planpost-mcp 0.2.0 → 0.3.0

package/README.md

@@ -12,13 +12,36 @@ In the PlanPost dashboard go to **Settings → API Keys → Create Key** and sel
 
 ### 2. Add the server to your agent
 
-**Claude Code:**
+Two ways to connect. **Hosted** is the default: point your client at
+`https://mcp.planpo.st/mcp`, nothing to install, your key travels as a header.
+**Local** runs the same server on your machine with `npx`, so the key never
+leaves it. Both expose the same 47 tools.
+
+Replace `pk_live_xxx` with your key throughout.
+
+**Claude Code**
+
+```bash
+claude mcp add --transport http planpost https://mcp.planpo.st/mcp \
+  --header "Authorization: Bearer pk_live_xxx"
+```
+
+Local fallback:
 
 ```bash
 claude mcp add planpost -e PLANPOST_API_KEY=pk_live_xxx -- npx -y planpost-mcp
 ```
 
-**Claude Desktop** (`claude_desktop_config.json`):
+Run `claude mcp list` afterwards to confirm it is connected.
+
+**Claude Desktop**
+
+Hosted: Settings → Connectors → Add custom connector. Name `PlanPost`, URL
+`https://mcp.planpo.st/mcp`, then add the header `Authorization: Bearer pk_live_xxx`.
+
+Local fallback, in `claude_desktop_config.json` (macOS:
+`~/Library/Application Support/Claude/`, Windows: `%APPDATA%\Claude\`), then
+restart the app:
 
 ```json
 {
@@ -32,24 +55,87 @@ claude mcp add planpost -e PLANPOST_API_KEY=pk_live_xxx -- npx -y planpost-mcp
 }
 ```
 
-**Any other MCP client:** run `npx -y planpost-mcp` over stdio with the `PLANPOST_API_KEY` environment variable set.
+**Cursor** (`~/.cursor/mcp.json`, or `.cursor/mcp.json` per project)
 
-### Remote (HTTP) mode
+```json
+{
+  "mcpServers": {
+    "planpost": {
+      "url": "https://mcp.planpo.st/mcp",
+      "headers": { "Authorization": "Bearer pk_live_xxx" }
+    }
+  }
+}
+```
+
+Local fallback: replace the entry with
+`{ "command": "npx", "args": ["-y", "planpost-mcp"], "env": { "PLANPOST_API_KEY": "pk_live_xxx" } }`.
+A project-level `.cursor/mcp.json` is committed with your repo, so prefer the
+hosted form and keep the key out of the file.
+
+**OpenAI Codex CLI** (`~/.codex/config.toml`)
+
+```toml
+[mcp_servers.planpost]
+url = "https://mcp.planpo.st/mcp"
+bearer_token_env_var = "PLANPOST_API_KEY"
+```
+
+Export `PLANPOST_API_KEY` in your shell; Codex reads the token from the
+environment, not the file. `codex mcp add` does the same thing interactively.
+
+Local fallback:
+
+```toml
+[mcp_servers.planpost]
+command = "npx"
+args = ["-y", "planpost-mcp"]
 
-The server can also run as a shared, multi-tenant HTTP endpoint — no local install for users, each request authenticated by its own key:
+[mcp_servers.planpost.env]
+PLANPOST_API_KEY = "pk_live_xxx"
+```
+
+**Gemini CLI** (`~/.gemini/settings.json`, or `.gemini/settings.json` per project)
+
+```json
+{
+  "mcpServers": {
+    "planpost": {
+      "httpUrl": "https://mcp.planpo.st/mcp",
+      "headers": { "Authorization": "Bearer pk_live_xxx" },
+      "timeout": 10000
+    }
+  }
+}
+```
+
+Gemini CLI uses `httpUrl` for streamable HTTP, not `url`; the wrong key is a
+silent no-op. Local fallback: the same `command`/`args`/`env` entry as Cursor.
+
+**Any other MCP client:** connect to `https://mcp.planpo.st/mcp` (streamable
+HTTP, `Authorization: Bearer pk_live_xxx` on every request), or run
+`npx -y planpost-mcp` over stdio with `PLANPOST_API_KEY` set. Per-client
+walkthroughs with screenshots: [planpo.st/docs/agents](https://planpo.st/docs/agents).
+
+### Self-hosting the HTTP endpoint
+
+`mcp.planpo.st` is this same package running with `--http`. To run your own:
 
 ```bash
 npx -y planpost-mcp --http --port 3020     # exposes POST /mcp (+ /health)
 ```
 
-Connect from any HTTP-capable MCP client, e.g.:
+Behind a reverse proxy, bind to loopback so the port isn't reachable directly:
 
 ```bash
-claude mcp add --transport http planpost https://mcp.yourhost.com/mcp \
-  --header "Authorization: Bearer pk_live_xxx"
+HOST=127.0.0.1 npx -y planpost-mcp --http --port 3020
 ```
 
-The transport is stateless (streamable HTTP); the `Authorization: Bearer pk_...` header is required on every request and scoped per request, so one hosted instance serves many users safely. Put it behind HTTPS (reverse proxy) in production.
+The transport is stateless (streamable HTTP); the `Authorization: Bearer pk_...`
+header is required on every request and scoped per request, so one hosted
+instance serves many users safely. Put it behind HTTPS in production.
+`--host` / `HOST` default to `0.0.0.0`, so containers and LAN use work without
+extra flags.
 
 ### 3. Talk to it
 
@@ -70,6 +156,8 @@ The transport is stateless (streamable HTTP); the `Authorization: Bearer pk_...`
 
 ## Tools
 
+47 tools, grouped below. The permission column is the API-key scope a tool needs; a key without the scope gets a clear error rather than a silent failure.
+
 ### Posts & publishing
 
 | Tool | Required permission | Description |
@@ -80,6 +168,11 @@ The transport is stateless (streamable HTTP); the `Authorization: Bearer pk_...`
 | `update_post` | `posts:write` | Update a draft/scheduled post |
 | `delete_post` | `posts:write` | Delete a post |
 | `publish_post` | `posts:write` | Publish immediately |
+| `preview_post` | `posts:read` | Show exactly what each platform will receive (text after overrides, attachments, warnings) |
+| `bulk_create_posts` | `posts:write` | Create a whole campaign of posts from one manifest |
+| `list_campaigns` | `posts:read` | Campaign tags in use, with post counts by status and platform |
+| `delete_posts` | `posts:write` | Bulk-delete posts matching a filter (a filter is required) |
+| `list_media` | `media:read` | Media already uploaded, so an asset can be reused instead of re-uploaded |
 | `upload_media` | `media:write` | Get a presigned URL to upload an image/video |
 | `repurpose_content` | `repurpose:write` | Save repurposed content as draft posts |
 
@@ -90,8 +183,31 @@ The transport is stateless (streamable HTTP); the `Authorization: Bearer pk_...`
 | `list_connections` | `connections:read` | Connected social accounts |
 | `list_account_groups` | `groups:read` | Named account groups (e.g. "Polish Pages") |
 | `get_account_group` | `groups:read` | Resolve a group by id/name/default → connection IDs |
+| `create_account_group` | `groups:write` | Create a named group bundling connections |
+| `update_account_group` | `groups:write` | Rename, recolour, set default, or replace a group's connections |
+| `delete_account_group` | `groups:write` | Delete a group (the accounts stay connected) |
+| `add_connections_to_group` | `groups:write` | Add connections to a group |
+| `remove_connections_from_group` | `groups:write` | Remove connections from a group |
+| `get_connection_link` | `connections:read` | Link the user opens in a browser to connect a new social account (OAuth needs a human) |
+
+Connecting a new social account requires OAuth in a browser: `get_connection_link` hands the user the link, and the agent can target the account once it is connected.
+
+### Approvals
+
+| Tool | Required permission | Description |
+|---|---|---|
+| `submit_for_approval` | `approvals:write` | Send a post to a human reviewer (required when the API key is approval-gated) |
+| `list_pending_approvals` | `approvals:read` | Posts waiting for review, with outcomes |
+| `get_approval_status` | `approvals:read` | Pending / approved / rejected / changes requested for one submission |
 
-Connecting a new social account requires OAuth in the dashboard — agents can target any account that's already connected.
+### Scheduling
+
+| Tool | Required permission | Description |
+|---|---|---|
+| `get_best_times` | `schedule:read` | Best posting times per platform from the account's engagement history |
+| `suggest_schedule` | `schedule:read` | Spread N posts across a date range at optimal times; returns concrete timestamps |
+| `get_posting_schedule` | `schedule:read` | Weekly queue slots, global plus per-group overrides |
+| `set_posting_schedule` | `schedule:write` | Replace the weekly queue slots for the global schedule or one group (Pro) |
 
 ### Video & carousels
 
@@ -105,6 +221,7 @@ Connecting a new social account requires OAuth in the dashboard — agents can t
 | `render_carousel` | `carousels:write` | Render slides into branded PNGs in the media library |
 | `get_carousel_render` | `carousels:read` | Poll a render; completed renders return post-ready media assets |
 | `list_brand_kits` | `brand-kits:read` | Saved brand kits (palette, fonts, logo, handle) for `render_carousel` |
+| `generate_image` | `images:write` | Generate an image with AI for a post (1 AI credit); pass the URL to `create_post` |
 
 ### Content sources
 
@@ -125,6 +242,13 @@ Connecting a new social account requires OAuth in the dashboard — agents can t
 
 Revenue data is read-only over the API; connecting Stripe/RevenueCat/Shopify happens in the dashboard (Settings → Revenue).
 
+### Brand voice (Pro)
+
+| Tool | Required permission | Description |
+|---|---|---|
+| `get_brand_voices` | `brand-voice:read` | Tone-of-voice profiles analysed from the user's content |
+| `get_brand_voice_prompt` | `brand-voice:read` | Ready-to-use system prompt for a voice; apply it when drafting posts |
+
 ## A typical agent workflow
 
 1. `get_account_group` (`default: true`) → connection IDs
@@ -144,11 +268,54 @@ Or, for a branded carousel post end-to-end:
 ```bash
 npm install
 npm run build      # tsc → dist/
+npm test           # validates server.json against the registry schema, boots the stdio server
 PLANPOST_API_KEY=pk_test_xxx node dist/index.js
 ```
 
 The server speaks MCP over stdio. It calls the PlanPost public API (`/api/public/v1`) with your key; nothing else is stored or sent anywhere.
 
+## Maintainers
+
+Releasing a version means publishing twice: the code to npm, then the metadata
+to the [official MCP Registry](https://registry.modelcontextprotocol.io), which
+only stores `server.json` and checks that the npm package it points at exists
+and carries the matching `mcpName`. Glama and other directories import from the
+registry, so the second step is what makes a release discoverable.
+
+1. Bump `version` in `package.json` **and** in `server.json` (top level and
+   `packages[0].version`). `npm test` fails if they disagree.
+2. Publish to npm first; the registry rejects a version npm does not have yet:
+
+   ```bash
+   npm publish --access public
+   ```
+
+3. Install the publisher CLI once (`brew install mcp-publisher`, or the tarball
+   from the registry's GitHub releases), then log in. The `io.github.lukBB/*`
+   namespace is proven by GitHub device-flow login as that account:
+
+   ```bash
+   mcp-publisher login github
+   ```
+
+4. Validate and publish from this directory:
+
+   ```bash
+   mcp-publisher validate
+   mcp-publisher publish
+   ```
+
+5. Confirm the listing:
+
+   ```bash
+   curl "https://registry.modelcontextprotocol.io/v0.1/servers?search=io.github.lukBB/planpost"
+   ```
+
+An expired token shows as "Invalid or expired Registry JWT token": run the login
+again. `mcp-publisher status` deprecates or deletes a published version.
+Directory listings beyond the registry (mcp.so, Cursor Directory, outreach) are
+tracked in [DISTRIBUTION.md](./DISTRIBUTION.md).
+
 ## License
 
 MIT

package/dist/index.js

@@ -74,7 +74,10 @@ function buildServer() {
 // ─── Tools ───
 function registerTools(server) {
     server.tool("list_posts", "List your scheduled and published social media posts. Filter by status, platform, campaign, label, post type, or free text.", {
-        status: z.enum(["draft", "scheduled", "processing", "published", "failed", "cancelled"]).optional().describe("Filter by post status"),
+        // `needs_approval` is a first-class status, not an internal one: a post
+        // parked for human sign-off is exactly what an agent needs to be able to
+        // find again after submitting it.
+        status: z.enum(["draft", "needs_approval", "scheduled", "processing", "published", "failed", "cancelled"]).optional().describe("Filter by post status ('needs_approval' = waiting on human sign-off)"),
         platform: z.string().optional().describe("Filter by platform (instagram, twitter, linkedin, etc.)"),
         campaign: z.string().optional().describe("Filter by campaign tag, e.g. 'garmin-cirqa-2026' (matches utm.campaign; slugified automatically)"),
         label: z.string().optional().describe("Filter by internal label (case-insensitive substring), e.g. 'Garmin CIRQA'"),
@@ -112,7 +115,7 @@ function registerTools(server) {
         const data = await api(`/posts/${id}`);
         return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
     });
-    server.tool("create_post", "Create a new social media post. Saves as draft or schedules it for a specific time.", {
+    server.tool("create_post", "Create a new social media post. Saves as draft or schedules it for a specific time. X (Twitter): nothing sent to X may contain a link (URL, bare domain or t.co) — not the post, any thread segment, or a first comment (posted to X as a reply). The X API bills each link post at $0.20 vs $0.015, so the API rejects them; put a link-free version in platformContent.twitter.", {
         content: z.string().describe("Post text content"),
         connectionIds: z.array(z.string()).describe("Array of social connection IDs to post to. Use list_connections or list_account_groups to find IDs."),
         platformContent: z.record(z.string(), z.string()).optional().describe("Per-platform content overrides, e.g. { twitter: 'shorter version', linkedin: 'longer version' }"),
@@ -193,7 +196,9 @@ function registerTools(server) {
             const media = pl.mediaCount === 0
                 ? `no media${pl.mediaSource === "override" ? " (text-only override)" : ""}`
                 : `${pl.mediaCount} ${pl.mediaCount === 1 ? "item" : "items"} (${pl.media.map((m) => m.filename ?? m.type).join(", ")})`;
-            const warn = pl.warnings?.length ? `\n  warnings: ${pl.warnings.map((w) => w.code).join(", ")}` : "";
+            const warn = pl.warnings?.length
+                ? `\n  warnings:\n${pl.warnings.map((w) => `    - [${w.code}] ${w.message}`).join("\n")}`
+                : "";
             return [
                 `── ${pl.platform.toUpperCase()} ─────────────`,
                 `  text (${pl.contentSource}): ${limit}${pl.linksClickable ? "" : "  [links NOT clickable]"}`,
@@ -212,7 +217,7 @@ function registerTools(server) {
                 }],
         };
     });
-    server.tool("bulk_create_posts", "Create a whole campaign of posts from one manifest. Each entry accepts the same fields as create_post; `defaults` supplies values shared by every entry (campaign, connectionIds, timezone, ...) so you don't repeat them. Rows are independent — one bad row fails alone and the rest still get created. Max 50 per call. Returns a per-row result with ids, warnings and edit links.", {
+    server.tool("bulk_create_posts", "Create a whole campaign of posts from one manifest. Each entry accepts the same fields as create_post; `defaults` supplies values shared by every entry (campaign, connectionIds, timezone, ...) so you don't repeat them. Rows are independent — one bad row fails alone and the rest still get created. Max 50 per call. Returns a per-row result with ids, warnings and edit links. X (Twitter): nothing sent to X may contain a link (URL, bare domain or t.co) — not the post, any thread segment, or a first comment (posted to X as a reply). The X API bills each link post at $0.20 vs $0.015, so the API rejects them; put a link-free version in platformContent.twitter.", {
         posts: z.array(z.record(z.string(), z.any())).describe("Array of post payloads. Each accepts every create_post field: content, connectionIds, platformContent, platformSettings, postType, threadSegments, label, campaign, schedule/scheduledFor, media, platformMedia, utm."),
         defaults: z.record(z.string(), z.any()).optional().describe("Fields merged into every entry before its own values (which always win). Ideal for campaign, connectionIds and timezone."),
     }, async ({ posts, defaults }) => {
@@ -280,7 +285,7 @@ function registerTools(server) {
         const data = await api(`/media?${params}`);
         return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
     });
-    server.tool("update_post", "Update a draft or scheduled post.", {
+    server.tool("update_post", "Update a draft or scheduled post. X (Twitter): nothing sent to X may contain a link (URL, bare domain or t.co) — not the post, any thread segment, or a first comment (posted to X as a reply). The X API bills each link post at $0.20 vs $0.015, so the API rejects them; put a link-free version in platformContent.twitter.", {
         id: z.string().describe("Post ID to update"),
         content: z.string().optional().describe("New post text content"),
         connectionIds: z.array(z.string()).optional().describe("New connection IDs"),
@@ -356,7 +361,7 @@ function registerTools(server) {
         await api(`/posts/${id}`, { method: "DELETE" });
         return { content: [{ type: "text", text: `Post ${id} deleted.` }] };
     });
-    server.tool("publish_post", "Publish a draft or scheduled post immediately to all connected platforms.", {
+    server.tool("publish_post", "Publish a draft or scheduled post immediately to all connected platforms. X (Twitter): nothing sent to X may contain a link (URL, bare domain or t.co) — not the post, any thread segment, or a first comment (posted to X as a reply). The X API bills each link post at $0.20 vs $0.015, so the API rejects them; put a link-free version in platformContent.twitter.", {
         id: z.string().describe("Post ID to publish now"),
     }, async ({ id }) => {
         const data = await api(`/posts/${id}/publish`, { method: "POST" });
@@ -774,6 +779,31 @@ function registerTools(server) {
         });
         return { content: [{ type: "text", text: JSON.stringify(data.data, null, 2) }] };
     });
+    server.tool("get_posting_schedule", "Read the weekly posting queue schedule: the global schedule plus any per-group overrides. Slots are {day: 1-7 (Mon=1..Sun=7), time: 'HH:MM' 24h} in the user's timezone. Groups without an override inherit the global schedule. Needs the schedule:read permission.", {}, async () => {
+        const data = await api("/posting-queue/queues");
+        return { content: [{ type: "text", text: JSON.stringify(data.data, null, 2) }] };
+    });
+    server.tool("set_posting_schedule", "Replace the weekly posting queue slots for the global schedule or one account group (Pro feature; needs the schedule:write permission). Pass the FULL desired slot list — it replaces the existing one. An empty array on a group removes its override so it inherits the global schedule again.", {
+        groupId: z
+            .string()
+            .optional()
+            .describe("Account group id (from list_account_groups); omit for the global schedule"),
+        slots: z
+            .array(z.object({
+            day: z.number().int().min(1).max(7).describe("ISO weekday: 1=Monday .. 7=Sunday"),
+            time: z
+                .string()
+                .regex(/^([01]\d|2[0-3]):[0-5]\d$/)
+                .describe("24h time 'HH:MM' in the user's timezone, e.g. '09:30'"),
+        }))
+            .describe("The complete weekly slot list to store"),
+    }, async ({ groupId, slots }) => {
+        const data = await api(`/posting-queue/queues/${encodeURIComponent(groupId ?? "global")}`, {
+            method: "PUT",
+            body: JSON.stringify({ slots }),
+        });
+        return { content: [{ type: "text", text: JSON.stringify(data.data, null, 2) }] };
+    });
 }
 // ─── Start ───
 async function startStdio() {
@@ -813,24 +843,44 @@ function readBody(req) {
  * (e.g. `claude mcp add --transport http planpost https://host/mcp --header
  * "Authorization: Bearer pk_..."`) at it without local installs.
  */
-async function startHttp(port) {
+async function startHttp(port, host) {
     const httpServer = createHttpServer(async (req, res) => {
+        // An API host must never rank: Google indexed the bare /mcp 405 JSON as a
+        // page under the brand. The header, not robots.txt, is the fix on purpose:
+        // a crawler has to be able to fetch the URL to see the noindex, so
+        // robots.txt below allows crawling and this header does the de-indexing.
+        res.setHeader("X-Robots-Tag", "noindex, nofollow");
         const fail = (status, message) => {
-            res.writeHead(status, { "Content-Type": "application/json" });
+            // charset is load-bearing: without it, any non-ASCII byte in a message
+            // renders as mojibake in browsers that assume latin-1 for JSON.
+            res.writeHead(status, { "Content-Type": "application/json; charset=utf-8" });
             res.end(JSON.stringify({ jsonrpc: "2.0", error: { code: -32000, message }, id: null }));
         };
         try {
             const url = new URL(req.url || "/", `http://${req.headers.host || "localhost"}`);
             if (url.pathname === "/health") {
-                res.writeHead(200, { "Content-Type": "application/json" });
+                res.writeHead(200, { "Content-Type": "application/json; charset=utf-8" });
                 res.end(JSON.stringify({ status: "ok" }));
                 return;
             }
+            if (url.pathname === "/robots.txt") {
+                // Allow crawling so the X-Robots-Tag noindex is actually seen.
+                res.writeHead(200, { "Content-Type": "text/plain; charset=utf-8" });
+                res.end("User-agent: *\nDisallow:\n");
+                return;
+            }
+            if (url.pathname === "/" && (req.method === "GET" || req.method === "HEAD")) {
+                // A human (or crawler) landing on the bare host gets the docs page
+                // instead of a JSON error.
+                res.writeHead(302, { Location: "https://planpo.st/mcp" });
+                res.end();
+                return;
+            }
             if (url.pathname !== "/mcp")
-                return fail(404, "Not found — MCP endpoint is /mcp");
+                return fail(404, "Not found. The MCP endpoint is /mcp");
             if (req.method !== "POST") {
                 // Stateless mode: no SSE resumption stream, no sessions to delete.
-                return fail(405, "Method not allowed — stateless transport accepts POST only");
+                return fail(405, "Method not allowed. This stateless transport accepts POST only; setup guide at https://planpo.st/mcp");
             }
             const auth = req.headers.authorization || "";
             const key = auth.startsWith("Bearer ") ? auth.slice(7) : "";
@@ -855,8 +905,8 @@ async function startHttp(port) {
                 fail(500, "Internal error");
         }
     });
-    httpServer.listen(port, () => {
-        console.log(`planpost-mcp listening on http://0.0.0.0:${port}/mcp (streamable HTTP, stateless)`);
+    httpServer.listen(port, host, () => {
+        console.log(`planpost-mcp listening on http://${host}:${port}/mcp (streamable HTTP, stateless)`);
     });
 }
 async function main() {
@@ -864,7 +914,12 @@ async function main() {
     if (args.includes("--http")) {
         const portArg = args[args.indexOf("--port") + 1];
         const port = Number(portArg) || Number(process.env.PORT) || 3020;
-        await startHttp(port);
+        // Defaults to all interfaces so `--http` works in a container or on a LAN
+        // without extra flags. Behind a reverse proxy set HOST=127.0.0.1 so the
+        // port isn't reachable except through the proxy.
+        const hostArg = args.includes("--host") ? args[args.indexOf("--host") + 1] : undefined;
+        const host = hostArg || process.env.HOST || "0.0.0.0";
+        await startHttp(port, host);
         return;
     }
     await startStdio();

package/package.json

@@ -1,7 +1,9 @@
 {
   "name": "planpost-mcp",
-  "version": "0.2.0",
-  "description": "PlanPost MCP server — let Claude and other AI agents schedule posts, manage social media, create videos and carousels, and read analytics via the PlanPost public API",
+  "version": "0.3.0",
+  "//mcpName": "Ownership marker for the official MCP Registry: must equal `name` in server.json, or `mcp-publisher publish` fails validation. Namespace is the GitHub account that owns this repo, verified with `mcp-publisher login github`.",
+  "mcpName": "io.github.lukBB/planpost",
+  "description": "PlanPost MCP server: schedule and publish social posts to Instagram, TikTok, LinkedIn, X, Facebook, Threads and YouTube from Claude, Cursor, Codex or any MCP client; render video and carousels, read analytics and revenue.",
   "license": "MIT",
   "type": "module",
   "bin": {
@@ -17,26 +19,43 @@
   "engines": {
     "node": ">=18"
   },
-  "homepage": "https://planpo.st",
+  "homepage": "https://planpo.st/mcp",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/lukBB/social-poster-v2.git",
     "directory": "packages/mcp-server"
   },
+  "bugs": {
+    "url": "https://planpo.st/support"
+  },
   "keywords": [
     "mcp",
     "model-context-protocol",
-    "claude",
-    "ai-agent",
+    "mcp-server",
     "social-media",
+    "social-media-scheduling",
     "scheduling",
+    "instagram",
+    "tiktok",
+    "linkedin",
+    "twitter",
+    "facebook",
+    "threads",
+    "youtube",
+    "claude",
+    "claude-code",
+    "cursor",
+    "codex",
+    "gemini-cli",
+    "ai-agent",
     "planpost"
   ],
   "scripts": {
     "build": "tsc",
     "dev": "tsc --watch",
     "start": "node dist/index.js",
-    "prepublishOnly": "npm run build"
+    "prepublishOnly": "npm run build",
+    "test": "node --test test/*.test.mjs"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.12.1",
@@ -44,6 +63,8 @@
   },
   "devDependencies": {
     "typescript": "^5.7.0",
-    "@types/node": "^22.0.0"
+    "@types/node": "^22.0.0",
+    "ajv": "^8.17.1",
+    "ajv-formats": "^3.0.1"
   }
 }