@socialneuron/mcp-server 1.7.15 → 1.8.0

package/CHANGELOG.md

@@ -2,11 +2,61 @@
 
 All notable changes to `@socialneuron/mcp-server` will be documented in this file.
 
+## [1.8.0] - 2026-07-14
+
+### Changed
+
+- **`generate_video` model menu rebuilt around quality — 8 → 12 models.** New: `seedance-2-fast`, `seedance-2`, `grok-imagine`, `wan-2.6`, `gemini-omni-video`, `hailuo-02-standard`, `seedance-1.5-pro`. Removed from the menu: `runway-aleph` (upstream provider sunsets 2026-07-30), `sora2`/`sora2-pro` (upstream API shuts down 2026-09-24). The model description now carries a quality ladder plus honest per-model base credit costs, replacing figures that had drifted badly from real charges.
+- **`enable_audio` now defaults to FALSE** (cost control) with the real per-model audio multipliers documented in the parameter description.
+- **Video prices corrected server-side** (notably `veo3-fast` cut to roughly a third of its previous credit price); the client-side estimate map matches.
+
+### Added
+
+- **`generate_video` accepts `project_id`** so videos land in the right workspace/brand on multi-project accounts (brand context auto-injects from the project's brand profile).
+- **Stable `check_status` JSON shape** (`lib/checkStatusShape.ts`): canonical snake_case fields (`job_id`, `status`, `progress`, `result_url`, `r2_key`, `all_urls`, `error`, `credits_cost`, `created_at`, `completed_at`) are ALWAYS present regardless of which poll branch serves the response, with legacy camelCase aliases (`jobId`, `resultUrl`, `credits`, `createdAt`, …) also always populated. Previously the field names differed depending on whether the poll caught a job mid-render or after completion.
+
+### Fixed
+
+- **Completed-video download handoff.** `get_media_url` now accepts the exact `r2://...` key returned by `check_status`, normalizing the storage marker before signing. Previously a successfully generated video could appear unusable because the direct handoff returned HTTP 403 unless the caller stripped the prefix itself.
+- **False `PROJECT_SCOPE_MISMATCH` (403) on project-scoped API keys** for tools that take no `project_id` argument (e.g. `get_credit_balance`). The client previously guessed a default project from "most recently created", which can disagree with the key's real scope on multi-project accounts. The key's own server-resolved project scope is now carried per-request (stdio and HTTP modes) and always wins over the guess. Fixes the same class of failure across every project-scoped tool that relied on the default-project lookup.
+
+## [1.7.18] - 2026-07-06
+
+### Added
+
+- **REST API is real.** `POST /v1/tools/{name}`, `GET /v1/tools`, and `GET /v1/openapi.json` are now served (previously documented but 404). The REST surface is a faithful projection of the MCP engine — same auth, scopes, rate limits, credit pool, and tool handlers — not a second implementation.
+- **Generated OpenAPI 3.1 spec** at `/v1/openapi.json` (unauthenticated), built from the tool catalog + the same input schemas `tools/list` serves, so it can never drift from the tools. Import into Postman/Swagger or generate a client.
+- **`sn call <tool> [--json|--arg]`** — CLI tool invoker that mirrors the same projection, resolving the caller's scopes from their key. Four surfaces (MCP · REST · SDK · CLI), one catalog.
+
+### Fixed
+
+- Scrubbed an internal codename from `schedule_post`'s param descriptions (exposed via the new unauthenticated OpenAPI). Added a regression guard.
+- Tightened `schedule_post` account selection so platform account IDs are validated against the requested `project_id`, platform, and usable connection status before a post is scheduled. `list_connected_accounts`, `start_platform_connection`, and `wait_for_connection` now carry project context so agents can distinguish brands such as The VPN Matrix from Social Neuron.
+- Hid internal loop-observability tools from public HTTP discovery, server-card, OpenAPI, REST, and `search_tools`, while keeping them registered for internal automation.
+- Removed private lineage fields from public `schedule_post` discovery/OpenAPI schemas while preserving runtime compatibility for internal callers.
+
+### Changed
+
+- `docs/rest-api.md` updated to the real response shape (MCP result on success, `error_type` on error) and re-links the live OpenAPI spec.
+- PR CI now enforces the dependency cooldown gate with `SN_DEP_AGE_ENFORCE=true` when package manifests, lockfiles, SDK package files, content-calendar package files, or the release workflow change.
+
+## [1.7.16] - 2026-07-06
+
+### Fixed
+
+- **Structured tool errors (audit #188).** New `toolError()` helper attaches a machine-readable `error_type` (`policy_block` / `validation_error` / `permission_denied` / `billing_error` / `rate_limited` / `not_found` / `upstream_error` / `server_error`) in `structuredContent`, mirrored to the text block — matching the 2025-11-25 spec convention (SEP-1303) so clients can programmatically distinguish a policy block from a validation, permission, or billing error. Input-safety blocks and scope denials are the first adopters.
+- **Rate-limit category bug.** `getRateLimiter` resolved its config from the full `category:key` bucket string, so every per-user/per-tool call silently fell back to the loose 60/min `read` bucket — the intended `posting` (30/min) and `screenshot` (10/min) limits never applied. Config now resolves from the bare category; added `generation` (15/min) and `upload` (20/min) categories.
+- **Capabilities pricing table drift.** The `socialneuron://docs/capabilities` resource showed the Free tier at 100 credits (canonical monthly allocation is 50; 100 is the spending cap) and omitted the 14-day Trial tier. Corrected.
+
+### Changed
+
+- Removed unused `cors` and `express-rate-limit` dependencies.
+
 ## [1.7.15] - 2026-07-06
 
 ### Changed
 
-- **Public tool surface tightened.** Internal service tools used by Social Neuron's own automation are still registered and scope-gated at runtime, but are no longer advertised on the hosted server card, HTTP discovery, `search_tools`, knowledge documents, or the CLI tool listing. The hosted endpoint now advertises 85 tools; the npm stdio server exposes 87 discoverable tools (including 2 local screen-capture tools).
+- **Public tool surface tightened.** Internal service tools used by Social Neuron's own automation are still registered and scope-gated at runtime, but are no longer advertised on the hosted server card, HTTP discovery, `search_tools`, knowledge documents, or the CLI tool listing.
 - **Tool descriptions cleaned up.** Internal project references and implementation jargon removed from tool descriptions across the catalog.
 - **`run_content_pipeline` scheduling guard restored.** Scheduling again requires `schedule_confirmed=true` after explicit user approval, cannot run with the quality stage skipped, caps generated posts to the requested plan size, drops posts targeting unrequested platforms, and counts scheduled posts against the credit budget. (This hardening was unintentionally dropped in the 1.7.14 source sync.)
 - **Metadata contract unified + CI-guarded.** `server.json` version/pricing/tool-count now match `package.json` and the canonical pricing (MCP requires Pro $49/mo or higher; free tier is 50 credits/mo with no MCP access). Added `mcpName` for MCP Registry ownership verification. New `npm run verify:metadata` gate (wired into CI and release) blocks stale counts, stale pricing, internal codenames, and dead endpoint links from re-entering the public surface.

package/README.md

@@ -1,6 +1,6 @@
 # @socialneuron/mcp-server
 
-> 85+ MCP tools for AI-powered social media management. Create content, schedule posts, track analytics, and optimize performance — all from Claude Code or any MCP client.
+> 80+ public MCP tools for AI-powered social media management. Create content, schedule posts, track analytics, and optimize performance — all from Claude Code or any MCP client.
 
 [![npm version](https://img.shields.io/npm/v/@socialneuron/mcp-server)](https://www.npmjs.com/package/@socialneuron/mcp-server)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
@@ -13,7 +13,7 @@
 npx -y @socialneuron/mcp-server login --device
 ```
 
-This opens your browser to authorize access. Requires a paid Social Neuron plan (Starter or above). See [pricing](https://socialneuron.com/pricing).
+This opens your browser to authorize access. Requires a Social Neuron Pro plan or higher. See [pricing](https://socialneuron.com/pricing).
 
 ### 2. Add to Claude Code
 
@@ -94,7 +94,7 @@ Ask Claude things like:
 
 ## Tool Categories
 
-The hosted endpoint advertises **85 tools** (live count: [server card](https://mcp.socialneuron.com/.well-known/mcp/server-card.json)); the npm stdio server adds 2 local screen-capture tools (87 discoverable). A small set of internal service tools used by Social Neuron's own automation are registered but not part of the public surface.
+The hosted endpoint advertises **83 public tools** (live count: [server card](https://mcp.socialneuron.com/.well-known/mcp/server-card.json)); the npm stdio server exposes **84 public tools**, including 2 local screen-capture tools. A small set of internal service tools used by Social Neuron's own automation are registered but not part of the public surface.
 
 These tools are available to AI agents (Claude, Cursor, etc.) via the MCP protocol.
 
@@ -166,15 +166,15 @@ Keys are stored in your OS keychain (macOS Keychain, Linux secret-tool) or file
 
 ## Pricing
 
-MCP access requires a paid plan:
+MCP/API access requires a Pro plan or higher:
 
-| Plan | Price | Credits/mo | MCP Access |
+| Plan | Price | Credits/mo | MCP/API Access |
 |------|-------|-----------|------------|
 | Free | $0 | 50 | — |
 | Starter | $19/mo | 500 | — |
-| Pro | $49/mo | 1,500 | Read + Analytics + Write + Distribute |
-| Team | $99/mo | 3,500 | Full + 5 keys |
-| Agency | $249/mo | 10,000 | Full + 20 keys + REST API |
+| Pro | $49/mo | 1,500 | MCP/API: Read + Analytics + Write + Distribute |
+| Team | $99/mo | 3,500 | Full MCP/API + 5 keys |
+| Agency | $249/mo | 10,000 | Full MCP/API + 20 keys |
 
 Sign up at [socialneuron.com/pricing](https://socialneuron.com/pricing).