@nooticr/mcp 1.26.55 → 1.26.57

package/README.md

@@ -52,7 +52,7 @@ npx @nooticr/mcp login   # one-time sign-in (Google)
 
 ## Tools
 
-88 tools, grouped by what you are trying to do. Prices are in nooticr credits and
+90 tools, grouped by what you are trying to do. Prices are in nooticr credits and
 match what the server actually charges.
 
 The job tools under **Answer a question you actually have** are not
@@ -113,7 +113,7 @@ them caps that fan-out with an argument.
 
 | Tool | Credits | What it is for |
 |------|---------|----------------|
-| `answer_my_audience` | 2 + 2 per post opened (14 by default) | **The mirror of `search_mentions`.** The questions waiting under your *own* posts: recent posts fetched, comments read on each, grouped under the post they were left on, every comment with a stable id, and the ones that read like questions or requests flagged and sorted to the top. It finds and drafts — it cannot post a reply: nooticr does not post comments on any network, even where a connection's grant allows managing them. `limit` caps how many posts are opened, which is the price. |
+| `answer_my_audience` | 2 + 2 per post opened (14 by default) | **The mirror of `search_mentions`.** The questions waiting under your *own* posts: recent posts fetched, comments read on each, grouped under the post they were left on, every comment with a stable id, and the ones that read like questions or requests flagged and sorted to the top. It finds and drafts — it cannot post a reply. This tool never sends anything; a reply is posted only if you then ask for it, on your connected account, after you confirm the exact text. `limit` caps how many posts are opened, which is the price. |
 | `prepare_handoff` | free | **The hand-off to your tracker.** Turns items you classified — a bug report in a comment, a complaint said out loud in a video — into the exact `title`, `body` and `labels` to file through whichever GitHub, Jira or Linear MCP server the host also has connected. nooticr files nothing and holds no tracker credential. The body carries the quote fenced and framed as a third-party report rather than as instructions, because the issue is read next by a coding agent; contact details are redacted, `@handles` and `#numbers` are defanged so filing notifies nobody by accident, and a `searchFirst` string dedupes a second sweep against the first. Makes no requests. |
 | `show_audience_replies` | free | Lays your drafts out for a person to work through, grouped under the post, each with what you decided to do about it. Sends nothing; fetches nothing. |
 | `show_standings` | free | Draws the standings your model read out of `compare_creators` or `watchlist_standings` — one row per creator, with the window and the median it was scored against. `ranking` records which axis you ordered on, and `tooThin` draws a creator with too short a window as unranked rather than last: missing from a comparison is not the same as losing it. Makes no requests. |
@@ -173,6 +173,8 @@ a `scanId` for the rest.
 |------|---------|----------------|
 | `nooticr_getting_started` | free | **Start here.** Where this account stands — balance, connected accounts, watchlist — and the next calls worth making, each with its price and an example. The server's `instructions` point every host at it. |
 | `check_nooticr_credits` | free | Balance and billing URL. |
+| `nooticr_settings_read` | free | Read your default social platform and result count. |
+| `nooticr_settings_update` | free | Save the default platform and result count used by supported searches when arguments are omitted. |
 | `list_tool_runs` | free | Your tool-call history: what ran, whether it worked, and the credits each call actually took (0 for a free, refunded, cached or replayed call). `scope: "workspace"` shows every member's runs to owners and admins. |
 | `get_tool_run` | free | One run from that history by id, with its full error. |
 | `get_usage_report` | free | The run ledger added up over a window: total calls, failures and credits actually taken, per tool, per day and the most recent failures. `scope: "workspace"` adds one row per seat, for the workspace's owners and admins. |
@@ -636,6 +638,10 @@ and text** posts.
 See [docs/SUBMISSION.md](docs/SUBMISSION.md) for ready-to-paste configs and the submission
 package for **Claude Desktop**, **Cursor**, and **OpenAI Agents SDK**.
 
+The official MCP registry entry `com.nooticr/mcp` must equal `server.json`'s version after each
+release; see [docs/registry-publishing.md](docs/registry-publishing.md) for the drift check
+(`npm run registry:check`) and the publish script (`npm run registry:publish`).
+
 ## Security notes
 
 - The credentials file is written with mode `0600` and the directory with

package/dist/index.js

@@ -414,6 +414,23 @@ export async function runApiKey(opts) {
                 "the key it returns is what every run afterwards uses.");
     }
     const client = new NooticrClient(baseUrl, createManagementTokenProvider(auth));
+    // Who, and where. A key is scoped to one account on one server, and both
+    // are easy to get wrong without noticing: the credentials file holds
+    // whoever last ran `login` on this machine, and NOOTICR_BASE_URL defaults
+    // to production. A key minted against one pair and looked for in another
+    // is simply absent, with nothing anywhere saying why — which is exactly how
+    // this was first reported.
+    let account = "an unknown account";
+    try {
+        const me = await client.me();
+        if (me?.email)
+            account = me.email;
+    }
+    catch {
+        // Not worth failing the command over; the operation below will fail with
+        // a better message if the credential is genuinely bad.
+    }
+    const scope = `${account} on ${baseUrl}`;
     if (opts.action === "create") {
         const created = await client.createApiKey({
             ...(opts.name !== undefined ? { name: opts.name } : {}),
@@ -424,7 +441,7 @@ export async function runApiKey(opts) {
             process.stdout.write(`${JSON.stringify(created, null, 2)}\n`);
             return;
         }
-        process.stdout.write(`Created API key "${created.name}" (${created.id}).\n\n` +
+        process.stdout.write(`Created API key "${created.name}" (${created.id}) for ${scope}.\n\n` +
             `  ${created.key}\n\n` +
             "This is the only time the key is shown — nooticr stores a hash of it and\n" +
             "cannot show it again. Store it wherever this deployment keeps its secrets,\n" +
@@ -441,10 +458,11 @@ export async function runApiKey(opts) {
             return;
         }
         if (keys.length === 0) {
-            process.stdout.write("No API keys. Create one with `npx nooticr-mcp api-key create --name <name>`.\n");
+            process.stdout.write(`No API keys for ${scope}.\n` +
+                "Create one with `npx nooticr-mcp api-key create --name <name>`.\n");
             return;
         }
-        process.stdout.write(`${keys.map(describeKey).join("\n\n")}\n`);
+        process.stdout.write(`Keys for ${scope}:\n\n${keys.map(describeKey).join("\n\n")}\n`);
         return;
     }
     if (!opts.id) {
@@ -455,7 +473,7 @@ export async function runApiKey(opts) {
         process.stdout.write(`${JSON.stringify({ id: opts.id, revoked: true }, null, 2)}\n`);
         return;
     }
-    process.stdout.write(`Revoked ${opts.id}. Any server still presenting it now gets a 401.\n`);
+    process.stdout.write(`Revoked ${opts.id} for ${scope}. Any server still presenting it now gets a 401.\n`);
 }
 // ---------------------------------------------------------------------------
 // CLI

package/dist/shared/amazon.js

@@ -177,7 +177,15 @@ export function categoryGuidance(opts) {
     // commonest reason is a query in a language that storefront does not sell
     // in. Said here rather than only in the tool description because by the time
     // this is read the description is long out of the model's attention.
-    if (opts.products === 0 && opts.complete) {
+    if (opts.status === "degraded") {
+        lines.push(`DEGRADED SCAN: ${site} could not be read properly right now, so this is not a finding ` +
+            `about the category and not evidence that nothing sells there. ` +
+            (opts.notice
+                ? `Tell the user this, verbatim: "${opts.notice}". `
+                : `Tell the user the site is currently unavailable. `) +
+            `Do not retry with other queries and do not call the category empty.`);
+    }
+    else if (opts.products === 0 && opts.complete) {
         lines.push(`No listings came back. This is not a finding about the category — it is a search that ` +
             `matched nothing. Before reporting it: check the query is in the language that ` +
             `storefront sells in, try the common shopper's word for the thing rather than a ` +
@@ -190,6 +198,10 @@ export function categoryGuidance(opts) {
     // caveat changes what it writes.
     if (opts.freshness)
         lines.push(opts.freshness);
+    if (opts.siteStatus && opts.status !== "degraded") {
+        lines.push(`Caveat: the ${site} collector is currently ${opts.siteStatus}, so this data may be ` +
+            `partial. Say so when you report it.`);
+    }
     if (polling) {
         lines.push(`Stop polling only if ${statusTool} reports status "failed", or returns the same number of ` +
             `listings three calls in a row. Then write the read from what was collected and say plainly ` +

package/dist/shared/backend-only.js

@@ -20,5 +20,9 @@ export const BACKEND_ONLY_TOOLS = {
     schedule_post: "Rendering and publishing stay in the dashboard (#92).",
     get_batch_history: "History of the dashboard's compose batches, which only exist once rendering does; stays with #92.",
     get_latest_analysis: "Returns the dashboard's stored AI fleet-analysis verdict; the public surface sells the evidence, not a judgement of ours.",
+    propose_listing_update: "Commerce writes (nooticr-server C1 3/4) stay in the dashboard until exposing store writes to hosts is a product decision. connect_store and list_store_products, the C1 read pair, are undecided and want settling together with these.",
+    apply_listing_update: "Commerce writes (nooticr-server C1 3/4) stay in the dashboard until exposing store writes to hosts is a product decision; applying a change edits the merchant's live store.",
+    propose_price_change: "Commerce writes (nooticr-server C1 3/4) stay in the dashboard until exposing store writes to hosts is a product decision.",
+    apply_price_change: "Commerce writes (nooticr-server C1 3/4) stay in the dashboard until exposing store writes to hosts is a product decision; applying a change edits the merchant's live prices.",
     brand_watch_history: "Not a deliberate exclusion: a candidate for the public surface once it has a trend view to draw. Listed so it reads as pending, not forgotten.",
 };

package/dist/shared/connections.js

@@ -68,20 +68,27 @@ export function registerConnectionTools(server, makeClient) {
             "or product — omit both and this picks the only one if there is just one, or lists the " +
             "choices if there is more than one. The user approves at the provider; nothing is " +
             "connected until they do, and no credential ever passes through this tool. Each call " +
-            "mints a fresh link, so do not reuse an old one. No cost to call.",
+            "mints a fresh link, so do not reuse an old one. For YouTube, pass capabilities " +
+            "[\"manage_comments\"] to also ask for the comment-management grant. No cost to call.",
         annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
         inputSchema: z
             .object({
             platform: z.string().describe("Which network to connect, e.g. tiktok, youtube."),
             influencerId: z.number().int().optional().describe("Which creator profile — call list_own_apps or list_social_connections first if unsure."),
             appId: z.number().int().optional().describe("Which product this connection is for."),
+            capabilities: z
+                .array(z.enum(["manage_comments"]))
+                .optional()
+                .describe("Extra access to ask for. YouTube only: [\"manage_comments\"] asks for the comment-management grant. Omit for the default."),
         })
             .strict(),
         outputSchema: OUTPUT_SCHEMAS.connect_social_account,
     }, async (args, extra) => {
         const client = await makeClient({ ...extra, arguments: args });
         try {
-            return toResult(await client.callTool("connect_social_account", args));
+            // Forward capabilities only when supplied, so a plain call is unchanged.
+            const { capabilities, ...rest } = args;
+            return toResult(await client.callTool("connect_social_account", capabilities ? { ...rest, capabilities } : rest));
         }
         catch (err) {
             return failed("connect_social_account failed", err);

package/dist/shared/jobs.js

@@ -320,9 +320,8 @@ function audienceGuidance(a) {
             "ones asking the same thing: a single pinned reply beats twenty individual ones, and a " +
             "question that recurs across posts is a video rather than a reply.",
         "",
-        "You are drafting, not sending. nooticr does not post comments on any network — even a " +
-            "connection whose grant allows managing comments is never used to send one — so these are " +
-            "for the creator to paste in themselves. Say that rather than implying the replies will go out.",
+        "You are drafting, not sending. this tool cannot post: nothing is sent from here, and a reply is posted only " +
+            "after the creator confirms its exact text. Say that rather than implying the replies will go out.",
         "",
         "Do not invent facts about the product, the price or the creator's plans to fill a gap. If a " +
             "comment cannot be answered from what is here, say what you would need.",
@@ -633,9 +632,8 @@ export function registerJobTools(server, makeClient, store) {
             "reads the comments on each, and returns them grouped under the post they were left on — " +
             "every comment with a stable id, and the ones that look like questions or requests " +
             "flagged and sorted to the top. This FINDS and helps you DRAFT answers; it cannot post " +
-            "them: nooticr does not post replies on any network, even where list_social_connections " +
-            "reports that a connection can manage comments, so the replies are for a person to paste " +
-            "in themselves — never promise the user they will be sent. `since` filters on the POST's date, not the comments'. `limit` caps how many " +
+            "them: this tool sends nothing, and a reply is only ever posted after the user confirms its " +
+            "exact text — never promise the user a reply will go out on its own. `since` filters on the POST's date, not the comments'. `limit` caps how many " +
             "posts are opened. Pair it with show_audience_replies to lay the drafts out for triage. " +
             "Costs 2 nooticr credits for the post list plus 2 per post opened — 14 credits at the " +
             "default of 6 posts. Use when the job is to answer people; search_mentions is for what " +
@@ -1631,8 +1629,8 @@ export function registerJobTools(server, makeClient, store) {
         _meta: viewMeta("show_audience_replies"),
         description: "Lay out the replies you drafted from answer_my_audience so a person can read them. " +
             "Free, and makes no requests — it only draws what you pass it. It does NOT send " +
-            "anything: nooticr does not post comments, whatever a connection allows, so each row is a draft for the " +
-            "creator to copy into the app themselves. Each comment shows with what you decided to do " +
+            "anything: each row is a draft, and a reply is posted only after the creator confirms its " +
+            "exact text. Each comment shows with what you decided to do " +
             "about it and your draft underneath, grouped under its post, so they can work through " +
             "them one at a time and skip the rest. Call this after you have drafted the replies, not " +
             "instead of drafting them.",
@@ -1660,7 +1658,7 @@ export function registerJobTools(server, makeClient, store) {
                 draft: z
                     .string()
                     .optional()
-                    .describe("The reply, in the creator's voice, for them to paste in themselves."),
+                    .describe("The reply, in the creator's voice. It is only a draft: nothing is posted until the creator confirms its exact text."),
                 kind: z
                     .enum(["answer", "pin", "make_a_video", "escalate", "ignore"])
                     .optional()

package/dist/shared/loading-plans.js

@@ -67,6 +67,8 @@ const CREATOR_UNIT = {
  * generic grey box that said "Working".
  */
 export const LOADING_PLANS = {
+    nooticr_settings_read: { label: "Reading your research defaults", kind: "text", n: 0, steps: [], free: true },
+    nooticr_settings_update: { label: "Saving your research defaults", kind: "text", n: 0, steps: [], free: true },
     // ─── Read a post ───
     get_social_media: { label: "Fetching the post", kind: "post", n: 1, steps: [step("get_social_media")] },
     get_post_transcript: {

package/dist/shared/marketplace.js

@@ -164,6 +164,17 @@ function toolError(what, err) {
     return { isError: true, content: [{ type: "text", text: `${what}: ${message}` }] };
 }
 const num = (v) => (typeof v === "number" && Number.isFinite(v) ? v : null);
+/** `siteStatus` is `{status, since, note}` from the server; a bare string is accepted too. */
+function siteStatusName(v) {
+    if (typeof v === "string")
+        return v;
+    if (v && typeof v === "object") {
+        const status = v.status;
+        if (typeof status === "string")
+            return status;
+    }
+    return undefined;
+}
 /**
  * The scan, in the shape the view and the digest read.
  *
@@ -172,7 +183,7 @@ const num = (v) => (typeof v === "number" && Number.isFinite(v) ? v : null);
  * `market`, because each collector calls it something different and a caller
  * should not have to know which.
  */
-function marketplaceResult(payload, m, focus) {
+export function marketplaceResult(payload, m, focus) {
     const products = normaliseProducts(payload.products);
     const rollup = (payload.rollup ?? {});
     const reviews = allReviews(products);
@@ -198,6 +209,9 @@ function marketplaceResult(payload, m, focus) {
         statusTool: "marketplace_scan_status",
         statusArgs: { marketplace: m.slug },
         status: typeof payload.status === "string" ? payload.status : undefined,
+        notice: typeof payload.notice === "string" ? payload.notice : undefined,
+        // The server sends `{status, since, note}`; a bare string is accepted too.
+        siteStatus: siteStatusName(payload.siteStatus),
         total: num(progress.total) ?? undefined,
         // Its own view, labelled with this site (#95): pointing a model at
         // show_amazon_category_insights would have it draw a Lazada scan as an
@@ -226,6 +240,11 @@ function marketplaceResult(payload, m, focus) {
         reviews,
         errors: payload.errors ?? [],
         mcpCredits: payload.mcpCredits ?? null,
+        // Degraded-scan fields (nooticr-server#239); absent on an older server.
+        notice: payload.notice ?? null,
+        quality: payload.quality ?? null,
+        collectorStatus: payload.collectorStatus ?? null,
+        siteStatus: payload.siteStatus ?? null,
     };
     return {
         content: [{ type: "text", text: pollTail(withEvidence(guidance, structuredPayload), structuredPayload.nextCall) }],

package/dist/shared/output-schemas.js

@@ -640,8 +640,8 @@ export const OUTPUT_SCHEMAS = {
         since: scalar().describe("The date window asked for, if any."),
         sinceApplied: scalar().describe("False when the platform returned no dates, so the window could not be honoured."),
         postsChecked: scalar().describe("Posts whose comments were actually read."),
-        repliesCanBeSent: scalar().describe("Always false. nooticr does not post replies, even where list_social_connections reports a " +
-            "connection can manage comments, so the drafts this produces are for a person to paste in themselves."),
+        repliesCanBeSent: scalar().describe("Always false. This tool only drafts and never sends; a reply is posted only by a separate step, " +
+            "on the user's connected account, after the user confirms the exact text."),
         totalMentions: scalar().describe("Comments returned across every group."),
         totalThreads: scalar(),
         wantsReplyCount: scalar().describe("How many carry a reply signal. A sort, not a verdict."),

package/dist/shared/settings.js

@@ -0,0 +1,69 @@
+export const SETTINGS_READ_TOOL = "nooticr_settings_read";
+export const SETTINGS_UPDATE_TOOL = "nooticr_settings_update";
+export const DEFAULT_SOCIAL_PLATFORMS = [
+    "tiktok",
+    "instagram",
+    "youtube",
+    "twitter",
+    "reddit",
+    "douyin",
+    "xiaohongshu",
+    "weibo",
+    "bilibili",
+];
+export const DEFAULT_NOOTICR_SETTINGS = {
+    defaultSocialPlatform: "tiktok",
+    // Keep existing tool behaviour until the user chooses another count.
+    defaultResultCount: 12,
+};
+export class MemorySettingsStore {
+    values = new Map();
+    async get(owner) {
+        const value = this.values.get(owner);
+        return value ? { ...value } : undefined;
+    }
+    async put(owner, value) {
+        this.values.set(owner, { ...value });
+    }
+}
+/** Durable account-scoped preferences for the Cloudflare-hosted MCP server. */
+export class KvSettingsStore {
+    kv;
+    constructor(kv) {
+        this.kv = kv;
+    }
+    key(owner) {
+        return `plugin-settings:${owner}`;
+    }
+    async get(owner) {
+        const raw = await this.kv.get(this.key(owner));
+        if (!raw)
+            return undefined;
+        try {
+            const parsed = JSON.parse(raw);
+            const platform = DEFAULT_SOCIAL_PLATFORMS.find((candidate) => candidate === parsed.defaultSocialPlatform);
+            const count = parsed.defaultResultCount;
+            if (!platform || !Number.isInteger(count) || count < 3 || count > 12)
+                return undefined;
+            return { defaultSocialPlatform: platform, defaultResultCount: count };
+        }
+        catch {
+            return undefined;
+        }
+    }
+    async put(owner, value) {
+        await this.kv.put(this.key(owner), JSON.stringify(value));
+    }
+}
+/** Stable owner keys prefer the authenticated Nooticr account ID. */
+export async function settingsOwnerFromAuth(authInfo, resolveAccountId) {
+    const token = authInfo?.token ?? "";
+    const accountId = token && resolveAccountId ? await resolveAccountId(token) : undefined;
+    if (accountId)
+        return `account:${accountId}`;
+    if (!token)
+        return "local";
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(token));
+    const hex = Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+    return `credential:${hex}`;
+}

package/dist/shared/tools-def.js

@@ -399,13 +399,13 @@ export const TOOL_DEFINITIONS = [
     {
         name: "connect_social_account",
         title: "Connect Social Account",
-        description: "Get a link to open so you can connect one social account. The user approves at the provider; nothing is connected until they do, and no credential ever passes through this tool. No cost to call.",
-        inputSchema: z.object({ platform: z.string().describe("Which network to connect."), influencerId: z.number().int().optional(), appId: z.number().int().optional() }).strict(),
+        description: "Get a link to open so you can connect one social account. The user approves at the provider; nothing is connected until they do, and no credential ever passes through this tool. For YouTube, pass capabilities [\"manage_comments\"] to also ask for the comment-management grant. No cost to call.",
+        inputSchema: z.object({ platform: z.string().describe("Which network to connect."), influencerId: z.number().int().optional(), appId: z.number().int().optional(), capabilities: z.array(z.enum(["manage_comments"])).optional().describe("YouTube only: [\"manage_comments\"] asks for the comment-management grant.") }).strict(),
     },
     {
         name: "answer_my_audience",
         title: "Answer My Audience",
-        description: "The questions waiting for you under your own posts. Fetches a creator's recent posts, reads the comments on each, and returns them grouped under the post they were left on \u2014 every comment with a stable id, and the ones that read like questions or requests flagged and sorted to the top. Finds and drafts; it cannot post a reply, because nooticr does not post comments whatever a connection allows \u2014 the drafts are for a person to paste in themselves. Use when the job is to answer your own audience rather than to read about strangers. Consumes 2 nooticr credits for the post list plus 2 per post opened \u2014 14 credits at the default of 6 posts.",
+        description: "The questions waiting for you under your own posts. Fetches a creator's recent posts, reads the comments on each, and returns them grouped under the post they were left on \u2014 every comment with a stable id, and the ones that read like questions or requests flagged and sorted to the top. Finds and drafts; this tool cannot post a reply \u2014 a reply is posted only after the user confirms its exact text. Use when the job is to answer your own audience rather than to read about strangers. Consumes 2 nooticr credits for the post list plus 2 per post opened \u2014 14 credits at the default of 6 posts.",
         inputSchema: z.object({ username: z.string().describe("Your handle, with or without @."), platform: z.string().optional().describe("Platform (default tiktok)."), limit: z.number().int().optional().describe("Posts to open (default 6, max 12). Each one is a comment fetch, so this is the price."), commentsPerPost: z.number().int().optional().describe("Comments to read per post (default 20, max 50)."), since: z.string().optional().describe("Only posts published on or after this date, as YYYY-MM-DD. Windows the posts, not the comments.") }).strict(),
     },
     {
@@ -528,4 +528,16 @@ export const TOOL_DEFINITIONS = [
         description: "Display the category read you produced from scan_marketplace_category: purchase drivers, barriers, what each brand does well, the gaps, and the positioning angles \u2014 drawn beside the listings and their reviews, so a person can click a product and check any claim against the text it came from. Pass the scanId: the listings are then re-read from the scan itself (free) rather than taken from you, and any ASIN you cite that the scan does not contain is flagged. Without a scanId, listings you pass are drawn marked as not checked against a scan. Free. Your read is attributed to you rather than presented as a nooticr rating of anyone's product. Call this after you have read the reviews, not instead of reading them.",
         inputSchema: z.object({ marketplace: z.string().describe("The site the scan ran on, e.g. lazada."), category: z.string().describe("The category this is a read of."), summary: z.string().optional(), drivers: z.array(z.any()).optional().describe("What makes someone buy, each with the review evidence behind it."), barriers: z.array(z.any()).optional().describe("What stops them buying, or makes them return it."), strengths: z.array(z.any()).optional().describe("What each incumbent does well."), gaps: z.array(z.any()).optional().describe("What buyers keep asking for that nobody serves."), positioning: z.array(z.any()).optional().describe("Angles a new entrant could take."), products: z.array(z.any()).optional().describe("The listings from the scan, passed straight through."), rollup: z.record(z.unknown()).optional().describe("The rollup from the scan, passed straight through."), scanId: z.string().optional() }).passthrough(),
     },
+    {
+        name: "nooticr_settings_read",
+        title: "Read Nooticr Settings",
+        description: "Read the current default social platform and result count for this Nooticr account. Free; no credits are used.",
+        inputSchema: z.object({}).strict(),
+    },
+    {
+        name: "nooticr_settings_update",
+        title: "Update Nooticr Settings",
+        description: "Save changed default social platform or result count preferences for this Nooticr account. Free; no credits are used.",
+        inputSchema: z.object({ set: z.object({ defaultSocialPlatform: z.enum(["tiktok", "instagram", "youtube", "twitter", "reddit", "douyin", "xiaohongshu", "weibo", "bilibili"]).optional(), defaultResultCount: z.number().int().min(3).max(12).optional() }).strict() }).strict(),
+    },
 ];

package/dist/shared/tools.js

@@ -29,8 +29,9 @@ import { registerHandoff } from "./handoff.js";
 import { registerCollabTools } from "./collab.js";
 import { registerAmazonTools } from "./amazon.js";
 import { registerMarketplaceTools } from "./marketplace.js";
+import { DEFAULT_NOOTICR_SETTINGS, DEFAULT_SOCIAL_PLATFORMS, MemorySettingsStore, SETTINGS_READ_TOOL, SETTINGS_UPDATE_TOOL, settingsOwnerFromAuth, } from "./settings.js";
 /** Current MCP server version — bumped on every deploy for traceability. */
-export const MCP_SERVER_VERSION = "1.26.55";
+export const MCP_SERVER_VERSION = "1.26.57";
 /** MCP Apps extension identifier */
 const UI_EXTENSION = "io.modelcontextprotocol/ui";
 /** MIME type for MCP Apps HTML resources */
@@ -559,6 +560,10 @@ export function createMcpServer(rawMakeClient, opts) {
             prompts: {},
             extensions: {
                 [UI_EXTENSION]: { mimeTypes: [RESOURCE_MIME_TYPE] },
+                "openai/settings": {
+                    readTool: SETTINGS_READ_TOOL,
+                    updateTool: SETTINGS_UPDATE_TOOL,
+                },
             },
         },
     });
@@ -567,13 +572,110 @@ export function createMcpServer(rawMakeClient, opts) {
     // model's copy of it (#107). Wrapped once here rather than in eighty
     // handlers; registerSlowTool records the task path the same way.
     const ledger = ledgerFor(server);
+    const settingsStore = opts?.settingsStore ?? new MemorySettingsStore();
+    const settingsForCall = async (extra) => {
+        const owner = opts?.resolveSettingsOwner
+            ? await opts.resolveSettingsOwner(extra?.authInfo)
+            : await settingsOwnerFromAuth(extra?.authInfo);
+        return { owner, settings: (await settingsStore.get(owner)) ?? DEFAULT_NOOTICR_SETTINGS };
+    };
+    // Only apply defaults to search/research tools where these settings describe
+    // the omitted arguments. Explicit values always win; cost-bearing deeper
+    // reads such as comment counts and monitor sweeps are deliberately excluded.
+    const platformDefaults = {
+        discover_social_posts: DEFAULT_SOCIAL_PLATFORMS,
+        get_user_posts: DEFAULT_SOCIAL_PLATFORMS,
+        analyze_creator_profile: DEFAULT_SOCIAL_PLATFORMS,
+        search_creators: ["tiktok", "instagram", "xiaohongshu"],
+        get_similar_creators: ["tiktok", "instagram"],
+        discover_sounds: ["tiktok", "instagram"],
+        niche_report: DEFAULT_SOCIAL_PLATFORMS,
+        find_hook_pattern: DEFAULT_SOCIAL_PLATFORMS,
+    };
+    const resultCountFields = {
+        discover_social_posts: "limit",
+        get_user_posts: "limit",
+        analyze_creator_profile: "limit",
+        search_creators: "count",
+        discover_sounds: "count",
+        niche_report: "count",
+        find_hook_pattern: "limit",
+    };
     const registerTool = server.registerTool.bind(server);
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     server.registerTool = (name, config, handler) => registerTool(name, config, async (...a) => {
-        const result = (await handler(...a));
+        const [rawArgs, rawExtra, ...rest] = a;
+        let callArgs = a;
+        if (rawArgs &&
+            typeof rawArgs === "object" &&
+            !Array.isArray(rawArgs) &&
+            (platformDefaults[name] || resultCountFields[name])) {
+            const args = { ...rawArgs };
+            const extra = rawExtra;
+            try {
+                const { settings } = await settingsForCall(extra);
+                const allowed = platformDefaults[name];
+                if (allowed && args.platform === undefined && allowed.includes(settings.defaultSocialPlatform)) {
+                    args.platform = settings.defaultSocialPlatform;
+                }
+                const resultField = resultCountFields[name];
+                if (resultField && args[resultField] === undefined)
+                    args[resultField] = settings.defaultResultCount;
+                callArgs = [args, rawExtra, ...rest];
+            }
+            catch (err) {
+                if (name === SETTINGS_READ_TOOL || name === SETTINGS_UPDATE_TOOL)
+                    throw err;
+                // A preferences-store outage must not take down ordinary MCP tools.
+            }
+        }
+        const result = (await handler(...callArgs));
+        // Login recovery promises to retry what the caller originally supplied.
+        // The settings layer's effective defaults belong to this attempt only.
+        if (result?.isError && pendingAfterLogin?.name === name && rawArgs && typeof rawArgs === "object") {
+            pendingAfterLogin = { name, args: rawArgs };
+        }
         ledger.record(name, result?.structuredContent);
         return result;
     });
+    const settingsSchema = {
+        type: "object",
+        properties: {
+            defaultSocialPlatform: {
+                type: "string",
+                title: "Default social platform",
+                description: "Used when a supported social search omits its platform. Explicit tool arguments take precedence.",
+                enum: [...DEFAULT_SOCIAL_PLATFORMS],
+            },
+            defaultResultCount: {
+                type: "integer",
+                title: "Default result count",
+                description: "Used when supported search tools omit their result limit. Choose 3–12 results.",
+                minimum: 3,
+                maximum: 12,
+            },
+        },
+        required: ["defaultSocialPlatform", "defaultResultCount"],
+    };
+    const settingPropertySchema = z.object({
+        type: z.enum(["string", "integer"]),
+        title: z.string(),
+        description: z.string(),
+        enum: z.array(z.string()).optional(),
+        minimum: z.number().optional(),
+        maximum: z.number().optional(),
+    }).strict();
+    const settingsOutput = z.object({
+        schema: z.object({
+            type: z.literal("object"),
+            properties: z.object({
+                defaultSocialPlatform: settingPropertySchema,
+                defaultResultCount: settingPropertySchema,
+            }).strict(),
+            required: z.array(z.string()),
+        }).strict(),
+        values: z.object({ defaultSocialPlatform: z.string(), defaultResultCount: z.number().int() }),
+    });
     // Register one UI app resource per tool/view. Claude/ChatGPT render a
     // separate sandboxed app per resourceUri and key app state by it, so a
     // distinct URI per tool avoids a shared app instance/session colliding
@@ -984,12 +1086,12 @@ export function createMcpServer(rawMakeClient, opts) {
             .object({
             niche: z.string().describe("Niche/topic, e.g. 'fitness'."),
             keywords: z.string().optional().describe("Optional extra keywords."),
-            limit: z.number().int().optional().describe("Max results (default 6)."),
+            limit: z.number().int().optional().describe("Max results (default 6, or your Settings result count when omitted)."),
             offset: z.number().int().optional().describe("Skip first N results — for 'next' pagination."),
             platform: z
                 .enum(["youtube", "tiktok", "instagram", "douyin", "xiaohongshu", "twitter", "bilibili", "reddit", "weibo", "any"])
                 .optional()
-                .describe("Platform to search (default youtube)."),
+                .describe("Platform to search (your Settings default when omitted; otherwise youtube)."),
         })
             .strict(),
     }, async (args, extra) => {
@@ -1024,8 +1126,8 @@ export function createMcpServer(rawMakeClient, opts) {
             platform: z
                 .enum(["tiktok", "instagram", "youtube", "douyin", "xiaohongshu", "twitter", "bilibili", "linkedin", "reddit", "weibo"])
                 .optional()
-                .describe("Which platform (default tiktok)."),
-            limit: z.number().int().optional().describe("Max posts (default 6)."),
+                .describe("Which platform (your Settings default when supported, otherwise tiktok)."),
+            limit: z.number().int().optional().describe("Max posts (default 6, or your Settings result count when omitted)."),
         })
             .strict(),
     }, async (args, extra) => {
@@ -1064,7 +1166,7 @@ export function createMcpServer(rawMakeClient, opts) {
             platform: z
                 .enum(["tiktok", "instagram", "youtube", "douyin", "xiaohongshu", "twitter", "bilibili", "linkedin", "reddit", "weibo"])
                 .optional()
-                .describe("Which platform (default tiktok)."),
+                .describe("Which platform (your Settings default when supported, otherwise tiktok)."),
             limit: z.number().int().optional().describe("Posts to fetch (default 12, max 30)."),
             focus: z.string().optional().describe("Extra instruction for the profile synthesis."),
         })
@@ -1139,8 +1241,8 @@ export function createMcpServer(rawMakeClient, opts) {
                 // fields at all, so advertising them only spends a paid call to fail.
                 .enum(["tiktok", "instagram", "xiaohongshu"])
                 .optional()
-                .describe("Which platform (default tiktok)."),
-            count: z.number().int().optional().describe("Max creators (default 8)."),
+                .describe("Which platform (your Settings default when supported, otherwise tiktok)."),
+            count: z.number().int().optional().describe("Max creators (default 8, or your Settings result count when omitted)."),
         })
             .strict(),
     }, async (args, extra) => {
@@ -1244,8 +1346,8 @@ export function createMcpServer(rawMakeClient, opts) {
         inputSchema: z
             .object({
             keyword: z.string().describe("Niche/keyword, e.g. 'gym'."),
-            platform: z.enum(["tiktok", "instagram"]).optional().describe("Which platform (default tiktok)."),
-            count: z.number().int().optional().describe("Max sounds (default 6)."),
+            platform: z.enum(["tiktok", "instagram"]).optional().describe("Which platform (your Settings default when supported, otherwise tiktok)."),
+            count: z.number().int().optional().describe("Max sounds (default 6, or your Settings result count when omitted)."),
         })
             .strict(),
     }, async (args, extra) => {
@@ -2374,7 +2476,7 @@ export function createMcpServer(rawMakeClient, opts) {
             .object({
             niche: z.string().describe("Niche or topic, e.g. 'home fitness'."),
             platform: z.string().optional().describe("Platform to survey (default tiktok)."),
-            count: z.number().int().optional().describe("Posts to survey (default 12, max 40)."),
+            count: z.number().int().optional().describe("Posts to survey (default 12, or your Settings result count when omitted; max 40)."),
         })
             .strict(),
     }, async (args, extra) => {
@@ -2406,7 +2508,7 @@ export function createMcpServer(rawMakeClient, opts) {
             .object({
             username: z.string().describe("Creator handle, with or without @."),
             platform: z.string().optional().describe("Platform (default tiktok)."),
-            limit: z.number().int().optional().describe("Posts to read (default 12, max 40)."),
+            limit: z.number().int().optional().describe("Posts to read (default 12, or your Settings result count when omitted; max 40)."),
         })
             .strict(),
     }, async (args, extra) => {
@@ -2798,5 +2900,41 @@ export function createMcpServer(rawMakeClient, opts) {
     // and the generic one cannot, so the two descriptions are not the same
     // promise — not because the question differs.
     registerMarketplaceTools(server, makeClient);
+    // Register the settings controls after the existing tool surface so adding
+    // them does not reorder tools that hosts already know about. These settings
+    // tools have no app view; the host renders them in its native settings UI.
+    server.registerTool(SETTINGS_READ_TOOL, {
+        title: "Read Nooticr Settings",
+        description: "Read the current default social platform and result count for this Nooticr account. Free; no credits are used.",
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+        inputSchema: z.object({}).strict(),
+        outputSchema: settingsOutput,
+    }, async (_args, extra) => {
+        const { settings } = await settingsForCall(extra);
+        return {
+            content: [],
+            structuredContent: {
+                schema: settingsSchema,
+                values: settings,
+            },
+        };
+    });
+    server.registerTool(SETTINGS_UPDATE_TOOL, {
+        title: "Update Nooticr Settings",
+        description: "Save changed Nooticr research defaults for this account. Free; no credits are used.",
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+        inputSchema: z.object({
+            set: z.object({
+                defaultSocialPlatform: z.enum(DEFAULT_SOCIAL_PLATFORMS).optional(),
+                defaultResultCount: z.number().int().min(3).max(12).optional(),
+            }).strict().refine((set) => Object.keys(set).length > 0, "At least one setting must change."),
+        }).strict(),
+        outputSchema: z.object({ values: settingsOutput.shape.values }),
+    }, async ({ set }, extra) => {
+        const { owner, settings } = await settingsForCall(extra);
+        const updated = { ...settings, ...set };
+        await settingsStore.put(owner, updated);
+        return { content: [], structuredContent: { values: updated } };
+    });
     return server;
 }

package/dist/shared/ui-template.js

@@ -4411,7 +4411,7 @@ export const NOOTICR_UI_TEMPLATE = `<!DOCTYPE html>
           +'<div class="nt-commerce-chiprow">'+readOnly.map(function(k){
             return '<span class="nt-tag nt-commerce-nettag tag">'+glyph(k,12)+esc(pTitle(k))+"</span>";}).join("")+"</div>"
           +'<p class="nt-commerce-conn-sub" style="margin-top:8px">So "monitor my brand on Weibo" works and "reply to that Weibo comment" cannot — '
-          +"nooticr does not post replies on any network, whatever a connection is allowed to do.</p></div>":""),
+          +"replies are never sent on their own: one is posted only after you confirm its exact text.</p></div>":""),
       footer:'<span class="ai-note">Each press mints a fresh link — an old one does not work twice. Approve in your own browser; nothing is connected until you do.</span>'});
   }
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nooticr/mcp",
   "mcpName": "com.nooticr/mcp",
-  "version": "1.26.55",
+  "version": "1.26.57",
   "description": "MCP server for nooticr - fetch, discover and understand TikTok/Instagram/YouTube/X/Reddit/LinkedIn/Weibo posts with AI (media metadata, niche discovery, brand monitoring, hook & viral analysis)",
   "homepage": "https://mcp.nooticr.com",
   "repository": {
@@ -46,7 +46,9 @@
     "test:mutation": "node scripts/mutation-guard.mjs",
     "test:invariants": "node scripts/invariant-guard.mjs",
     "verify:deep": "npm run verify && npm run test:mutation && npm run test:invariants",
-    "check:submission": "node scripts/check-submission-schema.mjs"
+    "check:submission": "node scripts/check-submission-schema.mjs",
+    "registry:check": "node scripts/registry-drift.mjs",
+    "registry:publish": "bash scripts/publish-registry.sh"
   },
   "keywords": [
     "mcp",