@awesomate/hosting-mcp 0.88.2 → 0.88.6

package/dist/index.js

@@ -41747,6 +41747,7 @@ var TITLES = {
   awesomate_elementor_mcp_connect: "Connect Elementor MCP",
   awesomate_app_create: "Create app",
   awesomate_app_get: "Get app details",
+  awesomate_app_remove_failed: "Remove an app whose setup failed",
   awesomate_app_scaffold: "Get app scaffold guide",
   awesomate_app_deploy_info: "Get app deploy briefing",
   awesomate_app_update: "Link repo to app",
@@ -42048,11 +42049,31 @@ server.registerTool(
     }
   }
 );
+function withCredentialStaleWarning(data) {
+  if (!data || typeof data !== "object") return data;
+  const d = data;
+  if (d.stale !== true) return data;
+  const asOf = d.asOf ? new Date(d.asOf) : null;
+  const when = asOf && !Number.isNaN(asOf.getTime()) ? `as of ${asOf.toLocaleDateString("en-AU", { timeZone: "Australia/Sydney" })} ${asOf.toLocaleTimeString("en-AU", { timeZone: "Australia/Sydney", hour: "2-digit", minute: "2-digit" })} Sydney time (${d.asOf})` : "with no known refresh time";
+  const why = {
+    consent: `the refresh needs the "How your automations are running" privacy setting${d.settingsUrl ? ` (${d.settingsUrl})` : ""}`,
+    refresh_failed: "the hub could not refresh it from the n8n instance just now",
+    n8n_unreachable: "the hub could not reach the n8n instance's database to check it"
+  }[d.staleReason ?? "refresh_failed"];
+  const parts = [`This credential list may be out of date: it is ${when}, because ${why}.`];
+  const added = d.drift?.added ?? [];
+  const removed = d.drift?.removed ?? [];
+  if (added.length) parts.push(`n8n also has: ${added.map((c) => `${c.name} (${c.type}, ${c.credential_id})`).join(", ")}.`);
+  if (removed.length) parts.push(`No longer in n8n: ${removed.join(", ")}.`);
+  parts.push("Tell the user the list may be out of date before relying on it, and check the credential in n8n itself when it matters.");
+  const { stale: _s, ...rest } = d;
+  return { warning: parts.join(" "), stale: true, ...rest };
+}
 server.registerTool(
   "awesomate_n8n_inspect",
   {
     annotations: annotate("awesomate_n8n_inspect", READ_ONLY),
-    description: `Instance inventory reads, one tool: 'nodes' (distinct node types in use, counts, versions, community/AI flags), 'datatables' (tables + columns + row counts), 'datatable_rows' (pass datatableId; limit \u2264 100), 'possibilities' (facts for "what could I automate": connected services with live-usage cross-check, unused connections, top nodes, AI tools [null = unknown, not none], community packages, counts \u2014 YOU turn these into suggestions, grounded only in what's actually there), 'credentials' (names/types/inferred service \u2014 never secrets), 'variables' ($vars keys). All consent-gated server-side; 403 consent_required \u2192 settingsUrl.`,
+    description: `Instance inventory reads, one tool: 'nodes' (distinct node types in use, counts, versions, community/AI flags), 'datatables' (tables + columns + row counts), 'datatable_rows' (pass datatableId; limit \u2264 100), 'possibilities' (facts for "what could I automate": connected services with live-usage cross-check, unused connections, top nodes, AI tools [null = unknown, not none], community packages, counts \u2014 YOU turn these into suggestions, grounded only in what's actually there), 'credentials' (names/types/inferred service \u2014 never secrets; a leading 'warning' means the list may be out of date: say so to the user), 'variables' ($vars keys). All consent-gated server-side; 403 consent_required \u2192 settingsUrl.`,
     inputSchema: {
       what: external_exports.enum(["nodes", "datatables", "datatable_rows", "possibilities", "credentials", "variables"]),
       datatableId: external_exports.string().optional().describe("datatable_rows only"),
@@ -42074,7 +42095,8 @@ server.registerTool(
         credentials: "/api/my-n8n/machine/credentials",
         variables: "/api/my-n8n/machine/variables"
       }[what];
-      return textResult(await hubGet(cfg, path));
+      const data = await hubGet(cfg, path);
+      return textResult(what === "credentials" ? withCredentialStaleWarning(data) : data);
     } catch (err) {
       return errorResult(err);
     }
@@ -42265,7 +42287,7 @@ server.registerTool(
   "awesomate_domain_add",
   {
     annotations: annotate("awesomate_domain_add", MUTATING),
-    description: "Add a custom domain to the user's hosting account. Returns the DNS steps they need to complete at their registrar. **Needs Support Plus or above from Claude** \u2014 Essentials gets 403 `upgrade_required` even though its plan DOES include one custom domain, because adding it from a machine token is Support Plus; tell them it takes two clicks at hub.awesomate.ai/sites/domains instead. Plan COUNT limits are enforced separately on top.",
+    description: "Add a custom domain to the user's hosting account. Returns the DNS steps they need to complete at their registrar: `dnsInstructions` (A rows only when there is a public address; CNAME rows always) and `dnsNote`. When `dnsNote` is set, relay it word for word: on that server the records must be Proxied (orange cloud) in Cloudflare and SSL/TLS set to Full, not Flexible (Full (strict) only once HTTPS is on); a DNS-only record will not load. **Needs Support Plus or above from Claude** \u2014 Essentials gets 403 `upgrade_required` even though its plan DOES include one custom domain, because adding it from a machine token is Support Plus; tell them it takes two clicks at hub.awesomate.ai/sites/domains instead. Plan COUNT limits are enforced separately on top.",
     inputSchema: { domain: external_exports.string().describe("The domain to add, e.g. example.com") }
   },
   async ({ domain }) => {
@@ -42547,7 +42569,7 @@ server.registerTool(
   "awesomate_app_get",
   {
     annotations: annotate("awesomate_app_get", READ_ONLY),
-    description: "Get one app plus its environments (subdomains, ports, db engine/name, deploy + health state) and any hostnames of the user's own attached to them. Poll this after awesomate_app_create \u2014 status goes provisioning \u2192 active | failed (read provision_error on failure).",
+    description: "Get one app plus its environments (subdomains, ports, db engine/name, deploy + health state) and any hostnames of the user's own attached to them. Poll this after awesomate_app_create \u2014 status goes provisioning \u2192 active | failed (read provision_error on failure; to retry, call awesomate_app_create again with the same appSlug, or remove it with awesomate_app_remove_failed).",
     inputSchema: { appId: external_exports.number().int().positive().describe("The app id from awesomate_app_list / _create") }
   },
   async ({ appId }) => {
@@ -42558,6 +42580,24 @@ server.registerTool(
     }
   }
 );
+server.registerTool(
+  "awesomate_app_remove_failed",
+  {
+    annotations: annotate("awesomate_app_remove_failed", DESTRUCTIVE),
+    description: "Remove an app whose setup FAILED (awesomate_app_get shows status 'failed'), clearing whatever the attempt left on the user's hosting (subdomains, databases, folders). Only failed apps: an active, provisioning or suspended app is refused with 409 not_failed, and removing a working app stays a support request. A failed app already holds no plan slot and does not reserve its name, so to RETRY just call awesomate_app_create again with the same appSlug: the hub clears the failed attempt first. Use this when the user wants the failed app gone, not to retry. Tell the user what will be removed and get a yes first; confirm must equal the app's slug.",
+    inputSchema: {
+      appId: external_exports.number().int().positive().describe("The failed app id from awesomate_app_list / _get"),
+      confirm: external_exports.string().describe("Must equal the app's slug exactly, as proof of intent")
+    }
+  },
+  async ({ appId, confirm }) => {
+    try {
+      return textResult(await hubDelete(requireConfig(), `/api/my-apps/apps/${appId}`, { confirm }));
+    } catch (err) {
+      return errorResult(err);
+    }
+  }
+);
 server.registerTool(
   "awesomate_app_create",
   {
@@ -44302,7 +44342,7 @@ server.registerTool(
 server.registerTool(
   "awesomate_site_audit",
   {
-    description: "Run the SEO + AEO build gates against ONE live page the user owns, fetched AS GPTBot. Returns pass/fail per gate with specific fixes: is the content in the raw HTML at all (a React/Vue site is invisible to ChatGPT, Claude and Perplexity \u2014 only Gemini and Applebot run JavaScript), can the four retrieval bots reach it, is there an accidental noindex/nosnippet, does the canonical point at THIS domain (a leftover pointing at a Replit/Vercel/staging host silently de-indexes the real site), is the structured data valid AND mirrored in visible text, is the content structured so a single section survives being quoted, robots.txt + sitemap, and time-to-first-byte. Run it after building or changing any public page, and before telling the user their site is discoverable \u2014 reads on every plan. Two gates are reported as `skipped` because they need a headless browser or a full crawl; treat skipped as unknown, never as passing.",
+    description: "Run the SEO + AEO build gates against ONE live page the user owns, fetched AS OAI-SearchBot (a retrieval bot, so it sees what ChatGPT search sees; training crawlers like GPTBot are blocked by design on Awesomate-managed domains). Returns pass/fail per gate with specific fixes: is the content in the raw HTML at all (a React/Vue site is invisible to ChatGPT, Claude and Perplexity \u2014 only Gemini and Applebot run JavaScript), can the four retrieval bots reach it, is there an accidental noindex/nosnippet, does the canonical point at THIS domain (a leftover pointing at a Replit/Vercel/staging host silently de-indexes the real site), is the structured data valid AND mirrored in visible text, is the content structured so a single section survives being quoted, robots.txt + sitemap, and time-to-first-byte. Run it after building or changing any public page, and before telling the user their site is discoverable \u2014 reads on every plan. Two gates are reported as `skipped` because they need a headless browser or a full crawl; treat skipped as unknown, never as passing.",
     inputSchema: {
       domain: external_exports.string().min(3).max(253).describe("a domain on the user's own hosting account"),
       path: external_exports.string().max(400).optional().describe("page path to audit, default /")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@awesomate/hosting-mcp",
-  "version": "0.88.2",
+  "version": "0.88.6",
   "description": "Awesomate MCP server — lets Claude manage your Awesomate WordPress hosting, plan, limits, n8n automations, and build Node/static apps + databases",
   "license": "UNLICENSED",
   "type": "module",

package/skill/CHANGELOG.json

@@ -1,5 +1,30 @@
 {
   "versions": [
+    {
+      "version": "0.88.6",
+      "highlights": [
+        "An app whose setup failed no longer uses one of your app slots or blocks its name: create it again with the same name to retry, or ask Claude to remove it with the new awesomate_app_remove_failed tool"
+      ]
+    },
+    {
+      "version": "0.88.5",
+      "highlights": [
+        "Adding a domain now gives your server's public address, never an internal one, and says the records must be Proxied (orange cloud) in Cloudflare with SSL/TLS set to Full"
+      ]
+    },
+    {
+      "version": "0.88.4",
+      "highlights": [
+        "The site audit now reads your page the way ChatGPT search does, so a page that turns AI bots away is reported as unreachable instead of being scored on the block message, and the sitemap check no longer reports a sitemap missing when it is there",
+        "SEO checks test the AI search bots that decide whether you get cited. AI training bots are blocked on purpose on Awesomate-managed addresses, so Claude no longer reports that as a fault"
+      ]
+    },
+    {
+      "version": "0.88.3",
+      "highlights": [
+        "When the hub cannot bring your n8n credential list up to date, Claude now says the list may be out of date, as of when, and which credentials n8n has added or removed since"
+      ]
+    },
     {
       "version": "0.88.2",
       "highlights": [

package/skill/awesomate-app-builder/SKILL.md

@@ -126,7 +126,10 @@ target; never touch prod without an explicit ask.**
    webhooks/integrations → `node-api-only`; landing page → `static-landing`.
    It returns **202** with an `appId` + subdomain(s); poll `awesomate_app_get`
    until `status` is `active` (or `failed` — read `provision_error`, explain
-   plainly).
+   plainly). A failed app holds no plan slot and doesn't keep its name: to
+   retry, call `awesomate_app_create` again with the same `appSlug` (the hub
+   clears the failed attempt first). If the user would rather drop it, offer
+   `awesomate_app_remove_failed` (`confirm` = the slug) after their yes.
 4. **Scaffold** — call `awesomate_app_scaffold` and write each returned file
    into a fresh local project folder at its relative path (placeholders are
    already substituted), then `npm install` (Node) and read the bundled
@@ -257,10 +260,11 @@ keep going on what you can fix.
 - A `409` with code `app_limit` = the plan's app allowance is full (Support
   Plus 5, Pro 20 — `awesomate_app_context.limits` has the live numbers).
   Don't retry; tell the user and surface the `recommendedPlan`/`deepLink`
-  from the error. **There is no delete-app tool or route** — don't offer
-  "delete an old one to free a slot", because neither you nor the user can.
-  The honest options are an upgrade or asking support (awesomate-support
-  skill) to remove an app.
+  from the error. Failed apps never count toward it. There is no tool to
+  delete a WORKING app — don't offer "delete an old one to free a slot",
+  because neither you nor the user can. The honest options are an upgrade or
+  asking support (awesomate-support skill) to remove an app.
+  (`awesomate_app_remove_failed` only removes an app whose setup failed.)
 - Never invent that a capability exists — read `awesomate_app_context` first.
 - Never build on the hosting account, and never raise a support ticket for a
   repo or deploy problem yourself: the hub does both the building (via

package/skill/awesomate-hosting/SKILL.md

@@ -242,7 +242,7 @@ MCP, so say that rather than stopping.
 | `awesomate_domain_add` | Attach a custom domain to a site |
 | `awesomate_dns_check` | Live answer to "where does this domain actually point" — before and after any DNS change |
 | `awesomate_site_uptime` | 30-day availability, incidents, downtime per domain (cached, free) |
-| `awesomate_site_audit` | SEO + AEO build gates for one page, fetched as GPTBot — content present without JS, retrieval bots reachable, canonical, schema, structure, speed. Not plan-gated. Run it after any public-page change, and see the awesomate-seo skill for the fixes |
+| `awesomate_site_audit` | SEO + AEO build gates for one page, fetched as OAI-SearchBot (what ChatGPT search sees) — content present without JS, retrieval bots reachable, canonical, schema, structure, speed. Not plan-gated. Run it after any public-page change, and see the awesomate-seo skill for the fixes |
 | `awesomate_files` | Files on their automation account (public/, private/, temp/): put an image or download up and hand back its `public_url`, fetch what a workflow wrote, tidy a folder. Ask before make_public, a move into public/, or delete; `trash` shows what was deleted, and `empty_trash` erases it for good (show what goes, get a clear yes). Support Plus+, owner's file-folders switch on (`status` says what's missing). Guide: https://hub.awesomate.ai/docs/mcp/guides/files/ |
 | `awesomate_snapshot_site` | Before ANY change to a live site — files + DB restore point |
 | `awesomate_list_snapshots` | What restore points a site has |

package/skill/awesomate-seo/SKILL.md

@@ -159,7 +159,7 @@ the robots rules, the JSON-LD block, and tell them precisely where each goes
 ## 3. Verify — run the gates, don't eyeball it
 
 **`awesomate_site_audit { domain, path }`** runs the mechanical gates against
-the live page, fetched *as GPTBot*, and returns pass/fail with specific fixes:
+the live page, fetched *as OAI-SearchBot* (what ChatGPT search sees), and returns pass/fail with specific fixes:
 content present without JavaScript, all four retrieval bots reachable, no
 accidental `noindex`/`nosnippet`, canonical pointing at this domain, valid
 structured data whose facts also appear in the copy, section structure,
@@ -181,10 +181,14 @@ Then confirm by hand what the tool can't judge:
 - **Content is in the raw HTML** — `curl -s https://DOMAIN/page` shows the
   actual content, not an empty `<div id="root">`. AI crawlers don't run
   JavaScript; a client-rendered page is invisible to them.
-- **AI crawlers aren't blocked at the edge** — a `curl` with a GPTBot /
-  ClaudeBot user-agent returns 200, not a 403/Cloudflare challenge (Cloudflare
-  blocks many AI bots by default; robots.txt can't fix that). Commands + where
-  to fix each case: [references/ai-discoverability.md](references/ai-discoverability.md).
+- **AI retrieval bots aren't blocked at the edge** — a `curl` as OAI-SearchBot,
+  Claude-SearchBot, PerplexityBot, Perplexity-User, ChatGPT-User and Bingbot
+  returns 200, not a 403/Cloudflare challenge (robots.txt can't fix an edge
+  block). **Training bots (GPTBot, ClaudeBot, CCBot…) are not the test:** on
+  Awesomate-managed domains (`*.awesomate.site`, `*.awesomate.app`) they get a
+  403 by design, and on the user's own domain letting them in is the user's
+  choice. Commands + where to fix each case:
+  [references/ai-discoverability.md](references/ai-discoverability.md).
 Tell the user the next step is submitting the sitemap in Google Search Console
 (you can't do that for them) — offer a one-paragraph how-to if they want it.
 
@@ -203,9 +207,12 @@ the user asks to "check SEO", and after any content change:
    the page standing in for it — check whichever they have), and the content
    still mentions the current offerings. A stale llms.txt misdescribes the
    business to every AI assistant that reads it.
-4. **AI crawlers not blocked at the edge** —
-   `curl -A "GPTBot" -s -o /dev/null -w "%{http_code}" https://DOMAIN/`
-   (repeat with `ClaudeBot`) returns 200, not 403 or a challenge page.
+4. **AI retrieval bots not blocked at the edge** —
+   `curl -A "Mozilla/5.0 (compatible; OAI-SearchBot/1.0; +https://openai.com/searchbot)" -s -o /dev/null -w "%{http_code}" https://DOMAIN/`
+   (repeat as Claude-SearchBot, PerplexityBot, Perplexity-User, ChatGPT-User
+   and Bingbot) returns 200, not 403 or a challenge page. Don't test with
+   GPTBot or ClaudeBot: those are training bots, blocked by design on
+   Awesomate-managed domains and the owner's choice elsewhere.
    Where to fix each case: [references/ai-discoverability.md](references/ai-discoverability.md).
 5. **WordPress only: `blog_public` must be 1** — one checkbox ("Discourage
    search engines") silently de-indexes the whole site. Read it via

package/skill/awesomate-seo/references/ai-discoverability.md

@@ -58,39 +58,53 @@ Always check the live `https://DOMAIN/robots.txt`, not just the file you wrote.
 
 ## robots.txt allows it — but the CDN can still 403 it
 
-Cloudflare **blocks many AI crawlers by default on new zones** (GPTBot,
-ClaudeBot, PerplexityBot, CCBot, Google-Extended). The crawler gets a 403 or a
-challenge page before it ever reads robots.txt, so a perfect robots.txt proves
-nothing. Always verify from the outside:
+Cloudflare can block AI crawlers at the edge, and steers new zones into doing
+so. The crawler gets a 403 or a challenge page before it ever reads robots.txt,
+so a perfect robots.txt proves nothing. Always verify from the outside, with the
+**retrieval** bots — the ones whose access decides whether the site is cited:
 
 ```bash
-curl -s -o /dev/null -w "%{http_code}\n" -A "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.0; +https://openai.com/gptbot)" https://DOMAIN/
-curl -s -o /dev/null -w "%{http_code}\n" -A "Mozilla/5.0 (compatible; ClaudeBot/1.0)" https://DOMAIN/
-curl -s -o /dev/null -w "%{http_code}\n" -A "Mozilla/5.0 (compatible; PerplexityBot/1.0)" https://DOMAIN/
+for ua in \
+  "Mozilla/5.0 (compatible; OAI-SearchBot/1.0; +https://openai.com/searchbot)" \
+  "Mozilla/5.0 (compatible; Claude-SearchBot/1.0; +https://anthropic.com)" \
+  "Mozilla/5.0 (compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)" \
+  "Mozilla/5.0 (compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user)" \
+  "Mozilla/5.0 (compatible; ChatGPT-User/1.0; +https://openai.com/bot)" \
+  "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"; do
+  printf '%s  %s\n' "$(curl -s -o /dev/null -w '%{http_code}' -A "$ua" https://DOMAIN/)" "$ua"
+done
 ```
 
 200 = reachable. 403, 503, or an HTML page mentioning Cloudflare = blocked at
-the edge. Where to fix it:
-
-- **Awesomate-managed domain** (`*.awesomate.site` etc.): the zone is managed
-  by Awesomate — the user can't change it. Raise it via `awesomate_support`
-  so the zone's AI Crawl Control settings get reviewed.
-- **Custom domain on the user's own Cloudflare account**: fix it with a WAF
-  custom rule, action **Skip**, expression:
-
-  ```
-  cf.verified_bot_category in {"AI Crawler" "Search Engine Crawler"}
-  ```
-
-  Match on the **verified category, never on user-agent strings** — a UA
-  allowlist is trivially spoofed and silently rots as bots are renamed.
-  Cloudflare's own AI-bot toggle does not separate citation bots from training
-  bots, which is why the toggle alone is the wrong instrument.
+the edge.
+
+**Training bots (GPTBot, ClaudeBot, CCBot, Bytespider, Amazonbot…) are a
+different question.** On Awesomate-managed domains (`*.awesomate.site`,
+`*.awesomate.app`) they get `403 Your request was blocked.` **by design** — that
+is policy, not a fault, and it does not affect citation. Don't report it and
+don't ask for it to be lifted. On the user's own domain, letting training bots
+in is the user's choice.
+
+Where to fix a blocked **retrieval** bot:
+
+- **Awesomate-managed domain**: the zone is managed by Awesomate — the user
+  can't change it. Raise it via `awesomate_support`.
+- **Custom domain on the user's own Cloudflare account**: in **AI Crawl
+  Control**, set each blocked retrieval bot (OAI-SearchBot, Claude-SearchBot,
+  PerplexityBot, Perplexity-User, ChatGPT-User) to **Allow**; training bots are
+  their call. If Cloudflare's **managed robots.txt** is on, check the live
+  `/robots.txt` doesn't disallow the retrieval bots either. Don't write a WAF
+  skip on `cf.verified_bot_category "AI Crawler"`: that category is the
+  training crawlers, and PerplexityBot isn't a verified bot (since Aug 2025),
+  so a category rule can't match it anyway.
 
 Verified 2026-09-02 across awesomate.ai, hub.awesomate.ai and eight live client
-sites: all four retrieval bots got **200**, so this is not currently biting the
-fleet. Re-check per site rather than assuming either way — it is a per-zone
-setting and new zones are steered into blocking at signup.
+sites: all four retrieval bots got **200**. **That is now stale:** on
+08/10/2026 PerplexityBot was found getting 403 on Awesomate-managed zones
+(OAI-SearchBot, Claude-SearchBot, Perplexity-User, ChatGPT-User and Bingbot were
+fine). It is a known Cloudflare fault being fixed — PerplexityBot should get
+200; if a managed site still shows 403 for it, raise it with support rather
+than treating it as expected. Re-check per site rather than assuming either way.
 
 ## Most AI crawlers do not run JavaScript