Half5 Agent

Install the Half5 MCP bridge and Codex skill with one command:

npx half5 setup

The package configures a local stdio bridge. The bridge forwards MCP JSON-RPC requests to the production Half5 server at https://app.half5.com/mcp. Authentication uses a one-time browser connection and never asks users to copy a bearer token.

Package name: unscoped half5 on npm (not @half5/agent — no paid org).

Connect this machine

Run this once after setup:

npx half5 login
npx half5 doctor

Half5 opens in the browser. After the normal Half5 login, the CLI stores the connection under ~/.config/half5-agent/ (mode 0600) and coding agents can use it automatically. Developers can still override the stored connection with HALF5_MCP_TOKEN.

MCP config example

{
  "mcpServers": {
    "half5": {
      "command": "npx",
      "args": ["-y", "half5@^0.2.0", "mcp"]
    }
  }
}

Security notes

• Zero runtime dependencies, no postinstall, no local tools the model can abuse
• Token is only sent to https (or loopback) endpoints you configure
• Browser login uses PKCE; the verifier never leaves this machine
• Wrong-state probes on the loopback callback are ignored so another tab cannot cancel login
• Generated MCP configs pin half5@^0.2.0 instead of floating latest

Development

bun install
bun test
bun run lint

The current remote server exposes create_time_entry. More Half5 tools can be added to the backend without changing the client bridge.

Publish (maintainers)

Unscoped package — any logged-in npm user with 2FA can publish:

npm login          # once; complete 2FA if prompted
bun test && bun run lint
npm publish --access public
# or with authenticator OTP:
# npm publish --access public --otp=123456

Optional tag-based CI publish (.github/workflows/publish.yml): set Actions secret NPM_TOKEN (or Trusted Publishing for package half5), then:

git tag v0.2.0
git push origin v0.2.0

Verify:

npm view half5 version
npx half5 doctor