mcp-scraper 0.87.0 → 0.88.0

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 
 ## [Unreleased]
 
+## [0.88.0] - 2026-09-02
+
+### Changed
+
+- Made one `MCP_SCRAPER_API_KEY` authenticate scraping, Memory, Research, and native CRM through the canonical root MCP endpoint; root-to-Memory calls now use short-lived audience-bound owner assertions.
+- Reduced the customer-callable unified catalog from 377 to 375 tools by retiring Memory key issuance and scope mutation, while preserving explicit compatibility errors in SDK clients.
+- Added strict-schema validation for all 148 direct Memory tools and an authenticated 30-screenshot CRM workspace proof runner covering ten surfaces at wide, compact, and mobile viewports.
+
+### Security
+
+- Stopped normal creation, storage, display, and use of long-lived per-user Memory keys. Existing direct `mk_` credentials remain accepted for one documented compatibility release and can still be listed or revoked.
+
 ## [0.87.0] - 2026-09-02
 
 ### Added
@@ -1712,7 +1724,8 @@ All notable changes to MCP Scraper are documented here. The format is based on [
 - Write actions remain unavailable until the account owner explicitly enables them.
 - Provider-specific connection data is normalized into one agent-facing contract.
 
-[Unreleased]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.87.0...HEAD
+[Unreleased]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.88.0...HEAD
+[0.88.0]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.87.0...v0.88.0
 [0.87.0]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.86.5...v0.87.0
 [0.86.0]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.85.0...v0.86.0
 [0.84.0]: https://github.com/VilovietaSEO/mcp-scraper/compare/v0.83.5...v0.84.0

package/README.md

@@ -175,7 +175,7 @@ Build the branded one-click bundle:
 npm run build:mcpb
 ```
 
-The generated bundle is written to `build/mcpb/mcp-scraper-<version>.mcpb` and copied to `public/downloads/` for the hosted download. The current public bundle is `https://mcpscraper.dev/downloads/mcp-scraper.mcpb` (`0.87.0`, SHA-256 `4805165c18efda420136b9d00862a6d658dd0d4c7bef6d6b77bcb94922ce4d38`). Install it by opening or dragging it into Claude Desktop. Claude displays the `MCP Scraper` install card, icon, API-key configuration field, and manually curated current-release message from the bundle manifest.
+The generated bundle is written to `build/mcpb/mcp-scraper-<version>.mcpb` and copied to `public/downloads/` for the hosted download. The current public bundle is `https://mcpscraper.dev/downloads/mcp-scraper.mcpb` (`0.88.0`, SHA-256 `ff593dd4184122b9d9ef10bb0a9c21a907f8e2e180520dfbe56001bff0ee090d`). Install it by opening or dragging it into Claude Desktop. Claude displays the `MCP Scraper` install card, icon, API-key configuration field, and manually curated current-release message from the bundle manifest.
 
 The MCPB install exposes every tool — web-intelligence plus all `browser_*` tools — through the one `mcp-scraper` server.
 
@@ -350,9 +350,9 @@ The `mcp-scraper` server (and the MCPB bundle, which runs it) exposes both secti
 
 All MCP tools return `structuredContent` with the IDs, URLs, CSV paths, transcripts, browser session handles, replay paths, artifacts, recipe fields, or blueprint fields needed by the next step, plus readable text content for compatibility. Runtime `tools/list` omits output schemas so strict clients can register the complete catalog; the generated developer manifest retains every canonical output schema for validation and typed SDK generation. All tools carry MCP annotations; file-writing tools such as replay downloads and annotations state their filesystem side effects.
 
-The canonical tool inventory is generated at `docs/mcp-tool-manifest.generated.json`. The unified server exposes 377 tools: 249 scraper, browser, workflow, billing, connected-service, and personal-assistant tools plus 128 durable-memory tools. The scraper-side inventory includes complete Gmail selection, message, attachment, export, bulk-action, and Memory-import workflows; governed personal-assistant commands, messaging, approvals, grants, number setup, and execution readback; durable PAA starts and status; rendered site-content similarity; governed Local Sourcebook and Transparent Commons workflows; direct site-export reads; Editorial Reading Room and News Publisher templates; and production X-Ray setup, analytics, seven-model attribution, structured post-purchase surveys, reported impact, truthful view-evidence status, CRM policy and receipt, campaign, export, and scheduled-report tools. Provider setup remains absent until its authorization, ingestion, reconciliation, privacy, canary, cleanup, and deployment receipts are complete. Successful evidence-compiled Local Sourcebook revisions publish automatically to their canonical `localsourcebook.com` category profile and review URLs; administrator controls handle exceptional rejection or unpublishing. Release verification compares the exact local and hosted tool-name sets, not only the count.
+The canonical tool inventory is generated at `docs/mcp-tool-manifest.generated.json`. The unified server exposes 375 tools: 249 scraper, browser, workflow, billing, connected-service, and personal-assistant tools plus 126 durable-memory tools. The two retired customer credential mutations are no longer advertised. The scraper-side inventory includes complete Gmail selection, message, attachment, export, bulk-action, and Memory-import workflows; governed personal-assistant commands, messaging, approvals, grants, number setup, and execution readback; durable PAA starts and status; rendered site-content similarity; governed Local Sourcebook and Transparent Commons workflows; direct site-export reads; Editorial Reading Room and News Publisher templates; and production X-Ray setup, analytics, seven-model attribution, structured post-purchase surveys, reported impact, truthful view-evidence status, CRM policy and receipt, campaign, export, and scheduled-report tools. Provider setup remains absent until its authorization, ingestion, reconciliation, privacy, canary, cleanup, and deployment receipts are complete. Successful evidence-compiled Local Sourcebook revisions publish automatically to their canonical `localsourcebook.com` category profile and review URLs; administrator controls handle exceptional rejection or unpublishing. Release verification compares the exact local and hosted tool-name sets, not only the count.
 
-For contract parity, stdio and MCPB memory calls invoke the matching public tool on the hosted MCP Scraper `/mcp` endpoint. The hosted aggregate runtime owns MCP Scraper-specific billing, scheduling, credential, and in-process cutover policy; its internal `/memory/mcp-call` bridge is a fallback to the standalone memory service, not the public stdio execution path. Direct `mcp-memory` OAuth and stdio clients continue to use `memory.mcpscraper.dev` and must be verified as a separate dependent release surface.
+For contract parity, stdio and MCPB memory calls invoke the matching public tool on the hosted MCP Scraper `/mcp` endpoint. The hosted aggregate runtime owns MCP Scraper-specific billing, scheduling, credential, and in-process cutover policy; its internal `/memory/mcp-call` bridge is a fallback to the standalone Memory service, not a second customer setup path. Existing direct Memory credentials remain compatible for one release, but all new customer setup uses the root endpoint and `MCP_SCRAPER_API_KEY`.
 
 ## Resources
 

package/dist/bin/api-server.js

@@ -17,8 +17,8 @@ loadDotEnv();
 async function main() {
   const [{ serve }, { app, personalAssistantProductionStartup }, { startWorker }, { migrate }] = await Promise.all([
     import("@hono/node-server"),
-    import("../server-4QWARJET.js"),
-    import("../worker-DAVCZ3FP.js"),
+    import("../server-PD3TDL6Q.js"),
+    import("../worker-LDCAULWL.js"),
     import("../db-Z34LPZNR.js")
   ]);
   const PORT = parseInt(process.env.PORT ?? "3001");

package/dist/bin/mcp-scraper-cli.js

@@ -6,9 +6,9 @@ import {
   openWorkflowReport,
   runWorkflow,
   workflowOutputBaseDir
-} from "../chunk-6IOGTFNS.js";
+} from "../chunk-UZPTGUDV.js";
 import "../chunk-RJ7JVYKU.js";
-import "../chunk-OWF2JJKN.js";
+import "../chunk-GXBZXWXB.js";
 import {
   XRAY_INSTALL_CONTRACT,
   XRAY_INSTALL_PROTOCOL_DIGEST,
@@ -19,7 +19,7 @@ import {
 import "../chunk-GGZEC22A.js";
 import {
   PACKAGE_VERSION
-} from "../chunk-Y3AIFO7C.js";
+} from "../chunk-XIJI34RM.js";
 
 // src/cli/human-cli.ts
 import { Command } from "commander";

package/dist/bin/mcp-scraper-core.js

@@ -1,19 +1,19 @@
 #!/usr/bin/env node
 import {
   runMcpScraperStdio
-} from "../chunk-6XDNIYGP.js";
-import "../chunk-XX6XUZQM.js";
+} from "../chunk-P5FPC54B.js";
+import "../chunk-2JVZQGSN.js";
 import "../chunk-PGJQDMC2.js";
 import "../chunk-DNM65UCK.js";
 import "../chunk-T3MZISOF.js";
 import "../chunk-6HAV7LCE.js";
-import "../chunk-NKRO2SUO.js";
+import "../chunk-4QMUF6XM.js";
 import "../chunk-OM7HVEJ3.js";
 import "../chunk-OPQIGAFB.js";
-import "../chunk-UDLPENTY.js";
+import "../chunk-ABF2CGOZ.js";
 import "../chunk-P7FWOMU7.js";
 import "../chunk-GGZEC22A.js";
-import "../chunk-Y3AIFO7C.js";
+import "../chunk-XIJI34RM.js";
 import "../chunk-YXNDOQXN.js";
 
 // src/mcp/thorbit-restricted-tool-surface.ts

package/dist/bin/mcp-scraper-install.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   renderInstallTerminal
-} from "../chunk-UDLPENTY.js";
+} from "../chunk-ABF2CGOZ.js";
 import {
   PACKAGE_VERSION
-} from "../chunk-Y3AIFO7C.js";
+} from "../chunk-XIJI34RM.js";
 
 // bin/mcp-scraper-install.ts
 var noColor = process.argv.includes("--no-color") || process.env.NO_COLOR !== void 0 || process.env.FORCE_COLOR === "0" || !process.stdout.isTTY;

package/dist/bin/mcp-stdio-server.js

@@ -1,19 +1,19 @@
 #!/usr/bin/env node
 import {
   runMcpScraperStdio
-} from "../chunk-6XDNIYGP.js";
-import "../chunk-XX6XUZQM.js";
+} from "../chunk-P5FPC54B.js";
+import "../chunk-2JVZQGSN.js";
 import "../chunk-PGJQDMC2.js";
 import "../chunk-DNM65UCK.js";
 import "../chunk-T3MZISOF.js";
 import "../chunk-6HAV7LCE.js";
-import "../chunk-NKRO2SUO.js";
+import "../chunk-4QMUF6XM.js";
 import "../chunk-OM7HVEJ3.js";
 import "../chunk-OPQIGAFB.js";
-import "../chunk-UDLPENTY.js";
+import "../chunk-ABF2CGOZ.js";
 import "../chunk-P7FWOMU7.js";
 import "../chunk-GGZEC22A.js";
-import "../chunk-Y3AIFO7C.js";
+import "../chunk-XIJI34RM.js";
 import "../chunk-YXNDOQXN.js";
 
 // bin/mcp-stdio-server.ts

package/dist/bin/paa-harvest.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import {
   harvest
-} from "../chunk-R2HRN2FW.js";
+} from "../chunk-S24LFPL7.js";
 import {
   browserServiceApiKey
 } from "../chunk-OM7HVEJ3.js";
 import "../chunk-OPQIGAFB.js";
-import "../chunk-OWF2JJKN.js";
+import "../chunk-GXBZXWXB.js";
 import "../chunk-YXNDOQXN.js";
 
 // src/cli.ts

package/dist/{chunk-XX6XUZQM.js → chunk-2JVZQGSN.js}

@@ -26,7 +26,7 @@ import {
   PAA_QUESTION_CREDITS,
   PAGE_SCRAPE_CREDITS,
   SERP_SEARCH_CREDITS
-} from "./chunk-NKRO2SUO.js";
+} from "./chunk-4QMUF6XM.js";
 import {
   browserServiceProfileName,
   browserServiceProfileSaveChanges
@@ -50,7 +50,7 @@ import {
 } from "./chunk-P7FWOMU7.js";
 import {
   PACKAGE_VERSION
-} from "./chunk-Y3AIFO7C.js";
+} from "./chunk-XIJI34RM.js";
 import {
   PUBLIC_ERROR_CODES,
   buildPublicErrorEnvelope,
@@ -32304,6 +32304,10 @@ var MEMORY_TOOL_SCHEMAS = [
 var MEMORY_TOOL_DESCRIPTION_OVERRIDES = {
   "access-swap-vault": "Set the account's persisted active vault so later memory calls may omit vault and use it by default across stateless requests. The vault must be entitled to the key and the key must hold 'swap' scope."
 };
+var LEGACY_DIRECT_CREDENTIAL_TOOL_IDS = /* @__PURE__ */ new Set([
+  "access-issue-key",
+  "access-set-scope"
+]);
 var MEMORY_TOOL_REGISTRY = [
   ...MEMORY_TOOL_SCHEMAS.map((schema) => ({
     ...schema,
@@ -32311,7 +32315,7 @@ var MEMORY_TOOL_REGISTRY = [
   })),
   ...MEMORY_GOVERNED_TOOL_SCHEMAS,
   ...MEMORY_IMAGE_TOOL_SCHEMAS
-];
+].filter((schema) => !LEGACY_DIRECT_CREDENTIAL_TOOL_IDS.has(schema.id));
 
 // src/mcp/memory-mcp-server.ts
 function registerMemoryMcpTools(server, executor) {

package/dist/{chunk-NKRO2SUO.js → chunk-4QMUF6XM.js}

@@ -213,9 +213,9 @@ var PUBLIC_PRODUCT_CONTRACT = {
     "freeSignupCredits": 0
   },
   "inventory": {
-    "totalTools": 377,
+    "totalTools": 375,
     "scraperTools": 249,
-    "memoryTools": 128
+    "memoryTools": 126
   },
   "concurrencyPack": {
     "ratePolicyVersion": "2026-08-14.concurrency-pack-v1",

package/dist/{chunk-UDLPENTY.js → chunk-ABF2CGOZ.js}

@@ -55,7 +55,7 @@ function renderInstallTerminal(options) {
     "1/1 install surfaces ready",
     colorize(`Newest in v${options.version}: ${release_message_default.message}`, "lime", color),
     "",
-    `${colorize("Tools", "cyan", color)}  ${colorize("(377 MCP tools)", "muted", color)}`,
+    `${colorize("Tools", "cyan", color)}  ${colorize("(375 MCP tools)", "muted", color)}`,
     toolRow("search", ["harvest_paa", "search_serp", "maps_search", "maps_place_intel"], color),
     toolRow("extract", ["extract_url", "map_site_urls", "extract_site", "audit_site", "directory_workflow"], color),
     toolRow("build", ["create_editorial_reading_room", "rank_tracker_workflow", "portable HTML"], color),

package/dist/{chunk-OWF2JJKN.js → chunk-GXBZXWXB.js}

@@ -150,18 +150,18 @@ var RawMapsAboutAttributeSchema = z.object({
 
 // src/output/memory-library-sink.ts
 async function postToMemoryLibrary(args) {
-  const url = process.env.MCP_MEMORY_INGEST_URL;
-  const key = process.env.MCP_MEMORY_KEY;
-  if (!url || !key) return;
+  const key = process.env.MCP_SCRAPER_API_KEY?.trim();
+  const baseUrl = (process.env.MCP_SCRAPER_BASE_URL ?? "https://mcpscraper.dev").replace(/\/$/, "");
+  if (!key) return;
   try {
-    const res = await fetch(url, {
+    const res = await fetch(`${baseUrl}/memory/mcp-call`, {
       method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ data: { apiKey: key, title: args.title, content: args.content, source: args.source } })
+      headers: { "content-type": "application/json", "x-api-key": key },
+      body: JSON.stringify({ toolName: "libraryIngestTool", args })
     });
     const body = await res.json().catch(() => null);
-    if (!res.ok || body?.result?.error) {
-      console.warn("[memory-library-sink] ingest not accepted:", res.status, body?.result?.message ?? "");
+    if (!res.ok || body?.ok === false) {
+      console.warn("[memory-library-sink] ingest not accepted:", res.status, body?.error ?? "");
     }
   } catch (err) {
     console.warn("[memory-library-sink] ingest failed:", err?.message);

package/dist/{chunk-KQWVJOVR.js → chunk-IHXAXYIS.js}

@@ -7,7 +7,7 @@ import {
 } from "./chunk-DNM65UCK.js";
 import {
   LedgerOperation
-} from "./chunk-NKRO2SUO.js";
+} from "./chunk-4QMUF6XM.js";
 import {
   CREDIT_LOT_TTL,
   getDb,

package/dist/{chunk-WFGAR4BZ.js → chunk-MZDNZQWT.js}

@@ -19,7 +19,7 @@ import {
   LedgerOperation,
   MC_PER_CREDIT,
   calculateConnectedUsageCharge
-} from "./chunk-NKRO2SUO.js";
+} from "./chunk-4QMUF6XM.js";
 import {
   recordVendorUsage,
   runWithCostContext

package/dist/{chunk-6XDNIYGP.js → chunk-P5FPC54B.js}

@@ -12,13 +12,13 @@ import {
   registerScheduledResultsMcpTools,
   registerSerpIntelligenceCaptureTools,
   resolveDeploymentProfile
-} from "./chunk-XX6XUZQM.js";
+} from "./chunk-2JVZQGSN.js";
 import {
   renderInstallTerminal
-} from "./chunk-UDLPENTY.js";
+} from "./chunk-ABF2CGOZ.js";
 import {
   PACKAGE_VERSION
-} from "./chunk-Y3AIFO7C.js";
+} from "./chunk-XIJI34RM.js";
 
 // src/mcp/stdio-runtime.ts
 import { readFileSync } from "fs";

package/dist/{chunk-R2HRN2FW.js → chunk-S24LFPL7.js}

@@ -15,7 +15,7 @@ import {
   RawPAAItemSchema,
   postToMemoryLibrary,
   recencyToTbs
-} from "./chunk-OWF2JJKN.js";
+} from "./chunk-GXBZXWXB.js";
 import {
   CaptchaError,
   ExtractionError,

package/dist/{chunk-6IOGTFNS.js → chunk-UZPTGUDV.js}

@@ -4,7 +4,7 @@ import {
 import {
   DEFAULT_MAPS_PROXY_MODE,
   postToMemoryLibrary
-} from "./chunk-OWF2JJKN.js";
+} from "./chunk-GXBZXWXB.js";
 import {
   buildSerpEmailQuery,
   contactAttemptUrls,

package/dist/{chunk-Y3AIFO7C.js → chunk-XIJI34RM.js}

@@ -1,5 +1,5 @@
 // src/version.ts
-var PACKAGE_VERSION = "0.87.0";
+var PACKAGE_VERSION = "0.88.0";
 
 export {
   PACKAGE_VERSION

package/dist/{extract-bundle-FALNLKYY.js → extract-bundle-565SBZCR.js}

@@ -10,7 +10,7 @@ import {
   createSiteExtractContentReader,
   createSiteExtractImageArtifact,
   extractJobLimitInfo
-} from "./chunk-KQWVJOVR.js";
+} from "./chunk-IHXAXYIS.js";
 import "./chunk-OZJMVCDK.js";
 import {
   computeIssues,
@@ -19,7 +19,7 @@ import {
   renderLinkReport
 } from "./chunk-PGJQDMC2.js";
 import "./chunk-DNM65UCK.js";
-import "./chunk-NKRO2SUO.js";
+import "./chunk-4QMUF6XM.js";
 import "./chunk-GGZEC22A.js";
 import {
   getDb

package/dist/{gmail-service-BUSU4BVX.js → gmail-service-E6ALS7JG.js}

@@ -7,10 +7,10 @@ import {
   GmailServiceError,
   normalizeGmailMessage,
   parseGmailAddresses
-} from "./chunk-WFGAR4BZ.js";
+} from "./chunk-MZDNZQWT.js";
 import "./chunk-C5Z4OFKW.js";
 import "./chunk-T3MZISOF.js";
-import "./chunk-NKRO2SUO.js";
+import "./chunk-4QMUF6XM.js";
 import "./chunk-OPQIGAFB.js";
 import "./chunk-YXNDOQXN.js";
 export {

package/dist/index.cjs

@@ -4635,18 +4635,18 @@ var import_papaparse = __toESM(require("papaparse"), 1);
 
 // src/output/memory-library-sink.ts
 async function postToMemoryLibrary(args) {
-  const url = process.env.MCP_MEMORY_INGEST_URL;
-  const key = process.env.MCP_MEMORY_KEY;
-  if (!url || !key) return;
+  const key = process.env.MCP_SCRAPER_API_KEY?.trim();
+  const baseUrl = (process.env.MCP_SCRAPER_BASE_URL ?? "https://mcpscraper.dev").replace(/\/$/, "");
+  if (!key) return;
   try {
-    const res = await fetch(url, {
+    const res = await fetch(`${baseUrl}/memory/mcp-call`, {
       method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ data: { apiKey: key, title: args.title, content: args.content, source: args.source } })
+      headers: { "content-type": "application/json", "x-api-key": key },
+      body: JSON.stringify({ toolName: "libraryIngestTool", args })
     });
     const body = await res.json().catch(() => null);
-    if (!res.ok || body?.result?.error) {
-      console.warn("[memory-library-sink] ingest not accepted:", res.status, body?.result?.message ?? "");
+    if (!res.ok || body?.ok === false) {
+      console.warn("[memory-library-sink] ingest not accepted:", res.status, body?.error ?? "");
     }
   } catch (err) {
     console.warn("[memory-library-sink] ingest failed:", err?.message);

package/dist/index.js

@@ -1,11 +1,11 @@
 import {
   harvest
-} from "./chunk-R2HRN2FW.js";
+} from "./chunk-S24LFPL7.js";
 import "./chunk-OM7HVEJ3.js";
 import {
   recordVendorUsage
 } from "./chunk-OPQIGAFB.js";
-import "./chunk-OWF2JJKN.js";
+import "./chunk-GXBZXWXB.js";
 import "./chunk-YXNDOQXN.js";
 
 // src/video/VideoGenerator.ts