mcp-scraper 0.66.3 → 0.66.4

package/CHANGELOG.md

@@ -4,6 +4,17 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 
 ## [Unreleased]
 
+## [0.66.4] - 2026-08-25
+
+### Added
+
+- Connected-service discovery now returns a tenant-owned `userLabel` plus verified provider account ID, email, name, and identity status so agents can select the intended account when one integration has multiple connections.
+- Managed OAuth connections now retain non-secret provider identity metadata and support owner-scoped account names through the dashboard API.
+
+### Fixed
+
+- Nango tenant tags are no longer presented as the external provider account, preventing the MCP Scraper login from being mistaken for the Google, Slack, GitHub, Zoom, or other authorized identity.
+
 ## [0.66.3] - 2026-08-25
 
 ### Changed
@@ -1098,7 +1109,8 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 - Write actions remain unavailable until the account owner explicitly enables them.
 - Provider-specific connection data is normalized into one agent-facing contract.
 
-[Unreleased]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.66.3...HEAD
+[Unreleased]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.66.4...HEAD
+[0.66.4]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.66.3...v0.66.4
 [0.66.3]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.66.2...v0.66.3
 [0.66.2]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.66.1...v0.66.2
 [0.66.1]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.66.0...v0.66.1

package/README.md

@@ -159,7 +159,7 @@ Build the branded one-click bundle:
 npm run build:mcpb
 ```
 
-The generated bundle is written to `build/mcpb/mcp-scraper-<version>.mcpb` and copied to `public/downloads/` for the hosted download. The current public bundle is `https://mcpscraper.dev/downloads/mcp-scraper.mcpb` (`0.66.3`, SHA-256 `353b034b878340971fc1e07ca2ccf11578d6fd2e2ff894c8da1fa7df2c2bbd2d`). Install it by opening or dragging it into Claude Desktop. Claude displays the `MCP Scraper` install card, icon, API-key configuration field, and manually curated current-release message from the bundle manifest.
+The generated bundle is written to `build/mcpb/mcp-scraper-<version>.mcpb` and copied to `public/downloads/` for the hosted download. The current public bundle is `https://mcpscraper.dev/downloads/mcp-scraper.mcpb` (`0.66.4`, SHA-256 `53fa34844c0a030c9777cb0e62d547c446ebf6f553f0a850d33bd0aa4185f73c`). Install it by opening or dragging it into Claude Desktop. Claude displays the `MCP Scraper` install card, icon, API-key configuration field, and manually curated current-release message from the bundle manifest.
 
 The MCPB install exposes every tool — web-intelligence plus all `browser_*` tools — through the one `mcp-scraper` server.
 

package/dist/bin/api-server.cjs

@@ -49679,7 +49679,7 @@ var PACKAGE_VERSION;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    PACKAGE_VERSION = "0.66.3";
+    PACKAGE_VERSION = "0.66.4";
   }
 });
 
@@ -49940,10 +49940,10 @@ Multi-step orchestrations \u2014 prefer these over hand-chaining primitives when
   artifact, call \`report_artifact_read\` with the returned artifactId and follow nextOffset until null. This
   works through the authenticated MCP connection even when the client cannot open the signed download URL;
   do not try curl or web_fetch. Use \`archive_read\` for ZIP archives.
-- Before using a connected account, call \`list_service_connections\` and match the intended provider-side
-  identity from \`providerAccountEmail\` or \`providerAccountName\`, not the MCP Scraper login. If
-  \`providerIdentityStatus\` is \`unavailable\`, ask the person to refresh that connection before assuming
-  which external account it represents.
+- Before using a connected account, call \`list_service_connections\`. Match an explicit \`userLabel\` first,
+  then verified provider-side \`providerAccountEmail\`, \`providerAccountName\`, or \`providerAccountId\`; never
+  treat the MCP Scraper login as external-provider identity. If identity is pending or unavailable and no
+  distinct user label exists, ask the person which connection they mean instead of assuming.
 - For Google Search Console, use \`export_connected_service_data\` with
   \`dataset:"search_console_performance"\` when the person asks for a fresh JSONL download. When they
   ask to schedule ingestion or repeatedly filter historical rows, create a \`connection_sync\` schedule,
@@ -53853,7 +53853,12 @@ var init_mcp_tool_schemas = __esm({
         connectionId: import_zod45.z.string(),
         providerConfigKey: import_zod45.z.string(),
         provider: import_zod45.z.string().nullable().optional(),
-        label: import_zod45.z.string(),
+        label: import_zod45.z.string().describe("Best available human-facing account label: a userLabel when set, otherwise verified provider identity, then a stable fallback."),
+        userLabel: import_zod45.z.string().nullable().optional().describe("Optional tenant-owned name set in the dashboard to distinguish this connection. This is not asserted provider identity."),
+        providerAccountId: import_zod45.z.string().nullable().optional().describe("Stable provider-side account, user, workspace, channel, or tenant identifier when the provider exposes one."),
+        providerAccountEmail: import_zod45.z.string().email().nullable().optional().describe("Verified provider-side email when the provider exposes one. This is never inferred from the MCP Scraper login."),
+        providerAccountName: import_zod45.z.string().nullable().optional().describe("Provider-side account, user, workspace, channel, or tenant name when the provider exposes one."),
+        providerIdentityStatus: import_zod45.z.enum(["pending", "verified", "unavailable"]).optional().describe("Whether provider identity discovery is pending, returned at least one verified provider identifier, or completed without one."),
         status: import_zod45.z.string(),
         lifecycleStatus: import_zod45.z.enum(["pending", "connected", "needs_reauth", "disconnecting", "disconnected"]).optional().describe("Credential lifecycle. This is separate from current provider availability."),
         operationalStatus: import_zod45.z.enum(["unknown", "available", "degraded", "unavailable"]).optional().describe("Last observed provider transport availability. Unavailable does not imply reconnect is required."),
@@ -56357,7 +56362,7 @@ function registerPaaExtractorMcpTools(server, executor, options = {}) {
   }, async (input) => formatCreditsInfo(await executor.creditsInfo(input), input));
   server.registerTool("list_service_connections", {
     title: "List Connected Services",
-    description: "List every service connection this MCP Scraper account has authorized, including Resend, GitHub, Google Analytics, Google Search Console, YouTube, Facebook Pages, LinkedIn, X, Meta Marketing, Slack, Gmail, Calendar, Google Drive, Zoom, Xero, and others. Returns the tenant-scoped connectionId, credential transport, exact live readTools and gated actionTools, permission-aware toolCapabilities with missing OAuth-grant or provider-app-feature blockers, permanently blocked administrative tools, and schema-discovery metadata. Get a connectionId and exact tool name here before calling describe_service_connection_tool, read_service_connection, or call_service_connection_action. Managed OAuth and official remote MCP connections use the same provider-neutral bridges; mutations still require the account action switch and an exact allowed action. A scheduled Search Console connection_sync creates a typed tenant-owned performance table; after it runs, use the returned tableName with table-describe and table-query instead of repeatedly calling Google for historical filtering.",
+    description: "List every service connection this MCP Scraper account has authorized, including Resend, GitHub, Google Analytics, Google Search Console, YouTube, Facebook Pages, LinkedIn, X, Meta Marketing, Slack, Gmail, Calendar, Google Drive, Zoom, Xero, and others. Returns the tenant-scoped connectionId; a tenant-owned userLabel; verified provider-side account ID, email, or name when available; credential transport; exact live readTools and gated actionTools; permission-aware toolCapabilities with missing OAuth-grant or provider-app-feature blockers; permanently blocked administrative tools; and schema-discovery metadata. Get a connectionId and exact tool name here before calling describe_service_connection_tool, read_service_connection, or call_service_connection_action. Managed OAuth and official remote MCP connections use the same provider-neutral bridges; mutations still require the account action switch and an exact allowed action. A scheduled Search Console connection_sync creates a typed tenant-owned performance table; after it runs, use the returned tableName with table-describe and table-query instead of repeatedly calling Google for historical filtering.",
     inputSchema: ListServiceConnectionsInputSchema,
     outputSchema: recordOutputSchema("list_service_connections", ListServiceConnectionsOutputSchema),
     annotations: { title: "List Connected Services", readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false }
@@ -81169,6 +81174,12 @@ function ensureServiceConnectionsSchema() {
         transport                  TEXT NOT NULL,
         upstream_connection_id     TEXT,
         label                      TEXT,
+        user_label                 TEXT,
+        provider_account_id        TEXT,
+        provider_account_email     TEXT,
+        provider_account_name      TEXT,
+        provider_identity_checked_at TEXT,
+        provider_identity_source_updated_at TEXT,
         lifecycle_status           TEXT NOT NULL DEFAULT 'pending',
         operational_status         TEXT NOT NULL DEFAULT 'unknown',
         reconnect_required         INTEGER NOT NULL DEFAULT 0,
@@ -81190,6 +81201,30 @@ function ensureServiceConnectionsSchema() {
         UNIQUE(user_id, provider_config_key, upstream_connection_id)
       )
     `);
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN user_label TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_account_id TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_account_email TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_account_name TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_identity_checked_at TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_identity_source_updated_at TEXT`);
+    } catch {
+    }
     await db.execute(`CREATE INDEX IF NOT EXISTS service_connections_user_updated ON service_connections(user_id, updated_at DESC)`);
     await db.execute(`CREATE INDEX IF NOT EXISTS service_connections_upstream ON service_connections(provider_config_key, upstream_connection_id)`);
     await db.execute(`
@@ -81250,6 +81285,12 @@ function rowToRecord(row) {
     transport: row.transport === "remote_mcp" ? "remote_mcp" : "nango",
     upstreamConnectionId: typeof row.upstream_connection_id === "string" ? row.upstream_connection_id : null,
     label: typeof row.label === "string" ? row.label : null,
+    userLabel: typeof row.user_label === "string" ? row.user_label : null,
+    providerAccountId: typeof row.provider_account_id === "string" ? row.provider_account_id : null,
+    providerAccountEmail: typeof row.provider_account_email === "string" ? row.provider_account_email : null,
+    providerAccountName: typeof row.provider_account_name === "string" ? row.provider_account_name : null,
+    providerIdentityCheckedAt: typeof row.provider_identity_checked_at === "string" ? row.provider_identity_checked_at : null,
+    providerIdentitySourceUpdatedAt: typeof row.provider_identity_source_updated_at === "string" ? row.provider_identity_source_updated_at : null,
     lifecycleStatus: String(row.lifecycle_status),
     operationalStatus: String(row.operational_status),
     reconnectRequired: Number(row.reconnect_required) === 1,
@@ -81335,6 +81376,34 @@ async function updateServiceConnectionTools(connectionId, readTools, actionTools
     args: [JSON.stringify(readTools), JSON.stringify(actionTools), toolRevision, connectionId]
   });
 }
+async function setServiceConnectionProviderIdentity(args) {
+  await ensureServiceConnectionsSchema();
+  await getDb().execute({
+    sql: `
+      UPDATE service_connections SET
+        provider_account_id = ?, provider_account_email = ?, provider_account_name = ?,
+        provider_identity_checked_at = datetime('now'), provider_identity_source_updated_at = ?,
+        updated_at = datetime('now')
+      WHERE id = ?
+    `,
+    args: [
+      args.providerAccountId ?? null,
+      args.providerAccountEmail?.toLowerCase() ?? null,
+      args.providerAccountName ?? null,
+      args.sourceUpdatedAt,
+      args.connectionId
+    ]
+  });
+}
+async function setServiceConnectionUserLabel(identity, connectionId, userLabel) {
+  const connection = await getOwnedServiceConnection(identity, connectionId);
+  if (!connection || connection.lifecycleStatus === "disconnected") throw new Error("service_connection_not_found");
+  await getDb().execute({
+    sql: `UPDATE service_connections SET user_label = ?, updated_at = datetime('now') WHERE id = ? AND user_id = ?`,
+    args: [userLabel, connectionId, connection.userId]
+  });
+  return userLabel;
+}
 async function recordServiceConnectionHealth(args) {
   await ensureServiceConnectionsSchema();
   const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -84411,7 +84480,8 @@ async function nangoRequest(path6, options = {}) {
       headers: {
         authorization: `Bearer ${nangoSecret()}`,
         accept: "application/json",
-        ...options.body ? { "content-type": "application/json" } : {}
+        ...options.body ? { "content-type": "application/json" } : {},
+        ...options.headers
       },
       body: options.body ? JSON.stringify(options.body) : void 0,
       signal: AbortSignal.timeout(NANGO_TIMEOUT_MS)
@@ -84459,22 +84529,126 @@ function discoveredConnection(value) {
   const upstreamConnectionId = text(row?.connection_id);
   const providerConfigKey = text(row?.provider_config_key);
   if (!upstreamConnectionId || !providerConfigKey) return null;
-  const tags = asRecord2(row?.tags);
-  const endUser = asRecord2(row?.end_user);
   const errors = Array.isArray(row?.errors) ? row.errors : [];
   const authError = errors.some((error) => text(asRecord2(error)?.type) === "auth");
   return {
     upstreamConnectionId,
     providerConfigKey,
     provider: text(row?.provider) ?? providerConfigKey,
-    label: text(tags?.end_user_display_name) ?? text(endUser?.display_name) ?? text(tags?.end_user_email) ?? text(endUser?.email),
+    // Nango's end-user fields identify the MCP Scraper tenant, not the
+    // provider-side principal that authorized this connection.
+    label: null,
     lifecycleStatus: authError ? "needs_reauth" : "connected",
     reconnectRequired: authError,
     createdAt: text(row?.created_at) ?? text(row?.created),
     updatedAt: text(row?.updated_at)
   };
 }
-async function discoverOwnedNangoConnections(identity) {
+function scalarId(value) {
+  const valueText = text(value);
+  if (valueText) return valueText;
+  return typeof value === "number" && Number.isFinite(value) ? String(value) : null;
+}
+function providerEmail(value) {
+  const email = text(value)?.toLowerCase() ?? null;
+  return email && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email) ? email : null;
+}
+function compactProviderIdentity(identity) {
+  return identity.id || identity.email || identity.name ? identity : null;
+}
+async function providerProxyJson(args) {
+  return nangoRequest(`/proxy${args.path}`, {
+    query: args.query,
+    headers: {
+      "connection-id": args.upstreamConnectionId,
+      "provider-config-key": args.providerConfigKey,
+      ...args.baseUrlOverride ? { "base-url-override": args.baseUrlOverride } : {}
+    }
+  });
+}
+async function googleProviderAccountIdentity(args) {
+  const request = (path6, query, baseUrlOverride) => providerProxyJson({ ...args, path: path6, query, baseUrlOverride });
+  try {
+    if (args.providerConfigKey === "google-mail") {
+      const payload = asRecord2(await request("/gmail/v1/users/me/profile", void 0, "https://gmail.googleapis.com"));
+      const email = providerEmail(payload?.emailAddress);
+      return compactProviderIdentity({ id: email, email, name: null });
+    }
+    if (args.providerConfigKey === "google-drive") {
+      const payload = asRecord2(await request("/drive/v3/about", { fields: "user(permissionId,displayName,emailAddress)" }, "https://www.googleapis.com"));
+      const user = asRecord2(payload?.user);
+      return compactProviderIdentity({
+        id: text(user?.permissionId),
+        email: providerEmail(user?.emailAddress),
+        name: text(user?.displayName)
+      });
+    }
+    if (args.providerConfigKey === "google-calendar") {
+      const payload = asRecord2(await request("/calendar/v3/calendars/primary", void 0, "https://www.googleapis.com"));
+      const id = text(payload?.id);
+      return compactProviderIdentity({ id, email: providerEmail(id), name: text(payload?.summary) });
+    }
+    if (args.providerConfigKey === "youtube") {
+      const payload = asRecord2(await request("/youtube/v3/channels", { part: "snippet", mine: "true", maxResults: 1 }, "https://www.googleapis.com"));
+      const first = Array.isArray(payload?.items) ? asRecord2(payload.items[0]) : null;
+      return compactProviderIdentity({ id: text(first?.id), email: null, name: text(asRecord2(first?.snippet)?.title) });
+    }
+  } catch {
+  }
+  try {
+    const payload = asRecord2(await request("/v1/userinfo", void 0, "https://openidconnect.googleapis.com"));
+    return compactProviderIdentity({
+      id: text(payload?.sub),
+      email: payload?.email_verified === false ? null : providerEmail(payload?.email),
+      name: text(payload?.name)
+    });
+  } catch {
+    return null;
+  }
+}
+async function getNangoProviderAccountIdentity(args) {
+  if (!IDENTITY_SUPPORTED_PROVIDERS.has(args.providerConfigKey)) return null;
+  if (args.providerConfigKey.startsWith("google-") || args.providerConfigKey === "youtube") {
+    return googleProviderAccountIdentity(args);
+  }
+  try {
+    if (args.providerConfigKey === "github-getting-started") {
+      const payload = asRecord2(await providerProxyJson({ ...args, path: "/user" }));
+      return compactProviderIdentity({ id: scalarId(payload?.id), email: providerEmail(payload?.email), name: text(payload?.name) ?? text(payload?.login) });
+    }
+    if (args.providerConfigKey === "slack") {
+      const payload = asRecord2(await providerProxyJson({ ...args, path: "/api/auth.test" }));
+      return compactProviderIdentity({ id: text(payload?.user_id), email: null, name: [text(payload?.user), text(payload?.team)].filter(Boolean).join(" \xB7 ") || null });
+    }
+    if (args.providerConfigKey === "zoom") {
+      const payload = asRecord2(await providerProxyJson({ ...args, path: "/v2/users/me" }));
+      const fullName = [text(payload?.first_name), text(payload?.last_name)].filter(Boolean).join(" ");
+      return compactProviderIdentity({ id: text(payload?.id), email: providerEmail(payload?.email), name: text(payload?.display_name) ?? (fullName || null) });
+    }
+    if (args.providerConfigKey === "linkedin") {
+      const payload = asRecord2(await providerProxyJson({ ...args, path: "/v2/userinfo" }));
+      return compactProviderIdentity({ id: text(payload?.sub), email: payload?.email_verified === false ? null : providerEmail(payload?.email), name: text(payload?.name) });
+    }
+    if (args.providerConfigKey === "meta-marketing-api" || args.providerConfigKey === "facebook") {
+      const payload = asRecord2(await providerProxyJson({ ...args, path: "/me", query: { fields: "id,name,email" } }));
+      return compactProviderIdentity({ id: text(payload?.id), email: providerEmail(payload?.email), name: text(payload?.name) });
+    }
+    if (args.providerConfigKey === "twitter-v2") {
+      const payload = asRecord2(await providerProxyJson({ ...args, path: "/2/users/me", query: { "user.fields": "id,name,username" } }));
+      const data = asRecord2(payload?.data);
+      return compactProviderIdentity({ id: text(data?.id), email: null, name: text(data?.username) ?? text(data?.name) });
+    }
+    if (args.providerConfigKey === "xero") {
+      const payload = await providerProxyJson({ ...args, path: "/connections" });
+      const first = Array.isArray(payload) ? asRecord2(payload[0]) : null;
+      return compactProviderIdentity({ id: text(first?.tenantId), email: null, name: text(first?.tenantName) });
+    }
+  } catch {
+    return null;
+  }
+  return null;
+}
+async function discoverOwnedNangoConnections(identity, options = {}) {
   const rows = [];
   for (let page = 0; page < NANGO_CONNECTION_MAX_PAGES; page += 1) {
     const payload = await nangoRequest("/connections", {
@@ -84485,6 +84659,35 @@ async function discoverOwnedNangoConnections(identity) {
     if (pageRows.length < NANGO_CONNECTION_PAGE_SIZE) break;
   }
   const discovered = rows.filter((row) => connectionIdentityMatches(row, identity)).map(discoveredConnection).filter((connection) => connection !== null);
+  const reconciled = await reconcileDiscoveredNangoConnections(identity, discovered);
+  if (options.resolveProviderIdentity === false) return reconciled;
+  const remoteByKey = new Map(discovered.map((connection) => [
+    `${connection.providerConfigKey}\0${connection.upstreamConnectionId}`,
+    connection
+  ]));
+  await Promise.all(reconciled.map(async (connection) => {
+    if (connection.lifecycleStatus !== "connected" || !connection.upstreamConnectionId) return;
+    const remote = remoteByKey.get(`${connection.providerConfigKey}\0${connection.upstreamConnectionId}`);
+    if (!remote) return;
+    const sourceUpdatedAt = remote.updatedAt ?? remote.createdAt ?? connection.lifecycleStatus;
+    const hasProviderIdentity = Boolean(
+      connection.providerAccountId || connection.providerAccountEmail || connection.providerAccountName
+    );
+    const checkedAt = connection.providerIdentityCheckedAt ? Date.parse(`${connection.providerIdentityCheckedAt.replace(" ", "T")}Z`) : Number.NaN;
+    const unavailableIdentityIsFresh = !hasProviderIdentity && Number.isFinite(checkedAt) && Date.now() - checkedAt < PROVIDER_IDENTITY_RETRY_MS;
+    if (connection.providerIdentitySourceUpdatedAt === sourceUpdatedAt && (hasProviderIdentity || unavailableIdentityIsFresh)) return;
+    const providerIdentity = await getNangoProviderAccountIdentity({
+      upstreamConnectionId: connection.upstreamConnectionId,
+      providerConfigKey: connection.providerConfigKey
+    });
+    await setServiceConnectionProviderIdentity({
+      connectionId: connection.id,
+      providerAccountId: providerIdentity?.id,
+      providerAccountEmail: providerIdentity?.email,
+      providerAccountName: providerIdentity?.name,
+      sourceUpdatedAt
+    });
+  }));
   return reconcileDiscoveredNangoConnections(identity, discovered);
 }
 async function listNangoCatalogDirect() {
@@ -84747,7 +84950,7 @@ async function describeNangoToolDirect(identity, connectionId, toolName) {
     fetchedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
 }
-var import_node_crypto68, import_client13, DEFAULT_NANGO_MCP_URL, NANGO_TIMEOUT_MS, NANGO_CONNECTION_PAGE_SIZE, NANGO_CONNECTION_MAX_PAGES, MAIN_INTEGRATION_CONTRACT_VERSION, MAIN_INTEGRATION_CONTRACT_HASH, MainNangoTransportError;
+var import_node_crypto68, import_client13, DEFAULT_NANGO_MCP_URL, NANGO_TIMEOUT_MS, NANGO_CONNECTION_PAGE_SIZE, NANGO_CONNECTION_MAX_PAGES, PROVIDER_IDENTITY_RETRY_MS, MAIN_INTEGRATION_CONTRACT_VERSION, MAIN_INTEGRATION_CONTRACT_HASH, MainNangoTransportError, IDENTITY_SUPPORTED_PROVIDERS;
 var init_main_nango_transport = __esm({
   "src/api/main-nango-transport.ts"() {
     "use strict";
@@ -84761,6 +84964,7 @@ var init_main_nango_transport = __esm({
     NANGO_TIMEOUT_MS = 2e4;
     NANGO_CONNECTION_PAGE_SIZE = 100;
     NANGO_CONNECTION_MAX_PAGES = 20;
+    PROVIDER_IDENTITY_RETRY_MS = 6 * 60 * 60 * 1e3;
     MAIN_INTEGRATION_CONTRACT_VERSION = "2026-07-16.1";
     MAIN_INTEGRATION_CONTRACT_HASH = "f037859ec80c2ea2fac6e4a67c1a59f3200dd22d3642c97789b9bb3236723d3e";
     MainNangoTransportError = class extends Error {
@@ -84777,6 +84981,22 @@ var init_main_nango_transport = __esm({
         this.retryAfterMs = retryAfterMs;
       }
     };
+    IDENTITY_SUPPORTED_PROVIDERS = /* @__PURE__ */ new Set([
+      "facebook",
+      "github-getting-started",
+      "google-analytics",
+      "google-calendar",
+      "google-drive",
+      "google-mail",
+      "google-search-console",
+      "linkedin",
+      "meta-marketing-api",
+      "slack",
+      "twitter-v2",
+      "xero",
+      "youtube",
+      "zoom"
+    ]);
   }
 });
 
@@ -85067,7 +85287,7 @@ async function getNangoConnections(identity, options = {}) {
   if (mainOwnsIntegrations()) {
     let connections;
     try {
-      connections = await discoverOwnedNangoConnections(identity);
+      connections = await discoverOwnedNangoConnections(identity, { resolveProviderIdentity: !options.summaryOnly });
     } catch (error) {
       try {
         connections = await listServiceConnections(identity, "nango");
@@ -85088,11 +85308,12 @@ async function getNangoConnections(identity, options = {}) {
         connectionId: connection.id,
         providerConfigKey: connection.providerConfigKey,
         provider: connection.provider,
-        label: connection.label || connection.providerConfigKey,
-        providerAccountId: null,
-        providerAccountEmail: null,
-        providerAccountName: null,
-        providerIdentityStatus: "unavailable",
+        label: connection.userLabel || connection.providerAccountEmail || connection.providerAccountName || (connection.label && connection.label.toLowerCase() !== identity.trim().toLowerCase() ? connection.label : null) || connection.providerConfigKey,
+        userLabel: connection.userLabel,
+        providerAccountId: connection.providerAccountId,
+        providerAccountEmail: connection.providerAccountEmail,
+        providerAccountName: connection.providerAccountName,
+        providerIdentityStatus: connection.providerIdentityCheckedAt ? connection.providerAccountId || connection.providerAccountEmail || connection.providerAccountName ? "verified" : "unavailable" : "pending",
         status: connection.reconnectRequired ? "needs_reauth" : "connected",
         lifecycleStatus: connection.lifecycleStatus,
         operationalStatus: connection.operationalStatus,
@@ -85193,6 +85414,7 @@ async function getNangoConnections(identity, options = {}) {
       providerConfigKey,
       provider,
       label,
+      userLabel: null,
       providerAccountId,
       providerAccountEmail,
       providerAccountName,
@@ -86968,6 +87190,7 @@ var init_server = __esm({
     init_scheduling_access();
     init_memory_db();
     init_nango_control();
+    init_service_connections();
     init_resend_control();
     init_scheduler_integration_auth();
     init_connected_account_billing();
@@ -87559,6 +87782,26 @@ var init_server = __esm({
         return scheduleConnectionError(c, err, "Unable to load service connections.");
       }
     });
+    app.patch("/schedule-connections/:id/label", auth4, async (c) => {
+      const user = c.get("user");
+      const body = await c.req.json().catch(() => ({}));
+      if (body.label !== null && typeof body.label !== "string") {
+        return c.json({ ok: false, error: "label must be a string or null." }, 400);
+      }
+      const label = typeof body.label === "string" ? body.label.normalize("NFKC").trim().replace(/\s+/g, " ") : null;
+      if (label && label.length > 80) {
+        return c.json({ ok: false, error: "label must contain at most 80 characters." }, 400);
+      }
+      try {
+        const userLabel = await setServiceConnectionUserLabel(user.email, c.req.param("id"), label || null);
+        return c.json({ ok: true, userLabel });
+      } catch (err) {
+        if (err instanceof Error && err.message === "service_connection_not_found") {
+          return c.json({ ok: false, error: "Service connection not found." }, 404);
+        }
+        return scheduleConnectionError(c, err, "Unable to rename this service connection.");
+      }
+    });
     app.post("/schedule-connections/billing/reconcile", auth4, requireIntegrationsTier, async (c) => {
       const user = c.get("user");
       try {
@@ -88117,6 +88360,7 @@ var init_server = __esm({
     app.post("/integrations/:id/reconnect-session", (c) => forwardIntegrationAlias(c, `/schedule-connections/${encodeURIComponent(c.req.param("id"))}/reconnect-session`));
     app.post("/integrations/:id/enable-actions", (c) => forwardIntegrationAlias(c, `/schedule-connections/${encodeURIComponent(c.req.param("id"))}/enable-actions`));
     app.post("/integrations/:id/test", (c) => forwardIntegrationAlias(c, `/schedule-connections/${encodeURIComponent(c.req.param("id"))}/test`));
+    app.patch("/integrations/:id/label", (c) => forwardIntegrationAlias(c, `/schedule-connections/${encodeURIComponent(c.req.param("id"))}/label`));
     app.delete("/integrations/:id", (c) => forwardIntegrationAlias(c, `/schedule-connections/${encodeURIComponent(c.req.param("id"))}`));
     app.post("/integrations/actions/read", (c) => forwardIntegrationAlias(c, "/schedule-connections/actions/read"));
     app.post("/integrations/actions/describe", (c) => forwardIntegrationAlias(c, "/schedule-connections/actions/describe"));

package/dist/bin/api-server.js

@@ -17,7 +17,7 @@ loadDotEnv();
 async function main() {
   const [{ serve }, { app }, { startWorker }, { migrate }] = await Promise.all([
     import("@hono/node-server"),
-    import("../server-D47PNEXR.js"),
+    import("../server-YATQ3WHT.js"),
     import("../worker-UTBUWEXQ.js"),
     import("../db-4RVZ3NYZ.js")
   ]);

package/dist/bin/mcp-scraper-cli.cjs

@@ -30,7 +30,7 @@ var import_promises5 = require("fs/promises");
 var import_node_path3 = require("path");
 
 // src/version.ts
-var PACKAGE_VERSION = "0.66.3";
+var PACKAGE_VERSION = "0.66.4";
 
 // src/cli/agent-config.ts
 function apiKeyValue(options) {

package/dist/bin/mcp-scraper-cli.js

@@ -13,7 +13,7 @@ import "../chunk-VXLU74YZ.js";
 import "../chunk-GGZEC22A.js";
 import {
   PACKAGE_VERSION
-} from "../chunk-JBFLOJGM.js";
+} from "../chunk-EGNT3AY2.js";
 
 // src/cli/human-cli.ts
 import { Command } from "commander";

package/dist/bin/mcp-scraper-install.cjs

@@ -112,7 +112,7 @@ function renderInstallTerminal(options) {
 }
 
 // src/version.ts
-var PACKAGE_VERSION = "0.66.3";
+var PACKAGE_VERSION = "0.66.4";
 
 // bin/mcp-scraper-install.ts
 var noColor = process.argv.includes("--no-color") || process.env.NO_COLOR !== void 0 || process.env.FORCE_COLOR === "0" || !process.stdout.isTTY;

package/dist/bin/mcp-scraper-install.js

@@ -4,7 +4,7 @@ import {
 } from "../chunk-2XVDLF6H.js";
 import {
   PACKAGE_VERSION
-} from "../chunk-JBFLOJGM.js";
+} from "../chunk-EGNT3AY2.js";
 
 // bin/mcp-scraper-install.ts
 var noColor = process.argv.includes("--no-color") || process.env.NO_COLOR !== void 0 || process.env.FORCE_COLOR === "0" || !process.stdout.isTTY;

package/dist/bin/mcp-stdio-server.cjs

@@ -1232,7 +1232,7 @@ render();
 }
 
 // src/version.ts
-var PACKAGE_VERSION = "0.66.3";
+var PACKAGE_VERSION = "0.66.4";
 
 // src/mcp/input-field-descriptions.ts
 var import_zod = require("zod");
@@ -8408,10 +8408,10 @@ Multi-step orchestrations \u2014 prefer these over hand-chaining primitives when
   artifact, call \`report_artifact_read\` with the returned artifactId and follow nextOffset until null. This
   works through the authenticated MCP connection even when the client cannot open the signed download URL;
   do not try curl or web_fetch. Use \`archive_read\` for ZIP archives.
-- Before using a connected account, call \`list_service_connections\` and match the intended provider-side
-  identity from \`providerAccountEmail\` or \`providerAccountName\`, not the MCP Scraper login. If
-  \`providerIdentityStatus\` is \`unavailable\`, ask the person to refresh that connection before assuming
-  which external account it represents.
+- Before using a connected account, call \`list_service_connections\`. Match an explicit \`userLabel\` first,
+  then verified provider-side \`providerAccountEmail\`, \`providerAccountName\`, or \`providerAccountId\`; never
+  treat the MCP Scraper login as external-provider identity. If identity is pending or unavailable and no
+  distinct user label exists, ask the person which connection they mean instead of assuming.
 - For Google Search Console, use \`export_connected_service_data\` with
   \`dataset:"search_console_performance"\` when the person asks for a fresh JSONL download. When they
   ask to schedule ingestion or repeatedly filter historical rows, create a \`connection_sync\` schedule,
@@ -12064,7 +12064,12 @@ var ListServiceConnectionsOutputSchema = {
     connectionId: import_zod8.z.string(),
     providerConfigKey: import_zod8.z.string(),
     provider: import_zod8.z.string().nullable().optional(),
-    label: import_zod8.z.string(),
+    label: import_zod8.z.string().describe("Best available human-facing account label: a userLabel when set, otherwise verified provider identity, then a stable fallback."),
+    userLabel: import_zod8.z.string().nullable().optional().describe("Optional tenant-owned name set in the dashboard to distinguish this connection. This is not asserted provider identity."),
+    providerAccountId: import_zod8.z.string().nullable().optional().describe("Stable provider-side account, user, workspace, channel, or tenant identifier when the provider exposes one."),
+    providerAccountEmail: import_zod8.z.string().email().nullable().optional().describe("Verified provider-side email when the provider exposes one. This is never inferred from the MCP Scraper login."),
+    providerAccountName: import_zod8.z.string().nullable().optional().describe("Provider-side account, user, workspace, channel, or tenant name when the provider exposes one."),
+    providerIdentityStatus: import_zod8.z.enum(["pending", "verified", "unavailable"]).optional().describe("Whether provider identity discovery is pending, returned at least one verified provider identifier, or completed without one."),
     status: import_zod8.z.string(),
     lifecycleStatus: import_zod8.z.enum(["pending", "connected", "needs_reauth", "disconnecting", "disconnected"]).optional().describe("Credential lifecycle. This is separate from current provider availability."),
     operationalStatus: import_zod8.z.enum(["unknown", "available", "degraded", "unavailable"]).optional().describe("Last observed provider transport availability. Unavailable does not imply reconnect is required."),
@@ -14378,7 +14383,7 @@ function registerPaaExtractorMcpTools(server, executor, options = {}) {
   }, async (input) => formatCreditsInfo(await executor.creditsInfo(input), input));
   server.registerTool("list_service_connections", {
     title: "List Connected Services",
-    description: "List every service connection this MCP Scraper account has authorized, including Resend, GitHub, Google Analytics, Google Search Console, YouTube, Facebook Pages, LinkedIn, X, Meta Marketing, Slack, Gmail, Calendar, Google Drive, Zoom, Xero, and others. Returns the tenant-scoped connectionId, credential transport, exact live readTools and gated actionTools, permission-aware toolCapabilities with missing OAuth-grant or provider-app-feature blockers, permanently blocked administrative tools, and schema-discovery metadata. Get a connectionId and exact tool name here before calling describe_service_connection_tool, read_service_connection, or call_service_connection_action. Managed OAuth and official remote MCP connections use the same provider-neutral bridges; mutations still require the account action switch and an exact allowed action. A scheduled Search Console connection_sync creates a typed tenant-owned performance table; after it runs, use the returned tableName with table-describe and table-query instead of repeatedly calling Google for historical filtering.",
+    description: "List every service connection this MCP Scraper account has authorized, including Resend, GitHub, Google Analytics, Google Search Console, YouTube, Facebook Pages, LinkedIn, X, Meta Marketing, Slack, Gmail, Calendar, Google Drive, Zoom, Xero, and others. Returns the tenant-scoped connectionId; a tenant-owned userLabel; verified provider-side account ID, email, or name when available; credential transport; exact live readTools and gated actionTools; permission-aware toolCapabilities with missing OAuth-grant or provider-app-feature blockers; permanently blocked administrative tools; and schema-discovery metadata. Get a connectionId and exact tool name here before calling describe_service_connection_tool, read_service_connection, or call_service_connection_action. Managed OAuth and official remote MCP connections use the same provider-neutral bridges; mutations still require the account action switch and an exact allowed action. A scheduled Search Console connection_sync creates a typed tenant-owned performance table; after it runs, use the returned tableName with table-describe and table-query instead of repeatedly calling Google for historical filtering.",
     inputSchema: ListServiceConnectionsInputSchema,
     outputSchema: recordOutputSchema("list_service_connections", ListServiceConnectionsOutputSchema),
     annotations: { title: "List Connected Services", readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false }

package/dist/bin/mcp-stdio-server.js

@@ -13,7 +13,7 @@ import {
   registerScheduledResultsMcpTools,
   registerSerpIntelligenceCaptureTools,
   resolveDeploymentProfile
-} from "../chunk-LNLMOBP6.js";
+} from "../chunk-UPN4W4SV.js";
 import "../chunk-PGJQDMC2.js";
 import "../chunk-3EYALCYK.js";
 import "../chunk-3TKKJQB4.js";
@@ -24,7 +24,7 @@ import "../chunk-VXLU74YZ.js";
 import "../chunk-GGZEC22A.js";
 import {
   PACKAGE_VERSION
-} from "../chunk-JBFLOJGM.js";
+} from "../chunk-EGNT3AY2.js";
 import "../chunk-DNM65UCK.js";
 import "../chunk-AYJHI2FK.js";
 import "../chunk-55B3T5L2.js";

package/dist/{chunk-JBFLOJGM.js → chunk-EGNT3AY2.js}

@@ -1,5 +1,5 @@
 // src/version.ts
-var PACKAGE_VERSION = "0.66.3";
+var PACKAGE_VERSION = "0.66.4";
 
 export {
   PACKAGE_VERSION

package/dist/{chunk-LNLMOBP6.js → chunk-UPN4W4SV.js}

@@ -25,7 +25,7 @@ import {
 } from "./chunk-VXLU74YZ.js";
 import {
   PACKAGE_VERSION
-} from "./chunk-JBFLOJGM.js";
+} from "./chunk-EGNT3AY2.js";
 import {
   createPrivateArtifact,
   privateArtifactOwnerId,
@@ -580,10 +580,10 @@ Multi-step orchestrations \u2014 prefer these over hand-chaining primitives when
   artifact, call \`report_artifact_read\` with the returned artifactId and follow nextOffset until null. This
   works through the authenticated MCP connection even when the client cannot open the signed download URL;
   do not try curl or web_fetch. Use \`archive_read\` for ZIP archives.
-- Before using a connected account, call \`list_service_connections\` and match the intended provider-side
-  identity from \`providerAccountEmail\` or \`providerAccountName\`, not the MCP Scraper login. If
-  \`providerIdentityStatus\` is \`unavailable\`, ask the person to refresh that connection before assuming
-  which external account it represents.
+- Before using a connected account, call \`list_service_connections\`. Match an explicit \`userLabel\` first,
+  then verified provider-side \`providerAccountEmail\`, \`providerAccountName\`, or \`providerAccountId\`; never
+  treat the MCP Scraper login as external-provider identity. If identity is pending or unavailable and no
+  distinct user label exists, ask the person which connection they mean instead of assuming.
 - For Google Search Console, use \`export_connected_service_data\` with
   \`dataset:"search_console_performance"\` when the person asks for a fresh JSONL download. When they
   ask to schedule ingestion or repeatedly filter historical rows, create a \`connection_sync\` schedule,
@@ -9442,7 +9442,12 @@ var ListServiceConnectionsOutputSchema = {
     connectionId: z6.string(),
     providerConfigKey: z6.string(),
     provider: z6.string().nullable().optional(),
-    label: z6.string(),
+    label: z6.string().describe("Best available human-facing account label: a userLabel when set, otherwise verified provider identity, then a stable fallback."),
+    userLabel: z6.string().nullable().optional().describe("Optional tenant-owned name set in the dashboard to distinguish this connection. This is not asserted provider identity."),
+    providerAccountId: z6.string().nullable().optional().describe("Stable provider-side account, user, workspace, channel, or tenant identifier when the provider exposes one."),
+    providerAccountEmail: z6.string().email().nullable().optional().describe("Verified provider-side email when the provider exposes one. This is never inferred from the MCP Scraper login."),
+    providerAccountName: z6.string().nullable().optional().describe("Provider-side account, user, workspace, channel, or tenant name when the provider exposes one."),
+    providerIdentityStatus: z6.enum(["pending", "verified", "unavailable"]).optional().describe("Whether provider identity discovery is pending, returned at least one verified provider identifier, or completed without one."),
     status: z6.string(),
     lifecycleStatus: z6.enum(["pending", "connected", "needs_reauth", "disconnecting", "disconnected"]).optional().describe("Credential lifecycle. This is separate from current provider availability."),
     operationalStatus: z6.enum(["unknown", "available", "degraded", "unavailable"]).optional().describe("Last observed provider transport availability. Unavailable does not imply reconnect is required."),
@@ -11887,7 +11892,7 @@ function registerPaaExtractorMcpTools(server, executor, options = {}) {
   }, async (input) => formatCreditsInfo(await executor.creditsInfo(input), input));
   server.registerTool("list_service_connections", {
     title: "List Connected Services",
-    description: "List every service connection this MCP Scraper account has authorized, including Resend, GitHub, Google Analytics, Google Search Console, YouTube, Facebook Pages, LinkedIn, X, Meta Marketing, Slack, Gmail, Calendar, Google Drive, Zoom, Xero, and others. Returns the tenant-scoped connectionId, credential transport, exact live readTools and gated actionTools, permission-aware toolCapabilities with missing OAuth-grant or provider-app-feature blockers, permanently blocked administrative tools, and schema-discovery metadata. Get a connectionId and exact tool name here before calling describe_service_connection_tool, read_service_connection, or call_service_connection_action. Managed OAuth and official remote MCP connections use the same provider-neutral bridges; mutations still require the account action switch and an exact allowed action. A scheduled Search Console connection_sync creates a typed tenant-owned performance table; after it runs, use the returned tableName with table-describe and table-query instead of repeatedly calling Google for historical filtering.",
+    description: "List every service connection this MCP Scraper account has authorized, including Resend, GitHub, Google Analytics, Google Search Console, YouTube, Facebook Pages, LinkedIn, X, Meta Marketing, Slack, Gmail, Calendar, Google Drive, Zoom, Xero, and others. Returns the tenant-scoped connectionId; a tenant-owned userLabel; verified provider-side account ID, email, or name when available; credential transport; exact live readTools and gated actionTools; permission-aware toolCapabilities with missing OAuth-grant or provider-app-feature blockers; permanently blocked administrative tools; and schema-discovery metadata. Get a connectionId and exact tool name here before calling describe_service_connection_tool, read_service_connection, or call_service_connection_action. Managed OAuth and official remote MCP connections use the same provider-neutral bridges; mutations still require the account action switch and an exact allowed action. A scheduled Search Console connection_sync creates a typed tenant-owned performance table; after it runs, use the returned tableName with table-describe and table-query instead of repeatedly calling Google for historical filtering.",
     inputSchema: ListServiceConnectionsInputSchema,
     outputSchema: recordOutputSchema("list_service_connections", ListServiceConnectionsOutputSchema),
     annotations: { title: "List Connected Services", readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false }

package/dist/{server-D47PNEXR.js → server-YATQ3WHT.js}

@@ -199,7 +199,7 @@ import {
   resolveDeploymentProfile,
   resolveLocalSourcebookSchemaType,
   transcribeMediaUrl
-} from "./chunk-LNLMOBP6.js";
+} from "./chunk-UPN4W4SV.js";
 import {
   auditImageUrls,
   auditImages,
@@ -256,7 +256,7 @@ import {
 } from "./chunk-GGZEC22A.js";
 import {
   PACKAGE_VERSION
-} from "./chunk-JBFLOJGM.js";
+} from "./chunk-EGNT3AY2.js";
 import {
   SITE_EXTRACT_ARTIFACT_PREFIX,
   abandonExtractSettlement,
@@ -41109,6 +41109,12 @@ function ensureServiceConnectionsSchema() {
         transport                  TEXT NOT NULL,
         upstream_connection_id     TEXT,
         label                      TEXT,
+        user_label                 TEXT,
+        provider_account_id        TEXT,
+        provider_account_email     TEXT,
+        provider_account_name      TEXT,
+        provider_identity_checked_at TEXT,
+        provider_identity_source_updated_at TEXT,
         lifecycle_status           TEXT NOT NULL DEFAULT 'pending',
         operational_status         TEXT NOT NULL DEFAULT 'unknown',
         reconnect_required         INTEGER NOT NULL DEFAULT 0,
@@ -41130,6 +41136,30 @@ function ensureServiceConnectionsSchema() {
         UNIQUE(user_id, provider_config_key, upstream_connection_id)
       )
     `);
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN user_label TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_account_id TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_account_email TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_account_name TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_identity_checked_at TEXT`);
+    } catch {
+    }
+    try {
+      await db.execute(`ALTER TABLE service_connections ADD COLUMN provider_identity_source_updated_at TEXT`);
+    } catch {
+    }
     await db.execute(`CREATE INDEX IF NOT EXISTS service_connections_user_updated ON service_connections(user_id, updated_at DESC)`);
     await db.execute(`CREATE INDEX IF NOT EXISTS service_connections_upstream ON service_connections(provider_config_key, upstream_connection_id)`);
     await db.execute(`
@@ -41190,6 +41220,12 @@ function rowToRecord(row) {
     transport: row.transport === "remote_mcp" ? "remote_mcp" : "nango",
     upstreamConnectionId: typeof row.upstream_connection_id === "string" ? row.upstream_connection_id : null,
     label: typeof row.label === "string" ? row.label : null,
+    userLabel: typeof row.user_label === "string" ? row.user_label : null,
+    providerAccountId: typeof row.provider_account_id === "string" ? row.provider_account_id : null,
+    providerAccountEmail: typeof row.provider_account_email === "string" ? row.provider_account_email : null,
+    providerAccountName: typeof row.provider_account_name === "string" ? row.provider_account_name : null,
+    providerIdentityCheckedAt: typeof row.provider_identity_checked_at === "string" ? row.provider_identity_checked_at : null,
+    providerIdentitySourceUpdatedAt: typeof row.provider_identity_source_updated_at === "string" ? row.provider_identity_source_updated_at : null,
     lifecycleStatus: String(row.lifecycle_status),
     operationalStatus: String(row.operational_status),
     reconnectRequired: Number(row.reconnect_required) === 1,
@@ -41275,6 +41311,34 @@ async function updateServiceConnectionTools(connectionId, readTools, actionTools
     args: [JSON.stringify(readTools), JSON.stringify(actionTools), toolRevision, connectionId]
   });
 }
+async function setServiceConnectionProviderIdentity(args) {
+  await ensureServiceConnectionsSchema();
+  await getDb().execute({
+    sql: `
+      UPDATE service_connections SET
+        provider_account_id = ?, provider_account_email = ?, provider_account_name = ?,
+        provider_identity_checked_at = datetime('now'), provider_identity_source_updated_at = ?,
+        updated_at = datetime('now')
+      WHERE id = ?
+    `,
+    args: [
+      args.providerAccountId ?? null,
+      args.providerAccountEmail?.toLowerCase() ?? null,
+      args.providerAccountName ?? null,
+      args.sourceUpdatedAt,
+      args.connectionId
+    ]
+  });
+}
+async function setServiceConnectionUserLabel(identity, connectionId, userLabel) {
+  const connection = await getOwnedServiceConnection(identity, connectionId);
+  if (!connection || connection.lifecycleStatus === "disconnected") throw new Error("service_connection_not_found");
+  await getDb().execute({
+    sql: `UPDATE service_connections SET user_label = ?, updated_at = datetime('now') WHERE id = ? AND user_id = ?`,
+    args: [userLabel, connectionId, connection.userId]
+  });
+  return userLabel;
+}
 async function recordServiceConnectionHealth(args) {
   await ensureServiceConnectionsSchema();
   const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -44114,6 +44178,7 @@ var DEFAULT_NANGO_MCP_URL = "https://api.nango.dev/mcp";
 var NANGO_TIMEOUT_MS = 2e4;
 var NANGO_CONNECTION_PAGE_SIZE = 100;
 var NANGO_CONNECTION_MAX_PAGES = 20;
+var PROVIDER_IDENTITY_RETRY_MS = 6 * 60 * 60 * 1e3;
 var MAIN_INTEGRATION_CONTRACT_VERSION = "2026-07-16.1";
 var MAIN_INTEGRATION_CONTRACT_HASH = "f037859ec80c2ea2fac6e4a67c1a59f3200dd22d3642c97789b9bb3236723d3e";
 var MainNangoTransportError = class extends Error {
@@ -44217,7 +44282,8 @@ async function nangoRequest(path5, options = {}) {
       headers: {
         authorization: `Bearer ${nangoSecret()}`,
         accept: "application/json",
-        ...options.body ? { "content-type": "application/json" } : {}
+        ...options.body ? { "content-type": "application/json" } : {},
+        ...options.headers
       },
       body: options.body ? JSON.stringify(options.body) : void 0,
       signal: AbortSignal.timeout(NANGO_TIMEOUT_MS)
@@ -44265,22 +44331,142 @@ function discoveredConnection(value) {
   const upstreamConnectionId = text(row?.connection_id);
   const providerConfigKey = text(row?.provider_config_key);
   if (!upstreamConnectionId || !providerConfigKey) return null;
-  const tags = asRecord(row?.tags);
-  const endUser = asRecord(row?.end_user);
   const errors = Array.isArray(row?.errors) ? row.errors : [];
   const authError = errors.some((error) => text(asRecord(error)?.type) === "auth");
   return {
     upstreamConnectionId,
     providerConfigKey,
     provider: text(row?.provider) ?? providerConfigKey,
-    label: text(tags?.end_user_display_name) ?? text(endUser?.display_name) ?? text(tags?.end_user_email) ?? text(endUser?.email),
+    // Nango's end-user fields identify the MCP Scraper tenant, not the
+    // provider-side principal that authorized this connection.
+    label: null,
     lifecycleStatus: authError ? "needs_reauth" : "connected",
     reconnectRequired: authError,
     createdAt: text(row?.created_at) ?? text(row?.created),
     updatedAt: text(row?.updated_at)
   };
 }
-async function discoverOwnedNangoConnections(identity) {
+var IDENTITY_SUPPORTED_PROVIDERS = /* @__PURE__ */ new Set([
+  "facebook",
+  "github-getting-started",
+  "google-analytics",
+  "google-calendar",
+  "google-drive",
+  "google-mail",
+  "google-search-console",
+  "linkedin",
+  "meta-marketing-api",
+  "slack",
+  "twitter-v2",
+  "xero",
+  "youtube",
+  "zoom"
+]);
+function scalarId(value) {
+  const valueText = text(value);
+  if (valueText) return valueText;
+  return typeof value === "number" && Number.isFinite(value) ? String(value) : null;
+}
+function providerEmail(value) {
+  const email = text(value)?.toLowerCase() ?? null;
+  return email && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email) ? email : null;
+}
+function compactProviderIdentity(identity) {
+  return identity.id || identity.email || identity.name ? identity : null;
+}
+async function providerProxyJson(args) {
+  return nangoRequest(`/proxy${args.path}`, {
+    query: args.query,
+    headers: {
+      "connection-id": args.upstreamConnectionId,
+      "provider-config-key": args.providerConfigKey,
+      ...args.baseUrlOverride ? { "base-url-override": args.baseUrlOverride } : {}
+    }
+  });
+}
+async function googleProviderAccountIdentity(args) {
+  const request = (path5, query, baseUrlOverride) => providerProxyJson({ ...args, path: path5, query, baseUrlOverride });
+  try {
+    if (args.providerConfigKey === "google-mail") {
+      const payload = asRecord(await request("/gmail/v1/users/me/profile", void 0, "https://gmail.googleapis.com"));
+      const email = providerEmail(payload?.emailAddress);
+      return compactProviderIdentity({ id: email, email, name: null });
+    }
+    if (args.providerConfigKey === "google-drive") {
+      const payload = asRecord(await request("/drive/v3/about", { fields: "user(permissionId,displayName,emailAddress)" }, "https://www.googleapis.com"));
+      const user = asRecord(payload?.user);
+      return compactProviderIdentity({
+        id: text(user?.permissionId),
+        email: providerEmail(user?.emailAddress),
+        name: text(user?.displayName)
+      });
+    }
+    if (args.providerConfigKey === "google-calendar") {
+      const payload = asRecord(await request("/calendar/v3/calendars/primary", void 0, "https://www.googleapis.com"));
+      const id = text(payload?.id);
+      return compactProviderIdentity({ id, email: providerEmail(id), name: text(payload?.summary) });
+    }
+    if (args.providerConfigKey === "youtube") {
+      const payload = asRecord(await request("/youtube/v3/channels", { part: "snippet", mine: "true", maxResults: 1 }, "https://www.googleapis.com"));
+      const first = Array.isArray(payload?.items) ? asRecord(payload.items[0]) : null;
+      return compactProviderIdentity({ id: text(first?.id), email: null, name: text(asRecord(first?.snippet)?.title) });
+    }
+  } catch {
+  }
+  try {
+    const payload = asRecord(await request("/v1/userinfo", void 0, "https://openidconnect.googleapis.com"));
+    return compactProviderIdentity({
+      id: text(payload?.sub),
+      email: payload?.email_verified === false ? null : providerEmail(payload?.email),
+      name: text(payload?.name)
+    });
+  } catch {
+    return null;
+  }
+}
+async function getNangoProviderAccountIdentity(args) {
+  if (!IDENTITY_SUPPORTED_PROVIDERS.has(args.providerConfigKey)) return null;
+  if (args.providerConfigKey.startsWith("google-") || args.providerConfigKey === "youtube") {
+    return googleProviderAccountIdentity(args);
+  }
+  try {
+    if (args.providerConfigKey === "github-getting-started") {
+      const payload = asRecord(await providerProxyJson({ ...args, path: "/user" }));
+      return compactProviderIdentity({ id: scalarId(payload?.id), email: providerEmail(payload?.email), name: text(payload?.name) ?? text(payload?.login) });
+    }
+    if (args.providerConfigKey === "slack") {
+      const payload = asRecord(await providerProxyJson({ ...args, path: "/api/auth.test" }));
+      return compactProviderIdentity({ id: text(payload?.user_id), email: null, name: [text(payload?.user), text(payload?.team)].filter(Boolean).join(" \xB7 ") || null });
+    }
+    if (args.providerConfigKey === "zoom") {
+      const payload = asRecord(await providerProxyJson({ ...args, path: "/v2/users/me" }));
+      const fullName = [text(payload?.first_name), text(payload?.last_name)].filter(Boolean).join(" ");
+      return compactProviderIdentity({ id: text(payload?.id), email: providerEmail(payload?.email), name: text(payload?.display_name) ?? (fullName || null) });
+    }
+    if (args.providerConfigKey === "linkedin") {
+      const payload = asRecord(await providerProxyJson({ ...args, path: "/v2/userinfo" }));
+      return compactProviderIdentity({ id: text(payload?.sub), email: payload?.email_verified === false ? null : providerEmail(payload?.email), name: text(payload?.name) });
+    }
+    if (args.providerConfigKey === "meta-marketing-api" || args.providerConfigKey === "facebook") {
+      const payload = asRecord(await providerProxyJson({ ...args, path: "/me", query: { fields: "id,name,email" } }));
+      return compactProviderIdentity({ id: text(payload?.id), email: providerEmail(payload?.email), name: text(payload?.name) });
+    }
+    if (args.providerConfigKey === "twitter-v2") {
+      const payload = asRecord(await providerProxyJson({ ...args, path: "/2/users/me", query: { "user.fields": "id,name,username" } }));
+      const data = asRecord(payload?.data);
+      return compactProviderIdentity({ id: text(data?.id), email: null, name: text(data?.username) ?? text(data?.name) });
+    }
+    if (args.providerConfigKey === "xero") {
+      const payload = await providerProxyJson({ ...args, path: "/connections" });
+      const first = Array.isArray(payload) ? asRecord(payload[0]) : null;
+      return compactProviderIdentity({ id: text(first?.tenantId), email: null, name: text(first?.tenantName) });
+    }
+  } catch {
+    return null;
+  }
+  return null;
+}
+async function discoverOwnedNangoConnections(identity, options = {}) {
   const rows = [];
   for (let page = 0; page < NANGO_CONNECTION_MAX_PAGES; page += 1) {
     const payload = await nangoRequest("/connections", {
@@ -44291,6 +44477,35 @@ async function discoverOwnedNangoConnections(identity) {
     if (pageRows.length < NANGO_CONNECTION_PAGE_SIZE) break;
   }
   const discovered = rows.filter((row) => connectionIdentityMatches(row, identity)).map(discoveredConnection).filter((connection) => connection !== null);
+  const reconciled = await reconcileDiscoveredNangoConnections(identity, discovered);
+  if (options.resolveProviderIdentity === false) return reconciled;
+  const remoteByKey = new Map(discovered.map((connection) => [
+    `${connection.providerConfigKey}\0${connection.upstreamConnectionId}`,
+    connection
+  ]));
+  await Promise.all(reconciled.map(async (connection) => {
+    if (connection.lifecycleStatus !== "connected" || !connection.upstreamConnectionId) return;
+    const remote = remoteByKey.get(`${connection.providerConfigKey}\0${connection.upstreamConnectionId}`);
+    if (!remote) return;
+    const sourceUpdatedAt = remote.updatedAt ?? remote.createdAt ?? connection.lifecycleStatus;
+    const hasProviderIdentity = Boolean(
+      connection.providerAccountId || connection.providerAccountEmail || connection.providerAccountName
+    );
+    const checkedAt = connection.providerIdentityCheckedAt ? Date.parse(`${connection.providerIdentityCheckedAt.replace(" ", "T")}Z`) : Number.NaN;
+    const unavailableIdentityIsFresh = !hasProviderIdentity && Number.isFinite(checkedAt) && Date.now() - checkedAt < PROVIDER_IDENTITY_RETRY_MS;
+    if (connection.providerIdentitySourceUpdatedAt === sourceUpdatedAt && (hasProviderIdentity || unavailableIdentityIsFresh)) return;
+    const providerIdentity = await getNangoProviderAccountIdentity({
+      upstreamConnectionId: connection.upstreamConnectionId,
+      providerConfigKey: connection.providerConfigKey
+    });
+    await setServiceConnectionProviderIdentity({
+      connectionId: connection.id,
+      providerAccountId: providerIdentity?.id,
+      providerAccountEmail: providerIdentity?.email,
+      providerAccountName: providerIdentity?.name,
+      sourceUpdatedAt
+    });
+  }));
   return reconcileDiscoveredNangoConnections(identity, discovered);
 }
 async function listNangoCatalogDirect() {
@@ -44965,7 +45180,7 @@ async function getNangoConnections(identity, options = {}) {
   if (mainOwnsIntegrations()) {
     let connections;
     try {
-      connections = await discoverOwnedNangoConnections(identity);
+      connections = await discoverOwnedNangoConnections(identity, { resolveProviderIdentity: !options.summaryOnly });
     } catch (error) {
       try {
         connections = await listServiceConnections(identity, "nango");
@@ -44986,11 +45201,12 @@ async function getNangoConnections(identity, options = {}) {
         connectionId: connection.id,
         providerConfigKey: connection.providerConfigKey,
         provider: connection.provider,
-        label: connection.label || connection.providerConfigKey,
-        providerAccountId: null,
-        providerAccountEmail: null,
-        providerAccountName: null,
-        providerIdentityStatus: "unavailable",
+        label: connection.userLabel || connection.providerAccountEmail || connection.providerAccountName || (connection.label && connection.label.toLowerCase() !== identity.trim().toLowerCase() ? connection.label : null) || connection.providerConfigKey,
+        userLabel: connection.userLabel,
+        providerAccountId: connection.providerAccountId,
+        providerAccountEmail: connection.providerAccountEmail,
+        providerAccountName: connection.providerAccountName,
+        providerIdentityStatus: connection.providerIdentityCheckedAt ? connection.providerAccountId || connection.providerAccountEmail || connection.providerAccountName ? "verified" : "unavailable" : "pending",
         status: connection.reconnectRequired ? "needs_reauth" : "connected",
         lifecycleStatus: connection.lifecycleStatus,
         operationalStatus: connection.operationalStatus,
@@ -45091,6 +45307,7 @@ async function getNangoConnections(identity, options = {}) {
       providerConfigKey,
       provider,
       label,
+      userLabel: null,
       providerAccountId,
       providerAccountEmail,
       providerAccountName,
@@ -46932,6 +47149,26 @@ app.get("/schedule-connections", auth4, async (c) => {
     return scheduleConnectionError(c, err, "Unable to load service connections.");
   }
 });
+app.patch("/schedule-connections/:id/label", auth4, async (c) => {
+  const user = c.get("user");
+  const body = await c.req.json().catch(() => ({}));
+  if (body.label !== null && typeof body.label !== "string") {
+    return c.json({ ok: false, error: "label must be a string or null." }, 400);
+  }
+  const label = typeof body.label === "string" ? body.label.normalize("NFKC").trim().replace(/\s+/g, " ") : null;
+  if (label && label.length > 80) {
+    return c.json({ ok: false, error: "label must contain at most 80 characters." }, 400);
+  }
+  try {
+    const userLabel = await setServiceConnectionUserLabel(user.email, c.req.param("id"), label || null);
+    return c.json({ ok: true, userLabel });
+  } catch (err) {
+    if (err instanceof Error && err.message === "service_connection_not_found") {
+      return c.json({ ok: false, error: "Service connection not found." }, 404);
+    }
+    return scheduleConnectionError(c, err, "Unable to rename this service connection.");
+  }
+});
 app.post("/schedule-connections/billing/reconcile", auth4, requireIntegrationsTier, async (c) => {
   const user = c.get("user");
   try {
@@ -47518,6 +47755,7 @@ app.post("/integrations/billing/reconcile", (c) => forwardIntegrationAlias(c, "/
 app.post("/integrations/:id/reconnect-session", (c) => forwardIntegrationAlias(c, `/schedule-connections/${encodeURIComponent(c.req.param("id"))}/reconnect-session`));
 app.post("/integrations/:id/enable-actions", (c) => forwardIntegrationAlias(c, `/schedule-connections/${encodeURIComponent(c.req.param("id"))}/enable-actions`));
 app.post("/integrations/:id/test", (c) => forwardIntegrationAlias(c, `/schedule-connections/${encodeURIComponent(c.req.param("id"))}/test`));
+app.patch("/integrations/:id/label", (c) => forwardIntegrationAlias(c, `/schedule-connections/${encodeURIComponent(c.req.param("id"))}/label`));
 app.delete("/integrations/:id", (c) => forwardIntegrationAlias(c, `/schedule-connections/${encodeURIComponent(c.req.param("id"))}`));
 app.post("/integrations/actions/read", (c) => forwardIntegrationAlias(c, "/schedule-connections/actions/read"));
 app.post("/integrations/actions/describe", (c) => forwardIntegrationAlias(c, "/schedule-connections/actions/describe"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-scraper",
-  "version": "0.66.3",
+  "version": "0.66.4",
   "description": "MCP server for MCP Scraper web intelligence tools",
   "type": "module",
   "main": "./dist/index.cjs",