api-spec-cli 0.1.3 → 0.2.1

package/README.md

@@ -17,47 +17,67 @@ npx api-spec-cli <command>
 
 ## How It Works
 
-The CLI follows a progressive discovery pattern. You never dump an entire API spec at once — instead you narrow down to what you need.
+Every command is stateless — you specify the spec source on each call. Two paths:
 
-### Step 1: Load the spec
+| Path | When to use |
+|---|---|
+| `--spec <name>` | Registered spec — auto-fetches and caches on first use |
+| Inline flags | Ad-hoc — no registration, fetched each call |
+
+### Register once, use everywhere
 
 ```bash
-# OpenAPI
-spec load https://petstore3.swagger.io/api/v3/openapi.json
-spec load ./openapi.yaml
+spec add petstore --openapi https://petstore3.swagger.io/api/v3/openapi.json \
+  --base-url https://petstore3.swagger.io/api/v3 \
+  --description "Petstore example"
+
+spec add hashnode --graphql https://gql.hashnode.com --auth YOUR_TOKEN
 
-# GraphQL (auto-introspects)
-spec load https://gql.hashnode.com
+spec add agno --mcp-http https://docs.agno.com/mcp --description "Agno docs"
+
+spec add fs --mcp-stdio "npx -y @modelcontextprotocol/server-filesystem /tmp"
+```
 
-# MCP — stdio transport (spawn a local server)
-spec load --mcp-stdio "npx -y @modelcontextprotocol/server-filesystem /tmp"
+Registration is instant — does not connect. Connection happens on first `list`/`show`/`call` and the result is cached at `~/spec-cli-config/cache/<name>.json`.
 
-# MCP — SSE transport
-spec load --mcp-sse http://localhost:3000/sse
+### Or use inline (no registration)
 
-# MCP — Streamable HTTP transport
-spec load --mcp-http https://docs.agno.com/mcp
+```bash
+spec list --openapi https://petstore3.swagger.io/api/v3/openapi.json
+spec list --graphql https://gql.hashnode.com
+spec list --mcp-http https://docs.agno.com/mcp
+spec list --mcp-sse http://localhost:3000/sse
+spec list --mcp-stdio "npx -y @modelcontextprotocol/server-filesystem /tmp"
 ```
 
-Output tells you what was loaded:
-```json
-{ "ok": true, "type": "mcp", "transport": "streamable-http", "toolCount": 1 }
+Inline fetches every call, nothing cached.
+
+---
+
+## Discovery
+
+### List all specs in the registry
+
+```bash
+spec specs                    # Compact: name, type, enabled
+spec specs --compact false    # Full: includes source, config
 ```
 
-### Step 2: Find what you need
+### List operations / tools
 
 `list` is compact by default — just IDs, no schemas. Use `--filter`, `--tag`, `--limit` to narrow down.
 
 ```bash
-spec list                          # All operations/tools (compact IDs only)
-spec list --filter publish         # Search by keyword
-spec list --tag pets               # OpenAPI: filter by tag
-spec list --tag mutation           # GraphQL: filter by kind (query/mutation/subscription)
-spec list --limit 10               # First 10 only
-spec list --limit 10 --offset 10   # Next 10
+spec list --spec agno                          # Registered spec (uses cache)
+spec list --spec petstore --filter pet         # Search by keyword
+spec list --spec petstore --tag pets           # OpenAPI: filter by tag
+spec list --spec hashnode --tag mutation        # GraphQL: filter by kind
+spec list --spec petstore --limit 10           # First 10 only
+spec list --spec petstore --limit 10 --offset 10  # Next 10
+spec list --mcp-http https://docs.agno.com/mcp # Inline: no registration needed
 ```
 
-Compact output (token-efficient):
+Compact output:
 ```json
 {
   "type": "mcp",
@@ -69,99 +89,135 @@ Compact output (token-efficient):
 }
 ```
 
-Use `--compact false` for full details (including `inputSchema` for MCP tools).
+Use `--compact false` for full details including `inputSchema` for MCP tools.
 
-### Step 3: Inspect one operation or tool
+### Inspect one operation or tool
 
-`show` gives you everything you need to make a call — params, body schema, response, and related types — in one call.
+`show` gives you everything to make a call — params, body schema, response schemas, related types — in one call.
 
 ```bash
-spec show publishPost              # GraphQL: by operation name
-spec show getPetById               # OpenAPI: by operationId
-spec show /pet/{petId}             # OpenAPI: by path
-spec show "GET /pet/{petId}"       # OpenAPI: by method + path
-spec show search_agno              # MCP: by tool name
+spec show --spec petstore getPetById           # OpenAPI: by operationId
+spec show --spec petstore /pet/{petId}         # OpenAPI: by path
+spec show --spec petstore "GET /pet/{petId}"   # OpenAPI: by method + path
+spec show --spec hashnode publishPost          # GraphQL: by operation name
+spec show --spec agno search_agno             # MCP: by tool name
 ```
 
 MCP output includes the full `inputSchema` so you know exactly what arguments to pass.
 
-### Step 4: Drill into types (OpenAPI/GraphQL only)
+### Drill into types (OpenAPI/GraphQL only)
 
 ```bash
-spec types                         # List all schema/type names
-spec types Pet                     # Inspect one schema
-spec types PublishPostInput        # Inspect a GraphQL input type
+spec types --spec petstore                     # List all schema names
+spec types --spec petstore Pet                 # Inspect one schema
+spec types --spec hashnode PublishPostInput    # GraphQL input type
 ```
 
-### Step 5: Call the API
+---
+
+## Calling APIs
 
 ```bash
-# Set base URL and auth first (persisted across calls — OpenAPI/GraphQL)
-spec config set baseUrl https://petstore3.swagger.io/api/v3
-spec config set auth YOUR_TOKEN
+# OpenAPI
+spec call --spec petstore getPetById --var petId=1
+spec call --spec petstore findPetsByStatus --query status=available
+spec call --spec petstore addPet --data '{"name":"Rex","photoUrls":[]}'
 
-# OpenAPI calls
-spec call getPetById --var petId=1
-spec call findPetsByStatus --query status=available
-spec call addPet --data '{"name":"Rex","photoUrls":[]}'
+# GraphQL (auto-generates query from schema)
+spec call --spec hashnode me
+spec call --spec hashnode publication --var host=blog.hashnode.dev
 
-# GraphQL calls (auto-generates query from schema)
-spec call me
-spec call publication --var host=blog.hashnode.dev
+# MCP
+spec call --spec agno search_agno --var query="how to create an agent"
+spec call --spec agno search_agno --data '{"query":"agents"}'
 
-# MCP calls — use --var for individual args or --data for the full JSON object
-spec call search_agno --var query="how to create an agent"
-spec call read_file --data '{"path":"/tmp/hello.txt"}'
+# Inline (no registration)
+spec call --openapi https://petstore3.swagger.io/api/v3/openapi.json \
+  getPetById --var petId=1 --base-url https://petstore3.swagger.io/api/v3
 ```
 
+### Per-call overrides
+
+Flags passed at call time win over registry entry config, which wins over `.spec-cli/config.json`.
+
+```bash
+spec call --spec agno search_agno --var query="foo" --header X-Tenant=acme
+spec call --spec petstore getPetById --var petId=1 --auth staging-token
+spec list --spec petstore --base-url https://staging.api.example.com
+```
+
+---
+
+## Registry Management
+
+```bash
+spec remove <name>    # Delete entry and remove cache
+spec enable <name>    # Re-enable a disabled spec
+spec disable <name>   # Disable without removing
+spec refresh <name>   # Force re-fetch and update cache
+```
+
+---
+
+## spec add options
+
+```bash
+spec add <name> --openapi <url-or-file>   [--base-url <url>] [--auth <token>] [--header k=v]
+spec add <name> --graphql <url>            [--auth <token>] [--header k=v]
+spec add <name> --mcp-http <url>           [--header k=v]
+spec add <name> --mcp-sse <url>            [--header k=v]
+spec add <name> --mcp-stdio "<cmd args>"   [--env KEY=VAL]
+                                           [--description <text>]  (all types)
+```
+
+Headers are sent on every request. For stdio MCP, use `--env` to pass environment variables to the subprocess.
+
+---
+
 ## Config
 
-Persistent config stored in `.spec-cli/config.json`. Set once, used for all calls.
+Persistent config stored in `.spec-cli/config.json` (lowest priority — overridden by registry entry config and call-time flags).
 
 ```bash
 spec config set baseUrl https://api.example.com
 spec config set auth my-token                        # Auto-adds "Bearer " prefix
-spec config set auth "Basic dXNlcjpwYXNz"            # Or explicit auth header
-spec config set headers.X-API-Key abc123              # Custom headers (dot notation)
-spec config get                                       # Show all config
-spec config unset auth                                # Remove a key
+spec config set auth "Basic dXNlcjpwYXNz"            # Or explicit scheme
+spec config set headers.X-API-Key abc123              # Custom header (dot notation)
+spec config get
+spec config unset auth
 ```
 
 ## Validate
 
-Check an OpenAPI spec for errors before using it:
-
 ```bash
 spec validate https://api.example.com/openapi.json
+spec validate ./openapi.yaml
 ```
 
 Reports broken `$ref` references, missing required fields, duplicate operationIds, invalid schema types, and more.
 
 ## Output Format
 
-JSON by default. Use `--format text` or `--format yaml` for alternatives:
+JSON by default. Errors go to stderr as `{"error": "message"}` with a non-zero exit code.
 
 ```bash
-spec list --format text
-spec show getPetById --format yaml
+spec list --spec petstore --format text
+spec show --spec petstore getPetById --format yaml
+spec list --spec petstore --format=json    # equals syntax also works
 ```
 
-Errors always go to stderr as JSON: `{"error": "message"}` with non-zero exit code.
-
 ## Token Efficiency
 
-The CLI is designed to minimize context window usage for AI agents:
-
-- `list` returns only IDs by default (not full schemas)
-- `show` resolves schemas compactly — nested refs show as names, not deep explosions
-- `types` lets you inspect one type at a time instead of loading all schemas
-- `--limit` and `--offset` paginate large APIs
+- `list` returns only IDs by default — no schemas
+- `show` resolves `$ref` compactly — nested refs show as names, not explosions
+- `types` lets you inspect one schema at a time
+- `--limit` / `--offset` paginate large APIs
 - `--filter` and `--tag` narrow results before output
 
 ## Storage
 
-All state lives in `.spec-cli/` in the working directory:
-- `spec.json` — loaded spec cache
-- `config.json` — base URL, auth, headers
-
-Add `.spec-cli/` to your `.gitignore`.
+| Path | Purpose |
+|---|---|
+| `~/spec-cli-config/registry.json` | Global named registry |
+| `~/spec-cli-config/cache/<name>.json` | Cached spec per registered entry |
+| `.spec-cli/config.json` | Project-local config (baseUrl, auth, headers) |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "api-spec-cli",
-  "version": "0.1.3",
+  "version": "0.2.1",
   "description": "Agent-friendly CLI for exploring and calling OpenAPI and GraphQL APIs",
   "type": "module",
   "bin": {

package/src/args.js

@@ -2,7 +2,7 @@
 // Supports: --flag value, --flag=value, and positional args
 // Repeatable flags (--query, --header, --var) are collected into arrays.
 
-const REPEATABLE = new Set(["query", "header", "var", "env"]);
+const REPEATABLE = new Set(["query", "header", "var", "env", "allow-tool", "disable-tool"]);
 
 export function parseArgs(args) {
   const flags = {};

package/src/cli.js

@@ -6,6 +6,7 @@ import { validateSpec } from "./commands/validate.js";
 import { typesCmd } from "./commands/types.js";
 import { addCmd } from "./commands/add.js";
 import { specsCmd, registryMutate } from "./commands/specs.js";
+import { grepCmd } from "./commands/grep.js";
 import { out, err, setFormat } from "./output.js";
 
 const HELP = `spec-cli — Explore and call APIs from the command line.
@@ -29,6 +30,9 @@ REGISTRY (register once, use anywhere):
   spec add <name> --mcp-stdio "<cmd>"  Register an MCP server (stdio)
     Options: --description <text>  --base-url <url>  --auth <token>
              --header k=v (repeatable)  --env KEY=VAL (repeatable, stdio only)
+             --cwd <path> (stdio only)
+             --allow-tool <glob> (repeatable, MCP only)
+             --disable-tool <glob> (repeatable, MCP only)
 
   spec specs                           List all registered specs
   spec specs --compact false           Show full entry config
@@ -43,6 +47,8 @@ DISCOVER:
   spec list --spec <name> --tag pets          OpenAPI tag or GraphQL kind
   spec list --spec <name> --limit 10          Paginate
   spec list --mcp-http <url>           Inline: no registration needed
+  spec grep <pattern>                  Search across all registered specs
+  spec grep <pattern> --spec <name>    Search within one spec
 
 INSPECT:
   spec show --spec <name> <op>         Operation details (params, body, responses)
@@ -55,6 +61,7 @@ CALL:
   spec call --spec <name> <op> --query status=available  Query params
   spec call --spec <name> <op> --data '{"name":"Rex"}'   JSON body / MCP args
   spec call --spec <name> <op> --data-file args.json     Body from file
+  echo '{"query":"foo"}' | spec call --spec <name> <op>  Pipe JSON from stdin
   spec call --spec <name> <op> --header X-Custom=val     Extra headers
   spec call --spec <name> <op> --method PUT              Override HTTP method
 
@@ -74,6 +81,10 @@ OTHER:
   spec validate <file-or-url>          Check OpenAPI spec for errors
   --format json|text|yaml              Output format (default: json)
 
+ENV VARS (MCP):
+  MCP_MAX_RETRIES=3        Retry attempts on connection failure (default: 3)
+  MCP_RETRY_DELAY=1000     Base retry delay in ms, doubles each attempt (default: 1000)
+
 EXAMPLES:
   spec add agno --mcp-http https://docs.agno.com/mcp --description "Agno docs"
   spec add petstore --openapi https://petstore3.swagger.io/api/v3/openapi.json \\
@@ -148,6 +159,9 @@ export async function run(args) {
       case "refresh":
         await registryMutate("refresh", args.slice(1));
         break;
+      case "grep":
+        await grepCmd(args.slice(1));
+        break;
       default:
         err(`Unknown command: ${cmd}. Run 'spec help' for usage.`);
     }

package/src/commands/add.js

@@ -44,6 +44,7 @@ export async function addCmd(args) {
     entry.transport = "stdio";
     entry.command = parts[0];
     entry.args = parts.slice(1);
+    if (flags.cwd) entry.cwd = flags.cwd;
     entry.config = { env: parseKV(flags.env) };
   } else if (flags["mcp-sse"]) {
     entry.type = "mcp";
@@ -61,6 +62,14 @@ export async function addCmd(args) {
     );
   }
 
+  // Tool filtering (MCP only)
+  if (entry.type === "mcp") {
+    const allowed = flags["allow-tool"];
+    const disabled = flags["disable-tool"];
+    if (allowed?.length) entry.config.allowedTools = allowed;
+    if (disabled?.length) entry.config.disabledTools = disabled;
+  }
+
   registry.push(entry);
   saveRegistry(registry);
   out({ ok: true, name, type: entry.type, transport: entry.transport });

package/src/commands/call.js

@@ -15,6 +15,20 @@ export async function callOperation(args) {
     flags.data = readFileSync(flags["data-file"], "utf-8").trim();
   }
 
+  // Read from stdin when piped and no --data/--data-file provided.
+  // isTTY is true in a terminal, undefined when piped — so !isTTY catches piped input.
+  // Wrapped in try-catch so test runners with closed stdin don't crash.
+  if (!flags.data && !process.stdin.isTTY) {
+    try {
+      const chunks = [];
+      for await (const chunk of process.stdin) chunks.push(chunk);
+      const piped = Buffer.concat(chunks).toString("utf-8").trim();
+      if (piped) flags.data = piped;
+    } catch {
+      // stdin unavailable (test runner, closed pipe) — ignore
+    }
+  }
+
   const { spec, entry } = await resolveActiveSpec(flags);
   const config = resolveConfig(flags, entry);
 

package/src/commands/grep.js

@@ -0,0 +1,63 @@
+import { out } from "../output.js";
+import { parseArgs } from "../args.js";
+import { getRegistry, getEntry, getCachedSpec, saveCachedSpec } from "../registry.js";
+import { resolveSpec, matchGlob } from "./load.js";
+
+export async function grepCmd(args) {
+  const { flags, positional } = parseArgs(args);
+  const pattern = positional[0];
+  if (!pattern) throw new Error(
+    "Usage: spec grep <pattern> [--spec <name>]\n" +
+    "  Glob patterns: * matches anything, ? matches one char\n" +
+    "  Plain text: substring match across name and description"
+  );
+
+  const entries = flags.spec
+    ? [getEntry(flags.spec)]
+    : getRegistry().filter((e) => e.enabled);
+
+  if (entries.length === 0) throw new Error("No registered specs. Run 'spec add' first.");
+
+  const results = [];
+
+  for (const entry of entries) {
+    let spec = getCachedSpec(entry.name);
+    if (!spec) {
+      spec = await resolveSpec(entry);
+      saveCachedSpec(entry.name, spec);
+    }
+
+    const matches = [];
+
+    if (spec.type === "mcp") {
+      for (const tool of spec.tools) {
+        const nameMatch = matchGlob(pattern, tool.name);
+        const descMatch = tool.description && matchGlob(pattern, tool.description);
+        if (nameMatch || descMatch) {
+          matches.push({ id: tool.name, description: tool.description });
+        }
+      }
+    } else if (spec.type === "openapi") {
+      for (const op of spec.operations) {
+        if (matchGlob(pattern, op.id) || matchGlob(pattern, op.path) ||
+            (op.summary && matchGlob(pattern, op.summary))) {
+          matches.push({ id: op.id, method: op.method, path: op.path });
+        }
+      }
+    } else if (spec.type === "graphql") {
+      for (const op of spec.operations) {
+        if (matchGlob(pattern, op.name) ||
+            (op.description && matchGlob(pattern, op.description))) {
+          matches.push({ id: op.name, kind: op.kind });
+        }
+      }
+    }
+
+    if (matches.length > 0) {
+      results.push({ spec: entry.name, type: spec.type, matches });
+    }
+  }
+
+  const total = results.reduce((s, r) => s + r.matches.length, 0);
+  out({ pattern, total, results });
+}

package/src/commands/load.js

@@ -88,6 +88,7 @@ export function inlineEntryFromFlags(flags) {
       transport: "stdio",
       command: parts[0],
       args: parts.slice(1),
+      cwd: flags.cwd,
       config: { env: parseKV(flags.env) },
     };
   }
@@ -118,10 +119,35 @@ export function inlineEntryFromFlags(flags) {
 
 // --- Internal loaders ---
 
+function matchGlob(pattern, str) {
+  // If no glob chars, use case-insensitive substring match
+  if (!pattern.includes("*") && !pattern.includes("?")) {
+    return str.toLowerCase().includes(pattern.toLowerCase());
+  }
+  const re = new RegExp(
+    "^" + pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".") + "$",
+    "i"
+  );
+  return re.test(str);
+}
+
+export { matchGlob };
+
 async function loadMCPFromEntry(entry) {
   const client = await createMcpClient(entry);
   try {
     const { tools } = await client.listTools();
+    let mapped = tools.map((t) => ({
+      name: t.name,
+      description: t.description || null,
+      inputSchema: t.inputSchema || null,
+    }));
+
+    const allowed = entry.config?.allowedTools;
+    const disabled = entry.config?.disabledTools;
+    if (allowed?.length) mapped = mapped.filter((t) => allowed.some((p) => matchGlob(p, t.name)));
+    if (disabled?.length) mapped = mapped.filter((t) => !disabled.some((p) => matchGlob(p, t.name)));
+
     return {
       type: "mcp",
       title: entry.name || "MCP Server",
@@ -129,12 +155,9 @@ async function loadMCPFromEntry(entry) {
       url: entry.url,
       command: entry.command,
       args: entry.args,
+      cwd: entry.cwd,
       config: entry.config,
-      tools: tools.map((t) => ({
-        name: t.name,
-        description: t.description || null,
-        inputSchema: t.inputSchema || null,
-      })),
+      tools: mapped,
     };
   } finally {
     await client.close();

package/src/mcp-client.js

@@ -3,15 +3,31 @@ import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js"
 import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 
-export async function createMcpClient(spec) {
+const MAX_RETRIES = parseInt(process.env.MCP_MAX_RETRIES ?? "3");
+const RETRY_DELAY = parseInt(process.env.MCP_RETRY_DELAY ?? "1000");
+
+// Expand ${VAR} placeholders from process.env at call time
+function expandEnv(val) {
+  return val.replace(/\$\{([^}]+)\}/g, (_, name) => {
+    if (!(name in process.env)) throw new Error(`Environment variable not set: ${name}`);
+    return process.env[name];
+  });
+}
+
+async function connect(spec) {
   const client = new Client({ name: "spec-cli", version: "1.0.0" });
 
   let transport;
   if (spec.transport === "stdio") {
+    const rawEnv = spec.config?.env || {};
+    const expandedEnv = Object.fromEntries(
+      Object.entries(rawEnv).map(([k, v]) => [k, expandEnv(v)])
+    );
     transport = new StdioClientTransport({
       command: spec.command,
       args: spec.args,
-      env: spec.config?.env ? { ...process.env, ...spec.config.env } : undefined,
+      env: Object.keys(expandedEnv).length > 0 ? { ...process.env, ...expandedEnv } : undefined,
+      cwd: spec.cwd,
     });
   } else if (spec.transport === "sse") {
     const h = spec.config?.headers;
@@ -30,3 +46,18 @@ export async function createMcpClient(spec) {
   await client.connect(transport);
   return client;
 }
+
+export async function createMcpClient(spec) {
+  let lastError;
+  for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
+    try {
+      return await connect(spec);
+    } catch (e) {
+      lastError = e;
+      if (attempt < MAX_RETRIES) {
+        await new Promise((r) => setTimeout(r, RETRY_DELAY * Math.pow(2, attempt)));
+      }
+    }
+  }
+  throw lastError;
+}