mcp-client-kit 0.4.0__tar.gz → 0.5.0__tar.gz

{mcp_client_kit-0.4.0 → mcp_client_kit-0.5.0}/CHANGELOG.md

@@ -1,6 +1,40 @@
 # Changelog
 
-## [Unreleased] — 0.5.0
+## [Unreleased] — 0.6.0
+
+## [0.5.0] — 2026-08-09
+
+### Fixed
+
+- **A caller-supplied credentials path was silently ignored once past login, so tokens were
+  written to one file and read from another.** `login()` and `ensure_login()` accepted
+  `creds_path` and honoured it, but the call path never did: `_http_session()` built its
+  `FileTokenStorage` on the default `~/.mcpgen/credentials.json`, and neither `session()` nor
+  `McpBridgeCaller` even accepted the parameter, so there was no way to route a call to the file
+  the login had just written. Anyone keeping tokens outside the shared store — a project-local
+  credentials file, two identities side by side, a test fixture — logged in successfully and then
+  got `ReauthenticationRequired` on the very next call, in a loop, with both files on disk looking
+  plausible. `creds_path` now flows through `_http_session()`, `session()`, and
+  `McpBridgeCaller`, defaulting to `DEFAULT_CREDS_PATH` when omitted, so existing behaviour is
+  unchanged. The stdio, bearer, static-header, and raw-URL transports do not take it: they store
+  no credentials at all, and a parameter that silently does nothing is worse than its absence.
+
+### Added
+
+- **`--creds PATH`** on every command that touches stored credentials — `codegen`, `list`,
+  `probe`, `call`, `login`, and the management trio `list-creds`, `delete-creds`,
+  `migrate-creds` — the CLI surface for the fix above. `mcpgen login` previously dropped the
+  path entirely, having no flag to drop it from; it now logs in to exactly the file the
+  subsequent calls will read. The management commands were the other half of the same gap: all
+  three already took a `credentials_path` internally but exposed no way to set it, so after a
+  `--creds` login `list-creds` reported an empty store, `delete-creds` deleted nothing while
+  saying so, and `migrate-creds` migrated the wrong file. A flag that exists on half the
+  commands that read a file is worse than no flag at all — it makes the other half look broken.
+
+- **`DEFAULT_CREDS_PATH` is exported from `mcpgen`** — consumers that thread a credentials path
+  through their own CLI need the default as a value. Re-deriving
+  `Path.home() / ".mcpgen" / "credentials.json"` downstream would silently drift the day mcpgen
+  changes it.
 
 ## [0.4.0] — 2026-08-09
 

{mcp_client_kit-0.4.0 → mcp_client_kit-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mcp-client-kit
-Version: 0.4.0
+Version: 0.5.0
 Summary: mcp-client-kit — generate typed Python wrappers for any MCP server (codegen skill + CLI).
 Project-URL: Homepage, https://github.com/svd/mcp-client-kit
 Project-URL: Source, https://github.com/svd/mcp-client-kit

{mcp_client_kit-0.4.0 → mcp_client_kit-0.5.0}/doc/USAGE.md

@@ -80,13 +80,17 @@ uv add mcp-client-kit            # or: pip install mcp-client-kit
 | `call <server> <tool>` | One live call, raw payload to disk — bootstrap ids / inspect output | `--out <path>` (required) |
 | `merge <server>` | Consolidate `.parts/` → `<server>.shapes.json`; emit gitignored `verify.json` | `--out <path>` |
 | `login <server>` | Browser OAuth login | `--headless` / `--no-headless`, `--callback-timeout <seconds>`, connection flags below |
-| `migrate-creds` | Copy stored OAuth tokens between `file`/`keyring` backends | `--from`, `--to`, `--servers`, `--purge`, `--set-default` |
+| `migrate-creds` | Copy stored OAuth tokens between `file`/`keyring` backends | `--from`, `--to`, `--servers`, `--purge`, `--set-default`, `--creds <path>` |
 | `discover` | List servers from agent hosts | `--host <id>` (repeatable), `--json` |
 
 Connection flags shared by `codegen`/`list`/`probe`/`call`/`login`: `--url`,
-`--bearer`, `--stdio`, `--config`, `--client-name`, `--cred-backend`
+`--bearer`, `--stdio`, `--config`, `--client-name`, `--cred-backend`, `--creds`
 (see [§ Authenticate](#authenticate)).
 
+`--creds` is also accepted by the credential-management commands — `list-creds`,
+`delete-creds`, `migrate-creds` — so a non-default store stays addressable from every
+command that reads or writes it.
+
 > **PII:** `call` writes the raw, unscrubbed payload. Name the file `*.probe-raw.json`
 > (gitignored) and never commit it.
 
@@ -210,6 +214,23 @@ by `--cred-backend`, then `$MCPGEN_CRED_BACKEND`, then `~/.mcpgen/config.json`
 mcpgen login myserver --cred-backend keyring
 ```
 
+**Credential file location:** `--creds PATH` moves the `file` backend off
+`~/.mcpgen/credentials.json` — useful to keep one project's tokens out of the shared
+store, or to run two identities side by side. Pass the same path to every command
+that touches those tokens; a login written to one file is invisible to a call reading
+another:
+
+```bash
+mcpgen login myserver --creds ./.mcp-creds.json
+mcpgen call myserver whoami --creds ./.mcp-creds.json --out out.json
+mcpgen list-creds --creds ./.mcp-creds.json
+```
+
+The flag has no effect with `--bearer` or `--stdio`, which store no credentials. In
+code the same value is `creds_path=` on `login()`, `ensure_login()`,
+`ensure_login_all()`, `session()`, and `McpBridgeCaller(...)`; `mcpgen.DEFAULT_CREDS_PATH`
+is exported as the default.
+
 **Validate keyring storage** — confirm the token landed in the OS keystore, not the
 fallback file (service `mcpgen`, username `credentials`):
 

{mcp_client_kit-0.4.0 → mcp_client_kit-0.5.0}/mcpgen/__init__.py

@@ -1,6 +1,7 @@
 """mcpgen: typed Python wrapper generator for MCP servers."""
 
 from mcpgen._bridge import (
+    DEFAULT_CREDS_PATH,
     McpBridgeCaller,
     ReauthenticationRequired,
     delete_cred,
@@ -13,6 +14,7 @@ from mcpgen._bridge import (
 from mcpgen.seam import McpCaller
 
 __all__ = [
+    "DEFAULT_CREDS_PATH",
     "McpBridgeCaller",
     "McpCaller",
     "ReauthenticationRequired",

{mcp_client_kit-0.4.0 → mcp_client_kit-0.5.0}/mcpgen/_bridge.py

@@ -824,9 +824,16 @@ async def _http_session(
     *,
     client_name: str | None = None,
     cred_backend: str | None = None,
+    creds_path: Path | None = None,
 ):
-    """OAuth-authenticated HTTP MCP session. Pre-flight refresh before connecting."""
-    storage = FileTokenStorage(server_name, backend=resolve_cred_backend(cred_backend))
+    """OAuth-authenticated HTTP MCP session. Pre-flight refresh before connecting.
+
+    creds_path: read tokens from this file instead of DEFAULT_CREDS_PATH. Must match
+        whatever login() wrote to, or the session reads an empty store.
+    """
+    storage = FileTokenStorage(
+        server_name, creds_path or DEFAULT_CREDS_PATH, backend=resolve_cred_backend(cred_backend)
+    )
     await _pre_flight_refresh(server_name, storage)
 
     # Unlike login(), this does NOT clear a stale confidential-client registration,
@@ -913,6 +920,7 @@ async def session(
     client_name: str | None = None,
     config_path: str | Path | None = None,
     cred_backend: str | None = None,
+    creds_path: Path | None = None,
     env: dict[str, str] | None = None,
 ):
     """Yield an initialized MCP ClientSession.
@@ -924,6 +932,9 @@ async def session(
     url: inline server URL — routes through HTTP + OAuth keyed by `server` name,
         overriding config. client_name: inline OAuth client_name override.
     config_path: read the server registry from this file instead of the default search.
+    creds_path: read OAuth tokens from this file instead of DEFAULT_CREDS_PATH. Only
+        meaningful on the OAuth path — the stdio, bearer, static-header, and raw-URL
+        transports store no credentials.
     server: a configured name (servers()) → HTTP + OAuth; otherwise a raw URL.
     env: extra env vars forwarded to the stdio subprocess (merged over the SDK's
         safe allowlist). Keys NOT in ``get_default_environment()`` (e.g. API keys)
@@ -953,7 +964,13 @@ async def session(
         async with _static_headers_session(resolved_url, _headers_cache[server]) as s:
             yield s
     elif resolved_url is not None:
-        async with _http_session(server, resolved_url, client_name=client_name, cred_backend=cred_backend) as s:
+        async with _http_session(
+            server,
+            resolved_url,
+            client_name=client_name,
+            cred_backend=cred_backend,
+            creds_path=creds_path,
+        ) as s:
             yield s
     elif "://" not in server:
         raise ValueError(f"server {server!r} not found in config and is not a URL")
@@ -977,6 +994,7 @@ class McpBridgeCaller:
         client_name: str | None = None,
         config_path: str | Path | None = None,
         cred_backend: str | None = None,
+        creds_path: Path | None = None,
         env: dict[str, str] | None = None,
     ) -> None:
         self._cmd = cmd
@@ -985,6 +1003,7 @@ class McpBridgeCaller:
         self._client_name = client_name
         self._config_path = config_path
         self._cred_backend = cred_backend
+        self._creds_path = creds_path
         self._env = env
 
     async def call(self, server: str, tool: str, arguments: dict) -> Any:
@@ -996,6 +1015,7 @@ class McpBridgeCaller:
             client_name=self._client_name,
             config_path=self._config_path,
             cred_backend=self._cred_backend,
+            creds_path=self._creds_path,
             env=self._env,
         ) as s:
             result = await s.call_tool(tool, arguments)

{mcp_client_kit-0.4.0 → mcp_client_kit-0.5.0}/mcpgen/cli.py

@@ -33,6 +33,7 @@ async def _list_tools(
     client_name: str | None = None,
     config_path: str | None = None,
     cred_backend: str | None = None,
+    creds_path: Path | None = None,
     env: dict[str, str] | None = None,
 ) -> list[dict]:
     async with _bridge.session(
@@ -43,6 +44,7 @@ async def _list_tools(
         client_name=client_name,
         config_path=config_path,
         cred_backend=cred_backend,
+        creds_path=creds_path,
         env=env,
     ) as s:
         result = await s.list_tools()
@@ -72,6 +74,7 @@ async def _probe(
     client_name: str | None = None,
     config_path: str | None = None,
     cred_backend: str | None = None,
+    creds_path: Path | None = None,
     env: dict[str, str] | None = None,
 ) -> tuple[Any, int]:
     """Return `(observed_shape, observed_byte_size)` for one live probe call."""
@@ -82,6 +85,7 @@ async def _probe(
         client_name=client_name,
         config_path=config_path,
         cred_backend=cred_backend,
+        creds_path=creds_path,
         env=env,
     )
     raw = await caller.call(server, tool, args)
@@ -100,6 +104,7 @@ async def _call(
     client_name: str | None = None,
     config_path: str | None = None,
     cred_backend: str | None = None,
+    creds_path: Path | None = None,
     env: dict[str, str] | None = None,
 ) -> Any:
     caller = _bridge.McpBridgeCaller(
@@ -109,6 +114,7 @@ async def _call(
         client_name=client_name,
         config_path=config_path,
         cred_backend=cred_backend,
+        creds_path=creds_path,
         env=env,
     )
     return await caller.call(server, tool, args)
@@ -272,6 +278,7 @@ def _cmd_codegen(ns: argparse.Namespace) -> int:
         client_name=ns.client_name,
         config_path=ns.config,
         cred_backend=ns.cred_backend,
+        creds_path=_creds_path(ns),
         env=_parse_env(ns),
     )
     try:
@@ -329,6 +336,7 @@ def _cmd_probe(ns: argparse.Namespace) -> int:
         client_name=ns.client_name,
         config_path=ns.config,
         cred_backend=ns.cred_backend,
+        creds_path=_creds_path(ns),
         env=_parse_env(ns),
     )
     shapes = []
@@ -400,6 +408,7 @@ def _cmd_call(ns: argparse.Namespace) -> int:
         client_name=ns.client_name,
         config_path=ns.config,
         cred_backend=ns.cred_backend,
+        creds_path=_creds_path(ns),
         env=_parse_env(ns),
     )
 
@@ -583,6 +592,7 @@ def _cmd_list(ns: argparse.Namespace) -> int:
         client_name=ns.client_name,
         config_path=ns.config,
         cred_backend=ns.cred_backend,
+        creds_path=_creds_path(ns),
         env=_parse_env(ns),
     )
     try:
@@ -620,6 +630,7 @@ def _cmd_login(ns: argparse.Namespace) -> int:
     asyncio.run(
         _bridge.login(
             ns.server,
+            _creds_path(ns) or _bridge.DEFAULT_CREDS_PATH,
             url=ns.url,
             client_name=ns.client_name,
             config_path=ns.config,
@@ -642,6 +653,7 @@ def _cmd_migrate_creds(ns: argparse.Namespace) -> int:
         ns.from_backend,
         ns.to_backend,
         servers=parsed_servers,
+        credentials_path=_creds_path(ns) or _bridge.DEFAULT_CREDS_PATH,
         purge=ns.purge,
         set_default=ns.set_default,
     )
@@ -661,7 +673,11 @@ def _cmd_migrate_creds(ns: argparse.Namespace) -> int:
 
 def _cmd_list_creds(ns: argparse.Namespace) -> int:
     """Print stored credentials as a human table (default) or JSON (--json)."""
-    rows = _bridge.list_creds(backend=ns.cred_backend, expired_only=ns.expired)
+    rows = _bridge.list_creds(
+        backend=ns.cred_backend,
+        credentials_path=_creds_path(ns) or _bridge.DEFAULT_CREDS_PATH,
+        expired_only=ns.expired,
+    )
 
     if ns.json:
         sys.stdout.write(json.dumps(rows, indent=2) + "\n")
@@ -708,7 +724,11 @@ def _cmd_delete_creds(ns: argparse.Namespace) -> int:
             print("[delete-creds] aborted", file=sys.stderr)
             return 0
 
-    existed = _bridge.delete_cred(ns.server, backend=ns.cred_backend)
+    existed = _bridge.delete_cred(
+        ns.server,
+        backend=ns.cred_backend,
+        credentials_path=_creds_path(ns) or _bridge.DEFAULT_CREDS_PATH,
+    )
     if existed:
         print(f"[delete-creds] deleted {ns.server!r}", file=sys.stderr)
     else:
@@ -729,6 +749,33 @@ def _add_headless_flag(p: argparse.ArgumentParser) -> None:
     )
 
 
+def _add_creds_flag(p: argparse.ArgumentParser, *, transport_note: bool = True) -> None:
+    """Add --creds PATH — the file backend's credentials store.
+
+    Shared by the connection commands and the credential-management ones, so a
+    non-default store stays addressable end to end: login writes it, calls read
+    it, list/delete/migrate operate on it.
+    """
+    note = (
+        " No effect with --bearer or --stdio, which store no credentials."
+        if transport_note
+        else " Only the file backend has a path; the keyring backend ignores it."
+    )
+    p.add_argument(
+        "--creds",
+        dest="creds",
+        metavar="PATH",
+        help=f"OAuth credentials file for both storing and reading tokens "
+        f"(default: {_bridge.DEFAULT_CREDS_PATH}).{note}",
+    )
+
+
+def _creds_path(ns: argparse.Namespace) -> Path | None:
+    """--creds as a Path, or None to let _bridge use DEFAULT_CREDS_PATH."""
+    value = getattr(ns, "creds", None)
+    return Path(value) if value else None
+
+
 def _callback_timeout(value: str) -> float:
     """argparse type for --callback-timeout: a non-negative number of seconds."""
     try:
@@ -756,6 +803,7 @@ def _add_conn_args(p: argparse.ArgumentParser) -> None:
     p.add_argument(
         "--config", dest="config", help="servers config path; overrides $MCPGEN_SERVERS and the default search"
     )
+    _add_creds_flag(p)
     p.add_argument(
         "--cred-backend",
         dest="cred_backend",
@@ -907,6 +955,7 @@ def main(argv: list[str] | None = None) -> int:
         help="write cred_backend=<to> into ~/.mcpgen/config.json so future "
         "commands default to the target backend (default: leave config untouched)",
     )
+    _add_creds_flag(mc, transport_note=False)
     mc.set_defaults(func=_cmd_migrate_creds)
 
     lc = sub.add_parser("list-creds", help="list stored credentials (flags expired)")
@@ -926,6 +975,7 @@ def main(argv: list[str] | None = None) -> int:
         choices=["file", "keyring", "auto"],
         help="credential storage backend (default: resolved from env/config, else file)",
     )
+    _add_creds_flag(lc, transport_note=False)
     lc.set_defaults(func=_cmd_list_creds)
 
     dl = sub.add_parser("delete-creds", help="delete the stored credential for one server")
@@ -942,6 +992,7 @@ def main(argv: list[str] | None = None) -> int:
         choices=["file", "keyring", "auto"],
         help="credential storage backend (default: resolved from env/config, else file)",
     )
+    _add_creds_flag(dl, transport_note=False)
     dl.set_defaults(func=_cmd_delete_creds)
 
     dc = sub.add_parser("discover", help="list MCP servers from installed agent hosts")

{mcp_client_kit-0.4.0 → mcp_client_kit-0.5.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "mcp-client-kit"
-version = "0.4.0"
+version = "0.5.0"
 description = "mcp-client-kit — generate typed Python wrappers for any MCP server (codegen skill + CLI)."
 readme = "README.md"
 license = { text = "MIT" }

{mcp_client_kit-0.4.0 → mcp_client_kit-0.5.0}/tests/test_bridge.py

@@ -18,6 +18,7 @@ import stat
 import time
 import warnings
 from contextlib import asynccontextmanager
+from pathlib import Path
 from unittest.mock import AsyncMock, MagicMock, patch
 
 import pytest
@@ -113,7 +114,7 @@ def test_session_routes_bearer_not_oauth_when_bearer_provided():
         yield _make_mock_session()
 
     @asynccontextmanager
-    async def fake_oauth(name, url, *, client_name=None, cred_backend=None):
+    async def fake_oauth(name, url, *, client_name=None, cred_backend=None, creds_path=None):
         oauth_calls.append(name)
         yield _make_mock_session()
 
@@ -161,7 +162,7 @@ def test_session_oauth_path_unchanged_without_bearer():
     oauth_calls: list = []
 
     @asynccontextmanager
-    async def fake_oauth(name, url, *, client_name=None, cred_backend=None):
+    async def fake_oauth(name, url, *, client_name=None, cred_backend=None, creds_path=None):
         oauth_calls.append(name)
         yield _make_mock_session()
 
@@ -1806,3 +1807,165 @@ def test_cli_login_callback_timeout_rejects_invalid(bad, capsys):
         main(["login", "acme", "--callback-timeout", bad])
     assert exc.value.code == 2
     assert "--callback-timeout" in capsys.readouterr().err
+
+
+# ---------------------------------------------------------------------------
+# creds_path on the CALL path (not just login)
+# ---------------------------------------------------------------------------
+
+
+def _recording_storage_factory(recorded: dict):
+    """Stand-in for FileTokenStorage that records how it was constructed."""
+
+    def factory(server_name, credentials_path=_bridge.DEFAULT_CREDS_PATH, *, backend=None):
+        recorded["server_name"] = server_name
+        recorded["credentials_path"] = credentials_path
+        recorded["backend"] = backend
+        storage = MagicMock()
+        storage._load.return_value = {}
+        return storage
+
+    return factory
+
+
+def _run_failing_call(recorded: dict, **caller_kwargs):
+    """Drive McpBridgeCaller.call() far enough to construct the token storage."""
+
+    async def run():
+        with (
+            patch("mcpgen._bridge.FileTokenStorage", _recording_storage_factory(recorded)),
+            patch("mcpgen._bridge._pre_flight_refresh", AsyncMock()),
+            patch("mcpgen._bridge.OAuthClientProvider", MagicMock()),
+            patch("mcpgen._bridge._open_http", _fake_http_fail),
+        ):
+            caller = _bridge.McpBridgeCaller(url="https://acme.example.com/mcp", **caller_kwargs)
+            with pytest.raises(RuntimeError, match="network error"):
+                await caller.call("acme", "whoami", {})
+
+    asyncio.run(run())
+
+
+def test_call_path_uses_custom_creds_path(tmp_path):
+    """A caller-supplied creds_path must reach the token storage on the call path.
+
+    login() honoured creds_path but the session did not, so tokens were written
+    to one file and read from another.
+    """
+    creds = tmp_path / "alt-credentials.json"
+    recorded: dict = {}
+    _run_failing_call(recorded, creds_path=creds)
+    assert recorded["credentials_path"] == creds
+
+
+def test_call_path_defaults_to_default_creds_path():
+    """No creds_path → DEFAULT_CREDS_PATH; existing behaviour is unchanged."""
+    recorded: dict = {}
+    _run_failing_call(recorded)
+    assert recorded["credentials_path"] == _bridge.DEFAULT_CREDS_PATH
+
+
+def test_session_forwards_creds_path_to_http_session(tmp_path):
+    """session() is a public entry point too — it must forward the path."""
+    creds = tmp_path / "alt-credentials.json"
+    recorded: dict = {}
+
+    async def run():
+        with (
+            patch("mcpgen._bridge.FileTokenStorage", _recording_storage_factory(recorded)),
+            patch("mcpgen._bridge._pre_flight_refresh", AsyncMock()),
+            patch("mcpgen._bridge.OAuthClientProvider", MagicMock()),
+            patch("mcpgen._bridge._open_http", _fake_http_fail),
+        ):
+            with pytest.raises(RuntimeError, match="network error"):
+                async with _bridge.session("acme", url="https://acme.example.com/mcp", creds_path=creds):
+                    pass
+
+    asyncio.run(run())
+    assert recorded["credentials_path"] == creds
+
+
+def test_default_creds_path_is_exported():
+    """Consumers need the default as a value instead of re-deriving the path."""
+    import mcpgen
+
+    assert mcpgen.DEFAULT_CREDS_PATH is _bridge.DEFAULT_CREDS_PATH
+    assert "DEFAULT_CREDS_PATH" in mcpgen.__all__
+
+
+def _fake_session_factory(captured: dict):
+    @asynccontextmanager
+    async def fake_session(*args, **kwargs):
+        captured.update(kwargs)
+        s = MagicMock()
+        s.list_tools = AsyncMock(return_value=MagicMock(tools=[]))
+        yield s
+
+    return fake_session
+
+
+@pytest.mark.parametrize(
+    ("argv_flag", "expected"),
+    [(["--creds", "/tmp/alt-creds.json"], Path("/tmp/alt-creds.json")), ([], None)],
+)
+def test_cli_creds_flag_reaches_session(argv_flag, expected):
+    """`--creds` on a session-opening command arrives at _bridge.session."""
+    from mcpgen.cli import main
+
+    captured: dict = {}
+    with patch("mcpgen._bridge.session", _fake_session_factory(captured)):
+        assert main(["list", "acme", "--url", "https://acme.example.com/mcp", *argv_flag]) == 0
+    assert captured["creds_path"] == expected
+
+
+@pytest.mark.parametrize(
+    ("argv_flag", "expected"),
+    [(["--creds", "/tmp/alt-creds.json"], Path("/tmp/alt-creds.json")), ([], _bridge.DEFAULT_CREDS_PATH)],
+)
+def test_cli_login_passes_creds_path(argv_flag, expected):
+    """`mcpgen login` previously dropped --creds entirely — it must log in to that file."""
+    from mcpgen.cli import main
+
+    login_mock = AsyncMock()
+    with patch("mcpgen._bridge.login", login_mock):
+        assert main(["login", "acme", *argv_flag]) == 0
+    assert login_mock.await_args.args[1] == expected
+
+
+@pytest.mark.parametrize(
+    ("argv_flag", "expected"),
+    [(["--creds", "/tmp/alt-creds.json"], Path("/tmp/alt-creds.json")), ([], _bridge.DEFAULT_CREDS_PATH)],
+)
+def test_cli_list_creds_passes_creds_path(argv_flag, expected):
+    """`list-creds` must inspect the same store `login --creds` wrote to."""
+    from mcpgen.cli import main
+
+    with patch("mcpgen._bridge.list_creds", return_value=[]) as list_mock:
+        assert main(["list-creds", *argv_flag]) == 0
+    assert list_mock.call_args.kwargs["credentials_path"] == expected
+
+
+@pytest.mark.parametrize(
+    ("argv_flag", "expected"),
+    [(["--creds", "/tmp/alt-creds.json"], Path("/tmp/alt-creds.json")), ([], _bridge.DEFAULT_CREDS_PATH)],
+)
+def test_cli_delete_creds_passes_creds_path(argv_flag, expected):
+    """Deleting from the default store when the user named another would be a silent no-op."""
+    from mcpgen.cli import main
+
+    with patch("mcpgen._bridge.delete_cred", return_value=True) as delete_mock:
+        assert main(["delete-creds", "acme", "--yes", *argv_flag]) == 0
+    assert delete_mock.call_args.kwargs["credentials_path"] == expected
+
+
+@pytest.mark.parametrize(
+    ("argv_flag", "expected"),
+    [(["--creds", "/tmp/alt-creds.json"], Path("/tmp/alt-creds.json")), ([], _bridge.DEFAULT_CREDS_PATH)],
+)
+def test_cli_migrate_creds_passes_creds_path(argv_flag, expected):
+    """migrate-creds reads and writes the file backend — it needs the path too."""
+    from mcpgen.cli import main
+
+    result = {"from": "file", "to": "keyring", "migrated": 0, "overwritten": 0, "purged": False, "set_default": False}
+    with patch("mcpgen._bridge.migrate_creds", return_value=result) as migrate_mock:
+        assert main(["migrate-creds", "--from", "file", "--to", "keyring", *argv_flag]) == 0
+    assert migrate_mock.call_args.kwargs["credentials_path"] == expected

{mcp_client_kit-0.4.0 → mcp_client_kit-0.5.0}/uv.lock

@@ -535,7 +535,7 @@ cli = [
 
 [[package]]
 name = "mcp-client-kit"
-version = "0.4.0"
+version = "0.5.0"
 source = { editable = "." }
 dependencies = [
     { name = "httpx" },