@@ -21,9 +21,11 @@ import {
   parseCompletionShell,
   registerCompletionOption,
   renderCompletion,
+  renderZsh,
   type CompletionShell,
 } from "../src/completion.js";
 import { ONE_SHOT_METHODS } from "@inspector/core/cli/handlers/method-types.js";
+import { CATALOG_WRITE_METHODS } from "../src/handlers/servers-write.js";
 
 async function script(shell: CompletionShell): Promise<string> {
   const result = await runCli(["--completion", shell]);
@@ -94,6 +96,28 @@ describe("--completion", () => {
       expect(out).toContain(method);
     }
   });
+
+  it("offers the catalog write methods the CLI implements (#2629)", async () => {
+    // Read from servers-write itself, not from CATALOG_METHODS, so a write
+    // method the completion list forgets fails here.
+    expect(CATALOG_METHODS).toEqual(
+      expect.arrayContaining([...CATALOG_WRITE_METHODS]),
+    );
+    const out = await script("bash");
+    for (const method of CATALOG_WRITE_METHODS) {
+      expect(out).toContain(method);
+    }
+  });
+
+  it("offers no --method the CLI would reject as unsupported", async () => {
+    for (const method of VALUE_CHOICES["--method"]!) {
+      const result = await runCli(["--method", method]);
+      expect(result.stderr, method).not.toContain("Unsupported method");
+    }
+    // Control: an unknown method is rejected by the same check.
+    const bogus = await runCli(["--method", "servers/bogus"]);
+    expect(bogus.stderr).toContain("Unsupported method: servers/bogus");
+  });
 });
 
 describe("collectCompletionFlags", () => {
@@ -162,6 +186,14 @@ describe("collectCompletionFlags", () => {
 });
 
 describe("shell helpers", () => {
+  it("escapes backslashes before colons in a zsh _describe name (CodeQL #78)", () => {
+    const out = renderZsh([
+      { long: "--a\\b:c", takesValue: false, description: "Desc" },
+    ]);
+    // Name --a\b:c → --a\\b\:c, then ":" and the description.
+    expect(out).toContain("'--a\\\\b\\:c:Desc'");
+  });
+
   it("parseCompletionShell / isCompletionShell", () => {
     expect(isCompletionShell("zsh")).toBe(true);
     expect(isCompletionShell("csh")).toBe(false);
@@ -227,6 +259,18 @@ describe.skipIf(!hasShell("bash"))("bash script", () => {
     expect(
       await complete(["mcp-inspector", "--cli", "--transport", ""]),
     ).toEqual(["stdio", "sse", "http"]);
+    expect(
+      await complete(["mcp-inspector", "--cli", "--method", "servers/"]),
+    ).toEqual([
+      "servers/list",
+      "servers/show",
+      "servers/add",
+      "servers/edit",
+      "servers/remove",
+    ]);
+    expect(
+      await complete(["mcp-inspector", "--cli", "--output-format", ""]),
+    ).toEqual(["raw", "json"]);
     // A free-form value offers nothing (the shell falls back to files).
     expect(
       await complete(["mcp-inspector", "--cli", "--tool-name", "--"]),
 
@@ -1,6 +1,8 @@
 import { Command } from "commander";
 import {
+  CATALOG_METHODS,
   emitCompletionIfRequested,
+  isCatalogMethod,
   registerCompletionOption,
 } from "./completion.js";
 type McpResponse = Record<string, unknown>;
@@ -21,7 +23,6 @@ import {
   showServerEntry,
 } from "@inspector/core/cli/handlers/servers-list.js";
 import {
-  CATALOG_WRITE_METHODS,
   isCatalogWriteMethod,
   runCatalogWrite,
 } from "./handlers/servers-write.js";
@@ -1268,13 +1269,9 @@ async function parseArgs(argv?: string[]): Promise<ParseResult> {
       "Method is required. Use --method to specify the method to invoke.",
     );
   }
-  const isCatalogMethod =
-    options.method === "servers/list" ||
-    options.method === "servers/show" ||
-    isCatalogWriteMethod(options.method);
-  if (!isCatalogMethod && !isOneShotMethod(options.method)) {
+  if (!isCatalogMethod(options.method) && !isOneShotMethod(options.method)) {
     throw new Error(
-      `Unsupported method: ${options.method}. Supported --cli methods: ${ONE_SHOT_METHODS.join(", ")}, servers/list, servers/show, ${CATALOG_WRITE_METHODS.join(", ")}.`,
+      `Unsupported method: ${options.method}. Supported --cli methods: ${[...ONE_SHOT_METHODS, ...CATALOG_METHODS].join(", ")}.`,
     );
   }
   if (options.rename !== undefined && options.method !== "servers/edit") {
 
@@ -25,6 +25,8 @@ import type { Command, Option } from "commander";
 import { LoggingLevelSchema } from "@modelcontextprotocol/core";
 import { ONE_SHOT_METHODS } from "@inspector/core/cli/handlers/method-types.js";
 import { awaitableLog } from "@inspector/core/cli/utils/awaitable-log.js";
+import { OUTPUT_FILE_FORMATS } from "@inspector/core/cli/handlers/output-file.js";
+import { CATALOG_WRITE_METHODS } from "./handlers/servers-write.js";
 
 export const COMPLETION_SHELLS = ["bash", "zsh", "fish"] as const;
 export type CompletionShell = (typeof COMPLETION_SHELLS)[number];
@@ -39,8 +41,20 @@ const MODE_FLAGS: readonly CompletionFlag[] = [
   { long: "--tui", takesValue: false, description: "Run the terminal UI" },
 ];
 
-/** Catalog-only methods `parseArgs` accepts alongside `ONE_SHOT_METHODS`. */
-export const CATALOG_METHODS = ["servers/list", "servers/show"] as const;
+/**
+ * Catalog-only methods `parseArgs` accepts alongside `ONE_SHOT_METHODS` —
+ * the reads plus the writes `servers-write` implements. `parseArgs` validates
+ * `--method` against this same list, so the two cannot drift (#2629).
+ */
+export const CATALOG_METHODS = [
+  "servers/list",
+  "servers/show",
+  ...CATALOG_WRITE_METHODS,
+] as const;
+
+export function isCatalogMethod(method: string): boolean {
+  return (CATALOG_METHODS as readonly string[]).includes(method);
+}
 
 /**
  * Finite value sets for flags whose values the CLI validates in a custom
@@ -51,6 +65,7 @@ export const VALUE_CHOICES: Readonly<Record<string, readonly string[]>> = {
   "--transport": ["stdio", "sse", "http"],
   "--log-level": Object.values(LoggingLevelSchema.enum),
   "--format": ["text", "json"],
+  "--output-format": OUTPUT_FILE_FORMATS,
   "--protocol-era": ["legacy", "auto", "modern"],
   "--completion": COMPLETION_SHELLS,
 };
@@ -198,9 +213,14 @@ complete -o default -F ${FUNCTION_NAME} ${COMPLETION_COMMAND}
 `;
 }
 
-/** `name:description` for zsh `_describe`; colons in the name are escaped. */
+/**
+ * `name:description` for zsh `_describe`. `_describe` reads `\` as an escape
+ * and the first unescaped `:` as the separator, so backslashes in the name are
+ * escaped first, then colons (CodeQL #78).
+ */
 function zshDescribeEntry(name: string, description: string): string {
-  return shQuote(`${name.replace(/:/g, "\\:")}:${description}`);
+  const escaped = name.replace(/\\/g, "\\\\").replace(/:/g, "\\:");
+  return shQuote(`${escaped}:${description}`);
 }
 
 export function renderZsh(flags: readonly CompletionFlag[]): string {
 
@@ -144,7 +144,7 @@ describe("connection stored-auth helpers", () => {
       hasRefreshToken: true,
     });
     expect(
-      list.servers.find((s) => s.url.includes("example.com")),
+      list.servers.find((s) => s.url === "https://example.com/mcp"),
     ).toMatchObject({ hasTokens: true, hasRefreshToken: true });
     expect(list.servers.find((s) => s.url.includes("other"))).toMatchObject({
       hasTokens: true,
@@ -190,7 +190,7 @@ describe("connection stored-auth helpers", () => {
 
     const list = await listStoredAuth();
     expect(
-      list.servers.find((s) => s.url.includes("example.com")),
+      list.servers.find((s) => s.url === "https://example.com/mcp"),
     ).toMatchObject({ hasTokens: true, hasRefreshToken: true });
   });
 
 
@@ -7,6 +7,7 @@ import { DaemonServer } from "./server.js";
 import { generateDaemonToken, getDaemonTokenFromEnv } from "./auth.js";
 import { ensureDaemonDir } from "./paths.js";
 import { disallowMemorySecretStoreFallback } from "@inspector/core/auth/node/secret-store-selection.js";
+import { awaitableError } from "@inspector/core/cli/utils/awaitable-log.js";
 
 // Name the process `mcpdod` (Unix d-suffix convention) so `ps`/`pgrep`/`pkill`
 // see the daemon under a greppable name instead of a bare `node .../mcpdod.js`.
@@ -44,8 +45,10 @@ async function main(): Promise<void> {
   await server.start();
 }
 
-main().catch((error: unknown) => {
+main().catch(async (error: unknown) => {
   const message = error instanceof Error ? error.message : String(error);
-  process.stderr.write(`mcpdo daemon: ${message}\n`);
+  // Exit only once the write has been performed: on a pipe or file stderr is
+  // asynchronous, and process.exit() would discard the diagnostic (#2638).
+  await awaitableError(`mcpdo daemon: ${message}\n`);
   process.exit(1);
 });
@@ -5,6 +5,14 @@ import type { Root } from "@modelcontextprotocol/client";
 import type { InspectorClient } from "@inspector/core/mcp/index.js";
 
 vi.mock("ink-form", () => import("./helpers/inkFormMock.js"));
+// Passthrough spy: the modal's frame is empty under ink-testing-library (see
+// below), so the redaction test asserts the error reached the display boundary.
+vi.mock("../src/utils/errorText.js", async (importOriginal) => {
+  const actual =
+    await importOriginal<typeof import("../src/utils/errorText.js")>();
+  return { ...actual, errorMessage: vi.fn(actual.errorMessage) };
+});
+import * as errorText from "../src/utils/errorText.js";
 
 import { RootsModal, rootFromForm } from "../src/components/RootsModal.js";
 
@@ -156,6 +164,23 @@ describe("RootsModal", () => {
     expect(setRoots).toHaveBeenCalledTimes(1);
   });
 
+  it("shows a failed save through the redacting display boundary (#2638)", async () => {
+    const failure = new Error(
+      "Request failed: https://auth.example/cb?code=s3cret&state=ok",
+    );
+    const setRoots = vi.fn(async () => {
+      throw failure;
+    });
+    const { stdin } = renderModal({ inspectorClient: fakeClient(setRoots) });
+    await tick();
+    stdin.write("x");
+    await tick();
+    expect(errorText.errorMessage).toHaveBeenCalledWith(failure);
+    expect(vi.mocked(errorText.errorMessage).mock.results.at(-1)?.value).toBe(
+      "Request failed: https://auth.example/cb?code=%5BREDACTED%5D&state=ok",
+    );
+  });
+
   it("reports a non-Error failure", async () => {
     const setRoots = vi.fn(() => Promise.reject("nope"));
     const { stdin } = renderModal({ inspectorClient: fakeClient(setRoots) });
 
@@ -155,6 +155,22 @@ describe("SubscriptionsTab", () => {
     expect(lastFrame()).toContain("does not support resource subscriptions");
   });
 
+  it("redacts URL query secrets in a surfaced failure (#2638)", async () => {
+    const client = fakeClient({
+      subscribeToResource: vi.fn(async () => {
+        throw new Error(
+          "Request failed: https://auth.example/cb?code=s3cret&state=ok",
+        );
+      }),
+    });
+    const { stdin, lastFrame } = renderTab({ inspectorClient: client });
+    stdin.write("\r");
+    await tick();
+    const frame = (lastFrame() ?? "").replace(/\s+/g, "");
+    expect(frame).toContain("code=%5BREDACTED%5D&state=ok");
+    expect(frame).not.toContain("s3cret");
+  });
+
   it("surfaces a non-Error failure", async () => {
     const client = fakeClient({
       subscribeToResource: vi.fn(() => Promise.reject("nope")),
 
@@ -160,6 +160,21 @@ describe("TasksTab", () => {
     expect(lastFrame()).toContain("list failed");
   });
 
+  it("redacts URL query secrets in a surfaced failure (#2638)", async () => {
+    const { stdin, lastFrame } = renderTab({
+      onRefresh: vi.fn(async () => {
+        throw new Error(
+          "Request failed: https://auth.example/cb?code=s3cret&state=ok",
+        );
+      }),
+    });
+    stdin.write("f");
+    await tick();
+    const frame = (lastFrame() ?? "").replace(/\s+/g, "");
+    expect(frame).toContain("code=%5BREDACTED%5D&state=ok");
+    expect(frame).not.toContain("s3cret");
+  });
+
   it("surfaces a non-Error failure with no task selected", async () => {
     const { stdin, lastFrame } = renderTab({
       tasks: [],
 
@@ -18,6 +18,7 @@ import { Form, type FormStructure } from "ink-form";
 import type { Root } from "@modelcontextprotocol/client";
 import type { InspectorClient } from "@inspector/core/mcp/index.js";
 import { useSelectableList } from "../hooks/useSelectableList.js";
+import { errorMessage } from "../utils/errorText.js";
 
 export const ADD_ROOT_FORM: FormStructure = {
   title: "Add Root",
@@ -89,7 +90,7 @@ export function RootsModal({
       await inspectorClient.setRoots(next);
       setMode("list");
     } catch (err) {
-      setError(err instanceof Error ? err.message : String(err));
+      setError(errorMessage(err));
     } finally {
       savingRef.current = false;
       setSaving(false);
 
@@ -28,6 +28,7 @@ import {
   findNestedAuthError,
 } from "@inspector/core/auth/challenge.js";
 import { useSelectableList } from "../hooks/useSelectableList.js";
+import { errorMessage } from "../utils/errorText.js";
 import {
   resourceUpdateFeed,
   subscribableResources,
@@ -116,7 +117,7 @@ export function SubscriptionsTab({
         onAuthRecoveryRequired?.(authErr);
         return;
       }
-      setError(err instanceof Error ? err.message : String(err));
+      setError(errorMessage(err));
     } finally {
       inFlightRef.current = false;
       setPendingUri(null);