premiere-pro-mcp 1.9.2 → 1.10.0

package/CHANGELOG.md

@@ -6,6 +6,59 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.10.0] - 2026-08-16
+
+### Added
+
+- Added 21 consolidated, capability-gated UXP tools across two stable workflow
+  groups, expanding the connected surface from 297 to 318 tools while retaining
+  CEP as the production-compatible bridge.
+- Added native effects, selection batches, deterministic timeline selection,
+  scene detection, proxy and ingest control, offline relinking, transactional
+  metadata, color conformance, Source Monitor audition, Productions storage
+  preflight, and an operator-selected workspace broker.
+- Added project-panel selection, marker CRUD, bin organization, sequence settings,
+  workspace-gated imports, typed parameter and keyframe automation, track-item
+  transforms, SequenceEditor operations, sequence lifecycle controls, and Adobe
+  Media Encoder submission.
+
+### Changed
+
+- Bounded selection, project, marker, sequence, bin, and keyframe inspection so a
+  request cannot accidentally traverse or serialize an unbounded production project.
+- Grouped compatible mutations into Adobe action transactions with stale-state
+  guards, replay protection, and post-commit readback. A failed UXP mutation is
+  returned to the caller and is never silently retried through CEP.
+- Replaced UXP filesystem full access with operator-selected folder access and kept
+  native paths and persistent tokens inside the panel.
+
+### Security
+
+- Updated vulnerable transitive dependencies and refreshed the validated package
+  lockfiles used by the server and landing build.
+
+### Validation
+
+- Automated unit, contract, distribution, and coverage gates exercise the expanded
+  UXP surface. Real Premiere host verification and latency benchmarking remain
+  pending and are not implied by this release.
+
+## [1.9.3] - 2026-08-12
+
+### Added
+
+- Added the Premiere Pro MCP cinematic intro video to the landing assets.
+- Added the dated security best-practices audit report for repository reference.
+
+### Changed
+
+- Simplified the README release overview to show only the latest release and link
+  to the complete GitHub release notes.
+
+### Security
+
+- Updated the landing build's transitive `nanoid` dependency to a patched version.
+
 ## [1.9.2] - 2026-08-04
 
 ### Fixed

package/README.md

@@ -4,9 +4,9 @@
 
 [![MCP Toplist](https://mcptoplist.com/badge/glama%2Fleancoderkavy%2Fpremiere-pro-mcp.svg)](https://mcptoplist.com/server/glama%2Fleancoderkavy%2Fpremiere-pro-mcp)
 
-**Give AI full control over Adobe Premiere Pro.**
+**Give compatible AI assistants structured control over supported Adobe Premiere Pro workflows.**
 
-280 core tools across 31 modules, 3 resources, and 4 guided workflows. A connected UXP host adds 19 capability-gated tools.
+280 core tools across 31 modules, 3 resources, and 4 guided workflows. A connected UXP host adds 40 capability-gated tools.
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 [![Node.js](https://img.shields.io/badge/Node.js-20.19%2B-green.svg)](https://nodejs.org)
@@ -19,6 +19,8 @@
 
 ---
 
+![Premiere Pro MCP turns a structured AI request into an organized local editing workflow](landing/public/marketing/premiere-pro-mcp-campaign-hero-v1.png)
+
 ## What is this?
 
 An [MCP (Model Context Protocol)](https://modelcontextprotocol.io) server that lets AI assistants like **Claude**, **Windsurf**, **Cursor**, **GitHub Copilot**, or any MCP-compatible client directly control Adobe Premiere Pro — importing media, editing timelines, applying effects, managing keyframes, exporting, and more.
@@ -27,58 +29,21 @@ An [MCP (Model Context Protocol)](https://modelcontextprotocol.io) server that l
 "Add the B-roll clips to V2, apply a cross dissolve between each, color correct them to match the A-roll, and export a 1080p ProRes."
 ```
 
-The AI handles the entire workflow through 280 core tools spanning the supported ExtendScript, QE DOM, local media analysis, safe edit-planning, and connection-verification surfaces. A compatible, authenticated UXP panel adds 19 documented, capability-gated workflows without replacing the production CEP bridge.
-
-### What's new in 1.9.2
-
-- **Adobe Marketplace compatibility:** the signed CEP connector now declares a
-  minimum supported Premiere version without an artificial future maximum.
-- **Clear privacy disclosure:** the public site now documents local processing,
-  optional operational telemetry, site analytics, retention, and user choices.
-
-### Previous release: 1.9.1
-
-- **Production browser hardening:** every HTTP response includes CSP, HSTS,
-  MIME sniffing protection, frame denial, bounded permissions, and explicit
-  referrer and cross-origin policies.
-
-### Earlier release: 1.9.0
-
-- **Assistant-first setup:** Claude Desktop users start with a validated MCPB
-  bundle, while npm and manual JSON configuration stay under Advanced setup.
-- **Safe connection help:** `verify_premiere_connection`, `--doctor`, the CEP
-  Connection Center, and sanitized support bundles explain exactly what is
-  installed, configured, connected, and live-verified.
-- **Distribution foundations:** MCPB v0.4, deterministic direct/Marketplace CCX
-  packaging, and native Windows/macOS CEP installer pipelines make the supported
-  routes easier to package without overstating signing or Marketplace approval.
-- **Canonical tool surface:** 280 registered tools, 278 in the default profile,
-  and 297 while the 19 capability-gated UXP tools are connected.
+The AI handles the entire workflow through 280 core tools spanning the supported ExtendScript, QE DOM, local media analysis, safe edit-planning, and connection-verification surfaces. A compatible, authenticated UXP panel adds 40 documented, capability-gated tools without replacing the production CEP bridge.
 
-### Previous release: 1.8.0
+### Latest release: 1.10.0
 
-- **Native transcript planning:** compatible UXP hosts can export and search the
-  transcript Premiere generated for a clip, then preview a revision-locked set of
-  source-time deletion ranges.
-- **No false edit promise:** previews return a deterministic confirmation token and
-  never modify a clip or timeline. Automated application remains withheld until the
-  documented source-to-sequence reconstruction path passes real-host validation.
-- **19 connected UXP tools:** the capability-gated UXP surface grows from 16 to 19
-  without changing the 279 core-tool surface.
+- **Expanded native UXP workflows:** 21 consolidated tools cover effects, selections, markers,
+  bins, sequence settings, imports, keyframes, timeline edits, sequence lifecycle, and encoding.
+- **Bounded and transactional execution:** stable IDs, stale-state guards, replay protection,
+  capped traversal, grouped Adobe actions, and post-commit readback reduce ambiguous mutations.
+- **Least-privilege workspace access:** operators choose the folder available to UXP workflows;
+  native paths and persistent tokens stay inside the panel.
+- **Truthful compatibility:** CEP remains the production-compatible bridge, and a failed UXP
+  mutation is never silently retried through CEP.
 
-### Earlier release: 1.7.0
-
-- **Six documented workflows:** compatible 26.3+ hosts can expose UXP track renaming, subclip creation, stable marker IDs, Source Monitor seeking, transcript presence checks, and AAF export.
-- **Capability first:** a tool is discoverable only with the authenticated local panel; the panel's live `capabilities.get` response—not package metadata—decides whether the current host supports it.
-- **Evidence boundary:** automated tests validate schemas, routing, capability declarations, transactions, and result envelopes. They do not verify a specific Premiere installation. See [Adobe UXP 26.3 coverage](docs/adobe-uxp-26.3-coverage.md) for the exact host gate and the stable-versus-beta policy.
-- **Adobe-aligned validation:** the official Premiere 26.3 declarations and ESLint rules now enforce supported signatures and lock/transaction boundaries in CI.
-
-### Added in 1.2.0
-
-- **Safe edit plans:** preview compound insert/remove operations, bind approval to a SHA-256 plan token, then apply the validated plan in one bridge command.
-- **Capability profiles:** unsafe scripting is disabled by default and requires explicit `unsafe-script` authority.
-- **Modern MCP responses:** tools expose safety annotations and structured results; four workflow prompts and a machine-readable workflow resource guide common edits.
-- **UXP bridge preview:** a packaged Premiere 25.6+ panel adds capability discovery, event-driven state notifications with a deduplicated polling fallback, correlated operation lifecycle events, reconnecting WebSocket transport, and supported frame export with file verification. Cancellation is cooperative before non-cancellable host calls; no atomic rollback is claimed. Live host verification is still required.
+See the [v1.10.0 release notes](https://github.com/leancoderkavy/premiere-pro-mcp/releases/tag/v1.10.0)
+for complete details. Live installation in Premiere Pro still requires host verification.
 
 ---
 
@@ -86,9 +51,9 @@ The AI handles the entire workflow through 280 core tools spanning the supported
 
 ### Easiest supported path: Claude Desktop
 
-1. Download the current [Claude Desktop bundle (`.mcpb`)](https://github.com/leancoderkavy/premiere-pro-mcp/releases/download/v1.9.2/premiere-pro-mcp-1.9.2.mcpb).
+1. Download the current [Claude Desktop bundle (`.mcpb`)](https://github.com/leancoderkavy/premiere-pro-mcp/releases/download/v1.10.0/premiere-pro-mcp-1.10.0.mcpb).
 2. In Claude Desktop, open **Settings > Extensions > Advanced settings > Install Extension**, select the downloaded bundle, and restart Claude Desktop.
-3. Download the separate [signed Premiere connector (`.zxp`)](https://github.com/leancoderkavy/premiere-pro-mcp/releases/download/v1.9.2/MCPBridgeCEP.zxp). Open it with your trusted ZXP installer. If your computer has no ZXP installer, use the npm connector installer in **Advanced setup** below.
+3. Download the separate [signed Premiere connector (`.zxp`)](https://github.com/leancoderkavy/premiere-pro-mcp/releases/download/v1.10.0/MCPBridgeCEP.zxp). Open it with your trusted ZXP installer. If your computer has no ZXP installer, use the npm connector installer in **Advanced setup** below.
 4. Restart Premiere, open a project, then open **Window > Extensions > MCP Bridge**.
 5. In Claude, enter: `Safely check my Premiere connection with verify_premiere_connection. Make no changes.`
 
@@ -312,11 +277,11 @@ From a clone of this repository:
 ```bash
 codex plugin marketplace add .
 codex plugin add premiere-pro@premiere-pro-mcp
-npx -y premiere-pro-mcp@1.9.2 --install-cep
+npx -y premiere-pro-mcp@1.10.0 --install-cep
 ```
 
 Restart Premiere Pro and start a new Codex session after installation. The plugin
-launches `premiere-pro-mcp@1.9.2` through `npx`; the separate CEP installation is
+launches `premiere-pro-mcp@1.10.0` through `npx`; the separate CEP installation is
 required because the MCP server communicates with the running Premiere host through
 the local bridge.
 
@@ -336,7 +301,7 @@ For Claude Code, add this repository as a marketplace and install the plugin:
 Then install the Premiere bridge and start a new Claude Code session:
 
 ```bash
-npx -y premiere-pro-mcp@1.9.2 --install-cep
+npx -y premiere-pro-mcp@1.10.0 --install-cep
 ```
 
 The Claude Code package lives in
@@ -426,7 +391,9 @@ PREMIERE_UXP_TOKEN="replace-with-a-long-random-secret" premiere-pro-mcp
 
 Enter the same token in the UXP panel. The listener binds only to `127.0.0.1:7777`, authenticates the WebSocket upgrade, requires a versioned capability handshake, correlates concurrent requests, and fails pending work on timeout or disconnect. Set `PREMIERE_UXP_PORT` to use another loopback port.
 
-When enabled, MCP discovery includes `get_uxp_capabilities`, `get_uxp_state`, `inspect_project_uxp`, `save_project_uxp`, `create_sequence_with_preset_uxp`, `export_interchange_uxp`, `get_transcript_languages_uxp`, `get_clip_transcript_uxp`, `search_clip_transcript_uxp`, `preview_transcript_edit_uxp`, `detect_object_masks_uxp`, `configure_encoder_uxp`, `export_frame_uxp`, `rename_track_uxp`, `create_subclip_uxp`, `list_markers_uxp`, `set_source_monitor_position_uxp`, `has_transcript_uxp`, and `export_aaf_uxp`. Commands are advertised only while the authenticated local UXP bridge is connected; the host capability handshake remains the authority for support in the running Premiere build. A failed UXP command is never silently retried through CEP because the first operation may have partially succeeded.
+When enabled, MCP discovery includes the original 19 UXP tools plus 21 consolidated stable workflows. The first expansion covers effects, deterministic timeline selection, selection batches, scene detection, proxy/ingest, relink, metadata, color conformance, Source Monitor audition, storage, and least-privilege workspace access. The second adds Project-panel selection, marker CRUD, bin organization, sequence settings, imports, typed effect parameters/keyframes, track-item transforms, SequenceEditor timeline edits, sequence lifecycle, and AME encoding. See [the first stable workflow matrix](docs/uxp-stable-workflows.md) and [the next-ten workflow matrix](docs/uxp-next-ten-workflows.md). Commands are advertised only while the authenticated local UXP bridge is connected; the host capability handshake remains the authority for support in the running Premiere build. A failed UXP command is never silently retried through CEP because the first operation may have partially succeeded.
+
+The panel now requests access to one operator-selected workspace instead of declaring full filesystem access. Choose the folder in the panel before invoking a path-based UXP workflow. Media, relink, preset, export, and Source Monitor file paths must remain inside it; the persistent capability token and native root path are never returned over MCP. Lexical containment alone cannot exclude symlink, junction, or reparse-point escapes, and Adobe's request-scoped UXP filesystem API does not document canonical-path resolution. Builds without a host-supplied canonical resolver therefore advertise path-based UXP commands as unsupported and fail closed at invocation; use the existing CEP fallback for those operations.
 
 Native transcript editing starts with a read-only, revision-locked planning flow. Use
 `get_clip_transcript_uxp` to export the transcript Premiere generated for a source
@@ -448,10 +415,19 @@ coverage matrix](docs/adobe-uxp-26.3-coverage.md) and [the UXP capability
 foundation](docs/uxp-capability-foundation.md) for the command matrix and live-host
 validation boundary.
 
+The stable workflow expansion adds native component-chain effects, deterministic
+timeline selection, compound selection batches, scene-edit detection, proxy/ingest control, guarded offline
+relink, transactional project/XMP metadata, color and footage-conformance
+preflight, full Source Monitor audition, and project/Production storage checks.
+See [the stable UXP workflow matrix](docs/uxp-stable-workflows.md) for exact
+argument, undo, confirmation, and live-host boundaries.
+
 ---
 
 ## Architecture
 
+![Local-first Premiere Pro MCP workflow from AI assistant through the MCP bridge to a verified Premiere result](landing/public/marketing/premiere-pro-mcp-workflow-v1.png)
+
 **Local (stdio):**
 
 ```text
@@ -490,7 +466,7 @@ The file-based IPC bridge is simple, reliable, and works across macOS and Window
 
 ---
 
-## Tools (280 core total; 278 under the default profile; 297 with a connected UXP bridge)
+## Tools (280 core total; 278 under the default profile; 318 with a connected UXP bridge)
 
 ### Discovery & Inspection (10 + 10)
 
@@ -888,6 +864,10 @@ npm version, fully quit every Premiere process, run `premiere-pro-mcp --install-
 
 Contributions are welcome! See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
 
+The evidence-backed [next improvement pull-request roadmap](docs/next-improvement-pr-roadmap.md)
+breaks the proposed feature, protocol, reliability, and performance work into ten
+reviewable changes with explicit dependencies and live-host acceptance gates.
+
 ---
 
 ## License

package/cep-plugin/CSXS/manifest.xml

@@ -1,8 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<ExtensionManifest Version="7.0" ExtensionBundleId="com.mcp.premiere.bridge" ExtensionBundleVersion="1.9.2" ExtensionBundleName="MCP Bridge">
+<ExtensionManifest Version="7.0" ExtensionBundleId="com.mcp.premiere.bridge" ExtensionBundleVersion="1.10.0" ExtensionBundleName="MCP Bridge">
   <ExtensionList>
-    <Extension Id="com.mcp.premiere.bridge.panel" Version="1.9.2"/>
-    <Extension Id="com.mcp.premiere.bridge.headless" Version="1.9.2"/>
+    <Extension Id="com.mcp.premiere.bridge.panel" Version="1.10.0"/>
+    <Extension Id="com.mcp.premiere.bridge.headless" Version="1.10.0"/>
   </ExtensionList>
   <ExecutionEnvironment>
     <HostList>

package/cep-plugin/index.html

@@ -81,7 +81,7 @@
     <section class="update-section" aria-live="polite">
       <div class="update-copy">
         <span class="section-label">Connector updates</span>
-        <strong id="updateTitle">Version 1.9.2</strong>
+        <strong id="updateTitle">Version 1.10.0</strong>
         <span id="updateDetail">Checking for updates…</span>
       </div>
       <button id="btnUpdate" class="button button-update" onclick="handleUpdateClick()" type="button" disabled>

package/cep-plugin/updater.cjs

@@ -7,7 +7,7 @@
 })(this, function () {
   "use strict";
 
-  var CURRENT_VERSION = "1.9.2";
+  var CURRENT_VERSION = "1.10.0";
   var LATEST_RELEASE_API =
     "https://api.github.com/repos/leancoderkavy/premiere-pro-mcp/releases/latest";
   var RELEASES_URL =

package/dist/platform-capabilities.js

@@ -205,6 +205,75 @@ export function buildPlatformCapabilityReport(capabilities, platform = process.p
                     "transcript.has",
                     "transcript.import",
                     "captions.inspect",
+                    "effects.catalog",
+                    "effects.chain.get",
+                    "effects.chain.add",
+                    "effects.chain.remove",
+                    "selection.inspect",
+                    "selection.fingerprints.inspect",
+                    "selection.targets.inspect",
+                    "selection.update",
+                    "effects.selection.add",
+                    "effects.selection.remove",
+                    "sceneEdit.detect",
+                    "proxy.inspect",
+                    "proxy.attach",
+                    "ingest.get",
+                    "ingest.configure",
+                    "media.relink",
+                    "metadata.get",
+                    "metadata.update",
+                    "color.preflight",
+                    "footage.conform",
+                    "sourceMonitor.state",
+                    "sourceMonitor.open",
+                    "sourceMonitor.play",
+                    "sourceMonitor.close",
+                    "storage.preflight",
+                    "scratch.configure",
+                    "workspace.status",
+                    "projectSelection.views",
+                    "projectSelection.inspect",
+                    "markers.inspect",
+                    "markers.add",
+                    "markers.update",
+                    "markers.remove",
+                    "bins.inspect",
+                    "bins.create",
+                    "bins.createSmart",
+                    "bins.rename",
+                    "bins.move",
+                    "bins.color",
+                    "bins.remove",
+                    "sequenceSettings.get",
+                    "sequenceSettings.update",
+                    "project.import",
+                    "parameters.inspect",
+                    "parameters.set",
+                    "parameters.keyframeAdd",
+                    "parameters.keyframeRemove",
+                    "parameters.keyframeRemoveRange",
+                    "parameters.keyframeInterpolation",
+                    "trackItem.inspect",
+                    "trackItem.update",
+                    "timeline.insert",
+                    "timeline.overwrite",
+                    "timeline.cloneSelection",
+                    "timeline.removeSelection",
+                    "timeline.mogrtPath",
+                    "timeline.mogrtLibrary",
+                    "sequences.inspect",
+                    "sequences.createFromMedia",
+                    "sequences.clone",
+                    "sequences.subsequence",
+                    "sequences.activate",
+                    "sequences.open",
+                    "sequences.close",
+                    "sequences.delete",
+                    "encoder.preflight",
+                    "encoder.sequence",
+                    "encoder.projectItem",
+                    "encoder.file",
                 ],
                 unsupportedCommands: {
                     "captions.create": "No documented Premiere UXP caption creation API.",