@rolino/mcp 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,36 @@
+# @rolino/mcp
+
+## 0.1.0
+
+### Minor Changes
+
+- fdc916f: Add least-privilege, idempotent project creation across the public API, SDK,
+  CLI, and local stdio MCP, including atomic paired-brand creation.
+- 2f5220f: Expose Bluesky consistently across public publishing contracts, the SDK, CLI,
+  and MCP, including 300-grapheme caption overrides, text and image readiness,
+  health reporting, scheduling, and immediate publishing. The fixed release group
+  also advances `@rolino/local-auth` even though its source does not change.
+- edd5f2e: Validate YouTube descriptions by their 5,000-byte UTF-8 provider limit so every Rolino client rejects multibyte text that YouTube would refuse.
+- 1b644ef: Prepare the first coordinated public release of Rolino's contracts, SDK, shared
+  local authentication, CLI, and local stdio MCP packages.
+- 420484d: Add reusable media discovery and direct local-file uploads across the public
+  API contracts, SDK, CLI, and MCP so agents can safely prepare folder-based
+  social scheduling workflows. The fixed release group also advances
+  `@rolino/local-auth` even though its source does not change.
+- 52373a6: Expose YouTube consistently across public contracts, the SDK, CLI, and MCP,
+  including explicit draft metadata, readiness and health, early scheduled
+  preparation, exact publish confirmation, and typed pending reconciliation.
+  The fixed release group also advances `@rolino/local-auth` even though its
+  source does not change.
+
+### Patch Changes
+
+- Updated dependencies [fdc916f]
+- Updated dependencies [2f5220f]
+- Updated dependencies [edd5f2e]
+- Updated dependencies [1b644ef]
+- Updated dependencies [420484d]
+- Updated dependencies [52373a6]
+  - @rolino/contracts@0.1.0
+  - @rolino/sdk@0.1.0
+  - @rolino/local-auth@0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Vlad
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,111 @@
+# `@rolino/mcp`
+
+Rolino's Model Context Protocol adapter. The first supported transport is local
+stdio and it calls the same public API used by the CLI. Remote Streamable HTTP
+remains gated by the OAuth interoperability decision in ADR 0003.
+
+## Installation
+
+Local MCP remains a separate, explicit
+installation so CLI-only users do not receive MCP runtime dependencies:
+
+```bash
+npm install --global @rolino/cli @rolino/mcp
+```
+
+The CLI handles browser authorization and writes token-free Codex or Claude
+Code configuration that points to this package's installed stdio entry point.
+Headless operators may install only `@rolino/mcp` and provide a scoped
+`ROLINO_TOKEN` explicitly.
+
+Initial tools:
+
+- `whoami`
+- `list_projects`
+- `get_project`
+- `create_project`
+- `list_media_assets`
+- `upload_media_asset`
+- `list_posts`
+- `get_post`
+- `create_draft_post`
+- `update_draft_post`
+- `get_post_readiness`
+- `preview_post_schedule`
+- `execute_post_schedule`
+- `preview_post_publish`
+- `execute_post_publish`
+- `list_integration_health`
+- `list_calendar_events`
+
+The media tools discover reusable project assets and upload one explicitly
+approved local JPEG, PNG, WebP, MP4, or MOV file directly to configured
+storage. Uploading never creates, schedules, or publishes a post; the returned
+asset ID is passed into a later draft operation.
+
+The tool set includes discovery and inspection tools that are read-only.
+`create_project` is an additive, closed-world mutation that requires
+`projects:write` and a caller-supplied idempotency key. It atomically saves the
+project and its paired brand without starting research, connecting accounts,
+scheduling posts, or publishing. The two draft tools can create or replace
+draft content but cannot schedule or publish it. Both require caller-supplied
+idempotency keys, and updates also require the version returned by `get_post`
+so stale writes fail safely. Every tool returns output-schema-validated
+`structuredContent` plus a JSON text fallback.
+YouTube drafts require exactly one stored video, explicit title/category/
+visibility/audience/declaration settings, and optional tags. The YOUTUBE caption
+override becomes the video description, with the shared caption as fallback.
+Unaudited Google API projects may be restricted to Private uploads; the tools
+do not infer audit approval from server configuration.
+Bluesky drafts can be text-only or contain up to four stored JPEG, PNG, or WebP
+images. The BLUESKY caption override accepts up to 300 graphemes, with the
+shared caption as fallback.
+Integration health is cached and secret-safe, post
+readiness reuses Rolino's publishing checks, and calendar reads use bounded
+date windows with cursor pagination. After `rolino auth login`, configure `ROLINO_URL` and
+the server automatically reuses the browser-authorized credential saved for
+that exact host. `ROLINO_TOKEN` remains an explicit override for CI and other
+headless environments. `ROLINO_CONFIG_DIR` can override the portable credential
+directory, and `ROLINO_TIMEOUT` is optional. Stdout is reserved for MCP
+messages; startup failures go to stderr without secrets or stack traces.
+`ROLINO_TIMEOUT` accepts integer milliseconds or values such as `500ms`, `15s`,
+and `1m`, matching the CLI.
+
+Scheduling uses two separate tools. `preview_post_schedule` contacts the
+configured providers, validates the exact post version, time, timezone, and
+readiness, and returns a five-minute single-use confirmation without scheduling
+anything. `execute_post_schedule` is marked consequential and open-world; it
+requires the unchanged preview values, confirmation token, and a stable
+idempotency key. The server repeats readiness and live-health checks and rejects
+expired, consumed, stale, cross-credential, or mismatched confirmation.
+For YouTube, the preview explains that confirmed scheduling starts or resumes a
+private upload immediately so processing can complete before the Public target.
+Execution may return a typed `PENDING` result while the remote schedule is
+being confirmed; it does not report the video as published.
+
+Immediate publishing also uses two tools. `preview_post_publish` checks the
+exact destination set, post version, readiness, live provider health, and retry
+safety without contacting a publish endpoint. `execute_post_publish` requires
+the unchanged preview values, confirmation token, and stable idempotency key,
+then durably queues the selected destinations for immediate delivery. Provider
+calls happen after that database commit, and Rolino's existing reconciliation
+rules block blind retries after ambiguous external results. YouTube remains
+`PREPARING` until upload and processing are provider-confirmed, and its exact
+configured visibility is reconciled before publication is reported.
+
+MCP tools cannot enable YouTube or Bluesky or bypass the deployment's
+Google/YouTube approval boundary. Self-hosted operators should complete the
+[YouTube operations guide](https://github.com/deifos/rolino/blob/main/docs/integrations/youtube.md)
+and
+[Bluesky operations guide](https://github.com/deifos/rolino/blob/main/docs/integrations/bluesky.md)
+before live testing.
+
+## Support, security, and license
+
+Stable releases are published only after the maintainer approves the release
+gate. Report bugs through the
+[Rolino issue tracker](https://github.com/deifos/rolino/issues) and security
+issues through the repository's
+[security policy](https://github.com/deifos/rolino/security/policy).
+
+`@rolino/mcp` is available under the MIT License.