multicorn-shield 0.6.1 → 0.7.0

package/dist/index.cjs

@@ -2106,7 +2106,7 @@ var MulticornShield = class {
    *
    * @example
    * ```ts
-   * const shield = new MulticornShield({ apiKey: 'mcs_your_key_here' });
+   * const shield = new MulticornShield({ apiKey: 'mcs_live_abc123...' });
    * ```
    */
   constructor(config) {
@@ -2463,16 +2463,20 @@ function validateBaseUrl(baseUrl) {
     );
   }
 }
+var PLACEHOLDER_KEYS = /* @__PURE__ */ new Set(["mcs_your_key_here"]);
+var INVALID_KEY_MESSAGE = "Invalid Multicorn Shield API key. Get your key at https://app.multicorn.ai/settings";
 function validateApiKey(apiKey) {
+  if (typeof apiKey !== "string" || apiKey.length === 0) {
+    throw new Error(INVALID_KEY_MESSAGE);
+  }
   if (!apiKey.startsWith(API_KEY_PREFIX)) {
-    throw new Error(
-      `[MulticornShield] Invalid API key format. Keys must start with "${API_KEY_PREFIX}". Find your API key in the Multicorn dashboard under Settings \u2192 API Keys.`
-    );
+    throw new Error(INVALID_KEY_MESSAGE);
   }
   if (apiKey.length < MIN_API_KEY_LENGTH) {
-    throw new Error(
-      `[MulticornShield] API key is too short (${String(apiKey.length)} characters). Minimum length is ${String(MIN_API_KEY_LENGTH)} characters. Find your API key in the Multicorn dashboard under Settings \u2192 API Keys.`
-    );
+    throw new Error(INVALID_KEY_MESSAGE);
+  }
+  if (PLACEHOLDER_KEYS.has(apiKey)) {
+    throw new Error(INVALID_KEY_MESSAGE);
   }
 }
 

package/dist/index.d.cts

@@ -1902,7 +1902,7 @@ declare function createMcpAdapter(config: McpAdapterConfig): McpAdapter;
  * @example
  * ```ts
  * const shield = new MulticornShield({
- *   apiKey: 'mcs_your_key_here',
+ *   apiKey: 'mcs_live_abc123...',
  *   baseUrl: 'https://api.multicorn.ai',
  *   timeout: 5000,
  * });
@@ -1938,7 +1938,7 @@ interface MulticornShieldConfig {
      * @example
      * ```ts
      * const shield = new MulticornShield({
-     *   apiKey: 'mcs_your_key_here',
+     *   apiKey: 'mcs_live_abc123...',
      *   onError: (err) => myLogger.warn(err.message),
      * });
      * ```
@@ -2052,7 +2052,7 @@ declare class MulticornShield {
      *
      * @example
      * ```ts
-     * const shield = new MulticornShield({ apiKey: 'mcs_your_key_here' });
+     * const shield = new MulticornShield({ apiKey: 'mcs_live_abc123...' });
      * ```
      */
     constructor(config: MulticornShieldConfig);

package/dist/index.d.ts

@@ -1902,7 +1902,7 @@ declare function createMcpAdapter(config: McpAdapterConfig): McpAdapter;
  * @example
  * ```ts
  * const shield = new MulticornShield({
- *   apiKey: 'mcs_your_key_here',
+ *   apiKey: 'mcs_live_abc123...',
  *   baseUrl: 'https://api.multicorn.ai',
  *   timeout: 5000,
  * });
@@ -1938,7 +1938,7 @@ interface MulticornShieldConfig {
      * @example
      * ```ts
      * const shield = new MulticornShield({
-     *   apiKey: 'mcs_your_key_here',
+     *   apiKey: 'mcs_live_abc123...',
      *   onError: (err) => myLogger.warn(err.message),
      * });
      * ```
@@ -2052,7 +2052,7 @@ declare class MulticornShield {
      *
      * @example
      * ```ts
-     * const shield = new MulticornShield({ apiKey: 'mcs_your_key_here' });
+     * const shield = new MulticornShield({ apiKey: 'mcs_live_abc123...' });
      * ```
      */
     constructor(config: MulticornShieldConfig);

package/dist/index.js

@@ -2104,7 +2104,7 @@ var MulticornShield = class {
    *
    * @example
    * ```ts
-   * const shield = new MulticornShield({ apiKey: 'mcs_your_key_here' });
+   * const shield = new MulticornShield({ apiKey: 'mcs_live_abc123...' });
    * ```
    */
   constructor(config) {
@@ -2461,16 +2461,20 @@ function validateBaseUrl(baseUrl) {
     );
   }
 }
+var PLACEHOLDER_KEYS = /* @__PURE__ */ new Set(["mcs_your_key_here"]);
+var INVALID_KEY_MESSAGE = "Invalid Multicorn Shield API key. Get your key at https://app.multicorn.ai/settings";
 function validateApiKey(apiKey) {
+  if (typeof apiKey !== "string" || apiKey.length === 0) {
+    throw new Error(INVALID_KEY_MESSAGE);
+  }
   if (!apiKey.startsWith(API_KEY_PREFIX)) {
-    throw new Error(
-      `[MulticornShield] Invalid API key format. Keys must start with "${API_KEY_PREFIX}". Find your API key in the Multicorn dashboard under Settings \u2192 API Keys.`
-    );
+    throw new Error(INVALID_KEY_MESSAGE);
   }
   if (apiKey.length < MIN_API_KEY_LENGTH) {
-    throw new Error(
-      `[MulticornShield] API key is too short (${String(apiKey.length)} characters). Minimum length is ${String(MIN_API_KEY_LENGTH)} characters. Find your API key in the Multicorn dashboard under Settings \u2192 API Keys.`
-    );
+    throw new Error(INVALID_KEY_MESSAGE);
+  }
+  if (PLACEHOLDER_KEYS.has(apiKey)) {
+    throw new Error(INVALID_KEY_MESSAGE);
   }
 }
 

package/dist/multicorn-proxy.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { existsSync } from 'fs';
-import { readFile, writeFile, mkdir, unlink } from 'fs/promises';
+import { mkdir, writeFile, readFile, unlink } from 'fs/promises';
 import { join } from 'path';
 import { homedir } from 'os';
 import { createInterface } from 'readline';
@@ -94,31 +94,68 @@ function collectAgentsFromConfig(cfg) {
   }
   return [];
 }
-async function loadConfig() {
+async function parseConfigFile() {
   try {
     const raw = await readFile(CONFIG_PATH, "utf8");
-    const parsed = JSON.parse(raw);
-    if (!isProxyConfig(parsed)) return null;
-    const obj = parsed;
-    const agentNameRaw = obj["agentName"];
-    const agentsRaw = obj["agents"];
-    const hasNonEmptyAgents = Array.isArray(agentsRaw) && agentsRaw.length > 0 && agentsRaw.every((e) => isAgentEntry(e));
-    const needsMigrate = typeof agentNameRaw === "string" && agentNameRaw.length > 0 && !hasNonEmptyAgents;
-    if (!needsMigrate) {
-      return parsed;
-    }
-    const platform = typeof obj["platform"] === "string" && obj["platform"].length > 0 ? obj["platform"] : "unknown";
-    const next = { ...obj };
-    delete next["agentName"];
-    delete next["platform"];
-    next["agents"] = [{ name: agentNameRaw, platform }];
-    next["defaultAgent"] = agentNameRaw;
-    const migrated = next;
-    await saveConfig(migrated);
-    return migrated;
-  } catch {
-    return null;
+    try {
+      return { kind: "ok", value: JSON.parse(raw) };
+    } catch {
+      return { kind: "parseError" };
+    }
+  } catch (error) {
+    if (isErrnoException(error) && error.code === "ENOENT") {
+      return { kind: "missing" };
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    return { kind: "readError", message };
+  }
+}
+function isAllowedShieldApiBaseUrl(url) {
+  return url.startsWith("https://") || url.startsWith("http://localhost") || url.startsWith("http://127.0.0.1");
+}
+async function loadConfig() {
+  const result = await parseConfigFile();
+  if (result.kind !== "ok") return null;
+  const parsed = result.value;
+  if (!isProxyConfig(parsed)) return null;
+  const obj = parsed;
+  const agentNameRaw = obj["agentName"];
+  const agentsRaw = obj["agents"];
+  const hasNonEmptyAgents = Array.isArray(agentsRaw) && agentsRaw.length > 0 && agentsRaw.every((e) => isAgentEntry(e));
+  const needsMigrate = typeof agentNameRaw === "string" && agentNameRaw.length > 0 && !hasNonEmptyAgents;
+  if (!needsMigrate) {
+    return parsed;
+  }
+  const platform = typeof obj["platform"] === "string" && obj["platform"].length > 0 ? obj["platform"] : "unknown";
+  const next = { ...obj };
+  delete next["agentName"];
+  delete next["platform"];
+  next["agents"] = [{ name: agentNameRaw, platform }];
+  next["defaultAgent"] = agentNameRaw;
+  const migrated = next;
+  await saveConfig(migrated);
+  return migrated;
+}
+async function readBaseUrlFromConfig() {
+  const result = await parseConfigFile();
+  if (result.kind === "missing") return void 0;
+  if (result.kind === "readError") {
+    process.stderr.write(
+      style.yellow(`Warning: could not read base URL from config file: ${result.message}`) + "\n"
+    );
+    return void 0;
   }
+  if (result.kind === "parseError") {
+    process.stderr.write(
+      style.yellow("Warning: could not parse ~/.multicorn/config.json as JSON.") + "\n"
+    );
+    return void 0;
+  }
+  const parsed = result.value;
+  if (typeof parsed !== "object" || parsed === null) return void 0;
+  const u = parsed["baseUrl"];
+  if (typeof u !== "string" || u.length === 0) return void 0;
+  return u;
 }
 async function deleteAgentByName(name) {
   const config = await loadConfig();
@@ -329,11 +366,12 @@ async function isCursorConnected() {
     return false;
   }
 }
-var PLATFORM_LABELS = ["OpenClaw", "Claude Code", "Cursor"];
+var PLATFORM_LABELS = ["OpenClaw", "Claude Code", "Cursor", "Local MCP / Other"];
 var PLATFORM_BY_SELECTION = {
   1: "openclaw",
   2: "claude-code",
-  3: "cursor"
+  3: "cursor",
+  4: "other-mcp"
 };
 var DEFAULT_AGENT_NAMES = {
   openclaw: "my-openclaw-agent",
@@ -350,17 +388,20 @@ async function promptPlatformSelection(ask) {
     await isCursorConnected()
   ];
   for (let i = 0; i < PLATFORM_LABELS.length; i++) {
-    const marker = connectedFlags[i] ? " " + style.green("\u2713") + style.dim(" connected") : "";
+    const marker = i < connectedFlags.length && connectedFlags[i] ? " " + style.dim("\u25CF detected locally") : "";
     process.stderr.write(
       `  ${style.violet(String(i + 1))}. ${PLATFORM_LABELS[i] ?? ""}${marker}
 `
     );
   }
+  process.stderr.write(
+    style.dim("     Pick 4 if you want to wrap a local MCP server with multicorn-proxy --wrap.") + "\n"
+  );
   let selection = 0;
   while (selection === 0) {
-    const input = await ask("Select (1-3): ");
+    const input = await ask("Select (1-4): ");
     const num = parseInt(input.trim(), 10);
-    if (num >= 1 && num <= 3) {
+    if (num >= 1 && num <= 4) {
       selection = num;
     }
   }
@@ -490,7 +531,7 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
   if (platform !== "cursor") {
     process.stderr.write(
       style.dim(
-        "Replace YOUR_SHIELD_API_KEY with your API key. Find it in Settings > API keys at https://app.multicorn.ai/settings/api-keys"
+        "Replace YOUR_SHIELD_API_KEY with your API key. Find it in Settings > API keys at https://app.multicorn.ai/settings#api-keys"
       ) + "\n"
     );
   }
@@ -507,7 +548,8 @@ function printPlatformSnippet(platform, routingToken, shortName, apiKey) {
     );
   }
 }
-async function runInit(baseUrl = "https://api.multicorn.ai") {
+var DEFAULT_SHIELD_API_BASE_URL = "https://api.multicorn.ai";
+async function runInit(explicitBaseUrl) {
   if (!process.stdin.isTTY) {
     process.stderr.write(
       style.red("Error: interactive terminal required. Cannot run init with piped input.") + "\n"
@@ -522,19 +564,32 @@ async function runInit(baseUrl = "https://api.multicorn.ai") {
   process.stderr.write(style.dim("Agent governance for the AI era") + "\n\n");
   process.stderr.write(style.bold(style.violet("Multicorn Shield proxy setup")) + "\n\n");
   process.stderr.write(
-    style.dim("Get your API key at https://app.multicorn.ai/settings/api-keys") + "\n\n"
+    style.dim("Get your API key at https://app.multicorn.ai/settings#api-keys") + "\n\n"
   );
   const existing = await loadConfig().catch(() => null);
-  if (baseUrl === "https://api.multicorn.ai") {
-    if (existing !== null && existing.baseUrl.length > 0) {
-      baseUrl = existing.baseUrl;
+  let resolvedBaseUrl;
+  if (explicitBaseUrl !== void 0 && explicitBaseUrl.trim().length > 0) {
+    resolvedBaseUrl = explicitBaseUrl.trim();
+  } else if (existing !== null && existing.baseUrl.length > 0) {
+    resolvedBaseUrl = existing.baseUrl;
+  } else {
+    const fromFile = await readBaseUrlFromConfig();
+    if (fromFile !== void 0 && fromFile.length > 0) {
+      resolvedBaseUrl = fromFile;
     } else {
       const envBaseUrl = process.env["MULTICORN_BASE_URL"];
-      if (envBaseUrl !== void 0 && envBaseUrl.length > 0) {
-        baseUrl = envBaseUrl;
-      }
+      resolvedBaseUrl = envBaseUrl !== void 0 && envBaseUrl.trim().length > 0 ? envBaseUrl.trim() : DEFAULT_SHIELD_API_BASE_URL;
     }
   }
+  if (!isAllowedShieldApiBaseUrl(resolvedBaseUrl)) {
+    process.stderr.write(
+      style.red(
+        "Base URL must use HTTPS (or http://localhost for local development). Received a non-HTTPS URL from config. Use --base-url to override."
+      ) + "\n"
+    );
+    rl.close();
+    return null;
+  }
   let apiKey = "";
   if (existing !== null && existing.apiKey.startsWith("mcs_") && existing.apiKey.length >= 8) {
     const masked = "mcs_..." + existing.apiKey.slice(-4);
@@ -554,7 +609,7 @@ async function runInit(baseUrl = "https://api.multicorn.ai") {
     const spinner = withSpinner("Validating key...");
     let result;
     try {
-      result = await validateApiKey(key, baseUrl);
+      result = await validateApiKey(key, resolvedBaseUrl);
     } catch (error) {
       spinner.stop(false, "Validation failed");
       throw error;
@@ -566,18 +621,11 @@ async function runInit(baseUrl = "https://api.multicorn.ai") {
     spinner.stop(true, "Key validated");
     apiKey = key;
   }
-  if (!baseUrl.startsWith("https://") && !baseUrl.startsWith("http://localhost") && !baseUrl.startsWith("http://127.0.0.1")) {
-    process.stderr.write(
-      style.red(`\u2717 Shield API base URL must use HTTPS. Got: ${baseUrl}`) + "\n"
-    );
-    rl.close();
-    return null;
-  }
   const configuredAgents = [];
   let currentAgents = collectAgentsFromConfig(existing);
   let lastConfig = {
     apiKey,
-    baseUrl,
+    baseUrl: resolvedBaseUrl,
     ...currentAgents.length > 0 ? {
       agents: currentAgents,
       defaultAgent: existing !== null && typeof existing.defaultAgent === "string" && existing.defaultAgent.length > 0 ? existing.defaultAgent : currentAgents[currentAgents.length - 1]?.name ?? ""
@@ -588,6 +636,40 @@ async function runInit(baseUrl = "https://api.multicorn.ai") {
     const selection = await promptPlatformSelection(ask);
     const selectedPlatform = PLATFORM_BY_SELECTION[selection] ?? "cursor";
     const selectedLabel = PLATFORM_LABELS[selection - 1] ?? "Cursor";
+    if (selection === 4) {
+      const raw = existing !== null ? { ...existing } : {};
+      raw["apiKey"] = apiKey;
+      raw["baseUrl"] = resolvedBaseUrl;
+      delete raw["agentName"];
+      delete raw["platform"];
+      lastConfig = raw;
+      try {
+        await saveConfig(lastConfig);
+        process.stderr.write(
+          style.green("\u2713") + ` Config saved to ${style.cyan(CONFIG_PATH)}
+`
+        );
+        process.stderr.write(
+          "\n" + style.bold("Try it:") + " " + style.cyan(
+            "npx multicorn-proxy --wrap npx @modelcontextprotocol/server-filesystem /tmp"
+          ) + "\n"
+        );
+      } catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        process.stderr.write(style.red(`Failed to save config: ${detail}`) + "\n");
+      }
+      configuredAgents.push({
+        selection,
+        platform: selectedPlatform,
+        platformLabel: selectedLabel,
+        agentName: ""
+      });
+      const another2 = await ask("\nConnect another agent? (Y/n) ");
+      if (another2.trim().toLowerCase() === "n") {
+        configuring = false;
+      }
+      continue;
+    }
     const existingForPlatform = currentAgents.find((a) => a.platform === selectedPlatform);
     if (existingForPlatform !== void 0) {
       process.stderr.write(
@@ -657,7 +739,7 @@ An agent for ${selectedLabel} already exists: ${style.cyan(existingForPlatform.n
         }
         const spinner = withSpinner("Updating OpenClaw config...");
         try {
-          const result = await updateOpenClawConfigIfPresent(apiKey, baseUrl, agentName);
+          const result = await updateOpenClawConfigIfPresent(apiKey, resolvedBaseUrl, agentName);
           if (result === "not-found") {
             spinner.stop(false, "OpenClaw config disappeared unexpectedly.");
             rl.close();
@@ -712,7 +794,7 @@ An agent for ${selectedLabel} already exists: ${style.cyan(existingForPlatform.n
         const spinner = withSpinner("Creating proxy config...");
         try {
           proxyUrl = await createProxyConfig(
-            baseUrl,
+            resolvedBaseUrl,
             apiKey,
             agentName,
             targetUrl,
@@ -750,7 +832,7 @@ An agent for ${selectedLabel} already exists: ${style.cyan(existingForPlatform.n
       currentAgents.push({ name: agentName, platform: selectedPlatform });
       const raw = existing !== null ? { ...existing } : {};
       raw["apiKey"] = apiKey;
-      raw["baseUrl"] = baseUrl;
+      raw["baseUrl"] = resolvedBaseUrl;
       raw["agents"] = currentAgents;
       raw["defaultAgent"] = agentName;
       delete raw["agentName"];
@@ -776,14 +858,15 @@ An agent for ${selectedLabel} already exists: ${style.cyan(existingForPlatform.n
   if (configuredAgents.length > 0) {
     process.stderr.write("\n" + style.bold(style.violet("Setup complete")) + "\n\n");
     for (const agent of configuredAgents) {
+      const namePart = agent.agentName.length > 0 ? ` - ${style.cyan(agent.agentName)}` : "";
+      const urlPart = agent.proxyUrl != null ? ` ${style.dim(`(${agent.proxyUrl})`)}` : "";
       process.stderr.write(
-        `  ${style.green("\u2713")} ${agent.platformLabel} - ${style.cyan(agent.agentName)}${agent.proxyUrl != null ? ` ${style.dim(`(${agent.proxyUrl})`)}` : ""}
+        `  ${style.green("\u2713")} ${agent.platformLabel}${namePart}${urlPart}
 `
       );
     }
     process.stderr.write("\n");
     const configuredPlatforms = new Set(configuredAgents.map((a) => a.platform));
-    process.stderr.write("\n" + style.bold(style.violet("Next steps")) + "\n");
     const blocks = [];
     if (configuredPlatforms.has("openclaw")) {
       blocks.push(
@@ -805,12 +888,10 @@ An agent for ${selectedLabel} already exists: ${style.cyan(existingForPlatform.n
         "\n" + style.bold("To complete your Cursor setup:") + "\n  \u2192 Restart Cursor to pick up MCP config changes\n"
       );
     }
-    if (configuredPlatforms.has("other-mcp")) {
-      blocks.push(
-        "\n" + style.bold("To complete your Other MCP Agent setup:") + "\n  \u2192 Start your agent with: " + style.cyan("npx multicorn-proxy --wrap <your-server> --agent-name <name>") + "\n"
-      );
+    if (blocks.length > 0) {
+      process.stderr.write("\n" + style.bold(style.violet("Next steps")) + "\n");
+      process.stderr.write(blocks.join("") + "\n");
     }
-    process.stderr.write(blocks.join("") + "\n");
   }
   return lastConfig;
 }
@@ -1807,6 +1888,15 @@ function createProxyServer(config) {
     agentId = agentRecord.id;
     grantedScopes = agentRecord.scopes;
     authInvalid = agentRecord.authInvalid === true;
+    if (authInvalid) {
+      config.logger.error("API key rejected by the Multicorn service.", {
+        agent: config.agentName
+      });
+      process.stderr.write(
+        "\nError: API key was rejected by the Multicorn service.\nCheck your key at https://app.multicorn.ai/settings#api-keys or run `npx multicorn-proxy init` to reconfigure.\n\n"
+      );
+      throw new Error("API key was rejected by the Multicorn service.");
+    }
     config.logger.info("Agent resolved.", {
       agent: config.agentName,
       id: agentId,
@@ -1920,10 +2010,11 @@ function parseArgs(argv) {
   let wrapCommand = "";
   let wrapArgs = [];
   let logLevel = "info";
-  let baseUrl = "https://api.multicorn.ai";
+  let baseUrl = void 0;
   let dashboardUrl = "";
   let agentName = "";
   let deleteAgentName = "";
+  let apiKey = void 0;
   for (let i = 0; i < args.length; i++) {
     const arg = args[i];
     if (arg === "init") {
@@ -1942,46 +2033,56 @@ function parseArgs(argv) {
       i++;
     } else if (arg === "--wrap") {
       subcommand = "wrap";
-      const next = args[i + 1];
-      if (next === void 0 || next.startsWith("-")) {
-        process.stderr.write("Error: --wrap requires a command to run.\n");
-        process.stderr.write("Example: npx multicorn-proxy --wrap my-mcp-server\n");
-        process.exit(1);
-      }
-      wrapCommand = next;
-      wrapArgs = args.slice(i + 2);
-      const cleaned = [];
-      for (let j = 0; j < wrapArgs.length; j++) {
-        const token = wrapArgs[j];
+      const tail = args.slice(i + 1);
+      const remaining = [];
+      for (let j = 0; j < tail.length; j++) {
+        const token = tail[j];
+        if (token === void 0) continue;
+        if (remaining.length > 0) {
+          remaining.push(token);
+          continue;
+        }
         if (token === "--agent-name") {
-          const value = wrapArgs[j + 1];
+          const value = tail[j + 1];
           if (value !== void 0) {
             agentName = value;
             j++;
           }
         } else if (token === "--log-level") {
-          const value = wrapArgs[j + 1];
+          const value = tail[j + 1];
           if (value !== void 0 && isValidLogLevel(value)) {
             logLevel = value;
             j++;
           }
         } else if (token === "--base-url") {
-          const value = wrapArgs[j + 1];
+          const value = tail[j + 1];
           if (value !== void 0) {
             baseUrl = value;
             j++;
           }
         } else if (token === "--dashboard-url") {
-          const value = wrapArgs[j + 1];
+          const value = tail[j + 1];
           if (value !== void 0) {
             dashboardUrl = value;
             j++;
           }
-        } else if (token !== void 0) {
-          cleaned.push(token);
+        } else if (token === "--api-key") {
+          const value = tail[j + 1];
+          if (value !== void 0) {
+            apiKey = value;
+            j++;
+          }
+        } else {
+          remaining.push(token);
         }
       }
-      wrapArgs = cleaned;
+      if (remaining.length === 0) {
+        process.stderr.write("Error: --wrap requires a command to run.\n");
+        process.stderr.write("Example: npx multicorn-proxy --wrap my-mcp-server\n");
+        process.exit(1);
+      }
+      wrapCommand = remaining[0] ?? "";
+      wrapArgs = remaining.slice(1);
       break;
     } else if (arg === "--log-level") {
       const next = args[i + 1];
@@ -2007,6 +2108,12 @@ function parseArgs(argv) {
         agentName = next;
         i++;
       }
+    } else if (arg === "--api-key") {
+      const next = args[i + 1];
+      if (next !== void 0) {
+        apiKey = next;
+        i++;
+      }
     }
   }
   return {
@@ -2017,7 +2124,8 @@ function parseArgs(argv) {
     baseUrl,
     dashboardUrl,
     agentName,
-    deleteAgentName
+    deleteAgentName,
+    apiKey
   };
 }
 function printHelp() {
@@ -2040,6 +2148,7 @@ function printHelp() {
       "      Shield's permission layer.",
       "",
       "Options:",
+      "  --api-key <key>       Multicorn API key (overrides MULTICORN_API_KEY env var and config file)",
       "  --log-level <level>   Log level: debug | info | warn | error  (default: info)",
       "  --base-url <url>      Multicorn API base URL  (default: https://api.multicorn.ai)",
       "  --dashboard-url <url> Dashboard URL for consent page  (default: derived from --base-url)",
@@ -2098,23 +2207,25 @@ async function main() {
 `);
     return;
   }
-  if (!cli.baseUrl.startsWith("https://") && !cli.baseUrl.startsWith("http://localhost") && !cli.baseUrl.startsWith("http://127.0.0.1")) {
-    process.stderr.write(
-      `Error: --base-url must use HTTPS. Received: "${cli.baseUrl}"
-Use https:// or http://localhost for local development.
-`
-    );
-    process.exit(1);
+  if (cli.baseUrl !== void 0 && cli.baseUrl.length > 0) {
+    if (!isAllowedShieldApiBaseUrl(cli.baseUrl)) {
+      process.stderr.write(
+        "Error: --base-url must use HTTPS. Received a non-HTTPS URL.\nUse https:// or http://localhost for local development.\n"
+      );
+      process.exit(1);
+    }
   }
-  const config = await loadConfig();
-  if (config === null) {
-    process.stderr.write(
-      "No config found. Run `npx multicorn-proxy init` to set up your API key.\n"
-    );
-    process.exit(1);
+  const config = await resolveWrapConfig(cli, logger);
+  const finalBaseUrl = cli.baseUrl !== void 0 && cli.baseUrl.length > 0 ? cli.baseUrl : config.baseUrl;
+  if (cli.baseUrl === void 0 || cli.baseUrl.length === 0) {
+    if (!isAllowedShieldApiBaseUrl(finalBaseUrl)) {
+      process.stderr.write(
+        "Error: --base-url must use HTTPS. Received a non-HTTPS URL.\nUse https:// or http://localhost for local development.\n"
+      );
+      process.exit(1);
+    }
   }
   const agentName = resolveWrapAgentName(cli, config);
-  const finalBaseUrl = cli.baseUrl !== "https://api.multicorn.ai" ? cli.baseUrl : config.baseUrl;
   const finalDashboardUrl = cli.dashboardUrl !== "" ? cli.dashboardUrl : deriveDashboardUrl(finalBaseUrl);
   const legacyPlatform = config.platform;
   const platformForServer = typeof legacyPlatform === "string" && legacyPlatform.length > 0 ? legacyPlatform : "other-mcp";
@@ -2141,6 +2252,31 @@ Use https:// or http://localhost for local development.
   });
   await proxy.start();
 }
+async function resolveWrapConfig(cli, logger) {
+  if (cli.apiKey !== void 0 && cli.apiKey.length > 0) {
+    logger.debug("Using API key from --api-key flag.");
+    return {
+      apiKey: cli.apiKey,
+      baseUrl: cli.baseUrl ?? DEFAULT_SHIELD_API_BASE_URL
+    };
+  }
+  const envKey = process.env["MULTICORN_API_KEY"];
+  if (typeof envKey === "string" && envKey.length > 0) {
+    logger.debug("Using API key from MULTICORN_API_KEY environment variable.");
+    return {
+      apiKey: envKey,
+      baseUrl: cli.baseUrl ?? DEFAULT_SHIELD_API_BASE_URL
+    };
+  }
+  const config = await loadConfig();
+  if (config !== null) {
+    return config;
+  }
+  process.stderr.write(
+    "No API key found. Provide one via the --api-key flag, the MULTICORN_API_KEY environment variable, or run `npx multicorn-proxy init` to set up a config file.\n"
+  );
+  process.exit(1);
+}
 function resolveWrapAgentName(cli, config) {
   if (cli.agentName.length > 0) {
     return cli.agentName;
@@ -2165,9 +2301,14 @@ function deriveAgentName(command) {
   const base = command.split("/").pop() ?? command;
   return base.replace(/\.[cm]?[jt]s$/, "");
 }
-main().catch((error) => {
-  const message = error instanceof Error ? error.message : String(error);
-  process.stderr.write(`Fatal error: ${message}
+var isDirectRun = process.argv[1] !== void 0 && (import.meta.url.endsWith(process.argv[1]) || import.meta.url === `file://${process.argv[1]}` || import.meta.url.endsWith("/multicorn-proxy.js") || import.meta.url.endsWith("/multicorn-proxy.ts"));
+if (isDirectRun && process.env["VITEST"] === void 0) {
+  main().catch((error) => {
+    const message = error instanceof Error ? error.message : String(error);
+    process.stderr.write(`Fatal error: ${message}
 `);
-  process.exit(1);
-});
+    process.exit(1);
+  });
+}
+
+export { parseArgs, resolveWrapConfig };

package/dist/shield-extension.js

@@ -22358,7 +22358,7 @@ async function writeExtensionBackup(claudeDesktopConfigPath, mcpServers) {
 
 // package.json
 var package_default = {
-  version: "0.6.1"};
+  version: "0.7.0"};
 
 // src/package-meta.ts
 var PACKAGE_VERSION = package_default.version;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "multicorn-shield",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "description": "The control layer for AI agents: permissions, consent, spending limits, and audit logging.",
   "license": "MIT",
   "type": "module",