androjack-mcp 1.6.3 → 1.6.4

package/README.md

@@ -19,21 +19,21 @@
 
 [![npm version](https://img.shields.io/npm/v/androjack-mcp?color=0A7AFF&style=flat-square&logo=npm&label=npm)](https://www.npmjs.com/package/androjack-mcp)
 [![VS Code](https://img.shields.io/visual-studio-marketplace/v/VIKAS9793.androjack-vscode?color=0A7AFF&style=flat-square&logo=visual-studio-code&label=VS%20Code)](https://marketplace.visualstudio.com/items?itemName=VIKAS9793.androjack-vscode)
-[![GitHub stars](https://img.shields.io/github/stars/VIKAS9793/AndroJack-mcp?style=flat-square&logo=github&color=0A7AFF)](https://github.com/VIKAS9793/AndroJack-mcp/stargazers)
-[![Node.js](https://img.shields.io/badge/node-%3E%3D18.0.0-brightgreen?style=flat-square&logo=node.js)](https://nodejs.org)
-[![MCP Spec](https://img.shields.io/badge/MCP-2025--11--25-blueviolet?style=flat-square)](https://modelcontextprotocol.io)
-[![TypeScript](https://img.shields.io/badge/TypeScript-5.5-3178C6?style=flat-square&logo=typescript)](https://typescriptlang.org)
-[![Tools](https://img.shields.io/badge/tools-21-orange?style=flat-square)](#-the-21-tools)
-[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg?style=flat-square)](LICENSE)
-[![Security Policy](https://img.shields.io/badge/security-policy-0A7AFF?style=flat-square&logo=github)](SECURITY.md)
-[![Android API](https://img.shields.io/badge/Android-API%2021--36-34A853?style=flat-square&logo=android)](https://developer.android.com)
+[![GitHub stars](https://img.shields.io/github/stars/VIKAS9793/AndroJack-mcp?style=flat-square&logo=github&color=0A7AFF)](https://github.com/VIKAS9793/AndroJack-mcp/stargazers)
+[![Node.js](https://img.shields.io/badge/node-%3E%3D18.0.0-brightgreen?style=flat-square&logo=node.js)](https://nodejs.org)
+[![MCP Spec](https://img.shields.io/badge/MCP-2025--11--25-blueviolet?style=flat-square)](https://modelcontextprotocol.io)
+[![TypeScript](https://img.shields.io/badge/TypeScript-5.5-3178C6?style=flat-square&logo=typescript)](https://typescriptlang.org)
+[![Tools](https://img.shields.io/badge/tools-21-orange?style=flat-square)](#-the-21-tools)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg?style=flat-square)](LICENSE)
+[![Security Policy](https://img.shields.io/badge/security-policy-0A7AFF?style=flat-square&logo=github)](SECURITY.md)
+[![Android API](https://img.shields.io/badge/Android-API%2021--36-34A853?style=flat-square&logo=android)](https://developer.android.com)
 
 ### 🚀 One-Click Install
 
 [![Install in VS Code](https://img.shields.io/badge/Install%20in-VS%20Code-007ACC?style=for-the-badge&logo=visual-studio-code&logoColor=white)](https://marketplace.visualstudio.com/items?itemName=VIKAS9793.androjack-vscode)
-[![Install in Claude Desktop](https://img.shields.io/badge/Install%20in-Claude%20Desktop-D97706?style=for-the-badge&logo=anthropic&logoColor=white)](https://claude.ai/integrations/install-mcp?params=eyJuYW1lIjoiYW5kcm9qYWNrIiwiY29tbWFuZCI6Im5weCIsImFyZ3MiOlsiLXkiLCJhbmRyb2phY2stbWNwQDEuNi4zIl19)
-[![Install in Cursor](https://img.shields.io/badge/Install%20in-Cursor-000000?style=for-the-badge&logo=cursor&logoColor=white)](https://cursor.com/install-mcp?name=androjack&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsImFuZHJvamFjay1tY3BAMS42LjMiXX0=)
-[![Add to Kiro](https://img.shields.io/badge/Add%20to-AWS%20Kiro-FF9900?style=for-the-badge&logo=amazonaws&logoColor=white)](https://kiro.dev/launch/mcp/add?name=androjack&config=%7B%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22androjack-mcp%401.6.3%22%5D%2C%22disabled%22%3Afalse%2C%22autoApprove%22%3A%5B%5D%7D)
+[![Install in Claude Desktop](https://img.shields.io/badge/Install%20in-Claude%20Desktop-D97706?style=for-the-badge&logo=anthropic&logoColor=white)](https://claude.ai/integrations/install-mcp?params=eyJuYW1lIjoiYW5kcm9qYWNrIiwiY29tbWFuZCI6Im5weCIsImFyZ3MiOlsiLXkiLCJhbmRyb2phY2stbWNwQDEuNi4zIl19)
+[![Install in Cursor](https://img.shields.io/badge/Install%20in-Cursor-000000?style=for-the-badge&logo=cursor&logoColor=white)](https://cursor.com/install-mcp?name=androjack&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsImFuZHJvamFjay1tY3BAMS42LjMiXX0=)
+[![Add to Kiro](https://img.shields.io/badge/Add%20to-AWS%20Kiro-FF9900?style=for-the-badge&logo=amazonaws&logoColor=white)](https://kiro.dev/launch/mcp/add?name=androjack&config=%7B%22command%22%3A%22npx%22%2C%22args%22%3A%5B%22-y%22%2C%22androjack-mcp%401.6.4%22%5D%2C%22disabled%22%3Afalse%2C%22autoApprove%22%3A%5B%5D%7D)
 [![View on npm](https://img.shields.io/badge/View%20on-npm-CB3837?style=for-the-badge&logo=npm&logoColor=white)](https://www.npmjs.com/package/androjack-mcp)
 
 **VS Code distribution:** AndroJack MCP is also live on the VS Code Marketplace as [AndroJack MCP for VS Code](https://marketplace.visualstudio.com/items?itemName=VIKAS9793.androjack-vscode). The `VS Code` badge above always reflects the currently published Marketplace version.
@@ -258,28 +258,49 @@ That's the job AndroJack exists to do — and nothing else in the current ecosys
 
 ## 🚀 Quick Start — Zero Install Required
 
-### Option 1 — Interactive CLI (v1.6.3) ✨ Recommended
-```bash
-npx androjack-mcp@1.6.3 install
-```
+### Option 1 — Interactive CLI (v1.6.4) ✨ Recommended
+```bash
+npx -y androjack-mcp@1.6.4 install
+```
 Launches a full animated terminal wizard with auto-detection for **VS Code, Cursor, Claude, Windsurf, JetBrains, Kiro, and Antigravity.**
 
 ### Option 2 — Targeted installs
-```bash
-# Auto-detect all
-npx androjack-mcp@1.6.3 install --auto
-
-# Install to specific IDE
-npx androjack-mcp@1.6.3 install --ide=cursor
-npx androjack-mcp@1.6.3 install --ide=claude
-npx androjack-mcp@1.6.3 install --ide=vscode
-npx androjack-mcp@1.6.3 install --ide=jetbrains
-```
+```bash
+# Preview detected IDEs and config paths
+npx -y androjack-mcp@1.6.4 install --list
+
+# Auto-detect all
+npx -y androjack-mcp@1.6.4 install --auto
+
+# Install to specific IDE
+npx -y androjack-mcp@1.6.4 install --ide=cursor
+npx -y androjack-mcp@1.6.4 install --ide=claude
+npx -y androjack-mcp@1.6.4 install --ide=vscode
+npx -y androjack-mcp@1.6.4 install --ide=windsurf
+npx -y androjack-mcp@1.6.4 install --ide=jetbrains
+npx -y androjack-mcp@1.6.4 install --ide=kiro
+npx -y androjack-mcp@1.6.4 install --ide=antigravity
+```
 
 ### Option 3 — Test without IDE
-```bash
-npx @modelcontextprotocol/inspector npx -y androjack-mcp@1.6.3
-```
+```bash
+npx -y @modelcontextprotocol/inspector npx -y androjack-mcp@1.6.4
+```
+
+## 🧩 Manual Config / Copy / Paste
+
+If you prefer to wire the server manually, or want to inspect the exact JSON before writing anything:
+
+- Run `npx -y androjack-mcp@1.6.4 install --list` to preview detected IDEs and target config paths.
+- Ready-to-paste examples live in [`config/`](config/).
+- Use [`config/claude_desktop_config.json`](config/claude_desktop_config.json) for Claude Desktop.
+- Use [`config/cursor_mcp.json`](config/cursor_mcp.json) for Cursor.
+- Use [`config/vscode_mcp.json`](config/vscode_mcp.json) for VS Code / GitHub Copilot.
+- Use [`config/windsurf_mcp.json`](config/windsurf_mcp.json) for Windsurf.
+- Use [`config/jetbrains_mcp.json`](config/jetbrains_mcp.json) for Android Studio / IntelliJ.
+- Use [`config/kiro_mcp.json`](config/kiro_mcp.json) for AWS Kiro.
+- Use [`config/antigravity_mcp.json`](config/antigravity_mcp.json) for Google Antigravity.
+- Every example keeps AndroJack local by default and runs the published package via `npx -y androjack-mcp@1.6.4`.
 
 ---
 
@@ -291,26 +312,26 @@ npx @modelcontextprotocol/inspector npx -y androjack-mcp@1.6.3
 | **Mechanism** | Context Retrieval | Context Enforcement |
 | **Scope** | Generalist — Firebase, Cloud, Maps | Android engineering specialist |
 | **Tools** | 3 retrieval tools | 21 specialized tools |
-| **Setup** | Google Cloud project + API key required | `npx androjack-mcp@1.6.3` — zero auth |
+| **Setup** | Google Cloud project + API key required | `npx androjack-mcp@1.6.4` — zero auth |
 | **Enforcement**| Passive — AI decides when to retrieve | Active — mandating calls by task type |
 
-## 🔒 Security & Privacy
-*   **Domain allowlist**: Requests only to Google/Android/Kotlin official domains.
-*   **HTTPS only**: Outbound documentation fetches refuse non-HTTPS URLs, cap body size, and redact query strings in retry logs.
-*   **Local by default**: `serve` binds to loopback only unless you explicitly pass `--allow-remote`.
-*   **HTTP hardening**: Streamable HTTP validates `Origin` and `Host` headers and caps request bodies and active sessions.
-*   **Transparent agent**: User-Agent: `AndroJack-MCP/1.6.3`.
-*   **Read-only**: All 21 tools are annotated `readOnlyHint: true`.
-*   **Zero credentials**: No API keys or tokens required for documentation fetching.
-*   **Security policy**: Disclosure process and supported versions live in [SECURITY.md](SECURITY.md).
-
-## 📋 Changelog
-### v1.6.3 — CLI Routing Fixes and Local Transport Hardening
-- **Fix:** `npx androjack-mcp install`, `install --auto`, `install --ide=...`, `help`, and `--version` now route correctly instead of falling through to the stdio server.
-- **Fix:** `install --auto` no longer over-detects IDEs from parent directories and create configs in a clean workspace.
-- **Fix:** HTTP serve mode now fails closed on non-loopback binds unless `--allow-remote` is explicit.
-- **Security:** Streamable HTTP now validates `Origin` and `Host` headers and enforces request body and session limits.
-- **Security:** Outbound fetches now enforce HTTPS, cap response size, and redact sensitive URL parts from retry logs.
+## 🔒 Security & Privacy
+*   **Domain allowlist**: Requests only to Google/Android/Kotlin official domains.
+*   **HTTPS only**: Outbound documentation fetches refuse non-HTTPS URLs, cap body size, and redact query strings in retry logs.
+*   **Local by default**: `serve` binds to loopback only unless you explicitly pass `--allow-remote`.
+*   **HTTP hardening**: Streamable HTTP validates `Origin` and `Host` headers and caps request bodies and active sessions.
+*   **Transparent agent**: User-Agent: `AndroJack-MCP/1.6.4`.
+*   **Read-only**: All 21 tools are annotated `readOnlyHint: true`.
+*   **Zero credentials**: No API keys or tokens required for documentation fetching.
+*   **Security policy**: Disclosure process and supported versions live in [SECURITY.md](SECURITY.md).
+
+## 📋 Changelog
+### v1.6.4 — CLI Routing Fixes and Local Transport Hardening
+- **Fix:** `npx androjack-mcp install`, `install --auto`, `install --ide=...`, `help`, and `--version` now route correctly instead of falling through to the stdio server.
+- **Fix:** `install --auto` no longer over-detects IDEs from parent directories and create configs in a clean workspace.
+- **Fix:** HTTP serve mode now fails closed on non-loopback binds unless `--allow-remote` is explicit.
+- **Security:** Streamable HTTP now validates `Origin` and `Host` headers and enforces request body and session limits.
+- **Security:** Outbound fetches now enforce HTTPS, cap response size, and redact sensitive URL parts from retry logs.
 
 ## 👥 Authorship & Ownership
 **Vikas Sahani** — Product Lead (vikassahani17@gmail.com)  

package/build/http-server.js

@@ -1,25 +1,16 @@
 /**
  * AndroJack MCP – Streamable HTTP Transport
  *
- * Runs the same MCP server over HTTP instead of stdio.
+ * Runs the MCP server over HTTP instead of stdio.
  * Spec: MCP 2025-11-25 Streamable HTTP transport.
  *
+ * Security: each new initialize request creates a FRESH McpServer +
+ * StreamableHTTPServerTransport pair. Sessions are never shared —
+ * this prevents cross-session state leakage that existed in v1.6.3.
+ *
  * Usage:
  *   node build/index.js --http              # default port 3000
  *   PORT=8080 node build/index.js --http    # custom port
- *
- * Config for Claude Desktop / Cursor (remote team instance):
- *   {
- *     "mcpServers": {
- *       "androjack": {
- *         "type": "streamable-http",
- *         "url": "http://localhost:3000/mcp"
- *       }
- *     }
- *   }
- *
- * Security note: bind to 127.0.0.1 by default (loopback only).
- * To expose on LAN, set HOST=0.0.0.0 and add your own auth layer.
  */
 import http from "node:http";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
@@ -32,8 +23,7 @@ const MCP_PATH = "/mcp";
 const WELL_KNOWN_PATH = "/.well-known/mcp";
 const MAX_REQUEST_BODY_BYTES = 1024 * 1024;
 const MAX_ACTIVE_SESSIONS = 64;
-// Per-session transports — Streamable HTTP is session-aware (MCP-Session-Id header)
-const sessions = new Map();
+// ── Helpers ────────────────────────────────────────────────────────────────
 function createHttpError(statusCode, message) {
     const error = new Error(message);
     error.statusCode = statusCode;
@@ -103,16 +93,49 @@ function validateHostHeader(hostHeader, bindHost) {
         throw createHttpError(403, `Host "${hostHeader}" is not allowed.`);
     }
 }
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let totalBytes = 0;
+        req.on("data", (chunk) => {
+            totalBytes += chunk.length;
+            if (totalBytes > MAX_REQUEST_BODY_BYTES) {
+                req.destroy(createHttpError(413, "Request body too large"));
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8")));
+        req.on("error", reject);
+    });
+}
+// ── Main export ────────────────────────────────────────────────────────────
 /**
- * Starts the Streamable HTTP server and connects the provided MCP server to it.
- * Exported so index.ts can dynamically import it only when --http is passed.
+ * Starts the Streamable HTTP server.
+ *
+ * @param createServer - Factory called once per MCP initialize request.
+ *   Each call MUST return a new McpServer instance — never share instances
+ *   across sessions.
+ * @param opts - Optional port/host overrides (fall back to env vars / defaults).
+ * @returns A handle with close() and the bound address.
+ *
+ * Security controls (all preserved from v1.6.3):
+ *   - Loopback-only bind host by default
+ *   - Explicit --allow-remote required for non-loopback (enforced in serve.ts)
+ *   - Host header validation
+ *   - Origin header validation
+ *   - Body size cap (1 MiB)
+ *   - Active session cap (64)
+ *   - Per-session server isolation (NEW in v1.6.4)
  */
-export async function startHttpServer(server) {
-    const port = parseInt(process.env.PORT ?? String(DEFAULT_PORT), 10);
-    const host = process.env.HOST ?? DEFAULT_HOST;
+export async function startHttpServer(createServer, opts) {
+    const port = opts?.port ?? parseInt(process.env["PORT"] ?? String(DEFAULT_PORT), 10);
+    const host = opts?.host ?? process.env["HOST"] ?? DEFAULT_HOST;
     let advertisedPort = port;
     let advertisedHost = host;
     let allowedOrigins = buildAllowedOrigins(host, port);
+    // Per-session state: each session owns its own server + transport pair
+    const sessions = new Map();
     const httpServer = http.createServer(async (req, res) => {
         try {
             validateHostHeader(req.headers.host, host);
@@ -125,7 +148,7 @@ export async function startHttpServer(server) {
             return;
         }
         const url = new URL(req.url ?? "/", "http://localhost");
-        // ── .well-known/mcp — capability discovery (MCP 2025-11-25) ──────────
+        // ── .well-known/mcp — capability discovery ─────────────────────────────
         if (url.pathname === WELL_KNOWN_PATH && req.method === "GET") {
             res.writeHead(200, { "Content-Type": "application/json" });
             res.end(JSON.stringify({
@@ -141,24 +164,25 @@ export async function startHttpServer(server) {
             }));
             return;
         }
-        // ── /mcp — Streamable HTTP transport endpoint ─────────────────────────
+        // ── /mcp — Streamable HTTP transport endpoint ──────────────────────────
         if (url.pathname !== MCP_PATH) {
             res.writeHead(404, { "Content-Type": "text/plain" });
             res.end(`AndroJack MCP: endpoint is ${MCP_PATH}`);
             return;
         }
-        // Only POST and GET are valid for Streamable HTTP
         if (req.method !== "POST" && req.method !== "GET" && req.method !== "DELETE") {
             res.writeHead(405, { Allow: "GET, POST, DELETE" });
             res.end();
             return;
         }
-        // DELETE — client signals session teardown
+        // ── DELETE — client signals session teardown ───────────────────────────
         if (req.method === "DELETE") {
             const sessionId = req.headers["mcp-session-id"];
             if (sessionId && sessions.has(sessionId)) {
-                await sessions.get(sessionId).close();
+                const session = sessions.get(sessionId);
+                await session.transport.close();
                 sessions.delete(sessionId);
+                process.stderr.write(`AndroJack HTTP: session deleted [${sessionId}]\n`);
             }
             res.writeHead(200);
             res.end();
@@ -166,13 +190,14 @@ export async function startHttpServer(server) {
         }
         try {
             const sessionId = req.headers["mcp-session-id"];
-            let transport;
             if (sessionId && sessions.has(sessionId)) {
-                // Resume existing session
-                transport = sessions.get(sessionId);
+                // ── Resume existing session — reuse only this session's transport ──
+                const { transport } = sessions.get(sessionId);
+                await transport.handleRequest(req, res);
+                return;
             }
-            else if (!sessionId) {
-                // New session — only valid if this is an Initialize request
+            if (!sessionId) {
+                // ── New session — only valid for MCP Initialize requests ───────────
                 if (sessions.size >= MAX_ACTIVE_SESSIONS) {
                     res.writeHead(503, { "Content-Type": "text/plain" });
                     res.end("Too many active MCP sessions");
@@ -193,11 +218,13 @@ export async function startHttpServer(server) {
                     res.end("First request must be an MCP Initialize request");
                     return;
                 }
+                // ── Create a fresh server + transport pair for this session ────────
                 const newSessionId = randomUUID();
-                transport = new StreamableHTTPServerTransport({
+                const mcpServer = createServer(); // <-- fresh instance per session
+                const transport = new StreamableHTTPServerTransport({
                     sessionIdGenerator: () => newSessionId,
                     onsessioninitialized: (id) => {
-                        sessions.set(id, transport);
+                        sessions.set(id, { server: mcpServer, transport });
                         process.stderr.write(`AndroJack HTTP: session opened [${id}]\n`);
                     },
                 });
@@ -205,18 +232,15 @@ export async function startHttpServer(server) {
                     sessions.delete(newSessionId);
                     process.stderr.write(`AndroJack HTTP: session closed [${newSessionId}]\n`);
                 };
-                // Connect the shared McpServer to this session's transport
-                await server.connect(transport);
+                // Connect this session's fresh server to its own transport
+                await mcpServer.connect(transport);
                 // Handle the Initialize request on the new transport
                 await transport.handleRequest(req, res, parsed);
                 return;
             }
-            else {
-                res.writeHead(400, { "Content-Type": "text/plain" });
-                res.end("Unknown session ID");
-                return;
-            }
-            await transport.handleRequest(req, res);
+            // Unknown session ID
+            res.writeHead(400, { "Content-Type": "text/plain" });
+            res.end("Unknown session ID");
         }
         catch (err) {
             process.stderr.write(`AndroJack HTTP error: ${err}\n`);
@@ -245,26 +269,17 @@ export async function startHttpServer(server) {
     for (const sig of ["SIGINT", "SIGTERM"]) {
         process.once(sig, async () => {
             process.stderr.write(`\nAndroJack HTTP: shutting down (${sig})…\n`);
-            for (const t of sessions.values())
-                await t.close().catch(() => { });
+            for (const { transport } of sessions.values())
+                await transport.close().catch(() => { });
             httpServer.close(() => process.exit(0));
         });
     }
-}
-// ── Helpers ────────────────────────────────────────────────────────────────
-function readBody(req) {
-    return new Promise((resolve, reject) => {
-        const chunks = [];
-        let totalBytes = 0;
-        req.on("data", (chunk) => {
-            totalBytes += chunk.length;
-            if (totalBytes > MAX_REQUEST_BODY_BYTES) {
-                req.destroy(createHttpError(413, "Request body too large"));
-                return;
-            }
-            chunks.push(chunk);
-        });
-        req.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8")));
-        req.on("error", reject);
-    });
+    return {
+        close: () => {
+            for (const { transport } of sessions.values())
+                transport.close().catch(() => { });
+            httpServer.close();
+        },
+        address: { host: advertisedHost, port: advertisedPort },
+    };
 }

package/build/install.js

@@ -6,10 +6,10 @@
  * Supports both automated (--auto) and guided interactive installation.
  *
  * Usage:
- *   npx androjack-mcp@1.6.3 install           → interactive guided mode
- *   npx androjack-mcp@1.6.3 install --auto    → auto-detect and install to all found IDEs
- *   npx androjack-mcp@1.6.3 install --ide cursor   → target a specific IDE
- *   npx androjack-mcp@1.6.3 install --list    → list all supported IDEs and their status
+ *   npx androjack-mcp@1.6.4 install           → interactive guided mode
+ *   npx androjack-mcp@1.6.4 install --auto    → auto-detect and install to all found IDEs
+ *   npx androjack-mcp@1.6.4 install --ide cursor   → target a specific IDE
+ *   npx androjack-mcp@1.6.4 install --list    → list all supported IDEs and their status
  */
 import * as fs from "fs";
 import * as path from "path";
@@ -105,6 +105,15 @@ function getConfigPaths(platform) {
                 path.join(process.cwd(), ".kiro", "settings", "mcp.json"), // project-level
                 path.join(HOME, ".kiro", "settings", "mcp.json"), // global
             ],
+            // Kiro creates ~/.kiro only after first launch + MCP plugin setup.
+            // Detect the Kiro app itself via its known install location.
+            ideInstalledPaths: [
+                ...(platform === "win32"
+                    ? [path.join(process.env.LOCALAPPDATA ?? path.join(HOME, "AppData", "Local"), "Programs", "Kiro", "Kiro.exe")]
+                    : platform === "darwin"
+                        ? ["/Applications/Kiro.app"]
+                        : [path.join(HOME, ".local", "share", "kiro")]),
+            ],
             configKey: "mcpServers",
             format: "standard",
             oneClickUrl: (() => {
@@ -145,6 +154,21 @@ function getConfigPaths(platform) {
                             path.join(HOME, ".config", "JetBrains", "IdeaIC2024.3", "mcp.json"),
                         ]),
             ],
+            // JetBrains config dir only exists after first launch with AI plugin installed.
+            // Detect IDE via its known application paths.
+            ideInstalledPaths: [
+                ...(platform === "darwin"
+                    ? ["/Applications/Android Studio.app", "/Applications/IntelliJ IDEA.app", "/Applications/IntelliJ IDEA CE.app"]
+                    : platform === "win32"
+                        ? [
+                            path.join(process.env.LOCALAPPDATA ?? path.join(HOME, "AppData", "Local"), "Programs", "Android Studio", "bin", "studio64.exe"),
+                            path.join("C:\\", "Program Files", "Android", "Android Studio", "bin", "studio64.exe"),
+                        ]
+                        : [
+                            path.join(HOME, ".local", "share", "JetBrains"),
+                            "/opt/android-studio",
+                        ]),
+            ],
             configKey: "mcpServers",
             format: "standard",
             notes: "Or add manually: Android Studio → Settings → Tools → AI Assistant → MCP Servers → +",
@@ -210,6 +234,18 @@ function detectInstalledIdes(targets) {
         return target.configPaths.some((configPath) => fs.existsSync(path.dirname(configPath)));
     });
 }
+/**
+ * Returns true when the IDE application is installed on this machine, but the
+ * MCP config directory hasn't been created yet (IDE was never launched or
+ * the AI/MCP plugin hasn't been set up). Used in v1.6.4 to surface a
+ * more helpful message than silently showing "not found".
+ */
+function isIdeApplicationInstalled(target) {
+    if (!target.ideInstalledPaths || detectInstalledIdes([target]).length > 0) {
+        return false; // already detected via config dir — no extra message needed
+    }
+    return target.ideInstalledPaths.some((p) => fs.existsSync(p));
+}
 function alreadyInstalled(target) {
     for (const p of target.configPaths) {
         if (!fs.existsSync(p))
@@ -283,18 +319,23 @@ function printStatusTable(targets) {
     for (const t of targets) {
         const installed = alreadyInstalled(t);
         const detected = detectInstalledIdes([t]).length > 0;
+        const ideInstalled = isIdeApplicationInstalled(t);
         let icon;
         let label;
         if (installed) {
-            icon = chalk.green("  ✓");
-            label = chalk.green("already installed") + chalk.dim(` → ${installed}`);
+            icon = chalk.green("  ✓");
+            label = chalk.green("already installed") + chalk.dim(` → ${installed}`);
         }
         else if (detected) {
-            icon = chalk.cyan("  â—‰");
+            icon = chalk.cyan("  ◉");
             label = chalk.cyan("detected, not configured");
         }
+        else if (ideInstalled) {
+            icon = chalk.yellow("  ◈");
+            label = chalk.yellow("detected (MCP not yet configured — open the IDE once to initialize)");
+        }
         else {
-            icon = chalk.dim("  â—‹");
+            icon = chalk.dim("  ○");
             label = chalk.dim("not found");
         }
         console.log(`${icon}  ${chalk.bold(t.name)}  ${label}`);
@@ -521,6 +562,7 @@ export async function main(rawArgs = process.argv.slice(2)) {
             options: targets.map((t) => {
                 const installed = alreadyInstalled(t);
                 const detected = detectInstalledIdes([t]).length > 0;
+                const ideInstalled = isIdeApplicationInstalled(t);
                 return {
                     value: t.id,
                     label: t.name,
@@ -528,7 +570,9 @@ export async function main(rawArgs = process.argv.slice(2)) {
                         ? chalk.green("already installed")
                         : detected
                             ? chalk.cyan("detected")
-                            : chalk.dim("not found"),
+                            : ideInstalled
+                                ? chalk.yellow("IDE installed — run once to initialize MCP")
+                                : chalk.dim("not found"),
                 };
             }),
             required: true,