-  const home = opts.home ?? homedir13();
+  const home = opts.home ?? homedir14();
   const session = await getSession({ home, baseUrl: opts.baseUrl });
   if (!session) {
     const msg = "Not signed in. Run `yaw-mcp login --key <license-key>` first.";
@@ -9987,6 +10438,9 @@ function handleSyncError(err, opts, io) {
 var KNOWN_SUBCOMMANDS = [
   "compliance",
   "install",
+  "add",
+  "remove",
+  "list",
   "doctor",
   "reset-learning",
   "servers",
@@ -10012,7 +10466,7 @@ if (subcommand && NAG_ELIGIBLE_SUBCOMMANDS.has(subcommand) && process.env.YAW_MC
   let inAccountMode = envHasToken;
   if (!inAccountMode) {
     try {
-      const cfg = await loadMcphConfig();
+      const cfg = await loadYawMcpConfig();
       inAccountMode = Boolean(cfg.token);
     } catch {
       inAccountMode = false;
@@ -10121,6 +10575,30 @@ if (subcommand === "compliance") {
     process.exit(2);
   }
   runTryCleanup(parsed.options).then((r) => process.exit(r.exitCode));
+} else if (subcommand === "add") {
+  const parsed = parseAddArgs(process.argv.slice(3));
+  if (!parsed.ok) {
+    process.stderr.write(`${parsed.error}
+`);
+    process.exit(2);
+  }
+  runAdd(parsed.options).then((r) => process.exit(r.exitCode));
+} else if (subcommand === "remove") {
+  const parsed = parseRemoveArgs(process.argv.slice(3));
+  if (!parsed.ok) {
+    process.stderr.write(`${parsed.error}
+`);
+    process.exit(2);
+  }
+  runRemove(parsed.options).then((r) => process.exit(r.exitCode));
+} else if (subcommand === "list") {
+  const parsed = parseListArgs(process.argv.slice(3));
+  if (!parsed.ok) {
+    process.stderr.write(`${parsed.error}
+`);
+    process.exit(2);
+  }
+  runList(parsed.options).then((r) => process.exit(r.exitCode));
 } else if (subcommand === "login") {
   const parsed = parseLoginArgs(process.argv.slice(3));
   if (!parsed.ok) {
@@ -10170,16 +10648,26 @@ if (subcommand === "compliance") {
     2. Install yaw-mcp     yaw-mcp install claude-code --token mcp_pat_...
     3. Verify setup     yaw-mcp doctor
 
-  Setup:
-    install <client>         Configure one MCP client to launch yaw-mcp.
-                             <client> is one of: claude-code, claude-desktop,
-                             cursor, vscode.
+  Setup (connect a client to yaw-mcp):
+    install <client>         Connect one MCP client to yaw-mcp. This wires the
+                             aggregator into the client; it does NOT add a
+                             server (for that, see \`add\` below). <client> is
+                             one of: claude-code, claude-desktop, cursor, vscode.
     install --list           List which MCP clients are installed on this
                              machine (read-only; no writes).
     install --all            Configure every installed MCP client in one go.
-    try <slug>               Wire a one-off trial of an upstream MCP server
-                             into your AI client. No account needed; expires
-                             after --ttl (default 1h). Doctor GCs it after.
+
+  Local servers (no account):
+    add <slug>               Add an MCP server from the yaw.sh/mcp catalog to
+                             your local ~/.yaw-mcp/bundles.json so yaw-mcp loads
+                             it. Pass required env with --env KEY=value.
+    remove <slug>            Remove a server (by slug or namespace) from
+                             bundles.json.
+    list                     List the servers yaw-mcp loads locally.
+    try <slug>               Wire a one-off trial of a catalog MCP server
+                             directly into your AI client (bypassing yaw-mcp).
+                             No account needed; expires after --ttl (default
+                             1h). Doctor GCs it after.
     try-cleanup <slug>       Remove a wired trial early.
 
   Inspection:
@@ -10200,6 +10688,17 @@ if (subcommand === "compliance") {
                              fish, or powershell. Redirect to your
                              completions directory to install.
 
+  Account / sync (Pro + Team):
+    login                    Authenticate this machine with a Yaw MCP account
+                             (Pro/Team). --key <license> to pass the key inline.
+    logout                   Sign this machine out of the account.
+    sync <push|pull|status>  Replicate your local bundles.json to/from the
+                             account store (env values stripped on push).
+    secrets <action>         Manage synced secret VALUES: set, get, list,
+                             remove, lock, push, pull.
+    stats                    Show your account usage statistics
+                             (--limit, --days, --json).
+
   Other:
     compliance <target>      Run the 88-test compliance suite against an MCP
                              server. --publish posts the report to
@@ -10230,8 +10729,10 @@ if (subcommand === "compliance") {
                                upgraded in the background).
     YAW_MCP_PRUNE_RESPONSES       Set to \`0\` to disable response pruning.
     YAW_MCP_DISABLE_PERSISTENCE   Disable cross-session learning state.
-    YAW_MCP_BASE_URL              Override the host \`yaw-mcp try\` queries for
-                               /api/explore/:slug (default https://yaw.sh/mcp).
+    YAW_MCP_CATALOG_URL          Override the catalog \`add\`/\`try\` resolve slugs
+                               against (default https://yaw.sh/data/mcp-catalog.json).
+    YAW_MCP_BASE_URL              Base URL for \`yaw-mcp try\` signup/telemetry
+                               links (default https://yaw.sh/mcp).
 
   Config resolution (highest precedence first):
     1. YAW_MCP_TOKEN / YAW_MCP_URL env vars
@@ -10249,7 +10750,7 @@ if (subcommand === "compliance") {
 `);
   process.exit(0);
 } else if (subcommand === "--version" || subcommand === "-V") {
-  process.stdout.write(`yaw-mcp ${true ? "0.58.4" : "dev"}
+  process.stdout.write(`yaw-mcp ${true ? "0.59.1" : "dev"}
 `);
   process.exit(0);
 } else if (subcommand && !subcommand.startsWith("-")) {
@@ -10263,7 +10764,7 @@ if (subcommand === "compliance") {
   runServer();
 }
 async function runServer() {
-  const config = await loadMcphConfig();
+  const config = await loadYawMcpConfig();
   for (const w of config.warnings) {
     log("warn", "Config warning", { warning: w });
   }