mcp-for-i 0.1.12 → 0.1.13

package/README.md

@@ -1,190 +1,207 @@
-# MCP-for-i
-
-`mcp-for-i` is a local MCP server + control plane for IBM i workflows. It provides secure connection onboarding, keychain-backed credentials, cross-platform runtime update controls, and IBM i tools for agent-driven operations.
-
-## Install
-
-Install globally from npm:
-
-```bash
-npm i -g mcp-for-i
-```
-
-Verify commands:
-
-```bash
-mcp-for-i --help
-mcp-for-i-control help
-```
-
-Supported shells and terminals include PowerShell, `cmd`, Git Bash, Bash, Zsh, and WSL shells, across Windows, macOS, and Linux.
-
-## Quick Start
-
-1. Open the local control plane:
-
-```bash
-mcp-for-i control
-```
-
-`mcp-for-i control` will start the control server in the background if needed, then open the UI. If a browser cannot be opened in the current environment, it prints the local URL instead.
-
-2. The default local UI URL is:
-
-```text
-http://127.0.0.1:3980
-```
-
-3. Add IBM i connection profiles in the UI. Passwords are stored in the OS keychain, not plain config.
-
-## Control Commands
-
-From an npm install or a git checkout build, these commands are the supported control entrypoints:
-
-```bash
-mcp-for-i control
-mcp-for-i control status
-mcp-for-i control enable
-mcp-for-i control disable
-```
-
-Equivalent direct control-plane binary commands:
-
-```bash
-mcp-for-i-control open
-mcp-for-i-control status
-mcp-for-i-control enable
-mcp-for-i-control disable
-mcp-for-i-control serve
-```
-
-Behavior by environment:
-- Windows: `enable` registers a Startup entry.
-- macOS: `enable` registers a LaunchAgent.
-- Linux: `enable` uses a user `systemd` service when available.
-- WSL: `enable` installs a guarded `.bashrc` hook that starts the control plane on interactive Bash shell launch.
-
-## Add To Coding Clients
-
-The control-plane UI now includes a `Clients` tab with one-click setup for:
-- `Codex Desktop / CLI`
-- `Claude Code` when the `claude` CLI is installed
-- `VS Code / GitHub Copilot` when the `code` CLI is installed
-
-It also includes manual guidance for:
-- `Project Bob`
-- other MCP clients that use generic JSON/TOML stdio server configuration
-
-The UI writes or invokes the local client-specific setup on the same machine where the control plane is running. If a client CLI is not installed, the UI falls back to showing the exact launch command/snippet to use manually.
-
-## Update and Version Management
-
-Update to latest globally:
-
-```bash
-npm i -g mcp-for-i@latest
-```
-
-Install a specific version:
-
-```bash
-npm i -g mcp-for-i@0.1.1
-```
-
-Rollback example:
-
-```bash
-npm i -g mcp-for-i@0.1.0
-```
-
-Check current installed version:
-
-```bash
-mcp-for-i --version
-```
-
-## Control Plane Updates
-
-The control plane intentionally stays narrow:
-
-- `Update MCP`
-  - If running from a git checkout: pulls latest changes from `origin/<current-branch>`, then installs/builds.
-  - If running as an npm-installed package: upgrades the global npm package to latest.
-  - On Windows global installs, update still runs in a detached updater to avoid file-lock (`EBUSY`) errors during self-update.
-- `Update Skills`
-  - Pulls or clones the configured skills repository and branch into the local `skills` directory.
-
-For npm installs and manual upgrades, prefer standard npm commands such as `npm i -g mcp-for-i@latest`.
-
-## Development (Git Checkout)
-
-For contributors working from source:
-
-```bash
-npm install
-npm run build
-npm test
-npm run start:controlplane
-```
-
-You can also use the built artifacts directly after build:
-
-```bash
-node dist/index.js
-node dist/index.js control
-node dist/controlplane/index.js open
-```
-
-## Automated Release (No Manual Version Bump)
-
-Use the release script instead of raw `npm publish`.
-
-Patch release:
-
-```bash
-npm run release:patch
-```
-
-Minor release:
-
-```bash
-npm run release:minor
-```
-
-Major release:
-
-```bash
-npm run release:major
-```
-
-What it does:
-- Verifies git working tree is clean.
-- Runs `npm test` (unless `--skip-tests` is passed).
-- Checks npm published version.
-- Auto-bumps version only when local version is not ahead.
-- Publishes to npm.
-- Pushes commit/tag to GitHub.
-
-Optional flags:
-
-```bash
-npm run release:patch -- --skip-tests
-npm run release:patch -- --otp=123456
-npm run release:patch -- --no-push
-```
-
-## Security Model
-
-- Credential-bearing direct tool arguments are blocked for connection creation/update flows.
-- Passwords are stored in keychain when available.
-- Control plane is local-first (`127.0.0.1` by default).
-- Guarded policy profile is the default for operational safety.
-- Tool schemas are strict (`additionalProperties: false`) with runtime argument validation, including nested connection/action/filter/profile payloads.
-- QSYS object names and source settings are validated before command execution to reduce interpolation and injection risk.
-
-## Links
-
-- Main repo: [ashishthomas2202/mcp-for-i](https://github.com/ashishthomas2202/mcp-for-i)
-- Skills repo: [ashishthomas2202/mcp-for-i-skills](https://github.com/ashishthomas2202/mcp-for-i-skills)
-- Docs: `docs/`
-- Full capability guide: `docs/capabilities.md`
+# MCP-for-i
+
+`mcp-for-i` is a local MCP server + control plane for IBM i workflows. It provides secure connection onboarding, keychain-backed credentials, cross-platform runtime update controls, and IBM i tools for agent-driven operations.
+
+## Install
+
+The npm package name is `mcp-for-i`.
+
+Install globally from npm:
+
+```bash
+npm i -g mcp-for-i
+```
+
+Verify commands:
+
+```bash
+mcp-for-i --help
+mcp-for-i-control help
+```
+
+Supported shells and terminals include PowerShell, `cmd`, Git Bash, Bash, Zsh, and WSL shells, across Windows, macOS, and Linux.
+
+## Quick Start
+
+1. Open the local control plane:
+
+```bash
+mcp-for-i control
+```
+
+`mcp-for-i control` will start the control server in the background if needed, then open the UI. If a browser cannot be opened in the current environment, it prints the local URL instead.
+
+2. The default local UI URL is:
+
+```text
+http://127.0.0.1:3980
+```
+
+3. Add IBM i connection profiles in the UI. Passwords are stored in the OS keychain, not plain config.
+
+WSL note: persistent password storage requires a working Linux Secret Service inside the WSL distro. WSL does not automatically use Windows Credential Manager; when no keychain is available, MCP-for-i keeps passwords only for the current process and the control plane shows a warning.
+
+Credential storage adapts to the Node runtime: Windows Node from PowerShell, `cmd`, or Git Bash uses Windows Credential Manager; macOS uses Keychain; Linux uses Secret Service; WSL uses the WSL distro's Linux Secret Service.
+
+## Control Commands
+
+From an npm install or a git checkout build, these commands are the supported control entrypoints:
+
+```bash
+mcp-for-i control
+mcp-for-i control status
+mcp-for-i control enable
+mcp-for-i control disable
+```
+
+Equivalent direct control-plane binary commands:
+
+```bash
+mcp-for-i-control open
+mcp-for-i-control status
+mcp-for-i-control enable
+mcp-for-i-control disable
+mcp-for-i-control serve
+```
+
+Behavior by environment:
+- Windows: `enable` registers a Startup entry.
+- macOS: `enable` registers a LaunchAgent.
+- Linux: `enable` uses a user `systemd` service when available.
+- WSL: `enable` installs a guarded `.bashrc` hook that starts the control plane on interactive Bash shell launch.
+
+## Add To Coding Clients
+
+The control-plane UI now includes a `Clients` tab with one-click setup for:
+- `Codex Desktop / CLI`
+- `Claude Code` when the `claude` CLI is installed
+- `VS Code / GitHub Copilot` when the `code` CLI is installed
+
+It also includes manual guidance for:
+- `Project Bob`
+- other MCP clients that use generic JSON/TOML stdio server configuration
+
+The UI writes or invokes the local client-specific setup on the same machine where the control plane is running. If a client CLI is not installed, the UI falls back to showing the exact launch command/snippet to use manually.
+
+## Update and Version Management
+
+Update to latest globally:
+
+```bash
+npm i -g mcp-for-i@latest
+```
+
+Install a specific version:
+
+```bash
+npm i -g mcp-for-i@0.1.1
+```
+
+Rollback example:
+
+```bash
+npm i -g mcp-for-i@0.1.0
+```
+
+Check current installed version:
+
+```bash
+mcp-for-i --version
+```
+
+## Control Plane Updates
+
+The control plane intentionally stays narrow:
+
+- `Update MCP`
+  - If running from a git checkout: pulls latest changes from `origin/<current-branch>`, then installs/builds.
+  - If running as an npm-installed package: upgrades the global npm package to latest.
+  - On Windows global installs, update still runs in a detached updater to avoid file-lock (`EBUSY`) errors during self-update.
+- `Update Skills`
+  - Pulls or clones the configured skills repository and branch into the local `skills` directory.
+
+For npm installs and manual upgrades, prefer standard npm commands such as `npm i -g mcp-for-i@latest`.
+
+## Development (Git Checkout)
+
+For contributors working from source:
+
+```bash
+npm install
+npm run build
+npm test
+npm run start:controlplane
+```
+
+You can also use the built artifacts directly after build:
+
+```bash
+node dist/index.js
+node dist/index.js control
+node dist/controlplane/index.js open
+```
+
+## Automated Release (No Manual Version Bump)
+
+Use the release script instead of raw `npm publish`. The script publishes the `mcp-for-i` npm package.
+
+Before releasing, verify npm auth and the currently published version:
+
+```bash
+npm whoami
+npm view mcp-for-i version
+```
+
+If `npm whoami` fails, run `npm login` first.
+
+Patch release:
+
+```bash
+npm run release:patch
+```
+
+Minor release:
+
+```bash
+npm run release:minor
+```
+
+Major release:
+
+```bash
+npm run release:major
+```
+
+What it does:
+- Verifies git working tree is clean.
+- Runs `npm test` (unless `--skip-tests` is passed).
+- Checks npm published version.
+- Auto-bumps version only when local version is not ahead.
+- Publishes to npm.
+- Pushes commit/tag to GitHub.
+
+Optional flags:
+
+```bash
+npm run release:patch -- --skip-tests
+npm run release:patch -- --otp=123456
+npm run release:patch -- --no-push
+```
+
+OTP is only needed when the npm account has two-factor authentication enabled for publishing. If npm asks for a one-time password, use the current code from the authenticator app or recovery method configured on the npm account, then rerun with `--otp=<code>`. If the account does not have publish-time 2FA enabled, no OTP is needed.
+
+## Security Model
+
+- Credential-bearing direct tool arguments are blocked for connection creation/update flows.
+- Passwords are stored in keychain when available; failed or missing keychain access falls back to process-only session storage with a visible control-plane warning.
+- Control plane is local-first (`127.0.0.1` by default).
+- Guarded policy profile is the default for operational safety.
+- Tool schemas are strict (`additionalProperties: false`) with runtime argument validation, including nested connection/action/filter/profile payloads.
+- QSYS object names and source settings are validated before command execution to reduce interpolation and injection risk.
+
+## Links
+
+- Main repo: [ashishthomas2202/mcp-for-i](https://github.com/ashishthomas2202/mcp-for-i)
+- Skills repo: [ashishthomas2202/mcp-for-i-skills](https://github.com/ashishthomas2202/mcp-for-i-skills)
+- Docs: `docs/`
+- Full capability guide: `docs/capabilities.md`

package/dist/controlplane/server.js

@@ -5,7 +5,7 @@ import path from "path";
 import { URL } from "url";
 import { fileURLToPath } from "url";
 import { ConfigStore, getConfigDir } from "../config/store.js";
-import { isKeychainAvailable } from "../security/credentialStore.js";
+import { getCredentialStoreStatus } from "../security/credentialStore.js";
 import { ConnectionService } from "./connectionService.js";
 import { RuntimeService } from "./runtimeService.js";
 import { ClientIntegrationService } from "./clientIntegrationService.js";
@@ -48,7 +48,8 @@ async function routeRequest(req, res, services) {
         return;
     }
     if (method === "GET" && pathname === "/api/health") {
-        sendJson(res, 200, { ok: true, keychainAvailable: await isKeychainAvailable() });
+        const credentialStore = await getCredentialStoreStatus();
+        sendJson(res, 200, { ok: true, keychainAvailable: credentialStore.keychainAvailable, credentialStore });
         return;
     }
     if (method === "GET" && pathname === "/api/settings") {

package/dist/controlplane/ui.js

@@ -124,7 +124,23 @@ export function renderControlPlaneHtml() {
     }
     .badge.latest { color: var(--ok); border-color: color-mix(in srgb, var(--ok) 45%, var(--line)); }
     .badge.update { color: var(--warn); border-color: color-mix(in srgb, var(--warn) 45%, var(--line)); }
-    .badge.unknown { color: var(--muted); }
+    .badge.unknown { color: var(--muted); }
+    .notice {
+      border: 1px solid var(--line);
+      border-radius: 10px;
+      background: var(--surface-2);
+      padding: 10px;
+      margin: 10px 0;
+      color: var(--muted);
+    }
+    .notice.warning {
+      color: var(--warn);
+      border-color: color-mix(in srgb, var(--warn) 45%, var(--line));
+    }
+    .notice.success {
+      color: var(--ok);
+      border-color: color-mix(in srgb, var(--ok) 40%, var(--line));
+    }
     .fields { display: grid; gap: 9px; grid-template-columns: repeat(2, minmax(0, 1fr)); }
     .field label {
       display: block; margin-bottom: 5px;
@@ -239,6 +255,7 @@ export function renderControlPlaneHtml() {
           <span class="badge unknown" id="startupBadge">Checking</span>
         </div>
       </div>
+      <div id="credentialNotice" class="notice">Credential store: checking...</div>
       <div id="versionCheckedAt" class="hint"></div>
       <h3 style="margin: 12px 0 8px; font-size: 11px; letter-spacing: 0.08em; text-transform: uppercase; color: var(--muted);">Session Snapshot</h3>
       <table>
@@ -613,6 +630,16 @@ export function renderControlPlaneHtml() {
       ].filter(Boolean).join(" ");
       $("autostartInfo").textContent = detail;
     }
+    function renderCredentialStore(status) {
+      const el = $("credentialNotice");
+      if (!status) {
+        el.textContent = "Credential store: unavailable.";
+        el.className = "notice warning";
+        return;
+      }
+      el.textContent = "Credential store: " + status.message;
+      el.className = "notice " + (status.persistent ? "success" : "warning");
+    }
     function renderClients(targets) {
       const list = Array.isArray(targets) ? targets : [];
       $("clientSummary").textContent = list.length
@@ -665,6 +692,7 @@ export function renderControlPlaneHtml() {
         const res = await fetch("/api/health", { cache: "no-store" });
         if (!res.ok) return false;
         const data = await res.json();
+        renderCredentialStore(data?.credentialStore || null);
         return Boolean(data?.ok);
       } catch {
         return false;

package/dist/index.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import crypto from "crypto";
+import fs from "fs";
 import { fileURLToPath } from "url";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -12,6 +13,7 @@ import { appendAuditRecord } from "./mcp/audit.js";
 import { runControlCommand } from "./controlplane/commands.js";
 const argv = process.argv.slice(2);
 const firstArg = (argv[0] || "").toLowerCase();
+const packageVersion = readPackageVersion();
 if (firstArg === "control") {
     await runControlCommand(argv.slice(1), {
         defaultCommand: "open",
@@ -19,11 +21,15 @@ if (firstArg === "control") {
     });
     process.exit(0);
 }
+if (firstArg === "--version" || firstArg === "-v" || firstArg === "version") {
+    process.stdout.write(`${packageVersion}\n`);
+    process.exit(0);
+}
 if (firstArg === "--help" || firstArg === "-h" || firstArg === "help") {
     printHelp();
     process.exit(0);
 }
-const server = new Server({ name: "mcp-for-i", version: "0.1.8" }, { capabilities: { tools: {} } });
+const server = new Server({ name: "mcp-for-i", version: packageVersion }, { capabilities: { tools: {} } });
 const ctx = new McpContext();
 const tools = getTools();
 const toolMap = new Map(tools.map(tool => [tool.name, tool]));
@@ -132,4 +138,15 @@ function printHelp() {
     process.stderr.write(`  mcp-for-i control status  Show control plane and background-service status\n`);
     process.stderr.write(`  mcp-for-i control enable  Enable background service for this platform\n`);
     process.stderr.write(`  mcp-for-i control disable Disable background service for this platform\n`);
+    process.stderr.write(`  mcp-for-i --version       Print package version\n`);
+}
+function readPackageVersion() {
+    try {
+        const packageJsonPath = fileURLToPath(new URL("../package.json", import.meta.url));
+        const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, "utf8"));
+        return typeof packageJson.version === "string" ? packageJson.version : "0.0.0";
+    }
+    catch {
+        return "0.0.0";
+    }
 }

package/dist/security/credentialStore.js

@@ -1,5 +1,7 @@
+import os from "os";
 const SERVICE = "mcp-for-i";
 const sessionStore = new Map();
+let lastKeychainError;
 let keytar;
 async function getKeytar() {
     if (keytar !== undefined)
@@ -13,30 +15,155 @@ async function getKeytar() {
     }
     return keytar;
 }
+export function detectCredentialEnvironment(env = process.env, platform = process.platform, release = os.release()) {
+    const isWsl = isWslRuntime(env, platform, release);
+    const shell = String(env.SHELL || env.ComSpec || env.PSModulePath || "").toLowerCase();
+    const terminal = platform === "win32"
+        ? shell.includes("bash") || shell.includes("git") || env.MSYSTEM
+            ? "git-bash"
+            : env.PSModulePath
+                ? "powershell"
+                : "cmd"
+        : isWsl
+            ? "wsl"
+            : shell.includes("zsh")
+                ? "zsh"
+                : shell.includes("bash")
+                    ? "bash"
+                    : "unknown";
+    const nativeStore = platform === "win32"
+        ? "Windows Credential Manager"
+        : platform === "darwin"
+            ? "macOS Keychain"
+            : "Linux Secret Service";
+    return {
+        platform,
+        arch: process.arch,
+        isWsl,
+        terminal,
+        nativeStore,
+        label: isWsl
+            ? "Linux (WSL)"
+            : platform === "win32"
+                ? "Windows"
+                : platform === "darwin"
+                    ? "macOS"
+                    : platform === "linux"
+                        ? "Linux"
+                        : platform
+    };
+}
+function getCredentialStoreMode() {
+    const value = String(process.env.MCP_FOR_I_CREDENTIAL_STORE || "auto").trim().toLowerCase();
+    if (value === "keychain" || value === "session")
+        return value;
+    return "auto";
+}
+function describeError(err) {
+    return err instanceof Error ? err.message : String(err);
+}
 export async function setPassword(connectionName, password) {
+    if (getCredentialStoreMode() === "session") {
+        sessionStore.set(connectionName, password);
+        return;
+    }
     const kt = await getKeytar();
     if (kt) {
-        await kt.setPassword(SERVICE, connectionName, password);
-    }
-    else {
-        sessionStore.set(connectionName, password);
+        try {
+            await kt.setPassword(SERVICE, connectionName, password);
+            lastKeychainError = undefined;
+            sessionStore.delete(connectionName);
+            return;
+        }
+        catch (err) {
+            lastKeychainError = describeError(err);
+        }
     }
+    sessionStore.set(connectionName, password);
 }
 export async function getPassword(connectionName) {
+    if (getCredentialStoreMode() === "session") {
+        return sessionStore.get(connectionName);
+    }
     const kt = await getKeytar();
     if (kt) {
-        return kt.getPassword(SERVICE, connectionName);
+        try {
+            const password = await kt.getPassword(SERVICE, connectionName);
+            lastKeychainError = undefined;
+            if (password)
+                return password;
+        }
+        catch (err) {
+            lastKeychainError = describeError(err);
+        }
     }
     return sessionStore.get(connectionName);
 }
 export async function deletePassword(connectionName) {
+    if (getCredentialStoreMode() === "session") {
+        sessionStore.delete(connectionName);
+        return;
+    }
     const kt = await getKeytar();
     if (kt) {
-        await kt.deletePassword(SERVICE, connectionName);
+        try {
+            await kt.deletePassword(SERVICE, connectionName);
+            lastKeychainError = undefined;
+        }
+        catch (err) {
+            lastKeychainError = describeError(err);
+        }
     }
     sessionStore.delete(connectionName);
 }
 export async function isKeychainAvailable() {
+    if (getCredentialStoreMode() === "session")
+        return false;
     const kt = await getKeytar();
-    return Boolean(kt);
+    if (!kt)
+        return false;
+    try {
+        if (typeof kt.findCredentials === "function") {
+            await kt.findCredentials(SERVICE);
+        }
+        lastKeychainError = undefined;
+        return true;
+    }
+    catch (err) {
+        lastKeychainError = describeError(err);
+        return false;
+    }
+}
+export async function getCredentialStoreStatus() {
+    const requestedMode = getCredentialStoreMode();
+    const environment = detectCredentialEnvironment();
+    const keychainAvailable = await isKeychainAvailable();
+    const isWsl = environment.isWsl;
+    const mode = keychainAvailable ? "keychain" : "session";
+    return {
+        mode,
+        requestedMode,
+        persistent: keychainAvailable,
+        keychainAvailable,
+        platform: environment.platform,
+        terminal: environment.terminal,
+        nativeStore: environment.nativeStore,
+        runtimeLabel: environment.label,
+        isWsl,
+        error: lastKeychainError,
+        message: keychainAvailable
+            ? `Passwords are stored in ${environment.nativeStore}.`
+            : requestedMode === "session"
+                ? "Password storage is configured for session-only mode by MCP_FOR_I_CREDENTIAL_STORE=session."
+                : isWsl
+                    ? "WSL could not access a persistent Linux Secret Service keychain; passwords are kept in this process only. Use SSH keys, install/configure libsecret in WSL, or run MCP-for-i from Windows to use Windows Credential Manager."
+                    : "No persistent OS keychain is available; passwords are kept in this process only."
+    };
+}
+function isWslRuntime(env = process.env, platform = process.platform, release = os.release()) {
+    if (platform !== "linux")
+        return false;
+    if (env.WSL_DISTRO_NAME || env.WSL_INTEROP)
+        return true;
+    return /microsoft/i.test(release);
 }

package/docs/configuration.md

@@ -20,6 +20,9 @@ Default settings (editable in the config file):
 
 ## Connections
 Connections are stored without passwords. Passwords are stored in OS keychain (or in-session fallback). Each connection can include optional `settings` overrides.
+The control plane health response and Overview page report whether password storage is persistent (`keychain`) or process-only (`session`).
+WSL users should note that Linux Secret Service is separate from Windows Credential Manager; if WSL has no working keychain, passwords must be re-entered after the process exits.
+Set `MCP_FOR_I_CREDENTIAL_STORE=session` to force process-only password storage even when a keychain is available.
 Connections can also define policy, for example:
 - `read-only`
 - `guarded` (default; approvals required for risky operations)

package/docs/installation.md

@@ -6,6 +6,10 @@
 - On Linux: `libsecret` (for keychain via `keytar`)
 - Works from PowerShell, `cmd`, Git Bash, Bash, Zsh, and WSL shells
 
+WSL note: password persistence depends on a working Linux Secret Service inside the WSL distro. WSL does not automatically share Windows Credential Manager with Linux `keytar`. If the control plane reports session-only credential storage, use SSH keys, configure libsecret/Secret Service in WSL, or run MCP-for-i from Windows.
+
+Credential storage follows the Node runtime, not only the visible terminal: PowerShell, `cmd`, and Git Bash with Windows Node use Windows Credential Manager; WSL with Linux Node uses Linux Secret Service.
+
 ## Install
 1. Clone or copy this repo for git-checkout usage, or install globally for npm usage
 2. For git-checkout usage, install dependencies:

package/docs/security.md

@@ -1,7 +1,15 @@
 # Security
 
 - Credentials are stored in OS keychain via `keytar` (Windows Credential Manager, macOS Keychain, Linux libsecret).
-- If keychain is unavailable, credentials are stored in memory for the current session only.
+- Credential storage is selected at runtime from the Node process environment:
+  - Windows Node from PowerShell, `cmd`, or Git Bash uses Windows Credential Manager.
+  - macOS Node uses macOS Keychain.
+  - Linux Node uses Linux Secret Service.
+  - WSL Node is Linux and uses the WSL distro's Linux Secret Service, not Windows Credential Manager.
+- Keychain availability is checked as an actual read operation, not only as a module import.
+- If keychain is unavailable or a keychain operation fails, credentials are stored in memory for the current process only.
+- In WSL, `keytar` uses the Linux Secret Service inside the distro. It does not automatically use Windows Credential Manager. For persistent credentials in WSL, configure Linux libsecret/Secret Service, use SSH keys, or run MCP-for-i from Windows.
+- Set `MCP_FOR_I_CREDENTIAL_STORE=session` to force process-only password storage.
 - Passwords are never written to the config file.
 - `readOnlyMode` prevents write operations on members/IFS.
 - Connection policies support `read-only`, `guarded`, and `power-user` modes.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-for-i",
-  "version": "0.1.12",
+  "version": "0.1.13",
   "private": false,
   "description": "Local MCP server and control plane for IBM i workflows",
   "type": "module",
@@ -28,7 +28,7 @@
     "start:controlplane": "node dist/controlplane/index.js",
     "dev": "ts-node src/index.ts",
     "dev:controlplane": "ts-node src/controlplane/index.ts",
-    "test": "npm run build && node --test test/tools.test.mjs test/variables.test.mjs test/validation.test.mjs test/config.migration.test.mjs test/sql.parse.test.mjs test/audit.chain.test.mjs test/controlplane.platform.test.mjs test/controlplane.service.test.mjs",
+    "test": "npm run build && node --test test/tools.test.mjs test/variables.test.mjs test/validation.test.mjs test/config.migration.test.mjs test/sql.parse.test.mjs test/audit.chain.test.mjs test/controlplane.platform.test.mjs test/controlplane.service.test.mjs test/credential.environment.test.mjs",
     "test:all": "npm run build && node --test test/*.mjs",
     "test:ibmi": "npm run build && node --test test/ibmi.integration.test.mjs",
     "test:mcp": "npm run build && node --test test/mcp.integration.test.mjs",