@nooticr/mcp 1.26.56 → 1.26.57

package/README.md

@@ -113,7 +113,7 @@ them caps that fan-out with an argument.
 
 | Tool | Credits | What it is for |
 |------|---------|----------------|
-| `answer_my_audience` | 2 + 2 per post opened (14 by default) | **The mirror of `search_mentions`.** The questions waiting under your *own* posts: recent posts fetched, comments read on each, grouped under the post they were left on, every comment with a stable id, and the ones that read like questions or requests flagged and sorted to the top. It finds and drafts — it cannot post a reply: nooticr does not post comments on any network, even where a connection's grant allows managing them. `limit` caps how many posts are opened, which is the price. |
+| `answer_my_audience` | 2 + 2 per post opened (14 by default) | **The mirror of `search_mentions`.** The questions waiting under your *own* posts: recent posts fetched, comments read on each, grouped under the post they were left on, every comment with a stable id, and the ones that read like questions or requests flagged and sorted to the top. It finds and drafts — it cannot post a reply. This tool never sends anything; a reply is posted only if you then ask for it, on your connected account, after you confirm the exact text. `limit` caps how many posts are opened, which is the price. |
 | `prepare_handoff` | free | **The hand-off to your tracker.** Turns items you classified — a bug report in a comment, a complaint said out loud in a video — into the exact `title`, `body` and `labels` to file through whichever GitHub, Jira or Linear MCP server the host also has connected. nooticr files nothing and holds no tracker credential. The body carries the quote fenced and framed as a third-party report rather than as instructions, because the issue is read next by a coding agent; contact details are redacted, `@handles` and `#numbers` are defanged so filing notifies nobody by accident, and a `searchFirst` string dedupes a second sweep against the first. Makes no requests. |
 | `show_audience_replies` | free | Lays your drafts out for a person to work through, grouped under the post, each with what you decided to do about it. Sends nothing; fetches nothing. |
 | `show_standings` | free | Draws the standings your model read out of `compare_creators` or `watchlist_standings` — one row per creator, with the window and the median it was scored against. `ranking` records which axis you ordered on, and `tooThin` draws a creator with too short a window as unranked rather than last: missing from a comparison is not the same as losing it. Makes no requests. |
@@ -638,6 +638,10 @@ and text** posts.
 See [docs/SUBMISSION.md](docs/SUBMISSION.md) for ready-to-paste configs and the submission
 package for **Claude Desktop**, **Cursor**, and **OpenAI Agents SDK**.
 
+The official MCP registry entry `com.nooticr/mcp` must equal `server.json`'s version after each
+release; see [docs/registry-publishing.md](docs/registry-publishing.md) for the drift check
+(`npm run registry:check`) and the publish script (`npm run registry:publish`).
+
 ## Security notes
 
 - The credentials file is written with mode `0600` and the directory with

package/dist/index.js

@@ -414,6 +414,23 @@ export async function runApiKey(opts) {
                 "the key it returns is what every run afterwards uses.");
     }
     const client = new NooticrClient(baseUrl, createManagementTokenProvider(auth));
+    // Who, and where. A key is scoped to one account on one server, and both
+    // are easy to get wrong without noticing: the credentials file holds
+    // whoever last ran `login` on this machine, and NOOTICR_BASE_URL defaults
+    // to production. A key minted against one pair and looked for in another
+    // is simply absent, with nothing anywhere saying why — which is exactly how
+    // this was first reported.
+    let account = "an unknown account";
+    try {
+        const me = await client.me();
+        if (me?.email)
+            account = me.email;
+    }
+    catch {
+        // Not worth failing the command over; the operation below will fail with
+        // a better message if the credential is genuinely bad.
+    }
+    const scope = `${account} on ${baseUrl}`;
     if (opts.action === "create") {
         const created = await client.createApiKey({
             ...(opts.name !== undefined ? { name: opts.name } : {}),
@@ -424,7 +441,7 @@ export async function runApiKey(opts) {
             process.stdout.write(`${JSON.stringify(created, null, 2)}\n`);
             return;
         }
-        process.stdout.write(`Created API key "${created.name}" (${created.id}).\n\n` +
+        process.stdout.write(`Created API key "${created.name}" (${created.id}) for ${scope}.\n\n` +
             `  ${created.key}\n\n` +
             "This is the only time the key is shown — nooticr stores a hash of it and\n" +
             "cannot show it again. Store it wherever this deployment keeps its secrets,\n" +
@@ -441,10 +458,11 @@ export async function runApiKey(opts) {
             return;
         }
         if (keys.length === 0) {
-            process.stdout.write("No API keys. Create one with `npx nooticr-mcp api-key create --name <name>`.\n");
+            process.stdout.write(`No API keys for ${scope}.\n` +
+                "Create one with `npx nooticr-mcp api-key create --name <name>`.\n");
             return;
         }
-        process.stdout.write(`${keys.map(describeKey).join("\n\n")}\n`);
+        process.stdout.write(`Keys for ${scope}:\n\n${keys.map(describeKey).join("\n\n")}\n`);
         return;
     }
     if (!opts.id) {
@@ -455,7 +473,7 @@ export async function runApiKey(opts) {
         process.stdout.write(`${JSON.stringify({ id: opts.id, revoked: true }, null, 2)}\n`);
         return;
     }
-    process.stdout.write(`Revoked ${opts.id}. Any server still presenting it now gets a 401.\n`);
+    process.stdout.write(`Revoked ${opts.id} for ${scope}. Any server still presenting it now gets a 401.\n`);
 }
 // ---------------------------------------------------------------------------
 // CLI

package/dist/shared/amazon.js

@@ -177,7 +177,15 @@ export function categoryGuidance(opts) {
     // commonest reason is a query in a language that storefront does not sell
     // in. Said here rather than only in the tool description because by the time
     // this is read the description is long out of the model's attention.
-    if (opts.products === 0 && opts.complete) {
+    if (opts.status === "degraded") {
+        lines.push(`DEGRADED SCAN: ${site} could not be read properly right now, so this is not a finding ` +
+            `about the category and not evidence that nothing sells there. ` +
+            (opts.notice
+                ? `Tell the user this, verbatim: "${opts.notice}". `
+                : `Tell the user the site is currently unavailable. `) +
+            `Do not retry with other queries and do not call the category empty.`);
+    }
+    else if (opts.products === 0 && opts.complete) {
         lines.push(`No listings came back. This is not a finding about the category — it is a search that ` +
             `matched nothing. Before reporting it: check the query is in the language that ` +
             `storefront sells in, try the common shopper's word for the thing rather than a ` +
@@ -190,6 +198,10 @@ export function categoryGuidance(opts) {
     // caveat changes what it writes.
     if (opts.freshness)
         lines.push(opts.freshness);
+    if (opts.siteStatus && opts.status !== "degraded") {
+        lines.push(`Caveat: the ${site} collector is currently ${opts.siteStatus}, so this data may be ` +
+            `partial. Say so when you report it.`);
+    }
     if (polling) {
         lines.push(`Stop polling only if ${statusTool} reports status "failed", or returns the same number of ` +
             `listings three calls in a row. Then write the read from what was collected and say plainly ` +

package/dist/shared/backend-only.js

@@ -20,5 +20,9 @@ export const BACKEND_ONLY_TOOLS = {
     schedule_post: "Rendering and publishing stay in the dashboard (#92).",
     get_batch_history: "History of the dashboard's compose batches, which only exist once rendering does; stays with #92.",
     get_latest_analysis: "Returns the dashboard's stored AI fleet-analysis verdict; the public surface sells the evidence, not a judgement of ours.",
+    propose_listing_update: "Commerce writes (nooticr-server C1 3/4) stay in the dashboard until exposing store writes to hosts is a product decision. connect_store and list_store_products, the C1 read pair, are undecided and want settling together with these.",
+    apply_listing_update: "Commerce writes (nooticr-server C1 3/4) stay in the dashboard until exposing store writes to hosts is a product decision; applying a change edits the merchant's live store.",
+    propose_price_change: "Commerce writes (nooticr-server C1 3/4) stay in the dashboard until exposing store writes to hosts is a product decision.",
+    apply_price_change: "Commerce writes (nooticr-server C1 3/4) stay in the dashboard until exposing store writes to hosts is a product decision; applying a change edits the merchant's live prices.",
     brand_watch_history: "Not a deliberate exclusion: a candidate for the public surface once it has a trend view to draw. Listed so it reads as pending, not forgotten.",
 };

package/dist/shared/connections.js

@@ -68,20 +68,27 @@ export function registerConnectionTools(server, makeClient) {
             "or product — omit both and this picks the only one if there is just one, or lists the " +
             "choices if there is more than one. The user approves at the provider; nothing is " +
             "connected until they do, and no credential ever passes through this tool. Each call " +
-            "mints a fresh link, so do not reuse an old one. No cost to call.",
+            "mints a fresh link, so do not reuse an old one. For YouTube, pass capabilities " +
+            "[\"manage_comments\"] to also ask for the comment-management grant. No cost to call.",
         annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
         inputSchema: z
             .object({
             platform: z.string().describe("Which network to connect, e.g. tiktok, youtube."),
             influencerId: z.number().int().optional().describe("Which creator profile — call list_own_apps or list_social_connections first if unsure."),
             appId: z.number().int().optional().describe("Which product this connection is for."),
+            capabilities: z
+                .array(z.enum(["manage_comments"]))
+                .optional()
+                .describe("Extra access to ask for. YouTube only: [\"manage_comments\"] asks for the comment-management grant. Omit for the default."),
         })
             .strict(),
         outputSchema: OUTPUT_SCHEMAS.connect_social_account,
     }, async (args, extra) => {
         const client = await makeClient({ ...extra, arguments: args });
         try {
-            return toResult(await client.callTool("connect_social_account", args));
+            // Forward capabilities only when supplied, so a plain call is unchanged.
+            const { capabilities, ...rest } = args;
+            return toResult(await client.callTool("connect_social_account", capabilities ? { ...rest, capabilities } : rest));
         }
         catch (err) {
             return failed("connect_social_account failed", err);

package/dist/shared/jobs.js

@@ -320,9 +320,8 @@ function audienceGuidance(a) {
             "ones asking the same thing: a single pinned reply beats twenty individual ones, and a " +
             "question that recurs across posts is a video rather than a reply.",
         "",
-        "You are drafting, not sending. nooticr does not post comments on any network — even a " +
-            "connection whose grant allows managing comments is never used to send one — so these are " +
-            "for the creator to paste in themselves. Say that rather than implying the replies will go out.",
+        "You are drafting, not sending. this tool cannot post: nothing is sent from here, and a reply is posted only " +
+            "after the creator confirms its exact text. Say that rather than implying the replies will go out.",
         "",
         "Do not invent facts about the product, the price or the creator's plans to fill a gap. If a " +
             "comment cannot be answered from what is here, say what you would need.",
@@ -633,9 +632,8 @@ export function registerJobTools(server, makeClient, store) {
             "reads the comments on each, and returns them grouped under the post they were left on — " +
             "every comment with a stable id, and the ones that look like questions or requests " +
             "flagged and sorted to the top. This FINDS and helps you DRAFT answers; it cannot post " +
-            "them: nooticr does not post replies on any network, even where list_social_connections " +
-            "reports that a connection can manage comments, so the replies are for a person to paste " +
-            "in themselves — never promise the user they will be sent. `since` filters on the POST's date, not the comments'. `limit` caps how many " +
+            "them: this tool sends nothing, and a reply is only ever posted after the user confirms its " +
+            "exact text — never promise the user a reply will go out on its own. `since` filters on the POST's date, not the comments'. `limit` caps how many " +
             "posts are opened. Pair it with show_audience_replies to lay the drafts out for triage. " +
             "Costs 2 nooticr credits for the post list plus 2 per post opened — 14 credits at the " +
             "default of 6 posts. Use when the job is to answer people; search_mentions is for what " +
@@ -1631,8 +1629,8 @@ export function registerJobTools(server, makeClient, store) {
         _meta: viewMeta("show_audience_replies"),
         description: "Lay out the replies you drafted from answer_my_audience so a person can read them. " +
             "Free, and makes no requests — it only draws what you pass it. It does NOT send " +
-            "anything: nooticr does not post comments, whatever a connection allows, so each row is a draft for the " +
-            "creator to copy into the app themselves. Each comment shows with what you decided to do " +
+            "anything: each row is a draft, and a reply is posted only after the creator confirms its " +
+            "exact text. Each comment shows with what you decided to do " +
             "about it and your draft underneath, grouped under its post, so they can work through " +
             "them one at a time and skip the rest. Call this after you have drafted the replies, not " +
             "instead of drafting them.",
@@ -1660,7 +1658,7 @@ export function registerJobTools(server, makeClient, store) {
                 draft: z
                     .string()
                     .optional()
-                    .describe("The reply, in the creator's voice, for them to paste in themselves."),
+                    .describe("The reply, in the creator's voice. It is only a draft: nothing is posted until the creator confirms its exact text."),
                 kind: z
                     .enum(["answer", "pin", "make_a_video", "escalate", "ignore"])
                     .optional()

package/dist/shared/marketplace.js

@@ -164,6 +164,17 @@ function toolError(what, err) {
     return { isError: true, content: [{ type: "text", text: `${what}: ${message}` }] };
 }
 const num = (v) => (typeof v === "number" && Number.isFinite(v) ? v : null);
+/** `siteStatus` is `{status, since, note}` from the server; a bare string is accepted too. */
+function siteStatusName(v) {
+    if (typeof v === "string")
+        return v;
+    if (v && typeof v === "object") {
+        const status = v.status;
+        if (typeof status === "string")
+            return status;
+    }
+    return undefined;
+}
 /**
  * The scan, in the shape the view and the digest read.
  *
@@ -172,7 +183,7 @@ const num = (v) => (typeof v === "number" && Number.isFinite(v) ? v : null);
  * `market`, because each collector calls it something different and a caller
  * should not have to know which.
  */
-function marketplaceResult(payload, m, focus) {
+export function marketplaceResult(payload, m, focus) {
     const products = normaliseProducts(payload.products);
     const rollup = (payload.rollup ?? {});
     const reviews = allReviews(products);
@@ -198,6 +209,9 @@ function marketplaceResult(payload, m, focus) {
         statusTool: "marketplace_scan_status",
         statusArgs: { marketplace: m.slug },
         status: typeof payload.status === "string" ? payload.status : undefined,
+        notice: typeof payload.notice === "string" ? payload.notice : undefined,
+        // The server sends `{status, since, note}`; a bare string is accepted too.
+        siteStatus: siteStatusName(payload.siteStatus),
         total: num(progress.total) ?? undefined,
         // Its own view, labelled with this site (#95): pointing a model at
         // show_amazon_category_insights would have it draw a Lazada scan as an
@@ -226,6 +240,11 @@ function marketplaceResult(payload, m, focus) {
         reviews,
         errors: payload.errors ?? [],
         mcpCredits: payload.mcpCredits ?? null,
+        // Degraded-scan fields (nooticr-server#239); absent on an older server.
+        notice: payload.notice ?? null,
+        quality: payload.quality ?? null,
+        collectorStatus: payload.collectorStatus ?? null,
+        siteStatus: payload.siteStatus ?? null,
     };
     return {
         content: [{ type: "text", text: pollTail(withEvidence(guidance, structuredPayload), structuredPayload.nextCall) }],

package/dist/shared/output-schemas.js

@@ -640,8 +640,8 @@ export const OUTPUT_SCHEMAS = {
         since: scalar().describe("The date window asked for, if any."),
         sinceApplied: scalar().describe("False when the platform returned no dates, so the window could not be honoured."),
         postsChecked: scalar().describe("Posts whose comments were actually read."),
-        repliesCanBeSent: scalar().describe("Always false. nooticr does not post replies, even where list_social_connections reports a " +
-            "connection can manage comments, so the drafts this produces are for a person to paste in themselves."),
+        repliesCanBeSent: scalar().describe("Always false. This tool only drafts and never sends; a reply is posted only by a separate step, " +
+            "on the user's connected account, after the user confirms the exact text."),
         totalMentions: scalar().describe("Comments returned across every group."),
         totalThreads: scalar(),
         wantsReplyCount: scalar().describe("How many carry a reply signal. A sort, not a verdict."),

package/dist/shared/tools-def.js

@@ -399,13 +399,13 @@ export const TOOL_DEFINITIONS = [
     {
         name: "connect_social_account",
         title: "Connect Social Account",
-        description: "Get a link to open so you can connect one social account. The user approves at the provider; nothing is connected until they do, and no credential ever passes through this tool. No cost to call.",
-        inputSchema: z.object({ platform: z.string().describe("Which network to connect."), influencerId: z.number().int().optional(), appId: z.number().int().optional() }).strict(),
+        description: "Get a link to open so you can connect one social account. The user approves at the provider; nothing is connected until they do, and no credential ever passes through this tool. For YouTube, pass capabilities [\"manage_comments\"] to also ask for the comment-management grant. No cost to call.",
+        inputSchema: z.object({ platform: z.string().describe("Which network to connect."), influencerId: z.number().int().optional(), appId: z.number().int().optional(), capabilities: z.array(z.enum(["manage_comments"])).optional().describe("YouTube only: [\"manage_comments\"] asks for the comment-management grant.") }).strict(),
     },
     {
         name: "answer_my_audience",
         title: "Answer My Audience",
-        description: "The questions waiting for you under your own posts. Fetches a creator's recent posts, reads the comments on each, and returns them grouped under the post they were left on \u2014 every comment with a stable id, and the ones that read like questions or requests flagged and sorted to the top. Finds and drafts; it cannot post a reply, because nooticr does not post comments whatever a connection allows \u2014 the drafts are for a person to paste in themselves. Use when the job is to answer your own audience rather than to read about strangers. Consumes 2 nooticr credits for the post list plus 2 per post opened \u2014 14 credits at the default of 6 posts.",
+        description: "The questions waiting for you under your own posts. Fetches a creator's recent posts, reads the comments on each, and returns them grouped under the post they were left on \u2014 every comment with a stable id, and the ones that read like questions or requests flagged and sorted to the top. Finds and drafts; this tool cannot post a reply \u2014 a reply is posted only after the user confirms its exact text. Use when the job is to answer your own audience rather than to read about strangers. Consumes 2 nooticr credits for the post list plus 2 per post opened \u2014 14 credits at the default of 6 posts.",
         inputSchema: z.object({ username: z.string().describe("Your handle, with or without @."), platform: z.string().optional().describe("Platform (default tiktok)."), limit: z.number().int().optional().describe("Posts to open (default 6, max 12). Each one is a comment fetch, so this is the price."), commentsPerPost: z.number().int().optional().describe("Comments to read per post (default 20, max 50)."), since: z.string().optional().describe("Only posts published on or after this date, as YYYY-MM-DD. Windows the posts, not the comments.") }).strict(),
     },
     {

package/dist/shared/tools.js

@@ -31,7 +31,7 @@ import { registerAmazonTools } from "./amazon.js";
 import { registerMarketplaceTools } from "./marketplace.js";
 import { DEFAULT_NOOTICR_SETTINGS, DEFAULT_SOCIAL_PLATFORMS, MemorySettingsStore, SETTINGS_READ_TOOL, SETTINGS_UPDATE_TOOL, settingsOwnerFromAuth, } from "./settings.js";
 /** Current MCP server version — bumped on every deploy for traceability. */
-export const MCP_SERVER_VERSION = "1.26.56";
+export const MCP_SERVER_VERSION = "1.26.57";
 /** MCP Apps extension identifier */
 const UI_EXTENSION = "io.modelcontextprotocol/ui";
 /** MIME type for MCP Apps HTML resources */

package/dist/shared/ui-template.js

@@ -4411,7 +4411,7 @@ export const NOOTICR_UI_TEMPLATE = `<!DOCTYPE html>
           +'<div class="nt-commerce-chiprow">'+readOnly.map(function(k){
             return '<span class="nt-tag nt-commerce-nettag tag">'+glyph(k,12)+esc(pTitle(k))+"</span>";}).join("")+"</div>"
           +'<p class="nt-commerce-conn-sub" style="margin-top:8px">So "monitor my brand on Weibo" works and "reply to that Weibo comment" cannot — '
-          +"nooticr does not post replies on any network, whatever a connection is allowed to do.</p></div>":""),
+          +"replies are never sent on their own: one is posted only after you confirm its exact text.</p></div>":""),
       footer:'<span class="ai-note">Each press mints a fresh link — an old one does not work twice. Approve in your own browser; nothing is connected until you do.</span>'});
   }
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nooticr/mcp",
   "mcpName": "com.nooticr/mcp",
-  "version": "1.26.56",
+  "version": "1.26.57",
   "description": "MCP server for nooticr - fetch, discover and understand TikTok/Instagram/YouTube/X/Reddit/LinkedIn/Weibo posts with AI (media metadata, niche discovery, brand monitoring, hook & viral analysis)",
   "homepage": "https://mcp.nooticr.com",
   "repository": {
@@ -46,7 +46,9 @@
     "test:mutation": "node scripts/mutation-guard.mjs",
     "test:invariants": "node scripts/invariant-guard.mjs",
     "verify:deep": "npm run verify && npm run test:mutation && npm run test:invariants",
-    "check:submission": "node scripts/check-submission-schema.mjs"
+    "check:submission": "node scripts/check-submission-schema.mjs",
+    "registry:check": "node scripts/registry-drift.mjs",
+    "registry:publish": "bash scripts/publish-registry.sh"
   },
   "keywords": [
     "mcp",