mcp_cmd.rs

//! MCP (Model Context Protocol) management commands.

use anyhow::{Context, Result, bail};
use clap::{ArgGroup, Parser};
use cortex_common::CliConfigOverrides;
use cortex_engine::{config::find_cortex_home, create_default_client};
use std::io::{self, BufRead, Write};

// ============================================================================
// Input Validation Constants and Utilities
// ============================================================================

/// Maximum length for server names (prevents DoS and storage issues)
const MAX_SERVER_NAME_LENGTH: usize = 64;

/// Maximum length for URLs (reasonable limit for HTTP URLs)
const MAX_URL_LENGTH: usize = 2048;

/// Maximum length for environment variable names
const MAX_ENV_VAR_NAME_LENGTH: usize = 256;

/// Maximum length for environment variable values
const MAX_ENV_VAR_VALUE_LENGTH: usize = 4096;

/// Maximum number of environment variables per server
const MAX_ENV_VARS: usize = 50;

/// Maximum number of command arguments
const MAX_COMMAND_ARGS: usize = 100;

/// Maximum length for a single command argument
const MAX_COMMAND_ARG_LENGTH: usize = 4096;

/// Allowed URL schemes for MCP HTTP transport
const ALLOWED_URL_SCHEMES: &[&str] = &["http", "https"];

/// Dangerous URL patterns that should be blocked
const BLOCKED_URL_PATTERNS: &[&str] = &[
    "javascript:",
    "data:",
    "file:",
    "ftp:",
    "localhost", // Require explicit localhost allowance
    "127.0.0.1",
    "0.0.0.0",
    "[::1]",
    "169.254.", // Link-local
    "10.",      // Private network
    "192.168.", // Private network
    "172.16.",  // Private network start
    "172.17.",
    "172.18.",
    "172.19.",
    "172.20.",
    "172.21.",
    "172.22.",
    "172.23.",
    "172.24.",
    "172.25.",
    "172.26.",
    "172.27.",
    "172.28.",
    "172.29.",
    "172.30.",
    "172.31.", // Private network end
];

/// Validates and sanitizes a URL for MCP HTTP transport.
///
/// # Validation Rules:
/// - Must not exceed maximum length
/// - Must use allowed schemes (http/https)
/// - Must not contain dangerous patterns
/// - Must be a valid URL format
fn validate_url(url: &str) -> Result<()> {
    // Check length
    if url.is_empty() {
        bail!("URL cannot be empty");
    }
    if url.len() > MAX_URL_LENGTH {
        bail!(
            "URL exceeds maximum length of {} characters",
            MAX_URL_LENGTH
        );
    }

    // Check for null bytes
    if url.contains('\0') {
        bail!("URL contains null bytes");
    }

    let url_lower = url.to_lowercase();

    // Check scheme - must start with http:// or https://
    let has_valid_scheme = ALLOWED_URL_SCHEMES
        .iter()
        .any(|&scheme| url_lower.starts_with(&format!("{}://", scheme)));
    if !has_valid_scheme {
        bail!(
            "URL must start with http:// or https://. Got: {}",
            url.chars().take(20).collect::<String>()
        );
    }

    // Check for blocked patterns
    for pattern in BLOCKED_URL_PATTERNS {
        if url_lower.contains(pattern) {
            bail!(
                "URL contains blocked pattern '{}'. For security, local/private network URLs are not allowed by default. \
                 Use environment variables for local development servers.",
                pattern
            );
        }
    }

    // Extract host portion for validation (simple parsing)
    let after_scheme = if url_lower.starts_with("https://") {
        &url[8..]
    } else if url_lower.starts_with("http://") {
        &url[7..]
    } else {
        bail!("Invalid URL scheme");
    };

    // Host should be non-empty (check up to first / or end)
    let host_end = after_scheme.find('/').unwrap_or(after_scheme.len());
    let host_port = &after_scheme[..host_end];

    if host_port.is_empty() {
        bail!("URL must contain a valid host");
    }

    // Remove port if present to check host
    let host = host_port.split(':').next().unwrap_or(host_port);
    if host.is_empty() {
        bail!("URL must contain a valid host");
    }

    // Check for path traversal attempts in the path portion
    if let Some(path_start) = after_scheme.find('/') {
        let path = &after_scheme[path_start..];
        if path.contains("..") {
            bail!("URL path contains potentially dangerous path traversal patterns");
        }
    }

    // Check for control characters
    for c in url.chars() {
        if c.is_control() && c != '\t' {
            bail!("URL contains control characters");
        }
    }

    Ok(())
}

/// Validates environment variable name.
fn validate_env_var_name(name: &str) -> Result<()> {
    if name.is_empty() {
        bail!("Environment variable name cannot be empty");
    }
    if name.len() > MAX_ENV_VAR_NAME_LENGTH {
        bail!(
            "Environment variable name exceeds maximum length of {} characters",
            MAX_ENV_VAR_NAME_LENGTH
        );
    }
    // Env var names should be alphanumeric with underscores
    if !name.chars().all(|c| c.is_ascii_alphanumeric() || c == '_') {
        bail!(
            "Environment variable name '{}' contains invalid characters. Use only letters, numbers, and underscores.",
            name
        );
    }
    // Should not start with a digit
    if name
        .chars()
        .next()
        .map(|c| c.is_ascii_digit())
        .unwrap_or(false)
    {
        bail!("Environment variable name cannot start with a digit");
    }
    Ok(())
}

/// Validates environment variable value.
fn validate_env_var_value(value: &str) -> Result<()> {
    if value.len() > MAX_ENV_VAR_VALUE_LENGTH {
        bail!(
            "Environment variable value exceeds maximum length of {} characters",
            MAX_ENV_VAR_VALUE_LENGTH
        );
    }
    // Check for null bytes which could cause issues
    if value.contains('\0') {
        bail!("Environment variable value contains null bytes");
    }
    Ok(())
}

/// Validates command arguments for stdio transport.
fn validate_command_args(args: &[String]) -> Result<()> {
    if args.is_empty() {
        bail!("Command cannot be empty");
    }
    if args.len() > MAX_COMMAND_ARGS {
        bail!(
            "Too many command arguments ({}). Maximum allowed is {}",
            args.len(),
            MAX_COMMAND_ARGS
        );
    }
    for (i, arg) in args.iter().enumerate() {
        if arg.len() > MAX_COMMAND_ARG_LENGTH {
            bail!(
                "Command argument {} exceeds maximum length of {} characters",
                i + 1,
                MAX_COMMAND_ARG_LENGTH
            );
        }
        // Check for null bytes
        if arg.contains('\0') {
            bail!("Command argument {} contains null bytes", i + 1);
        }
    }
    Ok(())
}

/// Validates bearer token environment variable name.
fn validate_bearer_token_env_var(var_name: &str) -> Result<()> {
    validate_env_var_name(var_name)?;
    // Additional checks for token env vars
    let upper = var_name.to_uppercase();
    if upper.contains("PASSWORD") || upper.contains("PASSWD") {
        // Warn but don't block - just log
        tracing::warn!(
            "Bearer token env var '{}' contains 'PASSWORD' - ensure this is intentional",
            var_name
        );
    }
    Ok(())
}

/// MCP management CLI.
#[derive(Debug, Parser)]
pub struct McpCli {
    #[clap(flatten)]
    pub config_overrides: CliConfigOverrides,

    #[command(subcommand)]
    pub subcommand: McpSubcommand,
}

/// MCP subcommands.
#[derive(Debug, clap::Subcommand)]
pub enum McpSubcommand {
    /// List configured MCP servers.
    List(ListArgs),

    /// List configured MCP servers (alias for list).
    #[command(visible_alias = "ls")]
    Ls(ListArgs),

    /// Show details for a configured MCP server.
    Get(GetArgs),

    /// Add a global MCP server entry.
    Add(AddArgs),

    /// Remove a global MCP server entry.
    #[command(visible_alias = "rm")]
    Remove(RemoveArgs),

    /// Authenticate with an OAuth-enabled MCP server.
    Auth(AuthCommand),

    /// Remove OAuth credentials for an MCP server.
    Logout(LogoutArgs),

    /// Debug and test an MCP server connection.
    Debug(DebugArgs),
}

/// Arguments for list command.
#[derive(Debug, Parser)]
pub struct ListArgs {
    /// Output the configured servers as JSON.
    #[arg(long)]
    pub json: bool,
}

/// Arguments for get command.
#[derive(Debug, Parser)]
pub struct GetArgs {
    /// Name of the MCP server to display.
    pub name: String,

    /// Output the server configuration as JSON.
    #[arg(long)]
    pub json: bool,
}

/// Arguments for add command.
#[derive(Debug, Parser)]
#[command(
    override_usage = "cortex mcp add [OPTIONS] <NAME> (--url <URL> | -- <COMMAND>...)",
    after_help = "IMPORTANT: Use '--' to separate the MCP server command from cortex options.\n\
This is required when the command or its arguments start with a dash (-).\n\n\
Examples:\n  \
cortex mcp add myserver -- npx @example/server\n  \
cortex mcp add myserver -- python -m my_server\n  \
cortex mcp add myserver -- node server.js -v       # -v goes to server, not cortex\n  \
cortex mcp add myserver --url https://example.com/mcp\n\n\
Without '--', arguments like '-v' or '-m' may be interpreted as cortex flags."
)]
pub struct AddArgs {
    /// Name for the MCP server configuration.
    pub name: String,

    /// Overwrite existing server configuration if it exists.
    #[arg(long, short = 'f')]
    pub force: bool,

    #[command(flatten)]
    pub transport_args: AddMcpTransportArgs,
}

/// Transport arguments for add command.
#[derive(Debug, clap::Args)]
#[command(
    group(
        ArgGroup::new("transport")
            .args(["command", "url"])
            .required(true)
            .multiple(false)
    )
)]
pub struct AddMcpTransportArgs {
    #[command(flatten)]
    pub stdio: Option<AddMcpStdioArgs>,

    #[command(flatten)]
    pub streamable_http: Option<AddMcpStreamableHttpArgs>,
}

/// Stdio transport arguments.
#[derive(Debug, clap::Args)]
pub struct AddMcpStdioArgs {
    /// Command to launch the MCP server.
    #[arg(trailing_var_arg = true, num_args = 0..)]
    pub command: Vec<String>,

    /// Environment variables to set when launching the server.
    #[arg(long, value_parser = parse_env_pair, value_name = "KEY=VALUE")]
    pub env: Vec<(String, String)>,
}

/// HTTP transport arguments.
#[derive(Debug, clap::Args)]
pub struct AddMcpStreamableHttpArgs {
    /// URL for a streamable HTTP MCP server.
    #[arg(long)]
    pub url: String,

    /// Optional environment variable to read for a bearer token.
    #[arg(
        long = "bearer-token-env-var",
        value_name = "ENV_VAR",
        requires = "url"
    )]
    pub bearer_token_env_var: Option<String>,
}

/// Arguments for remove command.
#[derive(Debug, Parser)]
pub struct RemoveArgs {
    /// Name of the MCP server configuration to remove.
    pub name: String,

    /// Skip confirmation prompt.
    /// Aliases: --force, -f (for compatibility)
    #[arg(short = 'y', long = "yes", visible_aliases = ["force"], short_alias = 'f')]
    pub yes: bool,
}

/// Auth command with subcommands.
#[derive(Debug, Parser)]
pub struct AuthCommand {
    #[command(subcommand)]
    pub action: Option<AuthSubcommand>,

    /// Name of the MCP server to authenticate with (if no subcommand).
    pub name: Option<String>,

    /// Client ID for OAuth (if not using dynamic registration).
    #[arg(long)]
    pub client_id: Option<String>,

    /// Client secret for OAuth (if required).
    #[arg(long)]
    pub client_secret: Option<String>,
}

/// Auth subcommands.
#[derive(Debug, clap::Subcommand)]
pub enum AuthSubcommand {
    /// List OAuth status for all servers.
    List(AuthListArgs),
}

/// Arguments for auth list command.
#[derive(Debug, Parser)]
pub struct AuthListArgs {
    /// Output as JSON.
    #[arg(long)]
    pub json: bool,
}

/// Arguments for logout command.
#[derive(Debug, Parser)]
pub struct LogoutArgs {
    /// Name of the MCP server to remove credentials for.
    #[arg(required_unless_present = "all")]
    pub name: Option<String>,

    /// Remove OAuth credentials for all servers.
    #[arg(long)]
    pub all: bool,
}

/// Arguments for debug command.
#[derive(Debug, Parser)]
pub struct DebugArgs {
    /// Name of the MCP server to debug.
    pub name: String,

    /// Output as JSON.
    #[arg(long)]
    pub json: bool,

    /// Test OAuth authentication if configured.
    #[arg(long)]
    pub test_auth: bool,

    /// Timeout in seconds for connection test.
    #[arg(long, default_value = "30")]
    pub timeout: u64,
}

impl McpCli {
    /// Run the MCP command.
    pub async fn run(self) -> Result<()> {
        let McpCli {
            config_overrides: _,
            subcommand,
        } = self;

        match subcommand {
            McpSubcommand::List(args) | McpSubcommand::Ls(args) => run_list(args).await,
            McpSubcommand::Get(args) => run_get(args).await,
            McpSubcommand::Add(args) => run_add(args).await,
            McpSubcommand::Remove(args) => run_remove(args).await,
            McpSubcommand::Auth(cmd) => run_auth_command(cmd).await,
            McpSubcommand::Logout(args) => run_logout(args).await,
            McpSubcommand::Debug(args) => run_debug(args).await,
        }
    }
}

/// Load the config file as a toml::Value.
fn load_config() -> Result<Option<toml::Value>> {
    let config_path = find_cortex_home()
        .map_err(|e| anyhow::anyhow!("Failed to find cortex home: {}", e))?
        .join("config.toml");

    if !config_path.exists() {
        return Ok(None);
    }

    let content = std::fs::read_to_string(&config_path)
        .with_context(|| format!("failed to read config: {}", config_path.display()))?;

    let config: toml::Value = toml::from_str(&content).with_context(|| "failed to parse config")?;

    Ok(Some(config))
}

/// Get all MCP servers from config.
fn get_mcp_servers() -> Result<toml::map::Map<String, toml::Value>> {
    let config = load_config()?;

    let servers = config
        .and_then(|c| c.get("mcp_servers").and_then(|v| v.as_table()).cloned())
        .unwrap_or_default();

    Ok(servers)
}

/// Get a specific MCP server from config.
fn get_mcp_server(name: &str) -> Result<Option<toml::Value>> {
    let servers = get_mcp_servers()?;
    Ok(servers.get(name).cloned())
}

async fn run_list(args: ListArgs) -> Result<()> {
    let servers = get_mcp_servers()?;

    if args.json {
        let json = serde_json::to_string_pretty(&servers)?;
        println!("{json}");
        return Ok(());
    }

    if servers.is_empty() {
        println!("No MCP servers configured yet.");
        println!("\nTo add a server:");
        println!("  cortex mcp add my-tool -- my-command      # Local stdio server");
        println!("  cortex mcp add my-api --url https://...   # Remote HTTP server");
        return Ok(());
    }

    println!(
        "{:<20} {:<12} {:<8} {:<18} {:<30}",
        "Name", "Status", "Tools", "Auth", "Transport"
    );
    println!("{}", "-".repeat(90));

    for (name, server) in &servers {
        let enabled = server
            .get("enabled")
            .and_then(toml::Value::as_bool)
            .unwrap_or(true);
        let status = if enabled { "enabled" } else { "disabled" };

        // Get tools count if available (would come from cached server info)
        let tools_count = server
            .get("_cached_tools_count")
            .and_then(|v| v.as_integer())
            .map(|n| n.to_string())
            .unwrap_or_else(|| "-".to_string());

        // Determine transport type and auth status
        let (transport_info, auth_status) = if let Some(transport) = server.get("transport") {
            let transport_type = transport
                .get("type")
                .and_then(|v| v.as_str())
                .unwrap_or("unknown");
            match transport_type {
                "stdio" => {
                    let cmd = transport
                        .get("command")
                        .and_then(|v| v.as_str())
                        .unwrap_or("?");
                    (format!("stdio: {cmd}"), "N/A".to_string())
                }
                "http" => {
                    let url = transport.get("url").and_then(|v| v.as_str()).unwrap_or("?");
                    // Check OAuth status for HTTP servers
                    let auth = get_auth_status_for_display(name, url)
                        .await
                        .unwrap_or_else(|_| "Unknown".to_string());
                    // Truncate URL if too long
                    let transport_str = if url.len() > 28 {
                        format!("http: {}...", &url[..25])
                    } else {
                        format!("http: {url}")
                    };
                    (transport_str, auth)
                }
                _ => (transport_type.to_string(), "N/A".to_string()),
            }
        } else {
            ("unknown".to_string(), "N/A".to_string())
        };

        println!("{name:<20} {status:<12} {tools_count:<8} {auth_status:<18} {transport_info:<30}");
    }

    println!("\nTotal: {} server(s)", servers.len());
    println!("\nUse 'cortex mcp get <name>' for details.");
    println!("Use 'cortex mcp debug <name>' to test connection.");

    Ok(())
}

async fn run_get(args: GetArgs) -> Result<()> {
    let server = get_mcp_server(&args.name)?
        .ok_or_else(|| anyhow::anyhow!("No MCP server named '{}' found", args.name))?;

    if args.json {
        let json = serde_json::to_string_pretty(&server)?;
        println!("{json}");
        return Ok(());
    }

    println!("MCP Server: {}", args.name);
    println!("{}", "=".repeat(40));

    let enabled = server
        .get("enabled")
        .and_then(toml::Value::as_bool)
        .unwrap_or(true);
    println!("Enabled: {enabled}");

    if let Some(transport) = server.get("transport") {
        let transport_type = transport
            .get("type")
            .and_then(|v| v.as_str())
            .unwrap_or("unknown");
        println!("\nTransport: {transport_type}");

        match transport_type {
            "stdio" => {
                if let Some(cmd) = transport.get("command").and_then(|v| v.as_str()) {
                    println!("  Command: {cmd}");
                }
                if let Some(args) = transport.get("args").and_then(|v| v.as_array()) {
                    let args_str: Vec<_> = args.iter().filter_map(|v| v.as_str()).collect();
                    if !args_str.is_empty() {
                        println!("  Args: {}", args_str.join(" "));
                    }
                }
                if let Some(env) = transport.get("env").and_then(|v| v.as_table()) {
                    if !env.is_empty() {
                        println!("  Environment:");
                        for (key, value) in env {
                            let val_str = value.as_str().unwrap_or("***");
                            // Mask sensitive values
                            let masked = if key.to_lowercase().contains("key")
                                || key.to_lowercase().contains("secret")
                                || key.to_lowercase().contains("token")
                                || key.to_lowercase().contains("password")
                            {
                                "***"
                            } else {
                                val_str
                            };
                            println!("    {key}={masked}");
                        }
                    }
                }
            }
            "http" => {
                if let Some(url) = transport.get("url").and_then(|v| v.as_str()) {
                    println!("  URL: {url}");
                }
                if let Some(token_var) = transport
                    .get("bearer_token_env_var")
                    .and_then(|v| v.as_str())
                {
                    println!("  Bearer Token Env Var: {token_var}");
                }
            }
            _ => {}
        }
    }

    // Show OAuth status if HTTP
    if let Some(transport) = server.get("transport") {
        let transport_type = transport
            .get("type")
            .and_then(|v| v.as_str())
            .unwrap_or("unknown");
        if transport_type == "http" {
            if let Some(url) = transport.get("url").and_then(|v| v.as_str()) {
                println!("\nOAuth Status:");
                match get_auth_status_for_display(&args.name, url).await {
                    Ok(status) => println!("  {status}"),
                    Err(_) => println!("  Unknown"),
                }
            }
        }
    }

    Ok(())
}

async fn run_add(args: AddArgs) -> Result<()> {
    let AddArgs {
        name,
        force,
        transport_args,
    } = args;

    validate_server_name(&name)?;

    // Check if server already exists
    let server_exists = get_mcp_server(&name)?.is_some();
    if server_exists && !force {
        bail!(
            "MCP server '{}' already exists. Use --force to overwrite, or 'cortex mcp remove {}' first.",
            name,
            name
        );
    }

    // Validate that bearer token is not used with stdio transport
    if let Some(ref http_args) = transport_args.streamable_http {
        if http_args.bearer_token_env_var.is_some() {
            if let Some(ref stdio_args) = transport_args.stdio {
                if !stdio_args.command.is_empty() {
                    bail!(
                        "Error: --bearer-token-env-var is only supported for HTTP transport.\n\
                         You cannot use bearer tokens with stdio transport (command execution).\n\n\
                         To use bearer token authentication:\n\
                         • Remove the command arguments (-- <COMMAND>)\n\
                         • Use --url instead to specify an HTTP MCP server\n\n\
                         Example: cortex mcp add {name} --url https://api.example.com --bearer-token-env-var MY_TOKEN"
                    );
                }
            }
        }
    }

    let cortex_home =
        find_cortex_home().map_err(|e| anyhow::anyhow!("Failed to find cortex home: {}", e))?;
    let config_path = cortex_home.join("config.toml");

    // If force mode and server exists, remove it first
    if server_exists && force {
        // Parse, remove the server, and re-serialize
        if config_path.exists() {
            let content = std::fs::read_to_string(&config_path)
                .with_context(|| format!("failed to read config: {}", config_path.display()))?;
            let mut config: toml::Value =
                toml::from_str(&content).with_context(|| "failed to parse config")?;

            if let Some(mcp_servers) = config.get_mut("mcp_servers").and_then(|v| v.as_table_mut())
            {
                mcp_servers.remove(&name);
            }

            // Write back the config without the old server
            let updated_content =
                toml::to_string_pretty(&config).with_context(|| "failed to serialize config")?;
            std::fs::write(&config_path, &updated_content)
                .with_context(|| format!("failed to write config: {}", config_path.display()))?;

            println!("✓ Removed existing MCP server '{name}' (--force)");
        }
    }

    // Load existing config or create new
    let mut config_content = if config_path.exists() {
        std::fs::read_to_string(&config_path)
            .with_context(|| format!("failed to read config: {}", config_path.display()))?
    } else {
        String::new()
    };

    // Create MCP server entry
    // Returns (toml_content, success_message) - message is deferred until config write succeeds
    let (transport_toml, success_msg) = match transport_args {
        AddMcpTransportArgs {
            stdio: Some(stdio), ..
        } => {
            // Validate command arguments
            validate_command_args(&stdio.command)?;

            // Validate environment variables
            if stdio.env.len() > MAX_ENV_VARS {
                bail!(
                    "Too many environment variables ({}). Maximum allowed is {}",
                    stdio.env.len(),
                    MAX_ENV_VARS
                );
            }
            for (key, value) in &stdio.env {
                validate_env_var_name(key)?;
                validate_env_var_value(value)?;
            }

            let mut command_parts = stdio.command.into_iter();
            let command_bin = command_parts
                .next()
                .ok_or_else(|| anyhow::anyhow!("command is required"))?;
            let command_args: Vec<String> = command_parts.collect();

            // Sanitize command_bin for TOML (escape special characters)
            let command_bin_escaped = command_bin.replace('\\', "\\\\").replace('"', "\\\"");

            let mut toml = format!(
                r#"
[mcp_servers.{name}]
enabled = true
[mcp_servers.{name}.transport]
type = "stdio"
command = "{command_bin_escaped}"
"#
            );

            if !command_args.is_empty() {
                toml.push_str(&format!(
                    "args = [{}]\n",
                    command_args
                        .iter()
                        .map(|a| {
                            // Escape special characters in args
                            let escaped = a.replace('\\', "\\\\").replace('"', "\\\"");
                            format!("\"{escaped}\"")
                        })
                        .collect::<Vec<_>>()
                        .join(", ")
                ));
            }

            if !stdio.env.is_empty() {
                toml.push_str("[mcp_servers.");
                toml.push_str(&name);
                toml.push_str(".transport.env]\n");
                for (key, value) in &stdio.env {
                    // Escape special characters in env values
                    let escaped_value = value.replace('\\', "\\\\").replace('"', "\\\"");
                    toml.push_str(&format!("{key} = \"{escaped_value}\"\n"));
                }
            }

            // Build success message but defer printing until config write succeeds
            let mut success_msg = format!("✓ Added stdio MCP server '{name}'\n");
            success_msg.push_str(&format!("  Command: {command_bin}\n"));
            if !command_args.is_empty() {
                success_msg.push_str(&format!("  Args: {}\n", command_args.join(" ")));
            }

            (toml, success_msg)
        }
        AddMcpTransportArgs {
            streamable_http:
                Some(AddMcpStreamableHttpArgs {
                    url,
                    bearer_token_env_var,
                }),
            ..
        } => {
            // Validate URL format and safety
            validate_url(&url)?;

            // Validate bearer token env var if provided
            if let Some(ref token_var) = bearer_token_env_var {
                validate_bearer_token_env_var(token_var)?;
            }

            // Escape URL for TOML
            let url_escaped = url.replace('\\', "\\\\").replace('"', "\\\"");

            let mut toml = format!(
                r#"
[mcp_servers.{name}]
enabled = true
[mcp_servers.{name}.transport]
type = "http"
url = "{url_escaped}"
"#
            );

            if let Some(ref token_var) = bearer_token_env_var {
                toml.push_str(&format!("bearer_token_env_var = \"{token_var}\"\n"));
            }

            // Build success message but defer printing until config write succeeds
            let mut success_msg = format!("✓ Added HTTP MCP server '{name}'\n");
            success_msg.push_str(&format!("  URL: {url}\n"));
            if let Some(ref token_var) = bearer_token_env_var {
                success_msg.push_str(&format!("  Bearer Token Env Var: {token_var}\n"));
            }

            (toml, success_msg)
        }
        _ => bail!("exactly one of --command or --url must be provided"),
    };

    // Append to config
    config_content.push_str(&transport_toml);

    // Ensure directory exists
    if let Some(parent) = config_path.parent() {
        std::fs::create_dir_all(parent)?;
    }

    // Write config file - only print success message after this succeeds
    std::fs::write(&config_path, &config_content)
        .with_context(|| format!("failed to write config: {}", config_path.display()))?;

    // Now that config was successfully written, print the success message
    print!("{success_msg}");
    println!("\nUse 'cortex mcp debug {name}' to test the connection.");

    Ok(())
}

async fn run_remove(args: RemoveArgs) -> Result<()> {
    let RemoveArgs { name, yes } = args;

    validate_server_name(&name)?;

    // Check if server exists
    if get_mcp_server(&name)?.is_none() {
        bail!("No MCP server named '{}' found", name);
    }

    // Confirm removal if not skipped via --yes/-y/--force/-f
    if !yes {
        print!("Remove MCP server '{name}'? [y/N]: ");
        io::stdout().flush()?;

        let mut input = String::new();
        io::stdin().lock().read_line(&mut input)?;

        if !input.trim().eq_ignore_ascii_case("y") {
            println!("Cancelled.");
            return Ok(());
        }
    }

    let cortex_home =
        find_cortex_home().map_err(|e| anyhow::anyhow!("Failed to find cortex home: {}", e))?;
    let config_path = cortex_home.join("config.toml");

    if !config_path.exists() {
        bail!("Config file not found");
    }

    let content = std::fs::read_to_string(&config_path)
        .with_context(|| format!("failed to read config: {}", config_path.display()))?;

    // Parse the TOML and remove the server section
    let mut config: toml::Value =
        toml::from_str(&content).with_context(|| "failed to parse config")?;

    if let Some(mcp_servers) = config.get_mut("mcp_servers").and_then(|v| v.as_table_mut()) {
        mcp_servers.remove(&name);
    }

    // Write back the config
    let new_content =
        toml::to_string_pretty(&config).with_context(|| "failed to serialize config")?;

    std::fs::write(&config_path, new_content)
        .with_context(|| format!("failed to write config: {}", config_path.display()))?;

    println!("✓ Removed MCP server '{name}'.");

    // Also remove OAuth credentials if any
    match remove_auth_silent(&name).await {
        Ok(true) => println!("✓ Removed OAuth credentials for '{name}'."),
        Ok(false) => {}
        Err(_) => {}
    }

    Ok(())
}

fn parse_env_pair(raw: &str) -> Result<(String, String), String> {
    let mut parts = raw.splitn(2, '=');
    let key = parts
        .next()
        .map(str::trim)
        .filter(|s| !s.is_empty())
        .ok_or_else(|| "environment entries must be in KEY=VALUE form".to_string())?;
    let value = parts
        .next()
        .map(str::to_string)
        .ok_or_else(|| "environment entries must be in KEY=VALUE form".to_string())?;

    Ok((key.to_string(), value))
}

fn validate_server_name(name: &str) -> Result<()> {
    // Check for empty name
    if name.is_empty() {
        bail!("server name cannot be empty");
    }

    // Check length limits
    if name.len() > MAX_SERVER_NAME_LENGTH {
        bail!(
            "server name '{}' exceeds maximum length of {} characters",
            name,
            MAX_SERVER_NAME_LENGTH
        );
    }

    // Check for valid characters
    let is_valid_chars = name
        .chars()
        .all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_');

    if !is_valid_chars {
        bail!("invalid server name '{name}' (use letters, numbers, '-', '_')");
    }

    // Must start with a letter or underscore
    let first_char = name.chars().next().unwrap();
    if first_char.is_ascii_digit() || first_char == '-' {
        bail!(
            "server name must start with a letter or underscore, not '{}'",
            first_char
        );
    }

    // Check for reserved names
    let reserved_names = [".", "..", "con", "prn", "aux", "nul"];
    if reserved_names.contains(&name.to_lowercase().as_str()) {
        bail!("server name '{}' is reserved and cannot be used", name);
    }

    Ok(())
}

async fn run_auth_command(cmd: AuthCommand) -> Result<()> {
    match cmd.action {
        Some(AuthSubcommand::List(args)) => {
            // If subcommand is list, name should not be provided
            if cmd.name.is_some() {
                bail!("Cannot specify server name with 'list' subcommand");
            }
            run_auth_list(args).await
        }
        None => {
            // Direct auth with server name
            let name = cmd.name.ok_or_else(|| {
                anyhow::anyhow!(
                    "Server name required. Use 'cortex mcp auth <name>' to authenticate or 'cortex mcp auth list' to list auth status."
                )
            })?;
            run_auth(name, cmd.client_id, cmd.client_secret).await
        }
    }
}

async fn run_auth_list(args: AuthListArgs) -> Result<()> {
    let servers = get_mcp_servers()?;

    if servers.is_empty() {
        if args.json {
            println!("[]");
        } else {
            println!("No MCP servers configured.");
        }
        return Ok(());
    }

    let mut auth_statuses = Vec::new();

    for (name, server) in &servers {
        // Only check HTTP servers (stdio servers don't use OAuth)
        let transport = server.get("transport");
        let transport_type = transport
            .and_then(|t| t.get("type"))
            .and_then(|v| v.as_str())
            .unwrap_or("unknown");

        if transport_type != "http" {
            continue;
        }

        let url = transport
            .and_then(|t| t.get("url"))
            .and_then(|v| v.as_str())
            .unwrap_or("");

        let status = get_auth_status_for_display(name, url)
            .await
            .unwrap_or_else(|_| "Unknown".to_string());
        let has_oauth = check_server_supports_oauth(url).await.unwrap_or(false);

        auth_statuses.push(serde_json::json!({
            "name": name,
            "url": url,
            "oauth_supported": has_oauth,
            "status": status,
        }));
    }

    if args.json {
        let json = serde_json::to_string_pretty(&auth_statuses)?;
        println!("{json}");
        return Ok(());
    }

    if auth_statuses.is_empty() {
        println!("No HTTP MCP servers configured (OAuth is only for HTTP servers).");
        return Ok(());
    }

    println!("{:<20} {:<18} {:<40}", "Server", "Auth Status", "URL");
    println!("{}", "-".repeat(80));

    for status in &auth_statuses {
        let name = status["name"].as_str().unwrap_or("?");
        let url = status["url"].as_str().unwrap_or("?");
        let auth_status = status["status"].as_str().unwrap_or("Unknown");
        let oauth_supported = status["oauth_supported"].as_bool().unwrap_or(false);

        let display_status = if !oauth_supported {
            "N/A (no OAuth)"
        } else {
            auth_status
        };

        // Truncate URL if too long
        let display_url = if url.len() > 38 {
            format!("{}...", &url[..35])
        } else {
            url.to_string()
        };

        println!("{name:<20} {display_status:<18} {display_url:<40}");
    }

    println!("\nUse 'cortex mcp auth <name>' to authenticate with a server.");
    println!("Use 'cortex mcp logout <name>' to remove credentials.");

    Ok(())
}

async fn run_auth(
    name: String,
    client_id: Option<String>,
    client_secret: Option<String>,
) -> Result<()> {
    use cortex_engine::mcp;

    validate_server_name(&name)?;

    let server = get_mcp_server(&name)?.ok_or_else(|| {
        anyhow::anyhow!(
            "No MCP server named '{}' found. Add it first with `cortex mcp add`.",
            name
        )
    })?;

    // Get the server URL
    let transport = server
        .get("transport")
        .ok_or_else(|| anyhow::anyhow!("MCP server '{name}' has no transport configured"))?;

    let transport_type = transport
        .get("type")
        .and_then(|v| v.as_str())
        .unwrap_or("unknown");

    if transport_type != "http" {
        bail!(
            "OAuth authentication is only supported for HTTP MCP servers. Server '{name}' uses {transport_type} transport."
        );
    }

    let server_url = transport
        .get("url")
        .and_then(|v| v.as_str())
        .ok_or_else(|| anyhow::anyhow!("HTTP MCP server '{name}' has no URL configured"))?;

    // Check current auth status
    let auth_status = mcp::get_auth_status(&name, server_url)
        .await
        .map_err(|e| anyhow::anyhow!("Failed to check auth status: {e}"))?;

    match auth_status {
        mcp::AuthStatus::Authenticated => {
            println!("MCP server '{name}' is already authenticated.");
            println!("Use `cortex mcp logout {name}` first if you want to re-authenticate.");
            return Ok(());
        }
        mcp::AuthStatus::Expired => {
            println!("OAuth tokens for '{name}' have expired. Re-authenticating...");
        }
        mcp::AuthStatus::NotAuthenticated => {
            println!("Starting OAuth authentication for '{name}'...");
        }
    }

    // Run the OAuth flow
    println!("Opening browser for authentication...");
    println!("Waiting for authorization (timeout: 5 minutes)...");

    match mcp::run_oauth_flow(
        &name,
        server_url,
        client_id.as_deref(),
        client_secret.as_deref(),
    )
    .await
    {
        Ok(_tokens) => {
            println!("✓ Successfully authenticated with MCP server '{name}'!");
        }
        Err(e) => {
            bail!("OAuth authentication failed: {e}");
        }
    }

    Ok(())
}

async fn run_logout(args: LogoutArgs) -> Result<()> {
    use cortex_engine::mcp;

    if args.all {
        // Logout from all servers
        let servers = get_mcp_servers()?;
        let mut count = 0;

        for (name, server) in &servers {
            // Only check HTTP servers
            let transport = server.get("transport");
            let transport_type = transport
                .and_then(|t| t.get("type"))
                .and_then(|v| v.as_str())
                .unwrap_or("unknown");

            if transport_type != "http" {
                continue;
            }

            let has_tokens = mcp::has_stored_tokens(name).await.unwrap_or(false);

            if has_tokens {
                match mcp::remove_auth(name).await {
                    Ok(_) => {
                        println!("✓ Removed OAuth credentials for '{name}'.");
                        count += 1;
                    }
                    Err(e) => {
                        eprintln!("✗ Failed to remove credentials for '{name}': {e}");
                    }
                }
            }
        }

        if count == 0 {
            println!("No OAuth credentials found to remove.");
        } else {
            println!("\nRemoved credentials for {count} server(s).");
        }

        return Ok(());
    }

    let name = args
        .name
        .ok_or_else(|| anyhow::anyhow!("Server name required (or use --all)"))?;

    validate_server_name(&name)?;

    // Check if we have stored credentials
    let has_tokens = mcp::has_stored_tokens(&name)
        .await
        .map_err(|e| anyhow::anyhow!("Failed to check stored tokens: {e}"))?;

    if !has_tokens {
        println!("No OAuth credentials found for MCP server '{name}'.");
        return Ok(());
    }

    // Remove the credentials
    mcp::remove_auth(&name)
        .await
        .map_err(|e| anyhow::anyhow!("Failed to remove OAuth credentials: {e}"))?;

    println!("✓ Removed OAuth credentials for MCP server '{name}'.");

    Ok(())
}

async fn run_debug(args: DebugArgs) -> Result<()> {
    let DebugArgs {
        name,
        json,
        test_auth,
        timeout,
    } = args;

    validate_server_name(&name)?;

    let server = get_mcp_server(&name)?
        .ok_or_else(|| anyhow::anyhow!("No MCP server named '{}' found", name))?;

    let enabled = server
        .get("enabled")
        .and_then(toml::Value::as_bool)
        .unwrap_or(true);

    let transport = server
        .get("transport")
        .ok_or_else(|| anyhow::anyhow!("MCP server '{name}' has no transport configured"))?;

    let transport_type = transport
        .get("type")
        .and_then(|v| v.as_str())
        .unwrap_or("unknown");

    let mut debug_result = serde_json::json!({
        "name": name,
        "enabled": enabled,
        "transport_type": transport_type,
        "connection": null,
        "capabilities": null,
        "tools": [],
        "resources": [],
        "prompts": [],
        "auth_status": null,
        "errors": [],
    });

    let mut errors: Vec<String> = Vec::new();

    if !json {
        println!("Debugging MCP Server: {name}");
        println!("{}", "=".repeat(50));
        println!();
        println!("Configuration:");
        println!("  Enabled: {enabled}");
        println!("  Transport: {transport_type}");
    }

    // Transport-specific info
    match transport_type {
        "stdio" => {
            let cmd = transport
                .get("command")
                .and_then(|v| v.as_str())
                .unwrap_or("?");
            let args = transport
                .get("args")
                .and_then(|v| v.as_array())
                .map(|arr| {
                    arr.iter()
                        .filter_map(|v| v.as_str())
                        .collect::<Vec<_>>()
                        .join(" ")
                })
                .unwrap_or_default();

            debug_result["command"] = serde_json::json!(cmd);
            debug_result["args"] = serde_json::json!(args);

            if !json {
                println!("  Command: {cmd}");
                if !args.is_empty() {
                    println!("  Args: {args}");
                }
            }

            // Test if command exists (check if it's in PATH)
            let cmd_exists = std::process::Command::new(cmd)
                .arg("--version")
                .stdout(std::process::Stdio::null())
                .stderr(std::process::Stdio::null())
                .status()
                .is_ok();
            debug_result["command_exists"] = serde_json::json!(cmd_exists);

            if !json {
                println!();
                println!("Command Check:");
                if cmd_exists {
                    println!("  ✓ Command '{cmd}' found in PATH");
                } else {
                    println!("  ✗ Command '{cmd}' not found in PATH");
                    errors.push(format!("Command '{}' not found in PATH", cmd));
                }
            }

            // Try to connect and get capabilities
            if !json {
                println!();
                println!("Connection Test:");
            }

            match test_stdio_connection(&name, cmd, &args, timeout).await {
                Ok(info) => {
                    debug_result["connection"] = serde_json::json!("success");
                    debug_result["capabilities"] = info.capabilities.clone();
                    debug_result["tools"] = info.tools.clone();
                    debug_result["resources"] = info.resources.clone();
                    debug_result["prompts"] = info.prompts.clone();

                    if !json {
                        println!("  ✓ Connected successfully");
                        println!();
                        println!("Server Capabilities:");
                        if let Some(caps) = info.capabilities.as_object() {
                            for (key, value) in caps {
                                println!("  • {key}: {value}");
                            }
                        } else {
                            println!("  (none reported)");
                        }
                        println!();
                        println!(
                            "Available Tools: {}",
                            info.tools.as_array().map(|a| a.len()).unwrap_or(0)
                        );
                        if let Some(tools) = info.tools.as_array() {
                            for tool in tools.iter().take(10) {
                                if let Some(name) = tool.get("name").and_then(|v| v.as_str()) {
                                    let desc = tool
                                        .get("description")
                                        .and_then(|v| v.as_str())
                                        .unwrap_or("");
                                    let desc_short = if desc.len() > 50 {
                                        format!("{}...", &desc[..47])
                                    } else {
                                        desc.to_string()
                                    };
                                    println!("  • {name}: {desc_short}");
                                }
                            }
                            if tools.len() > 10 {
                                println!("  ... and {} more", tools.len() - 10);
                            }
                        }
                        println!();
                        println!(
                            "Available Resources: {}",
                            info.resources.as_array().map(|a| a.len()).unwrap_or(0)
                        );
                        println!(
                            "Available Prompts: {}",
                            info.prompts.as_array().map(|a| a.len()).unwrap_or(0)
                        );
                    }
                }
                Err(e) => {
                    debug_result["connection"] = serde_json::json!("failed");
                    errors.push(format!("Connection failed: {}", e));

                    if !json {
                        println!("  ✗ Connection failed: {e}");
                    }
                }
            }
        }
        "http" => {
            let url = transport.get("url").and_then(|v| v.as_str()).unwrap_or("?");

            debug_result["url"] = serde_json::json!(url);

            if !json {
                println!("  URL: {url}");
            }

            // Test HTTP connection
            if !json {
                println!();
                println!("Connection Test:");
            }

            match test_http_connection(&name, url, timeout).await {
                Ok(info) => {
                    debug_result["connection"] = serde_json::json!("success");
                    debug_result["capabilities"] = info.capabilities.clone();
                    debug_result["tools"] = info.tools.clone();
                    debug_result["resources"] = info.resources.clone();
                    debug_result["prompts"] = info.prompts.clone();

                    if !json {
                        println!("  ✓ Connected successfully");
                        println!();
                        println!("Server Capabilities:");
                        if let Some(caps) = info.capabilities.as_object() {
                            for (key, value) in caps {
                                println!("  • {key}: {value}");
                            }
                        } else {
                            println!("  (none reported)");
                        }
                        println!();
                        println!(
                            "Available Tools: {}",
                            info.tools.as_array().map(|a| a.len()).unwrap_or(0)
                        );
                        if let Some(tools) = info.tools.as_array() {
                            for tool in tools.iter().take(10) {
                                if let Some(name) = tool.get("name").and_then(|v| v.as_str()) {
                                    let desc = tool
                                        .get("description")
                                        .and_then(|v| v.as_str())
                                        .unwrap_or("");
                                    let desc_short = if desc.len() > 50 {
                                        format!("{}...", &desc[..47])
                                    } else {
                                        desc.to_string()
                                    };
                                    println!("  • {name}: {desc_short}");
                                }
                            }
                            if tools.len() > 10 {
                                println!("  ... and {} more", tools.len() - 10);
                            }
                        }
                        println!();
                        println!(
                            "Available Resources: {}",
                            info.resources.as_array().map(|a| a.len()).unwrap_or(0)
                        );
                        println!(
                            "Available Prompts: {}",
                            info.prompts.as_array().map(|a| a.len()).unwrap_or(0)
                        );
                    }
                }
                Err(e) => {
                    debug_result["connection"] = serde_json::json!("failed");
                    errors.push(format!("Connection failed: {}", e));

                    if !json {
                        println!("  ✗ Connection failed: {e}");
                    }
                }
            }

            // Check OAuth status
            if test_auth {
                if !json {
                    println!();
                    println!("OAuth Status:");
                }

                let auth_status = get_auth_status_for_display(&name, url)
                    .await
                    .unwrap_or_else(|_| "Unknown".to_string());
                debug_result["auth_status"] = serde_json::json!(auth_status);

                if !json {
                    println!("  {auth_status}");

                    if auth_status == "Not Authenticated" {
                        println!("\n  Use 'cortex mcp auth {name}' to authenticate.");
                    }
                }
            }
        }
        _ => {
            errors.push(format!("Unknown transport type: {}", transport_type));
            if !json {
                println!("  ✗ Unknown transport type: {transport_type}");
            }
        }
    }

    debug_result["errors"] = serde_json::json!(errors);

    if json {
        let output = serde_json::to_string_pretty(&debug_result)?;
        println!("{output}");
    } else if !errors.is_empty() {
        println!();
        println!("Errors:");
        for err in &errors {
            println!("  ✗ {err}");
        }
    }

    Ok(())
}

/// Server info returned from connection tests.
struct ServerInfo {
    capabilities: serde_json::Value,
    tools: serde_json::Value,
    resources: serde_json::Value,
    prompts: serde_json::Value,
}

/// Test connection to a stdio MCP server.
async fn test_stdio_connection(
    _name: &str,
    command: &str,
    _args: &str,
    timeout_secs: u64,
) -> Result<ServerInfo> {
    use std::process::Stdio;
    use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
    use tokio::process::Command;
    use tokio::time::{Duration, timeout};

    // Parse args
    let args_vec: Vec<&str> = if _args.is_empty() {
        vec![]
    } else {
        _args.split_whitespace().collect()
    };

    // Spawn the process
    let mut child = Command::new(command)
        .args(&args_vec)
        .stdin(Stdio::piped())
        .stdout(Stdio::piped())
        .stderr(Stdio::piped())
        .spawn()
        .with_context(|| format!("Failed to spawn command: {}", command))?;

    let mut stdin = child
        .stdin
        .take()
        .ok_or_else(|| anyhow::anyhow!("Failed to get stdin"))?;
    let stdout = child
        .stdout
        .take()
        .ok_or_else(|| anyhow::anyhow!("Failed to get stdout"))?;
    let mut reader = BufReader::new(stdout);

    // Send initialize request
    let init_request = serde_json::json!({
        "jsonrpc": "2.0",
        "id": 1,
        "method": "initialize",
        "params": {
            "protocolVersion": "2024-11-05",
            "capabilities": {},
            "clientInfo": {
                "name": "Cortex",
                "version": "1.0.0"
            }
        }
    });

    let request_str = serde_json::to_string(&init_request)? + "\n";
    stdin.write_all(request_str.as_bytes()).await?;
    stdin.flush().await?;

    // Read response with timeout
    let mut response_line = String::new();
    let read_result = timeout(
        Duration::from_secs(timeout_secs),
        reader.read_line(&mut response_line),
    )
    .await
    .map_err(|_| anyhow::anyhow!("Connection timed out after {} seconds", timeout_secs))?
    .with_context(|| "Failed to read response")?;

    if read_result == 0 {
        bail!("Server closed connection without response");
    }

    let response: serde_json::Value =
        serde_json::from_str(&response_line).with_context(|| "Failed to parse server response")?;

    let capabilities = response
        .get("result")
        .and_then(|r| r.get("capabilities"))
        .cloned()
        .unwrap_or(serde_json::json!({}));

    // Send initialized notification
    let initialized = serde_json::json!({
        "jsonrpc": "2.0",
        "method": "notifications/initialized"
    });
    let notif_str = serde_json::to_string(&initialized)? + "\n";
    stdin.write_all(notif_str.as_bytes()).await?;
    stdin.flush().await?;

    // Request tools list
    let tools_request = serde_json::json!({
        "jsonrpc": "2.0",
        "id": 2,
        "method": "tools/list",
        "params": {}
    });
    let tools_str = serde_json::to_string(&tools_request)? + "\n";
    stdin.write_all(tools_str.as_bytes()).await?;
    stdin.flush().await?;

    let mut tools_line = String::new();
    let _ = timeout(Duration::from_secs(5), reader.read_line(&mut tools_line)).await;
    let tools = if !tools_line.is_empty() {
        serde_json::from_str::<serde_json::Value>(&tools_line)
            .ok()
            .and_then(|v| v.get("result").and_then(|r| r.get("tools")).cloned())
            .unwrap_or(serde_json::json!([]))
    } else {
        serde_json::json!([])
    };

    // Request resources list
    let resources_request = serde_json::json!({
        "jsonrpc": "2.0",
        "id": 3,
        "method": "resources/list",
        "params": {}
    });
    let resources_str = serde_json::to_string(&resources_request)? + "\n";
    stdin.write_all(resources_str.as_bytes()).await?;
    stdin.flush().await?;

    let mut resources_line = String::new();
    let _ = timeout(
        Duration::from_secs(5),
        reader.read_line(&mut resources_line),
    )
    .await;
    let resources = if !resources_line.is_empty() {
        serde_json::from_str::<serde_json::Value>(&resources_line)
            .ok()
            .and_then(|v| v.get("result").and_then(|r| r.get("resources")).cloned())
            .unwrap_or(serde_json::json!([]))
    } else {
        serde_json::json!([])
    };

    // Request prompts list
    let prompts_request = serde_json::json!({
        "jsonrpc": "2.0",
        "id": 4,
        "method": "prompts/list",
        "params": {}
    });
    let prompts_str = serde_json::to_string(&prompts_request)? + "\n";
    stdin.write_all(prompts_str.as_bytes()).await?;
    stdin.flush().await?;

    let mut prompts_line = String::new();
    let _ = timeout(Duration::from_secs(5), reader.read_line(&mut prompts_line)).await;
    let prompts = if !prompts_line.is_empty() {
        serde_json::from_str::<serde_json::Value>(&prompts_line)
            .ok()
            .and_then(|v| v.get("result").and_then(|r| r.get("prompts")).cloned())
            .unwrap_or(serde_json::json!([]))
    } else {
        serde_json::json!([])
    };

    // Kill the process
    let _ = child.kill().await;

    Ok(ServerInfo {
        capabilities,
        tools,
        resources,
        prompts,
    })
}

/// Test connection to an HTTP MCP server.
async fn test_http_connection(_name: &str, url: &str, timeout_secs: u64) -> Result<ServerInfo> {
    use tokio::time::{Duration, timeout};

    let client = create_default_client().context("Failed to create HTTP client")?;

    // Send initialize request
    let init_request = serde_json::json!({
        "jsonrpc": "2.0",
        "id": 1,
        "method": "initialize",
        "params": {
            "protocolVersion": "2024-11-05",
            "capabilities": {},
            "clientInfo": {
                "name": "Cortex",
                "version": "1.0.0"
            }
        }
    });

    let response = timeout(
        Duration::from_secs(timeout_secs),
        client
            .post(url)
            .header("Content-Type", "application/json")
            .json(&init_request)
            .send(),
    )
    .await
    .map_err(|_| anyhow::anyhow!("Connection timed out after {} seconds", timeout_secs))?
    .map_err(|e| anyhow::anyhow!("HTTP request failed: {}", e))?;

    if !response.status().is_success() {
        bail!("Server returned error: {}", response.status());
    }

    let response_json: serde_json::Value = response
        .json()
        .await
        .with_context(|| "Failed to parse server response")?;

    let capabilities = response_json
        .get("result")
        .and_then(|r| r.get("capabilities"))
        .cloned()
        .unwrap_or(serde_json::json!({}));

    // Send initialized notification
    let initialized = serde_json::json!({
        "jsonrpc": "2.0",
        "method": "notifications/initialized"
    });
    let _ = client
        .post(url)
        .header("Content-Type", "application/json")
        .json(&initialized)
        .send()
        .await;

    // Request tools list
    let tools_request = serde_json::json!({
        "jsonrpc": "2.0",
        "id": 2,
        "method": "tools/list",
        "params": {}
    });
    let tools = match client
        .post(url)
        .header("Content-Type", "application/json")
        .json(&tools_request)
        .send()
        .await
    {
        Ok(resp) => resp
            .json::<serde_json::Value>()
            .await
            .ok()
            .and_then(|v| v.get("result").and_then(|r| r.get("tools")).cloned())
            .unwrap_or(serde_json::json!([])),
        Err(_) => serde_json::json!([]),
    };

    // Request resources list
    let resources_request = serde_json::json!({
        "jsonrpc": "2.0",
        "id": 3,
        "method": "resources/list",
        "params": {}
    });
    let resources = match client
        .post(url)
        .header("Content-Type", "application/json")
        .json(&resources_request)
        .send()
        .await
    {
        Ok(resp) => resp
            .json::<serde_json::Value>()
            .await
            .ok()
            .and_then(|v| v.get("result").and_then(|r| r.get("resources")).cloned())
            .unwrap_or(serde_json::json!([])),
        Err(_) => serde_json::json!([]),
    };

    // Request prompts list
    let prompts_request = serde_json::json!({
        "jsonrpc": "2.0",
        "id": 4,
        "method": "prompts/list",
        "params": {}
    });
    let prompts = match client
        .post(url)
        .header("Content-Type", "application/json")
        .json(&prompts_request)
        .send()
        .await
    {
        Ok(resp) => resp
            .json::<serde_json::Value>()
            .await
            .ok()
            .and_then(|v| v.get("result").and_then(|r| r.get("prompts")).cloned())
            .unwrap_or(serde_json::json!([])),
        Err(_) => serde_json::json!([]),
    };

    Ok(ServerInfo {
        capabilities,
        tools,
        resources,
        prompts,
    })
}

/// Get auth status for display purposes.
async fn get_auth_status_for_display(name: &str, url: &str) -> Result<String> {
    use cortex_engine::mcp;

    let status = mcp::get_auth_status(name, url)
        .await
        .map_err(|e| anyhow::anyhow!("Failed to get auth status: {}", e))?;

    Ok(match status {
        mcp::AuthStatus::Authenticated => "Authenticated".to_string(),
        mcp::AuthStatus::Expired => "Expired".to_string(),
        mcp::AuthStatus::NotAuthenticated => "Not Authenticated".to_string(),
    })
}

/// Check if server supports OAuth (by checking for .well-known endpoint).
async fn check_server_supports_oauth(url: &str) -> Result<bool> {
    // Try to parse URL and check for OAuth metadata
    let base_url = url.trim_end_matches('/');

    // Check for .well-known/oauth-authorization-server
    let well_known_url = format!("{}/.well-known/oauth-authorization-server", base_url);

    let client = create_default_client()?;

    match client.get(&well_known_url).send().await {
        Ok(resp) => Ok(resp.status().is_success()),
        Err(_) => Ok(false),
    }
}

/// Remove auth silently (returns true if credentials were removed).
async fn remove_auth_silent(name: &str) -> Result<bool> {
    use cortex_engine::mcp;

    let has_tokens = mcp::has_stored_tokens(name).await.unwrap_or(false);
    if has_tokens {
        mcp::remove_auth(name).await?;
        Ok(true)
    } else {
        Ok(false)
    }
}