add-mcp 1.10.4 → 1.12.0

package/README.md

@@ -50,7 +50,7 @@ MCP servers can be installed to any of these agents:
 
 | Agent                  | `--agent`            | Project Path            | Global Path                                                                                                     |
 | ---------------------- | -------------------- | ----------------------- | --------------------------------------------------------------------------------------------------------------- |
-| Antigravity            | `antigravity`        | -                       | `~/.gemini/antigravity/mcp_config.json`                                                                         |
+| Antigravity            | `antigravity`        | -                       | `~/.gemini/config/mcp_config.json` (shared by Antigravity, Antigravity IDE, and Antigravity CLI)                |
 | Cline VSCode Extension | `cline`              | -                       | `~/Library/Application Support/Code/User/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json` |
 | Cline CLI              | `cline-cli`          | -                       | `~/.cline/data/settings/cline_mcp_settings.json`                                                                |
 | Claude Code            | `claude-code`        | `.mcp.json`             | `~/.claude.json`                                                                                                |
@@ -124,6 +124,16 @@ npx add-mcp https://mcp.example.com/sse --transport sse
 # Remote MCP server with auth header
 npx add-mcp https://mcp.example.com/mcp --header "Authorization: Bearer $TOKEN"
 
+# Remote server with a request timeout and OAuth scopes
+# (each agent only keeps the fields it supports; others are dropped with a warning)
+npx add-mcp https://mcp.example.com/mcp --timeout 30000 --scopes "read,write"
+
+# Auto-approve all tools for agents that support it (Codex, Claude Code)
+npx add-mcp "executor mcp" --name executor -a codex -a claude-code --auto-approve
+
+# Auto-approve only selected tools
+npx add-mcp "executor mcp" --name executor -a codex --auto-approve --approve-tool execute
+
 # npm package (runs via npx)
 npx add-mcp @modelcontextprotocol/server-postgres
 
@@ -160,18 +170,60 @@ npx add-mcp https://mcp.example.com/mcp -a cursor -y --gitignore
 
 ### Options
 
-| Option                   | Description                                                              |
-| ------------------------ | ------------------------------------------------------------------------ |
-| `-g, --global`           | Install to user directory instead of project                             |
-| `-a, --agent <agent>`    | Target specific agents (e.g., `cursor`, `claude-code`). Can be repeated. |
-| `-t, --transport <type>` | Transport type for remote servers: `http` (default), `sse`               |
-| `--type <type>`          | Alias for `--transport`                                                  |
-| `-h, --header <header>`  | HTTP header for remote servers (repeatable, `Key: Value`)                |
-| `--env <env>`            | Env var for local stdio servers (repeatable, `KEY=VALUE`)                |
-| `-n, --name <name>`      | Server name (auto-inferred if not provided)                              |
-| `-y, --yes`              | Skip all confirmation prompts                                            |
-| `--all`                  | Install to all agents                                                    |
-| `--gitignore`            | Add generated config files to `.gitignore`                               |
+| Option                    | Description                                                              |
+| ------------------------- | ------------------------------------------------------------------------ |
+| `-g, --global`            | Install to user directory instead of project                             |
+| `-a, --agent <agent>`     | Target specific agents (e.g., `cursor`, `claude-code`). Can be repeated. |
+| `-t, --transport <type>`  | Transport type for remote servers: `http` (default), `sse`               |
+| `--type <type>`           | Alias for `--transport`                                                  |
+| `-h, --header <header>`   | HTTP header for remote servers (repeatable, `Key: Value`)                |
+| `--env <env>`             | Env var for local stdio servers (repeatable, `KEY=VALUE`)                |
+| `--timeout <ms>`          | Request timeout (ms) for remote servers (capability-gated, see below)    |
+| `--scopes <scopes>`       | OAuth scopes for remote servers, comma-separated (capability-gated)      |
+| `--oauth-scopes <scopes>` | Alias for `--scopes`                                                     |
+| `--auto-approve`          | Auto-approve MCP tool calls for supported agents (Codex, Claude Code)    |
+| `--approve-tool <tool>`   | Tool to auto-approve with `--auto-approve` (repeatable; defaults to all) |
+| `-n, --name <name>`       | Server name (auto-inferred if not provided)                              |
+| `-y, --yes`               | Skip all confirmation prompts                                            |
+| `--all`                   | Install to all agents                                                    |
+| `--gitignore`             | Add generated config files to `.gitignore`                               |
+
+#### Capability-gated fields (`--timeout`, `--scopes`)
+
+Not every MCP client understands every field. `add-mcp` keeps one canonical
+server config and each agent declares which optional fields it supports, mapping
+them into that client's native shape:
+
+| Field              | Flag                                | Supported by            | Mapped to                                                |
+| ------------------ | ----------------------------------- | ----------------------- | -------------------------------------------------------- |
+| Timeout            | `--timeout`                         | Claude Code, Gemini CLI | `timeout` (milliseconds)                                 |
+| OAuth scopes       | `--scopes`                          | Cursor, Gemini CLI      | Cursor `auth.scopes`, Gemini `oauth.scopes`              |
+| Tool auto-approval | `--auto-approve` / `--approve-tool` | Codex, Claude Code      | Codex approval modes; Claude Code permission allow rules |
+
+When you target an agent that does not support a field, `add-mcp` drops it from
+that agent's config and prints a warning (e.g. _"request timeout is not
+supported by VS Code; dropped from that config."_). Other agents still receive
+it. `--timeout` and `--scopes` apply to remote servers only; `--auto-approve`
+applies to both remote and local servers.
+
+#### Auto-approving tool calls (`--auto-approve`)
+
+`--auto-approve` preconfigures agent-level approval so the agent doesn't prompt
+before each MCP tool call — useful for servers that already gate actions
+internally. Use `--approve-tool <name>` (repeatable) to approve only specific
+tools; without it, all tools are approved.
+
+- **Codex** — writes approval modes into `config.toml`: per-tool
+  `tools.<name>.approval_mode = "approve"`, or `default_tools_approval_mode = "approve"` for all tools.
+- **Claude Code** — writes permission allow rules to a separate settings file
+  (`.claude/settings.local.json` for project installs, `~/.claude/settings.json`
+  for global), e.g. `mcp__<server>__<tool>`, or `mcp__<server>` for all tools.
+  The MCP server entry itself stays clean.
+
+> Note: Claude Code's all-tools rule (`mcp__<server>`) follows the documented
+> format, but a known Claude Code bug ([#34739](https://github.com/anthropics/claude-code/issues/34739))
+> can still prompt for non-fully-qualified MCP rules. Listing tools explicitly
+> with `--approve-tool` is the most reliable path there.
 
 ### Transport Types
 
@@ -209,14 +261,16 @@ npx add-mcp find github --all --gitignore
 
 ### Options
 
-| Option                | Description                                                              |
-| --------------------- | ------------------------------------------------------------------------ |
-| `-g, --global`        | Install to user directory instead of project                             |
-| `-a, --agent <agent>` | Target specific agents (e.g., `cursor`, `claude-code`). Can be repeated. |
-| `-n, --name <name>`   | Server name override (defaults to the selected catalog entry name)       |
-| `-y, --yes`           | Skip confirmation prompts                                                |
-| `--all`               | Install to all agents                                                    |
-| `--gitignore`         | Add generated config files to `.gitignore`                               |
+| Option                  | Description                                                              |
+| ----------------------- | ------------------------------------------------------------------------ |
+| `-g, --global`          | Install to user directory instead of project                             |
+| `-a, --agent <agent>`   | Target specific agents (e.g., `cursor`, `claude-code`). Can be repeated. |
+| `-n, --name <name>`     | Server name override (defaults to the selected catalog entry name)       |
+| `-y, --yes`             | Skip confirmation prompts                                                |
+| `--auto-approve`        | Auto-approve MCP tool calls for supported agents (Codex, Claude Code)    |
+| `--approve-tool <tool>` | Tool to auto-approve with `--auto-approve` (repeatable; defaults to all) |
+| `--all`                 | Install to all agents                                                    |
+| `--gitignore`           | Add generated config files to `.gitignore`                               |
 
 Transport for `find`/`search` is inferred from registry metadata. The CLI prefers HTTP remotes when available and only falls back to SSE when HTTP is not available for the selected install context.
 

package/dist/{chunk-ONLHW5AV.js → chunk-IPCKQUBH.js}

@@ -133,7 +133,7 @@ var { appSupport, vscodePath, gooseConfigPath } = getPlatformPaths();
 var antigravityConfigPath = join2(
   home,
   ".gemini",
-  "antigravity",
+  "config",
   "mcp_config.json"
 );
 var clineCliConfigPath = join2(
@@ -159,6 +159,41 @@ var windsurfConfigPath = join2(
   "windsurf",
   "mcp_config.json"
 );
+function buildStandardRemote(config) {
+  const remote = {};
+  if (config.type) remote.type = config.type;
+  if (config.url) remote.url = config.url;
+  if (config.headers && Object.keys(config.headers).length > 0) {
+    remote.headers = config.headers;
+  }
+  if (typeof config.timeout === "number") {
+    remote.timeout = config.timeout;
+  }
+  return remote;
+}
+function buildStandardLocal(config) {
+  const local = {
+    command: config.command,
+    args: config.args || []
+  };
+  if (config.env && Object.keys(config.env).length > 0) {
+    local.env = config.env;
+  }
+  return local;
+}
+function transformStandardConfig(_serverName, config) {
+  return config.url ? buildStandardRemote(config) : buildStandardLocal(config);
+}
+function transformGeminiConfig(_serverName, config) {
+  if (!config.url) {
+    return buildStandardLocal(config);
+  }
+  const remote = buildStandardRemote(config);
+  if (config.oauthScopes && config.oauthScopes.length > 0) {
+    remote.oauth = { scopes: config.oauthScopes };
+  }
+  return remote;
+}
 function transformGooseConfig(serverName, config) {
   if (config.url) {
     const gooseType = config.type === "sse" ? "sse" : "streamable_http";
@@ -215,6 +250,17 @@ function transformOpenCodeConfig(_serverName, config) {
     environment: config.env || {}
   };
 }
+function applyCodexApproval(target, autoApproveTools) {
+  if (!autoApproveTools) return target;
+  if (autoApproveTools.length === 0) {
+    target.default_tools_approval_mode = "approve";
+    return target;
+  }
+  target.tools = Object.fromEntries(
+    autoApproveTools.map((tool) => [tool, { approval_mode: "approve" }])
+  );
+  return target;
+}
 function transformCodexConfig(_serverName, config) {
   if (config.url) {
     const remoteConfig = {
@@ -224,13 +270,16 @@ function transformCodexConfig(_serverName, config) {
     if (config.headers && Object.keys(config.headers).length > 0) {
       remoteConfig.http_headers = config.headers;
     }
-    return remoteConfig;
+    return applyCodexApproval(remoteConfig, config.autoApproveTools);
   }
-  return {
-    command: config.command,
-    args: config.args || [],
-    env: config.env
-  };
+  return applyCodexApproval(
+    {
+      command: config.command,
+      args: config.args || [],
+      env: config.env
+    },
+    config.autoApproveTools
+  );
 }
 function transformCursorConfig(_serverName, config) {
   if (config.url) {
@@ -240,9 +289,12 @@ function transformCursorConfig(_serverName, config) {
     if (config.headers && Object.keys(config.headers).length > 0) {
       remoteConfig.headers = config.headers;
     }
+    if (config.oauthScopes && config.oauthScopes.length > 0) {
+      remoteConfig.auth = { scopes: config.oauthScopes };
+    }
     return remoteConfig;
   }
-  return config;
+  return buildStandardLocal(config);
 }
 function transformClineConfig(_serverName, config) {
   if (config.url) {
@@ -335,8 +387,9 @@ var agents = {
     configKey: "mcpServers",
     format: "json",
     supportedTransports: ["stdio", "http", "sse"],
+    supportedFields: [],
     detectGlobalInstall: async () => {
-      return existsSync(join2(home, ".gemini"));
+      return existsSync(join2(home, ".gemini", "config"));
     },
     transformConfig: transformAntigravityConfig
   },
@@ -349,6 +402,7 @@ var agents = {
     configKey: "mcpServers",
     format: "json",
     supportedTransports: ["stdio", "http", "sse"],
+    supportedFields: [],
     detectGlobalInstall: async () => {
       return existsSync(dirname2(clineExtensionConfigPath));
     },
@@ -363,6 +417,7 @@ var agents = {
     configKey: "mcpServers",
     format: "json",
     supportedTransports: ["stdio", "http", "sse"],
+    supportedFields: [],
     detectGlobalInstall: async () => {
       return existsSync(dirname2(clineCliConfigPath));
     },
@@ -377,9 +432,11 @@ var agents = {
     configKey: "mcpServers",
     format: "json",
     supportedTransports: ["stdio", "http", "sse"],
+    supportedFields: ["timeout", "autoApprove"],
     detectGlobalInstall: async () => {
       return existsSync(join2(home, ".claude"));
-    }
+    },
+    transformConfig: transformStandardConfig
   },
   "claude-desktop": {
     name: "claude-desktop",
@@ -390,10 +447,12 @@ var agents = {
     configKey: "mcpServers",
     format: "json",
     supportedTransports: ["stdio"],
+    supportedFields: [],
     unsupportedTransportMessage: "Claude Desktop only supports local (stdio) servers via its config file. Add remote servers through Settings \u2192 Connectors in the app instead.",
     detectGlobalInstall: async () => {
       return existsSync(join2(appSupport, "Claude"));
-    }
+    },
+    transformConfig: transformStandardConfig
   },
   codex: {
     name: "codex",
@@ -407,6 +466,7 @@ var agents = {
     configKey: "mcp_servers",
     format: "toml",
     supportedTransports: ["stdio", "http", "sse"],
+    supportedFields: ["autoApprove"],
     detectGlobalInstall: async () => {
       return existsSync(join2(home, ".codex"));
     },
@@ -421,6 +481,7 @@ var agents = {
     configKey: "mcpServers",
     format: "json",
     supportedTransports: ["stdio", "http", "sse"],
+    supportedFields: ["scopes"],
     detectGlobalInstall: async () => {
       return existsSync(join2(home, ".cursor"));
     },
@@ -435,9 +496,11 @@ var agents = {
     configKey: "mcpServers",
     format: "json",
     supportedTransports: ["stdio", "http", "sse"],
+    supportedFields: ["timeout", "scopes"],
     detectGlobalInstall: async () => {
       return existsSync(join2(home, ".gemini"));
-    }
+    },
+    transformConfig: transformGeminiConfig
   },
   goose: {
     name: "goose",
@@ -448,6 +511,7 @@ var agents = {
     configKey: "extensions",
     format: "yaml",
     supportedTransports: ["stdio", "http", "sse"],
+    supportedFields: [],
     detectGlobalInstall: async () => {
       return existsSync(gooseConfigPath);
     },
@@ -463,6 +527,7 @@ var agents = {
     localConfigKey: "servers",
     format: "json",
     supportedTransports: ["stdio", "http", "sse"],
+    supportedFields: [],
     detectGlobalInstall: async () => {
       return existsSync(dirname2(copilotConfigPath));
     },
@@ -477,10 +542,12 @@ var agents = {
     configKey: "mcpServers",
     format: "json",
     supportedTransports: ["stdio", "http", "sse"],
+    supportedFields: [],
     detectGlobalInstall: async () => {
       return existsSync(join2(home, ".mcporter"));
     },
-    resolveConfigPath: resolveMcporterConfigPath
+    resolveConfigPath: resolveMcporterConfigPath,
+    transformConfig: transformStandardConfig
   },
   opencode: {
     name: "opencode",
@@ -491,6 +558,7 @@ var agents = {
     configKey: "mcp",
     format: "json",
     supportedTransports: ["stdio", "http", "sse"],
+    supportedFields: [],
     detectGlobalInstall: async () => {
       return existsSync(join2(home, ".config", "opencode"));
     },
@@ -505,9 +573,11 @@ var agents = {
     configKey: "servers",
     format: "json",
     supportedTransports: ["stdio", "http", "sse"],
+    supportedFields: [],
     detectGlobalInstall: async () => {
       return existsSync(vscodePath);
-    }
+    },
+    transformConfig: transformStandardConfig
   },
   windsurf: {
     name: "windsurf",
@@ -518,6 +588,7 @@ var agents = {
     configKey: "mcpServers",
     format: "json",
     supportedTransports: ["stdio", "http", "sse"],
+    supportedFields: [],
     detectGlobalInstall: async () => {
       return existsSync(join2(home, ".codeium", "windsurf"));
     },
@@ -532,6 +603,7 @@ var agents = {
     configKey: "context_servers",
     format: "json",
     supportedTransports: ["stdio", "http", "sse"],
+    supportedFields: [],
     detectGlobalInstall: async () => {
       const configDir = process.platform === "darwin" || process.platform === "win32" ? join2(appSupport, "Zed") : join2(appSupport, "zed");
       return existsSync(configDir);
@@ -1108,9 +1180,59 @@ function buildConfigWithKey(configKey, serverName, serverConfig) {
   return config;
 }
 
+// src/schema.ts
+var OPTIONAL_FIELD_SPECS = {
+  timeout: {
+    label: "request timeout",
+    isSet: (config) => typeof config.timeout === "number",
+    clear: (config) => {
+      delete config.timeout;
+    }
+  },
+  scopes: {
+    label: "OAuth scopes",
+    isSet: (config) => Array.isArray(config.oauthScopes) && config.oauthScopes.length > 0,
+    clear: (config) => {
+      delete config.oauthScopes;
+    }
+  },
+  autoApprove: {
+    label: "tool auto-approval",
+    // An empty array is meaningful ("approve all tools"), so presence alone
+    // counts as set — unlike scopes where an empty list means "nothing".
+    isSet: (config) => Array.isArray(config.autoApproveTools),
+    clear: (config) => {
+      delete config.autoApproveTools;
+    }
+  }
+};
+var ALL_OPTIONAL_FIELDS = Object.keys(
+  OPTIONAL_FIELD_SPECS
+);
+function describeOptionalField(field) {
+  return OPTIONAL_FIELD_SPECS[field].label;
+}
+function applyFieldSupport(config, supportedFields) {
+  const supported = new Set(supportedFields);
+  const copy = { ...config };
+  if (copy.oauthScopes) copy.oauthScopes = [...copy.oauthScopes];
+  if (copy.autoApproveTools) copy.autoApproveTools = [...copy.autoApproveTools];
+  const dropped = [];
+  for (const field of ALL_OPTIONAL_FIELDS) {
+    const spec = OPTIONAL_FIELD_SPECS[field];
+    if (spec.isSet(copy) && !supported.has(field)) {
+      spec.clear(copy);
+      dropped.push(field);
+    }
+  }
+  return { config: copy, dropped };
+}
+
 // src/installer.ts
 import { existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
+import { homedir as homedir3 } from "os";
 import { join as join3, dirname as dirname6, isAbsolute, relative, sep } from "path";
+var home2 = homedir3();
 function buildServerConfig(parsed, options = {}) {
   if (parsed.type === "remote") {
     const config2 = {
@@ -1120,6 +1242,15 @@ function buildServerConfig(parsed, options = {}) {
     if (options.headers && Object.keys(options.headers).length > 0) {
       config2.headers = options.headers;
     }
+    if (typeof options.timeout === "number") {
+      config2.timeout = options.timeout;
+    }
+    if (options.oauthScopes && options.oauthScopes.length > 0) {
+      config2.oauthScopes = options.oauthScopes;
+    }
+    if (options.autoApproveTools) {
+      config2.autoApproveTools = options.autoApproveTools;
+    }
     return config2;
   }
   if (parsed.type === "command") {
@@ -1141,6 +1272,9 @@ function buildServerConfig(parsed, options = {}) {
     if (options.env && Object.keys(options.env).length > 0) {
       config2.env = options.env;
     }
+    if (options.autoApproveTools) {
+      config2.autoApproveTools = options.autoApproveTools;
+    }
     return config2;
   }
   const config = {
@@ -1150,8 +1284,66 @@ function buildServerConfig(parsed, options = {}) {
   if (options.env && Object.keys(options.env).length > 0) {
     config.env = options.env;
   }
+  if (options.autoApproveTools) {
+    config.autoApproveTools = options.autoApproveTools;
+  }
   return config;
 }
+function readJsonObject(filePath) {
+  if (!existsSync5(filePath)) {
+    return {};
+  }
+  const parsed = JSON.parse(readFileSync4(filePath, "utf-8"));
+  return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+}
+function writeJsonObject(filePath, value) {
+  const dir = dirname6(filePath);
+  if (!existsSync5(dir)) {
+    mkdirSync4(dir, { recursive: true });
+  }
+  writeFileSync4(filePath, `${JSON.stringify(value, null, 2)}
+`, "utf-8");
+}
+function addUniqueStrings(existing, additions) {
+  const values = Array.isArray(existing) ? existing.filter((value) => typeof value === "string") : [];
+  for (const addition of additions) {
+    if (!values.includes(addition)) {
+      values.push(addition);
+    }
+  }
+  return values;
+}
+function claudeAutoApproveRules(serverName, tools) {
+  if (tools.length === 0) {
+    return [`mcp__${serverName}`];
+  }
+  return tools.map((tool) => `mcp__${serverName}__${tool}`);
+}
+function getClaudeCodeSettingsPath(options = {}) {
+  const local = Boolean(options.local);
+  const cwd = options.cwd || process.cwd();
+  return local ? join3(cwd, ".claude", "settings.local.json") : join3(home2, ".claude", "settings.json");
+}
+function installClaudeCodeAutoApproval(serverName, tools, options = {}) {
+  const settingsPath = getClaudeCodeSettingsPath(options);
+  try {
+    const settings = readJsonObject(settingsPath);
+    const permissions = settings.permissions && typeof settings.permissions === "object" && !Array.isArray(settings.permissions) ? settings.permissions : {};
+    permissions.allow = addUniqueStrings(
+      permissions.allow,
+      claudeAutoApproveRules(serverName, tools)
+    );
+    settings.permissions = permissions;
+    writeJsonObject(settingsPath, settings);
+    return { success: true, path: settingsPath };
+  } catch (error) {
+    return {
+      success: false,
+      path: settingsPath,
+      error: error instanceof Error ? error.message : "Unknown error"
+    };
+  }
+}
 function updateGitignoreWithPaths(paths, options = {}) {
   const cwd = options.cwd || process.cwd();
   const gitignorePath = join3(cwd, ".gitignore");
@@ -1212,15 +1404,37 @@ function installServerForAgent(serverName, serverConfig, agentType, options = {}
     if (!existsSync5(dir)) {
       mkdirSync4(dir, { recursive: true });
     }
-    const transformedConfig = agent.transformConfig ? agent.transformConfig(serverName, serverConfig, {
+    const { config: gatedConfig, dropped } = applyFieldSupport(
+      serverConfig,
+      agent.supportedFields
+    );
+    const transformedConfig = agent.transformConfig(serverName, gatedConfig, {
       local: Boolean(options.local)
-    }) : serverConfig;
+    });
     const configKey = getConfigKey(agent, options);
     const config = buildConfigWithKey(configKey, serverName, transformedConfig);
     writeConfig2(configPath, config, agent.format, configKey);
+    const extraPaths = [];
+    if (agentType === "claude-code" && gatedConfig.autoApproveTools) {
+      const approval = installClaudeCodeAutoApproval(
+        serverName,
+        gatedConfig.autoApproveTools,
+        options
+      );
+      if (!approval.success) {
+        return {
+          success: false,
+          path: approval.path,
+          error: approval.error
+        };
+      }
+      extraPaths.push(approval.path);
+    }
     return {
       success: true,
-      path: configPath
+      path: configPath,
+      ...dropped.length > 0 ? { droppedFields: dropped } : {},
+      ...extraPaths.length > 0 ? { extraPaths } : {}
     };
   } catch (error) {
     return {
@@ -1384,6 +1598,7 @@ export {
   getNestedValue,
   readConfig2 as readConfig,
   removeServerFromConfig,
+  describeOptionalField,
   buildServerConfig,
   updateGitignoreWithPaths,
   getConfigPath2,

package/dist/index.js

@@ -3,6 +3,7 @@ import {
   agents,
   buildAgentSelectionChoices,
   buildServerConfig,
+  describeOptionalField,
   detectGlobalAgents,
   detectProjectAgents,
   findMatchingServers,
@@ -22,7 +23,7 @@ import {
   selectAgentsInteractive,
   supportsProjectConfig,
   updateGitignoreWithPaths
-} from "./chunk-ONLHW5AV.js";
+} from "./chunk-IPCKQUBH.js";
 
 // src/index.ts
 import { program } from "commander";
@@ -782,7 +783,7 @@ async function runFind(query, options) {
 // package.json
 var package_default = {
   name: "add-mcp",
-  version: "1.10.4",
+  version: "1.12.0",
   description: "Add MCP servers to your favorite coding agents with a single command.",
   author: "Andre Landgraf <andre@neon.tech>",
   license: "Apache-2.0",
@@ -973,6 +974,25 @@ function extractSubcommandOptionsFromArgv() {
       result.gitignore = true;
       continue;
     }
+    if (arg === "--auto-approve") {
+      result.autoApprove = true;
+      continue;
+    }
+    if (arg === "--approve-tool") {
+      const tools = result.approveTool ? [...result.approveTool] : [];
+      let j = i + 1;
+      while (j < argv.length) {
+        const value = argv[j];
+        if (!value || value.startsWith("-")) break;
+        tools.push(value);
+        j += 1;
+      }
+      if (tools.length > 0) {
+        result.approveTool = tools;
+      }
+      i = j - 1;
+      continue;
+    }
     if ((arg === "-h" || arg === "--header") && argv[i + 1]) {
       const headers = result.header ? [...result.header] : [];
       headers.push(argv[i + 1]);
@@ -1119,6 +1139,20 @@ program.name("add-mcp").description(
   "Argument for local stdio servers (repeatable). Placeholders ${VAR} prompt interactively when not using --yes. Use single quotes so your shell does not expand the ${VAR}.",
   collect,
   []
+).option(
+  "--timeout <ms>",
+  "Request timeout in milliseconds for remote servers. Only applied to agents that support it (e.g. Claude Code, Gemini CLI); dropped with a warning elsewhere."
+).option(
+  "--scopes <scopes>",
+  "OAuth scopes to request for remote servers (comma-separated). Only applied to agents that support it (e.g. Cursor, Gemini CLI); dropped with a warning elsewhere."
+).option("--oauth-scopes <scopes>", "Alias for --scopes").option(
+  "--auto-approve",
+  "Auto-approve MCP tool calls for agents that support it (Codex, Claude Code). Dropped with a warning for other agents."
+).option(
+  "--approve-tool <tool>",
+  "Tool name to auto-approve when --auto-approve is set (repeatable; defaults to all tools)",
+  collect,
+  []
 ).option("-y, --yes", "Skip confirmation prompts").option("--all", "Install to all agents").option("--gitignore", "Add generated project config files to .gitignore").action(async (target, options) => {
   await main(target, options);
 });
@@ -1165,7 +1199,15 @@ program.command("find [keyword]").description(
 ).option("-a, --agent <agent>", "Specify agents to install to", collect, []).option(
   "-n, --name <name>",
   "Server name override (defaults to catalog entry name)"
-).option("-y, --yes", "Skip confirmation prompts").option("--all", "Install to all agents").option("--gitignore", "Add generated project config files to .gitignore").action(
+).option("-y, --yes", "Skip confirmation prompts").option(
+  "--auto-approve",
+  "Auto-approve MCP tool calls for agents that support it (Codex, Claude Code)"
+).option(
+  "--approve-tool <tool>",
+  "Tool name to auto-approve when --auto-approve is set (repeatable; defaults to all tools)",
+  collect,
+  []
+).option("--all", "Install to all agents").option("--gitignore", "Add generated project config files to .gitignore").action(
   async (keyword, options) => {
     await runFindCommand(keyword, options);
   }
@@ -1176,7 +1218,15 @@ program.command("search [keyword]").description("Alias for find").option(
 ).option("-a, --agent <agent>", "Specify agents to install to", collect, []).option(
   "-n, --name <name>",
   "Server name override (defaults to catalog entry name)"
-).option("-y, --yes", "Skip confirmation prompts").option("--all", "Install to all agents").option("--gitignore", "Add generated project config files to .gitignore").action(
+).option("-y, --yes", "Skip confirmation prompts").option(
+  "--auto-approve",
+  "Auto-approve MCP tool calls for agents that support it (Codex, Claude Code)"
+).option(
+  "--approve-tool <tool>",
+  "Tool name to auto-approve when --auto-approve is set (repeatable; defaults to all tools)",
+  collect,
+  []
+).option("--all", "Install to all agents").option("--gitignore", "Add generated project config files to .gitignore").action(
   async (keyword, options) => {
     await runFindCommand(keyword, options);
   }
@@ -1791,11 +1841,47 @@ async function main(target, options) {
       p2.log.warn("--transport is only used for remote URLs, ignoring");
     }
   }
+  let resolvedTimeout;
+  if (options.timeout !== void 0) {
+    const parsedTimeout = Number(options.timeout);
+    if (!Number.isInteger(parsedTimeout) || parsedTimeout <= 0) {
+      p2.log.error(
+        `Invalid --timeout value: ${options.timeout}. Provide a positive integer (milliseconds).`
+      );
+      process.exit(1);
+    }
+    if (isRemote) {
+      resolvedTimeout = parsedTimeout;
+    } else {
+      p2.log.warn("--timeout is only used for remote URLs, ignoring");
+    }
+  }
+  const scopesValue = options.scopes ?? options.oauthScopes;
+  let resolvedScopes;
+  if (scopesValue !== void 0) {
+    const parsedScopes = scopesValue.split(",").map((scope) => scope.trim()).filter((scope) => scope.length > 0);
+    if (parsedScopes.length === 0) {
+      p2.log.error(
+        `Invalid --scopes value: ${scopesValue}. Provide one or more comma-separated scopes.`
+      );
+      process.exit(1);
+    }
+    if (isRemote) {
+      resolvedScopes = parsedScopes;
+    } else {
+      p2.log.warn("--scopes is only used for remote URLs, ignoring");
+    }
+  }
+  const approveTools = [...new Set(options.approveTool ?? [])];
+  const autoApproveTools = options.autoApprove || approveTools.length > 0 ? approveTools : void 0;
   const serverConfig = buildServerConfig(parsed, {
     transport: resolvedTransport,
     headers: headersForConfig && Object.keys(headersForConfig).length > 0 ? headersForConfig : void 0,
     env: envForConfig && Object.keys(envForConfig).length > 0 ? envForConfig : void 0,
-    args: argsForConfig && argsForConfig.length > 0 ? argsForConfig : void 0
+    args: argsForConfig && argsForConfig.length > 0 ? argsForConfig : void 0,
+    timeout: resolvedTimeout,
+    oauthScopes: resolvedScopes,
+    autoApproveTools
   });
   let targetAgents;
   const allAgentTypes = getAgentTypes();
@@ -1991,6 +2077,11 @@ async function main(target, options) {
   const summaryLines = [];
   summaryLines.push(`${chalk.cyan("Server:")} ${serverName}`);
   summaryLines.push(`${chalk.cyan("Type:")} ${sourceType}`);
+  if (autoApproveTools) {
+    summaryLines.push(
+      `${chalk.cyan("Auto-approve:")} ${autoApproveTools.length === 0 ? "All tools" : autoApproveTools.join(", ")}`
+    );
+  }
   const localAgents = targetAgents.filter(
     (a) => agentRouting.get(a) === "local"
   );
@@ -2043,6 +2134,11 @@ async function main(target, options) {
       resultLines.push(
         `${chalk.green("\u2713")} ${agent.displayName}: ${chalk.dim(shortPath)}`
       );
+      for (const extraPath of result.extraPaths ?? []) {
+        resultLines.push(
+          `  ${chalk.dim("\u21B3 permissions:")} ${chalk.dim(shortenPath(extraPath))}`
+        );
+      }
     }
     p2.note(
       resultLines.join("\n"),
@@ -2065,12 +2161,28 @@ async function main(target, options) {
       );
     }
   }
+  const droppedByField = /* @__PURE__ */ new Map();
+  for (const [agentType, result] of results) {
+    for (const field of result.droppedFields ?? []) {
+      const agentNames = droppedByField.get(field) ?? [];
+      agentNames.push(agents[agentType].displayName);
+      droppedByField.set(field, agentNames);
+    }
+  }
+  for (const [field, agentNames] of droppedByField) {
+    p2.log.warn(
+      `${describeOptionalField(field)} is not supported by ${agentNames.join(", ")}; dropped from ${agentNames.length === 1 ? "that config" : "those configs"}.`
+    );
+  }
   if (options.gitignore && options.global) {
     p2.log.warn(
       "--gitignore is only supported for project-scoped installations; ignoring."
     );
   } else if (options.gitignore) {
-    const successfulPaths = successful.map(([_, result]) => result.path);
+    const successfulPaths = successful.flatMap(([_, result]) => [
+      result.path,
+      ...result.extraPaths ?? []
+    ]);
     const gitignoreUpdate = updateGitignoreWithPaths(successfulPaths);
     if (gitignoreUpdate.added.length > 0) {
       p2.log.info(

package/dist/lib.d.ts

@@ -1,3 +1,15 @@
+/**
+ * Optional, capability-gated fields on {@link McpServerConfig}.
+ *
+ * The canonical {@link McpServerConfig} is the single, agent-agnostic schema
+ * that the CLI and library populate. Not every MCP client understands every
+ * optional field, so each agent declares which of these it supports via
+ * `AgentConfig.supportedFields`. Anything an agent does not support is dropped
+ * before its transform runs, guaranteeing that only known fields are ever
+ * written to a client config.
+ */
+type OptionalField = "timeout" | "scopes" | "autoApprove";
+
 type AgentType = "antigravity" | "cline" | "cline-cli" | "claude-code" | "claude-desktop" | "codex" | "cursor" | "gemini-cli" | "goose" | "github-copilot-cli" | "mcporter" | "opencode" | "vscode" | "windsurf" | "zed";
 type ConfigFormat = "json" | "yaml" | "toml";
 interface AgentConfig {
@@ -19,6 +31,14 @@ interface AgentConfig {
     format: ConfigFormat;
     /** Supported transport types for this agent */
     supportedTransports: ("stdio" | "sse" | "http")[];
+    /**
+     * Optional, capability-gated server fields this agent understands (e.g.
+     * `timeout`, `scopes`). Any optional field not listed here is stripped from
+     * the canonical config before {@link transformConfig} runs, so a client never
+     * receives a field it cannot interpret. Use an empty array for agents that
+     * only support the core fields.
+     */
+    supportedFields: OptionalField[];
     /** Shown when a user tries to use an unsupported transport */
     unsupportedTransportMessage?: string;
     /** Function to detect if agent is installed globally */
@@ -28,8 +48,13 @@ interface AgentConfig {
         local: boolean;
         cwd: string;
     }) => string;
-    /** Optional function to transform server config to agent-specific format */
-    transformConfig?: (serverName: string, config: McpServerConfig, context?: {
+    /**
+     * Transform the canonical, field-gated server config into this agent's
+     * concrete on-disk schema. Required for every agent: transforms must build a
+     * fresh object with only the keys the client understands, which structurally
+     * guarantees no unknown fields leak into a written config.
+     */
+    transformConfig: (serverName: string, config: McpServerConfig, context?: {
         local: boolean;
     }) => unknown;
 }
@@ -43,6 +68,26 @@ interface McpServerConfig {
     command?: string;
     args?: string[];
     env?: Record<string, string>;
+    /**
+     * Request timeout in milliseconds for remote servers. Capability-gated:
+     * only emitted for agents that list `"timeout"` in `supportedFields`.
+     */
+    timeout?: number;
+    /**
+     * OAuth scopes to request for remote servers. Capability-gated: only emitted
+     * for agents that list `"scopes"` in `supportedFields`, each mapping it into
+     * their own native shape (e.g. Cursor `auth.scopes`, Gemini `oauth.scopes`).
+     */
+    oauthScopes?: string[];
+    /**
+     * Tools to auto-approve (skip the agent's per-call approval prompt). An empty
+     * array means "all tools". This is an install directive rather than a literal
+     * server-config key: capability-gated via `"autoApprove"` in `supportedFields`
+     * and each supporting agent applies it in its own way (e.g. Codex emits
+     * approval modes in its config; Claude Code writes permission allow rules to a
+     * separate settings file). It is never written into a server entry verbatim.
+     */
+    autoApproveTools?: string[];
 }
 
 interface InstallOptions {
@@ -55,6 +100,17 @@ interface InstallResult {
     success: boolean;
     path: string;
     error?: string;
+    /**
+     * Optional fields that were requested but dropped because the target agent
+     * does not support them. Empty/undefined when nothing was dropped.
+     */
+    droppedFields?: OptionalField[];
+    /**
+     * Additional files written beyond the main config (e.g. a Claude Code
+     * permissions settings file for auto-approval). Surfaced so the CLI can
+     * report them and include them in `--gitignore`.
+     */
+    extraPaths?: string[];
 }
 
 declare const agents: Record<AgentType, AgentConfig>;
@@ -99,4 +155,4 @@ interface RemoveServerResult {
 }
 declare function removeServer(agentType: AgentInput, serverName: string, options?: InstallOptions): RemoveServerResult;
 
-export { type AgentConfig, type AgentInput, type AgentServers, type AgentType, type InstallOptions, type InstallResult, type InstalledServer, type McpServerConfig, type RemoveServerResult, agents, detectGlobalAgents, detectProjectAgents, getAgentTypes, listInstalledServers, removeServer, upsertServer };
+export { type AgentConfig, type AgentInput, type AgentServers, type AgentType, type InstallOptions, type InstallResult, type InstalledServer, type McpServerConfig, type OptionalField, type RemoveServerResult, agents, detectGlobalAgents, detectProjectAgents, getAgentTypes, listInstalledServers, removeServer, upsertServer };

package/dist/lib.js

@@ -10,7 +10,7 @@ import {
   listInstalledServers,
   readConfig,
   removeServerFromConfig
-} from "./chunk-ONLHW5AV.js";
+} from "./chunk-IPCKQUBH.js";
 
 // src/lib.ts
 import { existsSync } from "fs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "add-mcp",
-  "version": "1.10.4",
+  "version": "1.12.0",
   "description": "Add MCP servers to your favorite coding agents with a single command.",
   "author": "Andre Landgraf <andre@neon.tech>",
   "license": "Apache-2.0",