unbrowse 12.0.0 → 12.1.0

package/README.md

@@ -18,7 +18,8 @@ unbrowse resume <runId> origin=SIN           # answer on the same run
 | `learn a.har b.har`, `learned [id]` | Teach a site from two recordings |
 | `logins`, `logins remove <origin>` | Saved logins, masked. The CLI never takes a password |
 | `registry [query]`, `site <host>` | Public compiled sites, no account |
-| `install` | Add the hosted MCP to Claude Code, Codex and others |
+
+The CLI is the REST client. The remote MCP is a separate client; see the [install guide](https://github.com/unbrowse-ai/unbrowse-skill/blob/main/docs/install.md).
 
 Exit codes: 0 accepted/ok (check status and verified), 1 error, 2 input required, 3 sign-in or saved login needed, 4 not verified.
 Env: `UNBROWSE_API_KEY`, `UNBROWSE_BASE_URL`. Node 18.17+, no dependencies.

package/SKILL.md

@@ -25,10 +25,21 @@ CLI installation and SDK instructions: https://github.com/unbrowse-ai/unbrowse-s
 Use the client version identified there; older npm versions may target a different service.
 For automation, supply an API key via `UNBROWSE_API_KEY` using the caller's secret manager. Do not put keys into committed config, prompts, command arguments or logs. Create a key in the signed-in console at https://unbrowse.ai/app.
 
+## Host plugins
+
+Packaged installs that bundle this skill, connect Unbrowse and redirect the host's own browser to it (https://github.com/unbrowse-ai/unbrowse/tree/main/plugins):
+
+- Claude Code: `claude plugin marketplace add unbrowse-ai/unbrowse`, then `claude plugin install unbrowse@unbrowse`.
+- Codex: `codex plugin marketplace add unbrowse-ai/unbrowse`, then `codex plugin add unbrowse@unbrowse`; set `web_search = "disabled"` to drop built-in search.
+- Grok Build: `grok plugin install unbrowse-ai/unbrowse#plugins/grok-build --trust`.
+- OpenClaw (`@unbrowse/openclaw`), Hermes (`plugins/hermes`), elizaOS (`@unbrowse/plugin-unbrowse`): native tools or actions over the same MCP.
+
+Hosts that need a stdio server or reject dotted tool names can run `npx unbrowse mcp`: tool names there use `_` (`unbrowse_scrape`). With a plugin installed, built-in web fetch, web search and browser navigation to non-local URLs are refused with a pointer to the matching Unbrowse tool; `UNBROWSE_ALLOW_BUILTIN_BROWSER=1` lifts that for a session.
+
 ## Choose the interface
 
 - MCP: discovery, runs, page reading, cloud browsing, saved-login requests and live canvas cards.
-- CLI: `unbrowse discover`, `run`, `inspect`, `resume`, `registry`; `unbrowse install` prints MCP configuration. `unbrowse help` describes the installed version.
+- CLI: `unbrowse discover`, `run`, `inspect`, `resume`, `registry`. It calls the REST API and is not an MCP client. `unbrowse help` describes the installed version.
 - SDK: REST integration and scripting. Consult the public SDK docs for its supported methods; MCP tools and REST methods are not interchangeable names.
 
 Core MCP tools: `unbrowse.discover`, `unbrowse.run`, `unbrowse.inspect`, `unbrowse.resume`, `unbrowse.cancel`, `unbrowse.scrape`, `unbrowse.map`, `unbrowse.sites`, `unbrowse.usage`, `unbrowse.credits`, `unbrowse.forget`, `unbrowse.learn`, `unbrowse.index`, `unbrowse.index.status`, `unbrowse.credentials.list`, `unbrowse.credentials.request`, `unbrowse.credentials.status`, and the cloud browser `unbrowse.browse.open`, `unbrowse.browse.snapshot`, `unbrowse.browse.act`, `unbrowse.browse.finish`, `unbrowse.browse.close`.

package/dist/cli.js

@@ -1,166 +1,17 @@
 #!/usr/bin/env node
-
-// src/cli.ts
-import { spawn } from "node:child_process";
-import { randomUUID } from "node:crypto";
-import { readFileSync as readFileSync2 } from "node:fs";
-
-// src/auth.ts
-import { createHash, randomBytes } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { createServer } from "node:http";
-import { homedir } from "node:os";
-import { dirname, join } from "node:path";
-function configPath() {
-  const root = process.env.UNBROWSE_CONFIG_DIR ?? join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "unbrowse");
-  return join(root, "cli.json");
-}
-function load() {
-  const path = configPath();
-  if (!existsSync(path))
-    return {};
-  try {
-    return JSON.parse(readFileSync(path, "utf8"));
-  } catch {
-    return {};
-  }
-}
-function save(stored) {
-  const path = configPath();
-  mkdirSync(dirname(path), { recursive: true, mode: 448 });
-  writeFileSync(path, JSON.stringify(stored, null, 2), { mode: 384 });
-  chmodSync(path, 384);
-}
-function clear() {
-  rmSync(configPath(), { force: true });
-}
-async function currentToken(baseUrl, fetchImpl = fetch) {
-  if (process.env.UNBROWSE_API_KEY)
-    return process.env.UNBROWSE_API_KEY;
-  const stored = load();
-  if (stored.baseUrl && stored.baseUrl !== baseUrl)
-    return;
-  if (stored.apiKey)
-    return stored.apiKey;
-  const o = stored.oauth;
-  if (!o)
-    return;
-  if (o.expiresAt && o.refreshToken && Date.now() > o.expiresAt - 60000) {
+var __esm = (fn, res, err) => () => {
+  if (fn)
     try {
-      const fresh = await tokenRequest(baseUrl, { grant_type: "refresh_token", refresh_token: o.refreshToken, client_id: o.clientId }, fetchImpl);
-      save({ ...stored, oauth: { clientId: o.clientId, ...fresh, refreshToken: fresh.refreshToken ?? o.refreshToken } });
-      return fresh.accessToken;
-    } catch {
-      return o.accessToken;
+      res = fn(fn = 0);
+    } catch (e) {
+      err = [e];
     }
-  }
-  return o.accessToken;
-}
-function describe(baseUrl) {
-  if (process.env.UNBROWSE_API_KEY)
-    return "API key from UNBROWSE_API_KEY";
-  const stored = load();
-  if (stored.baseUrl && stored.baseUrl !== baseUrl)
-    return `not signed in to ${baseUrl} (stored login is for ${stored.baseUrl})`;
-  if (stored.apiKey)
-    return `API key ${mask(stored.apiKey)} in ${configPath()}`;
-  if (stored.oauth)
-    return `OAuth sign-in in ${configPath()}`;
-  return "not signed in";
-}
-function mask(key) {
-  return key.length <= 12 ? "…" : `${key.slice(0, 8)}…${key.slice(-4)}`;
-}
-async function tokenRequest(baseUrl, form, fetchImpl) {
-  const res = await fetchImpl(`${baseUrl}/oauth/token`, {
-    method: "POST",
-    headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
-    body: new URLSearchParams(form).toString()
-  });
-  const body = await res.json().catch(() => ({}));
-  if (!res.ok || !body.access_token)
-    throw new Error(body.error_description ?? body.error ?? `token endpoint answered HTTP ${res.status}`);
-  return { accessToken: body.access_token, refreshToken: body.refresh_token, expiresAt: body.expires_in ? Date.now() + body.expires_in * 1000 : undefined };
-}
-var b64url = (buf) => buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-async function oauthLogin(baseUrl, opts) {
-  const fetchImpl = opts.fetch ?? fetch;
-  const verifier = b64url(randomBytes(32));
-  const challenge = b64url(createHash("sha256").update(verifier).digest());
-  const state = b64url(randomBytes(16));
-  let settle;
-  const got = new Promise((r) => settle = r);
-  const server = createServer((req, res) => {
-    const u = new URL(req.url ?? "/", "http://127.0.0.1");
-    if (u.pathname !== "/callback") {
-      res.writeHead(404).end();
-      return;
-    }
-    const ok = u.searchParams.get("state") === state && !!u.searchParams.get("code");
-    res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
-    res.end(ok ? "<p>Signed in to Unbrowse. You can close this tab.</p>" : "<p>Sign-in failed. Return to the terminal.</p>");
-    settle(ok ? { code: u.searchParams.get("code") } : { error: u.searchParams.get("error_description") ?? u.searchParams.get("error") ?? "state mismatch" });
-  });
-  await new Promise((r) => server.listen(0, "127.0.0.1", r));
-  const port = server.address().port;
-  const redirectUri = `http://127.0.0.1:${port}/callback`;
-  try {
-    const reg = await fetchImpl(`${baseUrl}/oauth/register`, {
-      method: "POST",
-      headers: { "content-type": "application/json", accept: "application/json" },
-      body: JSON.stringify({
-        client_name: "Unbrowse CLI",
-        redirect_uris: [redirectUri],
-        grant_types: ["authorization_code", "refresh_token"],
-        response_types: ["code"],
-        token_endpoint_auth_method: "none"
-      })
-    });
-    const client = await reg.json().catch(() => ({}));
-    if (!reg.ok || !client.client_id)
-      throw new Error(`client registration failed: ${client.error_description ?? `HTTP ${reg.status}`}`);
-    const url = new URL(`${baseUrl}/authorize`);
-    url.search = new URLSearchParams({
-      response_type: "code",
-      client_id: client.client_id,
-      redirect_uri: redirectUri,
-      code_challenge: challenge,
-      code_challenge_method: "S256",
-      state,
-      scope: "unbrowse",
-      resource: `${baseUrl}/mcp`
-    }).toString();
-    opts.log(`Opening ${url.origin}/authorize in your browser. If it does not open, visit:
-${url.toString()}`);
-    opts.open(url.toString());
-    const timer = setTimeout(() => settle({ error: "timed out waiting for the browser sign-in" }), opts.timeoutMs ?? 300000);
-    const answer = await got;
-    clearTimeout(timer);
-    if (!answer.code)
-      throw new Error(answer.error ?? "sign-in failed");
-    const tokens = await tokenRequest(baseUrl, { grant_type: "authorization_code", code: answer.code, redirect_uri: redirectUri, client_id: client.client_id, code_verifier: verifier }, fetchImpl);
-    save({ baseUrl, oauth: { clientId: client.client_id, ...tokens } });
-  } finally {
-    server.close();
-  }
-}
+  if (err)
+    throw err[0];
+  return res;
+};
 
 // ../sdk/src/client.ts
-var DEFAULT_BASE_URL = "https://unbrowse.ai/api/v1";
-
-class UnbrowseError extends Error {
-  status;
-  code;
-  body;
-  constructor(message, status, code, body) {
-    super(message);
-    this.status = status;
-    this.code = code;
-    this.body = body;
-    this.name = "UnbrowseError";
-  }
-}
-var env = (name) => (typeof process !== "undefined" ? process.env?.[name] : undefined) || undefined;
 function apiBase(url) {
   const u = url.replace(/\/+$/, "");
   return /\/api\/v1$/.test(u) ? u : `${u}/api/v1`;
@@ -308,16 +159,341 @@ function normalizeHost(site) {
     host = new URL(host).hostname;
   return host.replace(/\/.*$/, "").replace(/^www\./, "");
 }
-// ../sdk/src/mcp-install.ts
-function mcpCommands(url) {
-  return {
-    claudeCode: `claude mcp add --transport http unbrowse ${url}`,
-    codex: `codex mcp add unbrowse --url ${url} && codex mcp login unbrowse`,
-    json: JSON.stringify({ mcpServers: { unbrowse: { url } } }, null, 2)
+var DEFAULT_BASE_URL = "https://unbrowse.ai/api/v1", UnbrowseError, env = (name) => (typeof process !== "undefined" ? process.env?.[name] : undefined) || undefined;
+var init_client = __esm(() => {
+  UnbrowseError = class UnbrowseError extends Error {
+    status;
+    code;
+    body;
+    constructor(message, status, code, body) {
+      super(message);
+      this.status = status;
+      this.code = code;
+      this.body = body;
+      this.name = "UnbrowseError";
+    }
+  };
+});
+// ../sdk/src/mcp.ts
+function parseRpcBody(text) {
+  const trimmed = text.trim();
+  if (trimmed.startsWith("{"))
+    return JSON.parse(trimmed);
+  const events = trimmed.split(/\n\n+/).flatMap((block) => {
+    const data = block.split(`
+`).filter((l) => l.startsWith("data:")).map((l) => l.slice(5).trimStart()).join(`
+`);
+    return data ? [data] : [];
+  });
+  if (!events.length)
+    throw new UnbrowseError("Empty MCP response", 502, "mcp_empty");
+  return JSON.parse(events[events.length - 1]);
+}
+
+class UnbrowseMcp {
+  url;
+  apiKey;
+  endUser;
+  client;
+  fetchImpl;
+  nextId = 1;
+  constructor(opts = {}) {
+    this.url = (opts.url ?? env2("UNBROWSE_MCP_URL") ?? DEFAULT_MCP_URL).replace(/\/+$/, "");
+    this.apiKey = opts.apiKey ?? env2("UNBROWSE_API_KEY");
+    this.endUser = opts.endUser ?? env2("UNBROWSE_END_USER");
+    this.client = opts.client ?? "sdk";
+    this.fetchImpl = opts.fetch ?? ((...a) => globalThis.fetch(...a));
+  }
+  async rpc(method, params) {
+    const res = await this.fetchImpl(this.url, {
+      method: "POST",
+      headers: {
+        ...this.apiKey ? { authorization: `Bearer ${this.apiKey}` } : {},
+        ...this.endUser ? { "x-unbrowse-end-user": this.endUser } : {},
+        "content-type": "application/json",
+        accept: "application/json, text/event-stream",
+        "mcp-protocol-version": MCP_PROTOCOL_VERSION,
+        "user-agent": `unbrowse-${this.client}`
+      },
+      body: JSON.stringify({ jsonrpc: "2.0", id: this.nextId++, method, ...params ? { params } : {} })
+    });
+    const text = await res.text();
+    if (!res.ok) {
+      let body = {};
+      try {
+        body = JSON.parse(text);
+      } catch {}
+      const err = typeof body.error === "object" ? body.error : undefined;
+      throw new UnbrowseError(err?.message ?? body.error_description ?? (res.statusText || `HTTP ${res.status}`), res.status, err?.code ?? (typeof body.error === "string" ? body.error : "http_error"), body);
+    }
+    const msg = parseRpcBody(text);
+    if (msg.error)
+      throw new UnbrowseError(msg.error.message, 200, msg.error.data?.code ?? `rpc_${msg.error.code}`, msg.error);
+    return msg.result;
+  }
+  async listTools() {
+    const tools = [];
+    let cursor;
+    do {
+      const page = await this.rpc("tools/list", cursor ? { cursor } : undefined);
+      tools.push(...page.tools);
+      cursor = page.nextCursor;
+    } while (cursor);
+    return tools;
+  }
+  callTool(name, args = {}) {
+    return this.rpc("tools/call", { name, arguments: args });
+  }
+}
+var DEFAULT_MCP_URL = "https://unbrowse.ai/mcp", MCP_PROTOCOL_VERSION = "2025-11-25", env2 = (name) => (typeof process !== "undefined" ? process.env?.[name] : undefined) || undefined;
+var init_mcp = __esm(() => {
+  init_client();
+});
+
+// ../sdk/src/index.ts
+var init_src = __esm(() => {
+  init_client();
+  init_mcp();
+});
+
+// src/mcp-proxy.ts
+import { createInterface } from "node:readline";
+function safeToolName(name) {
+  return name.replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 64);
+}
+function createProxy(upstream, version) {
+  const names = new Map;
+  async function list() {
+    const tools = await (await upstream()).listTools();
+    names.clear();
+    const out = [];
+    for (const t of tools) {
+      const safe = safeToolName(t.name);
+      if (names.has(safe))
+        continue;
+      names.set(safe, t.name);
+      out.push({ ...t, name: safe });
+    }
+    return out;
+  }
+  async function original(safe) {
+    if (!names.has(safe))
+      await list();
+    return names.get(safe) ?? safe;
+  }
+  return async function handle(msg) {
+    if (msg.id === undefined || msg.id === null)
+      return;
+    const reply = (result) => ({ jsonrpc: "2.0", id: msg.id, result });
+    try {
+      switch (msg.method) {
+        case "initialize": {
+          const asked = String(msg.params?.protocolVersion ?? "");
+          return reply({
+            protocolVersion: PROTOCOLS.includes(asked) ? asked : PROTOCOLS[0],
+            capabilities: { tools: { listChanged: false } },
+            serverInfo: { name: "unbrowse", title: "Unbrowse (local proxy to the hosted MCP)", version },
+            instructions: "Unbrowse is the browserless browser. Prefer unbrowse_discover then unbrowse_run; unbrowse_scrape reads a page; unbrowse_browse_* drive the cloud browser. input_required is not a failure: answer it with unbrowse_resume."
+          });
+        }
+        case "ping":
+          return reply({});
+        case "tools/list":
+          return reply({ tools: await list() });
+        case "tools/call": {
+          const name = String(msg.params?.name ?? "");
+          return reply(await (await upstream()).rpc("tools/call", { ...msg.params, name: await original(name) }));
+        }
+        default:
+          return reply(await (await upstream()).rpc(String(msg.method), msg.params));
+      }
+    } catch (e) {
+      const err = e;
+      const code = err instanceof UnbrowseError ? err.code : "proxy_error";
+      const hint = err instanceof UnbrowseError && err.status === 401 ? " Run `unbrowse login` (or set UNBROWSE_API_KEY) and restart this server." : "";
+      return { jsonrpc: "2.0", id: msg.id, error: { code: -32000, message: `${err.message}${hint}`, data: { code } } };
+    }
   };
 }
+async function serveStdio(opts) {
+  const handle = createProxy(async () => new UnbrowseMcp({ url: opts.url, apiKey: await opts.token() ?? "", endUser: opts.endUser, client: `cli-mcp/${opts.version}` }), opts.version);
+  const write = (m) => new Promise((resolve) => process.stdout.write(`${JSON.stringify(m)}
+`, () => resolve()));
+  const rl = createInterface({ input: process.stdin, crlfDelay: Infinity });
+  const pending = new Set;
+  for await (const line of rl) {
+    if (!line.trim())
+      continue;
+    let msg;
+    try {
+      msg = JSON.parse(line);
+    } catch {
+      pending.add(write({ jsonrpc: "2.0", id: null, error: { code: -32700, message: "Parse error" } }));
+      continue;
+    }
+    const p = handle(msg).then((res) => res ? write(res) : undefined);
+    pending.add(p);
+    p.finally(() => pending.delete(p));
+  }
+  await Promise.all(pending);
+}
+var PROTOCOLS;
+var init_mcp_proxy = __esm(() => {
+  init_src();
+  PROTOCOLS = ["2025-11-25", "2025-06-18", "2025-03-26", "2024-11-05"];
+});
+
 // src/cli.ts
-var VERSION = "12.0.0";
+import { spawn } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { readFileSync as readFileSync2 } from "node:fs";
+
+// src/auth.ts
+import { createHash, randomBytes } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { createServer } from "node:http";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+function configPath() {
+  const root = process.env.UNBROWSE_CONFIG_DIR ?? join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "unbrowse");
+  return join(root, "cli.json");
+}
+function load() {
+  const path = configPath();
+  if (!existsSync(path))
+    return {};
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function save(stored) {
+  const path = configPath();
+  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  writeFileSync(path, JSON.stringify(stored, null, 2), { mode: 384 });
+  chmodSync(path, 384);
+}
+function clear() {
+  rmSync(configPath(), { force: true });
+}
+async function currentToken(baseUrl, fetchImpl = fetch) {
+  if (process.env.UNBROWSE_API_KEY)
+    return process.env.UNBROWSE_API_KEY;
+  const stored = load();
+  if (stored.baseUrl && stored.baseUrl !== baseUrl)
+    return;
+  if (stored.apiKey)
+    return stored.apiKey;
+  const o = stored.oauth;
+  if (!o)
+    return;
+  if (o.expiresAt && o.refreshToken && Date.now() > o.expiresAt - 60000) {
+    try {
+      const fresh = await tokenRequest(baseUrl, { grant_type: "refresh_token", refresh_token: o.refreshToken, client_id: o.clientId, resource: apiResource(baseUrl) }, fetchImpl);
+      save({ ...stored, oauth: { clientId: o.clientId, ...fresh, refreshToken: fresh.refreshToken ?? o.refreshToken } });
+      return fresh.accessToken;
+    } catch {
+      return o.accessToken;
+    }
+  }
+  return o.accessToken;
+}
+function describe(baseUrl) {
+  if (process.env.UNBROWSE_API_KEY)
+    return "API key from UNBROWSE_API_KEY";
+  const stored = load();
+  if (stored.baseUrl && stored.baseUrl !== baseUrl)
+    return `not signed in to ${baseUrl} (stored login is for ${stored.baseUrl})`;
+  if (stored.apiKey)
+    return `API key ${mask(stored.apiKey)} in ${configPath()}`;
+  if (stored.oauth)
+    return `OAuth sign-in in ${configPath()}`;
+  return "not signed in";
+}
+function mask(key) {
+  return key.length <= 12 ? "…" : `${key.slice(0, 8)}…${key.slice(-4)}`;
+}
+function apiResource(baseUrl) {
+  return `${baseUrl.replace(/\/+$/, "")}/api`;
+}
+async function tokenRequest(baseUrl, form, fetchImpl) {
+  const res = await fetchImpl(`${baseUrl}/oauth/token`, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+    body: new URLSearchParams(form).toString()
+  });
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok || !body.access_token)
+    throw new Error(body.error_description ?? body.error ?? `token endpoint answered HTTP ${res.status}`);
+  return { accessToken: body.access_token, refreshToken: body.refresh_token, expiresAt: body.expires_in ? Date.now() + body.expires_in * 1000 : undefined };
+}
+var b64url = (buf) => buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+async function oauthLogin(baseUrl, opts) {
+  const fetchImpl = opts.fetch ?? fetch;
+  const verifier = b64url(randomBytes(32));
+  const challenge = b64url(createHash("sha256").update(verifier).digest());
+  const state = b64url(randomBytes(16));
+  let settle;
+  const got = new Promise((r) => settle = r);
+  const server = createServer((req, res) => {
+    const u = new URL(req.url ?? "/", "http://127.0.0.1");
+    if (u.pathname !== "/callback") {
+      res.writeHead(404).end();
+      return;
+    }
+    const ok = u.searchParams.get("state") === state && !!u.searchParams.get("code");
+    res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+    res.end(ok ? "<p>Signed in to Unbrowse. You can close this tab.</p>" : "<p>Sign-in failed. Return to the terminal.</p>");
+    settle(ok ? { code: u.searchParams.get("code") } : { error: u.searchParams.get("error_description") ?? u.searchParams.get("error") ?? "state mismatch" });
+  });
+  await new Promise((r) => server.listen(0, "127.0.0.1", r));
+  const port = server.address().port;
+  const redirectUri = `http://127.0.0.1:${port}/callback`;
+  try {
+    const reg = await fetchImpl(`${baseUrl}/oauth/register`, {
+      method: "POST",
+      headers: { "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify({
+        client_name: "Unbrowse CLI",
+        redirect_uris: [redirectUri],
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+        token_endpoint_auth_method: "none"
+      })
+    });
+    const client = await reg.json().catch(() => ({}));
+    if (!reg.ok || !client.client_id)
+      throw new Error(`client registration failed: ${client.error_description ?? `HTTP ${reg.status}`}`);
+    const url = new URL(`${baseUrl}/authorize`);
+    url.search = new URLSearchParams({
+      response_type: "code",
+      client_id: client.client_id,
+      redirect_uri: redirectUri,
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+      state,
+      scope: "unbrowse",
+      resource: apiResource(baseUrl)
+    }).toString();
+    opts.log(`Opening ${url.origin}/authorize in your browser. If it does not open, visit:
+${url.toString()}`);
+    opts.open(url.toString());
+    const timer = setTimeout(() => settle({ error: "timed out waiting for the browser sign-in" }), opts.timeoutMs ?? 300000);
+    const answer = await got;
+    clearTimeout(timer);
+    if (!answer.code)
+      throw new Error(answer.error ?? "sign-in failed");
+    const tokens = await tokenRequest(baseUrl, { grant_type: "authorization_code", code: answer.code, redirect_uri: redirectUri, client_id: client.client_id, code_verifier: verifier, resource: apiResource(baseUrl) }, fetchImpl);
+    save({ baseUrl, oauth: { clientId: client.client_id, ...tokens } });
+  } finally {
+    server.close();
+  }
+}
+
+// src/cli.ts
+init_src();
+var VERSION = "12.1.0";
 var DEFAULT_ORIGIN = "https://unbrowse.ai";
 var HELP = `unbrowse ${VERSION} — call websites as APIs through the Unbrowse API
 
@@ -340,10 +516,12 @@ var HELP = `unbrowse ${VERSION} — call websites as APIs through the Unbrowse A
 
   registry [query]                Public compiled sites (no account)
   site <host>                     One site's tools (no account)
-  install                         Add the Unbrowse MCP to Claude Code, Codex or any client
+
+  mcp                             Local stdio MCP server proxying the hosted one (tool names use _ not .)
+      [--url URL] [--end-user ID]   for agent hosts that need stdio or strict tool names (Grok Build)
 
 Options: --json (errors as JSON) · --base-url URL · --no-open
-Env: UNBROWSE_API_KEY, UNBROWSE_BASE_URL (default ${DEFAULT_ORIGIN})
+Env: UNBROWSE_API_KEY, UNBROWSE_BASE_URL (default ${DEFAULT_ORIGIN}), UNBROWSE_MCP_URL, UNBROWSE_END_USER
 Exit: 0 ok · 1 error · 2 input required · 3 sign-in or login needed · 4 not verified`;
 var BOOLEAN = new Set(["json", "help", "version", "no-open", "no-wait", "unattended"]);
 function parseArgs(argv) {
@@ -389,6 +567,16 @@ async function main(argv, io = stdio) {
   const flag = (k) => typeof args.flags[k] === "string" ? args.flags[k] : undefined;
   const print = (v) => io.out(JSON.stringify(v, null, 2));
   const client = async () => new Unbrowse({ apiKey: await currentToken(origin) ?? "", baseUrl: origin });
+  if (cmd === "mcp") {
+    await Promise.resolve().then(() => init_mcp_proxy());
+    await serveStdio({
+      url: flag("url") ?? process.env.UNBROWSE_MCP_URL ?? `${origin}/api/mcp`,
+      token: async () => await currentToken(origin) ?? undefined,
+      version: VERSION,
+      endUser: flag("end-user") ?? process.env.UNBROWSE_END_USER
+    });
+    return 0;
+  }
   try {
     const ub = await client();
     switch (cmd) {
@@ -470,14 +658,6 @@ async function main(argv, io = stdio) {
       case "site":
         print(await ub.site(need(rest[0], "site <host>")));
         return 0;
-      case "install": {
-        const c = mcpCommands(`${origin}/mcp`);
-        io.out(`Claude Code:  ${c.claudeCode}
-Codex:        ${c.codex}
-Other clients:
-${c.json}`);
-        return 0;
-      }
       default:
         throw new UsageError(`unknown command "${cmd}". Run \`unbrowse help\`.`);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unbrowse",
-  "version": "12.0.0",
+  "version": "12.1.0",
   "description": "Call websites as APIs: a thin CLI over the Unbrowse API.",
   "license": "MIT",
   "type": "module",