@socialneuron/mcp-server 1.5.2 → 1.6.1

package/dist/http.js

@@ -343,7 +343,6 @@ __export(supabase_exports, {
   CLOUD_SUPABASE_URL: () => CLOUD_SUPABASE_URL,
   getAuthMode: () => getAuthMode,
   getAuthenticatedApiKey: () => getAuthenticatedApiKey,
-  getAuthenticatedEmail: () => getAuthenticatedEmail,
   getAuthenticatedExpiresAt: () => getAuthenticatedExpiresAt,
   getAuthenticatedScopes: () => getAuthenticatedScopes,
   getDefaultProjectId: () => getDefaultProjectId,
@@ -431,7 +430,6 @@ async function initializeAuth() {
       _authMode = "api-key";
       authenticatedUserId = result.userId;
       authenticatedScopes = result.scopes && result.scopes.length > 0 ? result.scopes : ["mcp:read"];
-      authenticatedEmail = result.email || null;
       authenticatedExpiresAt = result.expiresAt || null;
       console.error(
         "[MCP] Authenticated via API key (prefix: " + apiKey.substring(0, 6) + "..." + apiKey.slice(-4) + ")"
@@ -487,9 +485,6 @@ function getMcpRunId() {
 function getAuthenticatedScopes() {
   return authenticatedScopes;
 }
-function getAuthenticatedEmail() {
-  return authenticatedEmail;
-}
 function getAuthenticatedExpiresAt() {
   return authenticatedExpiresAt;
 }
@@ -528,7 +523,7 @@ async function logMcpToolInvocation(args) {
   captureToolEvent(args).catch(() => {
   });
 }
-var SUPABASE_URL, SUPABASE_SERVICE_KEY, client2, _authMode, authenticatedUserId, authenticatedScopes, authenticatedEmail, authenticatedExpiresAt, authenticatedApiKey, MCP_RUN_ID, CLOUD_SUPABASE_URL, CLOUD_SUPABASE_ANON_KEY, projectIdCache;
+var SUPABASE_URL, SUPABASE_SERVICE_KEY, client2, _authMode, authenticatedUserId, authenticatedScopes, authenticatedExpiresAt, authenticatedApiKey, MCP_RUN_ID, CLOUD_SUPABASE_URL, CLOUD_SUPABASE_ANON_KEY, projectIdCache;
 var init_supabase = __esm({
   "src/lib/supabase.ts"() {
     "use strict";
@@ -540,7 +535,6 @@ var init_supabase = __esm({
     _authMode = "service-role";
     authenticatedUserId = null;
     authenticatedScopes = [];
-    authenticatedEmail = null;
     authenticatedExpiresAt = null;
     authenticatedApiKey = null;
     MCP_RUN_ID = randomUUID();
@@ -787,6 +781,8 @@ async function callEdgeFunction(functionName, body, options) {
 var CATEGORY_CONFIGS = {
   posting: { maxTokens: 30, refillRate: 30 / 60 },
   // 30 req/min
+  generation: { maxTokens: 20, refillRate: 20 / 60 },
+  // 20 req/min — AI content generation (mcp:write)
   screenshot: { maxTokens: 10, refillRate: 10 / 60 },
   // 10 req/min
   read: { maxTokens: 60, refillRate: 60 / 60 }
@@ -1363,12 +1359,24 @@ function sanitizeDbError(error) {
   }
   return "Database operation failed. Please try again.";
 }
+function sanitizeError(error) {
+  const msg = error instanceof Error ? error.message : typeof error === "string" ? error : "Unknown error";
+  if (process.env.NODE_ENV !== "production") {
+    console.error("[Error]", msg);
+  }
+  for (const [pattern, userMessage] of ERROR_PATTERNS) {
+    if (pattern.test(msg)) {
+      return userMessage;
+    }
+  }
+  return "An unexpected error occurred. Please try again.";
+}
 
 // src/tools/content.ts
 init_request_context();
 
 // src/lib/version.ts
-var MCP_VERSION = "1.5.2";
+var MCP_VERSION = "1.6.0";
 
 // src/tools/content.ts
 var MAX_CREDITS_PER_RUN = Math.max(
@@ -9449,7 +9457,7 @@ async function verifyApiKey(apiKey, supabaseUrl, supabaseAnonKey) {
       clientId: "api-key",
       scopes: data.scopes ?? ["mcp:read"],
       expiresAt,
-      extra: { userId: data.userId, email: data.email }
+      extra: { userId: data.userId }
     };
   } catch (err) {
     clearTimeout(timer);
@@ -9462,6 +9470,986 @@ async function verifyApiKey(apiKey, supabaseUrl, supabaseAnonKey) {
 
 // src/http.ts
 init_posthog();
+
+// src/api/tool-executor.ts
+var toolHandlers = /* @__PURE__ */ new Map();
+function captureToolHandlers(server) {
+  const original = server.tool.bind(server);
+  server.tool = function capturedTool(...args) {
+    const name = args[0];
+    const handlerIndex = args.findIndex(
+      (a, i) => i > 0 && typeof a === "function"
+    );
+    if (handlerIndex !== -1) {
+      toolHandlers.set(name, args[handlerIndex]);
+    }
+    return original(...args);
+  };
+}
+async function executeToolDirect(name, args) {
+  const meta = {
+    tool: name,
+    version: MCP_VERSION,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const handler = toolHandlers.get(name);
+  if (!handler) {
+    return {
+      data: null,
+      error: `Tool '${name}' not found. Use GET /v1/tools to list available tools.`,
+      isError: true,
+      _meta: meta
+    };
+  }
+  try {
+    const result = await handler(args);
+    const textContent = result.content.filter((c) => c.type === "text").map((c) => c.text).join("\n");
+    if (result.isError) {
+      return { data: null, error: textContent, isError: true, _meta: meta };
+    }
+    let data;
+    try {
+      data = JSON.parse(textContent);
+    } catch {
+      data = { text: textContent };
+    }
+    return { data, error: null, isError: false, _meta: meta };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return { data: null, error: message, isError: true, _meta: meta };
+  }
+}
+function hasRegisteredTool(name) {
+  return toolHandlers.has(name);
+}
+function getRegisteredToolCount() {
+  return toolHandlers.size;
+}
+function checkToolScope(toolName, userScopes) {
+  const requiredScope = TOOL_SCOPES[toolName];
+  if (!requiredScope) {
+    return { allowed: false, requiredScope: null };
+  }
+  return { allowed: hasScope(userScopes, requiredScope), requiredScope };
+}
+function getToolCatalogForApi() {
+  return TOOL_CATALOG.filter((tool) => toolHandlers.has(tool.name)).map(
+    (tool) => ({
+      ...tool,
+      endpoint: `/v1/tools/${tool.name}`,
+      method: "POST"
+    })
+  );
+}
+
+// src/api/router.ts
+import { Router } from "express";
+init_request_context();
+
+// src/api/openapi.ts
+function generateOpenApiSpec() {
+  const modules = [...new Set(TOOL_CATALOG.map((t) => t.module))];
+  const toolPaths = {};
+  for (const tool of TOOL_CATALOG) {
+    toolPaths[`/v1/tools/${tool.name}`] = {
+      post: {
+        operationId: tool.name,
+        summary: tool.description,
+        tags: [tool.module],
+        "x-required-scope": tool.scope,
+        security: [{ bearerAuth: [] }],
+        requestBody: {
+          required: false,
+          content: {
+            "application/json": {
+              schema: {
+                type: "object",
+                description: `Input parameters for ${tool.name}. Pass tool-specific arguments as JSON.`
+              }
+            }
+          }
+        },
+        responses: {
+          "200": { $ref: "#/components/responses/ToolSuccess" },
+          "400": { $ref: "#/components/responses/ToolError" },
+          "401": { $ref: "#/components/responses/Unauthorized" },
+          "403": { $ref: "#/components/responses/InsufficientScope" },
+          "404": { $ref: "#/components/responses/NotFound" },
+          "429": { $ref: "#/components/responses/RateLimited" }
+        }
+      }
+    };
+  }
+  return {
+    openapi: "3.1.0",
+    info: {
+      title: "Social Neuron API",
+      version: MCP_VERSION,
+      description: "AI content creation platform \u2014 generate, schedule, and analyze social media content across platforms. 52 tools accessible via REST API, MCP, CLI, or SDK. Same auth, scopes, and credit system across all methods.",
+      contact: {
+        name: "Social Neuron",
+        email: "socialneuronteam@gmail.com",
+        url: "https://socialneuron.com/for-developers"
+      },
+      license: { name: "MIT", url: "https://opensource.org/licenses/MIT" },
+      termsOfService: "https://socialneuron.com/terms"
+    },
+    servers: [
+      {
+        url: "https://mcp.socialneuron.com",
+        description: "Production"
+      }
+    ],
+    tags: [
+      {
+        name: "tools",
+        description: "Tool discovery and universal tool proxy"
+      },
+      {
+        name: "credits",
+        description: "Credit balance and budget tracking"
+      },
+      {
+        name: "brand",
+        description: "Brand profile management"
+      },
+      {
+        name: "analytics",
+        description: "Performance analytics and insights"
+      },
+      {
+        name: "content",
+        description: "Content generation (text, image, video)"
+      },
+      {
+        name: "distribution",
+        description: "Post scheduling and publishing"
+      },
+      {
+        name: "posts",
+        description: "Post listing and status"
+      },
+      ...modules.map((m) => ({
+        name: m,
+        description: `${m} tools (via tool proxy)`
+      }))
+    ],
+    paths: {
+      "/v1/": {
+        get: {
+          operationId: "getApiInfo",
+          summary: "API info and discovery",
+          tags: ["tools"],
+          security: [{ bearerAuth: [] }],
+          responses: {
+            "200": {
+              description: "API metadata",
+              content: {
+                "application/json": {
+                  schema: { type: "object" }
+                }
+              }
+            }
+          }
+        }
+      },
+      "/v1/tools": {
+        get: {
+          operationId: "listTools",
+          summary: "List available tools with optional filtering",
+          tags: ["tools"],
+          security: [{ bearerAuth: [] }],
+          parameters: [
+            {
+              name: "module",
+              in: "query",
+              schema: { type: "string" },
+              description: "Filter by module name"
+            },
+            {
+              name: "scope",
+              in: "query",
+              schema: { type: "string" },
+              description: "Filter by required scope"
+            },
+            {
+              name: "q",
+              in: "query",
+              schema: { type: "string" },
+              description: "Search tools by keyword"
+            }
+          ],
+          responses: {
+            "200": {
+              description: "Tool catalog",
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object",
+                    properties: {
+                      data: {
+                        type: "object",
+                        properties: {
+                          tools: {
+                            type: "array",
+                            items: { $ref: "#/components/schemas/ToolEntry" }
+                          },
+                          total: { type: "integer" },
+                          modules: {
+                            type: "array",
+                            items: { type: "string" }
+                          }
+                        }
+                      },
+                      _meta: { $ref: "#/components/schemas/Meta" }
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      },
+      "/v1/credits": {
+        get: {
+          operationId: "getCreditBalance",
+          summary: "Get credit balance, plan, and monthly usage",
+          tags: ["credits"],
+          "x-tool-name": "get_credit_balance",
+          "x-required-scope": "mcp:read",
+          security: [{ bearerAuth: [] }],
+          responses: {
+            "200": { $ref: "#/components/responses/ToolSuccess" },
+            "401": { $ref: "#/components/responses/Unauthorized" }
+          }
+        }
+      },
+      "/v1/credits/budget": {
+        get: {
+          operationId: "getBudgetStatus",
+          summary: "Get per-session budget and spending status",
+          tags: ["credits"],
+          "x-tool-name": "get_budget_status",
+          "x-required-scope": "mcp:read",
+          security: [{ bearerAuth: [] }],
+          responses: {
+            "200": { $ref: "#/components/responses/ToolSuccess" },
+            "401": { $ref: "#/components/responses/Unauthorized" }
+          }
+        }
+      },
+      "/v1/brand": {
+        get: {
+          operationId: "getBrandProfile",
+          summary: "Get current brand profile",
+          tags: ["brand"],
+          "x-tool-name": "get_brand_profile",
+          "x-required-scope": "mcp:read",
+          security: [{ bearerAuth: [] }],
+          responses: {
+            "200": { $ref: "#/components/responses/ToolSuccess" },
+            "401": { $ref: "#/components/responses/Unauthorized" }
+          }
+        }
+      },
+      "/v1/analytics": {
+        get: {
+          operationId: "fetchAnalytics",
+          summary: "Fetch post performance analytics",
+          tags: ["analytics"],
+          "x-tool-name": "fetch_analytics",
+          "x-required-scope": "mcp:read",
+          security: [{ bearerAuth: [] }],
+          responses: {
+            "200": { $ref: "#/components/responses/ToolSuccess" },
+            "401": { $ref: "#/components/responses/Unauthorized" }
+          }
+        }
+      },
+      "/v1/analytics/insights": {
+        get: {
+          operationId: "getPerformanceInsights",
+          summary: "Get AI-generated performance insights",
+          tags: ["analytics"],
+          "x-tool-name": "get_performance_insights",
+          "x-required-scope": "mcp:read",
+          security: [{ bearerAuth: [] }],
+          responses: {
+            "200": { $ref: "#/components/responses/ToolSuccess" },
+            "401": { $ref: "#/components/responses/Unauthorized" }
+          }
+        }
+      },
+      "/v1/analytics/best-times": {
+        get: {
+          operationId: "getBestPostingTimes",
+          summary: "Get recommended posting times based on audience data",
+          tags: ["analytics"],
+          "x-tool-name": "get_best_posting_times",
+          "x-required-scope": "mcp:read",
+          security: [{ bearerAuth: [] }],
+          responses: {
+            "200": { $ref: "#/components/responses/ToolSuccess" },
+            "401": { $ref: "#/components/responses/Unauthorized" }
+          }
+        }
+      },
+      "/v1/posts": {
+        get: {
+          operationId: "listRecentPosts",
+          summary: "List recently published or scheduled posts",
+          tags: ["posts"],
+          "x-tool-name": "list_recent_posts",
+          "x-required-scope": "mcp:read",
+          security: [{ bearerAuth: [] }],
+          parameters: [
+            {
+              name: "limit",
+              in: "query",
+              schema: { type: "integer", default: 20 },
+              description: "Max number of posts to return"
+            }
+          ],
+          responses: {
+            "200": { $ref: "#/components/responses/ToolSuccess" },
+            "401": { $ref: "#/components/responses/Unauthorized" }
+          }
+        }
+      },
+      "/v1/accounts": {
+        get: {
+          operationId: "listConnectedAccounts",
+          summary: "List connected social media accounts",
+          tags: ["posts"],
+          "x-tool-name": "list_connected_accounts",
+          "x-required-scope": "mcp:read",
+          security: [{ bearerAuth: [] }],
+          responses: {
+            "200": { $ref: "#/components/responses/ToolSuccess" },
+            "401": { $ref: "#/components/responses/Unauthorized" }
+          }
+        }
+      },
+      "/v1/content/generate": {
+        post: {
+          operationId: "generateContent",
+          summary: "Generate social media content with AI",
+          tags: ["content"],
+          "x-tool-name": "generate_content",
+          "x-required-scope": "mcp:write",
+          security: [{ bearerAuth: [] }],
+          requestBody: {
+            required: true,
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  properties: {
+                    topic: {
+                      type: "string",
+                      description: "Content topic or prompt"
+                    },
+                    platforms: {
+                      type: "array",
+                      items: { type: "string" },
+                      description: "Target platforms"
+                    },
+                    tone: { type: "string", description: "Content tone" },
+                    content_type: {
+                      type: "string",
+                      description: "Type of content to generate"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          responses: {
+            "200": { $ref: "#/components/responses/ToolSuccess" },
+            "401": { $ref: "#/components/responses/Unauthorized" },
+            "403": { $ref: "#/components/responses/InsufficientScope" }
+          }
+        }
+      },
+      "/v1/content/adapt": {
+        post: {
+          operationId: "adaptContent",
+          summary: "Adapt existing content for different platforms",
+          tags: ["content"],
+          "x-tool-name": "adapt_content",
+          "x-required-scope": "mcp:write",
+          security: [{ bearerAuth: [] }],
+          requestBody: {
+            required: true,
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  properties: {
+                    content: {
+                      type: "string",
+                      description: "Content to adapt"
+                    },
+                    target_platforms: {
+                      type: "array",
+                      items: { type: "string" },
+                      description: "Target platforms for adaptation"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          responses: {
+            "200": { $ref: "#/components/responses/ToolSuccess" },
+            "401": { $ref: "#/components/responses/Unauthorized" },
+            "403": { $ref: "#/components/responses/InsufficientScope" }
+          }
+        }
+      },
+      "/v1/content/video": {
+        post: {
+          operationId: "generateVideo",
+          summary: "Generate video content using AI models",
+          tags: ["content"],
+          "x-tool-name": "generate_video",
+          "x-required-scope": "mcp:write",
+          security: [{ bearerAuth: [] }],
+          requestBody: {
+            required: true,
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  properties: {
+                    prompt: { type: "string" },
+                    aspect_ratio: { type: "string" },
+                    duration: { type: "integer" }
+                  }
+                }
+              }
+            }
+          },
+          responses: {
+            "200": { $ref: "#/components/responses/ToolSuccess" },
+            "401": { $ref: "#/components/responses/Unauthorized" },
+            "403": { $ref: "#/components/responses/InsufficientScope" }
+          }
+        }
+      },
+      "/v1/content/image": {
+        post: {
+          operationId: "generateImage",
+          summary: "Generate images using AI models",
+          tags: ["content"],
+          "x-tool-name": "generate_image",
+          "x-required-scope": "mcp:write",
+          security: [{ bearerAuth: [] }],
+          requestBody: {
+            required: true,
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  properties: {
+                    prompt: { type: "string" },
+                    aspect_ratio: { type: "string" },
+                    style: { type: "string" }
+                  }
+                }
+              }
+            }
+          },
+          responses: {
+            "200": { $ref: "#/components/responses/ToolSuccess" },
+            "401": { $ref: "#/components/responses/Unauthorized" },
+            "403": { $ref: "#/components/responses/InsufficientScope" }
+          }
+        }
+      },
+      "/v1/content/status/{jobId}": {
+        get: {
+          operationId: "checkJobStatus",
+          summary: "Check status of async content generation job",
+          tags: ["content"],
+          "x-tool-name": "check_status",
+          "x-required-scope": "mcp:read",
+          security: [{ bearerAuth: [] }],
+          parameters: [
+            {
+              name: "jobId",
+              in: "path",
+              required: true,
+              schema: { type: "string" },
+              description: "Job ID to check"
+            }
+          ],
+          responses: {
+            "200": { $ref: "#/components/responses/ToolSuccess" },
+            "401": { $ref: "#/components/responses/Unauthorized" },
+            "404": { $ref: "#/components/responses/NotFound" }
+          }
+        }
+      },
+      "/v1/distribution/schedule": {
+        post: {
+          operationId: "schedulePost",
+          summary: "Schedule or publish content to social platforms",
+          tags: ["distribution"],
+          "x-tool-name": "schedule_post",
+          "x-required-scope": "mcp:distribute",
+          security: [{ bearerAuth: [] }],
+          requestBody: {
+            required: true,
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  properties: {
+                    media_url: {
+                      type: "string",
+                      description: "URL of media to post"
+                    },
+                    caption: {
+                      type: "string",
+                      description: "Post caption text"
+                    },
+                    platforms: {
+                      type: "array",
+                      items: { type: "string" },
+                      description: "Target platforms"
+                    },
+                    schedule_at: {
+                      type: "string",
+                      format: "date-time",
+                      description: "ISO 8601 schedule time (omit for immediate)"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          responses: {
+            "200": { $ref: "#/components/responses/ToolSuccess" },
+            "401": { $ref: "#/components/responses/Unauthorized" },
+            "403": { $ref: "#/components/responses/InsufficientScope" }
+          }
+        }
+      },
+      "/v1/loop": {
+        get: {
+          operationId: "getLoopSummary",
+          summary: "Get growth loop summary and optimization recommendations",
+          tags: ["analytics"],
+          "x-tool-name": "get_loop_summary",
+          "x-required-scope": "mcp:read",
+          security: [{ bearerAuth: [] }],
+          responses: {
+            "200": { $ref: "#/components/responses/ToolSuccess" },
+            "401": { $ref: "#/components/responses/Unauthorized" }
+          }
+        }
+      },
+      // Spread all tool proxy paths
+      ...toolPaths
+    },
+    components: {
+      securitySchemes: {
+        bearerAuth: {
+          type: "http",
+          scheme: "bearer",
+          description: "API key from Settings > Developer. Format: snk_live_..."
+        }
+      },
+      schemas: {
+        Meta: {
+          type: "object",
+          properties: {
+            tool: { type: "string" },
+            version: { type: "string" },
+            timestamp: { type: "string", format: "date-time" }
+          }
+        },
+        ToolEntry: {
+          type: "object",
+          properties: {
+            name: { type: "string" },
+            description: { type: "string" },
+            module: { type: "string" },
+            scope: { type: "string" },
+            endpoint: { type: "string" },
+            method: { type: "string" }
+          }
+        },
+        ApiError: {
+          type: "object",
+          properties: {
+            error: {
+              type: "object",
+              properties: {
+                code: { type: "string" },
+                message: { type: "string" },
+                status: { type: "integer" }
+              },
+              required: ["code", "message", "status"]
+            }
+          }
+        }
+      },
+      responses: {
+        ToolSuccess: {
+          description: "Successful tool execution",
+          content: {
+            "application/json": {
+              schema: {
+                type: "object",
+                properties: {
+                  data: { type: "object" },
+                  _meta: { $ref: "#/components/schemas/Meta" }
+                }
+              }
+            }
+          }
+        },
+        ToolError: {
+          description: "Tool execution error",
+          content: {
+            "application/json": {
+              schema: { $ref: "#/components/schemas/ApiError" }
+            }
+          }
+        },
+        Unauthorized: {
+          description: "Missing or invalid Bearer token",
+          content: {
+            "application/json": {
+              schema: { $ref: "#/components/schemas/ApiError" }
+            }
+          }
+        },
+        InsufficientScope: {
+          description: "API key lacks required scope",
+          content: {
+            "application/json": {
+              schema: { $ref: "#/components/schemas/ApiError" }
+            }
+          }
+        },
+        NotFound: {
+          description: "Tool or resource not found",
+          content: {
+            "application/json": {
+              schema: { $ref: "#/components/schemas/ApiError" }
+            }
+          }
+        },
+        RateLimited: {
+          description: "Rate limit exceeded",
+          headers: {
+            "Retry-After": {
+              schema: { type: "integer" },
+              description: "Seconds to wait before retrying"
+            }
+          },
+          content: {
+            "application/json": {
+              schema: { $ref: "#/components/schemas/ApiError" }
+            }
+          }
+        }
+      }
+    },
+    security: [{ bearerAuth: [] }]
+  };
+}
+
+// src/api/router.ts
+function createRestApiRouter(options) {
+  const router = Router();
+  const tokenVerifier2 = createTokenVerifier({
+    supabaseUrl: options.supabaseUrl,
+    supabaseAnonKey: options.supabaseAnonKey
+  });
+  async function authenticate(req, res, next) {
+    const authHeader = req.headers.authorization;
+    if (!authHeader?.startsWith("Bearer ")) {
+      res.status(401).json({
+        error: {
+          code: "unauthorized",
+          message: "Bearer token required. Get your API key at https://socialneuron.com/settings/developer",
+          status: 401
+        }
+      });
+      return;
+    }
+    const token = authHeader.slice(7);
+    try {
+      const authInfo = await tokenVerifier2.verifyAccessToken(token);
+      req.auth = {
+        userId: authInfo.extra?.userId ?? authInfo.clientId,
+        scopes: authInfo.scopes,
+        clientId: authInfo.clientId,
+        token: authInfo.token
+      };
+      next();
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Token verification failed";
+      res.status(401).json({
+        error: { code: "invalid_token", message, status: 401 }
+      });
+    }
+  }
+  function rateLimit(req, res, next) {
+    const rl = checkRateLimit("read", req.auth.userId);
+    if (!rl.allowed) {
+      res.setHeader("Retry-After", String(rl.retryAfter));
+      res.status(429).json({
+        error: {
+          code: "rate_limited",
+          message: "Too many requests. Please slow down.",
+          retry_after: rl.retryAfter,
+          status: 429
+        }
+      });
+      return;
+    }
+    next();
+  }
+  router.get("/openapi.json", (_req, res) => {
+    res.setHeader("Cache-Control", "public, max-age=3600");
+    res.json(generateOpenApiSpec());
+  });
+  router.get("/", (_req, res) => {
+    res.json({
+      name: "Social Neuron API",
+      version: MCP_VERSION,
+      description: "AI content creation platform \u2014 REST API",
+      tools: getRegisteredToolCount(),
+      documentation: "https://socialneuron.com/docs/rest-api",
+      endpoints: {
+        tools: "/v1/tools",
+        tool_proxy: "/v1/tools/:name",
+        credits: "/v1/credits",
+        brand: "/v1/brand",
+        analytics: "/v1/analytics",
+        posts: "/v1/posts",
+        accounts: "/v1/accounts",
+        content_generate: "/v1/content/generate",
+        distribution_schedule: "/v1/distribution/schedule",
+        openapi: "/v1/openapi.json"
+      },
+      auth: {
+        type: "Bearer token",
+        header: "Authorization: Bearer <your-api-key>",
+        get_key: "https://socialneuron.com/settings/developer"
+      }
+    });
+  });
+  router.use(
+    authenticate
+  );
+  router.use(
+    rateLimit
+  );
+  async function executeInContext(req, res, toolName, args) {
+    const scopeCheck = checkToolScope(toolName, req.auth.scopes);
+    if (!scopeCheck.allowed) {
+      res.status(403).json({
+        error: {
+          code: "insufficient_scope",
+          message: scopeCheck.requiredScope ? `Tool '${toolName}' requires scope '${scopeCheck.requiredScope}'. Regenerate your API key with the required scope at https://socialneuron.com/settings/developer` : `Tool '${toolName}' has no scope defined. Contact support.`,
+          required_scope: scopeCheck.requiredScope,
+          status: 403
+        }
+      });
+      return;
+    }
+    const rateLimitCategory = scopeCheck.requiredScope === "mcp:distribute" ? "posting" : scopeCheck.requiredScope === "mcp:write" ? "generation" : "read";
+    const toolRl = checkRateLimit(rateLimitCategory, req.auth.userId);
+    if (!toolRl.allowed) {
+      res.setHeader("Retry-After", String(toolRl.retryAfter));
+      res.status(429).json({
+        error: {
+          code: "rate_limited",
+          message: `Rate limit exceeded for ${rateLimitCategory} operations. Wait ${toolRl.retryAfter}s.`,
+          retry_after: toolRl.retryAfter,
+          status: 429
+        }
+      });
+      return;
+    }
+    const result = await requestContext.run(
+      {
+        userId: req.auth.userId,
+        scopes: req.auth.scopes,
+        creditsUsed: 0,
+        assetsGenerated: 0
+      },
+      () => executeToolDirect(toolName, args)
+    );
+    if (result.isError) {
+      const status = result.error?.includes("not found") ? 404 : result.error?.includes("rate limit") || result.error?.includes("Rate limit") ? 429 : result.error?.includes("Permission denied") ? 403 : 400;
+      res.status(status).json({
+        error: { code: "tool_error", message: result.error, status },
+        _meta: result._meta
+      });
+      return;
+    }
+    res.json({ data: result.data, _meta: result._meta });
+  }
+  router.get("/tools", (req, res) => {
+    const tools = getToolCatalogForApi();
+    const module = req.query.module;
+    const scope = req.query.scope;
+    const search = req.query.q;
+    let filtered = tools;
+    if (module) filtered = filtered.filter((t) => t.module === module);
+    if (scope) filtered = filtered.filter((t) => t.scope === scope);
+    if (search) {
+      const q = search.toLowerCase();
+      filtered = filtered.filter(
+        (t) => t.name.toLowerCase().includes(q) || t.description.toLowerCase().includes(q)
+      );
+    }
+    res.json({
+      data: {
+        tools: filtered,
+        total: filtered.length,
+        modules: [...new Set(TOOL_CATALOG.map((t) => t.module))]
+      },
+      _meta: { version: MCP_VERSION, timestamp: (/* @__PURE__ */ new Date()).toISOString() }
+    });
+  });
+  router.post(
+    "/tools/:name",
+    async (req, res) => {
+      const toolName = req.params.name;
+      if (!hasRegisteredTool(toolName)) {
+        res.status(404).json({
+          error: {
+            code: "tool_not_found",
+            message: `Tool '${toolName}' not found. Use GET /v1/tools to list available tools.`,
+            available_tools: TOOL_CATALOG.length,
+            status: 404
+          }
+        });
+        return;
+      }
+      await executeInContext(req, res, toolName, req.body || {});
+    }
+  );
+  router.get("/credits", async (req, res) => {
+    await executeInContext(req, res, "get_credit_balance", {
+      response_format: "json"
+    });
+  });
+  router.get(
+    "/credits/budget",
+    async (req, res) => {
+      await executeInContext(req, res, "get_budget_status", {
+        response_format: "json"
+      });
+    }
+  );
+  router.get("/brand", async (req, res) => {
+    await executeInContext(req, res, "get_brand_profile", {
+      response_format: "json"
+    });
+  });
+  router.get("/analytics", async (req, res) => {
+    const {
+      days,
+      platform: platform2,
+      limit: qLimit
+    } = req.query;
+    await executeInContext(req, res, "fetch_analytics", {
+      response_format: "json",
+      ...days && { days: Number(days) },
+      ...platform2 && { platform: platform2 },
+      ...qLimit && { limit: Number(qLimit) }
+    });
+  });
+  router.get(
+    "/analytics/insights",
+    async (req, res) => {
+      await executeInContext(req, res, "get_performance_insights", {
+        response_format: "json"
+      });
+    }
+  );
+  router.get(
+    "/analytics/best-times",
+    async (req, res) => {
+      await executeInContext(req, res, "get_best_posting_times", {
+        response_format: "json"
+      });
+    }
+  );
+  router.get("/posts", async (req, res) => {
+    await executeInContext(req, res, "list_recent_posts", {
+      response_format: "json",
+      limit: req.query.limit ? Number(req.query.limit) : void 0
+    });
+  });
+  router.get("/accounts", async (req, res) => {
+    await executeInContext(req, res, "list_connected_accounts", {
+      response_format: "json"
+    });
+  });
+  router.post(
+    "/content/generate",
+    async (req, res) => {
+      await executeInContext(req, res, "generate_content", {
+        response_format: "json",
+        ...req.body
+      });
+    }
+  );
+  router.post(
+    "/content/adapt",
+    async (req, res) => {
+      await executeInContext(req, res, "adapt_content", {
+        response_format: "json",
+        ...req.body
+      });
+    }
+  );
+  router.post(
+    "/content/video",
+    async (req, res) => {
+      await executeInContext(req, res, "generate_video", req.body || {});
+    }
+  );
+  router.post(
+    "/content/image",
+    async (req, res) => {
+      await executeInContext(req, res, "generate_image", req.body || {});
+    }
+  );
+  router.get(
+    "/content/status/:jobId",
+    async (req, res) => {
+      await executeInContext(req, res, "check_status", {
+        job_id: req.params.jobId,
+        response_format: "json"
+      });
+    }
+  );
+  router.post(
+    "/distribution/schedule",
+    async (req, res) => {
+      await executeInContext(req, res, "schedule_post", req.body || {});
+    }
+  );
+  router.get("/loop", async (req, res) => {
+    await executeInContext(req, res, "get_loop_summary", {
+      response_format: "json"
+    });
+  });
+  return router;
+}
+
+// src/http.ts
 var PORT = parseInt(process.env.PORT ?? "8080", 10);
 var SUPABASE_URL2 = process.env.SUPABASE_URL ?? "";
 var SUPABASE_ANON_KEY = process.env.SUPABASE_ANON_KEY ?? "";
@@ -9541,7 +10529,7 @@ var cleanupInterval = setInterval(
 );
 var app = express();
 app.disable("x-powered-by");
-app.use(express.json());
+app.use(express.json({ limit: "50kb" }));
 app.set("trust proxy", 1);
 var ipBuckets = /* @__PURE__ */ new Map();
 var IP_RATE_MAX = 60;
@@ -9646,7 +10634,7 @@ async function authenticateRequest(req, res, next) {
     };
     next();
   } catch (err) {
-    const message = err instanceof Error ? err.message : "Token verification failed";
+    const message = sanitizeError(err);
     res.status(401).json({
       error: "invalid_token",
       error_description: message
@@ -9757,9 +10745,10 @@ app.post(
         () => transport.handleRequest(req, res, req.body)
       );
     } catch (err) {
-      const message = err instanceof Error ? err.message : "Internal server error";
-      console.error(`[MCP HTTP] POST /mcp error: ${message}`);
+      const rawMessage = err instanceof Error ? err.message : "Internal server error";
+      console.error(`[MCP HTTP] POST /mcp error: ${rawMessage}`);
       if (!res.headersSent) {
+        const message = sanitizeError(err);
         res.status(500).json({ jsonrpc: "2.0", error: { code: -32603, message } });
       }
     }
@@ -9809,12 +10798,25 @@ app.delete(
     res.status(200).json({ status: "session_closed" });
   }
 );
+var restCaptureServer = new McpServer({
+  name: "socialneuron-rest",
+  version: MCP_VERSION
+});
+captureToolHandlers(restCaptureServer);
+registerAllTools(restCaptureServer, { skipScreenshots: true });
+var restRouter = createRestApiRouter({
+  supabaseUrl: SUPABASE_URL2,
+  supabaseAnonKey: SUPABASE_ANON_KEY
+});
+app.use("/v1", restRouter);
+console.log("[MCP HTTP] REST API mounted at /v1");
 var httpServer = app.listen(PORT, "0.0.0.0", () => {
   console.log(
     `[MCP HTTP] Social Neuron MCP Server listening on 0.0.0.0:${PORT}`
   );
   console.log(`[MCP HTTP] Health: http://localhost:${PORT}/health`);
   console.log(`[MCP HTTP] MCP endpoint: ${MCP_SERVER_URL}`);
+  console.log(`[MCP HTTP] REST API: http://localhost:${PORT}/v1`);
   console.log(`[MCP HTTP] Environment: ${NODE_ENV}`);
 });
 async function shutdown(signal) {