pi-mcp-adapter 2.3.4 → 2.4.0

package/CHANGELOG.md

@@ -7,6 +7,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.4.0] - 2026-04-13
+
+### Added
+- `settings.disableProxyTool` to hide the `mcp` proxy tool once configured direct tools are fully available from cache. Thanks @tanavamsikrishna for PR #41.
+- Per-server `excludeTools` to hide specific MCP tools/resources by original or prefixed name across direct tools, proxy discovery, and the `/mcp` panel. Thanks @ahmadaccino for issue #36.
+- `settings.autoAuth` to optionally trigger OAuth automatically from proxy/direct tool usage, then rerun the original blocked connect/tool operation once after authentication succeeds. Thanks @unimonkiez for issue #34.
+
+### Fixed
+- Regenerated `package-lock.json` so the root lockfile metadata matches `package.json` again, including the declared `open`, `@types/bun`, `@types/open`, and `tsx` entries.
+- Kept the `mcp` proxy tool available as a first-session fallback when configured direct tools are still missing cache metadata, avoiding no-tool startup gaps.
+
+## [2.3.5] - 2026-04-13
+
+### Fixed
+- Session lifecycle now always tears down OAuth callback state on restart and shutdown, preventing callback-server leaks across session transitions.
+- OAuth callback server now calls `unref()` after successful bind so it no longer keeps sub-agent processes alive by itself.
+- Strict OAuth port mode now rebinds to the configured callback port when safe, while refusing to switch ports when authorizations are still pending.
+- Added focused lifecycle/callback-server regression coverage for teardown, `unref()`, strict rebinding, and pending-auth guardrails.
+- Thanks @blai for the investigation and PR #43 that surfaced the sub-agent hang/root lifecycle issues.
+
 ## [2.3.4] - 2026-04-12
 
 ### Fixed

package/README.md

@@ -91,6 +91,7 @@ Two calls instead of 26 tools cluttering the context.
 | `idleTimeout` | Minutes before idle disconnect (overrides global) |
 | `exposeResources` | Expose MCP resources as tools (default: true) |
 | `directTools` | `true`, `string[]`, or `false` — register tools individually instead of through proxy |
+| `excludeTools` | `string[]` of tool names to hide (matches original names like `get_screenshot` and prefixed names like `figma_get_screenshot`) |
 | `debug` | Show server stderr (default: false) |
 
 ### Lifecycle Modes
@@ -116,6 +117,8 @@ Two calls instead of 26 tools cluttering the context.
 | `toolPrefix` | `"server"` (default), `"short"` (strips `-mcp` suffix), or `"none"` |
 | `idleTimeout` | Global idle timeout in minutes (default: 10, 0 to disable) |
 | `directTools` | Global default for all servers (default: false). Per-server overrides this. |
+| `disableProxyTool` | Hide the `mcp` proxy tool once configured direct tools are fully available from cache. |
+| `autoAuth` | Auto-run OAuth on `connect`/tool calls when a server needs auth, then retry once (default: false). |
 
 Per-server `idleTimeout` overrides the global setting.
 
@@ -169,6 +172,22 @@ To set a global default for all servers:
 
 Per-server `directTools` overrides the global setting. The example above registers direct tools for every server except `huge-server`.
 
+To exclude specific tools while still using `directTools: true`, add `excludeTools` on the server:
+
+```json
+{
+  "mcpServers": {
+    "figma": {
+      "url": "http://localhost:3845/mcp",
+      "directTools": true,
+      "excludeTools": ["get_figjam", "figma_get_code_connect_map"]
+    }
+  }
+}
+```
+
+`excludeTools` filters direct tools, proxy search/list/describe, and the `/mcp` panel view.
+
 Each direct tool costs ~150-300 tokens in the system prompt (name + description + schema). Good for targeted sets of 5-20 tools. For servers with 75+ tools, stick with the proxy or pick specific tools with a `string[]`.
 
 Direct tools register from the metadata cache (`~/.pi/agent/mcp-cache.json`), so no server connections are needed at startup. On the first session after adding `directTools` to a new server, the cache won't exist yet — tools fall back to proxy-only and the cache populates in the background. Restart Pi and they'll be available. To force it: `/mcp reconnect <server>` then restart.
@@ -279,6 +298,8 @@ Tool names are fuzzy-matched on hyphens and underscores — `context7_resolve_li
 | `/mcp reconnect <server>` | Connect or reconnect a single server |
 | `/mcp-auth <server>` | OAuth setup |
 
+If `settings.autoAuth` is `true`, `mcp({ connect: ... })`, `mcp({ tool: ... })`, and direct tool calls will automatically run OAuth when needed and retry once. In non-interactive sessions, browser-based OAuth still requires running `/mcp-auth <server>` manually.
+
 ## How It Works
 
 - One `mcp` tool in context (~200 tokens) instead of hundreds

package/direct-tools.ts

@@ -7,11 +7,50 @@ import { isServerCacheValid } from "./metadata-cache.js";
 import { formatSchema } from "./tool-metadata.js";
 import { transformMcpContent } from "./tool-registrar.js";
 import { maybeStartUiSession, type UiSessionRuntime } from "./ui-session.js";
-import { formatToolName } from "./types.js";
+import { formatToolName, isToolExcluded } from "./types.js";
 import { resourceNameToToolName } from "./resource-tools.js";
+import { authenticate, supportsOAuth } from "./mcp-auth-flow.js";
 
 const BUILTIN_NAMES = new Set(["read", "bash", "edit", "write", "grep", "find", "ls", "mcp"]);
 
+type DirectAutoAuthResult =
+  | { status: "skipped" }
+  | { status: "success" }
+  | { status: "failed"; message: string };
+
+async function attemptDirectAutoAuth(
+  state: McpExtensionState,
+  serverName: string,
+): Promise<DirectAutoAuthResult> {
+  if (state.config.settings?.autoAuth !== true) {
+    return { status: "skipped" };
+  }
+
+  const definition = state.config.mcpServers[serverName];
+  if (!definition || !supportsOAuth(definition) || !definition.url) {
+    return { status: "skipped" };
+  }
+
+  const grantType = definition.oauth?.grantType ?? "authorization_code";
+  if (!state.ui && grantType !== "client_credentials") {
+    return {
+      status: "failed",
+      message: `MCP server "${serverName}" requires OAuth authentication. Run /mcp-auth ${serverName} in an interactive session.`,
+    };
+  }
+
+  try {
+    await authenticate(serverName, definition.url, definition);
+    return { status: "success" };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+      status: "failed",
+      message: `OAuth authentication failed for "${serverName}": ${message}. Run /mcp-auth ${serverName} first.`,
+    };
+  }
+}
+
 export function resolveDirectTools(
   config: McpConfig,
   cache: MetadataCache | null,
@@ -68,6 +107,7 @@ export function resolveDirectTools(
 
     for (const tool of serverCache.tools ?? []) {
       if (toolFilter !== true && !toolFilter.includes(tool.name)) continue;
+      if (isToolExcluded(tool.name, serverName, prefix, definition.excludeTools)) continue;
       const prefixedName = formatToolName(tool.name, serverName, prefix);
       if (BUILTIN_NAMES.has(prefixedName)) {
         console.warn(`MCP: skipping direct tool "${prefixedName}" (collides with builtin)`);
@@ -93,6 +133,7 @@ export function resolveDirectTools(
       for (const resource of serverCache.resources ?? []) {
         const baseName = `get_${resourceNameToToolName(resource.name)}`;
         if (toolFilter !== true && !toolFilter.includes(baseName)) continue;
+        if (isToolExcluded(baseName, serverName, prefix, definition.excludeTools)) continue;
         const prefixedName = formatToolName(baseName, serverName, prefix);
         if (BUILTIN_NAMES.has(prefixedName)) {
           console.warn(`MCP: skipping direct resource tool "${prefixedName}" (collides with builtin)`);
@@ -117,11 +158,35 @@ export function resolveDirectTools(
   return specs;
 }
 
+export function getMissingConfiguredDirectToolServers(
+  config: McpConfig,
+  cache: MetadataCache | null,
+): string[] {
+  const missing: string[] = [];
+  const globalDirect = config.settings?.directTools;
+
+  for (const [serverName, definition] of Object.entries(config.mcpServers)) {
+    const hasDirectTools = definition.directTools !== undefined
+      ? !!definition.directTools
+      : !!globalDirect;
+
+    if (!hasDirectTools) continue;
+
+    const serverCache = cache?.servers?.[serverName];
+    if (!serverCache || !isServerCacheValid(serverCache, definition)) {
+      missing.push(serverName);
+    }
+  }
+
+  return missing;
+}
+
 export function buildProxyDescription(
   config: McpConfig,
   cache: MetadataCache | null,
   directSpecs: DirectToolSpec[],
 ): string {
+  const prefix = config.settings?.toolPrefix ?? "server";
   let desc = `MCP gateway - connect to MCP servers and call their tools.\n`;
 
   const directByServer = new Map<string, number>();
@@ -139,8 +204,15 @@ export function buildProxyDescription(
   for (const serverName of Object.keys(config.mcpServers)) {
     const entry = cache?.servers?.[serverName];
     const definition = config.mcpServers[serverName];
-    const toolCount = entry?.tools?.length ?? 0;
-    const resourceCount = definition?.exposeResources !== false ? (entry?.resources?.length ?? 0) : 0;
+    const toolCount = (entry?.tools ?? []).filter(
+      (tool) => !isToolExcluded(tool.name, serverName, prefix, definition.excludeTools),
+    ).length;
+    const resourceCount = definition?.exposeResources !== false
+      ? (entry?.resources ?? []).filter((resource) => {
+          const baseName = `get_${resourceNameToToolName(resource.name)}`;
+          return !isToolExcluded(baseName, serverName, prefix, definition.excludeTools);
+        }).length
+      : 0;
     const totalItems = toolCount + resourceCount;
     if (totalItems === 0) continue;
     const directCount = directByServer.get(serverName) ?? 0;
@@ -196,13 +268,32 @@ export function createDirectToolExecutor(
       };
     }
 
-    const connected = await lazyConnect(state, spec.serverName);
+    let connected = await lazyConnect(state, spec.serverName);
+    let autoAuthAttempted = false;
+
+    if (!connected && state.manager.getConnection(spec.serverName)?.status === "needs-auth") {
+      autoAuthAttempted = true;
+      const autoAuth = await attemptDirectAutoAuth(state, spec.serverName);
+      if (autoAuth.status === "failed") {
+        return {
+          content: [{ type: "text" as const, text: autoAuth.message }],
+          details: { error: "auth_required", server: spec.serverName, message: autoAuth.message },
+        };
+      }
+      if (autoAuth.status === "success") {
+        await state.manager.close(spec.serverName);
+        state.failureTracker.delete(spec.serverName);
+        connected = await lazyConnect(state, spec.serverName);
+      }
+    }
+
     if (!connected) {
       const authConnection = state.manager.getConnection(spec.serverName);
       if (authConnection?.status === "needs-auth") {
+        const message = `MCP server "${spec.serverName}" requires OAuth authentication. Run /mcp-auth ${spec.serverName} first.`;
         return {
-          content: [{ type: "text" as const, text: `MCP server "${spec.serverName}" requires OAuth authentication. Run /mcp-auth ${spec.serverName} first.` }],
-          details: { error: "auth_required", server: spec.serverName },
+          content: [{ type: "text" as const, text: message }],
+          details: { error: "auth_required", server: spec.serverName, message, autoAuthAttempted },
         };
       }
       const failedAgo = getFailureAgeSeconds(state, spec.serverName);

package/index.ts

@@ -3,12 +3,12 @@ import type { McpExtensionState } from "./state.js";
 import { Type } from "@sinclair/typebox";
 import { showStatus, showTools, reconnectServers, authenticateServer, openMcpPanel } from "./commands.js";
 import { loadMcpConfig } from "./config.js";
-import { buildProxyDescription, createDirectToolExecutor, resolveDirectTools } from "./direct-tools.js";
+import { buildProxyDescription, createDirectToolExecutor, getMissingConfiguredDirectToolServers, resolveDirectTools } from "./direct-tools.js";
 import { flushMetadataCache, initializeMcp, updateStatusBar } from "./init.js";
 import { loadMetadataCache } from "./metadata-cache.js";
 import { executeCall, executeConnect, executeDescribe, executeList, executeSearch, executeStatus, executeUiMessages } from "./proxy-modes.js";
 import { getConfigPathFromArgv, truncateAtWord } from "./utils.js";
-import { initializeOAuth } from "./mcp-auth-flow.js";
+import { initializeOAuth, shutdownOAuth } from "./mcp-auth-flow.js";
 
 export default function mcpAdapter(pi: ExtensionAPI) {
   let state: McpExtensionState | null = null;
@@ -59,6 +59,11 @@ export default function mcpAdapter(pi: ExtensionAPI) {
         prefix,
         envRaw?.split(",").map(s => s.trim()).filter(Boolean),
       );
+  const missingConfiguredDirectToolServers = getMissingConfiguredDirectToolServers(earlyConfig, earlyCache);
+  const shouldRegisterProxyTool =
+    earlyConfig.settings?.disableProxyTool !== true
+    || directSpecs.length === 0
+    || missingConfiguredDirectToolServers.length > 0;
 
   for (const spec of directSpecs) {
     pi.registerTool({
@@ -85,7 +90,10 @@ export default function mcpAdapter(pi: ExtensionAPI) {
     initPromise = null;
 
     try {
-      await shutdownState(previousState, "session_restart");
+      await Promise.all([
+        shutdownState(previousState, "session_restart"),
+        shutdownOAuth(),
+      ]);
     } catch (error) {
       console.error("MCP: failed to shut down previous session state", error);
     }
@@ -133,7 +141,10 @@ export default function mcpAdapter(pi: ExtensionAPI) {
     initPromise = null;
 
     try {
-      await shutdownState(currentState, "session_shutdown");
+      await Promise.all([
+        shutdownState(currentState, "session_shutdown"),
+        shutdownOAuth(),
+      ]);
     } catch (error) {
       console.error("MCP: session shutdown cleanup failed", error);
     }
@@ -207,86 +218,88 @@ export default function mcpAdapter(pi: ExtensionAPI) {
     },
   });
 
-  pi.registerTool({
-    name: "mcp",
-    label: "MCP",
-    description: buildProxyDescription(earlyConfig, earlyCache, directSpecs),
-    promptSnippet: "MCP gateway - connect to MCP servers and call their tools",
-    parameters: Type.Object({
-      tool: Type.Optional(Type.String({ description: "Tool name to call (e.g., 'xcodebuild_list_sims')" })),
-      args: Type.Optional(Type.String({ description: "Arguments as JSON string (e.g., '{\"key\": \"value\"}')" })),
-      connect: Type.Optional(Type.String({ description: "Server name to connect (lazy connect + metadata refresh)" })),
-      describe: Type.Optional(Type.String({ description: "Tool name to describe (shows parameters)" })),
-      search: Type.Optional(Type.String({ description: "Search tools by name/description" })),
-      regex: Type.Optional(Type.Boolean({ description: "Treat search as regex (default: substring match)" })),
-      includeSchemas: Type.Optional(Type.Boolean({ description: "Include parameter schemas in search results (default: true)" })),
-      server: Type.Optional(Type.String({ description: "Filter to specific server (also disambiguates tool calls)" })),
-      action: Type.Optional(Type.String({ description: "Action: 'ui-messages' to retrieve prompts/intents from UI sessions" })),
-    }),
-    async execute(_toolCallId, params: {
-      tool?: string;
-      args?: string;
-      connect?: string;
-      describe?: string;
-      search?: string;
-      regex?: boolean;
-      includeSchemas?: boolean;
-      server?: string;
-      action?: string;
-    }, _signal, _onUpdate, _ctx) {
-      let parsedArgs: Record<string, unknown> | undefined;
-      if (params.args) {
-        try {
-          parsedArgs = JSON.parse(params.args);
-          if (typeof parsedArgs !== "object" || parsedArgs === null || Array.isArray(parsedArgs)) {
-            const gotType = Array.isArray(parsedArgs) ? "array" : parsedArgs === null ? "null" : typeof parsedArgs;
-            throw new Error(`Invalid args: expected a JSON object, got ${gotType}`);
-          }
-        } catch (error) {
-          if (error instanceof SyntaxError) {
-            throw new Error(`Invalid args JSON: ${error.message}`, { cause: error });
+  if (shouldRegisterProxyTool) {
+    pi.registerTool({
+      name: "mcp",
+      label: "MCP",
+      description: buildProxyDescription(earlyConfig, earlyCache, directSpecs),
+      promptSnippet: "MCP gateway - connect to MCP servers and call their tools",
+      parameters: Type.Object({
+        tool: Type.Optional(Type.String({ description: "Tool name to call (e.g., 'xcodebuild_list_sims')" })),
+        args: Type.Optional(Type.String({ description: "Arguments as JSON string (e.g., '{\"key\": \"value\"}')" })),
+        connect: Type.Optional(Type.String({ description: "Server name to connect (lazy connect + metadata refresh)" })),
+        describe: Type.Optional(Type.String({ description: "Tool name to describe (shows parameters)" })),
+        search: Type.Optional(Type.String({ description: "Search tools by name/description" })),
+        regex: Type.Optional(Type.Boolean({ description: "Treat search as regex (default: substring match)" })),
+        includeSchemas: Type.Optional(Type.Boolean({ description: "Include parameter schemas in search results (default: true)" })),
+        server: Type.Optional(Type.String({ description: "Filter to specific server (also disambiguates tool calls)" })),
+        action: Type.Optional(Type.String({ description: "Action: 'ui-messages' to retrieve prompts/intents from UI sessions" })),
+      }),
+      async execute(_toolCallId, params: {
+        tool?: string;
+        args?: string;
+        connect?: string;
+        describe?: string;
+        search?: string;
+        regex?: boolean;
+        includeSchemas?: boolean;
+        server?: string;
+        action?: string;
+      }, _signal, _onUpdate, _ctx) {
+        let parsedArgs: Record<string, unknown> | undefined;
+        if (params.args) {
+          try {
+            parsedArgs = JSON.parse(params.args);
+            if (typeof parsedArgs !== "object" || parsedArgs === null || Array.isArray(parsedArgs)) {
+              const gotType = Array.isArray(parsedArgs) ? "array" : parsedArgs === null ? "null" : typeof parsedArgs;
+              throw new Error(`Invalid args: expected a JSON object, got ${gotType}`);
+            }
+          } catch (error) {
+            if (error instanceof SyntaxError) {
+              throw new Error(`Invalid args JSON: ${error.message}`, { cause: error });
+            }
+            throw error;
           }
-          throw error;
         }
-      }
 
-      if (!state && initPromise) {
-        try {
-          state = await initPromise;
-        } catch (error) {
-          const message = error instanceof Error ? error.message : String(error);
+        if (!state && initPromise) {
+          try {
+            state = await initPromise;
+          } catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            return {
+              content: [{ type: "text" as const, text: `MCP initialization failed: ${message}` }],
+              details: { error: "init_failed", message },
+            };
+          }
+        }
+        if (!state) {
           return {
-            content: [{ type: "text" as const, text: `MCP initialization failed: ${message}` }],
-            details: { error: "init_failed", message },
+            content: [{ type: "text" as const, text: "MCP not initialized" }],
+            details: { error: "not_initialized" },
           };
         }
-      }
-      if (!state) {
-        return {
-          content: [{ type: "text" as const, text: "MCP not initialized" }],
-          details: { error: "not_initialized" },
-        };
-      }
 
-      if (params.action === "ui-messages") {
-        return executeUiMessages(state);
-      }
-      if (params.tool) {
-        return executeCall(state, params.tool, parsedArgs, params.server);
-      }
-      if (params.connect) {
-        return executeConnect(state, params.connect);
-      }
-      if (params.describe) {
-        return executeDescribe(state, params.describe);
-      }
-      if (params.search) {
-        return executeSearch(state, params.search, params.regex, params.server, params.includeSchemas, getPiTools);
-      }
-      if (params.server) {
-        return executeList(state, params.server);
-      }
-      return executeStatus(state);
-    },
-  });
+        if (params.action === "ui-messages") {
+          return executeUiMessages(state);
+        }
+        if (params.tool) {
+          return executeCall(state, params.tool, parsedArgs, params.server);
+        }
+        if (params.connect) {
+          return executeConnect(state, params.connect);
+        }
+        if (params.describe) {
+          return executeDescribe(state, params.describe);
+        }
+        if (params.search) {
+          return executeSearch(state, params.search, params.regex, params.server, params.includeSchemas, getPiTools);
+        }
+        if (params.server) {
+          return executeList(state, params.server);
+        }
+        return executeStatus(state);
+      },
+    });
+  }
 }

package/init.ts

@@ -21,6 +21,7 @@ import { buildToolMetadata, totalToolCount } from "./tool-metadata.js";
 import { UiResourceHandler } from "./ui-resource-handler.js";
 import { openUrl, parallelLimit } from "./utils.js";
 import { logger } from "./logger.js";
+import { getMissingConfiguredDirectToolServers } from "./direct-tools.js";
 
 const FAILURE_BACKOFF_MS = 60 * 1000;
 
@@ -89,7 +90,7 @@ export async function initializeMcp(
     }
 
     if (cache?.servers?.[name] && isServerCacheValid(cache.servers[name], definition)) {
-      const metadata = reconstructToolMetadata(name, cache.servers[name], prefix, definition.exposeResources);
+      const metadata = reconstructToolMetadata(name, cache.servers[name], prefix, definition);
       toolMetadata.set(name, metadata);
     }
   }
@@ -151,18 +152,8 @@ export async function initializeMcp(
 
   const envDirect = process.env.MCP_DIRECT_TOOLS;
   if (envDirect !== "__none__") {
-    const missingCacheServers: string[] = [];
     const currentCache = loadMetadataCache();
-    for (const [name, definition] of serverEntries) {
-      const hasDirect = definition.directTools !== undefined
-        ? !!definition.directTools
-        : !!config.settings?.directTools;
-      if (!hasDirect) continue;
-      const entry = currentCache?.servers?.[name];
-      if (!entry || !isServerCacheValid(entry, definition)) {
-        missingCacheServers.push(name);
-      }
-    }
+    const missingCacheServers = getMissingConfiguredDirectToolServers(config, currentCache);
 
     if (missingCacheServers.length > 0) {
       const bootstrapResults = await parallelLimit(

package/mcp-auth-flow.ts

@@ -36,6 +36,9 @@ export type AuthStatus = "authenticated" | "expired" | "not_authenticated"
 // Track pending transports for auth completion
 const pendingTransports = new Map<string, StreamableHTTPClientTransport>()
 
+// Deduplicate concurrent authenticate() calls per server.
+const pendingAuthentications = new Map<string, Promise<AuthStatus>>()
+
 /**
  * Generate a cryptographically secure random state parameter.
  */
@@ -182,56 +185,74 @@ export async function authenticate(
   serverUrl: string,
   definition?: ServerEntry,
 ): Promise<AuthStatus> {
-  // Start auth flow
-  const { authorizationUrl } = await startAuth(serverName, serverUrl, definition)
-
-  // If no auth URL needed, already authenticated
-  if (!authorizationUrl) {
-    return "authenticated"
+  const inFlight = pendingAuthentications.get(serverName)
+  if (inFlight) {
+    return inFlight
   }
 
-  // Get the state that was already generated and stored in startAuth()
-  const oauthState = await getOAuthState(serverName)
-  if (!oauthState) {
-    throw new Error("OAuth state not found - this should not happen")
-  }
+  const operation = (async (): Promise<AuthStatus> => {
+    // Start auth flow
+    const { authorizationUrl } = await startAuth(serverName, serverUrl, definition)
 
-  // Register the callback BEFORE opening the browser
-  const callbackPromise = waitForCallback(oauthState)
+    // If no auth URL needed, already authenticated
+    if (!authorizationUrl) {
+      return "authenticated"
+    }
 
-  // Open browser
-  console.log(`MCP Auth: Opening browser for ${serverName}`)
-  try {
-    await open(authorizationUrl)
-  } catch (error) {
-    console.warn(`MCP Auth: Failed to open browser for ${serverName}`, { error })
-    throw new Error(
-      `Could not open browser. Please open this URL manually: ${authorizationUrl}`
-    )
-  }
+    // Get the state that was already generated and stored in startAuth()
+    const oauthState = await getOAuthState(serverName)
+    if (!oauthState) {
+      throw new Error("OAuth state not found - this should not happen")
+    }
 
-  try {
-    // Wait for callback
-    const code = await callbackPromise
+    // Register the callback BEFORE opening the browser
+    const callbackPromise = waitForCallback(oauthState)
+
+    // Open browser
+    console.log(`MCP Auth: Opening browser for ${serverName}`)
+    try {
+      await open(authorizationUrl)
+    } catch (error) {
+      console.warn(`MCP Auth: Failed to open browser for ${serverName}`, { error })
+      throw new Error(
+        `Could not open browser. Please open this URL manually: ${authorizationUrl}`,
+        { cause: error },
+      )
+    }
 
-    // Validate state
-    const storedState = await getOAuthState(serverName)
-    if (storedState !== oauthState) {
+    try {
+      // Wait for callback
+      const code = await callbackPromise
+
+      // Validate state
+      const storedState = await getOAuthState(serverName)
+      if (storedState !== oauthState) {
+        await clearOAuthState(serverName)
+        throw new Error("OAuth state mismatch - potential CSRF attack")
+      }
       await clearOAuthState(serverName)
-      throw new Error("OAuth state mismatch - potential CSRF attack")
+
+      // Complete the auth
+      return await completeAuth(serverName, code)
+    } catch (error) {
+      cancelPendingCallback(oauthState)
+      const pendingTransport = pendingTransports.get(serverName)
+      if (pendingTransport) {
+        pendingTransports.delete(serverName)
+        await pendingTransport.close().catch(() => {})
+      }
+      throw error
     }
-    await clearOAuthState(serverName)
+  })()
 
-    // Complete the auth
-    return await completeAuth(serverName, code)
-  } catch (error) {
-    cancelPendingCallback(oauthState)
-    const pendingTransport = pendingTransports.get(serverName)
-    if (pendingTransport) {
-      pendingTransports.delete(serverName)
-      await pendingTransport.close().catch(() => {})
+  pendingAuthentications.set(serverName, operation)
+
+  try {
+    return await operation
+  } finally {
+    if (pendingAuthentications.get(serverName) === operation) {
+      pendingAuthentications.delete(serverName)
     }
-    throw error
   }
 }
 

package/mcp-callback-server.ts

@@ -155,9 +155,13 @@ export async function ensureCallbackServer(options: EnsureCallbackServerOptions
   if (server) {
     if (!strictPort || getOAuthCallbackPort() === configuredPort) return
 
-    throw new Error(
-      `OAuth callback server is already running on port ${getOAuthCallbackPort()}, but strict callback port ${configuredPort} is required`
-    )
+    if (pendingAuths.size > 0) {
+      throw new Error(
+        `OAuth callback server is running on port ${getOAuthCallbackPort()}, but strict callback port ${configuredPort} is required and cannot be switched while authorizations are pending`
+      )
+    }
+
+    await stopCallbackServer()
   }
 
   const preferredPort = configuredPort
@@ -180,6 +184,7 @@ export async function ensureCallbackServer(options: EnsureCallbackServerOptions
       })
 
       server = candidateServer
+      server.unref()
       setOAuthCallbackPort(candidatePort)
       return
     } catch (error) {
@@ -257,7 +262,7 @@ export async function stopCallbackServer(): Promise<void> {
   const pendingList = Array.from(pendingAuths.entries())
   pendingAuths.clear()
   setTimeout(() => {
-    for (const [state, pending] of pendingList) {
+    for (const [, pending] of pendingList) {
       clearTimeout(pending.timeout)
       pending.reject(new Error("OAuth callback server stopped"))
     }

package/mcp-panel.ts

@@ -1,4 +1,5 @@
 import { matchesKey, truncateToWidth, visibleWidth } from "@mariozechner/pi-tui";
+import { isToolExcluded } from "./types.js";
 import type { McpConfig, McpPanelCallbacks, McpPanelResult, ServerProvenance } from "./types.js";
 import { resourceNameToToolName } from "./resource-tools.js";
 import type { MetadataCache, ServerCacheEntry, CachedTool } from "./metadata-cache.js";
@@ -93,6 +94,8 @@ interface ServerState {
   expanded: boolean;
   source: "user" | "project" | "import";
   importKind?: string;
+  excludeTools?: string[];
+  exposeResources: boolean;
   connectionStatus: ConnectionStatus;
   tools: ToolState[];
   hasCachedData: boolean;
@@ -105,6 +108,7 @@ interface VisibleItem {
 }
 
 class McpPanel {
+  private prefix: "server" | "none" | "short";
   private servers: ServerState[] = [];
   private cursorIndex = 0;
   private nameQuery = "";
@@ -132,6 +136,7 @@ class McpPanel {
     private done: (result: McpPanelResult) => void,
   ) {
     this.tui = tui;
+    this.prefix = config.settings?.toolPrefix ?? "server";
 
     for (const [serverName, definition] of Object.entries(config.mcpServers)) {
       const prov = provenance.get(serverName);
@@ -148,6 +153,10 @@ class McpPanel {
       const tools: ToolState[] = [];
       if (serverCache) {
         for (const tool of serverCache.tools ?? []) {
+          if (isToolExcluded(tool.name, serverName, this.prefix, definition.excludeTools)) {
+            continue;
+          }
+
           const isDirect = toolFilter === true || (Array.isArray(toolFilter) && toolFilter.includes(tool.name));
           tools.push({
             name: tool.name,
@@ -160,6 +169,10 @@ class McpPanel {
         if (definition.exposeResources !== false) {
           for (const resource of serverCache.resources ?? []) {
             const baseName = `get_${resourceNameToToolName(resource.name)}`;
+            if (isToolExcluded(baseName, serverName, this.prefix, definition.excludeTools)) {
+              continue;
+            }
+
             const isDirect = toolFilter === true || (Array.isArray(toolFilter) && toolFilter.includes(baseName));
             const ct: CachedTool = { name: baseName, description: resource.description };
             tools.push({
@@ -180,6 +193,8 @@ class McpPanel {
         expanded: false,
         source: prov?.kind ?? "user",
         importKind: prov?.importKind,
+        excludeTools: definition.excludeTools,
+        exposeResources: definition.exposeResources !== false,
         connectionStatus: status,
         tools,
         hasCachedData: !!serverCache,
@@ -385,8 +400,10 @@ class McpPanel {
           server.hasCachedData = true;
         }
         this.tui.requestRender();
-      }).catch(() => {
+      }).catch((error) => {
         server.connectionStatus = "failed";
+        const message = error instanceof Error ? error.message : String(error);
+        this.authNotice = `Reconnect failed for ${server.name}: ${message}`;
         this.tui.requestRender();
       });
       return;
@@ -477,6 +494,10 @@ class McpPanel {
 
     const newTools: ToolState[] = [];
     for (const tool of entry.tools ?? []) {
+      if (isToolExcluded(tool.name, server.name, this.prefix, server.excludeTools)) {
+        continue;
+      }
+
       const prev = existingState.get(tool.name);
       const isDirect = prev !== undefined ? prev : false;
       newTools.push({
@@ -488,18 +509,24 @@ class McpPanel {
       });
     }
 
-    for (const resource of entry.resources ?? []) {
-      const baseName = `get_${resourceNameToToolName(resource.name)}`;
-      const prev = existingState.get(baseName);
-      const isDirect = prev !== undefined ? prev : false;
-      const ct: CachedTool = { name: baseName, description: resource.description };
-      newTools.push({
-        name: baseName,
-        description: resource.description ?? `Read resource: ${resource.uri}`,
-        isDirect,
-        wasDirect: prev !== undefined ? server.tools.find((t) => t.name === baseName)?.wasDirect ?? false : false,
-        estimatedTokens: estimateTokens(ct),
-      });
+    if (server.exposeResources) {
+      for (const resource of entry.resources ?? []) {
+        const baseName = `get_${resourceNameToToolName(resource.name)}`;
+        if (isToolExcluded(baseName, server.name, this.prefix, server.excludeTools)) {
+          continue;
+        }
+
+        const prev = existingState.get(baseName);
+        const isDirect = prev !== undefined ? prev : false;
+        const ct: CachedTool = { name: baseName, description: resource.description };
+        newTools.push({
+          name: baseName,
+          description: resource.description ?? `Read resource: ${resource.uri}`,
+          isDirect,
+          wasDirect: prev !== undefined ? server.tools.find((t) => t.name === baseName)?.wasDirect ?? false : false,
+          estimatedTokens: estimateTokens(ct),
+        });
+      }
     }
 
     server.tools = newTools;

package/metadata-cache.ts

@@ -5,7 +5,7 @@ import { dirname, join } from "node:path";
 import { createHash } from "node:crypto";
 import { getToolUiResourceUri } from "@modelcontextprotocol/ext-apps/app-bridge";
 import type { McpTool, McpResource, ServerEntry, ToolMetadata } from "./types.js";
-import { formatToolName } from "./types.js";
+import { formatToolName, isToolExcluded } from "./types.js";
 import { resourceNameToToolName } from "./resource-tools.js";
 import { extractToolUiStreamMode } from "./utils.js";
 
@@ -95,6 +95,7 @@ export function computeServerHash(definition: ServerEntry): string {
     bearerToken: definition.bearerToken,
     bearerTokenEnv: definition.bearerTokenEnv,
     exposeResources: definition.exposeResources,
+    excludeTools: definition.excludeTools,
   };
   const normalized = stableStringify(identity);
   return createHash("sha256").update(normalized).digest("hex");
@@ -115,12 +116,16 @@ export function reconstructToolMetadata(
   serverName: string,
   entry: ServerCacheEntry,
   prefix: "server" | "none" | "short",
-  exposeResources?: boolean
+  definition: Pick<ServerEntry, "exposeResources" | "excludeTools">
 ): ToolMetadata[] {
   const metadata: ToolMetadata[] = [];
 
   for (const tool of entry.tools ?? []) {
     if (!tool?.name) continue;
+    if (isToolExcluded(tool.name, serverName, prefix, definition.excludeTools)) {
+      continue;
+    }
+
     metadata.push({
       name: formatToolName(tool.name, serverName, prefix),
       originalName: tool.name,
@@ -131,10 +136,14 @@ export function reconstructToolMetadata(
     });
   }
 
-  if (exposeResources !== false) {
+  if (definition.exposeResources !== false) {
     for (const resource of entry.resources ?? []) {
       if (!resource?.name || !resource?.uri) continue;
       const baseName = `get_${resourceNameToToolName(resource.name)}`;
+      if (isToolExcluded(baseName, serverName, prefix, definition.excludeTools)) {
+        continue;
+      }
+
       metadata.push({
         name: formatToolName(baseName, serverName, prefix),
         originalName: baseName,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-mcp-adapter",
-  "version": "2.3.4",
+  "version": "2.4.0",
   "description": "MCP (Model Context Protocol) adapter extension for Pi coding agent",
   "type": "module",
   "license": "MIT",

package/proxy-modes.ts

@@ -7,9 +7,52 @@ import { buildToolMetadata, getToolNames, findToolByName, formatSchema } from ".
 import { transformMcpContent } from "./tool-registrar.js";
 import { maybeStartUiSession, type UiSessionRuntime } from "./ui-session.js";
 import { truncateAtWord } from "./utils.js";
+import { authenticate, supportsOAuth } from "./mcp-auth-flow.js";
 
 type ProxyToolResult = AgentToolResult<Record<string, unknown>>;
 
+type AutoAuthResult =
+  | { status: "skipped" }
+  | { status: "success" }
+  | { status: "failed"; message: string };
+
+function getAuthRequiredMessage(serverName: string): string {
+  return `Server "${serverName}" requires OAuth authentication. Run /mcp-auth ${serverName} first.`;
+}
+
+async function attemptAutoAuth(
+  state: McpExtensionState,
+  serverName: string,
+): Promise<AutoAuthResult> {
+  if (state.config.settings?.autoAuth !== true) {
+    return { status: "skipped" };
+  }
+
+  const definition = state.config.mcpServers[serverName];
+  if (!definition || !supportsOAuth(definition) || !definition.url) {
+    return { status: "skipped" };
+  }
+
+  const grantType = definition.oauth?.grantType ?? "authorization_code";
+  if (!state.ui && grantType !== "client_credentials") {
+    return {
+      status: "failed",
+      message: `Server "${serverName}" requires OAuth authentication. Run /mcp-auth ${serverName} in an interactive session.`,
+    };
+  }
+
+  try {
+    await authenticate(serverName, definition.url, definition);
+    return { status: "success" };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return {
+      status: "failed",
+      message: `OAuth authentication failed for "${serverName}": ${message}. Run /mcp-auth ${serverName} first.`,
+    };
+  }
+}
+
 export function executeUiMessages(state: McpExtensionState): ProxyToolResult {
   const sessions = state.completedUiSessions;
 
@@ -376,12 +419,26 @@ export async function executeConnect(state: McpExtensionState, serverName: strin
     if (state.ui) {
       state.ui.setStatus("mcp", `MCP: connecting to ${serverName}...`);
     }
-    const connection = await state.manager.connect(serverName, definition);
+    let connection = await state.manager.connect(serverName, definition);
     if (connection.status === "needs-auth") {
-      return {
-        content: [{ type: "text" as const, text: `Server "${serverName}" requires OAuth authentication. Run /mcp-auth ${serverName} first.` }],
-        details: { mode: "connect", error: "auth_required", server: serverName },
-      };
+      const autoAuth = await attemptAutoAuth(state, serverName);
+      if (autoAuth.status === "failed") {
+        return {
+          content: [{ type: "text" as const, text: autoAuth.message }],
+          details: { mode: "connect", error: "auth_required", server: serverName, message: autoAuth.message },
+        };
+      }
+      if (autoAuth.status === "success") {
+        await state.manager.close(serverName);
+        connection = await state.manager.connect(serverName, definition);
+      }
+      if (connection.status === "needs-auth") {
+        const message = getAuthRequiredMessage(serverName);
+        return {
+          content: [{ type: "text" as const, text: message }],
+          details: { mode: "connect", error: "auth_required", server: serverName, message },
+        };
+      }
     }
     const prefix = state.config.settings?.toolPrefix ?? "server";
     const { metadata } = buildToolMetadata(connection.tools, connection.resources, definition, serverName, prefix);
@@ -409,6 +466,7 @@ export async function executeCall(
 ): Promise<ProxyToolResult> {
   let serverName: string | undefined = serverOverride;
   let toolMeta: ToolMetadata | undefined;
+  let autoAuthAttempted = false;
   const prefixMode = state.config.settings?.toolPrefix ?? "server";
 
   if (serverName && !state.config.mcpServers[serverName]) {
@@ -438,17 +496,48 @@ export async function executeCall(
     } else {
       const needsAuthConnection = state.manager.getConnection(serverName);
       if (needsAuthConnection?.status === "needs-auth") {
-        return {
-          content: [{ type: "text" as const, text: `Server "${serverName}" requires OAuth authentication. Run /mcp-auth ${serverName} first.` }],
-          details: { mode: "call", error: "auth_required", server: serverName },
-        };
+        if (!autoAuthAttempted) {
+          autoAuthAttempted = true;
+          const autoAuth = await attemptAutoAuth(state, serverName);
+          if (autoAuth.status === "failed") {
+            return {
+              content: [{ type: "text" as const, text: autoAuth.message }],
+              details: { mode: "call", error: "auth_required", server: serverName, message: autoAuth.message },
+            };
+          }
+          if (autoAuth.status === "success") {
+            await state.manager.close(serverName);
+            state.failureTracker.delete(serverName);
+            const connectedAfterAuth = await lazyConnect(state, serverName);
+            if (connectedAfterAuth) {
+              toolMeta = findToolByName(state.toolMetadata.get(serverName), toolName);
+              if (!toolMeta) {
+                return {
+                  content: [{ type: "text" as const, text: `Tool "${toolName}" not found on "${serverName}" after reconnect.` }],
+                  details: { mode: "call", error: "tool_not_found_after_reconnect", requestedTool: toolName },
+                };
+              }
+            }
+          }
+        }
+
+        if (!toolMeta && state.manager.getConnection(serverName)?.status === "needs-auth") {
+          const message = getAuthRequiredMessage(serverName);
+          return {
+            content: [{ type: "text" as const, text: message }],
+            details: { mode: "call", error: "auth_required", server: serverName, message },
+          };
+        }
       }
-      const failedAgo = getFailureAgeSeconds(state, serverName);
-      if (failedAgo !== null) {
-        return {
-          content: [{ type: "text" as const, text: `Server "${serverName}" not available (last failed ${failedAgo}s ago)` }],
-          details: { mode: "call", error: "server_backoff", server: serverName },
-        };
+
+      if (!toolMeta) {
+        const failedAgo = getFailureAgeSeconds(state, serverName);
+        if (failedAgo !== null) {
+          return {
+            content: [{ type: "text" as const, text: `Server "${serverName}" not available (last failed ${failedAgo}s ago)` }],
+            details: { mode: "call", error: "server_backoff", server: serverName },
+          };
+        }
       }
     }
   }
@@ -462,9 +551,27 @@ export async function executeCall(
       .sort((a, b) => b.prefix.length - a.prefix.length);
 
     for (const { name: configuredServer } of candidates) {
+      const existingConnection = state.manager.getConnection(configuredServer);
       const failedAgo = getFailureAgeSeconds(state, configuredServer);
-      if (failedAgo !== null) continue;
-      const connected = await lazyConnect(state, configuredServer);
+      if (failedAgo !== null && existingConnection?.status !== "needs-auth") continue;
+
+      let connected = await lazyConnect(state, configuredServer);
+      if (!connected && state.manager.getConnection(configuredServer)?.status === "needs-auth" && !autoAuthAttempted) {
+        autoAuthAttempted = true;
+        const autoAuth = await attemptAutoAuth(state, configuredServer);
+        if (autoAuth.status === "failed") {
+          return {
+            content: [{ type: "text" as const, text: autoAuth.message }],
+            details: { mode: "call", error: "auth_required", server: configuredServer, message: autoAuth.message },
+          };
+        }
+        if (autoAuth.status === "success") {
+          await state.manager.close(configuredServer);
+          state.failureTracker.delete(configuredServer);
+          connected = await lazyConnect(state, configuredServer);
+        }
+      }
+
       if (!connected) continue;
       if (!prefixMatchedServer) prefixMatchedServer = configuredServer;
       toolMeta = findToolByName(state.toolMetadata.get(configuredServer), toolName);
@@ -492,10 +599,29 @@ export async function executeCall(
 
   let connection = state.manager.getConnection(serverName);
   if (connection?.status === "needs-auth") {
-    return {
-      content: [{ type: "text" as const, text: `Server "${serverName}" requires OAuth authentication. Run /mcp-auth ${serverName} first.` }],
-      details: { mode: "call", error: "auth_required", server: serverName },
-    };
+    if (!autoAuthAttempted) {
+      autoAuthAttempted = true;
+      const autoAuth = await attemptAutoAuth(state, serverName);
+      if (autoAuth.status === "failed") {
+        return {
+          content: [{ type: "text" as const, text: autoAuth.message }],
+          details: { mode: "call", error: "auth_required", server: serverName, message: autoAuth.message },
+        };
+      }
+      if (autoAuth.status === "success") {
+        await state.manager.close(serverName);
+        state.failureTracker.delete(serverName);
+        connection = state.manager.getConnection(serverName);
+      }
+    }
+
+    if (connection?.status === "needs-auth") {
+      const message = getAuthRequiredMessage(serverName);
+      return {
+        content: [{ type: "text" as const, text: message }],
+        details: { mode: "call", error: "auth_required", server: serverName, message },
+      };
+    }
   }
   if (!connection || connection.status !== "connected") {
     const failedAgo = getFailureAgeSeconds(state, serverName);
@@ -520,10 +646,28 @@ export async function executeCall(
       }
       connection = await state.manager.connect(serverName, definition);
       if (connection.status === "needs-auth") {
-        return {
-          content: [{ type: "text" as const, text: `Server "${serverName}" requires OAuth authentication. Run /mcp-auth ${serverName} first.` }],
-          details: { mode: "call", error: "auth_required", server: serverName },
-        };
+        if (!autoAuthAttempted) {
+          autoAuthAttempted = true;
+          const autoAuth = await attemptAutoAuth(state, serverName);
+          if (autoAuth.status === "failed") {
+            return {
+              content: [{ type: "text" as const, text: autoAuth.message }],
+              details: { mode: "call", error: "auth_required", server: serverName, message: autoAuth.message },
+            };
+          }
+          if (autoAuth.status === "success") {
+            await state.manager.close(serverName);
+            connection = await state.manager.connect(serverName, definition);
+          }
+        }
+
+        if (connection.status === "needs-auth") {
+          const message = getAuthRequiredMessage(serverName);
+          return {
+            content: [{ type: "text" as const, text: message }],
+            details: { mode: "call", error: "auth_required", server: serverName, message },
+          };
+        }
       }
       state.failureTracker.delete(serverName);
       updateServerMetadata(state, serverName);

package/tool-metadata.ts

@@ -1,7 +1,7 @@
 import { getToolUiResourceUri } from "@modelcontextprotocol/ext-apps/app-bridge";
 import type { McpExtensionState } from "./state.js";
 import type { ToolMetadata, McpTool, McpResource, ServerEntry } from "./types.js";
-import { formatToolName } from "./types.js";
+import { formatToolName, isToolExcluded } from "./types.js";
 import { resourceNameToToolName } from "./resource-tools.js";
 import { extractToolUiStreamMode } from "./utils.js";
 
@@ -20,6 +20,10 @@ export function buildToolMetadata(
       failedTools.push("(unnamed)");
       continue;
     }
+    if (isToolExcluded(tool.name, serverName, prefix, definition.excludeTools)) {
+      continue;
+    }
+
     let uiResourceUri: string | undefined;
     try {
       uiResourceUri = getToolUiResourceUri({ _meta: tool._meta });
@@ -39,6 +43,10 @@ export function buildToolMetadata(
   if (definition.exposeResources !== false) {
     for (const resource of resources) {
       const baseName = `get_${resourceNameToToolName(resource.name)}`;
+      if (isToolExcluded(baseName, serverName, prefix, definition.excludeTools)) {
+        continue;
+      }
+
       metadata.push({
         name: formatToolName(baseName, serverName, prefix),
         originalName: baseName,

package/types.ts

@@ -305,6 +305,8 @@ export interface ServerEntry {
   exposeResources?: boolean;
   // Direct tool registration
   directTools?: boolean | string[];
+  // Exclude specific MCP tools/resources by original or prefixed name
+  excludeTools?: string[];
   // Debug
   debug?: boolean;  // Show server stderr (default: false)
 }
@@ -314,6 +316,8 @@ export interface McpSettings {
   toolPrefix?: "server" | "none" | "short";
   idleTimeout?: number; // minutes, default 10, 0 to disable
   directTools?: boolean;
+  disableProxyTool?: boolean;
+  autoAuth?: boolean;
 }
 
 // Root config
@@ -391,3 +395,32 @@ export function formatToolName(
   const p = getServerPrefix(serverName, prefix);
   return p ? `${p}_${toolName}` : toolName;
 }
+
+function normalizeToolName(value: string): string {
+  return value.replace(/-/g, "_");
+}
+
+export function isToolExcluded(
+  toolName: string,
+  serverName: string,
+  prefix: "server" | "none" | "short",
+  excludeTools?: unknown
+): boolean {
+  if (!Array.isArray(excludeTools) || excludeTools.length === 0) return false;
+
+  const candidates = new Set<string>([
+    normalizeToolName(toolName),
+    normalizeToolName(formatToolName(toolName, serverName, prefix)),
+    normalizeToolName(formatToolName(toolName, serverName, "server")),
+    normalizeToolName(formatToolName(toolName, serverName, "short")),
+  ]);
+
+  for (const excluded of excludeTools) {
+    if (typeof excluded !== "string") continue;
+    if (candidates.has(normalizeToolName(excluded))) {
+      return true;
+    }
+  }
+
+  return false;
+}