posterly-mcp-server 0.50.4 → 0.50.5

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Grassroots Marketing LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -25,7 +25,7 @@ Posterly also exposes the same authenticated toolset over HTTP at [poster.ly/mcp
 - Agent reference: `https://www.poster.ly/llms-full.txt`
 - Signup and API-key acquisition: `https://www.poster.ly/agents/signup`
 - Smithery: `https://smithery.ai/servers/awpthorp/posterly`
-- Source: `https://github.com/awpthorp/posterly/tree/main/mcp-server`
+- Source: `https://github.com/awpthorp/posterly-mcp-server`
 
 The official MCP Registry metadata is in `server.json`. Its canonical registry
 name is `io.github.awpthorp/posterly`, matching this package's `mcpName`.
@@ -123,7 +123,7 @@ Add the same server definition to your Cursor MCP settings:
 
 ## Available tools
 
-`posterly-mcp-server@0.50.4` exposes 64 tools covering 100 actions. The hosted HTTP endpoint exposes the same catalog minus the three signup tools: 61 tools covering 97 actions.
+`posterly-mcp-server@0.50.5` exposes 64 tools covering 100 actions. The hosted HTTP endpoint exposes the same catalog minus the three signup tools: 61 tools covering 97 actions.
 
 Many tools pick what to do with one parameter: `view` (reads), `action` (writes), or `type`. A few pick their mode from which parameters you pass (for example `update_post` with `status` changes the status instead of editing). Every tool description names all of its views and actions.
 

package/dist/lib/version.d.ts

@@ -1 +1 @@
-export declare const POSTERLY_MCP_VERSION = "0.50.4";
+export declare const POSTERLY_MCP_VERSION = "0.50.5";

package/dist/lib/version.js

@@ -5,4 +5,4 @@
 // tool set (minus the intentional pre-auth signup tools that only this stdio
 // package exposes). `npm run check:mcp-parity` enforces both the version match
 // and the tool-list match, and runs in the pre-commit hook.
-export const POSTERLY_MCP_VERSION = '0.50.4';
+export const POSTERLY_MCP_VERSION = '0.50.5';

package/package.json

@@ -1,17 +1,16 @@
 {
   "name": "posterly-mcp-server",
-  "version": "0.50.4",
+  "version": "0.50.5",
   "mcpName": "io.github.awpthorp/posterly",
   "description": "MCP server for posterly: schedule and publish social media posts across 18 platforms from any MCP client (Claude, ChatGPT, Cursor, Windsurf, Cline, and more)",
   "license": "MIT",
   "homepage": "https://www.poster.ly/mcp",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/awpthorp/posterly.git",
-    "directory": "mcp-server"
+    "url": "git+https://github.com/awpthorp/posterly-mcp-server.git"
   },
   "bugs": {
-    "url": "https://github.com/awpthorp/posterly/issues"
+    "url": "https://github.com/awpthorp/posterly-mcp-server/issues"
   },
   "keywords": [
     "mcp",
@@ -28,6 +27,14 @@
     "posterly-mcp": "dist/index.js"
   },
   "main": "./dist/index.js",
+  "files": [
+    "dist",
+    "tool-registry.json",
+    "tool-annotations.json",
+    "server.json",
+    "README.md",
+    "LICENSE"
+  ],
   "scripts": {
     "build": "tsc",
     "dev": "tsc --watch",

package/server.json

@@ -3,18 +3,17 @@
   "name": "io.github.awpthorp/posterly",
   "title": "posterly",
   "description": "Validate, schedule, publish, and analyze social content across 18 platforms with posterly.",
-  "version": "0.50.4",
+  "version": "0.50.5",
   "websiteUrl": "https://www.poster.ly/mcp",
   "repository": {
-    "url": "https://github.com/awpthorp/posterly",
-    "source": "github",
-    "subfolder": "mcp-server"
+    "url": "https://github.com/awpthorp/posterly-mcp-server",
+    "source": "github"
   },
   "packages": [
     {
       "registryType": "npm",
       "identifier": "posterly-mcp-server",
-      "version": "0.50.4",
+      "version": "0.50.5",
       "transport": {
         "type": "stdio"
       },

package/RELEASING.md

@@ -1,115 +0,0 @@
-# Releasing the MCP surfaces
-
-posterly has two MCP surfaces sharing one version namespace:
-
-| Surface | Where it lives | How it reaches users |
-| --- | --- | --- |
-| Hosted HTTP | `lib/mcp/` → `POST /api/mcp` | **Automatically**, with the Vercel deploy of `main` |
-| npm stdio | `mcp-server/src/` → `posterly-mcp-server` | **Only when someone runs `npm publish`** |
-
-That asymmetry is the whole reason this file exists.
-
-## The failure this prevents
-
-The docs tell users to install with `npx -y posterly-mcp-server@latest`, so most
-MCP traffic is the npm package. The package is a thin client over `/api/v1/*`,
-which makes it tempting to assume a server-side fix reaches everyone. It does
-not. **The npm package does its own output formatting**, so anything the client
-renders itself stays broken until a publish:
-
-- tool output formatting (truncation, row caps, what columns are shown)
-- input schemas (new parameters like `limit` / `offset`)
-- tool descriptions and names
-
-This is not hypothetical. In Aug 2026 the Google Business review truncation was
-fixed server-side and merged. Hosted users got the fix on deploy. npm users kept
-seeing reviews clipped to ~180 characters, capped at 25 rows, with no dates —
-because that formatting lives in `mcp-server/src/tools/`. Only a publish fixed it.
-
-## Release order
-
-```
-change an MCP surface -> bump the version -> merge -> deploy -> npm publish
-```
-
-Bumping and publishing are separate steps with different failure modes:
-
-- **Skipping the bump is unrecoverable.** npm versions are immutable. Tool
-  changes merged under a version already on npm can never be delivered under
-  that version. `npm run check:mcp-version-bump` fails the build to prevent it.
-- **Skipping the publish is recoverable** — just publish. `npm run
-  check:mcp-published` tells you when one is outstanding.
-
-## 1. Bump the version
-
-The version appears in six places and `npm run check:mcp-parity` enforces that
-they all agree:
-
-- `lib/mcp/version.ts` — hosted endpoint
-- `mcp-server/src/lib/version.ts` — stdio package
-- `mcp-server/package.json`
-- `mcp-server/package-lock.json` (two entries)
-- `mcp-server/server.json` (two entries)
-- `mcp-server/README.md` — the `posterly-mcp-server@X.Y.Z exposes N tools` line
-
-Then rebuild so the compiled output matches, since the parity check reads
-`mcp-server/dist/lib/version.js` too:
-
-```bash
-npm --prefix mcp-server run build
-npm run check:mcp-parity
-```
-
-Use a patch bump for tool fixes and additive schema changes; a minor bump for
-new tools or a changed tool surface.
-
-## 2. Merge and deploy
-
-Land the PR and let `main` deploy. The hosted endpoint is live at this point;
-npm users are not.
-
-## 3. Publish
-
-```bash
-cd mcp-server
-npm whoami          # must be an account that can publish posterly-mcp-server
-npm publish         # add --otp=<code> if 2FA prompts
-```
-
-`prepack` rebuilds `dist/` and re-runs the parity check before packing, so a
-stale build or a drifted version cannot ship. `dist/` is gitignored but is
-included in the tarball — `prepack` is what puts it there.
-
-Sanity-check the tarball first if you want:
-
-```bash
-npm pack --dry-run
-```
-
-## 4. Verify
-
-```bash
-npm view posterly-mcp-server version dist-tags
-npm run check:mcp-published
-```
-
-Both should report the version you just published. Users on `@latest` pick it
-up on their next client restart; there is nothing for them to do.
-
-## If you published something broken
-
-Do not `npm unpublish` and do not republish the same number — npm versions are
-immutable and unpublishing breaks anyone who already resolved it. Cut the next
-patch version and publish that.
-
-
-## Publishing from GitHub (trusted publishing)
-
-npm now requires 2FA or a trusted publisher to publish. The repo has a manual
-workflow, `.github/workflows/publish-mcp.yml` ("Publish MCP"), that publishes
-`mcp-server/` with GitHub OIDC, so no npm token or one-time code is needed.
-One-time setup on npmjs.com: package `posterly-mcp-server` > Settings >
-Trusted Publisher > GitHub Actions, owner `awpthorp`, repository `posterly`,
-workflow `publish-mcp.yml`. After an MCP change merges and deploys, run it from
-the Actions tab (or `gh workflow run publish-mcp.yml`), then
-`npm run check:mcp-published`. It skips if the version is already on npm.

package/SUBMISSIONS.md

@@ -1,109 +0,0 @@
-# MCP connector submissions
-
-Notes for listing the hosted MCP server as a one-click connector. The pipework
-(hosted HTTP MCP + stdio MCP) already works with API keys. Dynamic Client
-Registration and refresh-token rotation are what Claude.ai / ChatGPT-style hosts
-need for a connect flow without a human-allowlisted `client_id`.
-
-Do not publish these notes as user-facing marketing copy. They are for the
-person who applies the production migration and files the directory forms.
-
-## Preconditions
-
-1. Apply the DCR / refresh-token migration
-   (`supabase/migrations/20260906140000_oauth_dynamic_registration_and_refresh.sql`)
-   **before or with** the production deploy, not after. Shipping the app first
-   leaves `oauth_refresh_tokens` missing: the token endpoint then falls back to
-   a 365-day access-only grant for dynamic clients, and DCR verification that
-   expects refresh tokens will fail. Do not apply the SQL from an agent session
-   that can write straight to prod.
-2. Confirm `NEXT_PUBLIC_SITE_URL` is `https://www.poster.ly` in the production
-   deploy so discovery documents advertise the right issuer.
-3. Create a reviewer test account with the API add-on enabled, plus a short
-   setup note they can follow.
-4. Confirm discovery before submitting:
-   - `GET /.well-known/oauth-authorization-server` includes
-     `registration_endpoint` and `refresh_token` in `grant_types_supported`
-   - `POST /api/oauth/register` returns `201` with a `dyn_` `client_id`
-   - consent shows the self-registered warning, callback host, and `client_id`
-     for that client
-   - refresh-token reuse within 30 seconds returns `invalid_grant` without
-     revoking the chain; reuse older than 30 seconds revokes the chain
-   - `/api/mcp` returns `403` `origin_not_allowed` for an untrusted Origin
-   - `tools/list` includes annotations on every tool
-
-## Anthropic Connectors Directory
-
-This is the remote MCP connector listing (Claude.ai / Claude desktop
-connectors). It is distinct from the Claude Code plugin already pending review.
-
-Submit the remote MCP server at
-https://claude.ai/admin-settings/directory/submissions/new or
-https://clau.de/mcp-directory-submission.
-
-Fallback contact: mcp-review@anthropic.com.
-
-Use:
-
-- Server URL: `https://www.poster.ly/api/mcp`
-- Server card: `https://www.poster.ly/.well-known/mcp/server-card.json`
-- Docs: `https://www.poster.ly/mcp` and `https://www.poster.ly/agents`
-  (public pages only; do not submit auth-gated `https://www.poster.ly/docs/...`
-  URLs)
-- Auth: OAuth 2.1 + PKCE, RFC 7591 Dynamic Client Registration, rotating
-  refresh tokens (1-hour access, 30-day refresh for DCR clients)
-- Platforms: all 18 production platforms
-
-Connectors Connect (the in-product connect form) uses a Client ID Metadata
-Document, not DCR, for this flow:
-
-- `client_id`: `https://claude.ai/oauth/mcp-oauth-client-metadata`
-- `redirect_uri`: `https://claude.ai/api/mcp/auth_callback`
-
-DCR at `POST /api/oauth/register` remains available for other hosts. It is
-not what Claude Connectors uses for Connect.
-
-Do not claim Autopilot ships. Do not claim the connector is already listed.
-
-Optional after deploy: bump and publish `posterly-mcp-server` if you want the
-stdio README changes on npm. Hosted `/api/mcp` picks up this repo deploy
-without an npm publish.
-
-## ChatGPT / OpenAI Plugins Directory
-
-This is a different form from the Claude plugin directory (already submitted)
-and from the Anthropic Connectors Directory above. File it after the OAuth DCR
-deploy is live. An agent cannot submit the form: Alex must complete OpenAI org
-verification / Apps Management write access.
-
-Portal: https://platform.openai.com/plugins
-
-Use:
-
-- MCP URL: `https://www.poster.ly/api/mcp`
-- Auth: OAuth 2.1 + PKCE + DCR at `POST /api/oauth/register` (now live on prod)
-- Domain verification: set `OPENAI_APPS_CHALLENGE_TOKEN` in Vercel to the
-  portal token, deploy, then Scan Tools. OpenAI fetches
-  `https://www.poster.ly/.well-known/openai-apps-challenge` and expects the
-  exact token as `text/plain` (no JSON).
-- Homepage: `https://www.poster.ly/agents`
-- Privacy: `https://www.poster.ly/privacy`
-- Terms: `https://www.poster.ly/terms`
-- Support: `https://www.poster.ly/dashboard/support` (or `/agents`)
-
-Do not claim the plugin is listed until OpenAI publishes it.
-
-## Other hosted hosts
-
-ChatGPT-style hosts follow the same DCR + authorize + token flow. HTTPS
-callbacks such as `https://chatgpt.com/oauth/callback` are already accepted by
-the redirect URI validator. Extra browser origins can be added with
-`MCP_TRUSTED_ORIGINS` (comma-separated hostnames or full URLs).
-
-The ChatGPT plugin / app directory form is covered in the section above.
-
-## Registry metadata
-
-`server.json` is the official MCP Registry metadata for the stdio package
-(`io.github.awpthorp/posterly`). Publishing that package is a separate release
-step. See `RELEASING.md`.