A trunk command line and an MCP server, on one read API

Context

The owner, 2026-10-17: "Main purpose is for mcp and a trunk cli library to be able to work to get the work done." Get code (2026-10-17-get-code) makes a component's code from its spec; an agent or a developer should get the same without the browser.

Decision

• One read API, /api/v1, signed in with a personal API token sent as Authorization: Bearer trk_…. A token is a person's, for one company, and reads what that person can read. It writes nothing.
• The converters run where the code is wanted. The API hands out the spec and the tokens; @trunk/codegen turns them into files in the CLI and the MCP server, as it does in the web app. The same request gives the same files everywhere.
• A target with no converter is written by the agent itself. Over MCP, the spec is the agent's to work from; no Trunk AI action is spent. The web sheet keeps Ask AI for people.
• Three packages, to be published to npm:
  • @trunk/api-client: the typed client for /api/v1, used by the other two.
  • @trunk/cli, command trunk: login, products, components, code, tokens, icons.
  • @trunk/mcp: an MCP server over stdio with the tools below.

The API

Call	Gives
GET /api/v1/me	the token's person, company and access
GET /api/v1/products	the products the person can open
GET /api/v1/products/{product}/components	each component with its variants, and whether each has a spec
GET /api/v1/variants/{variant}/spec	the variant's spec, with main's token values
GET /api/v1/products/{product}/tokens?format=css	the tokens in an export format
GET /api/v1/products/{product}/icons · /icons/{icon}.svg	the icons and each one's file

The command line

trunk login --token trk_… · trunk products · trunk components <product> · trunk code <component> [--variant <name>] --framework <react|vue|…> --styling <css|…> [--ts] [--plain] [--all-sizes] [--out <dir>] · trunk tokens <product> --format css --out tokens.css · trunk icons <product> --out icons/.

The MCP tools

list_products · list_components · get_component_spec · generate_code (framework, styling, options) · get_tokens · get_icon.

Schema, approved by the owner

ApiToken:

• id, clientId, userId, name;
• prefix (the first characters, shown in the list);
• hash (SHA-256 of the token; the token itself is never stored);
• expiresAt?, lastUsedAt?, revokedAt?, createdAt.

Unique on hash. Row-level security as for every company row, and only its own person sees it.

Why

• A token per person keeps access what it already is: what someone can open in the browser is what their token can read.
• Converting on the developer's machine keeps the API small and the answers the same as the web's.
• Letting the agent write unknown targets costs the company nothing and uses the model the developer already has.

Status

Active. Approved and built 2026-10-17. The packages are not published yet: the npm scope waits on the owner.

Sources

• The owner's messages in the session of 2026-10-17.