quiver-cli 1.0.0 → 1.2.0

package/README.md

@@ -50,6 +50,8 @@ quiver-cli check              # detect drift (CI-friendly: --json, exit 1)
 | `quiver-cli init`          | Interactive picker; write native configs + `quiver.lock`          |
 | `quiver-cli add <id>`      | Add one entry (`skill:`, `command:`, `mcp:`, `plugin:`)           |
 | `quiver-cli remove <id>`   | Remove one entry; keep lockfile + configs consistent (alias: `rm`)|
+| `quiver-cli disable <id>`  | Turn an MCP server off locally (`mcp:<name>`, gitignored override)|
+| `quiver-cli enable <id>`   | Turn a locally disabled MCP server back on                        |
 | `quiver-cli update [id]`   | Pull newer catalog content into `.agents/` (all or one entry)     |
 | `quiver-cli sync`          | Regenerate provider configs from `.agents/`; warn on drift        |
 | `quiver-cli providers`     | Change which tools get configs (`opencode`, `claude`, `codex`)    |
@@ -120,6 +122,21 @@ quiver-cli add plugin:rtk
 quiver-cli check             # also verifies that the rtk binary is on PATH
 ```
 
+## Toggling MCP servers locally
+
+Some MCP servers are only worth their token cost for specific tasks. Instead
+of removing them, switch them off locally:
+
+```bash
+quiver-cli disable mcp:posthog   # drop it from the generated provider configs
+quiver-cli enable mcp:posthog    # bring it back - instant, no re-introspection
+```
+
+The state lives in `.agents/config.local.json` (gitignored), so toggling never
+touches the committed `.agents/config.json`, `quiver.lock` or your teammates'
+setups. Disabled servers keep their lockfile entry and tool snapshot; `list`
+marks them as `disabled`, and `check` skips their re-introspection.
+
 ## The lockfile
 
 `quiver.lock` records, per entry: source path, content digest, and — for MCP
@@ -143,9 +160,15 @@ This is the basis for `sync` and `check`.
   poisoning), shown as a readable before/after.
 
 The first successful introspection records a baseline; subsequent `check` runs
-diff against it. Servers that fail introspection (e.g. requiring interactive
-OAuth) are reported as skipped. stdio servers run foreign code and are only
-introspected with `--introspect-stdio`.
+diff against it. stdio servers run foreign code and are only introspected with
+`--introspect-stdio`.
+
+**OAuth-protected servers** (e.g. Linear): `check` reuses opencode's MCP
+credentials (`~/.local/share/opencode/mcp-auth.json`, read-only — quiver never
+refreshes or rewrites them). Authenticate once with
+`opencode mcp auth <name>`, then re-run `quiver-cli check` to record the tool
+snapshot. Without a valid token the server is skipped with an actionable hint,
+and `quiver-cli list` shows why the tool count is missing.
 
 Pass `--offline` to skip MCP re-introspection entirely and check only digests
 and provider shims — no network, no foreign code, useful for a fast local

package/dist/cli.js

@@ -1199,9 +1199,47 @@ var init_fsops = __esm({
   }
 });
 
-// src/providers/opencode.ts
-import { existsSync as existsSync8 } from "fs";
+// src/providers/local-config.ts
+import { existsSync as existsSync8, readFileSync as readFileSync6, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "fs";
 import { resolve as resolve11 } from "path";
+var localConfigPath, readLocalConfig, disabledMcpServers, setMcpEnabled;
+var init_local_config = __esm({
+  "src/providers/local-config.ts"() {
+    "use strict";
+    localConfigPath = (targetRoot) => resolve11(targetRoot, ".agents", "config.local.json");
+    readLocalConfig = (targetRoot) => {
+      const path = localConfigPath(targetRoot);
+      if (!existsSync8(path)) return {};
+      return JSON.parse(readFileSync6(path, "utf8"));
+    };
+    disabledMcpServers = (targetRoot) => {
+      const disabled = /* @__PURE__ */ new Set();
+      const servers = readLocalConfig(targetRoot).mcpServers ?? {};
+      for (const [name, override] of Object.entries(servers)) {
+        if (override.enabled === false) disabled.add(name);
+      }
+      return disabled;
+    };
+    setMcpEnabled = (targetRoot, name, enabled) => {
+      const config = readLocalConfig(targetRoot);
+      const servers = { ...config.mcpServers ?? {} };
+      if (enabled) delete servers[name];
+      else servers[name] = { enabled: false };
+      if (Object.keys(servers).length) config.mcpServers = servers;
+      else delete config.mcpServers;
+      const path = localConfigPath(targetRoot);
+      if (Object.keys(config).length === 0) {
+        rmSync4(path, { force: true });
+        return;
+      }
+      writeFileSync4(path, JSON.stringify(config, null, 2) + "\n");
+    };
+  }
+});
+
+// src/providers/opencode.ts
+import { existsSync as existsSync9 } from "fs";
+import { resolve as resolve12 } from "path";
 var formatOpenCodeJson, preserveEnvReference, preserveEnvReferences, planOpenCode;
 var init_opencode = __esm({
   "src/providers/opencode.ts"() {
@@ -1253,11 +1291,11 @@ var init_opencode = __esm({
       const files = [];
       const removeFiles = [];
       const json = formatOpenCodeJson(rawMcpServers, opencodeConfig);
-      const jsonPath = resolve11(targetRoot, "opencode.json");
+      const jsonPath = resolve12(targetRoot, "opencode.json");
       if (json) files.push({ path: jsonPath, content: json });
       else removeFiles.push(jsonPath);
-      const tuiPath = resolve11(targetRoot, ".opencode/tui.json");
-      const tuiMarkerPath = resolve11(targetRoot, ".opencode/.quiver-tui");
+      const tuiPath = resolve12(targetRoot, ".opencode/tui.json");
+      const tuiMarkerPath = resolve12(targetRoot, ".opencode/.quiver-tui");
       if (tuiConfig) {
         files.push({
           path: tuiPath,
@@ -1268,20 +1306,20 @@ var init_opencode = __esm({
           ) + "\n"
         });
         files.push({ path: tuiMarkerPath, content: "managed by quiver\n" });
-      } else if (existsSync8(tuiMarkerPath)) {
+      } else if (existsSync9(tuiMarkerPath)) {
         removeFiles.push(tuiPath, tuiMarkerPath);
       }
       const symlinks = [
         ...selected.skills.map((s) => ({
-          path: resolve11(targetRoot, ".opencode/skills", s.name),
+          path: resolve12(targetRoot, ".opencode/skills", s.name),
           target: s.absDir
         })),
         ...selected.commands.map((c) => ({
-          path: resolve11(targetRoot, ".opencode/commands", `${c.name}.md`),
+          path: resolve12(targetRoot, ".opencode/commands", `${c.name}.md`),
           target: c.absPath
         })),
         ...selected.plugins.map((plugin) => ({
-          path: resolve11(
+          path: resolve12(
             targetRoot,
             ".opencode/plugins",
             `${plugin.name}${plugin.absPath.endsWith(".js") ? ".js" : ".ts"}`
@@ -1291,15 +1329,15 @@ var init_opencode = __esm({
       ];
       const managedDirs = [
         {
-          path: resolve11(targetRoot, ".opencode/skills"),
+          path: resolve12(targetRoot, ".opencode/skills"),
           expected: new Set(selected.skills.map((s) => s.name))
         },
         {
-          path: resolve11(targetRoot, ".opencode/commands"),
+          path: resolve12(targetRoot, ".opencode/commands"),
           expected: new Set(selected.commands.map((c) => `${c.name}.md`))
         },
         {
-          path: resolve11(targetRoot, ".opencode/plugins"),
+          path: resolve12(targetRoot, ".opencode/plugins"),
           expected: new Set(
             selected.plugins.map(
               (plugin) => `${plugin.name}${plugin.absPath.endsWith(".js") ? ".js" : ".ts"}`
@@ -1342,8 +1380,8 @@ var init_selection = __esm({
 });
 
 // src/providers/write.ts
-import { existsSync as existsSync9, lstatSync as lstatSync2 } from "fs";
-import { basename, relative as relative5, resolve as resolve12 } from "path";
+import { existsSync as existsSync10, lstatSync as lstatSync2 } from "fs";
+import { basename, relative as relative5, resolve as resolve13 } from "path";
 var isLinkable, buildPlan, writeProviders, formatWriteResult, checkProviders;
 var init_write = __esm({
   "src/providers/write.ts"() {
@@ -1353,6 +1391,7 @@ var init_write = __esm({
     init_claude();
     init_codex();
     init_fsops();
+    init_local_config();
     init_opencode();
     init_selection();
     isLinkable = (path) => {
@@ -1365,10 +1404,14 @@ var init_write = __esm({
     buildPlan = (targetRoot, catalog, lock, onMissingEnv, onSkippedRootFile) => {
       loadEnvLocal(targetRoot);
       const selected = resolveSelection(catalog, lock);
+      const disabled = disabledMcpServers(targetRoot);
+      if (disabled.size) {
+        selected.mcp = selected.mcp.filter((m) => !disabled.has(m.name));
+      }
       const rawMcpServers = {};
       for (const mcp of selected.mcp) rawMcpServers[mcp.name] = mcp.server;
       const mcpServers = interpolateEnvVars(rawMcpServers, onMissingEnv);
-      const agentsRoot = resolve12(targetRoot, ".agents");
+      const agentsRoot = resolve13(targetRoot, ".agents");
       const inputs = {
         targetRoot,
         agentsRoot,
@@ -1401,12 +1444,12 @@ var init_write = __esm({
         }
       }
       const rootSymlinks = [];
-      const agentsMd = resolve12(agentsRoot, "AGENTS.md");
-      if (existsSync9(agentsMd)) {
-        const rootAgents = resolve12(targetRoot, "AGENTS.md");
+      const agentsMd = resolve13(agentsRoot, "AGENTS.md");
+      if (existsSync10(agentsMd)) {
+        const rootAgents = resolve13(targetRoot, "AGENTS.md");
         for (const link of [
           { path: rootAgents, target: agentsMd },
-          { path: resolve12(targetRoot, "CLAUDE.md"), target: rootAgents }
+          { path: resolve13(targetRoot, "CLAUDE.md"), target: rootAgents }
         ]) {
           if (isLinkable(link.path)) rootSymlinks.push(link);
           else onSkippedRootFile?.(basename(link.path));
@@ -1468,15 +1511,16 @@ var init_write = __esm({
 
 // src/commands/gitignore.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync10, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
-import { resolve as resolve13 } from "path";
-var HEADER, SECRETS_COMMENT, PROVIDER_ENTRIES, SHARED_ENTRIES, SECRET_ENTRIES, patchGitignore, ignoredSourcePaths;
+import { existsSync as existsSync11, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
+import { resolve as resolve14 } from "path";
+var HEADER, SECRETS_COMMENT, LOCAL_COMMENT, PROVIDER_ENTRIES, SHARED_ENTRIES, SECRET_ENTRIES, LOCAL_ENTRIES, patchGitignore, ensureLocalOverrideIgnored, ignoredSourcePaths;
 var init_gitignore = __esm({
   "src/commands/gitignore.ts"() {
     "use strict";
     init_schema();
     HEADER = "# Generated by quiver (source of truth: .agents/ + quiver.lock)";
     SECRETS_COMMENT = "# Local secrets for MCP env-var interpolation";
+    LOCAL_COMMENT = "# Local overrides (quiver-cli enable/disable)";
     PROVIDER_ENTRIES = {
       claude: [".claude/", ".mcp.json"],
       opencode: [".opencode/", "opencode.json"],
@@ -1484,9 +1528,10 @@ var init_gitignore = __esm({
     };
     SHARED_ENTRIES = ["AGENTS.md", "CLAUDE.md"];
     SECRET_ENTRIES = [".env.local"];
+    LOCAL_ENTRIES = [".agents/config.local.json"];
     patchGitignore = (targetRoot, providers2) => {
-      const path = resolve13(targetRoot, ".gitignore");
-      const current = existsSync10(path) ? readFileSync6(path, "utf8") : "";
+      const path = resolve14(targetRoot, ".gitignore");
+      const current = existsSync11(path) ? readFileSync7(path, "utf8") : "";
       const lines = new Set(current.split("\n").map((l) => l.trim()));
       const active = providers2?.length ? providers2 : [...PROVIDERS];
       const shimEntries = [
@@ -1495,17 +1540,34 @@ var init_gitignore = __esm({
       ];
       const missingShims = shimEntries.filter((e) => !lines.has(e));
       const missingSecrets = SECRET_ENTRIES.filter((e) => !lines.has(e));
-      if (missingShims.length === 0 && missingSecrets.length === 0) return false;
+      const missingLocal = LOCAL_ENTRIES.filter((e) => !lines.has(e));
+      if (missingShims.length === 0 && missingSecrets.length === 0 && missingLocal.length === 0) {
+        return false;
+      }
       const block2 = [];
       if (missingShims.length) block2.push(HEADER, ...missingShims);
       if (missingSecrets.length) block2.push(SECRETS_COMMENT, ...missingSecrets);
+      if (missingLocal.length) block2.push(LOCAL_COMMENT, ...missingLocal);
       const prefix = current && !current.endsWith("\n") ? "\n" : "";
-      writeFileSync4(
+      writeFileSync5(
         path,
         current + prefix + (current ? "\n" : "") + block2.join("\n") + "\n"
       );
       return true;
     };
+    ensureLocalOverrideIgnored = (targetRoot) => {
+      const path = resolve14(targetRoot, ".gitignore");
+      const current = existsSync11(path) ? readFileSync7(path, "utf8") : "";
+      const lines = new Set(current.split("\n").map((l) => l.trim()));
+      const missing = LOCAL_ENTRIES.filter((e) => !lines.has(e));
+      if (!missing.length) return false;
+      const prefix = current && !current.endsWith("\n") ? "\n" : "";
+      writeFileSync5(
+        path,
+        current + prefix + (current ? "\n" : "") + [LOCAL_COMMENT, ...missing].join("\n") + "\n"
+      );
+      return true;
+    };
     ignoredSourcePaths = (targetRoot) => {
       try {
         const out = execFileSync2(
@@ -1747,15 +1809,15 @@ var init_init = __esm({
 });
 
 // src/catalog/repo.ts
-import { existsSync as existsSync11 } from "fs";
-import { resolve as resolve14 } from "path";
+import { existsSync as existsSync12 } from "fs";
+import { resolve as resolve15 } from "path";
 var repoCatalogRoot, repoCatalogExists, loadRepoCatalog;
 var init_repo = __esm({
   "src/catalog/repo.ts"() {
     "use strict";
     init_discover();
-    repoCatalogRoot = (targetRoot) => resolve14(targetRoot, ".agents");
-    repoCatalogExists = (targetRoot) => existsSync11(repoCatalogRoot(targetRoot));
+    repoCatalogRoot = (targetRoot) => resolve15(targetRoot, ".agents");
+    repoCatalogExists = (targetRoot) => existsSync12(repoCatalogRoot(targetRoot));
     loadRepoCatalog = (targetRoot, source) => {
       const resolved = {
         source,
@@ -1869,8 +1931,8 @@ var remove_exports = {};
 __export(remove_exports, {
   remove: () => remove
 });
-import { existsSync as existsSync12, readdirSync as readdirSync4, readFileSync as readFileSync7, rmSync as rmSync4, writeFileSync as writeFileSync5 } from "fs";
-import { resolve as resolve15 } from "path";
+import { existsSync as existsSync13, readdirSync as readdirSync4, readFileSync as readFileSync8, rmSync as rmSync5, writeFileSync as writeFileSync6 } from "fs";
+import { resolve as resolve16 } from "path";
 var remove, rewriteRepoPlugins, cleanupEmptyGroups, rewriteRepoMcp;
 var init_remove = __esm({
   "src/commands/remove.ts"() {
@@ -1920,9 +1982,9 @@ var init_remove = __esm({
       await success(`Removed ${id}.`);
     };
     rewriteRepoPlugins = (targetRoot, lock) => {
-      const configPath = resolve15(targetRoot, ".agents/config.json");
-      if (!existsSync12(configPath)) return;
-      const config = JSON.parse(readFileSync7(configPath, "utf8"));
+      const configPath = resolve16(targetRoot, ".agents/config.json");
+      if (!existsSync13(configPath)) return;
+      const config = JSON.parse(readFileSync8(configPath, "utf8"));
       if (!config.plugins) return;
       const keep = new Set(
         Object.keys(lock.entries).map(parseEntryId).filter((p) => p?.type === "plugin").map((p) => p.name)
@@ -1931,22 +1993,22 @@ var init_remove = __esm({
         Object.entries(config.plugins).filter(([name]) => keep.has(name))
       );
       if (!Object.keys(config.plugins).length) delete config.plugins;
-      writeFileSync5(configPath, JSON.stringify(config, null, 2) + "\n");
+      writeFileSync6(configPath, JSON.stringify(config, null, 2) + "\n");
     };
     cleanupEmptyGroups = (targetRoot) => {
-      const skillsRoot = resolve15(targetRoot, ".agents/skills");
-      if (!existsSync12(skillsRoot)) return;
+      const skillsRoot = resolve16(targetRoot, ".agents/skills");
+      if (!existsSync13(skillsRoot)) return;
       for (const entry of readdirSync4(skillsRoot, { withFileTypes: true })) {
         if (!entry.isDirectory()) continue;
-        const dir = resolve15(skillsRoot, entry.name);
-        if (existsSync12(resolve15(dir, "SKILL.md"))) continue;
-        if (readdirSync4(dir).length === 0) rmSync4(dir, { recursive: true, force: true });
+        const dir = resolve16(skillsRoot, entry.name);
+        if (existsSync13(resolve16(dir, "SKILL.md"))) continue;
+        if (readdirSync4(dir).length === 0) rmSync5(dir, { recursive: true, force: true });
       }
     };
     rewriteRepoMcp = (targetRoot, lock) => {
-      const configPath = resolve15(targetRoot, ".agents/config.json");
-      if (!existsSync12(configPath)) return;
-      const config = JSON.parse(readFileSync7(configPath, "utf8"));
+      const configPath = resolve16(targetRoot, ".agents/config.json");
+      if (!existsSync13(configPath)) return;
+      const config = JSON.parse(readFileSync8(configPath, "utf8"));
       if (!config.mcpServers) return;
       const keep = new Set(
         Object.keys(lock.entries).map(parseEntryId).filter((p) => p?.type === "mcp").map((p) => p.name)
@@ -1957,7 +2019,69 @@ var init_remove = __esm({
       }
       if (Object.keys(kept).length) config.mcpServers = kept;
       else delete config.mcpServers;
-      writeFileSync5(configPath, JSON.stringify(config, null, 2) + "\n");
+      writeFileSync6(configPath, JSON.stringify(config, null, 2) + "\n");
+    };
+  }
+});
+
+// src/commands/toggle.ts
+var toggle_exports = {};
+__export(toggle_exports, {
+  toggle: () => toggle
+});
+var toggle;
+var init_toggle = __esm({
+  "src/commands/toggle.ts"() {
+    "use strict";
+    init_repo();
+    init_io();
+    init_schema();
+    init_local_config();
+    init_write();
+    init_prompts();
+    init_gitignore();
+    toggle = async (options, enabled) => {
+      const verb = enabled ? "enable" : "disable";
+      const id = options.positionals[0];
+      const parsed = id ? parseEntryId(id) : null;
+      if (!parsed || parsed.type !== "mcp") {
+        await error(`Usage: quiver-cli ${verb} mcp:<name>`);
+        process.exitCode = 1;
+        return;
+      }
+      const lock = readLockfile(options.targetRoot);
+      if (!lock) {
+        await error("No quiver.lock found. Run `quiver-cli init` first.");
+        process.exitCode = 1;
+        return;
+      }
+      if (!repoCatalogExists(options.targetRoot)) {
+        await error("No .agents/ directory found. Run `quiver-cli init` first.");
+        process.exitCode = 1;
+        return;
+      }
+      if (!lock.entries[id]) {
+        const installed = Object.keys(lock.entries).map(parseEntryId).filter((p) => p?.type === "mcp").map((p) => p.name).sort((a, b) => a.localeCompare(b));
+        await error(
+          `${id} is not installed.` + (installed.length ? ` Installed MCP servers: ${installed.join(", ")}.` : " No MCP servers installed.")
+        );
+        process.exitCode = 1;
+        return;
+      }
+      const disabled = disabledMcpServers(options.targetRoot);
+      if (enabled !== disabled.has(parsed.name)) {
+        await info(`${id} is already ${enabled ? "enabled" : "disabled"}.`);
+        return;
+      }
+      setMcpEnabled(options.targetRoot, parsed.name, enabled);
+      if (!enabled && ensureLocalOverrideIgnored(options.targetRoot)) {
+        await step("Added .agents/config.local.json to .gitignore");
+      }
+      const { catalog } = loadRepoCatalog(options.targetRoot, lock.catalog.source);
+      writeProviders(options.targetRoot, catalog, lock);
+      await success(
+        enabled ? `Enabled ${id}.` : `Disabled ${id} locally (.agents/config.local.json). Re-enable with \`quiver-cli enable ${id}\`.`
+      );
     };
   }
 });
@@ -2174,8 +2298,8 @@ var update_exports = {};
 __export(update_exports, {
   update: () => update
 });
-import { cpSync as cpSync2, mkdirSync as mkdirSync5, readFileSync as readFileSync8, rmSync as rmSync5, writeFileSync as writeFileSync6 } from "fs";
-import { dirname as dirname5, resolve as resolve16 } from "path";
+import { cpSync as cpSync2, mkdirSync as mkdirSync5, readFileSync as readFileSync9, rmSync as rmSync6, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname5, resolve as resolve17 } from "path";
 var update, applyUpdate, report;
 var init_update = __esm({
   "src/commands/update.ts"() {
@@ -2262,8 +2386,8 @@ var init_update = __esm({
           return { id, status: "local-changes" };
         }
         if (dryRun) return { id, status: "updated" };
-        const dest = resolve16(targetRoot, ".agents", src2.sourcePath);
-        rmSync5(dest, { recursive: true, force: true });
+        const dest = resolve17(targetRoot, ".agents", src2.sourcePath);
+        rmSync6(dest, { recursive: true, force: true });
         mkdirSync5(dirname5(dest), { recursive: true });
         cpSync2(src2.absDir, dest, { recursive: true });
         entry.digest = src2.digest;
@@ -2280,7 +2404,7 @@ var init_update = __esm({
           return { id, status: "local-changes" };
         }
         if (dryRun) return { id, status: "updated" };
-        const dest = resolve16(targetRoot, ".agents", src2.sourcePath);
+        const dest = resolve17(targetRoot, ".agents", src2.sourcePath);
         mkdirSync5(dirname5(dest), { recursive: true });
         cpSync2(src2.absPath, dest, { force: true });
         entry.digest = src2.digest;
@@ -2296,16 +2420,16 @@ var init_update = __esm({
           return { id, status: "local-changes" };
         }
         if (dryRun) return { id, status: "updated" };
-        const dest = resolve16(targetRoot, ".agents", src2.sourcePath);
+        const dest = resolve17(targetRoot, ".agents", src2.sourcePath);
         mkdirSync5(dirname5(dest), { recursive: true });
         cpSync2(src2.absPath, dest, { force: true });
-        const configPath2 = resolve16(targetRoot, ".agents/config.json");
-        const config2 = JSON.parse(readFileSync8(configPath2, "utf8"));
+        const configPath2 = resolve17(targetRoot, ".agents/config.json");
+        const config2 = JSON.parse(readFileSync9(configPath2, "utf8"));
         config2.plugins = {
           ...config2.plugins,
           [parsed.name]: sourceCatalog.config.plugins?.[parsed.name]
         };
-        writeFileSync6(configPath2, JSON.stringify(config2, null, 2) + "\n");
+        writeFileSync7(configPath2, JSON.stringify(config2, null, 2) + "\n");
         entry.digest = src2.digest;
         entry.sourcePath = src2.sourcePath;
         entry.requires = src2.requires;
@@ -2319,10 +2443,10 @@ var init_update = __esm({
         return { id, status: "local-changes" };
       }
       if (dryRun) return { id, status: "updated" };
-      const configPath = resolve16(targetRoot, ".agents", "config.json");
-      const config = JSON.parse(readFileSync8(configPath, "utf8"));
+      const configPath = resolve17(targetRoot, ".agents", "config.json");
+      const config = JSON.parse(readFileSync9(configPath, "utf8"));
       config.mcpServers = { ...config.mcpServers, [parsed.name]: src.server };
-      writeFileSync6(configPath, JSON.stringify(config, null, 2) + "\n");
+      writeFileSync7(configPath, JSON.stringify(config, null, 2) + "\n");
       entry.configDigest = src.configDigest;
       entry.transport = src.server.transport;
       entry.tools = null;
@@ -2387,6 +2511,7 @@ var init_list = __esm({
     init_repo();
     init_io();
     init_schema();
+    init_local_config();
     init_prompts();
     truncate = (s, max) => {
       const flat = s.replace(/\s+/g, " ").trim();
@@ -2427,6 +2552,7 @@ var init_list = __esm({
       for (const group of [skills, commands, mcp, plugins]) {
         group.sort((a, b) => a.name.localeCompare(b.name));
       }
+      const disabled = disabledMcpServers(options.targetRoot);
       if (options.json) {
         console.log(
           JSON.stringify(
@@ -2441,8 +2567,10 @@ var init_list = __esm({
               mcp: mcp.map(({ name, entry }) => ({
                 name,
                 transport: entry.transport,
+                enabled: !disabled.has(name),
                 detail: serverDetail2.get(name) ?? null,
-                toolCount: entry.tools ? Object.keys(entry.tools).length : null
+                toolCount: entry.tools ? Object.keys(entry.tools).length : null,
+                authRequired: entry.authRequired ?? false
               })),
               plugins: plugins.map(({ name, entry }) => ({
                 name,
@@ -2482,6 +2610,7 @@ var init_list = __esm({
         }
       }
       let missingTools = false;
+      const needsAuth = [];
       if (mcp.length) {
         const nameW = Math.max(...mcp.map((e) => e.name.length));
         const toolW = Math.max(
@@ -2493,15 +2622,19 @@ var init_list = __esm({
         lines.push("", `  ${c.bold("mcp servers")}`);
         for (const { name, entry } of mcp) {
           const count = entry.tools ? Object.keys(entry.tools).length : null;
-          if (count === null) missingTools = true;
+          if (count === null) {
+            if (entry.authRequired) needsAuth.push(name);
+            else missingTools = true;
+          }
           const tools = padCell(
             `${count ?? "?"} tools`,
             toolW,
             count === null ? c.dim : c.green
           );
           const detail = serverDetail2.get(name);
+          const off = disabled.has(name) ? `  ${c.yellow("disabled")}` : "";
           lines.push(
-            `    ${name.padEnd(nameW)} ${entry.transport.padEnd(5)} ${tools}` + (detail ? `  ${c.dim(detail)}` : "")
+            `    ${name.padEnd(nameW)} ${entry.transport.padEnd(5)} ${tools}` + (detail ? `  ${c.dim(detail)}` : "") + off
           );
         }
       }
@@ -2519,6 +2652,13 @@ var init_list = __esm({
           `${skills.length} skills \xB7 ${commands.length} commands \xB7 ${mcp.length} MCP servers \xB7 ${plugins.length} plugins`
         )}  ${c.dim(`providers: ${providers2}`)}`
       );
+      for (const name of needsAuth) {
+        lines.push(
+          `  ${c.yellow(`${name} requires OAuth`)} ${c.dim(
+            `\u2014 run 'opencode mcp auth ${name}', then 'quiver-cli check'`
+          )}`
+        );
+      }
       if (missingTools) {
         lines.push(`  ${c.dim("run 'quiver-cli check' to populate tool counts")}`);
       }
@@ -2570,7 +2710,7 @@ var init_diff = __esm({
 });
 
 // src/mcp/introspect.ts
-var CONNECT_TIMEOUT_MS, withTimeout, introspect, errMsg;
+var CONNECT_TIMEOUT_MS, withTimeout, introspect, errMsg, isAuthError;
 var init_introspect = __esm({
   "src/mcp/introspect.ts"() {
     "use strict";
@@ -2586,13 +2726,20 @@ var init_introspect = __esm({
         clearTimeout(timer);
       }
     };
-    introspect = async (server, { allowStdio }) => {
+    introspect = async (server, { allowStdio, authToken }) => {
       const { Client } = await import("@modelcontextprotocol/sdk/client/index.js");
       let transport;
       try {
         if (server.transport === "http") {
           const { StreamableHTTPClientTransport } = await import("@modelcontextprotocol/sdk/client/streamableHttp.js");
-          const requestInit = server.headers ? { headers: server.headers } : {};
+          const headers2 = { ...server.headers ?? {} };
+          const hasAuthHeader = Object.keys(headers2).some(
+            (k) => k.toLowerCase() === "authorization"
+          );
+          if (authToken && !hasAuthHeader) {
+            headers2["Authorization"] = `Bearer ${authToken}`;
+          }
+          const requestInit = Object.keys(headers2).length ? { headers: headers2 } : {};
           transport = new StreamableHTTPClientTransport(new URL(server.url), {
             requestInit
           });
@@ -2627,6 +2774,9 @@ var init_introspect = __esm({
         }));
         return { ok: true, tools };
       } catch (e) {
+        if (await isAuthError(e)) {
+          return { ok: false, reason: errMsg(e), authRequired: true };
+        }
         return { ok: false, reason: errMsg(e) };
       } finally {
         try {
@@ -2636,6 +2786,55 @@ var init_introspect = __esm({
       }
     };
     errMsg = (e) => e instanceof Error ? e.message : String(e);
+    isAuthError = async (e) => {
+      try {
+        const { UnauthorizedError } = await import("@modelcontextprotocol/sdk/client/auth.js");
+        if (e instanceof UnauthorizedError) return true;
+      } catch {
+      }
+      if (typeof e === "object" && e !== null && e.code === 401) {
+        return true;
+      }
+      return /\b401\b|unauthorized|invalid_token/i.test(errMsg(e));
+    };
+  }
+});
+
+// src/mcp/opencode-auth.ts
+import { readFileSync as readFileSync10 } from "fs";
+import { homedir as homedir2 } from "os";
+import { resolve as resolve18 } from "path";
+var EXPIRY_SKEW_MS, authFilePath, normalizeUrl, findOpencodeToken;
+var init_opencode_auth = __esm({
+  "src/mcp/opencode-auth.ts"() {
+    "use strict";
+    EXPIRY_SKEW_MS = 3e4;
+    authFilePath = () => {
+      const base = process.env["XDG_DATA_HOME"] || resolve18(homedir2(), ".local", "share");
+      return resolve18(base, "opencode", "mcp-auth.json");
+    };
+    normalizeUrl = (url) => url.trim().replace(/\/+$/, "").toLowerCase();
+    findOpencodeToken = (name, url) => {
+      let data;
+      try {
+        data = JSON.parse(readFileSync10(authFilePath(), "utf8"));
+      } catch {
+        return { status: "none" };
+      }
+      if (typeof data !== "object" || data === null) return { status: "none" };
+      const entries = data;
+      const target = normalizeUrl(url);
+      const entry = Object.values(entries).find(
+        (e) => e?.serverUrl && normalizeUrl(e.serverUrl) === target
+      ) ?? entries[name];
+      const tokens = entry?.tokens;
+      if (!tokens?.accessToken) return { status: "none" };
+      if (typeof tokens.expiresAt === "number") {
+        const expiresMs = tokens.expiresAt > 1e12 ? tokens.expiresAt : tokens.expiresAt * 1e3;
+        if (expiresMs - EXPIRY_SKEW_MS <= Date.now()) return { status: "expired" };
+      }
+      return { status: "ok", accessToken: tokens.accessToken };
+    };
   }
 });
 
@@ -2661,13 +2860,14 @@ var init_snapshot = __esm({
 // src/commands/check.ts
 var check_exports = {};
 __export(check_exports, {
+  authHint: () => authHint,
   check: () => check,
   hasCommand: () => hasCommand,
   summarize: () => summarize
 });
 import { accessSync as accessSync2, constants as constants2 } from "fs";
-import { delimiter, resolve as resolve17 } from "path";
-var check, report2, driftLines, list2, recommend, summarize, hasCommand, truncate2, fail;
+import { delimiter, resolve as resolve19 } from "path";
+var check, report2, driftLines, list2, recommend, summarize, authHint, hasCommand, truncate2, fail;
 var init_check = __esm({
   "src/commands/check.ts"() {
     "use strict";
@@ -2676,7 +2876,9 @@ var init_check = __esm({
     init_schema();
     init_diff();
     init_introspect();
+    init_opencode_auth();
     init_snapshot();
+    init_local_config();
     init_write();
     init_interpolate();
     init_prompts();
@@ -2724,6 +2926,7 @@ var init_check = __esm({
       }
       const shimProblems = checkProviders(options.targetRoot, catalog, lock);
       const mcpReports = [];
+      const disabled = disabledMcpServers(options.targetRoot);
       let lockChanged = false;
       for (const [id, entry] of Object.entries(lock.entries)) {
         if (options.offline) break;
@@ -2731,15 +2934,33 @@ var init_check = __esm({
         const p = parseEntryId(id);
         const catMcp = catalog.mcp.find((m) => m.name === p.name);
         if (!catMcp) continue;
+        if (disabled.has(p.name)) {
+          mcpReports.push({ id, status: "skipped", reason: "disabled locally" });
+          continue;
+        }
         checked.mcp += 1;
         const server = interpolateEnvVars(catMcp.server);
-        const res = await introspect(server, { allowStdio: options.introspectStdio });
+        const mcpEntry = entry;
+        const cred = server.transport === "http" ? findOpencodeToken(p.name, server.url) : { status: "none" };
+        const res = await introspect(server, {
+          allowStdio: options.introspectStdio,
+          authToken: cred.status === "ok" ? cred.accessToken : void 0
+        });
         if (!res.ok) {
-          mcpReports.push({ id, status: "skipped", reason: res.reason });
+          if (res.authRequired && !mcpEntry.authRequired) {
+            mcpEntry.authRequired = true;
+            lockChanged = true;
+          }
+          const reason = res.authRequired ? authHint(cred.status, p.name) : res.reason;
+          mcpReports.push({
+            id,
+            status: "skipped",
+            reason,
+            ...res.authRequired ? { authRequired: true } : {}
+          });
           continue;
         }
         const current = toSnapshot(res.tools);
-        const mcpEntry = entry;
         if (!mcpEntry.tools) {
           mcpEntry.tools = current;
           mcpEntry.toolsFetchedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -2808,7 +3029,15 @@ var init_check = __esm({
   - ${shimProblems.join("\n  - ")}`
         );
       }
-      const skipped = mcpReports.filter((r) => r.status === "skipped");
+      const authSkipped = mcpReports.filter(
+        (r) => r.status === "skipped" && r.authRequired
+      );
+      for (const r of authSkipped) {
+        await warn(`${r.id}: ${r.reason}`);
+      }
+      const skipped = mcpReports.filter(
+        (r) => r.status === "skipped" && !r.authRequired
+      );
       if (skipped.length) {
         const names = skipped.map((r) => parseEntryId(r.id)?.name ?? r.id);
         await info(
@@ -2902,13 +3131,19 @@ var init_check = __esm({
       if (c.plugins) parts.push(plural(c.plugins, "plugin"));
       return parts.length ? parts.join(", ") : "nothing";
     };
+    authHint = (cred, name) => {
+      const reauth = `run 'opencode mcp auth ${name}', then 'quiver-cli check'`;
+      if (cred === "expired") return `OAuth token expired \u2014 re-${reauth}`;
+      if (cred === "ok") return `OAuth token rejected \u2014 re-${reauth}`;
+      return `requires OAuth \u2014 ${reauth}`;
+    };
     hasCommand = (command) => {
       if (!/^[A-Za-z0-9._-]+$/.test(command)) return false;
       const extensions = process.platform === "win32" ? (process.env["PATHEXT"] ?? ".EXE;.CMD;.BAT;.COM").split(";") : [""];
       for (const dir of (process.env["PATH"] ?? "").split(delimiter)) {
         for (const extension of extensions) {
           try {
-            accessSync2(resolve17(dir, command + extension), constants2.X_OK);
+            accessSync2(resolve19(dir, command + extension), constants2.X_OK);
             return true;
           } catch {
           }
@@ -2928,14 +3163,14 @@ var init_check = __esm({
 // src/catalog/upstreams.ts
 import { execFileSync as execFileSync3 } from "child_process";
 import {
-  existsSync as existsSync13,
+  existsSync as existsSync14,
   mkdtempSync as mkdtempSync2,
-  readFileSync as readFileSync9,
-  rmSync as rmSync6,
-  writeFileSync as writeFileSync7
+  readFileSync as readFileSync11,
+  rmSync as rmSync7,
+  writeFileSync as writeFileSync8
 } from "fs";
 import { tmpdir } from "os";
-import { join, resolve as resolve18 } from "path";
+import { join, resolve as resolve20 } from "path";
 var UPSTREAMS_FILE, upstreamsPath, loadUpstreams, writeUpstreams, fetchLatestCommit, fetchUpstreamDir, short, evaluateOrigin;
 var init_upstreams = __esm({
   "src/catalog/upstreams.ts"() {
@@ -2943,14 +3178,14 @@ var init_upstreams = __esm({
     init_auth();
     init_auth();
     UPSTREAMS_FILE = "upstreams.json";
-    upstreamsPath = (catalog) => resolve18(catalog.root, UPSTREAMS_FILE);
+    upstreamsPath = (catalog) => resolve20(catalog.root, UPSTREAMS_FILE);
     loadUpstreams = (catalog) => {
       const path = upstreamsPath(catalog);
-      if (!existsSync13(path)) return {};
-      return JSON.parse(readFileSync9(path, "utf8"));
+      if (!existsSync14(path)) return {};
+      return JSON.parse(readFileSync11(path, "utf8"));
     };
     writeUpstreams = (catalog, map) => {
-      writeFileSync7(upstreamsPath(catalog), JSON.stringify(map, null, 2) + "\n");
+      writeFileSync8(upstreamsPath(catalog), JSON.stringify(map, null, 2) + "\n");
     };
     fetchLatestCommit = async (origin) => {
       const url = `https://api.github.com/repos/${origin.repo}/commits?path=${encodeURIComponent(origin.path)}&sha=${encodeURIComponent(origin.ref)}&per_page=1`;
@@ -2989,7 +3224,7 @@ var init_upstreams = __esm({
     };
     fetchUpstreamDir = (origin) => {
       const tmp = mkdtempSync2(join(tmpdir(), "quiver-pull-"));
-      const cleanup = () => rmSync6(tmp, { recursive: true, force: true });
+      const cleanup = () => rmSync7(tmp, { recursive: true, force: true });
       const git = (args, cwd) => {
         execFileSync3("git", args, {
           cwd,
@@ -3015,8 +3250,8 @@ var init_upstreams = __esm({
         const msg = err instanceof Error && "stderr" in err ? String(err.stderr).trim().split("\n").pop() : err instanceof Error ? err.message : "git clone failed";
         return { ok: false, reason: msg || "git clone failed" };
       }
-      const dir = resolve18(tmp, origin.path);
-      if (!existsSync13(resolve18(dir, "SKILL.md"))) {
+      const dir = resolve20(tmp, origin.path);
+      if (!existsSync14(resolve20(dir, "SKILL.md"))) {
         cleanup();
         return { ok: false, reason: `no SKILL.md at ${origin.path} in ${origin.repo}` };
       }
@@ -3064,7 +3299,7 @@ var upstream_exports = {};
 __export(upstream_exports, {
   upstream: () => upstream
 });
-import { cpSync as cpSync3, rmSync as rmSync7 } from "fs";
+import { cpSync as cpSync3, rmSync as rmSync8 } from "fs";
 var upstream, guardWritableCatalog, STATUS_ORDER, pull, report3, countByStatus;
 var init_upstream = __esm({
   "src/commands/upstream.ts"() {
@@ -3174,7 +3409,7 @@ var init_upstream = __esm({
           continue;
         }
         try {
-          rmSync7(skill.absDir, { recursive: true, force: true });
+          rmSync8(skill.absDir, { recursive: true, force: true });
           cpSync3(fetched.dir, skill.absDir, { recursive: true, dereference: true });
         } finally {
           fetched.cleanup();
@@ -3309,9 +3544,9 @@ __export(notifier_exports, {
   installHint: () => installHint,
   notifierSuppressed: () => notifierSuppressed
 });
-import { existsSync as existsSync14, mkdirSync as mkdirSync6, readFileSync as readFileSync10, writeFileSync as writeFileSync8 } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname6, resolve as resolve19 } from "path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync6, readFileSync as readFileSync12, writeFileSync as writeFileSync9 } from "fs";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname6, resolve as resolve21 } from "path";
 var REGISTRY_URL, CHECK_TTL_MS, FETCH_TIMEOUT_MS, INSTALL_HINT, cacheFilePath, installHint, getCurrentVersion, compareSemver, readCache, writeCache, fetchLatestVersion, checkForUpdate, notifierSuppressed;
 var init_notifier = __esm({
   "src/version/notifier.ts"() {
@@ -3322,14 +3557,14 @@ var init_notifier = __esm({
     FETCH_TIMEOUT_MS = 2e3;
     INSTALL_HINT = "pnpm add -g quiver-cli";
     cacheFilePath = () => {
-      const base = process.env["XDG_CACHE_HOME"] || resolve19(homedir2(), ".cache");
-      return resolve19(base, "quiver", "update-check.json");
+      const base = process.env["XDG_CACHE_HOME"] || resolve21(homedir3(), ".cache");
+      return resolve21(base, "quiver", "update-check.json");
     };
     installHint = () => INSTALL_HINT;
     getCurrentVersion = () => {
       try {
         const pkg = JSON.parse(
-          readFileSync10(resolve19(packageRoot, "package.json"), "utf8")
+          readFileSync12(resolve21(packageRoot, "package.json"), "utf8")
         );
         return pkg.version;
       } catch {
@@ -3355,9 +3590,9 @@ var init_notifier = __esm({
     };
     readCache = () => {
       const path = cacheFilePath();
-      if (!existsSync14(path)) return null;
+      if (!existsSync15(path)) return null;
       try {
-        return JSON.parse(readFileSync10(path, "utf8"));
+        return JSON.parse(readFileSync12(path, "utf8"));
       } catch {
         return null;
       }
@@ -3366,7 +3601,7 @@ var init_notifier = __esm({
       try {
         const path = cacheFilePath();
         mkdirSync6(dirname6(path), { recursive: true });
-        writeFileSync8(path, JSON.stringify(cache, null, 2) + "\n");
+        writeFileSync9(path, JSON.stringify(cache, null, 2) + "\n");
       } catch {
       }
     };
@@ -3420,6 +3655,8 @@ Commands:
   init             Interactive picker over the catalog; write native configs + quiver.lock
   add <id>         Add an entry (skill:<name>, command:<name>, mcp:<name>, plugin:<name>)
   remove <id>      Remove a single entry; keep lockfile + configs consistent
+  disable <id>     Turn an MCP server off locally (mcp:<name>, gitignored override)
+  enable <id>      Turn a locally disabled MCP server back on
   sync             Regenerate provider configs from .agents/ (warns on drift)
   providers [a,b]  Change which tools get configs (claude, opencode, codex)
   update [id]      Pull newer catalog content into .agents/ (all or one entry)
@@ -3533,6 +3770,12 @@ var run = async () => {
       await remove2(options);
       break;
     }
+    case "enable":
+    case "disable": {
+      const { toggle: toggle2 } = await Promise.resolve().then(() => (init_toggle(), toggle_exports));
+      await toggle2(options, command === "enable");
+      break;
+    }
     case "sync": {
       const { sync: sync2 } = await Promise.resolve().then(() => (init_sync(), sync_exports));
       await sync2(options);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "quiver-cli",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "description": "Compose selected skills, commands, plugins and MCP servers from a central catalog into any repo as native configs for opencode, Claude Code and Codex - with lockfile-based drift awareness.",
   "type": "module",
   "bin": {