@jclvsh/dropspace 2.33.0 → 2.34.0

package/README.md

@@ -1,6 +1,6 @@
 # @jclvsh/dropspace
 
-MCP server and CLI for the [Dropspace](https://www.dropspace.dev) API. Lets AI agents (Claude Code, Cursor) and humans manage launches, personas, media generation, boosts, autopilot, recommendations, reddit engagement, platform connections, API keys, and webhooks. The full tool list, by category, is in the tables below and at https://www.dropspace.dev/docs#mcp-server.
+MCP server and CLI for the [Dropspace](https://www.dropspace.dev) API. Lets AI agents (Claude Code, Cursor) and humans manage launches, comments, personas, media generation, boosts, autopilot, recommendations, subreddit discovery, platform connections, profile and billing, API keys, and webhooks. The full tool list, by category, is in the tables below and at https://www.dropspace.dev/docs#mcp-server.
 
 ## Installation
 
@@ -44,23 +44,25 @@ dropspace launches --help
 
 ### CLI Commands
 
-| Group                  | Commands                                                                                                                                  |
-| ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
-| launches               | list, create, get, update, delete, publish, retry, generate, retry-content, analytics, batch-analytics, status, delete-post, delete-posts |
-| personas               | list, create, get, update, delete, analyze                                                                                                |
-| media                  | generate, job, library list, library add, library describe, library delete                                                                |
-| connections            | list                                                                                                                                      |
-| boosts                 | create, list, get, activate, cancel, performance                                                                                          |
-| reddit                 | suggest                                                                                                                                   |
-| credits                | balance, purchase                                                                                                                         |
-| keys                   | me, list, create, rename, revoke, rotate                                                                                                  |
-| webhooks               | list, create, get, update, delete, test, rotate-secret, deliveries                                                                        |
-| status                 | dropspace official account connections                                                                                                    |
-| usage                  | plan, limits, and billing period                                                                                                          |
-| changelog              | machine-readable release history                                                                                                          |
-| audience               | follower counts + growth per connected account                                                                                            |
-| autopilot              | status, configure, review, approve, reject, run, runs                                                                                     |
-| recommendations (recs) | list, apply, dismiss                                                                                                                      |
+| Group                  | Commands                                                                                                                                                                                                               |
+| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| launches               | list, create, get, update, delete, publish, retry, generate, retry-content, analytics, batch-analytics, status, destinations, delete-post, delete-posts, comments list, comments reply, comments hide, comments delete |
+| personas               | list, create, get, update, delete, analyze                                                                                                                                                                             |
+| media                  | generate, job, library list, library add, library describe, library delete                                                                                                                                             |
+| connections            | list, disconnect, profile                                                                                                                                                                                              |
+| boosts                 | create, list, get, activate, cancel, performance                                                                                                                                                                       |
+| reddit                 | suggest                                                                                                                                                                                                                |
+| credits                | balance, purchase                                                                                                                                                                                                      |
+| keys                   | me, list, create, rename, revoke, rotate                                                                                                                                                                               |
+| webhooks               | list, create, get, update, delete, test, rotate-secret, deliveries                                                                                                                                                     |
+| status                 | dropspace official account connections                                                                                                                                                                                 |
+| usage                  | plan, limits, and billing period                                                                                                                                                                                       |
+| changelog              | machine-readable release history                                                                                                                                                                                       |
+| audience               | follower counts + growth per connected account                                                                                                                                                                         |
+| autopilot              | status, configure, review, approve, reject, run, runs                                                                                                                                                                  |
+| recommendations (recs) | list, apply, dismiss                                                                                                                                                                                                   |
+| profile                | get, update                                                                                                                                                                                                            |
+| billing                | portal                                                                                                                                                                                                                 |
 
 ## MCP Server Configuration
 
@@ -119,7 +121,7 @@ https://api.dropspace.dev/mcp
 
 - Transport: MCP streamable HTTP, `POST` only, stateless, JSON responses.
 - Auth: `Authorization: Bearer ds_live_...` (the same API key; its scopes apply).
-- Tools: a subset of this package. API key, webhook, boost, credit, and reddit tools are only available through the npm package.
+- Tools: a subset of this package. API key, webhook, boost, credit, reddit, media library, comment, destination, disconnect, profile, and billing tools are only available through the npm package (stdio) for now.
 - Every tool is annotated by class: `read` (`readOnlyHint: true`), `write`, or `sensitive` (`destructiveHint: true`: it publishes, schedules, or deletes on a connected platform, or deletes a launch or persona with no restore). The class of each hosted tool is listed at https://www.dropspace.dev/docs#mcp-hosted, and the source of truth is `src/tool-policy.ts`.
 - `create_launch` sends a content-derived `Idempotency-Key`, so a retry after a timeout returns the launch already created instead of creating a second one (the result says so).
 - Each MCP request counts once against the key's rate limit, and each tool call counts once more when it reaches the REST API.
@@ -140,20 +142,21 @@ Other agents that read skill files can use the same file from `node_modules/@jcl
 
 ### Launches
 
-| Tool                         | Description                                                    |
-| ---------------------------- | -------------------------------------------------------------- |
-| `list_launches`              | List your launches with pagination                             |
-| `create_launch`              | Create a new launch with content, media, and account selection |
-| `get_launch`                 | Get a launch by ID with posting status                         |
-| `update_launch`              | Update a launch's schedule, status, content, or media          |
-| `delete_launch`              | Delete a launch                                                |
-| `publish_launch`             | Publish a launch to all configured platforms                   |
-| `retry_launch`               | Retry failed platforms for a launch                            |
-| `generate_content`           | Generate AI content and video scripts for a launch             |
-| `retry_launch_content`       | Retry AI content generation for failed platforms               |
-| `get_launch_analytics`       | Get publishing analytics with per-post engagement metrics      |
-| `get_batch_launch_analytics` | Get analytics for multiple launches in one call                |
-| `get_launch_status`          | Get detailed posting status with per-platform logs             |
+| Tool                         | Description                                                        |
+| ---------------------------- | ------------------------------------------------------------------ |
+| `list_launches`              | List your launches with pagination                                 |
+| `create_launch`              | Create a new launch with content, media, and account selection     |
+| `get_launch`                 | Get a launch by ID with posting status                             |
+| `update_launch`              | Update a launch's schedule, status, content, or media              |
+| `delete_launch`              | Delete a launch                                                    |
+| `publish_launch`             | Publish a launch to all configured platforms                       |
+| `retry_launch`               | Retry failed platforms for a launch                                |
+| `generate_content`           | Generate AI content and video scripts for a launch                 |
+| `retry_launch_content`       | Retry AI content generation for failed platforms                   |
+| `get_launch_analytics`       | Get publishing analytics with per-post engagement metrics          |
+| `get_batch_launch_analytics` | Get analytics for multiple launches in one call                    |
+| `get_launch_status`          | Get detailed posting status with per-platform logs                 |
+| `get_launch_destinations`    | One row per destination, naming each reddit subreddit (stdio only) |
 
 #### `create_launch` Parameters
 
@@ -252,9 +255,30 @@ Other agents that read skill files can use the same file from `node_modules/@jcl
 
 ### Connections
 
-| Tool               | Description                               |
-| ------------------ | ----------------------------------------- |
-| `list_connections` | List your connected social media accounts |
+| Tool                        | Description                                                                        |
+| --------------------------- | ---------------------------------------------------------------------------------- |
+| `list_connections`          | List your connected social media accounts                                          |
+| `disconnect_connection`     | Disconnect a platform, or one account on it with `account_id` (stdio only)         |
+| `update_connection_profile` | Edit the connected account's profile on the platform (youtube channel description) |
+
+### Comments
+
+| Tool                   | Description                                                                                       |
+| ---------------------- | ------------------------------------------------------------------------------------------------- |
+| `list_launch_comments` | Comments on a launch's published posts, newest first, per post with a support status (stdio only) |
+| `reply_to_comment`     | Reply as the publishing account: youtube and instagram (send scope, stdio only)                   |
+| `hide_comment`         | Hide or unhide a comment: instagram (send scope, stdio only)                                      |
+| `delete_comment`       | Permanently delete a comment: instagram, media owner only (send scope, stdio only)                |
+
+CLI: `dropspace launches comments list|reply|hide|delete`.
+
+### Reddit
+
+| Tool                 | Description                                                                                              |
+| -------------------- | -------------------------------------------------------------------------------------------------------- |
+| `suggest_subreddits` | Subreddits matched to a product brief, with promo policy and a standing badge per community (stdio only) |
+
+Reddit engagement (drafted comments in other communities) is paused: its tools and CLI commands are not served.
 
 ### Boosts
 
@@ -371,6 +395,16 @@ Counts come from each platform's official API and are cached for 15 minutes. You
 
 Autopilot is available on pro and premium plans. `configure_autopilot` takes `media_source` (`ai`, `library`, `mixed`) to post the user's own photos and videos, and `product_image_url` for AI slides built from the real product.
 
+### Account
+
+| Tool                            | Description                                                                                          |
+| ------------------------------- | ---------------------------------------------------------------------------------------------------- |
+| `get_profile`                   | Get your profile (stdio only)                                                                        |
+| `update_profile`                | Update your `full_name` and/or `avatar_url` (stdio only)                                             |
+| `create_billing_portal_session` | A URL to manage your subscription; pre-authenticated for subscribers, so don't share it (stdio only) |
+
+CLI: `dropspace profile get|update`, `dropspace billing portal`.
+
 ### Recommendations
 
 | Tool                     | Description                                                                                                |
@@ -387,23 +421,24 @@ Generate an API key at [www.dropspace.dev/settings](https://www.dropspace.dev/se
 
 API keys support scoped permissions:
 
-| Scope      | Access                                                          |
-| ---------- | --------------------------------------------------------------- |
-| `read`     | List and read launches, personas, connections, dropspace status |
-| `write`    | Create and update launches, personas                            |
-| `delete`   | Delete launches, personas                                       |
-| `publish`  | Publish and retry launches                                      |
-| `generate` | Generate AI content, retry content generation                   |
-| `admin`    | Manage API keys and webhooks                                    |
+| Scope      | Access                                                                       |
+| ---------- | ---------------------------------------------------------------------------- |
+| `read`     | List and read launches, personas, connections, dropspace status              |
+| `write`    | Create, update, and soft-delete launches and personas                        |
+| `generate` | Generate AI content and media, retry content generation                      |
+| `send`     | Publish and retry launches, reply to and moderate comments, deliver webhooks |
+| `admin`    | Manage API keys and webhooks                                                 |
+
+Keys created without a scopes list get `read` and `write`. The legacy `publish` and `delete` scopes were retired on 07/20/2026 (use `send` and `write`).
 
 ### Recommended Scopes by Use Case
 
-| Use Case         | Recommended Scopes                                        |
-| ---------------- | --------------------------------------------------------- |
-| AI agents / MCP  | `read`, `write`, `generate`                               |
-| CI/CD publishing | `read`, `publish`                                         |
-| Monitoring       | `read`                                                    |
-| Full management  | `read`, `write`, `delete`, `publish`, `generate`, `admin` |
+| Use Case         | Recommended Scopes                           |
+| ---------------- | -------------------------------------------- |
+| AI agents / MCP  | `read`, `write`, `generate`                  |
+| CI/CD publishing | `read`, `send`                               |
+| Monitoring       | `read`                                       |
+| Full management  | `read`, `write`, `generate`, `send`, `admin` |
 
 ## Webhook Events
 

package/dist/cli.js

@@ -18,6 +18,7 @@ import { registerRedditCommands } from "./commands/reddit.js";
 import { registerAutopilotCommands } from "./commands/autopilot.js";
 import { registerRecommendationCommands } from "./commands/recommendations.js";
 import { registerAudienceCommands } from "./commands/audience.js";
+import { registerAccountCommands } from "./commands/account.js";
 const program = new Command()
     .name("dropspace")
     .description("dropspace CLI - manage launches, personas, boosts, and more")
@@ -40,6 +41,7 @@ try {
     registerAutopilotCommands(program, client);
     registerRecommendationCommands(program, client);
     registerRedditCommands(program, client);
+    registerAccountCommands(program, client);
     await program.parseAsync(process.argv);
 }
 catch (error) {

package/dist/commands/account.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from "commander";
+import type { DropspaceClient } from "../client.js";
+export declare function registerAccountCommands(program: Command, client: DropspaceClient): void;

package/dist/commands/account.js

@@ -0,0 +1,50 @@
+import { formatOutput, handleError, getFormat } from "../cli-utils.js";
+export function registerAccountCommands(program, client) {
+    const profile = program.command("profile").description("your dropspace profile");
+    profile
+        .command("get")
+        .description("get your profile")
+        .action(async () => {
+        try {
+            const result = await client.get("/profile");
+            formatOutput(result, getFormat(program.opts()));
+        }
+        catch (error) {
+            handleError(error);
+        }
+    });
+    profile
+        .command("update")
+        .description("update your name and/or avatar")
+        .option("-n, --name <name>", "display name (1-120 characters)")
+        .option("--avatar <url>", "public URL of the avatar image")
+        .action(async (opts) => {
+        try {
+            const body = {};
+            if (opts.name)
+                body.full_name = opts.name;
+            if (opts.avatar)
+                body.avatar_url = opts.avatar;
+            if (Object.keys(body).length === 0)
+                throw new Error("provide --name or --avatar");
+            const result = await client.patch("/profile", body);
+            formatOutput(result, getFormat(program.opts()));
+        }
+        catch (error) {
+            handleError(error);
+        }
+    });
+    const billing = program.command("billing").description("manage your subscription");
+    billing
+        .command("portal")
+        .description("get a URL to manage your subscription (pre-authenticated for subscribers; don't share it)")
+        .action(async () => {
+        try {
+            const result = await client.post("/billing/portal");
+            formatOutput(result, getFormat(program.opts()));
+        }
+        catch (error) {
+            handleError(error);
+        }
+    });
+}

package/dist/commands/connections.js

@@ -1,4 +1,5 @@
 import { formatOutput, handleError, getFormat } from "../cli-utils.js";
+import { connectionPath } from "../tools/connections.js";
 export function registerConnectionCommands(program, client) {
     const connections = program.command("connections").alias("c").description("manage platform connections");
     connections
@@ -26,10 +27,7 @@ export function registerConnectionCommands(program, client) {
         .option("--account-id <id>", "disconnect only this account (its entity_id from `connections list`) instead of the whole platform")
         .action(async (platform, opts) => {
         try {
-            const path = opts.accountId
-                ? `/connections/${platform}?account_id=${encodeURIComponent(opts.accountId)}`
-                : `/connections/${platform}`;
-            await client.delete(path);
+            await client.delete(connectionPath(platform, opts.accountId));
             formatOutput({ message: `${platform} disconnected` }, getFormat(program.opts()));
         }
         catch (error) {

package/dist/commands/launches.js

@@ -1,4 +1,5 @@
 import { formatOutput, handleError, getFormat, parseList } from "../cli-utils.js";
+import { commentPath } from "../tools/comments.js";
 export function registerLaunchCommands(program, client) {
     const launches = program.command("launches").alias("l").description("manage launches");
     launches
@@ -258,6 +259,93 @@ export function registerLaunchCommands(program, client) {
             handleError(error);
         }
     });
+    launches
+        .command("destinations <id>")
+        .description("one row per destination (names the subreddit for each reddit community)")
+        .action(async (id) => {
+        try {
+            const result = await client.get(`/launches/${id}/destinations`);
+            formatOutput(result, getFormat(program.opts()));
+        }
+        catch (error) {
+            handleError(error);
+        }
+    });
+    const comments = launches.command("comments").description("read and moderate comments on a launch's posts");
+    comments
+        .command("list <launch-id>")
+        .description("list comments per published post, newest first")
+        .option("--post <post-id>", "one post's comments only (the platform post id; required with --cursor)")
+        .option("--platform <platform>", "only posts on this platform")
+        .option("--cursor <cursor>", "next_cursor from a previous page (needs --post)")
+        .option("-l, --limit <n>", "comments per post, 1-100 (default 25)")
+        .action(async (launchId, opts) => {
+        try {
+            const params = {};
+            if (opts.post)
+                params.post_id = opts.post;
+            if (opts.platform)
+                params.platform = opts.platform;
+            if (opts.cursor)
+                params.cursor = opts.cursor;
+            if (opts.limit)
+                params.limit = opts.limit;
+            const result = await client.get(`/launches/${launchId}/comments`, params);
+            formatOutput(result, getFormat(program.opts()));
+        }
+        catch (error) {
+            handleError(error);
+        }
+    });
+    comments
+        .command("reply <launch-id> <comment-id>")
+        .description("reply to a comment as the account that published the post (youtube, instagram)")
+        .requiredOption("--post <post-id>", "the platform post id the comment lives on")
+        .requiredOption("-m, --message <text>", "the reply (1-2,200 characters)")
+        .action(async (launchId, commentId, opts) => {
+        try {
+            const result = await client.post(`/launches/${launchId}/comments/replies`, {
+                post_id: opts.post,
+                comment_id: commentId,
+                message: opts.message,
+            });
+            formatOutput(result, getFormat(program.opts()));
+        }
+        catch (error) {
+            handleError(error);
+        }
+    });
+    comments
+        .command("hide <launch-id> <comment-id>")
+        .description("hide a comment from everyone but its author (instagram); --unhide reverses it")
+        .requiredOption("--post <post-id>", "the platform post id the comment lives on")
+        .option("--unhide", "unhide the comment instead")
+        .action(async (launchId, commentId, opts) => {
+        try {
+            const result = await client.post(`/launches/${launchId}/comments/hide`, {
+                post_id: opts.post,
+                comment_id: commentId,
+                hidden: !opts.unhide,
+            });
+            formatOutput(result, getFormat(program.opts()));
+        }
+        catch (error) {
+            handleError(error);
+        }
+    });
+    comments
+        .command("delete <launch-id> <comment-id>")
+        .description("permanently delete a comment (instagram, media owner only)")
+        .requiredOption("--post <post-id>", "the platform post id the comment lives on")
+        .action(async (launchId, commentId, opts) => {
+        try {
+            await client.delete(commentPath(launchId, commentId, opts.post));
+            formatOutput({ comment_id: commentId, deleted: true }, getFormat(program.opts()));
+        }
+        catch (error) {
+            handleError(error);
+        }
+    });
     launches
         .command("delete-post <launch-id> <posting-log-id>")
         .description("delete a single published post from its platform")

package/dist/server.js

@@ -15,6 +15,8 @@ import { registerAutopilotTools } from "./tools/autopilot.js";
 import { registerRecommendationTools } from "./tools/recommendations.js";
 import { registerRedditTools } from "./tools/reddit.js";
 import { registerAudienceTools } from "./tools/audience.js";
+import { registerCommentTools } from "./tools/comments.js";
+import { registerAccountTools } from "./tools/account.js";
 /** Drops tools whose feature is paused before the policy registrar sees them (see PAUSED_TOOLS). */
 function skipPausedTools(registrar) {
     return {
@@ -42,5 +44,7 @@ export function createDropspaceServer({ client, version, profile }) {
     registerRecommendationTools(registrar, client);
     registerRedditTools(registrar, client);
     registerAudienceTools(registrar, client);
+    registerCommentTools(registrar, client);
+    registerAccountTools(registrar, client);
     return server;
 }

package/dist/tool-policy.d.ts

@@ -5,8 +5,9 @@
  *
  * hosted: whether the hosted endpoint (https://api.dropspace.dev/mcp) serves the tool.
  * The stdio server serves every tool. Left off hosted: credits and boosts (payments and
- * ad spend), API keys and webhooks (developer plumbing and credentials), and reddit
- * engagement.
+ * ad spend), API keys and webhooks (developer plumbing and credentials), reddit
+ * engagement, and the tools added after the 10/13/2026 Meta submission (media library,
+ * comments, destinations, disconnect, account) until that review settles.
  *
  * category: the documentation grouping. Every tool count and category list in the docs
  * page, llms.txt, and llms-full.txt is computed from this table.
@@ -16,7 +17,7 @@
  */
 import { type PolicyTable, type ToolClass, type ToolPolicy, type ToolProfile } from "./policy.js";
 export type { ToolClass, ToolPolicy, ToolProfile };
-export declare const TOOL_CATEGORIES: readonly ["launches", "posts", "personas", "media", "connections", "boosts", "credits", "API keys", "webhooks", "dropspace", "usage", "autopilot", "recommendations", "reddit engagement", "audience"];
+export declare const TOOL_CATEGORIES: readonly ["launches", "posts", "comments", "personas", "media", "connections", "boosts", "credits", "API keys", "webhooks", "dropspace", "usage", "account", "autopilot", "recommendations", "reddit engagement", "audience"];
 export type ToolCategory = (typeof TOOL_CATEGORIES)[number];
 /**
  * Reddit engagement is paused (dropspace's reddit_engagement_disabled switch, 10/15/2026): the API
@@ -28,7 +29,7 @@ export declare const REDDIT_ENGAGEMENT_PAUSED = true;
 export declare const PAUSED_TOOLS: ReadonlySet<string>;
 /** The tools the package serves - every docs count and category list reads this. */
 export declare const TOOL_POLICY: PolicyTable<ToolCategory>;
-export declare const toolPolicy: (name: string) => ToolPolicy<"launches" | "personas" | "connections" | "webhooks" | "usage" | "credits" | "media" | "boosts" | "audience" | "posts" | "API keys" | "dropspace" | "autopilot" | "recommendations" | "reddit engagement">;
+export declare const toolPolicy: (name: string) => ToolPolicy<"audience" | "launches" | "comments" | "personas" | "connections" | "webhooks" | "usage" | "credits" | "media" | "boosts" | "posts" | "API keys" | "dropspace" | "account" | "autopilot" | "recommendations" | "reddit engagement">;
 export declare const isToolEnabled: (name: string, profile: ToolProfile) => boolean;
 export declare const toolAnnotations: (name: string) => {
     readOnlyHint: boolean;

package/dist/tool-policy.js

@@ -5,8 +5,9 @@
  *
  * hosted: whether the hosted endpoint (https://api.dropspace.dev/mcp) serves the tool.
  * The stdio server serves every tool. Left off hosted: credits and boosts (payments and
- * ad spend), API keys and webhooks (developer plumbing and credentials), and reddit
- * engagement.
+ * ad spend), API keys and webhooks (developer plumbing and credentials), reddit
+ * engagement, and the tools added after the 10/13/2026 Meta submission (media library,
+ * comments, destinations, disconnect, account) until that review settles.
  *
  * category: the documentation grouping. Every tool count and category list in the docs
  * page, llms.txt, and llms-full.txt is computed from this table.
@@ -18,6 +19,7 @@ import { isToolEnabledIn, toolAnnotationsFor, toolPolicyFor, toolsInCategoryOf,
 export const TOOL_CATEGORIES = [
     "launches",
     "posts",
+    "comments",
     "personas",
     "media",
     "connections",
@@ -27,6 +29,7 @@ export const TOOL_CATEGORIES = [
     "webhooks",
     "dropspace",
     "usage",
+    "account",
     "autopilot",
     "recommendations",
     "reddit engagement",
@@ -58,9 +61,19 @@ const FULL_TOOL_POLICY = {
     retry_launch_content: hosted("launches", "write"),
     publish_launch: hosted("launches", "sensitive"),
     retry_launch: hosted("launches", "sensitive"),
+    // stdio only for now: the hosted set is pinned to what was submitted to Meta on 10/13/2026
+    // (__tests__/server.test.ts), the same hold as the media library tools below.
+    get_launch_destinations: localOnly("launches", "read"),
     // posts
     delete_post: hosted("posts", "sensitive"),
     delete_all_posts: hosted("posts", "sensitive"),
+    // comments - stdio only for now, the same Meta-review hold as the media library tools below.
+    list_launch_comments: localOnly("comments", "read"),
+    // reply and hide act on the platform as the account that published the post
+    reply_to_comment: localOnly("comments", "sensitive"),
+    hide_comment: localOnly("comments", "sensitive"),
+    // deletes on the platform with no restore
+    delete_comment: localOnly("comments", "sensitive"),
     // personas
     list_personas: hosted("personas", "read"),
     get_persona: hosted("personas", "read"),
@@ -75,7 +88,7 @@ const FULL_TOOL_POLICY = {
     generate_media: hosted("media", "write"),
     get_media_job: hosted("media", "read"),
     // stdio only for now: the hosted set is pinned to what was submitted to Meta on 10/13/2026
-    // (__tests__/hosted.test.ts). Move these to hosted() once that review settles.
+    // (__tests__/server.test.ts). Move these to hosted() once that review settles.
     list_media_library: localOnly("media", "read"),
     add_to_media_library: localOnly("media", "write"),
     update_media_library_item: localOnly("media", "write"),
@@ -83,6 +96,9 @@ const FULL_TOOL_POLICY = {
     delete_media_library_item: localOnly("media", "write"),
     // connections
     list_connections: hosted("connections", "read"),
+    // deletes the stored token (a credential) with no restore short of reconnecting.
+    // stdio only for now, the same Meta-review hold as the media library tools above.
+    disconnect_connection: localOnly("connections", "sensitive"),
     // edits the profile ON the platform (youtube channel description)
     update_connection_profile: hosted("connections", "sensitive"),
     // autopilot
@@ -105,6 +121,11 @@ const FULL_TOOL_POLICY = {
     get_usage: hosted("usage", "read"),
     get_changelog: hosted("usage", "read"),
     get_dropspace_status: hosted("dropspace", "read"),
+    // account - stdio only for now, the same Meta-review hold as the media library tools above.
+    get_profile: localOnly("account", "read"),
+    update_profile: localOnly("account", "write"),
+    // returns a pre-authenticated stripe billing portal url (credential-like)
+    create_billing_portal_session: localOnly("account", "sensitive"),
     // reddit engagement
     suggest_subreddits: localOnly("reddit engagement", "read"),
     get_engagement_config: localOnly("reddit engagement", "read"),

package/dist/tools/account.d.ts

@@ -0,0 +1,3 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { DropspaceClient } from "../client.js";
+export declare function registerAccountTools(server: McpServer, client: DropspaceClient): void;

package/dist/tools/account.js

@@ -0,0 +1,40 @@
+import { z } from "zod";
+const text = (value) => ({ content: [{ type: "text", text: JSON.stringify(value, null, 2) }] });
+const fail = (error) => ({
+    content: [{ type: "text", text: `error: ${error instanceof Error ? error.message : String(error)}` }],
+    isError: true,
+});
+export function registerAccountTools(server, client) {
+    server.tool("get_profile", "get the authenticated user's profile: email, full_name, avatar_url, role, and whether onboarding is complete.", {}, async () => {
+        try {
+            return text(await client.get("/profile"));
+        }
+        catch (error) {
+            return fail(error);
+        }
+    });
+    server.tool("update_profile", "update the authenticated user's full_name and/or avatar_url (pass at least one). requires the write scope.", {
+        full_name: z.string().min(1).max(120).optional().describe("display name (1-120 characters)"),
+        avatar_url: z.string().url().optional().describe("public URL of the avatar image"),
+    }, async ({ full_name, avatar_url }) => {
+        try {
+            const body = {};
+            if (full_name !== undefined)
+                body.full_name = full_name;
+            if (avatar_url !== undefined)
+                body.avatar_url = avatar_url;
+            return text(await client.patch("/profile", body));
+        }
+        catch (error) {
+            return fail(error);
+        }
+    });
+    server.tool("create_billing_portal_session", "get a URL where the user manages their subscription. a subscriber gets a pre-authenticated stripe customer portal session, so treat the url like a credential: open it, never share it. a user with no subscription gets the web billing page, where they sign in to upgrade.", {}, async () => {
+        try {
+            return text(await client.post("/billing/portal"));
+        }
+        catch (error) {
+            return fail(error);
+        }
+    });
+}

package/dist/tools/comments.d.ts

@@ -0,0 +1,5 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { DropspaceClient } from "../client.js";
+/** DELETE path for one comment on one of a launch's posts (shared by the MCP tool and the CLI). */
+export declare function commentPath(launchId: string, commentId: string, postId: string): string;
+export declare function registerCommentTools(server: McpServer, client: DropspaceClient): void;

package/dist/tools/comments.js

@@ -0,0 +1,79 @@
+import { z } from "zod";
+const text = (value) => ({ content: [{ type: "text", text: JSON.stringify(value, null, 2) }] });
+const fail = (error) => ({
+    content: [{ type: "text", text: `error: ${error instanceof Error ? error.message : String(error)}` }],
+    isError: true,
+});
+/** DELETE path for one comment on one of a launch's posts (shared by the MCP tool and the CLI). */
+export function commentPath(launchId, commentId, postId) {
+    return `/launches/${launchId}/comments/${encodeURIComponent(commentId)}?post_id=${encodeURIComponent(postId)}`;
+}
+export function registerCommentTools(server, client) {
+    server.tool("list_launch_comments", "list comments on a launch's published posts, newest first, grouped per post. each post carries a status: ok (comments returned), unsupported (the platform's api does not expose comment content), comments_disabled, post_deleted, or unavailable (transient - retry later); detail explains every non-ok status. to page through one post, pass post_id plus the next_cursor from the previous response. comment ids feed reply_to_comment, hide_comment, and delete_comment.", {
+        launch_id: z.string().uuid().describe("launch ID"),
+        post_id: z
+            .string()
+            .min(1)
+            .max(200)
+            .optional()
+            .describe("read one post's comments only (the platform post id; required with cursor)"),
+        platform: z.string().min(1).max(50).optional().describe("only posts on this platform"),
+        cursor: z.string().min(1).max(500).optional().describe("next_cursor from a previous page (needs post_id)"),
+        limit: z.number().int().min(1).max(100).optional().describe("comments per post, 1-100 (default 25)"),
+    }, async ({ launch_id, post_id, platform, cursor, limit }) => {
+        try {
+            const params = {};
+            if (post_id)
+                params.post_id = post_id;
+            if (platform)
+                params.platform = platform;
+            if (cursor)
+                params.cursor = cursor;
+            if (limit !== undefined)
+                params.limit = String(limit);
+            return text(await client.get(`/launches/${launch_id}/comments`, params));
+        }
+        catch (error) {
+            return fail(error);
+        }
+    });
+    server.tool("reply_to_comment", "reply to a comment on one of a launch's published posts, as the account that published it. youtube and instagram only; other platforms, and instagram connections made before 08/25/2026 (reconnect instagram once to fix), return an error with the reason. requires the send scope.", {
+        launch_id: z.string().uuid().describe("launch ID"),
+        post_id: z.string().min(1).max(200).describe("the platform post id (from list_launch_comments)"),
+        comment_id: z.string().min(1).max(200).describe("the comment to reply to (from list_launch_comments)"),
+        message: z.string().min(1).max(2200).describe("the reply text (1-2,200 characters)"),
+    }, async ({ launch_id, post_id, comment_id, message }) => {
+        try {
+            return text(await client.post(`/launches/${launch_id}/comments/replies`, { post_id, comment_id, message }));
+        }
+        catch (error) {
+            return fail(error);
+        }
+    });
+    server.tool("hide_comment", "hide or unhide a comment on one of a launch's published posts, as the account that published it. a hidden comment stays visible to its author and disappears for everyone else; hidden: false reverses it. instagram only (not stories); other platforms return an error with the reason. requires the send scope.", {
+        launch_id: z.string().uuid().describe("launch ID"),
+        post_id: z.string().min(1).max(200).describe("the platform post id (from list_launch_comments)"),
+        comment_id: z.string().min(1).max(200).describe("the comment to hide or unhide"),
+        hidden: z.boolean().describe("true hides the comment, false unhides it"),
+    }, async ({ launch_id, post_id, comment_id, hidden }) => {
+        try {
+            return text(await client.post(`/launches/${launch_id}/comments/hide`, { post_id, comment_id, hidden }));
+        }
+        catch (error) {
+            return fail(error);
+        }
+    });
+    server.tool("delete_comment", "permanently delete a comment on one of a launch's published posts. instagram only, and instagram lets only the account that published the post delete; other platforms, stories, and instagram connections made before 08/25/2026 return an error with the reason. this cannot be undone. requires the send scope.", {
+        launch_id: z.string().uuid().describe("launch ID"),
+        post_id: z.string().min(1).max(200).describe("the platform post id the comment lives on"),
+        comment_id: z.string().min(1).max(200).describe("the comment to delete"),
+    }, async ({ launch_id, post_id, comment_id }) => {
+        try {
+            await client.delete(commentPath(launch_id, comment_id, post_id));
+            return text({ comment_id, deleted: true });
+        }
+        catch (error) {
+            return fail(error);
+        }
+    });
+}

package/dist/tools/connections.d.ts

@@ -1,3 +1,5 @@
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { DropspaceClient } from "../client.js";
+/** DELETE path for a platform, or for one account on it (shared by the MCP tool and the CLI). */
+export declare function connectionPath(platform: string, accountId?: string): string;
 export declare function registerConnectionTools(server: McpServer, client: DropspaceClient): void;

package/dist/tools/connections.js

@@ -1,6 +1,11 @@
 import { z } from "zod";
+/** DELETE path for a platform, or for one account on it (shared by the MCP tool and the CLI). */
+export function connectionPath(platform, accountId) {
+    const base = `/connections/${encodeURIComponent(platform)}`;
+    return accountId ? `${base}?account_id=${encodeURIComponent(accountId)}` : base;
+}
 export function registerConnectionTools(server, client) {
-    server.tool("list_connections", 'list your connected social media accounts. each row has a "platform" and an "entity_id" (null for your primary account on that platform, set for additional accounts). to target a specific account in create_launch when you have more than one on instagram / tiktok / youtube / twitter / reddit, pass "{platform}:{entity_id}" as a user_platform_accounts key (the bare "{platform}" key targets your primary). the same entity_id is what DELETE /connections/{platform}?account_id=... disconnects, and what retry_launch takes as account_id', {
+    server.tool("list_connections", 'list your connected social media accounts. each row has a "platform" and an "entity_id" (null for your primary account on that platform, set for additional accounts). to target a specific account in create_launch when you have more than one on instagram / tiktok / youtube / twitter / reddit, pass "{platform}:{entity_id}" as a user_platform_accounts key (the bare "{platform}" key targets your primary). the same entity_id is what disconnect_connection and retry_launch take as account_id', {
         page: z.number().int().positive().optional().describe("page number (default: 1)"),
         page_size: z.number().int().min(1).max(100).optional().describe("items per page (default: 50, max: 100)"),
     }, async ({ page, page_size }) => {
@@ -27,6 +32,36 @@ export function registerConnectionTools(server, client) {
             };
         }
     });
+    server.tool("disconnect_connection", "disconnect a connected platform: every account on it, or only the one whose entity_id you pass as account_id (from list_connections). the stored token is deleted, so launches cannot post through that account until it is reconnected in the web app. requires the write scope.", {
+        platform: z.string().describe('platform to disconnect (e.g. "instagram")'),
+        account_id: z
+            .string()
+            .optional()
+            .describe("disconnect only this account (its entity_id from list_connections) instead of the whole platform"),
+    }, async ({ platform, account_id }) => {
+        try {
+            await client.delete(connectionPath(platform, account_id));
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: JSON.stringify({ platform, account_id: account_id ?? null, disconnected: true }, null, 2),
+                    },
+                ],
+            };
+        }
+        catch (error) {
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: `error: ${error instanceof Error ? error.message : String(error)}`,
+                    },
+                ],
+                isError: true,
+            };
+        }
+    });
     server.tool("update_connection_profile", "edit the connected account's profile ON the platform. youtube only today: sets the channel description (max 1,000 characters; an empty string clears it) via channels.update. instagram's api can read a profile but not write it, facebook page \"about\" needs a permission dropspace does not hold, and tiktok / x / linkedin expose no profile write - those return an error with the reason. requires the write scope.", {
         platform: z.string().describe('platform whose profile to edit (currently only "youtube")'),
         description: z.string().max(1000).describe("the new profile / channel description (max 1,000 characters)"),

package/dist/tools/launches.js

@@ -466,6 +466,27 @@ export function registerLaunchTools(server, client) {
             };
         }
     });
+    server.tool("get_launch_destinations", "list one row per destination of a launch: platform, account_type, and subreddit for each reddit community, with its status, post_url, and error. get_launch_status reports every reddit subreddit as the same platform; this names each one, so you can see which community failed and retry just that one with retry_launch + subreddit.", {
+        id: z.string().uuid().describe("launch ID"),
+    }, async ({ id }) => {
+        try {
+            const result = await client.get(`/launches/${id}/destinations`);
+            return {
+                content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+            };
+        }
+        catch (error) {
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: `error: ${error instanceof Error ? error.message : String(error)}`,
+                    },
+                ],
+                isError: true,
+            };
+        }
+    });
     server.tool("retry_launch_content", "retry AI content generation for failed platforms (requires generate scope)", {
         id: z.string().uuid().describe("launch ID"),
         platforms: z

package/dist/tools/media.js

@@ -105,7 +105,7 @@ export function registerMediaTools(server, client) {
             return fail(error);
         }
     });
-    server.tool("add_to_media_library", "add photos or videos to the user's media library by public URL (up to 20 at once; a URL already in the library is skipped). Give each a description of what it shows - autopilot chooses media by it; images without one are captioned automatically on autopilot's next run, videos need one.", {
+    server.tool("add_to_media_library", "add photos or videos to the user's media library by public URL (up to 20 at once; a URL already in the library is skipped). Give each a description of what it shows - autopilot chooses media by it; items without one are captioned automatically on autopilot's next run: images from the image, videos from their thumbnail_url. give a video a description or a thumbnail_url, or autopilot cannot choose it.", {
         items: z
             .array(z.object({
             url: z.string().url().describe("public http(s) URL of the image or video"),

package/dist/types.d.ts

@@ -153,6 +153,12 @@ export interface Persona {
     instagram_samples?: unknown[];
     tiktok_samples?: unknown[];
     linkedin_samples?: unknown[];
+    brand_kit?: {
+        text_color?: string;
+        outline_color?: string;
+        logo_url?: string;
+        logo_position?: string;
+    };
     created_at: string;
     updated_at: string;
 }
@@ -335,8 +341,13 @@ export interface Boost {
     impressions: number | null;
     clicks: number | null;
     reach: number | null;
+    link_clicks?: number | null;
     total_spend_cents: number | null;
     failure_reason: string | null;
+    stop_rules?: {
+        max_cpc_cents?: number;
+    };
+    stop_reason?: string | null;
     created_at: string;
     updated_at: string;
     activated_at: string | null;
@@ -357,10 +368,15 @@ export interface AutopilotConfig {
     run_hour: number;
     timezone: string;
     product_url: string | null;
+    product_image_url?: string | null;
     product_brief: string | null;
     content_pillars: string[] | null;
+    directives?: string[] | null;
     min_queue: number;
     max_posts_per_day: number;
+    track_links?: boolean;
+    reuse_media?: boolean;
+    media_source?: "ai" | "library" | "mixed";
     paused: boolean;
     pause_reason: string | null;
     created_at: string;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@jclvsh/dropspace",
-	"version": "2.33.0",
+	"version": "2.34.0",
 	"description": "MCP server and CLI for the Dropspace API",
 	"repository": {
 		"type": "git",

package/skills/dropspace/SKILL.md

@@ -10,7 +10,7 @@ Dropspace turns one brief into per-platform posts and publishes them on the user
 ## Setup
 
 - MCP over stdio: `npx -y -p @jclvsh/dropspace dropspace-mcp` with `DROPSPACE_API_KEY=ds_live_...` in the environment. Every tool is available.
-- Hosted MCP: `https://api.dropspace.dev/mcp` (streamable HTTP, POST, `Authorization: Bearer ds_live_...`). Serves a subset: no credits, boosts, API keys, webhooks, or reddit tools.
+- Hosted MCP: `https://api.dropspace.dev/mcp` (streamable HTTP, POST, `Authorization: Bearer ds_live_...`). Serves a subset: no credits, boosts, API keys, webhooks, reddit, media library, comment, destination, disconnect, profile, or billing tools.
 - CLI: `npx -y @jclvsh/dropspace <command>` (the same key). `dropspace --help` lists commands.
 - No key? The user creates one at https://www.dropspace.dev/settings/api. A key's scopes limit what it can do (`read`, `write`, `generate`, `send`, `admin`); a 403 names the missing scope.
 
@@ -24,20 +24,22 @@ Dropspace turns one brief into per-platform posts and publishes them on the user
 
 1. `create_launch` with `product_url` and/or `product_description` and `platforms`. Dropspace reads the product page and writes copy per platform.
    - Use `platform_contents` or `custom_content` when the user already wrote the copy.
+   - Reddit: `platform_contents.reddit.metadata.subreddits` (up to 10, no `r/`) posts once per subreddit; `metadata.first_comment` (up to 1,500 characters) is posted as a comment under each reddit post once it is live. `suggest_subreddits` finds communities that fit the product.
    - `track_links: true` posts the product URL as a tracked redirect on X, LinkedIn, Facebook, Reddit, and YouTube; clicks then appear in analytics. Tell the user their posts will show a dropspace.dev link.
    - `save_to_library: true` adds the launch's uploaded photos and videos to the user's media library, where autopilot can post them.
    - `scheduled_date` (ISO 8601, at least 15 minutes out) schedules it; without one, the launch waits for `publish_launch`.
 2. Review: `get_launch` shows the generated copy per platform. Show it to the user before publishing anything they have not seen. Edit with `update_launch`; regenerate one platform with `retry_launch_content`.
 3. Media (optional): `generate_media` with `type: "image"` and `use_product_image: true` makes an image of the real product from its page; `get_media_job` polls it. Videos are 8-second clips (`type: "video"` or `"script_video"`).
-4. `publish_launch`, then `get_launch_status` until it settles. Failed platforms: `retry_launch`.
+4. `publish_launch`, then `get_launch_status` until it settles. Failed platforms: `retry_launch`. A launch posted to several subreddits reports them all as `reddit` there; `get_launch_destinations` names each subreddit, and `retry_launch` with `subreddit` retries just that one.
 5. Results: `get_launch_analytics` (or `get_batch_launch_analytics` for many). `metrics.tracked_clicks` is clicks on the tracked link.
+6. Comments (stdio server and CLI only): `list_launch_comments` reads comments per post, newest first. `reply_to_comment` (youtube, instagram), `hide_comment` and `delete_comment` (instagram) act on the platform as the user's account and need the `send` scope; show the user the reply or the comment before you send, hide, or delete. A deleted comment cannot be restored.
 
 ## Ongoing
 
 - Recommendations: `list_recommendations` after posts have run a day or two; `apply_recommendation` turns one into a draft launch, an autopilot post, or a paused boost. Nothing publishes or spends on apply.
 - Autopilot (pro and premium plans): `get_autopilot`, `configure_autopilot`, `run_autopilot_now`. In review mode it drafts posts for approval: `list_autopilot_review`, `approve_autopilot_draft`, `reject_autopilot_draft`.
   - `media_source`: `ai` (generated slides and video), `library` (only the user's own media), or `mixed` (library first). `product_image_url` makes AI slides show the real product.
-  - Media library (stdio server and CLI only): `list_media_library`, `add_to_media_library`, `update_media_library_item`, `delete_media_library_item`. Autopilot chooses items by their description, so describe each one; videos must have one.
+  - Media library (stdio server and CLI only): `list_media_library`, `add_to_media_library`, `update_media_library_item`, `delete_media_library_item`. Autopilot chooses items by their description, so describe each one. Items without one are captioned on autopilot's next run (images from the image, videos from their `thumbnail_url`), so a video needs a description or a thumbnail.
   - Brand kit: `update_persona` with `brand_kit` (text and outline colors, a corner logo) styles the image slides autopilot posts as that persona.
 - Audience: `get_audience` for follower counts on Instagram, TikTok, and YouTube.
 - Webhooks: `create_webhook` with a Slack incoming webhook URL (`https://hooks.slack.com/services/...`) posts events to that channel as readable messages.
@@ -46,7 +48,7 @@ Dropspace turns one brief into per-platform posts and publishes them on the user
 
 These cost the user money. Get an explicit yes for the amount before calling them:
 
-- `activate_boost` starts real ad spend on the user's Meta ad account. `create_boost` makes it paused; activation is the spend. Offer `max_cpc_cents` so the boost pauses itself if clicks get expensive; `objective: "traffic"` needs a Facebook link post.
+- `activate_boost` starts real ad spend on the user's Meta ad account. `create_boost` makes it paused; activation is the spend. Offer `max_cpc_cents` so the boost pauses itself if clicks get expensive; `objective: "traffic"` needs a Facebook link post. A boost reports `link_clicks` (clicks through to the link, for traffic boosts), and `stop_reason` says why a stop rule paused it (null while it runs).
 - `purchase_credit_pack`.
 
 ## Errors that need the user