NAME

demo - skip-paths / include-groups demo

SYNOPSIS

demo

DESCRIPTION

demo exercises two cli-mcp Options knobs that shape what an MCP client sees in tools/list:

Options.SkipPaths     ([]string)
   - Suppresses specific command paths from the MCP projection.
   - Path is the dotted command path: "secret-debug",
     "tree.leaf-a", etc. Exact match, not glob.
   - Use when a CLI leaf exists for human operators but should
     not be reachable via MCP (diagnostic commands, breaking-
     glass procedures, anything the agent should not call).

Options.IncludeGroups (bool)
   - Default false: only leaves project as MCP tools. Groups
     (cli.Command with subcommands and no own Action) are not
     tools.
   - true: groups also project as MCP tools, returning their
     --help text when called. Useful for letting an agent
     discover the subtree by asking the group what it does.

The three modes this example runs in (demo default | skip | include-groups) demonstrate the projection shape with each knob.

Operating model for an agent calling SkipPaths-protected trees:

- The agent never sees suppressed tools in tools/list. There is
  no soft "hidden" state; the tool simply does not exist in the
  MCP view. An agent cannot guess and call it.
- This is NOT a security boundary on its own. SkipPaths
  prevents accidental tool calls, not malicious bypass. The
  tool exists in the CLI surface; anyone with shell access can
  still run it. Pair with cli-guard for the actual gate.
- IncludeGroups changes the tool surface materially. Agents
  that cache tools/list should refresh whenever a server's
  Options change.

Usage:

demo [GLOBAL OPTIONS] [command [COMMAND OPTIONS]] [ARGUMENTS...]

COMMANDS

hello

greet someone

tree

command group with leaves

leaf-a

leaf A

leaf-b

leaf B

secret-debug

diagnostic; sometimes hidden