@rolino/mcp 0.6.0 → 0.7.1

package/CHANGELOG.md

@@ -1,9 +1,32 @@
 # @rolino/mcp
 
+## 0.7.1
+
+### Patch Changes
+
+- @rolino/contracts@0.7.1
+- @rolino/sdk@0.7.1
+- @rolino/local-auth@0.7.1
+
+## 0.7.0
+
+### Minor Changes
+
+- 358f37a: Expose additive safe Blog preparation, next-action, and quality summaries through the shared read contracts and existing clients.
+
+### Patch Changes
+
+- Updated dependencies [358f37a]
+  - @rolino/contracts@0.7.0
+  - @rolino/sdk@0.7.0
+  - @rolino/local-auth@0.7.0
+
 ## 0.6.0
 
 ### Minor Changes
 
+- Add nine scoped backlink prospecting tools with correct closed-world and open-world annotations. Rolino does not send email.
+
 - d162f85: Add safe Blog editorial cadence preview and apply operations across contracts, SDK, CLI, and MCP.
 - 50cb9fc: Add Google Business Profile as a disabled-by-default standard text and single-image publishing destination across shared public clients.
 - 1ac7ed5: Add signed custom Blog webhook setup, connection testing, one-time secret rotation, and safe idempotent replay parity.
@@ -93,6 +116,10 @@
 
 ### Minor Changes
 
+- Return additive safe Blog preparation and quality state from existing read tools.
+
+### Minor Changes
+
 - Add exact Blog image generation and upload, image review, confirmed
   exact-bundle approval, scheduling, and schedule cancellation tools with
   shared contracts, safe errors, and truthful capability and safety annotations.

package/README.md

@@ -1,20 +1,24 @@
 # `@rolino/mcp`
 
-Rolino's Model Context Protocol adapter. The first supported transport is local
-stdio and it calls the same public API used by the CLI. Remote Streamable HTTP
-remains gated by the OAuth interoperability decision in ADR 0003.
+Rolino's Model Context Protocol adapter. Rolino supports hosted Streamable HTTP
+with client-owned OAuth and local STDIO with the shared CLI OAuth session. The
+hosted route is stateless and does not need this package on the caller's
+computer. This package supplies the local STDIO process and the shared MCP tool
+definitions used by both transports.
 
 ## Installation
 
-Local MCP remains a separate, explicit
-installation so CLI-only users do not receive MCP runtime dependencies:
+Local STDIO MCP remains a separate, explicit installation so CLI-only and
+remote users do not receive MCP runtime dependencies:
 
 ```bash
 npm install --global @rolino/cli @rolino/mcp
 ```
 
-The CLI handles standard OAuth Authorization Code with PKCE and writes token-free Codex or Claude
-Code configuration that points to this package's installed stdio entry point.
+For hosted Streamable HTTP, run `rolino setup mcp --client codex --transport
+http`, then `codex mcp login rolino`. For local STDIO, the CLI handles standard
+OAuth Authorization Code with PKCE and writes token-free Codex or Claude Code
+configuration that points to this package's installed entry point.
 Headless operators may install only `@rolino/mcp` and provide a scoped
 `ROLINO_TOKEN` explicitly.
 
@@ -41,8 +45,19 @@ Initial tools:
 - `get_seo_opportunity`
 - `list_seo_reports`
 - `get_seo_report`
+- `start_backlink_discovery`
+- `get_backlink_discovery`
+- `list_backlink_prospects`
+- `get_backlink_prospect`
+- `research_backlink_contact`
+- `update_backlink_stage`
+- `update_backlink_outreach`
+- `list_backlink_contacts`
+- `verify_backlink`
 - `list_calendar_events`
 
+Backlink tools use independent opt-in scopes. Provider-calling tools are bounded and open-world. Stored reads are closed-world. No tool accepts an arbitrary search query or a user-supplied email. Rolino never sends email.
+
 The media tools discover reusable project assets and stream one explicitly
 approved local JPEG, PNG, WebP, MP4, or MOV file directly to configured
 storage. Rolino derives dimensions and video duration from the stored object.
@@ -105,7 +120,7 @@ an unknown outcome, inspect the selected Business Profile before retrying.
 Integration health is cached and secret-safe, post
 readiness reuses Rolino's publishing checks, and calendar reads use bounded
 date windows with cursor pagination. After `rolino auth login`, configure `ROLINO_URL` and
-the server automatically obtains and refreshes the API-resource OAuth token saved for
+the server automatically obtains and refreshes the API-resource OAuth token saved for
 that exact host. `ROLINO_TOKEN` remains an explicit override for CI and other
 headless environments. `ROLINO_CONFIG_DIR` can override the portable credential
 directory, and `ROLINO_TIMEOUT` is optional. Stdout is reserved for MCP
@@ -206,9 +221,9 @@ Read tools are closed-world. The signed revalidation test is accurately marked
 as an open-world write. Connection execute is confirmed, destructive, and
 idempotent; its first success may return one-time values that must be written
 only to server-side environment configuration. Errors and replays never reveal
-those values. These tools remain available over local stdio. The remote profile
-omits both caller-local media and Blog image uploads, and the hosted route stays hidden while its
-deployment gate is off. Publication still requires a user-approved exact revision and the
+those values. These tools remain available over local stdio. The remote profile
+omits both caller-local media and Blog image uploads, and the hosted route stays hidden while its
+deployment gate is off. Publication still requires a user-approved exact revision and the
 separate publish preview/execute tools.
 
 Use the Blog tools in this order: read setup and current article or plan state;

package/dist/bin.cjs

@@ -52,7 +52,7 @@ var z = __toESM(require("zod/v4"), 1);
 // package.json
 var package_default = {
   name: "@rolino/mcp",
-  version: "0.6.0",
+  version: "0.7.1",
   description: "Model Context Protocol server for Rolino",
   type: "module",
   license: "MIT",
@@ -111,9 +111,9 @@ var package_default = {
   dependencies: {
     "@hono/node-server": "2.0.12",
     "@modelcontextprotocol/server": "2.0.0",
-    "@rolino/contracts": "0.6.0",
-    "@rolino/local-auth": "0.6.0",
-    "@rolino/sdk": "0.6.0",
+    "@rolino/contracts": "0.7.1",
+    "@rolino/local-auth": "0.7.1",
+    "@rolino/sdk": "0.7.1",
     zod: "^4.4.3"
   },
   devDependencies: {
@@ -250,6 +250,8 @@ var readOnlyAnnotations = {
   idempotentHint: true,
   openWorldHint: false
 };
+var backlinkOpenWorldAnnotations = { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: true };
+var backlinkWriteAnnotations = { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false };
 var blogPublicationWeekdaysSchema = z.array(z.number().int().min(0).max(6)).min(1).max(7).superRefine((weekdays, context) => {
   if (new Set(weekdays).size !== weekdays.length) {
     context.addIssue({ code: "custom", message: "Weekdays must be unique." });
@@ -800,6 +802,73 @@ function createRolinoMcpServer(options = {}) {
       return errorResult(error);
     }
   });
+  const backlinkApi = () => {
+    if (!api.backlinks) throw new TypeError("This Rolino client does not support backlink prospecting.");
+    return api.backlinks;
+  };
+  server.registerTool("start_backlink_discovery", { title: "Start bounded backlink discovery", description: "Queue one bounded backlink opportunity discovery for an exact Rolino project. This can contact the configured web research provider. It does not accept an arbitrary query and Rolino never sends email.", inputSchema: z.object({ projectId: import_contracts.SeoEntityIdSchema, limit: z.number().int().min(1).max(20).default(20), idempotencyKey: z.string().min(1).max(128) }), outputSchema: import_contracts.BacklinkDiscoveryRunSchema, annotations: backlinkOpenWorldAnnotations }, async ({ projectId, limit, idempotencyKey }) => {
+    try {
+      return jsonResult(await backlinkApi().discoveries.start(projectId, { limit }, idempotencyKey));
+    } catch (error) {
+      return errorResult(error);
+    }
+  });
+  server.registerTool("get_backlink_discovery", { title: "Get backlink discovery", description: "Read one stored backlink discovery run. This closed-world tool does not contact providers or send email.", inputSchema: z.object({ projectId: import_contracts.SeoEntityIdSchema, runId: import_contracts.SeoEntityIdSchema }), outputSchema: import_contracts.BacklinkDiscoveryRunSchema, annotations: readOnlyAnnotations }, async ({ projectId, runId }) => {
+    try {
+      return jsonResult(await backlinkApi().discoveries.get(projectId, runId));
+    } catch (error) {
+      return errorResult(error);
+    }
+  });
+  server.registerTool("list_backlink_prospects", { title: "List backlink prospects", description: "Read bounded, safe backlink prospect summaries for one project. This closed-world tool omits emails and draft bodies and never sends email.", inputSchema: import_contracts.BacklinkProspectListQuerySchema.extend({ projectId: import_contracts.SeoEntityIdSchema }), outputSchema: import_contracts.BacklinkProspectListDataSchema, annotations: readOnlyAnnotations }, async ({ projectId, ...options2 }) => {
+    try {
+      return jsonResult(await backlinkApi().prospects.list(projectId, options2));
+    } catch (error) {
+      return errorResult(error);
+    }
+  });
+  server.registerTool("get_backlink_prospect", { title: "Get backlink prospect", description: "Read one safe stored backlink prospect and its canonical next action. It omits emails and drafts and never sends email.", inputSchema: z.object({ projectId: import_contracts.SeoEntityIdSchema, prospectId: import_contracts.SeoEntityIdSchema }), outputSchema: import_contracts.BacklinkProspectSchema, annotations: readOnlyAnnotations }, async ({ projectId, prospectId }) => {
+    try {
+      return jsonResult(await backlinkApi().prospects.get(projectId, prospectId));
+    } catch (error) {
+      return errorResult(error);
+    }
+  });
+  server.registerTool("research_backlink_contact", { title: "Research a public backlink contact", description: "Queue bounded public contact research for one approved stored prospect. This can contact the configured web provider. The tool cannot accept an email and Rolino never sends email.", inputSchema: z.object({ projectId: import_contracts.SeoEntityIdSchema, prospectId: import_contracts.SeoEntityIdSchema, idempotencyKey: z.string().min(1).max(128) }), outputSchema: import_contracts.BacklinkQueueResponseSchema.shape.data, annotations: backlinkOpenWorldAnnotations }, async ({ projectId, prospectId, idempotencyKey }) => {
+    try {
+      return jsonResult(await backlinkApi().prospects.researchContact(projectId, prospectId, idempotencyKey));
+    } catch (error) {
+      return errorResult(error);
+    }
+  });
+  server.registerTool("update_backlink_stage", { title: "Update backlink stage", description: "Apply one allowed optimistic stage change to a stored prospect. This cannot send email.", inputSchema: import_contracts.BacklinkStageUpdateInputSchema.extend({ projectId: import_contracts.SeoEntityIdSchema, prospectId: import_contracts.SeoEntityIdSchema, idempotencyKey: z.string().min(1).max(128) }), outputSchema: import_contracts.BacklinkProspectSchema, annotations: backlinkWriteAnnotations }, async ({ projectId, prospectId, stage, expectedVersion, idempotencyKey }) => {
+    try {
+      return jsonResult(await backlinkApi().prospects.updateStage(projectId, prospectId, { stage, expectedVersion }, idempotencyKey));
+    } catch (error) {
+      return errorResult(error);
+    }
+  });
+  server.registerTool("update_backlink_outreach", { title: "Update backlink outreach draft", description: "Save an edited stored outreach draft with an optimistic version. This tool only edits a draft. Rolino never sends email.", inputSchema: import_contracts.BacklinkOutreachUpdateInputSchema.extend({ projectId: import_contracts.SeoEntityIdSchema, prospectId: import_contracts.SeoEntityIdSchema, idempotencyKey: z.string().min(1).max(128) }), outputSchema: import_contracts.BacklinkOutreachDraftSchema, annotations: backlinkWriteAnnotations }, async ({ projectId, prospectId, idempotencyKey, ...input }) => {
+    try {
+      return jsonResult(await backlinkApi().prospects.updateOutreach(projectId, prospectId, input, idempotencyKey));
+    } catch (error) {
+      return errorResult(error);
+    }
+  });
+  server.registerTool("list_backlink_contacts", { title: "List approved public backlink contacts", description: "Read bounded, non-stale public contacts and editable drafts. This requires explicit contact access. Rolino never sends email.", inputSchema: import_contracts.BacklinkContactListQuerySchema.extend({ projectId: import_contracts.SeoEntityIdSchema }), outputSchema: import_contracts.BacklinkContactListDataSchema, annotations: readOnlyAnnotations }, async ({ projectId, ...options2 }) => {
+    try {
+      return jsonResult(await backlinkApi().contacts.list(projectId, options2));
+    } catch (error) {
+      return errorResult(error);
+    }
+  });
+  server.registerTool("verify_backlink", { title: "Verify an exact backlink", description: "Queue a bounded public fetch of a claimed page and check for the exact selected owned target URL. This contacts the configured web provider and never sends email.", inputSchema: import_contracts.BacklinkVerificationInputSchema.extend({ projectId: import_contracts.SeoEntityIdSchema, prospectId: import_contracts.SeoEntityIdSchema, idempotencyKey: z.string().min(1).max(128) }), outputSchema: import_contracts.BacklinkVerificationSchema, annotations: backlinkOpenWorldAnnotations }, async ({ projectId, prospectId, idempotencyKey, ...input }) => {
+    try {
+      return jsonResult(await backlinkApi().prospects.verify(projectId, prospectId, input, idempotencyKey));
+    } catch (error) {
+      return errorResult(error);
+    }
+  });
   server.registerTool("list_blog_plans", {
     title: "List Blog Studio plans",
     description: "Read the bounded 30-day Blog Studio plans for one exact project. This does not read the social calendar.",