mcpick 0.0.16 → 0.0.18

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # mcpick
 
+## 0.0.18
+
+### Patch Changes
+
+- 58ff00f: Add clone command and skip redundant stdio transport flag
+- 7f277da: redact env keys when listing
+- b52fcbd: Show available CLI commands hint in TUI intro
+
+## 0.0.17
+
+### Patch Changes
+
+- 54fe401: feat: plugin hook management with per-hook disable/enable
+  and update guard
+
 ## 0.0.16
 
 ### Patch Changes

package/dist/cli/commands/clone.js

@@ -0,0 +1,108 @@
+import { defineCommand } from 'citty';
+import { detect_server_scope, find_server_in_scope, } from '../../core/config.js';
+import { add_server_to_registry } from '../../core/registry.js';
+import { validate_mcp_server } from '../../core/validation.js';
+import { add_mcp_via_cli } from '../../utils/claude-cli.js';
+import { redact_server } from '../../utils/redact.js';
+import { error, output } from '../output.js';
+export default defineCommand({
+    meta: {
+        name: 'clone',
+        description: 'Clone an existing MCP server config with a new name, optionally overriding command/args',
+    },
+    args: {
+        source: {
+            type: 'positional',
+            description: 'Source server name to clone from',
+            required: true,
+        },
+        name: {
+            type: 'positional',
+            description: 'New server name',
+            required: true,
+        },
+        command: {
+            type: 'string',
+            description: 'Override command (e.g. "node" for local dev)',
+        },
+        args: {
+            type: 'string',
+            description: 'Override comma-separated arguments',
+        },
+        scope: {
+            type: 'string',
+            description: 'Scope for new server (default: same as source)',
+        },
+        json: {
+            type: 'boolean',
+            description: 'Output as JSON',
+            default: false,
+        },
+    },
+    async run({ args }) {
+        if (args.scope &&
+            !['local', 'project', 'user'].includes(args.scope)) {
+            error(`Invalid scope: ${args.scope}. Use local, project, or user.`);
+        }
+        // Find the source server
+        const scope = args.scope;
+        let found;
+        if (scope) {
+            found = await find_server_in_scope(args.source, scope);
+        }
+        else {
+            found = await detect_server_scope(args.source);
+        }
+        if (!found) {
+            error(`Server '${args.source}' not found${scope ? ` in ${scope} scope` : ' in any scope'}`);
+        }
+        const target_scope = args.scope || found.scope;
+        // Clone the config, applying overrides
+        const cloned = {
+            ...found.server,
+            name: args.name,
+        };
+        if (args.command) {
+            cloned.command = args.command;
+            // When overriding command, clear url/type if switching from http/sse to stdio
+            delete cloned.url;
+            if (cloned.type === 'sse' || cloned.type === 'http') {
+                delete cloned.type;
+            }
+        }
+        if (args.args) {
+            cloned.args = args.args.split(',');
+        }
+        // Validate
+        let server;
+        try {
+            server = validate_mcp_server(cloned);
+        }
+        catch (err) {
+            error(`Invalid cloned config: ${err instanceof Error ? err.message : 'validation failed'}`);
+        }
+        // Add to registry
+        await add_server_to_registry(server);
+        // Enable via CLI
+        const result = await add_mcp_via_cli(server, target_scope);
+        if (args.json) {
+            output({
+                cloned: server.name,
+                from: args.source,
+                scope: target_scope,
+                server: redact_server(server),
+                cli: result.success,
+                error: result.error,
+            }, true);
+        }
+        else {
+            if (result.success) {
+                console.log(`Cloned '${args.source}' → '${server.name}' (scope: ${target_scope})`);
+            }
+            else {
+                console.log(`Cloned '${args.source}' → '${server.name}' to registry but CLI failed: ${result.error}`);
+            }
+        }
+    },
+});
+//# sourceMappingURL=clone.js.map

package/dist/cli/commands/dev.js

@@ -1,5 +1,6 @@
 import { defineCommand } from 'citty';
 import { apply_dev_override, list_dev_overrides, restore_all_dev_overrides, restore_dev_override, } from '../../core/dev-override.js';
+import { redact_server_base } from '../../utils/redact.js';
 import { error, output } from '../output.js';
 const apply = defineCommand({
     meta: {
@@ -126,7 +127,12 @@ const list = defineCommand({
     async run({ args }) {
         const overrides = await list_dev_overrides();
         if (args.json) {
-            output(overrides, true);
+            const redacted = overrides.map((o) => ({
+                ...o,
+                original: redact_server_base(o.original),
+                dev: redact_server_base(o.dev),
+            }));
+            output(redacted, true);
             return;
         }
         if (overrides.length === 0) {

package/dist/cli/commands/hooks.js

@@ -0,0 +1,314 @@
+import { defineCommand } from 'citty';
+import { check_restored_hooks, disable_plugin_hook, enable_plugin_hook, read_disabled_hooks, redisable_restored_hooks, } from '../../core/hook-state.js';
+import { add_hook, get_all_hooks, remove_hook, } from '../../core/settings.js';
+import { error, output } from '../output.js';
+const list = defineCommand({
+    meta: {
+        name: 'list',
+        description: 'List all configured hooks (settings + plugins + disabled)',
+    },
+    args: {
+        scope: {
+            type: 'string',
+            description: 'Filter by source: user, project, project-local, or plugin',
+        },
+        json: {
+            type: 'boolean',
+            description: 'Output as JSON',
+            default: false,
+        },
+    },
+    async run({ args }) {
+        const hooks = await get_all_hooks();
+        const disabled = await read_disabled_hooks();
+        const filtered = args.scope
+            ? hooks.filter((h) => h.source === args.scope || h.scope === args.scope)
+            : hooks;
+        if (args.json) {
+            output({ active: filtered, disabled }, true);
+        }
+        else {
+            if (filtered.length === 0 && disabled.length === 0) {
+                console.log('No hooks configured.');
+                return;
+            }
+            if (filtered.length > 0) {
+                for (let i = 0; i < filtered.length; i++) {
+                    const h = filtered[i];
+                    const detail = h.handler.command ||
+                        h.handler.url ||
+                        h.handler.prompt ||
+                        '(unknown)';
+                    const matcher_str = h.matcher ? ` [${h.matcher}]` : '';
+                    const source = h.source === 'plugin'
+                        ? `plugin: ${h.plugin_key}`
+                        : h.scope;
+                    console.log(`${i}: [${source}] ${h.event}${matcher_str} → ${h.handler.type}: ${detail}`);
+                }
+            }
+            if (disabled.length > 0) {
+                console.log('\nDisabled:');
+                for (let i = 0; i < disabled.length; i++) {
+                    const d = disabled[i];
+                    const detail = d.original_handler.command ||
+                        d.original_handler.url ||
+                        d.original_handler.prompt ||
+                        '(unknown)';
+                    const matcher_str = d.matcher ? ` [${d.matcher}]` : '';
+                    console.log(`${i}: [${d.plugin_key}] ${d.event}${matcher_str} → ${d.original_handler.type}: ${detail}`);
+                }
+            }
+        }
+    },
+});
+const disable = defineCommand({
+    meta: {
+        name: 'disable',
+        description: 'Disable a hook by index (use "hooks list" to see indices)',
+    },
+    args: {
+        index: {
+            type: 'positional',
+            description: 'Hook index from "hooks list" (0-based)',
+            required: true,
+        },
+        json: {
+            type: 'boolean',
+            description: 'Output as JSON',
+            default: false,
+        },
+    },
+    async run({ args }) {
+        const hooks = await get_all_hooks();
+        const idx = parseInt(args.index, 10);
+        if (isNaN(idx) || idx < 0 || idx >= hooks.length) {
+            error(`Invalid index: ${args.index}. Run "mcpick hooks list" to see available hooks (0-${hooks.length - 1}).`);
+        }
+        const entry = hooks[idx];
+        if (entry.source === 'plugin') {
+            await disable_plugin_hook(entry);
+            if (args.json) {
+                output({
+                    disabled: true,
+                    event: entry.event,
+                    plugin_key: entry.plugin_key,
+                }, true);
+            }
+            else {
+                console.log(`Disabled: ${entry.event} from ${entry.plugin_key}`);
+                console.log('Restart Claude Code for changes to take effect.');
+            }
+        }
+        else {
+            // Settings hook — remove it
+            await remove_hook(entry);
+            if (args.json) {
+                output({
+                    removed: true,
+                    event: entry.event,
+                    scope: entry.scope,
+                }, true);
+            }
+            else {
+                console.log(`Removed: ${entry.event} (${entry.scope})`);
+            }
+        }
+    },
+});
+const enable = defineCommand({
+    meta: {
+        name: 'enable',
+        description: 'Re-enable a disabled hook by index (use "hooks list" to see disabled hooks)',
+    },
+    args: {
+        index: {
+            type: 'positional',
+            description: 'Disabled hook index from "hooks list" (0-based)',
+            required: true,
+        },
+        json: {
+            type: 'boolean',
+            description: 'Output as JSON',
+            default: false,
+        },
+    },
+    async run({ args }) {
+        const disabled = await read_disabled_hooks();
+        const idx = parseInt(args.index, 10);
+        if (isNaN(idx) || idx < 0 || idx >= disabled.length) {
+            error(`Invalid index: ${args.index}. Run "mcpick hooks list" to see disabled hooks (0-${disabled.length - 1}).`);
+        }
+        const entry = disabled[idx];
+        await enable_plugin_hook(entry);
+        if (args.json) {
+            output({
+                enabled: true,
+                event: entry.event,
+                plugin_key: entry.plugin_key,
+            }, true);
+        }
+        else {
+            console.log(`Re-enabled: ${entry.event} for ${entry.plugin_key}`);
+            console.log('Restart Claude Code for changes to take effect.');
+        }
+    },
+});
+const add = defineCommand({
+    meta: {
+        name: 'add',
+        description: 'Add a new settings-based hook',
+    },
+    args: {
+        event: {
+            type: 'positional',
+            description: 'Hook event type (e.g. UserPromptSubmit, PreToolUse)',
+            required: true,
+        },
+        handler_type: {
+            type: 'positional',
+            description: 'Handler type: command, prompt, http, or agent',
+            required: true,
+        },
+        value: {
+            type: 'positional',
+            description: 'Handler value (command string, prompt text, URL, or agent prompt)',
+            required: true,
+        },
+        matcher: {
+            type: 'string',
+            description: 'Matcher pattern (e.g. Bash, Edit|Write) — only for tool/session events',
+        },
+        scope: {
+            type: 'string',
+            description: 'Scope: user, project, or project-local (default: user)',
+            default: 'user',
+        },
+        json: {
+            type: 'boolean',
+            description: 'Output as JSON',
+            default: false,
+        },
+    },
+    async run({ args }) {
+        const scope = args.scope;
+        if (!['user', 'project', 'project-local'].includes(scope)) {
+            error(`Invalid scope: ${scope}. Use user, project, or project-local.`);
+        }
+        const handler_type = args.handler_type;
+        if (!['command', 'prompt', 'http', 'agent'].includes(handler_type)) {
+            error(`Invalid handler type: ${handler_type}. Use command, prompt, http, or agent.`);
+        }
+        const handler = { type: handler_type };
+        if (handler_type === 'command')
+            handler.command = args.value;
+        else if (handler_type === 'prompt')
+            handler.prompt = args.value;
+        else if (handler_type === 'http')
+            handler.url = args.value;
+        else if (handler_type === 'agent')
+            handler.prompt = args.value;
+        await add_hook(scope, args.event, args.matcher || undefined, handler);
+        if (args.json) {
+            output({
+                added: true,
+                event: args.event,
+                handler_type,
+                scope,
+                matcher: args.matcher || null,
+            }, true);
+        }
+        else {
+            console.log(`Hook added: ${args.event} → ${handler_type} (${scope})`);
+        }
+    },
+});
+const remove = defineCommand({
+    meta: {
+        name: 'remove',
+        description: 'Remove a settings hook by index (use "hooks list" to see indices)',
+    },
+    args: {
+        index: {
+            type: 'positional',
+            description: 'Hook index from "hooks list" (0-based)',
+            required: true,
+        },
+        json: {
+            type: 'boolean',
+            description: 'Output as JSON',
+            default: false,
+        },
+    },
+    async run({ args }) {
+        const hooks = await get_all_hooks();
+        const settings_hooks = hooks.filter((h) => h.source !== 'plugin');
+        const idx = parseInt(args.index, 10);
+        if (isNaN(idx) || idx < 0 || idx >= settings_hooks.length) {
+            error(`Invalid index: ${args.index}. Use "mcpick hooks list" to see settings hooks.`);
+        }
+        const entry = settings_hooks[idx];
+        await remove_hook(entry);
+        if (args.json) {
+            output({
+                removed: true,
+                event: entry.event,
+                scope: entry.scope,
+            }, true);
+        }
+        else {
+            const detail = entry.handler.command ||
+                entry.handler.url ||
+                entry.handler.prompt ||
+                '(unknown)';
+            console.log(`Removed: [${entry.scope}] ${entry.event} → ${entry.handler.type}: ${detail}`);
+        }
+    },
+});
+const check = defineCommand({
+    meta: {
+        name: 'check',
+        description: 'Check if marketplace updates restored any disabled hooks',
+    },
+    args: {
+        fix: {
+            type: 'boolean',
+            description: 'Automatically re-disable restored hooks',
+            default: false,
+        },
+        json: {
+            type: 'boolean',
+            description: 'Output as JSON',
+            default: false,
+        },
+    },
+    async run({ args }) {
+        const restored = await check_restored_hooks();
+        if (args.json) {
+            output({ restored: restored.length, hooks: restored }, true);
+            return;
+        }
+        if (restored.length === 0) {
+            console.log('No disabled hooks were restored. All good.');
+            return;
+        }
+        console.log(`${restored.length} disabled hook(s) were restored:`);
+        for (const r of restored) {
+            console.log(`  ${r.plugin_key}: ${r.event}`);
+        }
+        if (args.fix) {
+            const result = await redisable_restored_hooks(restored);
+            console.log(`Re-disabled ${result.success} hook(s).${result.failed > 0 ? ` Failed: ${result.failed}` : ''}`);
+        }
+        else {
+            console.log('Run with --fix to re-disable, or use "mcpick hooks disable".');
+        }
+    },
+});
+export default defineCommand({
+    meta: {
+        name: 'hooks',
+        description: 'Manage hooks (settings + plugin). Disable individual plugin hooks, add/remove settings hooks.',
+    },
+    subCommands: { list, disable, enable, add, remove, check },
+});
+//# sourceMappingURL=hooks.js.map

package/dist/cli/commands/list.js

@@ -1,6 +1,7 @@
 import { defineCommand } from 'citty';
 import { get_enabled_servers_for_scope } from '../../core/config.js';
 import { get_all_available_servers } from '../../core/registry.js';
+import { redact_server } from '../../utils/redact.js';
 import { error, output } from '../output.js';
 export default defineCommand({
     meta: {
@@ -38,7 +39,7 @@ export default defineCommand({
                 for (const scope of scopes) {
                     status[scope] = enabled_by_scope[scope].includes(server.name);
                 }
-                const { name, ...rest } = server;
+                const { name, ...rest } = redact_server(server);
                 return { name, ...status, ...rest };
             });
             output(data, true);

package/dist/cli/commands/marketplace.js

@@ -1,4 +1,5 @@
 import { defineCommand } from 'citty';
+import { check_restored_hooks, redisable_restored_hooks, } from '../../core/hook-state.js';
 import { read_marketplace_manifest } from '../../core/plugin-cache.js';
 import { marketplace_add_via_cli, marketplace_list_via_cli, marketplace_remove_via_cli, marketplace_update_via_cli, } from '../../utils/claude-cli.js';
 import { error, output } from '../output.js';
@@ -182,6 +183,13 @@ const update = defineCommand({
             console.log(args.name
                 ? `Marketplace updated: ${args.name}`
                 : 'All marketplaces updated.');
+            // Check if update restored any disabled hooks
+            const restored = await check_restored_hooks();
+            if (restored.length > 0) {
+                console.log(`\nWarning: ${restored.length} disabled hook(s) were restored by the update.`);
+                const redisable_result = await redisable_restored_hooks(restored);
+                console.log(`Re-disabled ${redisable_result.success} hook(s).${redisable_result.failed > 0 ? ` Failed: ${redisable_result.failed}` : ''}`);
+            }
         }
         else {
             error(result.error || 'Unknown error');

package/dist/cli/index.js

@@ -11,12 +11,14 @@ const main = defineCommand({
         remove: () => import('./commands/remove.js').then((m) => m.default),
         add: () => import('./commands/add.js').then((m) => m.default),
         'add-json': () => import('./commands/add-json.js').then((m) => m.default),
+        clone: () => import('./commands/clone.js').then((m) => m.default),
         get: () => import('./commands/get.js').then((m) => m.default),
         'reset-project-choices': () => import('./commands/reset-project-choices.js').then((m) => m.default),
         backup: () => import('./commands/backup.js').then((m) => m.default),
         restore: () => import('./commands/restore.js').then((m) => m.default),
         profile: () => import('./commands/profile.js').then((m) => m.default),
         plugins: () => import('./commands/plugins.js').then((m) => m.default),
+        hooks: () => import('./commands/hooks.js').then((m) => m.default),
         cache: () => import('./commands/cache.js').then((m) => m.default),
         dev: () => import('./commands/dev.js').then((m) => m.default),
         marketplace: () => import('./commands/marketplace.js').then((m) => m.default),

package/dist/commands/manage-hooks.js

@@ -0,0 +1,99 @@
+import { isCancel, log, multiselect, note } from '@clack/prompts';
+import { disable_plugin_hook, enable_plugin_hook, read_disabled_hooks, } from '../core/hook-state.js';
+import { get_all_hooks } from '../core/settings.js';
+function format_hook(entry) {
+    const detail = entry.handler.command ||
+        entry.handler.url ||
+        entry.handler.prompt ||
+        '(unknown)';
+    const truncated = detail.length > 50 ? detail.substring(0, 47) + '...' : detail;
+    return `${entry.event} → ${entry.handler.type}: ${truncated}`;
+}
+function format_source(entry) {
+    if (entry.source === 'plugin' && entry.plugin_key) {
+        return entry.plugin_key;
+    }
+    return entry.scope;
+}
+export async function manage_hooks() {
+    // Get all active hooks + disabled hooks
+    const active_hooks = await get_all_hooks();
+    const disabled = await read_disabled_hooks();
+    const items = [];
+    // Active hooks
+    for (let i = 0; i < active_hooks.length; i++) {
+        const h = active_hooks[i];
+        items.push({
+            id: `active:${i}`,
+            active_entry: h,
+            label: format_hook(h),
+            hint: format_source(h),
+        });
+    }
+    // Disabled hooks
+    for (let i = 0; i < disabled.length; i++) {
+        const d = disabled[i];
+        const detail = d.original_handler.command ||
+            d.original_handler.url ||
+            d.original_handler.prompt ||
+            '(unknown)';
+        const truncated = detail.length > 50 ? detail.substring(0, 47) + '...' : detail;
+        items.push({
+            id: `disabled:${i}`,
+            disabled_index: i,
+            label: `${d.event} → ${d.original_handler.type}: ${truncated}`,
+            hint: `${d.plugin_key} (disabled)`,
+        });
+    }
+    if (items.length === 0) {
+        note('No hooks found (settings or plugins).');
+        return;
+    }
+    // Currently enabled = active hooks
+    const currently_enabled = items
+        .filter((item) => item.active_entry)
+        .map((item) => item.id);
+    const selected = await multiselect({
+        message: 'Toggle hooks on/off:',
+        options: items.map((item) => ({
+            value: item.id,
+            label: item.label,
+            hint: item.hint,
+        })),
+        initialValues: currently_enabled,
+        required: false,
+    });
+    if (isCancel(selected))
+        return;
+    const selected_set = new Set(selected);
+    let changes = 0;
+    // Disable hooks that were deselected (active → disabled)
+    for (const item of items) {
+        if (!item.active_entry)
+            continue;
+        if (selected_set.has(item.id))
+            continue;
+        // Only plugin hooks can be disabled — settings hooks get removed
+        if (item.active_entry.source === 'plugin') {
+            await disable_plugin_hook(item.active_entry);
+            changes++;
+        }
+    }
+    // Enable hooks that were selected (disabled → active)
+    for (const item of items) {
+        if (item.disabled_index === undefined)
+            continue;
+        if (!selected_set.has(item.id))
+            continue;
+        await enable_plugin_hook(disabled[item.disabled_index]);
+        changes++;
+    }
+    if (changes > 0) {
+        log.success(`${changes} hook(s) updated.`);
+        log.info('Restart Claude Code for changes to take effect.');
+    }
+    else {
+        log.info('No changes.');
+    }
+}
+//# sourceMappingURL=manage-hooks.js.map

package/dist/commands/manage-marketplace.js

@@ -1,4 +1,5 @@
 import { confirm, isCancel, log, multiselect, note, select, text, } from '@clack/prompts';
+import { check_restored_hooks, redisable_restored_hooks, } from '../core/hook-state.js';
 import { read_known_marketplaces, read_marketplace_manifest, } from '../core/plugin-cache.js';
 import { get_all_plugins, read_claude_settings, } from '../core/settings.js';
 import { install_plugin_via_cli, marketplace_add_via_cli, marketplace_remove_via_cli, marketplace_update_via_cli, uninstall_plugin_via_cli, } from '../utils/claude-cli.js';
@@ -216,6 +217,23 @@ async function handle_update() {
             log.error(result.error || 'Unknown error');
         }
     }
+    // Check if update restored any disabled hooks
+    const restored = await check_restored_hooks();
+    if (restored.length > 0) {
+        log.warn(`${restored.length} disabled hook(s) were restored by the update.`);
+        const should_redisable = await confirm({
+            message: 'Re-disable these hooks?',
+        });
+        if (!isCancel(should_redisable) && should_redisable) {
+            const redisable_result = await redisable_restored_hooks(restored);
+            if (redisable_result.success > 0) {
+                log.success(`Re-disabled ${redisable_result.success} hook(s).`);
+            }
+            if (redisable_result.failed > 0) {
+                log.error(`Failed to re-disable ${redisable_result.failed} hook(s).`);
+            }
+        }
+    }
 }
 export async function manage_marketplace() {
     while (true) {

package/dist/core/config.js

@@ -42,6 +42,60 @@ export function create_config_from_servers(selected_servers) {
     });
     return { mcpServers: mcp_servers };
 }
+/**
+ * Find a server's full config in a specific scope.
+ */
+export async function find_server_in_scope(name, scope) {
+    if (scope === 'user' || scope === 'local') {
+        const config_path = get_claude_config_path();
+        try {
+            await access(config_path);
+            const content = await readFile(config_path, 'utf-8');
+            const parsed = JSON.parse(content);
+            if (scope === 'user') {
+                const server = parsed.mcpServers?.[name];
+                if (server)
+                    return { server, scope: 'user' };
+            }
+            else {
+                const cwd = get_current_project_path();
+                const server = parsed.projects?.[cwd]?.mcpServers?.[name];
+                if (server)
+                    return { server, scope: 'local' };
+            }
+        }
+        catch {
+            // File doesn't exist
+        }
+    }
+    else if (scope === 'project') {
+        const mcp_path = get_project_mcp_json_path();
+        try {
+            await access(mcp_path);
+            const content = await readFile(mcp_path, 'utf-8');
+            const parsed = JSON.parse(content);
+            const server = parsed.mcpServers?.[name];
+            if (server)
+                return { server, scope: 'project' };
+        }
+        catch {
+            // File doesn't exist
+        }
+    }
+    return null;
+}
+/**
+ * Auto-detect which scope a server lives in.
+ * Searches local → project → user.
+ */
+export async function detect_server_scope(name) {
+    for (const scope of ['local', 'project', 'user']) {
+        const result = await find_server_in_scope(name, scope);
+        if (result)
+            return result;
+    }
+    return null;
+}
 /**
  * Read full Claude config including projects section
  */

package/dist/core/dev-override.js

@@ -1,6 +1,7 @@
-import { access, readFile } from 'node:fs/promises';
+import { readFile } from 'node:fs/promises';
 import { atomic_json_write } from '../utils/atomic-write.js';
 import { get_claude_config_path, get_current_project_path, get_dev_overrides_path, get_project_mcp_json_path, } from '../utils/paths.js';
+import { detect_server_scope, find_server_in_scope, } from './config.js';
 const EMPTY_OVERRIDES = {
     version: 1,
     overrides: {},
@@ -17,62 +18,6 @@ export async function read_dev_overrides() {
 async function write_dev_overrides(data) {
     await atomic_json_write(get_dev_overrides_path(), () => data);
 }
-/**
- * Read full config for a given scope and return the server entry if found.
- * Returns { config, server, scope } or null.
- */
-async function find_server_in_scope(name, scope) {
-    if (scope === 'user' || scope === 'local') {
-        const config_path = get_claude_config_path();
-        try {
-            await access(config_path);
-            const content = await readFile(config_path, 'utf-8');
-            const parsed = JSON.parse(content);
-            if (scope === 'user') {
-                const server = parsed.mcpServers?.[name];
-                if (server)
-                    return { server, scope: 'user' };
-            }
-            else {
-                // local scope: projects[cwd].mcpServers
-                const cwd = get_current_project_path();
-                const server = parsed.projects?.[cwd]?.mcpServers?.[name];
-                if (server)
-                    return { server, scope: 'local' };
-            }
-        }
-        catch {
-            // File doesn't exist
-        }
-    }
-    else if (scope === 'project') {
-        const mcp_path = get_project_mcp_json_path();
-        try {
-            await access(mcp_path);
-            const content = await readFile(mcp_path, 'utf-8');
-            const parsed = JSON.parse(content);
-            const server = parsed.mcpServers?.[name];
-            if (server)
-                return { server, scope: 'project' };
-        }
-        catch {
-            // File doesn't exist
-        }
-    }
-    return null;
-}
-/**
- * Auto-detect which scope a server lives in.
- * Searches local → project → user.
- */
-async function detect_server_scope(name) {
-    for (const scope of ['local', 'project', 'user']) {
-        const result = await find_server_in_scope(name, scope);
-        if (result)
-            return result;
-    }
-    return null;
-}
 /**
  * Write a server config into the appropriate scope config file.
  */

package/dist/core/hook-state.js

@@ -0,0 +1,220 @@
+import { readFile, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { ensure_directory_exists, get_disabled_hooks_path, get_marketplaces_dir, get_mcpick_dir, } from '../utils/paths.js';
+export async function read_disabled_hooks() {
+    try {
+        const content = await readFile(get_disabled_hooks_path(), 'utf-8');
+        return JSON.parse(content);
+    }
+    catch {
+        return [];
+    }
+}
+async function write_disabled_hooks(entries) {
+    await ensure_directory_exists(get_mcpick_dir());
+    await writeFile(get_disabled_hooks_path(), JSON.stringify(entries, null, '\t'), 'utf-8');
+}
+/**
+ * Remove a specific hook handler from a hooks.json file by matching the handler.
+ * Returns true if the hook was found and removed.
+ */
+async function remove_hook_from_file(hooks_path, event, handler) {
+    let content;
+    try {
+        content = await readFile(hooks_path, 'utf-8');
+    }
+    catch {
+        return false;
+    }
+    const hooks_data = JSON.parse(content);
+    const hooks_obj = (hooks_data.hooks || hooks_data);
+    const matchers = hooks_obj[event];
+    if (!matchers)
+        return false;
+    let removed = false;
+    for (const m of matchers) {
+        const idx = m.hooks?.findIndex((h) => h.type === handler.type &&
+            h.command === handler.command &&
+            h.url === handler.url &&
+            h.prompt === handler.prompt);
+        if (idx !== undefined && idx >= 0) {
+            m.hooks.splice(idx, 1);
+            removed = true;
+            if (m.hooks.length === 0) {
+                matchers.splice(matchers.indexOf(m), 1);
+            }
+            break;
+        }
+    }
+    if (!removed)
+        return false;
+    if (matchers.length === 0) {
+        delete hooks_obj[event];
+    }
+    await writeFile(hooks_path, JSON.stringify(hooks_data, null, '\t'), 'utf-8');
+    return true;
+}
+/**
+ * Get all hooks.json paths for a plugin (cache + marketplace source).
+ */
+function get_all_hooks_paths(plugin_key, primary_path) {
+    const paths = [primary_path];
+    const at_index = plugin_key.lastIndexOf('@');
+    if (at_index > 0) {
+        const plugin_name = plugin_key.substring(0, at_index);
+        const marketplace_name = plugin_key.substring(at_index + 1);
+        paths.push(join(get_marketplaces_dir(), marketplace_name, 'plugins', plugin_name, 'hooks', 'hooks.json'));
+    }
+    return [...new Set(paths)]; // deduplicate
+}
+/**
+ * Disable a specific hook from a plugin.
+ * Removes from both cache and marketplace source hooks.json files.
+ */
+export async function disable_plugin_hook(entry) {
+    if (!entry.hooks_json_path || !entry.plugin_key) {
+        throw new Error('Not a plugin hook');
+    }
+    // Save to disabled state
+    const disabled = await read_disabled_hooks();
+    disabled.push({
+        plugin_key: entry.plugin_key,
+        hooks_json_path: entry.hooks_json_path,
+        event: entry.event,
+        matcher: entry.matcher,
+        matcher_index: entry.matcher_index,
+        hook_index: entry.hook_index,
+        original_handler: entry.handler,
+        disabled_at: new Date().toISOString(),
+    });
+    await write_disabled_hooks(disabled);
+    // Remove from all hooks.json files (cache + marketplace source)
+    const all_paths = get_all_hooks_paths(entry.plugin_key, entry.hooks_json_path);
+    for (const hooks_path of all_paths) {
+        await remove_hook_from_file(hooks_path, entry.event, entry.handler);
+    }
+}
+/**
+ * Add a hook handler back into a hooks.json file.
+ */
+async function add_hook_to_file(hooks_path, event, matcher_pattern, handler) {
+    let hooks_data;
+    try {
+        const content = await readFile(hooks_path, 'utf-8');
+        hooks_data = JSON.parse(content);
+    }
+    catch {
+        hooks_data = { hooks: {} };
+    }
+    const hooks_obj = (hooks_data.hooks ||
+        (hooks_data.hooks = {}));
+    if (!hooks_obj[event])
+        hooks_obj[event] = [];
+    const matchers = hooks_obj[event];
+    let matcher = matchers.find((m) => (m.matcher || undefined) === matcher_pattern);
+    if (!matcher) {
+        matcher = { hooks: [] };
+        if (matcher_pattern)
+            matcher.matcher = matcher_pattern;
+        matchers.push(matcher);
+    }
+    // Only add if not already present (avoids duplicates)
+    const already_exists = matcher.hooks.some((h) => h.type === handler.type &&
+        h.command === handler.command &&
+        h.url === handler.url &&
+        h.prompt === handler.prompt);
+    if (already_exists)
+        return;
+    matcher.hooks.push(handler);
+    await writeFile(hooks_path, JSON.stringify(hooks_data, null, '\t'), 'utf-8');
+}
+/**
+ * Re-enable a previously disabled plugin hook.
+ * Restores to both cache and marketplace source hooks.json files.
+ */
+export async function enable_plugin_hook(disabled_entry) {
+    const all_paths = get_all_hooks_paths(disabled_entry.plugin_key, disabled_entry.hooks_json_path);
+    for (const hooks_path of all_paths) {
+        await add_hook_to_file(hooks_path, disabled_entry.event, disabled_entry.matcher, disabled_entry.original_handler);
+    }
+    // Remove from disabled state
+    const disabled = await read_disabled_hooks();
+    const updated = disabled.filter((d) => !(d.plugin_key === disabled_entry.plugin_key &&
+        d.event === disabled_entry.event &&
+        d.disabled_at === disabled_entry.disabled_at));
+    await write_disabled_hooks(updated);
+}
+/**
+ * Check if any previously disabled hooks have been restored (e.g. by marketplace update).
+ * Returns entries that were re-added and need to be re-disabled.
+ */
+export async function check_restored_hooks() {
+    const disabled = await read_disabled_hooks();
+    if (disabled.length === 0)
+        return [];
+    const restored = [];
+    for (const entry of disabled) {
+        const all_paths = get_all_hooks_paths(entry.plugin_key, entry.hooks_json_path);
+        let found = false;
+        for (const hooks_path of all_paths) {
+            let hooks_data;
+            try {
+                const content = await readFile(hooks_path, 'utf-8');
+                hooks_data = JSON.parse(content);
+            }
+            catch {
+                continue;
+            }
+            const hooks_obj = (hooks_data.hooks || hooks_data);
+            const matchers = hooks_obj[entry.event];
+            if (!matchers)
+                continue;
+            for (const m of matchers) {
+                if ((m.matcher || undefined) !== entry.matcher)
+                    continue;
+                const has_match = m.hooks?.some((h) => h.type === entry.original_handler.type &&
+                    (h.command === entry.original_handler.command ||
+                        h.url === entry.original_handler.url ||
+                        h.prompt === entry.original_handler.prompt));
+                if (has_match) {
+                    found = true;
+                    break;
+                }
+            }
+            if (found)
+                break;
+        }
+        if (found)
+            restored.push(entry);
+    }
+    return restored;
+}
+/**
+ * Re-disable hooks that were restored by a marketplace update.
+ */
+export async function redisable_restored_hooks(restored) {
+    let success = 0;
+    let failed = 0;
+    for (const entry of restored) {
+        try {
+            const all_paths = get_all_hooks_paths(entry.plugin_key, entry.hooks_json_path);
+            let any_removed = false;
+            for (const hooks_path of all_paths) {
+                const removed = await remove_hook_from_file(hooks_path, entry.event, entry.original_handler);
+                if (removed)
+                    any_removed = true;
+            }
+            if (any_removed) {
+                success++;
+            }
+            else {
+                failed++;
+            }
+        }
+        catch {
+            failed++;
+        }
+    }
+    return { success, failed };
+}
+//# sourceMappingURL=hook-state.js.map

package/dist/core/settings.js

@@ -1,4 +1,5 @@
 import { access, readFile } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
 import { atomic_json_write } from '../utils/atomic-write.js';
 import { get_claude_settings_path } from '../utils/paths.js';
 export async function read_claude_settings() {
@@ -49,4 +50,194 @@ export function build_enabled_plugins(plugins) {
     }
     return result;
 }
+async function read_settings_file(path) {
+    try {
+        await access(path);
+        const content = await readFile(path, 'utf-8');
+        return JSON.parse(content);
+    }
+    catch {
+        return {};
+    }
+}
+function get_settings_paths() {
+    const home = process.env.HOME || process.env.USERPROFILE || '';
+    return [
+        {
+            scope: 'user',
+            path: resolve(home, '.claude', 'settings.json'),
+        },
+        {
+            scope: 'project',
+            path: resolve(process.cwd(), '.claude', 'settings.json'),
+        },
+        {
+            scope: 'project-local',
+            path: resolve(process.cwd(), '.claude', 'settings.local.json'),
+        },
+    ];
+}
+/**
+ * Read all hooks across all scopes (settings + plugins), flattened for display.
+ */
+export async function get_all_hooks() {
+    const entries = [];
+    // Settings-based hooks
+    for (const { scope, path } of get_settings_paths()) {
+        const data = await read_settings_file(path);
+        const hooks = data.hooks;
+        if (!hooks)
+            continue;
+        for (const [event, matchers] of Object.entries(hooks)) {
+            if (!Array.isArray(matchers))
+                continue;
+            for (let mi = 0; mi < matchers.length; mi++) {
+                const m = matchers[mi];
+                if (!m.hooks?.length)
+                    continue;
+                for (let hi = 0; hi < m.hooks.length; hi++) {
+                    entries.push({
+                        event: event,
+                        matcher: m.matcher,
+                        handler: m.hooks[hi],
+                        scope,
+                        source: scope,
+                        matcher_index: mi,
+                        hook_index: hi,
+                    });
+                }
+            }
+        }
+    }
+    // Plugin-based hooks
+    const plugin_hooks = await get_all_plugin_hooks();
+    entries.push(...plugin_hooks);
+    return entries;
+}
+/**
+ * Scan all installed plugins for hooks.json and return flattened hook entries.
+ * Checks both cache and marketplace source paths since Claude Code reads from both.
+ */
+export async function get_all_plugin_hooks() {
+    const { read_installed_plugins } = await import('./plugin-cache.js');
+    const { get_marketplaces_dir } = await import('../utils/paths.js');
+    const installed = await read_installed_plugins();
+    const entries = [];
+    const seen_hooks = new Set();
+    for (const [plugin_key, installs] of Object.entries(installed.plugins)) {
+        if (!installs?.length)
+            continue;
+        const install = installs[0];
+        const at_index = plugin_key.lastIndexOf('@');
+        const plugin_name = at_index > 0 ? plugin_key.substring(0, at_index) : plugin_key;
+        const marketplace_name = at_index > 0 ? plugin_key.substring(at_index + 1) : '';
+        // Collect all hooks.json paths for this plugin (cache + marketplace source)
+        const hooks_paths = [
+            join(install.installPath, 'hooks', 'hooks.json'),
+        ];
+        // Also check marketplace source path
+        if (marketplace_name) {
+            hooks_paths.push(join(get_marketplaces_dir(), marketplace_name, 'plugins', plugin_name, 'hooks', 'hooks.json'));
+        }
+        for (const hooks_path of hooks_paths) {
+            let hooks_data;
+            try {
+                const content = await readFile(hooks_path, 'utf-8');
+                hooks_data = JSON.parse(content);
+            }
+            catch {
+                continue;
+            }
+            const hooks = (hooks_data.hooks || hooks_data);
+            for (const [event, matchers] of Object.entries(hooks)) {
+                if (!Array.isArray(matchers))
+                    continue;
+                for (let mi = 0; mi < matchers.length; mi++) {
+                    const m = matchers[mi];
+                    if (!m.hooks?.length)
+                        continue;
+                    for (let hi = 0; hi < m.hooks.length; hi++) {
+                        // Deduplicate: same plugin + event + handler type + command
+                        const h = m.hooks[hi];
+                        const dedup_key = `${plugin_key}:${event}:${h.type}:${h.command || h.url || h.prompt}`;
+                        if (seen_hooks.has(dedup_key))
+                            continue;
+                        seen_hooks.add(dedup_key);
+                        entries.push({
+                            event: event,
+                            matcher: m.matcher,
+                            handler: h,
+                            scope: 'user',
+                            source: 'plugin',
+                            matcher_index: mi,
+                            hook_index: hi,
+                            plugin_key,
+                            hooks_json_path: hooks_path,
+                        });
+                    }
+                }
+            }
+        }
+    }
+    return entries;
+}
+/**
+ * Remove a specific hook entry by scope/event/indices.
+ */
+export async function remove_hook(entry) {
+    const scope_path = get_settings_paths().find((s) => s.scope === entry.scope);
+    if (!scope_path)
+        throw new Error(`Unknown scope: ${entry.scope}`);
+    await atomic_json_write(scope_path.path, (existing) => {
+        const hooks = existing.hooks;
+        if (!hooks)
+            return existing;
+        const matchers = hooks[entry.event];
+        if (!matchers?.[entry.matcher_index])
+            return existing;
+        const matcher = matchers[entry.matcher_index];
+        matcher.hooks.splice(entry.hook_index, 1);
+        // Clean up empty matchers
+        if (matcher.hooks.length === 0) {
+            matchers.splice(entry.matcher_index, 1);
+        }
+        // Clean up empty events
+        if (matchers.length === 0) {
+            delete hooks[entry.event];
+        }
+        // Clean up empty hooks object
+        if (Object.keys(hooks).length === 0) {
+            delete existing.hooks;
+        }
+        return existing;
+    });
+}
+/**
+ * Add a hook to a specific scope.
+ */
+export async function add_hook(scope, event, matcher, handler) {
+    const scope_path = get_settings_paths().find((s) => s.scope === scope);
+    if (!scope_path)
+        throw new Error(`Unknown scope: ${scope}`);
+    await atomic_json_write(scope_path.path, (existing) => {
+        if (!existing.hooks)
+            existing.hooks = {};
+        const hooks = existing.hooks;
+        if (!hooks[event])
+            hooks[event] = [];
+        const matchers = hooks[event];
+        // Find existing matcher group or create new
+        const existing_matcher = matchers.find((m) => (m.matcher || undefined) === matcher);
+        if (existing_matcher) {
+            existing_matcher.hooks.push(handler);
+        }
+        else {
+            const new_matcher = { hooks: [handler] };
+            if (matcher)
+                new_matcher.matcher = matcher;
+            matchers.push(new_matcher);
+        }
+        return existing;
+    });
+}
 //# sourceMappingURL=settings.js.map

package/dist/index.js

@@ -5,6 +5,7 @@ import { backup_config } from './commands/backup.js';
 import { edit_config } from './commands/edit-config.js';
 import { edit_plugins } from './commands/edit-plugins.js';
 import { manage_cache } from './commands/manage-cache.js';
+import { manage_hooks } from './commands/manage-hooks.js';
 import { manage_marketplace } from './commands/manage-marketplace.js';
 import { restore_config } from './commands/restore.js';
 import { write_claude_config } from './core/config.js';
@@ -164,6 +165,7 @@ async function main() {
         return;
     }
     intro('MCPick - MCP Server Configuration Manager');
+    log.info('CLI: mcpick <command> --help | Commands: list, add, clone, enable, disable, remove, get, dev, profile, plugins, hooks, backup, restore');
     while (true) {
         try {
             const action = await select({
@@ -184,6 +186,11 @@ async function main() {
                         label: 'Manage marketplaces',
                         hint: 'Add, remove, or update plugin marketplaces',
                     },
+                    {
+                        value: 'manage-hooks',
+                        label: 'Manage hooks',
+                        hint: 'List, add, or remove event hooks',
+                    },
                     {
                         value: 'manage-cache',
                         label: 'Manage plugin cache',
@@ -235,6 +242,9 @@ async function main() {
                 case 'manage-marketplace':
                     await manage_marketplace();
                     break;
+                case 'manage-hooks':
+                    await manage_hooks();
+                    break;
                 case 'manage-cache':
                     await manage_cache();
                     break;
@@ -286,8 +296,10 @@ const SUBCOMMANDS = new Set([
     'remove',
     'add',
     'add-json',
+    'clone',
     'get',
     'reset-project-choices',
+    'hooks',
     'backup',
     'restore',
     'profile',

package/dist/utils/claude-cli.js

@@ -34,9 +34,11 @@ function build_add_command(server, scope) {
     const parts = ['claude', 'mcp', 'add'];
     // Server name
     parts.push(shell_escape(server.name));
-    // Transport type
+    // Transport type (only specify if non-default)
     const transport = server.type || 'stdio';
-    parts.push('--transport', transport);
+    if (transport !== 'stdio') {
+        parts.push('--transport', transport);
+    }
     // Scope
     parts.push('--scope', scope);
     // Handle different transport types

package/dist/utils/paths.js

@@ -105,6 +105,9 @@ export function get_plugin_cache_dir() {
 export function get_marketplaces_dir() {
     return join(get_plugins_dir(), 'marketplaces');
 }
+export function get_disabled_hooks_path() {
+    return join(get_mcpick_dir(), 'disabled-hooks.json');
+}
 export function get_marketplace_manifest_path(name) {
     return join(get_marketplaces_dir(), name, '.claude-plugin', 'marketplace.json');
 }

package/dist/utils/redact.js

@@ -0,0 +1,28 @@
+/**
+ * Redact sensitive values (env, headers) from a server config.
+ * Shows key names but replaces values with "***".
+ */
+export function redact_server_base(server) {
+    const redacted = { ...server };
+    if ('env' in redacted && redacted.env) {
+        redacted.env = redact_record(redacted.env);
+    }
+    if ('headers' in redacted && redacted.headers) {
+        redacted.headers = redact_record(redacted.headers);
+    }
+    return redacted;
+}
+export function redact_server(server) {
+    return {
+        ...redact_server_base(server),
+        name: server.name,
+    };
+}
+function redact_record(record) {
+    const redacted = {};
+    for (const key of Object.keys(record)) {
+        redacted[key] = '***';
+    }
+    return redacted;
+}
+//# sourceMappingURL=redact.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcpick",
-  "version": "0.0.16",
+  "version": "0.0.18",
   "description": "Dynamic MCP server and plugin configuration manager for Claude Code",
   "type": "module",
   "main": "./dist/index.js",