cc225eb70f
mcpd now runs a cheap auth probe whenever an Llm is created (or its
apiKeyRef/url is updated). Catches misconfigured tokens / wrong URLs at
registration with a 422 + structured error message, instead of silently
500-ing on first chat with a generic "fetch failed". Caught in the wild
today: the homelab Pulumi config exposed `MCPCTL_GATEWAY_TOKEN` (which
is mcpctl_pat_-prefixed, intended for LiteLLM→mcplocal direction) where
LiteLLM expects `LITELLM_MASTER_KEY` (sk-prefixed). The probe makes
this immediate.
Probe shape (LlmAdapter.verifyAuth):
- OpenAI passthrough → GET <url>/v1/models. Cheap, idempotent, gated
by the same auth as chat/completions.
- Anthropic → POST /v1/messages with max_tokens:1, "ping". Anthropic
has no list-models endpoint; this is the cheapest auth-exercising
call.
- Returns one of:
{ ok: true }
{ ok: false, reason: "auth", status, body } — 401/403, fail hard
{ ok: false, reason: "unreachable", error } — network, warn-only
{ ok: false, reason: "unexpected", status, body } — non-auth 4xx, warn-only
Behavior:
- LlmService.create()/update() runs the probe after resolveApiKey.
Throws LlmAuthVerificationError on `auth`, logs warn for
unreachable/unexpected, swallows for offline registration.
- Probe is skipped when there's no apiKeyRef (nothing to verify) or
when the caller passes skipAuthCheck=true.
- update() probes only when apiKeyRef OR url changes — pure
description/tier updates don't trigger upstream calls.
- Routes catch LlmAuthVerificationError and return 422 with
`{ error, status }`. The CLI surfaces the message verbatim via
ApiError.
Opt-out:
- CLI: `mcpctl create llm ... --skip-auth-check` for offline
registration before the upstream is reachable.
- HTTP: side-channel body field `_skipAuthCheck: true` (stripped
before validation, never persisted on the row).
Side fix in same commit (caught while testing): src/cli/src/index.ts
read `program.opts()` BEFORE `program.parse()`, so `--direct` was a
no-op for ApiClient — every command went to mcplocal regardless. Some
commands accidentally still worked because mcplocal forwards plain
`/api/v1/*` to mcpd, but flows that need direct SSE streaming (e.g.
`mcpctl chat`) couldn't reach mcpd. Fixed by peeking at process.argv
directly for the two global flags before Commander's parse runs.
Tests:
- llm-adapters.test.ts (+8): OpenAI 200/401/403/404/network, Anthropic
200/401/400 (typo'd model = unexpected, NOT auth — registration
shouldn't block on bad model names that surface at chat time).
- llm-service.test.ts (+6): create-throws-on-auth-fail (no row
written), warn-only on unreachable/unexpected, skipAuthCheck
bypass, no-key skip, update-only-probes-on-auth-affecting-change.
mcpd 775/775, mcplocal 715/715, cli 430/430.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
396 lines
14 KiB
Bash
396 lines
14 KiB
Bash
# mcpctl bash completions — auto-generated by scripts/generate-completions.ts
|
|
# DO NOT EDIT MANUALLY — run: pnpm completions:generate
|
|
|
|
_mcpctl() {
|
|
local cur prev words cword
|
|
_init_completion || return
|
|
|
|
local commands="status login logout config get describe delete logs create edit apply chat patch backup approve console cache test migrate rotate"
|
|
local project_commands="get describe delete logs create edit attach-server detach-server"
|
|
local global_opts="-v --version --daemon-url --direct -p --project -h --help"
|
|
local resources="servers instances secrets secretbackends llms agents templates projects users groups rbac prompts promptrequests serverattachments proxymodels all"
|
|
local resource_aliases="servers instances secrets secretbackends llms agents templates projects users groups rbac prompts promptrequests serverattachments proxymodels all server srv instance inst secret sec secretbackend sb llm agent template tpl project proj user group rbac-definition rbac-binding prompt promptrequest pr serverattachment sa proxymodel pm"
|
|
|
|
# Check if --project/-p was given
|
|
local has_project=false
|
|
local i
|
|
for ((i=1; i < cword; i++)); do
|
|
if [[ "${words[i]}" == "--project" || "${words[i]}" == "-p" ]]; then
|
|
has_project=true
|
|
break
|
|
fi
|
|
done
|
|
|
|
# Find the first subcommand
|
|
local subcmd=""
|
|
local subcmd_pos=0
|
|
for ((i=1; i < cword; i++)); do
|
|
if [[ "${words[i]}" == "--project" || "${words[i]}" == "--daemon-url" || "${words[i]}" == "-p" ]]; then
|
|
((i++))
|
|
continue
|
|
fi
|
|
if [[ "${words[i]}" != -* ]]; then
|
|
subcmd="${words[i]}"
|
|
subcmd_pos=$i
|
|
break
|
|
fi
|
|
done
|
|
|
|
# Find the resource type after resource commands
|
|
local resource_type=""
|
|
if [[ -n "$subcmd_pos" ]] && [[ $subcmd_pos -gt 0 ]]; then
|
|
for ((i=subcmd_pos+1; i < cword; i++)); do
|
|
if [[ "${words[i]}" != -* ]] && [[ " $resource_aliases " == *" ${words[i]} "* ]]; then
|
|
resource_type="${words[i]}"
|
|
break
|
|
fi
|
|
done
|
|
fi
|
|
|
|
# Helper: get --project/-p value
|
|
_mcpctl_get_project_value() {
|
|
local i
|
|
for ((i=1; i < cword; i++)); do
|
|
if [[ "${words[i]}" == "--project" || "${words[i]}" == "-p" ]] && (( i+1 < cword )); then
|
|
echo "${words[i+1]}"
|
|
return
|
|
fi
|
|
done
|
|
}
|
|
|
|
# Helper: fetch resource names
|
|
_mcpctl_resource_names() {
|
|
local rt="$1"
|
|
if [[ -n "$rt" ]]; then
|
|
if [[ "$rt" == "instances" ]]; then
|
|
mcpctl get instances -o json 2>/dev/null | jq -r '.[][].server.name' 2>/dev/null
|
|
else
|
|
mcpctl get "$rt" -o json 2>/dev/null | jq -r '.[].name' 2>/dev/null
|
|
fi
|
|
fi
|
|
}
|
|
|
|
# Helper: find sub-subcommand (for config/create)
|
|
_mcpctl_get_subcmd() {
|
|
local parent_pos="$1"
|
|
local i
|
|
for ((i=parent_pos+1; i < cword; i++)); do
|
|
if [[ "${words[i]}" != -* ]]; then
|
|
echo "${words[i]}"
|
|
return
|
|
fi
|
|
done
|
|
}
|
|
|
|
# If completing option values
|
|
if [[ "$prev" == "--project" || "$prev" == "-p" ]]; then
|
|
local names
|
|
names=$(mcpctl get projects -o json 2>/dev/null | jq -r '.[].name' 2>/dev/null)
|
|
COMPREPLY=($(compgen -W "$names" -- "$cur"))
|
|
return
|
|
fi
|
|
|
|
case "$subcmd" in
|
|
status)
|
|
COMPREPLY=($(compgen -W "-o --output -h --help" -- "$cur"))
|
|
return ;;
|
|
login)
|
|
COMPREPLY=($(compgen -W "--mcpd-url -h --help" -- "$cur"))
|
|
return ;;
|
|
logout)
|
|
COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
|
|
return ;;
|
|
config)
|
|
local config_sub=$(_mcpctl_get_subcmd $subcmd_pos)
|
|
if [[ -z "$config_sub" ]]; then
|
|
COMPREPLY=($(compgen -W "view set path reset claude claude-generate setup impersonate help" -- "$cur"))
|
|
else
|
|
case "$config_sub" in
|
|
view)
|
|
COMPREPLY=($(compgen -W "-o --output -h --help" -- "$cur"))
|
|
;;
|
|
set)
|
|
COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
|
|
;;
|
|
path)
|
|
COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
|
|
;;
|
|
reset)
|
|
COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
|
|
;;
|
|
claude)
|
|
COMPREPLY=($(compgen -W "-p --project -o --output --inspect --stdout -h --help" -- "$cur"))
|
|
;;
|
|
claude-generate)
|
|
COMPREPLY=($(compgen -W "-p --project -o --output --inspect --stdout -h --help" -- "$cur"))
|
|
;;
|
|
setup)
|
|
COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
|
|
;;
|
|
impersonate)
|
|
COMPREPLY=($(compgen -W "--quit -h --help" -- "$cur"))
|
|
;;
|
|
*)
|
|
COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
|
|
;;
|
|
esac
|
|
fi
|
|
return ;;
|
|
get)
|
|
if [[ -z "$resource_type" ]]; then
|
|
COMPREPLY=($(compgen -W "$resources -o --output -p --project -A --all -h --help" -- "$cur"))
|
|
else
|
|
local names
|
|
names=$(_mcpctl_resource_names "$resource_type")
|
|
COMPREPLY=($(compgen -W "$names -o --output -p --project -A --all -h --help" -- "$cur"))
|
|
fi
|
|
return ;;
|
|
describe)
|
|
if [[ -z "$resource_type" ]]; then
|
|
COMPREPLY=($(compgen -W "$resources -o --output --show-values -h --help" -- "$cur"))
|
|
else
|
|
local names
|
|
names=$(_mcpctl_resource_names "$resource_type")
|
|
COMPREPLY=($(compgen -W "$names -o --output --show-values -h --help" -- "$cur"))
|
|
fi
|
|
return ;;
|
|
delete)
|
|
if [[ -z "$resource_type" ]]; then
|
|
COMPREPLY=($(compgen -W "$resources -p --project -h --help" -- "$cur"))
|
|
else
|
|
local names
|
|
names=$(_mcpctl_resource_names "$resource_type")
|
|
COMPREPLY=($(compgen -W "$names -p --project -h --help" -- "$cur"))
|
|
fi
|
|
return ;;
|
|
logs)
|
|
if [[ $((cword - subcmd_pos)) -eq 1 ]]; then
|
|
local names
|
|
names=$(mcpctl get instances -o json 2>/dev/null | jq -r '.[][].server.name' 2>/dev/null)
|
|
COMPREPLY=($(compgen -W "$names -t --tail -i --instance -h --help" -- "$cur"))
|
|
else
|
|
COMPREPLY=($(compgen -W "-t --tail -i --instance -h --help" -- "$cur"))
|
|
fi
|
|
return ;;
|
|
create)
|
|
local create_sub=$(_mcpctl_get_subcmd $subcmd_pos)
|
|
if [[ -z "$create_sub" ]]; then
|
|
COMPREPLY=($(compgen -W "server secret llm agent secretbackend project user group rbac mcptoken prompt serverattachment promptrequest help" -- "$cur"))
|
|
else
|
|
case "$create_sub" in
|
|
server)
|
|
COMPREPLY=($(compgen -W "-d --description --package-name --runtime --docker-image --transport --repository-url --external-url --command --container-port --replicas --env --from-template --env-from-secret --force -h --help" -- "$cur"))
|
|
;;
|
|
secret)
|
|
COMPREPLY=($(compgen -W "--data --force -h --help" -- "$cur"))
|
|
;;
|
|
llm)
|
|
COMPREPLY=($(compgen -W "--type --model --url --tier --description --api-key-ref --extra --force --skip-auth-check -h --help" -- "$cur"))
|
|
;;
|
|
agent)
|
|
COMPREPLY=($(compgen -W "--llm --project --description --system-prompt --system-prompt-file --proxy-model --default-temperature --default-top-p --default-top-k --default-max-tokens --default-seed --default-stop --default-extra --default-params-file --force -h --help" -- "$cur"))
|
|
;;
|
|
secretbackend)
|
|
COMPREPLY=($(compgen -W "--type --description --default --url --namespace --mount --path-prefix --auth --token-secret --role --auth-mount --sa-token-path --config --wizard --setup-token --policy-name --token-role --no-promote-default --force -h --help" -- "$cur"))
|
|
;;
|
|
project)
|
|
COMPREPLY=($(compgen -W "-d --description --proxy-model --prompt --llm --llm-model --gated --no-gated --server --force -h --help" -- "$cur"))
|
|
;;
|
|
user)
|
|
COMPREPLY=($(compgen -W "--password --name --force -h --help" -- "$cur"))
|
|
;;
|
|
group)
|
|
COMPREPLY=($(compgen -W "--description --member --force -h --help" -- "$cur"))
|
|
;;
|
|
rbac)
|
|
COMPREPLY=($(compgen -W "--subject --roleBindings --force -h --help" -- "$cur"))
|
|
;;
|
|
mcptoken)
|
|
COMPREPLY=($(compgen -W "-p --project --rbac --bind --ttl --description --force -h --help" -- "$cur"))
|
|
;;
|
|
prompt)
|
|
COMPREPLY=($(compgen -W "-p --project --content --content-file --priority --link -h --help" -- "$cur"))
|
|
;;
|
|
serverattachment)
|
|
COMPREPLY=($(compgen -W "-p --project -h --help" -- "$cur"))
|
|
;;
|
|
promptrequest)
|
|
COMPREPLY=($(compgen -W "-p --project --content --content-file --priority -h --help" -- "$cur"))
|
|
;;
|
|
*)
|
|
COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
|
|
;;
|
|
esac
|
|
fi
|
|
return ;;
|
|
edit)
|
|
if [[ -z "$resource_type" ]]; then
|
|
COMPREPLY=($(compgen -W "servers secrets projects groups rbac prompts promptrequests -h --help" -- "$cur"))
|
|
else
|
|
local names
|
|
names=$(_mcpctl_resource_names "$resource_type")
|
|
COMPREPLY=($(compgen -W "$names -h --help" -- "$cur"))
|
|
fi
|
|
return ;;
|
|
apply)
|
|
COMPREPLY=($(compgen -f -W "-f --file --dry-run -h --help" -- "$cur"))
|
|
return ;;
|
|
chat)
|
|
if [[ $((cword - subcmd_pos)) -eq 1 ]]; then
|
|
local names
|
|
names=$(_mcpctl_resource_names "agents")
|
|
COMPREPLY=($(compgen -W "$names -m --message --thread --system --system-file --system-append --temperature --top-p --top-k --max-tokens --seed --stop --allow-tool --extra --no-stream -h --help" -- "$cur"))
|
|
else
|
|
COMPREPLY=($(compgen -W "-m --message --thread --system --system-file --system-append --temperature --top-p --top-k --max-tokens --seed --stop --allow-tool --extra --no-stream -h --help" -- "$cur"))
|
|
fi
|
|
return ;;
|
|
patch)
|
|
if [[ -z "$resource_type" ]]; then
|
|
COMPREPLY=($(compgen -W "$resources -h --help" -- "$cur"))
|
|
else
|
|
local names
|
|
names=$(_mcpctl_resource_names "$resource_type")
|
|
COMPREPLY=($(compgen -W "$names -h --help" -- "$cur"))
|
|
fi
|
|
return ;;
|
|
backup)
|
|
local backup_sub=$(_mcpctl_get_subcmd $subcmd_pos)
|
|
if [[ -z "$backup_sub" ]]; then
|
|
COMPREPLY=($(compgen -W "log restore help" -- "$cur"))
|
|
else
|
|
case "$backup_sub" in
|
|
log)
|
|
COMPREPLY=($(compgen -W "-n --limit -h --help" -- "$cur"))
|
|
;;
|
|
restore)
|
|
COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
|
|
;;
|
|
*)
|
|
COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
|
|
;;
|
|
esac
|
|
fi
|
|
return ;;
|
|
attach-server)
|
|
if [[ $((cword - subcmd_pos)) -ne 1 ]]; then return; fi
|
|
local proj names all_servers proj_servers
|
|
proj=$(_mcpctl_get_project_value)
|
|
if [[ -n "$proj" ]]; then
|
|
all_servers=$(mcpctl get servers -o json 2>/dev/null | jq -r '.[].name' 2>/dev/null)
|
|
proj_servers=$(mcpctl --project "$proj" get servers -o json 2>/dev/null | jq -r '.[].name' 2>/dev/null)
|
|
names=$(comm -23 <(echo "$all_servers" | sort) <(echo "$proj_servers" | sort))
|
|
else
|
|
names=$(_mcpctl_resource_names "servers")
|
|
fi
|
|
COMPREPLY=($(compgen -W "$names" -- "$cur"))
|
|
return ;;
|
|
detach-server)
|
|
if [[ $((cword - subcmd_pos)) -ne 1 ]]; then return; fi
|
|
local proj names
|
|
proj=$(_mcpctl_get_project_value)
|
|
if [[ -n "$proj" ]]; then
|
|
names=$(mcpctl --project "$proj" get servers -o json 2>/dev/null | jq -r '.[].name' 2>/dev/null)
|
|
fi
|
|
COMPREPLY=($(compgen -W "$names" -- "$cur"))
|
|
return ;;
|
|
approve)
|
|
if [[ -z "$resource_type" ]]; then
|
|
COMPREPLY=($(compgen -W "promptrequest -h --help" -- "$cur"))
|
|
else
|
|
local names
|
|
names=$(_mcpctl_resource_names "$resource_type")
|
|
COMPREPLY=($(compgen -W "$names -h --help" -- "$cur"))
|
|
fi
|
|
return ;;
|
|
mcp)
|
|
COMPREPLY=($(compgen -W "-p --project -h --help" -- "$cur"))
|
|
return ;;
|
|
console)
|
|
if [[ $((cword - subcmd_pos)) -eq 1 ]]; then
|
|
local names
|
|
names=$(mcpctl get projects -o json 2>/dev/null | jq -r '.[].name' 2>/dev/null)
|
|
COMPREPLY=($(compgen -W "$names --stdin-mcp --audit -h --help" -- "$cur"))
|
|
else
|
|
COMPREPLY=($(compgen -W "--stdin-mcp --audit -h --help" -- "$cur"))
|
|
fi
|
|
return ;;
|
|
cache)
|
|
local cache_sub=$(_mcpctl_get_subcmd $subcmd_pos)
|
|
if [[ -z "$cache_sub" ]]; then
|
|
COMPREPLY=($(compgen -W "stats clear help" -- "$cur"))
|
|
else
|
|
case "$cache_sub" in
|
|
stats)
|
|
COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
|
|
;;
|
|
clear)
|
|
COMPREPLY=($(compgen -W "--older-than -y --yes -h --help" -- "$cur"))
|
|
;;
|
|
*)
|
|
COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
|
|
;;
|
|
esac
|
|
fi
|
|
return ;;
|
|
test)
|
|
local test_sub=$(_mcpctl_get_subcmd $subcmd_pos)
|
|
if [[ -z "$test_sub" ]]; then
|
|
COMPREPLY=($(compgen -W "mcp help" -- "$cur"))
|
|
else
|
|
case "$test_sub" in
|
|
mcp)
|
|
COMPREPLY=($(compgen -W "--token --tool --args --expect-tools --timeout -o --output --no-health -h --help" -- "$cur"))
|
|
;;
|
|
*)
|
|
COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
|
|
;;
|
|
esac
|
|
fi
|
|
return ;;
|
|
migrate)
|
|
local migrate_sub=$(_mcpctl_get_subcmd $subcmd_pos)
|
|
if [[ -z "$migrate_sub" ]]; then
|
|
COMPREPLY=($(compgen -W "secrets help" -- "$cur"))
|
|
else
|
|
case "$migrate_sub" in
|
|
secrets)
|
|
COMPREPLY=($(compgen -W "--from --to --names --keep-source --dry-run -h --help" -- "$cur"))
|
|
;;
|
|
*)
|
|
COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
|
|
;;
|
|
esac
|
|
fi
|
|
return ;;
|
|
rotate)
|
|
local rotate_sub=$(_mcpctl_get_subcmd $subcmd_pos)
|
|
if [[ -z "$rotate_sub" ]]; then
|
|
COMPREPLY=($(compgen -W "secretbackend help" -- "$cur"))
|
|
else
|
|
case "$rotate_sub" in
|
|
secretbackend)
|
|
COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
|
|
;;
|
|
*)
|
|
COMPREPLY=($(compgen -W "-h --help" -- "$cur"))
|
|
;;
|
|
esac
|
|
fi
|
|
return ;;
|
|
help)
|
|
COMPREPLY=($(compgen -W "$commands" -- "$cur"))
|
|
return ;;
|
|
esac
|
|
|
|
# No subcommand yet — offer commands based on context
|
|
if [[ -z "$subcmd" ]]; then
|
|
if $has_project; then
|
|
COMPREPLY=($(compgen -W "$project_commands $global_opts" -- "$cur"))
|
|
else
|
|
COMPREPLY=($(compgen -W "$commands $global_opts" -- "$cur"))
|
|
fi
|
|
fi
|
|
}
|
|
|
|
complete -F _mcpctl mcpctl
|