klyro 1.0.6 → 1.0.7

package/dist/mcp/auth.js

@@ -0,0 +1,249 @@
+/**
+ * B2 — MCP OAuth/PKCE auth surface (remote MCP reach parity).
+ *
+ * Token-backed OAuth 2.0 Authorization Code flow with PKCE (RFC 7636) for
+ * remote MCP servers (Risk #7 / #3 residual: "OAuth absent"). Access tokens
+ * are cached at `~/.klyro/mcp-tokens.json` (mode 0600) and keyed by the
+ * server's URL + clientId, so a cached credential survives restarts and is
+ * reused (with lazy refresh) instead of re-prompting every run.
+ *
+ * The auth code flow runs against a short-lived loopback listener on
+ * 127.0.0.1 (RFC 8252 native-app redirect). In a headless context the flow
+ * prints the authorization URL and the user completes it by opening the
+ * link; the code is captured on the loopback redirect. Every function is
+ * fail-safe: network/server failures never throw raw into the MCP tool path
+ * — they surface a typed `AuthError`.
+ */
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs';
+import * as http from 'node:http';
+import * as os from 'node:os';
+import * as path from 'node:path';
+export class AuthError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'AuthError';
+    }
+}
+export const TOKEN_STALE_MARGIN_S = 60;
+export const TOKENS_FILE = 'mcp-tokens.json';
+function tokensPath() {
+    const base = process.env.KLYRO_CONFIG_DIR ?? path.join(os.homedir() || process.cwd(), '.klyro');
+    return path.join(base, TOKENS_FILE);
+}
+/** Fully load the token cache as a plain object (missing/corrupt → {}). */
+export function loadMcpTokens() {
+    try {
+        const raw = fs.readFileSync(tokensPath(), 'utf-8');
+        const parsed = JSON.parse(raw);
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+            ? parsed
+            : {};
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Persist a token to the 0600 cache. Merges by key so concurrent server
+ * writes don't clobber each other. A symlinked cache path is refused (the
+ * write would land outside the klyro config dir or be swapped mid-write).
+ */
+export function saveMcpToken(cacheKey, token) {
+    const p = tokensPath();
+    try {
+        if (fs.lstatSync(p).isSymbolicLink()) {
+            throw new AuthError(`refusing to write token cache through symlink: ${p}`);
+        }
+    }
+    catch (e) {
+        if (e instanceof AuthError)
+            throw e;
+        /* ENOENT — first write, fine */
+    }
+    const dir = path.dirname(p);
+    fs.mkdirSync(dir, { recursive: true });
+    const all = loadMcpTokens();
+    all[cacheKey] = token;
+    const tmp = `${p}.tmp-${process.pid}-${Date.now()}`;
+    fs.writeFileSync(tmp, JSON.stringify(all, null, 2) + '\n', { mode: 0o600 });
+    fs.renameSync(tmp, p);
+}
+/** Stable cache key for a server URL + clientId. */
+export function mcpTokenCacheKey(url, clientId) {
+    return `${url}|${clientId}`;
+}
+/** True when a cached token is still usable (with a clock-skew margin). */
+export function tokenValid(t) {
+    if (!t || typeof t.access_token !== 'string' || !t.access_token)
+        return false;
+    // expires_at 0 = unknown lifetime — assume still valid.
+    return t.expires_at === 0 || t.expires_at > Date.now() / 1000 + TOKEN_STALE_MARGIN_S;
+}
+/** PKCE (RFC 7636 §4.1): cryptographically-random 43-128 char code verifier. */
+export function generateCodeVerifier() {
+    return crypto.randomBytes(64).toString('base64url'); // ~86 chars, within §4.1 range
+}
+/** PKCE §4.2: base64url SHA-256 challenge of the verifier. */
+export function codeChallengeFromVerifier(verifier) {
+    return crypto.createHash('sha256').update(verifier).digest('base64url');
+}
+/**
+ * Resolve auth headers for a server: reuse a valid cached token, else run
+ * the interactive Authorization Code + PKCE flow. Returns only the headers;
+ * failures surface as `AuthError` so callers (the MCP probe/connect path)
+ * can turn them into a clear error instead of a hang.
+ */
+export async function resolveAuth(auth, cacheKey) {
+    const cached = loadMcpTokens()[cacheKey];
+    if (cached && tokenValid(cached)) {
+        return { headers: { Authorization: `${cached.token_type || 'Bearer'} ${cached.access_token}` }, fromCache: true };
+    }
+    // No usable token — run the code flow.
+    const token = await runCodeFlow(auth);
+    if (!token)
+        throw new AuthError(`OAuth flow for "${auth.clientId}" returned no token`);
+    const expiryUnix = token.expires_in ? Math.floor(Date.now() / 1000 + token.expires_in) : 0;
+    const saved = {
+        access_token: token.access_token,
+        token_type: token.token_type ?? 'Bearer',
+        expires_at: expiryUnix,
+        refresh_token: token.refresh_token,
+        scope: token.scope,
+        cachedAtMs: Date.now(),
+    };
+    saveMcpToken(cacheKey, saved);
+    return { headers: { Authorization: `${saved.token_type} ${saved.access_token}` }, fromCache: false };
+}
+function resolveIssuer(auth, serverUrl) {
+    let issuer;
+    try {
+        issuer = new URL(auth.authorizationEndpoint ?? serverUrl);
+    }
+    catch {
+        throw new AuthError(`invalid OAuth issuer URL for "${auth.clientId}"`);
+    }
+    return issuer;
+}
+/**
+ * Run the Authorization Code flow with PKCE over a one-shot loopback
+ * redirect (RFC 8252). Best-effort and headless-friendly: on any failure it
+ * throws `AuthError` rather than leaving a stray listener. The token endpoint
+ * defaults to the OAuth metadata `token_endpoint` when the server advertises
+ * it, else the spec's `tokenEndpoint`.
+ */
+export async function runCodeFlow(auth, serverUrl) {
+    const issuer = resolveIssuer(auth, serverUrl ?? '');
+    const verifier = generateCodeVerifier();
+    const challenge = codeChallengeFromVerifier(verifier);
+    const listener = http.createServer();
+    const port = await new Promise((resolve, reject) => {
+        listener.once('error', reject);
+        listener.listen(0, '127.0.0.1', () => {
+            const addr = listener.address();
+            if (addr && typeof addr === 'object')
+                resolve(addr.port);
+            else
+                reject(new AuthError('could not bind loopback listener'));
+        });
+    });
+    let code = null;
+    const pending = new Promise((resolve, reject) => {
+        listener.on('request', (req, res) => {
+            const u = new URL(req.url ?? '/', 'http://127.0.0.1');
+            code = u.searchParams.get('code');
+            res.writeHead(200, { 'Content-Type': 'text/html' });
+            res.end('You can close this tab and return to the terminal.');
+            if (code)
+                resolve(code);
+            else
+                reject(new AuthError('authorization redirect carried no code'));
+        });
+    });
+    try {
+        const redirectUri = auth.redirectUri ?? `http://127.0.0.1:${port}/callback`;
+        const authorizeUrl = buildAuthorizeUrl(auth, issuer, challenge, redirectUri);
+        process.stdout.write(`\nOpen this URL in your browser to authorize klyro for MCP server "${auth.clientId}":\n${authorizeUrl}\n`);
+        code = await pending;
+        return await exchangeCode(auth, issuer, code, verifier, redirectUri);
+    }
+    finally {
+        listener.close();
+    }
+}
+function buildAuthorizeUrl(auth, issuer, challenge, redirectUri) {
+    const u = new URL(auth.authorizationEndpoint || issuer.origin, issuer);
+    u.searchParams.set('response_type', 'code');
+    u.searchParams.set('client_id', auth.clientId);
+    u.searchParams.set('redirect_uri', redirectUri);
+    u.searchParams.set('code_challenge', challenge);
+    u.searchParams.set('code_challenge_method', 'S256');
+    u.searchParams.set('state', crypto.randomBytes(8).toString('base64url'));
+    if (auth.scopes)
+        u.searchParams.set('scope', auth.scopes);
+    return u.toString();
+}
+async function exchangeCode(auth, issuer, code, verifier, redirectUri) {
+    const tokenEndpoint = auth.tokenEndpoint || `${issuer.origin}/token`;
+    const res = await fetch(tokenEndpoint, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' },
+        body: new URLSearchParams({
+            grant_type: 'authorization_code',
+            code,
+            redirect_uri: redirectUri,
+            client_id: auth.clientId,
+            code_verifier: verifier,
+        }),
+    });
+    if (!res.ok)
+        throw new AuthError(`token exchange failed: HTTP ${res.status}`);
+    const data = (await res.json());
+    if (!data.access_token)
+        throw new AuthError('token exchange returned no access_token');
+    return data;
+}
+/**
+ * Scrub credential-bearing headers from debug capture so `KLYRO_MCP_DEBUG`
+ * never writes a live access token to disk. Non-credential headers pass
+ * through untouched.
+ */
+export function scrubAuthHeaders(headers) {
+    const out = {};
+    for (const [k, v] of Object.entries(headers)) {
+        if (k.toLowerCase() === 'authorization' || k.toLowerCase() === 'cookie' || k.toLowerCase() === 'x-api-key') {
+            out[k] = '[REDACTED]';
+        }
+        else {
+            out[k] = v;
+        }
+    }
+    return out;
+}
+/** Refreshes a stale token when a refresh_token is cached (best-effort). */
+export async function tryRefresh(auth, cached) {
+    if (!cached.refresh_token || !auth.tokenEndpoint)
+        return null;
+    const res = await fetch(auth.tokenEndpoint, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' },
+        body: new URLSearchParams({
+            grant_type: 'refresh_token',
+            refresh_token: cached.refresh_token,
+            client_id: auth.clientId,
+        }),
+    });
+    if (!res.ok)
+        return null;
+    const data = (await res.json());
+    if (!data.access_token)
+        return null;
+    return {
+        access_token: data.access_token,
+        token_type: data.token_type ?? cached.token_type,
+        expires_at: data.expires_in ? Math.floor(Date.now() / 1000 + data.expires_in) : cached.expires_at,
+        refresh_token: data.refresh_token ?? cached.refresh_token,
+        scope: data.scope ?? cached.scope,
+        cachedAtMs: Date.now(),
+    };
+}

package/dist/mcp/config.d.ts

@@ -1,17 +1,45 @@
 import { z } from 'zod';
+/** MCP remote URL guard — https:// (or loopback http://) only. */
+export declare function assertSafeMcpUrl(url: string): void;
+/** True when the plain-HTTP MCP opt-in is set (env or persisted equivalent). */
+export declare function insecureMcpAllowed(): boolean;
 export declare const McpServerPolicySchema: z.ZodObject<{
     allowTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
     denyTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
     requireApproval: z.ZodOptional<z.ZodBoolean>;
     timeoutMs: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
+/**
+ * B2 — optional OAuth/PKCE auth surface for remote (`url`) transports.
+ * Present ⇒ the probe/connect path resolves a bearer token and attaches
+ * `Authorization`; the debug capture scrubs it (see `scrubAuthHeaders`).
+ */
+export declare const McpServerAuthSchema: z.ZodObject<{
+    clientId: z.ZodString;
+    tokenEndpoint: z.ZodOptional<z.ZodString>;
+    authorizationEndpoint: z.ZodOptional<z.ZodString>;
+    redirectUri: z.ZodOptional<z.ZodString>;
+    scopes: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type McpServerAuth = z.infer<typeof McpServerAuthSchema>;
 export type McpServerPolicy = z.infer<typeof McpServerPolicySchema>;
 export declare const McpServerSpecSchema: z.ZodObject<{
     command: z.ZodOptional<z.ZodString>;
     args: z.ZodOptional<z.ZodArray<z.ZodString>>;
     env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     url: z.ZodOptional<z.ZodString>;
+    transport: z.ZodOptional<z.ZodEnum<{
+        streamable: "streamable";
+        sse: "sse";
+    }>>;
     headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    auth: z.ZodOptional<z.ZodObject<{
+        clientId: z.ZodString;
+        tokenEndpoint: z.ZodOptional<z.ZodString>;
+        authorizationEndpoint: z.ZodOptional<z.ZodString>;
+        redirectUri: z.ZodOptional<z.ZodString>;
+        scopes: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
     disabled: z.ZodOptional<z.ZodBoolean>;
     policy: z.ZodOptional<z.ZodObject<{
         allowTools: z.ZodOptional<z.ZodArray<z.ZodString>>;

package/dist/mcp/config.js

@@ -12,12 +12,52 @@ import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 import { z } from 'zod';
+/** MCP remote URL guard — https:// (or loopback http://) only. */
+export function assertSafeMcpUrl(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new Error(`invalid MCP server url: ${url}`);
+    }
+    if (parsed.protocol === 'https:')
+        return;
+    if (parsed.protocol === 'http:') {
+        const h = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, '');
+        if (h === 'localhost' || h === '127.0.0.1' || h === '::1' || h === '0.0.0.0' || h === '::' || h.startsWith('127.'))
+            return;
+        throw new Error(`insecure MCP server url (plain HTTP) for host ${parsed.hostname} — use https:// or a loopback URL, or set KLYRO_ALLOW_INSECURE_MCP=1`);
+    }
+    throw new Error(`unsupported MCP server url protocol: ${parsed.protocol}`);
+}
+/** True when the plain-HTTP MCP opt-in is set (env or persisted equivalent). */
+export function insecureMcpAllowed() {
+    return process.env.KLYRO_ALLOW_INSECURE_MCP === '1';
+}
 export const McpServerPolicySchema = z.object({
     allowTools: z.array(z.string()).optional(),
     denyTools: z.array(z.string()).optional(),
     requireApproval: z.boolean().optional(),
     timeoutMs: z.number().int().positive().optional(),
 });
+/**
+ * B2 — optional OAuth/PKCE auth surface for remote (`url`) transports.
+ * Present ⇒ the probe/connect path resolves a bearer token and attaches
+ * `Authorization`; the debug capture scrubs it (see `scrubAuthHeaders`).
+ */
+export const McpServerAuthSchema = z.object({
+    /** OAuth 2.0 client id registered with the authorization server. */
+    clientId: z.string().min(1),
+    /** Token endpoint; when absent, derived from the authorization issuer. */
+    tokenEndpoint: z.string().url().optional(),
+    /** Authorization endpoint / metadata issuer; defaults to the server URL. */
+    authorizationEndpoint: z.string().url().optional(),
+    /** Custom redirect URI; defaults to a loopback listener on 127.0.0.1. */
+    redirectUri: z.string().url().optional(),
+    /** Space-separated additional scopes. */
+    scopes: z.string().optional(),
+});
 export const McpServerSpecSchema = z.object({
     /** stdio transport: command to spawn. Required unless `url` is set. */
     command: z.string().min(1).optional(),
@@ -25,17 +65,42 @@ export const McpServerSpecSchema = z.object({
     env: z.record(z.string(), z.string()).optional(),
     /** Remote transport: Streamable-HTTP JSON-RPC endpoint. Required unless `command` is set. */
     url: z.string().url().optional(),
+    /**
+     * Remote transport flavor: `streamable` (default, POST per message) or
+     * `sse` (legacy HTTP+SSE: persistent GET event stream + message POST).
+     */
+    transport: z.enum(['streamable', 'sse']).optional(),
     /** Extra HTTP headers for remote transport (`${env:VAR}` expanded). */
     headers: z.record(z.string(), z.string()).optional(),
+    /** B2 — optional OAuth/PKCE auth surface; only valid on remote transports. */
+    auth: McpServerAuthSchema.optional(),
     disabled: z.boolean().optional(),
     policy: McpServerPolicySchema.optional(),
 }).superRefine((s, ctx) => {
+    if (s.auth && !s.url) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'MCP server "auth" requires a remote "url" transport (stdio has no OAuth surface)' });
+    }
     if (!s.command && !s.url) {
         ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'MCP server needs either "command" (stdio) or "url" (remote HTTP)' });
     }
     if (s.command && s.url) {
         ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'MCP server takes either "command" or "url", not both' });
     }
+    if (s.url && !s.command) {
+        const u = s.url;
+        let parsed = null;
+        try {
+            parsed = new URL(u);
+        }
+        catch { /* invalid URL caught by z.string().url() */ }
+        if (parsed && parsed.protocol === 'http:') {
+            const h = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, '');
+            const loopback = h === 'localhost' || h === '127.0.0.1' || h === '::1' || h === '0.0.0.0' || h === '::' || h.startsWith('127.');
+            if (!loopback && process.env.KLYRO_ALLOW_INSECURE_MCP !== '1') {
+                ctx.addIssue({ code: z.ZodIssueCode.custom, message: `insecure MCP server url (plain HTTP) for host ${parsed.hostname} — use https:// or a loopback URL, or set KLYRO_ALLOW_INSECURE_MCP=1` });
+            }
+        }
+    }
 });
 /** Upper bound for per-server timeouts — larger values are clamped, not rejected. */
 export const MAX_MCP_TIMEOUT_MS = 600_000;

package/dist/mcp/registry.d.ts

@@ -31,8 +31,9 @@ export declare const MCP_SUCCESS_MAX_CHARS = 12000;
  */
 export declare function sanitizeMcpName(server: string, tool: string): string;
 /**
- * Construct the right client for a spec: remote HTTP when `url` is set,
- * else stdio. Used by registration, probe, and prompt runs.
+ * Construct the right client for a spec: remote HTTP when `url` is set
+ * (`transport: 'sse'` selects the legacy event-stream flavor, default is
+ * Streamable HTTP), else stdio. Used by registration, probe, and prompts.
  */
 export declare function makeMcpClient(name: string, spec: McpServerSpec): McpClientLike;
 export declare function registerMcpServers(cfg: {
@@ -58,10 +59,15 @@ export declare function loadAndRegisterMcp(opts: {
     }) => Promise<boolean>;
 }): Promise<McpRegisterResult>;
 /**
- * Run one MCP prompt (`/mcp__<server>__<prompt>`) on demand: fresh stdio
+ * Run one MCP prompt (`/mcp__<server>__<prompt>`) on demand: fresh
  * connection per invocation (no client lifecycle to manage), redacted
- * output. Typing the prompt name is explicit consent, so project servers
- * connect without the registration-time approval gate. Throws McpError /
- * Error on unknown server, disabled server, or prompt failure.
+ * output. Project servers need trust-store approval (see `klyro mcp
+ * trust`) — typing the prompt name is intent, not approval. Throws
+ * McpError / Error on unknown server, disabled server, or prompt failure.
  */
-export declare function runMcpPrompt(cwd: string, server: string, prompt: string, args: Record<string, string>): Promise<string>;
+export declare function runMcpPrompt(cwd: string, server: string, prompt: string, tokens: string[], opts?: {
+    trust?: {
+        isTrusted: (name: string, hash: string) => boolean;
+    };
+    clientFactory?: (name: string, spec: McpServerSpec) => McpClientLike;
+}): Promise<string>;

package/dist/mcp/registry.js

@@ -31,6 +31,7 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 import { McpClient, McpError } from './client.js';
 import { RemoteMcpClient } from './remote.js';
+import { SseMcpClient } from './sse.js';
 import { loadMcpServers } from './config.js';
 import { evaluateMcpPolicy } from './policy.js';
 import { jsonSchemaToZod } from './schema.js';
@@ -62,6 +63,29 @@ export function sanitizeMcpName(server, tool) {
 function errMessage(err) {
     return err instanceof Error ? err.message : String(err);
 }
+/**
+ * Recursively scrub credential-bearing keys (`authorization`, `cookie`,
+ * `x-api-key`) from a debug payload so a server echoing credentials back in
+ * an error body can't leak a live token into the capture file. Other values
+ * pass through untouched.
+ */
+function scrubCredentialKeys(value) {
+    if (Array.isArray(value))
+        return value.map(scrubCredentialKeys);
+    if (value && typeof value === 'object') {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            if (k.toLowerCase() === 'authorization' || k.toLowerCase() === 'cookie' || k.toLowerCase() === 'x-api-key') {
+                out[k] = '[REDACTED]';
+            }
+            else {
+                out[k] = scrubCredentialKeys(v);
+            }
+        }
+        return out;
+    }
+    return value;
+}
 /** Debug-capture filename disambiguator when Date.now() collides. */
 let mcpDebugCounter = 0;
 /**
@@ -82,7 +106,7 @@ function captureMcpDebug(server, tool, payload) {
             mcpDebugCounter += 1;
             file = path.join(dir, `mcp-${safe}-${Date.now()}-${mcpDebugCounter}.json`);
         }
-        fs.writeFileSync(file, JSON.stringify({ server, tool, payload }, null, 2), { mode: 0o600 });
+        fs.writeFileSync(file, JSON.stringify({ server, tool, payload: scrubCredentialKeys(payload) }, null, 2), { mode: 0o600 });
         try {
             process.stderr.write(`klyro: mcp debug captured ${server}/${tool} -> ${file}\n`);
         }
@@ -143,12 +167,13 @@ async function executeMcpTool(server, spec, toolDef, client, input, ctx) {
     }
 }
 /**
- * Construct the right client for a spec: remote HTTP when `url` is set,
- * else stdio. Used by registration, probe, and prompt runs.
+ * Construct the right client for a spec: remote HTTP when `url` is set
+ * (`transport: 'sse'` selects the legacy event-stream flavor, default is
+ * Streamable HTTP), else stdio. Used by registration, probe, and prompts.
  */
 export function makeMcpClient(name, spec) {
     if (spec.url)
-        return new RemoteMcpClient(name, spec);
+        return spec.transport === 'sse' ? new SseMcpClient(name, spec) : new RemoteMcpClient(name, spec);
     if (!spec.command)
         throw new McpError(`mcp server "${name}" has neither command nor url`, 'INVALID_SPEC');
     return new McpClient(name, spec);
@@ -304,27 +329,78 @@ export async function loadAndRegisterMcp(opts) {
     }
 }
 /**
- * Run one MCP prompt (`/mcp__<server>__<prompt>`) on demand: fresh stdio
+ * Run one MCP prompt (`/mcp__<server>__<prompt>`) on demand: fresh
  * connection per invocation (no client lifecycle to manage), redacted
- * output. Typing the prompt name is explicit consent, so project servers
- * connect without the registration-time approval gate. Throws McpError /
- * Error on unknown server, disabled server, or prompt failure.
+ * output. Project servers need trust-store approval (see `klyro mcp
+ * trust`) — typing the prompt name is intent, not approval. Throws
+ * McpError / Error on unknown server, disabled server, or prompt failure.
  */
-export async function runMcpPrompt(cwd, server, prompt, args) {
+export async function runMcpPrompt(cwd, server, prompt, tokens, opts = {}) {
     const cfg = loadMcpServers(cwd);
     const spec = cfg.servers[server];
     if (!spec)
         throw new Error(`mcp server not found: ${server}`);
     if (spec.disabled)
         throw new Error(`mcp server disabled: ${server}`);
-    const client = makeMcpClient(server, spec);
+    // Consent parity with the tool path: project-sourced servers require a
+    // trust-store approval (see `klyro mcp trust`). Typing the prompt name
+    // is intent, not approval — auto-spawning a project subprocess stays gated.
+    if (cfg.sources[server] === 'project') {
+        const { McpTrust, hashSpec } = await import('./trust.js');
+        const trust = opts.trust ?? new McpTrust();
+        if (!trust.isTrusted(server, hashSpec(spec))) {
+            throw new Error(`mcp server "${server}" is not trusted — run: klyro mcp trust ${server}`);
+        }
+    }
+    const client = (opts.clientFactory ?? makeMcpClient)(server, spec);
     if (!client.promptsGet)
         throw new Error(`mcp server "${server}" does not support prompts`);
+    const withConnect = client;
+    if (typeof withConnect.connect === 'function')
+        await withConnect.connect();
+    // Typed args: `key=value` tokens bind by name; bare tokens fill the
+    // prompt's declared argument names in order; leftovers join into `input`.
+    // Servers without declared arguments keep the legacy arg1..N + input form.
+    let mapped;
+    try {
+        const defs = typeof client.promptsList === 'function' ? await client.promptsList() : [];
+        const def = defs.find((d) => d.name === prompt);
+        const declared = def?.arguments?.map((a) => a.name) ?? [];
+        // Split tokens once: key=value binds by name, bare tokens are positional.
+        mapped = {};
+        const positional = [];
+        for (const tok of tokens) {
+            const eq = tok.indexOf('=');
+            if (eq > 0)
+                mapped[tok.slice(0, eq)] = tok.slice(eq + 1);
+            else
+                positional.push(tok);
+        }
+        if (declared.length > 0) {
+            // Named bindings win; bare tokens fill the remaining declared slots
+            // in order; anything left over joins into `input`.
+            const free = declared.filter((d) => !(d in mapped));
+            positional.forEach((v, i) => {
+                if (i < free.length)
+                    mapped[free[i]] = v;
+            });
+            const extras = positional.slice(free.length);
+            if (extras.length > 0)
+                mapped['input'] = extras.join(' ');
+        }
+        else {
+            positional.forEach((v, i) => { mapped[`arg${i + 1}`] = v; });
+            mapped['input'] = positional.join(' ');
+        }
+    }
+    catch {
+        // prompts/list failed — fall back to legacy positional mapping.
+        mapped = {};
+        tokens.forEach((v, i) => { mapped[`arg${i + 1}`] = v; });
+        mapped['input'] = tokens.join(' ');
+    }
     try {
-        const withConnect = client;
-        if (typeof withConnect.connect === 'function')
-            await withConnect.connect();
-        const text = await client.promptsGet(prompt, args);
+        const text = await client.promptsGet(prompt, mapped);
         return redact(text).slice(0, 8000);
     }
     finally {

package/dist/mcp/remote.d.ts

@@ -9,6 +9,8 @@
  */
 import type { McpServerSpec } from './config.js';
 import { type McpClientLike, type McpToolDef, type McpCallResult, type McpResource, type McpPromptDef } from './client.js';
+/** Loopback check shared with the SSE transport guard. */
+export declare function isLoopback(url: string): boolean;
 /** Parse a Streamable-HTTP SSE body (`data: {...}` lines) into JSON payloads. */
 export declare function parseSseBody(text: string): unknown[];
 export declare class RemoteMcpClient implements McpClientLike {
@@ -17,7 +19,12 @@ export declare class RemoteMcpClient implements McpClientLike {
     private nextId;
     private readonly headers;
     private readonly timeoutMs;
+    private authHeader;
     constructor(name: string, spec: McpServerSpec);
+    /** B2: resolve OAuth bearer token; returns true when usable headers exist. */
+    private ensureAuth;
+    /** Base headers merged with the OAuth bearer token (never mutates base). */
+    private headersFor;
     connect(): Promise<void>;
     listTools(signal?: AbortSignal): Promise<McpToolDef[]>;
     callTool(name: string, args: unknown, signal?: AbortSignal): Promise<McpCallResult>;