@nooticr/mcp 1.26.52 → 1.26.53

package/dist/shared/amazon.js

@@ -353,7 +353,7 @@ export function registerAmazonTools(server, makeClient) {
             "the category is wrong. " +
             "Use for a category or a competitive set; for one listing, get_amazon_product is cheaper.",
         annotations: {
-            readOnlyHint: true,
+            readOnlyHint: false,
             destructiveHint: false,
             idempotentHint: false,
             openWorldHint: true,

package/dist/shared/brand-watch.js

@@ -423,7 +423,7 @@ export function registerBrandWatch(server, makeClient) {
             "never widened. A run that turns up nothing new — or, for a competitor watch, nothing above " +
             "median — sends no mail. cadence is hourly, every_6_hours, every_12_hours, daily or weekly, " +
             "and defaults to daily. No cost to call.",
-        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
         inputSchema: z
             .object({
             kind: z
@@ -643,7 +643,7 @@ export function registerBrandWatch(server, makeClient) {
             "names any in platformsSkipped, tell the user those networks are no longer searched and " +
             "offer to remove a term or recreate the watch with a larger budget. A change the budget " +
             "cannot cover at all is refused and nothing changes. No cost to call: no credits are spent.",
-        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false },
         inputSchema: z
             .object({
             watchId: z.string().describe("The portfolio watch's id, from list_brand_watches."),

package/dist/shared/getting-started.js

@@ -26,6 +26,8 @@ export const SERVER_INSTRUCTIONS = [
     "Prices are nooticr credits per fetch and every paid tool states its price in its description. Free: " +
         "nooticr_getting_started, check_nooticr_credits, list_social_connections, watch_creator, unwatch_creator " +
         "and every show_* view, which only draws what you pass it.",
+    "Before a paid call, explain its stated cost and get the user's consent; follow any tool's built-in " +
+        "confirmation flow before proceeding.",
     "Not sure where to start? Call nooticr_getting_started: it is free, reads this account's state, and names " +
         "the next calls worth making with their prices. Good first calls: get_social_media on a post URL " +
         "(1 credit), discover_social_posts on a niche (2), analyze_comments on a post (2).",

package/dist/shared/handoff.js

@@ -362,38 +362,19 @@ export function prepareItem(item, seenIds) {
     };
 }
 /** How to actually file it, named per destination so the model does not guess. */
-function nextStepFor(destination, count) {
+function nextStepFor(_destination, count) {
     const n = `${count} item${count === 1 ? "" : "s"}`;
-    switch (destination) {
-        case "github":
-            return (`Search the repository's issues for each \`searchFirst\` string first — an exact match ` +
-                `means it is already filed and you should comment on that issue instead of opening a ` +
-                `second one. For the rest, call the GitHub server's issue-creation tool with \`title\`, ` +
-                `\`body\` and \`labels\` exactly as given. Do not rewrite the body: the quote is fenced ` +
-                `and framed deliberately. ${n} prepared.`);
-        case "jira":
-            return (`Search the project for each \`searchFirst\` string first, then create an issue per item ` +
-                `with \`title\` as the summary and \`body\` as the description. Jira renders its own ` +
-                `markup — if the project is not markdown-enabled the fence may show literally, which is ` +
-                `acceptable and better than an unfenced quote. Map \`labels\` to Jira labels. ${n} prepared.`);
-        case "linear":
-            return (`Search the team's issues for each \`searchFirst\` string first, then create an issue per ` +
-                `item with \`title\` and \`body\` as given, and \`labels\` as Linear labels (create any ` +
-                `that do not exist rather than dropping them). ${n} prepared.`);
-        default:
-            return (`Each item carries the exact \`title\`, \`body\` and \`labels\` to file, and a ` +
-                `\`searchFirst\` string to look for first so the same report does not land twice. Pass ` +
-                `them to whichever tracker tool this host has connected, unmodified. ${n} prepared.`);
-    }
+    return (`Each item includes a title, body, labels and a search phrase for duplicate checking. ` +
+        `Review the prepared text, then copy it into your chosen issue tracker. No issue is created ` +
+        `by this tool. ${n} prepared.`);
 }
 export function registerHandoff(server) {
     server.registerTool("prepare_handoff", {
         title: "Prepare Handoff",
         description: "Turn items you classified — a bug report in a comment, a complaint said out loud in a " +
-            "video, a feature request under a competitor's post — into the exact text to file in " +
-            "GitHub, Jira or Linear through whichever tracker server this host also has connected. " +
-            "This server files nothing itself and holds no tracker credential; it returns the " +
-            "strings and you make the call. Free, and makes no requests. " +
+            "video, a feature request under a competitor's post — into structured, issue-ready text. " +
+            "This server files nothing; review the result and copy it to your chosen issue tracker. " +
+            "Free, and makes no requests. " +
             "Use it after analyze_comments, search_mentions, answer_my_audience or " +
             "search_spoken_mentions, passing the ids those tools issued. For each item you get a " +
             "title, a ready body with the quote fenced and framed as third-party evidence rather " +

package/dist/shared/jobs.js

@@ -837,7 +837,7 @@ export function registerJobTools(server, makeClient, store) {
             "you follow; analyze_creator_profile is the full teardown of one you do not.",
         annotations: {
             readOnlyHint: false,
-            destructiveHint: false,
+            destructiveHint: true,
             // Moves the "last checked" marker for a watched creator, so the second
             // call in a row does not answer the same question as the first.
             idempotentHint: false,

package/dist/shared/marketplace.js

@@ -257,7 +257,7 @@ export function registerMarketplaceTools(server, makeClient) {
             "For Amazon specifically, scan_amazon_category returns the same shape plus Amazon's own " +
             "review-aspect counts.",
         annotations: {
-            readOnlyHint: true,
+            readOnlyHint: false,
             destructiveHint: false,
             idempotentHint: false,
             openWorldHint: true,

package/dist/shared/own-account.js

@@ -155,7 +155,7 @@ export function registerOwnAccountTools(server, makeClient) {
             "appId (optional when your workspace has only one product); every other field is " +
             "snake_case, the same names create_product takes and for the same reason — the backend " +
             "reads them by exact key. Free — no AI call, just a row.",
-        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false },
         inputSchema: z
             .object({
             appId: z
@@ -416,7 +416,7 @@ export function registerOwnAccountTools(server, makeClient) {
         // jobId and state: "pending", nothing to draw yet. analyze_product_status,
         // which returns the finished playbook, is where the view belongs — see
         // scripts/host-contract.py's NO_APP entry for this tool.
-        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
         inputSchema: z
             .object({
             appId: z
@@ -571,7 +571,7 @@ export function registerOwnAccountTools(server, makeClient) {
             "get_content_plan) but does not schedule or publish any post. Billed like the dashboard's " +
             "own Content Plan button: your workspace's plan AI credits, not your personal MCP credits.",
         _meta: viewMeta("generate_content_plan"),
-        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
         inputSchema: z
             .object({
             appId: z

package/dist/shared/tools.js

@@ -30,7 +30,7 @@ import { registerCollabTools } from "./collab.js";
 import { registerAmazonTools } from "./amazon.js";
 import { registerMarketplaceTools } from "./marketplace.js";
 /** Current MCP server version — bumped on every deploy for traceability. */
-export const MCP_SERVER_VERSION = "1.26.52";
+export const MCP_SERVER_VERSION = "1.26.53";
 /** MCP Apps extension identifier */
 const UI_EXTENSION = "io.modelcontextprotocol/ui";
 /** MIME type for MCP Apps HTML resources */
@@ -104,7 +104,9 @@ function appsSdkContents(uri, media, links, tool = "") {
         _meta: {
             "openai/widgetPrefersBorder": false,
             "openai/widgetCSP": {
-                connect_domains: media,
+                // The widget communicates through the host bridge and needs no direct
+                // network connections. Remote origins are limited to rendered resources.
+                connect_domains: [],
                 resource_domains: media,
                 redirect_domains: links,
             },
@@ -852,7 +854,7 @@ export function createMcpServer(rawMakeClient, opts) {
                         // Thumbnails and video come from our own origin and the platform CDNs.
                         // Without these the widget loads and then paints nothing at all.
                         "openai/widgetCSP": {
-                            connect_domains: domains,
+                            connect_domains: [],
                             resource_domains: domains,
                             redirect_domains: PLATFORM_LINK_DOMAINS,
                         },

package/dist/shared/watchlist.js

@@ -564,7 +564,7 @@ export function registerWatchlist(server, makeClient, store) {
             "snapshot forward — so this answers 'what is new' rather than 'what exists'. The first run " +
             "for a creator has nothing to compare against and just records the baseline. " +
             "Consumes 2 nooticr credits per creator checked.",
-        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
         inputSchema: z
             .object({
             limit: z.number().int().optional().describe("Posts to check per creator (default 6)."),

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nooticr/mcp",
   "mcpName": "com.nooticr/mcp",
-  "version": "1.26.52",
+  "version": "1.26.53",
   "description": "MCP server for nooticr - fetch, discover and understand TikTok/Instagram/YouTube/X/Reddit/LinkedIn/Weibo posts with AI (media metadata, niche discovery, brand monitoring, hook & viral analysis)",
   "homepage": "https://mcp.nooticr.com",
   "repository": {