posterly-mcp-server 0.43.7 → 0.44.0

package/README.md

@@ -122,7 +122,7 @@ Add the same server definition to your Cursor MCP settings:
 
 ## Available tools
 
-`posterly-mcp-server@0.43.7` exposes 90 tools.
+`posterly-mcp-server@0.44.0` exposes 92 tools.
 
 Public setup tools work before `POSTERLY_API_KEY` exists:
 
@@ -142,6 +142,8 @@ Authenticated tools require `POSTERLY_API_KEY`:
 - `get_connect_session` (poll connection progress while the user approves OAuth or enters credentials)
 - `create_api_key` (create a new API key after explicit confirmation; scopes cannot exceed the calling dashboard key)
 - `delete_api_key` (revoke a user-created API key after explicit confirmation)
+- `list_workspace_members` (list teammates, roles, brand access, and pending invites; requires `members:read`, granted by the "Manage team" permission)
+- `manage_workspace_member` (invite, update, or remove a colleague with `action`; always returns a preview first and only acts on `confirm: true` plus the `preview_id` after the user approves; requires `members:write`)
 - `get_subscription` (read subscription status, tier, and cancel/pause state; requires `billing:read`)
 - `cancel_subscription` (cancel after explicit confirmation; the agent must ask for a `reason` first; requires `billing:write`)
 - `pause_subscription` (pause 30 days, one per 90-day cooldown, after confirmation; requires `billing:write`)

package/dist/index.js

@@ -84,6 +84,8 @@ import { createConnectSessionTool } from './tools/create-connect-session.js';
 import { getConnectSessionTool } from './tools/get-connect-session.js';
 import { createApiKeyTool } from './tools/create-api-key.js';
 import { deleteApiKeyTool } from './tools/delete-api-key.js';
+import { listWorkspaceMembersTool } from './tools/list-workspace-members.js';
+import { manageWorkspaceMemberTool } from './tools/manage-workspace-member.js';
 import { getCreditsTool } from './tools/get-credits.js';
 import { getSubscriptionTool } from './tools/get-subscription.js';
 import { cancelSubscriptionTool } from './tools/cancel-subscription.js';
@@ -217,6 +219,24 @@ server.tool(deleteApiKeyTool.name, deleteApiKeyTool.description, deleteApiKeyToo
         return { content: [{ type: 'text', text: `Error: ${err.message}` }], isError: true };
     }
 });
+server.tool(listWorkspaceMembersTool.name, listWorkspaceMembersTool.description, listWorkspaceMembersTool.inputSchema.shape, getToolAnnotations(listWorkspaceMembersTool.name), async (input) => {
+    try {
+        const text = await listWorkspaceMembersTool.execute(client, input);
+        return { content: [{ type: 'text', text }] };
+    }
+    catch (err) {
+        return { content: [{ type: 'text', text: `Error: ${err.message}` }], isError: true };
+    }
+});
+server.tool(manageWorkspaceMemberTool.name, manageWorkspaceMemberTool.description, manageWorkspaceMemberTool.inputSchema.shape, getToolAnnotations(manageWorkspaceMemberTool.name), async (input) => {
+    try {
+        const text = await manageWorkspaceMemberTool.execute(client, input);
+        return { content: [{ type: 'text', text }] };
+    }
+    catch (err) {
+        return { content: [{ type: 'text', text: `Error: ${err.message}` }], isError: true };
+    }
+});
 server.tool(getCreditsTool.name, getCreditsTool.description, getCreditsTool.inputSchema.shape, getToolAnnotations(getCreditsTool.name), async () => {
     try {
         const text = await getCreditsTool.execute(client);

package/dist/lib/api-client.d.ts

@@ -320,6 +320,67 @@ export type AskSupportPayload = {
     confirm_escalation?: boolean;
 };
 export type ApiKeyScope = 'accounts:read' | 'accounts:write' | 'posts:read' | 'posts:write' | 'media:write' | 'analytics:read' | 'billing:read' | 'billing:write';
+export type WorkspaceMemberRole = 'publisher' | 'editor' | 'viewer';
+export type WorkspaceMemberSummary = {
+    id: string;
+    user_id: string | null;
+    email: string | null;
+    name: string | null;
+    role: string | null;
+    status: string | null;
+    /** [] = every brand; missing = not visible to a brand-limited caller. */
+    brand_ids?: string[];
+    joined_at: string | null;
+    created_at: string | null;
+};
+export type WorkspaceInviteSummary = {
+    id: string;
+    email: string | null;
+    role: string | null;
+    status: string | null;
+    brand_ids?: string[];
+    expires_at: string | null;
+    created_at: string | null;
+};
+export type WorkspaceMembersResponse = {
+    workspace_id: string;
+    members: WorkspaceMemberSummary[];
+    invites: WorkspaceInviteSummary[];
+    usage: {
+        active_members: number;
+        pending_invites: number;
+        seats_used: number;
+    };
+};
+export type WorkspaceMemberPreview = {
+    action: string;
+    summary: string;
+    email: string | null;
+    role: string | null;
+    previous_role: string | null;
+    brand_ids: string[] | null;
+    previous_brand_ids: string[] | null;
+    sends_email: boolean;
+    counts_toward_seats: boolean;
+    seats_used: number | null;
+    seat_limit: number | null;
+};
+export type WorkspaceMemberChangeResponse = {
+    requires_confirmation?: boolean;
+    preview?: WorkspaceMemberPreview;
+    preview_id?: string;
+    preview_expires_at?: string;
+    status?: string;
+    message?: string;
+    invite?: WorkspaceInviteSummary;
+    member?: WorkspaceMemberSummary;
+    email_sent?: boolean;
+    owner_notified?: boolean;
+};
+export type WorkspaceMemberConfirmFields = {
+    confirm?: boolean;
+    preview_id?: string;
+};
 export type CreateApiKeyPayload = {
     name?: string;
     scopes?: ApiKeyScope[];
@@ -1005,6 +1066,24 @@ export declare class PosterlyClient {
     deleteApiKey(keyId: string, data: {
         confirm: true;
     }): Promise<DeleteApiKeyResponse>;
+    listWorkspaceMembers(workspaceId: string): Promise<WorkspaceMembersResponse>;
+    inviteWorkspaceMember(workspaceId: string, data: {
+        email: string;
+        role: WorkspaceMemberRole;
+        brand_ids?: string[];
+        resend?: boolean;
+    } & WorkspaceMemberConfirmFields): Promise<WorkspaceMemberChangeResponse>;
+    updateWorkspaceMember(workspaceId: string, target: {
+        member_id?: string;
+        invite_id?: string;
+    }, data: {
+        role?: WorkspaceMemberRole;
+        brand_ids?: string[];
+    } & WorkspaceMemberConfirmFields): Promise<WorkspaceMemberChangeResponse>;
+    removeWorkspaceMember(workspaceId: string, target: {
+        member_id?: string;
+        invite_id?: string;
+    }, data: WorkspaceMemberConfirmFields): Promise<WorkspaceMemberChangeResponse>;
     getSubscription(): Promise<SubscriptionSummaryResponse>;
     getCredits(): Promise<CreditsSummaryResponse>;
     cancelSubscription(data: CancelSubscriptionPayload): Promise<CancelSubscriptionResponse>;

package/dist/lib/api-client.js

@@ -123,6 +123,32 @@ export class PosterlyClient {
     async deleteApiKey(keyId, data) {
         return this.request('DELETE', `/api-keys/${encodeURIComponent(keyId)}`, data);
     }
+    async listWorkspaceMembers(workspaceId) {
+        return this.request('GET', `/workspaces/${encodeURIComponent(workspaceId)}/members`);
+    }
+    async inviteWorkspaceMember(workspaceId, data) {
+        return this.request('POST', `/workspaces/${encodeURIComponent(workspaceId)}/members`, data);
+    }
+    async updateWorkspaceMember(workspaceId, target, data) {
+        const base = `/workspaces/${encodeURIComponent(workspaceId)}`;
+        const path = target.member_id
+            ? `${base}/members/${encodeURIComponent(target.member_id)}`
+            : `${base}/invites/${encodeURIComponent(target.invite_id || '')}`;
+        return this.request('PATCH', path, data);
+    }
+    async removeWorkspaceMember(workspaceId, target, data) {
+        const base = `/workspaces/${encodeURIComponent(workspaceId)}`;
+        const path = target.member_id
+            ? `${base}/members/${encodeURIComponent(target.member_id)}`
+            : `${base}/invites/${encodeURIComponent(target.invite_id || '')}`;
+        const params = new URLSearchParams();
+        if (data.confirm === true)
+            params.set('confirm', 'true');
+        if (data.preview_id)
+            params.set('preview_id', data.preview_id);
+        const qs = params.toString();
+        return this.request('DELETE', `${path}${qs ? `?${qs}` : ''}`);
+    }
     async getSubscription() {
         return this.request('GET', '/subscription');
     }

package/dist/lib/version.d.ts

@@ -1 +1 @@
-export declare const POSTERLY_MCP_VERSION = "0.43.7";
+export declare const POSTERLY_MCP_VERSION = "0.44.0";

package/dist/lib/version.js

@@ -5,4 +5,4 @@
 // tool set (minus the intentional pre-auth signup tools that only this stdio
 // package exposes). `npm run check:mcp-parity` enforces both the version match
 // and the tool-list match, and runs in the pre-commit hook.
-export const POSTERLY_MCP_VERSION = '0.43.7';
+export const POSTERLY_MCP_VERSION = '0.44.0';

package/dist/tools/create-api-key.js

@@ -20,7 +20,7 @@ function formatCreatedApiKey(result) {
 }
 export const createApiKeyTool = {
     name: 'create_api_key',
-    description: 'Create a new posterly API key for the authenticated user. SECRET-CREATING WRITE: only use after explicit user confirmation. The new key can only request scopes already present on the calling dashboard-created API key; OAuth and managed assistant tokens cannot mint keys.',
+    description: 'Create a new posterly API key for the authenticated user. SECRET-CREATING WRITE: only use after explicit user confirmation. The new key can only request scopes already present on the calling dashboard-created API key; OAuth and managed assistant tokens cannot mint keys. Team management (members:read, members:write) and client portal sign-in link permissions are never copied or granted here: a person turns them on in /dashboard/api.',
     inputSchema: z.object({
         name: z.string().trim().min(1).max(120).optional().describe('Human-readable key name.'),
         scopes: z.array(scopeSchema).min(1).max(8).optional().describe('Scopes for the new key. Omit to copy the calling key scopes. Cannot exceed the calling key scopes. billing:read and billing:write allow managing the posterly subscription (cancel/pause/resume/downgrade).'),

package/dist/tools/create-webhook.d.ts

@@ -11,15 +11,15 @@ export declare const createWebhookTool: {
         is_active: z.ZodOptional<z.ZodBoolean>;
         confirm: z.ZodLiteral<true>;
     }, "strip", z.ZodTypeAny, {
-        url: string;
         confirm: true;
+        url: string;
         description?: string | undefined;
         workspace_id?: string | undefined;
         events?: ("webhook.test" | "post.created" | "post.updated" | "post.deleted" | "post.publishing" | "post.published" | "post.failed" | "account.disconnected" | "analytics.synced" | "approval.requested" | "approval.approved" | "approval.changes_requested" | "approval.rejected" | "approval.commented")[] | undefined;
         is_active?: boolean | undefined;
     }, {
-        url: string;
         confirm: true;
+        url: string;
         description?: string | undefined;
         workspace_id?: string | undefined;
         events?: ("webhook.test" | "post.created" | "post.updated" | "post.deleted" | "post.publishing" | "post.published" | "post.failed" | "account.disconnected" | "analytics.synced" | "approval.requested" | "approval.approved" | "approval.changes_requested" | "approval.rejected" | "approval.commented")[] | undefined;

package/dist/tools/delete-post.d.ts

@@ -7,11 +7,11 @@ export declare const deletePostTool: {
         post_id: z.ZodNumber;
         confirm: z.ZodLiteral<true>;
     }, "strip", z.ZodTypeAny, {
-        post_id: number;
         confirm: true;
-    }, {
         post_id: number;
+    }, {
         confirm: true;
+        post_id: number;
     }>;
     execute(client: PosterlyClient, input: {
         post_id: number;

package/dist/tools/disconnect-account.d.ts

@@ -7,11 +7,11 @@ export declare const disconnectAccountTool: {
         account_id: z.ZodString;
         confirm: z.ZodBoolean;
     }, "strip", z.ZodTypeAny, {
-        account_id: string;
         confirm: boolean;
-    }, {
         account_id: string;
+    }, {
         confirm: boolean;
+        account_id: string;
     }>;
     execute(client: PosterlyClient, input: {
         account_id: string;

package/dist/tools/list-posts.js

@@ -3,7 +3,7 @@ import { dashboardUrlForPostList, formatLocalDateTime, truncateText } from '../l
 import { SUPPORTED_PLATFORM_INPUTS, SUPPORTED_PLATFORM_IDS } from '../generated/platform-manifest.js';
 export const listPostsTool = {
     name: 'list_posts',
-    description: 'List upcoming or recent posts. Filter by status (scheduled, published, failed, draft), platform, account_id, workspace_id, approval_status, or brand_id. If workspace_id is omitted, this returns your own posts, across workspaces, not every post in those workspaces.',
+    description: 'List upcoming or recent posts. Filter by status (scheduled, published, failed, draft), platform, account_id, workspace_id, approval_status, or brand_id. Returns posts in your workspaces, teammates\' too, per your role there (brand-locked seats only see their assigned brands). If workspace_id is omitted, this searches every workspace you belong to.',
     inputSchema: z.object({
         status: z
             .string()

package/dist/tools/list-workspace-members.d.ts

@@ -0,0 +1,17 @@
+import { z } from 'zod';
+import type { PosterlyClient } from '../lib/api-client.js';
+export declare function formatBrandIds(value: string[] | null | undefined): string;
+export declare const listWorkspaceMembersTool: {
+    name: string;
+    description: string;
+    inputSchema: z.ZodObject<{
+        workspace_id: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        workspace_id: string;
+    }, {
+        workspace_id: string;
+    }>;
+    execute(client: PosterlyClient, input: {
+        workspace_id: string;
+    }): Promise<string>;
+};

package/dist/tools/list-workspace-members.js

@@ -0,0 +1,51 @@
+import { z } from 'zod';
+import { code, mdKeyValue, mdSection, mdTable, mdTitle } from '../lib/format.js';
+export function formatBrandIds(value) {
+    if (!Array.isArray(value))
+        return 'hidden';
+    return value.length === 0 ? 'every brand' : value.map((id) => code(id)).join(', ');
+}
+function formatWorkspaceMembers(result) {
+    const members = result.members || [];
+    const invites = result.invites || [];
+    return [
+        mdTitle(`Team (${members.length} members, ${invites.length} pending invites)`, `Workspace ${result.workspace_id}`),
+        mdSection('Members', members.length > 0
+            ? mdTable(['Name', 'Member ID', 'Email', 'Role', 'Status', 'Brands'], members.map((member) => [
+                member.name || member.email || member.id,
+                code(member.id),
+                member.email,
+                member.role,
+                member.status,
+                formatBrandIds(member.brand_ids),
+            ]))
+            : 'No members found.'),
+        mdSection('Pending invites', invites.length > 0
+            ? mdTable(['Email', 'Invite ID', 'Role', 'Brands', 'Expires'], invites.map((invite) => [
+                invite.email,
+                code(invite.id),
+                invite.role,
+                formatBrandIds(invite.brand_ids),
+                invite.expires_at,
+            ]))
+            : ''),
+        mdSection('Seats', mdKeyValue([
+            ['Active members', result.usage?.active_members],
+            ['Pending invites', result.usage?.pending_invites],
+            ['Seats in use', result.usage?.seats_used],
+        ])),
+    ].filter(Boolean).join('\n\n');
+}
+export const listWorkspaceMembersTool = {
+    name: 'list_workspace_members',
+    description: 'List the people in a workspace: members (with role, status and brand access) and pending invites, plus seats in use. Needs an API key with the Manage team permission. Any workspace member can list; brand-limited teammates only see brand ids they can access.',
+    inputSchema: z.object({
+        workspace_id: z.string().describe('Workspace ID (from whoami).'),
+    }),
+    async execute(client, input) {
+        const workspaceId = input.workspace_id?.trim();
+        if (!workspaceId)
+            throw new Error('workspace_id is required. Get it from whoami.');
+        return formatWorkspaceMembers(await client.listWorkspaceMembers(workspaceId));
+    },
+};

package/dist/tools/manage-workspace-member.d.ts

@@ -0,0 +1,57 @@
+import { z } from 'zod';
+import type { PosterlyClient, WorkspaceMemberRole } from '../lib/api-client.js';
+declare const ACTIONS: readonly ["invite", "update", "remove"];
+export type ManageWorkspaceMemberInput = {
+    action: (typeof ACTIONS)[number];
+    workspace_id: string;
+    email?: string;
+    role?: WorkspaceMemberRole;
+    brand_ids?: string[];
+    resend?: boolean;
+    member_id?: string;
+    invite_id?: string;
+    confirm?: boolean;
+    preview_id?: string;
+};
+/** Per-action validation with clear errors. Exported for tests. */
+export declare function validateManageWorkspaceMemberInput(input: ManageWorkspaceMemberInput): string | null;
+export declare const manageWorkspaceMemberTool: {
+    name: string;
+    description: string;
+    inputSchema: z.ZodObject<{
+        action: z.ZodEnum<["invite", "update", "remove"]>;
+        workspace_id: z.ZodString;
+        email: z.ZodOptional<z.ZodString>;
+        role: z.ZodOptional<z.ZodEnum<["publisher", "editor", "viewer"]>>;
+        brand_ids: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        resend: z.ZodOptional<z.ZodBoolean>;
+        member_id: z.ZodOptional<z.ZodString>;
+        invite_id: z.ZodOptional<z.ZodString>;
+        confirm: z.ZodOptional<z.ZodBoolean>;
+        preview_id: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        workspace_id: string;
+        action: "invite" | "update" | "remove";
+        confirm?: boolean | undefined;
+        preview_id?: string | undefined;
+        email?: string | undefined;
+        role?: "publisher" | "editor" | "viewer" | undefined;
+        brand_ids?: string[] | undefined;
+        member_id?: string | undefined;
+        invite_id?: string | undefined;
+        resend?: boolean | undefined;
+    }, {
+        workspace_id: string;
+        action: "invite" | "update" | "remove";
+        confirm?: boolean | undefined;
+        preview_id?: string | undefined;
+        email?: string | undefined;
+        role?: "publisher" | "editor" | "viewer" | undefined;
+        brand_ids?: string[] | undefined;
+        member_id?: string | undefined;
+        invite_id?: string | undefined;
+        resend?: boolean | undefined;
+    }>;
+    execute(client: PosterlyClient, input: ManageWorkspaceMemberInput): Promise<string>;
+};
+export {};

package/dist/tools/manage-workspace-member.js

@@ -0,0 +1,131 @@
+import { z } from 'zod';
+import { code, mdKeyValue, mdSection, mdTitle } from '../lib/format.js';
+import { formatBrandIds } from './list-workspace-members.js';
+const ACTIONS = ['invite', 'update', 'remove'];
+const ROLES = ['publisher', 'editor', 'viewer'];
+const TITLES = {
+    invited: 'Invite sent',
+    invite_updated: 'Invite updated and sent again',
+    invite_resent: 'Invite email sent again',
+    already_invited: 'Already invited, nothing sent',
+    added: 'Teammate added',
+    updated: 'Access updated',
+    removed: 'Teammate removed',
+    revoked: 'Invite revoked',
+};
+function formatChange(result) {
+    if (result.requires_confirmation && result.preview) {
+        const preview = result.preview;
+        return [
+            mdTitle('Preview only: nothing has changed yet'),
+            preview.summary,
+            mdSection('Details', mdKeyValue([
+                ['Action', preview.action],
+                ['Email', preview.email],
+                ['Role', preview.previous_role && preview.previous_role !== preview.role ? `${preview.previous_role} -> ${preview.role}` : preview.role],
+                ['Brands', preview.brand_ids ? formatBrandIds(preview.brand_ids) : ''],
+                ['Sends an email', preview.sends_email ? 'yes' : 'no'],
+                ['Seats', preview.counts_toward_seats && preview.seat_limit != null
+                        ? `${preview.seats_used} in use of ${preview.seat_limit === -1 ? 'unlimited' : preview.seat_limit}`
+                        : ''],
+            ])),
+            mdSection('Preview ID', `${code(result.preview_id || '')} (expires ${result.preview_expires_at || 'soon'})`),
+            mdSection('Next step', 'Show this preview to the user. Only after they explicitly approve, call manage_workspace_member again with the same fields plus confirm: true and this preview_id.'),
+        ].filter(Boolean).join('\n\n');
+    }
+    const subject = result.invite || result.member;
+    return [
+        mdTitle(TITLES[result.status || ''] || 'Team updated'),
+        result.message || '',
+        mdSection('Details', mdKeyValue([
+            [result.invite ? 'Invite ID' : 'Member ID', subject?.id ? code(subject.id) : ''],
+            ['Email', subject?.email],
+            ['Role', subject?.role],
+            ['Status', subject?.status],
+            ['Brands', subject?.brand_ids ? formatBrandIds(subject.brand_ids) : ''],
+            ['Invite email sent', typeof result.email_sent === 'boolean' ? (result.email_sent ? 'yes' : 'no, ask them to check spam or resend later') : ''],
+            ['Workspace owner notified', result.owner_notified ? 'yes' : ''],
+        ])),
+    ].filter(Boolean).join('\n\n');
+}
+function has(input, key) {
+    return input[key] !== undefined && input[key] !== null;
+}
+/** Per-action validation with clear errors. Exported for tests. */
+export function validateManageWorkspaceMemberInput(input) {
+    const raw = input;
+    if (!ACTIONS.includes(input.action))
+        return 'action must be one of: invite, update, remove.';
+    if (!input.workspace_id?.trim())
+        return 'workspace_id is required. Get it from whoami.';
+    if (input.confirm === true && !input.preview_id) {
+        return 'confirm: true needs the preview_id from a preview call. Call once without confirm, show the preview to the user, then confirm.';
+    }
+    if (input.action === 'invite') {
+        const extra = ['member_id', 'invite_id'].filter((key) => has(raw, key));
+        if (extra.length)
+            return `action=invite does not take ${extra.join(', ')}. To change an existing seat use action=update.`;
+        if (!has(raw, 'email') || !has(raw, 'role'))
+            return 'action=invite needs email and role (publisher, editor or viewer).';
+        return null;
+    }
+    const notAllowed = input.action === 'update' ? ['email', 'resend'] : ['email', 'resend', 'role', 'brand_ids'];
+    const extra = notAllowed.filter((key) => has(raw, key));
+    if (extra.length)
+        return `action=${input.action} does not take ${extra.join(', ')}.`;
+    if (has(raw, 'member_id') === has(raw, 'invite_id')) {
+        return `action=${input.action} needs exactly one of member_id or invite_id (from list_workspace_members).`;
+    }
+    if (input.action === 'update' && !has(raw, 'role') && !has(raw, 'brand_ids')) {
+        return 'action=update needs role, brand_ids, or both.';
+    }
+    return null;
+}
+export const manageWorkspaceMemberTool = {
+    name: 'manage_workspace_member',
+    description: 'Invite, update, or remove a workspace colleague. This SENDS EMAILS and CHANGES WHO CAN ACCESS the workspace. Needs an API key with the Manage team permission, and the caller must be a workspace owner or admin. ALWAYS preview first: call without confirm, show the returned preview summary to the user, and only call again with confirm: true plus the returned preview_id after the user explicitly approves. action=invite: email and role required (publisher, editor or viewer), optional brand_ids and resend; always sends a pending invite email, never adds anyone instantly. action=update: member_id or invite_id (from list_workspace_members) plus role and/or brand_ids. action=remove: member_id (removes the teammate and revokes their API keys for this workspace) or invite_id (cancels a pending invite). Admin seats can only be granted in the posterly dashboard. The workspace owner is emailed about every change.',
+    inputSchema: z.object({
+        action: z.enum(ACTIONS).describe('invite, update, or remove.'),
+        workspace_id: z.string().describe('Workspace ID (from whoami).'),
+        email: z.string().optional().describe('action=invite only: the colleague email address.'),
+        role: z.enum(ROLES).optional().describe('action=invite (required) or action=update: publisher, editor, or viewer. Admin is dashboard-only.'),
+        brand_ids: z.array(z.string()).max(100).optional().describe('action=invite or action=update: limit the seat to these brand IDs (from list_brands). Empty array means every brand. Omit on update to keep the current brands.'),
+        resend: z.boolean().optional().describe('action=invite only: email an unchanged pending invite again.'),
+        member_id: z.string().optional().describe('action=update or action=remove: a member ID from list_workspace_members.'),
+        invite_id: z.string().optional().describe('action=update or action=remove: a pending invite ID from list_workspace_members.'),
+        confirm: z.boolean().optional().describe('Leave out to get a preview. Set true only after the user explicitly approved the preview, together with preview_id.'),
+        preview_id: z.string().optional().describe('The preview_id returned by the preview call. Required with confirm: true.'),
+    }),
+    async execute(client, input) {
+        const problem = validateManageWorkspaceMemberInput(input);
+        if (problem)
+            throw new Error(problem);
+        const workspaceId = input.workspace_id.trim();
+        const confirmFields = {
+            ...(input.confirm === true ? { confirm: true } : {}),
+            ...(input.preview_id ? { preview_id: input.preview_id } : {}),
+        };
+        const target = input.member_id ? { member_id: input.member_id } : { invite_id: input.invite_id };
+        let result;
+        if (input.action === 'invite') {
+            result = await client.inviteWorkspaceMember(workspaceId, {
+                email: input.email,
+                role: input.role,
+                ...(input.brand_ids !== undefined ? { brand_ids: input.brand_ids } : {}),
+                ...(input.resend !== undefined ? { resend: input.resend } : {}),
+                ...confirmFields,
+            });
+        }
+        else if (input.action === 'update') {
+            result = await client.updateWorkspaceMember(workspaceId, target, {
+                ...(input.role !== undefined ? { role: input.role } : {}),
+                ...(input.brand_ids !== undefined ? { brand_ids: input.brand_ids } : {}),
+                ...confirmFields,
+            });
+        }
+        else {
+            result = await client.removeWorkspaceMember(workspaceId, target, confirmFields);
+        }
+        return formatChange(result);
+    },
+};

package/dist/tools/reply-to-comment.d.ts

@@ -10,14 +10,14 @@ export declare const replyToCommentTool: {
         workspace_id: z.ZodOptional<z.ZodString>;
         confirm: z.ZodLiteral<true>;
     }, "strip", z.ZodTypeAny, {
-        content: string;
         confirm: true;
+        content: string;
         comment_id: string;
         workspace_id?: string | undefined;
         type?: "public" | "private" | undefined;
     }, {
-        content: string;
         confirm: true;
+        content: string;
         comment_id: string;
         workspace_id?: string | undefined;
         type?: "public" | "private" | undefined;

package/dist/tools/send-message.d.ts

@@ -9,13 +9,13 @@ export declare const sendMessageTool: {
         workspace_id: z.ZodOptional<z.ZodString>;
         confirm: z.ZodLiteral<true>;
     }, "strip", z.ZodTypeAny, {
-        content: string;
         confirm: true;
+        content: string;
         conversation_id: string;
         workspace_id?: string | undefined;
     }, {
-        content: string;
         confirm: true;
+        content: string;
         conversation_id: string;
         workspace_id?: string | undefined;
     }>;

package/dist/tools/submit-product-feedback.d.ts

@@ -18,8 +18,8 @@ export declare const submitProductFeedbackInputSchema: z.ZodObject<{
         related_tool?: string | undefined;
     }>>;
 }, "strict", z.ZodTypeAny, {
-    title: string;
     confirm: true;
+    title: string;
     category: "bug" | "idea" | "feedback";
     client?: string | undefined;
     description?: string | undefined;
@@ -29,8 +29,8 @@ export declare const submitProductFeedbackInputSchema: z.ZodObject<{
         related_tool?: string | undefined;
     } | undefined;
 }, {
-    title: string;
     confirm: true;
+    title: string;
     category: "bug" | "idea" | "feedback";
     client?: string | undefined;
     description?: string | undefined;
@@ -62,8 +62,8 @@ export declare const submitProductFeedbackTool: {
             related_tool?: string | undefined;
         }>>;
     }, "strict", z.ZodTypeAny, {
-        title: string;
         confirm: true;
+        title: string;
         category: "bug" | "idea" | "feedback";
         client?: string | undefined;
         description?: string | undefined;
@@ -73,8 +73,8 @@ export declare const submitProductFeedbackTool: {
             related_tool?: string | undefined;
         } | undefined;
     }, {
-        title: string;
         confirm: true;
+        title: string;
         category: "bug" | "idea" | "feedback";
         client?: string | undefined;
         description?: string | undefined;

package/dist/tools/update-post-release-id.d.ts

@@ -9,13 +9,13 @@ export declare const updatePostReleaseIdTool: {
         group_id: z.ZodOptional<z.ZodString>;
         confirm: z.ZodLiteral<true>;
     }, "strip", z.ZodTypeAny, {
-        post_id: number;
         confirm: true;
+        post_id: number;
         release_id: string;
         group_id?: string | undefined;
     }, {
-        post_id: number;
         confirm: true;
+        post_id: number;
         release_id: string;
         group_id?: string | undefined;
     }>;

package/dist/tools/update-post-status.d.ts

@@ -10,13 +10,13 @@ export declare const updatePostStatusTool: {
         confirm: z.ZodBoolean;
     }, "strip", z.ZodTypeAny, {
         status: "scheduled" | "paused" | "draft";
-        post_id: number;
         confirm: boolean;
+        post_id: number;
         scheduled_at?: string | undefined;
     }, {
         status: "scheduled" | "paused" | "draft";
-        post_id: number;
         confirm: boolean;
+        post_id: number;
         scheduled_at?: string | undefined;
     }>;
     execute(client: PosterlyClient, input: {

package/dist/tools/update-post.d.ts

@@ -977,8 +977,8 @@ export declare const updatePostTool: {
         }, z.ZodTypeAny, "passthrough">>>;
         confirm: z.ZodLiteral<true>;
     }, "strip", z.ZodTypeAny, {
-        post_id: number;
         confirm: true;
+        post_id: number;
         scheduled_at?: string | undefined;
         media_url?: string | undefined;
         media_urls?: string[] | undefined;
@@ -1141,8 +1141,8 @@ export declare const updatePostTool: {
             ai_generated: z.ZodOptional<z.ZodBoolean>;
         }, z.ZodTypeAny, "passthrough"> | undefined;
     }, {
-        post_id: number;
         confirm: true;
+        post_id: number;
         scheduled_at?: string | undefined;
         media_url?: string | undefined;
         media_urls?: string[] | undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "posterly-mcp-server",
-  "version": "0.43.7",
+  "version": "0.44.0",
   "mcpName": "io.github.awpthorp/posterly",
   "description": "MCP server for posterly: schedule and publish social media posts across 18 platforms from any MCP client (Claude, ChatGPT, Cursor, Windsurf, Cline, and more)",
   "license": "MIT",

package/server.json

@@ -3,7 +3,7 @@
   "name": "io.github.awpthorp/posterly",
   "title": "posterly",
   "description": "Validate, schedule, publish, and analyze social content across 18 platforms with posterly.",
-  "version": "0.43.7",
+  "version": "0.44.0",
   "websiteUrl": "https://www.poster.ly/mcp",
   "repository": {
     "url": "https://github.com/awpthorp/posterly",
@@ -14,7 +14,7 @@
     {
       "registryType": "npm",
       "identifier": "posterly-mcp-server",
-      "version": "0.43.7",
+      "version": "0.44.0",
       "transport": {
         "type": "stdio"
       },

package/src/index.ts

@@ -85,6 +85,8 @@ import { createConnectSessionTool } from './tools/create-connect-session.js';
 import { getConnectSessionTool } from './tools/get-connect-session.js';
 import { createApiKeyTool } from './tools/create-api-key.js';
 import { deleteApiKeyTool } from './tools/delete-api-key.js';
+import { listWorkspaceMembersTool } from './tools/list-workspace-members.js';
+import { manageWorkspaceMemberTool } from './tools/manage-workspace-member.js';
 import { getCreditsTool } from './tools/get-credits.js';
 import { getSubscriptionTool } from './tools/get-subscription.js';
 import { cancelSubscriptionTool } from './tools/cancel-subscription.js';
@@ -299,6 +301,36 @@ server.tool(
   }
 );
 
+server.tool(
+  listWorkspaceMembersTool.name,
+  listWorkspaceMembersTool.description,
+  listWorkspaceMembersTool.inputSchema.shape,
+  getToolAnnotations(listWorkspaceMembersTool.name),
+  async (input) => {
+    try {
+      const text = await listWorkspaceMembersTool.execute(client, input as any);
+      return { content: [{ type: 'text' as const, text }] };
+    } catch (err: any) {
+      return { content: [{ type: 'text' as const, text: `Error: ${err.message}` }], isError: true };
+    }
+  }
+);
+
+server.tool(
+  manageWorkspaceMemberTool.name,
+  manageWorkspaceMemberTool.description,
+  manageWorkspaceMemberTool.inputSchema.shape,
+  getToolAnnotations(manageWorkspaceMemberTool.name),
+  async (input) => {
+    try {
+      const text = await manageWorkspaceMemberTool.execute(client, input as any);
+      return { content: [{ type: 'text' as const, text }] };
+    } catch (err: any) {
+      return { content: [{ type: 'text' as const, text: `Error: ${err.message}` }], isError: true };
+    }
+  }
+);
+
 server.tool(
   getCreditsTool.name,
   getCreditsTool.description,

package/src/lib/api-client.ts

@@ -334,6 +334,70 @@ export type ApiKeyScope =
   | 'billing:read'
   | 'billing:write';
 
+export type WorkspaceMemberRole = 'publisher' | 'editor' | 'viewer';
+
+export type WorkspaceMemberSummary = {
+  id: string;
+  user_id: string | null;
+  email: string | null;
+  name: string | null;
+  role: string | null;
+  status: string | null;
+  /** [] = every brand; missing = not visible to a brand-limited caller. */
+  brand_ids?: string[];
+  joined_at: string | null;
+  created_at: string | null;
+};
+
+export type WorkspaceInviteSummary = {
+  id: string;
+  email: string | null;
+  role: string | null;
+  status: string | null;
+  brand_ids?: string[];
+  expires_at: string | null;
+  created_at: string | null;
+};
+
+export type WorkspaceMembersResponse = {
+  workspace_id: string;
+  members: WorkspaceMemberSummary[];
+  invites: WorkspaceInviteSummary[];
+  usage: { active_members: number; pending_invites: number; seats_used: number };
+};
+
+export type WorkspaceMemberPreview = {
+  action: string;
+  summary: string;
+  email: string | null;
+  role: string | null;
+  previous_role: string | null;
+  brand_ids: string[] | null;
+  previous_brand_ids: string[] | null;
+  sends_email: boolean;
+  counts_toward_seats: boolean;
+  seats_used: number | null;
+  seat_limit: number | null;
+};
+
+export type WorkspaceMemberChangeResponse = {
+  requires_confirmation?: boolean;
+  preview?: WorkspaceMemberPreview;
+  preview_id?: string;
+  preview_expires_at?: string;
+  status?: string;
+  message?: string;
+  invite?: WorkspaceInviteSummary;
+  member?: WorkspaceMemberSummary;
+  email_sent?: boolean;
+  owner_notified?: boolean;
+};
+
+export type WorkspaceMemberConfirmFields = {
+  confirm?: boolean;
+  preview_id?: string;
+};
+
 export type CreateApiKeyPayload = {
   name?: string;
   scopes?: ApiKeyScope[];
@@ -1190,6 +1254,45 @@ export class PosterlyClient {
     return this.request('DELETE', `/api-keys/${encodeURIComponent(keyId)}`, data);
   }
 
+  async listWorkspaceMembers(workspaceId: string): Promise<WorkspaceMembersResponse> {
+    return this.request('GET', `/workspaces/${encodeURIComponent(workspaceId)}/members`);
+  }
+
+  async inviteWorkspaceMember(
+    workspaceId: string,
+    data: { email: string; role: WorkspaceMemberRole; brand_ids?: string[]; resend?: boolean } & WorkspaceMemberConfirmFields,
+  ): Promise<WorkspaceMemberChangeResponse> {
+    return this.request('POST', `/workspaces/${encodeURIComponent(workspaceId)}/members`, data);
+  }
+
+  async updateWorkspaceMember(
+    workspaceId: string,
+    target: { member_id?: string; invite_id?: string },
+    data: { role?: WorkspaceMemberRole; brand_ids?: string[] } & WorkspaceMemberConfirmFields,
+  ): Promise<WorkspaceMemberChangeResponse> {
+    const base = `/workspaces/${encodeURIComponent(workspaceId)}`;
+    const path = target.member_id
+      ? `${base}/members/${encodeURIComponent(target.member_id)}`
+      : `${base}/invites/${encodeURIComponent(target.invite_id || '')}`;
+    return this.request('PATCH', path, data);
+  }
+
+  async removeWorkspaceMember(
+    workspaceId: string,
+    target: { member_id?: string; invite_id?: string },
+    data: WorkspaceMemberConfirmFields,
+  ): Promise<WorkspaceMemberChangeResponse> {
+    const base = `/workspaces/${encodeURIComponent(workspaceId)}`;
+    const path = target.member_id
+      ? `${base}/members/${encodeURIComponent(target.member_id)}`
+      : `${base}/invites/${encodeURIComponent(target.invite_id || '')}`;
+    const params = new URLSearchParams();
+    if (data.confirm === true) params.set('confirm', 'true');
+    if (data.preview_id) params.set('preview_id', data.preview_id);
+    const qs = params.toString();
+    return this.request('DELETE', `${path}${qs ? `?${qs}` : ''}`);
+  }
+
   async getSubscription(): Promise<SubscriptionSummaryResponse> {
     return this.request('GET', '/subscription');
   }

package/src/lib/version.ts

@@ -5,4 +5,4 @@
 // tool set (minus the intentional pre-auth signup tools that only this stdio
 // package exposes). `npm run check:mcp-parity` enforces both the version match
 // and the tool-list match, and runs in the pre-commit hook.
-export const POSTERLY_MCP_VERSION = '0.43.7';
+export const POSTERLY_MCP_VERSION = '0.44.0';

package/src/tools/create-api-key.ts

@@ -25,7 +25,7 @@ function formatCreatedApiKey(result: CreateApiKeyResponse): string {
 export const createApiKeyTool = {
   name: 'create_api_key',
   description:
-    'Create a new posterly API key for the authenticated user. SECRET-CREATING WRITE: only use after explicit user confirmation. The new key can only request scopes already present on the calling dashboard-created API key; OAuth and managed assistant tokens cannot mint keys.',
+    'Create a new posterly API key for the authenticated user. SECRET-CREATING WRITE: only use after explicit user confirmation. The new key can only request scopes already present on the calling dashboard-created API key; OAuth and managed assistant tokens cannot mint keys. Team management (members:read, members:write) and client portal sign-in link permissions are never copied or granted here: a person turns them on in /dashboard/api.',
   inputSchema: z.object({
     name: z.string().trim().min(1).max(120).optional().describe('Human-readable key name.'),
     scopes: z.array(scopeSchema).min(1).max(8).optional().describe('Scopes for the new key. Omit to copy the calling key scopes. Cannot exceed the calling key scopes. billing:read and billing:write allow managing the posterly subscription (cancel/pause/resume/downgrade).'),

package/src/tools/list-posts.ts

@@ -6,7 +6,7 @@ import { SUPPORTED_PLATFORM_INPUTS, SUPPORTED_PLATFORM_IDS } from '../generated/
 export const listPostsTool = {
   name: 'list_posts',
   description:
-    'List upcoming or recent posts. Filter by status (scheduled, published, failed, draft), platform, account_id, workspace_id, approval_status, or brand_id. If workspace_id is omitted, this returns your own posts, across workspaces, not every post in those workspaces.',
+    'List upcoming or recent posts. Filter by status (scheduled, published, failed, draft), platform, account_id, workspace_id, approval_status, or brand_id. Returns posts in your workspaces, teammates\' too, per your role there (brand-locked seats only see their assigned brands). If workspace_id is omitted, this searches every workspace you belong to.',
   inputSchema: z.object({
     status: z
       .string()

package/src/tools/list-workspace-members.ts

@@ -0,0 +1,61 @@
+import { z } from 'zod';
+import type { PosterlyClient, WorkspaceMembersResponse } from '../lib/api-client.js';
+import { code, mdKeyValue, mdSection, mdTable, mdTitle } from '../lib/format.js';
+
+export function formatBrandIds(value: string[] | null | undefined): string {
+  if (!Array.isArray(value)) return 'hidden';
+  return value.length === 0 ? 'every brand' : value.map((id) => code(id)).join(', ');
+}
+
+function formatWorkspaceMembers(result: WorkspaceMembersResponse): string {
+  const members = result.members || [];
+  const invites = result.invites || [];
+  return [
+    mdTitle(`Team (${members.length} members, ${invites.length} pending invites)`, `Workspace ${result.workspace_id}`),
+    mdSection('Members', members.length > 0
+      ? mdTable(
+          ['Name', 'Member ID', 'Email', 'Role', 'Status', 'Brands'],
+          members.map((member) => [
+            member.name || member.email || member.id,
+            code(member.id),
+            member.email,
+            member.role,
+            member.status,
+            formatBrandIds(member.brand_ids),
+          ]),
+        )
+      : 'No members found.'),
+    mdSection('Pending invites', invites.length > 0
+      ? mdTable(
+          ['Email', 'Invite ID', 'Role', 'Brands', 'Expires'],
+          invites.map((invite) => [
+            invite.email,
+            code(invite.id),
+            invite.role,
+            formatBrandIds(invite.brand_ids),
+            invite.expires_at,
+          ]),
+        )
+      : ''),
+    mdSection('Seats', mdKeyValue([
+      ['Active members', result.usage?.active_members],
+      ['Pending invites', result.usage?.pending_invites],
+      ['Seats in use', result.usage?.seats_used],
+    ])),
+  ].filter(Boolean).join('\n\n');
+}
+
+export const listWorkspaceMembersTool = {
+  name: 'list_workspace_members',
+  description:
+    'List the people in a workspace: members (with role, status and brand access) and pending invites, plus seats in use. Needs an API key with the Manage team permission. Any workspace member can list; brand-limited teammates only see brand ids they can access.',
+  inputSchema: z.object({
+    workspace_id: z.string().describe('Workspace ID (from whoami).'),
+  }),
+
+  async execute(client: PosterlyClient, input: { workspace_id: string }) {
+    const workspaceId = input.workspace_id?.trim();
+    if (!workspaceId) throw new Error('workspace_id is required. Get it from whoami.');
+    return formatWorkspaceMembers(await client.listWorkspaceMembers(workspaceId));
+  },
+};

package/src/tools/manage-workspace-member.ts

@@ -0,0 +1,151 @@
+import { z } from 'zod';
+import type {
+  PosterlyClient,
+  WorkspaceMemberChangeResponse,
+  WorkspaceMemberRole,
+} from '../lib/api-client.js';
+import { code, mdKeyValue, mdSection, mdTitle } from '../lib/format.js';
+import { formatBrandIds } from './list-workspace-members.js';
+
+const ACTIONS = ['invite', 'update', 'remove'] as const;
+const ROLES = ['publisher', 'editor', 'viewer'] as const;
+
+export type ManageWorkspaceMemberInput = {
+  action: (typeof ACTIONS)[number];
+  workspace_id: string;
+  email?: string;
+  role?: WorkspaceMemberRole;
+  brand_ids?: string[];
+  resend?: boolean;
+  member_id?: string;
+  invite_id?: string;
+  confirm?: boolean;
+  preview_id?: string;
+};
+
+const TITLES: Record<string, string> = {
+  invited: 'Invite sent',
+  invite_updated: 'Invite updated and sent again',
+  invite_resent: 'Invite email sent again',
+  already_invited: 'Already invited, nothing sent',
+  added: 'Teammate added',
+  updated: 'Access updated',
+  removed: 'Teammate removed',
+  revoked: 'Invite revoked',
+};
+
+function formatChange(result: WorkspaceMemberChangeResponse): string {
+  if (result.requires_confirmation && result.preview) {
+    const preview = result.preview;
+    return [
+      mdTitle('Preview only: nothing has changed yet'),
+      preview.summary,
+      mdSection('Details', mdKeyValue([
+        ['Action', preview.action],
+        ['Email', preview.email],
+        ['Role', preview.previous_role && preview.previous_role !== preview.role ? `${preview.previous_role} -> ${preview.role}` : preview.role],
+        ['Brands', preview.brand_ids ? formatBrandIds(preview.brand_ids) : ''],
+        ['Sends an email', preview.sends_email ? 'yes' : 'no'],
+        ['Seats', preview.counts_toward_seats && preview.seat_limit != null
+          ? `${preview.seats_used} in use of ${preview.seat_limit === -1 ? 'unlimited' : preview.seat_limit}`
+          : ''],
+      ])),
+      mdSection('Preview ID', `${code(result.preview_id || '')} (expires ${result.preview_expires_at || 'soon'})`),
+      mdSection('Next step', 'Show this preview to the user. Only after they explicitly approve, call manage_workspace_member again with the same fields plus confirm: true and this preview_id.'),
+    ].filter(Boolean).join('\n\n');
+  }
+  const subject = result.invite || result.member;
+  return [
+    mdTitle(TITLES[result.status || ''] || 'Team updated'),
+    result.message || '',
+    mdSection('Details', mdKeyValue([
+      [result.invite ? 'Invite ID' : 'Member ID', subject?.id ? code(subject.id) : ''],
+      ['Email', subject?.email],
+      ['Role', subject?.role],
+      ['Status', subject?.status],
+      ['Brands', subject?.brand_ids ? formatBrandIds(subject.brand_ids) : ''],
+      ['Invite email sent', typeof result.email_sent === 'boolean' ? (result.email_sent ? 'yes' : 'no, ask them to check spam or resend later') : ''],
+      ['Workspace owner notified', result.owner_notified ? 'yes' : ''],
+    ])),
+  ].filter(Boolean).join('\n\n');
+}
+
+function has(input: Record<string, unknown>, key: string): boolean {
+  return input[key] !== undefined && input[key] !== null;
+}
+
+/** Per-action validation with clear errors. Exported for tests. */
+export function validateManageWorkspaceMemberInput(input: ManageWorkspaceMemberInput): string | null {
+  const raw = input as unknown as Record<string, unknown>;
+  if (!ACTIONS.includes(input.action)) return 'action must be one of: invite, update, remove.';
+  if (!input.workspace_id?.trim()) return 'workspace_id is required. Get it from whoami.';
+  if (input.confirm === true && !input.preview_id) {
+    return 'confirm: true needs the preview_id from a preview call. Call once without confirm, show the preview to the user, then confirm.';
+  }
+  if (input.action === 'invite') {
+    const extra = ['member_id', 'invite_id'].filter((key) => has(raw, key));
+    if (extra.length) return `action=invite does not take ${extra.join(', ')}. To change an existing seat use action=update.`;
+    if (!has(raw, 'email') || !has(raw, 'role')) return 'action=invite needs email and role (publisher, editor or viewer).';
+    return null;
+  }
+  const notAllowed = input.action === 'update' ? ['email', 'resend'] : ['email', 'resend', 'role', 'brand_ids'];
+  const extra = notAllowed.filter((key) => has(raw, key));
+  if (extra.length) return `action=${input.action} does not take ${extra.join(', ')}.`;
+  if (has(raw, 'member_id') === has(raw, 'invite_id')) {
+    return `action=${input.action} needs exactly one of member_id or invite_id (from list_workspace_members).`;
+  }
+  if (input.action === 'update' && !has(raw, 'role') && !has(raw, 'brand_ids')) {
+    return 'action=update needs role, brand_ids, or both.';
+  }
+  return null;
+}
+
+export const manageWorkspaceMemberTool = {
+  name: 'manage_workspace_member',
+  description:
+    'Invite, update, or remove a workspace colleague. This SENDS EMAILS and CHANGES WHO CAN ACCESS the workspace. Needs an API key with the Manage team permission, and the caller must be a workspace owner or admin. ALWAYS preview first: call without confirm, show the returned preview summary to the user, and only call again with confirm: true plus the returned preview_id after the user explicitly approves. action=invite: email and role required (publisher, editor or viewer), optional brand_ids and resend; always sends a pending invite email, never adds anyone instantly. action=update: member_id or invite_id (from list_workspace_members) plus role and/or brand_ids. action=remove: member_id (removes the teammate and revokes their API keys for this workspace) or invite_id (cancels a pending invite). Admin seats can only be granted in the posterly dashboard. The workspace owner is emailed about every change.',
+  inputSchema: z.object({
+    action: z.enum(ACTIONS).describe('invite, update, or remove.'),
+    workspace_id: z.string().describe('Workspace ID (from whoami).'),
+    email: z.string().optional().describe('action=invite only: the colleague email address.'),
+    role: z.enum(ROLES).optional().describe('action=invite (required) or action=update: publisher, editor, or viewer. Admin is dashboard-only.'),
+    brand_ids: z.array(z.string()).max(100).optional().describe('action=invite or action=update: limit the seat to these brand IDs (from list_brands). Empty array means every brand. Omit on update to keep the current brands.'),
+    resend: z.boolean().optional().describe('action=invite only: email an unchanged pending invite again.'),
+    member_id: z.string().optional().describe('action=update or action=remove: a member ID from list_workspace_members.'),
+    invite_id: z.string().optional().describe('action=update or action=remove: a pending invite ID from list_workspace_members.'),
+    confirm: z.boolean().optional().describe('Leave out to get a preview. Set true only after the user explicitly approved the preview, together with preview_id.'),
+    preview_id: z.string().optional().describe('The preview_id returned by the preview call. Required with confirm: true.'),
+  }),
+
+  async execute(client: PosterlyClient, input: ManageWorkspaceMemberInput) {
+    const problem = validateManageWorkspaceMemberInput(input);
+    if (problem) throw new Error(problem);
+
+    const workspaceId = input.workspace_id.trim();
+    const confirmFields = {
+      ...(input.confirm === true ? { confirm: true } : {}),
+      ...(input.preview_id ? { preview_id: input.preview_id } : {}),
+    };
+    const target = input.member_id ? { member_id: input.member_id } : { invite_id: input.invite_id };
+
+    let result: WorkspaceMemberChangeResponse;
+    if (input.action === 'invite') {
+      result = await client.inviteWorkspaceMember(workspaceId, {
+        email: input.email as string,
+        role: input.role as WorkspaceMemberRole,
+        ...(input.brand_ids !== undefined ? { brand_ids: input.brand_ids } : {}),
+        ...(input.resend !== undefined ? { resend: input.resend } : {}),
+        ...confirmFields,
+      });
+    } else if (input.action === 'update') {
+      result = await client.updateWorkspaceMember(workspaceId, target, {
+        ...(input.role !== undefined ? { role: input.role } : {}),
+        ...(input.brand_ids !== undefined ? { brand_ids: input.brand_ids } : {}),
+        ...confirmFields,
+      });
+    } else {
+      result = await client.removeWorkspaceMember(workspaceId, target, confirmFields);
+    }
+    return formatChange(result);
+  },
+};

package/tool-annotations.json

@@ -89,7 +89,9 @@
     "get_comment",
     "reply_to_comment",
     "update_comment",
-    "sync_inbox"
+    "sync_inbox",
+    "list_workspace_members",
+    "manage_workspace_member"
   ],
   "readOnlyTools": [
     "get_agent_signup_info",
@@ -135,7 +137,8 @@
     "list_conversations",
     "get_conversation",
     "list_comments",
-    "get_comment"
+    "get_comment",
+    "list_workspace_members"
   ],
   "destructiveTools": [
     "disconnect_account",
@@ -155,7 +158,8 @@
     "delete_google_business_review_reply",
     "delete_google_business_media",
     "update_webhook",
-    "delete_webhook"
+    "delete_webhook",
+    "manage_workspace_member"
   ],
   "idempotentMutationTools": [
     "connect_account",
@@ -229,6 +233,7 @@
     "reply_to_comment",
     "update_comment",
     "delete_comment",
-    "sync_inbox"
+    "sync_inbox",
+    "manage_workspace_member"
   ]
 }