@socialneuron/mcp-server 1.7.5 → 1.7.10

package/dist/http.js

@@ -647,7 +647,12 @@ var TOOL_SCOPES = {
   suggest_next_content: "mcp:read",
   // mcp:analytics (digest and anomalies are analytics-scoped)
   generate_performance_digest: "mcp:analytics",
-  detect_anomalies: "mcp:analytics"
+  detect_anomalies: "mcp:analytics",
+  // mcp:read (Apps — entry tool for the Content Calendar MCP App; reads recent posts)
+  open_content_calendar: "mcp:read",
+  // platform connection deep-link flow
+  start_platform_connection: "mcp:distribute",
+  wait_for_connection: "mcp:read"
 };
 function hasScope(userScopes, required) {
   if (userScopes.includes(required)) return true;
@@ -1383,7 +1388,7 @@ init_supabase();
 init_request_context();
 
 // src/lib/version.ts
-var MCP_VERSION = "1.7.5";
+var MCP_VERSION = "1.7.10";
 
 // src/tools/content.ts
 var MAX_CREDITS_PER_RUN = Math.max(0, Number(process.env.SOCIALNEURON_MAX_CREDITS_PER_RUN || 0));
@@ -2919,7 +2924,7 @@ async function rehostExternalUrl(mediaUrl, projectId) {
 function registerDistributionTools(server) {
   server.tool(
     "schedule_post",
-    'Publish or schedule a post to connected social platforms. Check list_connected_accounts first to verify active OAuth for each target platform. For Instagram carousels: use media_type=CAROUSEL_ALBUM with 2-10 media_urls. For YouTube: title is required. schedule_at uses ISO 8601 (e.g. "2026-03-20T14:00:00Z") \u2014 omit to post immediately.',
+    'Publish or schedule a post to connected social platforms. ALWAYS call `list_connected_accounts` FIRST \u2014 if the target platform is not connected, call `start_platform_connection` to get a one-time browser deep link the user opens to complete the platform OAuth (this is a one-time setup on socialneuron.com, not another OAuth in Claude). After they approve, call `wait_for_connection` and only then call schedule_post. For Instagram carousels: use media_type=CAROUSEL_ALBUM with 2-10 media_urls. For YouTube: title is required. schedule_at uses ISO 8601 (e.g. "2026-03-20T14:00:00Z") \u2014 omit to post immediately.',
     {
       media_url: z3.string().optional().describe(
         "URL of the media file to post. Any public HTTPS URL works \u2014 including ephemeral generator URLs (Replicate, OpenAI, DALL-E). The server persists non-R2 URLs into R2 before posting so scheduled posts and byte-upload platforms (X, LinkedIn, YouTube, Bluesky) do not 404 when the source URL expires. Set auto_rehost=false to skip. Not needed if media_urls, r2_key, or job_id is provided."
@@ -4141,7 +4146,7 @@ function approxBase64Size(raw) {
 function registerMediaTools(server) {
   server.tool(
     "upload_media",
-    "Upload media to persistent R2 storage. Returns a durable r2_key that can be passed to schedule_post. Three input modes: (1) local file path (stdio mode only), (2) public URL fetched by the server, (3) inline base64 via file_data \u2014 use this from Claude Desktop, Claude Web, or any remote agent that cannot hand the server a filesystem path. Base64 uploads are capped at 10MB decoded; larger files still need stdio + presigned PUT.",
+    "Upload media to persistent R2 storage. Returns a durable r2_key that can be passed to schedule_post. Three input modes: (1) local file path (stdio mode only), (2) public URL fetched by the server, (3) inline base64 via file_data (remote agents, \u226410MB decoded). AGENT ROUTING GUIDE: If the media was produced by another tool here (generate_image, generate_video, create_carousel, etc.), use the returned job_id or r2_key directly with schedule_post \u2014 do NOT download and re-upload. For user-authored files larger than ~1MB, prefer request_upload_session (returns a tokenized Dashboard URL the user uploads through in their browser) so bytes never flow through the agent context. Reserve file_data for small assets (thumbnails, logos, short clips).",
     {
       source: z4.string().optional().describe(
         'Local file path (e.g. "/Users/me/image.png") or public URL (e.g. "https://example.com/photo.jpg"). Leave empty when passing file_data instead.'
@@ -4240,7 +4245,7 @@ function registerMediaTools(server) {
             content: [
               {
                 type: "text",
-                text: `file_data exceeds the 10MB base64 cap (got ~${(approxSize / 1024 / 1024).toFixed(1)}MB). For larger files, run the stdio MCP server locally and pass a file path so the server can use presigned PUT upload.`
+                text: `file_data exceeds the 10MB base64 cap (got ~${(approxSize / 1024 / 1024).toFixed(1)}MB). Alternatives, in order of preference: (1) if this media came from another tool here (generate_image/video, create_carousel), pass its job_id or r2_key directly to schedule_post \u2014 do not re-upload. (2) for user-authored files, call request_upload_session to get a tokenized Dashboard URL where the user uploads directly to R2 in their browser. (3) for stdio/local mode, pass a filesystem path via \`source\` so the server can stream and use presigned PUT.`
               }
             ],
             isError: true
@@ -4999,7 +5004,7 @@ function registerBrandTools(server) {
   );
   server.tool(
     "save_brand_profile",
-    "Persist a brand profile as the active profile for a project.",
+    "Save (or replace) the active brand profile for a project \u2014 voice, target audience, content pillars, claims, etc. Use after extract_brand has produced a draft AND the user has reviewed it, or when the user explicitly edits the profile. brand_context is the full profile payload from extract_brand or get_brand_profile. project_id defaults to the active project context. Overwrites the previous active profile (one per project) \u2014 pass the complete profile, no merge semantics. Use change_summary to leave an audit trail.",
     {
       project_id: z6.string().uuid().optional().describe("Project ID. Defaults to active project context."),
       brand_context: z6.record(z6.string(), z6.unknown()).describe("Brand context payload to save to brand_profiles.brand_context."),
@@ -6577,7 +6582,7 @@ function registerCommentsTools(server) {
   );
   server.tool(
     "post_comment",
-    "Post a new top-level comment on a YouTube video.",
+    "Post a new top-level comment on a YouTube video, authored as the connected channel. Use for proactive engagement on your own videos. For replies to existing comments use reply_to_comment instead \u2014 this tool only creates top-level comments. video_id comes from list_recent_posts (platform_post_id field) or any YouTube URL (the v= parameter, 11 chars). Subject to YouTube anti-spam rate limits; calls return rate_limited if exceeded.",
     {
       video_id: z11.string().describe("The YouTube video ID to comment on."),
       text: z11.string().min(1).describe("The comment text."),
@@ -6648,7 +6653,7 @@ function registerCommentsTools(server) {
   );
   server.tool(
     "moderate_comment",
-    "Moderate a YouTube comment by setting its status to published or rejected.",
+    'Moderate a YouTube comment on your channel \u2014 set status to "published" (approve) or "rejected" (hide from public view but kept in moderation queue). Use after list_comments surfaces a comment that needs action. For permanent removal use delete_comment instead. comment_id comes from list_comments results.',
     {
       comment_id: z11.string().describe("The comment ID to moderate."),
       moderation_status: z11.enum(["published", "rejected"]).describe('"published" to approve, "rejected" to hide.'),
@@ -7551,7 +7556,7 @@ ${lines.join("\n\n")}`
     "Execute a recipe template with the provided inputs. This creates a recipe run that processes each step sequentially. Long-running recipes will return a run_id you can check with get_recipe_run_status.",
     {
       slug: z17.string().describe('Recipe slug (e.g., "weekly-instagram-calendar")'),
-      inputs: z17.record(z17.unknown()).describe(
+      inputs: z17.record(z17.string(), z17.unknown()).describe(
         "Input values matching the recipe input schema. Use get_recipe_details to see required inputs."
       ),
       response_format: z17.enum(["text", "json"]).optional().describe("Optional response format. Defaults to text.")
@@ -8563,7 +8568,7 @@ ${rawText.slice(0, 1e3)}`
   );
   server.tool(
     "get_content_plan",
-    "Retrieve a persisted content plan by ID.",
+    "Load a persisted content plan by its UUID \u2014 returns the full plan including all posts, scheduling status, and approval state. Use to inspect a plan before update_content_plan or schedule_content_plan. plan_id comes from save_content_plan, plan_content_week (when persisted), or list_plan_approvals. For just the approval state, list_plan_approvals is cheaper.",
     {
       plan_id: z20.string().uuid().describe("Persisted content plan ID"),
       response_format: z20.enum(["text", "json"]).default("json")
@@ -8617,7 +8622,7 @@ ${rawText.slice(0, 1e3)}`
   );
   server.tool(
     "update_content_plan",
-    "Update individual posts in a persisted content plan.",
+    "Edit individual posts in a persisted content plan \u2014 change caption, title, hashtags, hook, or angle. Use after get_content_plan when the user wants to revise drafts before scheduling. Each post_updates entry must include post_id from the loaded plan; only the fields you pass get updated, others stay as-is. Does NOT trigger publishing \u2014 call schedule_content_plan separately when ready.",
     {
       plan_id: z20.string().uuid(),
       post_updates: z20.array(
@@ -8758,7 +8763,7 @@ function asEnvelope17(data) {
 function registerPlanApprovalTools(server) {
   server.tool(
     "create_plan_approvals",
-    "Create pending approval rows for each post in a content plan.",
+    'Create pending approval rows for each post in a content plan \u2014 one row per post, status="pending". Use after submit_content_plan_for_approval to materialize the approval queue. Each entry in posts becomes a row that respond_plan_approval can later approve, reject, or edit. Idempotent on (plan_id, post_id) \u2014 calling twice with the same posts is a no-op for already-existing rows. Returns IDs of created items for use with list_plan_approvals.',
     {
       plan_id: z21.string().uuid().describe("Content plan ID"),
       posts: z21.array(
@@ -8838,7 +8843,7 @@ function registerPlanApprovalTools(server) {
   );
   server.tool(
     "list_plan_approvals",
-    "List MCP-native approval items for a specific content plan.",
+    "List approval items for a content plan, optionally filtered by status (pending / approved / rejected / edited). Use to check what needs review before scheduling, or to audit decisions after the fact. plan_id comes from get_content_plan or save_content_plan. For a single item's full state, get the plan via get_content_plan instead \u2014 that includes per-post approval data inline.",
     {
       plan_id: z21.string().uuid().describe("Content plan ID"),
       status: z21.enum(["pending", "approved", "rejected", "edited"]).optional(),
@@ -8898,7 +8903,7 @@ function registerPlanApprovalTools(server) {
   );
   server.tool(
     "respond_plan_approval",
-    "Approve, reject, or edit a pending plan approval item.",
+    'Approve, reject, or edit a single pending plan approval item. Use to act on items surfaced by list_plan_approvals. decision="edited" REQUIRES edited_post containing the modified post fields \u2014 passing "edited" without edited_post returns an error. Once decided, an item cannot be re-decided (immutable transition). reason is optional but recommended for "rejected" or "edited" to leave a paper trail. After all items are decided, schedule_content_plan publishes only the approved (and edited) ones.',
     {
       approval_id: z21.string().uuid().describe("Approval item ID"),
       decision: z21.enum(["approved", "rejected", "edited"]),
@@ -9414,6 +9419,13 @@ var TOOL_CATALOG = [
     scope: "mcp:read"
   },
   // carousel (already listed in content section above)
+  // apps (MCP Apps — interactive UI inside the host)
+  {
+    name: "open_content_calendar",
+    description: "Open an interactive drag-drop calendar of the user's scheduled posts inside the host (Claude Desktop / claude.ai). Renders an MCP App; backed by list_recent_posts, schedule_post, find_next_slots \u2014 no new tools needed.",
+    module: "apps",
+    scope: "mcp:read"
+  },
   // recipes
   {
     name: "list_recipes",
@@ -9438,6 +9450,19 @@ var TOOL_CATALOG = [
     description: "Check the status and progress of a running recipe execution",
     module: "recipes",
     scope: "mcp:read"
+  },
+  // platform connection deep-link flow
+  {
+    name: "start_platform_connection",
+    description: "Mint a single-use deep link for a user to complete platform OAuth in their browser",
+    module: "distribution",
+    scope: "mcp:distribute"
+  },
+  {
+    name: "wait_for_connection",
+    description: "Poll until a platform connection becomes active or timeout",
+    module: "distribution",
+    scope: "mcp:read"
   }
 ];
 function getToolsByModule(module) {
@@ -11201,11 +11226,11 @@ function hexToLab(hex) {
   const lb = srgbToLinear(b);
   const x = lr * 0.4124564 + lg * 0.3575761 + lb * 0.1804375;
   const y = lr * 0.2126729 + lg * 0.7151522 + lb * 0.072175;
-  const z29 = lr * 0.0193339 + lg * 0.119192 + lb * 0.9503041;
+  const z31 = lr * 0.0193339 + lg * 0.119192 + lb * 0.9503041;
   const f = (t) => t > 8856e-6 ? Math.cbrt(t) : 7.787 * t + 16 / 116;
   const fx = f(x / 0.95047);
   const fy = f(y / 1);
-  const fz = f(z29 / 1.08883);
+  const fz = f(z31 / 1.08883);
   return { L: 116 * fy - 16, a: 500 * (fx - fy), b: 200 * (fy - fz) };
 }
 function deltaE2000(lab1, lab2) {
@@ -12030,6 +12055,343 @@ function registerCarouselTools(server) {
   );
 }
 
+// src/apps/content-calendar.ts
+import {
+  registerAppTool,
+  registerAppResource,
+  RESOURCE_MIME_TYPE
+} from "@modelcontextprotocol/ext-apps/server";
+import { z as z28 } from "zod";
+import fs from "node:fs/promises";
+import path from "node:path";
+var CALENDAR_URI = "ui://content-calendar/mcp-app.html";
+function startOfCurrentWeekMonday() {
+  const now = /* @__PURE__ */ new Date();
+  const day = now.getDay();
+  const monday = new Date(now);
+  monday.setUTCDate(now.getUTCDate() - day + (day === 0 ? -6 : 1));
+  return monday.toISOString().split("T")[0];
+}
+function registerContentCalendarApp(server) {
+  registerAppTool(
+    server,
+    "open_content_calendar",
+    {
+      title: "Content Calendar",
+      description: "Open an interactive drag-drop calendar showing the user's scheduled posts for the current week. Users can reschedule via drag, filter by platform, drill into any post, or quick-create a new post. Backed by list_recent_posts, schedule_post, and find_next_slots \u2014 no new tools needed.",
+      inputSchema: {
+        start_date: z28.string().optional().describe("ISO date for the week start (YYYY-MM-DD); defaults to the current week's Monday.")
+      },
+      _meta: {
+        ui: {
+          resourceUri: CALENDAR_URI,
+          csp: {
+            "img-src": ["'self'", "https://*.r2.cloudflarestorage.com", "data:"],
+            "connect-src": ["'self'"]
+          }
+        }
+      }
+    },
+    async ({ start_date }, extra) => {
+      const userScopes = extra.authInfo?.scopes ?? [];
+      const fromDate = start_date ?? startOfCurrentWeekMonday();
+      const { data: result, error } = await callEdgeFunction(
+        "mcp-data",
+        {
+          action: "recent-posts",
+          days: 14,
+          limit: 50
+        },
+        { timeoutMs: 15e3 }
+      );
+      if (error || !result?.success) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Failed to load posts: ${error || result?.error || "Unknown error"}`
+            }
+          ],
+          isError: true
+        };
+      }
+      const posts = (result.posts ?? []).filter((p) => {
+        const ts = p.scheduled_at ?? p.published_at ?? p.created_at;
+        if (!ts) return false;
+        return ts.split("T")[0] >= fromDate;
+      });
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify({ posts, scopes: userScopes })
+          }
+        ]
+      };
+    }
+  );
+  registerAppResource(
+    server,
+    CALENDAR_URI,
+    CALENDAR_URI,
+    { mimeType: RESOURCE_MIME_TYPE },
+    async () => {
+      const htmlPath = path.join(process.cwd(), "apps/content-calendar/dist/mcp-app.html");
+      try {
+        const html = await fs.readFile(htmlPath, "utf-8");
+        return {
+          contents: [{ uri: CALENDAR_URI, mimeType: RESOURCE_MIME_TYPE, text: html }]
+        };
+      } catch (err) {
+        const errorHtml = `<!DOCTYPE html>
+<html><head><title>Content Calendar \u2014 unavailable</title></head>
+<body style="font-family:sans-serif;padding:24px;color:#444;">
+  <h2>Content Calendar app bundle missing</h2>
+  <p>The server registered <code>open_content_calendar</code> but
+  <code>apps/content-calendar/dist/mcp-app.html</code> is not built.
+  Run <code>npm run build:app</code> in the mcp-server directory and redeploy.</p>
+  <p style="color:#999;font-size:12px;">${err.message}</p>
+</body></html>`;
+        return {
+          contents: [{ uri: CALENDAR_URI, mimeType: RESOURCE_MIME_TYPE, text: errorHtml }]
+        };
+      }
+    }
+  );
+}
+
+// src/tools/connections.ts
+import { z as z29 } from "zod";
+init_supabase();
+var PLATFORM_ENUM4 = [
+  "youtube",
+  "tiktok",
+  "instagram",
+  "twitter",
+  "linkedin",
+  "facebook",
+  "threads",
+  "bluesky",
+  "shopify",
+  "etsy"
+];
+function findActiveAccount(accounts, platform2) {
+  const target = platform2.toLowerCase();
+  return accounts.find((a) => a.platform.toLowerCase() === target && a.status === "active") ?? null;
+}
+function registerConnectionTools(server) {
+  server.tool(
+    "start_platform_connection",
+    "Begin connecting a social platform (Instagram, TikTok, YouTube, etc.). Returns a single-use deep link the user opens in a browser to complete the one-time OAuth handshake on socialneuron.com. This is NOT another OAuth in Claude \u2014 platform connections require a browser session because the social platforms (Meta, Google, TikTok) only accept callbacks on socialneuron.com. After the user clicks the link and approves on the platform, call `wait_for_connection` to detect completion. Link expires in 2 minutes; mint a new one if needed. Use `list_connected_accounts` first to check whether the platform is already connected before calling this.",
+    {
+      platform: z29.enum(PLATFORM_ENUM4).describe("Platform to connect. Lower-case: instagram, tiktok, youtube, etc."),
+      response_format: z29.enum(["text", "json"]).optional().describe("Response format. Default: text.")
+    },
+    async ({ platform: platform2, response_format }) => {
+      const format = response_format ?? "text";
+      const startedAt = Date.now();
+      const rl = checkRateLimit("read", `start_platform_connection:${platform2}`);
+      if (!rl.allowed) {
+        await logMcpToolInvocation({
+          toolName: "start_platform_connection",
+          status: "rate_limited",
+          durationMs: Date.now() - startedAt,
+          details: { retryAfter: rl.retryAfter, platform: platform2 }
+        });
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Rate limit exceeded. Retry in ~${rl.retryAfter}s.`
+            }
+          ],
+          isError: true
+        };
+      }
+      const { data, error } = await callEdgeFunction("mcp-data", { action: "mint-connection-nonce", platform: platform2 }, { timeoutMs: 1e4 });
+      if (error || !data?.success || !data.deep_link) {
+        const errMsg = error ?? data?.error ?? "Unknown error";
+        await logMcpToolInvocation({
+          toolName: "start_platform_connection",
+          status: "error",
+          durationMs: Date.now() - startedAt,
+          details: { error: errMsg, platform: platform2 }
+        });
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Failed to start ${platform2} connection: ${errMsg}`
+            }
+          ],
+          isError: true
+        };
+      }
+      await logMcpToolInvocation({
+        toolName: "start_platform_connection",
+        status: "success",
+        durationMs: Date.now() - startedAt,
+        details: { platform: data.platform, expires_at: data.expires_at }
+      });
+      if (format === "json") {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(
+                {
+                  platform: data.platform,
+                  deep_link: data.deep_link,
+                  expires_at: data.expires_at,
+                  next_step: "Open deep_link in a browser, approve on the platform, then call wait_for_connection."
+                },
+                null,
+                2
+              )
+            }
+          ],
+          isError: false
+        };
+      }
+      return {
+        content: [
+          {
+            type: "text",
+            text: [
+              `${data.platform} connection ready.`,
+              "",
+              'Ask the user to open this link in a browser and click "Connect" on the platform:',
+              `  ${data.deep_link}`,
+              "",
+              `Link expires at: ${data.expires_at} (~2 minutes).`,
+              "",
+              "After they approve, call `wait_for_connection` with the same platform to confirm.",
+              "This is a one-time browser setup \u2014 not another OAuth flow inside Claude."
+            ].join("\n")
+          }
+        ],
+        isError: false
+      };
+    }
+  );
+  server.tool(
+    "wait_for_connection",
+    "Poll until a platform connection becomes active. Use after `start_platform_connection` while the user completes the browser OAuth flow. Returns when the account row appears with status=active, or when the timeout elapses. Default timeout 120s, max 600s.",
+    {
+      platform: z29.enum(PLATFORM_ENUM4).describe("Platform to wait for."),
+      timeout_s: z29.number().min(5).max(600).optional().describe("How long to wait, in seconds. Default 120."),
+      poll_interval_s: z29.number().min(2).max(30).optional().describe("Poll interval in seconds. Default 5."),
+      response_format: z29.enum(["text", "json"]).optional().describe("Response format. Default: text.")
+    },
+    async ({ platform: platform2, timeout_s, poll_interval_s, response_format }) => {
+      const format = response_format ?? "text";
+      const startedAt = Date.now();
+      const timeoutMs = (timeout_s ?? 120) * 1e3;
+      const intervalMs = (poll_interval_s ?? 5) * 1e3;
+      const deadline = startedAt + timeoutMs;
+      const rl = checkRateLimit("read", `wait_for_connection:${platform2}`);
+      if (!rl.allowed) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Rate limit exceeded. Retry in ~${rl.retryAfter}s.`
+            }
+          ],
+          isError: true
+        };
+      }
+      let attempts = 0;
+      while (Date.now() < deadline) {
+        attempts++;
+        const { data, error } = await callEdgeFunction("mcp-data", { action: "connected-accounts" }, { timeoutMs: 1e4 });
+        if (!error && data?.success) {
+          const found = findActiveAccount(data.accounts ?? [], platform2);
+          if (found) {
+            await logMcpToolInvocation({
+              toolName: "wait_for_connection",
+              status: "success",
+              durationMs: Date.now() - startedAt,
+              details: { platform: platform2, attempts, found: true }
+            });
+            if (format === "json") {
+              return {
+                content: [
+                  {
+                    type: "text",
+                    text: JSON.stringify(
+                      {
+                        connected: true,
+                        platform: found.platform,
+                        account_id: found.id,
+                        username: found.username,
+                        connected_at: found.created_at,
+                        attempts
+                      },
+                      null,
+                      2
+                    )
+                  }
+                ],
+                isError: false
+              };
+            }
+            return {
+              content: [
+                {
+                  type: "text",
+                  text: [
+                    `${found.platform} is connected.`,
+                    `Account: ${found.username || "(unnamed)"} (id=${found.id})`,
+                    `Detected after ${attempts} poll(s) in ${((Date.now() - startedAt) / 1e3).toFixed(1)}s.`,
+                    "Ready to call `schedule_post`."
+                  ].join("\n")
+                }
+              ],
+              isError: false
+            };
+          }
+        }
+        const remaining = deadline - Date.now();
+        if (remaining <= 0) break;
+        await new Promise((resolve3) => setTimeout(resolve3, Math.min(intervalMs, remaining)));
+      }
+      await logMcpToolInvocation({
+        toolName: "wait_for_connection",
+        status: "error",
+        durationMs: Date.now() - startedAt,
+        details: { platform: platform2, attempts, found: false, reason: "timeout" }
+      });
+      const message = `${platform2} did not connect within ${timeout_s ?? 120}s (${attempts} polls). The user may not have completed the browser OAuth yet, or the link expired. Mint a new link with \`start_platform_connection\` and try again, or have the user go directly to socialneuron.com/settings/connections.`;
+      if (format === "json") {
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(
+                {
+                  connected: false,
+                  platform: platform2,
+                  attempts,
+                  timed_out: true,
+                  message
+                },
+                null,
+                2
+              )
+            }
+          ],
+          isError: true
+        };
+      }
+      return {
+        content: [{ type: "text", text: message }],
+        isError: true
+      };
+    }
+  );
+}
+
 // src/lib/register-tools.ts
 function applyScopeEnforcement(server, scopeResolver) {
   const originalTool = server.tool.bind(server);
@@ -12059,7 +12421,7 @@ function applyScopeEnforcement(server, scopeResolver) {
             content: [
               {
                 type: "text",
-                text: `Permission denied: '${name}' requires scope '${requiredScope}'. Generate a new key with the required scope at https://socialneuron.com/settings/developer`
+                text: `Permission denied: '${name}' requires scope '${requiredScope}'. Your scopes: [${userScopes.join(", ")}]. API-key users: regenerate your key with this scope at https://socialneuron.com/settings/developer. OAuth users (Claude Custom Connector): this scope is not enabled for your plan tier.`
               }
             ],
             isError: true
@@ -12135,21 +12497,25 @@ function registerAllTools(server, options) {
   registerDigestTools(server);
   registerBrandRuntimeTools(server);
   registerCarouselTools(server);
+  registerConnectionTools(server);
+  if (!options?.skipApps) {
+    registerContentCalendarApp(server);
+  }
   applyAnnotations(server);
 }
 
 // src/prompts.ts
-import { z as z28 } from "zod";
+import { z as z30 } from "zod";
 function registerPrompts(server) {
   server.prompt(
     "create_weekly_content_plan",
     "Generate a full week of social media content (7 days, multiple platforms). Returns a structured plan with topics, formats, and posting times.",
     {
-      niche: z28.string().describe('Your content niche or industry (e.g., "fitness coaching", "SaaS marketing")'),
-      platforms: z28.string().optional().describe(
+      niche: z30.string().describe('Your content niche or industry (e.g., "fitness coaching", "SaaS marketing")'),
+      platforms: z30.string().optional().describe(
         'Comma-separated platforms to target (default: "YouTube, Instagram, TikTok, LinkedIn")'
       ),
-      tone: z28.string().optional().describe('Brand tone of voice (e.g., "professional", "casual", "bold and edgy")')
+      tone: z30.string().optional().describe('Brand tone of voice (e.g., "professional", "casual", "bold and edgy")')
     },
     ({ niche, platforms, tone }) => {
       const targetPlatforms = platforms || "YouTube, Instagram, TikTok, LinkedIn";
@@ -12191,8 +12557,8 @@ After building the plan, use \`save_content_plan\` to save it.`
     "analyze_top_content",
     "Analyze your best-performing posts to identify patterns and replicate success. Returns insights on hooks, formats, timing, and topics that resonate.",
     {
-      timeframe: z28.string().optional().describe('Analysis period (default: "30 days"). E.g., "7 days", "90 days"'),
-      platform: z28.string().optional().describe('Filter to a specific platform (e.g., "youtube", "instagram")')
+      timeframe: z30.string().optional().describe('Analysis period (default: "30 days"). E.g., "7 days", "90 days"'),
+      platform: z30.string().optional().describe('Filter to a specific platform (e.g., "youtube", "instagram")')
     },
     ({ timeframe, platform: platform2 }) => {
       const period = timeframe || "30 days";
@@ -12229,10 +12595,10 @@ Format as a clear, actionable performance report.`
     "repurpose_content",
     "Take one piece of content and transform it into 8-10 pieces across multiple platforms and formats.",
     {
-      source: z28.string().describe(
+      source: z30.string().describe(
         "The source content to repurpose \u2014 a URL, transcript, or the content text itself"
       ),
-      target_platforms: z28.string().optional().describe(
+      target_platforms: z30.string().optional().describe(
         'Comma-separated target platforms (default: "Twitter, LinkedIn, Instagram, TikTok, YouTube")'
       )
     },
@@ -12274,9 +12640,9 @@ For each piece, include the platform, format, character count, and suggested pos
     "setup_brand_voice",
     "Define or refine your brand voice profile so all generated content stays on-brand. Walks through tone, audience, values, and style.",
     {
-      brand_name: z28.string().describe("Your brand or business name"),
-      industry: z28.string().optional().describe('Your industry or niche (e.g., "B2B SaaS", "fitness coaching")'),
-      website: z28.string().optional().describe("Your website URL for context")
+      brand_name: z30.string().describe("Your brand or business name"),
+      industry: z30.string().optional().describe('Your industry or niche (e.g., "B2B SaaS", "fitness coaching")'),
+      website: z30.string().optional().describe("Your website URL for context")
     },
     ({ brand_name, industry, website }) => {
       const industryContext = industry ? ` in the ${industry} space` : "";
@@ -12735,7 +13101,7 @@ function isAllowedRedirectUri(uri) {
     if ((parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1") && (parsed.pathname === "/oauth/callback" || parsed.pathname === "/oauth/callback/debug") && parsed.protocol === "http:") {
       return true;
     }
-    if (parsed.protocol === "https:") {
+    if (process.env.MCP_ALLOW_ANY_HTTPS_REDIRECT === "true" && parsed.protocol === "https:") {
       return true;
     }
   } catch {
@@ -12854,7 +13220,7 @@ function createOAuthProvider(options) {
       const controller = new AbortController();
       const timer = setTimeout(() => controller.abort(), 1e4);
       try {
-        await fetch(`${supabaseUrl}/functions/v1/mcp-auth?action=revoke-by-token`, {
+        const response = await fetch(`${supabaseUrl}/functions/v1/mcp-auth?action=revoke-by-token`, {
           method: "POST",
           headers: {
             Authorization: `Bearer ${supabaseAnonKey}`,
@@ -12863,9 +13229,17 @@ function createOAuthProvider(options) {
           body: JSON.stringify({ token: request.token }),
           signal: controller.signal
         });
+        if (!response.ok) {
+          throw new Error(`Token revocation failed: HTTP ${response.status}`);
+        }
+        const data = await response.json().catch(() => ({ success: true }));
+        if (data.success === false) {
+          throw new Error(data.error ?? "Token revocation failed");
+        }
       } catch (err) {
         const msg = err instanceof Error ? err.message : "unknown";
         console.error(`[oauth] Token revocation call failed: ${msg}`);
+        throw err;
       } finally {
         clearTimeout(timer);
       }
@@ -12954,7 +13328,7 @@ var cleanupInterval = setInterval(
 );
 var app = express();
 app.disable("x-powered-by");
-app.use(express.json());
+app.use(express.json({ limit: "1mb" }));
 app.set("trust proxy", 1);
 var ipBuckets = /* @__PURE__ */ new Map();
 var IP_RATE_MAX = 60;
@@ -13035,9 +13409,13 @@ app.use((req, res, next) => {
     next(err);
   });
 });
+function setNoStore(res) {
+  res.setHeader("Cache-Control", "no-store");
+}
 async function authenticateRequest(req, res, next) {
   const authHeader = req.headers.authorization;
   if (!authHeader?.startsWith("Bearer ")) {
+    setNoStore(res);
     res.status(401).json({
       error: "unauthorized",
       error_description: "Bearer token required"
@@ -13062,10 +13440,12 @@ async function authenticateRequest(req, res, next) {
     };
     next();
   } catch (err) {
-    const message = err instanceof Error ? err.message : "Token verification failed";
+    const message = err instanceof Error ? sanitizeError(err) : "Token verification failed";
+    console.error(`[MCP HTTP] Token verification failed: ${message}`);
+    setNoStore(res);
     res.status(401).json({
       error: "invalid_token",
-      error_description: message
+      error_description: "Token verification failed"
     });
   }
 }
@@ -13079,124 +13459,13 @@ app.get("/.well-known/mcp/server-card.json", (_req, res) => {
       required: true,
       schemes: ["oauth2"]
     },
-    tools: [
-      {
-        name: "generate_content",
-        description: "Create a script, caption, hook, or blog post tailored to a specific platform.",
-        inputSchema: {
-          type: "object",
-          properties: { prompt: { type: "string" }, platform: { type: "string" } },
-          required: ["prompt"]
-        }
-      },
-      {
-        name: "schedule_post",
-        description: "Publish or schedule a post to connected social platforms.",
-        inputSchema: {
-          type: "object",
-          properties: { content: { type: "string" }, platform: { type: "string" } },
-          required: ["content", "platform"]
-        }
-      },
-      {
-        name: "fetch_analytics",
-        description: "Get post performance metrics for connected platforms.",
-        inputSchema: { type: "object", properties: { platform: { type: "string" } } }
-      },
-      {
-        name: "extract_brand",
-        description: "Analyze a website URL and extract brand identity data.",
-        inputSchema: { type: "object", properties: { url: { type: "string" } }, required: ["url"] }
-      },
-      {
-        name: "plan_content_week",
-        description: "Generate a full week content plan with platform-specific drafts.",
-        inputSchema: {
-          type: "object",
-          properties: { niche: { type: "string" } },
-          required: ["niche"]
-        }
-      },
-      {
-        name: "generate_video",
-        description: "Start an async AI video generation job.",
-        inputSchema: {
-          type: "object",
-          properties: { prompt: { type: "string" } },
-          required: ["prompt"]
-        }
-      },
-      {
-        name: "generate_image",
-        description: "Start an async AI image generation job.",
-        inputSchema: {
-          type: "object",
-          properties: { prompt: { type: "string" } },
-          required: ["prompt"]
-        }
-      },
-      {
-        name: "adapt_content",
-        description: "Rewrite existing content for a different platform.",
-        inputSchema: {
-          type: "object",
-          properties: { content: { type: "string" }, target_platform: { type: "string" } },
-          required: ["content", "target_platform"]
-        }
-      },
-      {
-        name: "quality_check",
-        description: "Score post quality across 7 categories (0-100).",
-        inputSchema: {
-          type: "object",
-          properties: { content: { type: "string" } },
-          required: ["content"]
-        }
-      },
-      {
-        name: "run_content_pipeline",
-        description: "Full pipeline: trends \u2192 plan \u2192 quality check \u2192 schedule.",
-        inputSchema: {
-          type: "object",
-          properties: { niche: { type: "string" } },
-          required: ["niche"]
-        }
-      },
-      {
-        name: "fetch_trends",
-        description: "Get current trending topics for content inspiration.",
-        inputSchema: { type: "object", properties: { platform: { type: "string" } } }
-      },
-      {
-        name: "get_credit_balance",
-        description: "Check remaining credits and plan tier.",
-        inputSchema: { type: "object", properties: {} }
-      },
-      {
-        name: "list_connected_accounts",
-        description: "Check which social platforms have active OAuth connections.",
-        inputSchema: { type: "object", properties: {} }
-      },
-      {
-        name: "get_brand_profile",
-        description: "Load the active brand voice profile.",
-        inputSchema: { type: "object", properties: {} }
-      },
-      {
-        name: "list_comments",
-        description: "List YouTube comments for moderation.",
-        inputSchema: { type: "object", properties: {} }
-      },
-      {
-        name: "reply_to_comment",
-        description: "Reply to a YouTube comment.",
-        inputSchema: {
-          type: "object",
-          properties: { comment_id: { type: "string" }, text: { type: "string" } },
-          required: ["comment_id", "text"]
-        }
-      }
-    ],
+    toolCount: TOOL_CATALOG.length,
+    tools: TOOL_CATALOG.map((t) => ({
+      name: t.name,
+      description: t.description,
+      module: t.module,
+      scope: t.scope
+    })),
     prompts: [
       {
         name: "create_weekly_content_plan",
@@ -13254,6 +13523,7 @@ app.get("/health", (_req, res) => {
   res.json({ status: "ok", version: MCP_VERSION });
 });
 app.get("/health/details", authenticateRequest, (_req, res) => {
+  setNoStore(res);
   res.json({
     status: "ok",
     version: MCP_VERSION,
@@ -13268,6 +13538,7 @@ app.get("/health/details", authenticateRequest, (_req, res) => {
 app.post("/mcp", authenticateRequest, async (req, res) => {
   const auth = req.auth;
   const existingSessionId = req.headers["mcp-session-id"];
+  setNoStore(res);
   const rl = checkRateLimit("read", auth.userId);
   if (!rl.allowed) {
     res.setHeader("Retry-After", String(rl.retryAfter));
@@ -13347,6 +13618,7 @@ app.post("/mcp", authenticateRequest, async (req, res) => {
   }
 });
 app.get("/mcp", authenticateRequest, async (req, res) => {
+  setNoStore(res);
   const sessionId = req.headers["mcp-session-id"];
   if (!sessionId || !sessions.has(sessionId)) {
     res.status(400).json({ error: "Invalid or missing session ID" });
@@ -13359,13 +13631,14 @@ app.get("/mcp", authenticateRequest, async (req, res) => {
   }
   entry.lastActivity = Date.now();
   res.setHeader("X-Accel-Buffering", "no");
-  res.setHeader("Cache-Control", "no-cache");
+  res.setHeader("Cache-Control", "no-store");
   await requestContext.run(
     { userId: req.auth.userId, scopes: req.auth.scopes, creditsUsed: 0, assetsGenerated: 0 },
     () => entry.transport.handleRequest(req, res)
   );
 });
 app.delete("/mcp", authenticateRequest, async (req, res) => {
+  setNoStore(res);
   const sessionId = req.headers["mcp-session-id"];
   if (!sessionId || !sessions.has(sessionId)) {
     res.status(400).json({ error: "Invalid or missing session ID" });