@socialneuron/mcp-server 1.4.0 → 1.4.1

package/dist/http.js

@@ -587,7 +587,7 @@ var TOOL_SCOPES = {
   adapt_content: "mcp:write",
   generate_video: "mcp:write",
   generate_image: "mcp:write",
-  check_status: "mcp:write",
+  check_status: "mcp:read",
   render_demo_video: "mcp:write",
   save_brand_profile: "mcp:write",
   update_platform_voice: "mcp:write",
@@ -775,7 +775,76 @@ async function callEdgeFunction(functionName, body, options) {
   }
 }
 
+// src/lib/rate-limit.ts
+var CATEGORY_CONFIGS = {
+  posting: { maxTokens: 30, refillRate: 30 / 60 },
+  // 30 req/min
+  screenshot: { maxTokens: 10, refillRate: 10 / 60 },
+  // 10 req/min
+  read: { maxTokens: 60, refillRate: 60 / 60 }
+  // 60 req/min
+};
+var RateLimiter = class {
+  tokens;
+  lastRefill;
+  maxTokens;
+  refillRate;
+  // tokens per second
+  constructor(config) {
+    this.maxTokens = config.maxTokens;
+    this.refillRate = config.refillRate;
+    this.tokens = config.maxTokens;
+    this.lastRefill = Date.now();
+  }
+  /**
+   * Try to consume one token. Returns true if the request is allowed,
+   * false if rate-limited.
+   */
+  consume() {
+    this.refill();
+    if (this.tokens >= 1) {
+      this.tokens -= 1;
+      return true;
+    }
+    return false;
+  }
+  /**
+   * Seconds until at least one token is available.
+   */
+  retryAfter() {
+    this.refill();
+    if (this.tokens >= 1) return 0;
+    return Math.ceil((1 - this.tokens) / this.refillRate);
+  }
+  refill() {
+    const now = Date.now();
+    const elapsed = (now - this.lastRefill) / 1e3;
+    this.tokens = Math.min(this.maxTokens, this.tokens + elapsed * this.refillRate);
+    this.lastRefill = now;
+  }
+};
+var limiters = /* @__PURE__ */ new Map();
+function getRateLimiter(category) {
+  let limiter = limiters.get(category);
+  if (!limiter) {
+    const config = CATEGORY_CONFIGS[category] ?? CATEGORY_CONFIGS.read;
+    limiter = new RateLimiter(config);
+    limiters.set(category, limiter);
+  }
+  return limiter;
+}
+function checkRateLimit(category, key) {
+  const bucketKey = key ? `${category}:${key}` : category;
+  const limiter = getRateLimiter(bucketKey);
+  const allowed = limiter.consume();
+  return {
+    allowed,
+    retryAfter: allowed ? 0 : limiter.retryAfter()
+  };
+}
+
 // src/tools/ideation.ts
+init_supabase();
 function registerIdeationTools(server) {
   server.tool(
     "generate_content",
@@ -796,7 +865,9 @@ function registerIdeationTools(server) {
         "facebook",
         "threads",
         "bluesky"
-      ]).optional().describe("Target social media platform. Helps tailor tone, length, and format."),
+      ]).optional().describe(
+        "Target social media platform. Helps tailor tone, length, and format."
+      ),
       brand_voice: z.string().max(500).optional().describe(
         'Brand voice guidelines to follow (e.g. "professional and empathetic", "playful and Gen-Z"). Leave blank to use a neutral tone.'
       ),
@@ -807,7 +878,30 @@ function registerIdeationTools(server) {
         "Project ID to auto-load brand profile and performance context for prompt enrichment."
       )
     },
-    async ({ prompt, content_type, platform: platform2, brand_voice, model, project_id }) => {
+    async ({
+      prompt,
+      content_type,
+      platform: platform2,
+      brand_voice,
+      model,
+      project_id
+    }) => {
+      try {
+        const userId = await getDefaultUserId();
+        const rl = checkRateLimit("posting", userId);
+        if (!rl.allowed) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: `Rate limited. Retry after ${rl.retryAfter}s.`
+              }
+            ],
+            isError: true
+          };
+        }
+      } catch {
+      }
       let enrichedPrompt = prompt;
       if (platform2) {
         enrichedPrompt += `
@@ -939,8 +1033,12 @@ Content Type: ${content_type}`;
       category: z.string().optional().describe(
         "Category filter (for YouTube). Examples: general, entertainment, education, tech, music, gaming, sports, news."
       ),
-      niche: z.string().optional().describe("Niche keyword filter. Only return trends matching these keywords."),
-      url: z.string().optional().describe('Required when source is "rss" or "url". The feed or page URL to fetch.'),
+      niche: z.string().optional().describe(
+        "Niche keyword filter. Only return trends matching these keywords."
+      ),
+      url: z.string().optional().describe(
+        'Required when source is "rss" or "url". The feed or page URL to fetch.'
+      ),
       force_refresh: z.boolean().optional().describe("Skip the server-side cache and fetch fresh data.")
     },
     async ({ source, category, niche, url, force_refresh }) => {
@@ -1015,7 +1113,9 @@ Content Type: ${content_type}`;
     "adapt_content",
     "Adapt existing content for a different social media platform. Rewrites content to match the target platform's norms including character limits, hashtag style, tone, and CTA conventions.",
     {
-      content: z.string().max(5e3).describe("The content to adapt. Can be a caption, script, blog excerpt, or any text."),
+      content: z.string().max(5e3).describe(
+        "The content to adapt. Can be a caption, script, blog excerpt, or any text."
+      ),
       source_platform: z.enum([
         "youtube",
         "tiktok",
@@ -1025,7 +1125,9 @@ Content Type: ${content_type}`;
         "facebook",
         "threads",
         "bluesky"
-      ]).optional().describe("The platform the content was originally written for. Helps preserve intent."),
+      ]).optional().describe(
+        "The platform the content was originally written for. Helps preserve intent."
+      ),
       target_platform: z.enum([
         "youtube",
         "tiktok",
@@ -1039,9 +1141,33 @@ Content Type: ${content_type}`;
       brand_voice: z.string().max(500).optional().describe(
         'Brand voice guidelines to maintain during adaptation (e.g. "professional", "playful").'
       ),
-      project_id: z.string().uuid().optional().describe("Optional project ID to load platform voice overrides from brand profile.")
+      project_id: z.string().uuid().optional().describe(
+        "Optional project ID to load platform voice overrides from brand profile."
+      )
     },
-    async ({ content, source_platform, target_platform, brand_voice, project_id }) => {
+    async ({
+      content,
+      source_platform,
+      target_platform,
+      brand_voice,
+      project_id
+    }) => {
+      try {
+        const userId = await getDefaultUserId();
+        const rl = checkRateLimit("posting", userId);
+        if (!rl.allowed) {
+          return {
+            content: [
+              {
+                type: "text",
+                text: `Rate limited. Retry after ${rl.retryAfter}s.`
+              }
+            ],
+            isError: true
+          };
+        }
+      } catch {
+      }
       const platformGuidelines = {
         twitter: "Max 280 characters. Concise, punchy. 1-3 hashtags max. Thread-friendly.",
         threads: "Max 500 characters. Conversational, opinion-driven. Minimal hashtags.",
@@ -1123,76 +1249,6 @@ ${content}`,
 
 // src/tools/content.ts
 import { z as z2 } from "zod";
-
-// src/lib/rate-limit.ts
-var CATEGORY_CONFIGS = {
-  posting: { maxTokens: 30, refillRate: 30 / 60 },
-  // 30 req/min
-  screenshot: { maxTokens: 10, refillRate: 10 / 60 },
-  // 10 req/min
-  read: { maxTokens: 60, refillRate: 60 / 60 }
-  // 60 req/min
-};
-var RateLimiter = class {
-  tokens;
-  lastRefill;
-  maxTokens;
-  refillRate;
-  // tokens per second
-  constructor(config) {
-    this.maxTokens = config.maxTokens;
-    this.refillRate = config.refillRate;
-    this.tokens = config.maxTokens;
-    this.lastRefill = Date.now();
-  }
-  /**
-   * Try to consume one token. Returns true if the request is allowed,
-   * false if rate-limited.
-   */
-  consume() {
-    this.refill();
-    if (this.tokens >= 1) {
-      this.tokens -= 1;
-      return true;
-    }
-    return false;
-  }
-  /**
-   * Seconds until at least one token is available.
-   */
-  retryAfter() {
-    this.refill();
-    if (this.tokens >= 1) return 0;
-    return Math.ceil((1 - this.tokens) / this.refillRate);
-  }
-  refill() {
-    const now = Date.now();
-    const elapsed = (now - this.lastRefill) / 1e3;
-    this.tokens = Math.min(this.maxTokens, this.tokens + elapsed * this.refillRate);
-    this.lastRefill = now;
-  }
-};
-var limiters = /* @__PURE__ */ new Map();
-function getRateLimiter(category) {
-  let limiter = limiters.get(category);
-  if (!limiter) {
-    const config = CATEGORY_CONFIGS[category] ?? CATEGORY_CONFIGS.read;
-    limiter = new RateLimiter(config);
-    limiters.set(category, limiter);
-  }
-  return limiter;
-}
-function checkRateLimit(category, key) {
-  const bucketKey = key ? `${category}:${key}` : category;
-  const limiter = getRateLimiter(bucketKey);
-  const allowed = limiter.consume();
-  return {
-    allowed,
-    retryAfter: allowed ? 0 : limiter.retryAfter()
-  };
-}
-
-// src/tools/content.ts
 init_supabase();
 
 // src/lib/sanitize-error.ts
@@ -1246,8 +1302,19 @@ function sanitizeDbError(error) {
 
 // src/tools/content.ts
 init_request_context();
-var MAX_CREDITS_PER_RUN = Math.max(0, Number(process.env.SOCIALNEURON_MAX_CREDITS_PER_RUN || 0));
-var MAX_ASSETS_PER_RUN = Math.max(0, Number(process.env.SOCIALNEURON_MAX_ASSETS_PER_RUN || 0));
+
+// src/lib/version.ts
+var MCP_VERSION = "1.4.1";
+
+// src/tools/content.ts
+var MAX_CREDITS_PER_RUN = Math.max(
+  0,
+  Number(process.env.SOCIALNEURON_MAX_CREDITS_PER_RUN || 0)
+);
+var MAX_ASSETS_PER_RUN = Math.max(
+  0,
+  Number(process.env.SOCIALNEURON_MAX_ASSETS_PER_RUN || 0)
+);
 var _globalCreditsUsed = 0;
 var _globalAssetsGenerated = 0;
 function getCreditsUsed() {
@@ -1289,7 +1356,7 @@ function getCurrentBudgetStatus() {
 function asEnvelope(data) {
   return {
     _meta: {
-      version: "0.2.0",
+      version: MCP_VERSION,
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     },
     data
@@ -1371,8 +1438,12 @@ function registerContentTools(server) {
       enable_audio: z2.boolean().optional().describe(
         "Enable native audio generation. Kling 2.6: doubles cost. Kling 3.0: 50% more (std 30/sec, pro 40/sec). 5+ languages."
       ),
-      image_url: z2.string().optional().describe("Start frame image URL for image-to-video (Kling 3.0 frame control)."),
-      end_frame_url: z2.string().optional().describe("End frame image URL (Kling 3.0 only). Enables seamless loop transitions."),
+      image_url: z2.string().optional().describe(
+        "Start frame image URL for image-to-video (Kling 3.0 frame control)."
+      ),
+      end_frame_url: z2.string().optional().describe(
+        "End frame image URL (Kling 3.0 only). Enables seamless loop transitions."
+      ),
       response_format: z2.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
     },
     async ({
@@ -1810,10 +1881,13 @@ function registerContentTools(server) {
         };
       }
       if (job.external_id && (job.status === "pending" || job.status === "processing")) {
-        const { data: liveStatus } = await callEdgeFunction("kie-task-status", {
-          taskId: job.external_id,
-          model: job.model
-        });
+        const { data: liveStatus } = await callEdgeFunction(
+          "kie-task-status",
+          {
+            taskId: job.external_id,
+            model: job.model
+          }
+        );
         if (liveStatus) {
           const lines2 = [
             `Job: ${job.id}`,
@@ -1887,7 +1961,12 @@ function registerContentTools(server) {
       });
       if (format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope(job), null, 2) }]
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope(job), null, 2)
+            }
+          ]
         };
       }
       return {
@@ -1905,7 +1984,15 @@ function registerContentTools(server) {
       brand_context: z2.string().max(3e3).optional().describe(
         "Brand context JSON from extract_brand. Include colors, voice tone, visual style keywords for consistent branding across frames."
       ),
-      platform: z2.enum(["tiktok", "instagram-reels", "youtube-shorts", "youtube", "general"]).describe("Target platform. Determines aspect ratio, duration, and pacing."),
+      platform: z2.enum([
+        "tiktok",
+        "instagram-reels",
+        "youtube-shorts",
+        "youtube",
+        "general"
+      ]).describe(
+        "Target platform. Determines aspect ratio, duration, and pacing."
+      ),
       target_duration: z2.number().min(5).max(120).optional().describe(
         "Target total duration in seconds. Defaults to 30s for short-form, 60s for YouTube."
       ),
@@ -1913,7 +2000,9 @@ function registerContentTools(server) {
       style: z2.string().optional().describe(
         'Visual style direction (e.g., "cinematic", "anime", "documentary", "motion graphics").'
       ),
-      response_format: z2.enum(["text", "json"]).optional().describe("Response format. Defaults to json for structured storyboard data.")
+      response_format: z2.enum(["text", "json"]).optional().describe(
+        "Response format. Defaults to json for structured storyboard data."
+      )
     },
     async ({
       concept,
@@ -1926,7 +2015,11 @@ function registerContentTools(server) {
     }) => {
       const format = response_format ?? "json";
       const startedAt = Date.now();
-      const isShortForm = ["tiktok", "instagram-reels", "youtube-shorts"].includes(platform2);
+      const isShortForm = [
+        "tiktok",
+        "instagram-reels",
+        "youtube-shorts"
+      ].includes(platform2);
       const duration = target_duration ?? (isShortForm ? 30 : 60);
       const scenes = num_scenes ?? (isShortForm ? 7 : 10);
       const aspectRatio = isShortForm ? "9:16" : "16:9";
@@ -2019,7 +2112,12 @@ Return ONLY valid JSON in this exact format:
           details: { error }
         });
         return {
-          content: [{ type: "text", text: `Storyboard generation failed: ${error}` }],
+          content: [
+            {
+              type: "text",
+              text: `Storyboard generation failed: ${error}`
+            }
+          ],
           isError: true
         };
       }
@@ -2035,7 +2133,12 @@ Return ONLY valid JSON in this exact format:
         try {
           const parsed = JSON.parse(rawContent);
           return {
-            content: [{ type: "text", text: JSON.stringify(asEnvelope(parsed), null, 2) }]
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify(asEnvelope(parsed), null, 2)
+              }
+            ]
           };
         } catch {
           return {
@@ -2099,7 +2202,10 @@ Return ONLY valid JSON in this exact format:
           isError: true
         };
       }
-      const rateLimit = checkRateLimit("posting", `generate_voiceover:${userId}`);
+      const rateLimit = checkRateLimit(
+        "posting",
+        `generate_voiceover:${userId}`
+      );
       if (!rateLimit.allowed) {
         await logMcpToolInvocation({
           toolName: "generate_voiceover",
@@ -2134,7 +2240,12 @@ Return ONLY valid JSON in this exact format:
           details: { error }
         });
         return {
-          content: [{ type: "text", text: `Voiceover generation failed: ${error}` }],
+          content: [
+            {
+              type: "text",
+              text: `Voiceover generation failed: ${error}`
+            }
+          ],
           isError: true
         };
       }
@@ -2147,7 +2258,10 @@ Return ONLY valid JSON in this exact format:
         });
         return {
           content: [
-            { type: "text", text: "Voiceover generation failed: no audio URL returned." }
+            {
+              type: "text",
+              text: "Voiceover generation failed: no audio URL returned."
+            }
           ],
           isError: true
         };
@@ -2219,7 +2333,9 @@ Return ONLY valid JSON in this exact format:
         "Carousel template. hormozi-authority: bold typography, one idea per slide, dark backgrounds. educational-series: numbered tips. Default: hormozi-authority."
       ),
       slide_count: z2.number().min(3).max(10).optional().describe("Number of slides (3-10). Default: 7."),
-      aspect_ratio: z2.enum(["1:1", "4:5", "9:16"]).optional().describe("Aspect ratio. 1:1 square (default), 4:5 portrait, 9:16 story."),
+      aspect_ratio: z2.enum(["1:1", "4:5", "9:16"]).optional().describe(
+        "Aspect ratio. 1:1 square (default), 4:5 portrait, 9:16 story."
+      ),
       style: z2.enum(["minimal", "bold", "professional", "playful", "hormozi"]).optional().describe(
         "Visual style. hormozi: black bg, bold white text, gold accents. Default: hormozi (when using hormozi-authority template)."
       ),
@@ -2256,7 +2372,10 @@ Return ONLY valid JSON in this exact format:
         };
       }
       const userId = await getDefaultUserId();
-      const rateLimit = checkRateLimit("posting", `generate_carousel:${userId}`);
+      const rateLimit = checkRateLimit(
+        "posting",
+        `generate_carousel:${userId}`
+      );
       if (!rateLimit.allowed) {
         await logMcpToolInvocation({
           toolName: "generate_carousel",
@@ -2294,7 +2413,12 @@ Return ONLY valid JSON in this exact format:
           details: { error }
         });
         return {
-          content: [{ type: "text", text: `Carousel generation failed: ${error}` }],
+          content: [
+            {
+              type: "text",
+              text: `Carousel generation failed: ${error}`
+            }
+          ],
           isError: true
         };
       }
@@ -2306,7 +2430,12 @@ Return ONLY valid JSON in this exact format:
           details: { error: "No carousel data returned" }
         });
         return {
-          content: [{ type: "text", text: "Carousel generation returned no data." }],
+          content: [
+            {
+              type: "text",
+              text: "Carousel generation returned no data."
+            }
+          ],
           isError: true
         };
       }
@@ -2507,7 +2636,7 @@ var PLATFORM_CASE_MAP = {
 function asEnvelope2(data) {
   return {
     _meta: {
-      version: "0.2.0",
+      version: MCP_VERSION,
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     },
     data
@@ -2539,15 +2668,21 @@ function registerDistributionTools(server) {
           "threads",
           "bluesky"
         ])
-      ).min(1).describe("Target platforms to post to. Each must have an active OAuth connection."),
+      ).min(1).describe(
+        "Target platforms to post to. Each must have an active OAuth connection."
+      ),
       title: z3.string().optional().describe("Post title (used by YouTube and some other platforms)."),
-      hashtags: z3.array(z3.string()).optional().describe('Hashtags to append to the caption. Include or omit the "#" prefix.'),
+      hashtags: z3.array(z3.string()).optional().describe(
+        'Hashtags to append to the caption. Include or omit the "#" prefix.'
+      ),
       schedule_at: z3.string().optional().describe(
         'ISO 8601 datetime for scheduled posting (e.g. "2026-03-15T14:00:00Z"). Omit for immediate posting.'
       ),
       project_id: z3.string().optional().describe("Social Neuron project ID to associate this post with."),
       response_format: z3.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text."),
-      attribution: z3.boolean().optional().describe('If true, appends "Created with Social Neuron" to the caption. Default: false.')
+      attribution: z3.boolean().optional().describe(
+        'If true, appends "Created with Social Neuron" to the caption. Default: false.'
+      )
     },
     async ({
       media_url,
@@ -2566,7 +2701,12 @@ function registerDistributionTools(server) {
       const startedAt = Date.now();
       if ((!caption || caption.trim().length === 0) && (!title || title.trim().length === 0)) {
         return {
-          content: [{ type: "text", text: "Either caption or title is required." }],
+          content: [
+            {
+              type: "text",
+              text: "Either caption or title is required."
+            }
+          ],
           isError: true
         };
       }
@@ -2589,7 +2729,9 @@ function registerDistributionTools(server) {
           isError: true
         };
       }
-      const normalizedPlatforms = platforms.map((p) => PLATFORM_CASE_MAP[p.toLowerCase()] || p);
+      const normalizedPlatforms = platforms.map(
+        (p) => PLATFORM_CASE_MAP[p.toLowerCase()] || p
+      );
       let finalCaption = caption;
       if (attribution && finalCaption) {
         finalCaption = `${finalCaption}
@@ -2653,7 +2795,9 @@ Created with Social Neuron`;
       ];
       for (const [platform2, result] of Object.entries(data.results)) {
         if (result.success) {
-          lines.push(`  ${platform2}: OK (jobId=${result.jobId}, postId=${result.postId})`);
+          lines.push(
+            `  ${platform2}: OK (jobId=${result.jobId}, postId=${result.postId})`
+          );
         } else {
           lines.push(`  ${platform2}: FAILED - ${result.error}`);
         }
@@ -2670,7 +2814,12 @@ Created with Social Neuron`;
       });
       if (format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope2(data), null, 2) }],
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope2(data), null, 2)
+            }
+          ],
           isError: !data.success
         };
       }
@@ -2726,12 +2875,17 @@ Created with Social Neuron`;
       for (const account of accounts) {
         const name = account.username || "(unnamed)";
         const platformLower = account.platform.toLowerCase();
-        lines.push(`  ${platformLower}: ${name} (connected ${account.created_at.split("T")[0]})`);
+        lines.push(
+          `  ${platformLower}: ${name} (connected ${account.created_at.split("T")[0]})`
+        );
       }
       if (format === "json") {
         return {
           content: [
-            { type: "text", text: JSON.stringify(asEnvelope2({ accounts }), null, 2) }
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope2({ accounts }), null, 2)
+            }
           ]
         };
       }
@@ -2793,7 +2947,10 @@ Created with Social Neuron`;
         if (format === "json") {
           return {
             content: [
-              { type: "text", text: JSON.stringify(asEnvelope2({ posts: [] }), null, 2) }
+              {
+                type: "text",
+                text: JSON.stringify(asEnvelope2({ posts: [] }), null, 2)
+              }
             ]
           };
         }
@@ -2810,7 +2967,10 @@ Created with Social Neuron`;
       if (format === "json") {
         return {
           content: [
-            { type: "text", text: JSON.stringify(asEnvelope2({ posts }), null, 2) }
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope2({ posts }), null, 2)
+            }
           ]
         };
       }
@@ -2871,7 +3031,13 @@ Created with Social Neuron`;
       min_gap_hours: z3.number().min(1).max(24).default(4).describe("Minimum gap between posts on same platform"),
       response_format: z3.enum(["text", "json"]).default("text")
     },
-    async ({ platforms, count, start_after, min_gap_hours, response_format }) => {
+    async ({
+      platforms,
+      count,
+      start_after,
+      min_gap_hours,
+      response_format
+    }) => {
       const startedAt = Date.now();
       try {
         const userId = await getDefaultUserId();
@@ -2882,7 +3048,9 @@ Created with Social Neuron`;
         const gapMs = min_gap_hours * 60 * 60 * 1e3;
         const candidates = [];
         for (let dayOffset = 0; dayOffset < 7; dayOffset++) {
-          const date = new Date(startDate.getTime() + dayOffset * 24 * 60 * 60 * 1e3);
+          const date = new Date(
+            startDate.getTime() + dayOffset * 24 * 60 * 60 * 1e3
+          );
           const dayOfWeek = date.getUTCDay();
           for (const platform2 of platforms) {
             const hours = PREFERRED_HOURS[platform2] ?? [12, 16];
@@ -2891,8 +3059,11 @@ Created with Social Neuron`;
               slotDate.setUTCHours(hours[hourIdx], 0, 0, 0);
               if (slotDate <= startDate) continue;
               const hasConflict = (existingPosts ?? []).some((post) => {
-                if (String(post.platform).toLowerCase() !== platform2) return false;
-                const postTime = new Date(post.scheduled_at ?? post.published_at).getTime();
+                if (String(post.platform).toLowerCase() !== platform2)
+                  return false;
+                const postTime = new Date(
+                  post.scheduled_at ?? post.published_at
+                ).getTime();
                 return Math.abs(postTime - slotDate.getTime()) < gapMs;
               });
               let engagementScore = hours.length - hourIdx;
@@ -2937,15 +3108,22 @@ Created with Social Neuron`;
           };
         }
         const lines = [];
-        lines.push(`Found ${slots.length} optimal slots (${conflictsAvoided} conflicts avoided):`);
+        lines.push(
+          `Found ${slots.length} optimal slots (${conflictsAvoided} conflicts avoided):`
+        );
         lines.push("");
         lines.push("Datetime (UTC)           | Platform   | Score");
         lines.push("-------------------------+------------+------");
         for (const s of slots) {
           const dt = s.datetime.replace("T", " ").slice(0, 19);
-          lines.push(`${dt.padEnd(25)}| ${s.platform.padEnd(11)}| ${s.engagement_score}`);
+          lines.push(
+            `${dt.padEnd(25)}| ${s.platform.padEnd(11)}| ${s.engagement_score}`
+          );
         }
-        return { content: [{ type: "text", text: lines.join("\n") }], isError: false };
+        return {
+          content: [{ type: "text", text: lines.join("\n") }],
+          isError: false
+        };
       } catch (err) {
         const durationMs = Date.now() - startedAt;
         const message = err instanceof Error ? err.message : String(err);
@@ -2956,7 +3134,9 @@ Created with Social Neuron`;
           details: { error: message }
         });
         return {
-          content: [{ type: "text", text: `Failed to find slots: ${message}` }],
+          content: [
+            { type: "text", text: `Failed to find slots: ${message}` }
+          ],
           isError: true
         };
       }
@@ -2983,8 +3163,12 @@ Created with Social Neuron`;
       auto_slot: z3.boolean().default(true).describe("Auto-assign time slots for posts without schedule_at"),
       dry_run: z3.boolean().default(false).describe("Preview without actually scheduling"),
       response_format: z3.enum(["text", "json"]).default("text"),
-      enforce_quality: z3.boolean().default(true).describe("When true, block scheduling for posts that fail quality checks."),
-      quality_threshold: z3.number().int().min(0).max(35).optional().describe("Optional quality threshold override. Defaults to project setting or 26."),
+      enforce_quality: z3.boolean().default(true).describe(
+        "When true, block scheduling for posts that fail quality checks."
+      ),
+      quality_threshold: z3.number().int().min(0).max(35).optional().describe(
+        "Optional quality threshold override. Defaults to project setting or 26."
+      ),
       batch_size: z3.number().int().min(1).max(10).default(4).describe("Concurrent schedule calls per platform batch."),
       idempotency_seed: z3.string().max(128).optional().describe("Optional stable seed used when building idempotency keys.")
     },
@@ -3023,17 +3207,25 @@ Created with Social Neuron`;
           if (!stored?.plan_payload) {
             return {
               content: [
-                { type: "text", text: `No content plan found for plan_id=${plan_id}` }
+                {
+                  type: "text",
+                  text: `No content plan found for plan_id=${plan_id}`
+                }
               ],
               isError: true
             };
           }
           const payload = stored.plan_payload;
-          const postsFromPayload = Array.isArray(payload.posts) ? payload.posts : Array.isArray(payload.data?.posts) ? payload.data.posts : null;
+          const postsFromPayload = Array.isArray(payload.posts) ? payload.posts : Array.isArray(
+            payload.data?.posts
+          ) ? payload.data.posts : null;
           if (!postsFromPayload) {
             return {
               content: [
-                { type: "text", text: `Stored plan ${plan_id} has no posts array.` }
+                {
+                  type: "text",
+                  text: `Stored plan ${plan_id} has no posts array.`
+                }
               ],
               isError: true
             };
@@ -3125,7 +3317,10 @@ Created with Social Neuron`;
             approvalSummary = {
               total: approvals.length,
               eligible: approvedPosts.length,
-              skipped: Math.max(0, workingPlan.posts.length - approvedPosts.length)
+              skipped: Math.max(
+                0,
+                workingPlan.posts.length - approvedPosts.length
+              )
             };
             workingPlan = {
               ...workingPlan,
@@ -3159,9 +3354,14 @@ Created with Social Neuron`;
           try {
             const { data: settingsData } = await supabase.from("system_settings").select("value").eq("key", "content_safety").maybeSingle();
             if (settingsData?.value?.quality_threshold !== void 0) {
-              const parsedThreshold = Number(settingsData.value.quality_threshold);
+              const parsedThreshold = Number(
+                settingsData.value.quality_threshold
+              );
               if (Number.isFinite(parsedThreshold)) {
-                effectiveQualityThreshold = Math.max(0, Math.min(35, Math.trunc(parsedThreshold)));
+                effectiveQualityThreshold = Math.max(
+                  0,
+                  Math.min(35, Math.trunc(parsedThreshold))
+                );
               }
             }
             if (Array.isArray(settingsData?.value?.custom_banned_terms)) {
@@ -3197,13 +3397,18 @@ Created with Social Neuron`;
             }
           };
         });
-        const qualityPassed = postsWithResults.filter((post) => post.quality.passed).length;
+        const qualityPassed = postsWithResults.filter(
+          (post) => post.quality.passed
+        ).length;
         const qualitySummary = {
           total_posts: postsWithResults.length,
           passed: qualityPassed,
           failed: postsWithResults.length - qualityPassed,
           avg_score: postsWithResults.length > 0 ? Number(
-            (postsWithResults.reduce((sum, post) => sum + post.quality.score, 0) / postsWithResults.length).toFixed(2)
+            (postsWithResults.reduce(
+              (sum, post) => sum + post.quality.score,
+              0
+            ) / postsWithResults.length).toFixed(2)
           ) : 0
         };
         if (dry_run) {
@@ -3273,8 +3478,13 @@ Created with Social Neuron`;
             }
           }
           lines2.push("");
-          lines2.push(`Summary: ${passed}/${workingPlan.posts.length} passed quality check`);
-          return { content: [{ type: "text", text: lines2.join("\n") }], isError: false };
+          lines2.push(
+            `Summary: ${passed}/${workingPlan.posts.length} passed quality check`
+          );
+          return {
+            content: [{ type: "text", text: lines2.join("\n") }],
+            isError: false
+          };
         }
         let scheduled = 0;
         let failed = 0;
@@ -3366,7 +3576,8 @@ Created with Social Neuron`;
         }
         const chunk = (arr, size) => {
           const out = [];
-          for (let i = 0; i < arr.length; i += size) out.push(arr.slice(i, i + size));
+          for (let i = 0; i < arr.length; i += size)
+            out.push(arr.slice(i, i + size));
           return out;
         };
         const platformBatches = Array.from(grouped.entries()).map(
@@ -3374,7 +3585,9 @@ Created with Social Neuron`;
             const platformResults = [];
             const batches = chunk(platformPosts, batch_size);
             for (const batch of batches) {
-              const settled = await Promise.allSettled(batch.map((post) => scheduleOne(post)));
+              const settled = await Promise.allSettled(
+                batch.map((post) => scheduleOne(post))
+              );
               for (const outcome of settled) {
                 if (outcome.status === "fulfilled") {
                   platformResults.push(outcome.value);
@@ -3440,7 +3653,11 @@ Created with Social Neuron`;
                     plan_id: effectivePlanId,
                     approvals: approvalSummary,
                     posts: results,
-                    summary: { total_posts: workingPlan.posts.length, scheduled, failed }
+                    summary: {
+                      total_posts: workingPlan.posts.length,
+                      scheduled,
+                      failed
+                    }
                   }),
                   null,
                   2
@@ -3478,7 +3695,12 @@ Created with Social Neuron`;
           details: { error: message }
         });
         return {
-          content: [{ type: "text", text: `Batch scheduling failed: ${message}` }],
+          content: [
+            {
+              type: "text",
+              text: `Batch scheduling failed: ${message}`
+            }
+          ],
           isError: true
         };
       }
@@ -3492,7 +3714,7 @@ import { z as z4 } from "zod";
 function asEnvelope3(data) {
   return {
     _meta: {
-      version: "0.2.0",
+      version: MCP_VERSION,
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     },
     data
@@ -3605,7 +3827,9 @@ function registerAnalyticsTools(server) {
             ]
           };
         }
-        const { data: simpleRows, error: simpleError } = await supabase.from("post_analytics").select("id, post_id, platform, views, likes, comments, shares, captured_at").in("post_id", postIds).gte("captured_at", sinceIso).order("captured_at", { ascending: false }).limit(maxPosts);
+        const { data: simpleRows, error: simpleError } = await supabase.from("post_analytics").select(
+          "id, post_id, platform, views, likes, comments, shares, captured_at"
+        ).in("post_id", postIds).gte("captured_at", sinceIso).order("captured_at", { ascending: false }).limit(maxPosts);
         if (simpleError) {
           return {
             content: [
@@ -3617,7 +3841,12 @@ function registerAnalyticsTools(server) {
             isError: true
           };
         }
-        return formatSimpleAnalytics(simpleRows, platform2, lookbackDays, format);
+        return formatSimpleAnalytics(
+          simpleRows,
+          platform2,
+          lookbackDays,
+          format
+        );
       }
       if (!rows || rows.length === 0) {
         if (format === "json") {
@@ -3694,7 +3923,10 @@ function registerAnalyticsTools(server) {
       const format = response_format ?? "text";
       const startedAt = Date.now();
       const userId = await getDefaultUserId();
-      const rateLimit = checkRateLimit("posting", `refresh_platform_analytics:${userId}`);
+      const rateLimit = checkRateLimit(
+        "posting",
+        `refresh_platform_analytics:${userId}`
+      );
       if (!rateLimit.allowed) {
         await logMcpToolInvocation({
           toolName: "refresh_platform_analytics",
@@ -3712,7 +3944,9 @@ function registerAnalyticsTools(server) {
           isError: true
         };
       }
-      const { data, error } = await callEdgeFunction("fetch-analytics", { userId });
+      const { data, error } = await callEdgeFunction("fetch-analytics", {
+        userId
+      });
       if (error) {
         await logMcpToolInvocation({
           toolName: "refresh_platform_analytics",
@@ -3721,7 +3955,12 @@ function registerAnalyticsTools(server) {
           details: { error }
         });
         return {
-          content: [{ type: "text", text: `Error refreshing analytics: ${error}` }],
+          content: [
+            {
+              type: "text",
+              text: `Error refreshing analytics: ${error}`
+            }
+          ],
           isError: true
         };
       }
@@ -3734,12 +3973,18 @@ function registerAnalyticsTools(server) {
           details: { error: "Edge function returned success=false" }
         });
         return {
-          content: [{ type: "text", text: "Analytics refresh failed." }],
+          content: [
+            { type: "text", text: "Analytics refresh failed." }
+          ],
           isError: true
         };
       }
-      const queued = (result.results ?? []).filter((r) => r.status === "queued").length;
-      const errored = (result.results ?? []).filter((r) => r.status === "error").length;
+      const queued = (result.results ?? []).filter(
+        (r) => r.status === "queued"
+      ).length;
+      const errored = (result.results ?? []).filter(
+        (r) => r.status === "error"
+      ).length;
       const lines = [
         `Analytics refresh triggered successfully.`,
         `  Posts processed: ${result.postsProcessed}`,
@@ -3785,7 +4030,10 @@ function formatAnalytics(summary, days, format) {
   if (format === "json") {
     return {
       content: [
-        { type: "text", text: JSON.stringify(asEnvelope3({ ...summary, days }), null, 2) }
+        {
+          type: "text",
+          text: JSON.stringify(asEnvelope3({ ...summary, days }), null, 2)
+        }
       ]
     };
   }
@@ -3902,10 +4150,159 @@ function formatSimpleAnalytics(rows, platform2, days, format) {
 // src/tools/brand.ts
 import { z as z5 } from "zod";
 init_supabase();
+
+// src/lib/ssrf.ts
+var BLOCKED_IP_PATTERNS = [
+  // IPv4 localhost/loopback
+  /^127\./,
+  /^0\./,
+  // IPv4 private ranges (RFC 1918)
+  /^10\./,
+  /^172\.(1[6-9]|2[0-9]|3[0-1])\./,
+  /^192\.168\./,
+  // IPv4 link-local
+  /^169\.254\./,
+  // Cloud metadata endpoint (AWS, GCP, Azure)
+  /^169\.254\.169\.254$/,
+  // IPv4 broadcast
+  /^255\./,
+  // Shared address space (RFC 6598)
+  /^100\.(6[4-9]|[7-9][0-9]|1[0-1][0-9]|12[0-7])\./
+];
+var BLOCKED_IPV6_PATTERNS = [
+  /^::1$/i,
+  // loopback
+  /^::$/i,
+  // unspecified
+  /^fe[89ab][0-9a-f]:/i,
+  // link-local fe80::/10
+  /^fc[0-9a-f]:/i,
+  // unique local fc00::/7
+  /^fd[0-9a-f]:/i,
+  // unique local fc00::/7
+  /^::ffff:127\./i,
+  // IPv4-mapped localhost
+  /^::ffff:(0|10|127|169\.254|172\.(1[6-9]|2[0-9]|3[0-1])|192\.168)\./i
+  // IPv4-mapped private
+];
+var BLOCKED_HOSTNAMES = [
+  "localhost",
+  "localhost.localdomain",
+  "local",
+  "127.0.0.1",
+  "0.0.0.0",
+  "[::1]",
+  "[::ffff:127.0.0.1]",
+  // Cloud metadata endpoints
+  "metadata.google.internal",
+  "metadata.goog",
+  "instance-data",
+  "instance-data.ec2.internal"
+];
+var ALLOWED_PROTOCOLS = ["http:", "https:"];
+var BLOCKED_PORTS = [22, 23, 25, 110, 143, 445, 3306, 5432, 6379, 27017, 11211];
+function isBlockedIP(ip) {
+  const normalized = ip.replace(/^\[/, "").replace(/\]$/, "");
+  if (normalized.includes(":")) {
+    return BLOCKED_IPV6_PATTERNS.some((pattern) => pattern.test(normalized));
+  }
+  return BLOCKED_IP_PATTERNS.some((pattern) => pattern.test(normalized));
+}
+function isBlockedHostname(hostname) {
+  return BLOCKED_HOSTNAMES.includes(hostname.toLowerCase());
+}
+function isIPAddress(hostname) {
+  const ipv4Pattern = /^(\d{1,3}\.){3}\d{1,3}$/;
+  const ipv6Pattern = /^\[?[a-fA-F0-9:]+\]?$/;
+  return ipv4Pattern.test(hostname) || ipv6Pattern.test(hostname);
+}
+async function validateUrlForSSRF(urlString) {
+  try {
+    const url = new URL(urlString);
+    if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {
+      return {
+        isValid: false,
+        error: `Invalid protocol: ${url.protocol}. Only HTTP and HTTPS are allowed.`
+      };
+    }
+    if (url.username || url.password) {
+      return {
+        isValid: false,
+        error: "URLs with embedded credentials are not allowed."
+      };
+    }
+    const hostname = url.hostname.toLowerCase();
+    if (isBlockedHostname(hostname)) {
+      return {
+        isValid: false,
+        error: "Access to internal/localhost addresses is not allowed."
+      };
+    }
+    if (isIPAddress(hostname) && isBlockedIP(hostname)) {
+      return {
+        isValid: false,
+        error: "Access to private/internal IP addresses is not allowed."
+      };
+    }
+    const port = url.port ? parseInt(url.port, 10) : url.protocol === "https:" ? 443 : 80;
+    if (BLOCKED_PORTS.includes(port)) {
+      return {
+        isValid: false,
+        error: `Access to port ${port} is not allowed.`
+      };
+    }
+    let resolvedIP;
+    if (!isIPAddress(hostname)) {
+      try {
+        const dns = await import("node:dns");
+        const resolver = new dns.promises.Resolver();
+        const resolvedIPs = [];
+        try {
+          const aRecords = await resolver.resolve4(hostname);
+          resolvedIPs.push(...aRecords);
+        } catch {
+        }
+        try {
+          const aaaaRecords = await resolver.resolve6(hostname);
+          resolvedIPs.push(...aaaaRecords);
+        } catch {
+        }
+        if (resolvedIPs.length === 0) {
+          return {
+            isValid: false,
+            error: "DNS resolution failed: hostname did not resolve to any address."
+          };
+        }
+        for (const ip of resolvedIPs) {
+          if (isBlockedIP(ip)) {
+            return {
+              isValid: false,
+              error: "Hostname resolves to a private/internal IP address."
+            };
+          }
+        }
+        resolvedIP = resolvedIPs[0];
+      } catch {
+        return {
+          isValid: false,
+          error: "DNS resolution failed. Cannot verify hostname safety."
+        };
+      }
+    }
+    return { isValid: true, sanitizedUrl: url.toString(), resolvedIP };
+  } catch (error) {
+    return {
+      isValid: false,
+      error: `Invalid URL format: ${error instanceof Error ? error.message : "Unknown error"}`
+    };
+  }
+}
+
+// src/tools/brand.ts
 function asEnvelope4(data) {
   return {
     _meta: {
-      version: "0.2.0",
+      version: MCP_VERSION,
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     },
     data
@@ -3922,6 +4319,15 @@ function registerBrandTools(server) {
       response_format: z5.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
     },
     async ({ url, response_format }) => {
+      const ssrfCheck = await validateUrlForSSRF(url);
+      if (!ssrfCheck.isValid) {
+        return {
+          content: [
+            { type: "text", text: `URL blocked: ${ssrfCheck.error}` }
+          ],
+          isError: true
+        };
+      }
       const { data, error } = await callEdgeFunction(
         "brand-extract",
         { url },
@@ -3951,7 +4357,12 @@ function registerBrandTools(server) {
       }
       if ((response_format || "text") === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope4(data), null, 2) }]
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope4(data), null, 2)
+            }
+          ]
         };
       }
       const lines = [
@@ -4015,7 +4426,12 @@ function registerBrandTools(server) {
       const { data: membership } = await supabase.from("organization_members").select("organization_id").eq("user_id", userId).eq("organization_id", project.organization_id).maybeSingle();
       if (!membership) {
         return {
-          content: [{ type: "text", text: "Project is not accessible to current user." }],
+          content: [
+            {
+              type: "text",
+              text: "Project is not accessible to current user."
+            }
+          ],
           isError: true
         };
       }
@@ -4034,13 +4450,21 @@ function registerBrandTools(server) {
       if (!data) {
         return {
           content: [
-            { type: "text", text: "No active brand profile found for this project." }
+            {
+              type: "text",
+              text: "No active brand profile found for this project."
+            }
           ]
         };
       }
       if ((response_format || "text") === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope4(data), null, 2) }]
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope4(data), null, 2)
+            }
+          ]
         };
       }
       const lines = [
@@ -4061,11 +4485,18 @@ function registerBrandTools(server) {
     "Persist a brand profile as the active profile for a project.",
     {
       project_id: z5.string().uuid().optional().describe("Project ID. Defaults to active project context."),
-      brand_context: z5.record(z5.string(), z5.unknown()).describe("Brand context payload to save to brand_profiles.brand_context."),
+      brand_context: z5.record(z5.string(), z5.unknown()).describe(
+        "Brand context payload to save to brand_profiles.brand_context."
+      ),
       change_summary: z5.string().max(500).optional().describe("Optional summary of changes."),
       changed_paths: z5.array(z5.string()).optional().describe("Optional changed path list."),
       source_url: z5.string().url().optional().describe("Optional source URL for provenance."),
-      extraction_method: z5.enum(["manual", "url_extract", "business_profiler", "product_showcase"]).optional().describe("Extraction method metadata."),
+      extraction_method: z5.enum([
+        "manual",
+        "url_extract",
+        "business_profiler",
+        "product_showcase"
+      ]).optional().describe("Extraction method metadata."),
       overall_confidence: z5.number().min(0).max(1).optional().describe("Optional overall confidence score in range 0..1."),
       extraction_metadata: z5.record(z5.string(), z5.unknown()).optional(),
       response_format: z5.enum(["text", "json"]).optional()
@@ -4105,20 +4536,28 @@ function registerBrandTools(server) {
       const { data: membership } = await supabase.from("organization_members").select("organization_id").eq("user_id", userId).eq("organization_id", project.organization_id).maybeSingle();
       if (!membership) {
         return {
-          content: [{ type: "text", text: "Project is not accessible to current user." }],
+          content: [
+            {
+              type: "text",
+              text: "Project is not accessible to current user."
+            }
+          ],
           isError: true
         };
       }
-      const { data: profileId, error } = await supabase.rpc("set_active_brand_profile", {
-        p_project_id: projectId,
-        p_brand_context: brand_context,
-        p_change_summary: change_summary || null,
-        p_changed_paths: changed_paths || [],
-        p_source_url: source_url || null,
-        p_extraction_method: extraction_method || "manual",
-        p_overall_confidence: overall_confidence ?? null,
-        p_extraction_metadata: extraction_metadata || null
-      });
+      const { data: profileId, error } = await supabase.rpc(
+        "set_active_brand_profile",
+        {
+          p_project_id: projectId,
+          p_brand_context: brand_context,
+          p_change_summary: change_summary || null,
+          p_changed_paths: changed_paths || [],
+          p_source_url: source_url || null,
+          p_extraction_method: extraction_method || "manual",
+          p_overall_confidence: overall_confidence ?? null,
+          p_extraction_metadata: extraction_metadata || null
+        }
+      );
       if (error) {
         return {
           content: [
@@ -4139,7 +4578,12 @@ function registerBrandTools(server) {
       };
       if ((response_format || "text") === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope4(payload), null, 2) }]
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope4(payload), null, 2)
+            }
+          ]
         };
       }
       return {
@@ -4195,7 +4639,10 @@ Version: ${payload.version ?? "N/A"}`
       if (!projectId) {
         return {
           content: [
-            { type: "text", text: "No project_id provided and no default project found." }
+            {
+              type: "text",
+              text: "No project_id provided and no default project found."
+            }
           ],
           isError: true
         };
@@ -4210,7 +4657,12 @@ Version: ${payload.version ?? "N/A"}`
       const { data: membership } = await supabase.from("organization_members").select("organization_id").eq("user_id", userId).eq("organization_id", project.organization_id).maybeSingle();
       if (!membership) {
         return {
-          content: [{ type: "text", text: "Project is not accessible to current user." }],
+          content: [
+            {
+              type: "text",
+              text: "Project is not accessible to current user."
+            }
+          ],
           isError: true
         };
       }
@@ -4226,7 +4678,9 @@ Version: ${payload.version ?? "N/A"}`
           isError: true
         };
       }
-      const brandContext = { ...existingProfile.brand_context };
+      const brandContext = {
+        ...existingProfile.brand_context
+      };
       const voiceProfile = brandContext.voiceProfile ?? {};
       const platformOverrides = voiceProfile.platformOverrides ?? {};
       const existingOverride = platformOverrides[platform2] ?? {};
@@ -4250,16 +4704,19 @@ Version: ${payload.version ?? "N/A"}`
         ...brandContext,
         voiceProfile: updatedVoiceProfile
       };
-      const { data: profileId, error: saveError } = await supabase.rpc("set_active_brand_profile", {
-        p_project_id: projectId,
-        p_brand_context: updatedContext,
-        p_change_summary: `Updated platform voice override for ${platform2}`,
-        p_changed_paths: [`voiceProfile.platformOverrides.${platform2}`],
-        p_source_url: null,
-        p_extraction_method: "manual",
-        p_overall_confidence: null,
-        p_extraction_metadata: null
-      });
+      const { data: profileId, error: saveError } = await supabase.rpc(
+        "set_active_brand_profile",
+        {
+          p_project_id: projectId,
+          p_brand_context: updatedContext,
+          p_change_summary: `Updated platform voice override for ${platform2}`,
+          p_changed_paths: [`voiceProfile.platformOverrides.${platform2}`],
+          p_source_url: null,
+          p_extraction_method: "manual",
+          p_overall_confidence: null,
+          p_extraction_metadata: null
+        }
+      );
       if (saveError) {
         return {
           content: [
@@ -4280,7 +4737,12 @@ Version: ${payload.version ?? "N/A"}`
       };
       if ((response_format || "text") === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope4(payload), null, 2) }],
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope4(payload), null, 2)
+            }
+          ],
           isError: false
         };
       }
@@ -4378,155 +4840,6 @@ async function capturePageScreenshot(page, outputPath, selector) {
 // src/tools/screenshot.ts
 import { resolve, relative } from "node:path";
 import { mkdir } from "node:fs/promises";
-
-// src/lib/ssrf.ts
-var BLOCKED_IP_PATTERNS = [
-  // IPv4 localhost/loopback
-  /^127\./,
-  /^0\./,
-  // IPv4 private ranges (RFC 1918)
-  /^10\./,
-  /^172\.(1[6-9]|2[0-9]|3[0-1])\./,
-  /^192\.168\./,
-  // IPv4 link-local
-  /^169\.254\./,
-  // Cloud metadata endpoint (AWS, GCP, Azure)
-  /^169\.254\.169\.254$/,
-  // IPv4 broadcast
-  /^255\./,
-  // Shared address space (RFC 6598)
-  /^100\.(6[4-9]|[7-9][0-9]|1[0-1][0-9]|12[0-7])\./
-];
-var BLOCKED_IPV6_PATTERNS = [
-  /^::1$/i,
-  // loopback
-  /^::$/i,
-  // unspecified
-  /^fe[89ab][0-9a-f]:/i,
-  // link-local fe80::/10
-  /^fc[0-9a-f]:/i,
-  // unique local fc00::/7
-  /^fd[0-9a-f]:/i,
-  // unique local fc00::/7
-  /^::ffff:127\./i,
-  // IPv4-mapped localhost
-  /^::ffff:(0|10|127|169\.254|172\.(1[6-9]|2[0-9]|3[0-1])|192\.168)\./i
-  // IPv4-mapped private
-];
-var BLOCKED_HOSTNAMES = [
-  "localhost",
-  "localhost.localdomain",
-  "local",
-  "127.0.0.1",
-  "0.0.0.0",
-  "[::1]",
-  "[::ffff:127.0.0.1]",
-  // Cloud metadata endpoints
-  "metadata.google.internal",
-  "metadata.goog",
-  "instance-data",
-  "instance-data.ec2.internal"
-];
-var ALLOWED_PROTOCOLS = ["http:", "https:"];
-var BLOCKED_PORTS = [22, 23, 25, 110, 143, 445, 3306, 5432, 6379, 27017, 11211];
-function isBlockedIP(ip) {
-  const normalized = ip.replace(/^\[/, "").replace(/\]$/, "");
-  if (normalized.includes(":")) {
-    return BLOCKED_IPV6_PATTERNS.some((pattern) => pattern.test(normalized));
-  }
-  return BLOCKED_IP_PATTERNS.some((pattern) => pattern.test(normalized));
-}
-function isBlockedHostname(hostname) {
-  return BLOCKED_HOSTNAMES.includes(hostname.toLowerCase());
-}
-function isIPAddress(hostname) {
-  const ipv4Pattern = /^(\d{1,3}\.){3}\d{1,3}$/;
-  const ipv6Pattern = /^\[?[a-fA-F0-9:]+\]?$/;
-  return ipv4Pattern.test(hostname) || ipv6Pattern.test(hostname);
-}
-async function validateUrlForSSRF(urlString) {
-  try {
-    const url = new URL(urlString);
-    if (!ALLOWED_PROTOCOLS.includes(url.protocol)) {
-      return {
-        isValid: false,
-        error: `Invalid protocol: ${url.protocol}. Only HTTP and HTTPS are allowed.`
-      };
-    }
-    if (url.username || url.password) {
-      return {
-        isValid: false,
-        error: "URLs with embedded credentials are not allowed."
-      };
-    }
-    const hostname = url.hostname.toLowerCase();
-    if (isBlockedHostname(hostname)) {
-      return {
-        isValid: false,
-        error: "Access to internal/localhost addresses is not allowed."
-      };
-    }
-    if (isIPAddress(hostname) && isBlockedIP(hostname)) {
-      return {
-        isValid: false,
-        error: "Access to private/internal IP addresses is not allowed."
-      };
-    }
-    const port = url.port ? parseInt(url.port, 10) : url.protocol === "https:" ? 443 : 80;
-    if (BLOCKED_PORTS.includes(port)) {
-      return {
-        isValid: false,
-        error: `Access to port ${port} is not allowed.`
-      };
-    }
-    let resolvedIP;
-    if (!isIPAddress(hostname)) {
-      try {
-        const dns = await import("node:dns");
-        const resolver = new dns.promises.Resolver();
-        const resolvedIPs = [];
-        try {
-          const aRecords = await resolver.resolve4(hostname);
-          resolvedIPs.push(...aRecords);
-        } catch {
-        }
-        try {
-          const aaaaRecords = await resolver.resolve6(hostname);
-          resolvedIPs.push(...aaaaRecords);
-        } catch {
-        }
-        if (resolvedIPs.length === 0) {
-          return {
-            isValid: false,
-            error: "DNS resolution failed: hostname did not resolve to any address."
-          };
-        }
-        for (const ip of resolvedIPs) {
-          if (isBlockedIP(ip)) {
-            return {
-              isValid: false,
-              error: "Hostname resolves to a private/internal IP address."
-            };
-          }
-        }
-        resolvedIP = resolvedIPs[0];
-      } catch {
-        return {
-          isValid: false,
-          error: "DNS resolution failed. Cannot verify hostname safety."
-        };
-      }
-    }
-    return { isValid: true, sanitizedUrl: url.toString(), resolvedIP };
-  } catch (error) {
-    return {
-      isValid: false,
-      error: `Invalid URL format: ${error instanceof Error ? error.message : "Unknown error"}`
-    };
-  }
-}
-
-// src/tools/screenshot.ts
 init_supabase();
 function registerScreenshotTools(server) {
   server.tool(
@@ -5102,6 +5415,7 @@ function registerRemotionTools(server) {
 // src/tools/insights.ts
 init_supabase();
 import { z as z8 } from "zod";
+var MAX_INSIGHT_AGE_DAYS = 30;
 var PLATFORM_ENUM = [
   "youtube",
   "tiktok",
@@ -5112,11 +5426,19 @@ var PLATFORM_ENUM = [
   "threads",
   "bluesky"
 ];
-var DAY_NAMES = ["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"];
+var DAY_NAMES = [
+  "Sunday",
+  "Monday",
+  "Tuesday",
+  "Wednesday",
+  "Thursday",
+  "Friday",
+  "Saturday"
+];
 function asEnvelope5(data) {
   return {
     _meta: {
-      version: "0.2.0",
+      version: MCP_VERSION,
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     },
     data
@@ -5127,7 +5449,12 @@ function registerInsightsTools(server) {
     "get_performance_insights",
     "Query performance insights derived from post analytics. Returns metrics like engagement rate, view velocity, and click rate aggregated over time. Use this to understand what content is performing well.",
     {
-      insight_type: z8.enum(["top_hooks", "optimal_timing", "best_models", "competitor_patterns"]).optional().describe("Filter to a specific insight type."),
+      insight_type: z8.enum([
+        "top_hooks",
+        "optimal_timing",
+        "best_models",
+        "competitor_patterns"
+      ]).optional().describe("Filter to a specific insight type."),
       days: z8.number().min(1).max(90).optional().describe("Number of days to look back. Defaults to 30. Max 90."),
       limit: z8.number().min(1).max(50).optional().describe("Maximum number of insights to return. Defaults to 10."),
       response_format: z8.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
@@ -5146,10 +5473,13 @@ function registerInsightsTools(server) {
           projectIds.push(...projects.map((p) => p.id));
         }
       }
+      const effectiveDays = Math.min(lookbackDays, MAX_INSIGHT_AGE_DAYS);
       const since = /* @__PURE__ */ new Date();
-      since.setDate(since.getDate() - lookbackDays);
+      since.setDate(since.getDate() - effectiveDays);
       const sinceIso = since.toISOString();
-      let query = supabase.from("performance_insights").select("id, project_id, insight_type, insight_data, confidence_score, generated_at").gte("generated_at", sinceIso).order("generated_at", { ascending: false }).limit(maxRows);
+      let query = supabase.from("performance_insights").select(
+        "id, project_id, insight_type, insight_data, confidence_score, generated_at"
+      ).gte("generated_at", sinceIso).order("generated_at", { ascending: false }).limit(maxRows);
       if (projectIds.length > 0) {
         query = query.in("project_id", projectIds);
       } else {
@@ -5506,7 +5836,7 @@ init_supabase();
 function asEnvelope6(data) {
   return {
     _meta: {
-      version: "0.2.0",
+      version: MCP_VERSION,
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     },
     data
@@ -5517,7 +5847,9 @@ function registerCommentsTools(server) {
     "list_comments",
     "List YouTube comments. Without a video_id, returns recent comments across all channel videos. With a video_id, returns comments for that specific video.",
     {
-      video_id: z10.string().optional().describe("YouTube video ID. If omitted, returns comments across all channel videos."),
+      video_id: z10.string().optional().describe(
+        "YouTube video ID. If omitted, returns comments across all channel videos."
+      ),
       max_results: z10.number().min(1).max(100).optional().describe("Maximum number of comments to return. Defaults to 50."),
       page_token: z10.string().optional().describe("Pagination token from a previous list_comments call."),
       response_format: z10.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
@@ -5532,7 +5864,9 @@ function registerCommentsTools(server) {
       });
       if (error) {
         return {
-          content: [{ type: "text", text: `Error listing comments: ${error}` }],
+          content: [
+            { type: "text", text: `Error listing comments: ${error}` }
+          ],
           isError: true
         };
       }
@@ -5544,7 +5878,10 @@ function registerCommentsTools(server) {
             {
               type: "text",
               text: JSON.stringify(
-                asEnvelope6({ comments, nextPageToken: result.nextPageToken ?? null }),
+                asEnvelope6({
+                  comments,
+                  nextPageToken: result.nextPageToken ?? null
+                }),
                 null,
                 2
               )
@@ -5581,7 +5918,9 @@ function registerCommentsTools(server) {
     "reply_to_comment",
     "Reply to a YouTube comment. Requires the parent comment ID and reply text.",
     {
-      parent_id: z10.string().describe("The ID of the parent comment to reply to (from list_comments)."),
+      parent_id: z10.string().describe(
+        "The ID of the parent comment to reply to (from list_comments)."
+      ),
       text: z10.string().min(1).describe("The reply text."),
       response_format: z10.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
     },
@@ -5620,7 +5959,12 @@ function registerCommentsTools(server) {
           details: { error }
         });
         return {
-          content: [{ type: "text", text: `Error replying to comment: ${error}` }],
+          content: [
+            {
+              type: "text",
+              text: `Error replying to comment: ${error}`
+            }
+          ],
           isError: true
         };
       }
@@ -5633,7 +5977,12 @@ function registerCommentsTools(server) {
       });
       if (format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope6(result), null, 2) }]
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope6(result), null, 2)
+            }
+          ]
         };
       }
       return {
@@ -5691,7 +6040,9 @@ function registerCommentsTools(server) {
           details: { error }
         });
         return {
-          content: [{ type: "text", text: `Error posting comment: ${error}` }],
+          content: [
+            { type: "text", text: `Error posting comment: ${error}` }
+          ],
           isError: true
         };
       }
@@ -5704,7 +6055,12 @@ function registerCommentsTools(server) {
       });
       if (format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope6(result), null, 2) }]
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope6(result), null, 2)
+            }
+          ]
         };
       }
       return {
@@ -5762,7 +6118,12 @@ function registerCommentsTools(server) {
           details: { error }
         });
         return {
-          content: [{ type: "text", text: `Error moderating comment: ${error}` }],
+          content: [
+            {
+              type: "text",
+              text: `Error moderating comment: ${error}`
+            }
+          ],
           isError: true
         };
       }
@@ -5841,7 +6202,9 @@ function registerCommentsTools(server) {
           details: { error }
         });
         return {
-          content: [{ type: "text", text: `Error deleting comment: ${error}` }],
+          content: [
+            { type: "text", text: `Error deleting comment: ${error}` }
+          ],
           isError: true
         };
       }
@@ -5856,13 +6219,22 @@ function registerCommentsTools(server) {
           content: [
             {
               type: "text",
-              text: JSON.stringify(asEnvelope6({ success: true, commentId: comment_id }), null, 2)
+              text: JSON.stringify(
+                asEnvelope6({ success: true, commentId: comment_id }),
+                null,
+                2
+              )
             }
           ]
         };
       }
       return {
-        content: [{ type: "text", text: `Comment ${comment_id} deleted successfully.` }]
+        content: [
+          {
+            type: "text",
+            text: `Comment ${comment_id} deleted successfully.`
+          }
+        ]
       };
     }
   );
@@ -5890,8 +6262,12 @@ function transformInsightsToPerformanceContext(projectId, insights) {
     };
   }
   const topHooksInsight = insights.find((i) => i.insight_type === "top_hooks");
-  const optimalTimingInsight = insights.find((i) => i.insight_type === "optimal_timing");
-  const bestModelsInsight = insights.find((i) => i.insight_type === "best_models");
+  const optimalTimingInsight = insights.find(
+    (i) => i.insight_type === "optimal_timing"
+  );
+  const bestModelsInsight = insights.find(
+    (i) => i.insight_type === "best_models"
+  );
   const topHooks = topHooksInsight?.insight_data?.hooks || [];
   const hooksSummary = topHooksInsight?.insight_data?.summary || "";
   const timingSummary = optimalTimingInsight?.insight_data?.summary || "";
@@ -5902,7 +6278,10 @@ function transformInsightsToPerformanceContext(projectId, insights) {
   if (hooksSummary) promptParts.push(hooksSummary);
   if (timingSummary) promptParts.push(timingSummary);
   if (modelSummary) promptParts.push(modelSummary);
-  if (topHooks.length) promptParts.push(`Top performing hooks: ${topHooks.slice(0, 3).join(", ")}`);
+  if (topHooks.length)
+    promptParts.push(
+      `Top performing hooks: ${topHooks.slice(0, 3).join(", ")}`
+    );
   return {
     projectId,
     hasHistoricalData: true,
@@ -5928,7 +6307,7 @@ function transformInsightsToPerformanceContext(projectId, insights) {
 function asEnvelope7(data) {
   return {
     _meta: {
-      version: "0.2.0",
+      version: MCP_VERSION,
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     },
     data
@@ -5951,7 +6330,12 @@ function registerIdeationContextTools(server) {
       const { data: member } = await supabase.from("organization_members").select("organization_id").eq("user_id", userId).limit(1).single();
       if (!member?.organization_id) {
         return {
-          content: [{ type: "text", text: "No organization found for current user." }],
+          content: [
+            {
+              type: "text",
+              text: "No organization found for current user."
+            }
+          ],
           isError: true
         };
       }
@@ -5959,7 +6343,10 @@ function registerIdeationContextTools(server) {
       if (projectsError) {
         return {
           content: [
-            { type: "text", text: `Failed to resolve projects: ${projectsError.message}` }
+            {
+              type: "text",
+              text: `Failed to resolve projects: ${projectsError.message}`
+            }
           ],
           isError: true
         };
@@ -5967,7 +6354,12 @@ function registerIdeationContextTools(server) {
       const projectIds = (projects || []).map((p) => p.id);
       if (projectIds.length === 0) {
         return {
-          content: [{ type: "text", text: "No projects found for current user." }],
+          content: [
+            {
+              type: "text",
+              text: "No projects found for current user."
+            }
+          ],
           isError: true
         };
       }
@@ -5976,7 +6368,10 @@ function registerIdeationContextTools(server) {
       if (!selectedProjectId) {
         return {
           content: [
-            { type: "text", text: "No accessible project found for current user." }
+            {
+              type: "text",
+              text: "No accessible project found for current user."
+            }
           ],
           isError: true
         };
@@ -5994,7 +6389,9 @@ function registerIdeationContextTools(server) {
       }
       const since = /* @__PURE__ */ new Date();
       since.setDate(since.getDate() - lookbackDays);
-      const { data: insights, error } = await supabase.from("performance_insights").select("id, project_id, insight_type, insight_data, generated_at, expires_at").eq("project_id", selectedProjectId).gte("generated_at", since.toISOString()).gt("expires_at", (/* @__PURE__ */ new Date()).toISOString()).order("generated_at", { ascending: false }).limit(30);
+      const { data: insights, error } = await supabase.from("performance_insights").select(
+        "id, project_id, insight_type, insight_data, generated_at, expires_at"
+      ).eq("project_id", selectedProjectId).gte("generated_at", since.toISOString()).gt("expires_at", (/* @__PURE__ */ new Date()).toISOString()).order("generated_at", { ascending: false }).limit(30);
       if (error) {
         return {
           content: [
@@ -6012,7 +6409,12 @@ function registerIdeationContextTools(server) {
       );
       if (format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope7(context), null, 2) }]
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope7(context), null, 2)
+            }
+          ]
         };
       }
       const lines = [
@@ -6036,7 +6438,7 @@ import { z as z12 } from "zod";
 function asEnvelope8(data) {
   return {
     _meta: {
-      version: "0.2.0",
+      version: MCP_VERSION,
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     },
     data
@@ -6075,7 +6477,12 @@ function registerCreditsTools(server) {
       };
       if ((response_format || "text") === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope8(payload), null, 2) }]
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope8(payload), null, 2)
+            }
+          ]
         };
       }
       return {
@@ -6109,7 +6516,12 @@ Monthly used: ${payload.monthlyUsed}` + (payload.monthlyLimit ? ` / ${payload.mo
       };
       if ((response_format || "text") === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope8(payload), null, 2) }]
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope8(payload), null, 2)
+            }
+          ]
         };
       }
       return {
@@ -6136,7 +6548,7 @@ import { z as z13 } from "zod";
 function asEnvelope9(data) {
   return {
     _meta: {
-      version: "0.2.0",
+      version: MCP_VERSION,
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     },
     data
@@ -6175,7 +6587,12 @@ function registerLoopSummaryTools(server) {
       const { data: membership } = await supabase.from("organization_members").select("organization_id").eq("user_id", userId).eq("organization_id", project.organization_id).maybeSingle();
       if (!membership) {
         return {
-          content: [{ type: "text", text: "Project is not accessible to current user." }],
+          content: [
+            {
+              type: "text",
+              text: "Project is not accessible to current user."
+            }
+          ],
           isError: true
         };
       }
@@ -6198,7 +6615,12 @@ function registerLoopSummaryTools(server) {
       };
       if ((response_format || "text") === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope9(payload), null, 2) }]
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope9(payload), null, 2)
+            }
+          ]
         };
       }
       return {
@@ -6221,11 +6643,6 @@ Next Action: ${payload.recommendedNextAction}`
 // src/tools/usage.ts
 init_supabase();
 import { z as z14 } from "zod";
-
-// src/lib/version.ts
-var MCP_VERSION = "1.4.0";
-
-// src/tools/usage.ts
 function asEnvelope10(data) {
   return {
     _meta: {
@@ -6531,7 +6948,10 @@ ${"=".repeat(40)}
 import { z as z16 } from "zod";
 init_supabase();
 function asEnvelope12(data) {
-  return { _meta: { version: "0.2.0", timestamp: (/* @__PURE__ */ new Date()).toISOString() }, data };
+  return {
+    _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() },
+    data
+  };
 }
 function isYouTubeUrl(url) {
   if (/youtube\.com\/watch|youtu\.be\//.test(url)) return "video";
@@ -6562,13 +6982,17 @@ Metadata:`);
     if (m.tags?.length) lines.push(`  Tags: ${m.tags.join(", ")}`);
   }
   if (content.features?.length)
-    lines.push(`
+    lines.push(
+      `
 Features:
-${content.features.map((f) => `  - ${f}`).join("\n")}`);
+${content.features.map((f) => `  - ${f}`).join("\n")}`
+    );
   if (content.benefits?.length)
-    lines.push(`
+    lines.push(
+      `
 Benefits:
-${content.benefits.map((b) => `  - ${b}`).join("\n")}`);
+${content.benefits.map((b) => `  - ${b}`).join("\n")}`
+    );
   if (content.usp) lines.push(`
 USP: ${content.usp}`);
   if (content.suggested_hooks?.length)
@@ -6590,12 +7014,20 @@ function registerExtractionTools(server) {
       max_results: z16.number().min(1).max(100).default(10).describe("Max comments to include"),
       response_format: z16.enum(["text", "json"]).default("text")
     },
-    async ({ url, extract_type, include_comments, max_results, response_format }) => {
+    async ({
+      url,
+      extract_type,
+      include_comments,
+      max_results,
+      response_format
+    }) => {
       const startedAt = Date.now();
       const ssrfCheck = await validateUrlForSSRF(url);
       if (!ssrfCheck.isValid) {
         return {
-          content: [{ type: "text", text: `URL blocked: ${ssrfCheck.error}` }],
+          content: [
+            { type: "text", text: `URL blocked: ${ssrfCheck.error}` }
+          ],
           isError: true
         };
       }
@@ -6723,13 +7155,21 @@ function registerExtractionTools(server) {
         if (response_format === "json") {
           return {
             content: [
-              { type: "text", text: JSON.stringify(asEnvelope12(extracted), null, 2) }
+              {
+                type: "text",
+                text: JSON.stringify(asEnvelope12(extracted), null, 2)
+              }
             ],
             isError: false
           };
         }
         return {
-          content: [{ type: "text", text: formatExtractedContentAsText(extracted) }],
+          content: [
+            {
+              type: "text",
+              text: formatExtractedContentAsText(extracted)
+            }
+          ],
           isError: false
         };
       } catch (err) {
@@ -6742,7 +7182,9 @@ function registerExtractionTools(server) {
           details: { url, error: message }
         });
         return {
-          content: [{ type: "text", text: `Extraction failed: ${message}` }],
+          content: [
+            { type: "text", text: `Extraction failed: ${message}` }
+          ],
           isError: true
         };
       }
@@ -6754,7 +7196,10 @@ function registerExtractionTools(server) {
 import { z as z17 } from "zod";
 init_supabase();
 function asEnvelope13(data) {
-  return { _meta: { version: "0.2.0", timestamp: (/* @__PURE__ */ new Date()).toISOString() }, data };
+  return {
+    _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() },
+    data
+  };
 }
 function registerQualityTools(server) {
   server.tool(
@@ -6810,7 +7255,12 @@ function registerQualityTools(server) {
       });
       if (response_format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope13(result), null, 2) }],
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope13(result), null, 2)
+            }
+          ],
           isError: false
         };
       }
@@ -6820,7 +7270,9 @@ function registerQualityTools(server) {
       );
       lines.push("");
       for (const cat of result.categories) {
-        lines.push(`  ${cat.name}: ${cat.score}/${cat.maxScore} \u2014 ${cat.detail}`);
+        lines.push(
+          `  ${cat.name}: ${cat.score}/${cat.maxScore} \u2014 ${cat.detail}`
+        );
       }
       if (result.blockers.length > 0) {
         lines.push("");
@@ -6831,7 +7283,10 @@ function registerQualityTools(server) {
       }
       lines.push("");
       lines.push(`Threshold: ${result.threshold}/${result.maxTotal}`);
-      return { content: [{ type: "text", text: lines.join("\n") }], isError: false };
+      return {
+        content: [{ type: "text", text: lines.join("\n") }],
+        isError: false
+      };
     }
   );
   server.tool(
@@ -6872,7 +7327,9 @@ function registerQualityTools(server) {
       });
       const scores = postsWithQuality.map((p) => p.quality.score);
       const passed = postsWithQuality.filter((p) => p.quality.passed).length;
-      const avgScore = scores.length > 0 ? Math.round(scores.reduce((a, b) => a + b, 0) / scores.length * 10) / 10 : 0;
+      const avgScore = scores.length > 0 ? Math.round(
+        scores.reduce((a, b) => a + b, 0) / scores.length * 10
+      ) / 10 : 0;
       const summary = {
         total_posts: plan.posts.length,
         passed,
@@ -6891,25 +7348,36 @@ function registerQualityTools(server) {
           content: [
             {
               type: "text",
-              text: JSON.stringify(asEnvelope13({ posts: postsWithQuality, summary }), null, 2)
+              text: JSON.stringify(
+                asEnvelope13({ posts: postsWithQuality, summary }),
+                null,
+                2
+              )
             }
           ],
           isError: false
         };
       }
       const lines = [];
-      lines.push(`PLAN QUALITY: ${passed}/${plan.posts.length} passed (avg: ${avgScore}/35)`);
+      lines.push(
+        `PLAN QUALITY: ${passed}/${plan.posts.length} passed (avg: ${avgScore}/35)`
+      );
       lines.push("");
       for (const post of postsWithQuality) {
         const icon = post.quality.passed ? "[PASS]" : "[FAIL]";
-        lines.push(`${icon} ${post.id} | ${post.platform} | ${post.quality.score}/35`);
+        lines.push(
+          `${icon} ${post.id} | ${post.platform} | ${post.quality.score}/35`
+        );
         if (post.quality.blockers.length > 0) {
           for (const b of post.quality.blockers) {
             lines.push(`       - ${b}`);
           }
         }
       }
-      return { content: [{ type: "text", text: lines.join("\n") }], isError: false };
+      return {
+        content: [{ type: "text", text: lines.join("\n") }],
+        isError: false
+      };
     }
   );
 }
@@ -6922,7 +7390,10 @@ function toRecord(value) {
   return value && typeof value === "object" ? value : void 0;
 }
 function asEnvelope14(data) {
-  return { _meta: { version: "0.2.0", timestamp: (/* @__PURE__ */ new Date()).toISOString() }, data };
+  return {
+    _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() },
+    data
+  };
 }
 function tomorrowIsoDate() {
   const d = /* @__PURE__ */ new Date();
@@ -6960,7 +7431,9 @@ function formatPlanAsText(plan) {
   lines.push(`WEEKLY CONTENT PLAN: "${plan.topic}"`);
   lines.push(`Period: ${plan.start_date} to ${plan.end_date}`);
   lines.push(`Platforms: ${plan.platforms.join(", ")}`);
-  lines.push(`Posts: ${plan.posts.length} | Estimated credits: ~${plan.estimated_credits}`);
+  lines.push(
+    `Posts: ${plan.posts.length} | Estimated credits: ~${plan.estimated_credits}`
+  );
   if (plan.plan_id) lines.push(`Plan ID: ${plan.plan_id}`);
   if (plan.insights_applied?.has_historical_data) {
     lines.push("");
@@ -6975,7 +7448,9 @@ function formatPlanAsText(plan) {
         `- Best posting time: ${days[timing.dayOfWeek] ?? timing.dayOfWeek} ${timing.hourOfDay}:00`
       );
     }
-    lines.push(`- Recommended model: ${plan.insights_applied.recommended_model ?? "N/A"}`);
+    lines.push(
+      `- Recommended model: ${plan.insights_applied.recommended_model ?? "N/A"}`
+    );
     lines.push(`- Insights count: ${plan.insights_applied.insights_count}`);
   }
   lines.push("");
@@ -6996,9 +7471,11 @@ function formatPlanAsText(plan) {
         `  Caption: ${post.caption.slice(0, 200)}${post.caption.length > 200 ? "..." : ""}`
       );
       if (post.title) lines.push(`  Title: ${post.title}`);
-      if (post.visual_direction) lines.push(`  Visual: ${post.visual_direction}`);
+      if (post.visual_direction)
+        lines.push(`  Visual: ${post.visual_direction}`);
       if (post.media_type) lines.push(`  Media: ${post.media_type}`);
-      if (post.hashtags?.length) lines.push(`  Hashtags: ${post.hashtags.join(" ")}`);
+      if (post.hashtags?.length)
+        lines.push(`  Hashtags: ${post.hashtags.join(" ")}`);
       lines.push("");
     }
   }
@@ -7081,7 +7558,10 @@ function registerPlanningTools(server) {
               "mcp-data",
               {
                 action: "brand-profile",
-                ...resolvedProjectId ? { projectId: resolvedProjectId, project_id: resolvedProjectId } : {}
+                ...resolvedProjectId ? {
+                  projectId: resolvedProjectId,
+                  project_id: resolvedProjectId
+                } : {}
               },
               { timeoutMs: 15e3 }
             );
@@ -7285,7 +7765,12 @@ ${rawText.slice(0, 1e3)}`
               details: { topic, error: `plan persistence failed: ${message}` }
             });
             return {
-              content: [{ type: "text", text: `Plan persistence failed: ${message}` }],
+              content: [
+                {
+                  type: "text",
+                  text: `Plan persistence failed: ${message}`
+                }
+              ],
               isError: true
             };
           }
@@ -7299,7 +7784,12 @@ ${rawText.slice(0, 1e3)}`
         });
         if (response_format === "json") {
           return {
-            content: [{ type: "text", text: JSON.stringify(asEnvelope14(plan), null, 2) }],
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify(asEnvelope14(plan), null, 2)
+              }
+            ],
             isError: false
           };
         }
@@ -7317,7 +7807,12 @@ ${rawText.slice(0, 1e3)}`
           details: { topic, error: message }
         });
         return {
-          content: [{ type: "text", text: `Plan generation failed: ${message}` }],
+          content: [
+            {
+              type: "text",
+              text: `Plan generation failed: ${message}`
+            }
+          ],
           isError: true
         };
       }
@@ -7377,7 +7872,11 @@ ${rawText.slice(0, 1e3)}`
           toolName: "save_content_plan",
           status: "success",
           durationMs,
-          details: { plan_id: planId, project_id: resolvedProjectId, status: normalizedStatus }
+          details: {
+            plan_id: planId,
+            project_id: resolvedProjectId,
+            status: normalizedStatus
+          }
         });
         const result = {
           plan_id: planId,
@@ -7386,13 +7885,21 @@ ${rawText.slice(0, 1e3)}`
         };
         if (response_format === "json") {
           return {
-            content: [{ type: "text", text: JSON.stringify(asEnvelope14(result), null, 2) }],
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify(asEnvelope14(result), null, 2)
+              }
+            ],
             isError: false
           };
         }
         return {
           content: [
-            { type: "text", text: `Saved content plan ${planId} (${normalizedStatus}).` }
+            {
+              type: "text",
+              text: `Saved content plan ${planId} (${normalizedStatus}).`
+            }
           ],
           isError: false
         };
@@ -7406,7 +7913,12 @@ ${rawText.slice(0, 1e3)}`
           details: { error: message }
         });
         return {
-          content: [{ type: "text", text: `Failed to save content plan: ${message}` }],
+          content: [
+            {
+              type: "text",
+              text: `Failed to save content plan: ${message}`
+            }
+          ],
           isError: true
         };
       }
@@ -7422,7 +7934,9 @@ ${rawText.slice(0, 1e3)}`
     async ({ plan_id, response_format }) => {
       const supabase = getSupabaseClient();
       const userId = await getDefaultUserId();
-      const { data, error } = await supabase.from("content_plans").select("id, topic, status, plan_payload, insights_applied, created_at, updated_at").eq("id", plan_id).eq("user_id", userId).maybeSingle();
+      const { data, error } = await supabase.from("content_plans").select(
+        "id, topic, status, plan_payload, insights_applied, created_at, updated_at"
+      ).eq("id", plan_id).eq("user_id", userId).maybeSingle();
       if (error) {
         return {
           content: [
@@ -7437,7 +7951,10 @@ ${rawText.slice(0, 1e3)}`
       if (!data) {
         return {
           content: [
-            { type: "text", text: `No content plan found for plan_id=${plan_id}` }
+            {
+              type: "text",
+              text: `No content plan found for plan_id=${plan_id}`
+            }
           ],
           isError: true
         };
@@ -7453,7 +7970,12 @@ ${rawText.slice(0, 1e3)}`
       };
       if (response_format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope14(payload), null, 2) }],
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope14(payload), null, 2)
+            }
+          ],
           isError: false
         };
       }
@@ -7464,7 +7986,10 @@ ${rawText.slice(0, 1e3)}`
         `Status: ${data.status}`,
         `Posts: ${Array.isArray(plan?.posts) ? plan.posts.length : 0}`
       ];
-      return { content: [{ type: "text", text: lines.join("\n") }], isError: false };
+      return {
+        content: [{ type: "text", text: lines.join("\n") }],
+        isError: false
+      };
     }
   );
   server.tool(
@@ -7507,14 +8032,19 @@ ${rawText.slice(0, 1e3)}`
       if (!stored?.plan_payload) {
         return {
           content: [
-            { type: "text", text: `No content plan found for plan_id=${plan_id}` }
+            {
+              type: "text",
+              text: `No content plan found for plan_id=${plan_id}`
+            }
           ],
           isError: true
         };
       }
       const plan = stored.plan_payload;
       const existingPosts = Array.isArray(plan.posts) ? plan.posts : [];
-      const updatesById = new Map(post_updates.map((update) => [update.post_id, update]));
+      const updatesById = new Map(
+        post_updates.map((update) => [update.post_id, update])
+      );
       const updatedPosts = existingPosts.map((post) => {
         const update = updatesById.get(post.id);
         if (!update) return post;
@@ -7532,7 +8062,9 @@ ${rawText.slice(0, 1e3)}`
           ...update.status !== void 0 ? { status: update.status } : {}
         };
       });
-      const nextStatus = updatedPosts.length > 0 && updatedPosts.every((post) => post.status === "approved" || post.status === "edited") ? "approved" : stored.status === "scheduled" || stored.status === "completed" ? stored.status : "draft";
+      const nextStatus = updatedPosts.length > 0 && updatedPosts.every(
+        (post) => post.status === "approved" || post.status === "edited"
+      ) ? "approved" : stored.status === "scheduled" || stored.status === "completed" ? stored.status : "draft";
       const updatedPlan = {
         ...plan,
         posts: updatedPosts
@@ -7559,7 +8091,12 @@ ${rawText.slice(0, 1e3)}`
       };
       if (response_format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope14(payload), null, 2) }],
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope14(payload), null, 2)
+            }
+          ],
           isError: false
         };
       }
@@ -7599,7 +8136,10 @@ ${rawText.slice(0, 1e3)}`
       if (!stored?.plan_payload || !stored.project_id) {
         return {
           content: [
-            { type: "text", text: `No content plan found for plan_id=${plan_id}` }
+            {
+              type: "text",
+              text: `No content plan found for plan_id=${plan_id}`
+            }
           ],
           isError: true
         };
@@ -7608,7 +8148,12 @@ ${rawText.slice(0, 1e3)}`
       const posts = Array.isArray(plan.posts) ? plan.posts : [];
       if (posts.length === 0) {
         return {
-          content: [{ type: "text", text: `Plan ${plan_id} has no posts to submit.` }],
+          content: [
+            {
+              type: "text",
+              text: `Plan ${plan_id} has no posts to submit.`
+            }
+          ],
           isError: true
         };
       }
@@ -7651,7 +8196,12 @@ ${rawText.slice(0, 1e3)}`
       };
       if (response_format === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope14(payload), null, 2) }],
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope14(payload), null, 2)
+            }
+          ],
           isError: false
         };
       }
@@ -7674,7 +8224,7 @@ import { z as z19 } from "zod";
 function asEnvelope15(data) {
   return {
     _meta: {
-      version: "0.2.0",
+      version: MCP_VERSION,
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     },
     data
@@ -7713,14 +8263,24 @@ function registerPlanApprovalTools(server) {
       if (!projectId) {
         return {
           content: [
-            { type: "text", text: "No project_id provided and no default project found." }
+            {
+              type: "text",
+              text: "No project_id provided and no default project found."
+            }
           ],
           isError: true
         };
       }
-      const accessError = await assertProjectAccess(supabase, userId, projectId);
+      const accessError = await assertProjectAccess(
+        supabase,
+        userId,
+        projectId
+      );
       if (accessError) {
-        return { content: [{ type: "text", text: accessError }], isError: true };
+        return {
+          content: [{ type: "text", text: accessError }],
+          isError: true
+        };
       }
       const rows = posts.map((post) => ({
         plan_id,
@@ -7749,7 +8309,12 @@ function registerPlanApprovalTools(server) {
       };
       if ((response_format || "text") === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope15(payload), null, 2) }],
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope15(payload), null, 2)
+            }
+          ],
           isError: false
         };
       }
@@ -7798,14 +8363,22 @@ function registerPlanApprovalTools(server) {
       };
       if ((response_format || "text") === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope15(payload), null, 2) }],
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope15(payload), null, 2)
+            }
+          ],
           isError: false
         };
       }
       if (!data || data.length === 0) {
         return {
           content: [
-            { type: "text", text: `No approval items found for plan ${plan_id}.` }
+            {
+              type: "text",
+              text: `No approval items found for plan ${plan_id}.`
+            }
           ],
           isError: false
         };
@@ -7818,7 +8391,10 @@ function registerPlanApprovalTools(server) {
       }
       lines.push("");
       lines.push(`Total: ${data.length}`);
-      return { content: [{ type: "text", text: lines.join("\n") }], isError: false };
+      return {
+        content: [{ type: "text", text: lines.join("\n") }],
+        isError: false
+      };
     }
   );
   server.tool(
@@ -7837,7 +8413,10 @@ function registerPlanApprovalTools(server) {
       if (decision === "edited" && !edited_post) {
         return {
           content: [
-            { type: "text", text: 'edited_post is required when decision is "edited".' }
+            {
+              type: "text",
+              text: 'edited_post is required when decision is "edited".'
+            }
           ],
           isError: true
         };
@@ -7850,7 +8429,9 @@ function registerPlanApprovalTools(server) {
       if (decision === "edited") {
         updates.edited_post = edited_post;
       }
-      const { data, error } = await supabase.from("content_plan_approvals").update(updates).eq("id", approval_id).eq("user_id", userId).eq("status", "pending").select("id, plan_id, post_id, status, reason, decided_at, original_post, edited_post").maybeSingle();
+      const { data, error } = await supabase.from("content_plan_approvals").update(updates).eq("id", approval_id).eq("user_id", userId).eq("status", "pending").select(
+        "id, plan_id, post_id, status, reason, decided_at, original_post, edited_post"
+      ).maybeSingle();
       if (error) {
         return {
           content: [
@@ -7875,7 +8456,12 @@ function registerPlanApprovalTools(server) {
       }
       if ((response_format || "text") === "json") {
         return {
-          content: [{ type: "text", text: JSON.stringify(asEnvelope15(data), null, 2) }],
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(asEnvelope15(data), null, 2)
+            }
+          ],
           isError: false
         };
       }
@@ -7940,7 +8526,7 @@ var TOOL_CATALOG = [
     name: "check_status",
     description: "Check status of async content generation job",
     module: "content",
-    scope: "mcp:write"
+    scope: "mcp:read"
   },
   {
     name: "create_storyboard",
@@ -8373,12 +8959,34 @@ function getJWKS(supabaseUrl) {
   }
   return jwks;
 }
+var apiKeyCache = /* @__PURE__ */ new Map();
+var API_KEY_CACHE_TTL_MS = 6e4;
 function createTokenVerifier(options) {
   const { supabaseUrl, supabaseAnonKey } = options;
   return {
     async verifyAccessToken(token) {
       if (token.startsWith("snk_")) {
-        return verifyApiKey(token, supabaseUrl, supabaseAnonKey);
+        const cached = apiKeyCache.get(token);
+        if (cached && cached.expiresAt > Date.now()) {
+          return cached.authInfo;
+        }
+        if (cached) apiKeyCache.delete(token);
+        const authInfo = await verifyApiKey(
+          token,
+          supabaseUrl,
+          supabaseAnonKey
+        );
+        apiKeyCache.set(token, {
+          authInfo,
+          expiresAt: Date.now() + API_KEY_CACHE_TTL_MS
+        });
+        if (apiKeyCache.size > 100) {
+          const now = Date.now();
+          for (const [k, v] of apiKeyCache) {
+            if (v.expiresAt <= now) apiKeyCache.delete(k);
+          }
+        }
+        return authInfo;
       }
       return verifySupabaseJwt(token, supabaseUrl);
     }
@@ -8458,6 +9066,12 @@ if (!SUPABASE_URL2 || !SUPABASE_ANON_KEY) {
   console.error("[MCP HTTP] Missing SUPABASE_URL or SUPABASE_ANON_KEY");
   process.exit(1);
 }
+var SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY ?? "";
+if (SUPABASE_SERVICE_ROLE_KEY && SUPABASE_SERVICE_ROLE_KEY.length < 100) {
+  console.error(
+    `[MCP HTTP] SUPABASE_SERVICE_ROLE_KEY looks invalid (${SUPABASE_SERVICE_ROLE_KEY.length} chars, expected 200+). Edge function calls may fail. Check your environment variables.`
+  );
+}
 process.on("uncaughtException", (err) => {
   console.error(`[MCP HTTP] Uncaught exception: ${err.message}`);
   process.exit(1);
@@ -8498,14 +9112,63 @@ var cleanupInterval = setInterval(
   5 * 60 * 1e3
 );
 var app = express();
+app.disable("x-powered-by");
 app.use(express.json());
 app.set("trust proxy", 1);
+var ipBuckets = /* @__PURE__ */ new Map();
+var IP_RATE_MAX = 60;
+var IP_RATE_REFILL = 60 / 60;
+var IP_RATE_CLEANUP_INTERVAL = 10 * 60 * 1e3;
+setInterval(() => {
+  const cutoff = Date.now() - 5 * 60 * 1e3;
+  for (const [ip, bucket] of ipBuckets) {
+    if (bucket.lastRefill < cutoff) ipBuckets.delete(ip);
+  }
+}, IP_RATE_CLEANUP_INTERVAL).unref();
+app.use((req, res, next) => {
+  if (req.path === "/health") return next();
+  const ip = req.ip ?? req.socket.remoteAddress ?? "unknown";
+  const now = Date.now();
+  let bucket = ipBuckets.get(ip);
+  if (!bucket) {
+    bucket = { tokens: IP_RATE_MAX, lastRefill: now };
+    ipBuckets.set(ip, bucket);
+  }
+  const elapsed = (now - bucket.lastRefill) / 1e3;
+  bucket.tokens = Math.min(
+    IP_RATE_MAX,
+    bucket.tokens + elapsed * IP_RATE_REFILL
+  );
+  bucket.lastRefill = now;
+  if (bucket.tokens < 1) {
+    const retryAfter = Math.ceil((1 - bucket.tokens) / IP_RATE_REFILL);
+    res.setHeader("Retry-After", String(retryAfter));
+    res.status(429).json({
+      error: "rate_limited",
+      error_description: "Too many requests from this IP. Please slow down.",
+      retry_after: retryAfter
+    });
+    return;
+  }
+  bucket.tokens -= 1;
+  next();
+});
+app.use((_req, res, next) => {
+  res.setHeader(
+    "Strict-Transport-Security",
+    "max-age=63072000; includeSubDomains"
+  );
+  res.setHeader("X-Content-Type-Options", "nosniff");
+  next();
+});
 app.use((_req, res, next) => {
   res.setHeader("Access-Control-Allow-Origin", "*");
   res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
-  res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization, Mcp-Session-Id");
+  res.setHeader(
+    "Access-Control-Allow-Headers",
+    "Content-Type, Authorization, Mcp-Session-Id"
+  );
   res.setHeader("Access-Control-Expose-Headers", "Mcp-Session-Id");
-  res.setHeader("Vary", "Origin");
   if (_req.method === "OPTIONS") {
     res.status(204).end();
     return;
@@ -8540,9 +9203,16 @@ async function authenticateRequest(req, res, next) {
   const token = authHeader.slice(7);
   try {
     const authInfo = await tokenVerifier.verifyAccessToken(token);
+    let scopes = authInfo.scopes;
+    const scopeParam = req.query.scope;
+    if (scopeParam) {
+      const requestedScopes = scopeParam.split(",").map((s) => s.trim()).filter(Boolean);
+      scopes = requestedScopes.filter((s) => authInfo.scopes.includes(s));
+      if (scopes.length === 0) scopes = authInfo.scopes;
+    }
     req.auth = {
       userId: authInfo.extra?.userId ?? authInfo.clientId,
-      scopes: authInfo.scopes,
+      scopes,
       clientId: authInfo.clientId,
       token: authInfo.token
     };
@@ -8558,97 +9228,115 @@ async function authenticateRequest(req, res, next) {
 app.get("/health", (_req, res) => {
   res.json({ status: "ok", version: MCP_VERSION });
 });
-app.get("/health/details", authenticateRequest, (_req, res) => {
-  res.json({
-    status: "ok",
-    version: MCP_VERSION,
-    transport: "streamable-http",
-    sessions: sessions.size,
-    sessionCap: MAX_SESSIONS,
-    uptime: Math.floor(process.uptime()),
-    memory: Math.round(process.memoryUsage().rss / 1024 / 1024),
-    env: NODE_ENV
-  });
-});
-app.post("/mcp", authenticateRequest, async (req, res) => {
-  const auth = req.auth;
-  const existingSessionId = req.headers["mcp-session-id"];
-  const rl = checkRateLimit("read", auth.userId);
-  if (!rl.allowed) {
-    res.setHeader("Retry-After", String(rl.retryAfter));
-    res.status(429).json({
-      error: "rate_limited",
-      error_description: "Too many requests. Please slow down.",
-      retry_after: rl.retryAfter
+app.get(
+  "/health/details",
+  authenticateRequest,
+  (_req, res) => {
+    res.json({
+      status: "ok",
+      version: MCP_VERSION,
+      transport: "streamable-http",
+      sessions: sessions.size,
+      sessionCap: MAX_SESSIONS,
+      uptime: Math.floor(process.uptime()),
+      memory: Math.round(process.memoryUsage().rss / 1024 / 1024),
+      env: NODE_ENV
     });
-    return;
   }
-  try {
-    if (existingSessionId && sessions.has(existingSessionId)) {
-      const entry = sessions.get(existingSessionId);
-      if (entry.userId !== auth.userId) {
-        res.status(403).json({
-          error: "forbidden",
-          error_description: "Session belongs to another user"
-        });
-        return;
-      }
-      entry.lastActivity = Date.now();
-      await requestContext.run(
-        { userId: auth.userId, scopes: auth.scopes, creditsUsed: 0, assetsGenerated: 0 },
-        () => entry.transport.handleRequest(req, res, req.body)
-      );
-      return;
-    }
-    if (sessions.size >= MAX_SESSIONS) {
-      res.status(429).json({
-        error: "too_many_sessions",
-        error_description: `Server session limit reached (${MAX_SESSIONS}). Try again later.`
-      });
-      return;
-    }
-    if (countUserSessions(auth.userId) >= MAX_SESSIONS_PER_USER) {
+);
+app.post(
+  "/mcp",
+  authenticateRequest,
+  async (req, res) => {
+    const auth = req.auth;
+    const existingSessionId = req.headers["mcp-session-id"];
+    const rl = checkRateLimit("read", auth.userId);
+    if (!rl.allowed) {
+      res.setHeader("Retry-After", String(rl.retryAfter));
       res.status(429).json({
-        error: "too_many_sessions",
-        error_description: `Per-user session limit reached (${MAX_SESSIONS_PER_USER}). Close existing sessions or wait for timeout.`
+        error: "rate_limited",
+        error_description: "Too many requests. Please slow down.",
+        retry_after: rl.retryAfter
       });
       return;
     }
-    const server = new McpServer({
-      name: "socialneuron",
-      version: MCP_VERSION
-    });
-    applyScopeEnforcement(server, () => getRequestScopes() ?? auth.scopes);
-    registerAllTools(server, { skipScreenshots: true });
-    const transport = new StreamableHTTPServerTransport({
-      sessionIdGenerator: () => randomUUID3(),
-      onsessioninitialized: (sessionId) => {
-        sessions.set(sessionId, {
-          transport,
-          server,
-          lastActivity: Date.now(),
-          userId: auth.userId
+    try {
+      if (existingSessionId && sessions.has(existingSessionId)) {
+        const entry = sessions.get(existingSessionId);
+        if (entry.userId !== auth.userId) {
+          res.status(403).json({
+            error: "forbidden",
+            error_description: "Session belongs to another user"
+          });
+          return;
+        }
+        entry.lastActivity = Date.now();
+        await requestContext.run(
+          {
+            userId: auth.userId,
+            scopes: auth.scopes,
+            creditsUsed: 0,
+            assetsGenerated: 0
+          },
+          () => entry.transport.handleRequest(req, res, req.body)
+        );
+        return;
+      }
+      if (sessions.size >= MAX_SESSIONS) {
+        res.status(429).json({
+          error: "too_many_sessions",
+          error_description: `Server session limit reached (${MAX_SESSIONS}). Try again later.`
         });
+        return;
       }
-    });
-    transport.onclose = () => {
-      if (transport.sessionId) {
-        sessions.delete(transport.sessionId);
+      if (countUserSessions(auth.userId) >= MAX_SESSIONS_PER_USER) {
+        res.status(429).json({
+          error: "too_many_sessions",
+          error_description: `Per-user session limit reached (${MAX_SESSIONS_PER_USER}). Close existing sessions or wait for timeout.`
+        });
+        return;
+      }
+      const server = new McpServer({
+        name: "socialneuron",
+        version: MCP_VERSION
+      });
+      applyScopeEnforcement(server, () => getRequestScopes() ?? auth.scopes);
+      registerAllTools(server, { skipScreenshots: true });
+      const transport = new StreamableHTTPServerTransport({
+        sessionIdGenerator: () => randomUUID3(),
+        onsessioninitialized: (sessionId) => {
+          sessions.set(sessionId, {
+            transport,
+            server,
+            lastActivity: Date.now(),
+            userId: auth.userId
+          });
+        }
+      });
+      transport.onclose = () => {
+        if (transport.sessionId) {
+          sessions.delete(transport.sessionId);
+        }
+      };
+      await server.connect(transport);
+      await requestContext.run(
+        {
+          userId: auth.userId,
+          scopes: auth.scopes,
+          creditsUsed: 0,
+          assetsGenerated: 0
+        },
+        () => transport.handleRequest(req, res, req.body)
+      );
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Internal server error";
+      console.error(`[MCP HTTP] POST /mcp error: ${message}`);
+      if (!res.headersSent) {
+        res.status(500).json({ jsonrpc: "2.0", error: { code: -32603, message } });
       }
-    };
-    await server.connect(transport);
-    await requestContext.run(
-      { userId: auth.userId, scopes: auth.scopes, creditsUsed: 0, assetsGenerated: 0 },
-      () => transport.handleRequest(req, res, req.body)
-    );
-  } catch (err) {
-    const message = err instanceof Error ? err.message : "Internal server error";
-    console.error(`[MCP HTTP] POST /mcp error: ${message}`);
-    if (!res.headersSent) {
-      res.status(500).json({ jsonrpc: "2.0", error: { code: -32603, message } });
     }
   }
-});
+);
 app.get("/mcp", authenticateRequest, async (req, res) => {
   const sessionId = req.headers["mcp-session-id"];
   if (!sessionId || !sessions.has(sessionId)) {
@@ -8664,28 +9352,39 @@ app.get("/mcp", authenticateRequest, async (req, res) => {
   res.setHeader("X-Accel-Buffering", "no");
   res.setHeader("Cache-Control", "no-cache");
   await requestContext.run(
-    { userId: req.auth.userId, scopes: req.auth.scopes, creditsUsed: 0, assetsGenerated: 0 },
+    {
+      userId: req.auth.userId,
+      scopes: req.auth.scopes,
+      creditsUsed: 0,
+      assetsGenerated: 0
+    },
     () => entry.transport.handleRequest(req, res)
   );
 });
-app.delete("/mcp", authenticateRequest, async (req, res) => {
-  const sessionId = req.headers["mcp-session-id"];
-  if (!sessionId || !sessions.has(sessionId)) {
-    res.status(400).json({ error: "Invalid or missing session ID" });
-    return;
-  }
-  const entry = sessions.get(sessionId);
-  if (entry.userId !== req.auth.userId) {
-    res.status(403).json({ error: "Session belongs to another user" });
-    return;
+app.delete(
+  "/mcp",
+  authenticateRequest,
+  async (req, res) => {
+    const sessionId = req.headers["mcp-session-id"];
+    if (!sessionId || !sessions.has(sessionId)) {
+      res.status(400).json({ error: "Invalid or missing session ID" });
+      return;
+    }
+    const entry = sessions.get(sessionId);
+    if (entry.userId !== req.auth.userId) {
+      res.status(403).json({ error: "Session belongs to another user" });
+      return;
+    }
+    await entry.transport.close();
+    await entry.server.close();
+    sessions.delete(sessionId);
+    res.status(200).json({ status: "session_closed" });
   }
-  await entry.transport.close();
-  await entry.server.close();
-  sessions.delete(sessionId);
-  res.status(200).json({ status: "session_closed" });
-});
+);
 var httpServer = app.listen(PORT, "0.0.0.0", () => {
-  console.log(`[MCP HTTP] Social Neuron MCP Server listening on 0.0.0.0:${PORT}`);
+  console.log(
+    `[MCP HTTP] Social Neuron MCP Server listening on 0.0.0.0:${PORT}`
+  );
   console.log(`[MCP HTTP] Health: http://localhost:${PORT}/health`);
   console.log(`[MCP HTTP] MCP endpoint: ${MCP_SERVER_URL}`);
   console.log(`[MCP HTTP] Environment: ${NODE_ENV}`);