npm - mcpman - Versions diffs - 0.7.0 → 0.8.0 - Mend

mcpman 0.7.0 → 0.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (10) hide show

package/README.md +85 -0
package/dist/chunk-AOCGFOA6.js +80 -0
package/dist/chunk-DZ3D5RZQ.js +181 -0
package/dist/{chunk-NS6HV723.js → chunk-XPYCEHZZ.js} +6 -62
package/dist/{client-detector-CY7WPF3K.js → client-detector-NHXBDNMY.js} +2 -1
package/dist/index.cjs +1798 -696
package/dist/index.js +1527 -544
package/dist/{lockfile-RBA7HB24.js → lockfile-5XXA26FM.js} +2 -1
package/package.json +1 -1
package/dist/chunk-YZNTMR6O.js +0 -88

package/dist/index.cjs CHANGED Viewed

@@ -37,6 +37,166 @@ var init_cjs_shims = __esm({
   }
 });
+// src/utils/paths.ts
+function getHomedir() {
+  return import_node_os.default.homedir();
+}
+function getMcpmanDir() {
+  return import_node_path.default.join(import_node_os.default.homedir(), ".mcpman");
+}
+function getConfigPath() {
+  return import_node_path.default.join(getMcpmanDir(), "config.json");
+}
+function getPluginDir() {
+  return import_node_path.default.join(getMcpmanDir(), "plugins");
+}
+function getProfilesDir() {
+  return import_node_path.default.join(getMcpmanDir(), "profiles");
+}
+function getEnvDir() {
+  return import_node_path.default.join(getMcpmanDir(), "env");
+}
+function getGroupsFile() {
+  return import_node_path.default.join(getMcpmanDir(), "groups.json");
+}
+function getPinsFile() {
+  return import_node_path.default.join(getMcpmanDir(), "pins.json");
+}
+function getRollbackDir() {
+  return import_node_path.default.join(getMcpmanDir(), "rollback");
+}
+function getAppDataDir() {
+  const home = getHomedir();
+  if (process.platform === "darwin") {
+    return import_node_path.default.join(home, "Library", "Application Support");
+  }
+  if (process.platform === "win32") {
+    return process.env.APPDATA ?? import_node_path.default.join(home, "AppData", "Roaming");
+  }
+  return process.env.XDG_CONFIG_HOME ?? import_node_path.default.join(home, ".config");
+}
+function resolveConfigPath(client) {
+  const appData = getAppDataDir();
+  const home = getHomedir();
+  switch (client) {
+    case "claude-desktop":
+      return import_node_path.default.join(appData, "Claude", "claude_desktop_config.json");
+    case "cursor":
+      return import_node_path.default.join(appData, "Cursor", "User", "globalStorage", "cursor.mcp", "mcp.json");
+    case "windsurf":
+      return import_node_path.default.join(
+        appData,
+        "Windsurf",
+        "User",
+        "globalStorage",
+        "windsurf.mcpConfigJson",
+        "mcp.json"
+      );
+    case "vscode":
+      if (process.platform === "darwin") {
+        return import_node_path.default.join(appData, "Code", "User", "settings.json");
+      }
+      if (process.platform === "win32") {
+        return import_node_path.default.join(appData, "Code", "User", "settings.json");
+      }
+      return import_node_path.default.join(home, ".config", "Code", "User", "settings.json");
+  }
+}
+var import_node_os, import_node_path;
+var init_paths = __esm({
+  "src/utils/paths.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_node_os = __toESM(require("os"), 1);
+    import_node_path = __toESM(require("path"), 1);
+  }
+});
+// src/core/rollback-service.ts
+function ensureDir(dir) {
+  if (!import_node_fs.default.existsSync(dir)) import_node_fs.default.mkdirSync(dir, { recursive: true });
+}
+function listSnapshotFiles(dir) {
+  if (!import_node_fs.default.existsSync(dir)) return [];
+  return import_node_fs.default.readdirSync(dir).filter((f) => f.endsWith(".json")).sort();
+}
+function snapshotBeforeWrite(content, rollbackDir) {
+  const dir = rollbackDir ?? getRollbackDir();
+  ensureDir(dir);
+  const existing = listSnapshotFiles(dir);
+  if (existing.length > 0) {
+    const latest = existing[existing.length - 1];
+    try {
+      const prev = import_node_fs.default.readFileSync(import_node_path2.default.join(dir, latest), "utf-8");
+      if (prev === content) return;
+    } catch {
+    }
+  }
+  const ts = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  const filename = `${ts}.json`;
+  import_node_fs.default.writeFileSync(import_node_path2.default.join(dir, filename), content, "utf-8");
+  evictOldSnapshots(dir);
+}
+function evictOldSnapshots(rollbackDir) {
+  const dir = rollbackDir ?? getRollbackDir();
+  const files = listSnapshotFiles(dir);
+  const excess = files.length - MAX_SNAPSHOTS;
+  for (let i = 0; i < excess; i++) {
+    try {
+      import_node_fs.default.unlinkSync(import_node_path2.default.join(dir, files[i]));
+    } catch {
+    }
+  }
+}
+function listSnapshots(rollbackDir) {
+  const dir = rollbackDir ?? getRollbackDir();
+  const files = listSnapshotFiles(dir).reverse();
+  return files.map((filename, index) => {
+    const filepath = import_node_path2.default.join(dir, filename);
+    let sizeBytes = 0;
+    let createdAt = "";
+    try {
+      const stat = import_node_fs.default.statSync(filepath);
+      sizeBytes = stat.size;
+      createdAt = stat.mtime.toISOString();
+    } catch {
+    }
+    return { index, filename, createdAt, sizeBytes };
+  });
+}
+function readSnapshot(index, rollbackDir) {
+  const dir = rollbackDir ?? getRollbackDir();
+  const files = listSnapshotFiles(dir).reverse();
+  const filename = files[index];
+  if (!filename) return null;
+  try {
+    return import_node_fs.default.readFileSync(import_node_path2.default.join(dir, filename), "utf-8");
+  } catch {
+    return null;
+  }
+}
+function restoreSnapshot(index, targetPath, rollbackDir) {
+  const content = readSnapshot(index, rollbackDir);
+  if (content === null) return null;
+  const dir = import_node_path2.default.dirname(targetPath);
+  if (!import_node_fs.default.existsSync(dir)) import_node_fs.default.mkdirSync(dir, { recursive: true });
+  const tmp = `${targetPath}.tmp`;
+  import_node_fs.default.writeFileSync(tmp, content, "utf-8");
+  import_node_fs.default.renameSync(tmp, targetPath);
+  return content;
+}
+var import_node_fs, import_node_path2, MAX_SNAPSHOTS;
+var init_rollback_service = __esm({
+  "src/core/rollback-service.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_node_fs = __toESM(require("fs"), 1);
+    import_node_path2 = __toESM(require("path"), 1);
+    init_paths();
+    MAX_SNAPSHOTS = 5;
+  }
+});
 // src/core/lockfile.ts
 var lockfile_exports = {};
 __export(lockfile_exports, {
@@ -54,27 +214,27 @@ __export(lockfile_exports, {
 function findLockfile() {
   let dir = process.cwd();
   while (true) {
-    const candidate = import_node_path.default.join(dir, LOCKFILE_NAME);
-    if (import_node_fs.default.existsSync(candidate)) return candidate;
-    const parent = import_node_path.default.dirname(dir);
+    const candidate = import_node_path3.default.join(dir, LOCKFILE_NAME);
+    if (import_node_fs2.default.existsSync(candidate)) return candidate;
+    const parent = import_node_path3.default.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
   return null;
 }
 function getGlobalLockfilePath() {
-  return import_node_path.default.join(import_node_os.default.homedir(), ".mcpman", LOCKFILE_NAME);
+  return import_node_path3.default.join(import_node_os2.default.homedir(), ".mcpman", LOCKFILE_NAME);
 }
 function resolveLockfilePath() {
   return findLockfile() ?? getGlobalLockfilePath();
 }
 function readLockfile(filePath) {
   const target = filePath ?? resolveLockfilePath();
-  if (!import_node_fs.default.existsSync(target)) {
+  if (!import_node_fs2.default.existsSync(target)) {
     return { lockfileVersion: 1, servers: {} };
   }
   try {
-    const raw = import_node_fs.default.readFileSync(target, "utf-8");
+    const raw = import_node_fs2.default.readFileSync(target, "utf-8");
     return JSON.parse(raw);
   } catch {
     return { lockfileVersion: 1, servers: {} };
@@ -92,13 +252,21 @@ function serialize(data) {
 }
 function writeLockfile(data, filePath) {
   const target = filePath ?? resolveLockfilePath();
-  const dir = import_node_path.default.dirname(target);
-  if (!import_node_fs.default.existsSync(dir)) {
-    import_node_fs.default.mkdirSync(dir, { recursive: true });
+  const dir = import_node_path3.default.dirname(target);
+  if (!import_node_fs2.default.existsSync(dir)) {
+    import_node_fs2.default.mkdirSync(dir, { recursive: true });
+  }
+  const serialized = serialize(data);
+  if (import_node_fs2.default.existsSync(target)) {
+    try {
+      const current = import_node_fs2.default.readFileSync(target, "utf-8");
+      snapshotBeforeWrite(current);
+    } catch {
+    }
   }
   const tmp = `${target}.tmp`;
-  import_node_fs.default.writeFileSync(tmp, serialize(data), "utf-8");
-  import_node_fs.default.renameSync(tmp, target);
+  import_node_fs2.default.writeFileSync(tmp, serialized, "utf-8");
+  import_node_fs2.default.renameSync(tmp, target);
 }
 function addEntry(name, entry, filePath) {
   const data = readLockfile(filePath);
@@ -119,14 +287,15 @@ function getLockedVersion(name, filePath) {
 function createEmptyLockfile(filePath) {
   writeLockfile({ lockfileVersion: 1, servers: {} }, filePath);
 }
-var import_node_fs, import_node_os, import_node_path, LOCKFILE_NAME;
+var import_node_fs2, import_node_os2, import_node_path3, LOCKFILE_NAME;
 var init_lockfile = __esm({
   "src/core/lockfile.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_fs = __toESM(require("fs"), 1);
-    import_node_os = __toESM(require("os"), 1);
-    import_node_path = __toESM(require("path"), 1);
+    import_node_fs2 = __toESM(require("fs"), 1);
+    import_node_os2 = __toESM(require("os"), 1);
+    import_node_path3 = __toESM(require("path"), 1);
+    init_rollback_service();
     LOCKFILE_NAME = "mcpman.lock";
   }
 });
@@ -215,69 +384,6 @@ var init_trust_scorer = __esm({
   }
 });
-// src/utils/paths.ts
-function getHomedir() {
-  return import_node_os3.default.homedir();
-}
-function getMcpmanDir() {
-  return import_node_path3.default.join(import_node_os3.default.homedir(), ".mcpman");
-}
-function getConfigPath() {
-  return import_node_path3.default.join(getMcpmanDir(), "config.json");
-}
-function getPluginDir() {
-  return import_node_path3.default.join(getMcpmanDir(), "plugins");
-}
-function getProfilesDir() {
-  return import_node_path3.default.join(getMcpmanDir(), "profiles");
-}
-function getAppDataDir() {
-  const home = getHomedir();
-  if (process.platform === "darwin") {
-    return import_node_path3.default.join(home, "Library", "Application Support");
-  }
-  if (process.platform === "win32") {
-    return process.env.APPDATA ?? import_node_path3.default.join(home, "AppData", "Roaming");
-  }
-  return process.env.XDG_CONFIG_HOME ?? import_node_path3.default.join(home, ".config");
-}
-function resolveConfigPath(client) {
-  const appData = getAppDataDir();
-  const home = getHomedir();
-  switch (client) {
-    case "claude-desktop":
-      return import_node_path3.default.join(appData, "Claude", "claude_desktop_config.json");
-    case "cursor":
-      return import_node_path3.default.join(appData, "Cursor", "User", "globalStorage", "cursor.mcp", "mcp.json");
-    case "windsurf":
-      return import_node_path3.default.join(
-        appData,
-        "Windsurf",
-        "User",
-        "globalStorage",
-        "windsurf.mcpConfigJson",
-        "mcp.json"
-      );
-    case "vscode":
-      if (process.platform === "darwin") {
-        return import_node_path3.default.join(appData, "Code", "User", "settings.json");
-      }
-      if (process.platform === "win32") {
-        return import_node_path3.default.join(appData, "Code", "User", "settings.json");
-      }
-      return import_node_path3.default.join(home, ".config", "Code", "User", "settings.json");
-  }
-}
-var import_node_os3, import_node_path3;
-var init_paths = __esm({
-  "src/utils/paths.ts"() {
-    "use strict";
-    init_cjs_shims();
-    import_node_os3 = __toESM(require("os"), 1);
-    import_node_path3 = __toESM(require("path"), 1);
-  }
-});
 // src/clients/types.ts
 var ConfigParseError, ConfigWriteError;
 var init_types = __esm({
@@ -305,43 +411,43 @@ var init_types = __esm({
 async function atomicWrite(filePath, content) {
   const tmpPath = `${filePath}.tmp`;
   try {
-    await import_node_fs5.default.promises.mkdir(import_node_path6.default.dirname(filePath), { recursive: true });
-    await import_node_fs5.default.promises.writeFile(tmpPath, content, { encoding: "utf-8", mode: 384 });
-    await import_node_fs5.default.promises.rename(tmpPath, filePath);
+    await import_node_fs7.default.promises.mkdir(import_node_path7.default.dirname(filePath), { recursive: true });
+    await import_node_fs7.default.promises.writeFile(tmpPath, content, { encoding: "utf-8", mode: 384 });
+    await import_node_fs7.default.promises.rename(tmpPath, filePath);
   } catch (err) {
     try {
-      await import_node_fs5.default.promises.unlink(tmpPath);
+      await import_node_fs7.default.promises.unlink(tmpPath);
     } catch {
     }
     throw err;
   }
 }
-async function pathExists(p13) {
+async function pathExists(p14) {
   try {
-    await import_node_fs5.default.promises.access(p13);
+    await import_node_fs7.default.promises.access(p14);
     return true;
   } catch {
     return false;
   }
 }
-var import_node_fs5, import_node_path6, BaseClientHandler;
+var import_node_fs7, import_node_path7, BaseClientHandler;
 var init_base_client_handler = __esm({
   "src/clients/base-client-handler.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_fs5 = __toESM(require("fs"), 1);
-    import_node_path6 = __toESM(require("path"), 1);
+    import_node_fs7 = __toESM(require("fs"), 1);
+    import_node_path7 = __toESM(require("path"), 1);
     init_types();
     BaseClientHandler = class {
       async isInstalled() {
-        const dir = import_node_path6.default.dirname(this.getConfigPath());
+        const dir = import_node_path7.default.dirname(this.getConfigPath());
         return pathExists(dir);
       }
       /** Read raw JSON from disk, return empty object if file missing */
       async readRaw() {
         const configPath = this.getConfigPath();
         try {
-          const raw = await import_node_fs5.default.promises.readFile(configPath, "utf-8");
+          const raw = await import_node_fs7.default.promises.readFile(configPath, "utf-8");
           return JSON.parse(raw);
         } catch (err) {
           if (err.code === "ENOENT") {
@@ -531,12 +637,12 @@ __export(vault_service_exports, {
   writeVault: () => writeVault
 });
 function getVaultPath() {
-  return import_node_path10.default.join(import_node_os5.default.homedir(), ".mcpman", "vault.enc");
+  return import_node_path12.default.join(import_node_os5.default.homedir(), ".mcpman", "vault.enc");
 }
 function readVault(vaultPath = getVaultPath()) {
   const empty = { version: 1, servers: {} };
   try {
-    const raw = import_node_fs8.default.readFileSync(vaultPath, "utf-8");
+    const raw = import_node_fs11.default.readFileSync(vaultPath, "utf-8");
     const parsed = JSON.parse(raw);
     if (parsed.version !== 1 || typeof parsed.servers !== "object") return empty;
     return parsed;
@@ -545,16 +651,16 @@ function readVault(vaultPath = getVaultPath()) {
   }
 }
 function writeVault(data, vaultPath = getVaultPath()) {
-  const dir = import_node_path10.default.dirname(vaultPath);
-  import_node_fs8.default.mkdirSync(dir, { recursive: true });
+  const dir = import_node_path12.default.dirname(vaultPath);
+  import_node_fs11.default.mkdirSync(dir, { recursive: true });
   const tmp = `${vaultPath}.tmp`;
-  import_node_fs8.default.writeFileSync(tmp, JSON.stringify(data, null, 2), { mode: 384 });
+  import_node_fs11.default.writeFileSync(tmp, JSON.stringify(data, null, 2), { mode: 384 });
   if (process.platform !== "win32") {
-    import_node_fs8.default.chmodSync(tmp, 384);
+    import_node_fs11.default.chmodSync(tmp, 384);
   }
-  import_node_fs8.default.renameSync(tmp, vaultPath);
+  import_node_fs11.default.renameSync(tmp, vaultPath);
   if (process.platform !== "win32") {
-    import_node_fs8.default.chmodSync(vaultPath, 384);
+    import_node_fs11.default.chmodSync(vaultPath, 384);
   }
 }
 function encrypt(value, password2) {
@@ -581,7 +687,7 @@ function decrypt(entry, password2) {
   ]);
   return decrypted.toString("utf-8");
 }
-async function getMasterPassword(confirm10 = false) {
+async function getMasterPassword(confirm11 = false) {
   if (_cachedPassword) return _cachedPassword;
   const password2 = await p3.password({
     message: "Enter vault master password:",
@@ -591,7 +697,7 @@ async function getMasterPassword(confirm10 = false) {
     p3.cancel("Vault access cancelled.");
     process.exit(0);
   }
-  if (confirm10) {
+  if (confirm11) {
     const confirm22 = await p3.password({ message: "Confirm master password:" });
     if (p3.isCancel(confirm22) || confirm22 !== password2) {
       p3.cancel("Passwords do not match.");
@@ -644,15 +750,15 @@ function listSecrets(server, vaultPath = getVaultPath()) {
     keys: Object.keys(keys)
   }));
 }
-var import_node_crypto2, import_node_fs8, import_node_os5, import_node_path10, p3, _cachedPassword;
+var import_node_crypto2, import_node_fs11, import_node_os5, import_node_path12, p3, _cachedPassword;
 var init_vault_service = __esm({
   "src/core/vault-service.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_crypto2 = __toESM(require("crypto"), 1);
-    import_node_fs8 = __toESM(require("fs"), 1);
+    import_node_fs11 = __toESM(require("fs"), 1);
     import_node_os5 = __toESM(require("os"), 1);
-    import_node_path10 = __toESM(require("path"), 1);
+    import_node_path12 = __toESM(require("path"), 1);
     p3 = __toESM(require("@clack/prompts"), 1);
     _cachedPassword = null;
     process.on("exit", () => {
@@ -663,7 +769,7 @@ var init_vault_service = __esm({
 // src/index.ts
 init_cjs_shims();
-var import_citty27 = require("citty");
+var import_citty33 = require("citty");
 // src/commands/audit.ts
 init_cjs_shims();
@@ -675,25 +781,25 @@ init_lockfile();
 // src/core/security-scanner.ts
 init_cjs_shims();
-var import_node_fs2 = __toESM(require("fs"), 1);
-var import_node_os2 = __toESM(require("os"), 1);
-var import_node_path2 = __toESM(require("path"), 1);
-var CACHE_PATH = import_node_path2.default.join(import_node_os2.default.homedir(), ".mcpman", ".audit-cache.json");
+var import_node_fs3 = __toESM(require("fs"), 1);
+var import_node_os3 = __toESM(require("os"), 1);
+var import_node_path4 = __toESM(require("path"), 1);
+var CACHE_PATH = import_node_path4.default.join(import_node_os3.default.homedir(), ".mcpman", ".audit-cache.json");
 var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
 function readCache() {
   try {
-    if (!import_node_fs2.default.existsSync(CACHE_PATH)) return {};
-    return JSON.parse(import_node_fs2.default.readFileSync(CACHE_PATH, "utf-8"));
+    if (!import_node_fs3.default.existsSync(CACHE_PATH)) return {};
+    return JSON.parse(import_node_fs3.default.readFileSync(CACHE_PATH, "utf-8"));
   } catch {
     return {};
   }
 }
 function writeCache(cache) {
-  const dir = import_node_path2.default.dirname(CACHE_PATH);
-  if (!import_node_fs2.default.existsSync(dir)) import_node_fs2.default.mkdirSync(dir, { recursive: true });
+  const dir = import_node_path4.default.dirname(CACHE_PATH);
+  if (!import_node_fs3.default.existsSync(dir)) import_node_fs3.default.mkdirSync(dir, { recursive: true });
   const tmp = `${CACHE_PATH}.tmp`;
-  import_node_fs2.default.writeFileSync(tmp, JSON.stringify(cache, null, 2), "utf-8");
-  import_node_fs2.default.renameSync(tmp, CACHE_PATH);
+  import_node_fs3.default.writeFileSync(tmp, JSON.stringify(cache, null, 2), "utf-8");
+  import_node_fs3.default.renameSync(tmp, CACHE_PATH);
 }
 function getCachedReport(name, version) {
   const cache = readCache();
@@ -804,11 +910,11 @@ async function scanAllServers(servers, concurrency = 3) {
   const results = [];
   const executing = /* @__PURE__ */ new Set();
   for (const [name, entry] of entries) {
-    const p13 = scanServer(name, entry).then((r) => {
+    const p14 = scanServer(name, entry).then((r) => {
       results.push(r);
-      executing.delete(p13);
+      executing.delete(p14);
     });
-    executing.add(p13);
+    executing.add(p14);
     if (executing.size >= concurrency) await Promise.race(executing);
   }
   await Promise.all(executing);
@@ -932,15 +1038,15 @@ init_cjs_shims();
 // src/core/plugin-loader.ts
 init_cjs_shims();
 var import_node_child_process = require("child_process");
-var import_node_fs4 = __toESM(require("fs"), 1);
+var import_node_fs5 = __toESM(require("fs"), 1);
 var import_node_module = require("module");
-var import_node_path5 = __toESM(require("path"), 1);
+var import_node_path6 = __toESM(require("path"), 1);
 init_paths();
 // src/core/config-service.ts
 init_cjs_shims();
-var import_node_fs3 = __toESM(require("fs"), 1);
-var import_node_path4 = __toESM(require("path"), 1);
+var import_node_fs4 = __toESM(require("fs"), 1);
+var import_node_path5 = __toESM(require("path"), 1);
 init_paths();
 var VALID_KEYS = /* @__PURE__ */ new Set([
   "defaultClient",
@@ -951,7 +1057,7 @@ var VALID_KEYS = /* @__PURE__ */ new Set([
 ]);
 function readConfig(configPath = getConfigPath()) {
   try {
-    const raw = import_node_fs3.default.readFileSync(configPath, "utf-8");
+    const raw = import_node_fs4.default.readFileSync(configPath, "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
       return {};
@@ -962,11 +1068,11 @@ function readConfig(configPath = getConfigPath()) {
   }
 }
 function writeConfig(data, configPath = getConfigPath()) {
-  const dir = import_node_path4.default.dirname(configPath);
-  import_node_fs3.default.mkdirSync(dir, { recursive: true });
+  const dir = import_node_path5.default.dirname(configPath);
+  import_node_fs4.default.mkdirSync(dir, { recursive: true });
   const tmp = `${configPath}.tmp`;
-  import_node_fs3.default.writeFileSync(tmp, JSON.stringify(data, null, 2), { encoding: "utf-8" });
-  import_node_fs3.default.renameSync(tmp, configPath);
+  import_node_fs4.default.writeFileSync(tmp, JSON.stringify(data, null, 2), { encoding: "utf-8" });
+  import_node_fs4.default.renameSync(tmp, configPath);
 }
 function getConfigValue(key, configPath = getConfigPath()) {
   const data = readConfig(configPath);
@@ -985,13 +1091,13 @@ function setConfigValue(key, value, configPath = getConfigPath()) {
 // src/core/plugin-loader.ts
 function isValidPlugin(obj) {
   if (typeof obj !== "object" || obj === null) return false;
-  const p13 = obj;
-  return typeof p13.name === "string" && typeof p13.prefix === "string" && typeof p13.resolve === "function";
+  const p14 = obj;
+  return typeof p14.name === "string" && typeof p14.prefix === "string" && typeof p14.resolve === "function";
 }
 function loadPlugin(pkg, pluginDir = getPluginDir()) {
   try {
-    const requirePath = import_node_path5.default.join(pluginDir, "node_modules", pkg);
-    const pluginRequire = (0, import_node_module.createRequire)(import_node_path5.default.join(pluginDir, "index.js"));
+    const requirePath = import_node_path6.default.join(pluginDir, "node_modules", pkg);
+    const pluginRequire = (0, import_node_module.createRequire)(import_node_path6.default.join(pluginDir, "index.js"));
     const mod = pluginRequire(requirePath);
     const exported = mod?.default ?? mod;
     if (isValidPlugin(exported)) return exported;
@@ -1011,10 +1117,10 @@ function loadAllPlugins(pluginDir = getPluginDir()) {
   return plugins;
 }
 function installPluginPackage(name, pluginDir = getPluginDir()) {
-  import_node_fs4.default.mkdirSync(pluginDir, { recursive: true });
-  const pkgJsonPath = import_node_path5.default.join(pluginDir, "package.json");
-  if (!import_node_fs4.default.existsSync(pkgJsonPath)) {
-    import_node_fs4.default.writeFileSync(
+  import_node_fs5.default.mkdirSync(pluginDir, { recursive: true });
+  const pkgJsonPath = import_node_path6.default.join(pluginDir, "package.json");
+  if (!import_node_fs5.default.existsSync(pkgJsonPath)) {
+    import_node_fs5.default.writeFileSync(
       pkgJsonPath,
       JSON.stringify({ name: "mcpman-plugins", private: true }, null, 2)
     );
@@ -1040,7 +1146,7 @@ function removePluginPackage(name, pluginDir = getPluginDir()) {
   }
   const config = readConfig();
   const plugins = config.plugins ?? [];
-  config.plugins = plugins.filter((p13) => p13 !== name);
+  config.plugins = plugins.filter((p14) => p14 !== name);
   writeConfig(config);
 }
 function listPluginPackages() {
@@ -1089,7 +1195,7 @@ async function resolveServer(input) {
       if (source.type.startsWith("plugin:")) {
         const pluginName = source.type.slice(7);
         const plugins = loadAllPlugins();
-        const plugin = plugins.find((p13) => p13.name === pluginName);
+        const plugin = plugins.find((p14) => p14.name === pluginName);
         if (plugin) {
           const resolved = await plugin.resolve(source.input);
           return resolved;
@@ -1145,6 +1251,51 @@ async function applyServerUpdate(serverName, lockEntry, clients) {
 // src/core/version-checker.ts
 init_cjs_shims();
+// src/core/pin-service.ts
+init_cjs_shims();
+var import_node_fs6 = __toESM(require("fs"), 1);
+init_paths();
+function readPins(file) {
+  const target = file ?? getPinsFile();
+  if (!import_node_fs6.default.existsSync(target)) return {};
+  try {
+    return JSON.parse(import_node_fs6.default.readFileSync(target, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+function writePins(store, file) {
+  const target = file ?? getPinsFile();
+  const dir = target.slice(0, target.lastIndexOf("/"));
+  if (dir && !import_node_fs6.default.existsSync(dir)) {
+    import_node_fs6.default.mkdirSync(dir, { recursive: true });
+  }
+  import_node_fs6.default.writeFileSync(target, JSON.stringify(store, null, 2), "utf-8");
+}
+function pinServer(server, version, file) {
+  const store = readPins(file);
+  store[server] = version;
+  writePins(store, file);
+}
+function unpinServer(server, file) {
+  const store = readPins(file);
+  if (!(server in store)) return;
+  delete store[server];
+  writePins(store, file);
+}
+function getPinnedVersion(server, file) {
+  return readPins(file)[server] ?? null;
+}
+function isPinned(server, file) {
+  return server in readPins(file);
+}
+function listPins(file) {
+  const store = readPins(file);
+  return Object.entries(store).sort(([a], [b]) => a.localeCompare(b)).map(([server, version]) => ({ server, version }));
+}
+// src/core/version-checker.ts
 function compareVersions(a, b) {
   const aParts = a.replace(/^v/, "").split(".").map(Number);
   const bParts = b.replace(/^v/, "").split(".").map(Number);
@@ -1245,11 +1396,12 @@ async function checkAllVersions(lockfile) {
   const results = [];
   const executing = /* @__PURE__ */ new Set();
   for (const [name, entry] of entries) {
-    const p13 = checkVersion(name, entry).then((r) => {
+    if (isPinned(name)) continue;
+    const p14 = checkVersion(name, entry).then((r) => {
       results.push(r);
-      executing.delete(p13);
+      executing.delete(p14);
     });
-    executing.add(p13);
+    executing.add(p14);
     if (executing.size >= 5) {
       await Promise.race(executing);
     }
@@ -1503,57 +1655,258 @@ async function runAuditFix(reports, servers, skipConfirm) {
 `);
 }
-// src/commands/completions.ts
+// src/commands/bench.ts
 init_cjs_shims();
-var import_node_fs6 = __toESM(require("fs"), 1);
-var import_node_os4 = __toESM(require("os"), 1);
-var import_node_path7 = __toESM(require("path"), 1);
 var import_citty2 = require("citty");
 var import_picocolors2 = __toESM(require("picocolors"), 1);
-// src/core/completion-generator.ts
+// src/core/bench-service.ts
 init_cjs_shims();
-init_lockfile();
-function getCommandList() {
-  return [
-    "install",
-    "list",
-    "remove",
-    "doctor",
-    "init",
-    "secrets",
-    "sync",
-    "audit",
-    "update",
-    "upgrade",
-    "config",
-    "search",
-    "info",
-    "run",
-    "logs",
-    "test",
-    "profiles",
-    "plugin",
-    "export",
-    "import",
-    "create",
-    "link",
-    "watch",
-    "registry",
-    "completions",
-    "why"
-  ];
+var import_node_child_process2 = require("child_process");
+var DEFAULT_TIMEOUT_MS = 1e4;
+function measureOneRun(command, args, env, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const start = Date.now();
+    let settled = false;
+    let stdout = "";
+    const child = (0, import_node_child_process2.spawn)(command, args, {
+      env: { ...process.env, ...env },
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    const finish = (err) => {
+      if (settled) return;
+      settled = true;
+      try {
+        child.kill("SIGTERM");
+      } catch {
+      }
+      if (err) reject(err);
+      else resolve(Date.now() - start);
+    };
+    const timer = setTimeout(() => {
+      finish(new Error("Timeout waiting for initialize response"));
+    }, timeoutMs);
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      finish(err);
+    });
+    child.on("exit", (code) => {
+      clearTimeout(timer);
+      if (!settled) finish(new Error(`Process exited with code ${code}`));
+    });
+    child.stdout?.on("data", (chunk) => {
+      stdout += chunk.toString();
+      for (const line of stdout.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed) continue;
+        try {
+          const msg = JSON.parse(trimmed);
+          if (msg.jsonrpc === "2.0" && msg.id === 1) {
+            clearTimeout(timer);
+            finish();
+          }
+        } catch {
+        }
+      }
+    });
+    const initReq = JSON.stringify({
+      jsonrpc: "2.0",
+      id: 1,
+      method: "initialize",
+      params: {
+        protocolVersion: "2024-11-05",
+        capabilities: {},
+        clientInfo: { name: "mcpman-bench", version: "0.8.0" }
+      }
+    });
+    child.stdin?.write(`${initReq}
+`);
+  });
 }
-var SERVER_ARG_COMMANDS = [
-  "run",
-  "test",
-  "logs",
-  "watch",
-  "remove",
-  "update",
-  "info",
-  "audit",
-  "link",
+function percentile(sorted, p14) {
+  if (sorted.length === 0) return 0;
+  const idx = Math.ceil(p14 / 100 * sorted.length) - 1;
+  return sorted[Math.max(0, idx)];
+}
+async function benchServer(command, args, env, runs = 5, timeoutMs = DEFAULT_TIMEOUT_MS) {
+  const allTimes = [];
+  for (let i = 0; i < runs; i++) {
+    try {
+      const ms = await measureOneRun(command, args, env, timeoutMs);
+      allTimes.push(ms);
+    } catch (err) {
+      return {
+        runs,
+        min: 0,
+        max: 0,
+        avg: 0,
+        p50: 0,
+        p95: 0,
+        allTimes,
+        error: String(err instanceof Error ? err.message : err)
+      };
+    }
+  }
+  const sorted = [...allTimes].sort((a, b) => a - b);
+  const sum = allTimes.reduce((a, b) => a + b, 0);
+  return {
+    runs,
+    min: sorted[0] ?? 0,
+    max: sorted[sorted.length - 1] ?? 0,
+    avg: Math.round(sum / allTimes.length),
+    p50: percentile(sorted, 50),
+    p95: percentile(sorted, 95),
+    allTimes
+  };
+}
+// src/commands/bench.ts
+init_lockfile();
+var bench_default = (0, import_citty2.defineCommand)({
+  meta: {
+    name: "bench",
+    description: "Benchmark MCP server latency (JSON-RPC initialize)"
+  },
+  args: {
+    server: {
+      type: "positional",
+      description: "Server name as stored in lockfile",
+      required: true
+    },
+    runs: {
+      type: "string",
+      description: "Number of benchmark runs (default: 5)",
+      default: "5"
+    },
+    timeout: {
+      type: "string",
+      description: "Per-run timeout in ms (default: 10000)",
+      default: "10000"
+    },
+    json: {
+      type: "boolean",
+      description: "Output results as JSON",
+      default: false
+    }
+  },
+  async run({ args }) {
+    const lockfile = readLockfile();
+    const entry = lockfile.servers[args.server];
+    if (!entry) {
+      console.error(`${import_picocolors2.default.red("\u2717")} Server "${args.server}" not found in lockfile.`);
+      console.error(import_picocolors2.default.dim("Run `mcpman list` to see installed servers."));
+      process.exit(1);
+    }
+    const runs = Math.max(1, Number.parseInt(args.runs, 10) || 5);
+    const timeoutMs = Math.max(1e3, Number.parseInt(args.timeout, 10) || 1e4);
+    if (!args.json) {
+      console.log(`
+${import_picocolors2.default.cyan("mcpman bench")} \u2014 ${import_picocolors2.default.bold(args.server)}`);
+      console.log(import_picocolors2.default.dim(`  Command: ${entry.command} ${(entry.args ?? []).join(" ")}`));
+      console.log(import_picocolors2.default.dim(`  Runs: ${runs}  Timeout: ${timeoutMs}ms
+`));
+      process.stdout.write(import_picocolors2.default.dim("  Running"));
+    }
+    const env = {};
+    for (const ev of entry.envVars ?? []) {
+      const idx = ev.indexOf("=");
+      if (idx > 0) env[ev.slice(0, idx)] = ev.slice(idx + 1);
+    }
+    const result = await benchServer(entry.command, entry.args ?? [], env, runs, timeoutMs);
+    if (!args.json) process.stdout.write("\n");
+    if (result.error) {
+      if (args.json) {
+        console.log(JSON.stringify({ server: args.server, error: result.error }));
+      } else {
+        console.error(`
+${import_picocolors2.default.red("\u2717")} Benchmark failed: ${result.error}`);
+      }
+      process.exit(1);
+    }
+    if (args.json) {
+      console.log(JSON.stringify({ server: args.server, ...result }, null, 2));
+      if (result.p95 > timeoutMs) process.exit(1);
+      return;
+    }
+    const pad4 = (s, w) => s.padEnd(w);
+    const ms = (n) => `${n}ms`;
+    console.log(`
+  ${import_picocolors2.default.bold("Latency statistics")} for ${import_picocolors2.default.cyan(args.server)}`);
+    console.log(import_picocolors2.default.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+    console.log(`  ${pad4("min", 8)} ${import_picocolors2.default.green(ms(result.min))}`);
+    console.log(`  ${pad4("avg", 8)} ${ms(result.avg)}`);
+    console.log(`  ${pad4("p50", 8)} ${ms(result.p50)}`);
+    console.log(
+      `  ${pad4("p95", 8)} ${result.p95 > timeoutMs ? import_picocolors2.default.red(ms(result.p95)) : import_picocolors2.default.yellow(ms(result.p95))}`
+    );
+    console.log(`  ${pad4("max", 8)} ${ms(result.max)}`);
+    console.log(`  ${pad4("runs", 8)} ${result.runs}`);
+    console.log("");
+    if (result.p95 > timeoutMs) {
+      console.error(import_picocolors2.default.red(`  \u2717 p95 (${result.p95}ms) exceeds timeout (${timeoutMs}ms)`));
+      process.exit(1);
+    }
+    console.log(import_picocolors2.default.green("  \u2713 Benchmark complete"));
+  }
+});
+// src/commands/completions.ts
+init_cjs_shims();
+var import_node_fs8 = __toESM(require("fs"), 1);
+var import_node_os4 = __toESM(require("os"), 1);
+var import_node_path8 = __toESM(require("path"), 1);
+var import_citty3 = require("citty");
+var import_picocolors3 = __toESM(require("picocolors"), 1);
+// src/core/completion-generator.ts
+init_cjs_shims();
+init_lockfile();
+function getCommandList() {
+  return [
+    "install",
+    "list",
+    "remove",
+    "doctor",
+    "init",
+    "secrets",
+    "sync",
+    "audit",
+    "update",
+    "upgrade",
+    "config",
+    "search",
+    "info",
+    "run",
+    "logs",
+    "test",
+    "profiles",
+    "plugin",
+    "export",
+    "import",
+    "create",
+    "link",
+    "watch",
+    "registry",
+    "completions",
+    "why",
+    "env",
+    "bench",
+    "diff",
+    "group",
+    "pin",
+    "rollback"
+  ];
+}
+var SERVER_ARG_COMMANDS = [
+  "run",
+  "test",
+  "logs",
+  "watch",
+  "remove",
+  "update",
+  "info",
+  "audit",
+  "link",
   "why"
 ];
 function getServerNames(lockfilePath) {
@@ -1666,7 +2019,7 @@ complete -c mcpman -l runtime -s r \\
 }
 // src/commands/completions.ts
-var completions_default = (0, import_citty2.defineCommand)({
+var completions_default = (0, import_citty3.defineCommand)({
   meta: {
     name: "completions",
     description: "Generate shell completion scripts (bash, zsh, fish)"
@@ -1716,24 +2069,24 @@ var completions_default = (0, import_citty2.defineCommand)({
         await installCompletion();
         break;
       default:
-        console.error(import_picocolors2.default.red(`  Error: Unknown shell '${shell}'. Use: bash, zsh, or fish.`));
+        console.error(import_picocolors3.default.red(`  Error: Unknown shell '${shell}'. Use: bash, zsh, or fish.`));
         process.exit(1);
     }
   }
 });
 function printUsage() {
-  console.log(import_picocolors2.default.bold("\n  mcpman completions \u2014 Shell completion setup\n"));
+  console.log(import_picocolors3.default.bold("\n  mcpman completions \u2014 Shell completion setup\n"));
   console.log("  Usage:");
-  console.log(`    ${import_picocolors2.default.cyan("mcpman completions bash")}    Output bash completion script`);
-  console.log(`    ${import_picocolors2.default.cyan("mcpman completions zsh")}     Output zsh completion script`);
-  console.log(`    ${import_picocolors2.default.cyan("mcpman completions fish")}    Output fish completion script`);
-  console.log(`    ${import_picocolors2.default.cyan("mcpman completions install")} Auto-detect shell and install
+  console.log(`    ${import_picocolors3.default.cyan("mcpman completions bash")}    Output bash completion script`);
+  console.log(`    ${import_picocolors3.default.cyan("mcpman completions zsh")}     Output zsh completion script`);
+  console.log(`    ${import_picocolors3.default.cyan("mcpman completions fish")}    Output fish completion script`);
+  console.log(`    ${import_picocolors3.default.cyan("mcpman completions install")} Auto-detect shell and install
 `);
   console.log("  Quick setup:");
-  console.log(`    ${import_picocolors2.default.dim("# bash")}`);
-  console.log(`    ${import_picocolors2.default.cyan("source <(mcpman completions bash)")}`);
-  console.log(`    ${import_picocolors2.default.dim("# zsh")}`);
-  console.log(`    ${import_picocolors2.default.cyan("source <(mcpman completions zsh)")}
+  console.log(`    ${import_picocolors3.default.dim("# bash")}`);
+  console.log(`    ${import_picocolors3.default.cyan("source <(mcpman completions bash)")}`);
+  console.log(`    ${import_picocolors3.default.dim("# zsh")}`);
+  console.log(`    ${import_picocolors3.default.cyan("source <(mcpman completions zsh)")}
 `);
 }
 async function installCompletion() {
@@ -1743,50 +2096,50 @@ async function installCompletion() {
   else if (shellBin.includes("fish")) detectedShell = "fish";
   else if (shellBin.includes("bash")) detectedShell = "bash";
   if (!detectedShell) {
-    console.error(import_picocolors2.default.red("  Could not detect shell from $SHELL. Run manually:"));
-    console.error(import_picocolors2.default.dim("    source <(mcpman completions bash|zsh|fish)"));
+    console.error(import_picocolors3.default.red("  Could not detect shell from $SHELL. Run manually:"));
+    console.error(import_picocolors3.default.dim("    source <(mcpman completions bash|zsh|fish)"));
     process.exit(1);
   }
   const home = import_node_os4.default.homedir();
   let rcFile;
   let script;
   if (detectedShell === "zsh") {
-    rcFile = import_node_path7.default.join(home, ".zshrc");
+    rcFile = import_node_path8.default.join(home, ".zshrc");
     script = generateZshCompletion();
   } else if (detectedShell === "fish") {
-    const fishDir = import_node_path7.default.join(home, ".config", "fish", "completions");
-    import_node_fs6.default.mkdirSync(fishDir, { recursive: true });
-    rcFile = import_node_path7.default.join(fishDir, "mcpman.fish");
-    import_node_fs6.default.writeFileSync(rcFile, generateFishCompletion(), "utf-8");
-    console.log(import_picocolors2.default.green(`  Installed fish completions to ${rcFile}`));
+    const fishDir = import_node_path8.default.join(home, ".config", "fish", "completions");
+    import_node_fs8.default.mkdirSync(fishDir, { recursive: true });
+    rcFile = import_node_path8.default.join(fishDir, "mcpman.fish");
+    import_node_fs8.default.writeFileSync(rcFile, generateFishCompletion(), "utf-8");
+    console.log(import_picocolors3.default.green(`  Installed fish completions to ${rcFile}`));
     return;
   } else {
-    rcFile = import_node_path7.default.join(home, ".bashrc");
+    rcFile = import_node_path8.default.join(home, ".bashrc");
     script = generateBashCompletion();
   }
   const marker = "# mcpman completions";
   let existing = "";
   try {
-    existing = import_node_fs6.default.readFileSync(rcFile, "utf-8");
+    existing = import_node_fs8.default.readFileSync(rcFile, "utf-8");
   } catch {
   }
   if (existing.includes(marker)) {
-    console.log(import_picocolors2.default.yellow(`  Completions already installed in ${rcFile}. Skipping.`));
+    console.log(import_picocolors3.default.yellow(`  Completions already installed in ${rcFile}. Skipping.`));
     return;
   }
-  import_node_fs6.default.appendFileSync(rcFile, `
+  import_node_fs8.default.appendFileSync(rcFile, `
 ${marker}
 source <(mcpman completions ${detectedShell})
 `);
-  console.log(import_picocolors2.default.green(`  Installed ${detectedShell} completions in ${rcFile}`));
-  console.log(import_picocolors2.default.dim(`  Restart your shell or run: source ${rcFile}`));
+  console.log(import_picocolors3.default.green(`  Installed ${detectedShell} completions in ${rcFile}`));
+  console.log(import_picocolors3.default.dim(`  Restart your shell or run: source ${rcFile}`));
 }
 // src/commands/config.ts
 init_cjs_shims();
 var p2 = __toESM(require("@clack/prompts"), 1);
-var import_citty3 = require("citty");
-var import_picocolors3 = __toESM(require("picocolors"), 1);
+var import_citty4 = require("citty");
+var import_picocolors4 = __toESM(require("picocolors"), 1);
 function coerceValue(raw) {
   if (raw === "true") return true;
   if (raw === "false") return false;
@@ -1794,7 +2147,7 @@ function coerceValue(raw) {
   if (!Number.isNaN(num) && raw.trim() !== "") return num;
   return raw;
 }
-var setCommand = (0, import_citty3.defineCommand)({
+var setCommand = (0, import_citty4.defineCommand)({
   meta: { name: "set", description: "Set a config value" },
   args: {
     key: {
@@ -1812,14 +2165,14 @@ var setCommand = (0, import_citty3.defineCommand)({
     try {
       const coerced = coerceValue(args.value);
       setConfigValue(args.key, coerced);
-      console.log(`${import_picocolors3.default.green("\u2713")} Set ${import_picocolors3.default.bold(args.key)} = ${import_picocolors3.default.cyan(String(coerced))}`);
+      console.log(`${import_picocolors4.default.green("\u2713")} Set ${import_picocolors4.default.bold(args.key)} = ${import_picocolors4.default.cyan(String(coerced))}`);
     } catch (err) {
-      console.error(`${import_picocolors3.default.red("\u2717")} ${String(err)}`);
+      console.error(`${import_picocolors4.default.red("\u2717")} ${String(err)}`);
       process.exit(1);
     }
   }
 });
-var getCommand = (0, import_citty3.defineCommand)({
+var getCommand = (0, import_citty4.defineCommand)({
   meta: { name: "get", description: "Get a config value" },
   args: {
     key: {
@@ -1831,32 +2184,32 @@ var getCommand = (0, import_citty3.defineCommand)({
   run({ args }) {
     const val = getConfigValue(args.key);
     if (val === void 0) {
-      console.log(import_picocolors3.default.dim(`${args.key}: (not set)`));
+      console.log(import_picocolors4.default.dim(`${args.key}: (not set)`));
     } else {
-      console.log(`${import_picocolors3.default.bold(args.key)}: ${import_picocolors3.default.cyan(String(val))}`);
+      console.log(`${import_picocolors4.default.bold(args.key)}: ${import_picocolors4.default.cyan(String(val))}`);
     }
   }
 });
-var listCommand = (0, import_citty3.defineCommand)({
+var listCommand = (0, import_citty4.defineCommand)({
   meta: { name: "list", description: "List all config values" },
   run() {
     const data = readConfig();
     const entries = Object.entries(data);
     if (entries.length === 0) {
-      console.log(import_picocolors3.default.dim("No config values set. Use `mcpman config set <key> <value>`."));
+      console.log(import_picocolors4.default.dim("No config values set. Use `mcpman config set <key> <value>`."));
       return;
     }
     console.log("");
-    console.log(import_picocolors3.default.bold("mcpman config:"));
+    console.log(import_picocolors4.default.bold("mcpman config:"));
     console.log("");
     for (const [key, val] of entries) {
-      console.log(`  ${import_picocolors3.default.green("\u25CF")} ${import_picocolors3.default.bold(key)}  ${import_picocolors3.default.cyan(String(val))}`);
+      console.log(`  ${import_picocolors4.default.green("\u25CF")} ${import_picocolors4.default.bold(key)}  ${import_picocolors4.default.cyan(String(val))}`);
     }
     console.log("");
-    console.log(import_picocolors3.default.dim(`  ${entries.length} key${entries.length !== 1 ? "s" : ""} configured`));
+    console.log(import_picocolors4.default.dim(`  ${entries.length} key${entries.length !== 1 ? "s" : ""} configured`));
   }
 });
-var resetCommand = (0, import_citty3.defineCommand)({
+var resetCommand = (0, import_citty4.defineCommand)({
   meta: { name: "reset", description: "Reset config to defaults (removes config file)" },
   async run() {
     const confirmed = await p2.confirm({
@@ -1868,10 +2221,10 @@ var resetCommand = (0, import_citty3.defineCommand)({
       return;
     }
     writeConfig({});
-    console.log(`${import_picocolors3.default.green("\u2713")} Config reset to defaults.`);
+    console.log(`${import_picocolors4.default.green("\u2713")} Config reset to defaults.`);
   }
 });
-var config_default = (0, import_citty3.defineCommand)({
+var config_default = (0, import_citty4.defineCommand)({
   meta: {
     name: "config",
     description: "Manage mcpman CLI configuration"
@@ -1886,14 +2239,14 @@ var config_default = (0, import_citty3.defineCommand)({
 // src/commands/create.ts
 init_cjs_shims();
-var import_node_path9 = __toESM(require("path"), 1);
-var import_citty4 = require("citty");
-var import_picocolors4 = __toESM(require("picocolors"), 1);
+var import_node_path10 = __toESM(require("path"), 1);
+var import_citty5 = require("citty");
+var import_picocolors5 = __toESM(require("picocolors"), 1);
 // src/core/scaffold-service.ts
 init_cjs_shims();
-var import_node_fs7 = __toESM(require("fs"), 1);
-var import_node_path8 = __toESM(require("path"), 1);
+var import_node_fs9 = __toESM(require("fs"), 1);
+var import_node_path9 = __toESM(require("path"), 1);
 function sanitizeName(name) {
   return name.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
@@ -2045,22 +2398,22 @@ if __name__ == "__main__":
   };
 }
 function writeScaffold(dir, files) {
-  if (import_node_fs7.default.existsSync(dir)) {
-    const existing = import_node_fs7.default.readdirSync(dir);
+  if (import_node_fs9.default.existsSync(dir)) {
+    const existing = import_node_fs9.default.readdirSync(dir);
     if (existing.length > 0) {
       throw new Error(`Directory '${dir}' already exists and is not empty.`);
     }
   }
   for (const [relativePath, content] of Object.entries(files)) {
-    const fullPath = import_node_path8.default.join(dir, relativePath);
-    const parentDir = import_node_path8.default.dirname(fullPath);
-    import_node_fs7.default.mkdirSync(parentDir, { recursive: true });
-    import_node_fs7.default.writeFileSync(fullPath, content, "utf-8");
+    const fullPath = import_node_path9.default.join(dir, relativePath);
+    const parentDir = import_node_path9.default.dirname(fullPath);
+    import_node_fs9.default.mkdirSync(parentDir, { recursive: true });
+    import_node_fs9.default.writeFileSync(fullPath, content, "utf-8");
   }
 }
 // src/commands/create.ts
-var create_default = (0, import_citty4.defineCommand)({
+var create_default = (0, import_citty5.defineCommand)({
   meta: {
     name: "create",
     description: "Scaffold a new MCP server project"
@@ -2098,7 +2451,7 @@ var create_default = (0, import_citty4.defineCommand)({
         const readline = await import("readline");
         const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
         projectName = await new Promise((resolve) => {
-          rl.question(import_picocolors4.default.cyan("  Project name: "), (answer) => {
+          rl.question(import_picocolors5.default.cyan("  Project name: "), (answer) => {
             rl.close();
             resolve(answer.trim());
           });
@@ -2108,7 +2461,7 @@ var create_default = (0, import_citty4.defineCommand)({
         const readline = await import("readline");
         const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
         projectDescription = await new Promise((resolve) => {
-          rl.question(import_picocolors4.default.cyan("  Description (optional): "), (answer) => {
+          rl.question(import_picocolors5.default.cyan("  Description (optional): "), (answer) => {
             rl.close();
             resolve(answer.trim());
           });
@@ -2118,7 +2471,7 @@ var create_default = (0, import_citty4.defineCommand)({
         const readline = await import("readline");
         const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
         const answer = await new Promise((resolve) => {
-          rl.question(import_picocolors4.default.cyan("  Runtime [node/python] (default: node): "), (a) => {
+          rl.question(import_picocolors5.default.cyan("  Runtime [node/python] (default: node): "), (a) => {
             rl.close();
             resolve(a.trim() || "node");
           });
@@ -2127,16 +2480,16 @@ var create_default = (0, import_citty4.defineCommand)({
       }
     }
     if (!projectName) {
-      console.error(import_picocolors4.default.red("  Error: Project name is required."));
+      console.error(import_picocolors5.default.red("  Error: Project name is required."));
       process.exit(1);
     }
     const sanitized = sanitizeName(projectName);
     if (!sanitized) {
-      console.error(import_picocolors4.default.red(`  Error: Invalid project name '${projectName}'.`));
+      console.error(import_picocolors5.default.red(`  Error: Invalid project name '${projectName}'.`));
       process.exit(1);
     }
     if (runtime !== "node" && runtime !== "python") {
-      console.error(import_picocolors4.default.red(`  Error: Unknown runtime '${runtime}'. Use node or python.`));
+      console.error(import_picocolors5.default.red(`  Error: Unknown runtime '${runtime}'. Use node or python.`));
       process.exit(1);
     }
     const options = {
@@ -2146,54 +2499,218 @@ var create_default = (0, import_citty4.defineCommand)({
       transport: "stdio"
     };
     const files = runtime === "python" ? generatePythonProject(options) : generateNodeProject(options);
-    const targetDir = import_node_path9.default.resolve(sanitized);
+    const targetDir = import_node_path10.default.resolve(sanitized);
     try {
       writeScaffold(targetDir, files);
     } catch (err) {
-      console.error(import_picocolors4.default.red(`  Error: ${err instanceof Error ? err.message : String(err)}`));
+      console.error(import_picocolors5.default.red(`  Error: ${err instanceof Error ? err.message : String(err)}`));
       process.exit(1);
     }
-    console.log(import_picocolors4.default.green(`
-  Created ${import_picocolors4.default.bold(sanitized)}/
+    console.log(import_picocolors5.default.green(`
+  Created ${import_picocolors5.default.bold(sanitized)}/
 `));
-    console.log(import_picocolors4.default.dim("  Files generated:"));
+    console.log(import_picocolors5.default.dim("  Files generated:"));
     for (const file of Object.keys(files)) {
-      console.log(`    ${import_picocolors4.default.cyan(file)}`);
+      console.log(`    ${import_picocolors5.default.cyan(file)}`);
     }
     console.log("\n  Next steps:");
     if (runtime === "node") {
-      console.log(`    ${import_picocolors4.default.bold(`cd ${sanitized}`)}`);
-      console.log(`    ${import_picocolors4.default.bold("npm install")}`);
-      console.log(`    ${import_picocolors4.default.bold("mcpman link .")}`);
+      console.log(`    ${import_picocolors5.default.bold(`cd ${sanitized}`)}`);
+      console.log(`    ${import_picocolors5.default.bold("npm install")}`);
+      console.log(`    ${import_picocolors5.default.bold("mcpman link .")}`);
     } else {
-      console.log(`    ${import_picocolors4.default.bold(`cd ${sanitized}`)}`);
-      console.log(`    ${import_picocolors4.default.bold("pip install -e .")}`);
-      console.log(`    ${import_picocolors4.default.bold("mcpman link .")}`);
+      console.log(`    ${import_picocolors5.default.bold(`cd ${sanitized}`)}`);
+      console.log(`    ${import_picocolors5.default.bold("pip install -e .")}`);
+      console.log(`    ${import_picocolors5.default.bold("mcpman link .")}`);
     }
     console.log();
   }
 });
+// src/commands/diff.ts
+init_cjs_shims();
+var import_citty6 = require("citty");
+var import_picocolors6 = __toESM(require("picocolors"), 1);
+// src/core/config-differ.ts
+init_cjs_shims();
+function entryDiffs(a, b) {
+  const diffs = [];
+  if (a.command !== b.command) {
+    diffs.push(`command: ${a.command} \u2192 ${b.command}`);
+  }
+  const aArgs = JSON.stringify(a.args ?? []);
+  const bArgs = JSON.stringify(b.args ?? []);
+  if (aArgs !== bArgs) {
+    diffs.push(`args: ${aArgs} \u2192 ${bArgs}`);
+  }
+  const aEnv = JSON.stringify(a.env ?? {});
+  const bEnv = JSON.stringify(b.env ?? {});
+  if (aEnv !== bEnv) {
+    diffs.push(`env: ${aEnv} \u2192 ${bEnv}`);
+  }
+  return diffs;
+}
+function diffClientConfigs(configA, configB) {
+  const results = [];
+  const serversA = configA.servers;
+  const serversB = configB.servers;
+  for (const name of Object.keys(serversB)) {
+    if (!(name in serversA)) {
+      results.push({ server: name, change: "added" });
+    }
+  }
+  for (const name of Object.keys(serversA)) {
+    if (!(name in serversB)) {
+      results.push({ server: name, change: "removed" });
+    }
+  }
+  for (const name of Object.keys(serversA)) {
+    if (name in serversB) {
+      const details = entryDiffs(serversA[name], serversB[name]);
+      if (details.length > 0) {
+        results.push({ server: name, change: "changed", details });
+      }
+    }
+  }
+  const order = { removed: 0, added: 1, changed: 2 };
+  results.sort((a, b) => {
+    const orderDiff = order[a.change] - order[b.change];
+    return orderDiff !== 0 ? orderDiff : a.server.localeCompare(b.server);
+  });
+  return results;
+}
+async function loadClientConfig(type) {
+  try {
+    const { getClient: getClient2 } = await Promise.resolve().then(() => (init_client_detector(), client_detector_exports));
+    const handler = getClient2(type);
+    return await handler.readConfig();
+  } catch {
+    return null;
+  }
+}
+// src/commands/diff.ts
+var VALID_CLIENTS = ["claude-desktop", "cursor", "vscode", "windsurf"];
+var CLIENT_DISPLAY = {
+  "claude-desktop": "Claude Desktop",
+  cursor: "Cursor",
+  vscode: "VS Code",
+  windsurf: "Windsurf"
+};
+var diff_default = (0, import_citty6.defineCommand)({
+  meta: {
+    name: "diff",
+    description: "Show config diff between two AI clients"
+  },
+  args: {
+    clientA: {
+      type: "positional",
+      description: `Source client (${VALID_CLIENTS.join("|")})`,
+      required: true
+    },
+    clientB: {
+      type: "positional",
+      description: `Target client (${VALID_CLIENTS.join("|")})`,
+      required: true
+    },
+    json: {
+      type: "boolean",
+      description: "Output results as JSON",
+      default: false
+    }
+  },
+  async run({ args }) {
+    const clientA = args.clientA;
+    const clientB = args.clientB;
+    if (!VALID_CLIENTS.includes(clientA)) {
+      console.error(
+        `${import_picocolors6.default.red("\u2717")} Unknown client "${clientA}". Valid: ${VALID_CLIENTS.join(", ")}`
+      );
+      process.exit(1);
+    }
+    if (!VALID_CLIENTS.includes(clientB)) {
+      console.error(
+        `${import_picocolors6.default.red("\u2717")} Unknown client "${clientB}". Valid: ${VALID_CLIENTS.join(", ")}`
+      );
+      process.exit(1);
+    }
+    if (clientA === clientB) {
+      console.error(`${import_picocolors6.default.red("\u2717")} clientA and clientB must be different.`);
+      process.exit(1);
+    }
+    const [configA, configB] = await Promise.all([
+      loadClientConfig(clientA),
+      loadClientConfig(clientB)
+    ]);
+    if (!configA) {
+      console.error(`${import_picocolors6.default.red("\u2717")} Could not read config for ${CLIENT_DISPLAY[clientA]}.`);
+      process.exit(1);
+    }
+    if (!configB) {
+      console.error(`${import_picocolors6.default.red("\u2717")} Could not read config for ${CLIENT_DISPLAY[clientB]}.`);
+      process.exit(1);
+    }
+    const diffs = diffClientConfigs(configA, configB);
+    if (args.json) {
+      console.log(JSON.stringify({ clientA, clientB, diffs }, null, 2));
+      return;
+    }
+    const labelA = CLIENT_DISPLAY[clientA];
+    const labelB = CLIENT_DISPLAY[clientB];
+    console.log(`
+${import_picocolors6.default.bold("mcpman diff")}  ${import_picocolors6.default.cyan(labelA)} \u2192 ${import_picocolors6.default.cyan(labelB)}
+`);
+    if (diffs.length === 0) {
+      console.log(import_picocolors6.default.green("  \u2713 No differences \u2014 configs are identical."));
+      console.log("");
+      return;
+    }
+    for (const d of diffs) {
+      if (d.change === "added") {
+        console.log(`  ${import_picocolors6.default.green("+")} ${import_picocolors6.default.bold(d.server)}  ${import_picocolors6.default.dim(`(only in ${labelB})`)}`);
+      } else if (d.change === "removed") {
+        console.log(`  ${import_picocolors6.default.red("-")} ${import_picocolors6.default.bold(d.server)}  ${import_picocolors6.default.dim(`(only in ${labelA})`)}`);
+      } else {
+        console.log(`  ${import_picocolors6.default.yellow("~")} ${import_picocolors6.default.bold(d.server)}  ${import_picocolors6.default.dim("(changed)")}`);
+        for (const detail of d.details ?? []) {
+          console.log(`      ${import_picocolors6.default.dim(detail)}`);
+        }
+      }
+    }
+    const added = diffs.filter((d) => d.change === "added").length;
+    const removed = diffs.filter((d) => d.change === "removed").length;
+    const changed = diffs.filter((d) => d.change === "changed").length;
+    const parts = [];
+    if (added > 0) parts.push(import_picocolors6.default.green(`+${added} added`));
+    if (removed > 0) parts.push(import_picocolors6.default.red(`-${removed} removed`));
+    if (changed > 0) parts.push(import_picocolors6.default.yellow(`~${changed} changed`));
+    console.log(`
+  ${parts.join("  ")}
+`);
+  }
+});
 // src/commands/doctor.ts
 init_cjs_shims();
-var import_citty5 = require("citty");
-var import_picocolors5 = __toESM(require("picocolors"), 1);
+var import_citty7 = require("citty");
+var import_picocolors7 = __toESM(require("picocolors"), 1);
 // src/core/health-checker.ts
 init_cjs_shims();
 // src/core/diagnostics.ts
 init_cjs_shims();
-var import_node_child_process3 = require("child_process");
+var import_node_child_process4 = require("child_process");
 var import_node_util = require("util");
 // src/core/mcp-process-checks.ts
 init_cjs_shims();
-var import_node_child_process2 = require("child_process");
+var import_node_child_process3 = require("child_process");
 async function checkProcessSpawn(command, args, env, timeoutMs = 3e3) {
   return new Promise((resolve) => {
     let settled = false;
-    const child = (0, import_node_child_process2.spawn)(command, args, {
+    const child = (0, import_node_child_process3.spawn)(command, args, {
       env: { ...process.env, ...env },
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -2239,7 +2756,7 @@ async function checkMcpHandshake(command, args, env, timeoutMs = 5e3) {
     let settled = false;
     const start = Date.now();
     let stdout = "";
-    const child = (0, import_node_child_process2.spawn)(command, args, {
+    const child = (0, import_node_child_process3.spawn)(command, args, {
       env: { ...process.env, ...env },
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -2296,7 +2813,7 @@ async function checkMcpHandshake(command, args, env, timeoutMs = 5e3) {
 }
 // src/core/diagnostics.ts
-var execAsync = (0, import_node_util.promisify)(import_node_child_process3.exec);
+var execAsync = (0, import_node_util.promisify)(import_node_child_process4.exec);
 async function checkRuntime(command) {
   const cmd = process.platform === "win32" ? "where" : "which";
   const runtimeCmd = command === "npx" ? "node" : command === "uvx" ? "python3" : command;
@@ -2530,12 +3047,12 @@ async function getInstalledServers(clientFilter) {
 // src/commands/doctor.ts
 var CHECK_ICON = {
-  pass: import_picocolors5.default.green("\u2713"),
-  fail: import_picocolors5.default.red("\u2717"),
-  skip: import_picocolors5.default.dim("-"),
-  warn: import_picocolors5.default.yellow("\u26A0")
+  pass: import_picocolors7.default.green("\u2713"),
+  fail: import_picocolors7.default.red("\u2717"),
+  skip: import_picocolors7.default.dim("-"),
+  warn: import_picocolors7.default.yellow("\u26A0")
 };
-var doctor_default = (0, import_citty5.defineCommand)({
+var doctor_default = (0, import_citty7.defineCommand)({
   meta: {
     name: "doctor",
     description: "Check MCP server health and configuration"
@@ -2548,11 +3065,11 @@ var doctor_default = (0, import_citty5.defineCommand)({
     }
   },
   async run({ args }) {
-    console.log(import_picocolors5.default.bold("\n  mcpman doctor\n"));
+    console.log(import_picocolors7.default.bold("\n  mcpman doctor\n"));
     const servers = await getInstalledServers();
     if (servers.length === 0) {
       console.log(
-        import_picocolors5.default.dim("  No MCP servers installed. Run mcpman install <server> to get started.")
+        import_picocolors7.default.dim("  No MCP servers installed. Run mcpman install <server> to get started.")
       );
       return;
     }
@@ -2569,20 +3086,20 @@ var doctor_default = (0, import_citty5.defineCommand)({
     if (pluginSummary.total > 0) {
       printPluginSection(pluginSummary);
     }
-    console.log(import_picocolors5.default.dim(`  ${"\u2500".repeat(50)}`));
+    console.log(import_picocolors7.default.dim(`  ${"\u2500".repeat(50)}`));
     const parts = [];
-    if (passed > 0) parts.push(import_picocolors5.default.green(`${passed} healthy`));
-    if (failed > 0) parts.push(import_picocolors5.default.red(`${failed} unhealthy`));
+    if (passed > 0) parts.push(import_picocolors7.default.green(`${passed} healthy`));
+    if (failed > 0) parts.push(import_picocolors7.default.red(`${failed} unhealthy`));
     console.log(`  Summary: ${parts.join(", ")}`);
     if (pluginSummary.total > 0) {
       const pParts = [];
-      if (pluginSummary.healthy > 0) pParts.push(import_picocolors5.default.green(`${pluginSummary.healthy} ok`));
-      if (pluginSummary.unhealthy > 0) pParts.push(import_picocolors5.default.red(`${pluginSummary.unhealthy} broken`));
+      if (pluginSummary.healthy > 0) pParts.push(import_picocolors7.default.green(`${pluginSummary.healthy} ok`));
+      if (pluginSummary.unhealthy > 0) pParts.push(import_picocolors7.default.red(`${pluginSummary.unhealthy} broken`));
       console.log(`  Plugins: ${pParts.join(", ")}`);
     }
     if (failed > 0 || pluginSummary.unhealthy > 0) {
       if (!args.fix) {
-        console.log(import_picocolors5.default.dim(`  Run ${import_picocolors5.default.cyan("mcpman doctor --fix")} for fix suggestions.
+        console.log(import_picocolors7.default.dim(`  Run ${import_picocolors7.default.cyan("mcpman doctor --fix")} for fix suggestions.
 `));
       }
       process.exit(1);
@@ -2591,26 +3108,26 @@ var doctor_default = (0, import_citty5.defineCommand)({
   }
 });
 function printPluginSection(summary) {
-  console.log(import_picocolors5.default.bold(`  Plugins (${summary.total})`));
+  console.log(import_picocolors7.default.bold(`  Plugins (${summary.total})`));
   for (const r of summary.results) {
-    const icon = r.loadable && r.prefixUnique && r.resolvable ? import_picocolors5.default.green("\u2713") : import_picocolors5.default.red("\u2717");
+    const icon = r.loadable && r.prefixUnique && r.resolvable ? import_picocolors7.default.green("\u2713") : import_picocolors7.default.red("\u2717");
     const label = r.pluginName ? `${r.packageName} (${r.pluginName})` : r.packageName;
-    const prefix = r.prefix ? import_picocolors5.default.dim(` [${r.prefix}]`) : "";
+    const prefix = r.prefix ? import_picocolors7.default.dim(` [${r.prefix}]`) : "";
     console.log(`    ${icon} ${label}${prefix}`);
     if (r.error) {
-      console.log(`      ${import_picocolors5.default.yellow("\u2192")} ${r.error}`);
+      console.log(`      ${import_picocolors7.default.yellow("\u2192")} ${r.error}`);
     }
   }
   console.log();
 }
 function printServerResult(result, showFix) {
-  const icon = result.status === "healthy" ? import_picocolors5.default.green("\u25CF") : import_picocolors5.default.red("\u25CF");
-  console.log(`  ${icon} ${import_picocolors5.default.bold(result.serverName)}`);
+  const icon = result.status === "healthy" ? import_picocolors7.default.green("\u25CF") : import_picocolors7.default.red("\u25CF");
+  console.log(`  ${icon} ${import_picocolors7.default.bold(result.serverName)}`);
   for (const check of result.checks) {
     const checkIcon = check.skipped ? CHECK_ICON.skip : check.passed ? CHECK_ICON.pass : CHECK_ICON.fail;
     console.log(`    ${checkIcon} ${check.name}: ${check.message}`);
     if (showFix && !check.passed && !check.skipped && check.fix) {
-      console.log(`      ${import_picocolors5.default.yellow("\u2192")} Fix: ${import_picocolors5.default.cyan(check.fix)}`);
+      console.log(`      ${import_picocolors7.default.yellow("\u2192")} Fix: ${import_picocolors7.default.cyan(check.fix)}`);
     }
   }
   console.log();
@@ -2619,11 +3136,11 @@ async function runParallel(tasks, concurrency) {
   const results = [];
   const executing = /* @__PURE__ */ new Set();
   for (const task of tasks) {
-    const p13 = task().then((r) => {
+    const p14 = task().then((r) => {
       results.push(r);
-      executing.delete(p13);
+      executing.delete(p14);
     });
-    executing.add(p13);
+    executing.add(p14);
     if (executing.size >= concurrency) {
       await Promise.race(executing);
     }
@@ -2632,21 +3149,194 @@ async function runParallel(tasks, concurrency) {
   return results;
 }
-// src/commands/export-command.ts
+// src/commands/env.ts
+init_cjs_shims();
+var import_citty8 = require("citty");
+var import_picocolors8 = __toESM(require("picocolors"), 1);
+// src/core/env-manager.ts
 init_cjs_shims();
 var import_node_fs10 = __toESM(require("fs"), 1);
 var import_node_path11 = __toESM(require("path"), 1);
-var import_citty6 = require("citty");
-var import_picocolors6 = __toESM(require("picocolors"), 1);
+init_paths();
+function envFilePath(server, dir) {
+  const base = dir ?? getEnvDir();
+  const safe = server.replace(/[/@]/g, "_");
+  return import_node_path11.default.join(base, `${safe}.json`);
+}
+function readStore(server, dir) {
+  const file = envFilePath(server, dir);
+  if (!import_node_fs10.default.existsSync(file)) return {};
+  try {
+    return JSON.parse(import_node_fs10.default.readFileSync(file, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+function writeStore(server, store, dir) {
+  const base = dir ?? getEnvDir();
+  if (!import_node_fs10.default.existsSync(base)) {
+    import_node_fs10.default.mkdirSync(base, { recursive: true });
+  }
+  const file = envFilePath(server, dir);
+  import_node_fs10.default.writeFileSync(file, JSON.stringify(store, null, 2), "utf-8");
+}
+function setEnv(server, key, value, dir) {
+  const store = readStore(server, dir);
+  store[key] = value;
+  writeStore(server, store, dir);
+}
+function getEnv(server, key, dir) {
+  const store = readStore(server, dir);
+  return key in store ? store[key] : null;
+}
+function listEnv(server, dir) {
+  return readStore(server, dir);
+}
+function deleteEnv(server, key, dir) {
+  const store = readStore(server, dir);
+  if (!(key in store)) return;
+  delete store[key];
+  writeStore(server, store, dir);
+}
+function clearEnv(server, dir) {
+  const file = envFilePath(server, dir);
+  if (import_node_fs10.default.existsSync(file)) {
+    import_node_fs10.default.unlinkSync(file);
+  }
+}
+function listEnvServers(dir) {
+  const base = dir ?? getEnvDir();
+  if (!import_node_fs10.default.existsSync(base)) return [];
+  return import_node_fs10.default.readdirSync(base).filter((f) => f.endsWith(".json")).map((f) => f.slice(0, -5));
+}
+// src/commands/env.ts
+var setCmd = (0, import_citty8.defineCommand)({
+  meta: { name: "set", description: "Set env var(s) for a server" },
+  args: {
+    server: { type: "positional", description: "Server name", required: true },
+    pairs: { type: "positional", description: "KEY=VALUE pair(s)", required: true }
+  },
+  run({ args }) {
+    const pairs = Array.isArray(args.pairs) ? args.pairs : [args.pairs];
+    for (const pair of pairs) {
+      const idx = pair.indexOf("=");
+      if (idx <= 0) {
+        console.error(`${import_picocolors8.default.red("\u2717")} Invalid format: "${pair}". Expected KEY=VALUE`);
+        process.exit(1);
+      }
+      const key = pair.slice(0, idx);
+      const value = pair.slice(idx + 1);
+      setEnv(args.server, key, value);
+      console.log(
+        `${import_picocolors8.default.green("\u2713")} Set ${import_picocolors8.default.bold(key)}=${import_picocolors8.default.dim(value)} for ${import_picocolors8.default.cyan(args.server)}`
+      );
+    }
+  }
+});
+var getCmd = (0, import_citty8.defineCommand)({
+  meta: { name: "get", description: "Get an env var for a server" },
+  args: {
+    server: { type: "positional", description: "Server name", required: true },
+    key: { type: "positional", description: "Variable name", required: true }
+  },
+  run({ args }) {
+    const value = getEnv(args.server, args.key);
+    if (value === null) {
+      console.error(`${import_picocolors8.default.red("\u2717")} No env var "${args.key}" for ${import_picocolors8.default.cyan(args.server)}`);
+      process.exit(1);
+    }
+    console.log(value);
+  }
+});
+var listCmd = (0, import_citty8.defineCommand)({
+  meta: { name: "list", description: "List env vars for a server (or all servers)" },
+  args: {
+    server: { type: "positional", description: "Server name (optional)", required: false }
+  },
+  run({ args }) {
+    if (args.server) {
+      const store = listEnv(args.server);
+      const keys = Object.keys(store);
+      if (keys.length === 0) {
+        console.log(import_picocolors8.default.dim(`No env vars for ${import_picocolors8.default.cyan(args.server)}.`));
+        return;
+      }
+      console.log(`
+${import_picocolors8.default.bold(import_picocolors8.default.cyan(args.server))}`);
+      for (const [k, v] of Object.entries(store)) {
+        console.log(`  ${import_picocolors8.default.green("\u25CF")} ${import_picocolors8.default.bold(k)}=${import_picocolors8.default.dim(v)}`);
+      }
+      console.log("");
+    } else {
+      const servers = listEnvServers();
+      if (servers.length === 0) {
+        console.log(import_picocolors8.default.dim("No env vars stored."));
+        return;
+      }
+      for (const srv of servers) {
+        const store = listEnv(srv);
+        console.log(`
+${import_picocolors8.default.bold(import_picocolors8.default.cyan(srv))}`);
+        for (const [k, v] of Object.entries(store)) {
+          console.log(`  ${import_picocolors8.default.green("\u25CF")} ${import_picocolors8.default.bold(k)}=${import_picocolors8.default.dim(v)}`);
+        }
+      }
+      console.log("");
+    }
+  }
+});
+var delCmd = (0, import_citty8.defineCommand)({
+  meta: { name: "del", description: "Delete an env var for a server" },
+  args: {
+    server: { type: "positional", description: "Server name", required: true },
+    key: { type: "positional", description: "Variable name to delete", required: true }
+  },
+  run({ args }) {
+    deleteEnv(args.server, args.key);
+    console.log(`${import_picocolors8.default.green("\u2713")} Deleted ${import_picocolors8.default.bold(args.key)} from ${import_picocolors8.default.cyan(args.server)}`);
+  }
+});
+var clearCmd = (0, import_citty8.defineCommand)({
+  meta: { name: "clear", description: "Clear all env vars for a server" },
+  args: {
+    server: { type: "positional", description: "Server name", required: true }
+  },
+  run({ args }) {
+    clearEnv(args.server);
+    console.log(`${import_picocolors8.default.green("\u2713")} Cleared all env vars for ${import_picocolors8.default.cyan(args.server)}`);
+  }
+});
+var env_default = (0, import_citty8.defineCommand)({
+  meta: {
+    name: "env",
+    description: "Manage per-server environment variables (non-sensitive)"
+  },
+  subCommands: {
+    set: setCmd,
+    get: getCmd,
+    list: listCmd,
+    del: delCmd,
+    clear: clearCmd
+  }
+});
+// src/commands/export-command.ts
+init_cjs_shims();
+var import_node_fs13 = __toESM(require("fs"), 1);
+var import_node_path13 = __toESM(require("path"), 1);
+var import_citty9 = require("citty");
+var import_picocolors9 = __toESM(require("picocolors"), 1);
 // src/core/export-import-service.ts
 init_cjs_shims();
-var import_node_fs9 = __toESM(require("fs"), 1);
+var import_node_fs12 = __toESM(require("fs"), 1);
 // src/utils/constants.ts
 init_cjs_shims();
 var APP_NAME = "mcpman";
-var APP_VERSION = "0.7.0";
+var APP_VERSION = "0.8.0";
 var APP_DESCRIPTION = "The package manager for MCP servers";
 // src/core/export-import-service.ts
@@ -2664,7 +3354,7 @@ function createExportBundle(opts = {}) {
   };
   if (includeVault) {
     const vaultPath = getVaultPath();
-    if (import_node_fs9.default.existsSync(vaultPath)) {
+    if (import_node_fs12.default.existsSync(vaultPath)) {
       bundle.vault = readVault();
     }
   }
@@ -2730,7 +3420,7 @@ function importBundle(bundle, opts = {}) {
 // src/commands/export-command.ts
 var DEFAULT_OUTPUT = "mcpman-export.json";
-var export_command_default = (0, import_citty6.defineCommand)({
+var export_command_default = (0, import_citty9.defineCommand)({
   meta: {
     name: "export",
     description: "Export mcpman config, lockfile, vault, and plugins to a portable JSON file"
@@ -2753,31 +3443,245 @@ var export_command_default = (0, import_citty6.defineCommand)({
     }
   },
   run({ args }) {
-    const outputFile = args.output || DEFAULT_OUTPUT;
-    const outputPath = import_node_path11.default.resolve(outputFile);
-    const bundle = createExportBundle({
-      includeVault: !args["no-vault"],
-      includePlugins: !args["no-plugins"]
+    const outputFile = args.output || DEFAULT_OUTPUT;
+    const outputPath = import_node_path13.default.resolve(outputFile);
+    const bundle = createExportBundle({
+      includeVault: !args["no-vault"],
+      includePlugins: !args["no-plugins"]
+    });
+    const serverCount = Object.keys(bundle.lockfile.servers).length;
+    const configKeys = Object.keys(bundle.config).length;
+    import_node_fs13.default.writeFileSync(outputPath, JSON.stringify(bundle, null, 2), "utf-8");
+    console.log(`${import_picocolors9.default.green("\u2713")} Exported to ${import_picocolors9.default.bold(outputFile)}`);
+    console.log(import_picocolors9.default.dim(`  Config keys: ${configKeys}`));
+    console.log(import_picocolors9.default.dim(`  Servers: ${serverCount}`));
+    console.log(import_picocolors9.default.dim(`  Vault: ${bundle.vault ? "included" : "excluded"}`));
+    console.log(import_picocolors9.default.dim(`  Plugins: ${bundle.plugins?.length ?? 0}`));
+  }
+});
+// src/commands/group.ts
+init_cjs_shims();
+var import_node_child_process5 = require("child_process");
+var import_citty10 = require("citty");
+var import_picocolors10 = __toESM(require("picocolors"), 1);
+// src/core/group-manager.ts
+init_cjs_shims();
+var import_node_fs14 = __toESM(require("fs"), 1);
+init_paths();
+function readGroups(file) {
+  const target = file ?? getGroupsFile();
+  if (!import_node_fs14.default.existsSync(target)) return {};
+  try {
+    return JSON.parse(import_node_fs14.default.readFileSync(target, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+function writeGroups(store, file) {
+  const target = file ?? getGroupsFile();
+  const dir = target.slice(0, target.lastIndexOf("/"));
+  if (dir && !import_node_fs14.default.existsSync(dir)) {
+    import_node_fs14.default.mkdirSync(dir, { recursive: true });
+  }
+  import_node_fs14.default.writeFileSync(target, JSON.stringify(store, null, 2), "utf-8");
+}
+function addToGroup(group, servers, file) {
+  const store = readGroups(file);
+  const existing = new Set(store[group] ?? []);
+  for (const s of servers) existing.add(s);
+  store[group] = [...existing].sort();
+  writeGroups(store, file);
+}
+function removeFromGroup(group, servers, file) {
+  const store = readGroups(file);
+  if (!store[group]) return;
+  const toRemove = new Set(servers);
+  store[group] = store[group].filter((s) => !toRemove.has(s));
+  if (store[group].length === 0) delete store[group];
+  writeGroups(store, file);
+}
+function getGroup(group, file) {
+  return readGroups(file)[group] ?? [];
+}
+function listGroups(file) {
+  return Object.keys(readGroups(file)).sort();
+}
+function deleteGroup(group, file) {
+  const store = readGroups(file);
+  if (!(group in store)) return;
+  delete store[group];
+  writeGroups(store, file);
+}
+function groupExists(group, file) {
+  return group in readGroups(file);
+}
+// src/commands/group.ts
+init_lockfile();
+var addCmd = (0, import_citty10.defineCommand)({
+  meta: { name: "add", description: "Add servers to a group" },
+  args: {
+    name: { type: "positional", description: "Group name", required: true },
+    servers: { type: "positional", description: "Server name(s)", required: true }
+  },
+  run({ args }) {
+    const servers = Array.isArray(args.servers) ? args.servers : [args.servers];
+    addToGroup(args.name, servers);
+    console.log(`${import_picocolors10.default.green("\u2713")} Added ${servers.join(", ")} to group ${import_picocolors10.default.cyan(args.name)}`);
+  }
+});
+var rmCmd = (0, import_citty10.defineCommand)({
+  meta: { name: "rm", description: "Remove servers from a group" },
+  args: {
+    name: { type: "positional", description: "Group name", required: true },
+    servers: { type: "positional", description: "Server name(s)", required: true }
+  },
+  run({ args }) {
+    const servers = Array.isArray(args.servers) ? args.servers : [args.servers];
+    removeFromGroup(args.name, servers);
+    console.log(`${import_picocolors10.default.green("\u2713")} Removed ${servers.join(", ")} from group ${import_picocolors10.default.cyan(args.name)}`);
+  }
+});
+var listCmd2 = (0, import_citty10.defineCommand)({
+  meta: { name: "list", description: "List all groups (or members of a group)" },
+  args: {
+    name: { type: "positional", description: "Group name (optional)", required: false }
+  },
+  run({ args }) {
+    if (args.name) {
+      const members = getGroup(args.name);
+      if (members.length === 0) {
+        console.log(import_picocolors10.default.dim(`Group "${args.name}" is empty or does not exist.`));
+        return;
+      }
+      console.log(`
+${import_picocolors10.default.bold(import_picocolors10.default.cyan(args.name))}`);
+      for (const s of members) console.log(`  ${import_picocolors10.default.green("\u25CF")} ${s}`);
+      console.log("");
+    } else {
+      const groups = listGroups();
+      if (groups.length === 0) {
+        console.log(import_picocolors10.default.dim("No groups defined. Use `mcpman group add <name> <server>`."));
+        return;
+      }
+      console.log("");
+      for (const g of groups) {
+        const members = getGroup(g);
+        console.log(
+          `  ${import_picocolors10.default.cyan(import_picocolors10.default.bold(g))}  ${import_picocolors10.default.dim(`(${members.length} server${members.length !== 1 ? "s" : ""})`)}`
+        );
+        for (const s of members) console.log(`    ${import_picocolors10.default.dim("\xB7")} ${s}`);
+      }
+      console.log("");
+    }
+  }
+});
+var deleteCmd = (0, import_citty10.defineCommand)({
+  meta: { name: "delete", description: "Delete an entire group" },
+  args: {
+    name: { type: "positional", description: "Group name", required: true }
+  },
+  run({ args }) {
+    if (!groupExists(args.name)) {
+      console.error(`${import_picocolors10.default.red("\u2717")} Group "${args.name}" does not exist.`);
+      process.exit(1);
+    }
+    deleteGroup(args.name);
+    console.log(`${import_picocolors10.default.green("\u2713")} Deleted group ${import_picocolors10.default.cyan(args.name)}`);
+  }
+});
+var installCmd = (0, import_citty10.defineCommand)({
+  meta: { name: "install", description: "Install all servers in a group" },
+  args: {
+    name: { type: "positional", description: "Group name", required: true }
+  },
+  async run({ args }) {
+    const members = getGroup(args.name);
+    if (members.length === 0) {
+      console.error(`${import_picocolors10.default.red("\u2717")} Group "${args.name}" is empty or does not exist.`);
+      process.exit(1);
+    }
+    console.log(
+      `${import_picocolors10.default.cyan("Installing")} group ${import_picocolors10.default.bold(args.name)} (${members.length} servers)...`
+    );
+    for (const server of members) {
+      console.log(`
+  ${import_picocolors10.default.dim("\u2192")} Installing ${import_picocolors10.default.bold(server)}...`);
+      await runInstall(server);
+    }
+    console.log(`
+${import_picocolors10.default.green("\u2713")} Group install complete.`);
+  }
+});
+var runCmd = (0, import_citty10.defineCommand)({
+  meta: { name: "run", description: "Run all servers in a group concurrently" },
+  args: {
+    name: { type: "positional", description: "Group name", required: true }
+  },
+  run({ args }) {
+    const members = getGroup(args.name);
+    if (members.length === 0) {
+      console.error(`${import_picocolors10.default.red("\u2717")} Group "${args.name}" is empty or does not exist.`);
+      process.exit(1);
+    }
+    const lockfile = readLockfile();
+    console.log(
+      `${import_picocolors10.default.cyan("Spawning")} group ${import_picocolors10.default.bold(args.name)} (${members.length} servers)...
+`
+    );
+    for (const server of members) {
+      const entry = lockfile.servers[server];
+      if (!entry) {
+        console.warn(`  ${import_picocolors10.default.yellow("!")} ${server} not in lockfile \u2014 skipping`);
+        continue;
+      }
+      const child = (0, import_node_child_process5.spawn)(entry.command, entry.args ?? [], {
+        env: process.env,
+        stdio: "inherit",
+        detached: false
+      });
+      child.on("error", (err) => {
+        console.error(`  ${import_picocolors10.default.red("\u2717")} ${server}: ${err.message}`);
+      });
+      console.log(`  ${import_picocolors10.default.green("\u2713")} Spawned ${import_picocolors10.default.bold(server)} (pid ${child.pid ?? "?"})`);
+    }
+  }
+});
+function runInstall(server) {
+  return new Promise((resolve, reject) => {
+    const child = (0, import_node_child_process5.spawn)("mcpman", ["install", server], { stdio: "inherit" });
+    child.on("close", (code) => {
+      if (code === 0) resolve();
+      else reject(new Error(`install exited with code ${code}`));
     });
-    const serverCount = Object.keys(bundle.lockfile.servers).length;
-    const configKeys = Object.keys(bundle.config).length;
-    import_node_fs10.default.writeFileSync(outputPath, JSON.stringify(bundle, null, 2), "utf-8");
-    console.log(`${import_picocolors6.default.green("\u2713")} Exported to ${import_picocolors6.default.bold(outputFile)}`);
-    console.log(import_picocolors6.default.dim(`  Config keys: ${configKeys}`));
-    console.log(import_picocolors6.default.dim(`  Servers: ${serverCount}`));
-    console.log(import_picocolors6.default.dim(`  Vault: ${bundle.vault ? "included" : "excluded"}`));
-    console.log(import_picocolors6.default.dim(`  Plugins: ${bundle.plugins?.length ?? 0}`));
+    child.on("error", reject);
+  });
+}
+var group_default = (0, import_citty10.defineCommand)({
+  meta: {
+    name: "group",
+    description: "Manage named server groups"
+  },
+  subCommands: {
+    add: addCmd,
+    rm: rmCmd,
+    list: listCmd2,
+    delete: deleteCmd,
+    install: installCmd,
+    run: runCmd
   }
 });
 // src/commands/import-command.ts
 init_cjs_shims();
-var import_node_fs11 = __toESM(require("fs"), 1);
-var import_node_path12 = __toESM(require("path"), 1);
+var import_node_fs15 = __toESM(require("fs"), 1);
+var import_node_path14 = __toESM(require("path"), 1);
 var p4 = __toESM(require("@clack/prompts"), 1);
-var import_citty7 = require("citty");
-var import_picocolors7 = __toESM(require("picocolors"), 1);
-var import_command_default = (0, import_citty7.defineCommand)({
+var import_citty11 = require("citty");
+var import_picocolors11 = __toESM(require("picocolors"), 1);
+var import_command_default = (0, import_citty11.defineCommand)({
   meta: {
     name: "import",
     description: "Import mcpman config, lockfile, vault, and plugins from an export file"
@@ -2800,21 +3704,21 @@ var import_command_default = (0, import_citty7.defineCommand)({
     }
   },
   async run({ args }) {
-    const filePath = import_node_path12.default.resolve(args.file);
-    if (!import_node_fs11.default.existsSync(filePath)) {
-      console.error(`${import_picocolors7.default.red("\u2717")} File not found: ${filePath}`);
+    const filePath = import_node_path14.default.resolve(args.file);
+    if (!import_node_fs15.default.existsSync(filePath)) {
+      console.error(`${import_picocolors11.default.red("\u2717")} File not found: ${filePath}`);
       process.exit(1);
     }
     let raw;
     try {
-      raw = JSON.parse(import_node_fs11.default.readFileSync(filePath, "utf-8"));
+      raw = JSON.parse(import_node_fs15.default.readFileSync(filePath, "utf-8"));
     } catch {
-      console.error(`${import_picocolors7.default.red("\u2717")} Invalid JSON in ${filePath}`);
+      console.error(`${import_picocolors11.default.red("\u2717")} Invalid JSON in ${filePath}`);
       process.exit(1);
     }
     const error2 = validateBundle(raw);
     if (error2) {
-      console.error(`${import_picocolors7.default.red("\u2717")} Invalid export bundle: ${error2}`);
+      console.error(`${import_picocolors11.default.red("\u2717")} Invalid export bundle: ${error2}`);
       process.exit(1);
     }
     const bundle = raw;
@@ -2824,16 +3728,16 @@ var import_command_default = (0, import_citty7.defineCommand)({
     const hasVault = !!bundle.vault;
     const isDryRun = !!args["dry-run"];
     console.log("");
-    console.log(import_picocolors7.default.bold("Import summary:"));
-    console.log(import_picocolors7.default.dim(`  Source version: mcpman ${bundle.mcpmanVersion}`));
-    console.log(import_picocolors7.default.dim(`  Exported at: ${bundle.exportedAt}`));
-    console.log(`  Config keys: ${import_picocolors7.default.cyan(String(configKeys))}`);
-    console.log(`  Servers: ${import_picocolors7.default.cyan(String(serverCount))}`);
-    console.log(`  Vault: ${hasVault ? import_picocolors7.default.green("included") : import_picocolors7.default.dim("not included")}`);
-    console.log(`  Plugins: ${import_picocolors7.default.cyan(String(pluginCount))}`);
+    console.log(import_picocolors11.default.bold("Import summary:"));
+    console.log(import_picocolors11.default.dim(`  Source version: mcpman ${bundle.mcpmanVersion}`));
+    console.log(import_picocolors11.default.dim(`  Exported at: ${bundle.exportedAt}`));
+    console.log(`  Config keys: ${import_picocolors11.default.cyan(String(configKeys))}`);
+    console.log(`  Servers: ${import_picocolors11.default.cyan(String(serverCount))}`);
+    console.log(`  Vault: ${hasVault ? import_picocolors11.default.green("included") : import_picocolors11.default.dim("not included")}`);
+    console.log(`  Plugins: ${import_picocolors11.default.cyan(String(pluginCount))}`);
     console.log("");
     if (isDryRun) {
-      console.log(import_picocolors7.default.yellow("  [dry-run] No changes applied."));
+      console.log(import_picocolors11.default.yellow("  [dry-run] No changes applied."));
       return;
     }
     if (!args.yes) {
@@ -2847,19 +3751,19 @@ var import_command_default = (0, import_citty7.defineCommand)({
       }
     }
     const summary = importBundle(bundle, { dryRun: false });
-    console.log(`${import_picocolors7.default.green("\u2713")} Import complete`);
-    console.log(import_picocolors7.default.dim(`  Config keys restored: ${summary.configKeys}`));
-    console.log(import_picocolors7.default.dim(`  Servers restored: ${summary.servers}`));
-    console.log(import_picocolors7.default.dim(`  Vault: ${summary.vaultImported ? "restored" : "skipped"}`));
-    console.log(import_picocolors7.default.dim(`  Plugins installed: ${summary.pluginsInstalled}`));
+    console.log(`${import_picocolors11.default.green("\u2713")} Import complete`);
+    console.log(import_picocolors11.default.dim(`  Config keys restored: ${summary.configKeys}`));
+    console.log(import_picocolors11.default.dim(`  Servers restored: ${summary.servers}`));
+    console.log(import_picocolors11.default.dim(`  Vault: ${summary.vaultImported ? "restored" : "skipped"}`));
+    console.log(import_picocolors11.default.dim(`  Plugins installed: ${summary.pluginsInstalled}`));
   }
 });
 // src/commands/info.ts
 init_cjs_shims();
-var import_citty8 = require("citty");
+var import_citty12 = require("citty");
 var import_nanospinner2 = require("nanospinner");
-var import_picocolors8 = __toESM(require("picocolors"), 1);
+var import_picocolors12 = __toESM(require("picocolors"), 1);
 // src/core/package-info.ts
 init_cjs_shims();
@@ -2917,11 +3821,11 @@ async function getPackageInfo(serverName) {
 // src/commands/info.ts
 function colorRisk2(score, riskLevel) {
   const label = score !== null ? `${score}/100 (${riskLevel})` : riskLevel;
-  if (riskLevel === "LOW") return import_picocolors8.default.green(label);
-  if (riskLevel === "MEDIUM") return import_picocolors8.default.yellow(label);
-  if (riskLevel === "HIGH") return import_picocolors8.default.red(label);
-  if (riskLevel === "CRITICAL") return import_picocolors8.default.bold(import_picocolors8.default.red(label));
-  return import_picocolors8.default.dim(label);
+  if (riskLevel === "LOW") return import_picocolors12.default.green(label);
+  if (riskLevel === "MEDIUM") return import_picocolors12.default.yellow(label);
+  if (riskLevel === "HIGH") return import_picocolors12.default.red(label);
+  if (riskLevel === "CRITICAL") return import_picocolors12.default.bold(import_picocolors12.default.red(label));
+  return import_picocolors12.default.dim(label);
 }
 function formatDaysAgo(isoDate) {
   if (!isoDate) return "unknown";
@@ -2931,54 +3835,54 @@ function formatDaysAgo(isoDate) {
   return `${days} days ago`;
 }
 function printInfo(info2) {
-  const installedBadge = info2.isInstalled ? import_picocolors8.default.green(" [installed]") : import_picocolors8.default.dim(" [not installed]");
+  const installedBadge = info2.isInstalled ? import_picocolors12.default.green(" [installed]") : import_picocolors12.default.dim(" [not installed]");
   console.log();
-  console.log(import_picocolors8.default.bold(`  ${info2.name}@${info2.version}`) + installedBadge);
-  console.log(import_picocolors8.default.dim(`  ${"\u2500".repeat(60)}`));
-  console.log(`  ${import_picocolors8.default.dim("Source:")}   ${info2.source}`);
-  console.log(`  ${import_picocolors8.default.dim("Runtime:")}  ${info2.runtime}`);
+  console.log(import_picocolors12.default.bold(`  ${info2.name}@${info2.version}`) + installedBadge);
+  console.log(import_picocolors12.default.dim(`  ${"\u2500".repeat(60)}`));
+  console.log(`  ${import_picocolors12.default.dim("Source:")}   ${info2.source}`);
+  console.log(`  ${import_picocolors12.default.dim("Runtime:")}  ${info2.runtime}`);
   if (info2.description) {
-    console.log(`  ${import_picocolors8.default.dim("Description:")} ${info2.description}`);
+    console.log(`  ${import_picocolors12.default.dim("Description:")} ${info2.description}`);
   }
   if (info2.deprecated) {
-    console.log(`  ${import_picocolors8.default.red("[DEPRECATED]")} This package is deprecated`);
+    console.log(`  ${import_picocolors12.default.red("[DEPRECATED]")} This package is deprecated`);
   }
   console.log();
-  console.log(`  ${import_picocolors8.default.bold("Trust & Security")}`);
-  console.log(`  ${import_picocolors8.default.dim("Trust score:")}   ${colorRisk2(info2.trustScore, info2.riskLevel)}`);
+  console.log(`  ${import_picocolors12.default.bold("Trust & Security")}`);
+  console.log(`  ${import_picocolors12.default.dim("Trust score:")}   ${colorRisk2(info2.trustScore, info2.riskLevel)}`);
   if (info2.source === "npm") {
     console.log(
-      `  ${import_picocolors8.default.dim("Downloads:")}    ${info2.weeklyDownloads.toLocaleString()}/week  ${import_picocolors8.default.dim("|")}  ${import_picocolors8.default.dim("Age:")} ${info2.packageAge}d  ${import_picocolors8.default.dim("|")}  ${import_picocolors8.default.dim("Maintainers:")} ${info2.maintainerCount}`
+      `  ${import_picocolors12.default.dim("Downloads:")}    ${info2.weeklyDownloads.toLocaleString()}/week  ${import_picocolors12.default.dim("|")}  ${import_picocolors12.default.dim("Age:")} ${info2.packageAge}d  ${import_picocolors12.default.dim("|")}  ${import_picocolors12.default.dim("Maintainers:")} ${info2.maintainerCount}`
     );
     if (info2.lastPublish) {
-      console.log(`  ${import_picocolors8.default.dim("Last publish:")} ${formatDaysAgo(info2.lastPublish)}`);
+      console.log(`  ${import_picocolors12.default.dim("Last publish:")} ${formatDaysAgo(info2.lastPublish)}`);
     }
   } else {
-    console.log(import_picocolors8.default.dim("  (Trust data available for npm packages only)"));
+    console.log(import_picocolors12.default.dim("  (Trust data available for npm packages only)"));
   }
   console.log();
-  console.log(`  ${import_picocolors8.default.bold("Environment Variables")}`);
+  console.log(`  ${import_picocolors12.default.bold("Environment Variables")}`);
   if (info2.envVars.length > 0) {
     for (const env of info2.envVars) {
-      console.log(`    ${import_picocolors8.default.cyan("\u2022")} ${env}`);
+      console.log(`    ${import_picocolors12.default.cyan("\u2022")} ${env}`);
     }
   } else {
-    console.log(import_picocolors8.default.dim("    none required"));
+    console.log(import_picocolors12.default.dim("    none required"));
   }
   console.log();
-  console.log(`  ${import_picocolors8.default.bold("Installed Clients")}`);
+  console.log(`  ${import_picocolors12.default.bold("Installed Clients")}`);
   if (info2.installedClients.length > 0) {
     for (const client of info2.installedClients) {
-      console.log(`    ${import_picocolors8.default.green("\u2713")} ${client}`);
+      console.log(`    ${import_picocolors12.default.green("\u2713")} ${client}`);
     }
   } else {
-    console.log(import_picocolors8.default.dim("    Not installed in any client"));
+    console.log(import_picocolors12.default.dim("    Not installed in any client"));
   }
   console.log();
-  console.log(import_picocolors8.default.dim(`  ${"\u2500".repeat(60)}`));
+  console.log(import_picocolors12.default.dim(`  ${"\u2500".repeat(60)}`));
   console.log();
 }
-var info_default = (0, import_citty8.defineCommand)({
+var info_default = (0, import_citty12.defineCommand)({
   meta: {
     name: "info",
     description: "Show detailed metadata for an MCP server (installed or from registry)"
@@ -3002,13 +3906,13 @@ var info_default = (0, import_citty8.defineCommand)({
       info2 = await getPackageInfo(args.server);
     } catch (err) {
       spinner5.error({ text: "Failed to fetch package info" });
-      console.error(import_picocolors8.default.red(String(err)));
+      console.error(import_picocolors12.default.red(String(err)));
       process.exit(1);
     }
     if (!info2) {
       spinner5.error({ text: `Package not found: ${args.server}` });
       console.log(
-        import_picocolors8.default.dim(`
+        import_picocolors12.default.dim(`
   "${args.server}" was not found in the npm registry or your lockfile.
 `)
       );
@@ -3025,11 +3929,11 @@ var info_default = (0, import_citty8.defineCommand)({
 // src/commands/init.ts
 init_cjs_shims();
-var import_node_path13 = __toESM(require("path"), 1);
+var import_node_path15 = __toESM(require("path"), 1);
 var p5 = __toESM(require("@clack/prompts"), 1);
-var import_citty9 = require("citty");
+var import_citty13 = require("citty");
 init_lockfile();
-var init_default = (0, import_citty9.defineCommand)({
+var init_default = (0, import_citty13.defineCommand)({
   meta: {
     name: "init",
     description: "Initialize mcpman.lock in the current project"
@@ -3045,7 +3949,7 @@ var init_default = (0, import_citty9.defineCommand)({
   async run({ args }) {
     const nonInteractive = args.yes || !process.stdout.isTTY;
     p5.intro("mcpman init");
-    const targetPath = import_node_path13.default.join(process.cwd(), LOCKFILE_NAME);
+    const targetPath = import_node_path15.default.join(process.cwd(), LOCKFILE_NAME);
     const existing = findLockfile();
     if (existing) {
       if (nonInteractive) {
@@ -3130,7 +4034,7 @@ var init_default = (0, import_citty9.defineCommand)({
 // src/commands/install.ts
 init_cjs_shims();
 var p8 = __toESM(require("@clack/prompts"), 1);
-var import_citty10 = require("citty");
+var import_citty14 = require("citty");
 // src/core/installer.ts
 init_cjs_shims();
@@ -3290,7 +4194,7 @@ init_lockfile();
 // src/utils/logger.ts
 init_cjs_shims();
-var import_picocolors9 = __toESM(require("picocolors"), 1);
+var import_picocolors13 = __toESM(require("picocolors"), 1);
 var noColor = process.env.NO_COLOR !== void 0 || process.argv.includes("--no-color");
 var isVerbose = process.argv.includes("--verbose");
 var isJson = process.argv.includes("--json");
@@ -3299,18 +4203,18 @@ function colorize(fn, text2) {
 }
 function info(message) {
   if (isJson) return;
-  console.log(`${colorize(import_picocolors9.default.cyan, "i")} ${message}`);
+  console.log(`${colorize(import_picocolors13.default.cyan, "i")} ${message}`);
 }
 function error(message) {
   if (isJson) return;
-  console.error(`${colorize(import_picocolors9.default.red, "\u2717")} ${message}`);
+  console.error(`${colorize(import_picocolors13.default.red, "\u2717")} ${message}`);
 }
 function json(data) {
   console.log(JSON.stringify(data, null, 2));
 }
 // src/commands/install.ts
-var install_default = (0, import_citty10.defineCommand)({
+var install_default = (0, import_citty14.defineCommand)({
   meta: {
     name: "install",
     description: "Install an MCP server into one or more AI clients"
@@ -3373,26 +4277,26 @@ async function restoreFromLockfile() {
 // src/commands/link.ts
 init_cjs_shims();
-var import_node_path15 = __toESM(require("path"), 1);
-var import_citty11 = require("citty");
-var import_picocolors10 = __toESM(require("picocolors"), 1);
+var import_node_path17 = __toESM(require("path"), 1);
+var import_citty15 = require("citty");
+var import_picocolors14 = __toESM(require("picocolors"), 1);
 init_client_detector();
 // src/core/link-service.ts
 init_cjs_shims();
-var import_node_fs12 = __toESM(require("fs"), 1);
-var import_node_path14 = __toESM(require("path"), 1);
+var import_node_fs16 = __toESM(require("fs"), 1);
+var import_node_path16 = __toESM(require("path"), 1);
 init_lockfile();
 function detectLocalServer(dir) {
-  if (!import_node_fs12.default.existsSync(dir)) {
+  if (!import_node_fs16.default.existsSync(dir)) {
     throw new Error(`Directory does not exist: ${dir}`);
   }
-  const pkgPath = import_node_path14.default.join(dir, "package.json");
-  if (import_node_fs12.default.existsSync(pkgPath)) {
+  const pkgPath = import_node_path16.default.join(dir, "package.json");
+  if (import_node_fs16.default.existsSync(pkgPath)) {
     return detectNodeServer(dir, pkgPath);
   }
-  const pyprojectPath = import_node_path14.default.join(dir, "pyproject.toml");
-  if (import_node_fs12.default.existsSync(pyprojectPath)) {
+  const pyprojectPath = import_node_path16.default.join(dir, "pyproject.toml");
+  if (import_node_fs16.default.existsSync(pyprojectPath)) {
     return detectPythonServer(dir, pyprojectPath);
   }
   throw new Error(
@@ -3400,28 +4304,28 @@ function detectLocalServer(dir) {
   );
 }
 function detectNodeServer(dir, pkgPath) {
-  const raw = import_node_fs12.default.readFileSync(pkgPath, "utf-8");
+  const raw = import_node_fs16.default.readFileSync(pkgPath, "utf-8");
   const pkg = JSON.parse(raw);
-  const name = String(pkg.name ?? import_node_path14.default.basename(dir));
+  const name = String(pkg.name ?? import_node_path16.default.basename(dir));
   const version = String(pkg.version ?? "0.0.0");
   let entryPoint = null;
   if (pkg.bin) {
     if (typeof pkg.bin === "string") {
-      entryPoint = import_node_path14.default.resolve(dir, pkg.bin);
+      entryPoint = import_node_path16.default.resolve(dir, pkg.bin);
     } else if (typeof pkg.bin === "object" && pkg.bin !== null) {
       const binObj = pkg.bin;
       const firstBin = Object.values(binObj)[0];
-      if (firstBin) entryPoint = import_node_path14.default.resolve(dir, firstBin);
+      if (firstBin) entryPoint = import_node_path16.default.resolve(dir, firstBin);
     }
   }
   if (!entryPoint && pkg.main) {
-    entryPoint = import_node_path14.default.resolve(dir, String(pkg.main));
+    entryPoint = import_node_path16.default.resolve(dir, String(pkg.main));
   }
   if (!entryPoint) {
     const candidates = ["src/index.ts", "src/index.js", "index.ts", "index.js"];
     for (const c of candidates) {
-      const candidate = import_node_path14.default.join(dir, c);
-      if (import_node_fs12.default.existsSync(candidate)) {
+      const candidate = import_node_path16.default.join(dir, c);
+      if (import_node_fs16.default.existsSync(candidate)) {
         entryPoint = candidate;
         break;
       }
@@ -3446,20 +4350,20 @@ function detectNodeServer(dir, pkgPath) {
   return { name, version, command, args, envVars, absolutePath: dir, runtime: "node" };
 }
 function detectPythonServer(dir, pyprojectPath) {
-  const raw = import_node_fs12.default.readFileSync(pyprojectPath, "utf-8");
-  const name = extractTomlValue(raw, "name") ?? import_node_path14.default.basename(dir);
+  const raw = import_node_fs16.default.readFileSync(pyprojectPath, "utf-8");
+  const name = extractTomlValue(raw, "name") ?? import_node_path16.default.basename(dir);
   const version = extractTomlValue(raw, "version") ?? "0.0.0";
   let pythonCmd = "python3";
-  const venvPython = import_node_path14.default.join(dir, ".venv", "bin", "python");
-  if (import_node_fs12.default.existsSync(venvPython)) {
+  const venvPython = import_node_path16.default.join(dir, ".venv", "bin", "python");
+  if (import_node_fs16.default.existsSync(venvPython)) {
     pythonCmd = venvPython;
   }
   const entryCandidate = [
-    import_node_path14.default.join(dir, "main.py"),
-    import_node_path14.default.join(dir, name.replace(/-/g, "_"), "main.py"),
-    import_node_path14.default.join(dir, "__main__.py")
-  ].find((p13) => import_node_fs12.default.existsSync(p13));
-  const entryPoint = entryCandidate ?? import_node_path14.default.join(dir, "main.py");
+    import_node_path16.default.join(dir, "main.py"),
+    import_node_path16.default.join(dir, name.replace(/-/g, "_"), "main.py"),
+    import_node_path16.default.join(dir, "__main__.py")
+  ].find((p14) => import_node_fs16.default.existsSync(p14));
+  const entryPoint = entryCandidate ?? import_node_path16.default.join(dir, "main.py");
   return {
     name,
     version,
@@ -3507,7 +4411,7 @@ async function registerLinkedServer(linkResult, clients, lockfilePath, nameOverr
 }
 // src/commands/link.ts
-var link_default = (0, import_citty11.defineCommand)({
+var link_default = (0, import_citty15.defineCommand)({
   meta: {
     name: "link",
     description: "Register a local MCP server directory with AI clients"
@@ -3533,42 +4437,42 @@ var link_default = (0, import_citty11.defineCommand)({
     const dirArg = args.dir ?? ".";
     const clientFilter = args.client;
     const nameOverride = args.name;
-    const absoluteDir = import_node_path15.default.resolve(dirArg);
+    const absoluteDir = import_node_path17.default.resolve(dirArg);
     let linkResult;
     try {
       linkResult = detectLocalServer(absoluteDir);
     } catch (err) {
-      console.error(import_picocolors10.default.red(`  Error: ${err instanceof Error ? err.message : String(err)}`));
+      console.error(import_picocolors14.default.red(`  Error: ${err instanceof Error ? err.message : String(err)}`));
       process.exit(1);
     }
     const serverName = nameOverride ?? linkResult.name;
-    console.log(import_picocolors10.default.dim(`
-  Detected: ${import_picocolors10.default.cyan(serverName)} (${linkResult.runtime})`));
-    console.log(import_picocolors10.default.dim(`  Path: ${absoluteDir}`));
-    console.log(import_picocolors10.default.dim(`  Command: ${linkResult.command} ${linkResult.args.join(" ")}`));
+    console.log(import_picocolors14.default.dim(`
+  Detected: ${import_picocolors14.default.cyan(serverName)} (${linkResult.runtime})`));
+    console.log(import_picocolors14.default.dim(`  Path: ${absoluteDir}`));
+    console.log(import_picocolors14.default.dim(`  Command: ${linkResult.command} ${linkResult.args.join(" ")}`));
     const allClients = await getInstalledClients();
     const clients = clientFilter ? allClients.filter((c) => c.type === clientFilter) : allClients;
     if (clientFilter && clients.length === 0) {
-      console.error(import_picocolors10.default.red(`  Error: Unknown client '${clientFilter}'.`));
+      console.error(import_picocolors14.default.red(`  Error: Unknown client '${clientFilter}'.`));
       process.exit(1);
     }
     let registered;
     try {
       registered = await registerLinkedServer(linkResult, clients, void 0, nameOverride);
     } catch (err) {
-      console.error(import_picocolors10.default.red(`  Error: ${err instanceof Error ? err.message : String(err)}`));
+      console.error(import_picocolors14.default.red(`  Error: ${err instanceof Error ? err.message : String(err)}`));
       process.exit(1);
     }
     if (registered.length === 0) {
-      console.log(import_picocolors10.default.yellow("  Warning: No clients registered. Are any AI clients installed?"));
-      console.log(import_picocolors10.default.dim(`  Server saved to lockfile with source "local".`));
+      console.log(import_picocolors14.default.yellow("  Warning: No clients registered. Are any AI clients installed?"));
+      console.log(import_picocolors14.default.dim(`  Server saved to lockfile with source "local".`));
     } else {
-      console.log(import_picocolors10.default.green(`
-  Linked ${import_picocolors10.default.bold(serverName)} to: ${registered.join(", ")}
+      console.log(import_picocolors14.default.green(`
+  Linked ${import_picocolors14.default.bold(serverName)} to: ${registered.join(", ")}
 `));
-      console.log(import_picocolors10.default.dim(`  Run ${import_picocolors10.default.cyan("mcpman list")} to verify.`));
+      console.log(import_picocolors14.default.dim(`  Run ${import_picocolors14.default.cyan("mcpman list")} to verify.`));
       console.log(
-        import_picocolors10.default.dim(`  Run ${import_picocolors10.default.cyan(`mcpman watch ${serverName}`)} to start with auto-restart.`)
+        import_picocolors14.default.dim(`  Run ${import_picocolors14.default.cyan(`mcpman watch ${serverName}`)} to start with auto-restart.`)
       );
     }
     console.log();
@@ -3577,14 +4481,14 @@ var link_default = (0, import_citty11.defineCommand)({
 // src/commands/list.ts
 init_cjs_shims();
-var import_citty12 = require("citty");
-var import_picocolors11 = __toESM(require("picocolors"), 1);
+var import_citty16 = require("citty");
+var import_picocolors15 = __toESM(require("picocolors"), 1);
 var STATUS_ICON = {
-  healthy: import_picocolors11.default.green("\u25CF"),
-  unhealthy: import_picocolors11.default.red("\u25CF"),
-  unknown: import_picocolors11.default.dim("\u25CB")
+  healthy: import_picocolors15.default.green("\u25CF"),
+  unhealthy: import_picocolors15.default.red("\u25CF"),
+  unknown: import_picocolors15.default.dim("\u25CB")
 };
-var list_default = (0, import_citty12.defineCommand)({
+var list_default = (0, import_citty16.defineCommand)({
   meta: {
     name: "list",
     description: "List installed MCP servers"
@@ -3605,8 +4509,8 @@ var list_default = (0, import_citty12.defineCommand)({
     if (servers.length === 0) {
       const filter = args.client ? ` for client "${args.client}"` : "";
       console.log(
-        import_picocolors11.default.dim(
-          `No MCP servers installed${filter}. Run ${import_picocolors11.default.cyan("mcpman install <server>")} to get started.`
+        import_picocolors15.default.dim(
+          `No MCP servers installed${filter}. Run ${import_picocolors15.default.cyan("mcpman install <server>")} to get started.`
         )
       );
       return;
@@ -3632,9 +4536,9 @@ var list_default = (0, import_citty12.defineCommand)({
     const nameWidth = Math.max(4, ...withStatus.map((s) => s.name.length));
     const clientsWidth = Math.max(7, ...withStatus.map((s) => formatClients(s.clients).length));
     const header = `  ${pad("NAME", nameWidth)}  ${pad("CLIENT(S)", clientsWidth)}  ${pad("COMMAND", 20)}  STATUS`;
-    console.log(import_picocolors11.default.dim(header));
+    console.log(import_picocolors15.default.dim(header));
     console.log(
-      import_picocolors11.default.dim(`  ${"-".repeat(nameWidth)}  ${"-".repeat(clientsWidth)}  ${"-".repeat(20)}  ------`)
+      import_picocolors15.default.dim(`  ${"-".repeat(nameWidth)}  ${"-".repeat(clientsWidth)}  ${"-".repeat(20)}  ------`)
     );
     for (const s of withStatus) {
       const icon = STATUS_ICON[s.status];
@@ -3649,7 +4553,7 @@ var list_default = (0, import_citty12.defineCommand)({
     }
     const clientSet = new Set(withStatus.flatMap((s) => s.clients));
     console.log(
-      import_picocolors11.default.dim(
+      import_picocolors15.default.dim(
         `
   ${withStatus.length} server${withStatus.length !== 1 ? "s" : ""} \xB7 ${clientSet.size} client${clientSet.size !== 1 ? "s" : ""}`
       )
@@ -3662,24 +4566,24 @@ function pad(s, width) {
 function truncate(s, max) {
   return s.length > max ? `${s.slice(0, max - 1)}\u2026` : s;
 }
-var CLIENT_DISPLAY = {
+var CLIENT_DISPLAY2 = {
   "claude-desktop": "Claude",
   cursor: "Cursor",
   vscode: "VS Code",
   windsurf: "Windsurf"
 };
 function formatClients(clients) {
-  return clients.map((c) => CLIENT_DISPLAY[c] ?? c).join(", ");
+  return clients.map((c) => CLIENT_DISPLAY2[c] ?? c).join(", ");
 }
 // src/commands/logs.ts
 init_cjs_shims();
-var import_node_child_process4 = require("child_process");
-var import_citty13 = require("citty");
-var import_picocolors12 = __toESM(require("picocolors"), 1);
+var import_node_child_process6 = require("child_process");
+var import_citty17 = require("citty");
+var import_picocolors16 = __toESM(require("picocolors"), 1);
 init_lockfile();
 init_vault_service();
-var logs_default = (0, import_citty13.defineCommand)({
+var logs_default = (0, import_citty17.defineCommand)({
   meta: {
     name: "logs",
     description: "Stream stdout/stderr from an MCP server"
@@ -3702,7 +4606,7 @@ var logs_default = (0, import_citty13.defineCommand)({
     const lockfile = readLockfile();
     const entry = lockfile.servers[serverName];
     if (!entry) {
-      console.error(import_picocolors12.default.red(`  Error: Server '${serverName}' is not installed.`));
+      console.error(import_picocolors16.default.red(`  Error: Server '${serverName}' is not installed.`));
       process.exit(1);
     }
     const lockfileEnv = parseEnvFlags(entry.envVars);
@@ -3712,24 +4616,24 @@ var logs_default = (0, import_citty13.defineCommand)({
       ...lockfileEnv,
       ...vaultEnv
     };
-    console.log(import_picocolors12.default.dim(`  Streaming logs for ${import_picocolors12.default.cyan(serverName)}... (Ctrl+C to stop)
+    console.log(import_picocolors16.default.dim(`  Streaming logs for ${import_picocolors16.default.cyan(serverName)}... (Ctrl+C to stop)
 `));
-    const child = (0, import_node_child_process4.spawn)(entry.command, entry.args, {
+    const child = (0, import_node_child_process6.spawn)(entry.command, entry.args, {
       env: finalEnv,
       stdio: ["pipe", "pipe", "pipe"]
     });
     child.stdout?.on("data", (chunk) => {
-      process.stdout.write(import_picocolors12.default.dim("[stdout] ") + chunk.toString());
+      process.stdout.write(import_picocolors16.default.dim("[stdout] ") + chunk.toString());
     });
     child.stderr?.on("data", (chunk) => {
-      process.stderr.write(import_picocolors12.default.yellow("[stderr] ") + chunk.toString());
+      process.stderr.write(import_picocolors16.default.yellow("[stderr] ") + chunk.toString());
     });
     child.on("error", (err) => {
-      console.error(import_picocolors12.default.red(`  Failed to start '${serverName}': ${err.message}`));
+      console.error(import_picocolors16.default.red(`  Failed to start '${serverName}': ${err.message}`));
       process.exit(1);
     });
     child.on("close", (code) => {
-      console.log(import_picocolors12.default.dim(`
+      console.log(import_picocolors16.default.dim(`
   Process exited with code ${code ?? 0}`));
       process.exit(code ?? 0);
     });
@@ -3753,12 +4657,101 @@ async function loadVaultSecrets(serverName) {
   }
 }
+// src/commands/pin.ts
+init_cjs_shims();
+var import_citty18 = require("citty");
+var import_picocolors17 = __toESM(require("picocolors"), 1);
+init_lockfile();
+var pin_default = (0, import_citty18.defineCommand)({
+  meta: {
+    name: "pin",
+    description: "Pin a server to a specific version"
+  },
+  args: {
+    server: {
+      type: "positional",
+      description: "Server name to pin/unpin",
+      required: false
+    },
+    version: {
+      type: "positional",
+      description: "Version to pin to (defaults to currently installed version)",
+      required: false
+    },
+    unpin: {
+      type: "boolean",
+      description: "Remove the pin for a server",
+      default: false
+    },
+    list: {
+      type: "boolean",
+      description: "List all pinned servers",
+      default: false
+    }
+  },
+  run({ args }) {
+    if (args.list) {
+      const pins = listPins();
+      if (pins.length === 0) {
+        console.log(import_picocolors17.default.dim("No servers are pinned."));
+        return;
+      }
+      console.log(`
+  ${import_picocolors17.default.bold("Pinned servers")}
+`);
+      for (const { server, version: version2 } of pins) {
+        console.log(`  ${import_picocolors17.default.cyan(import_picocolors17.default.bold(server))}  ${import_picocolors17.default.dim("@")}${import_picocolors17.default.green(version2)}`);
+      }
+      console.log("");
+      return;
+    }
+    if (args.unpin) {
+      if (!args.server) {
+        console.error(`${import_picocolors17.default.red("\u2717")} Specify a server name to unpin.`);
+        process.exit(1);
+      }
+      if (!isPinned(args.server)) {
+        console.log(import_picocolors17.default.dim(`"${args.server}" is not pinned.`));
+        return;
+      }
+      unpinServer(args.server);
+      console.log(`${import_picocolors17.default.green("\u2713")} Unpinned ${import_picocolors17.default.cyan(args.server)}`);
+      return;
+    }
+    if (!args.server) {
+      console.error(`${import_picocolors17.default.red("\u2717")} Specify a server name to pin. Use --list to see pins.`);
+      process.exit(1);
+    }
+    let version = args.version;
+    if (!version) {
+      const lockfile = readLockfile();
+      version = lockfile.servers[args.server]?.version;
+      if (!version) {
+        console.error(
+          `${import_picocolors17.default.red("\u2717")} "${args.server}" not found in lockfile. Specify a version explicitly.`
+        );
+        process.exit(1);
+      }
+    }
+    pinServer(args.server, version);
+    const prev = getPinnedVersion(args.server);
+    if (prev && prev !== version) {
+      console.log(
+        `${import_picocolors17.default.green("\u2713")} Re-pinned ${import_picocolors17.default.cyan(args.server)} ${import_picocolors17.default.dim(prev)} \u2192 ${import_picocolors17.default.green(version)}`
+      );
+    } else {
+      console.log(`${import_picocolors17.default.green("\u2713")} Pinned ${import_picocolors17.default.cyan(args.server)} @ ${import_picocolors17.default.green(version)}`);
+    }
+    console.log(import_picocolors17.default.dim("  Update notifications will be suppressed for this server."));
+  }
+});
 // src/commands/plugin.ts
 init_cjs_shims();
-var import_citty14 = require("citty");
+var import_citty19 = require("citty");
 var import_nanospinner3 = require("nanospinner");
-var import_picocolors13 = __toESM(require("picocolors"), 1);
-var addCommand = (0, import_citty14.defineCommand)({
+var import_picocolors18 = __toESM(require("picocolors"), 1);
+var addCommand = (0, import_citty19.defineCommand)({
   meta: { name: "add", description: "Install a plugin package" },
   args: {
     package: {
@@ -3776,23 +4769,23 @@ var addCommand = (0, import_citty14.defineCommand)({
       spinner5.stop();
       if (loaded) {
         console.log(
-          `${import_picocolors13.default.green("\u2713")} Plugin ${import_picocolors13.default.bold(loaded.name)} installed (prefix: ${import_picocolors13.default.cyan(loaded.prefix)})`
+          `${import_picocolors18.default.green("\u2713")} Plugin ${import_picocolors18.default.bold(loaded.name)} installed (prefix: ${import_picocolors18.default.cyan(loaded.prefix)})`
         );
       } else {
         console.log(
-          `${import_picocolors13.default.yellow("\u26A0")} Package ${import_picocolors13.default.bold(pkg)} installed but does not export a valid mcpman plugin.`
+          `${import_picocolors18.default.yellow("\u26A0")} Package ${import_picocolors18.default.bold(pkg)} installed but does not export a valid mcpman plugin.`
         );
       }
     } catch (err) {
       spinner5.stop();
       console.error(
-        `${import_picocolors13.default.red("\u2717")} Failed to install plugin: ${err instanceof Error ? err.message : String(err)}`
+        `${import_picocolors18.default.red("\u2717")} Failed to install plugin: ${err instanceof Error ? err.message : String(err)}`
       );
       process.exit(1);
     }
   }
 });
-var removeCommand = (0, import_citty14.defineCommand)({
+var removeCommand = (0, import_citty19.defineCommand)({
   meta: { name: "remove", description: "Uninstall a plugin package" },
   args: {
     package: {
@@ -3805,46 +4798,46 @@ var removeCommand = (0, import_citty14.defineCommand)({
     const pkg = args.package;
     const installed = listPluginPackages();
     if (!installed.includes(pkg)) {
-      console.log(import_picocolors13.default.dim(`Plugin "${pkg}" is not installed.`));
+      console.log(import_picocolors18.default.dim(`Plugin "${pkg}" is not installed.`));
       return;
     }
     try {
       removePluginPackage(pkg);
-      console.log(`${import_picocolors13.default.green("\u2713")} Plugin ${import_picocolors13.default.bold(pkg)} removed.`);
+      console.log(`${import_picocolors18.default.green("\u2713")} Plugin ${import_picocolors18.default.bold(pkg)} removed.`);
     } catch (err) {
       console.error(
-        `${import_picocolors13.default.red("\u2717")} Failed to remove plugin: ${err instanceof Error ? err.message : String(err)}`
+        `${import_picocolors18.default.red("\u2717")} Failed to remove plugin: ${err instanceof Error ? err.message : String(err)}`
       );
       process.exit(1);
     }
   }
 });
-var listCommand2 = (0, import_citty14.defineCommand)({
+var listCommand2 = (0, import_citty19.defineCommand)({
   meta: { name: "list", description: "List installed plugins" },
   run() {
     const packages = listPluginPackages();
     if (packages.length === 0) {
-      console.log(import_picocolors13.default.dim("No plugins installed. Use `mcpman plugin add <package>`."));
+      console.log(import_picocolors18.default.dim("No plugins installed. Use `mcpman plugin add <package>`."));
       return;
     }
     console.log("");
-    console.log(import_picocolors13.default.bold("Installed plugins:"));
+    console.log(import_picocolors18.default.bold("Installed plugins:"));
     console.log("");
     for (const pkg of packages) {
       const loaded = loadPlugin(pkg);
       if (loaded) {
         console.log(
-          `  ${import_picocolors13.default.green("\u25CF")} ${import_picocolors13.default.bold(loaded.name)}  prefix: ${import_picocolors13.default.cyan(loaded.prefix)}  pkg: ${import_picocolors13.default.dim(pkg)}`
+          `  ${import_picocolors18.default.green("\u25CF")} ${import_picocolors18.default.bold(loaded.name)}  prefix: ${import_picocolors18.default.cyan(loaded.prefix)}  pkg: ${import_picocolors18.default.dim(pkg)}`
         );
       } else {
-        console.log(`  ${import_picocolors13.default.yellow("\u25CF")} ${import_picocolors13.default.dim(pkg)}  ${import_picocolors13.default.yellow("(failed to load)")}`);
+        console.log(`  ${import_picocolors18.default.yellow("\u25CF")} ${import_picocolors18.default.dim(pkg)}  ${import_picocolors18.default.yellow("(failed to load)")}`);
       }
     }
     console.log("");
-    console.log(import_picocolors13.default.dim(`  ${packages.length} plugin${packages.length !== 1 ? "s" : ""} installed`));
+    console.log(import_picocolors18.default.dim(`  ${packages.length} plugin${packages.length !== 1 ? "s" : ""} installed`));
   }
 });
-var plugin_default = (0, import_citty14.defineCommand)({
+var plugin_default = (0, import_citty19.defineCommand)({
   meta: {
     name: "plugin",
     description: "Manage mcpman plugins for custom registries"
@@ -3858,26 +4851,26 @@ var plugin_default = (0, import_citty14.defineCommand)({
 // src/commands/profiles.ts
 init_cjs_shims();
-var import_citty15 = require("citty");
-var import_picocolors14 = __toESM(require("picocolors"), 1);
+var import_citty20 = require("citty");
+var import_picocolors19 = __toESM(require("picocolors"), 1);
 init_lockfile();
 // src/core/profile-service.ts
 init_cjs_shims();
-var import_node_fs13 = __toESM(require("fs"), 1);
-var import_node_path16 = __toESM(require("path"), 1);
+var import_node_fs17 = __toESM(require("fs"), 1);
+var import_node_path18 = __toESM(require("path"), 1);
 init_paths();
 init_lockfile();
-function ensureDir(dir = getProfilesDir()) {
-  import_node_fs13.default.mkdirSync(dir, { recursive: true });
+function ensureDir2(dir = getProfilesDir()) {
+  import_node_fs17.default.mkdirSync(dir, { recursive: true });
 }
 function profilePath(name, dir = getProfilesDir()) {
-  return import_node_path16.default.join(dir, `${name}.json`);
+  return import_node_path18.default.join(dir, `${name}.json`);
 }
 function createProfile(name, description = "", dir = getProfilesDir()) {
-  ensureDir(dir);
+  ensureDir2(dir);
   const filePath = profilePath(name, dir);
-  if (import_node_fs13.default.existsSync(filePath)) {
+  if (import_node_fs17.default.existsSync(filePath)) {
     throw new Error(`Profile '${name}' already exists. Delete it first or use a different name.`);
   }
   const lockfile = readLockfile();
@@ -3887,16 +4880,16 @@ function createProfile(name, description = "", dir = getProfilesDir()) {
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
     servers: lockfile.servers
   };
-  import_node_fs13.default.writeFileSync(filePath, JSON.stringify(profile, null, 2), "utf-8");
+  import_node_fs17.default.writeFileSync(filePath, JSON.stringify(profile, null, 2), "utf-8");
   return profile;
 }
 function listProfiles(dir = getProfilesDir()) {
-  ensureDir(dir);
-  const files = import_node_fs13.default.readdirSync(dir).filter((f) => f.endsWith(".json"));
+  ensureDir2(dir);
+  const files = import_node_fs17.default.readdirSync(dir).filter((f) => f.endsWith(".json"));
   const profiles = [];
   for (const file of files) {
     try {
-      const raw = import_node_fs13.default.readFileSync(import_node_path16.default.join(dir, file), "utf-8");
+      const raw = import_node_fs17.default.readFileSync(import_node_path18.default.join(dir, file), "utf-8");
       const data = JSON.parse(raw);
       profiles.push(data);
     } catch {
@@ -3906,9 +4899,9 @@ function listProfiles(dir = getProfilesDir()) {
 }
 function loadProfile(name, dir = getProfilesDir()) {
   const filePath = profilePath(name, dir);
-  if (!import_node_fs13.default.existsSync(filePath)) return null;
+  if (!import_node_fs17.default.existsSync(filePath)) return null;
   try {
-    const raw = import_node_fs13.default.readFileSync(filePath, "utf-8");
+    const raw = import_node_fs17.default.readFileSync(filePath, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -3916,13 +4909,13 @@ function loadProfile(name, dir = getProfilesDir()) {
 }
 function deleteProfile(name, dir = getProfilesDir()) {
   const filePath = profilePath(name, dir);
-  if (!import_node_fs13.default.existsSync(filePath)) return false;
-  import_node_fs13.default.unlinkSync(filePath);
+  if (!import_node_fs17.default.existsSync(filePath)) return false;
+  import_node_fs17.default.unlinkSync(filePath);
   return true;
 }
 // src/commands/profiles.ts
-var profiles_default = (0, import_citty15.defineCommand)({
+var profiles_default = (0, import_citty20.defineCommand)({
   meta: {
     name: "profiles",
     description: "Manage named server configuration profiles"
@@ -3951,16 +4944,16 @@ var profiles_default = (0, import_citty15.defineCommand)({
       case "create": {
         if (!name) {
           console.error(
-            import_picocolors14.default.red("  Error: Profile name required. Usage: mcpman profiles create <name>")
+            import_picocolors19.default.red("  Error: Profile name required. Usage: mcpman profiles create <name>")
           );
           process.exit(1);
         }
         try {
           const profile = createProfile(name, args.description ?? "");
           const count = Object.keys(profile.servers).length;
-          console.log(import_picocolors14.default.green(`  \u2713 Profile '${name}' created with ${count} server(s).`));
+          console.log(import_picocolors19.default.green(`  \u2713 Profile '${name}' created with ${count} server(s).`));
         } catch (err) {
-          console.error(import_picocolors14.default.red(`  Error: ${err instanceof Error ? err.message : String(err)}`));
+          console.error(import_picocolors19.default.red(`  Error: ${err instanceof Error ? err.message : String(err)}`));
           process.exit(1);
         }
         break;
@@ -3968,38 +4961,38 @@ var profiles_default = (0, import_citty15.defineCommand)({
       case "switch": {
         if (!name) {
           console.error(
-            import_picocolors14.default.red("  Error: Profile name required. Usage: mcpman profiles switch <name>")
+            import_picocolors19.default.red("  Error: Profile name required. Usage: mcpman profiles switch <name>")
           );
           process.exit(1);
         }
         const profile = loadProfile(name);
         if (!profile) {
-          console.error(import_picocolors14.default.red(`  Error: Profile '${name}' not found.`));
+          console.error(import_picocolors19.default.red(`  Error: Profile '${name}' not found.`));
           process.exit(1);
         }
         const lockData = { lockfileVersion: 1, servers: profile.servers };
         writeLockfile(lockData);
         const count = Object.keys(profile.servers).length;
-        console.log(import_picocolors14.default.green(`  \u2713 Switched to profile '${name}' (${count} servers).`));
-        console.log(import_picocolors14.default.dim("  Run mcpman sync to apply to all clients."));
+        console.log(import_picocolors19.default.green(`  \u2713 Switched to profile '${name}' (${count} servers).`));
+        console.log(import_picocolors19.default.dim("  Run mcpman sync to apply to all clients."));
         break;
       }
       case "list": {
         const profiles = listProfiles();
         if (profiles.length === 0) {
           console.log(
-            import_picocolors14.default.dim("  No profiles saved. Create one with: mcpman profiles create <name>")
+            import_picocolors19.default.dim("  No profiles saved. Create one with: mcpman profiles create <name>")
           );
           return;
         }
-        console.log(import_picocolors14.default.bold(`
+        console.log(import_picocolors19.default.bold(`
   Profiles (${profiles.length})
 `));
-        for (const p13 of profiles) {
-          const count = Object.keys(p13.servers).length;
-          const desc = p13.description ? import_picocolors14.default.dim(` \u2014 ${p13.description}`) : "";
+        for (const p14 of profiles) {
+          const count = Object.keys(p14.servers).length;
+          const desc = p14.description ? import_picocolors19.default.dim(` \u2014 ${p14.description}`) : "";
           console.log(
-            `  ${import_picocolors14.default.cyan("\u25CF")} ${import_picocolors14.default.bold(p13.name)}  ${import_picocolors14.default.dim(`${count} server(s)`)}${desc}`
+            `  ${import_picocolors19.default.cyan("\u25CF")} ${import_picocolors19.default.bold(p14.name)}  ${import_picocolors19.default.dim(`${count} server(s)`)}${desc}`
           );
         }
         console.log();
@@ -4008,22 +5001,22 @@ var profiles_default = (0, import_citty15.defineCommand)({
       case "delete": {
         if (!name) {
           console.error(
-            import_picocolors14.default.red("  Error: Profile name required. Usage: mcpman profiles delete <name>")
+            import_picocolors19.default.red("  Error: Profile name required. Usage: mcpman profiles delete <name>")
           );
           process.exit(1);
         }
         const deleted = deleteProfile(name);
         if (deleted) {
-          console.log(import_picocolors14.default.green(`  \u2713 Profile '${name}' deleted.`));
+          console.log(import_picocolors19.default.green(`  \u2713 Profile '${name}' deleted.`));
         } else {
-          console.error(import_picocolors14.default.red(`  Error: Profile '${name}' not found.`));
+          console.error(import_picocolors19.default.red(`  Error: Profile '${name}' not found.`));
           process.exit(1);
         }
         break;
       }
       default:
         console.error(
-          import_picocolors14.default.red(`  Unknown action '${action}'. Use: create, switch, list, or delete.`)
+          import_picocolors19.default.red(`  Unknown action '${action}'. Use: create, switch, list, or delete.`)
         );
         process.exit(1);
     }
@@ -4032,8 +5025,8 @@ var profiles_default = (0, import_citty15.defineCommand)({
 // src/commands/registry.ts
 init_cjs_shims();
-var import_citty16 = require("citty");
-var import_picocolors15 = __toESM(require("picocolors"), 1);
+var import_citty21 = require("citty");
+var import_picocolors20 = __toESM(require("picocolors"), 1);
 // src/core/registry-manager.ts
 init_cjs_shims();
@@ -4104,7 +5097,7 @@ function getDefaultRegistry(configPath) {
 }
 // src/commands/registry.ts
-var registry_default = (0, import_citty16.defineCommand)({
+var registry_default = (0, import_citty21.defineCommand)({
   meta: {
     name: "registry",
     description: "Manage custom registry URLs"
@@ -4134,67 +5127,67 @@ var registry_default = (0, import_citty16.defineCommand)({
       case "list": {
         const registries = getRegistries();
         const defaultName = getDefaultRegistry();
-        console.log(import_picocolors15.default.bold("\n  Registries\n"));
+        console.log(import_picocolors20.default.bold("\n  Registries\n"));
         for (const r of registries) {
           const isDefault = r.name === defaultName;
-          const defaultTag = isDefault ? import_picocolors15.default.green(" (default)") : "";
-          const builtinTag = r.builtin ? import_picocolors15.default.dim(" [builtin]") : "";
+          const defaultTag = isDefault ? import_picocolors20.default.green(" (default)") : "";
+          const builtinTag = r.builtin ? import_picocolors20.default.dim(" [builtin]") : "";
           console.log(
-            `  ${isDefault ? import_picocolors15.default.green("\u25CF") : import_picocolors15.default.dim("\u25CB")} ${import_picocolors15.default.bold(r.name)}${defaultTag}${builtinTag}`
+            `  ${isDefault ? import_picocolors20.default.green("\u25CF") : import_picocolors20.default.dim("\u25CB")} ${import_picocolors20.default.bold(r.name)}${defaultTag}${builtinTag}`
           );
-          console.log(`    ${import_picocolors15.default.dim(r.url)}`);
+          console.log(`    ${import_picocolors20.default.dim(r.url)}`);
         }
         console.log();
         break;
       }
       case "add": {
         if (!name) {
-          console.error(import_picocolors15.default.red("  Error: Usage: mcpman registry add <name> <url>"));
+          console.error(import_picocolors20.default.red("  Error: Usage: mcpman registry add <name> <url>"));
           process.exit(1);
         }
         if (!url) {
-          console.error(import_picocolors15.default.red("  Error: Usage: mcpman registry add <name> <url>"));
+          console.error(import_picocolors20.default.red("  Error: Usage: mcpman registry add <name> <url>"));
           process.exit(1);
         }
         try {
           addRegistry(name, url);
-          console.log(import_picocolors15.default.green(`  Added registry '${name}' \u2192 ${url}`));
+          console.log(import_picocolors20.default.green(`  Added registry '${name}' \u2192 ${url}`));
         } catch (err) {
-          console.error(import_picocolors15.default.red(`  Error: ${err instanceof Error ? err.message : String(err)}`));
+          console.error(import_picocolors20.default.red(`  Error: ${err instanceof Error ? err.message : String(err)}`));
           process.exit(1);
         }
         break;
       }
       case "remove": {
         if (!name) {
-          console.error(import_picocolors15.default.red("  Error: Usage: mcpman registry remove <name>"));
+          console.error(import_picocolors20.default.red("  Error: Usage: mcpman registry remove <name>"));
           process.exit(1);
         }
         try {
           removeRegistry(name);
-          console.log(import_picocolors15.default.green(`  Removed registry '${name}'.`));
+          console.log(import_picocolors20.default.green(`  Removed registry '${name}'.`));
         } catch (err) {
-          console.error(import_picocolors15.default.red(`  Error: ${err instanceof Error ? err.message : String(err)}`));
+          console.error(import_picocolors20.default.red(`  Error: ${err instanceof Error ? err.message : String(err)}`));
           process.exit(1);
         }
         break;
       }
       case "set-default": {
         if (!name) {
-          console.error(import_picocolors15.default.red("  Error: Usage: mcpman registry set-default <name>"));
+          console.error(import_picocolors20.default.red("  Error: Usage: mcpman registry set-default <name>"));
           process.exit(1);
         }
         try {
           setDefaultRegistry(name);
-          console.log(import_picocolors15.default.green(`  Default registry set to '${name}'.`));
+          console.log(import_picocolors20.default.green(`  Default registry set to '${name}'.`));
         } catch (err) {
-          console.error(import_picocolors15.default.red(`  Error: ${err instanceof Error ? err.message : String(err)}`));
+          console.error(import_picocolors20.default.red(`  Error: ${err instanceof Error ? err.message : String(err)}`));
           process.exit(1);
         }
         break;
       }
       default:
-        console.error(import_picocolors15.default.red(`  Unknown action '${action}'. Use: list, add, remove, set-default.`));
+        console.error(import_picocolors20.default.red(`  Unknown action '${action}'. Use: list, add, remove, set-default.`));
         process.exit(1);
     }
   }
@@ -4203,19 +5196,19 @@ var registry_default = (0, import_citty16.defineCommand)({
 // src/commands/remove.ts
 init_cjs_shims();
 var p9 = __toESM(require("@clack/prompts"), 1);
-var import_citty17 = require("citty");
-var import_picocolors16 = __toESM(require("picocolors"), 1);
+var import_citty22 = require("citty");
+var import_picocolors21 = __toESM(require("picocolors"), 1);
 init_client_detector();
-var CLIENT_DISPLAY2 = {
+var CLIENT_DISPLAY3 = {
   "claude-desktop": "Claude",
   cursor: "Cursor",
   vscode: "VS Code",
   windsurf: "Windsurf"
 };
 function clientDisplayName(type) {
-  return CLIENT_DISPLAY2[type] ?? type;
+  return CLIENT_DISPLAY3[type] ?? type;
 }
-var remove_default = (0, import_citty17.defineCommand)({
+var remove_default = (0, import_citty22.defineCommand)({
   meta: {
     name: "remove",
     description: "Remove an MCP server from one or more AI clients"
@@ -4242,7 +5235,7 @@ var remove_default = (0, import_citty17.defineCommand)({
     }
   },
   async run({ args }) {
-    p9.intro(import_picocolors16.default.bold("mcpman remove"));
+    p9.intro(import_picocolors21.default.bold("mcpman remove"));
     const serverName = args.server;
     const servers = await getInstalledServers();
     const match = servers.find((s) => s.name === serverName);
@@ -4252,7 +5245,7 @@ var remove_default = (0, import_citty17.defineCommand)({
         (s) => s.name.includes(serverName) || serverName.includes(s.name)
       );
       if (similar.length > 0) {
-        p9.log.info(`Did you mean: ${similar.map((s) => import_picocolors16.default.cyan(s.name)).join(", ")}?`);
+        p9.log.info(`Did you mean: ${similar.map((s) => import_picocolors21.default.cyan(s.name)).join(", ")}?`);
       }
       p9.outro("Nothing to remove.");
       return;
@@ -4287,7 +5280,7 @@ var remove_default = (0, import_citty17.defineCommand)({
     if (!args.yes) {
       const clientNames = targetClients.map(clientDisplayName).join(", ");
       const confirmed = await p9.confirm({
-        message: `Remove ${import_picocolors16.default.cyan(serverName)} from ${import_picocolors16.default.yellow(clientNames)}?`
+        message: `Remove ${import_picocolors21.default.cyan(serverName)} from ${import_picocolors21.default.yellow(clientNames)}?`
       });
       if (p9.isCancel(confirmed) || !confirmed) {
         p9.outro("Cancelled.");
@@ -4312,21 +5305,124 @@ var remove_default = (0, import_citty17.defineCommand)({
     }
     if (errors.length > 0) {
       for (const e of errors) p9.log.error(e);
-      p9.outro(import_picocolors16.default.red("Completed with errors."));
+      p9.outro(import_picocolors21.default.red("Completed with errors."));
+      process.exit(1);
+    }
+    p9.outro(import_picocolors21.default.green(`Removed "${serverName}" successfully.`));
+  }
+});
+// src/commands/rollback.ts
+init_cjs_shims();
+var p10 = __toESM(require("@clack/prompts"), 1);
+var import_citty23 = require("citty");
+var import_picocolors22 = __toESM(require("picocolors"), 1);
+init_lockfile();
+init_rollback_service();
+var rollback_default = (0, import_citty23.defineCommand)({
+  meta: {
+    name: "rollback",
+    description: "Restore a previous lockfile snapshot"
+  },
+  args: {
+    index: {
+      type: "positional",
+      description: "Snapshot index to restore (0 = most recent). Omit to use --list.",
+      required: false
+    },
+    list: {
+      type: "boolean",
+      description: "List available snapshots",
+      default: false
+    },
+    yes: {
+      type: "boolean",
+      description: "Skip confirmation prompt",
+      default: false
+    }
+  },
+  async run({ args }) {
+    const snapshots = listSnapshots();
+    if (args.list || args.index === void 0) {
+      if (snapshots.length === 0) {
+        console.log(
+          import_picocolors22.default.dim("No snapshots available. Snapshots are created on each lockfile write.")
+        );
+        return;
+      }
+      console.log(
+        `
+  ${import_picocolors22.default.bold("Lockfile snapshots")}  ${import_picocolors22.default.dim(`(${snapshots.length} available, 0 = most recent)`)}
+`
+      );
+      for (const snap2 of snapshots) {
+        const size = `${Math.ceil(snap2.sizeBytes / 1024)}KB`;
+        const date2 = snap2.createdAt ? new Date(snap2.createdAt).toLocaleString() : "unknown";
+        console.log(`  ${import_picocolors22.default.cyan(`[${snap2.index}]`)}  ${import_picocolors22.default.dim(date2)}  ${import_picocolors22.default.dim(size)}`);
+      }
+      console.log("");
+      if (args.index === void 0) return;
+    }
+    const idx = Number.parseInt(String(args.index), 10);
+    if (Number.isNaN(idx) || idx < 0) {
+      console.error(
+        `${import_picocolors22.default.red("\u2717")} Invalid index "${args.index}". Must be a non-negative integer.`
+      );
+      process.exit(1);
+    }
+    const snap = snapshots[idx];
+    if (!snap) {
+      console.error(
+        `${import_picocolors22.default.red("\u2717")} Snapshot [${idx}] does not exist. Use --list to see available snapshots.`
+      );
+      process.exit(1);
+    }
+    const content = readSnapshot(idx);
+    if (!content) {
+      console.error(`${import_picocolors22.default.red("\u2717")} Could not read snapshot [${idx}].`);
+      process.exit(1);
+    }
+    const date = snap.createdAt ? new Date(snap.createdAt).toLocaleString() : "unknown";
+    console.log(`
+  ${import_picocolors22.default.bold("Restoring snapshot")} ${import_picocolors22.default.cyan(`[${idx}]`)}  ${import_picocolors22.default.dim(date)}
+`);
+    try {
+      const parsed = JSON.parse(content);
+      const count = Object.keys(parsed.servers ?? {}).length;
+      console.log(`  ${import_picocolors22.default.dim(`Preview: ${count} server(s) in snapshot`)}
+`);
+    } catch {
+    }
+    const lockfilePath = resolveLockfilePath();
+    if (!args.yes) {
+      const confirmed = await p10.confirm({
+        message: `Restore snapshot [${idx}] to ${lockfilePath}?`,
+        initialValue: false
+      });
+      if (p10.isCancel(confirmed) || !confirmed) {
+        p10.cancel("Cancelled.");
+        return;
+      }
+    }
+    const restored = restoreSnapshot(idx, lockfilePath);
+    if (!restored) {
+      console.error(`${import_picocolors22.default.red("\u2717")} Restore failed.`);
       process.exit(1);
     }
-    p9.outro(import_picocolors16.default.green(`Removed "${serverName}" successfully.`));
+    console.log(`
+${import_picocolors22.default.green("\u2713")} Lockfile restored from snapshot [${idx}].`);
+    console.log(import_picocolors22.default.dim(`  Written to: ${lockfilePath}`));
   }
 });
 // src/commands/run.ts
 init_cjs_shims();
-var import_node_child_process5 = require("child_process");
-var import_citty18 = require("citty");
-var import_picocolors17 = __toESM(require("picocolors"), 1);
+var import_node_child_process7 = require("child_process");
+var import_citty24 = require("citty");
+var import_picocolors23 = __toESM(require("picocolors"), 1);
 init_lockfile();
 init_vault_service();
-var run_default = (0, import_citty18.defineCommand)({
+var run_default = (0, import_citty24.defineCommand)({
   meta: {
     name: "run",
     description: "Run an installed MCP server with vault secrets injected"
@@ -4348,8 +5444,8 @@ var run_default = (0, import_citty18.defineCommand)({
     const lockfile = readLockfile();
     const entry = lockfile.servers[serverName];
     if (!entry) {
-      console.error(import_picocolors17.default.red(`  Error: Server '${serverName}' is not installed.`));
-      console.error(import_picocolors17.default.dim(`  Run ${import_picocolors17.default.cyan("mcpman install <server>")} to install it first.`));
+      console.error(import_picocolors23.default.red(`  Error: Server '${serverName}' is not installed.`));
+      console.error(import_picocolors23.default.dim(`  Run ${import_picocolors23.default.cyan("mcpman install <server>")} to install it first.`));
       process.exit(1);
     }
     const lockfileEnv = parseEnvFlags(entry.envVars);
@@ -4361,8 +5457,8 @@ var run_default = (0, import_citty18.defineCommand)({
       ...vaultEnv,
       ...cliEnv
     };
-    console.log(import_picocolors17.default.dim(`  Running ${import_picocolors17.default.cyan(serverName)}...`));
-    const child = (0, import_node_child_process5.spawn)(entry.command, entry.args, {
+    console.log(import_picocolors23.default.dim(`  Running ${import_picocolors23.default.cyan(serverName)}...`));
+    const child = (0, import_node_child_process7.spawn)(entry.command, entry.args, {
       env: finalEnv,
       stdio: "inherit"
     });
@@ -4379,7 +5475,7 @@ var run_default = (0, import_citty18.defineCommand)({
         resolve();
       });
       child.on("error", (err) => {
-        console.error(import_picocolors17.default.red(`  Failed to start '${serverName}': ${err.message}`));
+        console.error(import_picocolors23.default.red(`  Failed to start '${serverName}': ${err.message}`));
         process.exit(1);
         resolve();
       });
@@ -4395,16 +5491,16 @@ async function loadVaultSecrets2(serverName) {
     const password2 = await getMasterPassword();
     return getSecretsForServer(serverName, password2);
   } catch {
-    console.warn(import_picocolors17.default.yellow("  Warning: Could not load vault secrets, continuing without them."));
+    console.warn(import_picocolors23.default.yellow("  Warning: Could not load vault secrets, continuing without them."));
     return {};
   }
 }
 // src/commands/search.ts
 init_cjs_shims();
-var import_citty19 = require("citty");
+var import_citty25 = require("citty");
 var import_nanospinner4 = require("nanospinner");
-var import_picocolors18 = __toESM(require("picocolors"), 1);
+var import_picocolors24 = __toESM(require("picocolors"), 1);
 // src/core/registry-search.ts
 init_cjs_shims();
@@ -4478,10 +5574,10 @@ function pad2(s, width) {
 function highlightMatch(name, query) {
   const idx = name.toLowerCase().indexOf(query.toLowerCase());
   if (idx === -1) return name;
-  return name.slice(0, idx) + import_picocolors18.default.yellow(name.slice(idx, idx + query.length)) + name.slice(idx + query.length);
+  return name.slice(0, idx) + import_picocolors24.default.yellow(name.slice(idx, idx + query.length)) + name.slice(idx + query.length);
 }
 function formatDownloads(n) {
-  if (!n) return import_picocolors18.default.dim("\u2014");
+  if (!n) return import_picocolors24.default.dim("\u2014");
   if (n >= 1e6) return `${(n / 1e6).toFixed(1)}M`;
   if (n >= 1e3) return `${(n / 1e3).toFixed(1)}k`;
   return String(n);
@@ -4492,9 +5588,9 @@ function printNpmResults(results, query) {
   const dlWidth = 9;
   const descMax = 50;
   const header = `  ${pad2("NAME", nameWidth)}  ${pad2("VERSION", verWidth)}  ${pad2("DOWNLOADS", dlWidth)}  DESCRIPTION`;
-  console.log(import_picocolors18.default.dim(header));
+  console.log(import_picocolors24.default.dim(header));
   console.log(
-    import_picocolors18.default.dim(
+    import_picocolors24.default.dim(
       `  ${"-".repeat(nameWidth)}  ${"-".repeat(verWidth)}  ${"-".repeat(dlWidth)}  ${"-".repeat(descMax)}`
     )
   );
@@ -4502,8 +5598,8 @@ function printNpmResults(results, query) {
     const name = highlightMatch(pad2(r.name, nameWidth), query);
     const ver = pad2(r.version, verWidth);
     const dl = pad2(formatDownloads(r.downloads), dlWidth);
-    const desc = truncate2(r.description || import_picocolors18.default.dim("(no description)"), descMax);
-    console.log(`  ${name}  ${import_picocolors18.default.dim(ver)}  ${dl}  ${desc}`);
+    const desc = truncate2(r.description || import_picocolors24.default.dim("(no description)"), descMax);
+    console.log(`  ${name}  ${import_picocolors24.default.dim(ver)}  ${dl}  ${desc}`);
   }
 }
 function printSmitheryResults(results, query) {
@@ -4511,19 +5607,19 @@ function printSmitheryResults(results, query) {
   const usesWidth = 8;
   const descMax = 50;
   const header = `  ${pad2("NAME", nameWidth)}  ${pad2("USES", usesWidth)}  DESCRIPTION`;
-  console.log(import_picocolors18.default.dim(header));
+  console.log(import_picocolors24.default.dim(header));
   console.log(
-    import_picocolors18.default.dim(`  ${"-".repeat(nameWidth)}  ${"-".repeat(usesWidth)}  ${"-".repeat(descMax)}`)
+    import_picocolors24.default.dim(`  ${"-".repeat(nameWidth)}  ${"-".repeat(usesWidth)}  ${"-".repeat(descMax)}`)
   );
   for (const r of results) {
     const name = highlightMatch(pad2(r.name, nameWidth), query);
     const uses = pad2(formatDownloads(r.useCount), usesWidth);
-    const badge = r.verified ? import_picocolors18.default.green(" \u2713") : "";
-    const desc = truncate2(r.description || import_picocolors18.default.dim("(no description)"), descMax);
+    const badge = r.verified ? import_picocolors24.default.green(" \u2713") : "";
+    const desc = truncate2(r.description || import_picocolors24.default.dim("(no description)"), descMax);
     console.log(`  ${name}${badge}  ${uses}  ${desc}`);
   }
 }
-var search_default = (0, import_citty19.defineCommand)({
+var search_default = (0, import_citty25.defineCommand)({
   meta: {
     name: "search",
     description: "Search for MCP servers on npm or Smithery registry"
@@ -4555,7 +5651,7 @@ var search_default = (0, import_citty19.defineCommand)({
     const registry = args.registry.toLowerCase();
     const limit = Math.min(Math.max(1, Number.parseInt(args.limit, 10) || 20), 100);
     if (registry !== "npm" && registry !== "smithery") {
-      console.error(import_picocolors18.default.red(`  Unknown registry "${registry}". Use "npm" or "smithery".`));
+      console.error(import_picocolors24.default.red(`  Unknown registry "${registry}". Use "npm" or "smithery".`));
       process.exit(1);
     }
     const spinner5 = (0, import_nanospinner4.createSpinner)(`Searching ${registry} for "${query}"...`).start();
@@ -4563,20 +5659,20 @@ var search_default = (0, import_citty19.defineCommand)({
       const results2 = await searchNpm(query, limit);
       spinner5.stop();
       if (results2.length === 0) {
-        console.log(import_picocolors18.default.dim(`
+        console.log(import_picocolors24.default.dim(`
   No results found for "${query}" on npm.
 `));
         return;
       }
       console.log(
-        import_picocolors18.default.bold(
+        import_picocolors24.default.bold(
           `
   mcpman search \u2014 npm (${results2.length} result${results2.length !== 1 ? "s" : ""})
 `
         )
       );
       printNpmResults(results2, query);
-      console.log(import_picocolors18.default.dim("\n  Install with: mcpman install <name>\n"));
+      console.log(import_picocolors24.default.dim("\n  Install with: mcpman install <name>\n"));
       if (args.all) {
         await printPluginResults(query, limit);
       }
@@ -4585,20 +5681,20 @@ var search_default = (0, import_citty19.defineCommand)({
     const results = await searchSmithery(query, limit);
     spinner5.stop();
     if (results.length === 0) {
-      console.log(import_picocolors18.default.dim(`
+      console.log(import_picocolors24.default.dim(`
   No results found for "${query}" on Smithery.
 `));
       return;
     }
     console.log(
-      import_picocolors18.default.bold(
+      import_picocolors24.default.bold(
         `
   mcpman search \u2014 Smithery (${results.length} result${results.length !== 1 ? "s" : ""})
 `
       )
     );
     printSmitheryResults(results, query);
-    console.log(import_picocolors18.default.dim("\n  Install with: mcpman install <name>\n"));
+    console.log(import_picocolors24.default.dim("\n  Install with: mcpman install <name>\n"));
     if (args.all) {
       await printPluginResults(query, limit);
     }
@@ -4608,7 +5704,7 @@ async function printPluginResults(query, limit) {
   const pluginResults = await searchPlugins(query, limit);
   if (pluginResults.length === 0) return;
   console.log(
-    import_picocolors18.default.bold(
+    import_picocolors24.default.bold(
       `
   Plugins (${pluginResults.length} result${pluginResults.length !== 1 ? "s" : ""})
 `
@@ -4618,23 +5714,23 @@ async function printPluginResults(query, limit) {
   const srcWidth = Math.max(6, ...pluginResults.map((r) => r.source.length));
   const descMax = 50;
   const header = `  ${pad2("NAME", nameWidth)}  ${pad2("SOURCE", srcWidth)}  DESCRIPTION`;
-  console.log(import_picocolors18.default.dim(header));
+  console.log(import_picocolors24.default.dim(header));
   console.log(
-    import_picocolors18.default.dim(`  ${"-".repeat(nameWidth)}  ${"-".repeat(srcWidth)}  ${"-".repeat(descMax)}`)
+    import_picocolors24.default.dim(`  ${"-".repeat(nameWidth)}  ${"-".repeat(srcWidth)}  ${"-".repeat(descMax)}`)
   );
   for (const r of pluginResults) {
     const name = highlightMatch(pad2(r.name, nameWidth), query);
     const src = pad2(r.source, srcWidth);
-    const desc = truncate2(r.description || import_picocolors18.default.dim("(no description)"), descMax);
-    console.log(`  ${name}  ${import_picocolors18.default.dim(src)}  ${desc}`);
+    const desc = truncate2(r.description || import_picocolors24.default.dim("(no description)"), descMax);
+    console.log(`  ${name}  ${import_picocolors24.default.dim(src)}  ${desc}`);
   }
 }
 // src/commands/secrets.ts
 init_cjs_shims();
-var p10 = __toESM(require("@clack/prompts"), 1);
-var import_citty20 = require("citty");
-var import_picocolors19 = __toESM(require("picocolors"), 1);
+var p11 = __toESM(require("@clack/prompts"), 1);
+var import_citty26 = require("citty");
+var import_picocolors25 = __toESM(require("picocolors"), 1);
 init_vault_service();
 function maskValue(value) {
   if (value.length <= 8) return "***";
@@ -4645,7 +5741,7 @@ function parseKeyValue(input) {
   if (idx <= 0) return null;
   return { key: input.slice(0, idx), value: input.slice(idx + 1) };
 }
-var setCommand2 = (0, import_citty20.defineCommand)({
+var setCommand2 = (0, import_citty26.defineCommand)({
   meta: { name: "set", description: "Store an encrypted secret for a server" },
   args: {
     server: {
@@ -4662,28 +5758,28 @@ var setCommand2 = (0, import_citty20.defineCommand)({
   async run({ args }) {
     const parsed = parseKeyValue(args.keyvalue);
     if (!parsed) {
-      console.error(`${import_picocolors19.default.red("\u2717")} Invalid format. Expected KEY=VALUE`);
+      console.error(`${import_picocolors25.default.red("\u2717")} Invalid format. Expected KEY=VALUE`);
       process.exit(1);
     }
-    p10.intro(import_picocolors19.default.cyan("mcpman secrets set"));
+    p11.intro(import_picocolors25.default.cyan("mcpman secrets set"));
     const isNew = listSecrets(args.server).length === 0 || !listSecrets(args.server)[0]?.keys.includes(parsed.key);
     const vaultPath = (await Promise.resolve().then(() => (init_vault_service(), vault_service_exports))).getVaultPath();
     const vaultExists = (await import("fs")).existsSync(vaultPath);
     const password2 = await getMasterPassword(!vaultExists && isNew);
-    const spin = p10.spinner();
+    const spin = p11.spinner();
     spin.start("Encrypting secret...");
     try {
       setSecret(args.server, parsed.key, parsed.value, password2);
-      spin.stop(`${import_picocolors19.default.green("\u2713")} Stored ${import_picocolors19.default.bold(parsed.key)} for ${import_picocolors19.default.cyan(args.server)}`);
+      spin.stop(`${import_picocolors25.default.green("\u2713")} Stored ${import_picocolors25.default.bold(parsed.key)} for ${import_picocolors25.default.cyan(args.server)}`);
     } catch (err) {
-      spin.stop(`${import_picocolors19.default.red("\u2717")} Failed to store secret`);
-      console.error(import_picocolors19.default.dim(String(err)));
+      spin.stop(`${import_picocolors25.default.red("\u2717")} Failed to store secret`);
+      console.error(import_picocolors25.default.dim(String(err)));
       process.exit(1);
     }
-    p10.outro(import_picocolors19.default.dim("Secret encrypted and saved to vault."));
+    p11.outro(import_picocolors25.default.dim("Secret encrypted and saved to vault."));
   }
 });
-var listCommand3 = (0, import_citty20.defineCommand)({
+var listCommand3 = (0, import_citty26.defineCommand)({
   meta: { name: "list", description: "List secret keys stored in the vault" },
   args: {
     server: {
@@ -4695,27 +5791,27 @@ var listCommand3 = (0, import_citty20.defineCommand)({
   async run({ args }) {
     const results = listSecrets(args.server || void 0);
     if (results.length === 0) {
-      const filter = args.server ? ` for ${import_picocolors19.default.cyan(args.server)}` : "";
-      console.log(import_picocolors19.default.dim(`No secrets stored${filter}.`));
+      const filter = args.server ? ` for ${import_picocolors25.default.cyan(args.server)}` : "";
+      console.log(import_picocolors25.default.dim(`No secrets stored${filter}.`));
       return;
     }
     console.log("");
     for (const { server, keys } of results) {
-      console.log(import_picocolors19.default.bold(import_picocolors19.default.cyan(server)));
+      console.log(import_picocolors25.default.bold(import_picocolors25.default.cyan(server)));
       for (const key of keys) {
-        console.log(`  ${import_picocolors19.default.green("\u25CF")} ${import_picocolors19.default.bold(key)}  ${import_picocolors19.default.dim(maskValue("\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022"))}`);
+        console.log(`  ${import_picocolors25.default.green("\u25CF")} ${import_picocolors25.default.bold(key)}  ${import_picocolors25.default.dim(maskValue("\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022"))}`);
       }
       console.log("");
     }
     const total = results.reduce((n, r) => n + r.keys.length, 0);
     console.log(
-      import_picocolors19.default.dim(
+      import_picocolors25.default.dim(
         `  ${total} secret${total !== 1 ? "s" : ""} in ${results.length} server${results.length !== 1 ? "s" : ""}`
       )
     );
   }
 });
-var removeCommand2 = (0, import_citty20.defineCommand)({
+var removeCommand2 = (0, import_citty26.defineCommand)({
   meta: { name: "remove", description: "Delete a secret from the vault" },
   args: {
     server: {
@@ -4730,25 +5826,25 @@ var removeCommand2 = (0, import_citty20.defineCommand)({
     }
   },
   async run({ args }) {
-    const confirmed = await p10.confirm({
-      message: `Remove ${import_picocolors19.default.bold(args.key)} from ${import_picocolors19.default.cyan(args.server)}?`,
+    const confirmed = await p11.confirm({
+      message: `Remove ${import_picocolors25.default.bold(args.key)} from ${import_picocolors25.default.cyan(args.server)}?`,
       initialValue: false
     });
-    if (p10.isCancel(confirmed) || !confirmed) {
-      p10.cancel("Cancelled.");
+    if (p11.isCancel(confirmed) || !confirmed) {
+      p11.cancel("Cancelled.");
       return;
     }
     try {
       removeSecret(args.server, args.key);
-      console.log(`${import_picocolors19.default.green("\u2713")} Removed ${import_picocolors19.default.bold(args.key)} from ${import_picocolors19.default.cyan(args.server)}`);
+      console.log(`${import_picocolors25.default.green("\u2713")} Removed ${import_picocolors25.default.bold(args.key)} from ${import_picocolors25.default.cyan(args.server)}`);
     } catch (err) {
-      console.error(`${import_picocolors19.default.red("\u2717")} Failed to remove secret`);
-      console.error(import_picocolors19.default.dim(String(err)));
+      console.error(`${import_picocolors25.default.red("\u2717")} Failed to remove secret`);
+      console.error(import_picocolors25.default.dim(String(err)));
       process.exit(1);
     }
   }
 });
-var secrets_default = (0, import_citty20.defineCommand)({
+var secrets_default = (0, import_citty26.defineCommand)({
   meta: {
     name: "secrets",
     description: "Manage encrypted secrets for MCP servers"
@@ -4762,9 +5858,9 @@ var secrets_default = (0, import_citty20.defineCommand)({
 // src/commands/sync.ts
 init_cjs_shims();
-var p11 = __toESM(require("@clack/prompts"), 1);
-var import_citty21 = require("citty");
-var import_picocolors20 = __toESM(require("picocolors"), 1);
+var p12 = __toESM(require("@clack/prompts"), 1);
+var import_citty27 = require("citty");
+var import_picocolors26 = __toESM(require("picocolors"), 1);
 // src/core/config-diff.ts
 init_cjs_shims();
@@ -4915,14 +6011,14 @@ async function getClientConfigs() {
 }
 // src/commands/sync.ts
-var VALID_CLIENTS = ["claude-desktop", "cursor", "vscode", "windsurf"];
-var CLIENT_DISPLAY3 = {
+var VALID_CLIENTS2 = ["claude-desktop", "cursor", "vscode", "windsurf"];
+var CLIENT_DISPLAY4 = {
   "claude-desktop": "Claude Desktop",
   cursor: "Cursor",
   vscode: "VS Code",
   windsurf: "Windsurf"
 };
-var sync_default = (0, import_citty21.defineCommand)({
+var sync_default = (0, import_citty27.defineCommand)({
   meta: {
     name: "sync",
     description: "Sync MCP server configs across all detected AI clients"
@@ -4949,20 +6045,20 @@ var sync_default = (0, import_citty21.defineCommand)({
     }
   },
   async run({ args }) {
-    p11.intro(`${import_picocolors20.default.cyan("mcpman sync")}`);
+    p12.intro(`${import_picocolors26.default.cyan("mcpman sync")}`);
     const sourceClient = args.source;
-    if (sourceClient && !VALID_CLIENTS.includes(sourceClient)) {
-      p11.log.error(
-        `Invalid --source "${sourceClient}". Must be one of: ${VALID_CLIENTS.join(", ")}`
+    if (sourceClient && !VALID_CLIENTS2.includes(sourceClient)) {
+      p12.log.error(
+        `Invalid --source "${sourceClient}". Must be one of: ${VALID_CLIENTS2.join(", ")}`
       );
       process.exit(1);
     }
-    const spinner5 = p11.spinner();
+    const spinner5 = p12.spinner();
     spinner5.start("Detecting clients and reading configs...");
     const { configs, handlers } = await getClientConfigs();
     spinner5.stop(`Found ${configs.size} client(s)`);
     if (configs.size === 0) {
-      p11.log.warn(
+      p12.log.warn(
         "No AI clients detected. Install Claude Desktop, Cursor, VS Code, or Windsurf first."
       );
       process.exit(0);
@@ -4971,10 +6067,10 @@ var sync_default = (0, import_citty21.defineCommand)({
     let actions;
     if (sourceClient) {
       if (!configs.has(sourceClient)) {
-        p11.log.error(`Source client "${sourceClient}" is not detected or its config is unreadable.`);
+        p12.log.error(`Source client "${sourceClient}" is not detected or its config is unreadable.`);
         process.exit(1);
       }
-      p11.log.info(`Using ${CLIENT_DISPLAY3[sourceClient]} as source of truth`);
+      p12.log.info(`Using ${CLIENT_DISPLAY4[sourceClient]} as source of truth`);
       actions = computeDiffFromClient(sourceClient, configs, diffOptions);
     } else {
       const lockfile = readLockfile();
@@ -4985,32 +6081,32 @@ var sync_default = (0, import_citty21.defineCommand)({
     const extraCount = actions.filter((a) => a.action === "extra").length;
     const removeCount = actions.filter((a) => a.action === "remove").length;
     if (addCount === 0 && removeCount === 0 && extraCount === 0) {
-      p11.outro(import_picocolors20.default.green("All clients are in sync."));
+      p12.outro(import_picocolors26.default.green("All clients are in sync."));
       process.exit(0);
     }
     const parts = [];
-    if (addCount > 0) parts.push(import_picocolors20.default.green(`${addCount} to add`));
-    if (removeCount > 0) parts.push(import_picocolors20.default.red(`${removeCount} to remove`));
-    if (extraCount > 0) parts.push(import_picocolors20.default.yellow(`${extraCount} extra (informational)`));
-    p11.log.info(parts.join("  \xB7  "));
+    if (addCount > 0) parts.push(import_picocolors26.default.green(`${addCount} to add`));
+    if (removeCount > 0) parts.push(import_picocolors26.default.red(`${removeCount} to remove`));
+    if (extraCount > 0) parts.push(import_picocolors26.default.yellow(`${extraCount} extra (informational)`));
+    p12.log.info(parts.join("  \xB7  "));
     if (args["dry-run"]) {
-      p11.outro(import_picocolors20.default.dim("Dry run \u2014 no changes applied."));
+      p12.outro(import_picocolors26.default.dim("Dry run \u2014 no changes applied."));
       process.exit(1);
     }
     if (addCount === 0 && removeCount === 0) {
-      p11.outro(import_picocolors20.default.dim("No additions needed. Extra servers left untouched."));
+      p12.outro(import_picocolors26.default.dim("No additions needed. Extra servers left untouched."));
       process.exit(1);
     }
     if (!args.yes) {
       const actionParts = [];
       if (addCount > 0) actionParts.push(`${addCount} addition(s)`);
       if (removeCount > 0) actionParts.push(`${removeCount} removal(s)`);
-      const confirmed = await p11.confirm({
+      const confirmed = await p12.confirm({
         message: `Apply ${actionParts.join(" and ")} to client configs?`,
         initialValue: true
       });
-      if (p11.isCancel(confirmed) || !confirmed) {
-        p11.outro(import_picocolors20.default.dim("Cancelled \u2014 no changes applied."));
+      if (p12.isCancel(confirmed) || !confirmed) {
+        p12.outro(import_picocolors26.default.dim("Cancelled \u2014 no changes applied."));
         process.exit(0);
       }
     }
@@ -5018,37 +6114,37 @@ var sync_default = (0, import_citty21.defineCommand)({
     const result = await applySyncActions(actions, handlers);
     spinner5.stop("Done");
     if (result.applied > 0) {
-      p11.log.success(`Added ${result.applied} server(s) to client configs.`);
+      p12.log.success(`Added ${result.applied} server(s) to client configs.`);
     }
     if (result.removed > 0) {
-      p11.log.success(`Removed ${result.removed} server(s) from client configs.`);
+      p12.log.success(`Removed ${result.removed} server(s) from client configs.`);
     }
     if (result.failed > 0) {
       for (const e of result.errors) {
-        p11.log.error(`Failed to sync "${e.server}" on ${e.client}: ${e.error}`);
+        p12.log.error(`Failed to sync "${e.server}" on ${e.client}: ${e.error}`);
       }
     }
-    p11.outro(
-      result.failed === 0 ? import_picocolors20.default.green("Sync complete.") : import_picocolors20.default.yellow("Sync complete with errors.")
+    p12.outro(
+      result.failed === 0 ? import_picocolors26.default.green("Sync complete.") : import_picocolors26.default.yellow("Sync complete with errors.")
     );
     process.exit(result.failed > 0 ? 1 : 0);
   }
 });
 function printDiffTable(actions) {
   if (actions.length === 0) {
-    p11.log.info("No actions to display.");
+    p12.log.info("No actions to display.");
     return;
   }
   const nameWidth = Math.max(6, ...actions.map((a) => a.server.length));
   const clientWidth = Math.max(
     6,
-    ...actions.map((a) => CLIENT_DISPLAY3[a.client]?.length ?? a.client.length)
+    ...actions.map((a) => CLIENT_DISPLAY4[a.client]?.length ?? a.client.length)
   );
   const header = `  ${pad3("SERVER", nameWidth)}  ${pad3("CLIENT", clientWidth)}  STATUS`;
-  console.log(import_picocolors20.default.dim(header));
-  console.log(import_picocolors20.default.dim(`  ${"-".repeat(nameWidth)}  ${"-".repeat(clientWidth)}  ------`));
+  console.log(import_picocolors26.default.dim(header));
+  console.log(import_picocolors26.default.dim(`  ${"-".repeat(nameWidth)}  ${"-".repeat(clientWidth)}  ------`));
   for (const action of actions) {
-    const clientDisplay = CLIENT_DISPLAY3[action.client] ?? action.client;
+    const clientDisplay = CLIENT_DISPLAY4[action.client] ?? action.client;
     const [icon, statusText] = formatAction(action.action);
     console.log(
       `  ${pad3(action.server, nameWidth)}  ${pad3(clientDisplay, clientWidth)}  ${icon} ${statusText}`
@@ -5059,13 +6155,13 @@ function printDiffTable(actions) {
 function formatAction(action) {
   switch (action) {
     case "add":
-      return [import_picocolors20.default.green("+"), import_picocolors20.default.green("missing \u2014 will add")];
+      return [import_picocolors26.default.green("+"), import_picocolors26.default.green("missing \u2014 will add")];
     case "extra":
-      return [import_picocolors20.default.yellow("?"), import_picocolors20.default.yellow("extra (not in lockfile)")];
+      return [import_picocolors26.default.yellow("?"), import_picocolors26.default.yellow("extra (not in lockfile)")];
     case "remove":
-      return [import_picocolors20.default.red("\u2013"), import_picocolors20.default.red("extra \u2014 will remove")];
+      return [import_picocolors26.default.red("\u2013"), import_picocolors26.default.red("extra \u2014 will remove")];
     case "ok":
-      return [import_picocolors20.default.dim("\xB7"), import_picocolors20.default.dim("in sync")];
+      return [import_picocolors26.default.dim("\xB7"), import_picocolors26.default.dim("in sync")];
   }
 }
 function pad3(s, width) {
@@ -5074,13 +6170,13 @@ function pad3(s, width) {
 // src/commands/test-command.ts
 init_cjs_shims();
-var import_citty22 = require("citty");
-var import_picocolors21 = __toESM(require("picocolors"), 1);
+var import_citty28 = require("citty");
+var import_picocolors27 = __toESM(require("picocolors"), 1);
 init_lockfile();
 // src/core/mcp-tester.ts
 init_cjs_shims();
-var import_node_child_process6 = require("child_process");
+var import_node_child_process8 = require("child_process");
 var TIMEOUT_MS = 1e4;
 async function testMcpServer(serverName, command, args, env) {
   const start = Date.now();
@@ -5090,7 +6186,7 @@ async function testMcpServer(serverName, command, args, env) {
     let initOk = false;
     let toolsOk = false;
     let tools = [];
-    const child = (0, import_node_child_process6.spawn)(command, args, {
+    const child = (0, import_node_child_process8.spawn)(command, args, {
       env: { ...process.env, ...env },
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -5176,7 +6272,7 @@ async function testMcpServer(serverName, command, args, env) {
 // src/commands/test-command.ts
 init_vault_service();
-var test_command_default = (0, import_citty22.defineCommand)({
+var test_command_default = (0, import_citty28.defineCommand)({
   meta: {
     name: "test",
     description: "Test MCP server connectivity and capabilities"
@@ -5197,10 +6293,10 @@ var test_command_default = (0, import_citty22.defineCommand)({
     const lockfile = readLockfile();
     const serverNames = args.all ? Object.keys(lockfile.servers) : args.server ? [args.server] : [];
     if (serverNames.length === 0) {
-      console.error(import_picocolors21.default.red("  Error: Specify a server name or use --all."));
+      console.error(import_picocolors27.default.red("  Error: Specify a server name or use --all."));
       process.exit(1);
     }
-    console.log(import_picocolors21.default.bold(`
+    console.log(import_picocolors27.default.bold(`
   mcpman test \u2014 ${serverNames.length} server(s)
 `));
     let passed = 0;
@@ -5208,7 +6304,7 @@ var test_command_default = (0, import_citty22.defineCommand)({
     for (const name of serverNames) {
       const entry = lockfile.servers[name];
       if (!entry) {
-        console.log(`  ${import_picocolors21.default.red("\u2717")} ${import_picocolors21.default.bold(name)} \u2014 not installed`);
+        console.log(`  ${import_picocolors27.default.red("\u2717")} ${import_picocolors27.default.bold(name)} \u2014 not installed`);
         failed++;
         continue;
       }
@@ -5219,27 +6315,27 @@ var test_command_default = (0, import_citty22.defineCommand)({
       if (result.passed) {
         passed++;
         console.log(
-          `  ${import_picocolors21.default.green("\u2713")} ${import_picocolors21.default.bold(name)} ${import_picocolors21.default.dim(`(${result.responseTimeMs}ms)`)}`
+          `  ${import_picocolors27.default.green("\u2713")} ${import_picocolors27.default.bold(name)} ${import_picocolors27.default.dim(`(${result.responseTimeMs}ms)`)}`
         );
         if (result.tools.length > 0) {
-          console.log(import_picocolors21.default.dim(`    Tools: ${result.tools.join(", ")}`));
+          console.log(import_picocolors27.default.dim(`    Tools: ${result.tools.join(", ")}`));
         }
       } else {
         failed++;
-        console.log(`  ${import_picocolors21.default.red("\u2717")} ${import_picocolors21.default.bold(name)} ${import_picocolors21.default.dim(`(${result.responseTimeMs}ms)`)}`);
+        console.log(`  ${import_picocolors27.default.red("\u2717")} ${import_picocolors27.default.bold(name)} ${import_picocolors27.default.dim(`(${result.responseTimeMs}ms)`)}`);
         if (result.error) {
-          console.log(`    ${import_picocolors21.default.red(result.error)}`);
+          console.log(`    ${import_picocolors27.default.red(result.error)}`);
         }
         console.log(
-          `    ${import_picocolors21.default.dim("initialize:")} ${result.initializeOk ? import_picocolors21.default.green("ok") : import_picocolors21.default.red("fail")}  ${import_picocolors21.default.dim("tools/list:")} ${result.toolsListOk ? import_picocolors21.default.green("ok") : import_picocolors21.default.red("fail")}`
+          `    ${import_picocolors27.default.dim("initialize:")} ${result.initializeOk ? import_picocolors27.default.green("ok") : import_picocolors27.default.red("fail")}  ${import_picocolors27.default.dim("tools/list:")} ${result.toolsListOk ? import_picocolors27.default.green("ok") : import_picocolors27.default.red("fail")}`
         );
       }
     }
-    console.log(import_picocolors21.default.dim(`
+    console.log(import_picocolors27.default.dim(`
   ${"\u2500".repeat(40)}`));
     const parts = [];
-    if (passed > 0) parts.push(import_picocolors21.default.green(`${passed} passed`));
-    if (failed > 0) parts.push(import_picocolors21.default.red(`${failed} failed`));
+    if (passed > 0) parts.push(import_picocolors27.default.green(`${passed} passed`));
+    if (failed > 0) parts.push(import_picocolors27.default.red(`${failed} failed`));
     console.log(`  ${parts.join(", ")}
 `);
     if (failed > 0) process.exit(1);
@@ -5258,26 +6354,26 @@ async function loadVaultSecrets3(serverName) {
 // src/commands/update.ts
 init_cjs_shims();
-var p12 = __toESM(require("@clack/prompts"), 1);
-var import_citty23 = require("citty");
-var import_picocolors23 = __toESM(require("picocolors"), 1);
+var p13 = __toESM(require("@clack/prompts"), 1);
+var import_citty29 = require("citty");
+var import_picocolors29 = __toESM(require("picocolors"), 1);
 init_lockfile();
 // src/core/update-notifier.ts
 init_cjs_shims();
-var import_node_fs14 = __toESM(require("fs"), 1);
+var import_node_fs18 = __toESM(require("fs"), 1);
 var import_node_os6 = __toESM(require("os"), 1);
-var import_node_path17 = __toESM(require("path"), 1);
-var import_picocolors22 = __toESM(require("picocolors"), 1);
-var CACHE_FILE = import_node_path17.default.join(import_node_os6.default.homedir(), ".mcpman", ".update-check");
+var import_node_path19 = __toESM(require("path"), 1);
+var import_picocolors28 = __toESM(require("picocolors"), 1);
+var CACHE_FILE = import_node_path19.default.join(import_node_os6.default.homedir(), ".mcpman", ".update-check");
 var TTL_MS = 24 * 60 * 60 * 1e3;
 function writeUpdateCache(data) {
   try {
-    const dir = import_node_path17.default.dirname(CACHE_FILE);
-    if (!import_node_fs14.default.existsSync(dir)) import_node_fs14.default.mkdirSync(dir, { recursive: true });
+    const dir = import_node_path19.default.dirname(CACHE_FILE);
+    if (!import_node_fs18.default.existsSync(dir)) import_node_fs18.default.mkdirSync(dir, { recursive: true });
     const tmp = `${CACHE_FILE}.tmp`;
-    import_node_fs14.default.writeFileSync(tmp, JSON.stringify(data, null, 2), "utf-8");
-    import_node_fs14.default.renameSync(tmp, CACHE_FILE);
+    import_node_fs18.default.writeFileSync(tmp, JSON.stringify(data, null, 2), "utf-8");
+    import_node_fs18.default.renameSync(tmp, CACHE_FILE);
   } catch {
   }
 }
@@ -5300,19 +6396,19 @@ function printTable(updates) {
     "LATEST".padEnd(VER_W),
     "STATUS"
   ].join("  ");
-  console.log(import_picocolors23.default.bold(`
+  console.log(import_picocolors29.default.bold(`
   ${header}`));
-  console.log(import_picocolors23.default.dim(`  ${"\u2500".repeat(NAME_W + VER_W * 2 + 20)}`));
+  console.log(import_picocolors29.default.dim(`  ${"\u2500".repeat(NAME_W + VER_W * 2 + 20)}`));
   for (const u of updates) {
     const nameCol = u.server.slice(0, NAME_W).padEnd(NAME_W);
     const curCol = u.currentVersion.padEnd(VER_W);
     const latCol = u.latestVersion.padEnd(VER_W);
-    const statusCol = u.hasUpdate ? import_picocolors23.default.yellow(`Update available${u.updateType ? ` [${u.updateType}]` : ""}`) : import_picocolors23.default.green("Up to date");
+    const statusCol = u.hasUpdate ? import_picocolors29.default.yellow(`Update available${u.updateType ? ` [${u.updateType}]` : ""}`) : import_picocolors29.default.green("Up to date");
     console.log(`  ${nameCol}  ${curCol}  ${latCol}  ${statusCol}`);
   }
   console.log();
 }
-var update_default = (0, import_citty23.defineCommand)({
+var update_default = (0, import_citty29.defineCommand)({
   meta: {
     name: "update",
     description: "Check for and apply updates to installed MCP servers"
@@ -5351,7 +6447,7 @@ var update_default = (0, import_citty23.defineCommand)({
       }
       process.exit(1);
     }
-    const spinner5 = p12.spinner();
+    const spinner5 = p13.spinner();
     spinner5.start("Checking versions...");
     let updates;
     try {
@@ -5373,51 +6469,51 @@ var update_default = (0, import_citty23.defineCommand)({
     printTable(updates);
     const outdated = updates.filter((u) => u.hasUpdate);
     if (outdated.length === 0) {
-      console.log(import_picocolors23.default.green("  All servers are up to date."));
+      console.log(import_picocolors29.default.green("  All servers are up to date."));
       return;
     }
     if (args.check) {
       console.log(
-        import_picocolors23.default.yellow(`  ${outdated.length} update(s) available. Run mcpman update to apply.`)
+        import_picocolors29.default.yellow(`  ${outdated.length} update(s) available. Run mcpman update to apply.`)
       );
       return;
     }
     if (!args.yes) {
-      const confirmed = await p12.confirm({
+      const confirmed = await p13.confirm({
         message: `Apply ${outdated.length} update(s)?`,
         initialValue: true
       });
-      if (p12.isCancel(confirmed) || !confirmed) {
-        p12.outro("Cancelled.");
+      if (p13.isCancel(confirmed) || !confirmed) {
+        p13.outro("Cancelled.");
         return;
       }
     }
     const clients = await loadClients3();
     let successCount = 0;
     for (const update of outdated) {
-      const s = p12.spinner();
+      const s = p13.spinner();
       s.start(`Updating ${update.server}...`);
       const result = await applyServerUpdate(update.server, servers[update.server], clients);
       if (result.success) {
-        s.stop(`${import_picocolors23.default.green("\u2713")} ${update.server}: ${result.fromVersion} \u2192 ${result.toVersion}`);
+        s.stop(`${import_picocolors29.default.green("\u2713")} ${update.server}: ${result.fromVersion} \u2192 ${result.toVersion}`);
         successCount++;
       } else {
-        s.stop(`${import_picocolors23.default.red("\u2717")} ${update.server}: ${result.error}`);
+        s.stop(`${import_picocolors29.default.red("\u2717")} ${update.server}: ${result.error}`);
       }
     }
     const freshLockfile = readLockfile(resolveLockfilePath());
     const freshUpdates = await checkAllVersions(freshLockfile);
     writeUpdateCache({ lastCheck: (/* @__PURE__ */ new Date()).toISOString(), updates: freshUpdates });
-    p12.outro(`${successCount} of ${outdated.length} server(s) updated.`);
+    p13.outro(`${successCount} of ${outdated.length} server(s) updated.`);
   }
 });
 // src/commands/upgrade.ts
 init_cjs_shims();
-var import_node_child_process7 = require("child_process");
-var import_citty24 = require("citty");
-var import_picocolors24 = __toESM(require("picocolors"), 1);
-var upgrade_default = (0, import_citty24.defineCommand)({
+var import_node_child_process9 = require("child_process");
+var import_citty30 = require("citty");
+var import_picocolors30 = __toESM(require("picocolors"), 1);
+var upgrade_default = (0, import_citty30.defineCommand)({
   meta: {
     name: "upgrade",
     description: "Upgrade mcpman to the latest version"
@@ -5430,30 +6526,30 @@ var upgrade_default = (0, import_citty24.defineCommand)({
     }
   },
   async run({ args }) {
-    console.log(import_picocolors24.default.dim(`  Current version: ${APP_VERSION}`));
+    console.log(import_picocolors30.default.dim(`  Current version: ${APP_VERSION}`));
     let latest;
     try {
-      latest = (0, import_node_child_process7.execSync)("npm view mcpman version", { encoding: "utf-8", timeout: 15e3 }).trim();
+      latest = (0, import_node_child_process9.execSync)("npm view mcpman version", { encoding: "utf-8", timeout: 15e3 }).trim();
     } catch {
-      console.error(import_picocolors24.default.red("  Error: Could not check latest version from npm."));
+      console.error(import_picocolors30.default.red("  Error: Could not check latest version from npm."));
       process.exit(1);
     }
     if (latest === APP_VERSION) {
-      console.log(import_picocolors24.default.green("  \u2713 Already on the latest version."));
+      console.log(import_picocolors30.default.green("  \u2713 Already on the latest version."));
       return;
     }
-    console.log(import_picocolors24.default.yellow(`  Update available: ${APP_VERSION} \u2192 ${latest}`));
+    console.log(import_picocolors30.default.yellow(`  Update available: ${APP_VERSION} \u2192 ${latest}`));
     if (args.check) {
-      console.log(import_picocolors24.default.dim("  Run mcpman upgrade to install."));
+      console.log(import_picocolors30.default.dim("  Run mcpman upgrade to install."));
       return;
     }
-    console.log(import_picocolors24.default.dim("  Installing..."));
+    console.log(import_picocolors30.default.dim("  Installing..."));
     try {
-      (0, import_node_child_process7.execSync)(`npm install -g mcpman@${latest}`, { stdio: "inherit", timeout: 6e4 });
-      console.log(import_picocolors24.default.green(`
+      (0, import_node_child_process9.execSync)(`npm install -g mcpman@${latest}`, { stdio: "inherit", timeout: 6e4 });
+      console.log(import_picocolors30.default.green(`
   \u2713 Upgraded to mcpman@${latest}`));
     } catch {
-      console.error(import_picocolors24.default.red("  Error: Upgrade failed. Try manually: npm install -g mcpman@latest"));
+      console.error(import_picocolors30.default.red("  Error: Upgrade failed. Try manually: npm install -g mcpman@latest"));
       process.exit(1);
     }
   }
@@ -5461,13 +6557,13 @@ var upgrade_default = (0, import_citty24.defineCommand)({
 // src/commands/watch.ts
 init_cjs_shims();
-var import_citty25 = require("citty");
-var import_picocolors25 = __toESM(require("picocolors"), 1);
+var import_citty31 = require("citty");
+var import_picocolors31 = __toESM(require("picocolors"), 1);
 // src/core/file-watcher-service.ts
 init_cjs_shims();
-var import_node_child_process8 = require("child_process");
-var import_node_fs15 = __toESM(require("fs"), 1);
+var import_node_child_process10 = require("child_process");
+var import_node_fs19 = __toESM(require("fs"), 1);
 var IGNORE_PATTERNS = [
   "node_modules",
   ".git",
@@ -5479,7 +6575,7 @@ var IGNORE_PATTERNS = [
   ".tox"
 ];
 function shouldIgnore(filename) {
-  return IGNORE_PATTERNS.some((p13) => filename.includes(p13));
+  return IGNORE_PATTERNS.some((p14) => filename.includes(p14));
 }
 function hasWatchedExtension(filename, extensions) {
   return extensions.some((ext) => filename.endsWith(`.${ext}`));
@@ -5505,7 +6601,7 @@ var ServerWatcher = class {
 `);
     this.spawnChild();
     try {
-      this.watcher = import_node_fs15.default.watch(options.watchDir, { recursive: true }, (_event, filename) => {
+      this.watcher = import_node_fs19.default.watch(options.watchDir, { recursive: true }, (_event, filename) => {
         if (!filename) return;
         this.onFileChange(filename);
       });
@@ -5540,7 +6636,7 @@ var ServerWatcher = class {
       process.stdout.write("\x1Bc");
     }
     console.log(`  [${timestamp()}] Starting ${serverName}...`);
-    this.child = (0, import_node_child_process8.spawn)(command, args, { env, stdio: ["pipe", "pipe", "pipe"] });
+    this.child = (0, import_node_child_process10.spawn)(command, args, { env, stdio: ["pipe", "pipe", "pipe"] });
     this.child.stdout?.on("data", (data) => {
       process.stdout.write(`  [stdout] ${data.toString().trimEnd()}
 `);
@@ -5606,7 +6702,7 @@ init_lockfile();
 init_vault_service();
 var DEFAULT_EXTENSIONS = ["ts", "js", "json", "py", "mjs", "cjs"];
 var DEFAULT_DEBOUNCE_MS = 300;
-var watch_default = (0, import_citty25.defineCommand)({
+var watch_default = (0, import_citty31.defineCommand)({
   meta: {
     name: "watch",
     description: "Watch a local MCP server for file changes and auto-restart"
@@ -5645,8 +6741,8 @@ var watch_default = (0, import_citty25.defineCommand)({
     const lockfile = readLockfile();
     const entry = lockfile.servers[serverName];
     if (!entry) {
-      console.error(import_picocolors25.default.red(`  Error: Server '${serverName}' not found in lockfile.`));
-      console.error(import_picocolors25.default.dim(`  Run ${import_picocolors25.default.cyan("mcpman link .")} to register a local server.`));
+      console.error(import_picocolors31.default.red(`  Error: Server '${serverName}' not found in lockfile.`));
+      console.error(import_picocolors31.default.dim(`  Run ${import_picocolors31.default.cyan("mcpman link .")} to register a local server.`));
       process.exit(1);
     }
     let watchDir = args.dir;
@@ -5654,8 +6750,8 @@ var watch_default = (0, import_citty25.defineCommand)({
       if (entry.source === "local" && entry.resolved) {
         watchDir = entry.resolved;
       } else {
-        console.error(import_picocolors25.default.red(`  Error: Cannot determine watch directory for '${serverName}'.`));
-        console.error(import_picocolors25.default.dim("  Use --dir to specify the directory to watch."));
+        console.error(import_picocolors31.default.red(`  Error: Cannot determine watch directory for '${serverName}'.`));
+        console.error(import_picocolors31.default.dim("  Use --dir to specify the directory to watch."));
         process.exit(1);
       }
     }
@@ -5702,13 +6798,13 @@ async function loadVaultSecrets4(serverName) {
 // src/commands/why.ts
 init_cjs_shims();
-var import_citty26 = require("citty");
-var import_picocolors26 = __toESM(require("picocolors"), 1);
+var import_citty32 = require("citty");
+var import_picocolors32 = __toESM(require("picocolors"), 1);
 // src/core/why-service.ts
 init_cjs_shims();
-var import_node_fs16 = __toESM(require("fs"), 1);
-var import_node_path18 = __toESM(require("path"), 1);
+var import_node_fs20 = __toESM(require("fs"), 1);
+var import_node_path20 = __toESM(require("path"), 1);
 init_paths();
 init_lockfile();
 var ALL_CLIENT_TYPES = ["claude-desktop", "cursor", "vscode", "windsurf"];
@@ -5770,16 +6866,16 @@ async function findOrphanedClients(serverName) {
 }
 function scanProfiles(serverName, profilesDir) {
   const found = [];
-  if (!import_node_fs16.default.existsSync(profilesDir)) return found;
+  if (!import_node_fs20.default.existsSync(profilesDir)) return found;
   let files;
   try {
-    files = import_node_fs16.default.readdirSync(profilesDir).filter((f) => f.endsWith(".json"));
+    files = import_node_fs20.default.readdirSync(profilesDir).filter((f) => f.endsWith(".json"));
   } catch {
     return found;
   }
   for (const file of files) {
     try {
-      const raw = import_node_fs16.default.readFileSync(import_node_path18.default.join(profilesDir, file), "utf-8");
+      const raw = import_node_fs20.default.readFileSync(import_node_path20.default.join(profilesDir, file), "utf-8");
       const profile = JSON.parse(raw);
       if (serverName in (profile.servers ?? {})) {
         found.push(profile.name ?? file.replace(".json", ""));
@@ -5808,8 +6904,8 @@ function formatWhyOutput(result) {
   if (result.profiles.length > 0) {
     lines.push("");
     lines.push("  Profiles:");
-    for (const p13 of result.profiles) {
-      lines.push(`    ${p13}`);
+    for (const p14 of result.profiles) {
+      lines.push(`    ${p14}`);
     }
   }
   if (result.envVars.length > 0) {
@@ -5823,7 +6919,7 @@ function formatWhyOutput(result) {
 }
 // src/commands/why.ts
-var why_default = (0, import_citty26.defineCommand)({
+var why_default = (0, import_citty32.defineCommand)({
   meta: {
     name: "why",
     description: "Show why a server is installed (provenance, clients, profiles)"
@@ -5845,15 +6941,15 @@ var why_default = (0, import_citty26.defineCommand)({
     const asJson = args.json;
     const result = await getServerProvenance(serverName);
     if (!result) {
-      console.error(import_picocolors26.default.red(`  Server '${serverName}' not found in lockfile or any client config.`));
-      console.error(import_picocolors26.default.dim(`  Run ${import_picocolors26.default.cyan("mcpman list")} to see installed servers.`));
+      console.error(import_picocolors32.default.red(`  Server '${serverName}' not found in lockfile or any client config.`));
+      console.error(import_picocolors32.default.dim(`  Run ${import_picocolors32.default.cyan("mcpman list")} to see installed servers.`));
       process.exit(1);
     }
     if (result.orphaned) {
-      console.log(import_picocolors26.default.yellow(`
+      console.log(import_picocolors32.default.yellow(`
   Server '${serverName}' is orphaned:`));
-      console.log(import_picocolors26.default.dim("  Found in client config(s) but not in lockfile."));
-      console.log(import_picocolors26.default.dim(`  Run ${import_picocolors26.default.cyan("mcpman sync --remove")} to clean up.
+      console.log(import_picocolors32.default.dim("  Found in client config(s) but not in lockfile."));
+      console.log(import_picocolors32.default.dim(`  Run ${import_picocolors32.default.cyan("mcpman sync --remove")} to clean up.
 `));
       const registeredClients = result.clients.filter((c) => c.registered).map((c) => c.type);
       if (registeredClients.length > 0) {
@@ -5876,7 +6972,7 @@ process.on("SIGINT", () => {
   console.log("\nAborted.");
   process.exit(130);
 });
-var main = (0, import_citty27.defineCommand)({
+var main = (0, import_citty33.defineCommand)({
   meta: {
     name: APP_NAME,
     version: APP_VERSION,
@@ -5908,7 +7004,13 @@ var main = (0, import_citty27.defineCommand)({
     watch: watch_default,
     registry: registry_default,
     completions: completions_default,
-    why: why_default
+    why: why_default,
+    env: env_default,
+    bench: bench_default,
+    diff: diff_default,
+    group: group_default,
+    pin: pin_default,
+    rollback: rollback_default
   }
 });
-(0, import_citty27.runMain)(main);
+(0, import_citty33.runMain)(main);