insightfactory-cli 1.0.3.dev17__py3-none-any.whl → 1.0.3.dev20__py3-none-any.whl

if_cli/assets/__init__.py

@@ -0,0 +1 @@
+"""Static files shipped with the CLI."""

if_cli/assets/insightfactoryai-logo.svg

@@ -0,0 +1,55 @@
+<svg class="logo" role="img" aria-label="insightfactory.ai" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 286.67 62.53">
+  <defs>
+    <style>
+      .iflogo-1 {
+        fill: #fab314;
+      }
+      .iflogo-2 {
+        fill: #f8e86c;
+      }
+      .iflogo-3 {
+        fill: #fad121;
+      }
+      .iflogo-4 {
+        fill: #1f252e;
+      }
+    </style>
+  </defs>
+  <g id="ARTWORK">
+    <g>
+      <g>
+        <polygon class="iflogo-4" points="32.49 37.52 32.5 37.53 32.49 37.52 32.49 37.52"/>
+        <polygon class="iflogo-4" points="21.66 18.76 0 31.27 21.66 43.78 21.66 18.76"/>
+        <g>
+          <polygon class="iflogo-4" points="43.32 31.27 43.32 43.78 54.15 37.52 43.32 31.27"/>
+          <polygon class="iflogo-4" points="43.32 43.78 43.32 56.28 54.15 62.53 64.98 56.28 43.32 43.78"/>
+        </g>
+        <polygon class="iflogo-2" points="21.66 6.26 32.49 12.51 43.32 6.26 32.48 0 21.66 6.26"/>
+        <polygon class="iflogo-3" points="32.49 12.51 32.49 12.51 21.66 6.26 21.66 18.76 21.66 18.76 21.66 43.78 32.49 50.03 32.49 37.52 32.49 12.51"/>
+        <g>
+          <polygon class="iflogo-1" points="32.49 12.51 32.5 25.02 43.32 18.76 43.32 6.26 32.49 12.51"/>
+          <polygon class="iflogo-1" points="43.32 56.28 43.32 43.78 43.32 31.27 32.49 37.52 32.49 50.03 43.32 56.28"/>
+        </g>
+      </g>
+      <g>
+        <path class="iflogo-4" d="m75.28,23.74c-.81,0-1.47-.27-1.99-.8-.52-.53-.77-1.17-.77-1.91s.26-1.41.77-1.93,1.18-.78,1.99-.78c.76,0,1.41.26,1.94.78.53.52.79,1.17.79,1.93s-.26,1.38-.79,1.91c-.53.53-1.17.8-1.94.8Zm-2.19,2.23h4.31v17.39h-4.31v-17.39Z"/>
+        <path class="iflogo-4" d="m79.46,25.97h3.91l.3,1.77c.54-.63,1.2-1.12,1.97-1.48.78-.36,1.61-.54,2.51-.54,1.33,0,2.46.29,3.39.87.93.58,1.65,1.42,2.16,2.52.51,1.1.76,2.46.76,4.09v10.16h-4.35v-9.57c0-1.34-.26-2.35-.78-3.03s-1.29-1.01-2.33-1.01-1.86.34-2.41,1.03c-.55.68-.83,1.7-.83,3.04v9.53h-4.31v-17.39Z"/>
+        <path class="iflogo-4" d="m100.08,37.69c.13.58.36,1.02.69,1.32.33.3.7.52,1.11.64.42.13.84.19,1.26.19.79,0,1.4-.16,1.85-.47.45-.31.67-.71.67-1.2,0-.42-.16-.75-.47-.99-.31-.24-.71-.43-1.2-.57-.48-.14-.99-.27-1.53-.38-.61-.16-1.25-.34-1.94-.54-.69-.2-1.33-.48-1.94-.85-.61-.37-1.11-.85-1.5-1.44-.39-.59-.59-1.34-.59-2.24,0-1.09.28-2.03.84-2.83.56-.8,1.35-1.43,2.38-1.9s2.21-.7,3.56-.7c1.59,0,2.94.35,4.04,1.04,1.1.7,1.9,1.69,2.39,2.99l-3.78,1.11c-.13-.32-.34-.59-.61-.8s-.59-.36-.96-.45c-.37-.09-.75-.14-1.13-.14-.65,0-1.19.13-1.62.4-.43.27-.64.63-.64,1.1,0,.28.08.5.24.68s.38.32.66.43c.28.12.61.22.98.31.37.09.78.2,1.23.31.7.19,1.4.4,2.11.64.71.24,1.36.55,1.96.92.59.37,1.07.87,1.43,1.5.36.63.56,1.42.61,2.37,0,1.02-.28,1.94-.84,2.77s-1.37,1.48-2.43,1.96c-1.06.49-2.34.73-3.84.73-1.75,0-3.24-.38-4.47-1.15s-2.03-1.96-2.41-3.58l3.88-1.18Z"/>
+        <path class="iflogo-4" d="m114.61,23.74c-.81,0-1.47-.27-1.99-.8-.52-.53-.77-1.17-.77-1.91s.26-1.41.77-1.93,1.18-.78,1.99-.78c.76,0,1.41.26,1.94.78.53.52.79,1.17.79,1.93s-.26,1.38-.79,1.91c-.53.53-1.17.8-1.94.8Zm-2.19,2.23h4.31v17.39h-4.31v-17.39Z"/>
+        <path class="iflogo-4" d="m131.9,25.97h3.91v14.82c0,1.97-.47,3.67-1.42,5.1-.94,1.43-2.31,2.52-4.09,3.29-1.79.76-3.93,1.15-6.42,1.15l-.67-3.76c2.72-.05,4.78-.54,6.18-1.5s2.11-2.32,2.11-4.1v-.07l.57-.21c-.54.81-1.28,1.5-2.22,2.07s-2.07.85-3.37.85c-1.48,0-2.79-.37-3.91-1.11-1.12-.74-2.01-1.78-2.65-3.11-.64-1.33-.96-2.91-.96-4.71s.32-3.39.96-4.73c.64-1.34,1.52-2.38,2.65-3.11,1.12-.73,2.43-1.1,3.91-1.1.76,0,1.48.11,2.14.33.66.22,1.25.51,1.75.87.5.36.93.76,1.26,1.2l.27-2.16Zm-8.32,8.7c0,1.46.37,2.64,1.09,3.53.73.89,1.7,1.34,2.92,1.34.7,0,1.34-.19,1.92-.57.58-.38,1.06-.94,1.43-1.69.37-.74.56-1.61.56-2.61s-.19-1.92-.56-2.64c-.37-.72-.85-1.27-1.45-1.65-.59-.38-1.23-.57-1.9-.57-1.21,0-2.19.45-2.92,1.34-.73.89-1.09,2.07-1.09,3.53Z"/>
+        <path class="iflogo-4" d="m138.5,18.32h4.31v9.36c.52-.58,1.16-1.05,1.94-1.41.78-.36,1.65-.54,2.61-.54,1.28,0,2.39.29,3.34.87.94.58,1.68,1.42,2.21,2.52.53,1.1.79,2.46.79,4.09v10.16h-4.55v-9.57c0-1.34-.26-2.35-.78-3.03s-1.29-1.01-2.33-1.01-1.86.37-2.41,1.1c-.55.73-.83,1.77-.83,3.11v9.39h-4.31v-25.04Z"/>
+        <path class="iflogo-4" d="m157.01,25.97v-4.87h4.35v4.87h3.74v3.93h-3.74v7.06c0,.9.19,1.54.57,1.91.38.37.86.57,1.43.59.57.02,1.15-.01,1.74-.1v3.83c-1.03.23-2.04.3-3.02.21-.98-.09-1.85-.37-2.61-.82-.76-.45-1.36-1.14-1.8-2.07-.44-.93-.66-2.11-.66-3.55v-7.06h-2.39v-3.93h2.39Z"/>
+        <path class="iflogo-4" d="m170.42,23.92c0-1.27.2-2.35.61-3.23s1.05-1.52,1.94-1.93c.89-.41,2.07-.55,3.56-.43v2.33c-1.35-.12-2.28.11-2.8.68s-.78,1.43-.78,2.59v2.05h3.71v2.43h-3.71v14.96h-2.53v-14.96h-2.36v-2.43h2.36v-2.05Z"/>
+        <path class="iflogo-4" d="m188.25,43.36l-.2-3.13c-.47,1.07-1.17,1.9-2.09,2.49-.92.59-2.09.89-3.5.89-1.21,0-2.25-.2-3.1-.59-.85-.39-1.51-.96-1.97-1.69-.46-.73-.69-1.59-.69-2.59,0-1.46.53-2.66,1.58-3.6,1.06-.94,2.58-1.51,4.58-1.72l5.19-.59v-1.39c0-.97-.35-1.76-1.04-2.35s-1.64-.89-2.83-.89-2.14.28-2.92.83c-.78.56-1.31,1.36-1.6,2.4l-2.29-.83c.45-1.53,1.28-2.72,2.48-3.58,1.2-.86,2.67-1.29,4.4-1.29,2,0,3.56.53,4.67,1.58,1.11,1.06,1.67,2.49,1.67,4.3v11.76h-2.33Zm-.2-8.31l-5.22.63c-1.12.14-1.98.46-2.56.96-.58.5-.88,1.15-.88,1.96s.29,1.46.86,1.95c.57.49,1.4.73,2.48.73,1.24,0,2.25-.25,3.03-.77.79-.51,1.37-1.2,1.74-2.07.37-.87.56-1.81.56-2.83v-.56Z"/>
+        <path class="iflogo-4" d="m201.02,43.61c-1.64,0-3.08-.37-4.31-1.11-1.24-.74-2.2-1.78-2.88-3.11-.69-1.33-1.03-2.88-1.03-4.64s.34-3.36,1.03-4.71,1.65-2.41,2.88-3.17c1.24-.75,2.67-1.13,4.31-1.13,1.73,0,3.25.41,4.55,1.23,1.3.82,2.25,1.97,2.83,3.43l-2.33.83c-.34-.93-.95-1.66-1.84-2.21-.89-.54-1.92-.82-3.08-.82s-2.14.27-2.98.8-1.49,1.29-1.96,2.26c-.46.97-.69,2.12-.69,3.44,0,1.95.51,3.51,1.52,4.68s2.36,1.76,4.04,1.76c1.15,0,2.17-.27,3.07-.8.9-.53,1.56-1.25,1.99-2.16l2.29.83c-.61,1.44-1.56,2.56-2.86,3.38-1.3.81-2.82,1.22-4.55,1.22Z"/>
+        <path class="iflogo-4" d="m212.07,25.97v-4.87h2.53v4.87h4.48v2.43h-4.48v9.36c0,1.07.22,1.84.66,2.33.44.49,1,.78,1.68.87.69.09,1.4.09,2.14,0v2.26c-.88.21-1.74.27-2.58.17-.84-.09-1.6-.35-2.26-.78-.66-.43-1.19-1.04-1.58-1.83-.39-.79-.59-1.8-.59-3.03v-9.36h-2.53v-2.43h2.53Z"/>
+        <path class="iflogo-4" d="m228.49,43.61c-1.6,0-3.02-.36-4.28-1.08-1.26-.72-2.25-1.74-2.97-3.08-.72-1.33-1.08-2.92-1.08-4.75s.37-3.46,1.1-4.8c.73-1.34,1.73-2.38,3-3.1,1.27-.72,2.7-1.08,4.3-1.08s3.03.36,4.3,1.08c1.27.72,2.27,1.75,3,3.08.73,1.33,1.1,2.92,1.1,4.75s-.37,3.46-1.11,4.8-1.75,2.38-3.03,3.1-2.72,1.08-4.31,1.08Zm-.03-2.47c.99,0,1.92-.23,2.8-.68.88-.45,1.59-1.16,2.14-2.12.55-.96.83-2.19.83-3.67s-.27-2.74-.81-3.69c-.54-.95-1.24-1.65-2.11-2.1s-1.79-.68-2.78-.68-1.91.23-2.76.68-1.54,1.16-2.07,2.12c-.53.96-.79,2.19-.79,3.67s.26,2.74.78,3.69c.52.95,1.2,1.65,2.04,2.1.84.45,1.76.68,2.75.68Z"/>
+        <path class="iflogo-4" d="m238.93,25.97h2.33l.13,2.54c.45-.63.99-1.16,1.63-1.6.64-.44,1.35-.75,2.12-.92.77-.17,1.6-.18,2.48-.02v2.61c-.94-.18-1.79-.18-2.54,0-.75.19-1.4.53-1.94,1.04-.54.51-.96,1.15-1.25,1.93-.29.78-.44,1.68-.44,2.7v9.11h-2.53v-17.39Z"/>
+        <path class="iflogo-4" d="m262.19,25.97h2.63l-9.64,24.35h-2.43l2.87-7.2-6.81-17.15h2.76l5.39,14.05,5.22-14.05Z"/>
+        <path class="iflogo-4" d="m263.09,43.52c-.46,0-.84-.16-1.15-.5-.31-.33-.46-.73-.46-1.21s.15-.88.46-1.21c.31-.33.69-.5,1.15-.5s.82.17,1.14.5c.32.33.48.73.48,1.21s-.16.88-.48,1.21c-.32.33-.7.5-1.14.5Z"/>
+        <path class="iflogo-4" d="m278.25,43.36l-.2-3.13c-.47,1.07-1.17,1.9-2.09,2.49-.92.59-2.09.89-3.5.89-1.21,0-2.25-.2-3.1-.59-.85-.39-1.51-.96-1.97-1.69-.46-.73-.69-1.59-.69-2.59,0-1.46.53-2.66,1.58-3.6,1.06-.94,2.58-1.51,4.58-1.72l5.19-.59v-1.39c0-.97-.35-1.76-1.04-2.35s-1.64-.89-2.83-.89-2.14.28-2.92.83c-.78.56-1.31,1.36-1.6,2.4l-2.29-.83c.45-1.53,1.28-2.72,2.48-3.58,1.2-.86,2.67-1.29,4.4-1.29,2,0,3.56.53,4.67,1.58,1.11,1.06,1.67,2.49,1.67,4.3v11.76h-2.33Zm-.2-8.31l-5.22.63c-1.12.14-1.98.46-2.56.96-.58.5-.88,1.15-.88,1.96s.29,1.46.86,1.95c.57.49,1.4.73,2.48.73,1.24,0,2.25-.25,3.03-.77.79-.51,1.37-1.2,1.74-2.07.37-.87.56-1.81.56-2.83v-.56Z"/>
+        <path class="iflogo-4" d="m284.92,22.49c-.52,0-.94-.17-1.28-.52-.34-.35-.51-.78-.51-1.29s.17-.97.51-1.32.76-.52,1.28-.52c.47,0,.88.17,1.23.52.35.35.52.79.52,1.32s-.17.94-.52,1.29c-.35.35-.76.52-1.23.52Zm-1.28,3.48h2.49v17.39h-2.49v-17.39Z"/>
+      </g>
+    </g>
+  </g>
+</svg>

if_cli/callback_page.py

@@ -0,0 +1,215 @@
+"""Branded HTML for the loopback OAuth callback tab.
+
+This tab is the frame straight after the Auth0 Universal Login widget, so it
+copies that theme rather than the Interfaces app. Every value here mirrors
+``auth0_branding_theme.insight_factory`` in
+``terraform-Insightfactory-infrastructure/Auth0/modules/auth0/branding.tf``, and
+the comments name the Terraform attribute each one came from. Change them together.
+
+The page is self-contained: the logo is inline SVG and the CSS is inline, so it
+renders from the loopback server with no network access beyond the webfont.
+"""
+
+from __future__ import annotations
+
+from functools import lru_cache
+from importlib.resources import files
+
+
+@lru_cache(maxsize=1)
+def logo_svg() -> str:
+    """The wordmark Auth0 serves from the CDN, shipped with the package.
+
+    Auth0 loads it from cdn.insightfactory.ai. We inline the same file so the
+    callback page does not depend on the CDN being reachable.
+    """
+    return files("if_cli.assets").joinpath("insightfactoryai-logo.svg").read_text(encoding="utf-8")
+
+
+STYLES = """\
+@import url("https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500&display=swap");
+
+:root {
+  --page-background: #20252e;   /* page_background.background_color */
+  --widget-background: #ffffff; /* colors.widget_background */
+  --header: #20252e;            /* colors.header */
+  --body-text: #20252e;         /* colors.body_text */
+  --icons: #65676e;             /* colors.icons */
+  --input-border: #c9cace;      /* colors.input_border */
+  --success: #13a688;           /* colors.success */
+  --error: #d03c38;             /* colors.error */
+  --success-soft: rgba(19, 166, 136, 0.12);
+  --error-soft: rgba(208, 60, 56, 0.12);
+}
+
+* {
+  box-sizing: border-box;
+}
+
+body {
+  margin: 0;
+  min-height: 100vh;
+  display: flex;
+  align-items: center;          /* page_layout: center */
+  justify-content: center;
+  padding: 24px;
+  background: var(--page-background);
+  color: var(--body-text);
+  font-family: "Roboto", -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+  font-size: 16px;              /* fonts.reference_text_size */
+  font-weight: 300;
+  line-height: 1.5;
+  -webkit-font-smoothing: antialiased;
+}
+
+main {
+  width: 100%;
+  max-width: 400px;
+  padding: 40px 32px 32px;
+  border-radius: 8px;                         /* borders.widget_corner_radius */
+  background: var(--widget-background);
+  box-shadow: 0 8px 24px rgba(0, 0, 0, 0.28); /* borders.show_widget_shadow */
+  text-align: center;                         /* widget.header_text_alignment */
+}
+
+.logo {
+  height: 68px;                 /* widget.logo_height */
+  width: auto;
+  max-width: 100%;
+  display: block;
+  margin: 0 auto 24px;          /* widget.logo_position: center */
+}
+
+.pill {
+  display: inline-flex;
+  align-items: center;
+  gap: 7px;
+  margin-bottom: 16px;
+  padding: 4px 12px 4px 10px;
+  border-radius: 999px;
+  background: var(--pill-soft);
+  color: var(--pill);
+  font-size: 14px;
+  font-weight: 500;
+}
+
+.dot {
+  width: 7px;
+  height: 7px;
+  border-radius: 50%;
+  background: currentColor;
+}
+
+h1 {
+  margin: 0 0 10px;
+  color: var(--header);         /* colors.header */
+  font-size: 24px;              /* fonts.title: 150% of 16px */
+  font-weight: 300;             /* fonts.title.bold = false */
+  line-height: 1.25;
+}
+
+p {
+  margin: 0;
+  color: var(--icons);
+  font-size: 14px;              /* fonts.subtitle: 87.5% of 16px */
+  font-weight: 400;
+}
+
+code {
+  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+  font-size: 13px;
+  color: var(--body-text);
+}
+
+pre {
+  margin: 20px 0 0;
+  padding: 12px 14px;
+  border: 1px solid var(--input-border); /* colors.input_border */
+  border-radius: 3px;                    /* borders.input_border_radius */
+  color: var(--body-text);
+  font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+  font-size: 13px;
+  text-align: left;
+  white-space: pre-wrap;
+  word-break: break-word;
+}
+"""
+
+_TEMPLATE = """\
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>{title} | insightfactory.ai</title>
+<style>
+{styles}
+</style>
+</head>
+<body>
+<main style="--pill: var({pill_colour}); --pill-soft: var({pill_soft});">
+{logo}
+<span class="pill"><span class="dot"></span>{pill}</span>
+<h1>{heading}</h1>
+<p>{message}</p>
+{detail}
+</main>
+</body>
+</html>
+"""
+
+
+def render(
+    *,
+    title: str,
+    pill: str,
+    heading: str,
+    message: str,
+    detail: str = "",
+    ok: bool = True,
+) -> bytes:
+    """Render one callback page, ready to write to the socket."""
+    return _TEMPLATE.format(
+        title=title,
+        styles=STYLES,
+        logo=logo_svg(),
+        pill=pill,
+        pill_colour="--success" if ok else "--error",
+        pill_soft="--success-soft" if ok else "--error-soft",
+        heading=heading,
+        message=message,
+        detail=detail,
+    ).encode("utf-8")
+
+
+def success_page() -> bytes:
+    return render(
+        title="Login complete",
+        pill="Connected",
+        heading="Authentication successful",
+        message="You can close this tab and return to the terminal.",
+    )
+
+
+def failure_page(error: str, description: str) -> bytes:
+    return render(
+        title="Login failed",
+        pill="Not connected",
+        heading="Authentication failed",
+        message="Close this tab and run <code>if-cli login</code> again.",
+        detail=f"<pre>{error}: {description}</pre>" if error or description else "",
+        ok=False,
+    )
+
+
+def state_mismatch_page() -> bytes:
+    return render(
+        title="Login callback ignored",
+        pill="Not connected",
+        heading="Callback ignored",
+        message=(
+            "The callback state did not match the one this login started with, "
+            "so it was discarded. Close this tab and run <code>if-cli login</code> again."
+        ),
+        ok=False,
+    )

if_cli/cli.py

@@ -53,6 +53,8 @@ def _parse_args_with_positionals(argv: list[str], *, options: Options) -> tuple[
     """Parse argv allowing options and positionals in any order (Node util.parseArgs parity)."""
     values: dict[str, Any] = {}
     for name, spec in options.items():
+        if spec.get("repeat"):
+            die(f"internal error: option '--{name}' has repeat=True, which allow_positionals parsing does not support")
         if spec["type"] == "boolean":
             values[name] = spec.get("default", False)
         else:
@@ -136,6 +138,10 @@ def parse_args(
         dest = name.replace("-", "_")
         if spec["type"] == "boolean":
             parser.add_argument(*flags, dest=dest, action="store_true", default=spec.get("default", False))
+        elif spec.get("repeat"):
+            # `action="append"` with `default=None` (rather than a spec-level `[]`) so
+            # unset stays None and a shared mutable default can't leak across calls.
+            parser.add_argument(*flags, dest=dest, action="append", default=None)
         else:
             parser.add_argument(*flags, dest=dest, default=spec.get("default"))
     namespace = parser.parse_args(argv)

if_cli/commands/mcp.py

@@ -0,0 +1,164 @@
+from __future__ import annotations
+
+import importlib.util
+import sys
+
+from if_cli.cli import Options, parse_args
+from if_cli.config import config_file, get_profile, list_factories, load_config, parse_factory_section
+from if_cli.http import parse_timeout_seconds
+from if_cli.runtime import die
+
+MCP_OPTIONS: Options = {
+    "env": {"type": "string", "repeat": True},
+    "writable": {"type": "string", "repeat": True},
+    "read-only": {"type": "boolean"},
+    "catalog": {"type": "string"},
+    "allow-tool": {"type": "string", "repeat": True},
+    "timeout": {"type": "string", "default": "120"},
+}
+
+MCP_USAGE = (
+    "usage: if-cli mcp [FACTORY] [--env CODE=PROFILE ...]\n"
+    "                   [--writable CODE ... | --read-only] [--catalog CODE]\n"
+    "                   [--allow-tool NAME ...] [--timeout SECONDS]\n"
+    "\n"
+    "Runs one MCP server over stdio that fronts several factory environments: every\n"
+    "tool gets a required 'environment' argument, routed to that environment's own\n"
+    "if-cli profile. FACTORY names a [factory NAME] section in the config file,\n"
+    "supplying its environments, --writable and --catalog; flags override the\n"
+    "section. Without FACTORY, --env is required at least once. --catalog defaults\n"
+    "to the first environment; environments not passed to --writable are read-only;\n"
+    "--read-only forces every environment read-only and cannot be combined with\n"
+    "--writable.\n"
+)
+
+MISSING_MCP_EXTRA = (
+    "if-cli mcp needs the mcp extra — install with: uv tool install 'insightfactory-cli[mcp]'\n"
+    "(or: uvx --from 'insightfactory-cli[mcp]' if-cli mcp ...)"
+)
+
+
+def _parse_env_mapping(raw: str) -> tuple[str, str]:
+    code, separator, profile_name = raw.partition("=")
+    if not separator or not code or not profile_name:
+        die(f"--env must be CODE=PROFILE (received '{raw}')\n\n{MCP_USAGE}")
+    return code, profile_name
+
+
+def _stray_positional(rest: list[str]) -> str | None:
+    """Find a bare (non-flag) token in `rest`, skipping tokens consumed as a
+    preceding flag's value. `rest` is `argv` with a leading FACTORY already
+    peeled off, so any bare token found here is a second, misplaced one."""
+    index = 0
+    while index < len(rest):
+        token = rest[index]
+        if token == "--":
+            return rest[index + 1] if index + 1 < len(rest) else None
+        if token.startswith("--"):
+            name, has_inline_value, _value = token[2:].partition("=")
+            spec = MCP_OPTIONS.get(name)
+            if spec is not None and spec["type"] != "boolean" and not has_inline_value:
+                index += 2
+                continue
+            index += 1
+            continue
+        if token.startswith("-") and len(token) > 1:
+            index += 1
+            continue
+        return token
+    return None
+
+
+def mcp_command(argv: list[str]) -> None:
+    if "-h" in argv or "--help" in argv:
+        sys.stdout.write(MCP_USAGE)
+        return
+
+    factory_name: str | None = None
+    rest = argv
+    if argv and not argv[0].startswith("-"):
+        factory_name, *rest = argv
+
+    stray = _stray_positional(rest)
+    if stray is not None:
+        die(f"FACTORY must come before the flags: if-cli mcp {stray} --env ...\n\n{MCP_USAGE}")
+
+    values, _positionals = parse_args(rest, options=MCP_OPTIONS)
+    raw_envs: list[str] = values["env"] or []
+    raw_writable: list[str] | None = values["writable"]
+    read_only: bool = values["read-only"]
+
+    if read_only and raw_writable is not None:
+        die(f"--read-only cannot be combined with --writable\n\n{MCP_USAGE}")
+
+    config = load_config()
+
+    # A dict, not a list of pairs: --env "adds or replaces that code's profile"
+    # (a factory's own environments first, then each --env in turn), so a
+    # repeated code is the way to override one, not a mistake to reject.
+    # Overriding an existing code keeps its original position (a dict update,
+    # not a delete-and-reinsert), which is what keeps the --catalog default
+    # (codes[0]) stable under a partial override.
+    mappings: dict[str, str] = {}
+    writable_codes: frozenset[str] = frozenset()
+    catalog_source: str | None = None
+
+    if factory_name is not None:
+        factory = parse_factory_section(config, factory_name)
+        mappings.update(factory["environments"])
+        writable_codes = factory["writable"]
+        catalog_source = factory["catalog"]
+
+    for raw in raw_envs:
+        code, profile_name = _parse_env_mapping(raw)
+        mappings[code] = profile_name
+
+    if not mappings:
+        factories = sorted(list_factories(config))
+        hint = f" or name one of the factories in {config_file()}: {', '.join(factories)}" if factories else ""
+        die(f"--env is required (at least one){hint}\n\n{MCP_USAGE}")
+    codes = list(mappings)
+
+    if read_only:
+        writable_codes = frozenset()
+    elif raw_writable is not None:
+        writable_codes = frozenset(raw_writable)
+    if values["catalog"] is not None:
+        catalog_source = values["catalog"]
+    if catalog_source is None:
+        catalog_source = codes[0]
+
+    # Checked with find_spec rather than a bare try/except ImportError so a genuine
+    # import bug inside if_cli.router propagates instead of reading as a missing extra.
+    if importlib.util.find_spec("mcp") is None:
+        die(MISSING_MCP_EXTRA)
+    from if_cli.router.server import build_router, log, run_server
+
+    timeout = parse_timeout_seconds(values["timeout"], "--timeout")
+    extra_read_only = frozenset(values["allow-tool"] or [])
+
+    if catalog_source not in codes:
+        die(f"--catalog '{catalog_source}' is not one of the --env codes: {', '.join(codes)}")
+
+    unknown_writable = sorted(code for code in writable_codes if code not in codes)
+    if unknown_writable:
+        named = ", ".join(f"'{code}'" for code in unknown_writable)
+        die(f"--writable {named} not among the --env codes: {', '.join(codes)}")
+
+    profiles = {code: get_profile(config, profile_name) for code, profile_name in mappings.items()}
+
+    label = factory_name if factory_name is not None else "environments"
+    parts = [
+        f"{code}={mappings[code]} {profiles[code]['host']}{' (writable)' if code in writable_codes else ''}"
+        for code in codes
+    ]
+    log(f"{label}: {'; '.join(parts)}; catalog={catalog_source}")
+
+    router = build_router(
+        profiles=profiles,
+        writable_codes=writable_codes,
+        catalog_source=catalog_source,
+        extra_read_only=extra_read_only,
+        timeout=timeout,
+    )
+    run_server(router)

if_cli/commands/profiles.py

@@ -8,7 +8,7 @@ from typing import Literal, TypedDict
 from if_cli.cache import TokenCache, is_fresh, load_cache
 from if_cli.cli import Options, parse_args
 from if_cli.colour import Colour, colourise
-from if_cli.config import config_file, get_profile, load_config
+from if_cli.config import config_file, get_profile, is_factory_section, load_config
 from if_cli.runtime import format_expiry
 
 TokenStatus = Literal["valid", "expired", "none", "unknown"]
@@ -41,6 +41,8 @@ def summarize_profiles(
 ) -> list[ProfileSummary]:
     summaries: list[ProfileSummary] = []
     for section in config:
+        if is_factory_section(section):
+            continue
         name = "DEFAULT" if section == "" else section
         try:
             profile = get_profile(config, name)

if_cli/config.py

@@ -23,6 +23,17 @@ class Profile(TypedDict):
     organization: str | None
 
 
+class Factory(TypedDict):
+    name: str
+    environments: list[tuple[str, str]]
+    writable: frozenset[str]
+    catalog: str
+
+
+FACTORY_SECTION_PREFIX = "factory "
+FACTORY_RESERVED_KEYS = {"writable", "catalog"}
+
+
 def config_dir() -> str:
     if "INSIGHTFACTORY_CONFIG_DIR" in os.environ:
         return os.environ["INSIGHTFACTORY_CONFIG_DIR"]
@@ -163,7 +174,82 @@ def resolve_profile_name(flag: str | None = None) -> str:
     return name
 
 
+def is_factory_section(name: str) -> bool:
+    return name.startswith(FACTORY_SECTION_PREFIX)
+
+
+def list_factories(config: dict[str, dict[str, str]]) -> list[str]:
+    return [section.removeprefix(FACTORY_SECTION_PREFIX) for section in config if is_factory_section(section)]
+
+
+def parse_factory_section(config: dict[str, dict[str, str]], name: str) -> Factory:
+    """Parse a `[factory <name>]` section on its own: no check that a `writable`/
+    `catalog` code is among its environments, and none of its profiles are resolved.
+
+    A caller that means to merge `--env`/`--writable`/`--catalog` overrides on top
+    (`commands/mcp.py`) validates the merged result once, afterwards, rather than
+    validating this unmerged section only to re-validate the effective mapping a
+    second time. `get_factory` below runs both steps for a caller that has no
+    overrides to merge.
+    """
+    section_key = f"{FACTORY_SECTION_PREFIX}{name}"
+    if section_key not in config:
+        known = sorted(list_factories(config))
+        hint = f"known factories: {', '.join(known)}" if known else "no factory sections defined"
+        die(
+            f"factory '{name}' not found in {config_file()} — add a [factory {name}] section with "
+            f"<code> = <profile> lines ({hint})"
+        )
+    section = config[section_key]
+
+    environments = [(code, profile_name) for code, profile_name in section.items() if code not in FACTORY_RESERVED_KEYS]
+    if not environments:
+        die(f"factory '{name}' in {config_file()} has no environments — add <code> = <profile> lines")
+    for code, profile_name in environments:
+        if not profile_name.strip():
+            die(
+                f"factory '{name}' in {config_file()}: environment '{code}' has an empty profile "
+                f"(found '{code} =' with no value)"
+            )
+    codes = [code for code, _profile_name in environments]
+
+    writable = frozenset(code.strip() for code in section.get("writable", "").split(",") if code.strip())
+    catalog_value = section.get("catalog")
+    catalog = catalog_value.strip() if catalog_value is not None and catalog_value.strip() else codes[0]
+
+    return {"name": name, "environments": environments, "writable": writable, "catalog": catalog}
+
+
+def get_factory(config: dict[str, dict[str, str]], name: str) -> Factory:
+    """Parse and fully validate a `[factory <name>]` section: every profile it
+    references exists, and its own `writable`/`catalog` codes are among its own
+    environments. A caller that merges overrides on top of the section should use
+    `parse_factory_section` instead, and validate the merged result once."""
+    factory = parse_factory_section(config, name)
+    codes = [code for code, _profile_name in factory["environments"]]
+
+    unknown_writable = sorted(code for code in factory["writable"] if code not in codes)
+    if unknown_writable:
+        named = ", ".join(f"'{code}'" for code in unknown_writable)
+        die(f"factory '{name}' in {config_file()}: writable {named} not among its environments: {', '.join(codes)}")
+
+    if factory["catalog"] not in codes:
+        die(
+            f"factory '{name}' in {config_file()}: catalog '{factory['catalog']}' is not among its environments: "
+            f"{', '.join(codes)}"
+        )
+
+    for _code, profile_name in factory["environments"]:
+        get_profile(config, profile_name)
+
+    return factory
+
+
 def get_profile(config: dict[str, dict[str, str]], name: str) -> Profile:
+    if is_factory_section(name):
+        die(
+            f"'{name}' is a factory section, not a profile; use: if-cli mcp {name.removeprefix(FACTORY_SECTION_PREFIX)}"
+        )
     section_key = "" if name == "DEFAULT" else name
     if section_key not in config:
         die(f"profile '{name}' not found in {config_file()} — run: if-cli login -p {name} --host <factory-url>")

if_cli/main.py

@@ -7,6 +7,7 @@ from if_cli.commands.api import api_command
 from if_cli.commands.config import config_command
 from if_cli.commands.login import login_command
 from if_cli.commands.logout import logout_command
+from if_cli.commands.mcp import mcp_command
 from if_cli.commands.profiles import profiles_command
 from if_cli.commands.set_token import set_token_command
 from if_cli.commands.token import token_command
@@ -30,6 +31,12 @@ commands:
               [-p profile] [-X METHOD] [-d DATA] [--timeout SECONDS] <path>
               routes [-p profile] [--timeout SECONDS] [filter]
               describe [-p profile] [--timeout SECONDS] METHOD <path>
+  mcp         run one MCP server that routes across factory environments
+              [FACTORY] [--env CODE=PROFILE ...]
+              [--writable CODE ... | --read-only] [--catalog CODE]
+              [--allow-tool NAME ...] [--timeout SECONDS]
+              FACTORY names a [factory NAME] config section; flags override it
+              (needs the mcp extra: uv tool install 'insightfactory-cli[mcp]')
 
 profile selection: -p flag, then ${ENV_PROFILE}, then [DEFAULT].
 request timeout: --timeout flag, then ${ENV_REQUEST_TIMEOUT}, then 30 seconds.
@@ -60,6 +67,9 @@ def run_cli(argv: list[str]) -> None:
     if command == "api":
         api_command(rest)
         return
+    if command == "mcp":
+        mcp_command(rest)
+        return
     if command in {None, "-h", "--help"}:
         import sys