mcp-scraper 0.66.2 → 0.66.4

package/CHANGELOG.md

@@ -4,6 +4,27 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 
 ## [Unreleased]
 
+## [0.66.4] - 2026-08-25
+
+### Added
+
+- Connected-service discovery now returns a tenant-owned `userLabel` plus verified provider account ID, email, name, and identity status so agents can select the intended account when one integration has multiple connections.
+- Managed OAuth connections now retain non-secret provider identity metadata and support owner-scoped account names through the dashboard API.
+
+### Fixed
+
+- Nango tenant tags are no longer presented as the external provider account, preventing the MCP Scraper login from being mistaken for the Google, Slack, GitHub, Zoom, or other authorized identity.
+
+## [0.66.3] - 2026-08-25
+
+### Changed
+
+- Runtime MCP discovery now omits output schemas across hosted OAuth, API-key, npm stdio, and MCPB clients, while the complete generated developer contract continues to supply typed Node and Python SDK outputs.
+
+### Fixed
+
+- Restored compatibility for strict MCP clients that could connect successfully but silently register zero tools when the complete output-schema catalog was advertised; tool calls retain both readable content and structured results.
+
 ## [0.66.2] - 2026-08-24
 
 ### Changed
@@ -1088,7 +1109,9 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 - Write actions remain unavailable until the account owner explicitly enables them.
 - Provider-specific connection data is normalized into one agent-facing contract.
 
-[Unreleased]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.66.2...HEAD
+[Unreleased]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.66.4...HEAD
+[0.66.4]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.66.3...v0.66.4
+[0.66.3]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.66.2...v0.66.3
 [0.66.2]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.66.1...v0.66.2
 [0.66.1]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.66.0...v0.66.1
 [0.66.0]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.65.1...v0.66.0

package/README.md

@@ -159,7 +159,7 @@ Build the branded one-click bundle:
 npm run build:mcpb
 ```
 
-The generated bundle is written to `build/mcpb/mcp-scraper-<version>.mcpb` and copied to `public/downloads/` for the hosted download. The current public bundle is `https://mcpscraper.dev/downloads/mcp-scraper.mcpb` (`0.66.2`, SHA-256 `0ed9a49cc80f3d8b2da41039e9a9baeeb77b3f626cd9f98a4e2c84e566e1a79d`). Install it by opening or dragging it into Claude Desktop. Claude displays the `MCP Scraper` install card, icon, API-key configuration field, and manually curated current-release message from the bundle manifest.
+The generated bundle is written to `build/mcpb/mcp-scraper-<version>.mcpb` and copied to `public/downloads/` for the hosted download. The current public bundle is `https://mcpscraper.dev/downloads/mcp-scraper.mcpb` (`0.66.4`, SHA-256 `53fa34844c0a030c9777cb0e62d547c446ebf6f553f0a850d33bd0aa4185f73c`). Install it by opening or dragging it into Claude Desktop. Claude displays the `MCP Scraper` install card, icon, API-key configuration field, and manually curated current-release message from the bundle manifest.
 
 The MCPB install exposes every tool — web-intelligence plus all `browser_*` tools — through the one `mcp-scraper` server.
 
@@ -315,7 +315,7 @@ For Google SERP and Maps tools, callers provide the query, two-letter country co
 
 The `mcp-scraper` server (and the MCPB bundle, which runs it) exposes both sections through one MCP server.
 
-All MCP tools expose output schemas and return `structuredContent` with the IDs, URLs, CSV paths, transcripts, browser session handles, replay paths, artifacts, recipe fields, or blueprint fields needed by the next step. Browser Agent tools keep a JSON text block for older clients, but structured data is the primary contract. All tools carry MCP annotations; file-writing tools such as replay downloads and annotations state their filesystem side effects.
+All MCP tools return `structuredContent` with the IDs, URLs, CSV paths, transcripts, browser session handles, replay paths, artifacts, recipe fields, or blueprint fields needed by the next step, plus readable text content for compatibility. Runtime `tools/list` omits output schemas so strict clients can register the complete catalog; the generated developer manifest retains every canonical output schema for validation and typed SDK generation. All tools carry MCP annotations; file-writing tools such as replay downloads and annotations state their filesystem side effects.
 
 The canonical tool inventory is generated at `docs/mcp-tool-manifest.generated.json`. The unified server exposes 259 tools: 158 scraper, browser, workflow, billing, and connected-service tools plus 101 durable-memory tools. The scraper-side inventory includes rendered site-content similarity, governed Local Sourcebook tools, Transparent Commons entity, linkset, and publication tools, direct site-export text and image readers, the searchable News Publisher and Editorial Reading Room template workflow, and 24 X-Ray tools for pixel administration, reporting, attribution journeys, campaign links, exports, and scheduled reports. Successful evidence-compiled Local Sourcebook revisions publish automatically to their canonical `localsourcebook.com` category profile and review URLs; administrator controls handle exceptional rejection or unpublishing. Release verification compares the exact local and hosted tool-name sets, not only the count.
 

package/dist/bin/api-server.cjs

@@ -49679,7 +49679,7 @@ var PACKAGE_VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    PACKAGE_VERSION = "0.66.2";
+    PACKAGE_VERSION = "0.66.4";
   }
 });
 
@@ -49940,10 +49940,10 @@ Multi-step orchestrations \u2014 prefer these over hand-chaining primitives when
   artifact, call \`report_artifact_read\` with the returned artifactId and follow nextOffset until null. This
   works through the authenticated MCP connection even when the client cannot open the signed download URL;
   do not try curl or web_fetch. Use \`archive_read\` for ZIP archives.
-- Before using a connected account, call \`list_service_connections\` and match the intended provider-side
-  identity from \`providerAccountEmail\` or \`providerAccountName\`, not the MCP Scraper login. If
-  \`providerIdentityStatus\` is \`unavailable\`, ask the person to refresh that connection before assuming
-  which external account it represents.
+- Before using a connected account, call \`list_service_connections\`. Match an explicit \`userLabel\` first,
+  then verified provider-side \`providerAccountEmail\`, \`providerAccountName\`, or \`providerAccountId\`; never
+  treat the MCP Scraper login as external-provider identity. If identity is pending or unavailable and no
+  distinct user label exists, ask the person which connection they mean instead of assuming.
 - For Google Search Console, use \`export_connected_service_data\` with
   \`dataset:"search_console_performance"\` when the person asks for a fresh JSONL download. When they
   ask to schedule ingestion or repeatedly filter historical rows, create a \`connection_sync\` schedule,
@@ -50109,14 +50109,30 @@ var init_server_instructions = __esm({
 });
 
 // src/mcp/output-schema-registry.ts
+function resolveOutputSchemaMode(env = process.env) {
+  const requested = env.MCP_SCRAPER_OUTPUT_SCHEMA_MODE?.trim().toLowerCase();
+  if (requested) {
+    if (requested === "contract" || requested === "all") return "contract";
+    if (requested === "runtime" || requested === "none" || requested === "essential") return "runtime";
+    throw new Error(`Unsupported MCP_SCRAPER_OUTPUT_SCHEMA_MODE: ${requested}`);
+  }
+  const legacyAdvertisement = env.MCP_SCRAPER_ADVERTISE_OUTPUT_SCHEMAS?.trim().toLowerCase();
+  if (legacyAdvertisement === "true") return "contract";
+  if (legacyAdvertisement === void 0 || legacyAdvertisement === "" || legacyAdvertisement === "false") {
+    return "runtime";
+  }
+  throw new Error(`Unsupported MCP_SCRAPER_ADVERTISE_OUTPUT_SCHEMAS value: ${legacyAdvertisement}`);
+}
 function recordOutputSchema(name, schema) {
   OUTPUT_SCHEMAS[name] = schema;
-  return schema;
+  return ADVERTISE_OUTPUT_SCHEMAS ? schema : void 0;
 }
-var OUTPUT_SCHEMAS;
+var OUTPUT_SCHEMA_MODE, ADVERTISE_OUTPUT_SCHEMAS, OUTPUT_SCHEMAS;
 var init_output_schema_registry = __esm({
   "src/mcp/output-schema-registry.ts"() {
     "use strict";
+    OUTPUT_SCHEMA_MODE = resolveOutputSchemaMode();
+    ADVERTISE_OUTPUT_SCHEMAS = OUTPUT_SCHEMA_MODE === "contract";
     OUTPUT_SCHEMAS = {};
   }
 });
@@ -53837,7 +53853,12 @@ var init_mcp_tool_schemas = __esm({
         connectionId: import_zod45.z.string(),
         providerConfigKey: import_zod45.z.string(),
         provider: import_zod45.z.string().nullable().optional(),
-        label: import_zod45.z.string(),
+        label: import_zod45.z.string().describe("Best available human-facing account label: a userLabel when set, otherwise verified provider identity, then a stable fallback."),
+        userLabel: import_zod45.z.string().nullable().optional().describe("Optional tenant-owned name set in the dashboard to distinguish this connection. This is not asserted provider identity."),
+        providerAccountId: import_zod45.z.string().nullable().optional().describe("Stable provider-side account, user, workspace, channel, or tenant identifier when the provider exposes one."),
+        providerAccountEmail: import_zod45.z.string().email().nullable().optional().describe("Verified provider-side email when the provider exposes one. This is never inferred from the MCP Scraper login."),
+        providerAccountName: import_zod45.z.string().nullable().optional().describe("Provider-side account, user, workspace, channel, or tenant name when the provider exposes one."),
+        providerIdentityStatus: import_zod45.z.enum(["pending", "verified", "unavailable"]).optional().describe("Whether provider identity discovery is pending, returned at least one verified provider identifier, or completed without one."),
         status: import_zod45.z.string(),
         lifecycleStatus: import_zod45.z.enum(["pending", "connected", "needs_reauth", "disconnecting", "disconnected"]).optional().describe("Credential lifecycle. This is separate from current provider availability."),
         operationalStatus: import_zod45.z.enum(["unknown", "available", "degraded", "unavailable"]).optional().describe("Last observed provider transport availability. Unavailable does not imply reconnect is required."),
@@ -56341,7 +56362,7 @@ function registerPaaExtractorMcpTools(server, executor, options = {}) {
   }, async (input) => formatCreditsInfo(await executor.creditsInfo(input), input));
   server.registerTool("list_service_connections", {
     title: "List Connected Services",
-    description: "List every service connection this MCP Scraper account has authorized, including Resend, GitHub, Google Analytics, Google Search Console, YouTube, Facebook Pages, LinkedIn, X, Meta Marketing, Slack, Gmail, Calendar, Google Drive, Zoom, Xero, and others. Returns the tenant-scoped connectionId, credential transport, exact live readTools and gated actionTools, permission-aware toolCapabilities with missing OAuth-grant or provider-app-feature blockers, permanently blocked administrative tools, and schema-discovery metadata. Get a connectionId and exact tool name here before calling describe_service_connection_tool, read_service_connection, or call_service_connection_action. Managed OAuth and official remote MCP connections use the same provider-neutral bridges; mutations still require the account action switch and an exact allowed action. A scheduled Search Console connection_sync creates a typed tenant-owned performance table; after it runs, use the returned tableName with table-describe and table-query instead of repeatedly calling Google for historical filtering.",
+    description: "List every service connection this MCP Scraper account has authorized, including Resend, GitHub, Google Analytics, Google Search Console, YouTube, Facebook Pages, LinkedIn, X, Meta Marketing, Slack, Gmail, Calendar, Google Drive, Zoom, Xero, and others. Returns the tenant-scoped connectionId; a tenant-owned userLabel; verified provider-side account ID, email, or name when available; credential transport; exact live readTools and gated actionTools; permission-aware toolCapabilities with missing OAuth-grant or provider-app-feature blockers; permanently blocked administrative tools; and schema-discovery metadata. Get a connectionId and exact tool name here before calling describe_service_connection_tool, read_service_connection, or call_service_connection_action. Managed OAuth and official remote MCP connections use the same provider-neutral bridges; mutations still require the account action switch and an exact allowed action. A scheduled Search Console connection_sync creates a typed tenant-owned performance table; after it runs, use the returned tableName with table-describe and table-query instead of repeatedly calling Google for historical filtering.",
     inputSchema: ListServiceConnectionsInputSchema,
     outputSchema: recordOutputSchema("list_service_connections", ListServiceConnectionsOutputSchema),
     annotations: { title: "List Connected Services", readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false }
@@ -81153,6 +81174,12 @@ function ensureServiceConnectionsSchema() {
         transport                  TEXT NOT NULL,
         upstream_connection_id     TEXT,
         label                      TEXT,
+        user_label                 TEXT,
+        provider_account_id        TEXT,
+        provider_account_email     TEXT,
+        provider_account_name      TEXT,
+        provider_identity_checked_at TEXT,
+        provider_identity_source_updated_at TEXT,
         lifecycle_status           TEXT NOT NULL DEFAULT 'pending',
         operational_status         TEXT NOT NULL DEFAULT 'unknown',
         reconnect_required         INTEGER NOT NULL DEFAULT 0,
@@ -81174,6 +81201,30 @@ function ensureServiceConnectionsSchema() {
         UNIQUE(user_id, provider_config_key, upstream_connection_id)
       )
     `);
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN user_label TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_account_id TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_account_email TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_account_name TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_identity_checked_at TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_identity_source_updated_at TEXT`);
+    } catch {
+    }
     await db.execute(`CREATE INDEX IF NOT EXISTS service_connections_user_updated ON service_connections(user_id, updated_at DESC)`);
     await db.execute(`CREATE INDEX IF NOT EXISTS service_connections_upstream ON service_connections(provider_config_key, upstream_connection_id)`);
     await db.execute(`
@@ -81234,6 +81285,12 @@ function rowToRecord(row) {
     transport: row.transport === "remote_mcp" ? "remote_mcp" : "nango",
     upstreamConnectionId: typeof row.upstream_connection_id === "string" ? row.upstream_connection_id : null,
     label: typeof row.label === "string" ? row.label : null,
+    userLabel: typeof row.user_label === "string" ? row.user_label : null,
+    providerAccountId: typeof row.provider_account_id === "string" ? row.provider_account_id : null,
+    providerAccountEmail: typeof row.provider_account_email === "string" ? row.provider_account_email : null,
+    providerAccountName: typeof row.provider_account_name === "string" ? row.provider_account_name : null,
+    providerIdentityCheckedAt: typeof row.provider_identity_checked_at === "string" ? row.provider_identity_checked_at : null,
+    providerIdentitySourceUpdatedAt: typeof row.provider_identity_source_updated_at === "string" ? row.provider_identity_source_updated_at : null,
     lifecycleStatus: String(row.lifecycle_status),
     operationalStatus: String(row.operational_status),
     reconnectRequired: Number(row.reconnect_required) === 1,
@@ -81319,6 +81376,34 @@ async function updateServiceConnectionTools(connectionId, readTools, actionTools
     args: [JSON.stringify(readTools), JSON.stringify(actionTools), toolRevision, connectionId]
   });
 }
+async function setServiceConnectionProviderIdentity(args) {
+  await ensureServiceConnectionsSchema();
+  await getDb().execute({
+    sql: `
+      UPDATE service_connections SET
+        provider_account_id = ?, provider_account_email = ?, provider_account_name = ?,
+        provider_identity_checked_at = datetime('now'), provider_identity_source_updated_at = ?,
+        updated_at = datetime('now')
+      WHERE id = ?
+    `,
+    args: [
+      args.providerAccountId ?? null,
+      args.providerAccountEmail?.toLowerCase() ?? null,
+      args.providerAccountName ?? null,
+      args.sourceUpdatedAt,
+      args.connectionId
+    ]
+  });
+}
+async function setServiceConnectionUserLabel(identity, connectionId, userLabel) {
+  const connection = await getOwnedServiceConnection(identity, connectionId);
+  if (!connection || connection.lifecycleStatus === "disconnected") throw new Error("service_connection_not_found");
+  await getDb().execute({
+    sql: `UPDATE service_connections SET user_label = ?, updated_at = datetime('now') WHERE id = ? AND user_id = ?`,
+    args: [userLabel, connectionId, connection.userId]
+  });
+  return userLabel;
+}
 async function recordServiceConnectionHealth(args) {
   await ensureServiceConnectionsSchema();
   const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -84395,7 +84480,8 @@ async function nangoRequest(path6, options = {}) {
       headers: {
         authorization: `Bearer ${nangoSecret()}`,
         accept: "application/json",
-        ...options.body ? { "content-type": "application/json" } : {}
+        ...options.body ? { "content-type": "application/json" } : {},
+        ...options.headers
       },
       body: options.body ? JSON.stringify(options.body) : void 0,
       signal: AbortSignal.timeout(NANGO_TIMEOUT_MS)
@@ -84443,22 +84529,126 @@ function discoveredConnection(value) {
   const upstreamConnectionId = text(row?.connection_id);
   const providerConfigKey = text(row?.provider_config_key);
   if (!upstreamConnectionId || !providerConfigKey) return null;
-  const tags = asRecord2(row?.tags);
-  const endUser = asRecord2(row?.end_user);
   const errors = Array.isArray(row?.errors) ? row.errors : [];
   const authError = errors.some((error) => text(asRecord2(error)?.type) === "auth");
   return {
     upstreamConnectionId,
     providerConfigKey,
     provider: text(row?.provider) ?? providerConfigKey,
-    label: text(tags?.end_user_display_name) ?? text(endUser?.display_name) ?? text(tags?.end_user_email) ?? text(endUser?.email),
+    // Nango's end-user fields identify the MCP Scraper tenant, not the
+    // provider-side principal that authorized this connection.
+    label: null,
     lifecycleStatus: authError ? "needs_reauth" : "connected",
     reconnectRequired: authError,
     createdAt: text(row?.created_at) ?? text(row?.created),
     updatedAt: text(row?.updated_at)
   };
 }
-async function discoverOwnedNangoConnections(identity) {
+function scalarId(value) {
+  const valueText = text(value);
+  if (valueText) return valueText;
+  return typeof value === "number" && Number.isFinite(value) ? String(value) : null;
+}
+function providerEmail(value) {
+  const email = text(value)?.toLowerCase() ?? null;
+  return email && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email) ? email : null;
+}
+function compactProviderIdentity(identity) {
+  return identity.id || identity.email || identity.name ? identity : null;
+}
+async function providerProxyJson(args) {
+  return nangoRequest(`/proxy${args.path}`, {
+    query: args.query,
+    headers: {
+      "connection-id": args.upstreamConnectionId,
+      "provider-config-key": args.providerConfigKey,
+      ...args.baseUrlOverride ? { "base-url-override": args.baseUrlOverride } : {}
+    }
+  });
+}
+async function googleProviderAccountIdentity(args) {
+  const request = (path6, query, baseUrlOverride) => providerProxyJson({ ...args, path: path6, query, baseUrlOverride });
+  try {
+    if (args.providerConfigKey === "google-mail") {
+      const payload = asRecord2(await request("/gmail/v1/users/me/profile", void 0, "https://gmail.googleapis.com"));
+      const email = providerEmail(payload?.emailAddress);
+      return compactProviderIdentity({ id: email, email, name: null });
+    }
+    if (args.providerConfigKey === "google-drive") {
+      const payload = asRecord2(await request("/drive/v3/about", { fields: "user(permissionId,displayName,emailAddress)" }, "https://www.googleapis.com"));
+      const user = asRecord2(payload?.user);
+      return compactProviderIdentity({
+        id: text(user?.permissionId),
+        email: providerEmail(user?.emailAddress),
+        name: text(user?.displayName)
+      });
+    }
+    if (args.providerConfigKey === "google-calendar") {
+      const payload = asRecord2(await request("/calendar/v3/calendars/primary", void 0, "https://www.googleapis.com"));
+      const id = text(payload?.id);
+      return compactProviderIdentity({ id, email: providerEmail(id), name: text(payload?.summary) });
+    }
+    if (args.providerConfigKey === "youtube") {
+      const payload = asRecord2(await request("/youtube/v3/channels", { part: "snippet", mine: "true", maxResults: 1 }, "https://www.googleapis.com"));
+      const first = Array.isArray(payload?.items) ? asRecord2(payload.items[0]) : null;
+      return compactProviderIdentity({ id: text(first?.id), email: null, name: text(asRecord2(first?.snippet)?.title) });
+    }
+  } catch {
+  }
+  try {
+    const payload = asRecord2(await request("/v1/userinfo", void 0, "https://openidconnect.googleapis.com"));
+    return compactProviderIdentity({
+      id: text(payload?.sub),
+      email: payload?.email_verified === false ? null : providerEmail(payload?.email),
+      name: text(payload?.name)
+    });
+  } catch {
+    return null;
+  }
+}
+async function getNangoProviderAccountIdentity(args) {
+  if (!IDENTITY_SUPPORTED_PROVIDERS.has(args.providerConfigKey)) return null;
+  if (args.providerConfigKey.startsWith("google-") || args.providerConfigKey === "youtube") {
+    return googleProviderAccountIdentity(args);
+  }
+  try {
+    if (args.providerConfigKey === "github-getting-started") {
+      const payload = asRecord2(await providerProxyJson({ ...args, path: "/user" }));
+      return compactProviderIdentity({ id: scalarId(payload?.id), email: providerEmail(payload?.email), name: text(payload?.name) ?? text(payload?.login) });
+    }
+    if (args.providerConfigKey === "slack") {
+      const payload = asRecord2(await providerProxyJson({ ...args, path: "/api/auth.test" }));
+      return compactProviderIdentity({ id: text(payload?.user_id), email: null, name: [text(payload?.user), text(payload?.team)].filter(Boolean).join(" \xB7 ") || null });
+    }
+    if (args.providerConfigKey === "zoom") {
+      const payload = asRecord2(await providerProxyJson({ ...args, path: "/v2/users/me" }));
+      const fullName = [text(payload?.first_name), text(payload?.last_name)].filter(Boolean).join(" ");
+      return compactProviderIdentity({ id: text(payload?.id), email: providerEmail(payload?.email), name: text(payload?.display_name) ?? (fullName || null) });
+    }
+    if (args.providerConfigKey === "linkedin") {
+      const payload = asRecord2(await providerProxyJson({ ...args, path: "/v2/userinfo" }));
+      return compactProviderIdentity({ id: text(payload?.sub), email: payload?.email_verified === false ? null : providerEmail(payload?.email), name: text(payload?.name) });
+    }
+    if (args.providerConfigKey === "meta-marketing-api" || args.providerConfigKey === "facebook") {
+      const payload = asRecord2(await providerProxyJson({ ...args, path: "/me", query: { fields: "id,name,email" } }));
+      return compactProviderIdentity({ id: text(payload?.id), email: providerEmail(payload?.email), name: text(payload?.name) });
+    }
+    if (args.providerConfigKey === "twitter-v2") {
+      const payload = asRecord2(await providerProxyJson({ ...args, path: "/2/users/me", query: { "user.fields": "id,name,username" } }));
+      const data = asRecord2(payload?.data);
+      return compactProviderIdentity({ id: text(data?.id), email: null, name: text(data?.username) ?? text(data?.name) });
+    }
+    if (args.providerConfigKey === "xero") {
+      const payload = await providerProxyJson({ ...args, path: "/connections" });
+      const first = Array.isArray(payload) ? asRecord2(payload[0]) : null;
+      return compactProviderIdentity({ id: text(first?.tenantId), email: null, name: text(first?.tenantName) });
+    }
+  } catch {
+    return null;
+  }
+  return null;
+}
+async function discoverOwnedNangoConnections(identity, options = {}) {
   const rows = [];
   for (let page = 0; page < NANGO_CONNECTION_MAX_PAGES; page += 1) {
     const payload = await nangoRequest("/connections", {
@@ -84469,6 +84659,35 @@ async function discoverOwnedNangoConnections(identity) {
     if (pageRows.length < NANGO_CONNECTION_PAGE_SIZE) break;
   }
   const discovered = rows.filter((row) => connectionIdentityMatches(row, identity)).map(discoveredConnection).filter((connection) => connection !== null);
+  const reconciled = await reconcileDiscoveredNangoConnections(identity, discovered);
+  if (options.resolveProviderIdentity === false) return reconciled;
+  const remoteByKey = new Map(discovered.map((connection) => [
+    `${connection.providerConfigKey}\0${connection.upstreamConnectionId}`,
+    connection
+  ]));
+  await Promise.all(reconciled.map(async (connection) => {
+    if (connection.lifecycleStatus !== "connected" || !connection.upstreamConnectionId) return;
+    const remote = remoteByKey.get(`${connection.providerConfigKey}\0${connection.upstreamConnectionId}`);
+    if (!remote) return;
+    const sourceUpdatedAt = remote.updatedAt ?? remote.createdAt ?? connection.lifecycleStatus;
+    const hasProviderIdentity = Boolean(
+      connection.providerAccountId || connection.providerAccountEmail || connection.providerAccountName
+    );
+    const checkedAt = connection.providerIdentityCheckedAt ? Date.parse(`${connection.providerIdentityCheckedAt.replace(" ", "T")}Z`) : Number.NaN;
+    const unavailableIdentityIsFresh = !hasProviderIdentity && Number.isFinite(checkedAt) && Date.now() - checkedAt < PROVIDER_IDENTITY_RETRY_MS;
+    if (connection.providerIdentitySourceUpdatedAt === sourceUpdatedAt && (hasProviderIdentity || unavailableIdentityIsFresh)) return;
+    const providerIdentity = await getNangoProviderAccountIdentity({
+      upstreamConnectionId: connection.upstreamConnectionId,
+      providerConfigKey: connection.providerConfigKey
+    });
+    await setServiceConnectionProviderIdentity({
+      connectionId: connection.id,
+      providerAccountId: providerIdentity?.id,
+      providerAccountEmail: providerIdentity?.email,
+      providerAccountName: providerIdentity?.name,
+      sourceUpdatedAt
+    });
+  }));
   return reconcileDiscoveredNangoConnections(identity, discovered);
 }
 async function listNangoCatalogDirect() {
@@ -84731,7 +84950,7 @@ async function describeNangoToolDirect(identity, connectionId, toolName) {
     fetchedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
 }
-var import_node_crypto68, import_client13, DEFAULT_NANGO_MCP_URL, NANGO_TIMEOUT_MS, NANGO_CONNECTION_PAGE_SIZE, NANGO_CONNECTION_MAX_PAGES, MAIN_INTEGRATION_CONTRACT_VERSION, MAIN_INTEGRATION_CONTRACT_HASH, MainNangoTransportError;
+var import_node_crypto68, import_client13, DEFAULT_NANGO_MCP_URL, NANGO_TIMEOUT_MS, NANGO_CONNECTION_PAGE_SIZE, NANGO_CONNECTION_MAX_PAGES, PROVIDER_IDENTITY_RETRY_MS, MAIN_INTEGRATION_CONTRACT_VERSION, MAIN_INTEGRATION_CONTRACT_HASH, MainNangoTransportError, IDENTITY_SUPPORTED_PROVIDERS;
 var init_main_nango_transport = __esm({
   "src/api/main-nango-transport.ts"() {
     "use strict";
@@ -84745,6 +84964,7 @@ var init_main_nango_transport = __esm({
     NANGO_TIMEOUT_MS = 2e4;
     NANGO_CONNECTION_PAGE_SIZE = 100;
     NANGO_CONNECTION_MAX_PAGES = 20;
+    PROVIDER_IDENTITY_RETRY_MS = 6 * 60 * 60 * 1e3;
     MAIN_INTEGRATION_CONTRACT_VERSION = "2026-07-16.1";
     MAIN_INTEGRATION_CONTRACT_HASH = "f037859ec80c2ea2fac6e4a67c1a59f3200dd22d3642c97789b9bb3236723d3e";
     MainNangoTransportError = class extends Error {
@@ -84761,6 +84981,22 @@ var init_main_nango_transport = __esm({
         this.retryAfterMs = retryAfterMs;
       }
     };
+    IDENTITY_SUPPORTED_PROVIDERS = /* @__PURE__ */ new Set([
+      "facebook",
+      "github-getting-started",
+      "google-analytics",
+      "google-calendar",
+      "google-drive",
+      "google-mail",
+      "google-search-console",
+      "linkedin",
+      "meta-marketing-api",
+      "slack",
+      "twitter-v2",
+      "xero",
+      "youtube",
+      "zoom"
+    ]);
   }
 });
 
@@ -85051,7 +85287,7 @@ async function getNangoConnections(identity, options = {}) {
   if (mainOwnsIntegrations()) {
     let connections;
     try {
-      connections = await discoverOwnedNangoConnections(identity);
+      connections = await discoverOwnedNangoConnections(identity, { resolveProviderIdentity: !options.summaryOnly });
     } catch (error) {
       try {
         connections = await listServiceConnections(identity, "nango");
@@ -85072,11 +85308,12 @@ async function getNangoConnections(identity, options = {}) {
         connectionId: connection.id,
         providerConfigKey: connection.providerConfigKey,
         provider: connection.provider,
-        label: connection.label || connection.providerConfigKey,
-        providerAccountId: null,
-        providerAccountEmail: null,
-        providerAccountName: null,
-        providerIdentityStatus: "unavailable",
+        label: connection.userLabel || connection.providerAccountEmail || connection.providerAccountName || (connection.label && connection.label.toLowerCase() !== identity.trim().toLowerCase() ? connection.label : null) || connection.providerConfigKey,
+        userLabel: connection.userLabel,
+        providerAccountId: connection.providerAccountId,
+        providerAccountEmail: connection.providerAccountEmail,
+        providerAccountName: connection.providerAccountName,
+        providerIdentityStatus: connection.providerIdentityCheckedAt ? connection.providerAccountId || connection.providerAccountEmail || connection.providerAccountName ? "verified" : "unavailable" : "pending",
         status: connection.reconnectRequired ? "needs_reauth" : "connected",
         lifecycleStatus: connection.lifecycleStatus,
         operationalStatus: connection.operationalStatus,
@@ -85177,6 +85414,7 @@ async function getNangoConnections(identity, options = {}) {
       providerConfigKey,
       provider,
       label,
+      userLabel: null,
       providerAccountId,
       providerAccountEmail,
       providerAccountName,
@@ -86952,6 +87190,7 @@ var init_server = __esm({
     init_scheduling_access();
     init_memory_db();
     init_nango_control();
+    init_service_connections();
     init_resend_control();
     init_scheduler_integration_auth();
     init_connected_account_billing();
@@ -87543,6 +87782,26 @@ var init_server = __esm({
         return scheduleConnectionError(c, err, "Unable to load service connections.");
       }
     });
+    app.patch("/schedule-connections/:id/label", auth4, async (c) => {
+      const user = c.get("user");
+      const body = await c.req.json().catch(() => ({}));
+      if (body.label !== null && typeof body.label !== "string") {
+        return c.json({ ok: false, error: "label must be a string or null." }, 400);
+      }
+      const label = typeof body.label === "string" ? body.label.normalize("NFKC").trim().replace(/\s+/g, " ") : null;
+      if (label && label.length > 80) {
+        return c.json({ ok: false, error: "label must contain at most 80 characters." }, 400);
+      }
+      try {
+        const userLabel = await setServiceConnectionUserLabel(user.email, c.req.param("id"), label || null);
+        return c.json({ ok: true, userLabel });
+      } catch (err) {
+        if (err instanceof Error && err.message === "service_connection_not_found") {
+          return c.json({ ok: false, error: "Service connection not found." }, 404);
+        }
+        return scheduleConnectionError(c, err, "Unable to rename this service connection.");
+      }
+    });
     app.post("/schedule-connections/billing/reconcile", auth4, requireIntegrationsTier, async (c) => {
       const user = c.get("user");
       try {
@@ -88101,6 +88360,7 @@ var init_server = __esm({
     app.post("/integrations/:id/reconnect-session", (c) => forwardIntegrationAlias(c, `/schedule-connections/${encodeURIComponent(c.req.param("id"))}/reconnect-session`));
     app.post("/integrations/:id/enable-actions", (c) => forwardIntegrationAlias(c, `/schedule-connections/${encodeURIComponent(c.req.param("id"))}/enable-actions`));
     app.post("/integrations/:id/test", (c) => forwardIntegrationAlias(c, `/schedule-connections/${encodeURIComponent(c.req.param("id"))}/test`));
+    app.patch("/integrations/:id/label", (c) => forwardIntegrationAlias(c, `/schedule-connections/${encodeURIComponent(c.req.param("id"))}/label`));
     app.delete("/integrations/:id", (c) => forwardIntegrationAlias(c, `/schedule-connections/${encodeURIComponent(c.req.param("id"))}`));
     app.post("/integrations/actions/read", (c) => forwardIntegrationAlias(c, "/schedule-connections/actions/read"));
     app.post("/integrations/actions/describe", (c) => forwardIntegrationAlias(c, "/schedule-connections/actions/describe"));

package/dist/bin/api-server.js

@@ -17,7 +17,7 @@ loadDotEnv();
 async function main() {
   const [{ serve }, { app }, { startWorker }, { migrate }] = await Promise.all([
     import("@hono/node-server"),
-    import("../server-Q7VYGSGQ.js"),
+    import("../server-YATQ3WHT.js"),
     import("../worker-UTBUWEXQ.js"),
     import("../db-4RVZ3NYZ.js")
   ]);

package/dist/bin/mcp-scraper-cli.cjs

@@ -30,7 +30,7 @@ var import_promises5 = require("fs/promises");
 var import_node_path3 = require("path");
 
 // src/version.ts
-var PACKAGE_VERSION = "0.66.2";
+var PACKAGE_VERSION = "0.66.4";
 
 // src/cli/agent-config.ts
 function apiKeyValue(options) {

package/dist/bin/mcp-scraper-cli.js

@@ -13,7 +13,7 @@ import "../chunk-VXLU74YZ.js";
 import "../chunk-GGZEC22A.js";
 import {
   PACKAGE_VERSION
-} from "../chunk-ALEBMPOW.js";
+} from "../chunk-EGNT3AY2.js";
 
 // src/cli/human-cli.ts
 import { Command } from "commander";

package/dist/bin/mcp-scraper-install.cjs

@@ -3,7 +3,7 @@
 
 // release-message.json
 var release_message_default = {
-  message: "PAA work now starts immediately on the direct runtime, and every MCP Scraper install exposes the same complete typed tool contract."
+  message: "Strict MCP clients now discover all 259 tools through a compact runtime catalog, while generated SDKs retain complete output types."
 };
 
 // src/install-terminal.ts
@@ -112,7 +112,7 @@ function renderInstallTerminal(options) {
 }
 
 // src/version.ts
-var PACKAGE_VERSION = "0.66.2";
+var PACKAGE_VERSION = "0.66.4";
 
 // bin/mcp-scraper-install.ts
 var noColor = process.argv.includes("--no-color") || process.env.NO_COLOR !== void 0 || process.env.FORCE_COLOR === "0" || !process.stdout.isTTY;

package/dist/bin/mcp-scraper-install.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   renderInstallTerminal
-} from "../chunk-OZDCTNUV.js";
+} from "../chunk-2XVDLF6H.js";
 import {
   PACKAGE_VERSION
-} from "../chunk-ALEBMPOW.js";
+} from "../chunk-EGNT3AY2.js";
 
 // bin/mcp-scraper-install.ts
 var noColor = process.argv.includes("--no-color") || process.env.NO_COLOR !== void 0 || process.env.FORCE_COLOR === "0" || !process.stdout.isTTY;

package/dist/bin/mcp-stdio-server.cjs

@@ -1232,7 +1232,7 @@ render();
 }
 
 // src/version.ts
-var PACKAGE_VERSION = "0.66.2";
+var PACKAGE_VERSION = "0.66.4";
 
 // src/mcp/input-field-descriptions.ts
 var import_zod = require("zod");
@@ -2237,10 +2237,26 @@ async function annotateReplayVideo(inputFilePath, outputFilePath, options) {
 }
 
 // src/mcp/output-schema-registry.ts
+function resolveOutputSchemaMode(env = process.env) {
+  const requested = env.MCP_SCRAPER_OUTPUT_SCHEMA_MODE?.trim().toLowerCase();
+  if (requested) {
+    if (requested === "contract" || requested === "all") return "contract";
+    if (requested === "runtime" || requested === "none" || requested === "essential") return "runtime";
+    throw new Error(`Unsupported MCP_SCRAPER_OUTPUT_SCHEMA_MODE: ${requested}`);
+  }
+  const legacyAdvertisement = env.MCP_SCRAPER_ADVERTISE_OUTPUT_SCHEMAS?.trim().toLowerCase();
+  if (legacyAdvertisement === "true") return "contract";
+  if (legacyAdvertisement === void 0 || legacyAdvertisement === "" || legacyAdvertisement === "false") {
+    return "runtime";
+  }
+  throw new Error(`Unsupported MCP_SCRAPER_ADVERTISE_OUTPUT_SCHEMAS value: ${legacyAdvertisement}`);
+}
+var OUTPUT_SCHEMA_MODE = resolveOutputSchemaMode();
+var ADVERTISE_OUTPUT_SCHEMAS = OUTPUT_SCHEMA_MODE === "contract";
 var OUTPUT_SCHEMAS = {};
 function recordOutputSchema(name, schema) {
   OUTPUT_SCHEMAS[name] = schema;
-  return schema;
+  return ADVERTISE_OUTPUT_SCHEMAS ? schema : void 0;
 }
 
 // src/mcp/browser-agent-mcp-server.ts
@@ -8392,10 +8408,10 @@ Multi-step orchestrations \u2014 prefer these over hand-chaining primitives when
   artifact, call \`report_artifact_read\` with the returned artifactId and follow nextOffset until null. This
   works through the authenticated MCP connection even when the client cannot open the signed download URL;
   do not try curl or web_fetch. Use \`archive_read\` for ZIP archives.
-- Before using a connected account, call \`list_service_connections\` and match the intended provider-side
-  identity from \`providerAccountEmail\` or \`providerAccountName\`, not the MCP Scraper login. If
-  \`providerIdentityStatus\` is \`unavailable\`, ask the person to refresh that connection before assuming
-  which external account it represents.
+- Before using a connected account, call \`list_service_connections\`. Match an explicit \`userLabel\` first,
+  then verified provider-side \`providerAccountEmail\`, \`providerAccountName\`, or \`providerAccountId\`; never
+  treat the MCP Scraper login as external-provider identity. If identity is pending or unavailable and no
+  distinct user label exists, ask the person which connection they mean instead of assuming.
 - For Google Search Console, use \`export_connected_service_data\` with
   \`dataset:"search_console_performance"\` when the person asks for a fresh JSONL download. When they
   ask to schedule ingestion or repeatedly filter historical rows, create a \`connection_sync\` schedule,
@@ -12048,7 +12064,12 @@ var ListServiceConnectionsOutputSchema = {
     connectionId: import_zod8.z.string(),
     providerConfigKey: import_zod8.z.string(),
     provider: import_zod8.z.string().nullable().optional(),
-    label: import_zod8.z.string(),
+    label: import_zod8.z.string().describe("Best available human-facing account label: a userLabel when set, otherwise verified provider identity, then a stable fallback."),
+    userLabel: import_zod8.z.string().nullable().optional().describe("Optional tenant-owned name set in the dashboard to distinguish this connection. This is not asserted provider identity."),
+    providerAccountId: import_zod8.z.string().nullable().optional().describe("Stable provider-side account, user, workspace, channel, or tenant identifier when the provider exposes one."),
+    providerAccountEmail: import_zod8.z.string().email().nullable().optional().describe("Verified provider-side email when the provider exposes one. This is never inferred from the MCP Scraper login."),
+    providerAccountName: import_zod8.z.string().nullable().optional().describe("Provider-side account, user, workspace, channel, or tenant name when the provider exposes one."),
+    providerIdentityStatus: import_zod8.z.enum(["pending", "verified", "unavailable"]).optional().describe("Whether provider identity discovery is pending, returned at least one verified provider identifier, or completed without one."),
     status: import_zod8.z.string(),
     lifecycleStatus: import_zod8.z.enum(["pending", "connected", "needs_reauth", "disconnecting", "disconnected"]).optional().describe("Credential lifecycle. This is separate from current provider availability."),
     operationalStatus: import_zod8.z.enum(["unknown", "available", "degraded", "unavailable"]).optional().describe("Last observed provider transport availability. Unavailable does not imply reconnect is required."),
@@ -14362,7 +14383,7 @@ function registerPaaExtractorMcpTools(server, executor, options = {}) {
   }, async (input) => formatCreditsInfo(await executor.creditsInfo(input), input));
   server.registerTool("list_service_connections", {
     title: "List Connected Services",
-    description: "List every service connection this MCP Scraper account has authorized, including Resend, GitHub, Google Analytics, Google Search Console, YouTube, Facebook Pages, LinkedIn, X, Meta Marketing, Slack, Gmail, Calendar, Google Drive, Zoom, Xero, and others. Returns the tenant-scoped connectionId, credential transport, exact live readTools and gated actionTools, permission-aware toolCapabilities with missing OAuth-grant or provider-app-feature blockers, permanently blocked administrative tools, and schema-discovery metadata. Get a connectionId and exact tool name here before calling describe_service_connection_tool, read_service_connection, or call_service_connection_action. Managed OAuth and official remote MCP connections use the same provider-neutral bridges; mutations still require the account action switch and an exact allowed action. A scheduled Search Console connection_sync creates a typed tenant-owned performance table; after it runs, use the returned tableName with table-describe and table-query instead of repeatedly calling Google for historical filtering.",
+    description: "List every service connection this MCP Scraper account has authorized, including Resend, GitHub, Google Analytics, Google Search Console, YouTube, Facebook Pages, LinkedIn, X, Meta Marketing, Slack, Gmail, Calendar, Google Drive, Zoom, Xero, and others. Returns the tenant-scoped connectionId; a tenant-owned userLabel; verified provider-side account ID, email, or name when available; credential transport; exact live readTools and gated actionTools; permission-aware toolCapabilities with missing OAuth-grant or provider-app-feature blockers; permanently blocked administrative tools; and schema-discovery metadata. Get a connectionId and exact tool name here before calling describe_service_connection_tool, read_service_connection, or call_service_connection_action. Managed OAuth and official remote MCP connections use the same provider-neutral bridges; mutations still require the account action switch and an exact allowed action. A scheduled Search Console connection_sync creates a typed tenant-owned performance table; after it runs, use the returned tableName with table-describe and table-query instead of repeatedly calling Google for historical filtering.",
     inputSchema: ListServiceConnectionsInputSchema,
     outputSchema: recordOutputSchema("list_service_connections", ListServiceConnectionsOutputSchema),
     annotations: { title: "List Connected Services", readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false }
@@ -18639,7 +18660,7 @@ var HostedMemoryMcpToolExecutor = class {
 
 // release-message.json
 var release_message_default = {
-  message: "PAA work now starts immediately on the direct runtime, and every MCP Scraper install exposes the same complete typed tool contract."
+  message: "Strict MCP clients now discover all 259 tools through a compact runtime catalog, while generated SDKs retain complete output types."
 };
 
 // src/install-terminal.ts

package/dist/bin/mcp-stdio-server.js

@@ -13,18 +13,18 @@ import {
   registerScheduledResultsMcpTools,
   registerSerpIntelligenceCaptureTools,
   resolveDeploymentProfile
-} from "../chunk-YKL3O7IU.js";
+} from "../chunk-UPN4W4SV.js";
 import "../chunk-PGJQDMC2.js";
 import "../chunk-3EYALCYK.js";
 import "../chunk-3TKKJQB4.js";
 import {
   renderInstallTerminal
-} from "../chunk-OZDCTNUV.js";
+} from "../chunk-2XVDLF6H.js";
 import "../chunk-VXLU74YZ.js";
 import "../chunk-GGZEC22A.js";
 import {
   PACKAGE_VERSION
-} from "../chunk-ALEBMPOW.js";
+} from "../chunk-EGNT3AY2.js";
 import "../chunk-DNM65UCK.js";
 import "../chunk-AYJHI2FK.js";
 import "../chunk-55B3T5L2.js";

package/dist/{chunk-OZDCTNUV.js → chunk-2XVDLF6H.js}

@@ -1,6 +1,6 @@
 // release-message.json
 var release_message_default = {
-  message: "PAA work now starts immediately on the direct runtime, and every MCP Scraper install exposes the same complete typed tool contract."
+  message: "Strict MCP clients now discover all 259 tools through a compact runtime catalog, while generated SDKs retain complete output types."
 };
 
 // src/install-terminal.ts

package/dist/{chunk-ALEBMPOW.js → chunk-EGNT3AY2.js}

@@ -1,5 +1,5 @@
 // src/version.ts
-var PACKAGE_VERSION = "0.66.2";
+var PACKAGE_VERSION = "0.66.4";
 
 export {
   PACKAGE_VERSION

package/dist/{chunk-YKL3O7IU.js → chunk-UPN4W4SV.js}

@@ -25,7 +25,7 @@ import {
 } from "./chunk-VXLU74YZ.js";
 import {
   PACKAGE_VERSION
-} from "./chunk-ALEBMPOW.js";
+} from "./chunk-EGNT3AY2.js";
 import {
   createPrivateArtifact,
   privateArtifactOwnerId,
@@ -580,10 +580,10 @@ Multi-step orchestrations \u2014 prefer these over hand-chaining primitives when
   artifact, call \`report_artifact_read\` with the returned artifactId and follow nextOffset until null. This
   works through the authenticated MCP connection even when the client cannot open the signed download URL;
   do not try curl or web_fetch. Use \`archive_read\` for ZIP archives.
-- Before using a connected account, call \`list_service_connections\` and match the intended provider-side
-  identity from \`providerAccountEmail\` or \`providerAccountName\`, not the MCP Scraper login. If
-  \`providerIdentityStatus\` is \`unavailable\`, ask the person to refresh that connection before assuming
-  which external account it represents.
+- Before using a connected account, call \`list_service_connections\`. Match an explicit \`userLabel\` first,
+  then verified provider-side \`providerAccountEmail\`, \`providerAccountName\`, or \`providerAccountId\`; never
+  treat the MCP Scraper login as external-provider identity. If identity is pending or unavailable and no
+  distinct user label exists, ask the person which connection they mean instead of assuming.
 - For Google Search Console, use \`export_connected_service_data\` with
   \`dataset:"search_console_performance"\` when the person asks for a fresh JSONL download. When they
   ask to schedule ingestion or repeatedly filter historical rows, create a \`connection_sync\` schedule,
@@ -5006,10 +5006,26 @@ ${rows}` : ""
 }
 
 // src/mcp/output-schema-registry.ts
+function resolveOutputSchemaMode(env = process.env) {
+  const requested = env.MCP_SCRAPER_OUTPUT_SCHEMA_MODE?.trim().toLowerCase();
+  if (requested) {
+    if (requested === "contract" || requested === "all") return "contract";
+    if (requested === "runtime" || requested === "none" || requested === "essential") return "runtime";
+    throw new Error(`Unsupported MCP_SCRAPER_OUTPUT_SCHEMA_MODE: ${requested}`);
+  }
+  const legacyAdvertisement = env.MCP_SCRAPER_ADVERTISE_OUTPUT_SCHEMAS?.trim().toLowerCase();
+  if (legacyAdvertisement === "true") return "contract";
+  if (legacyAdvertisement === void 0 || legacyAdvertisement === "" || legacyAdvertisement === "false") {
+    return "runtime";
+  }
+  throw new Error(`Unsupported MCP_SCRAPER_ADVERTISE_OUTPUT_SCHEMAS value: ${legacyAdvertisement}`);
+}
+var OUTPUT_SCHEMA_MODE = resolveOutputSchemaMode();
+var ADVERTISE_OUTPUT_SCHEMAS = OUTPUT_SCHEMA_MODE === "contract";
 var OUTPUT_SCHEMAS = {};
 function recordOutputSchema(name, schema) {
   OUTPUT_SCHEMAS[name] = schema;
-  return schema;
+  return ADVERTISE_OUTPUT_SCHEMAS ? schema : void 0;
 }
 
 // src/mcp/meta-ad-creative-media.ts
@@ -9426,7 +9442,12 @@ var ListServiceConnectionsOutputSchema = {
     connectionId: z6.string(),
     providerConfigKey: z6.string(),
     provider: z6.string().nullable().optional(),
-    label: z6.string(),
+    label: z6.string().describe("Best available human-facing account label: a userLabel when set, otherwise verified provider identity, then a stable fallback."),
+    userLabel: z6.string().nullable().optional().describe("Optional tenant-owned name set in the dashboard to distinguish this connection. This is not asserted provider identity."),
+    providerAccountId: z6.string().nullable().optional().describe("Stable provider-side account, user, workspace, channel, or tenant identifier when the provider exposes one."),
+    providerAccountEmail: z6.string().email().nullable().optional().describe("Verified provider-side email when the provider exposes one. This is never inferred from the MCP Scraper login."),
+    providerAccountName: z6.string().nullable().optional().describe("Provider-side account, user, workspace, channel, or tenant name when the provider exposes one."),
+    providerIdentityStatus: z6.enum(["pending", "verified", "unavailable"]).optional().describe("Whether provider identity discovery is pending, returned at least one verified provider identifier, or completed without one."),
     status: z6.string(),
     lifecycleStatus: z6.enum(["pending", "connected", "needs_reauth", "disconnecting", "disconnected"]).optional().describe("Credential lifecycle. This is separate from current provider availability."),
     operationalStatus: z6.enum(["unknown", "available", "degraded", "unavailable"]).optional().describe("Last observed provider transport availability. Unavailable does not imply reconnect is required."),
@@ -11871,7 +11892,7 @@ function registerPaaExtractorMcpTools(server, executor, options = {}) {
   }, async (input) => formatCreditsInfo(await executor.creditsInfo(input), input));
   server.registerTool("list_service_connections", {
     title: "List Connected Services",
-    description: "List every service connection this MCP Scraper account has authorized, including Resend, GitHub, Google Analytics, Google Search Console, YouTube, Facebook Pages, LinkedIn, X, Meta Marketing, Slack, Gmail, Calendar, Google Drive, Zoom, Xero, and others. Returns the tenant-scoped connectionId, credential transport, exact live readTools and gated actionTools, permission-aware toolCapabilities with missing OAuth-grant or provider-app-feature blockers, permanently blocked administrative tools, and schema-discovery metadata. Get a connectionId and exact tool name here before calling describe_service_connection_tool, read_service_connection, or call_service_connection_action. Managed OAuth and official remote MCP connections use the same provider-neutral bridges; mutations still require the account action switch and an exact allowed action. A scheduled Search Console connection_sync creates a typed tenant-owned performance table; after it runs, use the returned tableName with table-describe and table-query instead of repeatedly calling Google for historical filtering.",
+    description: "List every service connection this MCP Scraper account has authorized, including Resend, GitHub, Google Analytics, Google Search Console, YouTube, Facebook Pages, LinkedIn, X, Meta Marketing, Slack, Gmail, Calendar, Google Drive, Zoom, Xero, and others. Returns the tenant-scoped connectionId; a tenant-owned userLabel; verified provider-side account ID, email, or name when available; credential transport; exact live readTools and gated actionTools; permission-aware toolCapabilities with missing OAuth-grant or provider-app-feature blockers; permanently blocked administrative tools; and schema-discovery metadata. Get a connectionId and exact tool name here before calling describe_service_connection_tool, read_service_connection, or call_service_connection_action. Managed OAuth and official remote MCP connections use the same provider-neutral bridges; mutations still require the account action switch and an exact allowed action. A scheduled Search Console connection_sync creates a typed tenant-owned performance table; after it runs, use the returned tableName with table-describe and table-query instead of repeatedly calling Google for historical filtering.",
     inputSchema: ListServiceConnectionsInputSchema,
     outputSchema: recordOutputSchema("list_service_connections", ListServiceConnectionsOutputSchema),
     annotations: { title: "List Connected Services", readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false }

package/dist/{server-Q7VYGSGQ.js → server-YATQ3WHT.js}

@@ -199,7 +199,7 @@ import {
   resolveDeploymentProfile,
   resolveLocalSourcebookSchemaType,
   transcribeMediaUrl
-} from "./chunk-YKL3O7IU.js";
+} from "./chunk-UPN4W4SV.js";
 import {
   auditImageUrls,
   auditImages,
@@ -256,7 +256,7 @@ import {
 } from "./chunk-GGZEC22A.js";
 import {
   PACKAGE_VERSION
-} from "./chunk-ALEBMPOW.js";
+} from "./chunk-EGNT3AY2.js";
 import {
   SITE_EXTRACT_ARTIFACT_PREFIX,
   abandonExtractSettlement,
@@ -41109,6 +41109,12 @@ function ensureServiceConnectionsSchema() {
         transport                  TEXT NOT NULL,
         upstream_connection_id     TEXT,
         label                      TEXT,
+        user_label                 TEXT,
+        provider_account_id        TEXT,
+        provider_account_email     TEXT,
+        provider_account_name      TEXT,
+        provider_identity_checked_at TEXT,
+        provider_identity_source_updated_at TEXT,
         lifecycle_status           TEXT NOT NULL DEFAULT 'pending',
         operational_status         TEXT NOT NULL DEFAULT 'unknown',
         reconnect_required         INTEGER NOT NULL DEFAULT 0,
@@ -41130,6 +41136,30 @@ function ensureServiceConnectionsSchema() {
         UNIQUE(user_id, provider_config_key, upstream_connection_id)
       )
     `);
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN user_label TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_account_id TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_account_email TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_account_name TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_identity_checked_at TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_identity_source_updated_at TEXT`);
+    } catch {
+    }
     await db.execute(`CREATE INDEX IF NOT EXISTS service_connections_user_updated ON service_connections(user_id, updated_at DESC)`);
     await db.execute(`CREATE INDEX IF NOT EXISTS service_connections_upstream ON service_connections(provider_config_key, upstream_connection_id)`);
     await db.execute(`
@@ -41190,6 +41220,12 @@ function rowToRecord(row) {
     transport: row.transport === "remote_mcp" ? "remote_mcp" : "nango",
     upstreamConnectionId: typeof row.upstream_connection_id === "string" ? row.upstream_connection_id : null,
     label: typeof row.label === "string" ? row.label : null,
+    userLabel: typeof row.user_label === "string" ? row.user_label : null,
+    providerAccountId: typeof row.provider_account_id === "string" ? row.provider_account_id : null,
+    providerAccountEmail: typeof row.provider_account_email === "string" ? row.provider_account_email : null,
+    providerAccountName: typeof row.provider_account_name === "string" ? row.provider_account_name : null,
+    providerIdentityCheckedAt: typeof row.provider_identity_checked_at === "string" ? row.provider_identity_checked_at : null,
+    providerIdentitySourceUpdatedAt: typeof row.provider_identity_source_updated_at === "string" ? row.provider_identity_source_updated_at : null,
     lifecycleStatus: String(row.lifecycle_status),
     operationalStatus: String(row.operational_status),
     reconnectRequired: Number(row.reconnect_required) === 1,
@@ -41275,6 +41311,34 @@ async function updateServiceConnectionTools(connectionId, readTools, actionTools
     args: [JSON.stringify(readTools), JSON.stringify(actionTools), toolRevision, connectionId]
   });
 }
+async function setServiceConnectionProviderIdentity(args) {
+  await ensureServiceConnectionsSchema();
+  await getDb().execute({
+    sql: `
+      UPDATE service_connections SET
+        provider_account_id = ?, provider_account_email = ?, provider_account_name = ?,
+        provider_identity_checked_at = datetime('now'), provider_identity_source_updated_at = ?,
+        updated_at = datetime('now')
+      WHERE id = ?
+    `,
+    args: [
+      args.providerAccountId ?? null,
+      args.providerAccountEmail?.toLowerCase() ?? null,
+      args.providerAccountName ?? null,
+      args.sourceUpdatedAt,
+      args.connectionId
+    ]
+  });
+}
+async function setServiceConnectionUserLabel(identity, connectionId, userLabel) {
+  const connection = await getOwnedServiceConnection(identity, connectionId);
+  if (!connection || connection.lifecycleStatus === "disconnected") throw new Error("service_connection_not_found");
+  await getDb().execute({
+    sql: `UPDATE service_connections SET user_label = ?, updated_at = datetime('now') WHERE id = ? AND user_id = ?`,
+    args: [userLabel, connectionId, connection.userId]
+  });
+  return userLabel;
+}
 async function recordServiceConnectionHealth(args) {
   await ensureServiceConnectionsSchema();
   const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -44114,6 +44178,7 @@ var DEFAULT_NANGO_MCP_URL = "https://api.nango.dev/mcp";
 var NANGO_TIMEOUT_MS = 2e4;
 var NANGO_CONNECTION_PAGE_SIZE = 100;
 var NANGO_CONNECTION_MAX_PAGES = 20;
+var PROVIDER_IDENTITY_RETRY_MS = 6 * 60 * 60 * 1e3;
 var MAIN_INTEGRATION_CONTRACT_VERSION = "2026-07-16.1";
 var MAIN_INTEGRATION_CONTRACT_HASH = "f037859ec80c2ea2fac6e4a67c1a59f3200dd22d3642c97789b9bb3236723d3e";
 var MainNangoTransportError = class extends Error {
@@ -44217,7 +44282,8 @@ async function nangoRequest(path5, options = {}) {
       headers: {
         authorization: `Bearer ${nangoSecret()}`,
         accept: "application/json",
-        ...options.body ? { "content-type": "application/json" } : {}
+        ...options.body ? { "content-type": "application/json" } : {},
+        ...options.headers
       },
       body: options.body ? JSON.stringify(options.body) : void 0,
       signal: AbortSignal.timeout(NANGO_TIMEOUT_MS)
@@ -44265,22 +44331,142 @@ function discoveredConnection(value) {
   const upstreamConnectionId = text(row?.connection_id);
   const providerConfigKey = text(row?.provider_config_key);
   if (!upstreamConnectionId || !providerConfigKey) return null;
-  const tags = asRecord(row?.tags);
-  const endUser = asRecord(row?.end_user);
   const errors = Array.isArray(row?.errors) ? row.errors : [];
   const authError = errors.some((error) => text(asRecord(error)?.type) === "auth");
   return {
     upstreamConnectionId,
     providerConfigKey,
     provider: text(row?.provider) ?? providerConfigKey,
-    label: text(tags?.end_user_display_name) ?? text(endUser?.display_name) ?? text(tags?.end_user_email) ?? text(endUser?.email),
+    // Nango's end-user fields identify the MCP Scraper tenant, not the
+    // provider-side principal that authorized this connection.
+    label: null,
     lifecycleStatus: authError ? "needs_reauth" : "connected",
     reconnectRequired: authError,
     createdAt: text(row?.created_at) ?? text(row?.created),
     updatedAt: text(row?.updated_at)
   };
 }
-async function discoverOwnedNangoConnections(identity) {
+var IDENTITY_SUPPORTED_PROVIDERS = /* @__PURE__ */ new Set([
+  "facebook",
+  "github-getting-started",
+  "google-analytics",
+  "google-calendar",
+  "google-drive",
+  "google-mail",
+  "google-search-console",
+  "linkedin",
+  "meta-marketing-api",
+  "slack",
+  "twitter-v2",
+  "xero",
+  "youtube",
+  "zoom"
+]);
+function scalarId(value) {
+  const valueText = text(value);
+  if (valueText) return valueText;
+  return typeof value === "number" && Number.isFinite(value) ? String(value) : null;
+}
+function providerEmail(value) {
+  const email = text(value)?.toLowerCase() ?? null;
+  return email && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email) ? email : null;
+}
+function compactProviderIdentity(identity) {
+  return identity.id || identity.email || identity.name ? identity : null;
+}
+async function providerProxyJson(args) {
+  return nangoRequest(`/proxy${args.path}`, {
+    query: args.query,
+    headers: {
+      "connection-id": args.upstreamConnectionId,
+      "provider-config-key": args.providerConfigKey,
+      ...args.baseUrlOverride ? { "base-url-override": args.baseUrlOverride } : {}
+    }
+  });
+}
+async function googleProviderAccountIdentity(args) {
+  const request = (path5, query, baseUrlOverride) => providerProxyJson({ ...args, path: path5, query, baseUrlOverride });
+  try {
+    if (args.providerConfigKey === "google-mail") {
+      const payload = asRecord(await request("/gmail/v1/users/me/profile", void 0, "https://gmail.googleapis.com"));
+      const email = providerEmail(payload?.emailAddress);
+      return compactProviderIdentity({ id: email, email, name: null });
+    }
+    if (args.providerConfigKey === "google-drive") {
+      const payload = asRecord(await request("/drive/v3/about", { fields: "user(permissionId,displayName,emailAddress)" }, "https://www.googleapis.com"));
+      const user = asRecord(payload?.user);
+      return compactProviderIdentity({
+        id: text(user?.permissionId),
+        email: providerEmail(user?.emailAddress),
+        name: text(user?.displayName)
+      });
+    }
+    if (args.providerConfigKey === "google-calendar") {
+      const payload = asRecord(await request("/calendar/v3/calendars/primary", void 0, "https://www.googleapis.com"));
+      const id = text(payload?.id);
+      return compactProviderIdentity({ id, email: providerEmail(id), name: text(payload?.summary) });
+    }
+    if (args.providerConfigKey === "youtube") {
+      const payload = asRecord(await request("/youtube/v3/channels", { part: "snippet", mine: "true", maxResults: 1 }, "https://www.googleapis.com"));
+      const first = Array.isArray(payload?.items) ? asRecord(payload.items[0]) : null;
+      return compactProviderIdentity({ id: text(first?.id), email: null, name: text(asRecord(first?.snippet)?.title) });
+    }
+  } catch {
+  }
+  try {
+    const payload = asRecord(await request("/v1/userinfo", void 0, "https://openidconnect.googleapis.com"));
+    return compactProviderIdentity({
+      id: text(payload?.sub),
+      email: payload?.email_verified === false ? null : providerEmail(payload?.email),
+      name: text(payload?.name)
+    });
+  } catch {
+    return null;
+  }
+}
+async function getNangoProviderAccountIdentity(args) {
+  if (!IDENTITY_SUPPORTED_PROVIDERS.has(args.providerConfigKey)) return null;
+  if (args.providerConfigKey.startsWith("google-") || args.providerConfigKey === "youtube") {
+    return googleProviderAccountIdentity(args);
+  }
+  try {
+    if (args.providerConfigKey === "github-getting-started") {
+      const payload = asRecord(await providerProxyJson({ ...args, path: "/user" }));
+      return compactProviderIdentity({ id: scalarId(payload?.id), email: providerEmail(payload?.email), name: text(payload?.name) ?? text(payload?.login) });
+    }
+    if (args.providerConfigKey === "slack") {
+      const payload = asRecord(await providerProxyJson({ ...args, path: "/api/auth.test" }));
+      return compactProviderIdentity({ id: text(payload?.user_id), email: null, name: [text(payload?.user), text(payload?.team)].filter(Boolean).join(" \xB7 ") || null });
+    }
+    if (args.providerConfigKey === "zoom") {
+      const payload = asRecord(await providerProxyJson({ ...args, path: "/v2/users/me" }));
+      const fullName = [text(payload?.first_name), text(payload?.last_name)].filter(Boolean).join(" ");
+      return compactProviderIdentity({ id: text(payload?.id), email: providerEmail(payload?.email), name: text(payload?.display_name) ?? (fullName || null) });
+    }
+    if (args.providerConfigKey === "linkedin") {
+      const payload = asRecord(await providerProxyJson({ ...args, path: "/v2/userinfo" }));
+      return compactProviderIdentity({ id: text(payload?.sub), email: payload?.email_verified === false ? null : providerEmail(payload?.email), name: text(payload?.name) });
+    }
+    if (args.providerConfigKey === "meta-marketing-api" || args.providerConfigKey === "facebook") {
+      const payload = asRecord(await providerProxyJson({ ...args, path: "/me", query: { fields: "id,name,email" } }));
+      return compactProviderIdentity({ id: text(payload?.id), email: providerEmail(payload?.email), name: text(payload?.name) });
+    }
+    if (args.providerConfigKey === "twitter-v2") {
+      const payload = asRecord(await providerProxyJson({ ...args, path: "/2/users/me", query: { "user.fields": "id,name,username" } }));
+      const data = asRecord(payload?.data);
+      return compactProviderIdentity({ id: text(data?.id), email: null, name: text(data?.username) ?? text(data?.name) });
+    }
+    if (args.providerConfigKey === "xero") {
+      const payload = await providerProxyJson({ ...args, path: "/connections" });
+      const first = Array.isArray(payload) ? asRecord(payload[0]) : null;
+      return compactProviderIdentity({ id: text(first?.tenantId), email: null, name: text(first?.tenantName) });
+    }
+  } catch {
+    return null;
+  }
+  return null;
+}
+async function discoverOwnedNangoConnections(identity, options = {}) {
   const rows = [];
   for (let page = 0; page < NANGO_CONNECTION_MAX_PAGES; page += 1) {
     const payload = await nangoRequest("/connections", {
@@ -44291,6 +44477,35 @@ async function discoverOwnedNangoConnections(identity) {
     if (pageRows.length < NANGO_CONNECTION_PAGE_SIZE) break;
   }
   const discovered = rows.filter((row) => connectionIdentityMatches(row, identity)).map(discoveredConnection).filter((connection) => connection !== null);
+  const reconciled = await reconcileDiscoveredNangoConnections(identity, discovered);
+  if (options.resolveProviderIdentity === false) return reconciled;
+  const remoteByKey = new Map(discovered.map((connection) => [
+    `${connection.providerConfigKey}\0${connection.upstreamConnectionId}`,
+    connection
+  ]));
+  await Promise.all(reconciled.map(async (connection) => {
+    if (connection.lifecycleStatus !== "connected" || !connection.upstreamConnectionId) return;
+    const remote = remoteByKey.get(`${connection.providerConfigKey}\0${connection.upstreamConnectionId}`);
+    if (!remote) return;
+    const sourceUpdatedAt = remote.updatedAt ?? remote.createdAt ?? connection.lifecycleStatus;
+    const hasProviderIdentity = Boolean(
+      connection.providerAccountId || connection.providerAccountEmail || connection.providerAccountName
+    );
+    const checkedAt = connection.providerIdentityCheckedAt ? Date.parse(`${connection.providerIdentityCheckedAt.replace(" ", "T")}Z`) : Number.NaN;
+    const unavailableIdentityIsFresh = !hasProviderIdentity && Number.isFinite(checkedAt) && Date.now() - checkedAt < PROVIDER_IDENTITY_RETRY_MS;
+    if (connection.providerIdentitySourceUpdatedAt === sourceUpdatedAt && (hasProviderIdentity || unavailableIdentityIsFresh)) return;
+    const providerIdentity = await getNangoProviderAccountIdentity({
+      upstreamConnectionId: connection.upstreamConnectionId,
+      providerConfigKey: connection.providerConfigKey
+    });
+    await setServiceConnectionProviderIdentity({
+      connectionId: connection.id,
+      providerAccountId: providerIdentity?.id,
+      providerAccountEmail: providerIdentity?.email,
+      providerAccountName: providerIdentity?.name,
+      sourceUpdatedAt
+    });
+  }));
   return reconcileDiscoveredNangoConnections(identity, discovered);
 }
 async function listNangoCatalogDirect() {
@@ -44965,7 +45180,7 @@ async function getNangoConnections(identity, options = {}) {
   if (mainOwnsIntegrations()) {
     let connections;
     try {
-      connections = await discoverOwnedNangoConnections(identity);
+      connections = await discoverOwnedNangoConnections(identity, { resolveProviderIdentity: !options.summaryOnly });
     } catch (error) {
       try {
         connections = await listServiceConnections(identity, "nango");
@@ -44986,11 +45201,12 @@ async function getNangoConnections(identity, options = {}) {
         connectionId: connection.id,
         providerConfigKey: connection.providerConfigKey,
         provider: connection.provider,
-        label: connection.label || connection.providerConfigKey,
-        providerAccountId: null,
-        providerAccountEmail: null,
-        providerAccountName: null,
-        providerIdentityStatus: "unavailable",
+        label: connection.userLabel || connection.providerAccountEmail || connection.providerAccountName || (connection.label && connection.label.toLowerCase() !== identity.trim().toLowerCase() ? connection.label : null) || connection.providerConfigKey,
+        userLabel: connection.userLabel,
+        providerAccountId: connection.providerAccountId,
+        providerAccountEmail: connection.providerAccountEmail,
+        providerAccountName: connection.providerAccountName,
+        providerIdentityStatus: connection.providerIdentityCheckedAt ? connection.providerAccountId || connection.providerAccountEmail || connection.providerAccountName ? "verified" : "unavailable" : "pending",
         status: connection.reconnectRequired ? "needs_reauth" : "connected",
         lifecycleStatus: connection.lifecycleStatus,
         operationalStatus: connection.operationalStatus,
@@ -45091,6 +45307,7 @@ async function getNangoConnections(identity, options = {}) {
       providerConfigKey,
       provider,
       label,
+      userLabel: null,
       providerAccountId,
       providerAccountEmail,
       providerAccountName,
@@ -46932,6 +47149,26 @@ app.get("/schedule-connections", auth4, async (c) => {
     return scheduleConnectionError(c, err, "Unable to load service connections.");
   }
 });
+app.patch("/schedule-connections/:id/label", auth4, async (c) => {
+  const user = c.get("user");
+  const body = await c.req.json().catch(() => ({}));
+  if (body.label !== null && typeof body.label !== "string") {
+    return c.json({ ok: false, error: "label must be a string or null." }, 400);
+  }
+  const label = typeof body.label === "string" ? body.label.normalize("NFKC").trim().replace(/\s+/g, " ") : null;
+  if (label && label.length > 80) {
+    return c.json({ ok: false, error: "label must contain at most 80 characters." }, 400);
+  }
+  try {
+    const userLabel = await setServiceConnectionUserLabel(user.email, c.req.param("id"), label || null);
+    return c.json({ ok: true, userLabel });
+  } catch (err) {
+    if (err instanceof Error && err.message === "service_connection_not_found") {
+      return c.json({ ok: false, error: "Service connection not found." }, 404);
+    }
+    return scheduleConnectionError(c, err, "Unable to rename this service connection.");
+  }
+});
 app.post("/schedule-connections/billing/reconcile", auth4, requireIntegrationsTier, async (c) => {
   const user = c.get("user");
   try {
@@ -47518,6 +47755,7 @@ app.post("/integrations/billing/reconcile", (c) => forwardIntegrationAlias(c, "/
 app.post("/integrations/:id/reconnect-session", (c) => forwardIntegrationAlias(c, `/schedule-connections/${encodeURIComponent(c.req.param("id"))}/reconnect-session`));
 app.post("/integrations/:id/enable-actions", (c) => forwardIntegrationAlias(c, `/schedule-connections/${encodeURIComponent(c.req.param("id"))}/enable-actions`));
 app.post("/integrations/:id/test", (c) => forwardIntegrationAlias(c, `/schedule-connections/${encodeURIComponent(c.req.param("id"))}/test`));
+app.patch("/integrations/:id/label", (c) => forwardIntegrationAlias(c, `/schedule-connections/${encodeURIComponent(c.req.param("id"))}/label`));
 app.delete("/integrations/:id", (c) => forwardIntegrationAlias(c, `/schedule-connections/${encodeURIComponent(c.req.param("id"))}`));
 app.post("/integrations/actions/read", (c) => forwardIntegrationAlias(c, "/schedule-connections/actions/read"));
 app.post("/integrations/actions/describe", (c) => forwardIntegrationAlias(c, "/schedule-connections/actions/describe"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-scraper",
-  "version": "0.66.2",
+  "version": "0.66.4",
   "description": "MCP server for MCP Scraper web intelligence tools",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -37,6 +37,7 @@
     "build": "tsup",
     "build:md": "node scripts/build-md-mirror.mjs",
     "build:mcpb": "npm run build && node scripts/build-mcpb.mjs",
+    "build:mcpb:candidate": "npm run build && node scripts/build-mcpb.mjs --candidate",
     "build:rates": "node --import tsx scripts/gen-rates.ts",
     "build:geotargets": "node --import tsx scripts/gen-geotargets.ts",
     "build:blog": "node scripts/run-ts-sandbox-safe.mjs scripts/build-blog.ts",
@@ -79,7 +80,8 @@
     "db:migrate": "node --import tsx scripts/run-core-migration.ts",
     "analytics:migrate": "node --import tsx scripts/run-analytics-migration.ts",
     "analytics:rollups": "node --import tsx scripts/run-analytics-rollups.ts",
-    "mcp:verify": "npm run build && npm run mcp:manifest && npm run build:rates && npm run mcp:measure-catalog && npm run mcp:lint-tools && npm run typecheck && npm test && npm run package:verify-entrypoints",
+    "test:mcp-output-contract": "vitest run --config vitest.mcp-output-contract.config.ts tests/unit/golden-payloads.test.ts tests/unit/mcp-formatter-structured.test.ts tests/unit/mcp-2026-stdio.test.ts",
+    "mcp:verify": "npm run build && npm run mcp:manifest && npm run build:rates && npm run mcp:measure-catalog && npm run mcp:lint-tools && npm run test:mcp-output-contract && npm run typecheck && npm test && npm run package:verify-entrypoints",
     "prepack": "npm run mcp:verify",
     "package:verify-entrypoints": "node scripts/verify-package-entrypoints.mjs"
   },