posterly-mcp-server 0.23.1 → 0.24.0

package/dist/generated/platform-manifest.js

@@ -12,16 +12,17 @@ export const PLATFORM_MANIFEST = {
         "threads",
         "google_business",
         "telegram",
-        "bluesky"
+        "bluesky",
+        "discord",
+        "mastodon",
+        "devto",
+        "hashnode",
+        "wordpress",
+        "lemmy"
     ],
     "plannedPlatformIds": [
         "reddit",
-        "wordpress",
-        "mastodon",
         "medium",
-        "devto",
-        "hashnode",
-        "discord",
         "slack",
         "skool",
         "whop"
@@ -38,32 +39,39 @@ export const PLATFORM_MANIFEST = {
         "google_business",
         "telegram",
         "bluesky",
-        "reddit",
-        "wordpress",
+        "discord",
         "mastodon",
-        "medium",
         "devto",
         "hashnode",
-        "discord",
+        "wordpress",
+        "lemmy",
+        "reddit",
+        "medium",
         "slack",
         "skool",
         "whop"
     ],
     "supportedPlatformInputs": [
         "bluesky",
+        "devto",
+        "discord",
         "facebook",
         "gmb",
         "google-business",
         "google_business",
         "google_business_profile",
+        "hashnode",
         "instagram",
         "instagram-standalone",
+        "lemmy",
         "linkedin",
+        "mastodon",
         "pinterest",
         "telegram",
         "threads",
         "tiktok",
         "twitter",
+        "wordpress",
         "x",
         "youtube"
     ],
@@ -79,6 +87,7 @@ export const PLATFORM_MANIFEST = {
         "hashnode",
         "instagram",
         "instagram-standalone",
+        "lemmy",
         "linkedin",
         "mastodon",
         "medium",
@@ -106,6 +115,7 @@ export const PLATFORM_MANIFEST = {
         "hashnode": "hashnode",
         "instagram": "instagram",
         "instagram_standalone": "instagram",
+        "lemmy": "lemmy",
         "linkedin": "linkedin",
         "mastodon": "mastodon",
         "medium": "medium",
@@ -126,8 +136,7 @@ export const PLATFORM_MANIFEST = {
         "linkedin.recent_mentions",
         "pinterest.boards",
         "tiktok.creator_info",
-        "x.quota",
-        "youtube.playlists"
+        "x.quota"
     ],
     "analyticsPlatformIds": [
         "instagram",
@@ -135,6 +144,7 @@ export const PLATFORM_MANIFEST = {
         "linkedin",
         "youtube",
         "pinterest",
+        "threads",
         "google_business"
     ],
     "connectTargetIds": [
@@ -151,13 +161,14 @@ export const PLATFORM_MANIFEST = {
         "twitter",
         "telegram",
         "bluesky",
-        "reddit",
-        "wordpress",
+        "discord",
         "mastodon",
-        "medium",
         "devto",
         "hashnode",
-        "discord",
+        "wordpress",
+        "lemmy",
+        "reddit",
+        "medium",
         "slack",
         "skool",
         "whop"
@@ -177,6 +188,7 @@ export const PLATFORM_MANIFEST = {
         "instagram",
         "instagram-standalone",
         "instagram_direct",
+        "lemmy",
         "linkedin",
         "linkedin-company",
         "linkedin-page",
@@ -215,6 +227,7 @@ export const PLATFORM_MANIFEST = {
         "instagram": "instagram",
         "instagram_direct": "instagram",
         "instagram_standalone": "instagram",
+        "lemmy": "lemmy",
         "linkedin": "linkedin",
         "linkedin_company": "linkedin_page",
         "linkedin_page": "linkedin_page",
@@ -332,9 +345,7 @@ export const PLATFORM_MANIFEST = {
                 "video"
             ],
             "analyticsSupported": true,
-            "helpers": [
-                "youtube.playlists"
-            ]
+            "helpers": []
         },
         {
             "id": "pinterest",
@@ -363,7 +374,7 @@ export const PLATFORM_MANIFEST = {
                 "carousel",
                 "threads_thread"
             ],
-            "analyticsSupported": false,
+            "analyticsSupported": true,
             "helpers": []
         },
         {
@@ -411,53 +422,84 @@ export const PLATFORM_MANIFEST = {
             "helpers": []
         },
         {
-            "id": "reddit",
-            "label": "Reddit",
-            "status": "planned",
+            "id": "discord",
+            "label": "Discord",
+            "status": "supported",
             "aliases": [],
-            "postTypes": [],
+            "postTypes": [
+                "text",
+                "image",
+                "video",
+                "carousel"
+            ],
             "analyticsSupported": false,
             "helpers": []
         },
         {
-            "id": "wordpress",
-            "label": "WordPress",
-            "status": "planned",
+            "id": "mastodon",
+            "label": "Mastodon",
+            "status": "supported",
             "aliases": [],
-            "postTypes": [],
+            "postTypes": [
+                "text",
+                "image",
+                "video",
+                "carousel"
+            ],
             "analyticsSupported": false,
             "helpers": []
         },
         {
-            "id": "mastodon",
-            "label": "Mastodon",
-            "status": "planned",
+            "id": "devto",
+            "label": "Dev.to",
+            "status": "supported",
             "aliases": [],
-            "postTypes": [],
+            "postTypes": [
+                "text",
+                "image"
+            ],
             "analyticsSupported": false,
             "helpers": []
         },
         {
-            "id": "medium",
-            "label": "Medium",
-            "status": "planned",
+            "id": "hashnode",
+            "label": "Hashnode",
+            "status": "supported",
             "aliases": [],
-            "postTypes": [],
+            "postTypes": [
+                "text",
+                "image"
+            ],
             "analyticsSupported": false,
             "helpers": []
         },
         {
-            "id": "devto",
-            "label": "Dev.to",
-            "status": "planned",
+            "id": "wordpress",
+            "label": "WordPress",
+            "status": "supported",
             "aliases": [],
-            "postTypes": [],
+            "postTypes": [
+                "text",
+                "image"
+            ],
             "analyticsSupported": false,
             "helpers": []
         },
         {
-            "id": "hashnode",
-            "label": "Hashnode",
+            "id": "lemmy",
+            "label": "Lemmy",
+            "status": "supported",
+            "aliases": [],
+            "postTypes": [
+                "text",
+                "image"
+            ],
+            "analyticsSupported": false,
+            "helpers": []
+        },
+        {
+            "id": "reddit",
+            "label": "Reddit",
             "status": "planned",
             "aliases": [],
             "postTypes": [],
@@ -465,8 +507,8 @@ export const PLATFORM_MANIFEST = {
             "helpers": []
         },
         {
-            "id": "discord",
-            "label": "Discord",
+            "id": "medium",
+            "label": "Medium",
             "status": "planned",
             "aliases": [],
             "postTypes": [],
@@ -615,50 +657,57 @@ export const PLATFORM_MANIFEST = {
             "method": "manual_credentials"
         },
         {
-            "id": "reddit",
-            "label": "Reddit",
-            "status": "planned",
-            "aliases": [],
-            "method": "planned"
-        },
-        {
-            "id": "wordpress",
-            "label": "WordPress",
-            "status": "planned",
+            "id": "discord",
+            "label": "Discord",
+            "status": "supported",
             "aliases": [],
-            "method": "planned"
+            "method": "manual_credentials"
         },
         {
             "id": "mastodon",
             "label": "Mastodon",
-            "status": "planned",
-            "aliases": [],
-            "method": "planned"
-        },
-        {
-            "id": "medium",
-            "label": "Medium",
-            "status": "planned",
+            "status": "supported",
             "aliases": [],
-            "method": "planned"
+            "method": "manual_credentials"
         },
         {
             "id": "devto",
             "label": "Dev.to",
-            "status": "planned",
+            "status": "supported",
             "aliases": [],
-            "method": "planned"
+            "method": "manual_credentials"
         },
         {
             "id": "hashnode",
             "label": "Hashnode",
+            "status": "supported",
+            "aliases": [],
+            "method": "manual_credentials"
+        },
+        {
+            "id": "wordpress",
+            "label": "WordPress",
+            "status": "supported",
+            "aliases": [],
+            "method": "manual_credentials"
+        },
+        {
+            "id": "lemmy",
+            "label": "Lemmy",
+            "status": "supported",
+            "aliases": [],
+            "method": "manual_credentials"
+        },
+        {
+            "id": "reddit",
+            "label": "Reddit",
             "status": "planned",
             "aliases": [],
             "method": "planned"
         },
         {
-            "id": "discord",
-            "label": "Discord",
+            "id": "medium",
+            "label": "Medium",
             "status": "planned",
             "aliases": [],
             "method": "planned"
@@ -686,12 +735,12 @@ export const PLATFORM_MANIFEST = {
         }
     ]
 };
-export const SUPPORTED_PLATFORM_IDS = ["instagram", "facebook", "tiktok", "twitter", "linkedin", "youtube", "pinterest", "threads", "google_business", "telegram", "bluesky"];
-export const PLANNED_PLATFORM_IDS = ["reddit", "wordpress", "mastodon", "medium", "devto", "hashnode", "discord", "slack", "skool", "whop"];
-export const ALL_PLATFORM_IDS = ["instagram", "facebook", "tiktok", "twitter", "linkedin", "youtube", "pinterest", "threads", "google_business", "telegram", "bluesky", "reddit", "wordpress", "mastodon", "medium", "devto", "hashnode", "discord", "slack", "skool", "whop"];
-export const SUPPORTED_PLATFORM_INPUTS = ["bluesky", "facebook", "gmb", "google-business", "google_business", "google_business_profile", "instagram", "instagram-standalone", "linkedin", "pinterest", "telegram", "threads", "tiktok", "twitter", "x", "youtube"];
-export const ALL_PLATFORM_INPUTS = ["bluesky", "devto", "discord", "facebook", "gmb", "google-business", "google_business", "google_business_profile", "hashnode", "instagram", "instagram-standalone", "linkedin", "mastodon", "medium", "pinterest", "reddit", "skool", "slack", "telegram", "threads", "tiktok", "twitter", "whop", "wordpress", "x", "youtube"];
-export const PLATFORM_HELPER_NAMES = ["linkedin.recent_mentions", "pinterest.boards", "tiktok.creator_info", "x.quota", "youtube.playlists"];
-export const CONNECT_TARGET_IDS = ["instagram", "meta", "facebook", "youtube", "tiktok", "linkedin", "linkedin_page", "threads", "google_business", "pinterest", "twitter", "telegram", "bluesky", "reddit", "wordpress", "mastodon", "medium", "devto", "hashnode", "discord", "slack", "skool", "whop"];
-export const CONNECT_INPUTS = ["bluesky", "devto", "discord", "facebook", "facebook_instagram", "facebook_pages", "gmb", "google-business", "google_business", "google_business_profile", "hashnode", "instagram", "instagram-standalone", "instagram_direct", "linkedin", "linkedin-company", "linkedin-page", "linkedin_company", "linkedin_page", "linkedin_personal", "mastodon", "medium", "meta", "meta_business", "pinterest", "reddit", "skool", "slack", "telegram", "threads", "tiktok", "twitter", "whop", "wordpress", "x", "x_twitter", "youtube"];
-export const ANALYTICS_PLATFORM_IDS = ["instagram", "facebook", "linkedin", "youtube", "pinterest", "google_business"];
+export const SUPPORTED_PLATFORM_IDS = ["instagram", "facebook", "tiktok", "twitter", "linkedin", "youtube", "pinterest", "threads", "google_business", "telegram", "bluesky", "discord", "mastodon", "devto", "hashnode", "wordpress", "lemmy"];
+export const PLANNED_PLATFORM_IDS = ["reddit", "medium", "slack", "skool", "whop"];
+export const ALL_PLATFORM_IDS = ["instagram", "facebook", "tiktok", "twitter", "linkedin", "youtube", "pinterest", "threads", "google_business", "telegram", "bluesky", "discord", "mastodon", "devto", "hashnode", "wordpress", "lemmy", "reddit", "medium", "slack", "skool", "whop"];
+export const SUPPORTED_PLATFORM_INPUTS = ["bluesky", "devto", "discord", "facebook", "gmb", "google-business", "google_business", "google_business_profile", "hashnode", "instagram", "instagram-standalone", "lemmy", "linkedin", "mastodon", "pinterest", "telegram", "threads", "tiktok", "twitter", "wordpress", "x", "youtube"];
+export const ALL_PLATFORM_INPUTS = ["bluesky", "devto", "discord", "facebook", "gmb", "google-business", "google_business", "google_business_profile", "hashnode", "instagram", "instagram-standalone", "lemmy", "linkedin", "mastodon", "medium", "pinterest", "reddit", "skool", "slack", "telegram", "threads", "tiktok", "twitter", "whop", "wordpress", "x", "youtube"];
+export const PLATFORM_HELPER_NAMES = ["linkedin.recent_mentions", "pinterest.boards", "tiktok.creator_info", "x.quota"];
+export const CONNECT_TARGET_IDS = ["instagram", "meta", "facebook", "youtube", "tiktok", "linkedin", "linkedin_page", "threads", "google_business", "pinterest", "twitter", "telegram", "bluesky", "discord", "mastodon", "devto", "hashnode", "wordpress", "lemmy", "reddit", "medium", "slack", "skool", "whop"];
+export const CONNECT_INPUTS = ["bluesky", "devto", "discord", "facebook", "facebook_instagram", "facebook_pages", "gmb", "google-business", "google_business", "google_business_profile", "hashnode", "instagram", "instagram-standalone", "instagram_direct", "lemmy", "linkedin", "linkedin-company", "linkedin-page", "linkedin_company", "linkedin_page", "linkedin_personal", "mastodon", "medium", "meta", "meta_business", "pinterest", "reddit", "skool", "slack", "telegram", "threads", "tiktok", "twitter", "whop", "wordpress", "x", "x_twitter", "youtube"];
+export const ANALYTICS_PLATFORM_IDS = ["instagram", "facebook", "linkedin", "youtube", "pinterest", "threads", "google_business"];

package/dist/index.js

@@ -14,6 +14,10 @@ import { getBrandTool } from './tools/get-brand.js';
 import { listBrandAccountsTool } from './tools/list-brand-accounts.js';
 import { getBrandProfileTool } from './tools/get-brand-profile.js';
 import { getLearnedVoiceTool } from './tools/get-learned-voice.js';
+import { getPerformanceProfileTool } from './tools/get-performance-profile.js';
+import { getPostInsightsTool } from './tools/get-post-insights.js';
+import { listPostSuggestionsTool } from './tools/list-post-suggestions.js';
+import { dismissSuggestionTool } from './tools/dismiss-suggestion.js';
 import { createPostTool } from './tools/create-post.js';
 import { createPostsBatchTool } from './tools/create-posts-batch.js';
 import { findSlotTool } from './tools/find-slot.js';
@@ -288,6 +292,42 @@ server.tool(getLearnedVoiceTool.name, getLearnedVoiceTool.description, getLearne
         return { content: [{ type: 'text', text: `Error: ${err.message}` }], isError: true };
     }
 });
+server.tool(getPerformanceProfileTool.name, getPerformanceProfileTool.description, getPerformanceProfileTool.inputSchema.shape, async (input) => {
+    try {
+        const text = await getPerformanceProfileTool.execute(client, input);
+        return { content: [{ type: 'text', text }] };
+    }
+    catch (err) {
+        return { content: [{ type: 'text', text: `Error: ${err.message}` }], isError: true };
+    }
+});
+server.tool(getPostInsightsTool.name, getPostInsightsTool.description, getPostInsightsTool.inputSchema.shape, async (input) => {
+    try {
+        const text = await getPostInsightsTool.execute(client, input);
+        return { content: [{ type: 'text', text }] };
+    }
+    catch (err) {
+        return { content: [{ type: 'text', text: `Error: ${err.message}` }], isError: true };
+    }
+});
+server.tool(listPostSuggestionsTool.name, listPostSuggestionsTool.description, listPostSuggestionsTool.inputSchema.shape, async (input) => {
+    try {
+        const text = await listPostSuggestionsTool.execute(client, input);
+        return { content: [{ type: 'text', text }] };
+    }
+    catch (err) {
+        return { content: [{ type: 'text', text: `Error: ${err.message}` }], isError: true };
+    }
+});
+server.tool(dismissSuggestionTool.name, dismissSuggestionTool.description, dismissSuggestionTool.inputSchema.shape, async (input) => {
+    try {
+        const text = await dismissSuggestionTool.execute(client, input);
+        return { content: [{ type: 'text', text }] };
+    }
+    catch (err) {
+        return { content: [{ type: 'text', text: `Error: ${err.message}` }], isError: true };
+    }
+});
 server.tool(createPostTool.name, createPostTool.description, createPostTool.inputSchema.shape, async (input) => {
     try {
         const text = await createPostTool.execute(client, input);

package/dist/lib/api-client.d.ts

@@ -55,6 +55,70 @@ export interface LearnedVoice {
     post_count: number;
     derived_at: string | null;
 }
+export interface PerformanceProfile {
+    social_account_id: number;
+    platform: string;
+    username: string | null;
+    sample_size: number;
+    window_days: number;
+    engagement_rate_avg: number | null;
+    engagement_rate_trend: 'up' | 'down' | 'flat' | 'unknown';
+    bullets: string[];
+    narrative_summary: string | null;
+    stats: Record<string, unknown>;
+    derived_at: string | null;
+}
+export type PerformanceProfileNullReason = 'insufficient_data' | 'feature_not_available' | 'platform_not_measurable';
+export interface PerformanceProfileResponse {
+    performance_profile: PerformanceProfile | null;
+    reason: PerformanceProfileNullReason | null;
+}
+export interface FeedbackInsight {
+    id: string;
+    post_id: number;
+    social_account_id: number;
+    username: string | null;
+    platform: string;
+    checkpoint: '1h' | '6h' | '24h' | '72h' | '7d';
+    performance_tier: string;
+    action_type: string;
+    title: string;
+    diagnosis: string;
+    next_action: string;
+    impact_score: number;
+    confidence: number;
+    metrics: Record<string, unknown>;
+    baseline: Record<string, unknown>;
+    caption: string | null;
+    permalink: string | null;
+    published_at: string | null;
+    created_at: string;
+}
+export interface FeedbackInsightsResponse {
+    insights: FeedbackInsight[];
+}
+export interface PostSuggestion {
+    id: string;
+    social_account_id: number;
+    platform: string;
+    account: {
+        id: number;
+        username: string | null;
+        platform: string;
+    };
+    caption: string;
+    rationale: string | null;
+    period_key: string | null;
+    status: string;
+    created_at: string;
+}
+export interface PostSuggestionsResponse {
+    suggestions: PostSuggestion[];
+}
+export interface DismissSuggestionResponse {
+    ok: boolean;
+    status: string;
+}
 export interface Post {
     id: number;
     content: string;
@@ -697,6 +761,19 @@ export declare class PosterlyClient {
     getAccountLearnedVoice(id: string | number): Promise<{
         learned_voice: LearnedVoice | null;
     }>;
+    getAccountPerformanceProfile(id: string | number): Promise<PerformanceProfileResponse>;
+    getPostInsights(params?: {
+        account_id?: string | number;
+        post_id?: number;
+        checkpoint?: '1h' | '6h' | '24h' | '72h' | '7d';
+        limit?: number;
+    }): Promise<FeedbackInsightsResponse>;
+    listPostSuggestions(params?: {
+        account_id?: string | number;
+        status?: 'pending' | 'scheduled' | 'dismissed';
+        limit?: number;
+    }): Promise<PostSuggestionsResponse>;
+    dismissSuggestion(id: string): Promise<DismissSuggestionResponse>;
     listPosts(params?: {
         status?: string;
         platform?: string;
@@ -967,3 +1044,16 @@ export declare class PosterlyClient {
     }>;
 }
 export declare function resolvePosterlyBaseUrl(baseUrl?: string): string;
+type PosterlyBaseUrlInspection = {
+    valid: boolean;
+    secure: boolean;
+    protocol?: string;
+    host?: string;
+    trustedPosterlyHost: boolean;
+    localDevelopmentHost: boolean;
+    warnings: string[];
+    message: string;
+};
+export declare function inspectPosterlyBaseUrl(baseUrl: string): PosterlyBaseUrlInspection;
+export declare function validatePosterlyBaseUrlForKeyUse(baseUrl: string): void;
+export {};

package/dist/lib/api-client.js

@@ -6,6 +6,9 @@ export class PosterlyClient {
     constructor(apiKey, baseUrl) {
         this.apiKey = apiKey || process.env.POSTERLY_API_KEY || '';
         this.baseUrl = resolvePosterlyBaseUrl(baseUrl);
+        if (this.apiKey) {
+            validatePosterlyBaseUrlForKeyUse(this.baseUrl);
+        }
     }
     hasApiKey() {
         return Boolean(this.apiKey);
@@ -182,6 +185,36 @@ export class PosterlyClient {
     async getAccountLearnedVoice(id) {
         return this.request('GET', `/accounts/${encodeURIComponent(String(id))}/learned-voice`);
     }
+    async getAccountPerformanceProfile(id) {
+        return this.request('GET', `/accounts/${encodeURIComponent(String(id))}/performance-profile`);
+    }
+    async getPostInsights(params) {
+        const searchParams = new URLSearchParams();
+        if (params?.account_id)
+            searchParams.set('account_id', String(params.account_id));
+        if (params?.post_id)
+            searchParams.set('post_id', String(params.post_id));
+        if (params?.checkpoint)
+            searchParams.set('checkpoint', params.checkpoint);
+        if (params?.limit)
+            searchParams.set('limit', String(params.limit));
+        const qs = searchParams.toString();
+        return this.request('GET', `/analytics/insights${qs ? `?${qs}` : ''}`);
+    }
+    async listPostSuggestions(params) {
+        const searchParams = new URLSearchParams();
+        if (params?.account_id)
+            searchParams.set('account_id', String(params.account_id));
+        if (params?.status)
+            searchParams.set('status', params.status);
+        if (params?.limit)
+            searchParams.set('limit', String(params.limit));
+        const qs = searchParams.toString();
+        return this.request('GET', `/suggestions${qs ? `?${qs}` : ''}`);
+    }
+    async dismissSuggestion(id) {
+        return this.request('POST', `/suggestions/${encodeURIComponent(id)}/dismiss`, {});
+    }
     async listPosts(params) {
         const searchParams = new URLSearchParams();
         if (params?.status)
@@ -485,6 +518,73 @@ export function resolvePosterlyBaseUrl(baseUrl) {
         return configured.replace(/\/api\/v1\/?$/, '').replace(/\/$/, '');
     }
 }
+const TRUSTED_POSTERLY_HOSTS = new Set(['poster.ly', 'www.poster.ly']);
+function flagEnabled(name) {
+    const value = (process.env[name] || '').trim().toLowerCase();
+    return value === 'true' || value === '1' || value === 'yes';
+}
+function normalizeHostname(hostname) {
+    return hostname.toLowerCase().replace(/^\[|\]$/g, '');
+}
+function isLocalHost(hostname) {
+    const normalized = normalizeHostname(hostname);
+    return (normalized === 'localhost' ||
+        normalized.endsWith('.localhost') ||
+        normalized === '127.0.0.1' ||
+        normalized === '::1');
+}
+export function inspectPosterlyBaseUrl(baseUrl) {
+    try {
+        const url = new URL(baseUrl);
+        const hostname = normalizeHostname(url.hostname);
+        const local = isLocalHost(hostname);
+        const trustedPosterlyHost = TRUSTED_POSTERLY_HOSTS.has(hostname);
+        const secure = url.protocol === 'https:' || (url.protocol === 'http:' && local);
+        const warnings = [];
+        if (!trustedPosterlyHost) {
+            warnings.push(local ? 'local_development_host' : 'custom_host');
+        }
+        if (!secure) {
+            warnings.push('insecure_non_local_url');
+        }
+        return {
+            valid: true,
+            secure,
+            protocol: url.protocol.replace(/:$/, ''),
+            host: url.host,
+            trustedPosterlyHost,
+            localDevelopmentHost: local,
+            warnings,
+            message: secure
+                ? 'Base URL is secure for API-key requests.'
+                : 'Non-local HTTP URLs are blocked for API-key requests.',
+        };
+    }
+    catch {
+        return {
+            valid: false,
+            secure: false,
+            trustedPosterlyHost: false,
+            localDevelopmentHost: false,
+            warnings: ['invalid_url'],
+            message: 'Base URL must include a scheme and host, for example https://www.poster.ly.',
+        };
+    }
+}
+export function validatePosterlyBaseUrlForKeyUse(baseUrl) {
+    const check = inspectPosterlyBaseUrl(baseUrl);
+    if (!check.valid) {
+        throw new Error(`${check.message} Received: ${baseUrl}`);
+    }
+    if (!check.secure && !flagEnabled('POSTERLY_ALLOW_INSECURE_URL')) {
+        throw new Error(`Refusing to send an API key to ${baseUrl}. Use https, http://localhost for local development, or set POSTERLY_ALLOW_INSECURE_URL=true only for a trusted private development endpoint.`);
+    }
+    if (!check.trustedPosterlyHost &&
+        !check.localDevelopmentHost &&
+        !flagEnabled('POSTERLY_ALLOW_CUSTOM_BASE_URL')) {
+        throw new Error(`Refusing to send an API key to custom host ${baseUrl}. Set POSTERLY_ALLOW_CUSTOM_BASE_URL=true only for a trusted Posterly deployment.`);
+    }
+}
 function parseJson(text) {
     try {
         return text ? JSON.parse(text) : {};

package/dist/lib/version.d.ts

@@ -1 +1 @@
-export declare const POSTERLY_MCP_VERSION = "0.23.1";
+export declare const POSTERLY_MCP_VERSION = "0.24.0";

package/dist/lib/version.js

@@ -5,4 +5,4 @@
 // tool set (minus the intentional pre-auth signup tools that only this stdio
 // package exposes). `npm run check:mcp-parity` enforces both the version match
 // and the tool-list match, and runs in the pre-commit hook.
-export const POSTERLY_MCP_VERSION = '0.23.1';
+export const POSTERLY_MCP_VERSION = '0.24.0';