posterly-mcp-server 0.44.0 → 0.45.0

package/dist/tools/update-post.js

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import { code, formatDateTime, mdKeyValue, mdQuote, mdSection, mdTitle, statusLabel } from '../lib/format.js';
+import { validateArgs } from '../lib/tool-runtime.js';
 const mediaAccessibilitySchema = z.array(z.object({
     index: z.number().int().nonnegative(),
     asset_id: z.string().optional(),
@@ -107,8 +108,8 @@ const platformSettingsSchema = z.object({
 }).passthrough();
 export const updatePostTool = {
     name: 'update_post',
-    description: 'Update a scheduled or draft post. DESTRUCTIVE WRITE - overwrites the existing post\'s caption/media/schedule. Cannot edit published or currently publishing posts. If a client has already approved the post, a caption edit reopens caption approval and a media or thumbnail edit reopens asset approval. A reschedule, account change or settings change cannot be attributed to one axis and reopens both.\n\n' +
-        'REQUIRED BEFORE CALLING: Show the user a side-by-side of the CURRENT post (caption, scheduled time, media) and the PROPOSED changes, and get explicit confirmation ("yes update it", "apply those changes") before calling. Do not auto-edit posts based on a general instruction - each edit needs its own confirmation.',
+    description: 'Change a scheduled or draft post. DESTRUCTIVE WRITE. Edit (default): caption, media, schedule, post_type, or settings; overwrites the existing post; cannot edit published or currently publishing posts; if a client has already approved the post, a caption edit reopens caption approval, a media or thumbnail edit reopens asset approval, and a reschedule, account change or settings change reopens both. status (scheduled, paused, or draft, with scheduled_at when scheduling a draft): pause, resume, or move back to draft; send it on its own. release_id (with optional group_id): set or repair external release/group IDs; send it on its own.\n\n' +
+        'REQUIRED BEFORE CALLING: Show the user a side-by-side of the CURRENT post (caption, scheduled time, media, status) and the PROPOSED change, and get explicit confirmation ("yes update it", "apply those changes") before calling. Do not auto-edit posts based on a general instruction - each change needs its own confirmation.',
     inputSchema: z.object({
         post_id: z.number().describe('The post ID to update'),
         caption: z.string().optional().describe('New caption/text content'),
@@ -130,33 +131,85 @@ export const updatePostTool = {
         reel_thumb_offset: z.number().nonnegative().optional().describe('Frame offset in milliseconds to use as the reel cover.'),
         instagram_settings: instagramSettingsSchema
             .optional()
-            .describe('Instagram-specific updates. Distinguish caption @mentions, native media user_tags, and collaborators. Native media tags work with eligible direct or Meta-linked accounts; collaborators require an eligible Meta-linked account. Call get_platform_schema(account_id) first.'),
+            .describe('Instagram-specific updates. Distinguish caption @mentions, native media user_tags, and collaborators. Native media tags work with eligible direct or Meta-linked accounts; collaborators require an eligible Meta-linked account. Call list_platforms with view=schema and account_id first.'),
         platform_settings: platformSettingsSchema
             .optional()
             .describe('Platform-specific settings to merge into the post. Prefer this over raw metadata.'),
-        confirm: z.literal(true).describe('Must be true after explicit user confirmation of the proposed post update.'),
+        status: z
+            .enum(['scheduled', 'paused', 'draft'])
+            .optional()
+            .describe('Change the post status instead of editing it. Send with post_id (and scheduled_at when scheduling a draft) only.'),
+        release_id: z
+            .string()
+            .min(1)
+            .max(160)
+            .optional()
+            .describe('Set an external release ID instead of editing the post. Send with post_id and optional group_id only.'),
+        group_id: z.string().min(1).max(160).optional().describe('With release_id only: an external group/campaign ID.'),
+        confirm: z.literal(true).describe('Must be true after explicit user confirmation of the proposed change.'),
     }),
-    async execute(client, input) {
-        if (input.confirm !== true) {
-            throw new Error('Refusing to update post without confirm=true after explicit user confirmation.');
-        }
-        const { post_id, confirm: _confirm, instagram_settings, platform_settings, ...updates } = input;
-        const payload = {
-            ...updates,
-            ...(platform_settings || instagram_settings
-                ? { settings: { ...(instagram_settings ? { __type: 'instagram', ...instagram_settings } : {}), ...(platform_settings || {}) } }
-                : {}),
-        };
-        const result = await client.updatePost(post_id, payload);
-        const p = result.post;
-        return [
-            mdTitle(`✅ Post ${code(p.id)} updated`),
-            mdKeyValue([
-                ['Status', statusLabel(p.status)],
-                ['Scheduled', formatDateTime(p.scheduled_at)],
-                ['Type', p.post_type || 'unknown'],
-            ]),
-            mdSection('Caption', p.content ? mdQuote(p.content) : '_(empty)_'),
-        ].join('\n\n');
+    /** The old tools' exact input schemas, for alias calls (see alias-transport.ts). */
+    legacySchemas: {
+        update_post_status: z.object({
+            post_id: z.number(),
+            status: z.enum(['scheduled', 'paused', 'draft']),
+            scheduled_at: z.string().optional(),
+            confirm: z.boolean(),
+        }),
+        update_post_release_id: z.object({
+            post_id: z.number().int().positive(),
+            release_id: z.string().min(1).max(160),
+            group_id: z.string().min(1).max(160).optional(),
+            confirm: z.literal(true),
+        }),
+    },
+    async execute(client, input, ctx) {
+        const { mode, args } = validateArgs(ctx, 'update_post', input);
+        if (mode === 'status')
+            return updateStatus(client, args);
+        if (mode === 'release_id')
+            return updateReleaseId(client, args);
+        return editPost(client, args);
     },
 };
+async function editPost(client, input) {
+    if (input.confirm !== true) {
+        throw new Error('Refusing to update post without confirm=true after explicit user confirmation.');
+    }
+    const { post_id, confirm: _confirm, preview_id: _previewId, instagram_settings, platform_settings, ...updates } = input;
+    const payload = {
+        ...updates,
+        ...(platform_settings || instagram_settings
+            ? { settings: { ...(instagram_settings ? { __type: 'instagram', ...instagram_settings } : {}), ...(platform_settings || {}) } }
+            : {}),
+    };
+    const result = await client.updatePost(post_id, payload);
+    const p = result.post;
+    return [
+        mdTitle(`✅ Post ${code(p.id)} updated`),
+        mdKeyValue([
+            ['Status', statusLabel(p.status)],
+            ['Scheduled', formatDateTime(p.scheduled_at)],
+            ['Type', p.post_type || 'unknown'],
+        ]),
+        mdSection('Caption', p.content ? mdQuote(p.content) : '_(empty)_'),
+    ].join('\n\n');
+}
+async function updateStatus(client, input) {
+    if (input.confirm !== true) {
+        throw new Error('Refusing to update post status without confirm=true after explicit user confirmation.');
+    }
+    const result = await client.updatePostStatus(input.post_id, {
+        status: input.status,
+        scheduled_at: input.scheduled_at,
+    });
+    const transition = result.transition || {};
+    return `Post #${input.post_id} status changed from ${transition.old_status || 'unknown'} to ${transition.new_status || input.status}.`;
+}
+async function updateReleaseId(client, input) {
+    const result = await client.updatePostReleaseId(input.post_id, {
+        release_id: input.release_id,
+        group_id: input.group_id,
+    });
+    return JSON.stringify(result, null, 2);
+}

package/dist/tools/upload-media.d.ts

@@ -1,28 +1,51 @@
 import { z } from 'zod';
 import type { PosterlyClient } from '../lib/api-client.js';
+import { type ToolContext } from '../lib/tool-runtime.js';
+type UploadMediaInput = {
+    file_path?: string;
+    base64_data?: string;
+    url?: string;
+    filename?: string;
+    content_type?: string;
+};
 export declare const uploadMediaTool: {
     name: string;
     description: string;
     inputSchema: z.ZodObject<{
         file_path: z.ZodOptional<z.ZodString>;
         base64_data: z.ZodOptional<z.ZodString>;
-        filename: z.ZodString;
+        url: z.ZodOptional<z.ZodString>;
+        filename: z.ZodOptional<z.ZodString>;
         content_type: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        filename: string;
+        filename?: string | undefined;
+        url?: string | undefined;
         content_type?: string | undefined;
         file_path?: string | undefined;
         base64_data?: string | undefined;
     }, {
-        filename: string;
+        filename?: string | undefined;
+        url?: string | undefined;
         content_type?: string | undefined;
         file_path?: string | undefined;
         base64_data?: string | undefined;
     }>;
-    execute(client: PosterlyClient, input: {
-        file_path?: string;
-        base64_data?: string;
-        filename: string;
-        content_type?: string;
-    }): Promise<string>;
+    /** The old tools' exact input schemas, for alias calls (see alias-transport.ts). */
+    legacySchemas: {
+        upload_media_from_url: z.ZodObject<{
+            url: z.ZodString;
+            filename: z.ZodOptional<z.ZodString>;
+            content_type: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            url: string;
+            filename?: string | undefined;
+            content_type?: string | undefined;
+        }, {
+            url: string;
+            filename?: string | undefined;
+            content_type?: string | undefined;
+        }>;
+    };
+    execute(client: PosterlyClient, input: UploadMediaInput, ctx: ToolContext): Promise<string>;
 };
+export {};

package/dist/tools/upload-media.js

@@ -1,10 +1,10 @@
 import { z } from 'zod';
 import { mdError, mdSuccess } from '../lib/format.js';
+import { validateArgs } from '../lib/tool-runtime.js';
 export const uploadMediaTool = {
     name: 'upload_media',
-    description: 'Upload an image or video file to posterly storage. Returns a URL that can be used with create_post. Supports JPEG, PNG, GIF, WebP, MP4, MOV, WebM. Images up to 10MB, videos up to 50MB.\n\n' +
-        'This writes to the user\'s media storage (counts against quota) but does NOT publish the file anywhere. Uploading is safe - it\'s the subsequent `create_post` call that publishes content, and that tool has its own confirmation requirements.\n\n' +
-        'IMPORTANT: If the user shares an image in the chat, use base64_data (not file_path) since chat-uploaded images are not on the local filesystem. Only use file_path when the user provides an actual local filesystem path - never guess paths.',
+    description: 'Upload an image or video to posterly storage and get a URL for create_post. Supports JPEG, PNG, GIF, WebP, MP4, MOV, WebM. Images up to 10MB, videos up to 50MB. Three ways in: file_path (an explicit local path the user gave you), base64_data with filename (PREFERRED for images shared in chat, which are not on the local filesystem), or url (a public HTTPS image or video; local/private network URLs are blocked).\n\n' +
+        'This writes to the user\'s media storage (counts against quota) but does NOT publish the file anywhere. Uploading is safe - it\'s the subsequent `create_post` call that publishes content, and that tool has its own confirmation requirements. Never guess file paths. You can also pass public HTTP(S) media URLs directly to create_post/update_post; use url here when you want to upload once and reuse the returned posterly URL.',
     inputSchema: z.object({
         file_path: z
             .string()
@@ -14,27 +14,63 @@ export const uploadMediaTool = {
             .string()
             .optional()
             .describe('Base64-encoded file data. PREFERRED for images shared directly in chat - extract the image data as base64 and pass it here.'),
+        url: z
+            .string()
+            .url()
+            .optional()
+            .describe('Public HTTPS URL for the image or video to copy into posterly storage. Local/private network URLs are blocked.'),
         filename: z
             .string()
-            .describe('Filename with extension (e.g. photo.jpg, video.mp4)'),
+            .optional()
+            .describe('Filename with extension (e.g. photo.jpg, video.mp4). Required with file_path or base64_data; optional override with url.'),
         content_type: z
             .string()
             .optional()
             .describe('MIME type (auto-detected from filename if omitted)'),
     }),
-    async execute(client, input) {
-        if (!input.file_path && !input.base64_data) {
-            return mdError('Provide either `file_path` or `base64_data`.');
-        }
-        const result = await client.uploadMedia({
-            filePath: input.file_path,
-            base64Data: input.base64_data,
-            filename: input.filename,
-            contentType: input.content_type,
-        });
-        return mdSuccess('Media uploaded', [
-            ['URL', result.url],
-            ['Storage path', result.path],
-        ], 'Use this URL as `media_url` when creating a post.');
+    /** The old tools' exact input schemas, for alias calls (see alias-transport.ts). */
+    legacySchemas: {
+        upload_media_from_url: z.object({
+            url: z.string().url(),
+            filename: z.string().optional(),
+            content_type: z.string().optional(),
+        }),
+    },
+    async execute(client, input, ctx) {
+        const { mode, args } = validateArgs(ctx, 'upload_media', input);
+        if (mode === 'url')
+            return uploadFromUrl(client, args);
+        return uploadFile(client, args);
     },
 };
+async function uploadFile(client, input) {
+    if (!input.file_path && !input.base64_data) {
+        return mdError('Provide either `file_path` or `base64_data`.');
+    }
+    const result = await client.uploadMedia({
+        filePath: input.file_path,
+        base64Data: input.base64_data,
+        filename: input.filename,
+        contentType: input.content_type,
+    });
+    return mdSuccess('Media uploaded', [
+        ['URL', result.url],
+        ['Storage path', result.path],
+    ], 'Use this URL as `media_url` when creating a post.');
+}
+async function uploadFromUrl(client, input) {
+    const result = await client.uploadMediaFromUrl({
+        url: input.url,
+        filename: input.filename,
+        contentType: input.content_type,
+    });
+    return [
+        'Remote media uploaded successfully.',
+        `• URL: ${result.url}`,
+        `• Source URL: ${result.source_url}`,
+        `• Content type: ${result.content_type}`,
+        `• Size: ${result.size} bytes`,
+        '',
+        'Use this URL as media_url when creating a post.',
+    ].join('\n');
+}

package/dist/tools/validate-post.d.ts

@@ -490,7 +490,7 @@ export declare const validatePostInputSchema: import("zod").ZodObject<{
     }, import("zod").ZodTypeAny, "passthrough">>>;
     workspace_id: import("zod").ZodOptional<import("zod").ZodString>;
 }, "strip", import("zod").ZodTypeAny, {
-    platform?: "instagram" | "instagram-standalone" | "facebook" | "tiktok" | "twitter" | "threads" | "linkedin" | "youtube" | "pinterest" | "google_business" | "x" | "telegram" | "bluesky" | "discord" | "slack" | "mastodon" | "devto" | "hashnode" | "wordpress" | "lemmy" | "gmb" | "google-business" | "google_business_profile" | undefined;
+    platform?: "instagram" | "instagram-standalone" | "facebook" | "tiktok" | "twitter" | "threads" | "linkedin" | "youtube" | "pinterest" | "google_business" | "x" | "telegram" | "bluesky" | "discord" | "wordpress" | "devto" | "hashnode" | "lemmy" | "slack" | "mastodon" | "gmb" | "google-business" | "google_business_profile" | undefined;
     username?: string | undefined;
     workspace_id?: string | undefined;
     account_id?: string | undefined;
@@ -653,7 +653,7 @@ export declare const validatePostInputSchema: import("zod").ZodObject<{
         ai_generated: import("zod").ZodOptional<import("zod").ZodBoolean>;
     }, import("zod").ZodTypeAny, "passthrough"> | undefined;
 }, {
-    platform?: "instagram" | "instagram-standalone" | "facebook" | "tiktok" | "twitter" | "threads" | "linkedin" | "youtube" | "pinterest" | "google_business" | "x" | "telegram" | "bluesky" | "discord" | "slack" | "mastodon" | "devto" | "hashnode" | "wordpress" | "lemmy" | "gmb" | "google-business" | "google_business_profile" | undefined;
+    platform?: "instagram" | "instagram-standalone" | "facebook" | "tiktok" | "twitter" | "threads" | "linkedin" | "youtube" | "pinterest" | "google_business" | "x" | "telegram" | "bluesky" | "discord" | "wordpress" | "devto" | "hashnode" | "lemmy" | "slack" | "mastodon" | "gmb" | "google-business" | "google_business_profile" | undefined;
     username?: string | undefined;
     workspace_id?: string | undefined;
     account_id?: string | undefined;
@@ -1310,7 +1310,7 @@ export declare const validatePostTool: {
         }, import("zod").ZodTypeAny, "passthrough">>>;
         workspace_id: import("zod").ZodOptional<import("zod").ZodString>;
     }, "strip", import("zod").ZodTypeAny, {
-        platform?: "instagram" | "instagram-standalone" | "facebook" | "tiktok" | "twitter" | "threads" | "linkedin" | "youtube" | "pinterest" | "google_business" | "x" | "telegram" | "bluesky" | "discord" | "slack" | "mastodon" | "devto" | "hashnode" | "wordpress" | "lemmy" | "gmb" | "google-business" | "google_business_profile" | undefined;
+        platform?: "instagram" | "instagram-standalone" | "facebook" | "tiktok" | "twitter" | "threads" | "linkedin" | "youtube" | "pinterest" | "google_business" | "x" | "telegram" | "bluesky" | "discord" | "wordpress" | "devto" | "hashnode" | "lemmy" | "slack" | "mastodon" | "gmb" | "google-business" | "google_business_profile" | undefined;
         username?: string | undefined;
         workspace_id?: string | undefined;
         account_id?: string | undefined;
@@ -1473,7 +1473,7 @@ export declare const validatePostTool: {
             ai_generated: import("zod").ZodOptional<import("zod").ZodBoolean>;
         }, import("zod").ZodTypeAny, "passthrough"> | undefined;
     }, {
-        platform?: "instagram" | "instagram-standalone" | "facebook" | "tiktok" | "twitter" | "threads" | "linkedin" | "youtube" | "pinterest" | "google_business" | "x" | "telegram" | "bluesky" | "discord" | "slack" | "mastodon" | "devto" | "hashnode" | "wordpress" | "lemmy" | "gmb" | "google-business" | "google_business_profile" | undefined;
+        platform?: "instagram" | "instagram-standalone" | "facebook" | "tiktok" | "twitter" | "threads" | "linkedin" | "youtube" | "pinterest" | "google_business" | "x" | "telegram" | "bluesky" | "discord" | "wordpress" | "devto" | "hashnode" | "lemmy" | "slack" | "mastodon" | "gmb" | "google-business" | "google_business_profile" | undefined;
         username?: string | undefined;
         workspace_id?: string | undefined;
         account_id?: string | undefined;

package/dist/tools/whoami.d.ts

@@ -1,8 +1,21 @@
 import { z } from 'zod';
 import type { PosterlyClient } from '../lib/api-client.js';
+import { type ToolContext } from '../lib/tool-runtime.js';
 export declare const whoamiTool: {
     name: string;
     description: string;
-    inputSchema: z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>;
-    execute(client: PosterlyClient): Promise<string>;
+    inputSchema: z.ZodObject<{
+        view: z.ZodOptional<z.ZodEnum<["identity", "status"]>>;
+    }, "strip", z.ZodTypeAny, {
+        view?: "status" | "identity" | undefined;
+    }, {
+        view?: "status" | "identity" | undefined;
+    }>;
+    /** The old tools' exact input schemas, for alias calls (see alias-transport.ts). */
+    legacySchemas: {
+        get_mcp_status: z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>;
+    };
+    execute(client: PosterlyClient, input: {
+        view?: "identity" | "status";
+    }, ctx: ToolContext): Promise<string>;
 };

package/dist/tools/whoami.js

@@ -1,31 +1,227 @@
 import { z } from 'zod';
+import { POSTERLY_MCP_VERSION } from '../lib/version.js';
+import { resolvePosterlyBaseUrl } from '../lib/api-client.js';
 import { code, mdKeyValue, mdTable, mdTitle } from '../lib/format.js';
+import { validateArgs } from '../lib/tool-runtime.js';
+const NPM_LATEST_URL = 'https://registry.npmjs.org/posterly-mcp-server/latest';
 export const whoamiTool = {
     name: 'whoami',
-    description: 'Return the authenticated user, API key scopes, workspaces, and onboarding next step. ALWAYS call this at the start of a session. If onboarding.completed is false, walk the remaining onboarding steps IN THIS conversation (about you, connect, brand voice, first post). Do not send the user to /onboarding-v2 or the dashboard composer wizard.',
-    inputSchema: z.object({}),
-    async execute(client) {
-        const info = await client.whoami();
-        return [
-            mdTitle('posterly identity'),
-            mdKeyValue([
-                ['User', info.user.email || code(info.user.id)],
-                ['API scopes', info.api_key.scopes.join(', ') || 'none'],
-                ['Default workspace', `${info.default_workspace.name} (${code(info.default_workspace.id)})`],
-                ['Default timezone', info.default_workspace.timezone || 'n/a'],
-                ['Onboarding', info.onboarding?.completed ? 'complete' : info.onboarding?.next_step_label || 'unknown'],
-            ]),
-            info.onboarding && !info.onboarding.completed
-                ? `**Onboarding next:** ${info.onboarding.next_step_label}. ${info.onboarding.instruction}`
-                : '',
-            mdTable(['Workspace', 'Workspace ID', 'Role', 'Timezone', 'Default'], info.workspaces.map((workspace) => [
-                `${workspace.name}${workspace.is_personal ? ' (personal)' : ''}`,
-                code(workspace.id),
-                workspace.role || 'member',
-                workspace.timezone || 'n/a',
-                workspace.id === info.default_workspace.id,
-            ])),
-            '**Tip:** Pass `workspace_id` to `create_post`, `list_posts`, `list_accounts`, and `find_available_slot` when you want the assistant to stay inside one workspace.',
-        ].filter(Boolean).join('\n\n');
+    description: 'Who you are and how posterly is connected. view=identity (default): the authenticated user, API key scopes, workspaces, and onboarding next step. ALWAYS call this at the start of a session; if onboarding.completed is false, walk the remaining onboarding steps IN THIS conversation (about you, connect, brand voice, first post) and do not send the user to /onboarding-v2 or the dashboard composer wizard. view=status: MCP server version, latest npm version, endpoint and API key health, and update guidance; works before POSTERLY_API_KEY is configured.',
+    inputSchema: z.object({
+        view: z
+            .enum(['identity', 'status'])
+            .optional()
+            .describe('identity (default): user, scopes, workspaces, onboarding. status: MCP server and connection health.'),
+    }),
+    /** The old tools' exact input schemas, for alias calls (see alias-transport.ts). */
+    legacySchemas: {
+        get_mcp_status: z.object({}),
+    },
+    async execute(client, input, ctx) {
+        const { mode } = validateArgs(ctx, 'whoami', input);
+        if (mode === 'status')
+            return mcpStatus(client);
+        return identity(client, ctx);
     },
 };
+async function identity(client, ctx) {
+    const info = await client.whoami();
+    const text = [
+        mdTitle('posterly identity'),
+        mdKeyValue([
+            ['User', info.user.email || code(info.user.id)],
+            ['API scopes', info.api_key.scopes.join(', ') || 'none'],
+            ['Default workspace', `${info.default_workspace.name} (${code(info.default_workspace.id)})`],
+            ['Default timezone', info.default_workspace.timezone || 'n/a'],
+            ['Onboarding', info.onboarding?.completed ? 'complete' : info.onboarding?.next_step_label || 'unknown'],
+        ]),
+        info.onboarding && !info.onboarding.completed
+            ? `**Onboarding next:** ${info.onboarding.next_step_label}. ${info.onboarding.instruction}`
+            : '',
+        mdTable(['Workspace', 'Workspace ID', 'Role', 'Timezone', 'Default'], info.workspaces.map((workspace) => [
+            `${workspace.name}${workspace.is_personal ? ' (personal)' : ''}`,
+            code(workspace.id),
+            workspace.role || 'member',
+            workspace.timezone || 'n/a',
+            workspace.id === info.default_workspace.id,
+        ])),
+        '**Tip:** Pass `workspace_id` to `create_post`, `list_posts`, `list_accounts`, and `find_available_slot` when you want the assistant to stay inside one workspace.',
+    ].filter(Boolean).join('\n\n');
+    // Only when tool sets are filtered, so the default answer is unchanged.
+    const toolsets = ctx.toolsets;
+    if (!toolsets || toolsets.all)
+        return text;
+    return `${text}\n\n**Tool sets:** ${toolsets.enabled.join(', ')} are listed in this connection. Every tool can still be called by name. To list every set, unset POSTERLY_TOOLSETS (or set it to all) and restart the MCP client.`;
+}
+async function mcpStatus(client) {
+    const apiOrigin = client.getBaseUrl();
+    const [latest, apiProbe, authProbe] = await Promise.all([
+        fetchLatestNpmVersion(),
+        probeHostedMcp(apiOrigin),
+        client.hasApiKey() ? client.probeWhoami() : Promise.resolve(null),
+    ]);
+    const updateStatus = describeUpdateStatus(POSTERLY_MCP_VERSION, latest.version, latest.error);
+    const versionMatch = apiProbe.version ? yesNo(apiProbe.version === POSTERLY_MCP_VERSION) : 'unknown';
+    const rows = [
+        ['Connection type', 'local app process (stdio)'],
+        ['Current server version', POSTERLY_MCP_VERSION],
+        ['Latest npm version', latest.version || 'unknown'],
+        ['Update status', updateStatus],
+        ['posterly API origin', code(apiOrigin)],
+        ['MCP endpoint health', formatApiProbe(apiProbe)],
+        ['Hosted MCP version', apiProbe.version || 'unknown'],
+        ['Version match', versionMatch],
+        ['API key configured', client.hasApiKey()],
+        ['API auth check', formatAuthProbe(authProbe)],
+    ];
+    if (authProbe?.ok && authProbe.whoami) {
+        rows.push(['User', authProbe.whoami.user.email || code(authProbe.whoami.user.id)], ['Default workspace', `${authProbe.whoami.default_workspace.name} (${code(authProbe.whoami.default_workspace.id)})`], ['API scopes', authProbe.whoami.api_key.scopes.join(', ') || 'none']);
+    }
+    return [
+        mdTitle('posterly MCP status'),
+        mdKeyValue(rows),
+        latest.error ? `**Latest check:** ${latest.error}` : '',
+        apiProbe.error ? `**MCP endpoint check:** ${apiProbe.error}` : '',
+        authProbe && !authProbe.ok ? `**API auth check:** ${authProbe.error || 'API key validation failed'}` : '',
+        nextStep({ hasApiKey: client.hasApiKey(), updateStatus, apiProbe, authProbe }),
+    ].filter(Boolean).join('\n\n');
+}
+async function probeHostedMcp(apiOrigin) {
+    const startedAt = Date.now();
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 2500);
+    try {
+        const res = await fetch(`${resolvePosterlyBaseUrl(apiOrigin)}/api/mcp`, {
+            headers: { Accept: 'application/json' },
+            signal: controller.signal,
+        });
+        const text = await res.text();
+        const data = parseJson(text);
+        if (!res.ok) {
+            return {
+                ok: false,
+                status: res.status,
+                error: formatError(data, text, res.statusText),
+                durationMs: Date.now() - startedAt,
+            };
+        }
+        const version = typeof data?.serverInfo?.version === 'string' ? data.serverInfo.version : undefined;
+        return {
+            ok: Boolean(version),
+            status: res.status,
+            version,
+            error: version ? undefined : 'Hosted MCP response did not include serverInfo.version',
+            durationMs: Date.now() - startedAt,
+        };
+    }
+    catch (err) {
+        return {
+            ok: false,
+            error: err?.name === 'AbortError' ? 'timed out after 2500ms' : err?.message || String(err),
+            durationMs: Date.now() - startedAt,
+        };
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+async function fetchLatestNpmVersion() {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 2500);
+    try {
+        const res = await fetch(NPM_LATEST_URL, {
+            headers: { Accept: 'application/json' },
+            signal: controller.signal,
+        });
+        if (!res.ok) {
+            return { error: `npm registry returned HTTP ${res.status}` };
+        }
+        const data = await res.json();
+        return typeof data.version === 'string'
+            ? { version: data.version }
+            : { error: 'npm registry response did not include a version' };
+    }
+    catch (err) {
+        const reason = err?.name === 'AbortError' ? 'timed out' : err?.message || String(err);
+        return { error: `could not check npm latest: ${reason}` };
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+function describeUpdateStatus(current, latest, error) {
+    if (!latest)
+        return error ? 'unknown' : 'unknown';
+    const comparison = compareSemver(current, latest);
+    if (comparison < 0) {
+        return `update available: restart the MCP client or run ${code('npx -y posterly-mcp-server@latest')}`;
+    }
+    if (comparison > 0) {
+        return 'running newer than npm latest; npm may not have been published yet';
+    }
+    return 'current';
+}
+function formatApiProbe(probe) {
+    if (probe.ok)
+        return `ok (HTTP ${probe.status}, ${probe.durationMs}ms)`;
+    const status = probe.status ? `HTTP ${probe.status}` : 'network';
+    return `failed (${status}, ${probe.durationMs}ms)`;
+}
+function formatAuthProbe(probe) {
+    if (!probe)
+        return 'skipped (POSTERLY_API_KEY not configured)';
+    if (probe.ok)
+        return `valid (HTTP ${probe.status}, ${probe.durationMs}ms)`;
+    const status = probe.status ? `HTTP ${probe.status}` : 'network';
+    return `failed (${status}, ${probe.durationMs}ms)`;
+}
+function nextStep(input) {
+    const { hasApiKey, updateStatus, apiProbe, authProbe } = input;
+    if (updateStatus.startsWith('update available')) {
+        return '**Next step:** Restart your MCP client so it pulls `posterly-mcp-server@latest`, then call `whoami` with `view: "status"` again.';
+    }
+    if (!apiProbe.ok) {
+        return '**Next step:** Check `POSTERLY_URL` / `POSTERLY_API_BASE_URL`, DNS, and network access to the hosted MCP endpoint, then call `whoami` with `view: "status"` again.';
+    }
+    if (!hasApiKey) {
+        return '**Next step:** Add `POSTERLY_API_KEY` after activating API and MCP access, then call `whoami`.';
+    }
+    if (authProbe && !authProbe.ok) {
+        return '**Next step:** Create or reinstall a valid posterly API key, then restart the MCP client and call `whoami` with `view: "status"` again.';
+    }
+    return '**Next step:** Call `whoami` to confirm the user, workspace, and scopes before scheduling posts.';
+}
+function yesNo(value) {
+    return value ? 'yes' : 'no';
+}
+function parseJson(text) {
+    try {
+        return text ? JSON.parse(text) : {};
+    }
+    catch {
+        return null;
+    }
+}
+function formatError(data, fallback, statusText) {
+    if (data && typeof data === 'object') {
+        return data.error || data.message || data.code || statusText || 'API request failed';
+    }
+    return fallback || statusText || 'API request failed';
+}
+function compareSemver(a, b) {
+    const left = parts(a);
+    const right = parts(b);
+    for (let i = 0; i < 3; i += 1) {
+        if (left[i] !== right[i])
+            return left[i] > right[i] ? 1 : -1;
+    }
+    return 0;
+}
+function parts(value) {
+    const nums = value.split(/[.-]/).slice(0, 3).map((part) => Number.parseInt(part, 10));
+    return [
+        Number.isFinite(nums[0]) ? nums[0] : 0,
+        Number.isFinite(nums[1]) ? nums[1] : 0,
+        Number.isFinite(nums[2]) ? nums[2] : 0,
+    ];
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "posterly-mcp-server",
-  "version": "0.44.0",
+  "version": "0.45.0",
   "mcpName": "io.github.awpthorp/posterly",
   "description": "MCP server for posterly: schedule and publish social media posts across 18 platforms from any MCP client (Claude, ChatGPT, Cursor, Windsurf, Cline, and more)",
   "license": "MIT",
@@ -34,10 +34,12 @@
     "start": "node dist/index.js",
     "prepack": "npm run build && npm --prefix .. run --silent check:mcp-parity",
     "test:annotations": "npm run build && node scripts/test-tool-annotations.mjs",
-    "test:payloads": "npm run build && node scripts/test-payload-builders.mjs"
+    "test:payloads": "npm run build && node scripts/test-payload-builders.mjs",
+    "test:client-header": "npm run build && node scripts/test-client-header-sanitization.mjs",
+    "test:alias-transport": "npm run build && node scripts/test-alias-transport.mjs"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.12.1",
+    "@modelcontextprotocol/sdk": "1.27.1",
     "zod": "^3.24.0"
   },
   "devDependencies": {