@timelesscms-com/mcp-server 0.4.0 → 0.6.0

package/dist/tools/bulk.js

@@ -6,7 +6,7 @@ function v(version) {
 export const bulkTools = [
     {
         name: 'bulk_replace_text',
-        description: 'Replace a literal substring or regex across pages in one call. ALWAYS run with dry_run=true first and show the sample_diffs to the user before running the real call. Writes go through the normal pipeline (SEO transforms + revision snapshots).',
+        description: 'Replace a literal substring or regex across pages in one call. ALWAYS run with dry_run=true first and show the sample_diffs to the user before running the real call. Writes go through the normal pipeline (SEO transforms + revision snapshots). Response shape: { dry_run, updated, total_matches, pages_with_matches, sample_diffs_shown, additional_pages_with_matches, sample_diffs[], skipped (deprecated) }.',
         inputSchema: {
             pattern: z.string().min(1).describe('Literal substring (default) or JS regex source if regex=true.'),
             replacement: z.string(),

package/dist/tools/deploy.js

@@ -27,7 +27,7 @@ export const deployTools = [
     },
     {
         name: 'get_deploy_status',
-        description: 'Status of a single deploy job (queued | running | succeeded | failed).',
+        description: "Status of a single deploy job. Returns { job, queued_for_seconds, queue_timeout_seconds }. job.status is one of queued | running | succeeded | failed. Polling cadence: ~5s for queued/running. A job stuck in 'queued' for longer than queue_timeout_seconds (default 300s) auto-flips to failed with phase='queue_timeout' — so a single poll past that timestamp returns the terminal state and you can stop polling.",
         inputSchema: { job_id: z.string() },
         handler: withErrorBoundary(async (args, { client, siteId }) => {
             const res = await client.get(siteId, `deploys/${encodeURIComponent(args.job_id)}`);

package/dist/tools/pages.js

@@ -151,9 +151,17 @@ export const pageTools = [
             // 2. Build the new page body. Title + slug from args, everything else
             //    copied — except the new page always starts as a draft so cloning
             //    a published page doesn't accidentally publish a half-edited copy.
+            // Critical: preserve the source's content_mode exactly. Without
+            // this, create_page falls back to its blocks-default and seeds a
+            // fresh heading+prose tree, leaving the clone with TWO content
+            // sources (the copied html_content AND a default blocks[]). Bug
+            // surfaced in MCP-FEEDBACK-2.md from the Sundsvallsflytt demo build.
+            const srcMode = src.content_mode ?? 'html';
             const body = {
                 title: args.title,
-                html_content: src.html_content,
+                content_mode: srcMode,
+                html_content: srcMode === 'html' ? src.html_content : '',
+                blocks: srcMode === 'blocks' ? (src.blocks ?? []) : undefined,
                 seo_title: src.seo_title,
                 seo_description: src.seo_description,
                 og_image: src.og_image,

package/dist/tools/settings.js

@@ -1,12 +1,16 @@
-// Settings tools. scripts_head, scripts_body_end, and custom_css are NOT
-// exposed — the server omits them on read and silently drops them on
-// write. Customers edit those manually in /app/sites/{id}/settings.
+// Settings tools. scripts_head, scripts_body_end, and custom_css ARE
+// writable via the public API (as of mcp-server 0.4.x) — the v1 route
+// accepts them and they round-trip through read_site_settings. Same
+// trust model as user-authored block-type JS: a bearer-token caller
+// takes responsibility for what they ship. The portal chat AI still
+// doesn't expose these fields, so conversation-driven assistants can't
+// smuggle scripts in.
 import { z } from 'zod';
 import { ok, withErrorBoundary } from './helpers.js';
 export const settingsTools = [
     {
         name: 'read_site_settings',
-        description: 'Read the site\'s name, tagline, logo, favicon, colors, fonts, contact info, social links, default SEO suffix.',
+        description: "Read every site setting: name, tagline, logo, favicon, colors, fonts, contact info, social links, default SEO suffix, language, robots_txt, plus the scriptable surfaces scripts_head, scripts_body_end, and custom_css.",
         handler: withErrorBoundary(async (_args, { client, siteId }) => {
             const res = await client.get(siteId, 'settings');
             return ok(res);
@@ -14,7 +18,7 @@ export const settingsTools = [
     },
     {
         name: 'update_site_settings',
-        description: 'Patch site settings. Only the fields you pass change. Nested objects (colors, fonts, contact, social) are shallow-merged. scripts_* and custom_css are not writable.',
+        description: 'Patch site settings. Only the fields you pass change. Nested objects (colors, fonts, contact, social) are shallow-merged. scripts_head / scripts_body_end / custom_css ARE writable here — useful for a global stylesheet across all pages. Whatever you ship in those fields runs verbatim on the rendered site, so treat them as code, not data.',
         inputSchema: {
             site_name: z.string().optional(),
             tagline: z.string().optional(),
@@ -23,6 +27,10 @@ export const settingsTools = [
             default_seo_suffix: z.string().optional(),
             language: z.string().optional().describe('BCP-47 tag (e.g. "en", "sv", "en-GB"). Drives <html lang> on the rendered site.'),
             robots_txt: z.string().optional(),
+            // Scriptable surfaces. Trusted because the caller has an API key.
+            scripts_head: z.string().optional().describe('Raw HTML injected into <head> on every page. Use for analytics, fonts, third-party CSS links.'),
+            scripts_body_end: z.string().optional().describe('Raw HTML injected just before </body> on every page. Use for chat widgets, deferred analytics.'),
+            custom_css: z.string().optional().describe('Global CSS shipped in <style> at the end of <head>. Lets you define site-wide design tokens (CSS variables, @media queries, :hover states) without inlining on every element.'),
             colors: z.record(z.string()).optional(),
             fonts: z.record(z.unknown()).optional(),
             contact: z

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timelesscms-com/mcp-server",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Model Context Protocol server for the TimelessCMS public API. Use with Claude Code or any MCP-compatible client to manage a TimelessCMS site.",
   "license": "MIT",
   "type": "module",