clawskills-mcp 0.2.3 → 0.3.1

package/dist/index.test.js

@@ -185,7 +185,7 @@ const REQUIRED_SECTIONS = [
 const KNOWN_SKILLS = [
     "asana", "dynamics365", "figma", "github", "hubspot",
     "jira", "monday", "salesforce", "servicenow", "zendesk",
-    "slack",
+    "slack", "stripe", "notion",
 ];
 describe("real skills", () => {
     let skills;

package/package.json

@@ -1,7 +1,29 @@
 {
   "name": "clawskills-mcp",
-  "version": "0.2.3",
+  "version": "0.3.1",
   "description": "MCP server exposing ClawSkills API integration skill docs to AI agents",
+  "license": "MIT",
+  "author": "ClawSkills Contributors",
+  "homepage": "https://github.com/Shanksg/clawskills#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Shanksg/clawskills.git"
+  },
+  "keywords": [
+    "mcp",
+    "claude",
+    "ai",
+    "integration",
+    "api",
+    "skill",
+    "salesforce",
+    "hubspot",
+    "jira",
+    "zendesk",
+    "slack",
+    "crm",
+    "saas"
+  ],
   "type": "module",
   "bin": {
     "clawskills-mcp": "dist/index.js"

package/skills/INDEX.md

@@ -21,6 +21,8 @@ A curated library of integration skill documents for the most common SaaS platfo
 | GitHub | [github/skill.md](./github/skill.md) | Engineering, DevOps | Source control, PRs, CI/CD automation via REST + GraphQL |
 | Figma | [figma/skill.md](./figma/skill.md) | Design, Product, DevOps | Design file inspection, asset export, webhooks, design-to-dev handoff |
 | Slack | [slack/skill.md](./slack/skill.md) | All teams | Real-time messaging, notifications, event-driven automation via Web API |
+| Stripe | [stripe/skill.md](./stripe/skill.md) | Engineering, Finance, RevOps | Payments, subscriptions, refunds, webhooks, and Connect for platforms |
+| Notion | [notion/skill.md](./notion/skill.md) | Product, Engineering, Ops | Docs, databases, and blocks API for knowledge base and project automation |
 
 ---
 
@@ -180,6 +182,34 @@ A curated library of integration skill documents for the most common SaaS platfo
 
 ---
 
+### Notion → [skill.md](./notion/skill.md)
+1. Create a database row (page with properties: title, select, date, people)
+2. Query a database with AND/OR filters and sorts, paginating all results
+3. Update page properties (select, date, checkbox, rich_text)
+4. Archive (trash) a page
+5. Create a page with rich content blocks (headings, callout, to-do, code)
+6. Append blocks to an existing page in batches of 100
+7. Read all blocks from a page recursively (handling has_children)
+8. Search for pages and databases by title
+9. Incremental sync — query pages modified since a given timestamp
+10. Upsert pattern — create-or-update using an external ID property
+
+---
+
+### Stripe → [skill.md](./stripe/skill.md)
+1. Create a PaymentIntent for a one-time charge and confirm with Stripe.js
+2. Save a card for future off-session charges (SetupIntent → attach PaymentMethod)
+3. Create a recurring subscription (Customer + Price + Subscription)
+4. Launch a hosted Checkout Session and fulfil on `checkout.session.completed`
+5. Issue a full or partial refund
+6. Handle a failed subscription payment: notify customer, update payment method, retry invoice
+7. Receive and verify webhooks (Stripe-Signature HMAC-SHA256 verification)
+8. Stripe Connect: create a connected account, generate onboarding link, destination charge
+9. List all charges for a customer with cursor pagination
+10. Cancel a subscription at period end
+
+---
+
 ## Common Cross-Tool Patterns
 
 These scenarios span multiple skill docs — reference both tools:
@@ -197,6 +227,12 @@ These scenarios span multiple skill docs — reference both tools:
 | Bug report → GitHub issue + PR | Zendesk / ServiceNow | GitHub | Auto-create issue, label, assign; link ticket ID in body |
 | Design ready → engineering task | Figma | Jira / Asana / GitHub | `DEV_MODE_STATUS_UPDATE` webhook → create/update issue with frame link |
 | Asset pipeline | Figma | S3 / CDN | `FILE_VERSION_UPDATE` webhook → export frames as PNG, upload to storage |
+| Payment succeeded → CRM deal closed | Stripe | Salesforce / HubSpot | `payment_intent.succeeded` webhook → update deal stage to Closed Won |
+| Deal closed → Notion project page | Salesforce / HubSpot | Notion | Closed Won trigger → create onboarding project row in Notion database |
+| GitHub release → Notion changelog | GitHub | Notion | `release` event → append block to changelog database page |
+| Alert fired → Notion runbook page | PagerDuty / any webhook | Notion | Incident fires → create structured runbook page with checklist blocks |
+| Subscription cancelled → support ticket | Stripe | Zendesk / Jira | `customer.subscription.deleted` → create ticket for churn review |
+| Invoice paid → project provisioned | Stripe | Asana / Monday.com | `invoice.paid` webhook → create onboarding project or board item |
 
 ---
 
@@ -215,6 +251,8 @@ These scenarios span multiple skill docs — reference both tools:
 | GitHub | Fine-grained PAT or GitHub App installation token | Bearer token | Per-resource permissions (contents, issues, pull_requests, etc.) |
 | Figma | Personal Access Token (PAT) or OAuth 2.0 | `X-Figma-Token` (PAT) / `Authorization: Bearer` (OAuth) | Granular scopes: `file_content:read`, `webhooks:write`, etc. |
 | Slack | Bot token (OAuth 2.0 app install) | `xoxb-...` Bearer token | Per-method scopes: `chat:write`, `channels:read`, `users:read`, etc. |
+| Stripe | Secret API key or Restricted key | `Authorization: Bearer sk_live_...` | Per-resource scopes on restricted keys (None / Read / Write) |
+| Notion | Internal Integration Secret or OAuth token | `Authorization: Bearer secret_...` | Per-capability: Read/Insert/Update content, Read users |
 
 ---
 
@@ -233,10 +271,12 @@ These scenarios span multiple skill docs — reference both tools:
 | GitHub | PAT: 5,000/hr · GitHub App: 5k–12.5k/hr · Enterprise Cloud: 15,000/hr · Secondary: 900 pts/min, 80 create/min | 1 hour (primary) + sliding (secondary) | `x-ratelimit-remaining` / `x-ratelimit-reset`; 403 or 429 |
 | Figma | Starter: 10/min (T1), 25/min (T2) · Professional: 15/min (T1), 50/min (T2) · Org: 20/min (T1), 100/min (T2) | Per minute (leaky bucket) | `Retry-After` / `X-Figma-Rate-Limit-Type` / `X-Figma-Plan-Tier` |
 | Slack | Tier 1: 1/min · Tier 2: 20/min · Tier 3: 50/min · Tier 4: 100/min · `chat.postMessage`: 1/sec/channel sub-limit | Per method per workspace | HTTP 429 + `Retry-After` header (seconds) |
+| Stripe | Live: **100 req/sec** · Sandbox: **25 req/sec** · Search: 20/sec | Per account | HTTP 429 + `Stripe-Rate-Limited-Reason` header |
+| Notion | **3 req/sec average** (burst allowed) | Per workspace | HTTP 429 + `Retry-After` header (seconds) |
 
 ---
 
-*Last updated: 2026-02-26 (Slack skill added) | See [ROADMAP.md](./ROADMAP.md) for versioning and governance details.*
+*Last updated: 2026-03-02 (Notion skill added) | See [ROADMAP.md](./ROADMAP.md) for versioning and governance details.*
 
 ### API version reference (as of 2026-02-22)
 
@@ -253,3 +293,5 @@ These scenarios span multiple skill docs — reference both tools:
 | GitHub | REST API + GraphQL v4 | Pin `X-GitHub-Api-Version: 2022-11-28`; fine-grained PATs recommended |
 | Figma | REST API v1 / Webhooks V2 | Path-based versioning (`/v1/`, `/v2/`); `files:read` scope deprecated — use granular scopes |
 | Slack | Web API (no versioned path) | Always check `ok` field (HTTP 200 even on errors); `files.upload` deprecated — use `files.getUploadURLExternal` |
+| Stripe | `2026-02-25.clover` | Pin with `Stripe-Version` header; amounts in smallest currency unit (cents); never log raw card data |
+| Notion | `2025-09-03` | `Notion-Version` header required on every request; share pages with integration before API access works |

package/skills/ROADMAP.md

@@ -12,229 +12,152 @@ This skill set enables end-to-end automation and integration across the most com
 
 ---
 
-## Prioritization Framework
+## Current state (as of 2026-03-01)
 
-Each skill/recipe is scored on five dimensions (1–5 each):
+### What's shipped
 
-| Dimension | Description |
-|-----------|-------------|
-| **Impact** | Business value if automated (revenue, hours saved, error reduction) |
-| **Frequency** | How often the workflow runs daily/weekly |
-| **Complexity** | Inverse score — simpler = higher priority for Phase 1 |
-| **Risk** | Inverse score — lower risk of data loss/compliance issue = higher priority |
-| **Dependencies** | Whether other workflows or skills depend on this one being stable first |
+| Layer | Status |
+|-------|--------|
+| **11 skill docs** — Monday.com, Salesforce, Jira, Dynamics 365, HubSpot, ServiceNow, Zendesk, Asana, GitHub, Figma, Slack | ✅ Live |
+| **MCP server** — `clawskills-mcp` v0.2.3 on npm; `list_skills`, `get_skill`, `search_skills` | ✅ Live |
+| **CI pipeline** — build + test on every push/PR via `ci.yml` | ✅ Live |
+| **Release automation** — `release.yml` workflow_dispatch → bump, tag, npm publish via OIDC | ✅ Live |
+| **Test suite** — Vitest unit tests + real-skills validation (required sections, ≥5 KB, all 11 tools) | ✅ Live |
+| **Public repo readiness** — MIT license, `.gitignore`, full `package.json` metadata | ✅ Ready |
 
-**Priority score = (Impact × 2) + (Frequency × 1.5) + Complexity + Risk + Dependencies**
+### Content coverage by original phase
 
-Phases are ordered by descending average priority score within a theme.
+| Phase | Theme | Status |
+|-------|-------|--------|
+| Phase 1 — Foundation (Auth + Core CRUD) | Auth flows, basic CRUD, retry patterns | ✅ Complete — all 11 tools |
+| Phase 2 — High-Frequency Workflows | 6–12 recipes per tool | ✅ Complete — all 11 tools |
+| Phase 3 — Event-Driven & Real-Time | Webhook setup, signature verification, event handling | ✅ Complete — all 11 tools |
+| Phase 4 — Bulk & Advanced Operations | Batch APIs, large-volume patterns | ⚠️ Partial — documented for most tools; not all have >500-record examples |
+| Phase 5 — Cross-Tool Orchestration | Multi-system recipes spanning 2+ tools | ❌ Not started — patterns listed in INDEX.md but no dedicated recipes |
 
 ---
 
-## Phased Plan
-
-### Phase 1 — Foundation: Auth + Core CRUD (Weeks 1–4)
+## Next development phase
 
-**Theme:** Get the basics right. Every subsequent skill depends on reliable authentication and basic object manipulation.
+### Priority 1 — Content expansion: 3 new skills
 
-**Deliverables:**
-- All 8 `skill.md` files: Authentication & Permissions section fully validated against live environments
-- Core CRUD recipes for each tool (Create, Read by ID, Update, List/Search)
-- Error handling playbook (auth errors, 429s, 5xx retries)
-- Shared retry/backoff library or pattern documented
+Each new skill follows the 11-section template, lives on a `skill/<name>` branch, and is validated by CI before merge.
 
-**Cross-tool dependencies:**
-- OAuth 2.0 / token management pattern established first (applies to Salesforce JWT, Dynamics Azure AD, HubSpot Private Apps, Jira API Token, Asana PAT/OAuth, Zendesk API Token, ServiceNow OAuth, Monday token)
-- Secret storage convention agreed (env vars, vault reference) before any recipe is productionized
+| Skill | Why | Key areas to cover |
+|-------|-----|--------------------|
+| **Stripe** | Most common payments API; revenue-critical workflows missing from current library | Webhooks (event types + signature), Checkout Sessions, subscriptions, refunds, idempotency keys, Connect (multi-account) |
+| **Notion** | Knowledge base + lightweight PM; high demand for doc/wiki automation | Pages API, Databases + filters + sorts, Blocks API (rich text), Search, cursor pagination |
+| **Linear** | Fast-growing engineering tool, increasingly replacing Jira at startups | Issues, Projects, Teams, Cycles, GraphQL API, webhooks, OAuth + PAT auth |
 
-**Acceptance criteria:**
-- [ ] Each tool: auth flow documented end-to-end with working curl example
-- [ ] Each tool: create + read + update recipe tested against sandbox/dev environment
-- [ ] 429 rate-limit retry returns success within 3 attempts for all tools
-- [ ] No credentials stored in code or logs
+**Order:** Stripe → Notion → Linear (payments coverage is the biggest gap).
 
-**Definition of done:** A developer unfamiliar with any given tool can authenticate and perform a basic CRUD operation in under 30 minutes using only the skill doc.
+**Acceptance criteria for each:**
+- [ ] All 11 required sections present (CI enforces)
+- [ ] `Last validated:` date in header
+- [ ] Auth section has working `curl` example tested against sandbox/dev environment
+- [ ] At least 8 recipes with request/response examples
+- [ ] Rate limits verified against official docs
+- [ ] INDEX.md and README.md updated
 
 ---
 
-### Phase 2 — High-Frequency Workflows (Weeks 5–10)
+### Priority 2 — Freshness CI pipeline (the moat)
 
-**Theme:** The top 5 daily workflows per tool, covering the scenarios that save the most manual effort.
+A weekly automated check that skill docs aren't stale and that key API patterns still work.
 
-**Deliverables:**
-- Monday.com: Intake form → item creation, status sync, approval tracking
-- Salesforce: Lead capture & dedup, opportunity stage update, activity logging (Task/Event)
-- Jira: Ticket creation from external event, JQL search + triage, workflow transition with required fields
-- Dynamics 365: Contact/Account upsert, opportunity pipeline update, activity logging
-- HubSpot: Contact/Company sync, Deal stage update, Engagement logging (call/email/note)
-- ServiceNow: Incident create from alert, state transition + work notes, assignment group routing
-- Zendesk: Ticket creation, status/priority update, internal note vs public reply
-- Asana: Task creation in project/section, status update, comment/story append
+**Phase A — Staleness detection (low-effort, high-value):**
+- Parse `Last validated:` date from each `skill.md` header
+- Flag any doc older than 90 days in CI output
+- Open a GitHub issue automatically when a doc exceeds the threshold
+- Deliverable: `.github/workflows/freshness.yml` (weekly cron, `0 9 * * 1`) + `scripts/check-freshness.ts`
 
-**Cross-tool dependencies:**
-- Phase 1 auth foundation must be stable
-- Dedup/idempotency patterns (Phase 1) applied to all create recipes
+**Phase B — Live smoke tests (medium-effort, highest-value — the real moat):**
+- For each tool, maintain a minimal test that hits: auth endpoint + one read
+- Run weekly against sandbox environments using stored credentials (GitHub Secrets)
+- Failure creates a doc-review issue with the tool name and failing assertion
+- Candidates to start with: Jira (`/rest/api/3/myself`), GitHub (`/user`), HubSpot (`/crm/v3/objects/contacts?limit=1`)
 
 **Acceptance criteria:**
-- [ ] Each recipe has a validated request/response example
-- [ ] Pagination tested to >1 page of results
-- [ ] Incremental sync (updated_since / cursor) demonstrated for at least one search per tool
-- [ ] Dedup logic documented and tested (same input twice = no duplicate record)
-
-**Definition of done:** Each recipe can be executed end-to-end by an automation builder without consulting external docs.
+- [ ] Weekly cron runs without manual intervention
+- [ ] A PR that backdates a `Last validated:` date beyond 90 days fails the staleness check
+- [ ] Smoke test failure creates an issue and does not block `main` CI (it's a separate workflow)
 
 ---
 
-### Phase 3 — Event-Driven & Real-Time (Weeks 11–15)
+### Priority 3 — Distribution
 
-**Theme:** Replace polling with push. Webhooks and event triggers for real-time automation.
-
-**Deliverables:**
-- Monday.com: Webhook setup, column-change events, item-status triggers
-- Salesforce: Platform Events / Change Data Capture (CDC) basics; Outbound Messaging for simpler cases
-- Jira: Webhook registration (UI + API), issue-updated event structure, filtering by project/type
-- Dynamics 365: Webhooks via Plugin Registration Tool / Azure Service Bus; OData notifications
-- HubSpot: Webhook subscriptions, event types (contact.creation, deal.propertyChange), signature verification
-- ServiceNow: Outbound REST + Business Rules as webhook equivalent; Flow Designer basics
-- Zendesk: Webhook + Trigger setup, event payload structure, signature validation (X-Zendesk-Webhook-Signature)
-- Asana: Webhook registration, X-Hook-Secret handshake, event filtering
-
-**Cross-tool dependencies:**
-- Phase 2 update recipes required (webhooks trigger updates cross-system)
-- Shared webhook receiver pattern: signature verification, deduplication by event ID, idempotent handler
-
-**Acceptance criteria:**
-- [ ] Each tool: webhook registered, test event fired, handler receives and validates payload
-- [ ] Signature verification implemented and tested (reject tampered payload)
-- [ ] Idempotent event handler: same event delivered twice = processed once
-- [ ] Retry/dead-letter behavior documented per tool
-
-**Definition of done:** End-to-end event flow demonstrated: source system change → webhook delivery → target system update, with no polling.
+| Channel | Status | Next action |
+|---------|--------|-------------|
+| GitHub (public) | Ready to flip | Make repo public |
+| npm (`clawskills-mcp`) | ✅ Live — v0.2.3 | Maintain via `release.yml` |
+| MCP registry listings | Not submitted | Submit to glama.ai, mcp.so, smithery.ai after public launch |
+| Docs website | Planned | Mintlify — fastest path to SEO-friendly browsable docs |
+| Lane A vs B | TBD | Revisit after first traction signals from public launch |
 
 ---
 
-### Phase 4 — Bulk & Advanced Operations (Weeks 16–20)
-
-**Theme:** Scale up. Handle large datasets, bulk operations, and complex cross-tool orchestration.
+### Priority 4 — Complete Phase 4 & 5 gaps
 
-**Deliverables:**
-- Salesforce: Bulk API v2 (CSV ingest), SOQL aggregate queries, Composite API for multi-step
-- HubSpot: Batch create/update/read (up to 100 per batch), Import API for CSV
-- Jira: Bulk label/component updates, sprint management, custom field batch updates
-- ServiceNow: Import Sets with transform maps, batch table API calls
-- Zendesk: Bulk ticket update (update_many), Incremental Export API for full sync
-- Monday.com: Multiple mutations in single request, board duplication, subitems
-- Dynamics 365: $batch endpoint, FetchXML for complex aggregations
-- Asana: Parallel task creation patterns (respecting rate limits), Portfolio batch reads
+These are lower priority than new skills but worth finishing:
 
-**Cross-tool dependencies:**
-- All Phase 2 & 3 recipes stable
-- Rate limit / backoff patterns from Phase 1 must handle burst scenarios
+**Phase 4 gaps (Bulk operations):**
+- Salesforce Bulk API v2: end-to-end CSV ingest tested at ≥500 rows with error-row reporting
+- HubSpot batch create/update: tested at max batch size (100 records), partial-success handling
+- Zendesk Incremental Export API: full-sync recipe with cursor continuation
 
-**Acceptance criteria:**
-- [ ] Bulk create tested with ≥500 records per supported tool
-- [ ] Bulk job status polling recipe documented (for async APIs: Salesforce Bulk, ServiceNow Import Set)
-- [ ] Memory/time complexity noted for large payloads
-- [ ] Error partial-success handling documented (some rows fail, some succeed)
+**Phase 5 (Cross-tool orchestration) — first 3 recipes:**
+- Zendesk Ticket → Jira Bug (bidirectional status sync)
+- HubSpot Deal Won → Asana project creation (onboarding trigger)
+- Salesforce Lead → HubSpot Contact sync (dedup on email)
 
-**Definition of done:** An integration can process a 10,000-row export from one system and upsert into another using bulk APIs, with error reporting per failed row.
+Each recipe lives as a `## Cross-tool recipe` appendix section in the relevant primary skill doc (e.g., the Zendesk→Jira recipe goes in both `zendesk/skill.md` and `jira/skill.md`).
 
 ---
 
-### Phase 5 — Cross-Tool Orchestration & AI-Ready Patterns (Weeks 21–28)
-
-**Theme:** Connect the systems. Build the integration recipes that span multiple tools, and prepare data flows for AI enrichment.
+## Prioritization framework
 
-**Deliverables:**
-- Cross-tool recipes (documented separately or as appendices in relevant skill.md files):
-  - Salesforce Lead → HubSpot Contact sync
-  - Zendesk Ticket → Jira Bug creation (bidirectional status)
-  - ServiceNow Incident → Monday.com item (ops escalation board)
-  - HubSpot Deal Won → Asana project creation (onboarding workflow)
-  - Dynamics 365 Opportunity → Jira Epic (delivery handoff)
-- Enrichment patterns: append AI-generated summaries to ticket/task descriptions
-- Reporting aggregation: pull data from multiple tools into unified payload
-
-**Cross-tool dependencies:**
-- All Phase 1–4 skills stable
-- Canonical data model (shared field mapping table) agreed across tools
-
-**Acceptance criteria:**
-- [ ] Each cross-tool recipe: end-to-end tested in staging environments
-- [ ] Canonical IDs (external_id / reference fields) used to link records across systems
-- [ ] No data loss on failure (dead-letter queue or retry log)
-- [ ] Latency < 30s for real-time cross-tool sync
-
-**Definition of done:** A single external event (e.g., new support ticket) can automatically create linked records in 2+ systems with correct field mapping, documented in a runbook.
+Each skill/recipe is scored on five dimensions (1–5 each):
 
----
+| Dimension | Description |
+|-----------|-------------|
+| **Impact** | Business value if automated (revenue, hours saved, error reduction) |
+| **Frequency** | How often the workflow runs daily/weekly |
+| **Complexity** | Inverse score — simpler = higher priority |
+| **Risk** | Inverse score — lower risk of data loss = higher priority |
+| **Dependencies** | Whether other workflows depend on this one being stable |
 
-## Deliverables by Tool
-
-| Tool | Phase | Deliverable | Notes | Dependencies |
-|------|-------|-------------|-------|--------------|
-| All tools | 1 | Auth + Core CRUD skill sections | Sandbox environments required | None |
-| Monday.com | 1 | Auth (token + OAuth), Board/Item CRUD | GraphQL API — different pattern from REST tools | None |
-| Monday.com | 2 | Intake workflow, status sync, approval tracking | Column value JSON shapes per type | Phase 1 |
-| Monday.com | 3 | Webhook setup + column-change events | Webhooks require HTTPS endpoint | Phase 1 |
-| Monday.com | 4 | Multi-mutation requests, subitems | Complexity points budget management | Phase 2 |
-| Salesforce | 1 | Connected App, OAuth JWT, REST CRUD | Sandbox org required | None |
-| Salesforce | 2 | Lead capture, Opportunity update, Task logging | Validation rules awareness | Phase 1 |
-| Salesforce | 3 | Platform Events / CDC / Outbound Messaging | Streaming API is separate product | Phase 2 |
-| Salesforce | 4 | Bulk API v2, Composite API, SOQL aggregates | Bulk API best for >1000 rows | Phase 2 |
-| Salesforce | 5 | Lead → HubSpot sync, Opp → Jira Epic | Canonical field mapping required | Phase 4 |
-| Jira | 1 | API Token auth, Issue CRUD | Cloud vs Server distinction | None |
-| Jira | 2 | JQL search, workflow transitions, triage | ADF for rich text comments | Phase 1 |
-| Jira | 3 | Webhook registration + issue-updated events | Webhook URL must be publicly reachable | Phase 2 |
-| Jira | 4 | Bulk label/component updates, sprint ops | No native bulk create — workarounds needed | Phase 2 |
-| Jira | 5 | Zendesk Ticket → Jira Bug (bidirectional) | Status mapping table required | Phase 4 |
-| Dynamics 365 | 1 | Azure AD app registration, Web API CRUD | Azure tenant required; security roles | None |
-| Dynamics 365 | 2 | Account/Contact upsert, Opportunity update, Activity log | Solution prefix awareness | Phase 1 |
-| Dynamics 365 | 3 | Plugin/webhook setup, OData change notifications | Plugin Registration Tool needed | Phase 2 |
-| Dynamics 365 | 4 | $batch endpoint, FetchXML complex queries | FetchXML for anything OData can't express | Phase 2 |
-| Dynamics 365 | 5 | Opportunity → Jira Epic handoff | Canonical ID linking | Phase 4 |
-| HubSpot | 1 | Private App token, OAuth, CRM Object CRUD | Scopes per object type | None |
-| HubSpot | 2 | Contact/Company sync, Deal updates, Engagement logging | Properties API for custom fields | Phase 1 |
-| HubSpot | 3 | Webhook subscriptions + event handling | App registration required for webhooks | Phase 2 |
-| HubSpot | 4 | Batch APIs, Import API for CSV | 100-record batch limit | Phase 2 |
-| HubSpot | 5 | Salesforce Lead → HubSpot Contact sync | Dedup on email field | Phase 4 |
-| ServiceNow | 1 | Basic auth + OAuth, Table API CRUD | Dev instance recommended | None |
-| ServiceNow | 2 | Incident create/update, work notes, assignment | State values are integers — verify per instance | Phase 1 |
-| ServiceNow | 3 | Outbound REST + Business Rule webhooks | Flow Designer alternative | Phase 2 |
-| ServiceNow | 4 | Import Sets + transform maps, batch GETs | Transform map must be configured in UI | Phase 2 |
-| ServiceNow | 5 | Incident → Monday.com escalation board | State-to-status mapping required | Phase 4 |
-| Zendesk | 1 | API Token, OAuth, Ticket CRUD | Subdomain required for all calls | None |
-| Zendesk | 2 | Ticket create/update, note vs reply, bulk update | Status machine strictly enforced | Phase 1 |
-| Zendesk | 3 | Webhook + Trigger setup, signature verification | New webhook API vs deprecated HTTP targets | Phase 2 |
-| Zendesk | 4 | Bulk update_many, Incremental Export API | Incremental API requires Enterprise or above | Phase 2 |
-| Zendesk | 5 | Zendesk Ticket → Jira Bug (bidirectional) | Requires external_id / tag mapping | Phase 4 |
-| Asana | 1 | PAT + OAuth, Task/Project CRUD | opt_fields required for all reads | None |
-| Asana | 2 | Task creation in section, status update, story/comment | Memberships array for project placement | Phase 1 |
-| Asana | 3 | Webhook registration + X-Hook-Secret handshake | Webhook events are coarse-grained | Phase 2 |
-| Asana | 4 | Parallel task creation, Portfolio reads | No native bulk — rate limit math required | Phase 2 |
-| Asana | 5 | HubSpot Deal Won → Asana project (onboarding) | Template project duplication | Phase 4 |
+**Priority score = (Impact × 2) + (Frequency × 1.5) + Complexity + Risk + Dependencies**
 
 ---
 
-## Quality Bar & Governance
+## Quality bar & governance
 
 ### Keeping docs accurate
 
-- **Version pinning:** Each skill.md must note the API version it was validated against (e.g., Salesforce API v62.0, Jira REST API v3, Dynamics 365 v9.2). Update the version header when re-validating.
-- **Quarterly review cycle:** Each skill.md has a `Last validated:` date in its header. Docs older than 90 days are flagged for re-review.
-- **Changelog section:** Major API changes (new auth flows, deprecated endpoints, rate limit changes) are logged in a `## Changelog` section at the bottom of each skill.md.
+- **Version pinning:** Each skill.md notes the API version it was validated against. Update the version header when re-validating.
+- **Quarterly review cycle:** Docs older than 90 days are flagged by the freshness pipeline for re-review.
+- **Changelog notes:** Major API changes (new auth flows, deprecated endpoints, rate limit changes) noted inline with `> ⚠️ Changed [date]:` callouts.
 
 ### Validation approach
 
-- **Automated smoke tests:** For each tool, maintain a minimal test script (curl or SDK) that hits auth, a read, and a write. Run weekly in CI against sandbox environments. Failure triggers a doc-review issue.
-- **Breaking change monitoring:** Subscribe to each vendor's developer changelog / API release notes. Sources:
+- **CI test suite:** Real-skills tests in `mcp-server/src/index.test.ts` verify all skills load, have required sections, and are ≥5 KB.
+- **Freshness pipeline:** Weekly cron checks `Last validated:` dates (see Priority 2 above).
+- **Live smoke tests:** Optional phase B — weekly auth + read tests against sandboxes.
+- **Breaking change monitoring:** Subscribe to each vendor's developer changelog:
   - Monday: https://developer.monday.com/changelog
   - Salesforce: https://help.salesforce.com/s/articleView?id=release-notes.salesforce_release_notes.htm
   - Jira: https://developer.atlassian.com/cloud/jira/platform/changelog/
   - Dynamics 365: https://learn.microsoft.com/en-us/dynamics365/release-plans/
   - HubSpot: https://developers.hubspot.com/changelog
-  - ServiceNow: https://developer.servicenow.com/dev.do (release notes per version)
+  - ServiceNow: https://developer.servicenow.com/dev.do
   - Zendesk: https://developer.zendesk.com/api-reference/ticketing/introduction/#api-changelog
   - Asana: https://developers.asana.com/docs/changelog
+  - GitHub: https://github.blog/changelog/
+  - Figma: https://www.figma.com/developers/api#changelog
+  - Slack: https://api.slack.com/changelog
+  - Stripe: https://stripe.com/docs/changelog
+  - Notion: https://developers.notion.com/page/changelog
+  - Linear: https://linear.app/changelog
 
 ### Handling deprecations
 
@@ -245,29 +168,31 @@ Phases are ordered by descending average priority score within a theme.
 
 ### Contribution process
 
-- PRs to skill.md files require: (a) reference to official doc, (b) tested curl/pseudocode example, (c) updated `Last validated:` date.
-- All changes reviewed by at least one person who has tested against the live API.
+- PRs to `skill.md` files require: (a) reference to official doc, (b) tested curl/pseudocode example, (c) updated `Last validated:` date.
+- Branch convention: `skill/<toolname>` → PR → merge to main.
+- CI runs `npm test` on every PR — validates skill loads and has all required sections.
+- Releases: merge to main, then GitHub Actions → **Release** → Run workflow → pick `patch / minor / major`.
 
 ---
 
-## Backlog (Nice-to-Have)
-
-These items are out of scope for Phases 1–5 but worth tracking for future investment:
+## Backlog (tracked, not yet scheduled)
 
 | Item | Tool(s) | Value | Complexity |
 |------|---------|-------|------------|
-| AI-powered ticket summarization (append GPT summary to description) | Zendesk, Jira, ServiceNow | High | Medium |
+| AI-powered ticket summarization (append LLM summary to description) | Zendesk, Jira, ServiceNow | High | Medium |
 | Automated lead scoring sync | Salesforce, HubSpot | High | Medium |
 | Revenue analytics aggregation (pull pipeline across CRMs) | Salesforce, HubSpot, Dynamics 365 | High | High |
-| Admin automation: user provisioning / deprovisioning | All tools | Medium | Medium |
+| Token rotation automation (refresh before expiry) | All OAuth tools | High | Low |
+| Twilio skill (SMS/voice notifications) | Twilio | High | Medium |
+| Intercom skill (in-app messaging, user segments) | Intercom | Medium | Medium |
+| Okta/Auth0 skill (identity + SSO) | Okta | Medium | Medium |
+| PagerDuty skill (on-call, incident escalation) | PagerDuty | Medium | Low |
+| Docs website (Mintlify/Docusaurus) | — | High | Medium |
+| VS Code extension (inject skill doc into editor context) | — | Medium | High |
+| REST API / hosted endpoint for skill doc retrieval | — | Medium | High |
+| Admin automation: user provisioning/deprovisioning | All tools | Medium | Medium |
 | Compliance export (GDPR data subject requests) | Zendesk, Salesforce, HubSpot | Medium | High |
-| Monday → Asana project migration utility | Monday, Asana | Low | Medium |
-| Jira custom field schema introspection | Jira | Medium | Low |
-| Dynamics 365 Power Automate connector alternatives | Dynamics 365 | Medium | Low |
-| ServiceNow CMDB auto-discovery integration | ServiceNow | High | High |
 | Zendesk → Salesforce Case sync (bidirectional) | Zendesk, Salesforce | High | High |
-| HubSpot Sequences → Outreach/Salesloft parity | HubSpot | Medium | Medium |
-| Monday dashboards → BI tool (Looker/Tableau) export | Monday | Medium | Medium |
+| ServiceNow CMDB auto-discovery integration | ServiceNow | High | High |
 | Multi-workspace / multi-org management recipes | All tools | Medium | High |
-| Token rotation automation (refresh before expiry) | All OAuth tools | High | Low |
 | Audit log export to SIEM | Salesforce, Zendesk, ServiceNow | Medium | Medium |