quiver-cli 1.1.0 → 1.3.0

package/README.md

@@ -160,9 +160,15 @@ This is the basis for `sync` and `check`.
   poisoning), shown as a readable before/after.
 
 The first successful introspection records a baseline; subsequent `check` runs
-diff against it. Servers that fail introspection (e.g. requiring interactive
-OAuth) are reported as skipped. stdio servers run foreign code and are only
-introspected with `--introspect-stdio`.
+diff against it. stdio servers run foreign code and are only introspected with
+`--introspect-stdio`.
+
+**OAuth-protected servers** (e.g. Linear): `check` reuses opencode's MCP
+credentials (`~/.local/share/opencode/mcp-auth.json`, read-only — quiver never
+refreshes or rewrites them). Authenticate once with
+`opencode mcp auth <name>`, then re-run `quiver-cli check` to record the tool
+snapshot. Without a valid token the server is skipped with an actionable hint,
+and `quiver-cli list` shows why the tool count is missing.
 
 Pass `--offline` to skip MCP re-introspection entirely and check only digests
 and provider shims — no network, no foreign code, useful for a fast local

package/dist/cli.js

@@ -2499,6 +2499,31 @@ var init_update = __esm({
   }
 });
 
+// src/mcp/tokens.ts
+var estimateTokens, formatTokens, sumTokens;
+var init_tokens = __esm({
+  "src/mcp/tokens.ts"() {
+    "use strict";
+    init_digest();
+    estimateTokens = (tool) => Math.ceil(
+      canonicalJson({
+        name: tool.name,
+        description: tool.description,
+        inputSchema: tool.inputSchema
+      }).length / 4
+    );
+    formatTokens = (n) => n < 1e3 ? `~${n} tok` : `~${(n / 1e3).toFixed(1)}k tok`;
+    sumTokens = (tools) => {
+      let total = 0;
+      for (const tool of Object.values(tools)) {
+        if (tool.tokens === void 0) return null;
+        total += tool.tokens;
+      }
+      return total;
+    };
+  }
+});
+
 // src/commands/list.ts
 var list_exports = {};
 __export(list_exports, {
@@ -2511,6 +2536,7 @@ var init_list = __esm({
     init_repo();
     init_io();
     init_schema();
+    init_tokens();
     init_local_config();
     init_prompts();
     truncate = (s, max) => {
@@ -2569,7 +2595,9 @@ var init_list = __esm({
                 transport: entry.transport,
                 enabled: !disabled.has(name),
                 detail: serverDetail2.get(name) ?? null,
-                toolCount: entry.tools ? Object.keys(entry.tools).length : null
+                toolCount: entry.tools ? Object.keys(entry.tools).length : null,
+                tokenEstimate: entry.tools ? sumTokens(entry.tools) : null,
+                authRequired: entry.authRequired ?? false
               })),
               plugins: plugins.map(({ name, entry }) => ({
                 name,
@@ -2609,6 +2637,7 @@ var init_list = __esm({
         }
       }
       let missingTools = false;
+      const needsAuth = [];
       if (mcp.length) {
         const nameW = Math.max(...mcp.map((e) => e.name.length));
         const toolW = Math.max(
@@ -2617,19 +2646,35 @@ var init_list = __esm({
             return `${n ?? "?"} tools`.length;
           })
         );
+        const tokenCell = (entry) => {
+          const total = entry.tools ? sumTokens(entry.tools) : null;
+          return total === null ? "? tok" : formatTokens(total);
+        };
+        const tokW = Math.max(...mcp.map((e) => tokenCell(e.entry).length));
         lines.push("", `  ${c.bold("mcp servers")}`);
         for (const { name, entry } of mcp) {
           const count = entry.tools ? Object.keys(entry.tools).length : null;
-          if (count === null) missingTools = true;
+          const tokenTotal = entry.tools ? sumTokens(entry.tools) : null;
+          if (count === null) {
+            if (entry.authRequired) needsAuth.push(name);
+            else missingTools = true;
+          } else if (tokenTotal === null) {
+            missingTools = true;
+          }
           const tools = padCell(
             `${count ?? "?"} tools`,
             toolW,
             count === null ? c.dim : c.green
           );
+          const tokens = padCell(
+            tokenCell(entry),
+            tokW,
+            tokenTotal === null ? c.dim : c.cyan
+          );
           const detail = serverDetail2.get(name);
           const off = disabled.has(name) ? `  ${c.yellow("disabled")}` : "";
           lines.push(
-            `    ${name.padEnd(nameW)} ${entry.transport.padEnd(5)} ${tools}` + (detail ? `  ${c.dim(detail)}` : "") + off
+            `    ${name.padEnd(nameW)} ${entry.transport.padEnd(5)} ${tools}  ${tokens}` + (detail ? `  ${c.dim(detail)}` : "") + off
           );
         }
       }
@@ -2647,8 +2692,181 @@ var init_list = __esm({
           `${skills.length} skills \xB7 ${commands.length} commands \xB7 ${mcp.length} MCP servers \xB7 ${plugins.length} plugins`
         )}  ${c.dim(`providers: ${providers2}`)}`
       );
+      for (const name of needsAuth) {
+        lines.push(
+          `  ${c.yellow(`${name} requires OAuth`)} ${c.dim(
+            `\u2014 run 'opencode mcp auth ${name}', then 'quiver-cli check'`
+          )}`
+        );
+      }
       if (missingTools) {
-        lines.push(`  ${c.dim("run 'quiver-cli check' to populate tool counts")}`);
+        lines.push(
+          `  ${c.dim("run 'quiver-cli check' to populate tool counts and token estimates")}`
+        );
+      }
+      lines.push("");
+      block(lines);
+    };
+  }
+});
+
+// src/commands/inspect.ts
+var inspect_exports = {};
+__export(inspect_exports, {
+  inspect: () => inspect
+});
+var truncate2, padCell2, byCost, inspect;
+var init_inspect = __esm({
+  "src/commands/inspect.ts"() {
+    "use strict";
+    init_repo();
+    init_io();
+    init_tokens();
+    init_local_config();
+    init_prompts();
+    truncate2 = (s, max) => {
+      const flat = s.replace(/\s+/g, " ").trim();
+      if (max < 1) return "";
+      return flat.length > max ? flat.slice(0, max - 1) + "\u2026" : flat;
+    };
+    padCell2 = (text, width, color) => color(text.padEnd(width));
+    byCost = (a, b) => (b.tool.tokens ?? -1) - (a.tool.tokens ?? -1) || a.name.localeCompare(b.name);
+    inspect = async (options) => {
+      const arg = options.positionals[0];
+      if (!arg) {
+        if (options.json) {
+          console.log(JSON.stringify({ ok: false, error: "missing-argument" }));
+        } else {
+          await error("Usage: quiver-cli inspect <mcp-name>");
+        }
+        process.exitCode = 1;
+        return;
+      }
+      const name = arg.startsWith("mcp:") ? arg.slice("mcp:".length) : arg;
+      const lock = readLockfile(options.targetRoot);
+      if (!lock) {
+        if (options.json) console.log(JSON.stringify({ ok: false, error: "no-lockfile" }));
+        else await error("No quiver.lock found. Run `quiver-cli init` first.");
+        process.exitCode = 1;
+        return;
+      }
+      const entry = lock.entries[`mcp:${name}`];
+      if (!entry || entry.type !== "mcp") {
+        const available = Object.keys(lock.entries).filter((id) => id.startsWith("mcp:")).map((id) => id.slice("mcp:".length)).sort();
+        if (options.json) {
+          console.log(
+            JSON.stringify({ ok: false, error: "unknown-server", available })
+          );
+        } else {
+          await error(
+            `Unknown MCP server "${name}".` + (available.length ? ` Available: ${available.join(", ")}` : "")
+          );
+        }
+        process.exitCode = 1;
+        return;
+      }
+      const mcpEntry = entry;
+      let detail = null;
+      if (repoCatalogExists(options.targetRoot)) {
+        const { catalog } = loadRepoCatalog(options.targetRoot, lock.catalog.source);
+        const cat = catalog.mcp.find((m) => m.name === name);
+        if (cat) {
+          detail = cat.server.transport === "http" ? cat.server.url : [cat.server.command, ...cat.server.args ?? []].join(" ");
+        }
+      }
+      const enabled = !disabledMcpServers(options.targetRoot).has(name);
+      const tools = mcpEntry.tools ? Object.entries(mcpEntry.tools).map(([toolName, tool]) => ({ name: toolName, tool })).sort(byCost) : null;
+      const total = mcpEntry.tools ? sumTokens(mcpEntry.tools) : null;
+      if (options.json) {
+        console.log(
+          JSON.stringify(
+            {
+              ok: true,
+              name,
+              transport: mcpEntry.transport,
+              detail,
+              enabled,
+              authRequired: mcpEntry.authRequired ?? false,
+              toolsFetchedAt: mcpEntry.toolsFetchedAt,
+              toolCount: tools ? tools.length : null,
+              tokenEstimate: total,
+              tools: tools ? tools.map(({ name: toolName, tool }) => ({
+                name: toolName,
+                description: tool.description,
+                tokens: tool.tokens ?? null,
+                inputSchemaHash: tool.inputSchemaHash
+              })) : null
+            },
+            null,
+            2
+          )
+        );
+        return;
+      }
+      const c = palette();
+      const term = process.stdout.columns ?? 80;
+      const lines = [""];
+      lines.push(
+        `  ${c.bold(name)} ${mcpEntry.transport}` + (detail ? `  ${c.dim(detail)}` : "") + (enabled ? "" : `  ${c.yellow("disabled")}`)
+      );
+      if (!tools) {
+        lines.push("", `  ${c.dim("no tool snapshot recorded yet")}`);
+        if (mcpEntry.authRequired) {
+          lines.push(
+            `  ${c.yellow(`${name} requires OAuth`)} ${c.dim(
+              `\u2014 run 'opencode mcp auth ${name}', then 'quiver-cli check'`
+            )}`
+          );
+        } else {
+          lines.push(`  ${c.dim("run 'quiver-cli check' to introspect this server")}`);
+        }
+        lines.push("");
+        block(lines);
+        return;
+      }
+      const summary = `${tools.length} tools` + (total !== null ? ` \xB7 ${formatTokens(total)}` : "");
+      lines.push(
+        `  ${c.bold(summary)}` + (mcpEntry.toolsFetchedAt ? `  ${c.dim(`snapshot from ${mcpEntry.toolsFetchedAt}`)}` : ""),
+        ""
+      );
+      const nameW = Math.max(...tools.map((t) => t.name.length));
+      const tokW = Math.max(
+        ...tools.map(
+          ({ tool }) => (tool.tokens === void 0 ? "? tok" : formatTokens(tool.tokens)).length
+        )
+      );
+      const descMax = term - (4 + nameW + 2 + tokW + 2) - 1;
+      let missingTokens = false;
+      for (const { name: toolName, tool } of tools) {
+        if (tool.tokens === void 0) missingTokens = true;
+        const tokens = padCell2(
+          tool.tokens === void 0 ? "? tok" : formatTokens(tool.tokens),
+          tokW,
+          tool.tokens === void 0 ? c.dim : c.cyan
+        );
+        if (options.verbose) {
+          lines.push(`    ${c.bold(toolName.padEnd(nameW))}  ${tokens}`);
+          for (const descLine of tool.description.split("\n")) {
+            lines.push(`      ${c.dim(descLine)}`);
+          }
+          lines.push("");
+        } else {
+          lines.push(
+            `    ${toolName.padEnd(nameW)}  ${tokens}  ${c.dim(
+              truncate2(tool.description, descMax)
+            )}`.trimEnd()
+          );
+        }
+      }
+      if (!options.verbose) lines.push("");
+      lines.push(`  ${c.dim("token counts are chars/4 estimates of name + description + input schema")}`);
+      if (!options.verbose) {
+        lines.push(`  ${c.dim("use --verbose for full descriptions")}`);
+      }
+      if (missingTokens) {
+        lines.push(
+          `  ${c.dim("run 'quiver-cli check' to populate missing token estimates")}`
+        );
       }
       lines.push("");
       block(lines);
@@ -2698,7 +2916,7 @@ var init_diff = __esm({
 });
 
 // src/mcp/introspect.ts
-var CONNECT_TIMEOUT_MS, withTimeout, introspect, errMsg;
+var CONNECT_TIMEOUT_MS, withTimeout, introspect, errMsg, isAuthError;
 var init_introspect = __esm({
   "src/mcp/introspect.ts"() {
     "use strict";
@@ -2714,13 +2932,20 @@ var init_introspect = __esm({
         clearTimeout(timer);
       }
     };
-    introspect = async (server, { allowStdio }) => {
+    introspect = async (server, { allowStdio, authToken }) => {
       const { Client } = await import("@modelcontextprotocol/sdk/client/index.js");
       let transport;
       try {
         if (server.transport === "http") {
           const { StreamableHTTPClientTransport } = await import("@modelcontextprotocol/sdk/client/streamableHttp.js");
-          const requestInit = server.headers ? { headers: server.headers } : {};
+          const headers2 = { ...server.headers ?? {} };
+          const hasAuthHeader = Object.keys(headers2).some(
+            (k) => k.toLowerCase() === "authorization"
+          );
+          if (authToken && !hasAuthHeader) {
+            headers2["Authorization"] = `Bearer ${authToken}`;
+          }
+          const requestInit = Object.keys(headers2).length ? { headers: headers2 } : {};
           transport = new StreamableHTTPClientTransport(new URL(server.url), {
             requestInit
           });
@@ -2755,6 +2980,9 @@ var init_introspect = __esm({
         }));
         return { ok: true, tools };
       } catch (e) {
+        if (await isAuthError(e)) {
+          return { ok: false, reason: errMsg(e), authRequired: true };
+        }
         return { ok: false, reason: errMsg(e) };
       } finally {
         try {
@@ -2764,38 +2992,101 @@ var init_introspect = __esm({
       }
     };
     errMsg = (e) => e instanceof Error ? e.message : String(e);
+    isAuthError = async (e) => {
+      try {
+        const { UnauthorizedError } = await import("@modelcontextprotocol/sdk/client/auth.js");
+        if (e instanceof UnauthorizedError) return true;
+      } catch {
+      }
+      if (typeof e === "object" && e !== null && e.code === 401) {
+        return true;
+      }
+      return /\b401\b|unauthorized|invalid_token/i.test(errMsg(e));
+    };
+  }
+});
+
+// src/mcp/opencode-auth.ts
+import { readFileSync as readFileSync10 } from "fs";
+import { homedir as homedir2 } from "os";
+import { resolve as resolve18 } from "path";
+var EXPIRY_SKEW_MS, authFilePath, normalizeUrl, findOpencodeToken;
+var init_opencode_auth = __esm({
+  "src/mcp/opencode-auth.ts"() {
+    "use strict";
+    EXPIRY_SKEW_MS = 3e4;
+    authFilePath = () => {
+      const base = process.env["XDG_DATA_HOME"] || resolve18(homedir2(), ".local", "share");
+      return resolve18(base, "opencode", "mcp-auth.json");
+    };
+    normalizeUrl = (url) => url.trim().replace(/\/+$/, "").toLowerCase();
+    findOpencodeToken = (name, url) => {
+      let data;
+      try {
+        data = JSON.parse(readFileSync10(authFilePath(), "utf8"));
+      } catch {
+        return { status: "none" };
+      }
+      if (typeof data !== "object" || data === null) return { status: "none" };
+      const entries = data;
+      const target = normalizeUrl(url);
+      const entry = Object.values(entries).find(
+        (e) => e?.serverUrl && normalizeUrl(e.serverUrl) === target
+      ) ?? entries[name];
+      const tokens = entry?.tokens;
+      if (!tokens?.accessToken) return { status: "none" };
+      if (typeof tokens.expiresAt === "number") {
+        const expiresMs = tokens.expiresAt > 1e12 ? tokens.expiresAt : tokens.expiresAt * 1e3;
+        if (expiresMs - EXPIRY_SKEW_MS <= Date.now()) return { status: "expired" };
+      }
+      return { status: "ok", accessToken: tokens.accessToken };
+    };
   }
 });
 
 // src/mcp/snapshot.ts
-var toSnapshot;
+var toSnapshot, backfillTokens;
 var init_snapshot = __esm({
   "src/mcp/snapshot.ts"() {
     "use strict";
     init_digest();
+    init_tokens();
     toSnapshot = (tools) => {
       const snapshot = {};
       for (const tool of tools) {
         snapshot[tool.name] = {
           description: tool.description,
-          inputSchemaHash: jsonDigest(tool.inputSchema)
+          inputSchemaHash: jsonDigest(tool.inputSchema),
+          tokens: estimateTokens(tool)
         };
       }
       return snapshot;
     };
+    backfillTokens = (stored, current) => {
+      let changed = false;
+      for (const [name, tool] of Object.entries(stored)) {
+        const estimate = current[name]?.tokens;
+        if (tool.tokens === void 0 && estimate !== void 0) {
+          tool.tokens = estimate;
+          changed = true;
+        }
+      }
+      return changed;
+    };
   }
 });
 
 // src/commands/check.ts
 var check_exports = {};
 __export(check_exports, {
+  authHint: () => authHint,
   check: () => check,
   hasCommand: () => hasCommand,
   summarize: () => summarize
 });
 import { accessSync as accessSync2, constants as constants2 } from "fs";
-import { delimiter, resolve as resolve18 } from "path";
-var check, report2, driftLines, list2, recommend, summarize, hasCommand, truncate2, fail;
+import { delimiter, resolve as resolve19 } from "path";
+var check, report2, driftLines, list2, recommend, summarize, authHint, hasCommand, truncate3, fail;
 var init_check = __esm({
   "src/commands/check.ts"() {
     "use strict";
@@ -2804,6 +3095,7 @@ var init_check = __esm({
     init_schema();
     init_diff();
     init_introspect();
+    init_opencode_auth();
     init_snapshot();
     init_local_config();
     init_write();
@@ -2867,13 +3159,27 @@ var init_check = __esm({
         }
         checked.mcp += 1;
         const server = interpolateEnvVars(catMcp.server);
-        const res = await introspect(server, { allowStdio: options.introspectStdio });
+        const mcpEntry = entry;
+        const cred = server.transport === "http" ? findOpencodeToken(p.name, server.url) : { status: "none" };
+        const res = await introspect(server, {
+          allowStdio: options.introspectStdio,
+          authToken: cred.status === "ok" ? cred.accessToken : void 0
+        });
         if (!res.ok) {
-          mcpReports.push({ id, status: "skipped", reason: res.reason });
+          if (res.authRequired && !mcpEntry.authRequired) {
+            mcpEntry.authRequired = true;
+            lockChanged = true;
+          }
+          const reason = res.authRequired ? authHint(cred.status, p.name) : res.reason;
+          mcpReports.push({
+            id,
+            status: "skipped",
+            reason,
+            ...res.authRequired ? { authRequired: true } : {}
+          });
           continue;
         }
         const current = toSnapshot(res.tools);
-        const mcpEntry = entry;
         if (!mcpEntry.tools) {
           mcpEntry.tools = current;
           mcpEntry.toolsFetchedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -2883,6 +3189,7 @@ var init_check = __esm({
         }
         const diff = diffSnapshots(mcpEntry.tools, current);
         if (isEmptyDiff(diff)) {
+          if (backfillTokens(mcpEntry.tools, current)) lockChanged = true;
           mcpReports.push({ id, status: "ok" });
         } else if (options.accept) {
           mcpEntry.tools = current;
@@ -2942,7 +3249,15 @@ var init_check = __esm({
   - ${shimProblems.join("\n  - ")}`
         );
       }
-      const skipped = mcpReports.filter((r) => r.status === "skipped");
+      const authSkipped = mcpReports.filter(
+        (r) => r.status === "skipped" && r.authRequired
+      );
+      for (const r of authSkipped) {
+        await warn(`${r.id}: ${r.reason}`);
+      }
+      const skipped = mcpReports.filter(
+        (r) => r.status === "skipped" && !r.authRequired
+      );
       if (skipped.length) {
         const names = skipped.map((r) => parseEntryId(r.id)?.name ?? r.id);
         await info(
@@ -2991,8 +3306,8 @@ var init_check = __esm({
           for (const d of dc) {
             lines.push(
               `  "${d.name}":
-      before: ${truncate2(d.before)}
-      after:  ${truncate2(d.after)}`
+      before: ${truncate3(d.before)}
+      after:  ${truncate3(d.after)}`
             );
           }
         }
@@ -3036,13 +3351,19 @@ var init_check = __esm({
       if (c.plugins) parts.push(plural(c.plugins, "plugin"));
       return parts.length ? parts.join(", ") : "nothing";
     };
+    authHint = (cred, name) => {
+      const reauth = `run 'opencode mcp auth ${name}', then 'quiver-cli check'`;
+      if (cred === "expired") return `OAuth token expired \u2014 re-${reauth}`;
+      if (cred === "ok") return `OAuth token rejected \u2014 re-${reauth}`;
+      return `requires OAuth \u2014 ${reauth}`;
+    };
     hasCommand = (command) => {
       if (!/^[A-Za-z0-9._-]+$/.test(command)) return false;
       const extensions = process.platform === "win32" ? (process.env["PATHEXT"] ?? ".EXE;.CMD;.BAT;.COM").split(";") : [""];
       for (const dir of (process.env["PATH"] ?? "").split(delimiter)) {
         for (const extension of extensions) {
           try {
-            accessSync2(resolve18(dir, command + extension), constants2.X_OK);
+            accessSync2(resolve19(dir, command + extension), constants2.X_OK);
             return true;
           } catch {
           }
@@ -3050,7 +3371,7 @@ var init_check = __esm({
       }
       return false;
     };
-    truncate2 = (s, max = 120) => s.length > max ? s.slice(0, max) + "\u2026" : s;
+    truncate3 = (s, max = 120) => s.length > max ? s.slice(0, max) + "\u2026" : s;
     fail = async (options, code, message) => {
       if (options.json) console.log(JSON.stringify({ ok: false, error: code }));
       else await error(message);
@@ -3064,12 +3385,12 @@ import { execFileSync as execFileSync3 } from "child_process";
 import {
   existsSync as existsSync14,
   mkdtempSync as mkdtempSync2,
-  readFileSync as readFileSync10,
+  readFileSync as readFileSync11,
   rmSync as rmSync7,
   writeFileSync as writeFileSync8
 } from "fs";
 import { tmpdir } from "os";
-import { join, resolve as resolve19 } from "path";
+import { join, resolve as resolve20 } from "path";
 var UPSTREAMS_FILE, upstreamsPath, loadUpstreams, writeUpstreams, fetchLatestCommit, fetchUpstreamDir, short, evaluateOrigin;
 var init_upstreams = __esm({
   "src/catalog/upstreams.ts"() {
@@ -3077,11 +3398,11 @@ var init_upstreams = __esm({
     init_auth();
     init_auth();
     UPSTREAMS_FILE = "upstreams.json";
-    upstreamsPath = (catalog) => resolve19(catalog.root, UPSTREAMS_FILE);
+    upstreamsPath = (catalog) => resolve20(catalog.root, UPSTREAMS_FILE);
     loadUpstreams = (catalog) => {
       const path = upstreamsPath(catalog);
       if (!existsSync14(path)) return {};
-      return JSON.parse(readFileSync10(path, "utf8"));
+      return JSON.parse(readFileSync11(path, "utf8"));
     };
     writeUpstreams = (catalog, map) => {
       writeFileSync8(upstreamsPath(catalog), JSON.stringify(map, null, 2) + "\n");
@@ -3149,8 +3470,8 @@ var init_upstreams = __esm({
         const msg = err instanceof Error && "stderr" in err ? String(err.stderr).trim().split("\n").pop() : err instanceof Error ? err.message : "git clone failed";
         return { ok: false, reason: msg || "git clone failed" };
       }
-      const dir = resolve19(tmp, origin.path);
-      if (!existsSync14(resolve19(dir, "SKILL.md"))) {
+      const dir = resolve20(tmp, origin.path);
+      if (!existsSync14(resolve20(dir, "SKILL.md"))) {
         cleanup();
         return { ok: false, reason: `no SKILL.md at ${origin.path} in ${origin.repo}` };
       }
@@ -3443,9 +3764,9 @@ __export(notifier_exports, {
   installHint: () => installHint,
   notifierSuppressed: () => notifierSuppressed
 });
-import { existsSync as existsSync15, mkdirSync as mkdirSync6, readFileSync as readFileSync11, writeFileSync as writeFileSync9 } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname6, resolve as resolve20 } from "path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync6, readFileSync as readFileSync12, writeFileSync as writeFileSync9 } from "fs";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname6, resolve as resolve21 } from "path";
 var REGISTRY_URL, CHECK_TTL_MS, FETCH_TIMEOUT_MS, INSTALL_HINT, cacheFilePath, installHint, getCurrentVersion, compareSemver, readCache, writeCache, fetchLatestVersion, checkForUpdate, notifierSuppressed;
 var init_notifier = __esm({
   "src/version/notifier.ts"() {
@@ -3456,14 +3777,14 @@ var init_notifier = __esm({
     FETCH_TIMEOUT_MS = 2e3;
     INSTALL_HINT = "pnpm add -g quiver-cli";
     cacheFilePath = () => {
-      const base = process.env["XDG_CACHE_HOME"] || resolve20(homedir2(), ".cache");
-      return resolve20(base, "quiver", "update-check.json");
+      const base = process.env["XDG_CACHE_HOME"] || resolve21(homedir3(), ".cache");
+      return resolve21(base, "quiver", "update-check.json");
     };
     installHint = () => INSTALL_HINT;
     getCurrentVersion = () => {
       try {
         const pkg = JSON.parse(
-          readFileSync11(resolve20(packageRoot, "package.json"), "utf8")
+          readFileSync12(resolve21(packageRoot, "package.json"), "utf8")
         );
         return pkg.version;
       } catch {
@@ -3491,7 +3812,7 @@ var init_notifier = __esm({
       const path = cacheFilePath();
       if (!existsSync15(path)) return null;
       try {
-        return JSON.parse(readFileSync11(path, "utf8"));
+        return JSON.parse(readFileSync12(path, "utf8"));
       } catch {
         return null;
       }
@@ -3560,6 +3881,7 @@ Commands:
   providers [a,b]  Change which tools get configs (claude, opencode, codex)
   update [id]      Pull newer catalog content into .agents/ (all or one entry)
   list             Show installed entries (skills, commands, plugins, MCP tool counts)
+  inspect <name>   Show an MCP server's tools with descriptions and token cost
   check            Detect drift: skill digests, provider shims, MCP tool
                    snapshots (--offline skips MCP re-introspection)
   upstream         Catalog maintenance: check source repos for skill updates
@@ -3571,8 +3893,9 @@ Commands:
 Options:
   -f, --force          Overwrite existing files
   --all, -y            Keep everything without prompting (non-interactive)
-  --json               Machine-readable output (check/upstream/list)
-  -V, --verbose        Show full tool lists and description diffs (check)
+  --json               Machine-readable output (check/upstream/list/inspect)
+  -V, --verbose        Show full tool lists and description diffs (check);
+                       full tool descriptions (inspect)
   --accept             Record the current MCP tool snapshots as the new baseline (check)
   --offline            Skip MCP re-introspection; check digests + shims only (check)
   --dry-run            Report what would change without writing (update)
@@ -3696,6 +4019,11 @@ var run = async () => {
       await list3(options);
       break;
     }
+    case "inspect": {
+      const { inspect: inspect2 } = await Promise.resolve().then(() => (init_inspect(), inspect_exports));
+      await inspect2(options);
+      break;
+    }
     case "check": {
       const { check: check2 } = await Promise.resolve().then(() => (init_check(), check_exports));
       await check2(options);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "quiver-cli",
-  "version": "1.1.0",
+  "version": "1.3.0",
   "description": "Compose selected skills, commands, plugins and MCP servers from a central catalog into any repo as native configs for opencode, Claude Code and Codex - with lockfile-based drift awareness.",
   "type": "module",
   "bin": {