ziphro-mcp 0.0.0-stage → 2.0.0-preview.0

package/README.md

@@ -1,3 +1,90 @@
-# Temporary Holding Version
+# ziphro-mcp 🪐
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+> Model Context Protocol (MCP) server for Ziphro: a privacy-first task manager with client-side end-to-end zero-knowledge encryption.
+
+This MCP server allows AI agents (like Claude Desktop, Cursor, Windsurf, Cline, etc.) to securely read, update, complete, and analyze your tasks without exposing master passwords or sensitive credentials.
+
+---
+
+## 🚀 Quick Setup (Browser Pairing)
+
+Authorize your AI agent in one click:
+```bash
+npx -y ziphro-mcp auth
+```
+
+This starts a local handshake receiver and opens your browser to authorize the agent. An isolated zero-knowledge API Secret (`zs_live_...`) is derived and saved to `~/.ziphro/mcp.json`. Master passwords are **never** required, requested, or stored.
+
+---
+
+## 🛠️ Running the Server
+
+Run directly via `npx` (uses `~/.ziphro/mcp.json` automatically):
+```bash
+npx -y ziphro-mcp
+```
+
+Or install globally:
+```bash
+npm install -g ziphro-mcp
+ziphro-mcp
+```
+
+---
+
+## ⚙️ Client Configuration
+
+### Claude Desktop
+Add this to your `claude_desktop_config.json`:
+```json
+{
+  "mcpServers": {
+    "ziphro": {
+      "command": "npx",
+      "args": ["-y", "ziphro-mcp"]
+    }
+  }
+}
+```
+
+Or specify environment variables explicitly:
+```json
+{
+  "mcpServers": {
+    "ziphro": {
+      "command": "npx",
+      "args": ["-y", "ziphro-mcp"],
+      "env": {
+        "ZIPHRO_API_KEY": "zp_live_<your-api-key>",
+        "ZIPHRO_API_SECRET": "zs_live_<your-api-secret>",
+        "ZIPHRO_API": "https://api-ziphro.vercel.app"
+      }
+    }
+  }
+}
+```
+
+### Cursor IDE
+1. Open Cursor Settings -> Features -> MCP.
+2. Click **+ Add New MCP Server**.
+3. Command: `npx -y ziphro-mcp` (zero-config after `ziphro-mcp auth`).
+
+---
+
+## 🔑 Available Tools
+
+* **`list_tasks`**: List user tasks with optional status (`pending`, `in_progress`, `completed`), priority (`low`, `medium`, `high`), and tag filters.
+* **`add_task`**: Create a new task with description, priority, due date, and tags.
+* **`complete_task`**: Mark a task as completed with an optional note.
+* **`get_task_stats`**: Get aggregated task completion metrics and dashboard data.
+* **`suggest_priorities`**: Ranks active/pending tasks by priority and urgency.
+* **`search_tasks`**: Full-text search tasks by keyword, tag, or due date range.
+* **`update_task`**: Update description, priority, status, tags, or due date.
+* **`bulk_complete`**: Mark multiple tasks as completed in a single action.
+* **`get_overdue`**: Retrieve all overdue tasks past their deadlines.
+
+---
+
+## 📄 License
+
+MIT License.

package/dist/index.js

@@ -0,0 +1,1171 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import {
+  CallToolRequestSchema,
+  ErrorCode,
+  ListToolsRequestSchema,
+  McpError
+} from "@modelcontextprotocol/sdk/types.js";
+
+// ../packages/crypto/dist/web.js
+var KEY_LENGTH = 32;
+var PBKDF2_ITERATIONS_V2 = 6e5;
+var PBKDF2_ITERATIONS_V1 = 1e5;
+function uint8ArrayToBase64(arr) {
+  const binString = Array.from(arr, (byte) => String.fromCharCode(byte)).join("");
+  return btoa(binString);
+}
+function base64ToUint8Array(str) {
+  const binString = atob(str);
+  return Uint8Array.from(binString, (char) => char.charCodeAt(0));
+}
+function getSubtleCrypto() {
+  const c = typeof window !== "undefined" ? window.crypto : globalThis.crypto;
+  if (!c || !c.subtle) {
+    throw new Error("Web Crypto Subtle is not available in this environment.");
+  }
+  return c.subtle;
+}
+function getRandomValues(arr) {
+  const c = typeof window !== "undefined" ? window.crypto : globalThis.crypto;
+  return c.getRandomValues(arr);
+}
+function toBufferSource(bytes) {
+  if (bytes.buffer instanceof ArrayBuffer) {
+    return new Uint8Array(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  }
+  return new Uint8Array(bytes);
+}
+async function deriveAccountKeys(passphrase, emailSalt) {
+  const subtle = getSubtleCrypto();
+  const encoder = new TextEncoder();
+  const normalizedSalt = encoder.encode(emailSalt.trim().toLowerCase());
+  const passphraseBytes = encoder.encode(passphrase);
+  const pbkdf2Key = await subtle.importKey("raw", passphraseBytes, { name: "PBKDF2" }, false, ["deriveBits"]);
+  const masterBits = await subtle.deriveBits({
+    name: "PBKDF2",
+    salt: normalizedSalt,
+    iterations: PBKDF2_ITERATIONS_V2,
+    hash: "SHA-256"
+  }, pbkdf2Key, KEY_LENGTH * 8);
+  const hkdfKey = await subtle.importKey("raw", masterBits, "HKDF", false, ["deriveBits"]);
+  const authBits = await subtle.deriveBits({
+    name: "HKDF",
+    hash: "SHA-256",
+    salt: new Uint8Array(0),
+    info: encoder.encode("ziphro-auth-v2")
+  }, hkdfKey, KEY_LENGTH * 8);
+  const encBits = await subtle.deriveBits({
+    name: "HKDF",
+    hash: "SHA-256",
+    salt: new Uint8Array(0),
+    info: encoder.encode("ziphro-encryption-v2")
+  }, hkdfKey, KEY_LENGTH * 8);
+  return {
+    authSecret: uint8ArrayToBase64(new Uint8Array(authBits)),
+    encKey: new Uint8Array(encBits)
+  };
+}
+function buildAADBytes(meta) {
+  return new TextEncoder().encode(JSON.stringify({
+    u: meta.userId,
+    r: meta.revision,
+    v: meta.version ?? 2
+  }));
+}
+async function encryptWithAAD(plaintext, encKey, meta) {
+  const subtle = getSubtleCrypto();
+  const iv = getRandomValues(new Uint8Array(12));
+  const salt = getRandomValues(new Uint8Array(16));
+  const aad = buildAADBytes(meta);
+  const cryptoKey = ArrayBuffer.isView(encKey) ? await subtle.importKey("raw", toBufferSource(encKey), { name: "AES-GCM" }, false, ["encrypt"]) : encKey;
+  const plaintextBytes = new TextEncoder().encode(plaintext);
+  const encryptedBuffer = await subtle.encrypt({
+    name: "AES-GCM",
+    iv: toBufferSource(iv),
+    additionalData: toBufferSource(aad),
+    tagLength: 128
+  }, cryptoKey, plaintextBytes);
+  const encryptedBytes = new Uint8Array(encryptedBuffer);
+  const ciphertextBytes = encryptedBytes.slice(0, -16);
+  const authTagBytes = encryptedBytes.slice(-16);
+  return {
+    version: "2",
+    iterations: PBKDF2_ITERATIONS_V2,
+    revision: meta.revision,
+    salt: uint8ArrayToBase64(salt),
+    iv: uint8ArrayToBase64(iv),
+    ciphertext: uint8ArrayToBase64(ciphertextBytes),
+    authTag: uint8ArrayToBase64(authTagBytes)
+  };
+}
+async function decryptWithAAD(blob, encKey, meta) {
+  const subtle = getSubtleCrypto();
+  const iv = base64ToUint8Array(blob.iv);
+  const ciphertextBytes = base64ToUint8Array(blob.ciphertext);
+  const authTagBytes = base64ToUint8Array(blob.authTag);
+  const combined = new Uint8Array(ciphertextBytes.length + authTagBytes.length);
+  combined.set(ciphertextBytes, 0);
+  combined.set(authTagBytes, ciphertextBytes.length);
+  const cryptoKey = ArrayBuffer.isView(encKey) ? await subtle.importKey("raw", toBufferSource(encKey), { name: "AES-GCM" }, false, ["decrypt"]) : encKey;
+  const gcmParams = {
+    name: "AES-GCM",
+    iv: toBufferSource(iv),
+    tagLength: 128
+  };
+  if (blob.version === "2" && meta) {
+    gcmParams.additionalData = toBufferSource(buildAADBytes({
+      userId: meta.userId,
+      revision: meta.revision,
+      version: meta.version ?? 2
+    }));
+  }
+  const decryptedBuffer = await subtle.decrypt(gcmParams, cryptoKey, combined);
+  return new TextDecoder().decode(decryptedBuffer);
+}
+async function legacyDecrypt(blob, password, meta) {
+  const subtle = getSubtleCrypto();
+  const encoder = new TextEncoder();
+  const salt = base64ToUint8Array(blob.salt);
+  const iv = base64ToUint8Array(blob.iv);
+  const ciphertextBytes = base64ToUint8Array(blob.ciphertext);
+  const authTagBytes = base64ToUint8Array(blob.authTag);
+  const combined = new Uint8Array(ciphertextBytes.length + authTagBytes.length);
+  combined.set(ciphertextBytes, 0);
+  combined.set(authTagBytes, ciphertextBytes.length);
+  const isV2 = blob.version === "2";
+  const iterations = isV2 ? blob.iterations || PBKDF2_ITERATIONS_V2 : PBKDF2_ITERATIONS_V1;
+  const passwordBytes = encoder.encode(password);
+  const pbkdf2Key = await subtle.importKey("raw", passwordBytes, { name: "PBKDF2" }, false, ["deriveBits"]);
+  const masterBits = await subtle.deriveBits({
+    name: "PBKDF2",
+    salt: toBufferSource(salt),
+    iterations,
+    hash: "SHA-256"
+  }, pbkdf2Key, KEY_LENGTH * 8);
+  let cryptoKey;
+  if (isV2) {
+    const hkdfKey = await subtle.importKey("raw", masterBits, "HKDF", false, ["deriveKey"]);
+    cryptoKey = await subtle.deriveKey({
+      name: "HKDF",
+      hash: "SHA-256",
+      salt: new Uint8Array(0),
+      info: encoder.encode("ziphro-encryption")
+    }, hkdfKey, { name: "AES-GCM", length: 256 }, false, ["decrypt"]);
+  } else {
+    const labelBytes = encoder.encode("ziphro-encryption");
+    const combinedKey = new Uint8Array(masterBits.byteLength + labelBytes.length);
+    combinedKey.set(new Uint8Array(masterBits), 0);
+    combinedKey.set(labelBytes, masterBits.byteLength);
+    const hashBuffer = await subtle.digest("SHA-256", combinedKey);
+    cryptoKey = await subtle.importKey("raw", hashBuffer, { name: "AES-GCM" }, false, ["decrypt"]);
+  }
+  const gcmParams = {
+    name: "AES-GCM",
+    iv: toBufferSource(iv),
+    tagLength: 128
+  };
+  if (isV2 && meta) {
+    try {
+      const decryptedWithAAD = await subtle.decrypt({
+        ...gcmParams,
+        additionalData: toBufferSource(buildAADBytes(meta))
+      }, cryptoKey, combined);
+      return new TextDecoder().decode(decryptedWithAAD);
+    } catch {
+    }
+  }
+  const decryptedBuffer = await subtle.decrypt(gcmParams, cryptoKey, combined);
+  return new TextDecoder().decode(decryptedBuffer);
+}
+async function checksum(plaintext) {
+  const subtle = getSubtleCrypto();
+  const data = new TextEncoder().encode(plaintext);
+  const hashBuffer = await subtle.digest("SHA-256", data);
+  const hashArray = Array.from(new Uint8Array(hashBuffer));
+  return hashArray.map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+
+// src/crypto.ts
+function normalizeKeyOrSecret(secretOrPass) {
+  if (secretOrPass instanceof Uint8Array) return secretOrPass;
+  if (!secretOrPass || typeof secretOrPass !== "string") return new Uint8Array(32);
+  const trimmed = secretOrPass.trim();
+  if (trimmed.startsWith("zs_live_")) {
+    const hex = trimmed.slice("zs_live_".length);
+    if (hex.length === 64) {
+      return new Uint8Array(Buffer.from(hex, "hex"));
+    }
+  }
+  if (/^[0-9a-fA-F]{64}$/.test(trimmed)) {
+    return new Uint8Array(Buffer.from(trimmed, "hex"));
+  }
+  if (/^[A-Za-z0-9+/]{43}=?$/.test(trimmed) || /^[A-Za-z0-9+/]{44}$/.test(trimmed)) {
+    const buf = Buffer.from(trimmed, "base64");
+    if (buf.length === 32) {
+      return new Uint8Array(buf);
+    }
+  }
+  return trimmed;
+}
+async function encrypt(plaintext, secretOrPass, meta) {
+  const normalized = normalizeKeyOrSecret(secretOrPass);
+  let encKey;
+  if (typeof normalized === "string") {
+    const salt = meta?.userId || "ziphro-mcp-user";
+    const keys = await deriveAccountKeys(normalized, salt);
+    encKey = keys.encKey;
+  } else {
+    encKey = normalized;
+  }
+  const envelope = meta || {
+    userId: "mcp",
+    revision: 1,
+    version: 2
+  };
+  return encryptWithAAD(plaintext, encKey, envelope);
+}
+async function decrypt(blob, secretOrPass, meta) {
+  const normalized = normalizeKeyOrSecret(secretOrPass);
+  if (normalized instanceof Uint8Array) {
+    const candidateUserIds = [
+      meta?.userId,
+      "mcp",
+      "default",
+      "cli"
+    ].filter((u) => Boolean(u));
+    let lastErr;
+    for (const uid of candidateUserIds) {
+      try {
+        return await decryptWithAAD(blob, normalized, {
+          userId: uid,
+          revision: meta?.revision ?? 1,
+          version: meta?.version ?? 2
+        });
+      } catch (err) {
+        lastErr = err;
+      }
+    }
+    try {
+      return await decryptWithAAD(blob, normalized, void 0);
+    } catch {
+      throw lastErr || new Error("Decryption failed with provided secret.");
+    }
+  }
+  try {
+    const salt = meta?.userId || "ziphro-mcp-user";
+    const keys = await deriveAccountKeys(normalized, salt);
+    return await decryptWithAAD(blob, keys.encKey, meta);
+  } catch {
+    return legacyDecrypt(blob, normalized, meta);
+  }
+}
+
+// src/index.ts
+import crypto, { createDecipheriv, hkdfSync } from "crypto";
+import http from "http";
+import { exec } from "child_process";
+import { homedir, hostname, userInfo } from "os";
+import fs from "fs";
+import path from "path";
+import { fileURLToPath } from "url";
+var __filename2 = fileURLToPath(import.meta.url);
+var __dirname2 = path.dirname(__filename2);
+var ZIPHRO_DIR = path.join(homedir(), ".ziphro");
+var MCP_CONFIG_FILE = path.join(ZIPHRO_DIR, "mcp.json");
+var CLI_CREDENTIALS_FILE = path.join(ZIPHRO_DIR, "credentials");
+var SEED_FILE = path.join(ZIPHRO_DIR, ".seed");
+function loadEnv() {
+  const envPaths = [
+    path.join(process.cwd(), ".env"),
+    path.join(__dirname2, ".env"),
+    path.join(__dirname2, "..", ".env")
+  ];
+  for (const envPath of envPaths) {
+    if (fs.existsSync(envPath)) {
+      try {
+        const content = fs.readFileSync(envPath, "utf8");
+        for (const line of content.split(/\r?\n/)) {
+          const trimmed = line.trim();
+          if (!trimmed || trimmed.startsWith("#")) continue;
+          const match = trimmed.match(/^([^=]+)=(.*)$/);
+          if (match) {
+            const key = match[1].trim();
+            let val = match[2].trim();
+            if (val.startsWith('"') && val.endsWith('"') || val.startsWith("'") && val.endsWith("'")) {
+              val = val.substring(1, val.length - 1);
+            }
+            if (!process.env[key]) {
+              process.env[key] = val;
+            }
+          }
+        }
+        break;
+      } catch {
+      }
+    }
+  }
+}
+loadEnv();
+function getMachineKey() {
+  try {
+    if (!fs.existsSync(SEED_FILE)) return null;
+    const seed = fs.readFileSync(SEED_FILE);
+    if (seed.length < 32) return null;
+    const user = userInfo?.()?.username || "user";
+    const host = hostname() || "local";
+    const info = `ziphro-vault-v2-${user}-${host}-${process.platform}`;
+    return Buffer.from(hkdfSync("sha256", seed, Buffer.alloc(0), Buffer.from(info), 32));
+  } catch {
+    return null;
+  }
+}
+function decryptSecret(value) {
+  if (!value) return void 0;
+  if (!value.startsWith("enc:v1:")) return value;
+  try {
+    const parts = value.split(":");
+    if (parts.length !== 5) return void 0;
+    const [, , ivHex, cipherHex, tagHex] = parts;
+    const key = getMachineKey();
+    if (!key) return void 0;
+    const iv = Buffer.from(ivHex, "hex");
+    const ciphertext = Buffer.from(cipherHex, "hex");
+    const authTag = Buffer.from(tagHex, "hex");
+    const decipher = createDecipheriv("aes-256-gcm", key, iv);
+    decipher.setAuthTag(authTag);
+    const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+    return decrypted.toString("utf8");
+  } catch {
+    return void 0;
+  }
+}
+function readCliCredentials() {
+  try {
+    if (!fs.existsSync(CLI_CREDENTIALS_FILE)) return null;
+    const content = fs.readFileSync(CLI_CREDENTIALS_FILE, "utf8");
+    const ini = {};
+    for (const line of content.split(/\r?\n/)) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#") || trimmed.startsWith("[") || trimmed.startsWith(";")) continue;
+      const eq = trimmed.indexOf("=");
+      if (eq === -1) continue;
+      ini[trimmed.slice(0, eq).trim()] = trimmed.slice(eq + 1).trim();
+    }
+    const accessToken = decryptSecret(ini.access_token);
+    const vaultKey = decryptSecret(ini.vault_key);
+    const apiUrl = ini.api_url;
+    if (accessToken && vaultKey) {
+      return {
+        apiKey: accessToken,
+        apiSecret: vaultKey,
+        apiUrl
+      };
+    }
+  } catch {
+  }
+  return null;
+}
+function readMcpConfigFile() {
+  try {
+    if (!fs.existsSync(MCP_CONFIG_FILE)) return null;
+    const data = JSON.parse(fs.readFileSync(MCP_CONFIG_FILE, "utf8"));
+    return {
+      apiKey: data.api_key || data.apiKey || data.token,
+      apiSecret: data.api_secret || data.apiSecret || data.secret,
+      apiUrl: data.api_url || data.apiUrl || data.api
+    };
+  } catch {
+    return null;
+  }
+}
+function writeMcpConfigFile(data) {
+  try {
+    if (!fs.existsSync(ZIPHRO_DIR)) {
+      fs.mkdirSync(ZIPHRO_DIR, { recursive: true, mode: 448 });
+    }
+    fs.writeFileSync(MCP_CONFIG_FILE, JSON.stringify(data, null, 2), { mode: 384 });
+  } catch (err) {
+    console.error("Failed to write mcp config file:", err);
+  }
+}
+async function runBrowserAuth(apiUrl) {
+  const DEFAULT_PORT = 3456;
+  console.error("\n" + "=".repeat(68));
+  console.error("  \u2726 Ziphro MCP \u2014 Trusted AI Agent Authorization");
+  console.error("=".repeat(68));
+  console.error("Starting local handshake receiver...\n");
+  const server = http.createServer((req, res) => {
+    res.setHeader("Access-Control-Allow-Origin", "*");
+    res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+    res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
+    if (req.method === "OPTIONS") {
+      res.writeHead(204);
+      res.end();
+      return;
+    }
+    const parsedUrl = new URL(req.url || "/", `http://${req.headers.host || "localhost"}`);
+    if (parsedUrl.pathname === "/callback") {
+      const handlePayload = (apiKey, apiSecret, resolvedApiUrl) => {
+        if (!apiKey || !apiSecret) {
+          res.writeHead(400, { "Content-Type": "text/html" });
+          res.end(`
+            <html><body style="font-family:sans-serif;background:#0d1117;color:#ff6b6b;padding:40px;text-align:center;">
+              <h2>Authorization Failed</h2>
+              <p>Missing api_key or api_secret parameters.</p>
+            </body></html>
+          `);
+          return;
+        }
+        const finalApiUrl = (resolvedApiUrl || apiUrl).replace(/\/$/, "");
+        writeMcpConfigFile({
+          api_key: apiKey,
+          api_secret: apiSecret,
+          api_url: finalApiUrl
+        });
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(`
+          <!DOCTYPE html>
+          <html>
+          <head>
+            <meta charset="utf-8" />
+            <title>Ziphro MCP \u2014 Authorized</title>
+            <style>
+              body {
+                font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+                background: #090a0f;
+                color: #f1f5f9;
+                display: flex;
+                align-items: center;
+                justify-content: center;
+                height: 100vh;
+                margin: 0;
+              }
+              .box {
+                background: #11141c;
+                border: 1px solid #1f2536;
+                padding: 40px;
+                border-radius: 14px;
+                text-align: center;
+                max-width: 440px;
+                box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.7);
+              }
+              .badge {
+                display: inline-block;
+                background: rgba(0, 223, 216, 0.1);
+                color: #00dfd8;
+                border: 1px solid rgba(0, 223, 216, 0.25);
+                border-radius: 999px;
+                padding: 4px 14px;
+                font-size: 11px;
+                font-weight: 700;
+                letter-spacing: 0.08em;
+                text-transform: uppercase;
+                margin-bottom: 16px;
+              }
+              h1 { font-size: 20px; font-weight: 700; margin: 0 0 10px 0; color: #ffffff; }
+              p { color: #94a3b8; font-size: 13px; line-height: 1.6; margin: 0 0 24px 0; }
+              .btn {
+                background: #00dfd8;
+                color: #090a0f;
+                border: none;
+                padding: 10px 24px;
+                border-radius: 8px;
+                font-weight: 600;
+                font-size: 13px;
+                cursor: pointer;
+              }
+            </style>
+          </head>
+          <body>
+            <div class="box">
+              <div class="badge">E2E Zero-Knowledge Connected</div>
+              <h1>Trusted AI Agent Authorized</h1>
+              <p>Ziphro MCP has received your zero-knowledge API Key and Vault Secret. You can now close this browser tab and return to your terminal.</p>
+              <button class="btn" onclick="window.close()">Close Window</button>
+            </div>
+          </body>
+          </html>
+        `);
+        console.error("\n" + "\u2714".repeat(3) + " Successfully authorized AI agent!");
+        console.error(`\u2714 Credentials saved securely to: ${MCP_CONFIG_FILE}`);
+        console.error(`\u2714 API Key: ${apiKey.slice(0, 16)}...`);
+        console.error("\u2714 You can now run Ziphro MCP in Claude Desktop, Cursor, or CLI without passwords!\n");
+        setTimeout(() => {
+          server.close();
+          process.exit(0);
+        }, 800);
+      };
+      if (req.method === "POST") {
+        let body = "";
+        req.on("data", (chunk) => {
+          body += chunk;
+        });
+        req.on("end", () => {
+          try {
+            const json = JSON.parse(body);
+            handlePayload(json.api_key || json.apiKey, json.api_secret || json.apiSecret, json.api_url || json.apiUrl);
+          } catch {
+            res.writeHead(400);
+            res.end();
+          }
+        });
+      } else {
+        const apiKey = parsedUrl.searchParams.get("api_key") || parsedUrl.searchParams.get("apiKey") || "";
+        const apiSecret = parsedUrl.searchParams.get("api_secret") || parsedUrl.searchParams.get("apiSecret") || "";
+        const resApiUrl = parsedUrl.searchParams.get("api_url") || parsedUrl.searchParams.get("apiUrl") || "";
+        handlePayload(apiKey, apiSecret, resApiUrl);
+      }
+      return;
+    }
+    res.writeHead(404);
+    res.end();
+  });
+  server.on("error", (err) => {
+    if (err.code === "EADDRINUSE") {
+      server.listen(0, "127.0.0.1");
+    } else {
+      console.error("Handshake server error:", err);
+      process.exit(1);
+    }
+  });
+  server.listen(DEFAULT_PORT, "127.0.0.1", () => {
+    const addr = server.address();
+    const port = addr.port;
+    const authUrl = `${apiUrl.replace(/\/$/, "")}/mcp/authorize?port=${port}&client=Ziphro%20MCP`;
+    console.error(`1. Opening your browser to authorize your AI agent:`);
+    console.error(`   \u{1F449}  ${authUrl}
+`);
+    console.error(`2. If your browser did not open automatically, copy and open the link above.`);
+    console.error(`3. Waiting for browser authorization... (Press Ctrl+C to cancel)
+`);
+    const startCmd = process.platform === "win32" ? `start "" "${authUrl}"` : process.platform === "darwin" ? `open "${authUrl}"` : `xdg-open "${authUrl}"`;
+    exec(startCmd, () => {
+    });
+  });
+  setTimeout(() => {
+    console.error("\n\u2716 Authorization timed out after 5 minutes.");
+    server.close();
+    process.exit(1);
+  }, 5 * 60 * 1e3);
+}
+var cliApiKey = "";
+var cliApiSecret = "";
+var cliApiUrl = "";
+var isAuthCommand = false;
+for (let i = 2; i < process.argv.length; i++) {
+  const arg = process.argv[i];
+  if (arg === "auth" || arg === "--auth" || arg === "login" || arg === "--login") {
+    isAuthCommand = true;
+  } else if ((arg === "--api-key" || arg === "--token" || arg === "-t") && process.argv[i + 1]) {
+    cliApiKey = process.argv[i + 1];
+    i++;
+  } else if ((arg === "--api-secret" || arg === "--secret" || arg === "-s" || arg === "--password") && process.argv[i + 1]) {
+    cliApiSecret = process.argv[i + 1];
+    i++;
+  } else if ((arg === "--api" || arg === "--api-url" || arg === "-a") && process.argv[i + 1]) {
+    cliApiUrl = process.argv[i + 1];
+    i++;
+  }
+}
+var DEFAULT_API_URL = "https://api-ziphro.vercel.app";
+var ZIPHRO_API = (cliApiUrl || process.env.ZIPHRO_API || process.env.ZIPHRO_API_URL || readMcpConfigFile()?.apiUrl || readCliCredentials()?.apiUrl || DEFAULT_API_URL).replace(/\/$/, "");
+if (isAuthCommand) {
+  runBrowserAuth(ZIPHRO_API);
+} else {
+  startMcpServer();
+}
+async function startMcpServer() {
+  const mcpConfigFile = readMcpConfigFile();
+  const cliCreds = readCliCredentials();
+  const ZIPHRO_API_KEY = cliApiKey || process.env.ZIPHRO_API_KEY || process.env.ZIPHRO_TOKEN || mcpConfigFile?.apiKey || cliCreds?.apiKey || "";
+  const ZIPHRO_API_SECRET = cliApiSecret || process.env.ZIPHRO_API_SECRET || process.env.ZIPHRO_PASSWORD || mcpConfigFile?.apiSecret || cliCreds?.apiSecret || "";
+  if (!ZIPHRO_API_KEY || !ZIPHRO_API_SECRET) {
+    console.error("\n" + "=".repeat(68));
+    console.error("  \u2726 Ziphro MCP Server \u2014 Authentication Required");
+    console.error("=".repeat(68));
+    console.error("No credentials found. Ziphro MCP uses zero-knowledge API Key & Secret");
+    console.error("pairing. Your master password is NEVER asked for or stored.\n");
+    console.error("To authorize your AI agent in one step, run:");
+    console.error("  \u{1F449}  npx ziphro-mcp auth\n");
+    console.error("Or set environment variables in your client config:");
+    console.error('  ZIPHRO_API_KEY="zp_live_..."');
+    console.error('  ZIPHRO_API_SECRET="zs_live_..."');
+    console.error(`  ZIPHRO_API="${ZIPHRO_API}"`);
+    console.error("=".repeat(68) + "\n");
+    process.exit(1);
+  }
+  let currentUserId = "mcp";
+  let currentRevision = 1;
+  function resolveUniqueId(tasks, id) {
+    const matches = tasks.filter((t) => t.id === id || t.id.startsWith(id));
+    if (matches.length === 0) {
+      return { errorText: `Task with ID matching "${id}" not found.` };
+    }
+    if (matches.length > 1) {
+      const list = matches.map((t) => `- \`${t.id.substring(0, 8)}\`: ${t.description}`).join("\n");
+      return { errorText: `"${id}" matches ${matches.length} tasks \u2014 use a longer/exact ID:
+${list}` };
+    }
+    return { targetId: matches[0].id };
+  }
+  async function fetchTasks() {
+    try {
+      const res = await fetch(`${ZIPHRO_API}/api/v1/tasks`, {
+        method: "GET",
+        headers: {
+          Authorization: `Bearer ${ZIPHRO_API_KEY}`,
+          "Content-Type": "application/json"
+        }
+      });
+      if (res.status === 404) {
+        return { tasks: [], version: "" };
+      }
+      if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`Sync download failed: ${res.status} ${text}`);
+      }
+      const json = await res.json();
+      if (!json.success || !json.data || !json.data.encrypted_blob) {
+        return { tasks: [], version: "" };
+      }
+      if (json.data.userId || json.data.user_id) {
+        currentUserId = json.data.userId || json.data.user_id;
+      }
+      if (json.data.revision) {
+        currentRevision = json.data.revision;
+      }
+      const decrypted = await decrypt(json.data.encrypted_blob, ZIPHRO_API_SECRET, {
+        userId: currentUserId,
+        revision: currentRevision,
+        version: 2
+      });
+      const bundle = JSON.parse(decrypted);
+      return { tasks: bundle.tasks || [], version: json.data.checksum || "" };
+    } catch (err) {
+      console.error("Error fetching tasks from cloud:", err);
+      throw new McpError(ErrorCode.InternalError, `Could not retrieve task list: ${err.message}`);
+    }
+  }
+  async function uploadTasks(tasks, expectedVersion) {
+    try {
+      currentRevision = currentRevision + 1;
+      const bundle = {
+        tasks,
+        schema_version: "2",
+        exported_at: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      const plaintext = JSON.stringify(bundle);
+      const blobChecksum = checksum(plaintext);
+      const blob = await encrypt(plaintext, ZIPHRO_API_SECRET, {
+        userId: currentUserId || "mcp",
+        revision: currentRevision,
+        version: 2
+      });
+      const res = await fetch(`${ZIPHRO_API}/api/v1/tasks`, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${ZIPHRO_API_KEY}`,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({
+          encrypted_blob: blob,
+          checksum: blobChecksum,
+          expected_checksum: expectedVersion,
+          device_id: "mcp"
+        })
+      });
+      if (res.status === 409) {
+        throw new McpError(ErrorCode.InternalError, "Task list changed on another device \u2014 please retry.");
+      }
+      if (!res.ok) {
+        const text = await res.text();
+        throw new Error(`Sync upload failed: ${res.status} ${text}`);
+      }
+    } catch (err) {
+      console.error("Error uploading tasks to cloud:", err);
+      throw new McpError(ErrorCode.InternalError, `Could not sync changes to cloud: ${err.message}`);
+    }
+  }
+  const server = new Server(
+    {
+      name: "ziphro-mcp",
+      version: "2.0.0-preview.0"
+    },
+    {
+      capabilities: {
+        tools: {}
+      }
+    }
+  );
+  server.setRequestHandler(ListToolsRequestSchema, async () => {
+    return {
+      tools: [
+        {
+          name: "list_tasks",
+          description: "List user tasks with optional status and priority filters. Returns decrypted task details.",
+          inputSchema: {
+            type: "object",
+            properties: {
+              status: {
+                type: "string",
+                enum: ["pending", "in_progress", "completed", "all"],
+                description: "Filter tasks by status (default: all)"
+              },
+              priority: {
+                type: "string",
+                enum: ["high", "medium", "low", "all"],
+                description: "Filter tasks by priority level (default: all)"
+              },
+              tag: {
+                type: "string",
+                description: "Filter tasks by a specific tag"
+              }
+            }
+          }
+        },
+        {
+          name: "add_task",
+          description: "Create a new task with description, priority, due date, and tags.",
+          inputSchema: {
+            type: "object",
+            required: ["description"],
+            properties: {
+              description: {
+                type: "string",
+                description: "What needs to be done"
+              },
+              priority: {
+                type: "string",
+                enum: ["high", "medium", "low"],
+                description: "Task priority level (default: medium)"
+              },
+              due_date: {
+                type: "string",
+                description: "ISO 8601 due date string (optional)"
+              },
+              tags: {
+                type: "array",
+                items: { type: "string" },
+                description: "List of tags/labels for categorizing the task"
+              }
+            }
+          }
+        },
+        {
+          name: "complete_task",
+          description: "Mark an active task as completed with an optional note.",
+          inputSchema: {
+            type: "object",
+            required: ["task_id"],
+            properties: {
+              task_id: {
+                type: "string",
+                description: "The UUID or short prefix ID of the task to complete"
+              },
+              note: {
+                type: "string",
+                description: "Optional completion note"
+              }
+            }
+          }
+        },
+        {
+          name: "get_task_stats",
+          description: "Get aggregated metrics and status breakdown of the task list.",
+          inputSchema: {
+            type: "object",
+            properties: {}
+          }
+        },
+        {
+          name: "suggest_priorities",
+          description: "Rank and suggest high-priority or overdue tasks to focus on next.",
+          inputSchema: {
+            type: "object",
+            properties: {
+              limit: {
+                type: "number",
+                description: "Maximum number of suggestions to return (default: 5)"
+              }
+            }
+          }
+        },
+        {
+          name: "search_tasks",
+          description: "Full-text search tasks by keyword, tag, or due date range.",
+          inputSchema: {
+            type: "object",
+            properties: {
+              query: { type: "string", description: "Search keyword matching task description" },
+              tags: { type: "array", items: { type: "string" }, description: "List of tags to filter by" },
+              due_before: { type: "string", description: "ISO due date string" }
+            }
+          }
+        },
+        {
+          name: "update_task",
+          description: "Update properties (description, priority, status, tags, due date) of an existing task.",
+          inputSchema: {
+            type: "object",
+            required: ["id"],
+            properties: {
+              id: { type: "string", description: "UUID or unique prefix ID of the task to update" },
+              description: { type: "string", description: "New description" },
+              priority: { type: "string", enum: ["high", "medium", "low"], description: "New priority level" },
+              status: { type: "string", enum: ["pending", "in_progress", "completed"], description: "New status" },
+              due_date: { type: "string", description: "New ISO due date string" },
+              due: { type: "string", description: "Alias for due_date" },
+              tags: { type: "array", items: { type: "string" }, description: "New set of tags" }
+            }
+          }
+        },
+        {
+          name: "bulk_complete",
+          description: "Mark multiple tasks as completed in a single action.",
+          inputSchema: {
+            type: "object",
+            required: ["ids"],
+            properties: {
+              ids: { type: "array", items: { type: "string" }, description: "List of task UUIDs" },
+              note: { type: "string", description: "Optional completion note for all tasks" }
+            }
+          }
+        },
+        {
+          name: "get_overdue",
+          description: "Retrieve all pending or in-progress tasks that are past their due dates.",
+          inputSchema: {
+            type: "object",
+            properties: {}
+          }
+        }
+      ]
+    };
+  });
+  server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    const { name, arguments: args } = request.params;
+    try {
+      switch (name) {
+        case "list_tasks": {
+          const filterStatus = args?.status || "all";
+          const filterPriority = args?.priority || "all";
+          const filterTag = args?.tag || "";
+          const { tasks } = await fetchTasks();
+          let filtered = tasks;
+          if (filterStatus !== "all") {
+            filtered = filtered.filter((t) => t.status === filterStatus);
+          }
+          if (filterPriority !== "all") {
+            filtered = filtered.filter((t) => t.priority === filterPriority);
+          }
+          if (filterTag) {
+            filtered = filtered.filter((t) => t.tags.includes(filterTag));
+          }
+          if (filtered.length === 0) {
+            return {
+              content: [{ type: "text", text: "No matching tasks found." }]
+            };
+          }
+          const tableHeader = "| Status | Priority | Description | Due Date | Tags | Short ID |\n| :---: | :---: | :--- | :--- | :--- | :---: |";
+          const rows = filtered.map((t) => {
+            const statusEmoji = t.status === "completed" ? "\u2705" : t.status === "in_progress" ? "\u26A1" : "\u23F3";
+            const priorityEmoji = t.priority === "high" ? "\u{1F534} High" : t.priority === "medium" ? "\u{1F7E1} Medium" : "\u{1F7E2} Low";
+            const due = t.due_date ? new Date(t.due_date).toLocaleDateString() : "-";
+            const tagsStr = t.tags.length > 0 ? t.tags.map((tag) => `\`${tag}\``).join(", ") : "-";
+            const shortId = `\`${t.id.substring(0, 8)}\``;
+            return `| ${statusEmoji} | ${priorityEmoji} | ${t.description} | ${due} | ${tagsStr} | ${shortId} |`;
+          }).join("\n");
+          const formatted = `${tableHeader}
+${rows}`;
+          return {
+            content: [{ type: "text", text: `### \u{1FA90} Found ${filtered.length} task${filtered.length === 1 ? "" : "s"}:
+
+${formatted}` }]
+          };
+        }
+        case "add_task": {
+          const description = args?.description;
+          const priority = args?.priority || "medium";
+          const due_date = args?.due_date;
+          const tags = args?.tags || [];
+          if (!description) {
+            throw new McpError(ErrorCode.InvalidParams, "Description is required.");
+          }
+          const { tasks, version } = await fetchTasks();
+          const newTask = {
+            id: crypto.randomUUID(),
+            description,
+            priority,
+            status: "pending",
+            tags,
+            due_date,
+            created_at: (/* @__PURE__ */ new Date()).toISOString(),
+            updated_at: (/* @__PURE__ */ new Date()).toISOString(),
+            device_id: "mcp",
+            vector_clock: { mcp: 1 }
+          };
+          const nextTasks = [...tasks, newTask];
+          await uploadTasks(nextTasks, version);
+          return {
+            content: [{ type: "text", text: `Successfully created task: "${newTask.description}" with ID: ${newTask.id}` }]
+          };
+        }
+        case "complete_task": {
+          const taskId = args?.task_id;
+          const note = args?.note;
+          if (!taskId) {
+            throw new McpError(ErrorCode.InvalidParams, "Task ID is required.");
+          }
+          const { tasks, version } = await fetchTasks();
+          const resolution = resolveUniqueId(tasks, taskId);
+          if (resolution.errorText) {
+            return {
+              content: [{ type: "text", text: resolution.errorText }],
+              isError: true
+            };
+          }
+          const targetId = resolution.targetId;
+          const nextTasks = tasks.map((t) => {
+            if (t.id === targetId) {
+              return {
+                ...t,
+                status: "completed",
+                completed_at: (/* @__PURE__ */ new Date()).toISOString(),
+                completion_note: note,
+                updated_at: (/* @__PURE__ */ new Date()).toISOString()
+              };
+            }
+            return t;
+          });
+          await uploadTasks(nextTasks, version);
+          return {
+            content: [{ type: "text", text: `Task completed successfully.` }]
+          };
+        }
+        case "get_task_stats": {
+          const { tasks } = await fetchTasks();
+          const total = tasks.length;
+          const completed = tasks.filter((t) => t.status === "completed").length;
+          const pending = tasks.filter((t) => t.status === "pending").length;
+          const inProgress = tasks.filter((t) => t.status === "in_progress").length;
+          const high = tasks.filter((t) => t.priority === "high").length;
+          const medium = tasks.filter((t) => t.priority === "medium").length;
+          const low = tasks.filter((t) => t.priority === "low").length;
+          const overdue = tasks.filter((t) => t.due_date && t.status !== "completed" && new Date(t.due_date) < /* @__PURE__ */ new Date()).length;
+          const completionRate = total > 0 ? Math.round(completed / total * 100) : 0;
+          const responseText = [
+            `\u2726 Ziphro Dashboard Metrics \u2726`,
+            `------------------------------`,
+            `Total Tasks:     ${total}`,
+            `Completed:       ${completed} (${completionRate}%)`,
+            `In Progress:     ${inProgress}`,
+            `Backlog/Pending: ${pending}`,
+            `Overdue:         ${overdue}`,
+            `------------------------------`,
+            `Priority Breakdown:`,
+            ` - High:   ${high}`,
+            ` - Medium: ${medium}`,
+            ` - Low:    ${low}`
+          ].join("\n");
+          return {
+            content: [{ type: "text", text: responseText }]
+          };
+        }
+        case "suggest_priorities": {
+          const limit = args?.limit || 5;
+          const { tasks } = await fetchTasks();
+          const activeTasks = tasks.filter((t) => t.status !== "completed");
+          const sorted = activeTasks.sort((a, b) => {
+            const aOverdue = a.due_date && new Date(a.due_date) < /* @__PURE__ */ new Date();
+            const bOverdue = b.due_date && new Date(b.due_date) < /* @__PURE__ */ new Date();
+            if (aOverdue && !bOverdue) return -1;
+            if (!aOverdue && bOverdue) return 1;
+            const priorityWeights = { high: 3, medium: 2, low: 1 };
+            const aWeight = priorityWeights[a.priority];
+            const bWeight = priorityWeights[b.priority];
+            if (aWeight !== bWeight) {
+              return bWeight - aWeight;
+            }
+            return new Date(b.updated_at).getTime() - new Date(a.updated_at).getTime();
+          });
+          const suggestions = sorted.slice(0, limit);
+          if (suggestions.length === 0) {
+            return {
+              content: [{ type: "text", text: "You have no active pending tasks!" }]
+            };
+          }
+          const formatted = suggestions.map((t, idx) => {
+            const priorityEmoji = t.priority === "high" ? "\u{1F534} High" : t.priority === "medium" ? "\u{1F7E1} Medium" : "\u{1F7E2} Low";
+            const due = t.due_date ? ` \u{1F4C5} *Due: ${new Date(t.due_date).toLocaleDateString()}*` : "";
+            const overdueMarker = t.due_date && new Date(t.due_date) < /* @__PURE__ */ new Date() ? " \u26A0\uFE0F **[OVERDUE]**" : "";
+            const shortId = `\`${t.id.substring(0, 8)}\``;
+            return `${idx + 1}. **[${priorityEmoji}]** ${t.description}${due}${overdueMarker} *(ID: ${shortId})*`;
+          }).join("\n");
+          return {
+            content: [{ type: "text", text: `### \u{1F680} Suggested tasks to work on next:
+
+${formatted}` }]
+          };
+        }
+        case "search_tasks": {
+          const query = (args?.query || "").toLowerCase();
+          const filterTags = args?.tags || [];
+          const dueBefore = args?.due_before || "";
+          const { tasks } = await fetchTasks();
+          let filtered = tasks;
+          if (query) {
+            filtered = filtered.filter((t) => t.description.toLowerCase().includes(query));
+          }
+          if (filterTags.length > 0) {
+            filtered = filtered.filter((t) => filterTags.every((tag) => t.tags.includes(tag)));
+          }
+          if (dueBefore) {
+            const limitDate = new Date(dueBefore);
+            filtered = filtered.filter((t) => t.due_date && new Date(t.due_date) <= limitDate);
+          }
+          if (filtered.length === 0) {
+            return {
+              content: [{ type: "text", text: "No matching tasks found." }]
+            };
+          }
+          const tableHeader = "| Status | Priority | Description | Due Date | Tags | Short ID |\n| :---: | :---: | :--- | :--- | :--- | :---: |";
+          const rows = filtered.map((t) => {
+            const statusEmoji = t.status === "completed" ? "\u2705" : t.status === "in_progress" ? "\u26A1" : "\u23F3";
+            const priorityEmoji = t.priority === "high" ? "\u{1F534} High" : t.priority === "medium" ? "\u{1F7E1} Medium" : "\u{1F7E2} Low";
+            const due = t.due_date ? new Date(t.due_date).toLocaleDateString() : "-";
+            const tagsStr = t.tags.length > 0 ? t.tags.map((tag) => `\`${tag}\``).join(", ") : "-";
+            const shortId = `\`${t.id.substring(0, 8)}\``;
+            return `| ${statusEmoji} | ${priorityEmoji} | ${t.description} | ${due} | ${tagsStr} | ${shortId} |`;
+          }).join("\n");
+          return {
+            content: [{ type: "text", text: `### \u{1F50D} Search results (${filtered.length} matches):
+
+${tableHeader}
+${rows}` }]
+          };
+        }
+        case "update_task": {
+          const id = args?.id;
+          const description = args?.description;
+          const priority = args?.priority;
+          const status = args?.status;
+          const due_date = args?.due_date || args?.due;
+          const tags = args?.tags;
+          if (!id) {
+            throw new McpError(ErrorCode.InvalidParams, "Task ID (id) is required.");
+          }
+          const { tasks, version } = await fetchTasks();
+          const resolution = resolveUniqueId(tasks, id);
+          if (resolution.errorText) {
+            return {
+              content: [{ type: "text", text: resolution.errorText }],
+              isError: true
+            };
+          }
+          const targetId = resolution.targetId;
+          const nextTasks = tasks.map((t) => {
+            if (t.id === targetId) {
+              const updated = { ...t };
+              if (description !== void 0) updated.description = description;
+              if (priority !== void 0) updated.priority = priority;
+              if (status !== void 0) {
+                updated.status = status;
+                if (status === "completed") {
+                  updated.completed_at = (/* @__PURE__ */ new Date()).toISOString();
+                } else {
+                  updated.completed_at = void 0;
+                }
+              }
+              if (due_date !== void 0) {
+                updated.due_date = due_date ? new Date(due_date).toISOString() : void 0;
+              }
+              if (tags !== void 0) updated.tags = tags;
+              updated.updated_at = (/* @__PURE__ */ new Date()).toISOString();
+              updated.vector_clock = { ...t.vector_clock, mcp: (t.vector_clock["mcp"] || 0) + 1 };
+              return updated;
+            }
+            return t;
+          });
+          await uploadTasks(nextTasks, version);
+          return {
+            content: [{ type: "text", text: `Task updated successfully.` }]
+          };
+        }
+        case "bulk_complete": {
+          const ids = args?.ids;
+          const note = args?.note;
+          if (!ids || ids.length === 0) {
+            throw new McpError(ErrorCode.InvalidParams, "IDs list (ids) is required.");
+          }
+          const { tasks, version } = await fetchTasks();
+          const targetIds = [];
+          for (const id of ids) {
+            const resolution = resolveUniqueId(tasks, id);
+            if (resolution.errorText) {
+              return {
+                content: [{ type: "text", text: resolution.errorText }],
+                isError: true
+              };
+            }
+            targetIds.push(resolution.targetId);
+          }
+          const nextTasks = tasks.map((t) => {
+            if (targetIds.includes(t.id)) {
+              return {
+                ...t,
+                status: "completed",
+                completed_at: (/* @__PURE__ */ new Date()).toISOString(),
+                completion_note: note || t.completion_note,
+                updated_at: (/* @__PURE__ */ new Date()).toISOString(),
+                vector_clock: { ...t.vector_clock, mcp: (t.vector_clock["mcp"] || 0) + 1 }
+              };
+            }
+            return t;
+          });
+          await uploadTasks(nextTasks, version);
+          return {
+            content: [{ type: "text", text: `Successfully completed ${targetIds.length} tasks.` }]
+          };
+        }
+        case "get_overdue": {
+          const { tasks } = await fetchTasks();
+          const now = /* @__PURE__ */ new Date();
+          const overdue = tasks.filter((t) => t.due_date && t.status !== "completed" && new Date(t.due_date) < now);
+          if (overdue.length === 0) {
+            return {
+              content: [{ type: "text", text: "Nice job! You have no overdue tasks." }]
+            };
+          }
+          const tableHeader = "| Priority | Description | Due Date | Tags | Short ID |\n| :---: | :--- | :--- | :--- | :---: |";
+          const rows = overdue.map((t) => {
+            const priorityEmoji = t.priority === "high" ? "\u{1F534} High" : t.priority === "medium" ? "\u{1F7E1} Medium" : "\u{1F7E2} Low";
+            const due = t.due_date ? new Date(t.due_date).toLocaleDateString() : "-";
+            const tagsStr = t.tags.length > 0 ? t.tags.map((tag) => `\`${tag}\``).join(", ") : "-";
+            const shortId = `\`${t.id.substring(0, 8)}\``;
+            return `| ${priorityEmoji} | ${t.description} | **${due}** | ${tagsStr} | ${shortId} |`;
+          }).join("\n");
+          return {
+            content: [{ type: "text", text: `### \u26A0\uFE0F Found ${overdue.length} overdue task${overdue.length === 1 ? "" : "s"}:
+
+${tableHeader}
+${rows}` }]
+          };
+        }
+        default:
+          throw new McpError(ErrorCode.MethodNotFound, `Unknown tool: ${name}`);
+      }
+    } catch (err) {
+      return {
+        content: [{ type: "text", text: `Error executing tool "${name}": ${err.message}` }],
+        isError: true
+      };
+    }
+  });
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+  console.error("Ziphro MCP server running on stdio");
+}

package/package.json

@@ -1,6 +1,58 @@
 {
   "name": "ziphro-mcp",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "2.0.0-preview.0",
+  "description": "Ziphro Model Context Protocol (MCP) server for zero-knowledge E2E encrypted task management",
+  "license": "MIT",
+  "type": "module",
+  "main": "dist/index.js",
+  "bin": {
+    "ziphro-mcp": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "scripts",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsup src/index.ts --format esm --out-dir dist --shims --clean",
+    "start": "node dist/index.js",
+    "dev": "tsx src/index.ts",
+    "lint": "tsc --noEmit",
+    "postinstall": "node scripts/postinstall.js"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/AJAYMYTH/TaskAir.git",
+    "directory": "mcp-server"
+  },
+  "bugs": {
+    "url": "https://github.com/AJAYMYTH/TaskAir/issues"
+  },
+  "homepage": "https://github.com/AJAYMYTH/TaskAir#readme",
+  "keywords": [
+    "ziphro",
+    "mcp",
+    "model-context-protocol",
+    "e2e-encryption",
+    "zero-knowledge",
+    "task-management"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.1",
+    "@ziphro/crdt": "2.0.0-preview.0",
+    "@ziphro/crypto": "2.0.0-preview.0",
+    "@ziphro/types": "2.0.0-preview.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.14.0",
+    "tsup": "^8.1.0",
+    "tsx": "^4.15.0",
+    "typescript": "^5.4.5"
+  }
+}

package/scripts/postinstall.js

@@ -0,0 +1,30 @@
+const ORANGE = '\x1b[38;2;245;78;0m';
+const WHITE = '\x1b[38;2;245;244;239m';
+const MUTED = '\x1b[38;2;142;142;147m';
+const BOLD = '\x1b[1m';
+const RESET = '\x1b[0m';
+
+const ASCII_BANNER = [
+  { ziph: '███████╗██╗██████╗ ██╗  ██╗', ro: '██████╗  ██████╗ ' },
+  { ziph: '╚══███╔╝██║██╔══██╗██║  ██║', ro: '██╔══██╗██╔═══██╗' },
+  { ziph: '  ███╔╝ ██║██████╔╝███████║', ro: '██████╔╝██║   ██║' },
+  { ziph: ' ███╔╝  ██║██╔═══╝ ██╔══██║', ro: '██╔══██╗██║   ██║' },
+  { ziph: '███████╗██║██║     ██║  ██║', ro: '██║  ██║╚██████╔╝' },
+  { ziph: '╚══════╝╚═╝╚═╝     ╚═╝  ╚═╝', ro: '╚═╝  ╚═╝ ╚═════╝ ' },
+];
+
+function run() {
+  // Never emit stdout banners during CI or non-interactive npx stdio invocations
+  if (!process.stdout.isTTY || process.env.CI || process.env.npm_config_loglevel === 'silent') {
+    return;
+  }
+
+  console.log('');
+  for (const row of ASCII_BANNER) {
+    console.log(`${BOLD}${WHITE}${row.ziph}${ORANGE}${row.ro}${RESET}`);
+  }
+  console.log(`${MUTED}  ✦ Ziphro MCP Server v2.0.0-preview.0 · Zero-Knowledge Vault ✦${RESET}`);
+  console.log(`${MUTED}  Next: run ${ORANGE}npx ziphro-mcp@preview auth${MUTED} to authorize your AI client.${RESET}\n`);
+}
+
+run();