@omnisocials/mcp-server 1.33.0 → 1.34.1

package/README.md

@@ -189,15 +189,18 @@ Apply a set when creating a post: `create_post` / `create_and_publish_post` acce
 | `delete_webhook` | Delete a webhook |
 | `rotate_webhook_secret` | Rotate a webhook's signing secret |
 
-### Social Inbox (5 tools)
+### Social Inbox (8 tools)
 
 | Tool | Description |
 |------|-------------|
-| `list_inbox_conversations` | List conversations — Instagram/Facebook DMs, comments, mentions, LinkedIn company-page comments/mentions, TikTok video comments, YouTube video comments, X DMs (opt-in), and Threads replies on your posts plus mentions (rolling out); filter by platform, type, or unread |
-| `get_inbox_conversation` | Get a conversation's full message history |
-| `mark_inbox_read` | Mark all incoming messages in a conversation as read |
-| `reply_to_inbox` | Reply to a DM, comment, or mention (existing conversations only) |
-| `hide_inbox_reply` | Hide or unhide a reply on one of your Threads posts (Threads only for now) |
+| `list_inbox_conversations` | List conversations: Instagram/Facebook DMs, comments, mentions, LinkedIn company-page comments/mentions, TikTok video comments, YouTube video comments, X DMs (opt-in), and Threads replies on your posts plus mentions; filter by platform, type, unread, or `unanswered` |
+| `get_next_unanswered` | The next item that still needs an answer (longest-waiting first) with the whole thread and the post it is on; filter by platform or type, `include_read`, `exclude` |
+| `get_inbox_conversation` | Get a conversation's full message history with the post it belongs to; every message shows its `#id` |
+| `mark_inbox_read` | Mark all incoming messages in a conversation as read (also the durable skip for `get_next_unanswered`) |
+| `reply_to_inbox` | Reply to a DM, comment, or mention (existing conversations only); `include_next` returns the next unanswered item in the same call |
+| `hide_inbox_comment` | Hide or unhide a comment on one of your posts (Facebook, Instagram, TikTok, YouTube, Threads) |
+| `delete_inbox_comment` | Permanently delete a comment on one of your posts, with the replies under it (Facebook, Instagram, TikTok) |
+| `hide_inbox_reply` | Older name for `hide_inbox_comment`, kept for compatibility |
 
 Requires an API key with the opt-in `inbox:read` / `inbox:write` scopes — enable "Social Inbox access" when you create the key.
 
@@ -224,6 +227,22 @@ Full API docs: [docs.omnisocials.com](https://docs.omnisocials.com)
 
 ## Changelog
 
+### 1.34.1 (2026-09-14)
+
+- **Changed: Threads threads and the Threads inbox are no longer "rolling out".** Meta approved the reply, read-replies and mentions permissions, so `threads.thread_parts` and the Threads inbox work for every Threads connection; accounts connected before 2026-09-14 need a one-time reconnect under Settings -> Organisation -> Workspaces (`400`/`401` errors name the reconnect). Threads location tagging stays rolling out (not approved yet). Same on the companion server.
+
+### 1.34.0 (2026-09-06)
+
+- **Added: work through the inbox one item at a time.** New tool `get_next_unanswered` returns the next inbox item that still needs an answer, with the whole conversation and the post it is on, in one call: the customer's latest DM with no reply after it (Instagram/Facebook DMs within the 24-hour reply window), or a comment/mention nobody replied to and that is not hidden. Longest-waiting first; filter with `platform` and `type`; only unread items by default (`mark_inbox_read` is the durable skip, `include_read: true` widens it, `exclude` skips up to 100 conversation ids for one call); looks back 30 days and reports `remaining`. `reply_to_inbox` accepts `include_next: true` and returns the next item in the same response. `list_inbox_conversations` gains an `unanswered` filter. Replies typed in the native apps now appear as outgoing messages and count as answers. Same on the companion server (`mcp.omnisocials.com`).
+- **Added: hide and delete comments on every comment platform.** New tool `hide_inbox_comment` hides (or unhides with `hide: false`) a comment on one of your posts on Facebook, Instagram, TikTok, YouTube and Threads (on YouTube, hide sets the comment to `rejected` and unhide publishes it again); `hide_inbox_reply` stays as an alias. New tool `delete_inbox_comment` permanently deletes a comment on Facebook, Instagram and TikTok, on the platform and from the inbox, with the replies under it (YouTube cannot delete other people's comments: hide instead). Both take the message id (`#id` in the thread). Errors: `403 reconnect_required`, `429 quota_exceeded` (YouTube hide), `502 platform_error`, `404 account_not_connected`, `401 reauth_required` (TikTok/Threads). `hidden` is now a boolean for every comment platform, `null` for DMs. Same on the companion server.
+- **Added: post context in inbox threads.** The `post` object on conversations and messages carries `url` and `media_type` next to `id`, `caption` and `thumbnail`. `get_inbox_conversation` and `get_next_unanswered` render the post above the thread, and every message shows its `#id` plus `hidden` and reply-to-a-comment markers. Same on the companion server.
+
+### 1.33.0 (2026-09-06)
+
+- **Added: submit posts for approval.** New tool `list_approval_workflows` lists the workspace's approval workflows (id, steps, named approvers; workflows are created in the dashboard under Approvals). `create_post` accepts `approval_workflow_id`: the post is created as `in_approval` instead of `scheduled`, the approvers are notified (dashboard badge, email, Slack), and it publishes at `scheduled_at` once the workflow's last step approves it (Approvals page, or `approve_post`). This is the flow for "the agent prepares everything, a human only approves". Requires `scheduled_at`; not allowed with `publish_now`. Errors: `404 workflow_not_found`, `400 validation_error` (no `scheduled_at`, or no approvers on the first step). Same on the companion server (`mcp.omnisocials.com`).
+- **Added: platform options in `get_post`.** A new "Platform Options" section renders the TikTok options that were set (title, privacy level, cover frame `video_cover_timestamp_ms`, comment/duet/stitch toggles, AI-generated and brand disclosures, auto-add music), the YouTube options (title, privacy, tags, made for kids) and the Pinterest options (board, title, link). Previously only `first_comment` was rendered, so a pinned TikTok cover could not be verified without opening the post. Same on the companion server.
+- **Changed: inbox attachment types.** Inbox `attachment.type` now reflects the fetched bytes rather than the platform's label (a generic photo DM is `image`, an MP4 story mention is `video`; `file` only when we could not classify the media), and a new `link` type carries the platform's own URL when it did not point at media (for example a shared post). `reply_to_inbox` now returns clear errors instead of `platform_error` for Instagram DM text over 1,000 characters (`validation_error`), replies outside the 24-hour messaging window (`outside_messaging_window`), and replies to a comment or message that no longer exists on the platform (`not_found`).
+
 ### 1.32.0 (2026-09-02)
 
 - **Added: TikTok Photo Mode title.** The `tiktok` option object on `create_post`, `create_and_publish_post`, and `update_post` accepts `title` (max 90 characters): the title TikTok shows above the caption on photo carousels. TikTok's photo endpoint takes the title and the caption as two separate fields, and until now only the caption (`content`) could be set here, so photo posts created through the MCP always published with an empty title. Video posts have a single caption field and ignore `title`. `get_post` returns it as `tiktok.title`. Same on the companion server (`mcp.omnisocials.com`).

package/build/client.d.ts

@@ -1,4 +1,4 @@
-import type { Account, AnalyticsOverview, AccountAnalyticsEntry, ApiPost, ApiResponse, AudioSearchResult, BestTimesResult, HashtagSet, LocationSearchResult, MediaCheckResult, MediaCompatibility, MediaFolder, MediaItem, PdfUploadResult, PostAnalytics, PublishPostResult, RecentPlatformPost, RetryPostResult, ApprovePostResult, RejectPostResult, InboxConversation, InboxMessage, Webhook } from "./types.js";
+import type { Account, AnalyticsOverview, AccountAnalyticsEntry, ApiPost, ApiResponse, AudioSearchResult, BestTimesResult, HashtagSet, LocationSearchResult, MediaCheckResult, MediaCompatibility, MediaFolder, MediaItem, PdfUploadResult, PostAnalytics, PublishPostResult, RecentPlatformPost, RetryPostResult, ApprovePostResult, RejectPostResult, InboxConversation, InboxDeleteResult, InboxMessage, InboxNextUnanswered, Webhook } from "./types.js";
 export declare function fetchImageAsBase64(url: string): Promise<{
     data: string;
     mimeType: string;
@@ -380,6 +380,7 @@ export declare class OmniSocialsClient {
         platform?: string;
         type?: string;
         unread?: string;
+        unanswered?: string;
         limit?: string;
         cursor?: string;
     }): Promise<ApiResponse<InboxConversation[]>>;
@@ -392,6 +393,15 @@ export declare class OmniSocialsClient {
         text: string;
         attachment_url?: string;
         attachment_type?: string;
+        include_next?: boolean;
     }): Promise<ApiResponse<InboxMessage>>;
+    getNextUnanswered(params?: {
+        platform?: string;
+        type?: string;
+        order?: string;
+        include_read?: string;
+        exclude?: string;
+    }): Promise<ApiResponse<InboxNextUnanswered | null>>;
     hideInboxMessage(messageId: string, hide?: boolean): Promise<ApiResponse<InboxMessage>>;
+    deleteInboxMessage(messageId: string): Promise<ApiResponse<InboxDeleteResult>>;
 }

package/build/client.js

@@ -435,12 +435,29 @@ export class OmniSocialsClient {
     async markInboxRead(conversationId) {
         return this.request("POST", `/inbox/conversations/${encodeURIComponent(conversationId)}/read`);
     }
+    // `include_next: true` makes the response also carry `next` (the next
+    // conversation that needs an answer, same shape as getNextUnanswered data)
+    // and `remaining` at the top level.
     async replyToInboxConversation(conversationId, data) {
         return this.request("POST", `/inbox/conversations/${encodeURIComponent(conversationId)}/reply`, data);
     }
-    // Hide/unhide a reply on one of the workspace's Threads posts (Threads
-    // only for now). `hide: false` unhides. Needs the inbox:write scope.
+    // The next inbox item that needs an answer (GET /inbox/next): `data` is
+    // { conversation, message, messages } or null, `remaining` sits next to it.
+    // Only unread items by default (include_read: "true" widens it); `exclude`
+    // is a comma-separated list of conversation ids to skip for this call.
+    async getNextUnanswered(params) {
+        return this.request("GET", "/inbox/next", undefined, params);
+    }
+    // Hide/unhide a comment on one of the workspace's posts (Facebook,
+    // Instagram, TikTok, YouTube, Threads). `hide: false` unhides. Needs the
+    // inbox:write scope.
     async hideInboxMessage(messageId, hide = true) {
         return this.request("POST", `/inbox/messages/${encodeURIComponent(messageId)}/hide`, { hide });
     }
+    // Delete a comment on the platform and from the inbox (Facebook, Instagram,
+    // TikTok; YouTube cannot delete other people's comments, hide instead).
+    // Replies under it go too. Needs the inbox:write scope.
+    async deleteInboxMessage(messageId) {
+        return this.request("DELETE", `/inbox/messages/${encodeURIComponent(messageId)}`);
+    }
 }

package/build/index.js

@@ -29,7 +29,7 @@ const sessionState = { activeIndex: 0 };
 const getActiveClient = () => workspaceClients[sessionState.activeIndex].client;
 const server = new McpServer({
     name: "OmniSocials",
-    version: "1.32.0",
+    version: "1.34.1",
 });
 // Register all tools - pass getter function so tools always use the active workspace's client
 registerPostTools(server, getActiveClient);

package/build/tools/inbox.js

@@ -9,10 +9,88 @@ const PLATFORM_EMOJI = {
     x: "🐦",
     threads: "🧵",
 };
+const INBOX_PLATFORMS = [
+    "instagram",
+    "facebook",
+    "linkedin",
+    "tiktok",
+    "youtube",
+    "x",
+    "threads",
+];
+function errorResult(error) {
+    return {
+        content: [
+            {
+                type: "text",
+                text: `Error (${error.code}): ${error.message}`,
+            },
+        ],
+    };
+}
+// Inbox thread rendering shared by get_inbox_conversation, get_next_unanswered
+// and reply_to_inbox (include_next). The post comes first (a comment like
+// "what size is this?" only makes sense with the post in view), then the
+// messages oldest first, each with its inbox id so hide/delete can target it.
+function renderInboxPost(post) {
+    if (!post || (!post.caption && !post.url && !post.thumbnail))
+        return "";
+    let md = `**Post**`;
+    if (post.media_type) {
+        md += ` _(${String(post.media_type).toLowerCase().replace(/_/g, " ")})_`;
+    }
+    md += `\n`;
+    if (post.caption) {
+        md += `> ${post.caption.replace(/\s*\n+\s*/g, " ").slice(0, 600)}\n`;
+    }
+    if (post.url)
+        md += `🔗 ${post.url}\n`;
+    if (post.thumbnail)
+        md += `🖼️ ${post.thumbnail}\n`;
+    return md + `\n`;
+}
+function renderInboxMessages(msgs, highlightId) {
+    let md = "";
+    for (const m of msgs) {
+        const who = m.direction === "outgoing"
+            ? "→ You"
+            : `← ${m.sender?.name || m.sender?.username || "Them"}`;
+        const flags = [];
+        if (highlightId && String(m.id) === String(highlightId)) {
+            flags.push("**needs a reply**");
+        }
+        if (m.hidden)
+            flags.push("hidden");
+        if (m.parent_comment_id)
+            flags.push("reply to a comment");
+        md += `**${who}** _(${formatDateTime(m.timestamp)})_ \`#${m.id}\`${flags.length ? " · " + flags.join(" · ") : ""}\n${m.text || ""}\n`;
+        if (m.attachment?.url) {
+            md += `📎 [${m.attachment.type}] ${m.attachment.url}\n`;
+        }
+        if (m.permalink)
+            md += `${m.permalink}\n`;
+        md += `\n`;
+    }
+    return md;
+}
+function renderNextUnanswered(result) {
+    const item = result.data;
+    if (!item)
+        return "Nothing is waiting for an answer.";
+    const c = item.conversation;
+    const who = c.participant?.name || c.participant?.username || "Unknown";
+    let md = `## Next: ${PLATFORM_EMOJI[c.platform] || ""} ${c.platform} ${c.type} from ${who}\n\n`;
+    md += `Conversation ID: \`${c.conversation_id}\`\nMessage to answer: \`#${item.message.id}\`\n\n`;
+    md += renderInboxPost(item.message.post || c.post);
+    md += renderInboxMessages(item.messages, item.message.id);
+    md += `_${result.remaining || 0} more waiting._\n\n`;
+    md += `_Reply: reply_to_inbox with the conversation ID (add include_next: true to get the next one in the same call). Skip for good: mark_inbox_read. Comments: hide_inbox_comment / delete_inbox_comment with the message id._`;
+    return md;
+}
 export function registerInboxTools(server, getClient) {
-    server.tool("list_inbox_conversations", "List social inbox conversations (Instagram/Facebook DMs, comments, mentions, LinkedIn company-page comments/mentions, TikTok video comments, YouTube video comments, X DMs where the workspace has opted into X DMs, and Threads replies on the workspace's posts plus mentions), newest activity first. Threads conversations are comment (replies on the workspace's posts) and mention only, need a Threads connection with the reply-reading permission, and are currently rolling out (disabled on production until Meta approves the permission). Cursor-paginated: pass the returned cursor to get the next page.", {
+    server.tool("list_inbox_conversations", "List social inbox conversations (Instagram/Facebook DMs, comments, mentions, LinkedIn company-page comments/mentions, TikTok video comments, YouTube video comments, X DMs where the workspace has opted into X DMs, and Threads replies on the workspace's posts plus mentions), newest activity first. Cursor-paginated: pass the returned cursor to get the next page. To work through what needs answering one item at a time, use get_next_unanswered instead.", {
         platform: z
-            .enum(["instagram", "facebook", "linkedin", "tiktok", "x", "youtube", "threads"])
+            .enum(INBOX_PLATFORMS)
             .optional()
             .describe("Filter to one platform"),
         type: z
@@ -23,6 +101,10 @@ export function registerInboxTools(server, getClient) {
             .boolean()
             .optional()
             .describe("Only conversations with unread incoming messages"),
+        unanswered: z
+            .boolean()
+            .optional()
+            .describe("Only conversations that still need an answer: the customer's latest DM has no reply after it (Instagram/Facebook DMs within the 24-hour reply window), or a comment/mention nobody replied to and that is not hidden. Replies typed in the native apps count as answers."),
         limit: z
             .number()
             .optional()
@@ -39,21 +121,16 @@ export function registerInboxTools(server, getClient) {
             query.type = params.type;
         if (params.unread !== undefined)
             query.unread = String(params.unread);
+        if (params.unanswered !== undefined) {
+            query.unanswered = String(params.unanswered);
+        }
         if (params.limit !== undefined)
             query.limit = String(params.limit);
         if (params.cursor)
             query.cursor = params.cursor;
         const result = await getClient().listInboxConversations(query);
-        if (result.error) {
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: `Error (${result.error.code}): ${result.error.message}`,
-                    },
-                ],
-            };
-        }
+        if (result.error)
+            return errorResult(result.error);
         const convos = result.data || [];
         if (!convos.length) {
             return {
@@ -69,17 +146,20 @@ export function registerInboxTools(server, getClient) {
             md += `| ${PLATFORM_EMOJI[c.platform] || ""} ${c.platform} | ${c.type} | ${who} | ${c.unread_count || 0} | ${text} | \`${c.conversation_id}\` |\n`;
         }
         if (result.pagination?.next_cursor) {
-            md += `\n_More available — call list_inbox_conversations again with cursor "${result.pagination.next_cursor}"._`;
+            md += `\n_More available: pass \`cursor: "${result.pagination.next_cursor}"\` to list_inbox_conversations for the next page._`;
         }
         return { content: [{ type: "text", text: md }] };
     });
-    server.tool("get_inbox_conversation", "Get the full message history of one inbox conversation, oldest first. Use the conversation_id from list_inbox_conversations.", {
+    server.tool("get_inbox_conversation", "Get the full message history of one inbox conversation, oldest first, with the post it belongs to (caption, link, image) for comment/mention threads. Each message shows its inbox id (#id): that id is what hide_inbox_comment and delete_inbox_comment take. Use the conversation_id from list_inbox_conversations. Replies sent from the native apps appear as outgoing messages too.", {
         conversation_id: z.string().describe("The conversation ID to fetch"),
         limit: z
             .number()
             .optional()
             .describe("Max messages per page (1-100, default 50)"),
-        cursor: z.string().optional().describe("Pagination cursor"),
+        cursor: z
+            .string()
+            .optional()
+            .describe("Pagination cursor from a previous response"),
     }, { title: "Get Inbox Conversation", readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async ({ conversation_id, limit, cursor }) => {
         const query = {};
         if (limit !== undefined)
@@ -87,16 +167,8 @@ export function registerInboxTools(server, getClient) {
         if (cursor)
             query.cursor = cursor;
         const result = await getClient().getInboxMessages(conversation_id, query);
-        if (result.error) {
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: `Error (${result.error.code}): ${result.error.message}`,
-                    },
-                ],
-            };
-        }
+        if (result.error)
+            return errorResult(result.error);
         const msgs = result.data || [];
         if (!msgs.length) {
             return {
@@ -106,24 +178,11 @@ export function registerInboxTools(server, getClient) {
             };
         }
         let md = `## Conversation \`${conversation_id}\`\n\n`;
-        for (const m of msgs) {
-            const who = m.direction === "outgoing"
-                ? "→ You"
-                : `← ${m.sender?.name || m.sender?.username || "Them"}`;
-            // The message id is what hide_inbox_reply takes, so always render it.
-            const flags = [`id ${m.id}`];
-            if (m.hidden === true)
-                flags.push("hidden on Threads");
-            md += `**${who}** _(${formatDateTime(m.timestamp)})_ \`${flags.join(" · ")}\`\n${m.text || ""}\n`;
-            if (m.attachment?.url) {
-                md += `📎 [${m.attachment.type}] ${m.attachment.url}\n`;
-            }
-            if (m.permalink)
-                md += `${m.permalink}\n`;
-            md += `\n`;
-        }
+        const post = msgs.find((m) => m.post && (m.post.caption || m.post.url))?.post;
+        md += renderInboxPost(post);
+        md += renderInboxMessages(msgs);
         if (result.pagination?.next_cursor) {
-            md += `_More messages — call again with cursor "${result.pagination.next_cursor}"._`;
+            md += `_More messages: pass \`cursor: "${result.pagination.next_cursor}"\` for the next page._`;
         }
         return { content: [{ type: "text", text: md }] };
     });
@@ -131,16 +190,8 @@ export function registerInboxTools(server, getClient) {
         conversation_id: z.string().describe("The conversation ID to mark read"),
     }, { title: "Mark Inbox Message Read", readOnlyHint: false, destructiveHint: false, openWorldHint: false }, async ({ conversation_id }) => {
         const result = await getClient().markInboxRead(conversation_id);
-        if (result.error) {
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: `Error (${result.error.code}): ${result.error.message}`,
-                    },
-                ],
-            };
-        }
+        if (result.error)
+            return errorResult(result.error);
         return {
             content: [
                 {
@@ -150,7 +201,7 @@ export function registerInboxTools(server, getClient) {
             ],
         };
     });
-    server.tool("reply_to_inbox", "Reply to an existing inbox conversation (DM, comment, or mention) on Instagram, Facebook, LinkedIn, TikTok, X, YouTube, or Threads (Threads replies are on the workspace's posts and mentions; a 401 reauth_required means the Threads connection must be reconnected to grant the reply permission; the reply publishes as a native Threads reply). You can only reply to conversations that already exist. Meta direct-message replies must be within the platform's 24-hour messaging window. TikTok replies are comments only, text-only, and capped at 150 characters; they can take a few minutes to appear on TikTok while they pass spam review. YouTube replies are comments only. X replies are DM-only and use 2 prepaid credits per send (X's API fee passed through at cost) — a 402 insufficient_credits error means the organisation needs to top up at https://app.omnisocials.com/credits; relay that link to the user rather than retrying. Each workspace can send up to 1,000 replies per day. attachment_url/attachment_type let you send media on a Facebook or Instagram DM (text is optional when an attachment is set — an attachment-only DM is allowed); other platforms are text-only.", {
+    server.tool("reply_to_inbox", "Reply to an existing inbox conversation (DM, comment, or mention) on Instagram, Facebook, LinkedIn, TikTok, YouTube, X, or Threads. You can only reply to conversations that already exist. Meta direct-message replies must be within the platform's 24-hour messaging window. TikTok replies are comments only, text-only, and capped at 150 characters; they can take a few minutes to appear on TikTok while they pass spam review. YouTube replies are comments only. Threads replies are on the workspace's posts and mentions; a 401 reauth_required means the Threads connection must be reconnected to grant the reply permission. X replies are DM-only and use 2 prepaid credits per send (X's API fee passed through at cost); a 402 insufficient_credits error means the organisation needs to top up at https://app.omnisocials.com/credits; relay that link to the user rather than retrying. Each workspace can send up to 1,000 replies per day. attachment_url/attachment_type let you send media on a Facebook or Instagram DM (text is optional when an attachment is set); other platforms are text-only. Set include_next: true to get the next conversation that needs an answer back in the same call (same as get_next_unanswered), so the inbox can be worked through as: get_next_unanswered → draft → reply_to_inbox(include_next) → draft → repeat.", {
         conversation_id: z.string().describe("The conversation ID to reply to"),
         text: z
             .string()
@@ -164,60 +215,121 @@ export function registerInboxTools(server, getClient) {
             .enum(["image", "video", "audio", "file"])
             .optional()
             .describe("Required if attachment_url is set"),
-    }, { title: "Reply to Inbox Message", readOnlyHint: false, destructiveHint: false, openWorldHint: true }, async ({ conversation_id, text, attachment_url, attachment_type }) => {
+        include_next: z
+            .boolean()
+            .optional()
+            .describe("After sending, also return the next conversation that needs an answer (full thread + post context), or 'nothing waiting'"),
+    }, { title: "Reply to Inbox Message", readOnlyHint: false, destructiveHint: true, openWorldHint: true }, async ({ conversation_id, text, attachment_url, attachment_type, include_next }) => {
         const result = await getClient().replyToInboxConversation(conversation_id, {
             text: text ?? "",
             attachment_url,
             attachment_type,
+            ...(include_next ? { include_next: true } : {}),
         });
-        if (result.error) {
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: `Error (${result.error.code}): ${result.error.message}`,
-                    },
-                ],
-            };
+        if (result.error)
+            return errorResult(result.error);
+        const m = result.data;
+        let md = `Reply sent to \`${conversation_id}\` on ${m?.platform || "the platform"}.`;
+        if (include_next) {
+            md +=
+                `\n\n` +
+                    renderNextUnanswered({
+                        data: result.next || null,
+                        remaining: result.remaining || 0,
+                    });
         }
+        return { content: [{ type: "text", text: md }] };
+    });
+    server.tool("get_next_unanswered", "Get the next inbox item that needs an answer, with the whole conversation and the post it is on, in one call. Serves the longest-waiting item first: the customer's latest DM with no reply after it (Instagram/Facebook DMs within the 24-hour reply window only, since Meta refuses later replies), or a comment/mention nobody replied to and that is not hidden. Replies typed in the native apps count as answered (they are mirrored into the inbox), so a thread a colleague answered on their phone is not served again. Instagram mentions are skipped (no reply path). Only unread items are served by default: to skip one for good, mark_inbox_read it; pass include_read to also see read-but-unanswered items. Looks back 30 days. Loop: get_next_unanswered → draft a reply → reply_to_inbox with include_next: true → repeat until nothing is waiting.", {
+        platform: z
+            .enum(INBOX_PLATFORMS)
+            .optional()
+            .describe("Only items from one platform"),
+        type: z
+            .enum(["dm", "comment", "mention"])
+            .optional()
+            .describe("Only items of one type"),
+        order: z
+            .enum(["oldest", "newest"])
+            .optional()
+            .describe("oldest (default): the item that has waited longest first; newest: the most recent first"),
+        include_read: z
+            .boolean()
+            .optional()
+            .describe("Also serve items that were marked read but never answered"),
+        exclude: z
+            .string()
+            .optional()
+            .describe("Comma-separated conversation ids to leave out of this call (a temporary skip; up to 100)"),
+    }, { title: "Get Next Unanswered", readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (params) => {
+        const query = {};
+        if (params.platform)
+            query.platform = params.platform;
+        if (params.type)
+            query.type = params.type;
+        if (params.order)
+            query.order = params.order;
+        if (params.include_read !== undefined) {
+            query.include_read = String(params.include_read);
+        }
+        if (params.exclude)
+            query.exclude = params.exclude;
+        const result = await getClient().getNextUnanswered(query);
+        if (result.error)
+            return errorResult(result.error);
+        return {
+            content: [{ type: "text", text: renderNextUnanswered(result) }],
+        };
+    });
+    const hideCommentSchema = {
+        message_id: z
+            .string()
+            .describe("The inbox message id of the comment (the #id in the thread)"),
+        hide: z
+            .boolean()
+            .optional()
+            .describe("true (default) to hide, false to unhide"),
+    };
+    const hideComment = async ({ message_id, hide, }) => {
+        const result = await getClient().hideInboxMessage(message_id, hide !== false);
+        if (result.error)
+            return errorResult(result.error);
         const m = result.data;
+        const text = result.note
+            ? `Comment \`#${m?.id ?? message_id}\` on ${m?.platform || "the platform"}: ${result.note} Marked as handled — no need to retry it.`
+            : `Comment \`#${m?.id ?? message_id}\` on ${m?.platform || "the platform"} is now ${m?.hidden ? "hidden" : "visible"}.`;
         return {
             content: [
                 {
                     type: "text",
-                    text: `Reply sent to \`${conversation_id}\`${m?.platform ? ` on ${m.platform}` : ""}.`,
+                    text,
                 },
             ],
         };
-    });
-    server.tool("hide_inbox_reply", "Hide (or unhide) a reply someone left on one of the workspace's Threads posts, as the post owner. Threads only for now, and only incoming top-level replies can be hidden (Threads does not allow hiding nested replies). The message keeps its place in the conversation; its `hidden` flag flips. Use the message id shown by get_inbox_conversation. Errors: 400 unsupported_platform (not an incoming Threads reply), 400 not_hideable (nested reply, or Threads refused), 401 reauth_required (the Threads connection lacks the reply permission; reconnect Threads under Settings → Organisation → Workspaces). Threads inbox features are currently rolling out (disabled on production until Meta approves the permission). Requires the inbox:write scope.", {
+    };
+    server.tool("hide_inbox_comment", "Hide (or unhide) a comment someone left on one of the workspace's posts, on the platform, as the post owner. Facebook, Instagram, TikTok, YouTube and Threads comments. On YouTube, hide sets the comment to 'rejected' (removed from public view together with its replies) and unhide publishes it again. Takes the message id (the #id shown by get_inbox_conversation and get_next_unanswered), not the conversation id. A hidden comment no longer counts as unanswered. If the comment was already deleted on the platform (its author removed it, etc.), this still succeeds — the response says so — and the item is marked handled; do not retry it. A 403 reconnect_required means the account was connected without the comment-moderation permission and must be reconnected in the dashboard; relay that to the user rather than retrying.", hideCommentSchema, { title: "Hide Inbox Comment", readOnlyHint: false, destructiveHint: false, openWorldHint: true }, hideComment);
+    // Older name from 1.28.0 (when hiding was Threads-only). Kept so existing
+    // setups keep working; same call, same platforms as hide_inbox_comment.
+    server.tool("hide_inbox_reply", "Older name for hide_inbox_comment, kept so existing setups keep working; prefer hide_inbox_comment. Same behaviour: hide (or unhide with hide: false) a comment someone left on one of the workspace's posts, as the post owner, on Facebook, Instagram, TikTok, YouTube or Threads. Takes the message id (the #id in the thread), not the conversation id. A 403 reconnect_required means the account must be reconnected in the dashboard to grant the comment-moderation permission.", hideCommentSchema, { title: "Hide Inbox Comment (older name)", readOnlyHint: false, destructiveHint: false, openWorldHint: true }, hideComment);
+    server.tool("delete_inbox_comment", "Permanently delete a comment someone left on one of the workspace's posts, on the platform and from the inbox. Facebook, Instagram and TikTok comments only (YouTube's API cannot delete other people's comments: use hide_inbox_comment there). Replies under the comment are deleted with it. This cannot be undone: confirm with the user before calling. Takes the message id (the #id in the thread), not the conversation id. A 403 reconnect_required means the account must be reconnected in the dashboard to grant the moderation permission.", {
         message_id: z
             .string()
-            .describe("The inbox message id of the reply (from get_inbox_conversation)"),
-        hide: z
-            .boolean()
-            .optional()
-            .describe("true (default) hides the reply; false unhides it"),
-    }, async ({ message_id, hide }) => {
-        const result = await getClient().hideInboxMessage(message_id, hide ?? true);
-        if (result.error) {
-            return {
-                content: [
-                    {
-                        type: "text",
-                        text: `Error (${result.error.code}): ${result.error.message}`,
-                    },
-                ],
-            };
-        }
-        const hidden = result.data?.hidden === true;
+            .describe("The inbox message id of the comment (the #id in the thread)"),
+    }, { title: "Delete Inbox Comment", readOnlyHint: false, destructiveHint: true, openWorldHint: true }, async ({ message_id }) => {
+        const result = await getClient().deleteInboxMessage(message_id);
+        if (result.error)
+            return errorResult(result.error);
+        const d = result.data;
+        const replies = Array.isArray(d?.removed_reply_ids)
+            ? d.removed_reply_ids.length
+            : 0;
         return {
             content: [
                 {
                     type: "text",
-                    text: hidden
-                        ? `Reply \`${message_id}\` is now hidden on Threads.`
-                        : `Reply \`${message_id}\` is now visible on Threads again.`,
+                    text: `Comment \`#${d?.id ?? message_id}\` deleted${replies
+                        ? ` together with ${replies} repl${replies === 1 ? "y" : "ies"}`
+                        : ""}.`,
                 },
             ],
         };

package/build/tools/media.js

@@ -72,7 +72,7 @@ When the user provides an image in the conversation (not a URL), use base64_data
         filename: z.string().optional().describe("Optional filename for the uploaded media"),
         name: z.string().optional().describe('Human-readable label so you can find this asset by name later instead of re-uploading it, e.g. "pp-play5get50". Strongly recommended on every upload.'),
         folder: z.string().optional().describe('Optional folder name to file this asset under (created at the top level if it does not exist), e.g. "win-graphics". See list_folders.'),
-    }, { title: "Upload Media", readOnlyHint: false, destructiveHint: false, openWorldHint: false }, async (params) => {
+    }, { title: "Upload Media", readOnlyHint: false, destructiveHint: false, openWorldHint: true }, async (params) => {
         let result;
         if (params.base64_data && params.mime_type) {
             result = await getClient().uploadMediaFromBase64({
@@ -159,7 +159,7 @@ Provide ONE of: a public 'url' (its size/type is read via a HEAD request), an ex
         media_id: z.string().optional().describe("Id of an already-uploaded library item to check."),
         size_bytes: z.number().optional().describe("File size in bytes (use with mime when you already know them)."),
         mime: z.string().optional().describe("MIME type, e.g. 'video/mp4' (use with size_bytes)."),
-    }, { title: "Check Media Compatibility", readOnlyHint: true, destructiveHint: false, openWorldHint: false }, async (params) => {
+    }, { title: "Check Media Compatibility", readOnlyHint: true, destructiveHint: false, openWorldHint: true }, async (params) => {
         if (!params.url && !params.media_id && !(params.size_bytes && params.mime)) {
             return {
                 content: [{ type: "text", text: "Error: Provide one of 'url', 'media_id', or 'size_bytes' + 'mime'." }],

package/build/tools/posts.js

@@ -756,7 +756,7 @@ Do NOT call this tool without media when creating stories, reels, Instagram post
             thread_parts: z.array(MASTODON_THREAD_PART).min(2).max(25).optional().describe("Publish as a chained Mastodon thread instead of a single status. Provide 2–25 parts; each is posted in order as a native reply to the previous status (in_reply_to_id). Attach media to any part via media_ids (from upload_media) or media_urls — max 4 per part. For a single status, omit thread_parts and use content."),
         }).optional().describe("Mastodon options"),
         threads: z.object({
-            location_id: z.string().nullable().optional().describe("Tag a location on the Threads post. Use an `id` from search_locations with platform \"threads\" (Threads location ids are NOT Facebook Place IDs, so never reuse the Instagram location_id here). On a multi-post thread the tag goes on the first post. Needs the workspace's Threads connection to have the threads_location_tagging permission; the API returns a clear 400 asking to reconnect Threads when it is missing, and a clear 400 while location tagging is still rolling out (disabled in this environment). On update_post, pass null to remove the tag."),
+            location_id: z.string().nullable().optional().describe("Tag a location on the Threads post. Use an `id` from search_locations with platform \"threads\" (Threads location ids are NOT Facebook Place IDs, so never reuse the Instagram location_id here). On a multi-post thread the tag goes on the first post. Needs the workspace's Threads connection to have the threads_location_tagging permission; the API returns a clear 400 asking to reconnect Threads when it is missing, and a clear 400 while location tagging is still rolling out (Meta has not approved the permission yet). On update_post, pass null to remove the tag."),
             thread_parts: z.array(THREADS_THREAD_PART).min(2).max(25).optional().describe("Publish as a chained Threads (Meta) thread instead of a single post. Provide 2 to 25 parts; parts after the first are posted as replies to the previous part. Each part holds up to 500 characters and up to 10 media (images and videos can be mixed) via media_ids (from upload_media) or media_urls. When set, the Threads caption is taken from part 1 and content is ignored for Threads. For a single post, omit thread_parts and use content."),
         }).optional().describe("Threads (Meta) options: thread mode via `thread_parts`, location tag via `location_id`."),
         google_business: GOOGLE_BUSINESS_OPTIONS,
@@ -913,11 +913,11 @@ Do NOT call without required media — it will fail.`, {
             thread_parts: z.array(MASTODON_THREAD_PART).min(2).max(25).optional().describe("Publish as a chained Mastodon thread (2–25 parts). Each is posted in order as a native reply (in_reply_to_id). Attach media to any part via media_ids or media_urls — max 4 per part."),
         }).optional().describe("Mastodon options"),
         threads: z.object({
-            location_id: z.string().nullable().optional().describe("Tag a location on the Threads post. Use an `id` from search_locations with platform \"threads\" (Threads location ids are NOT Facebook Place IDs, so never reuse the Instagram location_id here). On a multi-post thread the tag goes on the first post. Needs the workspace's Threads connection to have the threads_location_tagging permission; the API returns a clear 400 asking to reconnect Threads when it is missing, and a clear 400 while location tagging is still rolling out (disabled in this environment). On update_post, pass null to remove the tag."),
+            location_id: z.string().nullable().optional().describe("Tag a location on the Threads post. Use an `id` from search_locations with platform \"threads\" (Threads location ids are NOT Facebook Place IDs, so never reuse the Instagram location_id here). On a multi-post thread the tag goes on the first post. Needs the workspace's Threads connection to have the threads_location_tagging permission; the API returns a clear 400 asking to reconnect Threads when it is missing, and a clear 400 while location tagging is still rolling out (Meta has not approved the permission yet). On update_post, pass null to remove the tag."),
             thread_parts: z.array(THREADS_THREAD_PART).min(2).max(25).optional().describe("Publish as a chained Threads (Meta) thread (2 to 25 parts). Parts after the first are posted as replies to the previous part. Each part holds up to 500 characters and up to 10 media (images and videos can be mixed) via media_ids or media_urls. The Threads caption is taken from part 1."),
         }).optional().describe("Threads (Meta) options: thread mode via `thread_parts`, location tag via `location_id`."),
         google_business: GOOGLE_BUSINESS_OPTIONS,
-    }, { title: "Create and Publish Post", readOnlyHint: false, destructiveHint: false, openWorldHint: true }, async (params) => {
+    }, { title: "Create and Publish Post", readOnlyHint: false, destructiveHint: true, openWorldHint: true }, async (params) => {
         const result = await getClient().createAndPublishPost({ ...params, source: "mcp" });
         if (result.error) {
             return {
@@ -1027,7 +1027,7 @@ Do NOT call without required media — it will fail.`, {
             thread_parts: z.array(MASTODON_THREAD_PART).min(2).max(25).nullable().optional().describe("Replace the Mastodon thread shape on this post. Pass an array (2–25 parts) to update/create the thread (attach media to any part via media_ids or media_urls; max 4 per part), or `null` to revert to single-status mode."),
         }).optional().describe("Mastodon options"),
         threads: z.object({
-            location_id: z.string().nullable().optional().describe("Tag a location on the Threads post. Use an `id` from search_locations with platform \"threads\" (Threads location ids are NOT Facebook Place IDs, so never reuse the Instagram location_id here). On a multi-post thread the tag goes on the first post. Needs the workspace's Threads connection to have the threads_location_tagging permission; the API returns a clear 400 asking to reconnect Threads when it is missing, and a clear 400 while location tagging is still rolling out (disabled in this environment). On update_post, pass null to remove the tag."),
+            location_id: z.string().nullable().optional().describe("Tag a location on the Threads post. Use an `id` from search_locations with platform \"threads\" (Threads location ids are NOT Facebook Place IDs, so never reuse the Instagram location_id here). On a multi-post thread the tag goes on the first post. Needs the workspace's Threads connection to have the threads_location_tagging permission; the API returns a clear 400 asking to reconnect Threads when it is missing, and a clear 400 while location tagging is still rolling out (Meta has not approved the permission yet). On update_post, pass null to remove the tag."),
             thread_parts: z.array(THREADS_THREAD_PART).min(2).max(25).nullable().optional().describe("Replace the Threads (Meta) thread shape on this post. Pass an array (2 to 25 parts, 500 characters per part) to update/create the thread (attach up to 10 media to any part via media_ids or media_urls; images and videos can be mixed), or `null` to revert to single-post mode."),
         }).optional().describe("Threads (Meta) options: thread mode via `thread_parts`, location tag via `location_id`."),
         google_business: GOOGLE_BUSINESS_OPTIONS,
@@ -1059,7 +1059,7 @@ Do NOT call without required media — it will fail.`, {
             content: [{ type: "text", text: md }],
         };
     });
-    server.tool("delete_post", "Delete a post by ID. This action cannot be undone.", {
+    server.tool("delete_post", "Delete a post by ID from OmniSocials only: it leaves the calendar, the posts list and the analytics. This never deletes the live post on a platform, so a published post stays live everywhere it went; the user must delete it in the platform's own app or via \"Delete from [platform]\" in the OmniSocials dashboard. This action cannot be undone.", {
         id: z.string().describe("The post ID to delete"),
     }, { title: "Delete Post", readOnlyHint: false, destructiveHint: true, openWorldHint: false }, async ({ id }) => {
         const result = await getClient().deletePost(id);
@@ -1071,7 +1071,7 @@ Do NOT call without required media — it will fail.`, {
 
 IMPORTANT: Before publishing, verify the post has all required media. If publishing a story or reel, ensure media was attached when the post was created/updated. If it's missing, use update_post to add media first, or inform the user.`, {
         id: z.string().describe("The post ID to publish"),
-    }, { title: "Publish Post", readOnlyHint: false, destructiveHint: false, openWorldHint: true }, async ({ id }) => {
+    }, { title: "Publish Post", readOnlyHint: false, destructiveHint: true, openWorldHint: true }, async ({ id }) => {
         const result = await getClient().publishPost(id);
         if (result.error) {
             return {
@@ -1097,7 +1097,7 @@ IMPORTANT: Before publishing, verify the post has all required media. If publish
 
 The retry runs asynchronously (usually within a few minutes). Poll \`get_post\` afterwards: on success the status becomes \`published\` and \`published_urls\` gains the platform's live URL; on another failure the platform's entry reappears under errors. Each platform can be retried at most 3 times — after that, recreate the post. Note \`publish_post\` refuses failed posts; this is the tool for them.`, {
         id: z.string().describe("The failed or partially failed post ID to retry"),
-    }, { title: "Retry Failed Post", readOnlyHint: false, destructiveHint: false, openWorldHint: true }, async ({ id }) => {
+    }, { title: "Retry Failed Post", readOnlyHint: false, destructiveHint: true, openWorldHint: true }, async ({ id }) => {
         const result = await getClient().retryPost(id);
         if (result.error) {
             return {
@@ -1161,7 +1161,7 @@ IMPORTANT: this only succeeds if the connected user is a listed approver for the
 
 If this is the workflow's last step, the post is finalized immediately: it moves to \`scheduled\` (future time) or \`posting\` (due now/in the past). If steps remain, the post stays \`in_approval\` and the next step's approvers are notified — call this again once they've approved, or use \`reject_post\` to stop the workflow instead.`, {
         id: z.string().describe("The post ID to approve (must have approval_status 'pending')"),
-    }, { title: "Approve Post", readOnlyHint: false, destructiveHint: false, openWorldHint: true }, async ({ id }) => {
+    }, { title: "Approve Post", readOnlyHint: false, destructiveHint: true, openWorldHint: true }, async ({ id }) => {
         const result = await getClient().approvePost(id);
         if (result.error) {
             return {
@@ -1195,7 +1195,7 @@ IMPORTANT: this only succeeds if the connected user is a listed approver for the
             .max(2000)
             .optional()
             .describe("Optional reason for the rejection, shown to the requester and other approvers."),
-    }, { title: "Reject Post", readOnlyHint: false, destructiveHint: false, openWorldHint: true }, async ({ id, comment }) => {
+    }, { title: "Reject Post", readOnlyHint: false, destructiveHint: false, openWorldHint: false }, async ({ id, comment }) => {
         const result = await getClient().rejectPost(id, comment);
         if (result.error) {
             return {
@@ -1223,7 +1223,7 @@ Flow (Threads): same, but pass the \`id\` as \`threads.location_id\`. Threads ca
 Notes:
 - Use a SPECIFIC venue name. Searching a broad brand ("Starbucks") returns individual store locations, not the brand page.
 - Instagram: if the user already gives you a numeric Facebook Place ID, you can pass it straight to create_post as \`location_id\`; it's validated at publish time and an invalid one returns a clear error. If results come back empty with a permission note, the workspace's Facebook app can't search arbitrary places; tell the user to use their own business Page's ID.
-- Threads: needs the workspace's Threads connection to have the location permission; if the result says to reconnect Threads, tell the user to reconnect it under Settings → Organisation → Workspaces. Threads location tagging is currently rolling out, so the search can also answer that it is not available yet.`, {
+- Threads: needs the workspace's Threads connection to have the location permission; if the result says to reconnect Threads, tell the user to reconnect it under Settings → Organisation → Workspaces. Threads location tagging is currently rolling out (Meta has not approved the permission yet), so the search can also answer that it is not available yet.`, {
         query: z
             .string()
             .optional()

package/build/types.d.ts

@@ -19,6 +19,9 @@ export interface ApiResponse<T = unknown> {
     };
     conversation_id?: string;
     marked_read?: number;
+    next?: InboxNextUnanswered | null;
+    remaining?: number;
+    note?: string;
 }
 export interface InboxParticipant {
     id: string;
@@ -26,6 +29,16 @@ export interface InboxParticipant {
     username: string;
     profile_picture: string | null;
 }
+/** The post a comment/mention thread belongs to. `url` is the public link to
+ * the post and `media_type` the platform's own label (IMAGE, VIDEO,
+ * CAROUSEL_ALBUM, ...); both nullable. null on DM conversations. */
+export interface InboxPostContext {
+    id: string | null;
+    caption: string | null;
+    thumbnail: string | null;
+    url: string | null;
+    media_type: string | null;
+}
 export interface InboxConversation {
     conversation_id: string;
     platform: "instagram" | "facebook" | "linkedin" | "tiktok" | "x" | "youtube" | "threads";
@@ -39,11 +52,7 @@ export interface InboxConversation {
         timestamp: string;
         is_read: boolean;
     };
-    post: {
-        id: string | null;
-        caption: string | null;
-        thumbnail: string | null;
-    } | null;
+    post: InboxPostContext | null;
 }
 export interface InboxMessage {
     id: string;
@@ -57,8 +66,9 @@ export interface InboxMessage {
     is_replied: boolean;
     reaction: string | null;
     parent_comment_id: string | null;
-    /** Threads replies only: true when the reply is hidden on Threads (flip it
-     * with hide_inbox_reply). null for every other platform. */
+    /** Comments on every comment platform (Facebook, Instagram, TikTok,
+     * YouTube, Threads): true when the comment is hidden on the platform (flip
+     * it with hide_inbox_comment). null for DMs. */
     hidden?: boolean | null;
     /** Link to the reply or mentioning post on the platform, when known. */
     permalink?: string | null;
@@ -70,11 +80,24 @@ export interface InboxMessage {
         type: "image" | "video" | "audio" | "file";
     } | null;
     sender: InboxParticipant;
-    post: {
-        id: string | null;
-        caption: string | null;
-        thumbnail: string | null;
-    } | null;
+    post: InboxPostContext | null;
+}
+/** What GET /inbox/next serves (and what `reply_to_inbox` returns as `next`
+ * when `include_next` is set). `message` is the unanswered incoming item: its
+ * `id` is what hide/delete take, its `conversation_id` is what reply takes.
+ * `messages` is the thread oldest first (the most recent 50, plus the target
+ * and its parent when they fall outside that window). */
+export interface InboxNextUnanswered {
+    conversation: InboxConversation;
+    message: InboxMessage;
+    messages: InboxMessage[];
+}
+/** Response of DELETE /inbox/messages/:id. Replies under the comment are
+ * removed with it; their inbox ids are listed in `removed_reply_ids`. */
+export interface InboxDeleteResult {
+    id: string;
+    conversation_id: string;
+    removed_reply_ids: string[];
 }
 /** One media entry on a post — a plain URL string, or an object carrying the
  * url plus an optional accessibility description (alt text). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@omnisocials/mcp-server",
-  "version": "1.33.0",
+  "version": "1.34.1",
   "mcpName": "io.github.omnisocials/mcp-server",
   "description": "MCP server for OmniSocials API - manage social media posts, media, accounts, analytics, and webhooks",
   "type": "module",