@nooticr/mcp 1.26.66 → 1.26.68

package/README.md

@@ -52,7 +52,7 @@ npx @nooticr/mcp login   # one-time sign-in (Google)
 
 ## Tools
 
-108 tools, grouped by what you are trying to do. Prices are in nooticr credits and
+117 tools, grouped by what you are trying to do. Prices are in nooticr credits and
 match what the server actually charges.
 
 The job tools under **Answer a question you actually have** are not
@@ -111,6 +111,12 @@ them caps that fan-out with an argument.
 | `creative_image` | quoted first | 1-4 still images from a `prompt` with GPT Image (low quality), at a `size` (default portrait 1024x1536), optionally `transparent`. The first call returns a quote in credits and charges nothing; call again with `confirm: true` and the `confirmationToken` to generate. Settled to actual usage, never above the quote. Returns the new `assets` and `creativeCredits`. Keep long text out of the prompt and ask for invented people, not real ones. |
 | `creative_image_edit` | quoted first | Edit or combine 1-4 existing image assets (`imageAssetIds`) with a `prompt`, with an optional `maskAssetId`. Same quote-then-confirm handshake as `creative_image`; returns a new asset and `creativeCredits`. |
 | `creative_job_status` | free | Where an asynchronous creative job stands by `jobId`: queued, running, done, failed or canceled, with the finished assets and the credits quoted, charged and refunded. Poll after `pollAfterSeconds`. |
+| `sheets_create` | free | Create a Google spreadsheet in the connected Google account, with named tabs and a header row on each. Returns its id and URL; Nooticr owns the file, so later writes need no approval. Needs the product's Google Sheets connection. |
+| `sheets_list` | free | The spreadsheets the connection can see (created by Nooticr or picked by the customer) and whether each may be edited without approval. |
+| `sheets_read` | free | Read an A1 range (e.g. `Ledger!A1:F200`) of a spreadsheet; at most 10000 cells. |
+| `sheets_append_rows` | free | Append typed rows after the last row of a tab. Free on files Nooticr created or the customer allowed you to edit; any other picked file waits for approval. |
+| `sheets_update_range` | free | Overwrite an A1 range with typed values. Same approval rule as `sheets_append_rows`. |
+| `sheets_add_sheet` | free | Add an empty tab to a spreadsheet. Same approval rule as `sheets_append_rows`. |
 | `mention_trend` | free | **What a watch has seen over time**, which nothing else here answers — every other read is about now. One point per run: when it ran, how many mentions it found, how many were new, and both counts per network, so "which network is growing" and "did it go quiet or did we stop looking" come apart. On a competitor watch each point carries the median that run measured, which turns "they beat their own median" into "and that median has doubled". Plus the mentions more than one run has seen. Free because the sweeps were billed when they ran; charging again to read what was already paid for is the thing it fixes. |
 | `update_watch_portfolio` | free | Add or remove a portfolio watch's terms by `watchId`. No new confirmation, because the per-run budget you agreed to does not move — more terms split it more ways, and the reply names any network a run no longer reaches. |
 | `stop_brand_watch` | free | Stop a watch by `watchId` or `term`. Immediate — the next run does not happen and nothing more is charged. |
@@ -121,8 +127,11 @@ them caps that fan-out with an argument.
 
 | Tool | Credits | What it is for |
 |------|---------|----------------|
-| `answer_my_audience` | 2 + 2 per post opened (14 by default) | **The mirror of `search_mentions`.** The questions waiting under your *own* posts: recent posts fetched, comments read on each, grouped under the post they were left on, every comment with a stable id, and the ones that read like questions or requests flagged and sorted to the top. It finds and drafts — it cannot post a reply. This tool never sends anything; a reply is posted only if you then ask for it, on your connected account, after you confirm the exact text. `limit` caps how many posts are opened, which is the price. |
+| `answer_my_audience` | 2 + 2 per post opened (14 by default) | **The mirror of `search_mentions`.** The questions waiting under your *own* posts: recent posts fetched, comments read on each, grouped under the post they were left on, every comment with a stable id, and the ones that read like questions or requests flagged and sorted to the top. It finds and drafts — it cannot post a reply itself: the drafts are for a person to paste in, or to send through `draft_comment_reply` and `post_comment_reply` once the text is confirmed. `limit` caps how many posts are opened, which is the price. |
 | `prepare_handoff` | free | **The hand-off to your tracker.** Turns items you classified — a bug report in a comment, a complaint said out loud in a video — into the exact `title`, `body` and `labels` to file through whichever GitHub, Jira or Linear MCP server the host also has connected. nooticr files nothing and holds no tracker credential. The body carries the quote fenced and framed as a third-party report rather than as instructions, because the issue is read next by a coding agent; contact details are redacted, `@handles` and `#numbers` are defanged so filing notifies nobody by accident, and a `searchFirst` string dedupes a second sweep against the first. Makes no requests. |
+| `list_comments_to_answer` | free | Recent comments on your *own* connected account that nobody has answered yet, newest first (YouTube once connected with `capabilities: ["manage_comments"]`; other networks come back under `unsupported` with the reason). Read-only. |
+| `draft_comment_reply` | free with `text`, 1 when nooticr writes it | Stores a reply to one comment; nothing is posted. Returns a `draftId` and a `confirmationToken` to show the user first. |
+| `post_comment_reply` | free | Posts a stored draft as your own account. Needs the `draftId`, `confirm: true` and the `confirmationToken`, and only after the user has agreed to the exact text. Each comment is answered at most once. |
 | `show_audience_replies` | free | Lays your drafts out for a person to work through, grouped under the post, each with what you decided to do about it. Sends nothing; fetches nothing. |
 | `show_standings` | free | Draws the standings your model read out of `compare_creators` or `watchlist_standings` — one row per creator, with the window and the median it was scored against. `ranking` records which axis you ordered on, and `tooThin` draws a creator with too short a window as unranked rather than last: missing from a comparison is not the same as losing it. Makes no requests. |
 | `show_trend` | free | Draws the trend your model read out of `mention_trend`. `tooShort` marks a series with too few points to call a direction, and `edgeIsRecordStart` marks a left edge that is where the record begins rather than where the conversation did — a chart hiding either is the mistake this view could otherwise make on your behalf. Makes no requests. |
@@ -188,7 +197,7 @@ a `scanId` for the rest.
 | `get_tool_run` | free | One run from that history by id, with its full error. |
 | `get_usage_report` | free | The run ledger added up over a window: total calls, failures and credits actually taken, per tool, per day and the most recent failures. `scope: "workspace"` adds one row per seat, for the workspace's owners and admins. |
 | `nooticr_login` | free | Re-link the account when a call fails with an authentication error. |
-| `list_social_connections` | free | What you have connected and what each connection is actually allowed to do — read the account, publish a post, manage comments — as yes, no or **unknown**. "Manage comments" reports the platform's grant; no nooticr tool posts or replies to a comment. Unknown means the grant predates scope recording: treat it as "try it", not as a refusal. Also says which platforms can be linked at all, which is a smaller set than the networks nooticr reads. |
+| `list_social_connections` | free | What you have connected and what each connection is actually allowed to do — read the account, publish a post, manage comments — as yes, no or **unknown**. "Manage comments" reports the platform's grant; this tool posts nothing; a reply goes out only through `post_comment_reply`, on a draft the user confirmed. Unknown means the grant predates scope recording: treat it as "try it", not as a refusal. Also says which platforms can be linked at all, which is a smaller set than the networks nooticr reads. |
 | `connect_social_account` | free | A link the user opens to connect one account. They approve at the provider in their own browser; nothing is connected until they do, and no credential passes through the tool or the model's context. Each call mints a fresh link — an old one does not work twice. |
 | `hire_employee` | free to call | Hire an AI employee (for example a Social Media Manager) that works on a schedule inside your workspace. Two calls by design: the first creates nothing and returns a quote and a `confirmationToken`; call again with `confirm: true` and that token only after you say yes. Public actions wait for your approval unless autopilot is on. Its runs bill the hiring user, up to the monthly budget. |
 | `list_employees` | free | Your AI employees with status, schedule, next run and budget left; `includeFired: true` adds the ones let go. |

package/dist/shared/connections.js

@@ -45,8 +45,9 @@ export function registerConnectionTools(server, makeClient) {
             "no, or unknown; unknown means the grant predates scope recording, so treat it as \"try " +
             "it\", not as a refusal. Also returns which platforms can be connected at all, which is a " +
             "smaller set than the networks nooticr can read. \"Manage comments\" reports what the " +
-            "platform granted, not something nooticr does: no nooticr tool posts, replies to or " +
-            "moderates a comment, so a yes there never means a drafted reply will be sent. Call this " +
+            "platform granted, not something this tool does: this tool posts nothing, and a yes there " +
+            "never means a drafted reply will be sent by itself. A reply goes out only through " +
+            "post_comment_reply, on a draft the user confirmed. Call this " +
             "before promising that something can be posted or replied to. No cost to call.",
         annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
         inputSchema: z.object({}).strict(),

package/dist/shared/employees.js

@@ -46,7 +46,7 @@ export function registerEmployeeTools(server, makeClient) {
         title: "Hire Employee",
         description: "Hire an AI employee (for example a Social Media Manager) that works on a schedule inside " +
             "this workspace. Pass `template` and optionally name, instructions, products (the string all, or a list of product ids; appId is deprecated), schedule, " +
-            "monthlyBudgetCredits, maxCreditsPerRun, approvalPolicy and notify. " +
+            "monthlyBudgetCredits, maxCreditsPerRun, approvalPolicy and notify (channels, and recipients: hirer, admins or member user ids). " +
             TWO_STEP_RULE +
             " Public actions (publish, email, reply, listing or price changes) wait for the user's " +
             "approval unless autopilot is turned on. The hiring user is billed for runs, up to the " +
@@ -69,7 +69,7 @@ export function registerEmployeeTools(server, makeClient) {
             monthlyBudgetCredits: z.number().int().min(1).optional(),
             maxCreditsPerRun: z.number().int().min(1).optional(),
             approvalPolicy: z.object({}).passthrough().optional().describe("Action type -> 'approval' | 'auto'."),
-            notify: z.object({}).passthrough().optional().describe("{channels:['email'|'slack']}."),
+            notify: z.object({}).passthrough().optional().describe("{channels:['email'|'slack'], recipients?:'hirer'|'admins'|[member user ids, max 25]}."),
             model: z.string().optional().describe("Optional model."),
             effort: z.string().optional().describe("low | medium | high."),
             confirm,

package/dist/shared/jobs.js

@@ -799,8 +799,8 @@ export function registerJobTools(server, makeClient, store) {
             postsChecked: threads.length,
             // Stated in the payload as well as the prose, because a model that
             // believes it can send will promise the user something that cannot
-            // happen. Some grants do allow managing comments (#29); nooticr has no
-            // send path whatever the grant says.
+            // happen. This payload comes from the drafting tools, which never post;
+            // only post_comment_reply sends, and only a confirmed draft.
             repliesCanBeSent: false,
             totalMentions: totalComments,
             totalThreads: threads.length,

package/dist/shared/loading-plans.js

@@ -487,6 +487,13 @@ export const LOADING_PLANS = {
     // Paid, but the first call only quotes; the charge waits for the confirmed second call.
     creative_image: { label: "Quoting the images", kind: "text", n: 1, steps: [] },
     creative_image_edit: { label: "Quoting the image edit", kind: "text", n: 1, steps: [] },
+    // Google Sheets (sheets.ts): reads are free; writes are free too (approval waits on the server side).
+    sheets_create: { label: "Creating the spreadsheet", kind: "text", n: 1, steps: [], free: true },
+    sheets_list: { label: "Listing your spreadsheets", kind: "list", n: 3, steps: [], free: true },
+    sheets_read: { label: "Reading the spreadsheet", kind: "text", n: 1, steps: [], free: true },
+    sheets_append_rows: { label: "Adding rows to the spreadsheet", kind: "text", n: 1, steps: [], free: true },
+    sheets_update_range: { label: "Updating the spreadsheet", kind: "text", n: 1, steps: [], free: true },
+    sheets_add_sheet: { label: "Adding a tab to the spreadsheet", kind: "text", n: 1, steps: [], free: true },
     list_brand_watches: { label: "Reading your watches", kind: "list", n: 3, steps: [], free: true },
     stop_brand_watch: { label: "Stopping the watch", kind: "text", n: 1, steps: [], free: true },
     update_watch_portfolio: { label: "Updating the portfolio", kind: "text", n: 1, steps: [], free: true },
@@ -530,6 +537,15 @@ export const LOADING_PLANS = {
     list_watchlist: { label: "Reading your watchlist", kind: "text", n: 1, steps: [], free: true },
     list_social_connections: { label: "Reading your connections", kind: "list", n: 3, steps: [], free: true },
     connect_social_account: { label: "Minting a fresh link", kind: "text", n: 1, steps: [], free: true },
+    list_comments_to_answer: { label: "Reading the comments waiting for a reply", kind: "list", n: 5, steps: [], free: true },
+    // Free when the caller passes `text`; 1 credit when the server writes the reply.
+    draft_comment_reply: {
+        label: "Drafting the reply",
+        kind: "text",
+        n: 1,
+        steps: [{ via: "draft_comment_reply", label: "Writing the reply", detail: "Free when you pass the text yourself", credits: 1 }],
+    },
+    post_comment_reply: { label: "Posting the reply", kind: "text", n: 1, steps: [], free: true },
     create_product: { label: "Writing the row", kind: "text", n: 1, steps: [], free: true },
     update_product: { label: "Patching the row", kind: "text", n: 1, steps: [], free: true },
 };

package/dist/shared/output-schemas.js

@@ -640,8 +640,9 @@ export const OUTPUT_SCHEMAS = {
         since: scalar().describe("The date window asked for, if any."),
         sinceApplied: scalar().describe("False when the platform returned no dates, so the window could not be honoured."),
         postsChecked: scalar().describe("Posts whose comments were actually read."),
-        repliesCanBeSent: scalar().describe("Always false. This tool only drafts and never sends; a reply is posted only by a separate step, " +
-            "on the user's connected account, after the user confirms the exact text."),
+        repliesCanBeSent: scalar().describe("Always false: answer_my_audience posts nothing, so the drafts this produces are for a person to " +
+            "paste in themselves, or to send through draft_comment_reply and post_comment_reply after " +
+            "confirming the text."),
         totalMentions: scalar().describe("Comments returned across every group."),
         totalThreads: scalar(),
         wantsReplyCount: scalar().describe("How many carry a reply signal. A sort, not a verdict."),
@@ -1327,6 +1328,13 @@ export const OUTPUT_SCHEMAS = {
         pollAfterSeconds: scalar(),
         error: scalar(),
     }),
+    // Google Sheets (nooticr-server BK2, sheets.ts): the server's own shapes, only stable keys named.
+    sheets_create: open({ id: scalar(), url: scalar(), title: scalar(), sheets: listOf(oneType(z.string())), owner: scalar() }),
+    sheets_list: open({ files: listOf(open({ id: scalar(), title: scalar(), url: scalar() })) }),
+    sheets_read: open({}),
+    sheets_append_rows: open({ id: scalar(), sheet: scalar(), rowsAppended: scalar(), cells: scalar(), updatedRange: scalar() }),
+    sheets_update_range: open({ id: scalar(), updatedRange: scalar(), updatedCells: scalar(), cells: scalar() }),
+    sheets_add_sheet: open({ id: scalar(), sheetId: scalar(), name: scalar() }),
     list_brand_watches: open({
         watches: listOf(open({
             watchId: scalar(),
@@ -1689,6 +1697,39 @@ export const OUTPUT_SCHEMAS = {
         connections: listOf(anyObject()),
         message: scalar(),
     }),
+    list_comments_to_answer: open({
+        account: open({
+            platform: scalar(),
+            username: scalar(),
+            influencerId: scalar(),
+            canManageComments: scalar(),
+            manageCommentsStatus: scalar(),
+        }).nullish(),
+        comments: listOf(open({})),
+        unsupported: listOf(open({ platform: scalar(), reason: scalar() })),
+        note: scalar(),
+        message: scalar(),
+    }),
+    draft_comment_reply: open({
+        draftId: scalar(),
+        reply: scalar().describe("The stored reply text. Show it to the user before posting."),
+        comment: open({ author: scalar(), snippet: scalar() }).nullish(),
+        postUrl: scalar(),
+        status: scalar(),
+        expiresInSeconds: scalar(),
+        confirmationToken: scalar().describe("Pass to post_comment_reply with confirm: true after the user agrees."),
+        rejected: scalar(),
+        instructions: scalar(),
+        mcpCredits: open({ cost: scalar(), balance: scalar() }).nullish(),
+    }),
+    post_comment_reply: open({
+        posted: scalar(),
+        alreadyPosted: scalar(),
+        draftId: scalar(),
+        platformReplyId: scalar(),
+        url: scalar(),
+        postedAt: scalar(),
+    }),
     // Marketplace. One shape for all three collection tools: a status poll
     // returns exactly what the scan that started it returns, and a single
     // product is a scan of one — describing them differently would be three

package/dist/shared/replies.js

@@ -0,0 +1,113 @@
+/**
+ * Replying to comments on the user's own posts (nooticr-server R1).
+ *
+ * Three tools, in the order a reply travels: list what is waiting, draft one
+ * reply (stored, nothing sent), post it. The first two never write to a
+ * network. `post_comment_reply` does, as the user's own account, so it needs
+ * the exact draft the user saw: the draftId, `confirm: true` and the
+ * confirmationToken that `draft_comment_reply` returned. The server enforces
+ * that; the schema here requires all three so a model cannot omit one.
+ *
+ * Thin passthroughs, like connections.ts: the server owns the rules.
+ */
+import { z } from "zod";
+import { OUTPUT_SCHEMAS } from "./output-schemas.js";
+function toResult(proxy) {
+    const textBlock = proxy.contentBlocks.find((c) => c.type === "text");
+    return {
+        content: textBlock ? [{ type: "text", text: String(textBlock.text ?? "") }] : [],
+        structuredContent: proxy.structured,
+    };
+}
+function failed(prefix, err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return {
+        content: [{ type: "text", text: `${prefix}: ${msg}` }],
+        isError: true,
+    };
+}
+const platform = z.enum(["youtube", "instagram"]);
+export function registerReplyTools(server, makeClient) {
+    server.registerTool("list_comments_to_answer", {
+        title: "List Comments To Answer",
+        description: "List recent comments on the user's own connected account that nobody has answered yet, " +
+            "newest first. Only the user's own posts, through their own connection: YouTube works once " +
+            "connected with capabilities: [\"manage_comments\"] (see connect_social_account); networks " +
+            "that cannot be answered come back under `unsupported` with the reason. Optional platform, " +
+            "influencerId, postId, sinceDays (1-30, default 7), limit (1-100, default 30), " +
+            "includeAnswered. Read-only: it sends nothing. No cost to call.",
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true },
+        outputSchema: OUTPUT_SCHEMAS.list_comments_to_answer,
+        inputSchema: z
+            .object({
+            platform: platform.optional().describe("Only this network."),
+            influencerId: z.number().int().optional().describe("Creator profile id when more than one account is connected."),
+            postId: z.string().optional().describe("Only comments on this video/media id."),
+            sinceDays: z.number().int().min(1).max(30).optional().describe("How far back to look (default 7)."),
+            limit: z.number().int().min(1).max(100).optional().describe("Most comments to return (default 30)."),
+            includeAnswered: z.boolean().optional().describe("Also list comments that already have a reply."),
+        })
+            .strict(),
+    }, async (args, extra) => {
+        const client = await makeClient({ ...extra, arguments: args });
+        try {
+            return toResult(await client.callTool("list_comments_to_answer", args));
+        }
+        catch (err) {
+            return failed("list_comments_to_answer failed", err);
+        }
+    });
+    server.registerTool("draft_comment_reply", {
+        title: "Draft Comment Reply",
+        description: "Draft a reply to one comment from list_comments_to_answer and store it; nothing is " +
+            "posted. Pass `text` to use the user's own wording (no cost), or omit it and nooticr " +
+            "writes one (costs 1 nooticr credit); `guidance` steers the writing. Replies may not contain links, " +
+            "emails, phone numbers or @-mentions of anyone but the commenter. Returns a draftId and a " +
+            "confirmationToken: show the reply to the user first, then post it with post_comment_reply.",
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+        outputSchema: OUTPUT_SCHEMAS.draft_comment_reply,
+        inputSchema: z
+            .object({
+            platform: platform.describe("The network the comment is on."),
+            commentId: z.string().describe("Comment id from list_comments_to_answer."),
+            postId: z.string().describe("Post id the comment is on."),
+            text: z.string().optional().describe("The reply to store, in the user's words. Omit to have one written (1 credit)."),
+            influencerId: z.number().int().optional().describe("Creator profile id when more than one account is connected."),
+            guidance: z.string().optional().describe("What the reply should say or avoid; a URL here is the only URL the reply may contain."),
+        })
+            .strict(),
+    }, async (args, extra) => {
+        const client = await makeClient({ ...extra, arguments: args });
+        try {
+            return toResult(await client.callTool("draft_comment_reply", args));
+        }
+        catch (err) {
+            return failed("draft_comment_reply failed", err);
+        }
+    });
+    server.registerTool("post_comment_reply", {
+        title: "Post Comment Reply",
+        description: "Post a stored reply draft to the comment, as the user's own account. Only after the user " +
+            "has seen and agreed to the exact text: pass the draftId, confirm: true and the " +
+            "confirmationToken from draft_comment_reply. Each comment is answered at most once and " +
+            "daily limits apply. It writes to a third-party network and cannot be undone from here. " +
+            "No cost to call.",
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
+        outputSchema: OUTPUT_SCHEMAS.post_comment_reply,
+        inputSchema: z
+            .object({
+            draftId: z.string().describe("Draft id from draft_comment_reply."),
+            confirm: z.boolean().describe("true only once the user has agreed to the exact text."),
+            confirmationToken: z.string().describe("Token returned with the draft."),
+        })
+            .strict(),
+    }, async (args, extra) => {
+        const client = await makeClient({ ...extra, arguments: args });
+        try {
+            return toResult(await client.callTool("post_comment_reply", args));
+        }
+        catch (err) {
+            return failed("post_comment_reply failed", err);
+        }
+    });
+}

package/dist/shared/sheets.js

@@ -0,0 +1,102 @@
+/**
+ * nooticr-server's `sheets_*` family (BK2, Google Sheets): create, list, read
+ * and write spreadsheets in the customer's connected Google account. Plain
+ * passthroughs to the server's `POST /mcp` dispatch, which owns the Google
+ * connection, the approval rule for files the customer picked, and the
+ * 10000-cell limit. Argument names match the server's schema exactly.
+ */
+import { z } from "zod";
+import { OUTPUT_SCHEMAS } from "./output-schemas.js";
+function toResult(proxy) {
+    const textBlock = proxy.contentBlocks.find((c) => c.type === "text");
+    const structured = proxy.structured;
+    const text = structured ? JSON.stringify(structured) : String(textBlock?.text ?? "");
+    return { content: [{ type: "text", text }], structuredContent: structured };
+}
+function failed(prefix, err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return {
+        content: [{ type: "text", text: `${prefix}: ${msg}` }],
+        isError: true,
+    };
+}
+const appId = z.number().int().optional().describe("Product id; optional when the workspace has one product.");
+const spreadsheetId = z.string().describe("Spreadsheet id from sheets_create or sheets_list.");
+const cell = z
+    .union([z.number(), z.boolean(), z.string(), z.null(), z.object({ formula: z.string() }).strict()])
+    .describe("A number, boolean, text or an ISO date (2026-01-31) or datetime; null leaves the cell empty. " +
+    'Text that looks like a formula or number stays text; use {"formula": "=SUM(A1:A3)"} for a formula.');
+const rows = z.array(z.array(cell));
+const READ = { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: true };
+const WRITE = { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true };
+export function registerSheetsTools(server, makeClient) {
+    const passthrough = (name) => async (args, extra) => {
+        const client = await makeClient({ ...extra, arguments: args });
+        try {
+            return toResult(await client.callTool(name, args));
+        }
+        catch (err) {
+            return failed(`${name} failed`, err);
+        }
+    };
+    server.registerTool("sheets_create", {
+        title: "Create Spreadsheet",
+        description: "Create a Google spreadsheet in the connected Google account, with the named sheets and a header row on each. " +
+            "Returns its id and URL; Nooticr owns the file, so later writes need no approval. " +
+            "Requires the product's Google Sheets connection. Free.",
+        annotations: WRITE,
+        inputSchema: z
+            .object({
+            appId,
+            title: z.string(),
+            sheets: z
+                .array(z.object({ name: z.string(), headers: z.array(z.string()).optional() }))
+                .optional()
+                .describe("Tabs to create."),
+        })
+            .strict(),
+        outputSchema: OUTPUT_SCHEMAS.sheets_create,
+    }, passthrough("sheets_create"));
+    server.registerTool("sheets_list", {
+        title: "List Spreadsheets",
+        description: "List the spreadsheets this connection can see: the ones Nooticr created and the ones the customer picked. " +
+            "Each says whether it was created or picked and whether the employee may edit it without approval. Free.",
+        annotations: READ,
+        inputSchema: z.object({ appId, limit: z.number().int().min(1).max(100).optional() }).strict(),
+        outputSchema: OUTPUT_SCHEMAS.sheets_list,
+    }, passthrough("sheets_list"));
+    server.registerTool("sheets_read", {
+        title: "Read Spreadsheet Range",
+        description: 'Read a range (A1 notation, e.g. "Ledger!A1:F200") of a spreadsheet. ' +
+            "Numbers come back as numbers and dates as formatted text; at most 10000 cells, " +
+            'and a range open at the bottom ("A:F") or longer than the cap is cut to the rows that fit, ' +
+            "with truncated=true when more may remain: read further down with a range that starts after the last row. Free.",
+        annotations: READ,
+        inputSchema: z.object({ appId, id: spreadsheetId, range: z.string() }).strict(),
+        outputSchema: OUTPUT_SCHEMAS.sheets_read,
+    }, passthrough("sheets_read"));
+    server.registerTool("sheets_append_rows", {
+        title: "Append Spreadsheet Rows",
+        description: "Append rows after the last row of a sheet (tab). Values are typed: numbers stay numbers and ISO dates become sheet dates. " +
+            "At most 10000 cells per call. Free on a file Nooticr created or one the customer allowed you to edit; " +
+            "on any other file the customer picked it waits for their approval.",
+        annotations: WRITE,
+        inputSchema: z.object({ appId, id: spreadsheetId, sheet: z.string().describe("Tab name."), rows }).strict(),
+        outputSchema: OUTPUT_SCHEMAS.sheets_append_rows,
+    }, passthrough("sheets_append_rows"));
+    server.registerTool("sheets_update_range", {
+        title: "Update Spreadsheet Range",
+        description: 'Overwrite a range (A1 notation, e.g. "Ledger!B2:C3") with values. Typed like sheets_append_rows; ' +
+            "at most 10000 cells per call. Same approval rule as sheets_append_rows: free on a file Nooticr created or one the customer allowed you to edit, otherwise it waits for their approval.",
+        annotations: WRITE,
+        inputSchema: z.object({ appId, id: spreadsheetId, range: z.string(), values: rows }).strict(),
+        outputSchema: OUTPUT_SCHEMAS.sheets_update_range,
+    }, passthrough("sheets_update_range"));
+    server.registerTool("sheets_add_sheet", {
+        title: "Add Spreadsheet Tab",
+        description: "Add an empty sheet (tab) to a spreadsheet. Same approval rule as sheets_append_rows: free on a file Nooticr created or one the customer allowed you to edit, otherwise it waits for their approval.",
+        annotations: WRITE,
+        inputSchema: z.object({ appId, id: spreadsheetId, name: z.string() }).strict(),
+        outputSchema: OUTPUT_SCHEMAS.sheets_add_sheet,
+    }, passthrough("sheets_add_sheet"));
+}

package/dist/shared/tools-def.js

@@ -312,6 +312,42 @@ export const TOOL_DEFINITIONS = [
         description: "Status of an asynchronous creative job by jobId: queued, running, done, failed or canceled, with the finished assets and the credits quoted, charged and refunded. Poll after pollAfterSeconds. No cost to call.",
         inputSchema: z.object({ jobId: z.string().describe("jobId returned when the job was started.") }).strict(),
     },
+    {
+        name: "sheets_create",
+        title: "Create Spreadsheet",
+        description: "Create a Google spreadsheet in the connected Google account, with the named sheets and a header row on each. Returns its id and URL; Nooticr owns the file, so later writes need no approval. Requires the product's Google Sheets connection. Free.",
+        inputSchema: z.object({ appId: z.number().int().optional().describe("Product id; optional when the workspace has one product."), title: z.string(), sheets: z.array(z.object({ name: z.string(), headers: z.array(z.string()).optional() })).optional().describe("Tabs to create.") }).strict(),
+    },
+    {
+        name: "sheets_list",
+        title: "List Spreadsheets",
+        description: "List the spreadsheets this connection can see: the ones Nooticr created and the ones the customer picked. Each says whether it was created or picked and whether the employee may edit it without approval. Free.",
+        inputSchema: z.object({ appId: z.number().int().optional().describe("Product id; optional when the workspace has one product."), limit: z.number().int().min(1).max(100).optional() }).strict(),
+    },
+    {
+        name: "sheets_read",
+        title: "Read Spreadsheet Range",
+        description: "Read a range (A1 notation, e.g. \"Ledger!A1:F200\") of a spreadsheet. Numbers come back as numbers and dates as formatted text; at most 10000 cells, and a range open at the bottom (\"A:F\") or longer than the cap is cut to the rows that fit, with truncated=true when more may remain: read further down with a range that starts after the last row. Free.",
+        inputSchema: z.object({ appId: z.number().int().optional().describe("Product id; optional when the workspace has one product."), id: z.string().describe("Spreadsheet id from sheets_create or sheets_list."), range: z.string() }).strict(),
+    },
+    {
+        name: "sheets_append_rows",
+        title: "Append Spreadsheet Rows",
+        description: "Append rows after the last row of a sheet (tab). Values are typed: numbers stay numbers and ISO dates become sheet dates. At most 10000 cells per call. Free on a file Nooticr created or one the customer allowed you to edit; on any other file the customer picked it waits for their approval.",
+        inputSchema: z.object({ appId: z.number().int().optional().describe("Product id; optional when the workspace has one product."), id: z.string().describe("Spreadsheet id from sheets_create or sheets_list."), sheet: z.string().describe("Tab name."), rows: z.array(z.array(z.union([z.number(), z.boolean(), z.string(), z.null(), z.object({ formula: z.string() }).strict()]).describe('A number, boolean, text or an ISO date (2026-01-31) or datetime; null leaves the cell empty. Text that looks like a formula or number stays text; use {"formula": "=SUM(A1:A3)"} for a formula.'))) }).strict(),
+    },
+    {
+        name: "sheets_update_range",
+        title: "Update Spreadsheet Range",
+        description: "Overwrite a range (A1 notation, e.g. \"Ledger!B2:C3\") with values. Typed like sheets_append_rows; at most 10000 cells per call. Same approval rule as sheets_append_rows: free on a file Nooticr created or one the customer allowed you to edit, otherwise it waits for their approval.",
+        inputSchema: z.object({ appId: z.number().int().optional().describe("Product id; optional when the workspace has one product."), id: z.string().describe("Spreadsheet id from sheets_create or sheets_list."), range: z.string(), values: z.array(z.array(z.union([z.number(), z.boolean(), z.string(), z.null(), z.object({ formula: z.string() }).strict()]).describe('A number, boolean, text or an ISO date (2026-01-31) or datetime; null leaves the cell empty. Text that looks like a formula or number stays text; use {"formula": "=SUM(A1:A3)"} for a formula.'))) }).strict(),
+    },
+    {
+        name: "sheets_add_sheet",
+        title: "Add Spreadsheet Tab",
+        description: "Add an empty sheet (tab) to a spreadsheet. Same approval rule as sheets_append_rows: free on a file Nooticr created or one the customer allowed you to edit, otherwise it waits for their approval.",
+        inputSchema: z.object({ appId: z.number().int().optional().describe("Product id; optional when the workspace has one product."), id: z.string().describe("Spreadsheet id from sheets_create or sheets_list."), name: z.string() }).strict(),
+    },
     {
         name: "list_brand_watches",
         title: "List Brand Watches",
@@ -441,7 +477,7 @@ export const TOOL_DEFINITIONS = [
     {
         name: "list_social_connections",
         title: "List Social Connections",
-        description: "List the social accounts your workspace has connected and what each connection is allowed to do — read the account, publish a post, manage comments. Manage comments reports the grant; no nooticr tool posts or replies to a comment. Also returns which platforms can be connected at all. No cost to call.",
+        description: "List the social accounts your workspace has connected and what each connection is allowed to do — read the account, publish a post, manage comments. Manage comments reports the grant; this tool posts nothing, and a reply goes out only through post_comment_reply on a draft the user confirmed. Also returns which platforms can be connected at all. No cost to call.",
         inputSchema: z.object({}).strict(),
     },
     {
@@ -450,6 +486,24 @@ export const TOOL_DEFINITIONS = [
         description: "Get a link to open so you can connect one social account. The user approves at the provider; nothing is connected until they do, and no credential ever passes through this tool. For YouTube, pass capabilities [\"manage_comments\"] to also ask for the comment-management grant. No cost to call.",
         inputSchema: z.object({ platform: z.string().describe("Which network to connect."), influencerId: z.number().int().optional(), appId: z.number().int().optional(), capabilities: z.array(z.enum(["manage_comments"])).optional().describe("YouTube only: [\"manage_comments\"] asks for the comment-management grant.") }).strict(),
     },
+    {
+        name: "list_comments_to_answer",
+        title: "List Comments To Answer",
+        description: "List recent comments on the user's own connected account that nobody has answered yet, newest first. Only the user's own posts, through their own connection: YouTube works once connected with capabilities: [\"manage_comments\"] (see connect_social_account); networks that cannot be answered come back under `unsupported` with the reason. Optional platform, influencerId, postId, sinceDays (1-30, default 7), limit (1-100, default 30), includeAnswered. Read-only: it sends nothing. No cost to call.",
+        inputSchema: z.object({ platform: z.enum(["youtube", "instagram"]).optional().describe("Only this network."), influencerId: z.number().int().optional().describe("Creator profile id when more than one account is connected."), postId: z.string().optional().describe("Only comments on this video/media id."), sinceDays: z.number().int().min(1).max(30).optional().describe("How far back to look (default 7)."), limit: z.number().int().min(1).max(100).optional().describe("Most comments to return (default 30)."), includeAnswered: z.boolean().optional().describe("Also list comments that already have a reply.") }).strict(),
+    },
+    {
+        name: "draft_comment_reply",
+        title: "Draft Comment Reply",
+        description: "Draft a reply to one comment from list_comments_to_answer and store it; nothing is posted. Pass `text` to use the user's own wording (no cost), or omit it and nooticr writes one (costs 1 nooticr credit); `guidance` steers the writing. Replies may not contain links, emails, phone numbers or @-mentions of anyone but the commenter. Returns a draftId and a confirmationToken: show the reply to the user first, then post it with post_comment_reply.",
+        inputSchema: z.object({ platform: z.enum(["youtube", "instagram"]).describe("The network the comment is on."), commentId: z.string().describe("Comment id from list_comments_to_answer."), postId: z.string().describe("Post id the comment is on."), text: z.string().optional().describe("The reply to store, in the user's words. Omit to have one written (1 credit)."), influencerId: z.number().int().optional().describe("Creator profile id when more than one account is connected."), guidance: z.string().optional().describe("What the reply should say or avoid; a URL here is the only URL the reply may contain.") }).strict(),
+    },
+    {
+        name: "post_comment_reply",
+        title: "Post Comment Reply",
+        description: "Post a stored reply draft to the comment, as the user's own account. Only after the user has seen and agreed to the exact text: pass the draftId, confirm: true and the confirmationToken from draft_comment_reply. Each comment is answered at most once and daily limits apply. It writes to a third-party network and cannot be undone from here. No cost to call.",
+        inputSchema: z.object({ draftId: z.string().describe("Draft id from draft_comment_reply."), confirm: z.boolean().describe("true only once the user has agreed to the exact text."), confirmationToken: z.string().describe("Token returned with the draft.") }).strict(),
+    },
     {
         name: "connect_store",
         title: "Connect Store",
@@ -465,7 +519,7 @@ export const TOOL_DEFINITIONS = [
     {
         name: "answer_my_audience",
         title: "Answer My Audience",
-        description: "The questions waiting for you under your own posts. Fetches a creator's recent posts, reads the comments on each, and returns them grouped under the post they were left on \u2014 every comment with a stable id, and the ones that read like questions or requests flagged and sorted to the top. Finds and drafts; this tool cannot post a reply \u2014 a reply is posted only after the user confirms its exact text. Use when the job is to answer your own audience rather than to read about strangers. Consumes 2 nooticr credits for the post list plus 2 per post opened \u2014 14 credits at the default of 6 posts.",
+        description: "The questions waiting for you under your own posts. Fetches a creator's recent posts, reads the comments on each, and returns them grouped under the post they were left on \u2014 every comment with a stable id, and the ones that read like questions or requests flagged and sorted to the top. Finds and drafts; it cannot post a reply \u2014 the drafts are for a person to paste in themselves, or to send through draft_comment_reply and post_comment_reply once the user has confirmed the text. Use when the job is to answer your own audience rather than to read about strangers. Consumes 2 nooticr credits for the post list plus 2 per post opened \u2014 14 credits at the default of 6 posts.",
         inputSchema: z.object({ username: z.string().describe("Your handle, with or without @."), platform: z.string().optional().describe("Platform (default tiktok)."), limit: z.number().int().optional().describe("Posts to open (default 6, max 12). Each one is a comment fetch, so this is the price."), commentsPerPost: z.number().int().optional().describe("Comments to read per post (default 20, max 50)."), since: z.string().optional().describe("Only posts published on or after this date, as YYYY-MM-DD. Windows the posts, not the comments.") }).strict(),
     },
     {
@@ -573,8 +627,8 @@ export const TOOL_DEFINITIONS = [
     {
         name: "hire_employee",
         title: "Hire Employee",
-        description: "Hire an AI employee (for example a Social Media Manager) that works on a schedule inside this workspace. Pass `template` and optionally name, instructions, products (the string all, or a list of product ids; appId is deprecated), schedule, monthlyBudgetCredits, maxCreditsPerRun, approvalPolicy and notify. The first call changes nothing and returns a preview and a confirmationToken; show it to the user, and call again with confirm: true and the token only after the user explicitly agrees — never confirm on the user's behalf. Public actions (publish, email, reply, listing or price changes) wait for the user's approval unless autopilot is turned on. The hiring user is billed for runs, up to the monthly budget. No cost to call.",
-        inputSchema: z.object({ template: z.string().describe("Template slug, e.g. social-media-manager."), name: z.string().optional().describe("What to call the employee."), instructions: z.string().optional().describe("Standing instructions from the customer (tone, topics to avoid, ...)."), appId: z.number().int().optional().describe("Deprecated: same as products:[appId]. Do not send together with products."), products: z.union([z.literal("all"), z.array(z.number().int()).min(1)]).optional().describe('"all" (every product, including ones added later) or a list of product ids the employee covers.'), schedule: z.object({}).passthrough().optional().describe("{kind:'weekly',days:['mon'],times:['09:00'],tz:'Europe/Paris'} | {kind:'interval',minutes:N>=60} | {kind:'manual'}."), monthlyBudgetCredits: z.number().int().min(1).optional(), maxCreditsPerRun: z.number().int().min(1).optional(), approvalPolicy: z.object({}).passthrough().optional().describe("Action type -> 'approval' | 'auto'."), notify: z.object({}).passthrough().optional().describe("{channels:['email'|'slack']}."), model: z.string().optional().describe("Optional model."), effort: z.string().optional().describe("low | medium | high."), confirm: z.boolean().optional(), confirmationToken: z.string().optional().describe("Token returned in the quote.") }).strict(),
+        description: "Hire an AI employee (for example a Social Media Manager) that works on a schedule inside this workspace. Pass `template` and optionally name, instructions, products (the string all, or a list of product ids; appId is deprecated), schedule, monthlyBudgetCredits, maxCreditsPerRun, approvalPolicy and notify (channels, and recipients: hirer, admins or member user ids). The first call changes nothing and returns a preview and a confirmationToken; show it to the user, and call again with confirm: true and the token only after the user explicitly agrees — never confirm on the user's behalf. Public actions (publish, email, reply, listing or price changes) wait for the user's approval unless autopilot is turned on. The hiring user is billed for runs, up to the monthly budget. No cost to call.",
+        inputSchema: z.object({ template: z.string().describe("Template slug, e.g. social-media-manager."), name: z.string().optional().describe("What to call the employee."), instructions: z.string().optional().describe("Standing instructions from the customer (tone, topics to avoid, ...)."), appId: z.number().int().optional().describe("Deprecated: same as products:[appId]. Do not send together with products."), products: z.union([z.literal("all"), z.array(z.number().int()).min(1)]).optional().describe('"all" (every product, including ones added later) or a list of product ids the employee covers.'), schedule: z.object({}).passthrough().optional().describe("{kind:'weekly',days:['mon'],times:['09:00'],tz:'Europe/Paris'} | {kind:'interval',minutes:N>=60} | {kind:'manual'}."), monthlyBudgetCredits: z.number().int().min(1).optional(), maxCreditsPerRun: z.number().int().min(1).optional(), approvalPolicy: z.object({}).passthrough().optional().describe("Action type -> 'approval' | 'auto'."), notify: z.object({}).passthrough().optional().describe("{channels:['email'|'slack'], recipients?:'hirer'|'admins'|[member user ids, max 25]}."), model: z.string().optional().describe("Optional model."), effort: z.string().optional().describe("low | medium | high."), confirm: z.boolean().optional(), confirmationToken: z.string().optional().describe("Token returned in the quote.") }).strict(),
     },
     {
         name: "list_employees",

package/dist/shared/tools.js

@@ -22,8 +22,10 @@ import { BackendWatchStore, MemoryWatchStore, registerWatchlist, } from "./watch
 import { registerJobTools } from "./jobs.js";
 import { registerBrandWatch } from "./brand-watch.js";
 import { registerCreativeTools } from "./creative.js";
+import { registerSheetsTools } from "./sheets.js";
 import { registerOwnAccountTools } from "./own-account.js";
 import { registerConnectionTools } from "./connections.js";
+import { registerReplyTools } from "./replies.js";
 import { registerEmployeeTools } from "./employees.js";
 import { registerStoreReadTools } from "./store-read.js";
 import { registerGettingStarted, SERVER_INSTRUCTIONS } from "./getting-started.js";
@@ -34,7 +36,7 @@ import { registerAmazonTools } from "./amazon.js";
 import { registerMarketplaceTools } from "./marketplace.js";
 import { DEFAULT_NOOTICR_SETTINGS, DEFAULT_SOCIAL_PLATFORMS, MemorySettingsStore, SETTINGS_READ_TOOL, SETTINGS_UPDATE_TOOL, settingsOwnerFromAuth, } from "./settings.js";
 /** Current MCP server version — bumped on every deploy for traceability. */
-export const MCP_SERVER_VERSION = "1.26.66";
+export const MCP_SERVER_VERSION = "1.26.68";
 /** MCP Apps extension identifier */
 const UI_EXTENSION = "io.modelcontextprotocol/ui";
 /** MIME type for MCP Apps HTML resources */
@@ -2890,7 +2892,10 @@ export function createMcpServer(rawMakeClient, opts) {
     registerOwnAccountTools(server, makeClient);
     // Creative assets (creative.ts): the free reads of nooticr-server's creative_* family.
     registerCreativeTools(server, makeClient);
+    // Google Sheets (sheets.ts): the sheets_* family of nooticr-server BK2.
+    registerSheetsTools(server, makeClient);
     registerConnectionTools(server, makeClient);
+    registerReplyTools(server, makeClient);
     // AI employees (employees.ts): hire, list, pause, fire, and approve or reject what they queue.
     registerEmployeeTools(server, makeClient);
     // Store connections (store-read.ts): the connect link and the catalogue read.

package/dist/shared/ui-template.js

@@ -4411,7 +4411,7 @@ export const NOOTICR_UI_TEMPLATE = `<!DOCTYPE html>
           +'<div class="nt-commerce-chiprow">'+readOnly.map(function(k){
             return '<span class="nt-tag nt-commerce-nettag tag">'+glyph(k,12)+esc(pTitle(k))+"</span>";}).join("")+"</div>"
           +'<p class="nt-commerce-conn-sub" style="margin-top:8px">So "monitor my brand on Weibo" works and "reply to that Weibo comment" cannot — '
-          +"replies are never sent on their own: one is posted only after you confirm its exact text.</p></div>":""),
+          +"replies go out only through post_comment_reply, on a draft you confirmed, and only where a connection allows managing comments.</p></div>":""),
       footer:'<span class="ai-note">Each press mints a fresh link — an old one does not work twice. Approve in your own browser; nothing is connected until you do.</span>'});
   }
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nooticr/mcp",
   "mcpName": "com.nooticr/mcp",
-  "version": "1.26.66",
+  "version": "1.26.68",
   "description": "MCP server for nooticr - fetch, discover and understand TikTok/Instagram/YouTube/X/Reddit/LinkedIn/Weibo posts with AI (media metadata, niche discovery, brand monitoring, hook & viral analysis)",
   "homepage": "https://mcp.nooticr.com",
   "repository": {