feat: CLI AI providers — use Claude Code, Codex CLI, or Gemini CLI instead of API tokens

NOTICE

@@ -119,7 +119,7 @@ APACHE 2.0 LICENSED DEPENDENCIES
 
   - github.com/aws/aws-sdk-go-v2/feature/s3/manager
     License: Apache-2.0
-    URL: https://github.com/aws/aws-sdk-go-v2/blob/feature/s3/manager/v1.22.10/feature/s3/manager/LICENSE.txt
+    URL: https://github.com/aws/aws-sdk-go-v2/blob/feature/s3/manager/v1.22.11/feature/s3/manager/LICENSE.txt
 
   - github.com/aws/aws-sdk-go-v2/internal/configsources
     License: Apache-2.0
@@ -167,11 +167,11 @@ APACHE 2.0 LICENSED DEPENDENCIES
 
   - github.com/aws/aws-sdk-go-v2/service/organizations
     License: Apache-2.0
-    URL: https://github.com/aws/aws-sdk-go-v2/blob/service/organizations/v1.50.6/service/organizations/LICENSE.txt
+    URL: https://github.com/aws/aws-sdk-go-v2/blob/service/organizations/v1.51.0/service/organizations/LICENSE.txt
 
   - github.com/aws/aws-sdk-go-v2/service/s3
     License: Apache-2.0
-    URL: https://github.com/aws/aws-sdk-go-v2/blob/service/s3/v1.97.3/service/s3/LICENSE.txt
+    URL: https://github.com/aws/aws-sdk-go-v2/blob/service/s3/v1.98.0/service/s3/LICENSE.txt
 
   - github.com/aws/aws-sdk-go-v2/service/secretsmanager
     License: Apache-2.0
@@ -279,7 +279,7 @@ APACHE 2.0 LICENSED DEPENDENCIES
 
   - github.com/go-git/go-git/v5
     License: Apache-2.0
-    URL: https://github.com/go-git/go-git/blob/v5.17.0/LICENSE
+    URL: https://github.com/go-git/go-git/blob/v5.17.2/LICENSE
 
   - github.com/go-ini/ini
     License: Apache-2.0
@@ -379,15 +379,15 @@ APACHE 2.0 LICENSED DEPENDENCIES
 
   - github.com/open-policy-agent/opa
     License: Apache-2.0
-    URL: https://github.com/open-policy-agent/opa/blob/v1.15.0/LICENSE
+    URL: https://github.com/open-policy-agent/opa/blob/v1.15.1/LICENSE
 
   - github.com/open-policy-agent/opa/internal/gojsonschema
     License: Apache-2.0
-    URL: https://github.com/open-policy-agent/opa/blob/v1.15.0/internal/gojsonschema/LICENSE-APACHE-2.0.txt
+    URL: https://github.com/open-policy-agent/opa/blob/v1.15.1/internal/gojsonschema/LICENSE-APACHE-2.0.txt
 
   - github.com/open-policy-agent/opa/internal/semver
     License: Apache-2.0
-    URL: https://github.com/open-policy-agent/opa/blob/v1.15.0/internal/semver/LICENSE
+    URL: https://github.com/open-policy-agent/opa/blob/v1.15.1/internal/semver/LICENSE
 
   - github.com/openai/openai-go
     License: Apache-2.0
@@ -403,7 +403,7 @@ APACHE 2.0 LICENSED DEPENDENCIES
 
   - github.com/petermattis/goid
     License: Apache-2.0
-    URL: https://github.com/petermattis/goid/blob/17d1149c6ac6/LICENSE
+    URL: https://github.com/petermattis/goid/blob/df67b199bc81/LICENSE
 
   - github.com/pjbgf/sha1cd
     License: Apache-2.0
@@ -543,23 +543,23 @@ APACHE 2.0 LICENSED DEPENDENCIES
 
   - google.golang.org/genai
     License: Apache-2.0
-    URL: https://github.com/googleapis/go-genai/blob/v1.51.0/LICENSE
+    URL: https://github.com/googleapis/go-genai/blob/v1.52.1/LICENSE
 
   - google.golang.org/genproto/googleapis
     License: Apache-2.0
-    URL: https://github.com/googleapis/go-genproto/blob/d00831a3d3e7/LICENSE
+    URL: https://github.com/googleapis/go-genproto/blob/d5a96adf58d8/LICENSE
 
   - google.golang.org/genproto/googleapis/api
     License: Apache-2.0
-    URL: https://github.com/googleapis/go-genproto/blob/d00831a3d3e7/googleapis/api/LICENSE
+    URL: https://github.com/googleapis/go-genproto/blob/d5a96adf58d8/googleapis/api/LICENSE
 
   - google.golang.org/genproto/googleapis/rpc
     License: Apache-2.0
-    URL: https://github.com/googleapis/go-genproto/blob/d00831a3d3e7/googleapis/rpc/LICENSE
+    URL: https://github.com/googleapis/go-genproto/blob/d5a96adf58d8/googleapis/rpc/LICENSE
 
   - google.golang.org/grpc
     License: Apache-2.0
-    URL: https://github.com/grpc/grpc-go/blob/v1.79.3/LICENSE
+    URL: https://github.com/grpc/grpc-go/blob/v1.80.0/LICENSE
 
   - gopkg.in/ini.v1
     License: Apache-2.0
@@ -583,7 +583,7 @@ APACHE 2.0 LICENSED DEPENDENCIES
 
   - k8s.io/kube-openapi/pkg/util
     License: Apache-2.0
-    URL: https://github.com/kubernetes/kube-openapi/blob/5883c5ee87b9/LICENSE
+    URL: https://github.com/kubernetes/kube-openapi/blob/16be699c7b31/LICENSE
 
   - k8s.io/utils
     License: Apache-2.0
@@ -626,6 +626,10 @@ BSD LICENSED DEPENDENCIES
     License: BSD-3-Clause
     URL: https://github.com/PuerkitoBio/goquery/blob/v1.12.0/LICENSE
 
+  - github.com/andybalholm/brotli/flate
+    License: BSD-3-Clause
+    URL: https://github.com/andybalholm/brotli/blob/v1.2.1/flate/LICENSE
+
   - github.com/andybalholm/cascadia
     License: BSD-2-Clause
     URL: https://github.com/andybalholm/cascadia/blob/v1.3.3/LICENSE
@@ -760,7 +764,7 @@ BSD LICENSED DEPENDENCIES
 
   - github.com/open-policy-agent/opa/internal/edittree/bitvector
     License: BSD-3-Clause
-    URL: https://github.com/open-policy-agent/opa/blob/v1.15.0/internal/edittree/bitvector/license.txt
+    URL: https://github.com/open-policy-agent/opa/blob/v1.15.1/internal/edittree/bitvector/license.txt
 
   - github.com/pierrec/lz4/v4
     License: BSD-3-Clause
@@ -868,11 +872,11 @@ BSD LICENSED DEPENDENCIES
 
   - google.golang.org/api
     License: BSD-3-Clause
-    URL: https://github.com/googleapis/google-api-go-client/blob/v0.273.0/LICENSE
+    URL: https://github.com/googleapis/google-api-go-client/blob/v0.273.1/LICENSE
 
   - google.golang.org/api/internal/third_party/uritemplates
     License: BSD-3-Clause
-    URL: https://github.com/googleapis/google-api-go-client/blob/v0.273.0/internal/third_party/uritemplates/LICENSE
+    URL: https://github.com/googleapis/google-api-go-client/blob/v0.273.1/internal/third_party/uritemplates/LICENSE
 
   - google.golang.org/protobuf
     License: BSD-3-Clause
@@ -912,7 +916,7 @@ BSD LICENSED DEPENDENCIES
 
   - modernc.org/sqlite
     License: BSD-3-Clause
-    URL: https://gitlab.com/cznic/sqlite/blob/v1.47.0/LICENSE
+    URL: https://gitlab.com/cznic/sqlite/blob/v1.48.0/LICENSE
 
   - mvdan.cc/sh/v3
     License: BSD-3-Clause
@@ -993,7 +997,7 @@ MOZILLA PUBLIC LICENSE (MPL) 2.0 DEPENDENCIES
 
   - github.com/hashicorp/go-version
     License: MPL-2.0
-    URL: https://github.com/hashicorp/go-version/blob/v1.8.0/LICENSE
+    URL: https://github.com/hashicorp/go-version/blob/v1.9.0/LICENSE
 
   - github.com/hashicorp/golang-lru/simplelru
     License: MPL-2.0
@@ -1146,7 +1150,7 @@ MIT LICENSED DEPENDENCIES
 
   - github.com/andybalholm/brotli
     License: MIT
-    URL: https://github.com/andybalholm/brotli/blob/v1.2.0/LICENSE
+    URL: https://github.com/andybalholm/brotli/blob/v1.2.1/LICENSE
 
   - github.com/anthropics/anthropic-sdk-go
     License: MIT
@@ -1246,7 +1250,7 @@ MIT LICENSED DEPENDENCIES
 
   - github.com/charmbracelet/x/exp/slice
     License: MIT
-    URL: https://github.com/charmbracelet/x/blob/df7b1bcffcca/exp/slice/LICENSE
+    URL: https://github.com/charmbracelet/x/blob/2dce04b6f8a4/exp/slice/LICENSE
 
   - github.com/charmbracelet/x/exp/strings
     License: MIT
@@ -1342,7 +1346,7 @@ MIT LICENSED DEPENDENCIES
 
   - github.com/fxamacker/cbor/v2
     License: MIT
-    URL: https://github.com/fxamacker/cbor/blob/v2.9.0/LICENSE
+    URL: https://github.com/fxamacker/cbor/blob/v2.9.1/LICENSE
 
   - github.com/gabriel-vasile/mimetype
     License: MIT
@@ -1526,7 +1530,7 @@ MIT LICENSED DEPENDENCIES
 
   - github.com/lestrrat-go/httprc/v3
     License: MIT
-    URL: https://github.com/lestrrat-go/httprc/blob/v3.0.4/LICENSE
+    URL: https://github.com/lestrrat-go/httprc/blob/v3.0.5/LICENSE
 
   - github.com/lestrrat-go/jwx/v3
     License: MIT
@@ -1542,7 +1546,7 @@ MIT LICENSED DEPENDENCIES
 
   - github.com/lucasb-eyer/go-colorful
     License: MIT
-    URL: https://github.com/lucasb-eyer/go-colorful/blob/v1.3.0/LICENSE
+    URL: https://github.com/lucasb-eyer/go-colorful/blob/v1.4.0/LICENSE
 
   - github.com/marshallbrekka/go-u2fhost
     License: MIT
@@ -1634,7 +1638,7 @@ MIT LICENSED DEPENDENCIES
 
   - github.com/rs/zerolog
     License: MIT
-    URL: https://github.com/rs/zerolog/blob/v1.34.0/LICENSE
+    URL: https://github.com/rs/zerolog/blob/v1.35.0/LICENSE
 
   - github.com/ryanuber/go-glob
     License: MIT

cmd/ai/init.go

@@ -48,9 +48,14 @@ func initializeAIToolsAndExecutor(atmosConfig *schema.AtmosConfiguration, mcpSer
 	}
 
 	// Register external MCP server tools (filtered by routing).
-	mcpMgr := registerMCPServerTools(registry, atmosConfig, mcpServerNames, question)
+	// Skip for CLI providers — they handle MCP via provider-specific pass-through.
+	var mcpMgr *mcpclient.Manager
+	if !isCLIProvider(atmosConfig.AI.DefaultProvider) {
+		mcpMgr = registerMCPServerTools(registry, atmosConfig, mcpServerNames, question)
+	}
 
 	ui.Info(fmt.Sprintf("AI tools initialized: %d total", registry.Count()))
+	ui.Info(fmt.Sprintf("AI provider: %s", atmosConfig.AI.DefaultProvider))
 
 	// Initialize permission cache for persistent decisions.
 	permCache, err := permission.NewPermissionCache(atmosConfig.BasePath)
@@ -292,6 +297,19 @@ func resolveAuthProvider(atmosConfig *schema.AtmosConfiguration) mcpclient.AuthE
 	return mgr
 }
 
+// cliProviders lists providers that invoke a local CLI binary as a subprocess.
+// These providers handle MCP via provider-specific pass-through, not via the Atmos tool registry.
+var cliProviders = map[string]bool{
+	"claude-code": true,
+	"codex-cli":   true,
+	"gemini-cli":  true,
+}
+
+// isCLIProvider returns true if the provider invokes a local CLI binary.
+func isCLIProvider(providerName string) bool {
+	return cliProviders[providerName]
+}
+
 // serversNeedAuth returns true if any configured MCP server has identity set.
 func serversNeedAuth(servers map[string]schema.MCPServerConfig) bool {
 	for _, s := range servers {

cmd/ai/init_test.go

@@ -527,6 +527,27 @@ func TestSortedServerNames(t *testing.T) {
 	})
 }
 
+func TestIsCLIProvider(t *testing.T) {
+	tests := []struct {
+		name     string
+		provider string
+		expected bool
+	}{
+		{"claude-code is CLI", "claude-code", true},
+		{"codex-cli is CLI", "codex-cli", true},
+		{"gemini-cli is CLI", "gemini-cli", true},
+		{"anthropic is not CLI", "anthropic", false},
+		{"openai is not CLI", "openai", false},
+		{"ollama is not CLI", "ollama", false},
+		{"empty is not CLI", "", false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.expected, isCLIProvider(tt.provider))
+		})
+	}
+}
+
 func TestSelectManualServers(t *testing.T) {
 	servers := map[string]schema.MCPServerConfig{
 		"aws":   {Command: "aws-mcp"},

cmd/mcp/client/export.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"os"
+	"strings"
 
 	"github.com/spf13/cobra"
 
@@ -87,22 +88,38 @@ func executeMCPExport(cmd *cobra.Command, _ []string) error {
 
 // buildMCPJSONEntry creates a .mcp.json entry for a server.
 // Servers with identity are wrapped with 'atmos auth exec' for credential injection.
+// Env keys are uppercased because Viper lowercases all YAML map keys.
 func buildMCPJSONEntry(_ string, serverCfg *schema.MCPServerConfig) mcpJSONServer {
+	env := uppercaseEnvKeys(serverCfg.Env)
+
 	if serverCfg.Identity != "" {
 		// Wrap with atmos auth exec for credential injection.
 		args := []string{"auth", "exec", "-i", serverCfg.Identity, "--", serverCfg.Command}
 		args = append(args, serverCfg.Args...)
 		return mcpJSONServer{
 			Command: "atmos",
 			Args:    args,
-			Env:     serverCfg.Env,
+			Env:     env,
 		}
 	}
 
 	// No auth — use command directly.
 	return mcpJSONServer{
 		Command: serverCfg.Command,
 		Args:    serverCfg.Args,
-		Env:     serverCfg.Env,
+		Env:     env,
+	}
+}
+
+// uppercaseEnvKeys returns a copy of the env map with all keys uppercased.
+// Viper lowercases all YAML map keys, but env vars are conventionally UPPERCASE.
+func uppercaseEnvKeys(env map[string]string) map[string]string {
+	if env == nil {
+		return nil
+	}
+	result := make(map[string]string, len(env))
+	for k, v := range env {
+		result[strings.ToUpper(k)] = v
 	}
+	return result
 }

docs/prd/atmos-ai-global-flag.md

@@ -1,8 +1,8 @@
 # Atmos Global `--ai` Flag - Product Requirements Document
 
-**Status:** In Progress (v3.0 — `--skill` flag)
-**Version:** 3.0
-**Last Updated:** 2026-03-11
+**Status:** Shipped
+**Version:** 3.1
+**Last Updated:** 2026-03-30
 
 ---