mcp-scraper 0.9.0 → 0.11.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +4 -4
- package/dist/bin/api-server.cjs +180 -9
- package/dist/bin/api-server.cjs.map +1 -1
- package/dist/bin/api-server.js +1 -1
- package/dist/bin/mcp-scraper-cli.cjs +1 -1
- package/dist/bin/mcp-scraper-cli.cjs.map +1 -1
- package/dist/bin/mcp-scraper-cli.js +1 -1
- package/dist/bin/mcp-scraper-install.cjs +2 -2
- package/dist/bin/mcp-scraper-install.cjs.map +1 -1
- package/dist/bin/mcp-scraper-install.js +2 -2
- package/dist/bin/mcp-stdio-server.cjs +98 -6
- package/dist/bin/mcp-stdio-server.cjs.map +1 -1
- package/dist/bin/mcp-stdio-server.js +3 -3
- package/dist/{chunk-5HNHYUJ5.js → chunk-D3AJWXA2.js} +2 -2
- package/dist/{chunk-5HNHYUJ5.js.map → chunk-D3AJWXA2.js.map} +1 -1
- package/dist/chunk-P2WZLJKQ.js +7 -0
- package/dist/chunk-P2WZLJKQ.js.map +1 -0
- package/dist/{chunk-FZG427QD.js → chunk-QJBWER2Q.js} +98 -6
- package/dist/chunk-QJBWER2Q.js.map +1 -0
- package/dist/{server-E34MNLI3.js → server-LRWHUBUN.js} +85 -6
- package/dist/server-LRWHUBUN.js.map +1 -0
- package/docs/mcp-tool-manifest.generated.json +11339 -1479
- package/docs/oauth-legal-review.md +38 -0
- package/package.json +1 -1
- package/dist/chunk-FZG427QD.js.map +0 -1
- package/dist/chunk-RD5JOAWS.js +0 -7
- package/dist/chunk-RD5JOAWS.js.map +0 -1
- package/dist/server-E34MNLI3.js.map +0 -1
|
@@ -0,0 +1,38 @@
|
|
|
1
|
+
# OAuth legal-page review notes
|
|
2
|
+
|
|
3
|
+
> Counsel review is required before treating these drafts as final legal advice or launching connected-provider access broadly.
|
|
4
|
+
|
|
5
|
+
Prepared July 11, 2026 for `public/privacy.html` and `public/terms.html`.
|
|
6
|
+
|
|
7
|
+
## Official policy sources
|
|
8
|
+
|
|
9
|
+
- Google API Services User Data Policy / Limited Use: <https://developers.google.com/terms/api-services-user-data-policy>
|
|
10
|
+
- Google APIs Terms: <https://developers.google.com/terms/>
|
|
11
|
+
- YouTube API Services Terms: <https://developers.google.com/youtube/terms/api-services-terms-of-service>
|
|
12
|
+
- YouTube API Services Developer Policies: <https://developers.google.com/youtube/terms/developer-policies>
|
|
13
|
+
- YouTube Terms of Service: <https://www.youtube.com/t/terms>
|
|
14
|
+
- Google Privacy Policy: <https://policies.google.com/privacy>
|
|
15
|
+
- Meta Platform Terms: <https://developers.facebook.com/terms/>
|
|
16
|
+
- Meta Privacy Policy: <https://www.facebook.com/privacy/policy/>
|
|
17
|
+
- LinkedIn API Terms of Use: <https://www.linkedin.com/legal/l/api-terms-of-use>
|
|
18
|
+
- X Developer Agreement: <https://docs.x.com/developer-terms/agreement>
|
|
19
|
+
- X Developer Policy: <https://docs.x.com/developer-terms/policy>
|
|
20
|
+
- Nango security and credential storage: <https://nango.dev/docs/guides/platform/security>
|
|
21
|
+
- Nango connection deletion API: <https://nango.dev/docs/reference/backend/http-api/connections/delete>
|
|
22
|
+
|
|
23
|
+
## Repo-grounded implementation facts
|
|
24
|
+
|
|
25
|
+
- `src/api/nango-control.ts` sends the signed-in identity to the separate Nango control service and retrieves only connections associated with that identity.
|
|
26
|
+
- The Integrations UI states that connections are private per login and that OAuth tokens remain server-side.
|
|
27
|
+
- `src/api/server.ts` has account deletion/deactivation, Stripe billing, and Resend transactional-email paths.
|
|
28
|
+
- `src/api/db.ts` uses Turso/libSQL in production; `vercel.json` defines the hosted application surface.
|
|
29
|
+
- Scheduled actions bind an exact connection ID to an allowlist of tools.
|
|
30
|
+
|
|
31
|
+
## Items counsel and the operator must confirm
|
|
32
|
+
|
|
33
|
+
1. Legal entity name, mailing address, governing law, and dispute forum are not present in the repo and should be added if required.
|
|
34
|
+
2. Confirm actual deletion orchestration removes Nango connections and connected-provider data when `/account/delete` runs; until then, the public policy correctly instructs users to email support for connection deletion confirmation.
|
|
35
|
+
3. Confirm exact operational retention periods, backup lifetime, subprocessor list, international-transfer mechanism, and DPA availability.
|
|
36
|
+
4. Confirm the Service age threshold and jurisdiction-specific consumer/privacy disclosures.
|
|
37
|
+
5. Confirm every provider action has the promised consent gate. In particular, YouTube and X require express action consent, and LinkedIn's general API terms restrict automated posting.
|
|
38
|
+
6. Re-run policy review before adding scopes, providers, advertising uses, model training, or new data recipients.
|