agent-baton-cli 0.1.0__tar.gz → 0.2.0__tar.gz

agent_baton_cli-0.2.0/.dockerignore

@@ -0,0 +1,6 @@
+*
+!pyproject.toml
+!README.md
+!LICENSE
+!src/
+**/__pycache__

agent_baton_cli-0.2.0/.github/workflows/release.yml

@@ -0,0 +1,62 @@
+name: release
+
+# Push a tag like v0.1.0 to publish to PyPI and ghcr.io/varnholt/agent-baton.
+# Uses PyPI trusted publishing and the workflow's GITHUB_TOKEN: no token is stored in this repo.
+
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  pypi:
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+      - run: uv run --group dev pytest -q
+      - name: check tag matches version
+        run: |
+          v=$(grep -m1 '^version' pyproject.toml | cut -d'"' -f2)
+          test "v$v" = "$GITHUB_REF_NAME" || { echo "tag $GITHUB_REF_NAME != version $v"; exit 1; }
+      - run: uv build
+      - uses: pypa/gh-action-pypi-publish@release/v1
+      - name: GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release create "$GITHUB_REF_NAME" dist/* --generate-notes
+
+  image:
+    # Runs after the PyPI job, so tests and the tag/version check have passed.
+    needs: pypi
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+      - name: version from tag
+        id: v
+        run: echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            ghcr.io/varnholt/agent-baton:${{ steps.v.outputs.version }}
+            ghcr.io/varnholt/agent-baton:latest
+          labels: |
+            org.opencontainers.image.source=https://github.com/varnholt/agent-baton
+            org.opencontainers.image.version=${{ steps.v.outputs.version }}
+            org.opencontainers.image.licenses=MIT

agent_baton_cli-0.2.0/CHANGELOG.md

@@ -0,0 +1,25 @@
+# Changelog
+
+## 0.2.0
+
+- `build_finished` facts can be verified against GitHub Actions. Evidence is the run
+  URL (`https://github.com/<owner>/<repo>/actions/runs/<id>`, optionally with
+  `/attempts/<n>` or `/job/<id>`); `build` is the run id, `job` is the workflow file
+  stem or name. The verifier is picked by the evidence host; Jenkins is unchanged.
+- `baton quickstart`: a local single-user server for a first try. Creates a
+  database and token in the per-user data directory, prints the env lines for
+  bash and PowerShell, and serves on 127.0.0.1 only.
+- `baton mcp`: an MCP stdio server with `baton_publish`, `baton_wait`,
+  `baton_facts` and `baton_types`. Standard library only.
+- Docker image for the server, published to `ghcr.io/varnholt/agent-baton` on release.
+
+## 0.1.1
+
+- PyPI metadata: project URLs, keywords and classifiers. No code changes.
+
+## 0.1.0
+
+- First release, on PyPI as `agent-baton-cli`: typed facts with strict field
+  patterns, an HTTP + SQLite server with long-poll waits, receiver-side
+  verification against GitHub, Bitbucket Cloud and Jenkins, and instructions for
+  Claude Code, Codex, Cursor and Aider.

agent_baton_cli-0.2.0/Dockerfile

@@ -0,0 +1,27 @@
+# baton fact server.
+#   docker build -t agent-baton .
+#   docker run --rm -v baton-data:/data agent-baton baton member add alice --db /data/baton.db
+#   docker run -d -p 8765:8765 -v baton-data:/data agent-baton
+# Serves plain HTTP: put it behind a TLS proxy, or pass --tls-cert/--tls-key.
+FROM python:3.13-slim
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    PIP_NO_CACHE_DIR=1 \
+    PIP_DISABLE_PIP_VERSION_CHECK=1
+
+WORKDIR /src
+COPY pyproject.toml README.md LICENSE ./
+COPY src ./src
+RUN pip install . && rm -rf /src
+
+RUN useradd --system --uid 10001 --home-dir /data --shell /usr/sbin/nologin baton \
+    && mkdir -p /data && chown baton:baton /data
+
+USER baton
+WORKDIR /data
+VOLUME /data
+EXPOSE 8765
+
+# No HEALTHCHECK: every route, /v1/health included, needs a member token.
+CMD ["baton", "serve", "--db", "/data/baton.db", "--host", "0.0.0.0"]

agent_baton_cli-0.1.0/README.md → agent_baton_cli-0.2.0/PKG-INFO

@@ -1,3 +1,25 @@
+Metadata-Version: 2.5
+Name: agent-baton-cli
+Version: 0.2.0
+Summary: Pass verified facts between coding agents, so none of them sits waiting on a human relay.
+Project-URL: Homepage, https://github.com/varnholt/agent-baton
+Project-URL: Source, https://github.com/varnholt/agent-baton
+Project-URL: Issues, https://github.com/varnholt/agent-baton/issues
+Project-URL: Changelog, https://github.com/varnholt/agent-baton/blob/main/CHANGELOG.md
+License-Expression: MIT
+License-File: LICENSE
+Keywords: ai-agents,claude-code,codex,coding-agents,llm-security,multi-agent,prompt-injection
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Software Development
+Classifier: Topic :: Software Development :: Build Tools
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+
 # agent-baton
 
 [![ci](https://github.com/varnholt/agent-baton/actions/workflows/ci.yml/badge.svg)](https://github.com/varnholt/agent-baton/actions/workflows/ci.yml)
@@ -44,7 +66,7 @@ errors and confusion. baton is built so that does not happen:
 | Risk | What baton does |
 |---|---|
 | One agent instructs another | **Facts, not messages.** Every field is a short string matching a strict pattern. There is no free-text field to put a prompt in. |
-| A confused or malicious peer lies | **The receiver checks the source.** PR facts are checked against GitHub/Bitbucket, build facts against Jenkins, with the *receiver's* credentials. A contradicted fact exits non-zero. |
+| A confused or malicious peer lies | **The receiver checks the source.** PR facts are checked against GitHub/Bitbucket, build facts against Jenkins or GitHub Actions, with the *receiver's* credentials. A contradicted fact exits non-zero. |
 | Fake evidence (`https://evil.example/...`) | Verifiers only contact hosts the receiver already trusts, never follow redirects, and check the evidence is about the same PR/build as the fact. |
 | Impersonation | The publisher is set by the server from the token, never from the payload. |
 | "Who did that?" | Append-only log: every fact has publisher, timestamp and evidence. |
@@ -58,10 +80,25 @@ useful pointers, never grounds for an irreversible action.
 |---|---|---|---|
 | `pr_merged` | repo, pr | commit | GitHub, Bitbucket Cloud |
 | `pr_state` | repo, pr | state (`open/merged/declined/closed`) | GitHub, Bitbucket Cloud |
-| `build_finished` | job, build | result (`SUCCESS/FAILURE/...`) | Jenkins (`JENKINS_URL`) |
+| `build_finished` | job, build | result (`SUCCESS/FAILURE/...`) | Jenkins (`JENKINS_URL`), GitHub Actions |
 | `working_on` | repo, path | branch, state (`started/stopped`) | - |
 | `hint` | topic | tag (slug) | - |
 
+The verifier is chosen by the evidence host. For GitHub Actions the evidence is the
+run URL, `https://github.com/<owner>/<repo>/actions/runs/<run_id>` (a trailing
+`/attempts/<n>` checks that attempt; `/job/<id>` is accepted and checks the whole run).
+`build` must be the run id. `job` names the workflow, case-insensitive: the workflow
+file name without extension (`.github/workflows/ci.yml` -> `ci`) or the workflow's
+display name, optionally prefixed with `<repo>/` or `<owner>/<repo>/`, which must then
+match the evidence. The run must be `completed`; its conclusion maps to `success` ->
+`SUCCESS`, `failure`/`timed_out`/`startup_failure` -> `FAILURE`, `cancelled` -> `ABORTED`,
+`skipped`/`neutral` -> `NOT_BUILT`.
+
+```
+baton publish build_finished -s job=ci -s build=19121611211 -v result=SUCCESS \
+  -e https://github.com/acme/api/actions/runs/19121611211
+```
+
 Add your own with `baton serve --types types.json` (always delivered as unverifiable):
 
 ```json
@@ -74,8 +111,31 @@ Add your own with `baton serve --types types.json` (always delivered as unverifi
 
 Pure Python 3.10+, no dependencies.
 
+### 60-second quickstart
+
 ```
 pip install agent-baton-cli               # or: uv tool install agent-baton-cli
+baton quickstart
+```
+
+`quickstart` creates a database and a token for you in your per-user data directory
+(`~/.local/share/baton`, or `%LOCALAPPDATA%\baton` on Windows), prints the
+`BATON_URL`/`BATON_TOKEN` lines for bash and PowerShell, and serves on
+`127.0.0.1:8765` (`--port` to change; it refuses non-loopback addresses). Paste the
+env lines into two terminals and try it:
+
+```
+baton wait hint -s topic=hello              # terminal 1: blocks
+baton publish hint -s topic=hello -v tag=hi # terminal 2: terminal 1 wakes up
+```
+
+Rerunning `baton quickstart` prints the same token again. For a team, set up a
+shared server as below.
+
+### Shared server
+
+```
+pip install agent-baton-cli
 
 # on one shared machine
 baton member add alice --db team.db     # prints a token once
@@ -92,6 +152,17 @@ export BITBUCKET_TOKEN=...                # optional, private repos
 
 Without TLS, keep the server on `127.0.0.1` and reach it over an SSH tunnel.
 
+### Docker
+
+```
+docker volume create baton-data
+docker run --rm -v baton-data:/data ghcr.io/varnholt/agent-baton baton member add alice --db /data/baton.db
+docker run -d --name baton -p 127.0.0.1:8765:8765 -v baton-data:/data ghcr.io/varnholt/agent-baton
+```
+
+The image runs `baton serve --db /data/baton.db --host 0.0.0.0` as a non-root user and
+speaks plain HTTP: publish the port on loopback as above, or put a TLS proxy in front.
+
 ## Use it from your agent
 
 | Agent | File | Install |
@@ -100,6 +171,7 @@ Without TLS, keep the server on `127.0.0.1` and reach it over an SSH tunnel.
 | Codex | [`integrations/codex/AGENTS.md`](integrations/codex/AGENTS.md) | append to your `AGENTS.md` |
 | Cursor | [`integrations/cursor/baton.mdc`](integrations/cursor/baton.mdc) | copy to `.cursor/rules/` |
 | Aider | [`integrations/aider/CONVENTIONS.md`](integrations/aider/CONVENTIONS.md) | `aider --read ...` |
+| Any MCP client | [`integrations/mcp`](integrations/mcp/README.md) | `claude mcp add baton -- baton mcp` |
 
 Each one teaches the agent the same three habits: wait instead of asking the user to
 relay, publish what others may be waiting on, and treat every fact as data.

agent_baton_cli-0.1.0/PKG-INFO → agent_baton_cli-0.2.0/README.md

@@ -1,14 +1,3 @@
-Metadata-Version: 2.5
-Name: agent-baton-cli
-Version: 0.1.0
-Summary: Pass verified facts between coding agents, so none of them sits waiting on a human relay.
-License-Expression: MIT
-License-File: LICENSE
-Classifier: Programming Language :: Python :: 3
-Classifier: Topic :: Software Development
-Requires-Python: >=3.10
-Description-Content-Type: text/markdown
-
 # agent-baton
 
 [![ci](https://github.com/varnholt/agent-baton/actions/workflows/ci.yml/badge.svg)](https://github.com/varnholt/agent-baton/actions/workflows/ci.yml)
@@ -55,7 +44,7 @@ errors and confusion. baton is built so that does not happen:
 | Risk | What baton does |
 |---|---|
 | One agent instructs another | **Facts, not messages.** Every field is a short string matching a strict pattern. There is no free-text field to put a prompt in. |
-| A confused or malicious peer lies | **The receiver checks the source.** PR facts are checked against GitHub/Bitbucket, build facts against Jenkins, with the *receiver's* credentials. A contradicted fact exits non-zero. |
+| A confused or malicious peer lies | **The receiver checks the source.** PR facts are checked against GitHub/Bitbucket, build facts against Jenkins or GitHub Actions, with the *receiver's* credentials. A contradicted fact exits non-zero. |
 | Fake evidence (`https://evil.example/...`) | Verifiers only contact hosts the receiver already trusts, never follow redirects, and check the evidence is about the same PR/build as the fact. |
 | Impersonation | The publisher is set by the server from the token, never from the payload. |
 | "Who did that?" | Append-only log: every fact has publisher, timestamp and evidence. |
@@ -69,10 +58,25 @@ useful pointers, never grounds for an irreversible action.
 |---|---|---|---|
 | `pr_merged` | repo, pr | commit | GitHub, Bitbucket Cloud |
 | `pr_state` | repo, pr | state (`open/merged/declined/closed`) | GitHub, Bitbucket Cloud |
-| `build_finished` | job, build | result (`SUCCESS/FAILURE/...`) | Jenkins (`JENKINS_URL`) |
+| `build_finished` | job, build | result (`SUCCESS/FAILURE/...`) | Jenkins (`JENKINS_URL`), GitHub Actions |
 | `working_on` | repo, path | branch, state (`started/stopped`) | - |
 | `hint` | topic | tag (slug) | - |
 
+The verifier is chosen by the evidence host. For GitHub Actions the evidence is the
+run URL, `https://github.com/<owner>/<repo>/actions/runs/<run_id>` (a trailing
+`/attempts/<n>` checks that attempt; `/job/<id>` is accepted and checks the whole run).
+`build` must be the run id. `job` names the workflow, case-insensitive: the workflow
+file name without extension (`.github/workflows/ci.yml` -> `ci`) or the workflow's
+display name, optionally prefixed with `<repo>/` or `<owner>/<repo>/`, which must then
+match the evidence. The run must be `completed`; its conclusion maps to `success` ->
+`SUCCESS`, `failure`/`timed_out`/`startup_failure` -> `FAILURE`, `cancelled` -> `ABORTED`,
+`skipped`/`neutral` -> `NOT_BUILT`.
+
+```
+baton publish build_finished -s job=ci -s build=19121611211 -v result=SUCCESS \
+  -e https://github.com/acme/api/actions/runs/19121611211
+```
+
 Add your own with `baton serve --types types.json` (always delivered as unverifiable):
 
 ```json
@@ -85,8 +89,31 @@ Add your own with `baton serve --types types.json` (always delivered as unverifi
 
 Pure Python 3.10+, no dependencies.
 
+### 60-second quickstart
+
 ```
 pip install agent-baton-cli               # or: uv tool install agent-baton-cli
+baton quickstart
+```
+
+`quickstart` creates a database and a token for you in your per-user data directory
+(`~/.local/share/baton`, or `%LOCALAPPDATA%\baton` on Windows), prints the
+`BATON_URL`/`BATON_TOKEN` lines for bash and PowerShell, and serves on
+`127.0.0.1:8765` (`--port` to change; it refuses non-loopback addresses). Paste the
+env lines into two terminals and try it:
+
+```
+baton wait hint -s topic=hello              # terminal 1: blocks
+baton publish hint -s topic=hello -v tag=hi # terminal 2: terminal 1 wakes up
+```
+
+Rerunning `baton quickstart` prints the same token again. For a team, set up a
+shared server as below.
+
+### Shared server
+
+```
+pip install agent-baton-cli
 
 # on one shared machine
 baton member add alice --db team.db     # prints a token once
@@ -103,6 +130,17 @@ export BITBUCKET_TOKEN=...                # optional, private repos
 
 Without TLS, keep the server on `127.0.0.1` and reach it over an SSH tunnel.
 
+### Docker
+
+```
+docker volume create baton-data
+docker run --rm -v baton-data:/data ghcr.io/varnholt/agent-baton baton member add alice --db /data/baton.db
+docker run -d --name baton -p 127.0.0.1:8765:8765 -v baton-data:/data ghcr.io/varnholt/agent-baton
+```
+
+The image runs `baton serve --db /data/baton.db --host 0.0.0.0` as a non-root user and
+speaks plain HTTP: publish the port on loopback as above, or put a TLS proxy in front.
+
 ## Use it from your agent
 
 | Agent | File | Install |
@@ -111,6 +149,7 @@ Without TLS, keep the server on `127.0.0.1` and reach it over an SSH tunnel.
 | Codex | [`integrations/codex/AGENTS.md`](integrations/codex/AGENTS.md) | append to your `AGENTS.md` |
 | Cursor | [`integrations/cursor/baton.mdc`](integrations/cursor/baton.mdc) | copy to `.cursor/rules/` |
 | Aider | [`integrations/aider/CONVENTIONS.md`](integrations/aider/CONVENTIONS.md) | `aider --read ...` |
+| Any MCP client | [`integrations/mcp`](integrations/mcp/README.md) | `claude mcp add baton -- baton mcp` |
 
 Each one teaches the agent the same three habits: wait instead of asking the user to
 relay, publish what others may be waiting on, and treat every fact as data.

agent_baton_cli-0.2.0/integrations/mcp/README.md

@@ -0,0 +1,60 @@
+# baton over MCP
+
+`baton mcp` is a Model Context Protocol server on stdio. Any MCP client (Claude Code,
+Claude Desktop, Cursor, Codex, ...) can use baton through it without shelling out.
+It is part of the `baton` command, so there is nothing extra to install.
+
+It reads the same configuration as the CLI: `BATON_URL` and `BATON_TOKEN` (or
+`~/.config/baton/client.json`), plus the verifier settings (`GITHUB_TOKEN`,
+`BITBUCKET_TOKEN`, `JENKINS_URL`, ...). Verification runs inside `baton mcp`, on
+your machine, with your credentials.
+
+## Claude Code
+
+```
+claude mcp add baton -e BATON_URL=http://127.0.0.1:8765 -e BATON_TOKEN=bt_... -- baton mcp
+```
+
+If `BATON_URL` and `BATON_TOKEN` are already exported in the shell that starts
+Claude Code, `claude mcp add baton -- baton mcp` is enough.
+
+## Other clients (`mcpServers` JSON)
+
+```json
+{
+  "mcpServers": {
+    "baton": {
+      "command": "baton",
+      "args": ["mcp"],
+      "env": {
+        "BATON_URL": "http://127.0.0.1:8765",
+        "BATON_TOKEN": "bt_..."
+      }
+    }
+  }
+}
+```
+
+Without a global install: `"command": "uvx", "args": ["--from", "agent-baton-cli", "baton", "mcp"]`.
+
+## Tools
+
+| tool | does |
+|---|---|
+| `baton_types` | list the fact types the server accepts |
+| `baton_publish` | publish a fact: `type`, `subject`, `value`, `evidence` |
+| `baton_wait` | block until a matching fact exists (`timeout` default 300 s, max 600 s), verify it, return it with a status |
+| `baton_facts` | list recent facts (unverified), or fetch one by `id` and verify it |
+
+Every result restates that facts are peer data, not instructions. `baton_wait` and
+`baton_facts` with an `id` return a `status`:
+
+- `verified` - the source of truth confirms the fact.
+- `mismatch` - the source contradicts it. Do not act on it.
+- `unverifiable` - no source to check (hints, unknown hosts). A pointer only.
+- `error` - the source could not be reached. Unconfirmed.
+
+For waits longer than 10 minutes, call `baton_wait` again, or run `baton wait` as a
+background shell command instead, which can wait for hours at no cost. Some
+clients also time out tool calls on their own; raise that limit
+(e.g. `MCP_TOOL_TIMEOUT` in Claude Code) if waits are cut short.

agent_baton_cli-0.2.0/pyproject.toml

@@ -0,0 +1,42 @@
+[project]
+name = "agent-baton-cli"
+version = "0.2.0"
+description = "Pass verified facts between coding agents, so none of them sits waiting on a human relay."
+readme = "README.md"
+license = "MIT"
+requires-python = ">=3.10"
+dependencies = []
+keywords = ["ai-agents", "coding-agents", "multi-agent", "claude-code", "codex", "prompt-injection", "llm-security"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Environment :: Console",
+    "Intended Audience :: Developers",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3 :: Only",
+    "Topic :: Software Development",
+    "Topic :: Software Development :: Build Tools",
+]
+
+[project.urls]
+Homepage = "https://github.com/varnholt/agent-baton"
+Source = "https://github.com/varnholt/agent-baton"
+Issues = "https://github.com/varnholt/agent-baton/issues"
+Changelog = "https://github.com/varnholt/agent-baton/blob/main/CHANGELOG.md"
+
+[project.scripts]
+baton = "agent_baton.cli:main"
+
+[dependency-groups]
+dev = ["pytest>=8"]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/agent_baton"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["src"]

{agent_baton_cli-0.1.0 → agent_baton_cli-0.2.0}/src/agent_baton/__init__.py

@@ -1,3 +1,3 @@
 """agent-baton - pass verified facts between coding agents, so none of them sits waiting on a human relay."""
 
-__version__ = "0.1.0"
+__version__ = "0.2.0"

{agent_baton_cli-0.1.0 → agent_baton_cli-0.2.0}/src/agent_baton/cli.py

@@ -1,10 +1,11 @@
-"""Command line: `baton serve | member | publish | wait | facts | types`."""
+"""Command line: `baton serve | quickstart | member | publish | wait | facts | types | mcp`."""
 
 from __future__ import annotations
 
 import argparse
 import json
 import sys
+from pathlib import Path
 
 from . import __version__
 from .client import BatonError, Client
@@ -43,17 +44,17 @@ def _print_fact(fact: dict, check: dict | None) -> None:
 # commands ------------------------------------------------------------------
 
 
-def cmd_serve(a) -> int:
+def _run_server(store, types, host: str, port: int, tls_cert: str | None = None, tls_key: str | None = None) -> int:
     from .server import serve
-    from .store import Store
 
-    types = load_types(a.types)
-    store = Store(a.db, retention_days=a.retention_days)
-    if not store.members():
-        print("warning: no members yet - add one with `baton member add <name> --db ...`", file=sys.stderr)
-    srv = serve(store, types, a.host, a.port, a.tls_cert, a.tls_key)
-    scheme = "https" if a.tls_cert else "http"
-    print(f"baton {__version__} serving {scheme}://{a.host}:{a.port} ({len(types)} fact types)", flush=True)
+    try:
+        srv = serve(store, types, host, port, tls_cert, tls_key)
+    except OSError as e:
+        store.close()
+        print(f"baton: cannot serve on {host}:{port}: {e}", file=sys.stderr)
+        return EXIT_ERROR
+    scheme = "https" if tls_cert else "http"
+    print(f"baton {__version__} serving {scheme}://{host}:{port} ({len(types)} fact types)", flush=True)
     try:
         srv.serve_forever()
     except KeyboardInterrupt:
@@ -64,6 +65,38 @@ def cmd_serve(a) -> int:
     return EXIT_OK
 
 
+def cmd_serve(a) -> int:
+    from .store import Store
+
+    types = load_types(a.types)
+    store = Store(a.db, retention_days=a.retention_days)
+    if not store.members():
+        print("warning: no members yet - add one with `baton member add <name> --db ...`", file=sys.stderr)
+    return _run_server(store, types, a.host, a.port, a.tls_cert, a.tls_key)
+
+
+def cmd_quickstart(a) -> int:
+    from . import quickstart as qs
+    from .store import Store
+
+    qs.check_host(a.host)
+    directory = Path(a.data_dir) if a.data_dir else qs.data_dir()
+    name = qs.member_name()
+    db, token = qs.setup(directory, name)
+    url = f"http://{a.host}:{a.port}"
+    print(f"baton quickstart: member {name!r}, database {db}")
+    print("Run these in the shell where your agent runs:\n")
+    print(qs.env_lines(url, token))
+    print("Then try: baton types   (Ctrl+C stops the server; rerun to print this again)\n", flush=True)
+    return _run_server(Store(str(db)), load_types(None), a.host, a.port)
+
+
+def cmd_mcp(a) -> int:
+    from .mcp import run
+
+    return run()
+
+
 def cmd_member(a) -> int:
     from .store import Store
 
@@ -165,6 +198,12 @@ def build_parser() -> argparse.ArgumentParser:
     s.add_argument("--retention-days", type=int, default=30)
     s.set_defaults(fn=cmd_serve)
 
+    s = sub.add_parser("quickstart", help="local trial: create a database and token, serve on 127.0.0.1")
+    s.add_argument("--port", type=int, default=8765)
+    s.add_argument("--host", default="127.0.0.1", help="loopback only")
+    s.add_argument("--data-dir", help="default: per-user data dir (or BATON_DATA_DIR)")
+    s.set_defaults(fn=cmd_quickstart)
+
     s = sub.add_parser("member", help="manage member tokens (run on the server)")
     s.add_argument("action", choices=["add", "remove", "list"])
     s.add_argument("name", nargs="?")
@@ -202,6 +241,9 @@ def build_parser() -> argparse.ArgumentParser:
     s.add_argument("--types-file")
     s.add_argument("--json", action="store_true")
     s.set_defaults(fn=cmd_types)
+
+    s = sub.add_parser("mcp", help="run an MCP stdio server exposing baton tools")
+    s.set_defaults(fn=cmd_mcp)
     return p