ikie-cli 0.1.23 → 0.1.25

package/dist/agent.js

@@ -937,6 +937,9 @@ changes they didn't ask for.
   files/scripts) for a specific kind of task. The skills installed on this machine are listed
   under "Available Skills" below by name + description. When a task matches one, call
   \`use_skill\` with its exact name FIRST to pull in the full instructions, then follow them.
+  **Skill scripts are for your internal use only.** If a skill includes Python/bash scripts,
+  run them yourself with the bash tool and use the output. Never paste the raw commands or
+  tell the user to run them manually. Apply the skill's knowledge directly to the user's task.
 - \`install_skill\`: Install a skill from a git URL (GitHub, GitLab, Bitbucket) or local path.
   Skills are instruction packs that give the agent specialized expertise. Example:
   \`install_skill(source: "https://github.com/user/repo.git")\`.
@@ -945,6 +948,27 @@ changes they didn't ask for.
 - \`ask_user\`: Ask the user a clarifying question when you need more info to proceed.
   The user's answer is returned as the tool result. Use sparingly — only when genuinely
   unsure. Don't ask for confirmation on safe operations.
+
+## MCP (Model Context Protocol) System
+- \`mcp_list\`: List all installed MCP servers and their available tools. MCPs extend ikie
+  with specialized capabilities like GitHub API, database access, browser automation, etc.
+- \`mcp_install\`: Install a new MCP server from npm, git URL, or local path.
+- \`mcp_start\`: Start an MCP server to make its tools available for use.
+- \`mcp_stop\`: Stop a running MCP server.
+- \`mcp_call\`: Call a tool from a running MCP. Use \`mcp_list\` first to see available tools.
+- \`mcp_uninstall\`: Remove an installed MCP (built-in MCPs cannot be uninstalled).
+
+**Built-in MCPs:**
+- **filesystem**: Enhanced file operations (read multiple files, directory trees)
+- **github**: GitHub API operations (search repos, manage issues, read files from repos)
+- **database**: Database operations for SQLite and PostgreSQL
+- **puppeteer**: Browser automation and web scraping
+
+**When to use MCPs:** When you need specialized functionality beyond basic tools. For example:
+- Use GitHub MCP to interact with repositories, issues, pull requests
+- Use database MCP to query and manage databases
+- Use puppeteer MCP for complex web interactions
+- Install custom MCPs for domain-specific needs (Slack, Jira, AWS, etc.)
 `,
     ];
     if (skillsCatalog) {

package/dist/mcp-manager.d.ts

@@ -0,0 +1,85 @@
+export interface MCPTool {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        properties: Record<string, any>;
+        required?: string[];
+    };
+}
+export interface MCPServer {
+    name: string;
+    command: string;
+    args: string[];
+    env?: Record<string, string>;
+    description: string;
+    enabled: boolean;
+    autoStart: boolean;
+    tools?: MCPTool[];
+}
+export interface MCPRegistry {
+    servers: Record<string, MCPServer>;
+    builtIn: string[];
+}
+export declare class MCPManager {
+    private registry;
+    private processes;
+    private messageHandlers;
+    constructor();
+    private ensureMCPDir;
+    private loadRegistry;
+    private saveRegistry;
+    private initializeBuiltInServers;
+    installMCP(config: {
+        name: string;
+        source: string;
+        description?: string;
+        env?: Record<string, string>;
+        autoStart?: boolean;
+    }): Promise<{
+        success: boolean;
+        error?: string;
+        server?: MCPServer;
+    }>;
+    uninstallMCP(name: string): {
+        success: boolean;
+        error?: string;
+    };
+    startMCP(name: string): Promise<{
+        success: boolean;
+        error?: string;
+        tools?: MCPTool[];
+    }>;
+    stopMCP(name: string): {
+        success: boolean;
+        error?: string;
+    };
+    private initializeMCP;
+    private requestMCPTools;
+    private sendMCPMessage;
+    private handleMCPMessage;
+    callMCPTool(serverName: string, toolName: string, args: Record<string, any>): Promise<{
+        success: boolean;
+        result?: any;
+        error?: string;
+    }>;
+    getAllTools(): Array<{
+        server: string;
+        tool: MCPTool;
+    }>;
+    listMCPs(): Array<{
+        name: string;
+        description: string;
+        enabled: boolean;
+        running: boolean;
+        builtIn: boolean;
+        tools?: MCPTool[];
+    }>;
+    setMCPEnabled(name: string, enabled: boolean): {
+        success: boolean;
+        error?: string;
+    };
+    startAutoStartMCPs(): Promise<void>;
+    stopAllMCPs(): void;
+}
+export declare function getMCPManager(): MCPManager;

package/dist/mcp-manager.js

@@ -0,0 +1,336 @@
+import { spawn } from 'child_process';
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'fs';
+import { join } from 'path';
+import { HOME_DIR } from './config.js';
+const MCP_REGISTRY_FILE = join(HOME_DIR, 'mcp-registry.json');
+const MCP_DIR = join(HOME_DIR, 'mcps');
+export class MCPManager {
+    registry;
+    processes = new Map();
+    messageHandlers = new Map();
+    constructor() {
+        this.ensureMCPDir();
+        this.registry = this.loadRegistry();
+        this.initializeBuiltInServers();
+    }
+    ensureMCPDir() {
+        if (!existsSync(MCP_DIR)) {
+            mkdirSync(MCP_DIR, { recursive: true });
+        }
+    }
+    loadRegistry() {
+        if (existsSync(MCP_REGISTRY_FILE)) {
+            try {
+                return JSON.parse(readFileSync(MCP_REGISTRY_FILE, 'utf-8'));
+            }
+            catch {
+                return { servers: {}, builtIn: [] };
+            }
+        }
+        return { servers: {}, builtIn: [] };
+    }
+    saveRegistry() {
+        writeFileSync(MCP_REGISTRY_FILE, JSON.stringify(this.registry, null, 2));
+    }
+    initializeBuiltInServers() {
+        const builtIn = {
+            filesystem: {
+                name: 'filesystem',
+                command: 'node',
+                args: [join(MCP_DIR, 'filesystem-server.js')],
+                description: 'File system operations MCP',
+                enabled: true,
+                autoStart: true,
+            },
+            github: {
+                name: 'github',
+                command: 'node',
+                args: [join(MCP_DIR, 'github-server.js')],
+                env: { GITHUB_TOKEN: process.env.GITHUB_TOKEN || '' },
+                description: 'GitHub API operations MCP',
+                enabled: false,
+                autoStart: false,
+            },
+            database: {
+                name: 'database',
+                command: 'node',
+                args: [join(MCP_DIR, 'database-server.js')],
+                description: 'Database operations MCP (SQLite, PostgreSQL)',
+                enabled: false,
+                autoStart: false,
+            },
+            puppeteer: {
+                name: 'puppeteer',
+                command: 'node',
+                args: [join(MCP_DIR, 'puppeteer-server.js')],
+                description: 'Browser automation MCP',
+                enabled: false,
+                autoStart: false,
+            },
+        };
+        for (const [name, server] of Object.entries(builtIn)) {
+            if (!this.registry.servers[name]) {
+                this.registry.servers[name] = server;
+                if (!this.registry.builtIn.includes(name)) {
+                    this.registry.builtIn.push(name);
+                }
+            }
+        }
+        this.saveRegistry();
+    }
+    async installMCP(config) {
+        try {
+            if (this.registry.servers[config.name]) {
+                return { success: false, error: `MCP '${config.name}' already installed` };
+            }
+            let command;
+            let args;
+            if (config.source.startsWith('npm:')) {
+                const pkg = config.source.slice(4);
+                const { execSync } = await import('child_process');
+                execSync(`npm install -g ${pkg}`, { cwd: MCP_DIR });
+                command = pkg;
+                args = [];
+            }
+            else if (config.source.startsWith('http://') || config.source.startsWith('https://')) {
+                const { execSync } = await import('child_process');
+                const repoName = config.source.split('/').pop()?.replace('.git', '') || config.name;
+                const repoPath = join(MCP_DIR, repoName);
+                execSync(`git clone ${config.source} ${repoPath}`, { cwd: MCP_DIR });
+                execSync('npm install', { cwd: repoPath });
+                command = 'node';
+                args = [join(repoPath, 'index.js')];
+            }
+            else {
+                command = 'node';
+                args = [config.source];
+            }
+            const server = {
+                name: config.name,
+                command,
+                args,
+                env: config.env,
+                description: config.description || 'Custom MCP server',
+                enabled: true,
+                autoStart: config.autoStart ?? false,
+            };
+            this.registry.servers[config.name] = server;
+            this.saveRegistry();
+            return { success: true, server };
+        }
+        catch (error) {
+            return {
+                success: false,
+                error: error instanceof Error ? error.message : String(error),
+            };
+        }
+    }
+    uninstallMCP(name) {
+        if (!this.registry.servers[name]) {
+            return { success: false, error: `MCP '${name}' not found` };
+        }
+        if (this.registry.builtIn.includes(name)) {
+            return { success: false, error: `Cannot uninstall built-in MCP '${name}'` };
+        }
+        if (this.processes.has(name)) {
+            this.stopMCP(name);
+        }
+        delete this.registry.servers[name];
+        this.saveRegistry();
+        return { success: true };
+    }
+    async startMCP(name) {
+        const server = this.registry.servers[name];
+        if (!server) {
+            return { success: false, error: `MCP '${name}' not found` };
+        }
+        if (!server.enabled) {
+            return { success: false, error: `MCP '${name}' is disabled` };
+        }
+        if (this.processes.has(name)) {
+            return { success: false, error: `MCP '${name}' is already running` };
+        }
+        try {
+            const child = spawn(server.command, server.args, {
+                env: { ...process.env, ...server.env },
+                stdio: ['pipe', 'pipe', 'pipe'],
+            });
+            const mcpProcess = {
+                server,
+                process: child,
+                tools: [],
+                ready: false,
+            };
+            this.processes.set(name, mcpProcess);
+            child.stdout?.on('data', (data) => {
+                this.handleMCPMessage(name, data.toString());
+            });
+            child.stderr?.on('data', (data) => {
+                console.error(`MCP ${name} error:`, data.toString());
+            });
+            child.on('exit', (code) => {
+                console.log(`MCP ${name} exited with code ${code}`);
+                this.processes.delete(name);
+            });
+            await this.initializeMCP(name);
+            return { success: true, tools: mcpProcess.tools };
+        }
+        catch (error) {
+            return {
+                success: false,
+                error: error instanceof Error ? error.message : String(error),
+            };
+        }
+    }
+    stopMCP(name) {
+        const mcpProcess = this.processes.get(name);
+        if (!mcpProcess) {
+            return { success: false, error: `MCP '${name}' is not running` };
+        }
+        mcpProcess.process.kill();
+        this.processes.delete(name);
+        return { success: true };
+    }
+    async initializeMCP(name) {
+        const mcpProcess = this.processes.get(name);
+        if (!mcpProcess)
+            return;
+        this.sendMCPMessage(name, {
+            jsonrpc: '2.0',
+            id: 1,
+            method: 'initialize',
+            params: {
+                protocolVersion: '2024-11-05',
+                capabilities: {
+                    roots: { listChanged: true },
+                },
+                clientInfo: {
+                    name: 'ikie-cli',
+                    version: '0.1.0',
+                },
+            },
+        });
+        await this.requestMCPTools(name);
+    }
+    async requestMCPTools(name) {
+        this.sendMCPMessage(name, {
+            jsonrpc: '2.0',
+            id: 2,
+            method: 'tools/list',
+        });
+    }
+    sendMCPMessage(name, message) {
+        const mcpProcess = this.processes.get(name);
+        if (!mcpProcess)
+            return;
+        const json = JSON.stringify(message) + '\n';
+        mcpProcess.process.stdin?.write(json);
+    }
+    handleMCPMessage(name, data) {
+        const lines = data.split('\n').filter(Boolean);
+        for (const line of lines) {
+            try {
+                const message = JSON.parse(line);
+                if (message.result?.tools) {
+                    const mcpProcess = this.processes.get(name);
+                    if (mcpProcess) {
+                        mcpProcess.tools = message.result.tools;
+                        mcpProcess.ready = true;
+                    }
+                }
+                if (message.id && this.messageHandlers.has(`${name}-${message.id}`)) {
+                    const handler = this.messageHandlers.get(`${name}-${message.id}`);
+                    handler?.(message);
+                    this.messageHandlers.delete(`${name}-${message.id}`);
+                }
+            }
+            catch (error) {
+                console.error(`Failed to parse MCP message from ${name}:`, error);
+            }
+        }
+    }
+    async callMCPTool(serverName, toolName, args) {
+        const mcpProcess = this.processes.get(serverName);
+        if (!mcpProcess) {
+            return { success: false, error: `MCP '${serverName}' is not running` };
+        }
+        if (!mcpProcess.ready) {
+            return { success: false, error: `MCP '${serverName}' is not ready` };
+        }
+        return new Promise((resolve) => {
+            const id = Date.now();
+            const handlerKey = `${serverName}-${id}`;
+            const timeout = setTimeout(() => {
+                this.messageHandlers.delete(handlerKey);
+                resolve({ success: false, error: 'MCP tool call timeout' });
+            }, 30000);
+            this.messageHandlers.set(handlerKey, (message) => {
+                clearTimeout(timeout);
+                if (message.error) {
+                    resolve({ success: false, error: message.error.message });
+                }
+                else {
+                    resolve({ success: true, result: message.result });
+                }
+            });
+            this.sendMCPMessage(serverName, {
+                jsonrpc: '2.0',
+                id,
+                method: 'tools/call',
+                params: {
+                    name: toolName,
+                    arguments: args,
+                },
+            });
+        });
+    }
+    getAllTools() {
+        const tools = [];
+        for (const [name, mcpProcess] of this.processes) {
+            if (mcpProcess.ready) {
+                for (const tool of mcpProcess.tools) {
+                    tools.push({ server: name, tool });
+                }
+            }
+        }
+        return tools;
+    }
+    listMCPs() {
+        return Object.entries(this.registry.servers).map(([name, server]) => ({
+            name,
+            description: server.description,
+            enabled: server.enabled,
+            running: this.processes.has(name),
+            builtIn: this.registry.builtIn.includes(name),
+            tools: this.processes.get(name)?.tools,
+        }));
+    }
+    setMCPEnabled(name, enabled) {
+        const server = this.registry.servers[name];
+        if (!server) {
+            return { success: false, error: `MCP '${name}' not found` };
+        }
+        server.enabled = enabled;
+        this.saveRegistry();
+        return { success: true };
+    }
+    async startAutoStartMCPs() {
+        for (const [name, server] of Object.entries(this.registry.servers)) {
+            if (server.enabled && server.autoStart) {
+                await this.startMCP(name);
+            }
+        }
+    }
+    stopAllMCPs() {
+        for (const name of this.processes.keys()) {
+            this.stopMCP(name);
+        }
+    }
+}
+let mcpManager = null;
+export function getMCPManager() {
+    if (!mcpManager) {
+        mcpManager = new MCPManager();
+    }
+    return mcpManager;
+}

package/dist/skills.js

@@ -179,7 +179,10 @@ export function renderSkill(skill) {
     parts.push('---');
     parts.push('Follow these instructions for the current task. Use your normal tools to read any ' +
         'bundled files or run any bundled scripts referenced above (resolve their paths against ' +
-        'the skill directory).');
+        'the skill directory). ' +
+        'IMPORTANT: do NOT show the user raw python3 / bash commands or tell them to run scripts manually. ' +
+        'If a skill includes scripts, run them yourself with the bash tool and present the results. ' +
+        'Use the skill\'s knowledge directly to do the work.');
     return parts.join('\n\n');
 }
 // ─── Install / remove ─────────────────────────────────────────────────────────
@@ -301,7 +304,8 @@ export async function installSkill(source, opts = {}) {
             }
             if (existsSync(target))
                 rmSync(target, { recursive: true, force: true });
-            cpSync(dir, target, { recursive: true });
+            // Dereference symlinks so bundled files don't point back to a temp clone dir.
+            cpSync(dir, target, { recursive: true, dereference: true });
             // Never carry version-control metadata into the skill store.
             rmSync(join(target, '.git'), { recursive: true, force: true });
             installed.push(name);

package/dist/tools.js

@@ -1,6 +1,6 @@
 import { exec, spawn } from 'child_process';
 import { readFileSync, writeFileSync, existsSync, readdirSync, statSync, mkdirSync } from 'fs';
-import { dirname, join, resolve } from 'path';
+import { dirname, join, relative, resolve } from 'path';
 import { promisify } from 'util';
 import { glob } from 'glob';
 const execAsync = promisify(exec);
@@ -328,15 +328,102 @@ export const TOOL_DEFS = [
             },
         },
     },
+    {
+        type: 'function',
+        function: {
+            name: 'mcp_install',
+            description: 'Install a new MCP (Model Context Protocol) server to extend capabilities. MCPs provide specialized tools like GitHub API, database access, browser automation, etc.',
+            parameters: {
+                type: 'object',
+                properties: {
+                    name: { type: 'string', description: 'Unique name for this MCP' },
+                    source: { type: 'string', description: 'Source: npm package (npm:package-name), git URL, or local path' },
+                    description: { type: 'string', description: 'Description of what this MCP does' },
+                    autoStart: { type: 'boolean', description: 'Start automatically on ikie launch (default: false)' },
+                },
+                required: ['name', 'source'],
+            },
+        },
+    },
+    {
+        type: 'function',
+        function: {
+            name: 'mcp_list',
+            description: 'List all installed MCP servers and their available tools.',
+            parameters: {
+                type: 'object',
+                properties: {},
+                required: [],
+            },
+        },
+    },
+    {
+        type: 'function',
+        function: {
+            name: 'mcp_start',
+            description: 'Start an installed MCP server to make its tools available.',
+            parameters: {
+                type: 'object',
+                properties: {
+                    name: { type: 'string', description: 'Name of the MCP server to start' },
+                },
+                required: ['name'],
+            },
+        },
+    },
+    {
+        type: 'function',
+        function: {
+            name: 'mcp_stop',
+            description: 'Stop a running MCP server.',
+            parameters: {
+                type: 'object',
+                properties: {
+                    name: { type: 'string', description: 'Name of the MCP server to stop' },
+                },
+                required: ['name'],
+            },
+        },
+    },
+    {
+        type: 'function',
+        function: {
+            name: 'mcp_call',
+            description: 'Call a tool from a running MCP server. Use mcp_list first to see available tools and their parameters.',
+            parameters: {
+                type: 'object',
+                properties: {
+                    server: { type: 'string', description: 'MCP server name' },
+                    tool: { type: 'string', description: 'Tool name from the MCP server' },
+                    arguments: { type: 'object', description: 'Arguments to pass to the tool' },
+                },
+                required: ['server', 'tool', 'arguments'],
+            },
+        },
+    },
+    {
+        type: 'function',
+        function: {
+            name: 'mcp_uninstall',
+            description: 'Uninstall an MCP server (cannot uninstall built-in MCPs).',
+            parameters: {
+                type: 'object',
+                properties: {
+                    name: { type: 'string', description: 'Name of the MCP server to uninstall' },
+                },
+                required: ['name'],
+            },
+        },
+    },
 ];
 // ─── Safe tools (auto-approved) ───────────────────────────────────────────────
 // spawn_agent is "safe" at the dispatch layer — the tools the sub-agent itself
 // runs go through their own approval inside the sub-agent loop.
-export const SAFE_TOOLS = new Set(['read_file', 'list_dir', 'search_files', 'grep', 'memory_write', 'spawn_agent', 'ask_user', 'fetch_url', 'web_search', 'git_status', 'git_diff', 'git_log', 'git_branch', 'use_skill', 'install_skill', 'remove_skill']);
+export const SAFE_TOOLS = new Set(['read_file', 'list_dir', 'search_files', 'grep', 'memory_write', 'spawn_agent', 'ask_user', 'fetch_url', 'web_search', 'git_status', 'git_diff', 'git_log', 'git_branch', 'use_skill', 'install_skill', 'remove_skill', 'mcp_list', 'mcp_start', 'mcp_stop', 'mcp_call']);
 // Tools available in PLAN mode — read-only exploration plus delegation/questions.
 // Everything that mutates the filesystem or runs commands (write_file, edit_file,
 // bash, memory_write) is intentionally excluded so plan mode can only research.
-export const PLAN_TOOLS = new Set(['read_file', 'list_dir', 'search_files', 'grep', 'spawn_agent', 'ask_user', 'fetch_url', 'web_search', 'git_status', 'git_diff', 'git_log', 'git_branch', 'use_skill', 'install_skill', 'remove_skill']);
+export const PLAN_TOOLS = new Set(['read_file', 'list_dir', 'search_files', 'grep', 'spawn_agent', 'ask_user', 'fetch_url', 'web_search', 'git_status', 'git_diff', 'git_log', 'git_branch', 'use_skill', 'install_skill', 'remove_skill', 'mcp_list', 'mcp_call']);
 // Paths that may contain secrets, credentials, or system configuration.
 // Reading these requires explicit user permission even though read_file is normally safe.
 const RESTRICTED_PATTERNS = [
@@ -424,14 +511,84 @@ export function formatToolArgs(name, input) {
             return JSON.stringify(input).slice(0, 80);
     }
 }
+// ─── Security Validation Functions ───────────────────────────────────────────
+/**
+ * Validates that a path is safe and within allowed boundaries
+ */
+function validatePathSafety(userPath) {
+    try {
+        const resolved = resolve(userPath);
+        const cwd = process.cwd();
+        const rel = relative(cwd, resolved);
+        if (rel.startsWith('..') || resolve(rel) !== rel) {
+            return { safe: false, resolved, error: 'Path traversal detected' };
+        }
+        if (!resolved.startsWith(cwd)) {
+            return { safe: false, resolved, error: 'Path outside working directory' };
+        }
+        return { safe: true, resolved };
+    }
+    catch (e) {
+        return { safe: false, resolved: '', error: `Invalid path: ${e}` };
+    }
+}
+/**
+ * Validates bash command for safety
+ */
+function validateBashCommand(command) {
+    const trimmed = command.trim();
+    const dangerousPatterns = [
+        { pattern: /[;&|`](?!.*\bin\b.*[\"'])/g, desc: 'shell metacharacters' },
+        { pattern: /\$\(/g, desc: 'command substitution' },
+        { pattern: />\s*\/(?:dev|etc|proc|sys)\b/g, desc: 'system file access' },
+    ];
+    for (const { pattern, desc } of dangerousPatterns) {
+        if (pattern.test(trimmed)) {
+            return { safe: false, error: `Potentially dangerous: ${desc}` };
+        }
+    }
+    return { safe: true };
+}
+/**
+ * Sanitizes git branch names
+ */
+function sanitizeGitBranchName(name) {
+    const trimmed = name.trim();
+    const dangerous = /[~^:\\@{}]|\.\.|\/{2,}|^[\/\.\-]|[\/\.]$/;
+    if (dangerous.test(trimmed)) {
+        return { safe: false, sanitized: '', error: 'Invalid branch name characters' };
+    }
+    if (trimmed.length === 0 || trimmed.length > 255) {
+        return { safe: false, sanitized: '', error: 'Branch name length must be 1-255 characters' };
+    }
+    return { safe: true, sanitized: trimmed };
+}
+/**
+ * Sanitizes error messages to prevent information leakage
+ */
+function sanitizeError(error) {
+    if (error instanceof Error) {
+        return error.message.split('\n')[0];
+    }
+    return String(error).split('\n')[0];
+}
 // ─── Executors ────────────────────────────────────────────────────────────────
 function readFile(input) {
     if (!input.path || input.path === 'undefined')
         return 'Error: path is required for read_file';
-    const abs = resolve(input.path);
+    const pathCheck = validatePathSafety(input.path);
+    if (!pathCheck.safe) {
+        return `Error: ${pathCheck.error}`;
+    }
+    const abs = pathCheck.resolved;
     if (!existsSync(abs))
         return `Error: File not found: ${input.path}`;
     try {
+        const stats = statSync(abs);
+        const maxSize = 10 * 1024 * 1024;
+        if (stats.size > maxSize) {
+            return `Error: File too large (${(stats.size / 1024 / 1024).toFixed(2)}MB). Maximum: 10MB`;
+        }
         const content = readFileSync(abs, 'utf-8');
         const lines = content.split('\n');
         const start = (input.start_line ?? 1) - 1;
@@ -439,7 +596,7 @@ function readFile(input) {
         return lines.slice(start, end).map((l, i) => `${String(i + start + 1).padStart(4)} │ ${l}`).join('\n');
     }
     catch (e) {
-        return `Error: ${e}`;
+        return `Error: ${sanitizeError(e)}`;
     }
 }
 function writeFile(input) {
@@ -447,22 +604,35 @@ function writeFile(input) {
         return 'Error: path is required for write_file';
     if (input.content == null)
         return 'Error: content is required for write_file';
-    const abs = resolve(input.path);
+    const pathCheck = validatePathSafety(input.path);
+    if (!pathCheck.safe) {
+        return `Error: ${pathCheck.error}`;
+    }
+    const abs = pathCheck.resolved;
+    const maxSize = 5 * 1024 * 1024;
+    const contentSize = Buffer.byteLength(input.content, 'utf-8');
+    if (contentSize > maxSize) {
+        return `Error: Content too large (${(contentSize / 1024 / 1024).toFixed(2)}MB). Maximum: 5MB`;
+    }
     const dir = dirname(abs);
-    if (!existsSync(dir))
-        mkdirSync(dir, { recursive: true });
     try {
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true });
         writeFileSync(abs, input.content);
         return `Written ${input.content.split('\n').length} lines to ${input.path}`;
     }
     catch (e) {
-        return `Error: ${e}`;
+        return `Error: ${sanitizeError(e)}`;
     }
 }
 function editFile(input) {
     if (!input.path || input.path === 'undefined')
         return 'Error: path is required for edit_file';
-    const abs = resolve(input.path);
+    const pathCheck = validatePathSafety(input.path);
+    if (!pathCheck.safe) {
+        return `Error: ${pathCheck.error}`;
+    }
+    const abs = pathCheck.resolved;
     if (!existsSync(abs))
         return `Error: File not found: ${input.path}`;
     try {
@@ -476,13 +646,23 @@ function editFile(input) {
         return `Edited ${input.path} — replaced 1 occurrence`;
     }
     catch (e) {
-        return `Error: ${e}`;
+        return `Error: ${sanitizeError(e)}`;
     }
 }
 async function bash(input) {
-    const cwd = input.cwd ? resolve(input.cwd) : process.cwd();
+    let cwd = process.cwd();
+    if (input.cwd) {
+        const cwdCheck = validatePathSafety(input.cwd);
+        if (!cwdCheck.safe) {
+            return `Error: ${cwdCheck.error}`;
+        }
+        cwd = cwdCheck.resolved;
+    }
     const command = input.command.trim();
-    // Background commands (ending with &) — detach properly so they survive
+    const validation = validateBashCommand(command);
+    if (!validation.safe) {
+        return `Error: ${validation.error}. Command blocked for security.`;
+    }
     if (command.endsWith('&')) {
         const bgCmd = command.slice(0, -1).trim();
         try {
@@ -500,13 +680,15 @@ async function bash(input) {
             return `Started background process (PID: ${child.pid})`;
         }
         catch (err) {
-            return `Error starting background process: ${err}`;
+            return `Error starting background process: ${sanitizeError(err)}`;
         }
     }
+    const maxTimeout = 60000;
+    const timeout = Math.min(input.timeout_ms ?? 30000, maxTimeout);
     try {
         const { stdout, stderr } = await execAsync(command, {
             cwd,
-            timeout: input.timeout_ms ?? 30000,
+            timeout,
             maxBuffer: 2 * 1024 * 1024,
         });
         const parts = [];
@@ -524,12 +706,15 @@ async function bash(input) {
         if (e.stderr?.trim())
             parts.push(`[stderr]\n${e.stderr.trim()}`);
         if (!parts.length)
-            parts.push(e.message ?? 'Command failed');
+            parts.push(sanitizeError(e.message ?? 'Command failed'));
         return `Exit ${e.code ?? 1}\n${parts.join('\n')}`;
     }
 }
 function listDir(input) {
-    const root = resolve(input.path ?? '.');
+    const check = validatePathSafety(input.path ?? '.');
+    if (!check.safe)
+        return `Error: ${check.error}`;
+    const root = check.resolved;
     if (!existsSync(root))
         return `Error: Not found: ${input.path}`;
     const maxDepth = input.max_depth ?? 3;
@@ -582,6 +767,8 @@ async function grepFiles(input) {
     const flags = input.ignore_case ? 'i' : '';
     let re;
     try {
+        if (input.pattern.length > 200)
+            return 'Error: Regex pattern too long (max 200 characters)';
         re = new RegExp(input.pattern, flags);
     }
     catch {
@@ -680,8 +867,7 @@ async function memoryWrite(input) {
         return `Saved to ${scope} memory.`;
     }
     catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        return `Error saving to ${scope} memory: ${msg}`;
+        return `Error saving to ${scope} memory: ${sanitizeError(err)}`;
     }
 }
 // ─── Git ──────────────────────────────────────────────────────────────────────
@@ -693,7 +879,7 @@ async function gitStatus(input) {
     }
     catch (err) {
         const e = err;
-        return `Error: ${e.stderr?.trim() ?? e.message ?? err}`;
+        return `Error: ${sanitizeError(e.stderr ?? e.message ?? err)}`;
     }
 }
 async function gitDiff(input) {
@@ -706,7 +892,7 @@ async function gitDiff(input) {
     }
     catch (err) {
         const e = err;
-        return `Error: ${e.stderr?.trim() ?? e.message ?? err}`;
+        return `Error: ${sanitizeError(e.stderr ?? e.message ?? err)}`;
     }
 }
 async function gitLog(input) {
@@ -717,7 +903,7 @@ async function gitLog(input) {
     }
     catch (err) {
         const e = err;
-        return `Error: ${e.stderr?.trim() ?? e.message ?? err}`;
+        return `Error: ${sanitizeError(e.stderr ?? e.message ?? err)}`;
     }
 }
 async function gitCommit(input) {
@@ -740,7 +926,7 @@ async function gitCommit(input) {
             parts.push(e.stdout.trim());
         if (e.stderr?.trim())
             parts.push(e.stderr.trim());
-        return `Error: ${parts.join('\n') || (e.message ?? String(err))}`;
+        return `Error: ${parts.join('\n') || sanitizeError(e)}`;
     }
 }
 async function gitBranch(input) {
@@ -750,16 +936,21 @@ async function gitBranch(input) {
             const { stdout } = await execAsync('git branch -a', { cwd });
             return stdout.trim() || '(no branches)';
         }
+        const validation = sanitizeGitBranchName(input.name);
+        if (!validation.safe) {
+            return `Error: ${validation.error}`;
+        }
+        const safeName = validation.sanitized;
         if (input.checkout) {
-            const { stdout, stderr } = await execAsync(`git checkout -b "${input.name}"`, { cwd });
-            return (stdout + stderr).trim() || `Switched to new branch '${input.name}'`;
+            const { stdout, stderr } = await execAsync(`git checkout -b ${JSON.stringify(safeName)}`, { cwd });
+            return (stdout + stderr).trim() || `Switched to new branch '${safeName}'`;
         }
-        await execAsync(`git branch "${input.name}"`, { cwd });
-        return `Created branch '${input.name}'`;
+        await execAsync(`git branch ${JSON.stringify(safeName)}`, { cwd });
+        return `Created branch '${safeName}'`;
     }
     catch (err) {
         const e = err;
-        return `Error: ${e.stderr?.trim() ?? e.message ?? err}`;
+        return `Error: ${sanitizeError(e.stderr ?? e.message ?? err)}`;
     }
 }
 // ─── Web ──────────────────────────────────────────────────────────────────────
@@ -823,7 +1014,7 @@ async function fetchUrl(input) {
         const e = err;
         if (e.name === 'AbortError')
             return `Error: request to ${url} timed out after 15s`;
-        return `Error fetching ${url}: ${e.message ?? err}`;
+        return `Error fetching ${url}: ${sanitizeError(e)}`;
     }
     finally {
         clearTimeout(timer);
@@ -834,7 +1025,6 @@ async function webSearch(input) {
     if (!query || query === 'undefined')
         return 'Error: query is required for web_search';
     const count = Math.min(Math.max(input.count ?? 5, 1), 10);
-    // Load account key at call time (same pattern as memoryWrite's dynamic import).
     const { loadConfig, getApiKey, IKIE_API_BASE } = await import('./config.js');
     const apiKey = getApiKey(loadConfig());
     if (!apiKey) {
@@ -855,8 +1045,7 @@ async function webSearch(input) {
         return formatSearchResults(query, data.results ?? []);
     }
     catch (err) {
-        const e = err;
-        return `Error during web_search: ${e.message ?? err}`;
+        return `Error during web_search: ${sanitizeError(err)}`;
     }
 }
 function formatSearchResults(query, results) {
@@ -901,7 +1090,7 @@ async function installSkill(input) {
         return lines.length ? lines.join('\n') : 'Nothing to install.';
     }
     catch (err) {
-        return `Error: ${err instanceof Error ? err.message : String(err)}`;
+        return `Error: ${sanitizeError(err)}`;
     }
 }
 async function removeSkill(input) {
@@ -918,6 +1107,81 @@ async function removeSkill(input) {
     const removed = doRemove(name);
     return removed ? `Removed skill "${name}".` : `No skill named "${name}" found.`;
 }
+// ─── MCP Functions ────────────────────────────────────────────────────────────
+async function mcpInstall(input) {
+    const { getMCPManager } = await import('./mcp-manager.js');
+    const manager = getMCPManager();
+    const result = await manager.installMCP({
+        name: input.name,
+        source: input.source,
+        description: input.description,
+        autoStart: input.autoStart,
+    });
+    if (!result.success) {
+        return `Error installing MCP: ${result.error}`;
+    }
+    return `✓ Installed MCP "${input.name}".\nRun mcp_start to activate it.`;
+}
+async function mcpList() {
+    const { getMCPManager } = await import('./mcp-manager.js');
+    const manager = getMCPManager();
+    const mcps = manager.listMCPs();
+    if (!mcps.length) {
+        return 'No MCPs installed. Use mcp_install to add MCP servers.';
+    }
+    const lines = ['Available MCPs:\n'];
+    for (const mcp of mcps) {
+        const status = mcp.running ? '🟢 Running' : mcp.enabled ? '⚪ Stopped' : '⚫ Disabled';
+        const builtIn = mcp.builtIn ? ' [Built-in]' : '';
+        lines.push(`${status} ${mcp.name}${builtIn}`);
+        lines.push(`   ${mcp.description}`);
+        if (mcp.running && mcp.tools) {
+            lines.push(`   Tools: ${mcp.tools.map(t => t.name).join(', ')}`);
+        }
+        lines.push('');
+    }
+    return lines.join('\n');
+}
+async function mcpStart(input) {
+    const { getMCPManager } = await import('./mcp-manager.js');
+    const manager = getMCPManager();
+    const result = await manager.startMCP(input.name);
+    if (!result.success) {
+        return `Error starting MCP: ${result.error}`;
+    }
+    const toolCount = result.tools?.length || 0;
+    const toolNames = result.tools?.map(t => t.name).join(', ') || 'none';
+    return `✓ Started MCP "${input.name}".\nAvailable tools (${toolCount}): ${toolNames}`;
+}
+async function mcpStop(input) {
+    const { getMCPManager } = await import('./mcp-manager.js');
+    const manager = getMCPManager();
+    const result = manager.stopMCP(input.name);
+    if (!result.success) {
+        return `Error stopping MCP: ${result.error}`;
+    }
+    return `✓ Stopped MCP "${input.name}".`;
+}
+async function mcpCall(input) {
+    const { getMCPManager } = await import('./mcp-manager.js');
+    const manager = getMCPManager();
+    const result = await manager.callMCPTool(input.server, input.tool, input.arguments);
+    if (!result.success) {
+        return `Error calling MCP tool: ${result.error}`;
+    }
+    return typeof result.result === 'string'
+        ? result.result
+        : JSON.stringify(result.result, null, 2);
+}
+async function mcpUninstall(input) {
+    const { getMCPManager } = await import('./mcp-manager.js');
+    const manager = getMCPManager();
+    const result = manager.uninstallMCP(input.name);
+    if (!result.success) {
+        return `Error uninstalling MCP: ${result.error}`;
+    }
+    return `✓ Uninstalled MCP "${input.name}".`;
+}
 // ─── Dispatcher ───────────────────────────────────────────────────────────────
 export async function executeTool(name, input) {
     switch (name) {
@@ -940,6 +1204,12 @@ export async function executeTool(name, input) {
         case 'use_skill': return useSkill(input);
         case 'install_skill': return installSkill(input);
         case 'remove_skill': return removeSkill(input);
+        case 'mcp_install': return mcpInstall(input);
+        case 'mcp_list': return mcpList();
+        case 'mcp_start': return mcpStart(input);
+        case 'mcp_stop': return mcpStop(input);
+        case 'mcp_call': return mcpCall(input);
+        case 'mcp_uninstall': return mcpUninstall(input);
         default: return `Unknown tool: ${name}`;
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ikie-cli",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "description": "Agentic coding CLI — your terminal AI pair programmer",
   "type": "module",
   "bin": {