unbrowse 12.0.1 → 12.1.1

package/SKILL.md

@@ -25,6 +25,17 @@ CLI installation and SDK instructions: https://github.com/unbrowse-ai/unbrowse-s
 Use the client version identified there; older npm versions may target a different service.
 For automation, supply an API key via `UNBROWSE_API_KEY` using the caller's secret manager. Do not put keys into committed config, prompts, command arguments or logs. Create a key in the signed-in console at https://unbrowse.ai/app.
 
+## Host plugins
+
+Packaged installs that bundle this skill, connect Unbrowse and redirect the host's own browser to it (https://github.com/unbrowse-ai/unbrowse/tree/main/plugins):
+
+- Claude Code: `claude plugin marketplace add unbrowse-ai/unbrowse`, then `claude plugin install unbrowse@unbrowse`.
+- Codex: `codex plugin marketplace add unbrowse-ai/unbrowse`, then `codex plugin add unbrowse@unbrowse`; set `web_search = "disabled"` to drop built-in search.
+- Grok Build: `grok plugin install unbrowse-ai/unbrowse#plugins/grok-build --trust`.
+- OpenClaw (`@unbrowse/openclaw`), Hermes (`plugins/hermes`), elizaOS (`@unbrowse/plugin-unbrowse`): native tools or actions over the same MCP.
+
+Hosts that need a stdio server or reject dotted tool names can run `npx unbrowse mcp`: tool names there use `_` (`unbrowse_scrape`). With a plugin installed, built-in web fetch, web search and browser navigation to non-local URLs are refused with a pointer to the matching Unbrowse tool; `UNBROWSE_ALLOW_BUILTIN_BROWSER=1` lifts that for a session.
+
 ## Choose the interface
 
 - MCP: discovery, runs, page reading, cloud browsing, saved-login requests and live canvas cards.

package/dist/cli.js

@@ -1,169 +1,17 @@
 #!/usr/bin/env node
-
-// src/cli.ts
-import { spawn } from "node:child_process";
-import { randomUUID } from "node:crypto";
-import { readFileSync as readFileSync2 } from "node:fs";
-
-// src/auth.ts
-import { createHash, randomBytes } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { createServer } from "node:http";
-import { homedir } from "node:os";
-import { dirname, join } from "node:path";
-function configPath() {
-  const root = process.env.UNBROWSE_CONFIG_DIR ?? join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "unbrowse");
-  return join(root, "cli.json");
-}
-function load() {
-  const path = configPath();
-  if (!existsSync(path))
-    return {};
-  try {
-    return JSON.parse(readFileSync(path, "utf8"));
-  } catch {
-    return {};
-  }
-}
-function save(stored) {
-  const path = configPath();
-  mkdirSync(dirname(path), { recursive: true, mode: 448 });
-  writeFileSync(path, JSON.stringify(stored, null, 2), { mode: 384 });
-  chmodSync(path, 384);
-}
-function clear() {
-  rmSync(configPath(), { force: true });
-}
-async function currentToken(baseUrl, fetchImpl = fetch) {
-  if (process.env.UNBROWSE_API_KEY)
-    return process.env.UNBROWSE_API_KEY;
-  const stored = load();
-  if (stored.baseUrl && stored.baseUrl !== baseUrl)
-    return;
-  if (stored.apiKey)
-    return stored.apiKey;
-  const o = stored.oauth;
-  if (!o)
-    return;
-  if (o.expiresAt && o.refreshToken && Date.now() > o.expiresAt - 60000) {
+var __esm = (fn, res, err) => () => {
+  if (fn)
     try {
-      const fresh = await tokenRequest(baseUrl, { grant_type: "refresh_token", refresh_token: o.refreshToken, client_id: o.clientId, resource: apiResource(baseUrl) }, fetchImpl);
-      save({ ...stored, oauth: { clientId: o.clientId, ...fresh, refreshToken: fresh.refreshToken ?? o.refreshToken } });
-      return fresh.accessToken;
-    } catch {
-      return o.accessToken;
+      res = fn(fn = 0);
+    } catch (e) {
+      err = [e];
     }
-  }
-  return o.accessToken;
-}
-function describe(baseUrl) {
-  if (process.env.UNBROWSE_API_KEY)
-    return "API key from UNBROWSE_API_KEY";
-  const stored = load();
-  if (stored.baseUrl && stored.baseUrl !== baseUrl)
-    return `not signed in to ${baseUrl} (stored login is for ${stored.baseUrl})`;
-  if (stored.apiKey)
-    return `API key ${mask(stored.apiKey)} in ${configPath()}`;
-  if (stored.oauth)
-    return `OAuth sign-in in ${configPath()}`;
-  return "not signed in";
-}
-function mask(key) {
-  return key.length <= 12 ? "…" : `${key.slice(0, 8)}…${key.slice(-4)}`;
-}
-function apiResource(baseUrl) {
-  return `${baseUrl.replace(/\/+$/, "")}/api`;
-}
-async function tokenRequest(baseUrl, form, fetchImpl) {
-  const res = await fetchImpl(`${baseUrl}/oauth/token`, {
-    method: "POST",
-    headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
-    body: new URLSearchParams(form).toString()
-  });
-  const body = await res.json().catch(() => ({}));
-  if (!res.ok || !body.access_token)
-    throw new Error(body.error_description ?? body.error ?? `token endpoint answered HTTP ${res.status}`);
-  return { accessToken: body.access_token, refreshToken: body.refresh_token, expiresAt: body.expires_in ? Date.now() + body.expires_in * 1000 : undefined };
-}
-var b64url = (buf) => buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-async function oauthLogin(baseUrl, opts) {
-  const fetchImpl = opts.fetch ?? fetch;
-  const verifier = b64url(randomBytes(32));
-  const challenge = b64url(createHash("sha256").update(verifier).digest());
-  const state = b64url(randomBytes(16));
-  let settle;
-  const got = new Promise((r) => settle = r);
-  const server = createServer((req, res) => {
-    const u = new URL(req.url ?? "/", "http://127.0.0.1");
-    if (u.pathname !== "/callback") {
-      res.writeHead(404).end();
-      return;
-    }
-    const ok = u.searchParams.get("state") === state && !!u.searchParams.get("code");
-    res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
-    res.end(ok ? "<p>Signed in to Unbrowse. You can close this tab.</p>" : "<p>Sign-in failed. Return to the terminal.</p>");
-    settle(ok ? { code: u.searchParams.get("code") } : { error: u.searchParams.get("error_description") ?? u.searchParams.get("error") ?? "state mismatch" });
-  });
-  await new Promise((r) => server.listen(0, "127.0.0.1", r));
-  const port = server.address().port;
-  const redirectUri = `http://127.0.0.1:${port}/callback`;
-  try {
-    const reg = await fetchImpl(`${baseUrl}/oauth/register`, {
-      method: "POST",
-      headers: { "content-type": "application/json", accept: "application/json" },
-      body: JSON.stringify({
-        client_name: "Unbrowse CLI",
-        redirect_uris: [redirectUri],
-        grant_types: ["authorization_code", "refresh_token"],
-        response_types: ["code"],
-        token_endpoint_auth_method: "none"
-      })
-    });
-    const client = await reg.json().catch(() => ({}));
-    if (!reg.ok || !client.client_id)
-      throw new Error(`client registration failed: ${client.error_description ?? `HTTP ${reg.status}`}`);
-    const url = new URL(`${baseUrl}/authorize`);
-    url.search = new URLSearchParams({
-      response_type: "code",
-      client_id: client.client_id,
-      redirect_uri: redirectUri,
-      code_challenge: challenge,
-      code_challenge_method: "S256",
-      state,
-      scope: "unbrowse",
-      resource: apiResource(baseUrl)
-    }).toString();
-    opts.log(`Opening ${url.origin}/authorize in your browser. If it does not open, visit:
-${url.toString()}`);
-    opts.open(url.toString());
-    const timer = setTimeout(() => settle({ error: "timed out waiting for the browser sign-in" }), opts.timeoutMs ?? 300000);
-    const answer = await got;
-    clearTimeout(timer);
-    if (!answer.code)
-      throw new Error(answer.error ?? "sign-in failed");
-    const tokens = await tokenRequest(baseUrl, { grant_type: "authorization_code", code: answer.code, redirect_uri: redirectUri, client_id: client.client_id, code_verifier: verifier, resource: apiResource(baseUrl) }, fetchImpl);
-    save({ baseUrl, oauth: { clientId: client.client_id, ...tokens } });
-  } finally {
-    server.close();
-  }
-}
+  if (err)
+    throw err[0];
+  return res;
+};
 
 // ../sdk/src/client.ts
-var DEFAULT_BASE_URL = "https://unbrowse.ai/api/v1";
-
-class UnbrowseError extends Error {
-  status;
-  code;
-  body;
-  constructor(message, status, code, body) {
-    super(message);
-    this.status = status;
-    this.code = code;
-    this.body = body;
-    this.name = "UnbrowseError";
-  }
-}
-var env = (name) => (typeof process !== "undefined" ? process.env?.[name] : undefined) || undefined;
 function apiBase(url) {
   const u = url.replace(/\/+$/, "");
   return /\/api\/v1$/.test(u) ? u : `${u}/api/v1`;
@@ -250,6 +98,43 @@ class Unbrowse {
   cancel(runId) {
     return this.req(`/runs/${runId}/cancel`, { method: "POST" });
   }
+  async runOnClient(request, opts = {}) {
+    const send = opts.fetch ?? ((...a) => globalThis.fetch(...a));
+    const deadline = Date.now() + (opts.timeoutMs ?? 600000);
+    let step = await this.run({ ...request, egress: "client" });
+    while (isEgressStep(step)) {
+      if (Date.now() > deadline) {
+        await this.closeEgress(step.egressId).catch(() => {
+          return;
+        });
+        throw new UnbrowseError("client-egress run did not finish in time", 408, "timeout");
+      }
+      const { egressId } = step;
+      for (const req of step.requests) {
+        let answer;
+        try {
+          if (await opts.onRequest?.(req) === false)
+            throw new Error("refused by onRequest");
+          answer = { response: await sendEgress(send, req) };
+        } catch (err) {
+          answer = { error: err instanceof Error ? err.message : String(err) };
+        }
+        step = await this.answerEgress(egressId, req.id, answer);
+        if (!isEgressStep(step))
+          break;
+      }
+    }
+    return step;
+  }
+  egress(egressId) {
+    return this.req(`/egress/${egressId}`);
+  }
+  answerEgress(egressId, requestId, answer) {
+    return this.post(`/egress/${egressId}`, { requestId, ...answer });
+  }
+  closeEgress(egressId) {
+    return this.req(`/egress/${egressId}`, { method: "DELETE" });
+  }
   discover(query) {
     return this.post("/capabilities/search", { query });
   }
@@ -311,8 +196,367 @@ function normalizeHost(site) {
     host = new URL(host).hostname;
   return host.replace(/\/.*$/, "").replace(/^www\./, "");
 }
+function isEgressStep(v) {
+  return !!v && typeof v === "object" && v.status === "egress_required";
+}
+async function sendEgress(send, req) {
+  const body = req.body === undefined ? undefined : req.bodyEncoding === "base64" ? base64ToBytes(req.body) : req.body;
+  const res = await send(req.url, { method: req.method, headers: req.headers, redirect: req.redirect, ...body !== undefined ? { body } : {} });
+  const headers = [];
+  res.headers.forEach((value, name) => headers.push([name, value]));
+  const cookies = res.headers.getSetCookie?.();
+  const pairs = cookies?.length ? [...headers.filter(([n]) => n.toLowerCase() !== "set-cookie"), ...cookies.map((c) => ["set-cookie", c])] : headers;
+  const bytes = new Uint8Array(await res.arrayBuffer());
+  return { status: res.status, headers: pairs, body: bytesToBase64(bytes), bodyEncoding: "base64", ...res.url ? { url: res.url } : {} };
+}
+function base64ToBytes(b64) {
+  const bin = atob(b64);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0;i < bin.length; i++)
+    out[i] = bin.charCodeAt(i);
+  return out;
+}
+function bytesToBase64(bytes) {
+  let bin = "";
+  for (let i = 0;i < bytes.length; i += 32768)
+    bin += String.fromCharCode(...bytes.subarray(i, i + 32768));
+  return btoa(bin);
+}
+var DEFAULT_BASE_URL = "https://unbrowse.ai/api/v1", UnbrowseError, env = (name) => (typeof process !== "undefined" ? process.env?.[name] : undefined) || undefined;
+var init_client = __esm(() => {
+  UnbrowseError = class UnbrowseError extends Error {
+    status;
+    code;
+    body;
+    constructor(message, status, code, body) {
+      super(message);
+      this.status = status;
+      this.code = code;
+      this.body = body;
+      this.name = "UnbrowseError";
+    }
+  };
+});
+// ../sdk/src/mcp.ts
+function parseRpcBody(text) {
+  const trimmed = text.trim();
+  if (trimmed.startsWith("{"))
+    return JSON.parse(trimmed);
+  const events = trimmed.split(/\n\n+/).flatMap((block) => {
+    const data = block.split(`
+`).filter((l) => l.startsWith("data:")).map((l) => l.slice(5).trimStart()).join(`
+`);
+    return data ? [data] : [];
+  });
+  if (!events.length)
+    throw new UnbrowseError("Empty MCP response", 502, "mcp_empty");
+  return JSON.parse(events[events.length - 1]);
+}
+
+class UnbrowseMcp {
+  url;
+  apiKey;
+  endUser;
+  client;
+  fetchImpl;
+  nextId = 1;
+  constructor(opts = {}) {
+    this.url = (opts.url ?? env2("UNBROWSE_MCP_URL") ?? DEFAULT_MCP_URL).replace(/\/+$/, "");
+    this.apiKey = opts.apiKey ?? env2("UNBROWSE_API_KEY");
+    this.endUser = opts.endUser ?? env2("UNBROWSE_END_USER");
+    this.client = opts.client ?? "sdk";
+    this.fetchImpl = opts.fetch ?? ((...a) => globalThis.fetch(...a));
+  }
+  async rpc(method, params) {
+    const res = await this.fetchImpl(this.url, {
+      method: "POST",
+      headers: {
+        ...this.apiKey ? { authorization: `Bearer ${this.apiKey}` } : {},
+        ...this.endUser ? { "x-unbrowse-end-user": this.endUser } : {},
+        "content-type": "application/json",
+        accept: "application/json, text/event-stream",
+        "mcp-protocol-version": MCP_PROTOCOL_VERSION,
+        "user-agent": `unbrowse-${this.client}`
+      },
+      body: JSON.stringify({ jsonrpc: "2.0", id: this.nextId++, method, ...params ? { params } : {} })
+    });
+    const text = await res.text();
+    if (!res.ok) {
+      let body = {};
+      try {
+        body = JSON.parse(text);
+      } catch {}
+      const err = typeof body.error === "object" ? body.error : undefined;
+      throw new UnbrowseError(err?.message ?? body.error_description ?? (res.statusText || `HTTP ${res.status}`), res.status, err?.code ?? (typeof body.error === "string" ? body.error : "http_error"), body);
+    }
+    const msg = parseRpcBody(text);
+    if (msg.error)
+      throw new UnbrowseError(msg.error.message, 200, msg.error.data?.code ?? `rpc_${msg.error.code}`, msg.error);
+    return msg.result;
+  }
+  async listTools() {
+    const tools = [];
+    let cursor;
+    do {
+      const page = await this.rpc("tools/list", cursor ? { cursor } : undefined);
+      tools.push(...page.tools);
+      cursor = page.nextCursor;
+    } while (cursor);
+    return tools;
+  }
+  callTool(name, args = {}) {
+    return this.rpc("tools/call", { name, arguments: args });
+  }
+}
+var DEFAULT_MCP_URL = "https://unbrowse.ai/mcp", MCP_PROTOCOL_VERSION = "2025-11-25", env2 = (name) => (typeof process !== "undefined" ? process.env?.[name] : undefined) || undefined;
+var init_mcp = __esm(() => {
+  init_client();
+});
+
+// ../sdk/src/index.ts
+var init_src = __esm(() => {
+  init_client();
+  init_mcp();
+});
+
+// src/mcp-proxy.ts
+import { createInterface } from "node:readline";
+function safeToolName(name) {
+  return name.replace(/[^A-Za-z0-9_-]/g, "_").slice(0, 64);
+}
+function createProxy(upstream, version) {
+  const names = new Map;
+  async function list() {
+    const tools = await (await upstream()).listTools();
+    names.clear();
+    const out = [];
+    for (const t of tools) {
+      const safe = safeToolName(t.name);
+      if (names.has(safe))
+        continue;
+      names.set(safe, t.name);
+      out.push({ ...t, name: safe });
+    }
+    return out;
+  }
+  async function original(safe) {
+    if (!names.has(safe))
+      await list();
+    return names.get(safe) ?? safe;
+  }
+  return async function handle(msg) {
+    if (msg.id === undefined || msg.id === null)
+      return;
+    const reply = (result) => ({ jsonrpc: "2.0", id: msg.id, result });
+    try {
+      switch (msg.method) {
+        case "initialize": {
+          const asked = String(msg.params?.protocolVersion ?? "");
+          return reply({
+            protocolVersion: PROTOCOLS.includes(asked) ? asked : PROTOCOLS[0],
+            capabilities: { tools: { listChanged: false } },
+            serverInfo: { name: "unbrowse", title: "Unbrowse (local proxy to the hosted MCP)", version },
+            instructions: "Unbrowse is the browserless browser. Prefer unbrowse_discover then unbrowse_run; unbrowse_scrape reads a page; unbrowse_browse_* drive the cloud browser. input_required is not a failure: answer it with unbrowse_resume."
+          });
+        }
+        case "ping":
+          return reply({});
+        case "tools/list":
+          return reply({ tools: await list() });
+        case "tools/call": {
+          const name = String(msg.params?.name ?? "");
+          return reply(await (await upstream()).rpc("tools/call", { ...msg.params, name: await original(name) }));
+        }
+        default:
+          return reply(await (await upstream()).rpc(String(msg.method), msg.params));
+      }
+    } catch (e) {
+      const err = e;
+      const code = err instanceof UnbrowseError ? err.code : "proxy_error";
+      const hint = err instanceof UnbrowseError && err.status === 401 ? " Run `unbrowse login` (or set UNBROWSE_API_KEY) and restart this server." : "";
+      return { jsonrpc: "2.0", id: msg.id, error: { code: -32000, message: `${err.message}${hint}`, data: { code } } };
+    }
+  };
+}
+async function serveStdio(opts) {
+  const handle = createProxy(async () => new UnbrowseMcp({ url: opts.url, apiKey: await opts.token() ?? "", endUser: opts.endUser, client: `cli-mcp/${opts.version}` }), opts.version);
+  const write = (m) => new Promise((resolve) => process.stdout.write(`${JSON.stringify(m)}
+`, () => resolve()));
+  const rl = createInterface({ input: process.stdin, crlfDelay: Infinity });
+  const pending = new Set;
+  for await (const line of rl) {
+    if (!line.trim())
+      continue;
+    let msg;
+    try {
+      msg = JSON.parse(line);
+    } catch {
+      pending.add(write({ jsonrpc: "2.0", id: null, error: { code: -32700, message: "Parse error" } }));
+      continue;
+    }
+    const p = handle(msg).then((res) => res ? write(res) : undefined);
+    pending.add(p);
+    p.finally(() => pending.delete(p));
+  }
+  await Promise.all(pending);
+}
+var PROTOCOLS;
+var init_mcp_proxy = __esm(() => {
+  init_src();
+  PROTOCOLS = ["2025-11-25", "2025-06-18", "2025-03-26", "2024-11-05"];
+});
+
+// src/cli.ts
+import { spawn } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { readFileSync as readFileSync2 } from "node:fs";
+
+// src/auth.ts
+import { createHash, randomBytes } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { createServer } from "node:http";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+function configPath() {
+  const root = process.env.UNBROWSE_CONFIG_DIR ?? join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "unbrowse");
+  return join(root, "cli.json");
+}
+function load() {
+  const path = configPath();
+  if (!existsSync(path))
+    return {};
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function save(stored) {
+  const path = configPath();
+  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  writeFileSync(path, JSON.stringify(stored, null, 2), { mode: 384 });
+  chmodSync(path, 384);
+}
+function clear() {
+  rmSync(configPath(), { force: true });
+}
+async function currentToken(baseUrl, fetchImpl = fetch) {
+  if (process.env.UNBROWSE_API_KEY)
+    return process.env.UNBROWSE_API_KEY;
+  const stored = load();
+  if (stored.baseUrl && stored.baseUrl !== baseUrl)
+    return;
+  if (stored.apiKey)
+    return stored.apiKey;
+  const o = stored.oauth;
+  if (!o)
+    return;
+  if (o.expiresAt && o.refreshToken && Date.now() > o.expiresAt - 60000) {
+    try {
+      const fresh = await tokenRequest(baseUrl, { grant_type: "refresh_token", refresh_token: o.refreshToken, client_id: o.clientId, resource: apiResource(baseUrl) }, fetchImpl);
+      save({ ...stored, oauth: { clientId: o.clientId, ...fresh, refreshToken: fresh.refreshToken ?? o.refreshToken } });
+      return fresh.accessToken;
+    } catch {
+      return o.accessToken;
+    }
+  }
+  return o.accessToken;
+}
+function describe(baseUrl) {
+  if (process.env.UNBROWSE_API_KEY)
+    return "API key from UNBROWSE_API_KEY";
+  const stored = load();
+  if (stored.baseUrl && stored.baseUrl !== baseUrl)
+    return `not signed in to ${baseUrl} (stored login is for ${stored.baseUrl})`;
+  if (stored.apiKey)
+    return `API key ${mask(stored.apiKey)} in ${configPath()}`;
+  if (stored.oauth)
+    return `OAuth sign-in in ${configPath()}`;
+  return "not signed in";
+}
+function mask(key) {
+  return key.length <= 12 ? "…" : `${key.slice(0, 8)}…${key.slice(-4)}`;
+}
+function apiResource(baseUrl) {
+  return `${baseUrl.replace(/\/+$/, "")}/api`;
+}
+async function tokenRequest(baseUrl, form, fetchImpl) {
+  const res = await fetchImpl(`${baseUrl}/oauth/token`, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded", accept: "application/json" },
+    body: new URLSearchParams(form).toString()
+  });
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok || !body.access_token)
+    throw new Error(body.error_description ?? body.error ?? `token endpoint answered HTTP ${res.status}`);
+  return { accessToken: body.access_token, refreshToken: body.refresh_token, expiresAt: body.expires_in ? Date.now() + body.expires_in * 1000 : undefined };
+}
+var b64url = (buf) => buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+async function oauthLogin(baseUrl, opts) {
+  const fetchImpl = opts.fetch ?? fetch;
+  const verifier = b64url(randomBytes(32));
+  const challenge = b64url(createHash("sha256").update(verifier).digest());
+  const state = b64url(randomBytes(16));
+  let settle;
+  const got = new Promise((r) => settle = r);
+  const server = createServer((req, res) => {
+    const u = new URL(req.url ?? "/", "http://127.0.0.1");
+    if (u.pathname !== "/callback") {
+      res.writeHead(404).end();
+      return;
+    }
+    const ok = u.searchParams.get("state") === state && !!u.searchParams.get("code");
+    res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+    res.end(ok ? "<p>Signed in to Unbrowse. You can close this tab.</p>" : "<p>Sign-in failed. Return to the terminal.</p>");
+    settle(ok ? { code: u.searchParams.get("code") } : { error: u.searchParams.get("error_description") ?? u.searchParams.get("error") ?? "state mismatch" });
+  });
+  await new Promise((r) => server.listen(0, "127.0.0.1", r));
+  const port = server.address().port;
+  const redirectUri = `http://127.0.0.1:${port}/callback`;
+  try {
+    const reg = await fetchImpl(`${baseUrl}/oauth/register`, {
+      method: "POST",
+      headers: { "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify({
+        client_name: "Unbrowse CLI",
+        redirect_uris: [redirectUri],
+        grant_types: ["authorization_code", "refresh_token"],
+        response_types: ["code"],
+        token_endpoint_auth_method: "none"
+      })
+    });
+    const client = await reg.json().catch(() => ({}));
+    if (!reg.ok || !client.client_id)
+      throw new Error(`client registration failed: ${client.error_description ?? `HTTP ${reg.status}`}`);
+    const url = new URL(`${baseUrl}/authorize`);
+    url.search = new URLSearchParams({
+      response_type: "code",
+      client_id: client.client_id,
+      redirect_uri: redirectUri,
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+      state,
+      scope: "unbrowse",
+      resource: apiResource(baseUrl)
+    }).toString();
+    opts.log(`Opening ${url.origin}/authorize in your browser. If it does not open, visit:
+${url.toString()}`);
+    opts.open(url.toString());
+    const timer = setTimeout(() => settle({ error: "timed out waiting for the browser sign-in" }), opts.timeoutMs ?? 300000);
+    const answer = await got;
+    clearTimeout(timer);
+    if (!answer.code)
+      throw new Error(answer.error ?? "sign-in failed");
+    const tokens = await tokenRequest(baseUrl, { grant_type: "authorization_code", code: answer.code, redirect_uri: redirectUri, client_id: client.client_id, code_verifier: verifier, resource: apiResource(baseUrl) }, fetchImpl);
+    save({ baseUrl, oauth: { clientId: client.client_id, ...tokens } });
+  } finally {
+    server.close();
+  }
+}
+
 // src/cli.ts
-var VERSION = "12.0.1";
+init_src();
+var VERSION = "12.1.1";
 var DEFAULT_ORIGIN = "https://unbrowse.ai";
 var HELP = `unbrowse ${VERSION} — call websites as APIs through the Unbrowse API
 
@@ -324,6 +568,7 @@ var HELP = `unbrowse ${VERSION} — call websites as APIs through the Unbrowse A
   discover <query>                Your capabilities first, then the public registry
   run <task…>                     Run a task and wait for a verified result
       [--capability ID] [--url URL] [--set key=value]… [--input JSON] [--unattended] [--no-wait]
+      [--from-here]                 send the site requests from this machine (your IP); Unbrowse decides and reads them
   inspect <runId>                 A run's status, requirements and result
   resume <runId> key=value…       Answer open requirements on the same run
   cancel <runId>                  Stop a run; prints the effect receipt
@@ -336,8 +581,11 @@ var HELP = `unbrowse ${VERSION} — call websites as APIs through the Unbrowse A
   registry [query]                Public compiled sites (no account)
   site <host>                     One site's tools (no account)
 
+  mcp                             Local stdio MCP server proxying the hosted one (tool names use _ not .)
+      [--url URL] [--end-user ID]   for agent hosts that need stdio or strict tool names (Grok Build)
+
 Options: --json (errors as JSON) · --base-url URL · --no-open
-Env: UNBROWSE_API_KEY, UNBROWSE_BASE_URL (default ${DEFAULT_ORIGIN})
+Env: UNBROWSE_API_KEY, UNBROWSE_BASE_URL (default ${DEFAULT_ORIGIN}), UNBROWSE_MCP_URL, UNBROWSE_END_USER
 Exit: 0 ok · 1 error · 2 input required · 3 sign-in or login needed · 4 not verified`;
 var BOOLEAN = new Set(["json", "help", "version", "no-open", "no-wait", "unattended"]);
 function parseArgs(argv) {
@@ -383,6 +631,16 @@ async function main(argv, io = stdio) {
   const flag = (k) => typeof args.flags[k] === "string" ? args.flags[k] : undefined;
   const print = (v) => io.out(JSON.stringify(v, null, 2));
   const client = async () => new Unbrowse({ apiKey: await currentToken(origin) ?? "", baseUrl: origin });
+  if (cmd === "mcp") {
+    await Promise.resolve().then(() => init_mcp_proxy());
+    await serveStdio({
+      url: flag("url") ?? process.env.UNBROWSE_MCP_URL ?? `${origin}/api/mcp`,
+      token: async () => await currentToken(origin) ?? undefined,
+      version: VERSION,
+      endUser: flag("end-user") ?? process.env.UNBROWSE_END_USER
+    });
+    return 0;
+  }
   try {
     const ub = await client();
     switch (cmd) {
@@ -415,14 +673,15 @@ async function main(argv, io = stdio) {
         if (!task && !capability)
           throw new UsageError("usage: unbrowse run <task…> | --capability ID");
         const input = { ...flag("input") ? JSON.parse(flag("input")) : {}, ...mapValues(args.sets) };
-        const view = await ub.run({
+        const request = {
           ...task ? { task } : {},
           ...capability ? { capability } : {},
           ...flag("url") ? { targetUrl: flag("url") } : {},
           ...Object.keys(input).length ? { input } : {},
           ...args.flags.unattended ? { interactionMode: "unattended" } : {},
           idempotencyKey: flag("idempotency-key") ?? randomUUID()
-        });
+        };
+        const view = args.flags["from-here"] ? await ub.runOnClient(request, { onRequest: (r) => void io.err(`→ ${r.method} ${r.url}`) }) : await ub.run(request);
         return settle(ub, view, args, io, print);
       }
       case "inspect":

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "unbrowse",
-  "version": "12.0.1",
+  "version": "12.1.1",
+  "mcpName": "io.github.unbrowse-ai/unbrowse",
   "description": "Call websites as APIs: a thin CLI over the Unbrowse API.",
   "license": "MIT",
   "type": "module",