mcp-scraper 0.86.5 → 0.88.0

package/CHANGELOG.md

@@ -4,6 +4,25 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 
 ## [Unreleased]
 
+## [0.88.0] - 2026-09-02
+
+### Changed
+
+- Made one `MCP_SCRAPER_API_KEY` authenticate scraping, Memory, Research, and native CRM through the canonical root MCP endpoint; root-to-Memory calls now use short-lived audience-bound owner assertions.
+- Reduced the customer-callable unified catalog from 377 to 375 tools by retiring Memory key issuance and scope mutation, while preserving explicit compatibility errors in SDK clients.
+- Added strict-schema validation for all 148 direct Memory tools and an authenticated 30-screenshot CRM workspace proof runner covering ten surfaces at wide, compact, and mobile viewports.
+
+### Security
+
+- Stopped normal creation, storage, display, and use of long-lived per-user Memory keys. Existing direct `mk_` credentials remain accepted for one documented compatibility release and can still be listed or revoked.
+
+## [0.87.0] - 2026-09-02
+
+### Added
+
+- Added optional `pages: 2` support to synchronous and durable PAA harvests, capturing a second organic result page before expanding questions on the untouched first page.
+- Added requested/captured page counts and bounded second-page outcomes to live results, durable recovery, the dashboard, and generated client contracts. A failed optional page-two capture preserves first-page evidence.
+
 ## [0.86.5] - 2026-09-02
 
 ### Fixed
@@ -1705,7 +1724,9 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 - Write actions remain unavailable until the account owner explicitly enables them.
 - Provider-specific connection data is normalized into one agent-facing contract.
 
-[Unreleased]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.86.0...HEAD
+[Unreleased]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.88.0...HEAD
+[0.88.0]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.87.0...v0.88.0
+[0.87.0]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.86.5...v0.87.0
 [0.86.0]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.85.0...v0.86.0
 [0.84.0]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.83.5...v0.84.0
 [0.83.5]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.83.4...v0.83.5

package/README.md

@@ -175,7 +175,7 @@ Build the branded one-click bundle:
 npm run build:mcpb
 ```
 
-The generated bundle is written to `build/mcpb/mcp-scraper-<version>.mcpb` and copied to `public/downloads/` for the hosted download. The current public bundle is `https://mcpscraper.dev/downloads/mcp-scraper.mcpb` (`0.86.5`, SHA-256 `c4ca185e4e7cbd8877e1fd100713e9eacef4e018b66eb435e107535736310916`). Install it by opening or dragging it into Claude Desktop. Claude displays the `MCP Scraper` install card, icon, API-key configuration field, and manually curated current-release message from the bundle manifest.
+The generated bundle is written to `build/mcpb/mcp-scraper-<version>.mcpb` and copied to `public/downloads/` for the hosted download. The current public bundle is `https://mcpscraper.dev/downloads/mcp-scraper.mcpb` (`0.88.0`, SHA-256 `ff593dd4184122b9d9ef10bb0a9c21a907f8e2e180520dfbe56001bff0ee090d`). Install it by opening or dragging it into Claude Desktop. Claude displays the `MCP Scraper` install card, icon, API-key configuration field, and manually curated current-release message from the bundle manifest.
 
 The MCPB install exposes every tool — web-intelligence plus all `browser_*` tools — through the one `mcp-scraper` server.
 
@@ -235,9 +235,22 @@ env = { MCP_SCRAPER_API_KEY = "sk_live_your_key" }
 
 ## Tools
 
+### Two-page PAA harvests
+
+Pass this input to `harvest_paa` (or add an `idempotencyKey` for `harvest_paa_start`):
+
+```json
+{"query":"commercial truck insurance","pages":2,"maxQuestions":10}
+```
+
+The harvester attempts page 2 organic results before expanding PAA on the untouched first page. It does not harvest a second PAA graph. `pages` accepts 1 or 2 and defaults to 1; pricing is unchanged. If page 2 is missing, empty, or cannot load, available first-page evidence is retained.
+
+Check `pagination.requestedPages`, `pagination.capturedPages`, and `pagination.page2Status` in the MCP result before assuming both pages were captured. Raw REST results place the same fields under `diagnostics.pagination`. Legacy saved results may have no pagination metadata, which MCP formatters expose as `null`.
+
 ### Web-intelligence tools
 
-- `harvest_paa`
+- `harvest_paa` — expand People Also Ask on the original first result page. Optional `pages: 2` captures a second organic result page first; the default is one page.
+- `harvest_paa_start` — start the same harvest as a durable job, with the same optional `pages: 2`.
 - `search_serp`
 - `extract_url` — extract normal or Wayback-replayed page copy; Wayback results omit playback chrome and can include a timestamp-matched featured image. Set `preserveMedia:true` to union static and rendered/lazy media, collapse responsive variants, attach up to `maxInlineImages` AI-readable images, and receive an owner-scoped ZIP manifest readable with `archive_read`. Branding output ranks the site logo separately from evidence-bounded proof images such as certifications, awards, memberships, partner/customer marks, and press mentions.
 - `map_site_urls`
@@ -337,9 +350,9 @@ The `mcp-scraper` server (and the MCPB bundle, which runs it) exposes both secti
 
 All MCP tools return `structuredContent` with the IDs, URLs, CSV paths, transcripts, browser session handles, replay paths, artifacts, recipe fields, or blueprint fields needed by the next step, plus readable text content for compatibility. Runtime `tools/list` omits output schemas so strict clients can register the complete catalog; the generated developer manifest retains every canonical output schema for validation and typed SDK generation. All tools carry MCP annotations; file-writing tools such as replay downloads and annotations state their filesystem side effects.
 
-The canonical tool inventory is generated at `docs/mcp-tool-manifest.generated.json`. The unified server exposes 377 tools: 249 scraper, browser, workflow, billing, connected-service, and personal-assistant tools plus 128 durable-memory tools. The scraper-side inventory includes complete Gmail selection, message, attachment, export, bulk-action, and Memory-import workflows; governed personal-assistant commands, messaging, approvals, grants, number setup, and execution readback; durable PAA starts and status; rendered site-content similarity; governed Local Sourcebook and Transparent Commons workflows; direct site-export reads; Editorial Reading Room and News Publisher templates; and production X-Ray setup, analytics, seven-model attribution, structured post-purchase surveys, reported impact, truthful view-evidence status, CRM policy and receipt, campaign, export, and scheduled-report tools. Provider setup remains absent until its authorization, ingestion, reconciliation, privacy, canary, cleanup, and deployment receipts are complete. Successful evidence-compiled Local Sourcebook revisions publish automatically to their canonical `localsourcebook.com` category profile and review URLs; administrator controls handle exceptional rejection or unpublishing. Release verification compares the exact local and hosted tool-name sets, not only the count.
+The canonical tool inventory is generated at `docs/mcp-tool-manifest.generated.json`. The unified server exposes 375 tools: 249 scraper, browser, workflow, billing, connected-service, and personal-assistant tools plus 126 durable-memory tools. The two retired customer credential mutations are no longer advertised. The scraper-side inventory includes complete Gmail selection, message, attachment, export, bulk-action, and Memory-import workflows; governed personal-assistant commands, messaging, approvals, grants, number setup, and execution readback; durable PAA starts and status; rendered site-content similarity; governed Local Sourcebook and Transparent Commons workflows; direct site-export reads; Editorial Reading Room and News Publisher templates; and production X-Ray setup, analytics, seven-model attribution, structured post-purchase surveys, reported impact, truthful view-evidence status, CRM policy and receipt, campaign, export, and scheduled-report tools. Provider setup remains absent until its authorization, ingestion, reconciliation, privacy, canary, cleanup, and deployment receipts are complete. Successful evidence-compiled Local Sourcebook revisions publish automatically to their canonical `localsourcebook.com` category profile and review URLs; administrator controls handle exceptional rejection or unpublishing. Release verification compares the exact local and hosted tool-name sets, not only the count.
 
-For contract parity, stdio and MCPB memory calls invoke the matching public tool on the hosted MCP Scraper `/mcp` endpoint. The hosted aggregate runtime owns MCP Scraper-specific billing, scheduling, credential, and in-process cutover policy; its internal `/memory/mcp-call` bridge is a fallback to the standalone memory service, not the public stdio execution path. Direct `mcp-memory` OAuth and stdio clients continue to use `memory.mcpscraper.dev` and must be verified as a separate dependent release surface.
+For contract parity, stdio and MCPB memory calls invoke the matching public tool on the hosted MCP Scraper `/mcp` endpoint. The hosted aggregate runtime owns MCP Scraper-specific billing, scheduling, credential, and in-process cutover policy; its internal `/memory/mcp-call` bridge is a fallback to the standalone Memory service, not a second customer setup path. Existing direct Memory credentials remain compatible for one release, but all new customer setup uses the root endpoint and `MCP_SCRAPER_API_KEY`.
 
 ## Resources
 

package/dist/bin/api-server.js

@@ -17,8 +17,8 @@ loadDotEnv();
 async function main() {
   const [{ serve }, { app, personalAssistantProductionStartup }, { startWorker }, { migrate }] = await Promise.all([
     import("@hono/node-server"),
-    import("../server-ARMF2IRI.js"),
-    import("../worker-OQSFSLNG.js"),
+    import("../server-PD3TDL6Q.js"),
+    import("../worker-LDCAULWL.js"),
     import("../db-Z34LPZNR.js")
   ]);
   const PORT = parseInt(process.env.PORT ?? "3001");

package/dist/bin/mcp-scraper-cli.js

@@ -6,9 +6,9 @@ import {
   openWorkflowReport,
   runWorkflow,
   workflowOutputBaseDir
-} from "../chunk-6IOGTFNS.js";
+} from "../chunk-UZPTGUDV.js";
 import "../chunk-RJ7JVYKU.js";
-import "../chunk-OWF2JJKN.js";
+import "../chunk-GXBZXWXB.js";
 import {
   XRAY_INSTALL_CONTRACT,
   XRAY_INSTALL_PROTOCOL_DIGEST,
@@ -19,7 +19,7 @@ import {
 import "../chunk-GGZEC22A.js";
 import {
   PACKAGE_VERSION
-} from "../chunk-BA6BPDSP.js";
+} from "../chunk-XIJI34RM.js";
 
 // src/cli/human-cli.ts
 import { Command } from "commander";

package/dist/bin/mcp-scraper-core.js

@@ -1,19 +1,19 @@
 #!/usr/bin/env node
 import {
   runMcpScraperStdio
-} from "../chunk-TV32LC76.js";
-import "../chunk-QJJQ4OAZ.js";
+} from "../chunk-P5FPC54B.js";
+import "../chunk-2JVZQGSN.js";
 import "../chunk-PGJQDMC2.js";
 import "../chunk-DNM65UCK.js";
 import "../chunk-T3MZISOF.js";
 import "../chunk-6HAV7LCE.js";
-import "../chunk-NKRO2SUO.js";
+import "../chunk-4QMUF6XM.js";
 import "../chunk-OM7HVEJ3.js";
 import "../chunk-OPQIGAFB.js";
-import "../chunk-3JRZZVWL.js";
+import "../chunk-ABF2CGOZ.js";
 import "../chunk-P7FWOMU7.js";
 import "../chunk-GGZEC22A.js";
-import "../chunk-BA6BPDSP.js";
+import "../chunk-XIJI34RM.js";
 import "../chunk-YXNDOQXN.js";
 
 // src/mcp/thorbit-restricted-tool-surface.ts

package/dist/bin/mcp-scraper-install.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   renderInstallTerminal
-} from "../chunk-3JRZZVWL.js";
+} from "../chunk-ABF2CGOZ.js";
 import {
   PACKAGE_VERSION
-} from "../chunk-BA6BPDSP.js";
+} from "../chunk-XIJI34RM.js";
 
 // bin/mcp-scraper-install.ts
 var noColor = process.argv.includes("--no-color") || process.env.NO_COLOR !== void 0 || process.env.FORCE_COLOR === "0" || !process.stdout.isTTY;

package/dist/bin/mcp-stdio-server.js

@@ -1,19 +1,19 @@
 #!/usr/bin/env node
 import {
   runMcpScraperStdio
-} from "../chunk-TV32LC76.js";
-import "../chunk-QJJQ4OAZ.js";
+} from "../chunk-P5FPC54B.js";
+import "../chunk-2JVZQGSN.js";
 import "../chunk-PGJQDMC2.js";
 import "../chunk-DNM65UCK.js";
 import "../chunk-T3MZISOF.js";
 import "../chunk-6HAV7LCE.js";
-import "../chunk-NKRO2SUO.js";
+import "../chunk-4QMUF6XM.js";
 import "../chunk-OM7HVEJ3.js";
 import "../chunk-OPQIGAFB.js";
-import "../chunk-3JRZZVWL.js";
+import "../chunk-ABF2CGOZ.js";
 import "../chunk-P7FWOMU7.js";
 import "../chunk-GGZEC22A.js";
-import "../chunk-BA6BPDSP.js";
+import "../chunk-XIJI34RM.js";
 import "../chunk-YXNDOQXN.js";
 
 // bin/mcp-stdio-server.ts

package/dist/bin/paa-harvest.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import {
   harvest
-} from "../chunk-NH4QAH3X.js";
+} from "../chunk-S24LFPL7.js";
 import {
   browserServiceApiKey
 } from "../chunk-OM7HVEJ3.js";
 import "../chunk-OPQIGAFB.js";
-import "../chunk-OWF2JJKN.js";
+import "../chunk-GXBZXWXB.js";
 import "../chunk-YXNDOQXN.js";
 
 // src/cli.ts

package/dist/{chunk-QJJQ4OAZ.js → chunk-2JVZQGSN.js}

@@ -26,7 +26,7 @@ import {
   PAA_QUESTION_CREDITS,
   PAGE_SCRAPE_CREDITS,
   SERP_SEARCH_CREDITS
-} from "./chunk-NKRO2SUO.js";
+} from "./chunk-4QMUF6XM.js";
 import {
   browserServiceProfileName,
   browserServiceProfileSaveChanges
@@ -50,7 +50,7 @@ import {
 } from "./chunk-P7FWOMU7.js";
 import {
   PACKAGE_VERSION
-} from "./chunk-BA6BPDSP.js";
+} from "./chunk-XIJI34RM.js";
 import {
   PUBLIC_ERROR_CODES,
   buildPublicErrorEnvelope,
@@ -1126,6 +1126,28 @@ function errorAttemptsSection(body) {
 Attempts:
 ${lines.join("\n")}`;
 }
+function publicHarvestPagination(value) {
+  const row = structuredRecord(value);
+  const statuses = ["not_requested", "not_attempted", "captured", "unavailable", "failed"];
+  const codes = ["missing_next", "invalid_next", "empty_page", "captcha", "timeout", "navigation_error", "unsupported_driver"];
+  if (row.requestedPages !== 1 && row.requestedPages !== 2 || row.capturedPages !== 1 && row.capturedPages !== 2 || !statuses.includes(row.page2Status) || !Number.isInteger(row.page1OrganicCount) || Number(row.page1OrganicCount) < 0 || !Number.isInteger(row.page2OrganicCount) || Number(row.page2OrganicCount) < 0) return null;
+  const captured = row.page2Status === "captured";
+  if (captured !== (row.capturedPages === 2) || captured && (row.requestedPages !== 2 || Number(row.page2OrganicCount) === 0) || !captured && row.page2OrganicCount !== 0 || row.requestedPages === 1 && row.page2Status !== "not_requested" || row.requestedPages === 2 && row.page2Status === "not_requested" || row.page2Status === "not_attempted" && row.failureCode !== void 0) return null;
+  return {
+    requestedPages: row.requestedPages,
+    capturedPages: row.capturedPages,
+    page2Status: row.page2Status,
+    page1OrganicCount: Number(row.page1OrganicCount),
+    page2OrganicCount: Number(row.page2OrganicCount),
+    ...codes.includes(row.failureCode) ? { failureCode: row.failureCode } : {}
+  };
+}
+function harvestPaginationText(pagination) {
+  if (!pagination) return "";
+  const outcome = pagination.page2Status === "captured" ? "Page 2 organic results captured; PAA harvested on the original first page." : pagination.requestedPages === 2 ? `Page 2 ${pagination.page2Status.replaceAll("_", " ")}${pagination.failureCode ? ` (${pagination.failureCode})` : ""}; first-page evidence retained.` : "PAA harvested on the first page.";
+  return `
+**Pagination:** ${pagination.capturedPages} of ${pagination.requestedPages} requested organic pages captured. ${outcome}`;
+}
 function publicPaaLifecycle(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return null;
   const row = value;
@@ -1285,6 +1307,7 @@ function formatHarvestPaa(raw, input) {
   const aiOvw = d.aiOverview;
   const diagnostics = d.diagnostics;
   const durationMs = d.stats?.durationMs;
+  const pagination = publicHarvestPagination(diagnostics?.pagination);
   const paaRows = flat.map(
     (r, i) => `| ${i + 1} | ${cell(r.question)} | ${cell(truncate(r.answer, 120))} | ${cell(r.source_title || r.source_site || "")} |`
   ).join("\n");
@@ -1317,7 +1340,7 @@ ${serpRows}` : "";
 - Dig into a result: use \`extract_url\` on any organic URL`;
   const full = `# PAA Report: "${input.query}"${input.location ? ` \xB7 ${input.location}` : ""}
 
-${paaTable}${serpTable}${entityIdsSection(entityIds)}${aiSection}${statsLine}${debugSection(diagnostics?.debug)}${tips}`;
+${paaTable}${harvestPaginationText(pagination)}${serpTable}${entityIdsSection(entityIds)}${aiSection}${statsLine}${debugSection(diagnostics?.debug)}${tips}`;
   return {
     ...oneBlock(full),
     structuredContent: {
@@ -1330,6 +1353,7 @@ ${paaTable}${serpTable}${entityIdsSection(entityIds)}${aiSection}${statsLine}${d
       degradationReasons: diagnostics?.degradationReasons ?? [],
       retryRecommended: diagnostics?.retryRecommended ?? null,
       paaLifecycle: publicPaaLifecycle(diagnostics?.paaLifecycle),
+      pagination,
       questions: flat.map((r) => publicPaaQuestion(r)),
       organicResults: organic.map((r) => publicOrganicResult(r)),
       aiOverview: publicAiOverview(aiOvw),
@@ -1390,6 +1414,7 @@ function durablePaaProgress(result, options) {
     );
   }
   return {
+    pagination: publicHarvestPagination(diagnostics.pagination ?? structuredRecord(rawProgress.material).pagination),
     requestedQuestions: finiteNonNegative(completeness.requestedQuestions ?? options.maxQuestions),
     capturedQuestions: captured,
     answeredQuestions: answered,
@@ -1410,6 +1435,7 @@ function durablePaaResult(result) {
     resultQuality: nullableBoundedString(diagnostics.resultQuality ?? result.resultQuality),
     retryRecommended: typeof diagnostics.retryRecommended === "boolean" ? diagnostics.retryRecommended : typeof result.retryRecommended === "boolean" ? result.retryRecommended : null,
     paaLifecycle: publicPaaLifecycle(diagnostics.paaLifecycle ?? structuredRecord(result.progress).lifecycle),
+    pagination: publicHarvestPagination(diagnostics.pagination ?? structuredRecord(structuredRecord(result.progress).material).pagination),
     questionCount: rows.length,
     questions: rows.map(publicPaaQuestion),
     organicResults: Array.isArray(result.organicResults) ? result.organicResults.filter((row) => row && typeof row === "object").map((row) => publicOrganicResult(row)) : [],
@@ -1521,7 +1547,7 @@ function formatHarvestPaaStatus(raw) {
   return {
     content: [{
       type: "text",
-      text: recovering ? `PAA job ${jobId}: recovering automatically after an interrupted worker. ${progress.capturedQuestions ?? 0} questions are preserved; keep polling this same job.` : `PAA job ${jobId}: ${state}. ${progress.capturedQuestions ?? 0} questions are preserved.`
+      text: (recovering ? `PAA job ${jobId}: recovering automatically after an interrupted worker. ${progress.capturedQuestions ?? 0} questions are preserved; keep polling this same job.` : `PAA job ${jobId}: ${state}. ${progress.capturedQuestions ?? 0} questions are preserved.`) + harvestPaginationText(publicHarvestPagination(structuredRecord(result.diagnostics).pagination ?? structuredRecord(structuredRecord(result.progress).material).pagination))
     }],
     structuredContent
   };
@@ -8725,6 +8751,7 @@ var WebsiteUrlOrDomainSchema = z7.string().trim().min(1).transform((raw, ctx) =>
   }
 });
 var HarvestPaaInputSchema = {
+  pages: z7.number().int().min(1).max(2).default(1).describe("Organic result pages to capture. Default 1, maximum 2. Page 2 is captured when available before harvesting PAA on the original first page; it does not add a second PAA graph. Pagination output reports the pages actually captured."),
   query: z7.string().min(1).describe('The search topic, exactly as it should be searched, e.g. "best hvac company in Denver". Include the place here when you want it in the search terms \u2014 the server sends your query to Google unchanged and never adds or removes a location.'),
   location: z7.string().optional().describe('Where Google should think the searcher is, e.g. "Denver, CO". Sets the Google UULE parameter only \u2014 it never changes your query text and never selects a proxy. To put the place in the search terms too, write it into query.'),
   maxQuestions: z7.number().int().min(1).max(200).default(30).describe("PAA questions to extract. Default 30, maximum 200. Use 10 for quick probes, 100-200 for deep research. Billed per extracted question; unused hold refunded."),
@@ -10019,6 +10046,14 @@ var PaaInteractionOutput = z7.object({
   sourceCount: z7.number().int().min(0),
   errorCode: z7.enum(["click_failed", "click_ack_timeout", "control_missing", "confirmation_timeout"]).nullable()
 });
+var HarvestPaginationOutput = z7.object({
+  requestedPages: z7.union([z7.literal(1), z7.literal(2)]),
+  capturedPages: z7.union([z7.literal(1), z7.literal(2)]),
+  page2Status: z7.enum(["not_requested", "not_attempted", "captured", "unavailable", "failed"]),
+  page1OrganicCount: z7.number().int().min(0),
+  page2OrganicCount: z7.number().int().min(0),
+  failureCode: z7.enum(["missing_next", "invalid_next", "empty_page", "captcha", "timeout", "navigation_error", "unsupported_driver"]).optional()
+}).nullable();
 var HarvestPaaOutputSchema = {
   query: z7.string(),
   location: NullableString,
@@ -10029,6 +10064,7 @@ var HarvestPaaOutputSchema = {
   degradationReasons: z7.array(z7.string()),
   retryRecommended: z7.boolean().nullable(),
   paaLifecycle: PaaLifecycleOutput,
+  pagination: HarvestPaginationOutput,
   questions: z7.array(PaaQuestionOutput),
   organicResults: z7.array(OrganicResultOutput),
   aiOverview: AiOverviewOutput,
@@ -10036,6 +10072,7 @@ var HarvestPaaOutputSchema = {
   durationMs: z7.number().min(0).nullable()
 };
 var HarvestPaaDurableProgressOutput = z7.object({
+  pagination: HarvestPaginationOutput,
   requestedQuestions: z7.number().int().min(0).nullable(),
   capturedQuestions: z7.number().int().min(0),
   answeredQuestions: z7.number().int().min(0),
@@ -10077,6 +10114,7 @@ var HarvestPaaDurableBillingOutput = z7.object({
   refundMc: z7.number().int().min(0).nullable()
 });
 var HarvestPaaDurableResultOutput = z7.object({
+  pagination: HarvestPaginationOutput,
   completionStatus: NullableString,
   resultQuality: NullableString,
   retryRecommended: z7.boolean().nullable(),
@@ -17286,7 +17324,7 @@ function registerPaaExtractorMcpTools(server, executor, options = {}) {
   registerPersonalAssistantMcpSurface(server, executor);
   server.registerTool("harvest_paa", {
     title: "Google PAA + SERP Harvest",
-    description: `Expand one Google People Also Ask SERP into questions, answers, every preserved source, AI Overview evidence, ranking URLs, and entity IDs. maxQuestions is a target count, not traversal depth. Results distinguish target_reached, proven frontier_exhausted, interruption, and recovery_exhausted; a failed click or browser timeout is never reported as exhaustion. This compatibility tool waits; use harvest_paa_start plus harvest_paa_status for long runs. Optional SERP modules require their include flags. Use gl and location for regional context. Costs ${PAA_BASE_CREDITS} Credits per harvest plus ${PAA_QUESTION_CREDITS} Credits per question actually returned; unused hold is refunded. After a timeout or unknown response, reuse the same idempotencyKey. Call credits_info for current pricing and balance.`,
+    description: `Expand one Google People Also Ask SERP into questions, answers, every preserved source, AI Overview evidence, ranking URLs, and entity IDs. Set pages to 2 to add the second organic-results page when available; PAA is still expanded once on the preserved first page, and pagination reports what was captured. maxQuestions is a target count, not traversal depth. Results distinguish target_reached, proven frontier_exhausted, interruption, and recovery_exhausted; a failed click or browser timeout is never reported as exhaustion. This compatibility tool waits; use harvest_paa_start plus harvest_paa_status for long runs. Optional SERP modules require their include flags. Use gl and location for regional context. Costs ${PAA_BASE_CREDITS} Credits per harvest plus ${PAA_QUESTION_CREDITS} Credits per question actually returned; unused hold is refunded. After a timeout or unknown response, reuse the same idempotencyKey. Call credits_info for current pricing and balance.`,
     inputSchema: harvestPaaInputSchema,
     outputSchema: recordOutputSchema("harvest_paa", HarvestPaaOutputSchema),
     annotations: liveWebToolAnnotations("Google PAA + SERP Harvest")
@@ -17299,7 +17337,7 @@ function registerPaaExtractorMcpTools(server, executor, options = {}) {
   });
   server.registerTool("harvest_paa_start", {
     title: "Start Durable Google PAA Harvest",
-    description: `Start a durable Google People Also Ask harvest and return its job receipt. maxQuestions is the requested target count. The job automatically resumes an interrupted serverless worker under the same jobId, idempotency key, and billing hold while preserving checkpoints. Keep one idempotencyKey after a timeout, unknown response, or in-progress reply; replaying it recovers the existing job without a duplicate charge. Poll jobId with harvest_paa_status. Costs ${PAA_BASE_CREDITS} Credits plus ${PAA_QUESTION_CREDITS} per retained question; unused hold is refunded.`,
+    description: `Start a durable Google People Also Ask harvest and return its job receipt. Set pages to 2 to add the second organic-results page when available; PAA is still expanded once on the preserved first page, and pagination survives checkpoint recovery. maxQuestions is the requested target count. The job automatically resumes an interrupted serverless worker under the same jobId, idempotency key, and billing hold while preserving checkpoints. Keep one idempotencyKey after a timeout, unknown response, or in-progress reply; replaying it recovers the existing job without a duplicate charge. Poll jobId with harvest_paa_status. Costs ${PAA_BASE_CREDITS} Credits plus ${PAA_QUESTION_CREDITS} per retained question; unused hold is refunded.`,
     inputSchema: harvestPaaStartInputSchema,
     outputSchema: recordOutputSchema("harvest_paa_start", HarvestPaaStartOutputSchema),
     annotations: { ...liveWebToolAnnotations("Start Durable Google PAA Harvest"), readOnlyHint: false, idempotentHint: true }
@@ -17309,7 +17347,7 @@ function registerPaaExtractorMcpTools(server, executor, options = {}) {
   });
   server.registerTool("harvest_paa_status", {
     title: "Check Durable Google PAA Harvest",
-    description: "Poll an owner-scoped harvest_paa_start job. Returns the job/operation/task correlation ID, saved progress, automatic-recovery count, target and discovery status, material completeness, recent per-control interaction outcomes with 0.7/1.0/1.4-second confirmation telemetry, provider-session-correlated attempts, terminal rows, and billing. frontier_exhausted means every observed eligible PAA control was processed plus three healthy no-growth confirmations; interruption never means exhaustion. Polling never starts or bills another run.",
+    description: "Poll an owner-scoped harvest_paa_start job. Returns the job/operation/task correlation ID, saved progress, automatic-recovery count, target and discovery status, material completeness, bounded organic-page pagination, recent per-control interaction outcomes with 0.7/1.0/1.4-second confirmation telemetry, provider-session-correlated attempts, terminal rows, and billing. Page-two outcomes describe organic results only; the PAA graph always comes from the preserved first page. frontier_exhausted means every observed eligible PAA control was processed plus three healthy no-growth confirmations; interruption never means exhaustion. Polling never starts or bills another run.",
     inputSchema: HarvestPaaStatusInputSchema,
     outputSchema: recordOutputSchema("harvest_paa_status", HarvestPaaStatusOutputSchema),
     annotations: { ...liveWebToolAnnotations("Check Durable Google PAA Harvest"), idempotentHint: true, openWorldHint: false }
@@ -32266,6 +32304,10 @@ var MEMORY_TOOL_SCHEMAS = [
 var MEMORY_TOOL_DESCRIPTION_OVERRIDES = {
   "access-swap-vault": "Set the account's persisted active vault so later memory calls may omit vault and use it by default across stateless requests. The vault must be entitled to the key and the key must hold 'swap' scope."
 };
+var LEGACY_DIRECT_CREDENTIAL_TOOL_IDS = /* @__PURE__ */ new Set([
+  "access-issue-key",
+  "access-set-scope"
+]);
 var MEMORY_TOOL_REGISTRY = [
   ...MEMORY_TOOL_SCHEMAS.map((schema) => ({
     ...schema,
@@ -32273,7 +32315,7 @@ var MEMORY_TOOL_REGISTRY = [
   })),
   ...MEMORY_GOVERNED_TOOL_SCHEMAS,
   ...MEMORY_IMAGE_TOOL_SCHEMAS
-];
+].filter((schema) => !LEGACY_DIRECT_CREDENTIAL_TOOL_IDS.has(schema.id));
 
 // src/mcp/memory-mcp-server.ts
 function registerMemoryMcpTools(server, executor) {

package/dist/{chunk-NKRO2SUO.js → chunk-4QMUF6XM.js}

@@ -213,9 +213,9 @@ var PUBLIC_PRODUCT_CONTRACT = {
     "freeSignupCredits": 0
   },
   "inventory": {
-    "totalTools": 377,
+    "totalTools": 375,
     "scraperTools": 249,
-    "memoryTools": 128
+    "memoryTools": 126
   },
   "concurrencyPack": {
     "ratePolicyVersion": "2026-08-14.concurrency-pack-v1",

package/dist/{chunk-3JRZZVWL.js → chunk-ABF2CGOZ.js}

@@ -1,6 +1,6 @@
 // release-message.json
 var release_message_default = {
-  message: "Reddit thread hydration now retries two fresh residential sessions and two managed-browser backups, stopping at the first accepted result while preserving attempt and provider-cost telemetry."
+  message: "PAA harvests can now request two organic result pages before expanding questions on the original first page. Use pages: 2 in MCP, SDKs, or the dashboard and check the reported capture status; an unavailable second page preserves first-page evidence."
 };
 
 // src/install-terminal.ts
@@ -55,7 +55,7 @@ function renderInstallTerminal(options) {
     "1/1 install surfaces ready",
     colorize(`Newest in v${options.version}: ${release_message_default.message}`, "lime", color),
     "",
-    `${colorize("Tools", "cyan", color)}  ${colorize("(377 MCP tools)", "muted", color)}`,
+    `${colorize("Tools", "cyan", color)}  ${colorize("(375 MCP tools)", "muted", color)}`,
     toolRow("search", ["harvest_paa", "search_serp", "maps_search", "maps_place_intel"], color),
     toolRow("extract", ["extract_url", "map_site_urls", "extract_site", "audit_site", "directory_workflow"], color),
     toolRow("build", ["create_editorial_reading_room", "rank_tracker_workflow", "portable HTML"], color),

package/dist/{chunk-OWF2JJKN.js → chunk-GXBZXWXB.js}

@@ -150,18 +150,18 @@ var RawMapsAboutAttributeSchema = z.object({
 
 // src/output/memory-library-sink.ts
 async function postToMemoryLibrary(args) {
-  const url = process.env.MCP_MEMORY_INGEST_URL;
-  const key = process.env.MCP_MEMORY_KEY;
-  if (!url || !key) return;
+  const key = process.env.MCP_SCRAPER_API_KEY?.trim();
+  const baseUrl = (process.env.MCP_SCRAPER_BASE_URL ?? "https://mcpscraper.dev").replace(/\/$/, "");
+  if (!key) return;
   try {
-    const res = await fetch(url, {
+    const res = await fetch(`${baseUrl}/memory/mcp-call`, {
       method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ data: { apiKey: key, title: args.title, content: args.content, source: args.source } })
+      headers: { "content-type": "application/json", "x-api-key": key },
+      body: JSON.stringify({ toolName: "libraryIngestTool", args })
     });
     const body = await res.json().catch(() => null);
-    if (!res.ok || body?.result?.error) {
-      console.warn("[memory-library-sink] ingest not accepted:", res.status, body?.result?.message ?? "");
+    if (!res.ok || body?.ok === false) {
+      console.warn("[memory-library-sink] ingest not accepted:", res.status, body?.error ?? "");
     }
   } catch (err) {
     console.warn("[memory-library-sink] ingest failed:", err?.message);

package/dist/{chunk-KQWVJOVR.js → chunk-IHXAXYIS.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-DNM65UCK.js";
 import {
   LedgerOperation
-} from "./chunk-NKRO2SUO.js";
+} from "./chunk-4QMUF6XM.js";
 import {
   CREDIT_LOT_TTL,
   getDb,

package/dist/{chunk-WFGAR4BZ.js → chunk-MZDNZQWT.js}

@@ -19,7 +19,7 @@ import {
   LedgerOperation,
   MC_PER_CREDIT,
   calculateConnectedUsageCharge
-} from "./chunk-NKRO2SUO.js";
+} from "./chunk-4QMUF6XM.js";
 import {
   recordVendorUsage,
   runWithCostContext

package/dist/{chunk-TV32LC76.js → chunk-P5FPC54B.js}

@@ -12,13 +12,13 @@ import {
   registerScheduledResultsMcpTools,
   registerSerpIntelligenceCaptureTools,
   resolveDeploymentProfile
-} from "./chunk-QJJQ4OAZ.js";
+} from "./chunk-2JVZQGSN.js";
 import {
   renderInstallTerminal
-} from "./chunk-3JRZZVWL.js";
+} from "./chunk-ABF2CGOZ.js";
 import {
   PACKAGE_VERSION
-} from "./chunk-BA6BPDSP.js";
+} from "./chunk-XIJI34RM.js";
 
 // src/mcp/stdio-runtime.ts
 import { readFileSync } from "fs";