feat: add vapi_logout, auto-open browser on login, remove vapi_auth_status

- Add vapi_logout tool to clear stored credentials and reset client
- Add clearConfig() to auth module to delete ~/.vapi/config.json
- Auto-open browser when OAuth flow starts using spawn
- Validate token with API call in vapi_login, clear if stale
- Remove redundant vapi_auth_status tool (vapi_login covers it)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: lukatmyshu

README.md

@@ -199,7 +199,7 @@ Connect to Vapi's hosted MCP server from any MCP client:
 | Tool | Description |
 |------|-------------|
 | `vapi_login` | Start OAuth flow |
-| `vapi_auth_status` | Check auth status |
+| `vapi_logout` | Log out and clear credentials |
 
 ---
 

skill/SKILL.md

@@ -39,7 +39,7 @@ Use these guidelines to craft effective voice assistant prompts based on what th
 
 ### Authentication
 - `vapi_login` - Start OAuth authentication flow
-- `vapi_auth_status` - Check if authenticated
+- `vapi_logout` - Log out and clear stored credentials
 
 ### Assistants
 - `vapi_list_assistants` - List all assistants

src/auth.ts

@@ -3,6 +3,7 @@ import * as path from 'path';
 import * as os from 'os';
 import * as http from 'http';
 import * as crypto from 'crypto';
+import { spawn } from 'child_process';
 
 const CONFIG_DIR = path.join(os.homedir(), '.vapi');
 const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');
@@ -56,6 +57,20 @@ export function saveConfig(config: VapiConfig): void {
   }
 }
 
+/**
+ * Clear stored Vapi configuration and reset in-memory state
+ */
+export function clearConfig(): void {
+  try {
+    if (fs.existsSync(CONFIG_FILE)) {
+      fs.unlinkSync(CONFIG_FILE);
+    }
+  } catch (error) {
+    // Ignore errors
+  }
+  cachedConfig = null;
+}
+
 /**
  * Check if we have a valid API token
  */
@@ -169,6 +184,7 @@ export function startAuthFlow(): Promise<string> {
       const redirectUri = `http://localhost:${port}/callback`;
       authUrl = `${VAPI_DASHBOARD_URL}/auth/cli?state=${state}&redirect_uri=${encodeURIComponent(redirectUri)}`;
 
+      openBrowser(authUrl);
       resolve(authUrl);
 
       // Timeout after 10 minutes
@@ -186,6 +202,23 @@ export function startAuthFlow(): Promise<string> {
   });
 }
 
+function openBrowser(url: string) {
+  try {
+    const cmd = process.platform === 'darwin'
+      ? 'open'
+      : process.platform === 'win32'
+        ? 'start'
+        : 'xdg-open';
+    const child = spawn(cmd, [url], {
+      detached: true,
+      stdio: 'ignore',
+    });
+    child.unref();
+  } catch {
+    // Ignore — URL is still returned in the response as fallback
+  }
+}
+
 function cleanupAuth() {
   authInProgress = false;
   authUrl = null;

src/index.ts

@@ -3,7 +3,7 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { VapiClient } from '@vapi-ai/server-sdk';
-import { hasValidToken, getToken, startAuthFlow, isAuthInProgress, getAuthUrl } from './auth.js';
+import { hasValidToken, getToken, startAuthFlow, isAuthInProgress, getAuthUrl, clearConfig } from './auth.js';
 import { registerAllTools } from './tools/index.js';
 
 import dotenv from 'dotenv';
@@ -37,16 +37,24 @@ function createMcpServer() {
     'Authenticate with Vapi. Call this first if other tools return authentication errors.',
     {},
     async () => {
-      // Check if already authenticated
+      // Check if we have a token and validate it
       if (hasValidToken()) {
-        return {
-          content: [
-            {
-              type: 'text' as const,
-              text: 'Already authenticated with Vapi! You can now use other Vapi tools.',
-            },
-          ],
-        };
+        try {
+          const client = getVapiClient();
+          await client.assistants.list({ limit: 1 });
+          return {
+            content: [
+              {
+                type: 'text' as const,
+                text: 'Already authenticated with Vapi! You can now use other Vapi tools.',
+              },
+            ],
+          };
+        } catch {
+          // Token is stale — clear it and restart auth
+          clearConfig();
+          vapiClient = null;
+        }
       }
 
       // Check if auth is already in progress
@@ -56,7 +64,7 @@ function createMcpServer() {
           content: [
             {
               type: 'text' as const,
-              text: `Authentication in progress. Please complete sign-in at:\n\n${url}\n\nAfter signing in, try your request again.`,
+              text: `Authentication in progress. Please complete sign-in:\n\n${url}\n\nAfter signing in, try your request again.`,
             },
           ],
         };
@@ -69,7 +77,7 @@ function createMcpServer() {
           content: [
             {
               type: 'text' as const,
-              text: `Please sign in to Vapi by opening this URL:\n\n${authUrl}\n\nAfter signing in, try your request again.`,
+              text: `Please sign in to Vapi:\n\n${authUrl}\n\nAfter signing in, try your request again.`,
             },
           ],
         };
@@ -87,40 +95,19 @@ function createMcpServer() {
     }
   );
 
-  // Register status tool
+  // Register logout tool
   mcpServer.tool(
-    'vapi_auth_status',
-    'Check Vapi authentication status',
+    'vapi_logout',
+    'Log out of Vapi and clear stored credentials. Use this if your auth token is stale or you want to switch accounts.',
     {},
     async () => {
-      if (hasValidToken()) {
-        return {
-          content: [
-            {
-              type: 'text' as const,
-              text: 'Authenticated with Vapi and ready to use.',
-            },
-          ],
-        };
-      }
-
-      if (isAuthInProgress()) {
-        const url = getAuthUrl();
-        return {
-          content: [
-            {
-              type: 'text' as const,
-              text: `Authentication in progress. Please complete sign-in at:\n\n${url}`,
-            },
-          ],
-        };
-      }
-
+      clearConfig();
+      vapiClient = null;
       return {
         content: [
           {
             type: 'text' as const,
-            text: 'Not authenticated. Use the vapi_login tool to sign in.',
+            text: 'Logged out of Vapi. Use vapi_login to sign in again.',
           },
         ],
       };

src/tools/utils.ts

@@ -34,7 +34,7 @@ export function createAuthRequiredResponse(url: string): ToolResponse {
     content: [
       {
         type: 'text' as const,
-        text: `Authentication required. Please sign in at:\n\n${url}\n\nAfter signing in, try your request again.`,
+        text: `Authentication required. Please sign in:\n\n${url}\n\nAfter signing in, try your request again.`,
       },
     ],
     isError: true,