mcpman 0.1.0 → 0.2.0

package/dist/index.cjs

@@ -37,6 +37,90 @@ var init_cjs_shims = __esm({
   }
 });
 
+// src/core/trust-scorer.ts
+var trust_scorer_exports = {};
+__export(trust_scorer_exports, {
+  computeTrustScore: () => computeTrustScore
+});
+function vulnScore(vulns) {
+  let score = 100;
+  for (const v of vulns) {
+    if (v.severity === "critical") score -= 25;
+    else if (v.severity === "high") score -= 15;
+    else if (v.severity === "moderate") score -= 10;
+    else score -= 5;
+  }
+  return Math.max(0, score);
+}
+function downloadScore(weeklyDownloads) {
+  if (weeklyDownloads <= 0) return 0;
+  if (weeklyDownloads >= 1e6) return 100;
+  if (weeklyDownloads >= 1e5) return 80;
+  if (weeklyDownloads >= 1e4) return 60;
+  if (weeklyDownloads >= 1e3) return 40;
+  if (weeklyDownloads >= 100) return 20;
+  return 10;
+}
+function ageScore(packageAge) {
+  if (packageAge <= 0) return 0;
+  if (packageAge >= 730) return 100;
+  if (packageAge >= 365) return 80;
+  if (packageAge >= 180) return 60;
+  if (packageAge >= 30) return 30;
+  return 10;
+}
+function publishScore(lastPublish) {
+  const daysSince = Math.floor((Date.now() - new Date(lastPublish).getTime()) / 864e5);
+  if (daysSince <= 30) return 100;
+  if (daysSince <= 90) return 80;
+  if (daysSince <= 180) return 60;
+  if (daysSince <= 365) return 40;
+  return 20;
+}
+function maintainerScore(count, deprecated) {
+  let score = 0;
+  if (count >= 3) score = 90;
+  else if (count === 2) score = 70;
+  else score = 50;
+  if (!deprecated) score += 10;
+  return Math.min(100, score);
+}
+function toRiskLevel(score) {
+  if (score >= 80) return "LOW";
+  if (score >= 50) return "MEDIUM";
+  if (score >= 20) return "HIGH";
+  return "CRITICAL";
+}
+function computeTrustScore(metadata, vulns) {
+  if (!metadata) {
+    const vScore = vulnScore(vulns);
+    const score2 = Math.round(vScore * WEIGHT_VULNS * 100) / 100;
+    return { score: Math.round(score2), riskLevel: toRiskLevel(score2) };
+  }
+  const scores = {
+    vulns: vulnScore(vulns),
+    downloads: downloadScore(metadata.weeklyDownloads),
+    age: ageScore(metadata.packageAge),
+    publish: publishScore(metadata.lastPublish),
+    maintainers: maintainerScore(metadata.maintainerCount, metadata.deprecated)
+  };
+  const weighted = scores.vulns * WEIGHT_VULNS + scores.downloads * WEIGHT_DOWNLOADS + scores.age * WEIGHT_AGE + scores.publish * WEIGHT_PUBLISH_FREQ + scores.maintainers * WEIGHT_MAINTAINERS;
+  const score = Math.min(100, Math.max(0, Math.round(weighted)));
+  return { score, riskLevel: toRiskLevel(score) };
+}
+var WEIGHT_VULNS, WEIGHT_DOWNLOADS, WEIGHT_AGE, WEIGHT_PUBLISH_FREQ, WEIGHT_MAINTAINERS;
+var init_trust_scorer = __esm({
+  "src/core/trust-scorer.ts"() {
+    "use strict";
+    init_cjs_shims();
+    WEIGHT_VULNS = 0.3;
+    WEIGHT_DOWNLOADS = 0.2;
+    WEIGHT_AGE = 0.15;
+    WEIGHT_PUBLISH_FREQ = 0.15;
+    WEIGHT_MAINTAINERS = 0.2;
+  }
+});
+
 // src/clients/types.ts
 var ConfigParseError, ConfigWriteError;
 var init_types = __esm({
@@ -64,43 +148,43 @@ var init_types = __esm({
 async function atomicWrite(filePath, content) {
   const tmpPath = `${filePath}.tmp`;
   try {
-    await import_node_fs.default.promises.mkdir(import_node_path.default.dirname(filePath), { recursive: true });
-    await import_node_fs.default.promises.writeFile(tmpPath, content, { encoding: "utf-8", mode: 384 });
-    await import_node_fs.default.promises.rename(tmpPath, filePath);
+    await import_node_fs3.default.promises.mkdir(import_node_path3.default.dirname(filePath), { recursive: true });
+    await import_node_fs3.default.promises.writeFile(tmpPath, content, { encoding: "utf-8", mode: 384 });
+    await import_node_fs3.default.promises.rename(tmpPath, filePath);
   } catch (err) {
     try {
-      await import_node_fs.default.promises.unlink(tmpPath);
+      await import_node_fs3.default.promises.unlink(tmpPath);
     } catch {
     }
     throw err;
   }
 }
-async function pathExists(p5) {
+async function pathExists(p9) {
   try {
-    await import_node_fs.default.promises.access(p5);
+    await import_node_fs3.default.promises.access(p9);
     return true;
   } catch {
     return false;
   }
 }
-var import_node_fs, import_node_path, BaseClientHandler;
+var import_node_fs3, import_node_path3, BaseClientHandler;
 var init_base_client_handler = __esm({
   "src/clients/base-client-handler.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_fs = __toESM(require("fs"), 1);
-    import_node_path = __toESM(require("path"), 1);
+    import_node_fs3 = __toESM(require("fs"), 1);
+    import_node_path3 = __toESM(require("path"), 1);
     init_types();
     BaseClientHandler = class {
       async isInstalled() {
-        const dir = import_node_path.default.dirname(this.getConfigPath());
+        const dir = import_node_path3.default.dirname(this.getConfigPath());
         return pathExists(dir);
       }
       /** Read raw JSON from disk, return empty object if file missing */
       async readRaw() {
         const configPath = this.getConfigPath();
         try {
-          const raw = await import_node_fs.default.promises.readFile(configPath, "utf-8");
+          const raw = await import_node_fs3.default.promises.readFile(configPath, "utf-8");
           return JSON.parse(raw);
         } catch (err) {
           if (err.code === "ENOENT") {
@@ -151,26 +235,26 @@ var init_base_client_handler = __esm({
 
 // src/utils/paths.ts
 function getHomedir() {
-  return import_node_os.default.homedir();
+  return import_node_os3.default.homedir();
 }
 function getAppDataDir() {
   const home = getHomedir();
   if (process.platform === "darwin") {
-    return import_node_path2.default.join(home, "Library", "Application Support");
+    return import_node_path4.default.join(home, "Library", "Application Support");
   }
   if (process.platform === "win32") {
-    return process.env.APPDATA ?? import_node_path2.default.join(home, "AppData", "Roaming");
+    return process.env.APPDATA ?? import_node_path4.default.join(home, "AppData", "Roaming");
   }
-  return process.env.XDG_CONFIG_HOME ?? import_node_path2.default.join(home, ".config");
+  return process.env.XDG_CONFIG_HOME ?? import_node_path4.default.join(home, ".config");
 }
 function resolveConfigPath(client) {
   const appData = getAppDataDir();
   const home = getHomedir();
   switch (client) {
     case "claude-desktop":
-      return import_node_path2.default.join(appData, "Claude", "claude_desktop_config.json");
+      return import_node_path4.default.join(appData, "Claude", "claude_desktop_config.json");
     case "cursor":
-      return import_node_path2.default.join(
+      return import_node_path4.default.join(
         appData,
         "Cursor",
         "User",
@@ -179,7 +263,7 @@ function resolveConfigPath(client) {
         "mcp.json"
       );
     case "windsurf":
-      return import_node_path2.default.join(
+      return import_node_path4.default.join(
         appData,
         "Windsurf",
         "User",
@@ -189,21 +273,21 @@ function resolveConfigPath(client) {
       );
     case "vscode":
       if (process.platform === "darwin") {
-        return import_node_path2.default.join(appData, "Code", "User", "settings.json");
+        return import_node_path4.default.join(appData, "Code", "User", "settings.json");
       }
       if (process.platform === "win32") {
-        return import_node_path2.default.join(appData, "Code", "User", "settings.json");
+        return import_node_path4.default.join(appData, "Code", "User", "settings.json");
       }
-      return import_node_path2.default.join(home, ".config", "Code", "User", "settings.json");
+      return import_node_path4.default.join(home, ".config", "Code", "User", "settings.json");
   }
 }
-var import_node_os, import_node_path2;
+var import_node_os3, import_node_path4;
 var init_paths = __esm({
   "src/utils/paths.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_os = __toESM(require("os"), 1);
-    import_node_path2 = __toESM(require("path"), 1);
+    import_node_os3 = __toESM(require("os"), 1);
+    import_node_path4 = __toESM(require("path"), 1);
   }
 });
 
@@ -331,14 +415,515 @@ var init_client_detector = __esm({
   }
 });
 
+// src/core/vault-service.ts
+var vault_service_exports = {};
+__export(vault_service_exports, {
+  clearPasswordCache: () => clearPasswordCache,
+  decrypt: () => decrypt,
+  encrypt: () => encrypt,
+  getMasterPassword: () => getMasterPassword,
+  getSecret: () => getSecret,
+  getSecretsForServer: () => getSecretsForServer,
+  getVaultPath: () => getVaultPath,
+  listSecrets: () => listSecrets,
+  readVault: () => readVault,
+  removeSecret: () => removeSecret,
+  setSecret: () => setSecret,
+  writeVault: () => writeVault
+});
+function getVaultPath() {
+  return import_node_path6.default.join(import_node_os4.default.homedir(), ".mcpman", "vault.enc");
+}
+function readVault(vaultPath = getVaultPath()) {
+  const empty = { version: 1, servers: {} };
+  try {
+    const raw = import_node_fs4.default.readFileSync(vaultPath, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (parsed.version !== 1 || typeof parsed.servers !== "object") return empty;
+    return parsed;
+  } catch {
+    return empty;
+  }
+}
+function writeVault(data, vaultPath = getVaultPath()) {
+  const dir = import_node_path6.default.dirname(vaultPath);
+  import_node_fs4.default.mkdirSync(dir, { recursive: true });
+  const tmp = `${vaultPath}.tmp`;
+  import_node_fs4.default.writeFileSync(tmp, JSON.stringify(data, null, 2), { mode: 384 });
+  if (process.platform !== "win32") {
+    import_node_fs4.default.chmodSync(tmp, 384);
+  }
+  import_node_fs4.default.renameSync(tmp, vaultPath);
+  if (process.platform !== "win32") {
+    import_node_fs4.default.chmodSync(vaultPath, 384);
+  }
+}
+function encrypt(value, password2) {
+  const salt = import_node_crypto2.default.randomBytes(16);
+  const key = import_node_crypto2.default.pbkdf2Sync(password2, salt, 1e5, 32, "sha256");
+  const iv = import_node_crypto2.default.randomBytes(16);
+  const cipher = import_node_crypto2.default.createCipheriv("aes-256-cbc", key, iv);
+  const encrypted = Buffer.concat([cipher.update(value, "utf-8"), cipher.final()]);
+  return {
+    salt: salt.toString("hex"),
+    iv: iv.toString("hex"),
+    data: encrypted.toString("hex")
+  };
+}
+function decrypt(entry, password2) {
+  const salt = Buffer.from(entry.salt, "hex");
+  const key = import_node_crypto2.default.pbkdf2Sync(password2, salt, 1e5, 32, "sha256");
+  const iv = Buffer.from(entry.iv, "hex");
+  const decipher = import_node_crypto2.default.createDecipheriv("aes-256-cbc", key, iv);
+  const decrypted = Buffer.concat([
+    decipher.update(Buffer.from(entry.data, "hex")),
+    decipher.final()
+    // throws ERR_OSSL_BAD_DECRYPT on wrong password
+  ]);
+  return decrypted.toString("utf-8");
+}
+async function getMasterPassword(confirm6 = false) {
+  if (_cachedPassword) return _cachedPassword;
+  const password2 = await p5.password({
+    message: "Enter vault master password:",
+    validate: (v) => v.length < 8 ? "Password must be at least 8 characters" : void 0
+  });
+  if (p5.isCancel(password2)) {
+    p5.cancel("Vault access cancelled.");
+    process.exit(0);
+  }
+  if (confirm6) {
+    const confirm22 = await p5.password({ message: "Confirm master password:" });
+    if (p5.isCancel(confirm22) || confirm22 !== password2) {
+      p5.cancel("Passwords do not match.");
+      process.exit(1);
+    }
+  }
+  _cachedPassword = password2;
+  return _cachedPassword;
+}
+function clearPasswordCache() {
+  _cachedPassword = null;
+}
+function setSecret(server, key, value, password2, vaultPath = getVaultPath()) {
+  const vault = readVault(vaultPath);
+  if (!vault.servers[server]) vault.servers[server] = {};
+  vault.servers[server][key] = encrypt(value, password2);
+  writeVault(vault, vaultPath);
+}
+function getSecret(server, key, password2, vaultPath = getVaultPath()) {
+  const vault = readVault(vaultPath);
+  const entry = vault.servers[server]?.[key];
+  if (!entry) return null;
+  return decrypt(entry, password2);
+}
+function getSecretsForServer(server, password2, vaultPath = getVaultPath()) {
+  const vault = readVault(vaultPath);
+  const entries = vault.servers[server];
+  if (!entries) return {};
+  const result = {};
+  for (const [k, entry] of Object.entries(entries)) {
+    result[k] = decrypt(entry, password2);
+  }
+  return result;
+}
+function removeSecret(server, key, vaultPath = getVaultPath()) {
+  const vault = readVault(vaultPath);
+  if (vault.servers[server]) {
+    delete vault.servers[server][key];
+    if (Object.keys(vault.servers[server]).length === 0) {
+      delete vault.servers[server];
+    }
+    writeVault(vault, vaultPath);
+  }
+}
+function listSecrets(server, vaultPath = getVaultPath()) {
+  const vault = readVault(vaultPath);
+  const entries = server ? vault.servers[server] ? { [server]: vault.servers[server] } : {} : vault.servers;
+  return Object.entries(entries).map(([srv, keys]) => ({
+    server: srv,
+    keys: Object.keys(keys)
+  }));
+}
+var import_node_crypto2, import_node_fs4, import_node_os4, import_node_path6, p5, _cachedPassword;
+var init_vault_service = __esm({
+  "src/core/vault-service.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_node_crypto2 = __toESM(require("crypto"), 1);
+    import_node_fs4 = __toESM(require("fs"), 1);
+    import_node_os4 = __toESM(require("os"), 1);
+    import_node_path6 = __toESM(require("path"), 1);
+    p5 = __toESM(require("@clack/prompts"), 1);
+    _cachedPassword = null;
+    process.on("exit", () => {
+      _cachedPassword = null;
+    });
+  }
+});
+
 // src/index.ts
 init_cjs_shims();
-var import_citty6 = require("citty");
+var import_citty10 = require("citty");
 
-// src/commands/doctor.ts
+// src/commands/audit.ts
 init_cjs_shims();
 var import_citty = require("citty");
 var import_picocolors = __toESM(require("picocolors"), 1);
+var import_nanospinner = require("nanospinner");
+
+// src/core/lockfile.ts
+init_cjs_shims();
+var import_node_fs = __toESM(require("fs"), 1);
+var import_node_path = __toESM(require("path"), 1);
+var import_node_os = __toESM(require("os"), 1);
+var LOCKFILE_NAME = "mcpman.lock";
+function findLockfile() {
+  let dir = process.cwd();
+  while (true) {
+    const candidate = import_node_path.default.join(dir, LOCKFILE_NAME);
+    if (import_node_fs.default.existsSync(candidate)) return candidate;
+    const parent = import_node_path.default.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+function getGlobalLockfilePath() {
+  return import_node_path.default.join(import_node_os.default.homedir(), ".mcpman", LOCKFILE_NAME);
+}
+function resolveLockfilePath() {
+  return findLockfile() ?? getGlobalLockfilePath();
+}
+function readLockfile(filePath) {
+  const target = filePath ?? resolveLockfilePath();
+  if (!import_node_fs.default.existsSync(target)) {
+    return { lockfileVersion: 1, servers: {} };
+  }
+  try {
+    const raw = import_node_fs.default.readFileSync(target, "utf-8");
+    return JSON.parse(raw);
+  } catch {
+    return { lockfileVersion: 1, servers: {} };
+  }
+}
+function serialize(data) {
+  const sorted = {
+    lockfileVersion: data.lockfileVersion,
+    servers: Object.fromEntries(
+      Object.entries(data.servers).sort(([a], [b]) => a.localeCompare(b))
+    )
+  };
+  return JSON.stringify(sorted, null, 2) + "\n";
+}
+function writeLockfile(data, filePath) {
+  const target = filePath ?? resolveLockfilePath();
+  const dir = import_node_path.default.dirname(target);
+  if (!import_node_fs.default.existsSync(dir)) {
+    import_node_fs.default.mkdirSync(dir, { recursive: true });
+  }
+  const tmp = `${target}.tmp`;
+  import_node_fs.default.writeFileSync(tmp, serialize(data), "utf-8");
+  import_node_fs.default.renameSync(tmp, target);
+}
+function addEntry(name, entry, filePath) {
+  const data = readLockfile(filePath);
+  data.servers[name] = entry;
+  writeLockfile(data, filePath);
+}
+function createEmptyLockfile(filePath) {
+  writeLockfile({ lockfileVersion: 1, servers: {} }, filePath);
+}
+
+// src/core/security-scanner.ts
+init_cjs_shims();
+var import_node_fs2 = __toESM(require("fs"), 1);
+var import_node_os2 = __toESM(require("os"), 1);
+var import_node_path2 = __toESM(require("path"), 1);
+var CACHE_PATH = import_node_path2.default.join(import_node_os2.default.homedir(), ".mcpman", ".audit-cache.json");
+var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
+function readCache() {
+  try {
+    if (!import_node_fs2.default.existsSync(CACHE_PATH)) return {};
+    return JSON.parse(import_node_fs2.default.readFileSync(CACHE_PATH, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+function writeCache(cache) {
+  const dir = import_node_path2.default.dirname(CACHE_PATH);
+  if (!import_node_fs2.default.existsSync(dir)) import_node_fs2.default.mkdirSync(dir, { recursive: true });
+  const tmp = `${CACHE_PATH}.tmp`;
+  import_node_fs2.default.writeFileSync(tmp, JSON.stringify(cache, null, 2), "utf-8");
+  import_node_fs2.default.renameSync(tmp, CACHE_PATH);
+}
+function getCachedReport(name, version) {
+  const cache = readCache();
+  const key = `${name}@${version}`;
+  const entry = cache[key];
+  if (!entry) return null;
+  if (Date.now() - entry.timestamp > CACHE_TTL_MS) return null;
+  return entry.report;
+}
+function cacheReport(name, version, report) {
+  const cache = readCache();
+  cache[`${name}@${version}`] = { report, timestamp: Date.now() };
+  writeCache(cache);
+}
+async function fetchNpmMetadata(packageName) {
+  const timeout = 1e4;
+  const signal = AbortSignal.timeout(timeout);
+  try {
+    const [regRes, dlRes] = await Promise.all([
+      fetch(`https://registry.npmjs.org/${encodeURIComponent(packageName)}`, { signal }),
+      fetch(`https://api.npmjs.org/downloads/point/last-week/${encodeURIComponent(packageName)}`, {
+        signal: AbortSignal.timeout(timeout)
+      })
+    ]);
+    if (!regRes.ok) return null;
+    const reg = await regRes.json();
+    const time = reg["time"] ?? {};
+    const created = time["created"] ? new Date(time["created"]) : null;
+    const modified = time["modified"] ? new Date(time["modified"]) : null;
+    const packageAge = created ? Math.floor((Date.now() - created.getTime()) / 864e5) : 0;
+    const maintainers = Array.isArray(reg["maintainers"]) ? reg["maintainers"] : [];
+    const latestVersion = reg["dist-tags"]?.["latest"] ?? "";
+    const versionData = reg["versions"]?.[latestVersion];
+    const deprecated = typeof versionData?.["deprecated"] === "string";
+    let weeklyDownloads = 0;
+    if (dlRes.ok) {
+      const dl = await dlRes.json();
+      weeklyDownloads = typeof dl["downloads"] === "number" ? dl["downloads"] : 0;
+    }
+    return {
+      weeklyDownloads,
+      lastPublish: modified?.toISOString() ?? (/* @__PURE__ */ new Date()).toISOString(),
+      packageAge,
+      maintainerCount: maintainers.length,
+      deprecated
+    };
+  } catch {
+    return null;
+  }
+}
+async function fetchVulnerabilities(packageName, version) {
+  try {
+    const res = await fetch("https://api.osv.dev/v1/query", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ package: { name: packageName, ecosystem: "npm" }, version }),
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!res.ok) return [];
+    const data = await res.json();
+    const vulns = Array.isArray(data["vulns"]) ? data["vulns"] : [];
+    return vulns.map((v) => {
+      const severity = v["database_specific"]?.["severity"];
+      const sev = typeof severity === "string" ? severity.toLowerCase() : "moderate";
+      const refs = Array.isArray(v["references"]) ? v["references"] : [];
+      return {
+        severity: ["low", "moderate", "high", "critical"].includes(sev) ? sev : "moderate",
+        title: typeof v["summary"] === "string" ? v["summary"] : typeof v["id"] === "string" ? v["id"] : "Unknown vulnerability",
+        url: typeof refs[0]?.["url"] === "string" ? refs[0]["url"] : void 0
+      };
+    });
+  } catch {
+    return [];
+  }
+}
+async function scanServer(name, entry) {
+  if (entry.source !== "npm") {
+    return {
+      server: name,
+      source: entry.source,
+      score: null,
+      riskLevel: "UNKNOWN",
+      vulnerabilities: [],
+      metadata: null
+    };
+  }
+  const cached = getCachedReport(name, entry.version);
+  if (cached) return cached;
+  const [metadata, vulnerabilities] = await Promise.all([
+    fetchNpmMetadata(name),
+    fetchVulnerabilities(name, entry.version)
+  ]);
+  const { computeTrustScore: computeTrustScore2 } = await Promise.resolve().then(() => (init_trust_scorer(), trust_scorer_exports));
+  const { score, riskLevel } = computeTrustScore2(metadata, vulnerabilities);
+  const report = {
+    server: name,
+    source: "npm",
+    score,
+    riskLevel,
+    vulnerabilities,
+    metadata
+  };
+  cacheReport(name, entry.version, report);
+  return report;
+}
+async function scanAllServers(servers, concurrency = 3) {
+  const entries = Object.entries(servers);
+  const results = [];
+  const executing = /* @__PURE__ */ new Set();
+  for (const [name, entry] of entries) {
+    const p9 = scanServer(name, entry).then((r) => {
+      results.push(r);
+      executing.delete(p9);
+    });
+    executing.add(p9);
+    if (executing.size >= concurrency) await Promise.race(executing);
+  }
+  await Promise.all(executing);
+  return results;
+}
+
+// src/commands/audit.ts
+function colorRisk(level, score) {
+  const label = score !== null ? `${score}/100 (${level})` : level;
+  if (level === "LOW") return import_picocolors.default.green(label);
+  if (level === "MEDIUM") return import_picocolors.default.yellow(label);
+  if (level === "HIGH") return import_picocolors.default.red(label);
+  if (level === "CRITICAL") return import_picocolors.default.bold(import_picocolors.default.red(label));
+  return import_picocolors.default.dim(label);
+}
+function daysAgo(isoDate) {
+  const days = Math.floor((Date.now() - new Date(isoDate).getTime()) / 864e5);
+  if (days === 0) return "today";
+  if (days === 1) return "1 day ago";
+  return `${days} days ago`;
+}
+function countVulns(vulns) {
+  const c = { critical: 0, high: 0, moderate: 0, low: 0 };
+  for (const v of vulns) c[v.severity]++;
+  if (vulns.length === 0) return import_picocolors.default.green("none");
+  const parts = [];
+  if (c.critical) parts.push(import_picocolors.default.bold(import_picocolors.default.red(`${c.critical} critical`)));
+  if (c.high) parts.push(import_picocolors.default.red(`${c.high} high`));
+  if (c.moderate) parts.push(import_picocolors.default.yellow(`${c.moderate} moderate`));
+  if (c.low) parts.push(import_picocolors.default.dim(`${c.low} low`));
+  return parts.join(", ");
+}
+function printReport(report) {
+  const riskColored = colorRisk(report.riskLevel, report.score);
+  const icon = report.riskLevel === "LOW" ? import_picocolors.default.green("\u25CF") : report.riskLevel === "MEDIUM" ? import_picocolors.default.yellow("\u25CF") : report.riskLevel === "UNKNOWN" ? import_picocolors.default.dim("\u25CB") : import_picocolors.default.red("\u25CF");
+  console.log(`  ${icon} ${import_picocolors.default.bold(report.server)}  Score: ${riskColored}`);
+  if (report.source !== "npm") {
+    console.log(`    ${import_picocolors.default.dim("Non-npm source \u2014 security data unavailable")}`);
+    console.log();
+    return;
+  }
+  if (report.metadata) {
+    const { weeklyDownloads, packageAge, lastPublish, maintainerCount, deprecated } = report.metadata;
+    const dlStr = weeklyDownloads.toLocaleString();
+    console.log(
+      `    ${import_picocolors.default.dim("Downloads:")} ${dlStr}/week  ${import_picocolors.default.dim("|")}  ${import_picocolors.default.dim("Age:")} ${packageAge}d  ${import_picocolors.default.dim("|")}  ${import_picocolors.default.dim("Last publish:")} ${daysAgo(lastPublish)}  ${import_picocolors.default.dim("|")}  ${import_picocolors.default.dim("Maintainers:")} ${maintainerCount}` + (deprecated ? import_picocolors.default.red("  [DEPRECATED]") : "")
+    );
+  }
+  console.log(`    ${import_picocolors.default.dim("Vulnerabilities:")} ${countVulns(report.vulnerabilities)}`);
+  if (report.vulnerabilities.length > 0) {
+    for (const v of report.vulnerabilities) {
+      const sevColor = v.severity === "critical" || v.severity === "high" ? import_picocolors.default.red : import_picocolors.default.yellow;
+      const url = v.url ? import_picocolors.default.dim(` ${v.url}`) : "";
+      console.log(`      ${sevColor("\u25B8")} [${v.severity}] ${v.title}${url}`);
+    }
+  }
+  console.log();
+}
+var audit_default = (0, import_citty.defineCommand)({
+  meta: {
+    name: "audit",
+    description: "Scan installed MCP servers for security vulnerabilities and trust scores"
+  },
+  args: {
+    server: {
+      type: "positional",
+      description: "Specific server to audit (omit to audit all)",
+      required: false
+    },
+    json: {
+      type: "boolean",
+      description: "Output results as JSON",
+      default: false
+    },
+    fix: {
+      type: "boolean",
+      description: "Show available fix versions for vulnerable packages",
+      default: false
+    }
+  },
+  async run({ args }) {
+    const lockfile = readLockfile();
+    const { servers } = lockfile;
+    if (Object.keys(servers).length === 0) {
+      console.log(import_picocolors.default.dim("\n  No MCP servers installed. Run mcpman install <server> to get started.\n"));
+      return;
+    }
+    const targets = {};
+    if (args.server) {
+      if (!servers[args.server]) {
+        console.error(import_picocolors.default.red(`
+  Server "${args.server}" not found in lockfile.
+`));
+        process.exit(1);
+      }
+      targets[args.server] = servers[args.server];
+    } else {
+      Object.assign(targets, servers);
+    }
+    const spinner5 = (0, import_nanospinner.createSpinner)(`Scanning ${Object.keys(targets).length} server(s)...`).start();
+    let reports;
+    try {
+      reports = args.server ? [await scanServer(args.server, targets[args.server])] : await scanAllServers(targets);
+    } catch (err) {
+      spinner5.error({ text: "Scan failed" });
+      console.error(import_picocolors.default.red(String(err)));
+      process.exit(1);
+    }
+    spinner5.success({ text: `Scanned ${reports.length} server(s)` });
+    if (args.json) {
+      console.log(JSON.stringify(reports, null, 2));
+      return;
+    }
+    console.log(import_picocolors.default.bold("\n  mcpman audit\n"));
+    console.log(import_picocolors.default.dim("  " + "\u2500".repeat(60)));
+    for (const report of reports) {
+      printReport(report);
+    }
+    console.log(import_picocolors.default.dim("  " + "\u2500".repeat(60)));
+    const withIssues = reports.filter(
+      (r) => r.riskLevel !== "LOW" && r.riskLevel !== "UNKNOWN"
+    );
+    const npmReports = reports.filter((r) => r.source === "npm");
+    const parts = [];
+    parts.push(`${reports.length} server(s) scanned`);
+    if (npmReports.length < reports.length) {
+      parts.push(import_picocolors.default.dim(`${reports.length - npmReports.length} non-npm (unverified)`));
+    }
+    if (withIssues.length > 0) {
+      parts.push(import_picocolors.default.yellow(`${withIssues.length} with issues`));
+    } else {
+      parts.push(import_picocolors.default.green("all clear"));
+    }
+    console.log(`
+  Summary: ${parts.join(" | ")}
+`);
+    if (args.fix) {
+      const withVulns = reports.filter((r) => r.vulnerabilities.length > 0);
+      if (withVulns.length > 0) {
+        console.log(import_picocolors.default.bold("  Fix suggestions:"));
+        for (const r of withVulns) {
+          console.log(`    ${import_picocolors.default.cyan("\u2192")} Run ${import_picocolors.default.cyan(`mcpman install ${r.server}@latest`)} to update`);
+        }
+        console.log();
+      }
+    }
+  }
+});
+
+// src/commands/doctor.ts
+init_cjs_shims();
+var import_citty2 = require("citty");
+var import_picocolors2 = __toESM(require("picocolors"), 1);
 
 // src/core/server-inventory.ts
 init_cjs_shims();
@@ -609,12 +1194,12 @@ async function quickHealthProbe(config, timeoutMs = 3e3) {
 
 // src/commands/doctor.ts
 var CHECK_ICON = {
-  pass: import_picocolors.default.green("\u2713"),
-  fail: import_picocolors.default.red("\u2717"),
-  skip: import_picocolors.default.dim("-"),
-  warn: import_picocolors.default.yellow("\u26A0")
+  pass: import_picocolors2.default.green("\u2713"),
+  fail: import_picocolors2.default.red("\u2717"),
+  skip: import_picocolors2.default.dim("-"),
+  warn: import_picocolors2.default.yellow("\u26A0")
 };
-var doctor_default = (0, import_citty.defineCommand)({
+var doctor_default = (0, import_citty2.defineCommand)({
   meta: {
     name: "doctor",
     description: "Check MCP server health and configuration"
@@ -627,10 +1212,10 @@ var doctor_default = (0, import_citty.defineCommand)({
     }
   },
   async run({ args }) {
-    console.log(import_picocolors.default.bold("\n  mcpman doctor\n"));
+    console.log(import_picocolors2.default.bold("\n  mcpman doctor\n"));
     const servers = await getInstalledServers();
     if (servers.length === 0) {
-      console.log(import_picocolors.default.dim("  No MCP servers installed. Run mcpman install <server> to get started."));
+      console.log(import_picocolors2.default.dim("  No MCP servers installed. Run mcpman install <server> to get started."));
       return;
     }
     const tasks = servers.map((s) => () => checkServerHealth(s.name, s.config));
@@ -642,14 +1227,14 @@ var doctor_default = (0, import_citty.defineCommand)({
       if (result.status === "healthy") passed++;
       else failed++;
     }
-    console.log(import_picocolors.default.dim("  " + "\u2500".repeat(50)));
+    console.log(import_picocolors2.default.dim("  " + "\u2500".repeat(50)));
     const parts = [];
-    if (passed > 0) parts.push(import_picocolors.default.green(`${passed} healthy`));
-    if (failed > 0) parts.push(import_picocolors.default.red(`${failed} unhealthy`));
+    if (passed > 0) parts.push(import_picocolors2.default.green(`${passed} healthy`));
+    if (failed > 0) parts.push(import_picocolors2.default.red(`${failed} unhealthy`));
     console.log(`  Summary: ${parts.join(", ")}`);
     if (failed > 0) {
       if (!args.fix) {
-        console.log(import_picocolors.default.dim(`  Run ${import_picocolors.default.cyan("mcpman doctor --fix")} for fix suggestions.
+        console.log(import_picocolors2.default.dim(`  Run ${import_picocolors2.default.cyan("mcpman doctor --fix")} for fix suggestions.
 `));
       }
       process.exit(1);
@@ -658,13 +1243,13 @@ var doctor_default = (0, import_citty.defineCommand)({
   }
 });
 function printServerResult(result, showFix) {
-  const icon = result.status === "healthy" ? import_picocolors.default.green("\u25CF") : import_picocolors.default.red("\u25CF");
-  console.log(`  ${icon} ${import_picocolors.default.bold(result.serverName)}`);
+  const icon = result.status === "healthy" ? import_picocolors2.default.green("\u25CF") : import_picocolors2.default.red("\u25CF");
+  console.log(`  ${icon} ${import_picocolors2.default.bold(result.serverName)}`);
   for (const check of result.checks) {
     const checkIcon = check.skipped ? CHECK_ICON.skip : check.passed ? CHECK_ICON.pass : CHECK_ICON.fail;
     console.log(`    ${checkIcon} ${check.name}: ${check.message}`);
     if (showFix && !check.passed && !check.skipped && check.fix) {
-      console.log(`      ${import_picocolors.default.yellow("\u2192")} Fix: ${import_picocolors.default.cyan(check.fix)}`);
+      console.log(`      ${import_picocolors2.default.yellow("\u2192")} Fix: ${import_picocolors2.default.cyan(check.fix)}`);
     }
   }
   console.log();
@@ -673,11 +1258,11 @@ async function runParallel(tasks, concurrency) {
   const results = [];
   const executing = /* @__PURE__ */ new Set();
   for (const task of tasks) {
-    const p5 = task().then((r) => {
+    const p9 = task().then((r) => {
       results.push(r);
-      executing.delete(p5);
+      executing.delete(p9);
     });
-    executing.add(p5);
+    executing.add(p9);
     if (executing.size >= concurrency) {
       await Promise.race(executing);
     }
@@ -688,72 +1273,9 @@ async function runParallel(tasks, concurrency) {
 
 // src/commands/init.ts
 init_cjs_shims();
-var import_citty2 = require("citty");
+var import_citty3 = require("citty");
 var p = __toESM(require("@clack/prompts"), 1);
-var import_node_path4 = __toESM(require("path"), 1);
-
-// src/core/lockfile.ts
-init_cjs_shims();
-var import_node_fs2 = __toESM(require("fs"), 1);
-var import_node_path3 = __toESM(require("path"), 1);
-var import_node_os2 = __toESM(require("os"), 1);
-var LOCKFILE_NAME = "mcpman.lock";
-function findLockfile() {
-  let dir = process.cwd();
-  while (true) {
-    const candidate = import_node_path3.default.join(dir, LOCKFILE_NAME);
-    if (import_node_fs2.default.existsSync(candidate)) return candidate;
-    const parent = import_node_path3.default.dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  return null;
-}
-function getGlobalLockfilePath() {
-  return import_node_path3.default.join(import_node_os2.default.homedir(), ".mcpman", LOCKFILE_NAME);
-}
-function resolveLockfilePath() {
-  return findLockfile() ?? getGlobalLockfilePath();
-}
-function readLockfile(filePath) {
-  const target = filePath ?? resolveLockfilePath();
-  if (!import_node_fs2.default.existsSync(target)) {
-    return { lockfileVersion: 1, servers: {} };
-  }
-  try {
-    const raw = import_node_fs2.default.readFileSync(target, "utf-8");
-    return JSON.parse(raw);
-  } catch {
-    return { lockfileVersion: 1, servers: {} };
-  }
-}
-function serialize(data) {
-  const sorted = {
-    lockfileVersion: data.lockfileVersion,
-    servers: Object.fromEntries(
-      Object.entries(data.servers).sort(([a], [b]) => a.localeCompare(b))
-    )
-  };
-  return JSON.stringify(sorted, null, 2) + "\n";
-}
-function writeLockfile(data, filePath) {
-  const target = filePath ?? resolveLockfilePath();
-  const dir = import_node_path3.default.dirname(target);
-  if (!import_node_fs2.default.existsSync(dir)) {
-    import_node_fs2.default.mkdirSync(dir, { recursive: true });
-  }
-  const tmp = `${target}.tmp`;
-  import_node_fs2.default.writeFileSync(tmp, serialize(data), "utf-8");
-  import_node_fs2.default.renameSync(tmp, target);
-}
-function addEntry(name, entry, filePath) {
-  const data = readLockfile(filePath);
-  data.servers[name] = entry;
-  writeLockfile(data, filePath);
-}
-function createEmptyLockfile(filePath) {
-  writeLockfile({ lockfileVersion: 1, servers: {} }, filePath);
-}
+var import_node_path5 = __toESM(require("path"), 1);
 
 // src/core/registry.ts
 init_cjs_shims();
@@ -865,22 +1387,34 @@ async function resolveFromGitHub(githubUrl) {
 }
 
 // src/commands/init.ts
-var init_default = (0, import_citty2.defineCommand)({
+var init_default = (0, import_citty3.defineCommand)({
   meta: {
     name: "init",
     description: "Initialize mcpman.lock in the current project"
   },
-  args: {},
-  async run() {
-    p.intro("mcpman init");
-    const targetPath = import_node_path4.default.join(process.cwd(), LOCKFILE_NAME);
-    const existing = findLockfile();
+  args: {
+    yes: {
+      type: "boolean",
+      alias: "y",
+      description: "Auto-import all servers without prompting",
+      default: false
+    }
+  },
+  async run({ args }) {
+    const nonInteractive = args.yes || !process.stdout.isTTY;
+    p.intro("mcpman init");
+    const targetPath = import_node_path5.default.join(process.cwd(), LOCKFILE_NAME);
+    const existing = findLockfile();
     if (existing) {
-      p.log.warn(`Lockfile already exists: ${existing}`);
-      const overwrite = await p.confirm({ message: "Overwrite?" });
-      if (p.isCancel(overwrite) || !overwrite) {
-        p.outro("Cancelled.");
-        return;
+      if (nonInteractive) {
+        p.log.warn(`Lockfile already exists: ${existing} \u2014 overwriting (non-interactive).`);
+      } else {
+        p.log.warn(`Lockfile already exists: ${existing}`);
+        const overwrite = await p.confirm({ message: "Overwrite?" });
+        if (p.isCancel(overwrite) || !overwrite) {
+          p.outro("Cancelled.");
+          return;
+        }
       }
     }
     let clients = [];
@@ -906,20 +1440,26 @@ var init_default = (0, import_citty2.defineCommand)({
       p.outro(`Created ${LOCKFILE_NAME} \u2014 add it to version control!`);
       return;
     }
-    const options = clientServers.map((cs) => ({
-      value: cs.client.type,
-      label: `${cs.client.displayName} (${Object.keys(cs.servers).length} servers)`
-    }));
-    const toImport = await p.multiselect({
-      message: "Import existing servers into lockfile?",
-      options,
-      required: false
-    });
-    if (p.isCancel(toImport)) {
-      p.outro(`Created empty ${LOCKFILE_NAME}`);
-      return;
+    let selected;
+    if (nonInteractive) {
+      selected = clientServers.map((cs) => cs.client.type);
+      p.log.info(`Non-interactive mode: importing all ${clientServers.length} client(s).`);
+    } else {
+      const options = clientServers.map((cs) => ({
+        value: cs.client.type,
+        label: `${cs.client.displayName} (${Object.keys(cs.servers).length} servers)`
+      }));
+      const toImport = await p.multiselect({
+        message: "Import existing servers into lockfile?",
+        options,
+        required: false
+      });
+      if (p.isCancel(toImport)) {
+        p.outro(`Created empty ${LOCKFILE_NAME}`);
+        return;
+      }
+      selected = toImport;
     }
-    const selected = toImport;
     let importCount = 0;
     for (const cs of clientServers) {
       if (!selected.includes(cs.client.type)) continue;
@@ -949,7 +1489,7 @@ var init_default = (0, import_citty2.defineCommand)({
 
 // src/commands/install.ts
 init_cjs_shims();
-var import_citty3 = require("citty");
+var import_citty4 = require("citty");
 
 // src/core/installer.ts
 init_cjs_shims();
@@ -1001,17 +1541,17 @@ async function loadClients() {
 }
 async function installServer(input, options = {}) {
   p2.intro("mcpman install");
-  const spinner2 = p2.spinner();
-  spinner2.start("Resolving server...");
+  const spinner5 = p2.spinner();
+  spinner5.start("Resolving server...");
   let metadata;
   try {
     metadata = await resolveServer(input);
   } catch (err) {
-    spinner2.stop("Resolution failed");
+    spinner5.stop("Resolution failed");
     p2.log.error(err instanceof Error ? err.message : String(err));
     process.exit(1);
   }
-  spinner2.stop(`Found: ${metadata.name}@${metadata.version}`);
+  spinner5.stop(`Found: ${metadata.name}@${metadata.version}`);
   const clients = await loadClients();
   if (clients.length === 0) {
     p2.log.warn("No supported AI clients detected on this machine.");
@@ -1065,18 +1605,18 @@ async function installServer(input, options = {}) {
     args: metadata.args,
     ...Object.keys(collectedEnv).length > 0 ? { env: collectedEnv } : {}
   };
-  spinner2.start("Writing config...");
+  spinner5.start("Writing config...");
   const clientTypes = [];
   for (const client of selectedClients) {
     try {
       await client.addServer(metadata.name, entry);
       clientTypes.push(client.type);
     } catch (err) {
-      spinner2.stop("Partial failure");
+      spinner5.stop("Partial failure");
       p2.log.warn(`Failed to write to ${client.displayName}: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
-  spinner2.stop("Config written");
+  spinner5.stop("Config written");
   const source = detectSource(input);
   const integrity = computeIntegrity(metadata.resolved);
   addEntry(metadata.name, {
@@ -1098,7 +1638,7 @@ async function installServer(input, options = {}) {
 
 // src/utils/logger.ts
 init_cjs_shims();
-var import_picocolors2 = __toESM(require("picocolors"), 1);
+var import_picocolors3 = __toESM(require("picocolors"), 1);
 var noColor = process.env.NO_COLOR !== void 0 || process.argv.includes("--no-color");
 var isVerbose = process.argv.includes("--verbose");
 var isJson = process.argv.includes("--json");
@@ -1107,11 +1647,11 @@ function colorize(fn, text2) {
 }
 function info(message) {
   if (isJson) return;
-  console.log(`${colorize(import_picocolors2.default.cyan, "i")} ${message}`);
+  console.log(`${colorize(import_picocolors3.default.cyan, "i")} ${message}`);
 }
 function error(message) {
   if (isJson) return;
-  console.error(`${colorize(import_picocolors2.default.red, "\u2717")} ${message}`);
+  console.error(`${colorize(import_picocolors3.default.red, "\u2717")} ${message}`);
 }
 function json(data) {
   console.log(JSON.stringify(data, null, 2));
@@ -1119,7 +1659,7 @@ function json(data) {
 
 // src/commands/install.ts
 var p3 = __toESM(require("@clack/prompts"), 1);
-var install_default = (0, import_citty3.defineCommand)({
+var install_default = (0, import_citty4.defineCommand)({
   meta: {
     name: "install",
     description: "Install an MCP server into one or more AI clients"
@@ -1182,14 +1722,14 @@ async function restoreFromLockfile() {
 
 // src/commands/list.ts
 init_cjs_shims();
-var import_citty4 = require("citty");
-var import_picocolors3 = __toESM(require("picocolors"), 1);
+var import_citty5 = require("citty");
+var import_picocolors4 = __toESM(require("picocolors"), 1);
 var STATUS_ICON = {
-  healthy: import_picocolors3.default.green("\u25CF"),
-  unhealthy: import_picocolors3.default.red("\u25CF"),
-  unknown: import_picocolors3.default.dim("\u25CB")
+  healthy: import_picocolors4.default.green("\u25CF"),
+  unhealthy: import_picocolors4.default.red("\u25CF"),
+  unknown: import_picocolors4.default.dim("\u25CB")
 };
-var list_default = (0, import_citty4.defineCommand)({
+var list_default = (0, import_citty5.defineCommand)({
   meta: {
     name: "list",
     description: "List installed MCP servers"
@@ -1209,13 +1749,13 @@ var list_default = (0, import_citty4.defineCommand)({
     const servers = await getInstalledServers(args.client);
     if (servers.length === 0) {
       const filter = args.client ? ` for client "${args.client}"` : "";
-      console.log(import_picocolors3.default.dim(`No MCP servers installed${filter}. Run ${import_picocolors3.default.cyan("mcpman install <server>")} to get started.`));
+      console.log(import_picocolors4.default.dim(`No MCP servers installed${filter}. Run ${import_picocolors4.default.cyan("mcpman install <server>")} to get started.`));
       return;
     }
     const withStatus = await Promise.all(
       servers.map(async (s) => ({
         ...s,
-        status: await quickHealthProbe(s.config, 3e3)
+        status: await quickHealthProbe(s.config, 5e3)
       }))
     );
     if (args.json) {
@@ -1233,8 +1773,8 @@ var list_default = (0, import_citty4.defineCommand)({
     const nameWidth = Math.max(4, ...withStatus.map((s) => s.name.length));
     const clientsWidth = Math.max(7, ...withStatus.map((s) => formatClients(s.clients).length));
     const header = `  ${pad("NAME", nameWidth)}  ${pad("CLIENT(S)", clientsWidth)}  ${pad("COMMAND", 20)}  STATUS`;
-    console.log(import_picocolors3.default.dim(header));
-    console.log(import_picocolors3.default.dim(`  ${"-".repeat(nameWidth)}  ${"-".repeat(clientsWidth)}  ${"-".repeat(20)}  ------`));
+    console.log(import_picocolors4.default.dim(header));
+    console.log(import_picocolors4.default.dim(`  ${"-".repeat(nameWidth)}  ${"-".repeat(clientsWidth)}  ${"-".repeat(20)}  ------`));
     for (const s of withStatus) {
       const icon = STATUS_ICON[s.status];
       const clientsStr = formatClients(s.clients);
@@ -1242,7 +1782,7 @@ var list_default = (0, import_citty4.defineCommand)({
       console.log(`  ${pad(s.name, nameWidth)}  ${pad(clientsStr, clientsWidth)}  ${pad(cmdStr, 20)}  ${icon} ${s.status}`);
     }
     const clientSet = new Set(withStatus.flatMap((s) => s.clients));
-    console.log(import_picocolors3.default.dim(`
+    console.log(import_picocolors4.default.dim(`
   ${withStatus.length} server${withStatus.length !== 1 ? "s" : ""} \xB7 ${clientSet.size} client${clientSet.size !== 1 ? "s" : ""}`));
   }
 });
@@ -1264,9 +1804,9 @@ function formatClients(clients) {
 
 // src/commands/remove.ts
 init_cjs_shims();
-var import_citty5 = require("citty");
+var import_citty6 = require("citty");
 var p4 = __toESM(require("@clack/prompts"), 1);
-var import_picocolors4 = __toESM(require("picocolors"), 1);
+var import_picocolors5 = __toESM(require("picocolors"), 1);
 init_client_detector();
 var CLIENT_DISPLAY2 = {
   "claude-desktop": "Claude",
@@ -1277,7 +1817,7 @@ var CLIENT_DISPLAY2 = {
 function clientDisplayName(type) {
   return CLIENT_DISPLAY2[type] ?? type;
 }
-var remove_default = (0, import_citty5.defineCommand)({
+var remove_default = (0, import_citty6.defineCommand)({
   meta: {
     name: "remove",
     description: "Remove an MCP server from one or more AI clients"
@@ -1304,7 +1844,7 @@ var remove_default = (0, import_citty5.defineCommand)({
     }
   },
   async run({ args }) {
-    p4.intro(import_picocolors4.default.bold("mcpman remove"));
+    p4.intro(import_picocolors5.default.bold("mcpman remove"));
     const serverName = args.server;
     const servers = await getInstalledServers();
     const match = servers.find((s) => s.name === serverName);
@@ -1312,7 +1852,7 @@ var remove_default = (0, import_citty5.defineCommand)({
       p4.log.warn(`Server "${serverName}" is not installed.`);
       const similar = servers.filter((s) => s.name.includes(serverName) || serverName.includes(s.name));
       if (similar.length > 0) {
-        p4.log.info(`Did you mean: ${similar.map((s) => import_picocolors4.default.cyan(s.name)).join(", ")}?`);
+        p4.log.info(`Did you mean: ${similar.map((s) => import_picocolors5.default.cyan(s.name)).join(", ")}?`);
       }
       p4.outro("Nothing to remove.");
       return;
@@ -1347,7 +1887,7 @@ var remove_default = (0, import_citty5.defineCommand)({
     if (!args.yes) {
       const clientNames = targetClients.map(clientDisplayName).join(", ");
       const confirmed = await p4.confirm({
-        message: `Remove ${import_picocolors4.default.cyan(serverName)} from ${import_picocolors4.default.yellow(clientNames)}?`
+        message: `Remove ${import_picocolors5.default.cyan(serverName)} from ${import_picocolors5.default.yellow(clientNames)}?`
       });
       if (p4.isCancel(confirmed) || !confirmed) {
         p4.outro("Cancelled.");
@@ -1372,17 +1912,697 @@ var remove_default = (0, import_citty5.defineCommand)({
     }
     if (errors.length > 0) {
       for (const e of errors) p4.log.error(e);
-      p4.outro(import_picocolors4.default.red("Completed with errors."));
+      p4.outro(import_picocolors5.default.red("Completed with errors."));
+      process.exit(1);
+    }
+    p4.outro(import_picocolors5.default.green(`Removed "${serverName}" successfully.`));
+  }
+});
+
+// src/commands/secrets.ts
+init_cjs_shims();
+var import_citty7 = require("citty");
+var import_picocolors6 = __toESM(require("picocolors"), 1);
+var p6 = __toESM(require("@clack/prompts"), 1);
+init_vault_service();
+function maskValue(value) {
+  if (value.length <= 8) return "***";
+  return `${value.slice(0, 4)}***${value.slice(-3)}`;
+}
+function parseKeyValue(input) {
+  const idx = input.indexOf("=");
+  if (idx <= 0) return null;
+  return { key: input.slice(0, idx), value: input.slice(idx + 1) };
+}
+var setCommand = (0, import_citty7.defineCommand)({
+  meta: { name: "set", description: "Store an encrypted secret for a server" },
+  args: {
+    server: {
+      type: "positional",
+      description: "Server name (e.g. @modelcontextprotocol/server-github)",
+      required: true
+    },
+    keyvalue: {
+      type: "positional",
+      description: "KEY=VALUE pair to store",
+      required: true
+    }
+  },
+  async run({ args }) {
+    const parsed = parseKeyValue(args.keyvalue);
+    if (!parsed) {
+      console.error(import_picocolors6.default.red("\u2717") + " Invalid format. Expected KEY=VALUE");
+      process.exit(1);
+    }
+    p6.intro(import_picocolors6.default.cyan("mcpman secrets set"));
+    const isNew = listSecrets(args.server).length === 0 || !listSecrets(args.server)[0]?.keys.includes(parsed.key);
+    const vaultPath = (await Promise.resolve().then(() => (init_vault_service(), vault_service_exports))).getVaultPath();
+    const vaultExists = (await import("fs")).existsSync(vaultPath);
+    const password2 = await getMasterPassword(!vaultExists && isNew);
+    const spin = p6.spinner();
+    spin.start("Encrypting secret...");
+    try {
+      setSecret(args.server, parsed.key, parsed.value, password2);
+      spin.stop(
+        `${import_picocolors6.default.green("\u2713")} Stored ${import_picocolors6.default.bold(parsed.key)} for ${import_picocolors6.default.cyan(args.server)}`
+      );
+    } catch (err) {
+      spin.stop(import_picocolors6.default.red("\u2717") + " Failed to store secret");
+      console.error(import_picocolors6.default.dim(String(err)));
+      process.exit(1);
+    }
+    p6.outro(import_picocolors6.default.dim("Secret encrypted and saved to vault."));
+  }
+});
+var listCommand = (0, import_citty7.defineCommand)({
+  meta: { name: "list", description: "List secret keys stored in the vault" },
+  args: {
+    server: {
+      type: "positional",
+      description: "Filter by server name (optional)",
+      required: false
+    }
+  },
+  async run({ args }) {
+    const results = listSecrets(args.server || void 0);
+    if (results.length === 0) {
+      const filter = args.server ? ` for ${import_picocolors6.default.cyan(args.server)}` : "";
+      console.log(import_picocolors6.default.dim(`No secrets stored${filter}.`));
+      return;
+    }
+    console.log("");
+    for (const { server, keys } of results) {
+      console.log(import_picocolors6.default.bold(import_picocolors6.default.cyan(server)));
+      for (const key of keys) {
+        console.log(`  ${import_picocolors6.default.green("\u25CF")} ${import_picocolors6.default.bold(key)}  ${import_picocolors6.default.dim(maskValue("\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022"))}`);
+      }
+      console.log("");
+    }
+    const total = results.reduce((n, r) => n + r.keys.length, 0);
+    console.log(import_picocolors6.default.dim(`  ${total} secret${total !== 1 ? "s" : ""} in ${results.length} server${results.length !== 1 ? "s" : ""}`));
+  }
+});
+var removeCommand = (0, import_citty7.defineCommand)({
+  meta: { name: "remove", description: "Delete a secret from the vault" },
+  args: {
+    server: {
+      type: "positional",
+      description: "Server name",
+      required: true
+    },
+    key: {
+      type: "positional",
+      description: "Secret key to remove",
+      required: true
+    }
+  },
+  async run({ args }) {
+    const confirmed = await p6.confirm({
+      message: `Remove ${import_picocolors6.default.bold(args.key)} from ${import_picocolors6.default.cyan(args.server)}?`,
+      initialValue: false
+    });
+    if (p6.isCancel(confirmed) || !confirmed) {
+      p6.cancel("Cancelled.");
+      return;
+    }
+    try {
+      removeSecret(args.server, args.key);
+      console.log(`${import_picocolors6.default.green("\u2713")} Removed ${import_picocolors6.default.bold(args.key)} from ${import_picocolors6.default.cyan(args.server)}`);
+    } catch (err) {
+      console.error(import_picocolors6.default.red("\u2717") + " Failed to remove secret");
+      console.error(import_picocolors6.default.dim(String(err)));
+      process.exit(1);
+    }
+  }
+});
+var secrets_default = (0, import_citty7.defineCommand)({
+  meta: {
+    name: "secrets",
+    description: "Manage encrypted secrets for MCP servers"
+  },
+  subCommands: {
+    set: setCommand,
+    list: listCommand,
+    remove: removeCommand
+  }
+});
+
+// src/commands/sync.ts
+init_cjs_shims();
+var import_citty8 = require("citty");
+var p7 = __toESM(require("@clack/prompts"), 1);
+var import_picocolors7 = __toESM(require("picocolors"), 1);
+
+// src/core/config-diff.ts
+init_cjs_shims();
+function reconstructServerEntry(lockEntry) {
+  const entry = {
+    command: lockEntry.command
+  };
+  if (lockEntry.args && lockEntry.args.length > 0) {
+    entry.args = lockEntry.args;
+  }
+  if (lockEntry.envVars && lockEntry.envVars.length > 0) {
+    entry.env = Object.fromEntries(lockEntry.envVars.map((k) => [k, ""]));
+  }
+  return entry;
+}
+function computeDiff(lockfile, clientConfigs) {
+  const actions = [];
+  for (const [server, lockEntry] of Object.entries(lockfile.servers)) {
+    for (const client of lockEntry.clients) {
+      const config = clientConfigs.get(client);
+      if (!config) continue;
+      if (server in config.servers) {
+        actions.push({ server, client, action: "ok" });
+      } else {
+        actions.push({
+          server,
+          client,
+          action: "add",
+          entry: reconstructServerEntry(lockEntry)
+        });
+      }
+    }
+  }
+  for (const [client, config] of clientConfigs) {
+    for (const server of Object.keys(config.servers)) {
+      if (!(server in lockfile.servers)) {
+        actions.push({ server, client, action: "extra" });
+      }
+    }
+  }
+  return actions;
+}
+function computeDiffFromClient(sourceClient, clientConfigs) {
+  const actions = [];
+  const sourceConfig = clientConfigs.get(sourceClient);
+  if (!sourceConfig) return [];
+  for (const [client, config] of clientConfigs) {
+    if (client === sourceClient) continue;
+    for (const [server, entry] of Object.entries(sourceConfig.servers)) {
+      if (server in config.servers) {
+        actions.push({ server, client, action: "ok" });
+      } else {
+        actions.push({ server, client, action: "add", entry });
+      }
+    }
+    for (const server of Object.keys(config.servers)) {
+      if (!(server in sourceConfig.servers)) {
+        actions.push({ server, client, action: "extra" });
+      }
+    }
+  }
+  return actions;
+}
+
+// src/core/sync-engine.ts
+init_cjs_shims();
+init_client_detector();
+async function applySyncActions(actions, clients) {
+  const result = { applied: 0, failed: 0, errors: [] };
+  const addActions = actions.filter((a) => a.action === "add" && a.entry);
+  for (const action of addActions) {
+    const handler = clients.get(action.client);
+    if (!handler || !action.entry) {
+      result.failed++;
+      result.errors.push({
+        server: action.server,
+        client: action.client,
+        error: "No handler available for client"
+      });
+      continue;
+    }
+    try {
+      await handler.addServer(action.server, action.entry);
+      result.applied++;
+    } catch (err) {
+      result.failed++;
+      result.errors.push({
+        server: action.server,
+        client: action.client,
+        error: String(err)
+      });
+    }
+  }
+  return result;
+}
+async function getClientConfigs() {
+  const configs = /* @__PURE__ */ new Map();
+  const handlers = /* @__PURE__ */ new Map();
+  let installedClients;
+  try {
+    installedClients = await getInstalledClients();
+  } catch {
+    return { configs, handlers };
+  }
+  await Promise.all(
+    installedClients.map(async (handler) => {
+      try {
+        const config = await handler.readConfig();
+        configs.set(handler.type, config);
+        handlers.set(handler.type, handler);
+      } catch (err) {
+        console.warn(`[mcpman] Warning: could not read config for ${handler.displayName}: ${String(err)}`);
+      }
+    })
+  );
+  return { configs, handlers };
+}
+
+// src/commands/sync.ts
+var VALID_CLIENTS = ["claude-desktop", "cursor", "vscode", "windsurf"];
+var CLIENT_DISPLAY3 = {
+  "claude-desktop": "Claude Desktop",
+  cursor: "Cursor",
+  vscode: "VS Code",
+  windsurf: "Windsurf"
+};
+var sync_default = (0, import_citty8.defineCommand)({
+  meta: {
+    name: "sync",
+    description: "Sync MCP server configs across all detected AI clients"
+  },
+  args: {
+    "dry-run": {
+      type: "boolean",
+      description: "Preview changes without applying them",
+      default: false
+    },
+    source: {
+      type: "string",
+      description: "Use a specific client as source of truth (claude-desktop, cursor, vscode, windsurf)"
+    },
+    yes: {
+      type: "boolean",
+      description: "Skip confirmation prompt",
+      default: false
+    }
+  },
+  async run({ args }) {
+    p7.intro(`${import_picocolors7.default.cyan("mcpman sync")}`);
+    const sourceClient = args.source;
+    if (sourceClient && !VALID_CLIENTS.includes(sourceClient)) {
+      p7.log.error(`Invalid --source "${sourceClient}". Must be one of: ${VALID_CLIENTS.join(", ")}`);
+      process.exit(1);
+    }
+    const spinner5 = p7.spinner();
+    spinner5.start("Detecting clients and reading configs...");
+    const { configs, handlers } = await getClientConfigs();
+    spinner5.stop(`Found ${configs.size} client(s)`);
+    if (configs.size === 0) {
+      p7.log.warn("No AI clients detected. Install Claude Desktop, Cursor, VS Code, or Windsurf first.");
+      process.exit(0);
+    }
+    let actions;
+    if (sourceClient) {
+      if (!configs.has(sourceClient)) {
+        p7.log.error(`Source client "${sourceClient}" is not detected or its config is unreadable.`);
+        process.exit(1);
+      }
+      p7.log.info(`Using ${CLIENT_DISPLAY3[sourceClient]} as source of truth`);
+      actions = computeDiffFromClient(sourceClient, configs);
+    } else {
+      const lockfile = readLockfile();
+      actions = computeDiff(lockfile, configs);
+    }
+    printDiffTable(actions);
+    const addCount = actions.filter((a) => a.action === "add").length;
+    const extraCount = actions.filter((a) => a.action === "extra").length;
+    if (addCount === 0 && extraCount === 0) {
+      p7.outro(import_picocolors7.default.green("All clients are in sync."));
+      process.exit(0);
+    }
+    const parts = [];
+    if (addCount > 0) parts.push(import_picocolors7.default.green(`${addCount} to add`));
+    if (extraCount > 0) parts.push(import_picocolors7.default.yellow(`${extraCount} extra (informational)`));
+    p7.log.info(parts.join("  \xB7  "));
+    if (args["dry-run"]) {
+      p7.outro(import_picocolors7.default.dim("Dry run \u2014 no changes applied."));
+      process.exit(1);
+    }
+    if (addCount === 0) {
+      p7.outro(import_picocolors7.default.dim("No additions needed. Extra servers left untouched."));
+      process.exit(1);
+    }
+    if (!args.yes) {
+      const confirmed = await p7.confirm({
+        message: `Apply ${addCount} addition(s) to client configs?`,
+        initialValue: true
+      });
+      if (p7.isCancel(confirmed) || !confirmed) {
+        p7.outro(import_picocolors7.default.dim("Cancelled \u2014 no changes applied."));
+        process.exit(0);
+      }
+    }
+    spinner5.start("Applying sync changes...");
+    const result = await applySyncActions(actions, handlers);
+    spinner5.stop("Done");
+    if (result.applied > 0) {
+      p7.log.success(`Added ${result.applied} server(s) to client configs.`);
+    }
+    if (result.failed > 0) {
+      for (const e of result.errors) {
+        p7.log.error(`Failed to add "${e.server}" to ${e.client}: ${e.error}`);
+      }
+    }
+    p7.outro(result.failed === 0 ? import_picocolors7.default.green("Sync complete.") : import_picocolors7.default.yellow("Sync complete with errors."));
+    process.exit(result.failed > 0 ? 1 : 0);
+  }
+});
+function printDiffTable(actions) {
+  if (actions.length === 0) {
+    p7.log.info("No actions to display.");
+    return;
+  }
+  const nameWidth = Math.max(6, ...actions.map((a) => a.server.length));
+  const clientWidth = Math.max(6, ...actions.map((a) => CLIENT_DISPLAY3[a.client]?.length ?? a.client.length));
+  const header = `  ${pad2("SERVER", nameWidth)}  ${pad2("CLIENT", clientWidth)}  STATUS`;
+  console.log(import_picocolors7.default.dim(header));
+  console.log(import_picocolors7.default.dim(`  ${"-".repeat(nameWidth)}  ${"-".repeat(clientWidth)}  ------`));
+  for (const action of actions) {
+    const clientDisplay = CLIENT_DISPLAY3[action.client] ?? action.client;
+    const [icon, statusText] = formatAction(action.action);
+    console.log(`  ${pad2(action.server, nameWidth)}  ${pad2(clientDisplay, clientWidth)}  ${icon} ${statusText}`);
+  }
+  console.log("");
+}
+function formatAction(action) {
+  switch (action) {
+    case "add":
+      return [import_picocolors7.default.green("+"), import_picocolors7.default.green("missing \u2014 will add")];
+    case "extra":
+      return [import_picocolors7.default.yellow("?"), import_picocolors7.default.yellow("extra (not in lockfile)")];
+    case "ok":
+      return [import_picocolors7.default.dim("\xB7"), import_picocolors7.default.dim("in sync")];
+  }
+}
+function pad2(s, width) {
+  return s.length >= width ? s : s + " ".repeat(width - s.length);
+}
+
+// src/commands/update.ts
+init_cjs_shims();
+var import_citty9 = require("citty");
+var p8 = __toESM(require("@clack/prompts"), 1);
+var import_picocolors9 = __toESM(require("picocolors"), 1);
+
+// src/core/version-checker.ts
+init_cjs_shims();
+function compareVersions(a, b) {
+  const aParts = a.replace(/^v/, "").split(".").map(Number);
+  const bParts = b.replace(/^v/, "").split(".").map(Number);
+  const len = Math.max(aParts.length, bParts.length);
+  for (let i = 0; i < len; i++) {
+    const aN = aParts[i] ?? 0;
+    const bN = bParts[i] ?? 0;
+    if (Number.isNaN(aN) || Number.isNaN(bN)) return 0;
+    if (aN < bN) return -1;
+    if (aN > bN) return 1;
+  }
+  return 0;
+}
+function detectUpdateType(current, latest) {
+  const cParts = current.replace(/^v/, "").split(".").map(Number);
+  const lParts = latest.replace(/^v/, "").split(".").map(Number);
+  if ((lParts[0] ?? 0) > (cParts[0] ?? 0)) return "major";
+  if ((lParts[1] ?? 0) > (cParts[1] ?? 0)) return "minor";
+  return "patch";
+}
+async function fetchNpmLatest(packageName) {
+  try {
+    const res = await fetch(
+      `https://registry.npmjs.org/${encodeURIComponent(packageName)}/latest`,
+      {
+        headers: { Accept: "application/json" },
+        signal: AbortSignal.timeout(8e3)
+      }
+    );
+    if (!res.ok) return null;
+    const data = await res.json();
+    return typeof data.version === "string" ? data.version : null;
+  } catch {
+    return null;
+  }
+}
+async function fetchSmitheryLatest(name) {
+  try {
+    const res = await fetch(
+      `https://registry.smithery.ai/servers/${encodeURIComponent(name)}`,
+      {
+        headers: { Accept: "application/json" },
+        signal: AbortSignal.timeout(8e3)
+      }
+    );
+    if (!res.ok) return null;
+    const data = await res.json();
+    return typeof data.version === "string" ? data.version : null;
+  } catch {
+    return null;
+  }
+}
+async function fetchGithubLatest(resolved) {
+  const match = resolved.match(/github\.com\/([^/]+)\/([^/]+)/);
+  if (!match) return null;
+  const [, owner, repo] = match;
+  try {
+    const res = await fetch(
+      `https://api.github.com/repos/${owner}/${repo}/releases/latest`,
+      {
+        headers: { Accept: "application/json" },
+        signal: AbortSignal.timeout(8e3)
+      }
+    );
+    if (!res.ok) return null;
+    const data = await res.json();
+    return typeof data.tag_name === "string" ? data.tag_name.replace(/^v/, "") : null;
+  } catch {
+    return null;
+  }
+}
+async function checkVersion(name, lockEntry) {
+  const current = lockEntry.version;
+  let latest = null;
+  if (lockEntry.source === "npm") {
+    latest = await fetchNpmLatest(name);
+  } else if (lockEntry.source === "smithery") {
+    latest = await fetchSmitheryLatest(name);
+  } else if (lockEntry.source === "github") {
+    latest = await fetchGithubLatest(lockEntry.resolved);
+  }
+  if (!latest || latest === current) {
+    return {
+      server: name,
+      source: lockEntry.source,
+      currentVersion: current,
+      latestVersion: latest ?? current,
+      hasUpdate: false
+    };
+  }
+  const hasUpdate = compareVersions(current, latest) === -1;
+  return {
+    server: name,
+    source: lockEntry.source,
+    currentVersion: current,
+    latestVersion: latest,
+    hasUpdate,
+    updateType: hasUpdate ? detectUpdateType(current, latest) : void 0
+  };
+}
+async function checkAllVersions(lockfile) {
+  const entries = Object.entries(lockfile.servers);
+  if (entries.length === 0) return [];
+  const results = [];
+  const executing = /* @__PURE__ */ new Set();
+  for (const [name, entry] of entries) {
+    const p9 = checkVersion(name, entry).then((r) => {
+      results.push(r);
+      executing.delete(p9);
+    });
+    executing.add(p9);
+    if (executing.size >= 5) {
+      await Promise.race(executing);
+    }
+  }
+  await Promise.all(executing);
+  return results;
+}
+
+// src/core/update-notifier.ts
+init_cjs_shims();
+var import_node_fs5 = __toESM(require("fs"), 1);
+var import_node_path7 = __toESM(require("path"), 1);
+var import_node_os5 = __toESM(require("os"), 1);
+var import_picocolors8 = __toESM(require("picocolors"), 1);
+var CACHE_FILE = import_node_path7.default.join(import_node_os5.default.homedir(), ".mcpman", ".update-check");
+var TTL_MS = 24 * 60 * 60 * 1e3;
+function writeUpdateCache(data) {
+  try {
+    const dir = import_node_path7.default.dirname(CACHE_FILE);
+    if (!import_node_fs5.default.existsSync(dir)) import_node_fs5.default.mkdirSync(dir, { recursive: true });
+    const tmp = `${CACHE_FILE}.tmp`;
+    import_node_fs5.default.writeFileSync(tmp, JSON.stringify(data, null, 2), "utf-8");
+    import_node_fs5.default.renameSync(tmp, CACHE_FILE);
+  } catch {
+  }
+}
+
+// src/commands/update.ts
+async function loadClients2() {
+  try {
+    const mod = await Promise.resolve().then(() => (init_client_detector(), client_detector_exports));
+    return mod.getInstalledClients();
+  } catch {
+    return [];
+  }
+}
+function printTable(updates) {
+  const NAME_W = 28;
+  const VER_W = 10;
+  const header = [
+    "NAME".padEnd(NAME_W),
+    "CURRENT".padEnd(VER_W),
+    "LATEST".padEnd(VER_W),
+    "STATUS"
+  ].join("  ");
+  console.log(import_picocolors9.default.bold(`
+  ${header}`));
+  console.log(import_picocolors9.default.dim(`  ${"\u2500".repeat(NAME_W + VER_W * 2 + 20)}`));
+  for (const u of updates) {
+    const nameCol = u.server.slice(0, NAME_W).padEnd(NAME_W);
+    const curCol = u.currentVersion.padEnd(VER_W);
+    const latCol = u.latestVersion.padEnd(VER_W);
+    const statusCol = u.hasUpdate ? import_picocolors9.default.yellow(`Update available${u.updateType ? ` [${u.updateType}]` : ""}`) : import_picocolors9.default.green("Up to date");
+    console.log(`  ${nameCol}  ${curCol}  ${latCol}  ${statusCol}`);
+  }
+  console.log();
+}
+var update_default = (0, import_citty9.defineCommand)({
+  meta: {
+    name: "update",
+    description: "Check for and apply updates to installed MCP servers"
+  },
+  args: {
+    server: {
+      type: "positional",
+      description: "Server name to update (omit to update all)",
+      required: false
+    },
+    check: {
+      type: "boolean",
+      description: "Check only \u2014 do not apply updates",
+      default: false
+    },
+    yes: {
+      type: "boolean",
+      description: "Skip confirmation prompt",
+      default: false
+    },
+    json: {
+      type: "boolean",
+      description: "Output results as JSON",
+      default: false
+    }
+  },
+  async run({ args }) {
+    const lockfile = readLockfile();
+    const servers = lockfile.servers;
+    const targetEntries = args.server ? Object.entries(servers).filter(([name]) => name === args.server) : Object.entries(servers);
+    if (targetEntries.length === 0) {
+      if (args.server) {
+        console.error(`Server '${args.server}' not found in lockfile.`);
+      } else {
+        console.log("No servers installed. Run mcpman install <server> first.");
+      }
       process.exit(1);
     }
-    p4.outro(import_picocolors4.default.green(`Removed "${serverName}" successfully.`));
+    const spinner5 = p8.spinner();
+    spinner5.start("Checking versions...");
+    let updates;
+    try {
+      const partialLock = {
+        lockfileVersion: 1,
+        servers: Object.fromEntries(targetEntries)
+      };
+      updates = await checkAllVersions(partialLock);
+    } catch (err) {
+      spinner5.stop("Version check failed");
+      console.error(err instanceof Error ? err.message : String(err));
+      process.exit(1);
+    }
+    spinner5.stop(`Checked ${updates.length} server(s)`);
+    if (args.json) {
+      console.log(JSON.stringify(updates, null, 2));
+      return;
+    }
+    printTable(updates);
+    const outdated = updates.filter((u) => u.hasUpdate);
+    if (outdated.length === 0) {
+      console.log(import_picocolors9.default.green("  All servers are up to date."));
+      return;
+    }
+    if (args.check) {
+      console.log(import_picocolors9.default.yellow(`  ${outdated.length} update(s) available. Run mcpman update to apply.`));
+      return;
+    }
+    if (!args.yes) {
+      const confirmed = await p8.confirm({
+        message: `Apply ${outdated.length} update(s)?`,
+        initialValue: true
+      });
+      if (p8.isCancel(confirmed) || !confirmed) {
+        p8.outro("Cancelled.");
+        return;
+      }
+    }
+    const clients = await loadClients2();
+    let successCount = 0;
+    for (const update of outdated) {
+      const lockEntry = servers[update.server];
+      const input = lockEntry.source === "smithery" ? `smithery:${update.server}` : lockEntry.source === "github" ? lockEntry.resolved : update.server;
+      const s = p8.spinner();
+      s.start(`Updating ${update.server}...`);
+      try {
+        const metadata = await resolveServer(input);
+        const integrity = computeIntegrity(metadata.resolved);
+        addEntry(update.server, {
+          ...lockEntry,
+          version: metadata.version,
+          resolved: metadata.resolved,
+          integrity,
+          command: metadata.command,
+          args: metadata.args,
+          installedAt: (/* @__PURE__ */ new Date()).toISOString()
+        });
+        const entryClients = clients.filter(
+          (c) => lockEntry.clients.includes(c.type)
+        );
+        for (const client of entryClients) {
+          try {
+            await client.addServer(update.server, {
+              command: metadata.command,
+              args: metadata.args
+            });
+          } catch {
+          }
+        }
+        s.stop(`${import_picocolors9.default.green("\u2713")} ${update.server}: ${update.currentVersion} \u2192 ${metadata.version}`);
+        successCount++;
+      } catch (err) {
+        s.stop(`${import_picocolors9.default.red("\u2717")} ${update.server}: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+    const freshLockfile = readLockfile(resolveLockfilePath());
+    const freshUpdates = await checkAllVersions(freshLockfile);
+    writeUpdateCache({ lastCheck: (/* @__PURE__ */ new Date()).toISOString(), updates: freshUpdates });
+    p8.outro(`${successCount} of ${outdated.length} server(s) updated.`);
   }
 });
 
 // src/utils/constants.ts
 init_cjs_shims();
 var APP_NAME = "mcpman";
-var APP_VERSION = "0.1.0";
+var APP_VERSION = "0.2.0";
 var APP_DESCRIPTION = "The package manager for MCP servers";
 
 // src/index.ts
@@ -1390,7 +2610,7 @@ process.on("SIGINT", () => {
   console.log("\nAborted.");
   process.exit(130);
 });
-var main = (0, import_citty6.defineCommand)({
+var main = (0, import_citty10.defineCommand)({
   meta: {
     name: APP_NAME,
     version: APP_VERSION,
@@ -1401,7 +2621,11 @@ var main = (0, import_citty6.defineCommand)({
     list: list_default,
     remove: remove_default,
     doctor: doctor_default,
-    init: init_default
+    init: init_default,
+    secrets: secrets_default,
+    sync: sync_default,
+    audit: audit_default,
+    update: update_default
   }
 });
-(0, import_citty6.runMain)(main);
+(0, import_citty10.runMain)(main);