@nooticr/mcp 1.26.52 → 1.26.54

package/dist/shared/amazon.js

@@ -353,7 +353,7 @@ export function registerAmazonTools(server, makeClient) {
             "the category is wrong. " +
             "Use for a category or a competitive set; for one listing, get_amazon_product is cheaper.",
         annotations: {
-            readOnlyHint: true,
+            readOnlyHint: false,
             destructiveHint: false,
             idempotentHint: false,
             openWorldHint: true,

package/dist/shared/brand-watch.js

@@ -423,7 +423,7 @@ export function registerBrandWatch(server, makeClient) {
             "never widened. A run that turns up nothing new — or, for a competitor watch, nothing above " +
             "median — sends no mail. cadence is hourly, every_6_hours, every_12_hours, daily or weekly, " +
             "and defaults to daily. No cost to call.",
-        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
         inputSchema: z
             .object({
             kind: z
@@ -643,7 +643,7 @@ export function registerBrandWatch(server, makeClient) {
             "names any in platformsSkipped, tell the user those networks are no longer searched and " +
             "offer to remove a term or recreate the watch with a larger budget. A change the budget " +
             "cannot cover at all is refused and nothing changes. No cost to call: no credits are spent.",
-        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false },
         inputSchema: z
             .object({
             watchId: z.string().describe("The portfolio watch's id, from list_brand_watches."),

package/dist/shared/getting-started.js

@@ -26,6 +26,8 @@ export const SERVER_INSTRUCTIONS = [
     "Prices are nooticr credits per fetch and every paid tool states its price in its description. Free: " +
         "nooticr_getting_started, check_nooticr_credits, list_social_connections, watch_creator, unwatch_creator " +
         "and every show_* view, which only draws what you pass it.",
+    "Before a paid call, explain its stated cost and get the user's consent; follow any tool's built-in " +
+        "confirmation flow before proceeding.",
     "Not sure where to start? Call nooticr_getting_started: it is free, reads this account's state, and names " +
         "the next calls worth making with their prices. Good first calls: get_social_media on a post URL " +
         "(1 credit), discover_social_posts on a niche (2), analyze_comments on a post (2).",

package/dist/shared/handoff.js

@@ -362,38 +362,19 @@ export function prepareItem(item, seenIds) {
     };
 }
 /** How to actually file it, named per destination so the model does not guess. */
-function nextStepFor(destination, count) {
+function nextStepFor(_destination, count) {
     const n = `${count} item${count === 1 ? "" : "s"}`;
-    switch (destination) {
-        case "github":
-            return (`Search the repository's issues for each \`searchFirst\` string first — an exact match ` +
-                `means it is already filed and you should comment on that issue instead of opening a ` +
-                `second one. For the rest, call the GitHub server's issue-creation tool with \`title\`, ` +
-                `\`body\` and \`labels\` exactly as given. Do not rewrite the body: the quote is fenced ` +
-                `and framed deliberately. ${n} prepared.`);
-        case "jira":
-            return (`Search the project for each \`searchFirst\` string first, then create an issue per item ` +
-                `with \`title\` as the summary and \`body\` as the description. Jira renders its own ` +
-                `markup — if the project is not markdown-enabled the fence may show literally, which is ` +
-                `acceptable and better than an unfenced quote. Map \`labels\` to Jira labels. ${n} prepared.`);
-        case "linear":
-            return (`Search the team's issues for each \`searchFirst\` string first, then create an issue per ` +
-                `item with \`title\` and \`body\` as given, and \`labels\` as Linear labels (create any ` +
-                `that do not exist rather than dropping them). ${n} prepared.`);
-        default:
-            return (`Each item carries the exact \`title\`, \`body\` and \`labels\` to file, and a ` +
-                `\`searchFirst\` string to look for first so the same report does not land twice. Pass ` +
-                `them to whichever tracker tool this host has connected, unmodified. ${n} prepared.`);
-    }
+    return (`Each item includes a title, body, labels and a search phrase for duplicate checking. ` +
+        `Review the prepared text, then copy it into your chosen issue tracker. No issue is created ` +
+        `by this tool. ${n} prepared.`);
 }
 export function registerHandoff(server) {
     server.registerTool("prepare_handoff", {
         title: "Prepare Handoff",
         description: "Turn items you classified — a bug report in a comment, a complaint said out loud in a " +
-            "video, a feature request under a competitor's post — into the exact text to file in " +
-            "GitHub, Jira or Linear through whichever tracker server this host also has connected. " +
-            "This server files nothing itself and holds no tracker credential; it returns the " +
-            "strings and you make the call. Free, and makes no requests. " +
+            "video, a feature request under a competitor's post — into structured, issue-ready text. " +
+            "This server files nothing; review the result and copy it to your chosen issue tracker. " +
+            "Free, and makes no requests. " +
             "Use it after analyze_comments, search_mentions, answer_my_audience or " +
             "search_spoken_mentions, passing the ids those tools issued. For each item you get a " +
             "title, a ready body with the quote fenced and framed as third-party evidence rather " +

package/dist/shared/jobs.js

@@ -837,7 +837,7 @@ export function registerJobTools(server, makeClient, store) {
             "you follow; analyze_creator_profile is the full teardown of one you do not.",
         annotations: {
             readOnlyHint: false,
-            destructiveHint: false,
+            destructiveHint: true,
             // Moves the "last checked" marker for a watched creator, so the second
             // call in a row does not answer the same question as the first.
             idempotentHint: false,

package/dist/shared/marketplace.js

@@ -257,7 +257,7 @@ export function registerMarketplaceTools(server, makeClient) {
             "For Amazon specifically, scan_amazon_category returns the same shape plus Amazon's own " +
             "review-aspect counts.",
         annotations: {
-            readOnlyHint: true,
+            readOnlyHint: false,
             destructiveHint: false,
             idempotentHint: false,
             openWorldHint: true,

package/dist/shared/own-account.js

@@ -155,7 +155,7 @@ export function registerOwnAccountTools(server, makeClient) {
             "appId (optional when your workspace has only one product); every other field is " +
             "snake_case, the same names create_product takes and for the same reason — the backend " +
             "reads them by exact key. Free — no AI call, just a row.",
-        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: true, openWorldHint: false },
         inputSchema: z
             .object({
             appId: z
@@ -383,7 +383,7 @@ export function registerOwnAccountTools(server, makeClient) {
             return failed(`${name} failed`, err);
         }
     });
-    connectorRead("get_google_analytics", "google_analytics", "Get Google Analytics", "Your own product's Google Analytics (GA4) sync, as of its last sync into nooticr — not a live " +
+    connectorRead("get_google_analytics", "google_analytics", "Read Google Analytics Data", "Your own product's Google Analytics (GA4) sync, as of its last sync into nooticr — not a live " +
         "GA4 call: the property, the date range synced and how many daily rows came in. The metrics " +
         "themselves (installs, opens, purchases, revenue) feed get_post_performance and growth_brief " +
         "rather than being repeated here. Returns a message rather than an error when nothing has " +
@@ -416,7 +416,7 @@ export function registerOwnAccountTools(server, makeClient) {
         // jobId and state: "pending", nothing to draw yet. analyze_product_status,
         // which returns the finished playbook, is where the view belongs — see
         // scripts/host-contract.py's NO_APP entry for this tool.
-        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
         inputSchema: z
             .object({
             appId: z
@@ -571,7 +571,7 @@ export function registerOwnAccountTools(server, makeClient) {
             "get_content_plan) but does not schedule or publish any post. Billed like the dashboard's " +
             "own Content Plan button: your workspace's plan AI credits, not your personal MCP credits.",
         _meta: viewMeta("generate_content_plan"),
-        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
         inputSchema: z
             .object({
             appId: z

package/dist/shared/tools-def.js

@@ -2,7 +2,7 @@ import { z } from "zod";
 export const TOOL_DEFINITIONS = [
     {
         name: "analyze_post",
-        title: "Analyze Post",
+        title: "Inspect Social Media Post",
         description: "Frames sampled evenly across a social post (video, image, carousel/slideshow), returned as real images you can look at, together with the post's transcript, caption and stats. It hands you the material rather than a verdict: read the frames and the words, then work out the hook, the structure, the visual style, the CTA and the audience yourself, citing the frame or line behind each claim. Supports TikTok, Instagram, YouTube, X, Reddit, Douyin, Xiaohongshu, Weibo, Bilibili and LinkedIn. Use when the visuals are the point — framing, editing, on-screen text; analyze_post_fast reads the same post without the frames for one credit less. Fans out to get_post_frames and get_post_transcript: 3 nooticr credits, 2 for the frames plus 1 for the transcript.",
         inputSchema: z.object({ url: z.string().describe("Public post URL (TikTok/Instagram/YouTube/X/Reddit/Douyin/Xiaohongshu/Weibo/Bilibili/LinkedIn).") }).strict(),
     },
@@ -26,7 +26,7 @@ export const TOOL_DEFINITIONS = [
     },
     {
         name: "analyze_creator_profile",
-        title: "Analyze Creator Profile",
+        title: "Research Creator Profile",
         description: "A creator's recent posts with their stats, on TikTok, Instagram, YouTube, Reddit, Douyin, Xiaohongshu, X, Weibo, Bilibili or LinkedIn — the raw material of a profile teardown, for you to read. Work out their niche, content themes, hook formula, strengths and weaknesses, engagement pattern and audience from the spread of the numbers rather than the best post, and name the posts you reason from. find_hook_pattern fetches the same posts and asks only for the formula. Costs 2 nooticr credits, for the one get_user_posts call it makes.",
         inputSchema: z.object({ username: z.string().describe("Creator handle, e.g. 'zoundsapp'."), platform: z.enum(["tiktok", "instagram", "youtube", "douyin", "xiaohongshu", "twitter", "bilibili", "reddit", "weibo"]).optional().describe("Which platform (default tiktok)."), limit: z.number().int().optional().describe("Posts to fetch (default 6; first 3 analyzed)."), focus: z.string().optional().describe("Extra instruction for the profile synthesis.") }).strict(),
     },
@@ -80,13 +80,13 @@ export const TOOL_DEFINITIONS = [
     },
     {
         name: "analyze_comments",
-        title: "Analyze Comments",
+        title: "Summarize Post Comments",
         description: "A post's comment section, fetched and laid out for you to classify: every comment with a stable id, plus whatever themes the platform clustered them into. Label each one's sentiment and what it is doing — praise, complaint, bug report, question, request, comparison, spam — then summarise the themes, the questions worth answering, the objections, and what to make next. The result names the exact labels, and show_comment_review draws them for free afterwards. Use when the goal is 'what should I make next' rather than 'what did people write'. Costs 2 nooticr credits, for the one get_post_comments call it makes.",
         inputSchema: z.object({ url: z.string().describe("Full public post URL."), limit: z.number().int().optional().describe("Comments to read (default 50, max 100)."), verbatim: z.boolean().optional().describe("Render every comment whole in the text you read (default false).") }).strict(),
     },
     {
         name: "compare_posts",
-        title: "Compare Posts",
+        title: "Compare Social Post Performance",
         description: "The first of 2-5 posts you want compared, fetched with its stats — and the comparison left to you. Call get_social_media on each remaining URL yourself (1 credit each), and get_post_transcript where the wording matters, then say which won, what actually differed (hook, format, length, caption, hashtags), what they share worth keeping, and the one experiment that would test your explanation. Use for 'why did this one work and that one not'. Costs 1 nooticr credit for this call, plus 1 per further post you fetch.",
         inputSchema: z.object({ urls: z.array(z.string()).describe("2-5 post URLs to compare.") }).strict(),
     },
@@ -98,31 +98,31 @@ export const TOOL_DEFINITIONS = [
     },
     {
         name: "analyze_post_fast",
-        title: "Analyze Post (Fast)",
+        title: "Quick Social Post Analysis",
         description: "A post's transcript, caption and stats, with no frames — which is what makes it the cheap read. Work out the hook, the script structure, the CTA and the audience from the words and the numbers yourself, and say plainly that you have not seen the visuals. Use this by default; call analyze_post when a judgement actually needs the frames. Fans out to get_social_media and get_post_transcript: 2 nooticr credits, 1 each.",
         inputSchema: z.object({ url: z.string().describe("Full public post URL.") }).strict(),
     },
     {
         name: "write_hooks",
-        title: "Write Hooks",
+        title: "Generate Hooks from a Post",
         description: "The source post, its transcript and its stats, so you can write the opening lines yourself — the first line said or shown on screen. Name the device each hook uses and who it stops; one that could open any video in the niche is not grounded in this one. Use when you know the subject and need openings to choose between. With a url it fetches get_social_media and get_post_transcript for 2 nooticr credits; with only a topic there is nothing to fetch and it costs nothing.",
         inputSchema: z.object({ url: z.string().optional().describe("Post to riff on (optional if topic given)."), topic: z.string().optional().describe("Subject to write hooks about (optional if url given)."), count: z.number().int().optional().describe("How many hooks (default 10, max 20)."), tone: z.string().optional().describe("Optional tone, e.g. 'blunt', 'contrarian'.") }).strict(),
     },
     {
         name: "create_variants",
-        title: "Create Variants",
+        title: "Generate Post Variants",
         description: "The post that worked, with its transcript and stats, so you can propose what to film next — same underlying mechanism, different execution. For each variant give the hook, the one angle that changes, the shot beats in order and the CTA, and say what made the original work. Use after reading a post to move from 'why it worked' to 'what to make'. Fans out to get_social_media and get_post_transcript: 2 nooticr credits, 1 each.",
         inputSchema: z.object({ url: z.string().describe("The post to make variants of."), count: z.number().int().optional().describe("How many variants (default 3, max 6)."), angle: z.string().optional().describe("Optional steer, e.g. 'for a beginner audience'.") }).strict(),
     },
     {
         name: "score_draft",
-        title: "Score Draft",
+        title: "Score a Social Media Draft",
         description: "Score your own draft BEFORE you film or post it. Returns the draft with the rubric to hold it to — hook, clarity, payoff, specificity and fit, each scored 1-10 — and asks you for the three fixes that would move it most, one rewritten opening line and a tightened version. The only tool that runs before the content exists. Use before filming, while changing it is still cheap. Free: it fetches nothing, so it costs no credits.",
         inputSchema: z.object({ draft: z.string().describe("Your script, caption or hook."), platform: z.string().optional().describe("Target platform (default tiktok).") }).strict(),
     },
     {
         name: "repurpose_post",
-        title: "Repurpose Post",
+        title: "Adapt a Post for Another Platform",
         description: "The source post, its transcript and its stats, for you to rewrite for other surfaces — X thread, LinkedIn post, carousel slides, YouTube title/description, newsletter — keeping the argument and changing the shape to suit how each is read. The same paragraph with different line breaks is not a repurposing. Use when a post already worked and you want it on other surfaces. Fans out to get_social_media and get_post_transcript: 2 nooticr credits, 1 each.",
         inputSchema: z.object({ url: z.string().describe("The post to repurpose."), targets: z.array(z.string()).optional().describe("Which formats to produce (default all).") }).strict(),
     },
@@ -338,7 +338,7 @@ export const TOOL_DEFINITIONS = [
     },
     {
         name: "get_google_analytics",
-        title: "Get Google Analytics",
+        title: "Read Google Analytics Data",
         description: "Your own product's Google Analytics (GA4) sync, as of its last sync into nooticr — not a live GA4 call: the property, the date range synced and how many daily rows came in. Connect GA4 in API Connections first. No cost to call.",
         inputSchema: z.object({ appId: z.number().int().optional().describe("Your product's id. Omit only with a single-app workspace.") }).strict(),
     },

package/dist/shared/tools.js

@@ -30,7 +30,7 @@ import { registerCollabTools } from "./collab.js";
 import { registerAmazonTools } from "./amazon.js";
 import { registerMarketplaceTools } from "./marketplace.js";
 /** Current MCP server version — bumped on every deploy for traceability. */
-export const MCP_SERVER_VERSION = "1.26.52";
+export const MCP_SERVER_VERSION = "1.26.54";
 /** MCP Apps extension identifier */
 const UI_EXTENSION = "io.modelcontextprotocol/ui";
 /** MIME type for MCP Apps HTML resources */
@@ -104,7 +104,9 @@ function appsSdkContents(uri, media, links, tool = "") {
         _meta: {
             "openai/widgetPrefersBorder": false,
             "openai/widgetCSP": {
-                connect_domains: media,
+                // The widget communicates through the host bridge and needs no direct
+                // network connections. Remote origins are limited to rendered resources.
+                connect_domains: [],
                 resource_domains: media,
                 redirect_domains: links,
             },
@@ -852,7 +854,7 @@ export function createMcpServer(rawMakeClient, opts) {
                         // Thumbnails and video come from our own origin and the platform CDNs.
                         // Without these the widget loads and then paints nothing at all.
                         "openai/widgetCSP": {
-                            connect_domains: domains,
+                            connect_domains: [],
                             resource_domains: domains,
                             redirect_domains: PLATFORM_LINK_DOMAINS,
                         },
@@ -889,7 +891,7 @@ export function createMcpServer(rawMakeClient, opts) {
         });
     }
     registerSlowTool(server, "analyze_post", {
-        title: "Analyze Post",
+        title: "Inspect Social Media Post",
         description: "Frames sampled evenly across a social post (video, image, carousel/slideshow), returned as " +
             "real images you can look at, together with the post's transcript, caption and stats. " +
             "This is the material an analysis is built from, not an analysis: read the frames and the " +
@@ -1033,7 +1035,7 @@ export function createMcpServer(rawMakeClient, opts) {
         }
     });
     registerSlowTool(server, "analyze_creator_profile", {
-        title: "Analyze Creator Profile",
+        title: "Research Creator Profile",
         description: "A creator's recent posts with their stats, on TikTok, Instagram, YouTube, Reddit, Douyin, " +
             "Xiaohongshu, X, Weibo, Bilibili or LinkedIn — the raw material of a profile teardown. " +
             "Work out their niche, recurring themes, hook formula, what over- and under-performs and who " +
@@ -1439,7 +1441,7 @@ export function createMcpServer(rawMakeClient, opts) {
         }
     });
     server.registerTool("analyze_comments", {
-        title: "Analyze Comments",
+        title: "Summarize Post Comments",
         description: "A post's comment section, fetched and laid out for you to classify: every comment with a " +
             "stable id, plus whatever themes the platform clustered them into. Label each one's sentiment " +
             "and what it is doing — praise, complaint, bug report, question, request, comparison, spam — " +
@@ -2061,7 +2063,7 @@ export function createMcpServer(rawMakeClient, opts) {
         };
     });
     server.registerTool("compare_posts", {
-        title: "Compare Posts",
+        title: "Compare Social Post Performance",
         description: "The first of 2-5 posts you want compared, fetched with its stats — and the comparison left " +
             "to you. Call get_social_media on each remaining URL yourself (1 credit each), plus " +
             "get_post_transcript where the wording matters, then say which won, what actually differed " +
@@ -2178,7 +2180,7 @@ export function createMcpServer(rawMakeClient, opts) {
         }
     });
     server.registerTool("analyze_post_fast", {
-        title: "Analyze Post (Fast)",
+        title: "Quick Social Post Analysis",
         description: "A post's transcript, caption and stats, with no frames — which is what makes it the cheap " +
             "read. Work out the hook, the script structure, the CTA and the audience from the words and " +
             "the numbers yourself, and say plainly that you have not seen the visuals. " +
@@ -2208,7 +2210,7 @@ export function createMcpServer(rawMakeClient, opts) {
         }
     });
     server.registerTool("write_hooks", {
-        title: "Write Hooks",
+        title: "Generate Hooks from a Post",
         description: "The source post, its transcript and its stats, so you can write the opening lines yourself — " +
             "the first line said or shown on screen. For each hook you write, name the device it uses and " +
             "who it stops; a hook that could open any video in the niche is not grounded in this one. " +
@@ -2242,7 +2244,7 @@ export function createMcpServer(rawMakeClient, opts) {
         }
     });
     server.registerTool("create_variants", {
-        title: "Create Variants",
+        title: "Generate Post Variants",
         description: "The post that worked, with its transcript and stats, so you can propose what to film next: " +
             "for each variant, the hook, the one angle that changes, the shot beats in order and the CTA. " +
             "Keep whatever made the original work and say what that was. " +
@@ -2274,7 +2276,7 @@ export function createMcpServer(rawMakeClient, opts) {
         }
     });
     server.registerTool("score_draft", {
-        title: "Score Draft",
+        title: "Score a Social Media Draft",
         description: "Score your own draft BEFORE you film or post it. Returns the draft alongside the rubric to " +
             "hold it to — hook, clarity, payoff, specificity and fit, each scored 1-10 — and asks you for " +
             "the three fixes that would move it most, one rewritten opening line and a tightened version. " +
@@ -2319,7 +2321,7 @@ export function createMcpServer(rawMakeClient, opts) {
         };
     });
     server.registerTool("repurpose_post", {
-        title: "Repurpose Post",
+        title: "Adapt a Post for Another Platform",
         description: "The source post, its transcript and its stats, for you to rewrite for other surfaces — X " +
             "thread, LinkedIn post, carousel slides, YouTube title/description, newsletter. Each surface " +
             "has its own length, register and conventions: the same paragraph with different line breaks " +

package/dist/shared/watchlist.js

@@ -564,7 +564,7 @@ export function registerWatchlist(server, makeClient, store) {
             "snapshot forward — so this answers 'what is new' rather than 'what exists'. The first run " +
             "for a creator has nothing to compare against and just records the baseline. " +
             "Consumes 2 nooticr credits per creator checked.",
-        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: true },
         inputSchema: z
             .object({
             limit: z.number().int().optional().describe("Posts to check per creator (default 6)."),

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nooticr/mcp",
   "mcpName": "com.nooticr/mcp",
-  "version": "1.26.52",
+  "version": "1.26.54",
   "description": "MCP server for nooticr - fetch, discover and understand TikTok/Instagram/YouTube/X/Reddit/LinkedIn/Weibo posts with AI (media metadata, niche discovery, brand monitoring, hook & viral analysis)",
   "homepage": "https://mcp.nooticr.com",
   "repository": {