feat(mcp): add runtime tool discovery and calls

[christso]

Summary

AllAgents can now discover and invoke live tools from any configured MCP server with mcp tools and mcp call. The commands work against project, user, and named-profile destinations over Streamable HTTP or stdio, so humans and automation no longer need a separate MCP client.

Design decisions

• Require exactly one destination. Project is the default; --scope user and --profile <name> select the other declaration stores.
• Connect directly to the configured transport. HTTP reuses the existing OAuth cache and origin-safe header policy; stdio uses shell-free process spawning and deterministic shutdown.
• Keep runtime authorization non-interactive. Public, cached, and refreshable credentials work automatically. Fresh consent returns a copyable mcp reauth command instead of opening a browser.
• Build one complete, application-owned tool catalog. Cursor pagination, duplicate names, repeated cursors, schema depth, metadata size, and page/tool counts are bounded before a tool is selected.
• Generate flags only when the entire input schema has an unambiguous CLI projection. Other schemas use exact JSON through --input, with lossless numeric parsing and output-schema validation.
• Bound every finite operation. Payload sizes, jq projection, startup cancellation, request interruption, cleanup, and credential-reflection checks fail closed.
• Preserve exact option-looking server and tool names through the standard -- separator.

Examples

# Discover tools from a project server
allagents mcp tools github --search issue

# Inspect live, generated tool help
allagents mcp call github create_issue --help

# Invoke with generated flags
allagents mcp call github create_issue \
  --owner allagentsdev --repo allagents --title "Runtime MCP CLI"

# Invoke a complex schema with exact JSON
allagents mcp call --input '{"symbol":"AAPL"}' trading -- -quote

# Select a user or profile declaration
allagents mcp tools --scope user -- --staging
allagents mcp call --profile markets trading quote --input '{"symbol":"AAPL"}' --json

Validation

• Red built-CLI baseline: bun run build && node dist/index.js mcp tools missing-server rejected tools as an invalid subcommand with exit 1 before implementation.
• Focused runtime suite: 148 passed, 0 failed, 542 assertions.
• bun run typecheck: passed.
• bun run lint: 134 files checked with no findings.
• bun run build: passed; 609 modules bundled.
• bun test: 2,023 passed, 7 skipped, 0 failed, 6,283 assertions across 174 files.
• bun run test:e2e: 208 passed, 4 skipped, 0 failed, 897 assertions across 18 files.
• node scripts/smoke-node-cli.mjs: exercised the built Node CLI for public HTTP discovery, cached and refreshed OAuth calls, stdio discovery/calls, reauthentication guidance, zero leaked sessions, and first-SIGINT exit 130.
• bun run docs:build: 13 pages built.
• Browser verification covered the rendered CLI reference and MCP guide, including exact-identity syntax and reauthentication guidance, with zero console errors.
• CI follow-up pinned Bun 1.4.0 after Bun 1.3.12 deterministically missed the Node-compatible HTTP close event after fetch abort. The two affected cancellation paths passed 200 focused repetitions and 300 parallel repetitions after the upgrade.
• The Windows argv harness now resolves its outer Node executable before injecting a hostile PATH; the current head passes every GitHub Actions check.

Implementation plan: docs/plans/2026-09-20-0921-feat-mcp-runtime-cli-plan.md.

---

[cloudflare-workers-and-pages]

Deploying allagents with    Cloudflare Pages

Latest commit:	1091b68
Status:	✅  Deploy successful!
Preview URL:	https://c2799e88.allagents.pages.dev
Branch Preview URL:	https://feat-mcp-runtime-cli.allagents.pages.dev

View logs