metheus-governance-mcp-cli 0.2.0

package/.env.npm.local.example

@@ -0,0 +1,3 @@
+# Copy this file to .env.npm.local and put your real npm publish token.
+# Do NOT commit .env.npm.local.
+NPM_TOKEN=__PASTE_NPM_TOKEN_HERE__

package/README.md

@@ -0,0 +1,137 @@
+# metheus-governance-mcp-cli
+
+Metheus Governance MCP helper CLI.
+
+- `setup`: register `metheus-governance-mcp` into Codex/Claude (if installed)
+- `proxy`: stdio MCP bridge to Metheus HTTPS gateway
+- `auth`: save/check/clear local Metheus token used by proxy
+
+## Install
+
+```bash
+npm install -g metheus-governance-mcp-cli
+```
+
+## Setup
+
+```bash
+metheus-governance-mcp setup --project-id <project_uuid> --ctxpack-key "<ctxpack_key>" --base-url https://metheus.gesiaplatform.com
+```
+
+`project-id` can be omitted if your current folder (or parent) has `.metheus_ctxpack_sync.json`.
+
+## Use in MCP
+
+`setup` auto-registers this server for `codex` and `claude` when those CLIs are available.
+
+## Auth flow (recommended)
+
+1. Auto login and save token once (default flow: `device -> callback -> manual hint`):
+
+```bash
+metheus-governance-mcp auth login --base-url https://metheus.gesiaplatform.com
+```
+
+Optional flags:
+
+```bash
+metheus-governance-mcp auth login --callback-port 43819 --open-browser true
+metheus-governance-mcp auth login --flow device
+metheus-governance-mcp auth login --flow callback --callback-port 43819
+metheus-governance-mcp auth login --client-id metheus-cli --realm master --keycloak-url https://oauth3.gesia.io
+```
+
+Keycloak client requirement for auto login:
+- Device flow:
+  - Enable OAuth 2.0 Device Authorization Grant for the client.
+- Callback flow:
+  - Add localhost callback URI to redirect list (example): `http://127.0.0.1/*`
+- If callback URI is not configured, CLI can still work via `--flow device`.
+
+Manual fallback:
+
+```bash
+metheus-governance-mcp auth login --manual true --base-url https://metheus.gesiaplatform.com
+```
+
+2. Check token status:
+
+```bash
+metheus-governance-mcp auth status
+```
+
+3. If token is rotated, set directly:
+
+```bash
+metheus-governance-mcp auth set --token "<access_token>"
+```
+
+4. Remove local token:
+
+```bash
+metheus-governance-mcp auth clear
+```
+
+`proxy` priority:
+- 1) `METHEUS_TOKEN`
+- 2) `MCP_AUTH_TOKEN`
+- 3) local file `~/.metheus/governance-mcp-auth.json`
+
+You can still use env token directly:
+
+```bash
+export METHEUS_TOKEN="<access_token>"
+```
+
+PowerShell:
+
+```powershell
+$env:METHEUS_TOKEN="<access_token>"
+```
+
+## npm publish token (where to store)
+
+Use this local file in this folder:
+
+- `tools/governance-mcp-cli/.env.npm.local` (create from `.env.npm.local.example`)
+
+Template:
+
+```env
+NPM_TOKEN=__PASTE_NPM_TOKEN_HERE__
+```
+
+Load token before publish:
+
+PowerShell:
+
+```powershell
+$env:NPM_TOKEN = (Get-Content .\.env.npm.local | Where-Object { $_ -match '^NPM_TOKEN=' } | ForEach-Object { $_.Split('=',2)[1] } | Select-Object -First 1).Trim()
+npm publish --access public
+```
+
+bash/zsh:
+
+```bash
+export NPM_TOKEN="$(grep '^NPM_TOKEN=' ./.env.npm.local | head -n1 | cut -d'=' -f2-)"
+npm publish --access public
+```
+
+## Release commands
+
+```bash
+npm run check
+npm run publish:dry
+```
+
+Actual publish:
+
+```bash
+npm run publish:public
+```
+
+If npm account uses 2FA, pass OTP:
+
+```bash
+node release.mjs --otp <6-digit-code>
+```

package/bin/metheus-governance-mcp.js

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import "../cli.mjs";
+