posterly-mcp-server 0.50.2 → 0.50.4

package/README.md

@@ -123,7 +123,7 @@ Add the same server definition to your Cursor MCP settings:
 
 ## Available tools
 
-`posterly-mcp-server@0.50.2` exposes 64 tools covering 100 actions. The hosted HTTP endpoint exposes the same catalog minus the three signup tools: 61 tools covering 97 actions.
+`posterly-mcp-server@0.50.4` exposes 64 tools covering 100 actions. The hosted HTTP endpoint exposes the same catalog minus the three signup tools: 61 tools covering 97 actions.
 
 Many tools pick what to do with one parameter: `view` (reads), `action` (writes), or `type`. A few pick their mode from which parameters you pass (for example `update_post` with `status` changes the status instead of editing). Every tool description names all of its views and actions.
 
@@ -532,3 +532,11 @@ The package reads:
 - optional `POSTERLY_API_KEY` for authenticated posterly tools
 - optional `POSTERLY_URL` if you need to point at a non-production environment
 - optional `POSTERLY_TOOLSETS` (for example `core,inbox`) to list fewer tool sets
+
+## Claude directory profile
+
+The optional directory profile provides 52 tools over HTTP or 55 tools over local stdio for social publishing, existing-media uploads, analytics, and inbox work. AI image and video generation, generation-job helpers, billing mutations, and legacy tool aliases are unavailable in this profile. Text caption suggestions and read-only subscription information remain available. Tool descriptions are functional summaries; input schemas retain their validation constraints.
+
+Hosted endpoint: `https://www.poster.ly/api/mcp?profile=claude`. For local stdio, set `POSTERLY_DIRECTORY_PROFILE=claude` alongside the existing API key. The default catalogs remain 61 hosted tools and 64 local tools. This profile does not grant authorization, bypass scopes, or change the existing preview and confirmation checks.
+
+Directory approval remains Anthropic's decision. This profile addresses the generation and financial-transaction restrictions in the [Anthropic Software Directory Policy](https://support.claude.com/en/articles/13145358-anthropic-software-directory-policy).

package/dist/index.js

@@ -5,6 +5,7 @@ import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
 import { PosterlyClient, setMcpClientNameResolver } from './lib/api-client.js';
 import { POSTERLY_MCP_VERSION } from './lib/version.js';
 import { getToolAnnotations } from './lib/tool-annotations.js';
+import { CLAUDE_DIRECTORY_INSTRUCTIONS, isClaudeDirectoryTool } from './lib/claude-directory-profile.js';
 import { McpError, ErrorCode } from '@modelcontextprotocol/sdk/types.js';
 import { AliasTransport } from './lib/alias-transport.js';
 import { StdioPreviewTokens } from './lib/preview-token.js';
@@ -148,6 +149,10 @@ const STDIO_TOOLS = [
 // tool-annotations.json; dist/index.js reads it from one level up.
 const require = createRequire(import.meta.url);
 const registry = require('../tool-registry.json');
+const directoryProfile = process.env.POSTERLY_DIRECTORY_PROFILE;
+if (directoryProfile && directoryProfile !== 'claude')
+    throw new Error('Unknown posterly directory profile');
+const claudeDirectoryProfile = directoryProfile === 'claude';
 /**
  * Tool sets to list (POSTERLY_TOOLSETS env or --toolsets=core,inbox). Default
  * is every set, so nobody loses tools. Signup tools are always listed. Sets
@@ -169,7 +174,7 @@ const server = new McpServer({
 }, {
     // Which tool sets exist, that every set is on by default, how to load
     // fewer, and how preview then confirm works (built from the registry).
-    instructions: toolsetInstructions(registry, 'stdio'),
+    instructions: claudeDirectoryProfile ? CLAUDE_DIRECTORY_INSTRUCTIONS : toolsetInstructions(registry, 'stdio'),
 });
 const client = new PosterlyClient();
 // The SDK only learns the connected client's identity (e.g. "claude-ai",
@@ -201,7 +206,7 @@ const legacyValidator = (aliasName, args) => {
 // Renamed tools (aliases) are never registered with McpServer: the transport
 // rewrites an alias call onto its target before the SDK sees it, and handlers
 // read the called name back through getCallInfo(extra.requestId).
-const transport = new AliasTransport(new StdioServerTransport(), registry, toolsets.all ? null : visibleTools(registry, toolsets.enabled, 'stdio'), legacyValidator);
+const transport = new AliasTransport(new StdioServerTransport(), registry, toolsets.all ? null : visibleTools(registry, toolsets.enabled, 'stdio'), legacyValidator, claudeDirectoryProfile);
 // Preview then confirm tokens: a random key and an in-memory one-time-use
 // set per process (UX protection only; REST authorization is unchanged).
 const previews = new StdioPreviewTokens();
@@ -230,7 +235,7 @@ function registerAll(tools) {
         });
     }
 }
-registerAll(STDIO_TOOLS);
+registerAll(claudeDirectoryProfile ? STDIO_TOOLS.filter((tool) => isClaudeDirectoryTool(tool.name)) : STDIO_TOOLS);
 // Start the server
 async function main() {
     await server.connect(transport);

package/dist/lib/alias-transport.d.ts

@@ -58,6 +58,7 @@ export declare class AliasTransport implements Transport {
     private readonly registry;
     private readonly visibleTools;
     private readonly legacyValidator;
+    private readonly claudeDirectoryProfile;
     onclose?: () => void;
     onerror?: (error: Error) => void;
     onmessage?: <T extends JSONRPCMessage>(message: T, extra?: MessageExtraInfo) => void;
@@ -68,7 +69,7 @@ export declare class AliasTransport implements Transport {
      * @param visibleTools names to list in tools/list, or null to list every
      *   registered tool unchanged (the default: every set).
      */
-    constructor(inner: Transport, registry: ToolRegistry, visibleTools?: Set<string> | null, legacyValidator?: LegacyAliasValidator | null);
+    constructor(inner: Transport, registry: ToolRegistry, visibleTools?: Set<string> | null, legacyValidator?: LegacyAliasValidator | null, claudeDirectoryProfile?: boolean);
     get sessionId(): string | undefined;
     setProtocolVersion(version: string): void;
     start(): Promise<void>;

package/dist/lib/alias-transport.js

@@ -29,6 +29,7 @@
  *
  * Only the public Transport interface is used; no SDK private fields.
  */
+import { claudeDirectoryDescription, claudeDirectorySchema, isClaudeDirectoryTool } from './claude-directory-profile.js';
 import { DEPRECATION_META_KEY, deprecationNote, resolveAlias, translateArgs, validateMode, } from './tool-registry.js';
 function requestKey(id) {
     return `${typeof id}:${String(id)}`;
@@ -41,6 +42,7 @@ export class AliasTransport {
     registry;
     visibleTools;
     legacyValidator;
+    claudeDirectoryProfile;
     onclose;
     onerror;
     onmessage;
@@ -51,11 +53,12 @@ export class AliasTransport {
      * @param visibleTools names to list in tools/list, or null to list every
      *   registered tool unchanged (the default: every set).
      */
-    constructor(inner, registry, visibleTools = null, legacyValidator = null) {
+    constructor(inner, registry, visibleTools = null, legacyValidator = null, claudeDirectoryProfile = false) {
         this.inner = inner;
         this.registry = registry;
         this.visibleTools = visibleTools;
         this.legacyValidator = legacyValidator;
+        this.claudeDirectoryProfile = claudeDirectoryProfile;
         inner.onmessage = (message, extra) => this.handleIncoming(message, extra);
         inner.onclose = () => this.onclose?.();
         inner.onerror = (error) => this.onerror?.(error);
@@ -95,7 +98,7 @@ export class AliasTransport {
             this.onmessage?.(message, extra);
             return;
         }
-        if (request.method === 'tools/list' && this.visibleTools && request.id !== undefined && request.id !== null) {
+        if (request.method === 'tools/list' && (this.visibleTools || this.claudeDirectoryProfile) && request.id !== undefined && request.id !== null) {
             this.listRequests.add(requestKey(request.id));
             this.onmessage?.(message, extra);
             return;
@@ -105,6 +108,12 @@ export class AliasTransport {
             return;
         }
         const name = request.params.name;
+        if (this.claudeDirectoryProfile && (typeof name !== 'string' || !isClaudeDirectoryTool(name))) {
+            // Omitted tools and legacy aliases reach the SDK unchanged and fail as
+            // unregistered names, rather than being rewritten into callable tools.
+            this.onmessage?.(message, extra);
+            return;
+        }
         const alias = typeof name === 'string' ? resolveAlias(this.registry, name) : null;
         if (!alias) {
             this.onmessage?.(message, extra);
@@ -150,7 +159,7 @@ export class AliasTransport {
     }
     filterToolsList(message) {
         const response = message;
-        if (!this.visibleTools || response.method !== undefined || response.id === undefined || response.id === null)
+        if ((!this.visibleTools && !this.claudeDirectoryProfile) || response.method !== undefined || response.id === undefined || response.id === null)
             return message;
         const key = requestKey(response.id);
         if (!this.listRequests.has(key))
@@ -163,7 +172,11 @@ export class AliasTransport {
             ...message,
             result: {
                 ...response.result,
-                tools: response.result.tools.filter((tool) => typeof tool?.name === 'string' && visible.has(tool.name)),
+                tools: response.result.tools
+                    .filter((tool) => typeof tool?.name === 'string' && (!visible || visible.has(tool.name)) && (!this.claudeDirectoryProfile || isClaudeDirectoryTool(tool.name)))
+                    .map((tool) => this.claudeDirectoryProfile ? {
+                    ...tool, description: claudeDirectoryDescription(tool.name), inputSchema: claudeDirectorySchema(tool.inputSchema),
+                } : tool),
             },
         };
         return filtered;

package/dist/lib/claude-directory-profile.d.ts

@@ -0,0 +1,5 @@
+export declare const CLAUDE_DIRECTORY_INSTRUCTIONS = "posterly provides social account discovery, existing-media uploads, social post validation and publication, analytics, and inbox management. AI image, video, and audio generation and billing mutations are unavailable in this directory profile. Public and destructive actions use the existing preview and confirmation contract.";
+export declare function isClaudeDirectoryTool(name: string): boolean;
+export declare function claudeDirectoryDescription(name: string): string;
+/** Keep validation constraints but omit prose referring to other tools or model behavior. */
+export declare function claudeDirectorySchema<T>(schema: T): T;

package/dist/lib/claude-directory-profile.js

@@ -0,0 +1,95 @@
+/**
+ * Opt-in catalog for the Anthropic Software Directory. Both MCP transports
+ * use this explicit allowlist; omitted tools are unavailable, including aliases.
+ * REST authorization and preview confirmation still apply to every operation.
+ * Policy: https://support.claude.com/en/articles/13145358
+ */
+const descriptions = {
+    get_agent_signup_info: 'Return posterly signup requirements and the human signup link.',
+    start_signup: 'Create a short-lived signup session with a browser link for human completion. This operation does not take payment.',
+    get_signup_session: 'Read the completion status of a signup session.',
+    whoami: 'Return connection status or the authenticated user, scopes, and accessible workspaces.',
+    create_api_key: 'Create a scoped posterly API key for the authenticated user. The new key cannot exceed the caller key permissions.',
+    delete_api_key: 'Revoke an API key owned by the authenticated user. The current authentication key and managed OAuth keys cannot be revoked here.',
+    list_workspace_members: 'List workspace members, pending invites, roles, brand access, API access, and occupied seats.',
+    manage_workspace_member: 'Invite, update, or remove a workspace colleague using the action selector. Workspace administrator permissions and existing seat limits apply.',
+    list_publishing_pauses: 'Read workspace and brand publishing pauses and the caller permissions to manage them.',
+    manage_publishing_pause: 'Pause or resume workspace or brand publishing using the action selector. Resume can keep missed posts paused or publish them.',
+    list_accounts: 'List connected social accounts, or read account brand profiles, learned voice, performance profiles, and connection-session status using the view selector.',
+    disconnect_account: 'Disconnect a social account, removing its connection and affecting its scheduled posts.',
+    connect_account: 'Connect a credential-based Telegram, Bluesky, Discord, WordPress, Dev.to, Hashnode, or Lemmy account.',
+    create_connect_session: 'Create a short-lived browser handoff session for a human to connect a social account.',
+    list_oauth_clients: 'List self-serve OAuth developer clients owned by the authenticated user.',
+    manage_oauth_client: 'Create, update, or delete a public OAuth 2.1 developer client using the action selector. Client secrets are not created.',
+    list_platforms: 'List supported platforms, read platform or account settings schemas, or return browser connection links using the view selector.',
+    trigger_platform_helper: 'Read account-specific platform discovery data: Pinterest boards, TikTok creator information, LinkedIn recent mentions, or X quota.',
+    list_brands: 'List accessible brands, read one brand, or list its social accounts using the view selector.',
+    list_post_suggestions: 'List suggested social post drafts, their performance rationale, and their scheduling status.',
+    dismiss_suggestion: 'Dismiss a pending post suggestion. Suggestions already converted into posts are unchanged.',
+    list_posts: 'List social posts accessible to the caller, filtered by account, brand, workspace, platform, status, or approval state.',
+    get_post: 'Read one social post and its current content, media, platform settings, and publication status.',
+    ask_support: 'Answer a posterly support question with documentation and read-only workspace diagnostics. A continued support conversation can request a human ticket with explicit escalation confirmation.',
+    find_available_slot: 'Find available posting times with a one-hour spacing rule, preferred hours, and an explicit timezone.',
+    submit_agent_feedback: 'Record private operational feedback about a completed posterly workflow. Content and credentials are not accepted as telemetry.',
+    submit_product_feedback: 'Submit a confirmed title, category, and description to the public posterly feedback board.',
+    validate_post: 'Validate and normalize proposed post content without saving, uploading, scheduling, or publishing it.',
+    create_post: 'Create one scheduled or immediate social post. Omitting scheduled_at requests immediate publication. The operation creates content on the selected connected social account.',
+    create_posts_batch: 'Create one to 25 scheduled or immediate social posts. Partial success is possible and failed items retain their input index.',
+    update_post: 'Edit a draft or scheduled post, change its status, assign release and group identifiers, or manage client approval using the action selector. Published posts cannot be edited.',
+    delete_post: 'Delete one draft or scheduled post, or all eligible posts in a selected group using the action selector. Published posts cannot be deleted.',
+    get_x_posting_quota: 'Read managed X posting usage, quota, remaining posts, URL restrictions, and existing add-on information.',
+    upload_media: 'Upload an existing image or video to posterly storage from a file, base64 content, or a public HTTPS URL. Returns a reusable media URL and does not publish content.',
+    create_signed_upload: 'Create a signed storage upload URL for an existing large image or video.',
+    create_media_drop: 'Create a short-lived browser page for a human to upload existing media without a dashboard login.',
+    list_media: 'List uploaded media assets or files uploaded to a selected media-drop session.',
+    generate_captions: 'Generate or adapt text caption suggestions for social platforms. Uses the caption allowance and does not create or publish posts.',
+    list_analytics: 'Read account analytics, post analytics, post feedback insights, or missing-post requirements using the view selector.',
+    list_google_business_reviews: 'Read Google Business Profile reviews or the public review link using the view selector.',
+    audit_google_business_profile: 'Read and audit a connected Google Business Profile location: completeness, categories, media, attributes, reviews, and recommendations.',
+    manage_google_business_review: 'Suggest text replies, publish owner replies, or delete owner replies to Google Business reviews using the action selector. Suggestions do not publish a reply.',
+    list_google_business_media: 'Read existing photos and videos in connected Google Business Profile galleries.',
+    manage_google_business_media: 'Add an existing photo or video to a Google Business gallery, or delete a gallery item using the action selector.',
+    list_conversations: 'List Instagram or Facebook Page inbox conversations, or read one conversation using the view selector. Requires a Pro plan and posts:read.',
+    manage_conversation: 'Reply to an Instagram or Facebook Page inbox conversation, or synchronize supported social inbox data using the action selector. Requires a Pro plan and posts:write.',
+    list_comments: 'List Instagram, Facebook Page, Threads, or LinkedIn Page comments, or read one comment using the view selector. Requires a Pro plan and posts:read.',
+    manage_comment: 'Reply to, hide, unhide, mark, or delete a social inbox comment using the action selector. Platform limitations apply. Requires a Pro plan and posts:write.',
+    list_activity: 'Read recent post activity, status changes, publish attempts, failures, and retries.',
+    list_webhooks: 'Read webhook subscriptions, event filters, destinations, and recent delivery status.',
+    create_webhook: 'Create a webhook subscription for post, account, or analytics events and return its signing secret once.',
+    manage_webhook: 'Update or delete a webhook subscription, or send a signed test event using the action selector.',
+    get_credits: 'Read the workspace AI credit balance, included allowance, purchased balance, and next reset time. Does not buy or spend credits.',
+    get_subscription: 'Read subscription status, tier, current period, trial end, cancellation-at-period-end, and pause state. Does not change billing.',
+    get_updates: 'Read recent posterly product updates.',
+};
+export const CLAUDE_DIRECTORY_INSTRUCTIONS = 'posterly provides social account discovery, existing-media uploads, social post validation and publication, analytics, and inbox management. AI image, video, and audio generation and billing mutations are unavailable in this directory profile. Public and destructive actions use the existing preview and confirmation contract.';
+export function isClaudeDirectoryTool(name) {
+    return Object.hasOwn(descriptions, name);
+}
+export function claudeDirectoryDescription(name) {
+    const description = descriptions[name];
+    if (!description)
+        throw new Error(`Tool is unavailable in the Claude directory profile: ${name}`);
+    return description;
+}
+/** Keep validation constraints but omit prose referring to other tools or model behavior. */
+export function claudeDirectorySchema(schema) {
+    const copy = structuredClone(schema);
+    function visit(value) {
+        if (Array.isArray(value))
+            value.forEach(visit);
+        else if (value && typeof value === 'object') {
+            const object = value;
+            if (typeof object.description === 'string')
+                delete object.description;
+            for (const key of ['properties', 'patternProperties', 'definitions', '$defs', 'dependentSchemas']) {
+                const schemas = object[key];
+                if (schemas && typeof schemas === 'object' && !Array.isArray(schemas))
+                    Object.values(schemas).forEach(visit);
+            }
+            for (const key of ['items', 'additionalProperties', 'additionalItems', 'contains', 'not', 'if', 'then', 'else', 'propertyNames', 'unevaluatedProperties', 'unevaluatedItems', 'allOf', 'oneOf', 'anyOf', 'prefixItems'])
+                visit(object[key]);
+        }
+    }
+    visit(copy);
+    return copy;
+}

package/dist/lib/version.d.ts

@@ -1 +1 @@
-export declare const POSTERLY_MCP_VERSION = "0.50.2";
+export declare const POSTERLY_MCP_VERSION = "0.50.4";

package/dist/lib/version.js

@@ -5,4 +5,4 @@
 // tool set (minus the intentional pre-auth signup tools that only this stdio
 // package exposes). `npm run check:mcp-parity` enforces both the version match
 // and the tool-list match, and runs in the pre-commit hook.
-export const POSTERLY_MCP_VERSION = '0.50.2';
+export const POSTERLY_MCP_VERSION = '0.50.4';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "posterly-mcp-server",
-  "version": "0.50.2",
+  "version": "0.50.4",
   "mcpName": "io.github.awpthorp/posterly",
   "description": "MCP server for posterly: schedule and publish social media posts across 18 platforms from any MCP client (Claude, ChatGPT, Cursor, Windsurf, Cline, and more)",
   "license": "MIT",

package/scripts/test-claude-directory-profile.mjs

@@ -0,0 +1,38 @@
+import assert from 'node:assert/strict';
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
+import { fileURLToPath } from 'node:url';
+
+async function connect(profile) {
+  const client = new Client({ name: 'directory-profile-test', version: '1.0.0' });
+  await client.connect(new StdioClientTransport({
+    command: process.execPath,
+    args: [fileURLToPath(new URL('../dist/index.js', import.meta.url))],
+    env: { PATH: process.env.PATH, POSTERLY_DIRECTORY_PROFILE: profile, POSTERLY_API_KEY: 'test', POSTERLY_API_URL: 'http://127.0.0.1:1/api/v1' },
+  }));
+  return client;
+}
+
+const client = await connect('claude');
+try {
+  const { tools } = await client.listTools();
+  assert.equal(tools.length, 55);
+  for (const name of ['generate_image', 'generate_video', 'list_jobs', 'run_video_function', 'get_video_options', 'cancel_subscription', 'pause_subscription', 'resume_subscription', 'downgrade_subscription', 'get_image_job', 'get_video_job', 'update_post_status']) {
+    assert(!tools.some(tool => tool.name === name), name);
+    const rejected = await client.callTool({ name, arguments: {} });
+    assert.equal(rejected.isError, true, name);
+    assert.match(rejected.content.map(item => item.text ?? '').join('\n'), /not found|unknown tool/i, name);
+  }
+  for (const tool of tools) {
+    assert(tool.annotations.title, tool.name);
+    assert(!/call [a-z_]+|always |you must|walk |read .*first/i.test(tool.description), tool.name);
+    assert(! /"description"\s*:\s*"/.test(JSON.stringify(tool.inputSchema)), tool.name);
+  }
+  console.log('OK Claude directory: real stdio catalog has 55 tools and blocks generation, billing mutations, and legacy aliases.');
+} finally { await client.close(); }
+
+const standard = await connect('');
+try {
+  assert.equal((await standard.listTools()).tools.length, 64);
+  console.log('OK Normal stdio catalog remains 64 tools.');
+} finally { await standard.close(); }

package/server.json

@@ -3,7 +3,7 @@
   "name": "io.github.awpthorp/posterly",
   "title": "posterly",
   "description": "Validate, schedule, publish, and analyze social content across 18 platforms with posterly.",
-  "version": "0.50.2",
+  "version": "0.50.4",
   "websiteUrl": "https://www.poster.ly/mcp",
   "repository": {
     "url": "https://github.com/awpthorp/posterly",
@@ -14,7 +14,7 @@
     {
       "registryType": "npm",
       "identifier": "posterly-mcp-server",
-      "version": "0.50.2",
+      "version": "0.50.4",
       "transport": {
         "type": "stdio"
       },

package/src/index.ts

@@ -7,6 +7,7 @@ import type { z } from 'zod';
 import { PosterlyClient, setMcpClientNameResolver } from './lib/api-client.js';
 import { POSTERLY_MCP_VERSION } from './lib/version.js';
 import { getToolAnnotations } from './lib/tool-annotations.js';
+import { CLAUDE_DIRECTORY_INSTRUCTIONS, isClaudeDirectoryTool } from './lib/claude-directory-profile.js';
 import { McpError, ErrorCode } from '@modelcontextprotocol/sdk/types.js';
 import { AliasTransport, type LegacyAliasValidator } from './lib/alias-transport.js';
 import { StdioPreviewTokens } from './lib/preview-token.js';
@@ -168,6 +169,9 @@ const STDIO_TOOLS: ToolModule[] = [
 // tool-annotations.json; dist/index.js reads it from one level up.
 const require = createRequire(import.meta.url);
 const registry = require('../tool-registry.json') as ToolRegistry;
+const directoryProfile = process.env.POSTERLY_DIRECTORY_PROFILE;
+if (directoryProfile && directoryProfile !== 'claude') throw new Error('Unknown posterly directory profile');
+const claudeDirectoryProfile = directoryProfile === 'claude';
 
 /**
  * Tool sets to list (POSTERLY_TOOLSETS env or --toolsets=core,inbox). Default
@@ -193,7 +197,7 @@ const server = new McpServer(
   {
     // Which tool sets exist, that every set is on by default, how to load
     // fewer, and how preview then confirm works (built from the registry).
-    instructions: toolsetInstructions(registry, 'stdio'),
+    instructions: claudeDirectoryProfile ? CLAUDE_DIRECTORY_INSTRUCTIONS : toolsetInstructions(registry, 'stdio'),
   },
 );
 
@@ -236,6 +240,7 @@ const transport = new AliasTransport(
   registry,
   toolsets.all ? null : visibleTools(registry, toolsets.enabled, 'stdio'),
   legacyValidator,
+  claudeDirectoryProfile,
 );
 
 // Preview then confirm tokens: a random key and an in-memory one-time-use
@@ -273,7 +278,7 @@ function registerAll(tools: ToolModule[]): void {
   }
 }
 
-registerAll(STDIO_TOOLS);
+registerAll(claudeDirectoryProfile ? STDIO_TOOLS.filter((tool) => isClaudeDirectoryTool(tool.name)) : STDIO_TOOLS);
 
 // Start the server
 async function main() {

package/src/lib/alias-transport.ts

@@ -32,6 +32,7 @@
 
 import type { Transport, TransportSendOptions } from '@modelcontextprotocol/sdk/shared/transport.js';
 import type { JSONRPCMessage, MessageExtraInfo, RequestId } from '@modelcontextprotocol/sdk/types.js';
+import { claudeDirectoryDescription, claudeDirectorySchema, isClaudeDirectoryTool } from './claude-directory-profile.js';
 import {
   DEPRECATION_META_KEY,
   deprecationNote,
@@ -88,6 +89,7 @@ export class AliasTransport implements Transport {
     private readonly registry: ToolRegistry,
     private readonly visibleTools: Set<string> | null = null,
     private readonly legacyValidator: LegacyAliasValidator | null = null,
+    private readonly claudeDirectoryProfile = false,
   ) {
     inner.onmessage = (message, extra) => this.handleIncoming(message as JSONRPCMessage, extra);
     inner.onclose = () => this.onclose?.();
@@ -134,7 +136,7 @@ export class AliasTransport implements Transport {
       this.onmessage?.(message, extra);
       return;
     }
-    if (request.method === 'tools/list' && this.visibleTools && request.id !== undefined && request.id !== null) {
+    if (request.method === 'tools/list' && (this.visibleTools || this.claudeDirectoryProfile) && request.id !== undefined && request.id !== null) {
       this.listRequests.add(requestKey(request.id));
       this.onmessage?.(message, extra);
       return;
@@ -144,6 +146,12 @@ export class AliasTransport implements Transport {
       return;
     }
     const name = request.params.name;
+    if (this.claudeDirectoryProfile && (typeof name !== 'string' || !isClaudeDirectoryTool(name))) {
+      // Omitted tools and legacy aliases reach the SDK unchanged and fail as
+      // unregistered names, rather than being rewritten into callable tools.
+      this.onmessage?.(message, extra);
+      return;
+    }
     const alias = typeof name === 'string' ? resolveAlias(this.registry, name) : null;
     if (!alias) {
       this.onmessage?.(message, extra);
@@ -194,7 +202,7 @@ export class AliasTransport implements Transport {
 
   private filterToolsList(message: JSONRPCMessage): JSONRPCMessage {
     const response = message as { id?: RequestId; result?: any; method?: string };
-    if (!this.visibleTools || response.method !== undefined || response.id === undefined || response.id === null) return message;
+    if ((!this.visibleTools && !this.claudeDirectoryProfile) || response.method !== undefined || response.id === undefined || response.id === null) return message;
     const key = requestKey(response.id);
     if (!this.listRequests.has(key)) return message;
     this.listRequests.delete(key);
@@ -204,7 +212,11 @@ export class AliasTransport implements Transport {
       ...(message as object),
       result: {
         ...response.result,
-        tools: response.result.tools.filter((tool: { name?: unknown }) => typeof tool?.name === 'string' && visible.has(tool.name)),
+        tools: response.result.tools
+          .filter((tool: { name?: unknown }) => typeof tool?.name === 'string' && (!visible || visible.has(tool.name)) && (!this.claudeDirectoryProfile || isClaudeDirectoryTool(tool.name)))
+          .map((tool: { name: string; inputSchema: unknown }) => this.claudeDirectoryProfile ? {
+            ...tool, description: claudeDirectoryDescription(tool.name), inputSchema: claudeDirectorySchema(tool.inputSchema),
+          } : tool),
       },
     };
     return filtered as unknown as JSONRPCMessage;

package/src/lib/claude-directory-profile.ts

@@ -0,0 +1,94 @@
+/**
+ * Opt-in catalog for the Anthropic Software Directory. Both MCP transports
+ * use this explicit allowlist; omitted tools are unavailable, including aliases.
+ * REST authorization and preview confirmation still apply to every operation.
+ * Policy: https://support.claude.com/en/articles/13145358
+ */
+const descriptions: Record<string, string> = {
+  get_agent_signup_info: 'Return posterly signup requirements and the human signup link.',
+  start_signup: 'Create a short-lived signup session with a browser link for human completion. This operation does not take payment.',
+  get_signup_session: 'Read the completion status of a signup session.',
+  whoami: 'Return connection status or the authenticated user, scopes, and accessible workspaces.',
+  create_api_key: 'Create a scoped posterly API key for the authenticated user. The new key cannot exceed the caller key permissions.',
+  delete_api_key: 'Revoke an API key owned by the authenticated user. The current authentication key and managed OAuth keys cannot be revoked here.',
+  list_workspace_members: 'List workspace members, pending invites, roles, brand access, API access, and occupied seats.',
+  manage_workspace_member: 'Invite, update, or remove a workspace colleague using the action selector. Workspace administrator permissions and existing seat limits apply.',
+  list_publishing_pauses: 'Read workspace and brand publishing pauses and the caller permissions to manage them.',
+  manage_publishing_pause: 'Pause or resume workspace or brand publishing using the action selector. Resume can keep missed posts paused or publish them.',
+  list_accounts: 'List connected social accounts, or read account brand profiles, learned voice, performance profiles, and connection-session status using the view selector.',
+  disconnect_account: 'Disconnect a social account, removing its connection and affecting its scheduled posts.',
+  connect_account: 'Connect a credential-based Telegram, Bluesky, Discord, WordPress, Dev.to, Hashnode, or Lemmy account.',
+  create_connect_session: 'Create a short-lived browser handoff session for a human to connect a social account.',
+  list_oauth_clients: 'List self-serve OAuth developer clients owned by the authenticated user.',
+  manage_oauth_client: 'Create, update, or delete a public OAuth 2.1 developer client using the action selector. Client secrets are not created.',
+  list_platforms: 'List supported platforms, read platform or account settings schemas, or return browser connection links using the view selector.',
+  trigger_platform_helper: 'Read account-specific platform discovery data: Pinterest boards, TikTok creator information, LinkedIn recent mentions, or X quota.',
+  list_brands: 'List accessible brands, read one brand, or list its social accounts using the view selector.',
+  list_post_suggestions: 'List suggested social post drafts, their performance rationale, and their scheduling status.',
+  dismiss_suggestion: 'Dismiss a pending post suggestion. Suggestions already converted into posts are unchanged.',
+  list_posts: 'List social posts accessible to the caller, filtered by account, brand, workspace, platform, status, or approval state.',
+  get_post: 'Read one social post and its current content, media, platform settings, and publication status.',
+  ask_support: 'Answer a posterly support question with documentation and read-only workspace diagnostics. A continued support conversation can request a human ticket with explicit escalation confirmation.',
+  find_available_slot: 'Find available posting times with a one-hour spacing rule, preferred hours, and an explicit timezone.',
+  submit_agent_feedback: 'Record private operational feedback about a completed posterly workflow. Content and credentials are not accepted as telemetry.',
+  submit_product_feedback: 'Submit a confirmed title, category, and description to the public posterly feedback board.',
+  validate_post: 'Validate and normalize proposed post content without saving, uploading, scheduling, or publishing it.',
+  create_post: 'Create one scheduled or immediate social post. Omitting scheduled_at requests immediate publication. The operation creates content on the selected connected social account.',
+  create_posts_batch: 'Create one to 25 scheduled or immediate social posts. Partial success is possible and failed items retain their input index.',
+  update_post: 'Edit a draft or scheduled post, change its status, assign release and group identifiers, or manage client approval using the action selector. Published posts cannot be edited.',
+  delete_post: 'Delete one draft or scheduled post, or all eligible posts in a selected group using the action selector. Published posts cannot be deleted.',
+  get_x_posting_quota: 'Read managed X posting usage, quota, remaining posts, URL restrictions, and existing add-on information.',
+  upload_media: 'Upload an existing image or video to posterly storage from a file, base64 content, or a public HTTPS URL. Returns a reusable media URL and does not publish content.',
+  create_signed_upload: 'Create a signed storage upload URL for an existing large image or video.',
+  create_media_drop: 'Create a short-lived browser page for a human to upload existing media without a dashboard login.',
+  list_media: 'List uploaded media assets or files uploaded to a selected media-drop session.',
+  generate_captions: 'Generate or adapt text caption suggestions for social platforms. Uses the caption allowance and does not create or publish posts.',
+  list_analytics: 'Read account analytics, post analytics, post feedback insights, or missing-post requirements using the view selector.',
+  list_google_business_reviews: 'Read Google Business Profile reviews or the public review link using the view selector.',
+  audit_google_business_profile: 'Read and audit a connected Google Business Profile location: completeness, categories, media, attributes, reviews, and recommendations.',
+  manage_google_business_review: 'Suggest text replies, publish owner replies, or delete owner replies to Google Business reviews using the action selector. Suggestions do not publish a reply.',
+  list_google_business_media: 'Read existing photos and videos in connected Google Business Profile galleries.',
+  manage_google_business_media: 'Add an existing photo or video to a Google Business gallery, or delete a gallery item using the action selector.',
+  list_conversations: 'List Instagram or Facebook Page inbox conversations, or read one conversation using the view selector. Requires a Pro plan and posts:read.',
+  manage_conversation: 'Reply to an Instagram or Facebook Page inbox conversation, or synchronize supported social inbox data using the action selector. Requires a Pro plan and posts:write.',
+  list_comments: 'List Instagram, Facebook Page, Threads, or LinkedIn Page comments, or read one comment using the view selector. Requires a Pro plan and posts:read.',
+  manage_comment: 'Reply to, hide, unhide, mark, or delete a social inbox comment using the action selector. Platform limitations apply. Requires a Pro plan and posts:write.',
+  list_activity: 'Read recent post activity, status changes, publish attempts, failures, and retries.',
+  list_webhooks: 'Read webhook subscriptions, event filters, destinations, and recent delivery status.',
+  create_webhook: 'Create a webhook subscription for post, account, or analytics events and return its signing secret once.',
+  manage_webhook: 'Update or delete a webhook subscription, or send a signed test event using the action selector.',
+  get_credits: 'Read the workspace AI credit balance, included allowance, purchased balance, and next reset time. Does not buy or spend credits.',
+  get_subscription: 'Read subscription status, tier, current period, trial end, cancellation-at-period-end, and pause state. Does not change billing.',
+  get_updates: 'Read recent posterly product updates.',
+}
+
+export const CLAUDE_DIRECTORY_INSTRUCTIONS = 'posterly provides social account discovery, existing-media uploads, social post validation and publication, analytics, and inbox management. AI image, video, and audio generation and billing mutations are unavailable in this directory profile. Public and destructive actions use the existing preview and confirmation contract.'
+
+export function isClaudeDirectoryTool(name: string): boolean {
+  return Object.hasOwn(descriptions, name)
+}
+
+export function claudeDirectoryDescription(name: string): string {
+  const description = descriptions[name]
+  if (!description) throw new Error(`Tool is unavailable in the Claude directory profile: ${name}`)
+  return description
+}
+
+/** Keep validation constraints but omit prose referring to other tools or model behavior. */
+export function claudeDirectorySchema<T>(schema: T): T {
+  const copy = structuredClone(schema)
+  function visit(value: unknown): void {
+    if (Array.isArray(value)) value.forEach(visit)
+    else if (value && typeof value === 'object') {
+      const object = value as Record<string, unknown>
+      if (typeof object.description === 'string') delete object.description
+      for (const key of ['properties', 'patternProperties', 'definitions', '$defs', 'dependentSchemas']) {
+        const schemas = object[key]
+        if (schemas && typeof schemas === 'object' && !Array.isArray(schemas)) Object.values(schemas).forEach(visit)
+      }
+      for (const key of ['items', 'additionalProperties', 'additionalItems', 'contains', 'not', 'if', 'then', 'else', 'propertyNames', 'unevaluatedProperties', 'unevaluatedItems', 'allOf', 'oneOf', 'anyOf', 'prefixItems']) visit(object[key])
+    }
+  }
+  visit(copy)
+  return copy
+}

package/src/lib/version.ts

@@ -5,4 +5,4 @@
 // tool set (minus the intentional pre-auth signup tools that only this stdio
 // package exposes). `npm run check:mcp-parity` enforces both the version match
 // and the tool-list match, and runs in the pre-commit hook.
-export const POSTERLY_MCP_VERSION = '0.50.2';
+export const POSTERLY_MCP_VERSION = '0.50.4';

package/tool-registry.json

@@ -855,7 +855,7 @@
           "label": "Pause, resume, schedule, or move to draft",
           "destructive": true,
           "idempotent": true,
-          "openWorld": false,
+          "openWorld": true,
           "confirm": "confirm",
           "when": [
             "status"