posterly-mcp-server 0.50.3 → 0.50.5

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Grassroots Marketing LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -25,7 +25,7 @@ Posterly also exposes the same authenticated toolset over HTTP at [poster.ly/mcp
 - Agent reference: `https://www.poster.ly/llms-full.txt`
 - Signup and API-key acquisition: `https://www.poster.ly/agents/signup`
 - Smithery: `https://smithery.ai/servers/awpthorp/posterly`
-- Source: `https://github.com/awpthorp/posterly/tree/main/mcp-server`
+- Source: `https://github.com/awpthorp/posterly-mcp-server`
 
 The official MCP Registry metadata is in `server.json`. Its canonical registry
 name is `io.github.awpthorp/posterly`, matching this package's `mcpName`.
@@ -123,7 +123,7 @@ Add the same server definition to your Cursor MCP settings:
 
 ## Available tools
 
-`posterly-mcp-server@0.50.3` exposes 64 tools covering 100 actions. The hosted HTTP endpoint exposes the same catalog minus the three signup tools: 61 tools covering 97 actions.
+`posterly-mcp-server@0.50.5` exposes 64 tools covering 100 actions. The hosted HTTP endpoint exposes the same catalog minus the three signup tools: 61 tools covering 97 actions.
 
 Many tools pick what to do with one parameter: `view` (reads), `action` (writes), or `type`. A few pick their mode from which parameters you pass (for example `update_post` with `status` changes the status instead of editing). Every tool description names all of its views and actions.
 
@@ -532,3 +532,11 @@ The package reads:
 - optional `POSTERLY_API_KEY` for authenticated posterly tools
 - optional `POSTERLY_URL` if you need to point at a non-production environment
 - optional `POSTERLY_TOOLSETS` (for example `core,inbox`) to list fewer tool sets
+
+## Claude directory profile
+
+The optional directory profile provides 52 tools over HTTP or 55 tools over local stdio for social publishing, existing-media uploads, analytics, and inbox work. AI image and video generation, generation-job helpers, billing mutations, and legacy tool aliases are unavailable in this profile. Text caption suggestions and read-only subscription information remain available. Tool descriptions are functional summaries; input schemas retain their validation constraints.
+
+Hosted endpoint: `https://www.poster.ly/api/mcp?profile=claude`. For local stdio, set `POSTERLY_DIRECTORY_PROFILE=claude` alongside the existing API key. The default catalogs remain 61 hosted tools and 64 local tools. This profile does not grant authorization, bypass scopes, or change the existing preview and confirmation checks.
+
+Directory approval remains Anthropic's decision. This profile addresses the generation and financial-transaction restrictions in the [Anthropic Software Directory Policy](https://support.claude.com/en/articles/13145358-anthropic-software-directory-policy).

package/dist/index.js

@@ -5,6 +5,7 @@ import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
 import { PosterlyClient, setMcpClientNameResolver } from './lib/api-client.js';
 import { POSTERLY_MCP_VERSION } from './lib/version.js';
 import { getToolAnnotations } from './lib/tool-annotations.js';
+import { CLAUDE_DIRECTORY_INSTRUCTIONS, isClaudeDirectoryTool } from './lib/claude-directory-profile.js';
 import { McpError, ErrorCode } from '@modelcontextprotocol/sdk/types.js';
 import { AliasTransport } from './lib/alias-transport.js';
 import { StdioPreviewTokens } from './lib/preview-token.js';
@@ -148,6 +149,10 @@ const STDIO_TOOLS = [
 // tool-annotations.json; dist/index.js reads it from one level up.
 const require = createRequire(import.meta.url);
 const registry = require('../tool-registry.json');
+const directoryProfile = process.env.POSTERLY_DIRECTORY_PROFILE;
+if (directoryProfile && directoryProfile !== 'claude')
+    throw new Error('Unknown posterly directory profile');
+const claudeDirectoryProfile = directoryProfile === 'claude';
 /**
  * Tool sets to list (POSTERLY_TOOLSETS env or --toolsets=core,inbox). Default
  * is every set, so nobody loses tools. Signup tools are always listed. Sets
@@ -169,7 +174,7 @@ const server = new McpServer({
 }, {
     // Which tool sets exist, that every set is on by default, how to load
     // fewer, and how preview then confirm works (built from the registry).
-    instructions: toolsetInstructions(registry, 'stdio'),
+    instructions: claudeDirectoryProfile ? CLAUDE_DIRECTORY_INSTRUCTIONS : toolsetInstructions(registry, 'stdio'),
 });
 const client = new PosterlyClient();
 // The SDK only learns the connected client's identity (e.g. "claude-ai",
@@ -201,7 +206,7 @@ const legacyValidator = (aliasName, args) => {
 // Renamed tools (aliases) are never registered with McpServer: the transport
 // rewrites an alias call onto its target before the SDK sees it, and handlers
 // read the called name back through getCallInfo(extra.requestId).
-const transport = new AliasTransport(new StdioServerTransport(), registry, toolsets.all ? null : visibleTools(registry, toolsets.enabled, 'stdio'), legacyValidator);
+const transport = new AliasTransport(new StdioServerTransport(), registry, toolsets.all ? null : visibleTools(registry, toolsets.enabled, 'stdio'), legacyValidator, claudeDirectoryProfile);
 // Preview then confirm tokens: a random key and an in-memory one-time-use
 // set per process (UX protection only; REST authorization is unchanged).
 const previews = new StdioPreviewTokens();
@@ -230,7 +235,7 @@ function registerAll(tools) {
         });
     }
 }
-registerAll(STDIO_TOOLS);
+registerAll(claudeDirectoryProfile ? STDIO_TOOLS.filter((tool) => isClaudeDirectoryTool(tool.name)) : STDIO_TOOLS);
 // Start the server
 async function main() {
     await server.connect(transport);

package/dist/lib/alias-transport.d.ts

@@ -58,6 +58,7 @@ export declare class AliasTransport implements Transport {
     private readonly registry;
     private readonly visibleTools;
     private readonly legacyValidator;
+    private readonly claudeDirectoryProfile;
     onclose?: () => void;
     onerror?: (error: Error) => void;
     onmessage?: <T extends JSONRPCMessage>(message: T, extra?: MessageExtraInfo) => void;
@@ -68,7 +69,7 @@ export declare class AliasTransport implements Transport {
      * @param visibleTools names to list in tools/list, or null to list every
      *   registered tool unchanged (the default: every set).
      */
-    constructor(inner: Transport, registry: ToolRegistry, visibleTools?: Set<string> | null, legacyValidator?: LegacyAliasValidator | null);
+    constructor(inner: Transport, registry: ToolRegistry, visibleTools?: Set<string> | null, legacyValidator?: LegacyAliasValidator | null, claudeDirectoryProfile?: boolean);
     get sessionId(): string | undefined;
     setProtocolVersion(version: string): void;
     start(): Promise<void>;

package/dist/lib/alias-transport.js

@@ -29,6 +29,7 @@
  *
  * Only the public Transport interface is used; no SDK private fields.
  */
+import { claudeDirectoryDescription, claudeDirectorySchema, isClaudeDirectoryTool } from './claude-directory-profile.js';
 import { DEPRECATION_META_KEY, deprecationNote, resolveAlias, translateArgs, validateMode, } from './tool-registry.js';
 function requestKey(id) {
     return `${typeof id}:${String(id)}`;
@@ -41,6 +42,7 @@ export class AliasTransport {
     registry;
     visibleTools;
     legacyValidator;
+    claudeDirectoryProfile;
     onclose;
     onerror;
     onmessage;
@@ -51,11 +53,12 @@ export class AliasTransport {
      * @param visibleTools names to list in tools/list, or null to list every
      *   registered tool unchanged (the default: every set).
      */
-    constructor(inner, registry, visibleTools = null, legacyValidator = null) {
+    constructor(inner, registry, visibleTools = null, legacyValidator = null, claudeDirectoryProfile = false) {
         this.inner = inner;
         this.registry = registry;
         this.visibleTools = visibleTools;
         this.legacyValidator = legacyValidator;
+        this.claudeDirectoryProfile = claudeDirectoryProfile;
         inner.onmessage = (message, extra) => this.handleIncoming(message, extra);
         inner.onclose = () => this.onclose?.();
         inner.onerror = (error) => this.onerror?.(error);
@@ -95,7 +98,7 @@ export class AliasTransport {
             this.onmessage?.(message, extra);
             return;
         }
-        if (request.method === 'tools/list' && this.visibleTools && request.id !== undefined && request.id !== null) {
+        if (request.method === 'tools/list' && (this.visibleTools || this.claudeDirectoryProfile) && request.id !== undefined && request.id !== null) {
             this.listRequests.add(requestKey(request.id));
             this.onmessage?.(message, extra);
             return;
@@ -105,6 +108,12 @@ export class AliasTransport {
             return;
         }
         const name = request.params.name;
+        if (this.claudeDirectoryProfile && (typeof name !== 'string' || !isClaudeDirectoryTool(name))) {
+            // Omitted tools and legacy aliases reach the SDK unchanged and fail as
+            // unregistered names, rather than being rewritten into callable tools.
+            this.onmessage?.(message, extra);
+            return;
+        }
         const alias = typeof name === 'string' ? resolveAlias(this.registry, name) : null;
         if (!alias) {
             this.onmessage?.(message, extra);
@@ -150,7 +159,7 @@ export class AliasTransport {
     }
     filterToolsList(message) {
         const response = message;
-        if (!this.visibleTools || response.method !== undefined || response.id === undefined || response.id === null)
+        if ((!this.visibleTools && !this.claudeDirectoryProfile) || response.method !== undefined || response.id === undefined || response.id === null)
             return message;
         const key = requestKey(response.id);
         if (!this.listRequests.has(key))
@@ -163,7 +172,11 @@ export class AliasTransport {
             ...message,
             result: {
                 ...response.result,
-                tools: response.result.tools.filter((tool) => typeof tool?.name === 'string' && visible.has(tool.name)),
+                tools: response.result.tools
+                    .filter((tool) => typeof tool?.name === 'string' && (!visible || visible.has(tool.name)) && (!this.claudeDirectoryProfile || isClaudeDirectoryTool(tool.name)))
+                    .map((tool) => this.claudeDirectoryProfile ? {
+                    ...tool, description: claudeDirectoryDescription(tool.name), inputSchema: claudeDirectorySchema(tool.inputSchema),
+                } : tool),
             },
         };
         return filtered;

package/dist/lib/claude-directory-profile.d.ts

@@ -0,0 +1,5 @@
+export declare const CLAUDE_DIRECTORY_INSTRUCTIONS = "posterly provides social account discovery, existing-media uploads, social post validation and publication, analytics, and inbox management. AI image, video, and audio generation and billing mutations are unavailable in this directory profile. Public and destructive actions use the existing preview and confirmation contract.";
+export declare function isClaudeDirectoryTool(name: string): boolean;
+export declare function claudeDirectoryDescription(name: string): string;
+/** Keep validation constraints but omit prose referring to other tools or model behavior. */
+export declare function claudeDirectorySchema<T>(schema: T): T;

package/dist/lib/claude-directory-profile.js

@@ -0,0 +1,95 @@
+/**
+ * Opt-in catalog for the Anthropic Software Directory. Both MCP transports
+ * use this explicit allowlist; omitted tools are unavailable, including aliases.
+ * REST authorization and preview confirmation still apply to every operation.
+ * Policy: https://support.claude.com/en/articles/13145358
+ */
+const descriptions = {
+    get_agent_signup_info: 'Return posterly signup requirements and the human signup link.',
+    start_signup: 'Create a short-lived signup session with a browser link for human completion. This operation does not take payment.',
+    get_signup_session: 'Read the completion status of a signup session.',
+    whoami: 'Return connection status or the authenticated user, scopes, and accessible workspaces.',
+    create_api_key: 'Create a scoped posterly API key for the authenticated user. The new key cannot exceed the caller key permissions.',
+    delete_api_key: 'Revoke an API key owned by the authenticated user. The current authentication key and managed OAuth keys cannot be revoked here.',
+    list_workspace_members: 'List workspace members, pending invites, roles, brand access, API access, and occupied seats.',
+    manage_workspace_member: 'Invite, update, or remove a workspace colleague using the action selector. Workspace administrator permissions and existing seat limits apply.',
+    list_publishing_pauses: 'Read workspace and brand publishing pauses and the caller permissions to manage them.',
+    manage_publishing_pause: 'Pause or resume workspace or brand publishing using the action selector. Resume can keep missed posts paused or publish them.',
+    list_accounts: 'List connected social accounts, or read account brand profiles, learned voice, performance profiles, and connection-session status using the view selector.',
+    disconnect_account: 'Disconnect a social account, removing its connection and affecting its scheduled posts.',
+    connect_account: 'Connect a credential-based Telegram, Bluesky, Discord, WordPress, Dev.to, Hashnode, or Lemmy account.',
+    create_connect_session: 'Create a short-lived browser handoff session for a human to connect a social account.',
+    list_oauth_clients: 'List self-serve OAuth developer clients owned by the authenticated user.',
+    manage_oauth_client: 'Create, update, or delete a public OAuth 2.1 developer client using the action selector. Client secrets are not created.',
+    list_platforms: 'List supported platforms, read platform or account settings schemas, or return browser connection links using the view selector.',
+    trigger_platform_helper: 'Read account-specific platform discovery data: Pinterest boards, TikTok creator information, LinkedIn recent mentions, or X quota.',
+    list_brands: 'List accessible brands, read one brand, or list its social accounts using the view selector.',
+    list_post_suggestions: 'List suggested social post drafts, their performance rationale, and their scheduling status.',
+    dismiss_suggestion: 'Dismiss a pending post suggestion. Suggestions already converted into posts are unchanged.',
+    list_posts: 'List social posts accessible to the caller, filtered by account, brand, workspace, platform, status, or approval state.',
+    get_post: 'Read one social post and its current content, media, platform settings, and publication status.',
+    ask_support: 'Answer a posterly support question with documentation and read-only workspace diagnostics. A continued support conversation can request a human ticket with explicit escalation confirmation.',
+    find_available_slot: 'Find available posting times with a one-hour spacing rule, preferred hours, and an explicit timezone.',
+    submit_agent_feedback: 'Record private operational feedback about a completed posterly workflow. Content and credentials are not accepted as telemetry.',
+    submit_product_feedback: 'Submit a confirmed title, category, and description to the public posterly feedback board.',
+    validate_post: 'Validate and normalize proposed post content without saving, uploading, scheduling, or publishing it.',
+    create_post: 'Create one scheduled or immediate social post. Omitting scheduled_at requests immediate publication. The operation creates content on the selected connected social account.',
+    create_posts_batch: 'Create one to 25 scheduled or immediate social posts. Partial success is possible and failed items retain their input index.',
+    update_post: 'Edit a draft or scheduled post, change its status, assign release and group identifiers, or manage client approval using the action selector. Published posts cannot be edited.',
+    delete_post: 'Delete one draft or scheduled post, or all eligible posts in a selected group using the action selector. Published posts cannot be deleted.',
+    get_x_posting_quota: 'Read managed X posting usage, quota, remaining posts, URL restrictions, and existing add-on information.',
+    upload_media: 'Upload an existing image or video to posterly storage from a file, base64 content, or a public HTTPS URL. Returns a reusable media URL and does not publish content.',
+    create_signed_upload: 'Create a signed storage upload URL for an existing large image or video.',
+    create_media_drop: 'Create a short-lived browser page for a human to upload existing media without a dashboard login.',
+    list_media: 'List uploaded media assets or files uploaded to a selected media-drop session.',
+    generate_captions: 'Generate or adapt text caption suggestions for social platforms. Uses the caption allowance and does not create or publish posts.',
+    list_analytics: 'Read account analytics, post analytics, post feedback insights, or missing-post requirements using the view selector.',
+    list_google_business_reviews: 'Read Google Business Profile reviews or the public review link using the view selector.',
+    audit_google_business_profile: 'Read and audit a connected Google Business Profile location: completeness, categories, media, attributes, reviews, and recommendations.',
+    manage_google_business_review: 'Suggest text replies, publish owner replies, or delete owner replies to Google Business reviews using the action selector. Suggestions do not publish a reply.',
+    list_google_business_media: 'Read existing photos and videos in connected Google Business Profile galleries.',
+    manage_google_business_media: 'Add an existing photo or video to a Google Business gallery, or delete a gallery item using the action selector.',
+    list_conversations: 'List Instagram or Facebook Page inbox conversations, or read one conversation using the view selector. Requires a Pro plan and posts:read.',
+    manage_conversation: 'Reply to an Instagram or Facebook Page inbox conversation, or synchronize supported social inbox data using the action selector. Requires a Pro plan and posts:write.',
+    list_comments: 'List Instagram, Facebook Page, Threads, or LinkedIn Page comments, or read one comment using the view selector. Requires a Pro plan and posts:read.',
+    manage_comment: 'Reply to, hide, unhide, mark, or delete a social inbox comment using the action selector. Platform limitations apply. Requires a Pro plan and posts:write.',
+    list_activity: 'Read recent post activity, status changes, publish attempts, failures, and retries.',
+    list_webhooks: 'Read webhook subscriptions, event filters, destinations, and recent delivery status.',
+    create_webhook: 'Create a webhook subscription for post, account, or analytics events and return its signing secret once.',
+    manage_webhook: 'Update or delete a webhook subscription, or send a signed test event using the action selector.',
+    get_credits: 'Read the workspace AI credit balance, included allowance, purchased balance, and next reset time. Does not buy or spend credits.',
+    get_subscription: 'Read subscription status, tier, current period, trial end, cancellation-at-period-end, and pause state. Does not change billing.',
+    get_updates: 'Read recent posterly product updates.',
+};
+export const CLAUDE_DIRECTORY_INSTRUCTIONS = 'posterly provides social account discovery, existing-media uploads, social post validation and publication, analytics, and inbox management. AI image, video, and audio generation and billing mutations are unavailable in this directory profile. Public and destructive actions use the existing preview and confirmation contract.';
+export function isClaudeDirectoryTool(name) {
+    return Object.hasOwn(descriptions, name);
+}
+export function claudeDirectoryDescription(name) {
+    const description = descriptions[name];
+    if (!description)
+        throw new Error(`Tool is unavailable in the Claude directory profile: ${name}`);
+    return description;
+}
+/** Keep validation constraints but omit prose referring to other tools or model behavior. */
+export function claudeDirectorySchema(schema) {
+    const copy = structuredClone(schema);
+    function visit(value) {
+        if (Array.isArray(value))
+            value.forEach(visit);
+        else if (value && typeof value === 'object') {
+            const object = value;
+            if (typeof object.description === 'string')
+                delete object.description;
+            for (const key of ['properties', 'patternProperties', 'definitions', '$defs', 'dependentSchemas']) {
+                const schemas = object[key];
+                if (schemas && typeof schemas === 'object' && !Array.isArray(schemas))
+                    Object.values(schemas).forEach(visit);
+            }
+            for (const key of ['items', 'additionalProperties', 'additionalItems', 'contains', 'not', 'if', 'then', 'else', 'propertyNames', 'unevaluatedProperties', 'unevaluatedItems', 'allOf', 'oneOf', 'anyOf', 'prefixItems'])
+                visit(object[key]);
+        }
+    }
+    visit(copy);
+    return copy;
+}

package/dist/lib/version.d.ts

@@ -1 +1 @@
-export declare const POSTERLY_MCP_VERSION = "0.50.3";
+export declare const POSTERLY_MCP_VERSION = "0.50.5";

package/dist/lib/version.js

@@ -5,4 +5,4 @@
 // tool set (minus the intentional pre-auth signup tools that only this stdio
 // package exposes). `npm run check:mcp-parity` enforces both the version match
 // and the tool-list match, and runs in the pre-commit hook.
-export const POSTERLY_MCP_VERSION = '0.50.3';
+export const POSTERLY_MCP_VERSION = '0.50.5';

package/package.json

@@ -1,17 +1,16 @@
 {
   "name": "posterly-mcp-server",
-  "version": "0.50.3",
+  "version": "0.50.5",
   "mcpName": "io.github.awpthorp/posterly",
   "description": "MCP server for posterly: schedule and publish social media posts across 18 platforms from any MCP client (Claude, ChatGPT, Cursor, Windsurf, Cline, and more)",
   "license": "MIT",
   "homepage": "https://www.poster.ly/mcp",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/awpthorp/posterly.git",
-    "directory": "mcp-server"
+    "url": "git+https://github.com/awpthorp/posterly-mcp-server.git"
   },
   "bugs": {
-    "url": "https://github.com/awpthorp/posterly/issues"
+    "url": "https://github.com/awpthorp/posterly-mcp-server/issues"
   },
   "keywords": [
     "mcp",
@@ -28,6 +27,14 @@
     "posterly-mcp": "dist/index.js"
   },
   "main": "./dist/index.js",
+  "files": [
+    "dist",
+    "tool-registry.json",
+    "tool-annotations.json",
+    "server.json",
+    "README.md",
+    "LICENSE"
+  ],
   "scripts": {
     "build": "tsc",
     "dev": "tsc --watch",

package/server.json

@@ -3,18 +3,17 @@
   "name": "io.github.awpthorp/posterly",
   "title": "posterly",
   "description": "Validate, schedule, publish, and analyze social content across 18 platforms with posterly.",
-  "version": "0.50.3",
+  "version": "0.50.5",
   "websiteUrl": "https://www.poster.ly/mcp",
   "repository": {
-    "url": "https://github.com/awpthorp/posterly",
-    "source": "github",
-    "subfolder": "mcp-server"
+    "url": "https://github.com/awpthorp/posterly-mcp-server",
+    "source": "github"
   },
   "packages": [
     {
       "registryType": "npm",
       "identifier": "posterly-mcp-server",
-      "version": "0.50.3",
+      "version": "0.50.5",
       "transport": {
         "type": "stdio"
       },

package/RELEASING.md

@@ -1,115 +0,0 @@
-# Releasing the MCP surfaces
-
-posterly has two MCP surfaces sharing one version namespace:
-
-| Surface | Where it lives | How it reaches users |
-| --- | --- | --- |
-| Hosted HTTP | `lib/mcp/` → `POST /api/mcp` | **Automatically**, with the Vercel deploy of `main` |
-| npm stdio | `mcp-server/src/` → `posterly-mcp-server` | **Only when someone runs `npm publish`** |
-
-That asymmetry is the whole reason this file exists.
-
-## The failure this prevents
-
-The docs tell users to install with `npx -y posterly-mcp-server@latest`, so most
-MCP traffic is the npm package. The package is a thin client over `/api/v1/*`,
-which makes it tempting to assume a server-side fix reaches everyone. It does
-not. **The npm package does its own output formatting**, so anything the client
-renders itself stays broken until a publish:
-
-- tool output formatting (truncation, row caps, what columns are shown)
-- input schemas (new parameters like `limit` / `offset`)
-- tool descriptions and names
-
-This is not hypothetical. In Aug 2026 the Google Business review truncation was
-fixed server-side and merged. Hosted users got the fix on deploy. npm users kept
-seeing reviews clipped to ~180 characters, capped at 25 rows, with no dates —
-because that formatting lives in `mcp-server/src/tools/`. Only a publish fixed it.
-
-## Release order
-
-```
-change an MCP surface -> bump the version -> merge -> deploy -> npm publish
-```
-
-Bumping and publishing are separate steps with different failure modes:
-
-- **Skipping the bump is unrecoverable.** npm versions are immutable. Tool
-  changes merged under a version already on npm can never be delivered under
-  that version. `npm run check:mcp-version-bump` fails the build to prevent it.
-- **Skipping the publish is recoverable** — just publish. `npm run
-  check:mcp-published` tells you when one is outstanding.
-
-## 1. Bump the version
-
-The version appears in six places and `npm run check:mcp-parity` enforces that
-they all agree:
-
-- `lib/mcp/version.ts` — hosted endpoint
-- `mcp-server/src/lib/version.ts` — stdio package
-- `mcp-server/package.json`
-- `mcp-server/package-lock.json` (two entries)
-- `mcp-server/server.json` (two entries)
-- `mcp-server/README.md` — the `posterly-mcp-server@X.Y.Z exposes N tools` line
-
-Then rebuild so the compiled output matches, since the parity check reads
-`mcp-server/dist/lib/version.js` too:
-
-```bash
-npm --prefix mcp-server run build
-npm run check:mcp-parity
-```
-
-Use a patch bump for tool fixes and additive schema changes; a minor bump for
-new tools or a changed tool surface.
-
-## 2. Merge and deploy
-
-Land the PR and let `main` deploy. The hosted endpoint is live at this point;
-npm users are not.
-
-## 3. Publish
-
-```bash
-cd mcp-server
-npm whoami          # must be an account that can publish posterly-mcp-server
-npm publish         # add --otp=<code> if 2FA prompts
-```
-
-`prepack` rebuilds `dist/` and re-runs the parity check before packing, so a
-stale build or a drifted version cannot ship. `dist/` is gitignored but is
-included in the tarball — `prepack` is what puts it there.
-
-Sanity-check the tarball first if you want:
-
-```bash
-npm pack --dry-run
-```
-
-## 4. Verify
-
-```bash
-npm view posterly-mcp-server version dist-tags
-npm run check:mcp-published
-```
-
-Both should report the version you just published. Users on `@latest` pick it
-up on their next client restart; there is nothing for them to do.
-
-## If you published something broken
-
-Do not `npm unpublish` and do not republish the same number — npm versions are
-immutable and unpublishing breaks anyone who already resolved it. Cut the next
-patch version and publish that.
-
-
-## Publishing from GitHub (trusted publishing)
-
-npm now requires 2FA or a trusted publisher to publish. The repo has a manual
-workflow, `.github/workflows/publish-mcp.yml` ("Publish MCP"), that publishes
-`mcp-server/` with GitHub OIDC, so no npm token or one-time code is needed.
-One-time setup on npmjs.com: package `posterly-mcp-server` > Settings >
-Trusted Publisher > GitHub Actions, owner `awpthorp`, repository `posterly`,
-workflow `publish-mcp.yml`. After an MCP change merges and deploys, run it from
-the Actions tab (or `gh workflow run publish-mcp.yml`), then
-`npm run check:mcp-published`. It skips if the version is already on npm.

package/SUBMISSIONS.md

@@ -1,109 +0,0 @@
-# MCP connector submissions
-
-Notes for listing the hosted MCP server as a one-click connector. The pipework
-(hosted HTTP MCP + stdio MCP) already works with API keys. Dynamic Client
-Registration and refresh-token rotation are what Claude.ai / ChatGPT-style hosts
-need for a connect flow without a human-allowlisted `client_id`.
-
-Do not publish these notes as user-facing marketing copy. They are for the
-person who applies the production migration and files the directory forms.
-
-## Preconditions
-
-1. Apply the DCR / refresh-token migration
-   (`supabase/migrations/20260906140000_oauth_dynamic_registration_and_refresh.sql`)
-   **before or with** the production deploy, not after. Shipping the app first
-   leaves `oauth_refresh_tokens` missing: the token endpoint then falls back to
-   a 365-day access-only grant for dynamic clients, and DCR verification that
-   expects refresh tokens will fail. Do not apply the SQL from an agent session
-   that can write straight to prod.
-2. Confirm `NEXT_PUBLIC_SITE_URL` is `https://www.poster.ly` in the production
-   deploy so discovery documents advertise the right issuer.
-3. Create a reviewer test account with the API add-on enabled, plus a short
-   setup note they can follow.
-4. Confirm discovery before submitting:
-   - `GET /.well-known/oauth-authorization-server` includes
-     `registration_endpoint` and `refresh_token` in `grant_types_supported`
-   - `POST /api/oauth/register` returns `201` with a `dyn_` `client_id`
-   - consent shows the self-registered warning, callback host, and `client_id`
-     for that client
-   - refresh-token reuse within 30 seconds returns `invalid_grant` without
-     revoking the chain; reuse older than 30 seconds revokes the chain
-   - `/api/mcp` returns `403` `origin_not_allowed` for an untrusted Origin
-   - `tools/list` includes annotations on every tool
-
-## Anthropic Connectors Directory
-
-This is the remote MCP connector listing (Claude.ai / Claude desktop
-connectors). It is distinct from the Claude Code plugin already pending review.
-
-Submit the remote MCP server at
-https://claude.ai/admin-settings/directory/submissions/new or
-https://clau.de/mcp-directory-submission.
-
-Fallback contact: mcp-review@anthropic.com.
-
-Use:
-
-- Server URL: `https://www.poster.ly/api/mcp`
-- Server card: `https://www.poster.ly/.well-known/mcp/server-card.json`
-- Docs: `https://www.poster.ly/mcp` and `https://www.poster.ly/agents`
-  (public pages only; do not submit auth-gated `https://www.poster.ly/docs/...`
-  URLs)
-- Auth: OAuth 2.1 + PKCE, RFC 7591 Dynamic Client Registration, rotating
-  refresh tokens (1-hour access, 30-day refresh for DCR clients)
-- Platforms: all 18 production platforms
-
-Connectors Connect (the in-product connect form) uses a Client ID Metadata
-Document, not DCR, for this flow:
-
-- `client_id`: `https://claude.ai/oauth/mcp-oauth-client-metadata`
-- `redirect_uri`: `https://claude.ai/api/mcp/auth_callback`
-
-DCR at `POST /api/oauth/register` remains available for other hosts. It is
-not what Claude Connectors uses for Connect.
-
-Do not claim Autopilot ships. Do not claim the connector is already listed.
-
-Optional after deploy: bump and publish `posterly-mcp-server` if you want the
-stdio README changes on npm. Hosted `/api/mcp` picks up this repo deploy
-without an npm publish.
-
-## ChatGPT / OpenAI Plugins Directory
-
-This is a different form from the Claude plugin directory (already submitted)
-and from the Anthropic Connectors Directory above. File it after the OAuth DCR
-deploy is live. An agent cannot submit the form: Alex must complete OpenAI org
-verification / Apps Management write access.
-
-Portal: https://platform.openai.com/plugins
-
-Use:
-
-- MCP URL: `https://www.poster.ly/api/mcp`
-- Auth: OAuth 2.1 + PKCE + DCR at `POST /api/oauth/register` (now live on prod)
-- Domain verification: set `OPENAI_APPS_CHALLENGE_TOKEN` in Vercel to the
-  portal token, deploy, then Scan Tools. OpenAI fetches
-  `https://www.poster.ly/.well-known/openai-apps-challenge` and expects the
-  exact token as `text/plain` (no JSON).
-- Homepage: `https://www.poster.ly/agents`
-- Privacy: `https://www.poster.ly/privacy`
-- Terms: `https://www.poster.ly/terms`
-- Support: `https://www.poster.ly/dashboard/support` (or `/agents`)
-
-Do not claim the plugin is listed until OpenAI publishes it.
-
-## Other hosted hosts
-
-ChatGPT-style hosts follow the same DCR + authorize + token flow. HTTPS
-callbacks such as `https://chatgpt.com/oauth/callback` are already accepted by
-the redirect URI validator. Extra browser origins can be added with
-`MCP_TRUSTED_ORIGINS` (comma-separated hostnames or full URLs).
-
-The ChatGPT plugin / app directory form is covered in the section above.
-
-## Registry metadata
-
-`server.json` is the official MCP Registry metadata for the stdio package
-(`io.github.awpthorp/posterly`). Publishing that package is a separate release
-step. See `RELEASING.md`.