neon 4.3.0 → 4.4.0

package/README.md

@@ -736,7 +736,7 @@ $ neon mcp -y
 # OAuth: no API key minted. The agent prompts for Neon sign-in on first use.
 $ neon mcp --oauth
 
-# Project-level config. A minted key is still account-wide.
+# Project-level config. A minted key is still account-wide unless a project is pinned.
 $ neon mcp --project
 
 $ neon mcp --agent cursor --agent claude-code
@@ -744,7 +744,7 @@ $ neon mcp --agent cursor --agent claude-code
 # Hide write tools. Does not change the minted key.
 $ neon mcp --read-only
 
-# Pin MCP tools to one project. Does not change the minted key.
+# Pin MCP tools to one project. A newly minted API key is limited to that project.
 $ neon mcp --project-id <project-id>
 
 # Limit which tool categories are visible.
@@ -753,11 +753,11 @@ $ neon mcp --category querying --category schema
 
 On a TTY the command asks for config location (global is the default), then agents, then API key vs OAuth, then a summary to confirm before it writes. Detected agents start selected: globally installed agents or project-folder markers such as `.cursor` when the install is project.
 
-`-y` skips those questions. `--project`, `--oauth` and `--agent` skip the question they answer and still apply with `-y`. `--read-only` and `--category` are flags only and are never prompted. A linked project-folder install asks whether to pin MCP tools to that `.neon` project (`?projectId=`). An unlinked project folder does not ask. Global installs never add that param unless you pass `--project-id`. Without a TTY, pass `-y` to mint into every detected agent, `--agent` to name the agents or `--oauth` to write the URL only.
+`-y` skips those questions. `--project`, `--oauth` and `--agent` skip the question they answer and still apply with `-y`. `--read-only` and `--category` are flags only and are never prompted. A linked project-folder install asks whether to pin MCP tools to that `.neon` project (`?projectId=`). If you pin and selected API-key auth, the minted key is limited to that project too. An unlinked project folder does not ask. Global installs never add that param unless you pass `--project-id`. `-y` does not infer a project from `.neon`. Without a TTY, pass `-y` to mint into every detected agent, `--agent` to name the agents or `--oauth` to write the URL only.
 
 `--agent` names: `antigravity`, `cline`, `cline-cli`, `claude-code`, `codex`, `cursor`, `gemini-cli`, `goose`, `github-copilot-cli`, `grok-build`, `mcporter`, `opencode`, `vscode`, `windsurf`, `zed`. Project installs drop `antigravity`, `cline`, `cline-cli`, `goose` and `windsurf`. `claude-desktop` is a known name that is then skipped.
 
-The default mints an account-wide API key (or reuses the Bearer already configured for Neon at `https://mcp.neon.tech/mcp`) and writes it into each selected agent's config. That key reaches everything the account can, in every organization. Revoke it with `neon api-keys revoke <id>`. `--oauth` writes the URL with no `Authorization` header; the agent signs in on first use. `--project` writes into the project config (`.cursor/mcp.json` and similar). `--read-only` adds `?readonly=true`. `--project-id` adds `?projectId=`. `--category` adds `?category=` (repeatable or comma-separated: `projects`, `branches`, `schema`, `querying`, `neon_auth`, `data_api`, `observability`, `docs`). Those query params restrict which MCP tools the server exposes; they do not change what the minted key can do.
+The default mints an account-wide API key (or reuses the Bearer already configured for Neon at `https://mcp.neon.tech/mcp`) and writes it into each selected agent's config. That key reaches everything the account can, in every organization. Revoke it with `neon api-keys revoke <id>`. `--oauth` writes the URL with no `Authorization` header; the agent signs in on first use. `--project` writes into the project config (`.cursor/mcp.json` and similar). `--read-only` adds `?readonly=true`. `--project-id` adds `?projectId=` and, when a key is minted, limits that key to the named project. Accepting the linked-project pin does the same. Revoke a project-scoped key with `neon api-keys revoke <id> --org-id <org>`. A reused Bearer keeps the scope it already has. `--category` adds `?category=` (repeatable or comma-separated: `projects`, `branches`, `schema`, `querying`, `neon_auth`, `data_api`, `observability`, `docs`). `--read-only` and `--category` restrict which MCP tools the server exposes; they do not change what the minted key can do.
 
 ## Install Neon agent skills (`skills`)
 
@@ -791,6 +791,34 @@ On a TTY the command asks which agents and which skills, then shows a summary to
 
 `--agent` names match `neon mcp`, minus agents that cannot install skills: `antigravity`, `cline`, `cline-cli`, `claude-code`, `claude-desktop`, `codex`, `cursor`, `gemini-cli`, `goose`, `github-copilot-cli`, `grok-build`, `opencode`, `vscode`, `windsurf`, `zed`. `mcporter` is a known MCP name that is then skipped.
 
+## Install the Neon plugin (`plugins`)
+
+`neon plugins` installs the Neon agent plugin (`neon-postgres`) by running `npx plugins add`. It does not call the Neon API.
+
+```bash
+# Interactive: agents, then confirm.
+$ neon plugins
+
+# Skip prompts. Every detected agent.
+$ neon plugins -y
+
+$ neon plugins --agent cursor --agent claude-code
+
+# User-level install.
+$ neon plugins --global
+$ neon plugins --global --agent vscode
+```
+
+On a TTY the command asks which agents, then shows a summary to confirm. Detected agents start selected from project-folder markers such as `.cursor`. There is one plugin (`neon-postgres`); there is no plugin picker and no `update` subcommand.
+
+`-y` skips those questions and installs into every detected agent. `--agent` names specific agents and skips the agent picker. Without a TTY, pass `-y` or `--agent`. `--agent` alone is enough because the plugin is fixed.
+
+Default scope is `project`. `--global` is `user`. On macOS and Linux, Cursor and Claude Code store the plugin cache under `~/.claude/plugins`; on Windows, Cursor installs into Cursor extensions. `project` vs `user` is the scope field the plugins CLI records, not a directory in the repo. VS Code, GitHub Copilot CLI, and Grok Build only install user-level: they are skipped at the default scope with a warning, and `--agent vscode` without `--global` fails if nothing else is selected.
+
+`--agent` names with a plugins mapping: `claude-code`, `claude-desktop`, `codex`, `cursor`, `github-copilot-cli`, `grok-build`, `vscode`. `claude-desktop` installs as Claude Code; naming both produces one install and lists both names in the table. `mcporter` is a known MCP name that is then skipped.
+
+The plugins CLI installs every plugin it finds in the Neon plugin package. Today that is `neon-postgres`.
+
 ## Snapshots (`snapshots`)
 
 `neon snapshots` (alias `neon snapshot`) manages **snapshots** — point-in-time backups of a branch that you can list, rename, expire, restore into a branch, or schedule automatically. Snapshots are a Beta Neon feature and were previously only available in the Console and REST API; this command group brings them to the CLI.
@@ -1171,6 +1199,7 @@ Id   Name      Project         Created At            Last Used At          Last
 | bootstrap                                                                  |                                                                                                              | Scaffold a project from a template |
 | init                                                                       |                                                                                                              | Set up a project for a coding agent |
 | mcp                                                                        |                                                                                                              | Install the Neon MCP server         |
+| plugins                                                                    |                                                                                                              | Install the Neon plugin             |
 | skills                                                                     | `update`                                                                                                     | Install Neon agent skills           |
 | bucket                                                                     | `create`, `list`, `delete`, `object list`, `object get`, `object put`, `object delete` (incl. `--recursive`) | Manage buckets and their objects   |
 | [completion](https://neon.com/docs/reference/cli-completion)               |                                                                                                              | Generate a completion script       |

package/dist/analytics.js

@@ -1,5 +1,5 @@
 import { a as OAUTH, t as storeFor } from "./_chunks/credential_io-D2vw1UOw.js";
-import { getGithubEnvVars, isCi } from "./env.js";
+import { getCliAgent, getGithubEnvVars, isCi } from "./env.js";
 import { log } from "./log.js";
 import pkg_default from "./pkg.js";
 import { getApiClient, isNeonApiError } from "./api.js";
@@ -190,13 +190,15 @@ const trackEvent = (event, properties) => {
 };
 const getErrorAnalyticsEventContext = (_args) => ({
 	version: pkg_default.version,
-	ci: isCi()
+	ci: isCi(),
+	agent: getCliAgent(process.env)
 });
 const getAnalyticsEventProperties = (args) => ({
 	version: pkg_default.version,
 	command: args._.join(" "),
 	flags: { output: args.output },
 	ci: isCi(),
+	agent: getCliAgent(process.env),
 	githubEnvVars: getGithubEnvVars(process.env)
 });
 //#endregion

package/dist/commands/api_keys.js

@@ -265,16 +265,16 @@ const revoke = async (props) => {
 * scoped key — the endpoint that accepts `project_id` is org-only — so that case fails here
 * with the reason, rather than as a 404 from a URL the user never typed.
 */
-const orgIdForProject = async (client, projectId) => {
+const orgIdForProject = async (client, projectId, usage = "api-keys") => {
 	let orgId;
 	try {
 		const { data: { project } } = await client.getProject(projectId);
 		orgId = project.org_id;
 	} catch (err) {
-		if (isNeonApiError(err) && err.status === 404) throw new Error(projectId.startsWith("org-") ? `Project ${projectId} not found. That looks like an organization id. Pass it as --org-id instead.` : `Project ${projectId} not found. Check the id with \`neon projects list\`.`);
+		if (isNeonApiError(err) && err.status === 404) throw new Error(projectId.startsWith("org-") ? usage === "mcp" ? `Project ${projectId} not found. That looks like an organization id. neon mcp takes a project id on --project-id.` : `Project ${projectId} not found. That looks like an organization id. Pass it as --org-id instead.` : `Project ${projectId} not found. Check the id with \`neon projects list\`.`);
 		throw err;
 	}
-	if (!orgId) throw new Error(`Project ${projectId} does not belong to an organization, so it cannot have a project-scoped API key. Omit --project-id to create an account key.`);
+	if (!orgId) throw new Error(usage === "mcp" ? `Project ${projectId} does not belong to an organization, so it cannot have a project-scoped API key. Pass --oauth to pin tools without minting, or omit --project-id to mint an account-wide key.` : `Project ${projectId} does not belong to an organization, so it cannot have a project-scoped API key. Omit --project-id to create an account key.`);
 	return orgId;
 };
 //#endregion

package/dist/commands/auth.js

@@ -6,7 +6,7 @@ import { log } from "../log.js";
 import { getApiClient } from "../api.js";
 import { o as isOwnedCredentialPath } from "../_chunks/paths-g3DRqJiD.js";
 import { setAuthContext } from "../auth_context.js";
-import { isConfigInit, isCurrentBranchProbe, isMcpCommand, isMcpOauth, isProfileCommand, isSkillsCommand } from "../context.js";
+import { isConfigInit, isCurrentBranchProbe, isMcpCommand, isMcpOauth, isPluginsCommand, isProfileCommand, isSkillsCommand } from "../context.js";
 import { extendTokenSet } from "../utils/auth.js";
 import { auth, refreshToken } from "../auth.js";
 import { i as selectCredential, n as displacedProfileWarning, t as credentialInputs } from "../_chunks/auth_selection-Bx2NAgkk.js";
@@ -217,7 +217,7 @@ const ensureAuth = async (props) => {
 	if (isProfileCommand(props)) return;
 	if (isMcpOauth(props)) return;
 	if (props._[0] === "open") return;
-	if (isSkillsCommand(props)) return;
+	if (isSkillsCommand(props) || isPluginsCommand(props)) return;
 	const isLocalDev = props._[0] === "dev";
 	const isBootstrap = props._[0] === "bootstrap";
 	const isInit = props._[0] === "init";

package/dist/commands/index.js

@@ -25,6 +25,7 @@ import { t as neon_auth_exports } from "./neon_auth.js";
 import { t as open_exports } from "./open.js";
 import { t as operations_exports } from "./operations.js";
 import { t as orgs_exports } from "./orgs.js";
+import { t as plugins_exports } from "./plugins.js";
 import { t as profile_exports } from "./profile.js";
 import { t as psql_exports } from "./psql.js";
 import { t as roles_exports } from "./roles.js";
@@ -61,6 +62,7 @@ var commands_default = [
 	open_exports,
 	init_exports,
 	mcp_exports,
+	plugins_exports,
 	skills_exports,
 	data_api_exports,
 	functions_exports,

package/dist/commands/mcp.js

@@ -5,7 +5,7 @@ import { getCliName } from "../utils/cli_name.js";
 import { writer } from "../writer.js";
 import { noPassthrough, single } from "../utils/flags.js";
 import { existingNeonApiKey, installNeonMcpServer, neonMcpUrl, parseMcpCategories, trackedProjectMcpConfig } from "../mcp/install.js";
-import { mintMcpApiKey, withdrawMintedKey } from "../mcp/mint.js";
+import { mintMcpApiKey, mintedKeyRevokeCommand, withdrawMintedKey } from "../mcp/mint.js";
 import { canPickAgentsInteractively } from "../utils/agent_picker.js";
 import { resolveInstallTargets } from "../mcp/targets.js";
 import { confirmMcpInstall } from "../mcp/wizard.js";
@@ -28,7 +28,7 @@ const builder = (argv) => argv.usage("$0 mcp [options]").options({
 	project: {
 		type: "boolean",
 		default: false,
-		describe: "Write project-level MCP config. Skips the config-location question. Does not change the minted key"
+		describe: "Write project-level MCP config. Skips the config-location question. A linked project-folder install may still pin a project and scope a newly minted key"
 	},
 	yes: {
 		alias: "y",
@@ -59,7 +59,7 @@ const builder = (argv) => argv.usage("$0 mcp [options]").options({
 	},
 	"project-id": {
 		type: "string",
-		describe: "Pin MCP tools to one Neon project (?projectId=). Does not change the minted key. Interactive asks only for a linked project-folder install",
+		describe: "Pin MCP tools to one Neon project (?projectId=). A newly minted API key is limited to that project. A linked project-folder install asks the same when you pick API-key auth",
 		coerce: single("project-id")
 	},
 	category: {
@@ -131,7 +131,8 @@ const handler = async (props) => {
 			skipped,
 			auth: plan.auth,
 			reuse: existing !== void 0,
-			url
+			url,
+			mintProjectId: plan.urlProjectId
 		})) {
 			log.info("Aborted. Nothing was written.");
 			return;
@@ -146,13 +147,18 @@ const handler = async (props) => {
 			apiKey: existing
 		};
 		log.info("Reusing the API key already configured for the Neon MCP server.");
+		if (plan.urlProjectId) log.warning("That key keeps its existing scope. Remove the Neon MCP entry to mint a project-scoped key, or pass --oauth to pin tools without a key.");
 	} else {
-		minted = await mintMcpApiKey({ apiClient: props.apiClient });
+		minted = await mintMcpApiKey({
+			apiClient: props.apiClient,
+			projectId: plan.urlProjectId
+		});
 		auth = {
 			kind: "api-key",
 			apiKey: minted.key
 		};
-		log.warning("This key reaches everything your account can, in every organization.");
+		if (minted.projectId) log.info("Limited to %s: it cannot create projects, mint API keys, or read any other project. It can still change and delete everything inside that project.", minted.projectId);
+		else log.warning("This key reaches everything your account can, in every organization.");
 	}
 	const rows = [];
 	let successes = 0;
@@ -189,7 +195,7 @@ const handler = async (props) => {
 	if (successes === 0) {
 		if (minted && props.apiClient) {
 			const withdrawn = await withdrawMintedKey(props.apiClient, minted);
-			throw new Error(withdrawn ? "Failed to write Neon MCP config to any agent. The minted API key has been revoked." : `Failed to write Neon MCP config to any agent. The minted API key could NOT be revoked. Remove it with \`${getCliName()} api-keys revoke ${minted.id}\`.`);
+			throw new Error(withdrawn ? "Failed to write Neon MCP config to any agent. The minted API key has been revoked." : `Failed to write Neon MCP config to any agent. The minted API key could NOT be revoked. Remove it with \`${mintedKeyRevokeCommand(minted)}\`.`);
 		}
 		throw new Error("Failed to write Neon MCP config to any agent.");
 	}
@@ -204,7 +210,7 @@ const handler = async (props) => {
 		title: "MCP"
 	});
 	out.end();
-	if (minted) log.info("Minted API key %s (id %d, account). Revoke with: %s", minted.name, minted.id, `${getCliName()} api-keys revoke ${minted.id}`);
+	if (minted) log.info("Minted API key %s (id %d, %s). Revoke with: %s", minted.name, minted.id, minted.projectId ? "project" : "account", mintedKeyRevokeCommand(minted));
 	if (plan.auth === "oauth") log.info("The agent will prompt for Neon sign-in on first use.");
 	if (failedAgents.length > 0) throw new Error(`Failed to write Neon MCP config for: ${failedAgents.join(", ")}.`);
 };

package/dist/commands/plugins.js

@@ -0,0 +1,135 @@
+import { t as __exportAll } from "../_chunks/rolldown-runtime-8H4AJuhK.js";
+import { log } from "../log.js";
+import { writer } from "../writer.js";
+import { noPassthrough } from "../utils/flags.js";
+import { getAgentDisplayName } from "../mcp/agents.js";
+import "../init/agents.js";
+import { canPickAgentsInteractively } from "../utils/agent_picker.js";
+import { resolvePluginsPlan } from "../plugins/plan.js";
+import { NEON_PLUGIN_NAME, neonPluginsRetryCommand, pluginsAddArgs, runPluginsCli } from "../plugins/run.js";
+import { confirmPluginsInstall } from "../plugins/wizard.js";
+//#region src/commands/plugins.ts
+var plugins_exports = /* @__PURE__ */ __exportAll({
+	builder: () => builder,
+	command: () => command,
+	describe: () => describe,
+	handler: () => handler
+});
+const scopeLabel = (scope) => scope === "project" ? "project" : "user";
+const coerceAgents = (value) => {
+	if (value === void 0) return [];
+	const list = Array.isArray(value) ? value : [value];
+	if (list.length === 0) throw new Error("--agent needs a value. Pass one, or omit the flag entirely.");
+	return list.map((item) => {
+		if (typeof item !== "string" || item.trim() === "") throw new Error("--agent needs a value. Pass one, or omit the flag entirely.");
+		return item;
+	});
+};
+const command = "plugins";
+const describe = "Install the Neon plugin into coding agents";
+const builder = (argv) => argv.usage("$0 plugins [options]").options({
+	yes: {
+		alias: "y",
+		type: "boolean",
+		default: false,
+		describe: "Skip prompts"
+	},
+	global: {
+		type: "boolean",
+		default: false,
+		describe: "Install user-level. Default is project"
+	},
+	agent: {
+		alias: "a",
+		type: "array",
+		string: true,
+		describe: "Coding agent to install into (repeatable). Skips the agent picker",
+		coerce: coerceAgents
+	}
+}).example("$0 plugins", "Interactive: agents, then confirm").example("$0 plugins -y", "Detected agents, skip prompts").example("$0 plugins --agent cursor --agent claude-code", "Install into specific agents").example("$0 plugins --global", "Install user-level").strict().check(noPassthrough("plugins"));
+const handler = async (props) => {
+	const cwd = process.cwd();
+	const yes = props.yes === true;
+	const interactive = canPickAgentsInteractively() && !yes;
+	const plan = await resolvePluginsPlan({
+		global: props.global === true,
+		agents: props.agent ?? [],
+		yes,
+		cwd,
+		interactive
+	});
+	for (const agent of plan.skipped) log.warning("Skipping %s: no plugins mapping.", getAgentDisplayName(agent));
+	for (const agent of plan.userScopeSkipped) log.warning("Skipping %s: plugins are user-level. Pass --global.", getAgentDisplayName(agent));
+	if (interactive) {
+		if (!await confirmPluginsInstall({
+			scope: plan.scope,
+			agents: plan.agents
+		})) {
+			log.info("Aborted. Nothing was written.");
+			return;
+		}
+	}
+	const rows = [];
+	const failed = [];
+	const scope = scopeLabel(plan.scope);
+	for (const mapped of plan.targets) {
+		const args = pluginsAddArgs({
+			target: mapped.target,
+			global: plan.scope === "global"
+		});
+		const agent = mapped.agents.join(", ");
+		try {
+			await runPluginsCli({
+				args,
+				cwd
+			});
+			rows.push({
+				scope,
+				plugin: NEON_PLUGIN_NAME,
+				agent,
+				status: "installed"
+			});
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			rows.push({
+				scope,
+				plugin: NEON_PLUGIN_NAME,
+				agent,
+				status: "failed",
+				error: "plugins CLI failed"
+			});
+			failed.push({
+				agents: mapped.agents,
+				message
+			});
+		}
+	}
+	const out = writer(props);
+	out.write(rows, {
+		fields: [
+			"scope",
+			"plugin",
+			"agent",
+			"status",
+			"error"
+		],
+		title: "Plugins"
+	});
+	out.end();
+	if (failed.length === 0) {
+		log.info(plan.scope === "project" ? "Installed the Neon plugin (project)." : "Installed the Neon plugin (user).");
+		return;
+	}
+	const first = failed[0];
+	if (first === void 0) throw new Error("Failed to install the Neon plugin.");
+	const retry = neonPluginsRetryCommand({
+		agents: failed.flatMap((row) => row.agents),
+		global: plan.scope === "global"
+	});
+	if (first.message.includes("needs npx (Node.js)")) throw new Error(first.message);
+	const detail = failed.map((row) => row.message).join("\n");
+	if (failed.length === rows.length) throw new Error(`${detail}\nRetry with: ${retry}`);
+	throw new Error(`Failed to install the Neon plugin for: ${failed.flatMap((row) => row.agents).join(", ")}.\n${detail}\nRetry with: ${retry}`);
+};
+//#endregion
+export { builder, command, describe, handler, plugins_exports as t };

package/dist/context.js

@@ -52,6 +52,7 @@ const isProfileCommand = (args) => args._[0] === "profile" || args._[0] === "pro
 const isApiKeysCommand = (args) => args._[0] === "api-keys" || args._[0] === "api-key";
 const isMcpCommand = (args) => args._[0] === "mcp";
 const isSkillsCommand = (args) => args._[0] === "skills";
+const isPluginsCommand = (args) => args._[0] === "plugins";
 /** Raw argv is required because auth middleware runs before MCP flags are parsed. */
 const isMcpOauth = (args) => isMcpCommand(args) && argvEnablesMcpOauth(process.argv);
 const OAUTH_FALSE = /* @__PURE__ */ new Set([
@@ -131,7 +132,7 @@ const enrichFromContext = (args) => {
 	if (isApiKeysCommand(args)) return;
 	if (isProfileCommand(args)) return;
 	if (isMcpCommand(args)) return;
-	if (isSkillsCommand(args)) return;
+	if (isSkillsCommand(args) || isPluginsCommand(args)) return;
 	const context = readContextFile(args.contextFile);
 	if (!args.orgId) args.orgId = context.orgId;
 	if (!args.projectId) args.projectId = context.projectId;
@@ -237,4 +238,4 @@ const globToRegExp = (pattern) => {
 	return new RegExp(`^${source}$`);
 };
 //#endregion
-export { applyContext, contextBranch, currentContextFile, enrichFromContext, ensureGitignored, isApiKeysCommand, isConfigInit, isCurrentBranchProbe, isMcpCommand, isMcpOauth, isProfileCommand, isSkillsCommand, readContextFile, setContext, updateContextFile, walkContextFile };
+export { applyContext, contextBranch, currentContextFile, enrichFromContext, ensureGitignored, isApiKeysCommand, isConfigInit, isCurrentBranchProbe, isMcpCommand, isMcpOauth, isPluginsCommand, isProfileCommand, isSkillsCommand, readContextFile, setContext, updateContextFile, walkContextFile };

package/dist/env.js

@@ -5,6 +5,11 @@ const isCi = () => {
 const isDebug = () => {
 	return Boolean(process.env.DEBUG);
 };
+const getCliAgent = (env) => {
+	const claudeCode = env.CLAUDE_CODE_CHILD_SESSION === "1";
+	if (claudeCode === (env.CODEX_CI === "1" && (Boolean(env.CODEX_THREAD_ID?.trim()) || Boolean(env.CODEX_SESSION_ID?.trim())))) return void 0;
+	return claudeCode ? "claude-code" : "codex";
+};
 const getGithubEnvVars = (env) => {
 	const vars = [
 		"GITHUB_ACTION_PATH",
@@ -27,4 +32,4 @@ const getGithubEnvVars = (env) => {
 	return Object.fromEntries(map);
 };
 //#endregion
-export { getGithubEnvVars, isCi, isDebug };
+export { getCliAgent, getGithubEnvVars, isCi, isDebug };

package/dist/index.js

@@ -30,6 +30,7 @@ const NO_SUBCOMMANDS_VERBS = [
 	"open",
 	"init",
 	"mcp",
+	"plugins",
 	"skills",
 	"dev",
 	"deploy",

package/dist/mcp/mint.js

@@ -1,24 +1,32 @@
 import { log } from "../log.js";
 import { isNeonApiError } from "../api.js";
 import { getCliName } from "../utils/cli_name.js";
+import { orgIdForProject } from "../commands/api_keys.js";
 import { mintedKeyName } from "../profile_keys.js";
 //#region src/mcp/mint.ts
 const cannotMintMessage = "This CLI credential cannot mint API keys. Organization and project-scoped keys cannot create other keys. Sign in with `neon auth` or pass a personal API key.";
-const withdraw = async (client, keyId) => {
+function mintedKeyRevokeCommand(key) {
+	return key.orgId ? `${getCliName()} api-keys revoke ${key.id} --org-id ${key.orgId}` : `${getCliName()} api-keys revoke ${key.id}`;
+}
+const withdraw = async (client, keyId, orgId) => {
 	if (!Number.isSafeInteger(keyId) || keyId === void 0 || keyId <= 0) return false;
 	try {
-		const { data } = await client.revokeApiKey(keyId);
+		const { data } = orgId ? await client.revokeOrgApiKey(orgId, keyId) : await client.revokeApiKey(keyId);
 		return data.revoked === true && data.id === keyId;
 	} catch (err) {
 		log.error("Failed to revoke API key %d: %s", keyId, err instanceof Error ? err.message : String(err));
 		return false;
 	}
 };
-const assertUsable = async (client, data, fallbackName) => {
-	const problem = typeof data.key !== "string" || data.key.trim() === "" ? "Neon returned no key." : data.project_id !== void 0 ? `Neon returned a key scoped to ${data.project_id} rather than the whole account.` : !Number.isSafeInteger(data.id) ? "Neon returned no key id." : null;
+const assertUsable = async (client, data, fallbackName, scope) => {
+	const wanted = scope.projectId;
+	const problem = typeof data.key !== "string" || data.key.trim() === "" ? "Neon returned no key." : data.project_id !== wanted ? wanted === void 0 ? `Neon returned a key scoped to ${data.project_id} rather than the whole account.` : `Neon returned a key scoped to ${data.project_id ?? "nothing"} rather than ${wanted}.` : !Number.isSafeInteger(data.id) ? "Neon returned no key id." : null;
 	if (problem) {
-		const withdrawn = await withdraw(client, data.id);
-		throw new Error(`${problem} ${withdrawn ? "The key has been revoked; nothing was issued." : `The key could NOT be revoked and may still be live${data.id === void 0 ? "" : `. Remove it with \`${getCliName()} api-keys revoke ${data.id}\``}.`}`);
+		const withdrawn = await withdraw(client, data.id, scope.orgId);
+		throw new Error(`${problem} ${withdrawn ? "The key has been revoked; nothing was issued." : `The key could NOT be revoked and may still be live${data.id === void 0 ? "" : `. Remove it with \`${mintedKeyRevokeCommand({
+			id: data.id,
+			orgId: scope.orgId
+		})}\``}.`}`);
 	}
 	const id = data.id;
 	const key = data.key;
@@ -26,21 +34,37 @@ const assertUsable = async (client, data, fallbackName) => {
 	return {
 		id,
 		name: data.name ?? fallbackName,
-		key
+		key,
+		orgId: scope.orgId,
+		projectId: scope.projectId
 	};
 };
-async function mintMcpApiKey(options) {
-	const name = mintedKeyName("mcp");
+const createAndAssert = async (client, create, name, scope) => {
 	try {
-		const { data } = await options.apiClient.createApiKey({ key_name: name });
-		return assertUsable(options.apiClient, data, name);
+		const { data } = await create();
+		return assertUsable(client, data, name, scope);
 	} catch (err) {
 		if (isNeonApiError(err) && (err.status === 403 || err.status === 404)) throw new Error(cannotMintMessage);
 		throw err;
 	}
+};
+async function mintMcpApiKey(options) {
+	const name = mintedKeyName("mcp");
+	const projectId = options.projectId;
+	if (projectId !== void 0) {
+		const orgId = await orgIdForProject(options.apiClient, projectId, "mcp");
+		return createAndAssert(options.apiClient, () => options.apiClient.createOrgApiKey(orgId, {
+			key_name: name,
+			project_id: projectId
+		}), name, {
+			orgId,
+			projectId
+		});
+	}
+	return createAndAssert(options.apiClient, () => options.apiClient.createApiKey({ key_name: name }), name, {});
 }
 async function withdrawMintedKey(apiClient, key) {
-	return withdraw(apiClient, key.id);
+	return withdraw(apiClient, key.id, key.orgId);
 }
 //#endregion
-export { mintMcpApiKey, withdrawMintedKey };
+export { mintMcpApiKey, mintedKeyRevokeCommand, withdrawMintedKey };

package/dist/mcp/plan.js

@@ -28,7 +28,7 @@ async function resolveMcpPlan(options) {
 	const auth = options.oauth ? "oauth" : prompt ? await (options.pickAuth ?? pickMcpAuth)() : "api-key";
 	let urlProjectId = options.projectId;
 	if (urlProjectId === void 0 && prompt && scope === "project" && options.linkedProjectId) {
-		if (await (options.pickProjectPin ?? pickMcpProjectPin)(options.linkedProjectId)) urlProjectId = options.linkedProjectId;
+		if (await (options.pickProjectPin ?? pickMcpProjectPin)(options.linkedProjectId, auth === "api-key")) urlProjectId = options.linkedProjectId;
 	}
 	return {
 		scope,

package/dist/mcp/wizard.js

@@ -51,20 +51,20 @@ const pickMcpAuth = async () => {
 	if (auth !== "api-key" && auth !== "oauth") throw new Error("Aborted.");
 	return auth;
 };
-const pickMcpProjectPin = async (linkedProjectId) => {
+const pickMcpProjectPin = async (linkedProjectId, willMintKey = false) => {
 	if (!canPickAgentsInteractively()) return false;
 	const { pin } = await prompts({
 		onState: restoreCursorOnAbort,
 		type: "confirm",
 		name: "pin",
-		message: `Pin MCP tools to the linked project ${linkedProjectId}?`,
+		message: willMintKey ? `Pin MCP tools to the linked project ${linkedProjectId}? A newly minted API key would be limited to that project.` : `Pin MCP tools to the linked project ${linkedProjectId}?`,
 		initial: true
 	});
 	return pin === true;
 };
 const mcpInstallSummary = (options) => {
 	const agents = options.install.map(getAgentDisplayName).join(", ");
-	const auth = options.auth === "oauth" ? "OAuth, agent signs in on first use" : options.reuse ? "reuse the API key already in agent config" : "mint an account-wide API key that reaches every organization";
+	const auth = options.auth === "oauth" ? "OAuth, agent signs in on first use" : options.reuse ? "reuse the API key already in agent config" : options.mintProjectId ? `mint an API key limited to ${options.mintProjectId}` : "mint an account-wide API key that reaches every organization";
 	const rows = [
 		["Config", options.scope === "project" ? "this directory" : "user-level"],
 		["Agents", agents],

package/dist/plugins/plan.js

@@ -0,0 +1,69 @@
+import { getAgentDisplayName, tryResolveAddMcpAgentId } from "../mcp/agents.js";
+import "../init/agents.js";
+import { agentChoicesFrom, pickAgentsInteractively, resolveAgentSelection } from "../utils/agent_picker.js";
+import { detectPluginsAgents, getPluginsTargetName, isUserScopeOnlyPluginsTarget, mappedPluginsTargets, pluginsInstallableAgents } from "./targets.js";
+//#region src/plugins/plan.ts
+const assertPluginsCanRun = (options) => {
+	if (options.yes || options.interactive || options.hasAgents) return;
+	throw new Error("No interactive terminal. Pass -y to install into detected agents, or --agent <name>.");
+};
+async function resolvePluginsPlan(options) {
+	assertPluginsCanRun({
+		yes: options.yes,
+		interactive: options.interactive,
+		hasAgents: options.agents.length > 0
+	});
+	const prompt = options.interactive && !options.yes;
+	const scope = options.global ? "global" : "project";
+	const available = pluginsInstallableAgents(scope);
+	const detected = await detectPluginsAgents({
+		scope,
+		cwd: options.cwd
+	});
+	const selected = await resolveAgentSelection({
+		specified: options.agents,
+		choices: agentChoicesFrom(available, detected),
+		detected,
+		message: "Which coding agents should get the Neon plugin? (space to toggle, enter to confirm)",
+		nonInteractiveMessage: scope === "project" ? `No coding agents detected in this project. Pass --agent <name>. Supported agents: ${available.join(", ")}` : `No coding agents detected. Pass --agent <name>. Supported agents: ${available.join(", ")}`,
+		resolveSpecified: (raw) => {
+			if (raw === "*") throw new Error("neon plugins does not accept --agent *. Pass --agent <name> for each coding agent, or omit --agent to use detected agents.");
+			const id = tryResolveAddMcpAgentId(raw);
+			if (!id) throw new Error(`Unknown agent: "${raw}". Supported agents: ${available.join(", ")}`);
+			return id;
+		},
+		pick: prompt ? options.pickAgents ?? pickAgentsInteractively : void 0,
+		interactive: prompt
+	});
+	const agents = [];
+	const skipped = [];
+	const userScopeSkipped = [];
+	for (const id of selected) {
+		const target = getPluginsTargetName(id);
+		if (target === void 0) {
+			skipped.push(id);
+			continue;
+		}
+		if (scope === "project" && isUserScopeOnlyPluginsTarget(target)) {
+			userScopeSkipped.push(id);
+			continue;
+		}
+		agents.push(id);
+	}
+	if (agents.length === 0) {
+		if (userScopeSkipped.length > 0 && skipped.length === 0) {
+			const names = userScopeSkipped.map((id) => getAgentDisplayName(id)).join(", ");
+			throw new Error(`${names}: plugins are user-level. Pass --global. Without --global: ${pluginsInstallableAgents("project").join(", ")}`);
+		}
+		throw new Error(`None of the selected agents can install plugins. Supported agents: ${available.join(", ")}`);
+	}
+	return {
+		scope,
+		agents,
+		skipped,
+		userScopeSkipped,
+		targets: mappedPluginsTargets(agents, scope)
+	};
+}
+//#endregion
+export { assertPluginsCanRun, resolvePluginsPlan };

package/dist/plugins/run.js

@@ -0,0 +1,123 @@
+import { spawnSync } from "node:child_process";
+import { execa } from "execa";
+//#region src/plugins/run.ts
+const TELEMETRY_BLOCKERS = ["DISABLE_TELEMETRY", "DO_NOT_TRACK"];
+const PLUGIN_SOURCE = "neondatabase/agent-skills";
+const NEON_PLUGIN_NAME = "neon-postgres";
+const PLUGINS_CLI_TIMEOUT_MS = 12e4;
+const pluginsChildEnv = (base = process.env) => {
+	const env = { ...base };
+	for (const key of TELEMETRY_BLOCKERS) delete env[key];
+	for (const key of Object.keys(env)) if (key.toUpperCase() === "NEON_API_KEY") delete env[key];
+	return env;
+};
+const pluginsScopeFlag = (global) => global ? "user" : "project";
+const pluginsAddArgs = (options) => {
+	if (options.target.length === 0) throw new Error("plugins add needs a -t target.");
+	return [
+		"-y",
+		"plugins",
+		"add",
+		PLUGIN_SOURCE,
+		"-t",
+		options.target,
+		"-s",
+		pluginsScopeFlag(options.global),
+		"-y"
+	];
+};
+const neonPluginsRetryCommand = (options) => {
+	const args = ["plugins"];
+	for (const agent of options.agents) args.push("--agent", agent);
+	if (options.global) args.push("--global");
+	args.push("-y");
+	return `neon ${args.map(quoteNpxArg).join(" ")}`;
+};
+const quoteNpxArg = (part) => /[\s"'\\*]/.test(part) ? `'${part.replace(/'/g, `'\\''`)}'` : part;
+const runPluginsCli = async (options) => {
+	const timeoutMs = options.timeoutMs ?? 12e4;
+	const subprocess = execa("npx", options.args, {
+		cwd: options.cwd,
+		env: pluginsChildEnv(options.env ?? process.env),
+		extendEnv: false,
+		stdio: "pipe",
+		detached: true
+	});
+	let timedOut = false;
+	let stopped = false;
+	const stop = () => {
+		if (stopped) return;
+		stopped = true;
+		if (subprocess.pid !== void 0) killProcessTree(subprocess.pid);
+	};
+	const onSigint = () => {
+		stop();
+		process.exit(130);
+	};
+	const onSigterm = () => {
+		stop();
+		process.exit(143);
+	};
+	process.once("SIGINT", onSigint);
+	process.once("SIGTERM", onSigterm);
+	process.once("exit", stop);
+	const timer = setTimeout(() => {
+		timedOut = true;
+		stop();
+	}, timeoutMs);
+	try {
+		const result = await subprocess;
+		return {
+			stdout: result.stdout,
+			stderr: result.stderr
+		};
+	} catch (error) {
+		if (isCommandMissing(error)) throw new Error("neon plugins needs npx (Node.js) to run the plugins CLI. Install Node.js, then retry.");
+		if (isExecaFailure(error)) throw new Error(pluginsCliFailureMessage({
+			stderr: typeof error.stderr === "string" ? error.stderr : "",
+			stdout: typeof error.stdout === "string" ? error.stdout : "",
+			timedOut,
+			timeoutMs
+		}));
+		throw error;
+	} finally {
+		clearTimeout(timer);
+		process.removeListener("SIGINT", onSigint);
+		process.removeListener("SIGTERM", onSigterm);
+		process.removeListener("exit", stop);
+	}
+};
+const pluginsCliFailureMessage = (error) => {
+	const childOut = [error.stderr, error.stdout].filter((part) => typeof part === "string" && part.length > 0).join("\n");
+	if (error.timedOut === true) {
+		const seconds = Math.max(1, Math.ceil((error.timeoutMs ?? 12e4) / 1e3));
+		const headline = `plugins CLI timed out after ${seconds} ${seconds === 1 ? "second" : "seconds"}`;
+		return childOut.length > 0 ? `${headline}:\n${childOut}` : `${headline}.`;
+	}
+	if (childOut.length > 0) return `plugins CLI failed:\n${childOut}`;
+	return "plugins CLI failed.";
+};
+const killProcessTree = (pid) => {
+	if (process.platform === "win32") {
+		spawnSync("taskkill", [
+			"/pid",
+			String(pid),
+			"/T",
+			"/F"
+		], { stdio: "ignore" });
+		return;
+	}
+	try {
+		process.kill(-pid, "SIGKILL");
+	} catch {
+		try {
+			process.kill(pid, "SIGKILL");
+		} catch {
+			return;
+		}
+	}
+};
+const isCommandMissing = (error) => typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+const isExecaFailure = (error) => typeof error === "object" && error !== null && "shortMessage" in error && typeof error.shortMessage === "string";
+//#endregion
+export { NEON_PLUGIN_NAME, PLUGINS_CLI_TIMEOUT_MS, PLUGIN_SOURCE, neonPluginsRetryCommand, pluginsAddArgs, pluginsChildEnv, pluginsCliFailureMessage, pluginsScopeFlag, quoteNpxArg, runPluginsCli };

package/dist/plugins/targets.js

@@ -0,0 +1,64 @@
+import { detectInstalledAgents, listMcpAgentIds, tryResolveAddMcpAgentId, uniqueAgentIds } from "../mcp/agents.js";
+import "../init/agents.js";
+import { detectProjectAgents } from "add-mcp";
+//#region src/plugins/targets.ts
+const PLUGINS_TARGET_BY_TYPE = {
+	cursor: "cursor",
+	vscode: "vscode",
+	"claude-code": "claude-code",
+	"claude-desktop": "claude-code",
+	codex: "codex",
+	"github-copilot-cli": "github-copilot",
+	"grok-build": "grok"
+};
+const USER_SCOPE_ONLY_TARGETS = /* @__PURE__ */ new Set([
+	"vscode",
+	"github-copilot",
+	"grok"
+]);
+function getPluginsTargetName(agent) {
+	if (Object.prototype.hasOwnProperty.call(PLUGINS_TARGET_BY_TYPE, agent)) return PLUGINS_TARGET_BY_TYPE[agent];
+	const id = tryResolveAddMcpAgentId(agent);
+	if (!id) return void 0;
+	return PLUGINS_TARGET_BY_TYPE[id];
+}
+function supportsPlugins(agent) {
+	return getPluginsTargetName(agent) !== void 0;
+}
+function isUserScopeOnlyPluginsTarget(target) {
+	return USER_SCOPE_ONLY_TARGETS.has(target);
+}
+const pluginsMappedAgents = () => listMcpAgentIds().filter((id) => supportsPlugins(id));
+const pluginsInstallableAgents = (scope) => pluginsMappedAgents().filter((id) => {
+	if (scope === "global") return true;
+	const target = getPluginsTargetName(id);
+	return target !== void 0 && !isUserScopeOnlyPluginsTarget(target);
+});
+const detectPluginsAgents = async (options) => {
+	const detected = options.scope === "project" ? detectProjectAgents(options.cwd) : await detectInstalledAgents();
+	return uniqueAgentIds(detected).filter((id) => supportsPlugins(id));
+};
+const mappedPluginsTargets = (agents, scope) => {
+	const mapped = [];
+	const byTarget = /* @__PURE__ */ new Map();
+	for (const agent of agents) {
+		const target = getPluginsTargetName(agent);
+		if (target === void 0) continue;
+		if (scope === "project" && isUserScopeOnlyPluginsTarget(target)) continue;
+		const existing = byTarget.get(target);
+		if (existing !== void 0) {
+			if (!existing.agents.includes(agent)) existing.agents.push(agent);
+			continue;
+		}
+		const row = {
+			agents: [agent],
+			target
+		};
+		byTarget.set(target, row);
+		mapped.push(row);
+	}
+	if (mapped.length === 0) throw new Error(`None of the selected agents can install plugins. Supported agents: ${pluginsInstallableAgents(scope).join(", ")}`);
+	return mapped;
+};
+//#endregion
+export { detectPluginsAgents, getPluginsTargetName, isUserScopeOnlyPluginsTarget, mappedPluginsTargets, pluginsInstallableAgents, pluginsMappedAgents, supportsPlugins };

package/dist/plugins/wizard.js

@@ -0,0 +1,36 @@
+import { getAgentDisplayName } from "../mcp/agents.js";
+import "../init/agents.js";
+import { canPickAgentsInteractively } from "../utils/agent_picker.js";
+import { NEON_PLUGIN_NAME } from "./run.js";
+import prompts from "prompts";
+//#region src/plugins/wizard.ts
+const restoreCursorOnAbort = (state) => {
+	if (state.aborted) {
+		process.stdout.write("\x1B[?25h");
+		process.stdout.write("\n");
+		process.exit(1);
+	}
+};
+const pluginsInstallSummary = (options) => {
+	const rows = [
+		["Scope", options.scope === "project" ? "project" : "user"],
+		["Agents", options.agents.map(getAgentDisplayName).join(", ")],
+		["Plugin", NEON_PLUGIN_NAME]
+	];
+	const labelWidth = Math.max(...rows.map(([label]) => label.length));
+	return rows.map(([label, value]) => `${label.padEnd(labelWidth)}  ${value}`).join("\n");
+};
+const confirmPluginsInstall = async (options) => {
+	if (!canPickAgentsInteractively()) return true;
+	process.stdout.write(`\n${pluginsInstallSummary(options)}\n\n`);
+	const { ok } = await prompts({
+		onState: restoreCursorOnAbort,
+		type: "confirm",
+		name: "ok",
+		message: "Install the Neon plugin into these agents?",
+		initial: true
+	});
+	return ok === true;
+};
+//#endregion
+export { confirmPluginsInstall, pluginsInstallSummary };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "4.3.0",
+  "version": "4.4.0",
   "description": "CLI tool for Neon, the cloud backend primitives built around Lakebase Postgres",
   "keywords": [
     "neon",
@@ -63,9 +63,9 @@
     "yaml": "^2.9.0",
     "yargs": "17.7.2",
     "yoctocolors": "^2.1.2",
-    "@neon/config": "1.0.2",
     "@neon/config-runtime": "1.0.2",
-    "@neon/sdk": "2.2.0"
+    "@neon/sdk": "2.2.0",
+    "@neon/config": "1.0.2"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "1.3.0",