posterly-mcp-server 0.45.3 → 0.47.0

package/dist/tools/list-posts.js

@@ -3,7 +3,7 @@ import { dashboardUrlForPostList, formatLocalDateTime, truncateText } from '../l
 import { SUPPORTED_PLATFORM_INPUTS, SUPPORTED_PLATFORM_IDS } from '../generated/platform-manifest.js';
 export const listPostsTool = {
     name: 'list_posts',
-    description: 'List upcoming or recent posts. Filter by status (scheduled, published, failed, draft), platform, account_id, workspace_id, approval_status, or brand_id. Returns posts in your workspaces, teammates\' too, per your role there (brand-locked seats only see their assigned brands). If workspace_id is omitted, this searches every workspace you belong to.',
+    description: 'List upcoming or recent posts. Filter by status (scheduled, published, failed, draft), platform, account_id, workspace_id, approval_status, approval_waiting_on, or brand_id. approval_waiting_on=client is the same queue as approval_status=pending_client. Each post includes approval.pending_client_approval. Returns posts in your workspaces, teammates\' too, per your role there (brand-locked seats only see their assigned brands). If workspace_id is omitted, this searches every workspace you belong to.',
     inputSchema: z.object({
         status: z
             .string()
@@ -31,6 +31,10 @@ export const listPostsTool = {
             .enum(['none', 'pending_client', 'approved', 'changes_requested', 'rejected'])
             .optional()
             .describe('Filter by client review approval status. pending_client means the post is waiting on the client.'),
+        approval_waiting_on: z
+            .enum(['client', 'team'])
+            .optional()
+            .describe('client: approval_status pending_client. team: changes_requested or rejected. Conflicts with a non-overlapping approval_status.'),
         brand_id: z
             .string()
             .optional()

package/dist/tools/list-workspace-members.d.ts

@@ -1,6 +1,16 @@
 import { z } from 'zod';
 import type { PosterlyClient } from '../lib/api-client.js';
 export declare function formatBrandIds(value: string[] | null | undefined): string;
+/** API and AI app access for one member (issue #1170). */
+export declare function formatApiAccess(member: {
+    role?: string | null;
+    api_access?: boolean;
+    api_usage?: {
+        key_count: number;
+        last_used_at: string | null;
+        connected_apps: string[];
+    };
+}): string;
 export declare const listWorkspaceMembersTool: {
     name: string;
     description: string;

package/dist/tools/list-workspace-members.js

@@ -5,19 +5,37 @@ export function formatBrandIds(value) {
         return 'hidden';
     return value.length === 0 ? 'every brand' : value.map((id) => code(id)).join(', ');
 }
+/** API and AI app access for one member (issue #1170). */
+export function formatApiAccess(member) {
+    if (member.api_access === undefined)
+        return '';
+    const base = member.role === 'owner' ? 'owner' : member.api_access ? 'on' : 'off';
+    const usage = member.api_usage;
+    if (!usage)
+        return base;
+    const parts = [];
+    if (usage.key_count > 0)
+        parts.push(`${usage.key_count} key${usage.key_count === 1 ? '' : 's'}`);
+    if (usage.connected_apps.length > 0)
+        parts.push(usage.connected_apps.join(', '));
+    if (usage.last_used_at)
+        parts.push(`last used ${usage.last_used_at}`);
+    return parts.length > 0 ? `${base} (${parts.join('; ')})` : base;
+}
 function formatWorkspaceMembers(result) {
     const members = result.members || [];
     const invites = result.invites || [];
     return [
         mdTitle(`Team (${members.length} members, ${invites.length} pending invites)`, `Workspace ${result.workspace_id}`),
         mdSection('Members', members.length > 0
-            ? mdTable(['Name', 'Member ID', 'Email', 'Role', 'Status', 'Brands'], members.map((member) => [
+            ? mdTable(['Name', 'Member ID', 'Email', 'Role', 'Status', 'Brands', 'API access'], members.map((member) => [
                 member.name || member.email || member.id,
                 code(member.id),
                 member.email,
                 member.role,
                 member.status,
                 formatBrandIds(member.brand_ids),
+                formatApiAccess(member),
             ]))
             : 'No members found.'),
         mdSection('Pending invites', invites.length > 0
@@ -38,7 +56,7 @@ function formatWorkspaceMembers(result) {
 }
 export const listWorkspaceMembersTool = {
     name: 'list_workspace_members',
-    description: 'List the people in a workspace: members (with role, status and brand access) and pending invites, plus seats in use. Needs an API key with the Manage team permission. Any workspace member can list; brand-limited teammates only see brand ids they can access.',
+    description: 'List the people in a workspace: members (with role, status, brand access and API access) and pending invites, plus seats in use. API access says whether a teammate can use this workspace\'s API plan from their own keys and AI apps; owners and admins also see each member\'s key count, connected AI apps and last use. Needs an API key with the Manage team permission. Any workspace member can list; brand-limited teammates only see brand ids they can access.',
     inputSchema: z.object({
         workspace_id: z.string().describe('Workspace ID (from whoami).'),
     }),

package/dist/tools/manage-workspace-member.d.ts

@@ -10,6 +10,7 @@ export type ManageWorkspaceMemberInput = {
     resend?: boolean;
     member_id?: string;
     invite_id?: string;
+    api_access?: boolean;
     confirm?: boolean;
     preview_id?: string;
 };
@@ -27,6 +28,7 @@ export declare const manageWorkspaceMemberTool: {
         resend: z.ZodOptional<z.ZodBoolean>;
         member_id: z.ZodOptional<z.ZodString>;
         invite_id: z.ZodOptional<z.ZodString>;
+        api_access: z.ZodOptional<z.ZodBoolean>;
         confirm: z.ZodOptional<z.ZodBoolean>;
         preview_id: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
@@ -40,6 +42,7 @@ export declare const manageWorkspaceMemberTool: {
         member_id?: string | undefined;
         invite_id?: string | undefined;
         resend?: boolean | undefined;
+        api_access?: boolean | undefined;
     }, {
         workspace_id: string;
         action: "invite" | "update" | "remove";
@@ -51,6 +54,7 @@ export declare const manageWorkspaceMemberTool: {
         member_id?: string | undefined;
         invite_id?: string | undefined;
         resend?: boolean | undefined;
+        api_access?: boolean | undefined;
     }>;
     execute(client: PosterlyClient, input: ManageWorkspaceMemberInput): Promise<string>;
 };

package/dist/tools/manage-workspace-member.js

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { code, mdKeyValue, mdSection, mdTitle } from '../lib/format.js';
-import { formatBrandIds } from './list-workspace-members.js';
+import { formatApiAccess, formatBrandIds } from './list-workspace-members.js';
 const ACTIONS = ['invite', 'update', 'remove'];
 const ROLES = ['publisher', 'editor', 'viewer'];
 const TITLES = {
@@ -28,6 +28,9 @@ function formatChange(result) {
                 ['Seats', preview.counts_toward_seats && preview.seat_limit != null
                         ? `${preview.seats_used} in use of ${preview.seat_limit === -1 ? 'unlimited' : preview.seat_limit}`
                         : ''],
+                ['API access', typeof preview.api_access === 'boolean'
+                        ? `${preview.previous_api_access ? 'on' : 'off'} -> ${preview.api_access ? 'on' : 'off'}`
+                        : ''],
             ])),
             mdSection('Preview ID', `${code(result.preview_id || '')} (expires ${result.preview_expires_at || 'soon'})`),
             mdSection('Next step', 'Show this preview to the user. Only after they explicitly approve, call manage_workspace_member again with the same fields plus confirm: true and this preview_id.'),
@@ -43,6 +46,7 @@ function formatChange(result) {
             ['Role', subject?.role],
             ['Status', subject?.status],
             ['Brands', subject?.brand_ids ? formatBrandIds(subject.brand_ids) : ''],
+            ['API access', result.member ? formatApiAccess(result.member) : ''],
             ['Invite email sent', typeof result.email_sent === 'boolean' ? (result.email_sent ? 'yes' : 'no, ask them to check spam or resend later') : ''],
             ['Workspace owner notified', result.owner_notified ? 'yes' : ''],
         ])),
@@ -69,21 +73,28 @@ export function validateManageWorkspaceMemberInput(input) {
             return 'action=invite needs email and role (publisher, editor or viewer).';
         return null;
     }
-    const notAllowed = input.action === 'update' ? ['email', 'resend'] : ['email', 'resend', 'role', 'brand_ids'];
+    const notAllowed = input.action === 'update' ? ['email', 'resend'] : ['email', 'resend', 'role', 'brand_ids', 'api_access'];
     const extra = notAllowed.filter((key) => has(raw, key));
     if (extra.length)
         return `action=${input.action} does not take ${extra.join(', ')}.`;
     if (has(raw, 'member_id') === has(raw, 'invite_id')) {
         return `action=${input.action} needs exactly one of member_id or invite_id (from list_workspace_members).`;
     }
+    if (input.action === 'update' && has(raw, 'api_access')) {
+        if (has(raw, 'invite_id'))
+            return 'api_access can only be set on a member (member_id), not a pending invite.';
+        if (has(raw, 'role') || has(raw, 'brand_ids'))
+            return 'Change api_access in its own call, without role or brand_ids.';
+        return null;
+    }
     if (input.action === 'update' && !has(raw, 'role') && !has(raw, 'brand_ids')) {
-        return 'action=update needs role, brand_ids, or both.';
+        return 'action=update needs role, brand_ids, or both; or api_access on its own.';
     }
     return null;
 }
 export const manageWorkspaceMemberTool = {
     name: 'manage_workspace_member',
-    description: 'Invite, update, or remove a workspace colleague. This SENDS EMAILS and CHANGES WHO CAN ACCESS the workspace. Needs an API key with the Manage team permission, and the caller must be a workspace owner or admin. ALWAYS preview first: call without confirm, show the returned preview summary to the user, and only call again with confirm: true plus the returned preview_id after the user explicitly approves. action=invite: email and role required (publisher, editor or viewer), optional brand_ids and resend; always sends a pending invite email, never adds anyone instantly. action=update: member_id or invite_id (from list_workspace_members) plus role and/or brand_ids. action=remove: member_id (removes the teammate and revokes their API keys for this workspace) or invite_id (cancels a pending invite). Admin seats can only be granted in the posterly dashboard. The workspace owner is emailed about every change.',
+    description: 'Invite, update, or remove a workspace colleague. This SENDS EMAILS and CHANGES WHO CAN ACCESS the workspace. Needs an API key with the Manage team permission, and the caller must be a workspace owner or admin. ALWAYS preview first: call without confirm, show the returned preview summary to the user, and only call again with confirm: true plus the returned preview_id after the user explicitly approves. action=invite: email and role required (publisher, editor or viewer), optional brand_ids and resend; always sends a pending invite email, never adds anyone instantly. action=update: member_id or invite_id (from list_workspace_members) plus role and/or brand_ids; or member_id plus api_access (true or false, on its own) to turn API and AI app access on or off for that teammate, which lets them use the workspace API plan from their own keys and AI apps (off by default; you cannot change your own; only the owner can change it for an admin; turning it off stops their keys, AI app connections and webhooks for this workspace). action=remove: member_id (removes the teammate and revokes their API keys for this workspace) or invite_id (cancels a pending invite). Admin seats can only be granted in the posterly dashboard. The workspace owner is emailed about every change.',
     inputSchema: z.object({
         action: z.enum(ACTIONS).describe('invite, update, or remove.'),
         workspace_id: z.string().describe('Workspace ID (from whoami).'),
@@ -93,6 +104,7 @@ export const manageWorkspaceMemberTool = {
         resend: z.boolean().optional().describe('action=invite only: email an unchanged pending invite again.'),
         member_id: z.string().optional().describe('action=update or action=remove: a member ID from list_workspace_members.'),
         invite_id: z.string().optional().describe('action=update or action=remove: a pending invite ID from list_workspace_members.'),
+        api_access: z.boolean().optional().describe('action=update with member_id only, on its own: true lets the teammate use this workspace\'s API plan from their own keys and AI apps; false turns it off.'),
         confirm: z.boolean().optional().describe('Leave out to get a preview. Set true only after the user explicitly approved the preview, together with preview_id.'),
         preview_id: z.string().optional().describe('The preview_id returned by the preview call. Required with confirm: true.'),
     }),
@@ -120,6 +132,7 @@ export const manageWorkspaceMemberTool = {
             result = await client.updateWorkspaceMember(workspaceId, target, {
                 ...(input.role !== undefined ? { role: input.role } : {}),
                 ...(input.brand_ids !== undefined ? { brand_ids: input.brand_ids } : {}),
+                ...(input.api_access !== undefined ? { api_access: input.api_access } : {}),
                 ...confirmFields,
             });
         }

package/dist/tools/update-post.d.ts

@@ -497,6 +497,9 @@ type UpdatePostInput = EditInput & {
     status?: 'scheduled' | 'paused' | 'draft';
     release_id?: string;
     group_id?: string;
+    approval_action?: 'request' | 'approve' | 'request_changes' | 'reject';
+    approval_axis?: 'asset' | 'caption';
+    approval_note?: string;
 };
 export declare const updatePostTool: {
     name: string;
@@ -995,11 +998,15 @@ export declare const updatePostTool: {
         status: z.ZodOptional<z.ZodEnum<["scheduled", "paused", "draft"]>>;
         release_id: z.ZodOptional<z.ZodString>;
         group_id: z.ZodOptional<z.ZodString>;
+        approval_action: z.ZodOptional<z.ZodEnum<["request", "approve", "request_changes", "reject"]>>;
+        approval_axis: z.ZodOptional<z.ZodEnum<["asset", "caption"]>>;
+        approval_note: z.ZodOptional<z.ZodString>;
         confirm: z.ZodLiteral<true>;
     }, "strip", z.ZodTypeAny, {
         confirm: true;
         post_id: number;
         status?: "scheduled" | "paused" | "draft" | undefined;
+        caption?: string | undefined;
         scheduled_at?: string | undefined;
         media_url?: string | undefined;
         media_urls?: string[] | undefined;
@@ -1007,7 +1014,6 @@ export declare const updatePostTool: {
         reel_cover_url?: string | undefined;
         reel_cover_method?: string | undefined;
         reel_thumb_offset?: number | undefined;
-        caption?: string | undefined;
         instagram_settings?: {
             post_type?: "post" | "feed" | "story" | "reel" | "carousel" | undefined;
             reel_cover_url?: string | undefined;
@@ -1163,10 +1169,14 @@ export declare const updatePostTool: {
         }, z.ZodTypeAny, "passthrough"> | undefined;
         release_id?: string | undefined;
         group_id?: string | undefined;
+        approval_action?: "request" | "approve" | "request_changes" | "reject" | undefined;
+        approval_axis?: "asset" | "caption" | undefined;
+        approval_note?: string | undefined;
     }, {
         confirm: true;
         post_id: number;
         status?: "scheduled" | "paused" | "draft" | undefined;
+        caption?: string | undefined;
         scheduled_at?: string | undefined;
         media_url?: string | undefined;
         media_urls?: string[] | undefined;
@@ -1174,7 +1184,6 @@ export declare const updatePostTool: {
         reel_cover_url?: string | undefined;
         reel_cover_method?: string | undefined;
         reel_thumb_offset?: number | undefined;
-        caption?: string | undefined;
         instagram_settings?: {
             post_type?: "post" | "feed" | "story" | "reel" | "carousel" | undefined;
             reel_cover_url?: string | undefined;
@@ -1330,6 +1339,9 @@ export declare const updatePostTool: {
         }, z.ZodTypeAny, "passthrough"> | undefined;
         release_id?: string | undefined;
         group_id?: string | undefined;
+        approval_action?: "request" | "approve" | "request_changes" | "reject" | undefined;
+        approval_axis?: "asset" | "caption" | undefined;
+        approval_note?: string | undefined;
     }>;
     /** The old tools' exact input schemas, for alias calls (see alias-transport.ts). */
     legacySchemas: {

package/dist/tools/update-post.js

@@ -108,7 +108,7 @@ const platformSettingsSchema = z.object({
 }).passthrough();
 export const updatePostTool = {
     name: 'update_post',
-    description: 'Change a scheduled or draft post. DESTRUCTIVE WRITE. Edit (default): caption, media, schedule, post_type, or settings; overwrites the existing post; cannot edit published or currently publishing posts; if a client has already approved the post, a caption edit reopens caption approval, a media or thumbnail edit reopens asset approval, and a reschedule, account change or settings change reopens both. status (scheduled, paused, or draft, with scheduled_at when scheduling a draft): pause, resume, or move back to draft; send it on its own. release_id (with optional group_id): set or repair external release/group IDs; send it on its own.\n\n' +
+    description: 'Change a scheduled or draft post. DESTRUCTIVE WRITE. Edit (default): caption, media, schedule, post_type, or settings; overwrites the existing post; cannot edit published or currently publishing posts; if a client has already approved the post, a caption edit reopens caption approval, a media or thumbnail edit reopens asset approval, and a reschedule, account change or settings change reopens both. status (scheduled, paused, or draft, with scheduled_at when scheduling a draft): pause, resume, or move back to draft; send it on its own. release_id (with optional group_id): set or repair external release/group IDs; send it on its own. approval_action (request, approve, request_changes, or reject): change client approval. Only a workspace owner or admin may do this. The actor is the API key user, never a brand guest. request emails the brand reviewers. approve, request_changes, and reject are team-side decisions. request_changes needs approval_note. Optional approval_axis is asset or caption; omit it for both. Send approval_action on its own.\n\n' +
         'REQUIRED BEFORE CALLING: Show the user a side-by-side of the CURRENT post (caption, scheduled time, media, status) and the PROPOSED change, and get explicit confirmation ("yes update it", "apply those changes") before calling. Do not auto-edit posts based on a general instruction - each change needs its own confirmation.',
     inputSchema: z.object({
         post_id: z.number().describe('The post ID to update'),
@@ -146,6 +146,18 @@ export const updatePostTool = {
             .optional()
             .describe('Set an external release ID instead of editing the post. Send with post_id and optional group_id only.'),
         group_id: z.string().min(1).max(160).optional().describe('With release_id only: an external group/campaign ID.'),
+        approval_action: z
+            .enum(['request', 'approve', 'request_changes', 'reject'])
+            .optional()
+            .describe('Change client approval instead of editing the post. Owner or admin only. The actor is the API key user, never a brand guest. Send on its own.'),
+        approval_axis: z
+            .enum(['asset', 'caption'])
+            .optional()
+            .describe('With approval_action approve, request_changes, or reject: which axis to decide. Omit for both. Not allowed with request.'),
+        approval_note: z
+            .string()
+            .optional()
+            .describe('Note stored with the approval change. Required for request_changes.'),
         confirm: z.literal(true).describe('Must be true after explicit user confirmation of the proposed change.'),
     }),
     /** The old tools' exact input schemas, for alias calls (see alias-transport.ts). */
@@ -169,6 +181,9 @@ export const updatePostTool = {
             return updateStatus(client, args);
         if (mode === 'release_id')
             return updateReleaseId(client, args);
+        if (mode === 'approval') {
+            return updateApproval(client, args);
+        }
         return editPost(client, args);
     },
 };
@@ -209,6 +224,17 @@ async function updateStatus(client, input) {
     const transition = result.transition || {};
     return `Post #${input.post_id} status changed from ${transition.old_status || 'unknown'} to ${transition.new_status || input.status}.`;
 }
+async function updateApproval(client, input) {
+    if (input.confirm !== true) {
+        throw new Error('Refusing to change client approval without confirm=true after explicit user confirmation. Only a workspace owner or admin can do this, and the actor is the API key user, never a brand guest.');
+    }
+    const result = await client.setPostApproval(input.post_id, {
+        action: input.approval_action,
+        axis: input.approval_axis,
+        note: input.approval_note,
+    });
+    return JSON.stringify(result, null, 2);
+}
 async function updateReleaseId(client, input) {
     const result = await client.updatePostReleaseId(input.post_id, {
         release_id: input.release_id,

package/dist/tools/upload-media.d.ts

@@ -7,6 +7,7 @@ type UploadMediaInput = {
     url?: string;
     filename?: string;
     content_type?: string;
+    workspace_id?: string;
 };
 export declare const uploadMediaTool: {
     name: string;
@@ -17,13 +18,16 @@ export declare const uploadMediaTool: {
         url: z.ZodOptional<z.ZodString>;
         filename: z.ZodOptional<z.ZodString>;
         content_type: z.ZodOptional<z.ZodString>;
+        workspace_id: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
+        workspace_id?: string | undefined;
         filename?: string | undefined;
         url?: string | undefined;
         content_type?: string | undefined;
         file_path?: string | undefined;
         base64_data?: string | undefined;
     }, {
+        workspace_id?: string | undefined;
         filename?: string | undefined;
         url?: string | undefined;
         content_type?: string | undefined;

package/dist/tools/upload-media.js

@@ -27,6 +27,7 @@ export const uploadMediaTool = {
             .string()
             .optional()
             .describe('MIME type (auto-detected from filename if omitted)'),
+        workspace_id: z.string().optional().describe('Optional. The workspace this acts in and whose plan pays (from whoami). Needed only when your connection can act in several workspaces.'),
     }),
     /** The old tools' exact input schemas, for alias calls (see alias-transport.ts). */
     legacySchemas: {
@@ -52,6 +53,7 @@ async function uploadFile(client, input) {
         base64Data: input.base64_data,
         filename: input.filename,
         contentType: input.content_type,
+        workspaceId: input.workspace_id,
     });
     return mdSuccess('Media uploaded', [
         ['URL', result.url],
@@ -63,6 +65,7 @@ async function uploadFromUrl(client, input) {
         url: input.url,
         filename: input.filename,
         contentType: input.content_type,
+        workspaceId: input.workspace_id,
     });
     return [
         'Remote media uploaded successfully.',

package/dist/tools/validate-post.d.ts

@@ -494,11 +494,11 @@ export declare const validatePostInputSchema: import("zod").ZodObject<{
     username?: string | undefined;
     workspace_id?: string | undefined;
     account_id?: string | undefined;
+    caption?: string | undefined;
     scheduled_at?: string | undefined;
     media_url?: string | undefined;
     media_urls?: string[] | undefined;
     post_type?: string | undefined;
-    caption?: string | undefined;
     thread_posts?: string[] | undefined;
     instagram_settings?: {
         post_type?: "post" | "feed" | "story" | "reel" | "carousel" | undefined;
@@ -657,11 +657,11 @@ export declare const validatePostInputSchema: import("zod").ZodObject<{
     username?: string | undefined;
     workspace_id?: string | undefined;
     account_id?: string | undefined;
+    caption?: string | undefined;
     scheduled_at?: string | undefined;
     media_url?: string | undefined;
     media_urls?: string[] | undefined;
     post_type?: string | undefined;
-    caption?: string | undefined;
     thread_posts?: string[] | undefined;
     instagram_settings?: {
         post_type?: "post" | "feed" | "story" | "reel" | "carousel" | undefined;
@@ -1314,11 +1314,11 @@ export declare const validatePostTool: {
         username?: string | undefined;
         workspace_id?: string | undefined;
         account_id?: string | undefined;
+        caption?: string | undefined;
         scheduled_at?: string | undefined;
         media_url?: string | undefined;
         media_urls?: string[] | undefined;
         post_type?: string | undefined;
-        caption?: string | undefined;
         thread_posts?: string[] | undefined;
         instagram_settings?: {
             post_type?: "post" | "feed" | "story" | "reel" | "carousel" | undefined;
@@ -1477,11 +1477,11 @@ export declare const validatePostTool: {
         username?: string | undefined;
         workspace_id?: string | undefined;
         account_id?: string | undefined;
+        caption?: string | undefined;
         scheduled_at?: string | undefined;
         media_url?: string | undefined;
         media_urls?: string[] | undefined;
         post_type?: string | undefined;
-        caption?: string | undefined;
         thread_posts?: string[] | undefined;
         instagram_settings?: {
             post_type?: "post" | "feed" | "story" | "reel" | "carousel" | undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "posterly-mcp-server",
-  "version": "0.45.3",
+  "version": "0.47.0",
   "mcpName": "io.github.awpthorp/posterly",
   "description": "MCP server for posterly: schedule and publish social media posts across 18 platforms from any MCP client (Claude, ChatGPT, Cursor, Windsurf, Cline, and more)",
   "license": "MIT",

package/server.json

@@ -3,7 +3,7 @@
   "name": "io.github.awpthorp/posterly",
   "title": "posterly",
   "description": "Validate, schedule, publish, and analyze social content across 18 platforms with posterly.",
-  "version": "0.45.3",
+  "version": "0.47.0",
   "websiteUrl": "https://www.poster.ly/mcp",
   "repository": {
     "url": "https://github.com/awpthorp/posterly",
@@ -14,7 +14,7 @@
     {
       "registryType": "npm",
       "identifier": "posterly-mcp-server",
-      "version": "0.45.3",
+      "version": "0.47.0",
       "transport": {
         "type": "stdio"
       },

package/src/lib/api-client.ts

@@ -190,6 +190,7 @@ export interface ApiPostApproval {
   asset_status: ApiPostApprovalStatus;
   caption_status: ApiPostApprovalStatus;
   waiting_on: 'client' | 'team' | null;
+  pending_client_approval: boolean;
   requested_at: string | null;
   completed_at: string | null;
 }
@@ -390,6 +391,10 @@ export type WorkspaceMemberSummary = {
   status: string | null;
   /** [] = every brand; missing = not visible to a brand-limited caller. */
   brand_ids?: string[];
+  /** Can this teammate use the workspace's API and AI app access. Always true for the owner. */
+  api_access?: boolean;
+  /** Owners and admins only: live keys and AI app connections for this workspace. */
+  api_usage?: { key_count: number; last_used_at: string | null; connected_apps: string[] };
   joined_at: string | null;
   created_at: string | null;
 };
@@ -423,6 +428,9 @@ export type WorkspaceMemberPreview = {
   counts_toward_seats: boolean;
   seats_used: number | null;
   seat_limit: number | null;
+  /** action=set_api_access only. */
+  api_access?: boolean;
+  previous_api_access?: boolean | null;
 };
 
 export type WorkspaceMemberChangeResponse = {
@@ -1333,7 +1341,7 @@ export class PosterlyClient {
   async updateWorkspaceMember(
     workspaceId: string,
     target: { member_id?: string; invite_id?: string },
-    data: { role?: WorkspaceMemberRole; brand_ids?: string[] } & WorkspaceMemberConfirmFields,
+    data: { role?: WorkspaceMemberRole; brand_ids?: string[]; api_access?: boolean } & WorkspaceMemberConfirmFields,
   ): Promise<WorkspaceMemberChangeResponse> {
     const base = `/workspaces/${encodeURIComponent(workspaceId)}`;
     const path = target.member_id
@@ -1537,6 +1545,7 @@ export class PosterlyClient {
     offset?: number;
     workspace_id?: string;
     approval_status?: string;
+    approval_waiting_on?: string;
     brand_id?: string;
   }): Promise<{ posts: Post[]; total: number }> {
     const searchParams = new URLSearchParams();
@@ -1547,6 +1556,7 @@ export class PosterlyClient {
     if (params?.offset) searchParams.set('offset', String(params.offset));
     if (params?.workspace_id) searchParams.set('workspace_id', params.workspace_id);
     if (params?.approval_status) searchParams.set('approval_status', params.approval_status);
+    if (params?.approval_waiting_on) searchParams.set('approval_waiting_on', params.approval_waiting_on);
     if (params?.brand_id) searchParams.set('brand_id', params.brand_id);
 
     const qs = searchParams.toString();
@@ -1607,8 +1617,27 @@ export class PosterlyClient {
     return this.request('PATCH', `/posts/${id}`, data);
   }
 
-  async deletePost(id: number): Promise<{ deleted: boolean; id: number }> {
-    return this.request('DELETE', `/posts/${id}`);
+  async deletePost(
+    id: number,
+    options?: { confirmPublished?: boolean },
+  ): Promise<{ deleted: boolean; id: number; platform_delete?: string }> {
+    const qs = options?.confirmPublished ? '?confirm_published=true' : '';
+    return this.request('DELETE', `/posts/${id}${qs}`);
+  }
+
+  async setPostApproval(
+    id: number,
+    data: {
+      action: 'request' | 'approve' | 'request_changes' | 'reject';
+      axis?: 'asset' | 'caption';
+      note?: string;
+    },
+  ): Promise<Record<string, unknown>> {
+    return this.request('POST', `/posts/${id}/approval`, {
+      action: data.action,
+      ...(data.axis ? { axis: data.axis } : {}),
+      ...(data.note ? { note: data.note } : {}),
+    });
   }
 
   async updatePostStatus(
@@ -1640,6 +1669,7 @@ export class PosterlyClient {
     quality?: 'low' | 'medium' | 'high';
     thinking_level?: 'minimal' | 'high';
     reference_image_urls?: string[];
+    workspace_id?: string;
   }): Promise<{
     job_id: string;
     status: string;
@@ -1685,6 +1715,7 @@ export class PosterlyClient {
     reference_images?: Array<{ url: string; type: 'character' | 'object' | 'scene' }>;
     generate_audio?: boolean;
     source_video_url?: string;
+    workspace_id?: string;
   }): Promise<Record<string, any>> {
     return this.request('POST', '/ai/generate-video', data);
   }
@@ -1984,6 +2015,7 @@ export class PosterlyClient {
     filename: string,
     contentType: string,
     size: number,
+    workspaceId?: string,
   ): Promise<{
     upload_url: string;
     token: string;
@@ -1995,12 +2027,14 @@ export class PosterlyClient {
       filename,
       content_type: contentType,
       size,
+      ...(workspaceId ? { workspace_id: workspaceId } : {}),
     });
   }
 
   async createMediaDrop(input?: {
     filename?: string;
     maxFiles?: number;
+    workspaceId?: string;
   }): Promise<{
     session_id: string;
     drop_url: string;
@@ -2012,6 +2046,7 @@ export class PosterlyClient {
     return this.request('POST', '/media/drop-sessions', {
       filename: input?.filename,
       max_files: input?.maxFiles,
+      ...(input?.workspaceId ? { workspace_id: input.workspaceId } : {}),
     });
   }
 
@@ -2043,6 +2078,7 @@ export class PosterlyClient {
     base64Data?: string;
     filename: string;
     contentType?: string;
+    workspaceId?: string;
   }): Promise<{ url: string; path: string }> {
     this.requireApiKey();
 
@@ -2068,6 +2104,7 @@ export class PosterlyClient {
         input.filename,
         contentType,
         fileBuffer.length,
+        input.workspaceId,
       );
 
       const uploadRes = await fetch(signed.upload_url, {
@@ -2094,6 +2131,7 @@ export class PosterlyClient {
       filename: input.filename,
       data,
       content_type: contentType,
+      ...(input.workspaceId ? { workspace_id: input.workspaceId } : {}),
     });
   }
 
@@ -2101,11 +2139,13 @@ export class PosterlyClient {
     url: string;
     filename?: string;
     contentType?: string;
+    workspaceId?: string;
   }): Promise<{ url: string; path: string; source_url: string; content_type: string; size: number }> {
     return this.request('POST', '/media/upload-from-url', {
       url: input.url,
       filename: input.filename,
       content_type: input.contentType,
+      ...(input.workspaceId ? { workspace_id: input.workspaceId } : {}),
     });
   }
 

package/src/lib/version.ts

@@ -5,4 +5,4 @@
 // tool set (minus the intentional pre-auth signup tools that only this stdio
 // package exposes). `npm run check:mcp-parity` enforces both the version match
 // and the tool-list match, and runs in the pre-commit hook.
-export const POSTERLY_MCP_VERSION = '0.45.3';
+export const POSTERLY_MCP_VERSION = '0.47.0';

package/src/tools/create-media-drop.ts

@@ -14,15 +14,17 @@ export const createMediaDropTool = {
       .max(10)
       .optional()
       .describe('How many files the drop can accept. Default 10, max 10.'),
+    workspace_id: z.string().optional().describe('Optional. The workspace this acts in and whose plan pays (from whoami). Needed only when your connection can act in several workspaces.'),
   }),
 
   async execute(
     client: PosterlyClient,
-    input: { filename?: string; max_files?: number },
+    input: { filename?: string; max_files?: number; workspace_id?: string },
   ) {
     const drop = await client.createMediaDrop({
       filename: input.filename,
       maxFiles: input.max_files,
+      workspaceId: input.workspace_id,
     });
     return [
       'Media drop created. Send this URL to the user. They open it with no posterly login and drop the file.',