@rolino/mcp 0.5.0 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # @rolino/mcp
 
+## 0.7.0
+
+### Minor Changes
+
+- 358f37a: Expose additive safe Blog preparation, next-action, and quality summaries through the shared read contracts and existing clients.
+
+### Patch Changes
+
+- Updated dependencies [358f37a]
+  - @rolino/contracts@0.7.0
+  - @rolino/sdk@0.7.0
+  - @rolino/local-auth@0.7.0
+
+## 0.6.0
+
+### Minor Changes
+
+- Add nine scoped backlink prospecting tools with correct closed-world and open-world annotations. Rolino does not send email.
+
+- d162f85: Add safe Blog editorial cadence preview and apply operations across contracts, SDK, CLI, and MCP.
+- 50cb9fc: Add Google Business Profile as a disabled-by-default standard text and single-image publishing destination across shared public clients.
+- 1ac7ed5: Add signed custom Blog webhook setup, connection testing, one-time secret rotation, and safe idempotent replay parity.
+- a56f834: Replace custom interactive CLI authorization with exact-resource OAuth, add the stateless MCP 2026-07-28 transport foundation, and provide safe connection instructions for workspace discovery and confirmed actions.
+
+### Patch Changes
+
+- Updated dependencies [d162f85]
+- Updated dependencies [50cb9fc]
+- Updated dependencies [1ac7ed5]
+- Updated dependencies [a56f834]
+  - @rolino/contracts@0.6.0
+  - @rolino/sdk@0.6.0
+  - @rolino/local-auth@0.6.0
+
 ## 0.5.0
 
 ### Minor Changes
@@ -74,6 +108,10 @@
 
 ### Minor Changes
 
+- Return additive safe Blog preparation and quality state from existing read tools.
+
+### Minor Changes
+
 - Add exact Blog image generation and upload, image review, confirmed
   exact-bundle approval, scheduling, and schedule cancellation tools with
   shared contracts, safe errors, and truthful capability and safety annotations.

package/README.md

@@ -1,20 +1,24 @@
 # `@rolino/mcp`
 
-Rolino's Model Context Protocol adapter. The first supported transport is local
-stdio and it calls the same public API used by the CLI. Remote Streamable HTTP
-remains gated by the OAuth interoperability decision in ADR 0003.
+Rolino's Model Context Protocol adapter. Rolino supports hosted Streamable HTTP
+with client-owned OAuth and local STDIO with the shared CLI OAuth session. The
+hosted route is stateless and does not need this package on the caller's
+computer. This package supplies the local STDIO process and the shared MCP tool
+definitions used by both transports.
 
 ## Installation
 
-Local MCP remains a separate, explicit
-installation so CLI-only users do not receive MCP runtime dependencies:
+Local STDIO MCP remains a separate, explicit installation so CLI-only and
+remote users do not receive MCP runtime dependencies:
 
 ```bash
 npm install --global @rolino/cli @rolino/mcp
 ```
 
-The CLI handles browser authorization and writes token-free Codex or Claude
-Code configuration that points to this package's installed stdio entry point.
+For hosted Streamable HTTP, run `rolino setup mcp --client codex --transport
+http`, then `codex mcp login rolino`. For local STDIO, the CLI handles standard
+OAuth Authorization Code with PKCE and writes token-free Codex or Claude Code
+configuration that points to this package's installed entry point.
 Headless operators may install only `@rolino/mcp` and provide a scoped
 `ROLINO_TOKEN` explicitly.
 
@@ -41,8 +45,19 @@ Initial tools:
 - `get_seo_opportunity`
 - `list_seo_reports`
 - `get_seo_report`
+- `start_backlink_discovery`
+- `get_backlink_discovery`
+- `list_backlink_prospects`
+- `get_backlink_prospect`
+- `research_backlink_contact`
+- `update_backlink_stage`
+- `update_backlink_outreach`
+- `list_backlink_contacts`
+- `verify_backlink`
 - `list_calendar_events`
 
+Backlink tools use independent opt-in scopes. Provider-calling tools are bounded and open-world. Stored reads are closed-world. No tool accepts an arbitrary search query or a user-supplied email. Rolino never sends email.
+
 The media tools discover reusable project assets and stream one explicitly
 approved local JPEG, PNG, WebP, MP4, or MOV file directly to configured
 storage. Rolino derives dimensions and video duration from the stored object.
@@ -96,10 +111,16 @@ preparation until LinkedIn confirms upload and processing. An optional
 3,000-character LINKEDIN caption override uses the shared caption as fallback.
 The connected member is always the author; Company Page publishing is outside
 this contract.
+Google Business Profile drafts can be text-only or contain one stored JPEG or
+PNG image with a stable public URL. The optional 1,500-character
+GOOGLE_BUSINESS_PROFILE update override uses the shared caption as fallback.
+The tools use the location selected in Rolino, create only standard updates,
+and never choose or change a Business Profile location. If final creation has
+an unknown outcome, inspect the selected Business Profile before retrying.
 Integration health is cached and secret-safe, post
 readiness reuses Rolino's publishing checks, and calendar reads use bounded
 date windows with cursor pagination. After `rolino auth login`, configure `ROLINO_URL` and
-the server automatically reuses the browser-authorized credential saved for
+the server automatically obtains and refreshes the API-resource OAuth token saved for
 that exact host. `ROLINO_TOKEN` remains an explicit override for CI and other
 headless environments. `ROLINO_CONFIG_DIR` can override the portable credential
 directory, and `ROLINO_TIMEOUT` is optional. Stdout is reserved for MCP
@@ -134,12 +155,15 @@ publication is reported. The preview reports `deliveryMode: "IMMEDIATE"` and
 `createsSchedule: false`; immediate publishing never enters schedule
 confirmation.
 
-MCP tools cannot enable YouTube, Bluesky, or LinkedIn or bypass a deployment's
-provider approval boundary. Self-hosted operators should complete the
+MCP tools cannot enable YouTube, Bluesky, LinkedIn, or Google Business Profile,
+or bypass a deployment's provider approval boundary. Self-hosted operators
+should complete the
 [YouTube operations guide](https://github.com/deifos/rolino/blob/main/docs/integrations/youtube.md)
 and
-[Bluesky operations guide](https://github.com/deifos/rolino/blob/main/docs/integrations/bluesky.md), and
+[Bluesky operations guide](https://github.com/deifos/rolino/blob/main/docs/integrations/bluesky.md),
 [LinkedIn operations guide](https://github.com/deifos/rolino/blob/main/docs/integrations/linkedin.md)
+and the
+[Google Business Profile operations guide](https://github.com/deifos/rolino/blob/main/docs/integrations/google-business-profile.md)
 before live testing.
 
 ## Support, security, and license
@@ -168,6 +192,14 @@ publishing reads:
 - `generate_blog_image`, `upload_blog_image`, and `review_blog_image` require
   `blog:write`. They cannot approve an article or publish it. Upload reads only
   the exact local JPEG, PNG, or WebP path supplied to the tool.
+- `preview_blog_plan_cadence` and `apply_blog_plan_cadence` require
+  `blog:write`. Preview first, show every editorial move and locked item, then
+  apply only the unchanged preview values with its confirmation and a stable
+  idempotency key.
+- These cadence tools never change `scheduledPublishAt` and never schedule,
+  publish, or unpublish an article.
+- `generate_blog_image` already accepts optional editorial direction through
+  `editorialBrief` with a 500-character limit.
 - `preview_blog_revision_approval` and `execute_blog_revision_approval` require
   the independent `blog:approve` capability. Execution makes the confirmed
   exact bundle eligible for a separate publication operation; it cannot
@@ -189,8 +221,9 @@ Read tools are closed-world. The signed revalidation test is accurately marked
 as an open-world write. Connection execute is confirmed, destructive, and
 idempotent; its first success may return one-time values that must be written
 only to server-side environment configuration. Errors and replays never reveal
-those values. These are local stdio tools—Rolino does not expose hosted remote
-MCP. Publication still requires a user-approved exact revision and the
+those values. These tools remain available over local stdio. The remote profile
+omits both caller-local media and Blog image uploads, and the hosted route stays hidden while its
+deployment gate is off. Publication still requires a user-approved exact revision and the
 separate publish preview/execute tools.
 
 Use the Blog tools in this order: read setup and current article or plan state;