posterly-mcp-server 0.45.3 → 0.46.0

package/README.md

@@ -35,6 +35,7 @@ name is `io.github.awpthorp/posterly`, matching this package's `mcpName`.
 - Node.js `20+`
 - No API key is required for the public setup tools: `whoami` with `view: "status"`, `get_agent_signup_info`, `start_signup`, and `get_signup_session`
 - A posterly account, API add-on, and API key are required for authenticated tools like `whoami`, `list_accounts`, `create_connect_session`, and `create_post`
+- A teammate does not need their own add-on when the workspace owner turned on **API and AI access** for them in Team settings: their key then works in that workspace, billed to the owner's plan ([Teammates and API access](https://www.poster.ly/docs/integrations/api#teammates-and-api-access))
 
 ## Install
 
@@ -122,7 +123,7 @@ Add the same server definition to your Cursor MCP settings:
 
 ## Available tools
 
-`posterly-mcp-server@0.45.3` exposes 62 tools covering 94 actions. The hosted HTTP endpoint exposes the same catalog minus the three signup tools: 59 tools covering 91 actions.
+`posterly-mcp-server@0.46.0` exposes 62 tools covering 94 actions. The hosted HTTP endpoint exposes the same catalog minus the three signup tools: 59 tools covering 91 actions.
 
 Many tools pick what to do with one parameter: `view` (reads), `action` (writes), or `type`. A few pick their mode from which parameters you pass (for example `update_post` with `status` changes the status instead of editing). Every tool description names all of its views and actions.
 
@@ -335,7 +336,7 @@ API keys, OAuth clients, webhooks, and workspace members.
 | Action | What it does |
 | --- | --- |
 | `invite` | Invite a colleague (preview then confirm) |
-| `update` | Change role or brands (preview then confirm) |
+| `update` | Change role or brands, or turn a teammate's API and AI access on or off (preview then confirm) |
 | `remove` | Remove a member or invite (preview then confirm) |
 
 **`manage_oauth_client`**: Manage an OAuth client

package/dist/lib/api-client.d.ts

@@ -341,6 +341,14 @@ export type WorkspaceMemberSummary = {
     status: string | null;
     /** [] = every brand; missing = not visible to a brand-limited caller. */
     brand_ids?: string[];
+    /** Can this teammate use the workspace's API and AI app access. Always true for the owner. */
+    api_access?: boolean;
+    /** Owners and admins only: live keys and AI app connections for this workspace. */
+    api_usage?: {
+        key_count: number;
+        last_used_at: string | null;
+        connected_apps: string[];
+    };
     joined_at: string | null;
     created_at: string | null;
 };
@@ -375,6 +383,9 @@ export type WorkspaceMemberPreview = {
     counts_toward_seats: boolean;
     seats_used: number | null;
     seat_limit: number | null;
+    /** action=set_api_access only. */
+    api_access?: boolean;
+    previous_api_access?: boolean | null;
 };
 export type WorkspaceMemberChangeResponse = {
     requires_confirmation?: boolean;
@@ -1097,6 +1108,7 @@ export declare class PosterlyClient {
     }, data: {
         role?: WorkspaceMemberRole;
         brand_ids?: string[];
+        api_access?: boolean;
     } & WorkspaceMemberConfirmFields): Promise<WorkspaceMemberChangeResponse>;
     removeWorkspaceMember(workspaceId: string, target: {
         member_id?: string;
@@ -1256,6 +1268,7 @@ export declare class PosterlyClient {
         quality?: 'low' | 'medium' | 'high';
         thinking_level?: 'minimal' | 'high';
         reference_image_urls?: string[];
+        workspace_id?: string;
     }): Promise<{
         job_id: string;
         status: string;
@@ -1295,6 +1308,7 @@ export declare class PosterlyClient {
         }>;
         generate_audio?: boolean;
         source_video_url?: string;
+        workspace_id?: string;
     }): Promise<Record<string, any>>;
     getVideoJob(params?: {
         job_id?: string;
@@ -1458,7 +1472,7 @@ export declare class PosterlyClient {
     getXPostingQuota(params?: {
         workspace_id?: string;
     }): Promise<XPostingQuotaResponse>;
-    getSignedUploadUrl(filename: string, contentType: string, size: number): Promise<{
+    getSignedUploadUrl(filename: string, contentType: string, size: number, workspaceId?: string): Promise<{
         upload_url: string;
         token: string;
         path: string;
@@ -1468,6 +1482,7 @@ export declare class PosterlyClient {
     createMediaDrop(input?: {
         filename?: string;
         maxFiles?: number;
+        workspaceId?: string;
     }): Promise<{
         session_id: string;
         drop_url: string;
@@ -1497,6 +1512,7 @@ export declare class PosterlyClient {
         base64Data?: string;
         filename: string;
         contentType?: string;
+        workspaceId?: string;
     }): Promise<{
         url: string;
         path: string;
@@ -1505,6 +1521,7 @@ export declare class PosterlyClient {
         url: string;
         filename?: string;
         contentType?: string;
+        workspaceId?: string;
     }): Promise<{
         url: string;
         path: string;

package/dist/lib/api-client.js

@@ -597,17 +597,19 @@ export class PosterlyClient {
         const qs = searchParams.toString();
         return this.request('GET', `/x-posting/quota${qs ? `?${qs}` : ''}`);
     }
-    async getSignedUploadUrl(filename, contentType, size) {
+    async getSignedUploadUrl(filename, contentType, size, workspaceId) {
         return this.request('POST', '/media/signed-upload', {
             filename,
             content_type: contentType,
             size,
+            ...(workspaceId ? { workspace_id: workspaceId } : {}),
         });
     }
     async createMediaDrop(input) {
         return this.request('POST', '/media/drop-sessions', {
             filename: input?.filename,
             max_files: input?.maxFiles,
+            ...(input?.workspaceId ? { workspace_id: input.workspaceId } : {}),
         });
     }
     async listMedia(params) {
@@ -636,7 +638,7 @@ export class PosterlyClient {
         const SIZE_THRESHOLD = 3 * 1024 * 1024; // 3MB
         if (fileBuffer.length > SIZE_THRESHOLD) {
             // Large file: PUT to the object-storage signed URL (not a Vercel relay).
-            const signed = await this.getSignedUploadUrl(input.filename, contentType, fileBuffer.length);
+            const signed = await this.getSignedUploadUrl(input.filename, contentType, fileBuffer.length, input.workspaceId);
             const uploadRes = await fetch(signed.upload_url, {
                 method: 'PUT',
                 headers: {
@@ -657,6 +659,7 @@ export class PosterlyClient {
             filename: input.filename,
             data,
             content_type: contentType,
+            ...(input.workspaceId ? { workspace_id: input.workspaceId } : {}),
         });
     }
     async uploadMediaFromUrl(input) {
@@ -664,6 +667,7 @@ export class PosterlyClient {
             url: input.url,
             filename: input.filename,
             content_type: input.contentType,
+            ...(input.workspaceId ? { workspace_id: input.workspaceId } : {}),
         });
     }
     appendInboxListParams(searchParams, params) {

package/dist/lib/version.d.ts

@@ -1 +1 @@
-export declare const POSTERLY_MCP_VERSION = "0.45.3";
+export declare const POSTERLY_MCP_VERSION = "0.46.0";

package/dist/lib/version.js

@@ -5,4 +5,4 @@
 // tool set (minus the intentional pre-auth signup tools that only this stdio
 // package exposes). `npm run check:mcp-parity` enforces both the version match
 // and the tool-list match, and runs in the pre-commit hook.
-export const POSTERLY_MCP_VERSION = '0.45.3';
+export const POSTERLY_MCP_VERSION = '0.46.0';

package/dist/tools/create-media-drop.d.ts

@@ -6,15 +6,19 @@ export declare const createMediaDropTool: {
     inputSchema: z.ZodObject<{
         filename: z.ZodOptional<z.ZodString>;
         max_files: z.ZodOptional<z.ZodNumber>;
+        workspace_id: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
+        workspace_id?: string | undefined;
         filename?: string | undefined;
         max_files?: number | undefined;
     }, {
+        workspace_id?: string | undefined;
         filename?: string | undefined;
         max_files?: number | undefined;
     }>;
     execute(client: PosterlyClient, input: {
         filename?: string;
         max_files?: number;
+        workspace_id?: string;
     }): Promise<string>;
 };

package/dist/tools/create-media-drop.js

@@ -11,11 +11,13 @@ export const createMediaDropTool = {
             .max(10)
             .optional()
             .describe('How many files the drop can accept. Default 10, max 10.'),
+        workspace_id: z.string().optional().describe('Optional. The workspace this acts in and whose plan pays (from whoami). Needed only when your connection can act in several workspaces.'),
     }),
     async execute(client, input) {
         const drop = await client.createMediaDrop({
             filename: input.filename,
             maxFiles: input.max_files,
+            workspaceId: input.workspace_id,
         });
         return [
             'Media drop created. Send this URL to the user. They open it with no posterly login and drop the file.',

package/dist/tools/create-signed-upload.d.ts

@@ -7,18 +7,22 @@ export declare const createSignedUploadTool: {
         filename: z.ZodString;
         content_type: z.ZodString;
         size: z.ZodNumber;
+        workspace_id: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         filename: string;
         content_type: string;
         size: number;
+        workspace_id?: string | undefined;
     }, {
         filename: string;
         content_type: string;
         size: number;
+        workspace_id?: string | undefined;
     }>;
     execute(client: PosterlyClient, input: {
         filename: string;
         content_type: string;
         size: number;
+        workspace_id?: string;
     }): Promise<string>;
 };

package/dist/tools/create-signed-upload.js

@@ -6,9 +6,10 @@ export const createSignedUploadTool = {
         filename: z.string().describe('Filename with extension, e.g. launch-video.mp4'),
         content_type: z.string().describe('MIME type, e.g. video/mp4'),
         size: z.number().int().positive().describe('File size in bytes'),
+        workspace_id: z.string().optional().describe('Optional. The workspace this acts in and whose plan pays (from whoami). Needed only when your connection can act in several workspaces.'),
     }),
     async execute(client, input) {
-        const signed = await client.getSignedUploadUrl(input.filename, input.content_type, input.size);
+        const signed = await client.getSignedUploadUrl(input.filename, input.content_type, input.size, input.workspace_id);
         return [
             'Signed upload created.',
             `• Upload URL: ${signed.upload_url}`,

package/dist/tools/generate-image.d.ts

@@ -14,10 +14,12 @@ export declare const generateImageTool: {
         quality: z.ZodOptional<z.ZodEnum<["low", "medium", "high"]>>;
         thinking_level: z.ZodOptional<z.ZodEnum<["minimal", "high"]>>;
         reference_image_urls: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        workspace_id: z.ZodOptional<z.ZodString>;
         confirm: z.ZodLiteral<true>;
     }, "strip", z.ZodTypeAny, {
         confirm: true;
         prompt: string;
+        workspace_id?: string | undefined;
         provider?: "google" | "xai" | undefined;
         aspect_ratio?: "1:1" | "16:9" | "9:16" | "4:3" | "3:4" | "3:2" | "2:3" | "4:5" | "1:4" | "1:8" | "21:9" | "4:1" | "8:1" | "5:4" | undefined;
         resolution?: "512" | "1K" | "2K" | "4K" | undefined;
@@ -30,6 +32,7 @@ export declare const generateImageTool: {
     }, {
         confirm: true;
         prompt: string;
+        workspace_id?: string | undefined;
         provider?: "google" | "xai" | undefined;
         aspect_ratio?: "1:1" | "16:9" | "9:16" | "4:3" | "3:4" | "3:2" | "2:3" | "4:5" | "1:4" | "1:8" | "21:9" | "4:1" | "8:1" | "5:4" | undefined;
         resolution?: "512" | "1K" | "2K" | "4K" | undefined;
@@ -51,6 +54,7 @@ export declare const generateImageTool: {
         quality?: "low" | "medium" | "high";
         thinking_level?: "minimal" | "high";
         reference_image_urls?: string[];
+        workspace_id?: string;
         confirm: true;
     }): Promise<string>;
 };

package/dist/tools/generate-image.js

@@ -62,6 +62,7 @@ export const generateImageTool = {
             .max(14)
             .optional()
             .describe('Google only. Up to 14 HTTPS image URLs used as references (logo, product, style lock). Same as dashboard reference images.'),
+        workspace_id: z.string().optional().describe('Optional. The workspace this acts in and whose plan pays (from whoami). Needed only when your connection can act in several workspaces.'),
         confirm: z.literal(true).describe('Must be true after explicit user confirmation of subject, style, aspect ratio, quality, and credit use.'),
     }),
     async execute(client, input) {

package/dist/tools/generate-video.d.ts

@@ -25,10 +25,12 @@ export declare const generateVideoTool: {
         }>, "many">>;
         generate_audio: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
         source_video_url: z.ZodOptional<z.ZodString>;
+        workspace_id: z.ZodOptional<z.ZodString>;
         confirm: z.ZodLiteral<true>;
     }, "strip", z.ZodTypeAny, {
         confirm: true;
         prompt: string;
+        workspace_id?: string | undefined;
         provider?: "google" | "xai" | undefined;
         negative_prompt?: string | undefined;
         aspect_ratio?: "1:1" | "16:9" | "9:16" | "4:3" | "3:4" | "3:2" | "2:3" | undefined;
@@ -46,6 +48,7 @@ export declare const generateVideoTool: {
     }, {
         confirm: true;
         prompt: string;
+        workspace_id?: string | undefined;
         provider?: "google" | "xai" | undefined;
         negative_prompt?: string | undefined;
         aspect_ratio?: "1:1" | "16:9" | "9:16" | "4:3" | "3:4" | "3:2" | "2:3" | undefined;

package/dist/tools/generate-video.js

@@ -18,6 +18,7 @@ export const generateVideoTool = {
         })).max(3).optional(),
         generate_audio: z.boolean().default(true).optional().describe('Google can disable generated audio. xAI Grok includes audio and requires this to remain true.'),
         source_video_url: z.string().url().optional(),
+        workspace_id: z.string().optional().describe('Optional. The workspace this acts in and whose plan pays (from whoami). Needed only when your connection can act in several workspaces.'),
         confirm: z.literal(true).describe('Must be true after explicit user confirmation of prompt, model, duration, resolution, and credit cost.'),
     }),
     async execute(client, input) {

package/dist/tools/list-workspace-members.d.ts

@@ -1,6 +1,16 @@
 import { z } from 'zod';
 import type { PosterlyClient } from '../lib/api-client.js';
 export declare function formatBrandIds(value: string[] | null | undefined): string;
+/** API and AI app access for one member (issue #1170). */
+export declare function formatApiAccess(member: {
+    role?: string | null;
+    api_access?: boolean;
+    api_usage?: {
+        key_count: number;
+        last_used_at: string | null;
+        connected_apps: string[];
+    };
+}): string;
 export declare const listWorkspaceMembersTool: {
     name: string;
     description: string;

package/dist/tools/list-workspace-members.js

@@ -5,19 +5,37 @@ export function formatBrandIds(value) {
         return 'hidden';
     return value.length === 0 ? 'every brand' : value.map((id) => code(id)).join(', ');
 }
+/** API and AI app access for one member (issue #1170). */
+export function formatApiAccess(member) {
+    if (member.api_access === undefined)
+        return '';
+    const base = member.role === 'owner' ? 'owner' : member.api_access ? 'on' : 'off';
+    const usage = member.api_usage;
+    if (!usage)
+        return base;
+    const parts = [];
+    if (usage.key_count > 0)
+        parts.push(`${usage.key_count} key${usage.key_count === 1 ? '' : 's'}`);
+    if (usage.connected_apps.length > 0)
+        parts.push(usage.connected_apps.join(', '));
+    if (usage.last_used_at)
+        parts.push(`last used ${usage.last_used_at}`);
+    return parts.length > 0 ? `${base} (${parts.join('; ')})` : base;
+}
 function formatWorkspaceMembers(result) {
     const members = result.members || [];
     const invites = result.invites || [];
     return [
         mdTitle(`Team (${members.length} members, ${invites.length} pending invites)`, `Workspace ${result.workspace_id}`),
         mdSection('Members', members.length > 0
-            ? mdTable(['Name', 'Member ID', 'Email', 'Role', 'Status', 'Brands'], members.map((member) => [
+            ? mdTable(['Name', 'Member ID', 'Email', 'Role', 'Status', 'Brands', 'API access'], members.map((member) => [
                 member.name || member.email || member.id,
                 code(member.id),
                 member.email,
                 member.role,
                 member.status,
                 formatBrandIds(member.brand_ids),
+                formatApiAccess(member),
             ]))
             : 'No members found.'),
         mdSection('Pending invites', invites.length > 0
@@ -38,7 +56,7 @@ function formatWorkspaceMembers(result) {
 }
 export const listWorkspaceMembersTool = {
     name: 'list_workspace_members',
-    description: 'List the people in a workspace: members (with role, status and brand access) and pending invites, plus seats in use. Needs an API key with the Manage team permission. Any workspace member can list; brand-limited teammates only see brand ids they can access.',
+    description: 'List the people in a workspace: members (with role, status, brand access and API access) and pending invites, plus seats in use. API access says whether a teammate can use this workspace\'s API plan from their own keys and AI apps; owners and admins also see each member\'s key count, connected AI apps and last use. Needs an API key with the Manage team permission. Any workspace member can list; brand-limited teammates only see brand ids they can access.',
     inputSchema: z.object({
         workspace_id: z.string().describe('Workspace ID (from whoami).'),
     }),

package/dist/tools/manage-workspace-member.d.ts

@@ -10,6 +10,7 @@ export type ManageWorkspaceMemberInput = {
     resend?: boolean;
     member_id?: string;
     invite_id?: string;
+    api_access?: boolean;
     confirm?: boolean;
     preview_id?: string;
 };
@@ -27,6 +28,7 @@ export declare const manageWorkspaceMemberTool: {
         resend: z.ZodOptional<z.ZodBoolean>;
         member_id: z.ZodOptional<z.ZodString>;
         invite_id: z.ZodOptional<z.ZodString>;
+        api_access: z.ZodOptional<z.ZodBoolean>;
         confirm: z.ZodOptional<z.ZodBoolean>;
         preview_id: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
@@ -40,6 +42,7 @@ export declare const manageWorkspaceMemberTool: {
         member_id?: string | undefined;
         invite_id?: string | undefined;
         resend?: boolean | undefined;
+        api_access?: boolean | undefined;
     }, {
         workspace_id: string;
         action: "invite" | "update" | "remove";
@@ -51,6 +54,7 @@ export declare const manageWorkspaceMemberTool: {
         member_id?: string | undefined;
         invite_id?: string | undefined;
         resend?: boolean | undefined;
+        api_access?: boolean | undefined;
     }>;
     execute(client: PosterlyClient, input: ManageWorkspaceMemberInput): Promise<string>;
 };

package/dist/tools/manage-workspace-member.js

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { code, mdKeyValue, mdSection, mdTitle } from '../lib/format.js';
-import { formatBrandIds } from './list-workspace-members.js';
+import { formatApiAccess, formatBrandIds } from './list-workspace-members.js';
 const ACTIONS = ['invite', 'update', 'remove'];
 const ROLES = ['publisher', 'editor', 'viewer'];
 const TITLES = {
@@ -28,6 +28,9 @@ function formatChange(result) {
                 ['Seats', preview.counts_toward_seats && preview.seat_limit != null
                         ? `${preview.seats_used} in use of ${preview.seat_limit === -1 ? 'unlimited' : preview.seat_limit}`
                         : ''],
+                ['API access', typeof preview.api_access === 'boolean'
+                        ? `${preview.previous_api_access ? 'on' : 'off'} -> ${preview.api_access ? 'on' : 'off'}`
+                        : ''],
             ])),
             mdSection('Preview ID', `${code(result.preview_id || '')} (expires ${result.preview_expires_at || 'soon'})`),
             mdSection('Next step', 'Show this preview to the user. Only after they explicitly approve, call manage_workspace_member again with the same fields plus confirm: true and this preview_id.'),
@@ -43,6 +46,7 @@ function formatChange(result) {
             ['Role', subject?.role],
             ['Status', subject?.status],
             ['Brands', subject?.brand_ids ? formatBrandIds(subject.brand_ids) : ''],
+            ['API access', result.member ? formatApiAccess(result.member) : ''],
             ['Invite email sent', typeof result.email_sent === 'boolean' ? (result.email_sent ? 'yes' : 'no, ask them to check spam or resend later') : ''],
             ['Workspace owner notified', result.owner_notified ? 'yes' : ''],
         ])),
@@ -69,21 +73,28 @@ export function validateManageWorkspaceMemberInput(input) {
             return 'action=invite needs email and role (publisher, editor or viewer).';
         return null;
     }
-    const notAllowed = input.action === 'update' ? ['email', 'resend'] : ['email', 'resend', 'role', 'brand_ids'];
+    const notAllowed = input.action === 'update' ? ['email', 'resend'] : ['email', 'resend', 'role', 'brand_ids', 'api_access'];
     const extra = notAllowed.filter((key) => has(raw, key));
     if (extra.length)
         return `action=${input.action} does not take ${extra.join(', ')}.`;
     if (has(raw, 'member_id') === has(raw, 'invite_id')) {
         return `action=${input.action} needs exactly one of member_id or invite_id (from list_workspace_members).`;
     }
+    if (input.action === 'update' && has(raw, 'api_access')) {
+        if (has(raw, 'invite_id'))
+            return 'api_access can only be set on a member (member_id), not a pending invite.';
+        if (has(raw, 'role') || has(raw, 'brand_ids'))
+            return 'Change api_access in its own call, without role or brand_ids.';
+        return null;
+    }
     if (input.action === 'update' && !has(raw, 'role') && !has(raw, 'brand_ids')) {
-        return 'action=update needs role, brand_ids, or both.';
+        return 'action=update needs role, brand_ids, or both; or api_access on its own.';
     }
     return null;
 }
 export const manageWorkspaceMemberTool = {
     name: 'manage_workspace_member',
-    description: 'Invite, update, or remove a workspace colleague. This SENDS EMAILS and CHANGES WHO CAN ACCESS the workspace. Needs an API key with the Manage team permission, and the caller must be a workspace owner or admin. ALWAYS preview first: call without confirm, show the returned preview summary to the user, and only call again with confirm: true plus the returned preview_id after the user explicitly approves. action=invite: email and role required (publisher, editor or viewer), optional brand_ids and resend; always sends a pending invite email, never adds anyone instantly. action=update: member_id or invite_id (from list_workspace_members) plus role and/or brand_ids. action=remove: member_id (removes the teammate and revokes their API keys for this workspace) or invite_id (cancels a pending invite). Admin seats can only be granted in the posterly dashboard. The workspace owner is emailed about every change.',
+    description: 'Invite, update, or remove a workspace colleague. This SENDS EMAILS and CHANGES WHO CAN ACCESS the workspace. Needs an API key with the Manage team permission, and the caller must be a workspace owner or admin. ALWAYS preview first: call without confirm, show the returned preview summary to the user, and only call again with confirm: true plus the returned preview_id after the user explicitly approves. action=invite: email and role required (publisher, editor or viewer), optional brand_ids and resend; always sends a pending invite email, never adds anyone instantly. action=update: member_id or invite_id (from list_workspace_members) plus role and/or brand_ids; or member_id plus api_access (true or false, on its own) to turn API and AI app access on or off for that teammate, which lets them use the workspace API plan from their own keys and AI apps (off by default; you cannot change your own; only the owner can change it for an admin; turning it off stops their keys, AI app connections and webhooks for this workspace). action=remove: member_id (removes the teammate and revokes their API keys for this workspace) or invite_id (cancels a pending invite). Admin seats can only be granted in the posterly dashboard. The workspace owner is emailed about every change.',
     inputSchema: z.object({
         action: z.enum(ACTIONS).describe('invite, update, or remove.'),
         workspace_id: z.string().describe('Workspace ID (from whoami).'),
@@ -93,6 +104,7 @@ export const manageWorkspaceMemberTool = {
         resend: z.boolean().optional().describe('action=invite only: email an unchanged pending invite again.'),
         member_id: z.string().optional().describe('action=update or action=remove: a member ID from list_workspace_members.'),
         invite_id: z.string().optional().describe('action=update or action=remove: a pending invite ID from list_workspace_members.'),
+        api_access: z.boolean().optional().describe('action=update with member_id only, on its own: true lets the teammate use this workspace\'s API plan from their own keys and AI apps; false turns it off.'),
         confirm: z.boolean().optional().describe('Leave out to get a preview. Set true only after the user explicitly approved the preview, together with preview_id.'),
         preview_id: z.string().optional().describe('The preview_id returned by the preview call. Required with confirm: true.'),
     }),
@@ -120,6 +132,7 @@ export const manageWorkspaceMemberTool = {
             result = await client.updateWorkspaceMember(workspaceId, target, {
                 ...(input.role !== undefined ? { role: input.role } : {}),
                 ...(input.brand_ids !== undefined ? { brand_ids: input.brand_ids } : {}),
+                ...(input.api_access !== undefined ? { api_access: input.api_access } : {}),
                 ...confirmFields,
             });
         }

package/dist/tools/upload-media.d.ts

@@ -7,6 +7,7 @@ type UploadMediaInput = {
     url?: string;
     filename?: string;
     content_type?: string;
+    workspace_id?: string;
 };
 export declare const uploadMediaTool: {
     name: string;
@@ -17,13 +18,16 @@ export declare const uploadMediaTool: {
         url: z.ZodOptional<z.ZodString>;
         filename: z.ZodOptional<z.ZodString>;
         content_type: z.ZodOptional<z.ZodString>;
+        workspace_id: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
+        workspace_id?: string | undefined;
         filename?: string | undefined;
         url?: string | undefined;
         content_type?: string | undefined;
         file_path?: string | undefined;
         base64_data?: string | undefined;
     }, {
+        workspace_id?: string | undefined;
         filename?: string | undefined;
         url?: string | undefined;
         content_type?: string | undefined;

package/dist/tools/upload-media.js

@@ -27,6 +27,7 @@ export const uploadMediaTool = {
             .string()
             .optional()
             .describe('MIME type (auto-detected from filename if omitted)'),
+        workspace_id: z.string().optional().describe('Optional. The workspace this acts in and whose plan pays (from whoami). Needed only when your connection can act in several workspaces.'),
     }),
     /** The old tools' exact input schemas, for alias calls (see alias-transport.ts). */
     legacySchemas: {
@@ -52,6 +53,7 @@ async function uploadFile(client, input) {
         base64Data: input.base64_data,
         filename: input.filename,
         contentType: input.content_type,
+        workspaceId: input.workspace_id,
     });
     return mdSuccess('Media uploaded', [
         ['URL', result.url],
@@ -63,6 +65,7 @@ async function uploadFromUrl(client, input) {
         url: input.url,
         filename: input.filename,
         contentType: input.content_type,
+        workspaceId: input.workspace_id,
     });
     return [
         'Remote media uploaded successfully.',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "posterly-mcp-server",
-  "version": "0.45.3",
+  "version": "0.46.0",
   "mcpName": "io.github.awpthorp/posterly",
   "description": "MCP server for posterly: schedule and publish social media posts across 18 platforms from any MCP client (Claude, ChatGPT, Cursor, Windsurf, Cline, and more)",
   "license": "MIT",

package/server.json

@@ -3,7 +3,7 @@
   "name": "io.github.awpthorp/posterly",
   "title": "posterly",
   "description": "Validate, schedule, publish, and analyze social content across 18 platforms with posterly.",
-  "version": "0.45.3",
+  "version": "0.46.0",
   "websiteUrl": "https://www.poster.ly/mcp",
   "repository": {
     "url": "https://github.com/awpthorp/posterly",
@@ -14,7 +14,7 @@
     {
       "registryType": "npm",
       "identifier": "posterly-mcp-server",
-      "version": "0.45.3",
+      "version": "0.46.0",
       "transport": {
         "type": "stdio"
       },

package/src/lib/api-client.ts

@@ -390,6 +390,10 @@ export type WorkspaceMemberSummary = {
   status: string | null;
   /** [] = every brand; missing = not visible to a brand-limited caller. */
   brand_ids?: string[];
+  /** Can this teammate use the workspace's API and AI app access. Always true for the owner. */
+  api_access?: boolean;
+  /** Owners and admins only: live keys and AI app connections for this workspace. */
+  api_usage?: { key_count: number; last_used_at: string | null; connected_apps: string[] };
   joined_at: string | null;
   created_at: string | null;
 };
@@ -423,6 +427,9 @@ export type WorkspaceMemberPreview = {
   counts_toward_seats: boolean;
   seats_used: number | null;
   seat_limit: number | null;
+  /** action=set_api_access only. */
+  api_access?: boolean;
+  previous_api_access?: boolean | null;
 };
 
 export type WorkspaceMemberChangeResponse = {
@@ -1333,7 +1340,7 @@ export class PosterlyClient {
   async updateWorkspaceMember(
     workspaceId: string,
     target: { member_id?: string; invite_id?: string },
-    data: { role?: WorkspaceMemberRole; brand_ids?: string[] } & WorkspaceMemberConfirmFields,
+    data: { role?: WorkspaceMemberRole; brand_ids?: string[]; api_access?: boolean } & WorkspaceMemberConfirmFields,
   ): Promise<WorkspaceMemberChangeResponse> {
     const base = `/workspaces/${encodeURIComponent(workspaceId)}`;
     const path = target.member_id
@@ -1640,6 +1647,7 @@ export class PosterlyClient {
     quality?: 'low' | 'medium' | 'high';
     thinking_level?: 'minimal' | 'high';
     reference_image_urls?: string[];
+    workspace_id?: string;
   }): Promise<{
     job_id: string;
     status: string;
@@ -1685,6 +1693,7 @@ export class PosterlyClient {
     reference_images?: Array<{ url: string; type: 'character' | 'object' | 'scene' }>;
     generate_audio?: boolean;
     source_video_url?: string;
+    workspace_id?: string;
   }): Promise<Record<string, any>> {
     return this.request('POST', '/ai/generate-video', data);
   }
@@ -1984,6 +1993,7 @@ export class PosterlyClient {
     filename: string,
     contentType: string,
     size: number,
+    workspaceId?: string,
   ): Promise<{
     upload_url: string;
     token: string;
@@ -1995,12 +2005,14 @@ export class PosterlyClient {
       filename,
       content_type: contentType,
       size,
+      ...(workspaceId ? { workspace_id: workspaceId } : {}),
     });
   }
 
   async createMediaDrop(input?: {
     filename?: string;
     maxFiles?: number;
+    workspaceId?: string;
   }): Promise<{
     session_id: string;
     drop_url: string;
@@ -2012,6 +2024,7 @@ export class PosterlyClient {
     return this.request('POST', '/media/drop-sessions', {
       filename: input?.filename,
       max_files: input?.maxFiles,
+      ...(input?.workspaceId ? { workspace_id: input.workspaceId } : {}),
     });
   }
 
@@ -2043,6 +2056,7 @@ export class PosterlyClient {
     base64Data?: string;
     filename: string;
     contentType?: string;
+    workspaceId?: string;
   }): Promise<{ url: string; path: string }> {
     this.requireApiKey();
 
@@ -2068,6 +2082,7 @@ export class PosterlyClient {
         input.filename,
         contentType,
         fileBuffer.length,
+        input.workspaceId,
       );
 
       const uploadRes = await fetch(signed.upload_url, {
@@ -2094,6 +2109,7 @@ export class PosterlyClient {
       filename: input.filename,
       data,
       content_type: contentType,
+      ...(input.workspaceId ? { workspace_id: input.workspaceId } : {}),
     });
   }
 
@@ -2101,11 +2117,13 @@ export class PosterlyClient {
     url: string;
     filename?: string;
     contentType?: string;
+    workspaceId?: string;
   }): Promise<{ url: string; path: string; source_url: string; content_type: string; size: number }> {
     return this.request('POST', '/media/upload-from-url', {
       url: input.url,
       filename: input.filename,
       content_type: input.contentType,
+      ...(input.workspaceId ? { workspace_id: input.workspaceId } : {}),
     });
   }
 

package/src/lib/version.ts

@@ -5,4 +5,4 @@
 // tool set (minus the intentional pre-auth signup tools that only this stdio
 // package exposes). `npm run check:mcp-parity` enforces both the version match
 // and the tool-list match, and runs in the pre-commit hook.
-export const POSTERLY_MCP_VERSION = '0.45.3';
+export const POSTERLY_MCP_VERSION = '0.46.0';

package/src/tools/create-media-drop.ts

@@ -14,15 +14,17 @@ export const createMediaDropTool = {
       .max(10)
       .optional()
       .describe('How many files the drop can accept. Default 10, max 10.'),
+    workspace_id: z.string().optional().describe('Optional. The workspace this acts in and whose plan pays (from whoami). Needed only when your connection can act in several workspaces.'),
   }),
 
   async execute(
     client: PosterlyClient,
-    input: { filename?: string; max_files?: number },
+    input: { filename?: string; max_files?: number; workspace_id?: string },
   ) {
     const drop = await client.createMediaDrop({
       filename: input.filename,
       maxFiles: input.max_files,
+      workspaceId: input.workspace_id,
     });
     return [
       'Media drop created. Send this URL to the user. They open it with no posterly login and drop the file.',

package/src/tools/create-signed-upload.ts

@@ -9,13 +9,14 @@ export const createSignedUploadTool = {
     filename: z.string().describe('Filename with extension, e.g. launch-video.mp4'),
     content_type: z.string().describe('MIME type, e.g. video/mp4'),
     size: z.number().int().positive().describe('File size in bytes'),
+    workspace_id: z.string().optional().describe('Optional. The workspace this acts in and whose plan pays (from whoami). Needed only when your connection can act in several workspaces.'),
   }),
 
   async execute(
     client: PosterlyClient,
-    input: { filename: string; content_type: string; size: number },
+    input: { filename: string; content_type: string; size: number; workspace_id?: string },
   ) {
-    const signed = await client.getSignedUploadUrl(input.filename, input.content_type, input.size);
+    const signed = await client.getSignedUploadUrl(input.filename, input.content_type, input.size, input.workspace_id);
     return [
       'Signed upload created.',
       `• Upload URL: ${signed.upload_url}`,

package/src/tools/generate-image.ts

@@ -65,6 +65,7 @@ export const generateImageTool = {
       .max(14)
       .optional()
       .describe('Google only. Up to 14 HTTPS image URLs used as references (logo, product, style lock). Same as dashboard reference images.'),
+    workspace_id: z.string().optional().describe('Optional. The workspace this acts in and whose plan pays (from whoami). Needed only when your connection can act in several workspaces.'),
     confirm: z.literal(true).describe('Must be true after explicit user confirmation of subject, style, aspect ratio, quality, and credit use.'),
   }),
 
@@ -81,6 +82,7 @@ export const generateImageTool = {
       quality?: 'low' | 'medium' | 'high';
       thinking_level?: 'minimal' | 'high';
       reference_image_urls?: string[];
+      workspace_id?: string;
       confirm: true;
     }
   ) {

package/src/tools/generate-video.ts

@@ -21,6 +21,7 @@ export const generateVideoTool = {
     })).max(3).optional(),
     generate_audio: z.boolean().default(true).optional().describe('Google can disable generated audio. xAI Grok includes audio and requires this to remain true.'),
     source_video_url: z.string().url().optional(),
+    workspace_id: z.string().optional().describe('Optional. The workspace this acts in and whose plan pays (from whoami). Needed only when your connection can act in several workspaces.'),
     confirm: z.literal(true).describe('Must be true after explicit user confirmation of prompt, model, duration, resolution, and credit cost.'),
   }),
 

package/src/tools/list-workspace-members.ts

@@ -7,6 +7,19 @@ export function formatBrandIds(value: string[] | null | undefined): string {
   return value.length === 0 ? 'every brand' : value.map((id) => code(id)).join(', ');
 }
 
+/** API and AI app access for one member (issue #1170). */
+export function formatApiAccess(member: { role?: string | null; api_access?: boolean; api_usage?: { key_count: number; last_used_at: string | null; connected_apps: string[] } }): string {
+  if (member.api_access === undefined) return '';
+  const base = member.role === 'owner' ? 'owner' : member.api_access ? 'on' : 'off';
+  const usage = member.api_usage;
+  if (!usage) return base;
+  const parts: string[] = [];
+  if (usage.key_count > 0) parts.push(`${usage.key_count} key${usage.key_count === 1 ? '' : 's'}`);
+  if (usage.connected_apps.length > 0) parts.push(usage.connected_apps.join(', '));
+  if (usage.last_used_at) parts.push(`last used ${usage.last_used_at}`);
+  return parts.length > 0 ? `${base} (${parts.join('; ')})` : base;
+}
+
 function formatWorkspaceMembers(result: WorkspaceMembersResponse): string {
   const members = result.members || [];
   const invites = result.invites || [];
@@ -14,7 +27,7 @@ function formatWorkspaceMembers(result: WorkspaceMembersResponse): string {
     mdTitle(`Team (${members.length} members, ${invites.length} pending invites)`, `Workspace ${result.workspace_id}`),
     mdSection('Members', members.length > 0
       ? mdTable(
-          ['Name', 'Member ID', 'Email', 'Role', 'Status', 'Brands'],
+          ['Name', 'Member ID', 'Email', 'Role', 'Status', 'Brands', 'API access'],
           members.map((member) => [
             member.name || member.email || member.id,
             code(member.id),
@@ -22,6 +35,7 @@ function formatWorkspaceMembers(result: WorkspaceMembersResponse): string {
             member.role,
             member.status,
             formatBrandIds(member.brand_ids),
+            formatApiAccess(member),
           ]),
         )
       : 'No members found.'),
@@ -48,7 +62,7 @@ function formatWorkspaceMembers(result: WorkspaceMembersResponse): string {
 export const listWorkspaceMembersTool = {
   name: 'list_workspace_members',
   description:
-    'List the people in a workspace: members (with role, status and brand access) and pending invites, plus seats in use. Needs an API key with the Manage team permission. Any workspace member can list; brand-limited teammates only see brand ids they can access.',
+    'List the people in a workspace: members (with role, status, brand access and API access) and pending invites, plus seats in use. API access says whether a teammate can use this workspace\'s API plan from their own keys and AI apps; owners and admins also see each member\'s key count, connected AI apps and last use. Needs an API key with the Manage team permission. Any workspace member can list; brand-limited teammates only see brand ids they can access.',
   inputSchema: z.object({
     workspace_id: z.string().describe('Workspace ID (from whoami).'),
   }),

package/src/tools/manage-workspace-member.ts

@@ -5,7 +5,7 @@ import type {
   WorkspaceMemberRole,
 } from '../lib/api-client.js';
 import { code, mdKeyValue, mdSection, mdTitle } from '../lib/format.js';
-import { formatBrandIds } from './list-workspace-members.js';
+import { formatApiAccess, formatBrandIds } from './list-workspace-members.js';
 
 const ACTIONS = ['invite', 'update', 'remove'] as const;
 const ROLES = ['publisher', 'editor', 'viewer'] as const;
@@ -19,6 +19,7 @@ export type ManageWorkspaceMemberInput = {
   resend?: boolean;
   member_id?: string;
   invite_id?: string;
+  api_access?: boolean;
   confirm?: boolean;
   preview_id?: string;
 };
@@ -49,6 +50,9 @@ function formatChange(result: WorkspaceMemberChangeResponse): string {
         ['Seats', preview.counts_toward_seats && preview.seat_limit != null
           ? `${preview.seats_used} in use of ${preview.seat_limit === -1 ? 'unlimited' : preview.seat_limit}`
           : ''],
+        ['API access', typeof preview.api_access === 'boolean'
+          ? `${preview.previous_api_access ? 'on' : 'off'} -> ${preview.api_access ? 'on' : 'off'}`
+          : ''],
       ])),
       mdSection('Preview ID', `${code(result.preview_id || '')} (expires ${result.preview_expires_at || 'soon'})`),
       mdSection('Next step', 'Show this preview to the user. Only after they explicitly approve, call manage_workspace_member again with the same fields plus confirm: true and this preview_id.'),
@@ -64,6 +68,7 @@ function formatChange(result: WorkspaceMemberChangeResponse): string {
       ['Role', subject?.role],
       ['Status', subject?.status],
       ['Brands', subject?.brand_ids ? formatBrandIds(subject.brand_ids) : ''],
+      ['API access', result.member ? formatApiAccess(result.member) : ''],
       ['Invite email sent', typeof result.email_sent === 'boolean' ? (result.email_sent ? 'yes' : 'no, ask them to check spam or resend later') : ''],
       ['Workspace owner notified', result.owner_notified ? 'yes' : ''],
     ])),
@@ -88,14 +93,19 @@ export function validateManageWorkspaceMemberInput(input: ManageWorkspaceMemberI
     if (!has(raw, 'email') || !has(raw, 'role')) return 'action=invite needs email and role (publisher, editor or viewer).';
     return null;
   }
-  const notAllowed = input.action === 'update' ? ['email', 'resend'] : ['email', 'resend', 'role', 'brand_ids'];
+  const notAllowed = input.action === 'update' ? ['email', 'resend'] : ['email', 'resend', 'role', 'brand_ids', 'api_access'];
   const extra = notAllowed.filter((key) => has(raw, key));
   if (extra.length) return `action=${input.action} does not take ${extra.join(', ')}.`;
   if (has(raw, 'member_id') === has(raw, 'invite_id')) {
     return `action=${input.action} needs exactly one of member_id or invite_id (from list_workspace_members).`;
   }
+  if (input.action === 'update' && has(raw, 'api_access')) {
+    if (has(raw, 'invite_id')) return 'api_access can only be set on a member (member_id), not a pending invite.';
+    if (has(raw, 'role') || has(raw, 'brand_ids')) return 'Change api_access in its own call, without role or brand_ids.';
+    return null;
+  }
   if (input.action === 'update' && !has(raw, 'role') && !has(raw, 'brand_ids')) {
-    return 'action=update needs role, brand_ids, or both.';
+    return 'action=update needs role, brand_ids, or both; or api_access on its own.';
   }
   return null;
 }
@@ -103,7 +113,7 @@ export function validateManageWorkspaceMemberInput(input: ManageWorkspaceMemberI
 export const manageWorkspaceMemberTool = {
   name: 'manage_workspace_member',
   description:
-    'Invite, update, or remove a workspace colleague. This SENDS EMAILS and CHANGES WHO CAN ACCESS the workspace. Needs an API key with the Manage team permission, and the caller must be a workspace owner or admin. ALWAYS preview first: call without confirm, show the returned preview summary to the user, and only call again with confirm: true plus the returned preview_id after the user explicitly approves. action=invite: email and role required (publisher, editor or viewer), optional brand_ids and resend; always sends a pending invite email, never adds anyone instantly. action=update: member_id or invite_id (from list_workspace_members) plus role and/or brand_ids. action=remove: member_id (removes the teammate and revokes their API keys for this workspace) or invite_id (cancels a pending invite). Admin seats can only be granted in the posterly dashboard. The workspace owner is emailed about every change.',
+    'Invite, update, or remove a workspace colleague. This SENDS EMAILS and CHANGES WHO CAN ACCESS the workspace. Needs an API key with the Manage team permission, and the caller must be a workspace owner or admin. ALWAYS preview first: call without confirm, show the returned preview summary to the user, and only call again with confirm: true plus the returned preview_id after the user explicitly approves. action=invite: email and role required (publisher, editor or viewer), optional brand_ids and resend; always sends a pending invite email, never adds anyone instantly. action=update: member_id or invite_id (from list_workspace_members) plus role and/or brand_ids; or member_id plus api_access (true or false, on its own) to turn API and AI app access on or off for that teammate, which lets them use the workspace API plan from their own keys and AI apps (off by default; you cannot change your own; only the owner can change it for an admin; turning it off stops their keys, AI app connections and webhooks for this workspace). action=remove: member_id (removes the teammate and revokes their API keys for this workspace) or invite_id (cancels a pending invite). Admin seats can only be granted in the posterly dashboard. The workspace owner is emailed about every change.',
   inputSchema: z.object({
     action: z.enum(ACTIONS).describe('invite, update, or remove.'),
     workspace_id: z.string().describe('Workspace ID (from whoami).'),
@@ -113,6 +123,7 @@ export const manageWorkspaceMemberTool = {
     resend: z.boolean().optional().describe('action=invite only: email an unchanged pending invite again.'),
     member_id: z.string().optional().describe('action=update or action=remove: a member ID from list_workspace_members.'),
     invite_id: z.string().optional().describe('action=update or action=remove: a pending invite ID from list_workspace_members.'),
+    api_access: z.boolean().optional().describe('action=update with member_id only, on its own: true lets the teammate use this workspace\'s API plan from their own keys and AI apps; false turns it off.'),
     confirm: z.boolean().optional().describe('Leave out to get a preview. Set true only after the user explicitly approved the preview, together with preview_id.'),
     preview_id: z.string().optional().describe('The preview_id returned by the preview call. Required with confirm: true.'),
   }),
@@ -141,6 +152,7 @@ export const manageWorkspaceMemberTool = {
       result = await client.updateWorkspaceMember(workspaceId, target, {
         ...(input.role !== undefined ? { role: input.role } : {}),
         ...(input.brand_ids !== undefined ? { brand_ids: input.brand_ids } : {}),
+        ...(input.api_access !== undefined ? { api_access: input.api_access } : {}),
         ...confirmFields,
       });
     } else {

package/src/tools/upload-media.ts

@@ -9,6 +9,7 @@ type UploadMediaInput = {
   url?: string;
   filename?: string;
   content_type?: string;
+  workspace_id?: string;
 };
 
 export const uploadMediaTool = {
@@ -38,6 +39,7 @@ export const uploadMediaTool = {
       .string()
       .optional()
       .describe('MIME type (auto-detected from filename if omitted)'),
+    workspace_id: z.string().optional().describe('Optional. The workspace this acts in and whose plan pays (from whoami). Needed only when your connection can act in several workspaces.'),
   }),
   /** The old tools' exact input schemas, for alias calls (see alias-transport.ts). */
   legacySchemas: {
@@ -50,7 +52,7 @@ export const uploadMediaTool = {
 
   async execute(client: PosterlyClient, input: UploadMediaInput, ctx: ToolContext) {
     const { mode, args } = validateArgs(ctx, 'upload_media', input);
-    if (mode === 'url') return uploadFromUrl(client, args as { url: string; filename?: string; content_type?: string });
+    if (mode === 'url') return uploadFromUrl(client, args as { url: string; filename?: string; content_type?: string; workspace_id?: string });
     return uploadFile(client, args as UploadMediaInput & { filename: string });
   },
 };
@@ -62,6 +64,7 @@ async function uploadFile(
     base64_data?: string;
     filename: string;
     content_type?: string;
+    workspace_id?: string;
   },
 ): Promise<string> {
   if (!input.file_path && !input.base64_data) {
@@ -73,6 +76,7 @@ async function uploadFile(
     base64Data: input.base64_data,
     filename: input.filename,
     contentType: input.content_type,
+    workspaceId: input.workspace_id,
   });
 
   return mdSuccess('Media uploaded', [
@@ -83,12 +87,13 @@ async function uploadFile(
 
 async function uploadFromUrl(
   client: PosterlyClient,
-  input: { url: string; filename?: string; content_type?: string },
+  input: { url: string; filename?: string; content_type?: string; workspace_id?: string },
 ): Promise<string> {
   const result = await client.uploadMediaFromUrl({
     url: input.url,
     filename: input.filename,
     contentType: input.content_type,
+    workspaceId: input.workspace_id,
   });
   return [
     'Remote media uploaded successfully.',

package/tool-registry.json

@@ -823,6 +823,9 @@
             },
             "content_type": {
               "type": "string"
+            },
+            "workspace_id": {
+              "type": "string"
             }
           }
         },
@@ -845,6 +848,9 @@
             },
             "content_type": {
               "type": "string"
+            },
+            "workspace_id": {
+              "type": "string"
             }
           }
         }