@socialneuron/mcp-server 1.7.5 → 1.7.9

package/CHANGELOG.md

@@ -2,6 +2,55 @@
 
 All notable changes to `@socialneuron/mcp-server` will be documented in this file.
 
+## [1.7.9] - 2026-05-01
+
+### Security
+- Hardened OAuth Dynamic Client Registration: production defaults now allow only known callback URIs plus localhost Claude development callbacks. Unknown HTTPS callbacks require `MCP_ALLOW_ANY_HTTPS_REDIRECT=true` for staging/onboarding.
+- Made OAuth token revocation authoritative: backend revocation failures now surface as failures instead of silently succeeding after local cache eviction.
+- Reduced auth error detail returned to clients and added no-store cache headers on protected HTTP responses.
+- `MCP_VERSION` bumped to `1.7.9`.
+
+### Fixed
+- Corrected auth documentation: this public server package currently uses an in-memory Dynamic Client Registration store. The earlier 1.7.7 changelog entry overstated persistent DCR storage; persistent DCR storage and separate short-lived connector tokens require companion backend changes outside this repo.
+
+## [1.7.8] - 2026-04-25
+
+### Added
+- **Platform connection deep-link tools**: `start_platform_connection` mints a single-use deep link the user opens in their browser to complete platform OAuth (X/LinkedIn/IG/etc.) in their already-authenticated session; `wait_for_connection` polls until the connection becomes active or the timeout elapses. Closes the "agent can't trigger OAuth from the chat" gap.
+- **Scope mapping**: `start_platform_connection` is `mcp:distribute`; `wait_for_connection` is `mcp:read`.
+
+### Changed
+- `MCP_VERSION` bumped to `1.7.8` (live `mcp.socialneuron.com` continues at `1.7.7` until the next deploy carries this surface).
+- Tool count: **76** (sealed via `tools.lock.json`).
+
+## [1.7.7] - 2026-04-25
+
+### Added
+- **MCP Apps — Calendar (Day 1 read-only scaffold)**: First inline UI surface inside Claude Desktop / claude.ai using `@modelcontextprotocol/ext-apps`. The `open_content_calendar` tool renders a drag-drop calendar of scheduled posts. Backed by existing tools (`list_recent_posts`, `schedule_post`, `find_next_slots`) — no new server-side work required.
+- **Connector icon**: OAuth metadata `logo_uri` points at `https://socialneuron.com/logo-icon.svg`. Custom Connector tile in claude.ai now renders the SN brand mark.
+- **Persistent OAuth client store**: Dynamic Client Registrations are persisted to `public.mcp_oauth_clients` (Supabase). Survives Railway redeploys — claude.ai's saved `client_id` no longer becomes invalid each deploy. Falls back to in-memory mode if the table is unreachable.
+- **Scope-denied OAuth-aware message**: Permission-denied responses now branch the remediation hint between API-key users (regenerate at `/settings/developer`) and OAuth Custom Connector users (scope is plan-tier-gated). [PR #73]
+
+### Changed
+- `MCP_VERSION` bumped to `1.7.7`.
+- Tool count: **74** at this release; subsequent backports brought public surface to 76.
+
+## [1.7.6] - 2026-04-22
+
+### Security
+- **Dependency cooldown re-armed**: `SN_DEP_AGE_ENFORCE` flipped back to `"true"` in `release.yml`. New dependency versions under 14 days old now block publish again. (Was temporarily warn-only in 1.7.5 while Trusted Publishing was being validated — that validation is complete.)
+
+### Changed
+- `MCP_VERSION` bumped to `1.7.6`.
+- First release published via npm Trusted Publishing (OIDC) with full SLSA provenance attestation. No tokens involved in the publish path.
+- **Reproducible `tools.lock.json`**: removed the `generated_at` timestamp so the sealed manifest is byte-identical across builds of the same source. Per-tool sha256 hashes remain the actual integrity seal.
+- **MCP Registry manifest synced**: `server.json` version fields bumped from `1.7.0` → `1.7.6` so registry discovery reflects the real latest package.
+- **Cursor plugin manifest synced**: `.cursor-plugin/plugin.json` bumped from `1.6.0` → `1.7.6`, tool count corrected from 52 → 73, and the `author.email` field (which leaked a real address) replaced with `author.url`.
+- **Docs tool-count drift fixed**: `docs/rest-api.md`, `docs/cli-guide.md`, `docs/integration-methods.md`, `docs/landing-page-brief.md`, `examples/rest/08-tool-proxy.sh`, and `examples/mcp/prompts.md` all updated from stale `52 tools` references to the current `73 tools`. CHANGELOG history entries are left intact.
+
+### Fixed
+- **Flaky CLI e2e test**: `unified JSON envelope > all JSON outputs include schema_version "1"` was occasionally hitting the default 5000ms vitest timeout on machines with slower cold-start. Raised per-test timeout to 15000ms. (Root cause is 6 sequential CLI spawns; a future PR can share the warm process.)
+
 ## [1.7.5] - 2026-04-22
 
 ### Added

package/README.md

@@ -1,6 +1,8 @@
 # @socialneuron/mcp-server
 
-> 73 tools for AI-powered social media management. MCP, REST API, CLI — create content, schedule posts, track analytics, and optimize performance.
+> 76 tools for AI-powered social media management. MCP, REST API, CLI — create content, schedule posts, track analytics, and optimize performance.
+>
+> The live Railway endpoint at [`mcp.socialneuron.com`](https://mcp.socialneuron.com) may surface a small number of additional integrated tools beyond the npm-published surface — see [`/.well-known/mcp/server-card.json`](https://mcp.socialneuron.com/.well-known/mcp/server-card.json) for runtime truth.
 
 [![npm version](https://img.shields.io/npm/v/@socialneuron/mcp-server)](https://www.npmjs.com/package/@socialneuron/mcp-server)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
@@ -14,7 +16,7 @@
 | **CLI** | Terminal, CI/CD pipelines | [Guide](docs/cli-guide.md) |
 | **SDK** | TypeScript/Node.js apps | Coming Q2 2026 |
 
-All methods share the same 73 tools, auth, scopes, and credit system. [Compare methods](docs/integration-methods.md).
+All methods share the same 76 tools, auth, scopes, and credit system. [Compare methods](docs/integration-methods.md).
 
 ## Quick Start
 
@@ -137,7 +139,7 @@ Ask Claude things like:
 - "Check my analytics and suggest improvements"
 - "Set up autopilot to post 3 times per week"
 
-## Tool Categories (73 tools)
+## Tool Categories (76 tools)
 
 > Full machine-readable listing in [`tools.lock.json`](tools.lock.json) (sealed manifest, verified in CI).
 
@@ -263,7 +265,7 @@ socialneuron-mcp sn loop
 socialneuron-mcp sn credits
 
 # Agent-native CLI v2
-socialneuron-mcp sn tools [--module ideation] [--scope mcp:write]  # List/filter all 73 tools
+socialneuron-mcp sn tools [--module ideation] [--scope mcp:write]  # List/filter all 76 tools
 socialneuron-mcp sn info                                            # Version, auth, credits, tool count
 socialneuron-mcp sn plan list|view|approve                          # Content plan management
 socialneuron-mcp sn preset list|show|save|delete                    # Platform presets (6 built-in)