rankcontrol 0.6.0 → 0.7.0

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Infowick
+Copyright (c) 2026 RankControl, LLC
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -9,15 +9,15 @@ Every command calls the same authed, rate-limited, org-scoped API the RankContro
 
 ## Auth
 
-The easy way — approve in your browser (you must be logged in to RankControl):
+The easy way (browser approval; you must be logged in to RankControl):
 
 ```bash
 npx rankcontrol login
 ```
 
-That opens your dashboard, you check the confirmation code matches, pick the permissions to grant, and the CLI stores a scoped key in `~/.rankcontrol/config.json`. `npx rankcontrol logout` removes it (revoke the key itself in Settings → API).
+That opens your dashboard, you check the confirmation code matches and approve. The CLI stores a key in `~/.rankcontrol/config.json`. `npx rankcontrol logout` removes it (revoke the key itself in Settings → API).
 
-The headless way (CI, servers, MCP `env` blocks) — create a key in **RankControl → Settings → API**, then:
+The headless way (CI, servers, MCP `env` blocks): create a key in **RankControl → Settings → API**, then:
 
 ```bash
 export RANKCONTROL_API_KEY=rctrl_pk_...
@@ -28,40 +28,102 @@ The env var wins over the stored config when both exist. Scopes are set per key;
 ## CLI
 
 ```bash
+# Visibility and citations
 npx rankcontrol funnel                 # AI crawls / AI visits / AI leads (30d)
 npx rankcontrol score                  # composite visibility score + subscores (AI/Google/Bing)
-npx rankcontrol leads --limit 100      # captured leads with AI source attribution
-npx rankcontrol traffic --days 30      # page views, visitors, bounce rate, time on page
 npx rankcontrol visibility --days 60   # daily AI visibility score trend
 npx rankcontrol sov --days 30          # share of voice vs competitors
 npx rankcontrol sources --days 30      # cited domains typed brand/competitive/ugc/editorial
 npx rankcontrol sentiment --days 30    # how AI answers frame your brand
-npx rankcontrol optimizer --limit 25   # pages ranked by citability, worst first
 npx rankcontrol citations --model chatgpt
+npx rankcontrol crawler-access         # can AI crawlers reach your site (daily probe)
 npx rankcontrol queries                # tracked queries checked weekly across AI engines
+npx rankcontrol query-add "best crm for agencies"
+npx rankcontrol query-edit <queryId> "new text"
+npx rankcontrol query-track <queryId> off      # pause weekly checks (frees a slot)
+npx rankcontrol query-remove <queryId>
+npx rankcontrol competitors
+npx rankcontrol competitor-add "Acme" https://acme.com
+npx rankcontrol competitor-remove <competitorId>
+
+# Content pipeline
 npx rankcontrol capacity               # remaining content-plan slots
+npx rankcontrol content                # pages with status
 npx rankcontrol plan-content --topics "bus travel" --max-difficulty 40
 npx rankcontrol commit-titles --file titles.json
-npx rankcontrol publish <contentId>            # dry run
-npx rankcontrol publish <contentId> --confirm  # actually publish
-npx rankcontrol generate <contentId>           # dry run
-npx rankcontrol generate <contentId> --confirm # write a planned article now (slot unchanged)
+npx rankcontrol ideas                  # scored content-idea backlog
+npx rankcontrol plan-idea "query text" # put an idea on the calendar
+npx rankcontrol delete-planned <contentId>     # title returns to the idea pool
+npx rankcontrol generate <contentId> --confirm # write a planned article now
+npx rankcontrol publish <contentId> --confirm  # dry run without --confirm
+npx rankcontrol archive <contentId>
+npx rankcontrol reschedule <contentId> 2026-08-04
 npx rankcontrol settings               # article policy (auto-write, auto-publish, images, ...)
 npx rankcontrol settings-set --auto-generate off --auto-publish off
-npx rankcontrol reschedule <contentId> 2026-08-04
+npx rankcontrol topics                 # pillar list (topic clusters)
+npx rankcontrol topics-set "Topic A" "Topic B"  # replaces the FULL list
 npx rankcontrol internal-links <contentId>     # who links here / links out
 npx rankcontrol site-pages             # pages used for internal links
 npx rankcontrol detect-links https://example.com/sitemap.xml
 npx rankcontrol add-pages https://example.com/pricing
-npx rankcontrol repurpose              # published articles + social draft chips
-npx rankcontrol repurpose <contentId>  # full drafts for one article
+
+# Leads and analytics
+npx rankcontrol leads --limit 100      # captured leads with AI source attribution
+npx rankcontrol traffic --days 30      # page views, visitors, bounce rate, time on page
+npx rankcontrol engagement             # per-page views, citations, sparkline
+npx rankcontrol analytics-sources      # which source writes traffic/crawler data
+npx rankcontrol analytics-set-source <dataType> <source>
+npx rankcontrol analytics-activate <screen>
+
+# Reports
+npx rankcontrol report                 # exec summary: last 30 days vs the 30 before
+npx rankcontrol wins                   # biggest wins of the last 30 days
+npx rankcontrol agent-activity         # recent runs per agent lane
+npx rankcontrol jobs                   # async job status
+
+# Backlinks and outreach
+npx rankcontrol backlinks --status live
+npx rankcontrol backlink-stats
+npx rankcontrol outreach-prospects
+npx rankcontrol outreach-find-contact <backlinkId>
+npx rankcontrol outreach-draft-reply <backlinkId>
+npx rankcontrol outreach-queue <backlinkId> --confirm   # sends from YOUR mailbox
+npx rankcontrol outreach-status <backlinkId> <status>
+npx rankcontrol network                # Link Network credits + placements
+npx rankcontrol network-opt-in on --confirm
+npx rankcontrol network-remove-placement <placementId> --confirm
+
+# Social and repurposing
+npx rankcontrol repurpose [contentId]  # published articles + social drafts (8 platforms)
 npx rankcontrol repurpose-generate <contentId> --platforms twitter --confirm
 npx rankcontrol repurpose-edit <draftId> --title "New hook"
-npx rankcontrol repurpose-channels     # Postiz channel ids (for repurpose-push)
-npx rankcontrol repurpose-push <draftId> --channels <id>   # dry run
+npx rankcontrol repurpose-channels     # Postiz channel ids
 npx rankcontrol repurpose-push <draftId> --channels <id> --confirm
-npx rankcontrol repurpose-mark-posted <draftId>            # posted it yourself
-npx rankcontrol jobs                   # async job status (agent runs)
+npx rankcontrol repurpose-mark-posted <draftId>
+npx rankcontrol social                 # Reddit/X threads where your articles fit
+npx rankcontrol social-stats
+npx rankcontrol social-status <threadId> <status>
+npx rankcontrol social-draft-reply <threadId>
+
+# Brand, team, workspace
+npx rankcontrol brand                  # brand profile, products, ICPs in one read
+npx rankcontrol brand-set --industry "SaaS"    # name, industry, description, authors, style refs
+npx rankcontrol brand-profile-set --json '{"tone":"confident"}'
+npx rankcontrol brand-product --json @product.json
+npx rankcontrol brand-icp --json @icp.json
+npx rankcontrol team
+npx rankcontrol team-invite user@company.com --perms content=write,analytics=read --confirm
+npx rankcontrol team-revoke <invitationId>
+npx rankcontrol team-remove <memberId> --confirm
+npx rankcontrol support "Subject" --message "..."
+
+# Integration helpers
+npx rankcontrol shopify-install-url <shop>
+npx rankcontrol cloudflare-connect     # OAuth URL for read-only crawler analytics
+npx rankcontrol cloudflare-zones
+npx rankcontrol cloudflare-zone <zoneId> <zoneName>
+npx rankcontrol framer-install-embed --confirm
+npx rankcontrol webflow-custom-code --confirm
 ```
 
 ## MCP
@@ -86,39 +148,104 @@ Or in `.mcp.json` / Cursor `mcp.json`:
 }
 ```
 
-### Tools
+### Tools (83)
+
+**Visibility and citations**
 
 | Tool | What it does |
 |---|---|
 | `get_overview_funnel` | AI crawls / AI visits / AI leads, last 30 days |
-| `list_leads` | Captured leads with AI model / query / page attribution |
-| `get_traffic_overview` | Page views, visitors, sessions, bounce rate, time on page |
-| `get_visibility_trend` | Daily visibility score from stored weekly citation checks |
-| `list_citations` | Recent citation checks per AI model |
-| `list_tracked_queries` | The queries checked weekly across the AI engines |
 | `get_visibility_score` | Composite score (50% AI + 30% Google + 20% Bing) with subscores |
+| `get_visibility_trend` | Daily visibility score from stored weekly citation checks |
 | `get_share_of_voice` | Your citation rate vs competitor mention rates + your share |
 | `get_citation_sources` | Cited domains typed brand / competitive / UGC / editorial |
 | `get_citation_sentiment` | Positive / neutral / negative framing with recent receipts |
 | `get_citability_report` | Published pages by citability score, worst first, with fixes |
+| `list_citations` | Recent citation checks per AI model |
+| `get_crawler_access` | Daily AI-crawler reachability probe (edge blocks, robots.txt) |
+| `list_tracked_queries` | The queries checked weekly across the AI engines |
+| `add_tracked_query` / `update_tracked_query` / `set_query_tracking` / `remove_tracked_query` | Manage the query pool and its plan slots |
+| `get_competitors` / `add_competitor` / `remove_competitor` | Manage share-of-voice competitors (max 10) |
+
+**Content pipeline**
+
+| Tool | What it does |
+|---|---|
 | `get_planning_capacity` | Remaining calendar slots (check before planning) |
 | `plan_content` | Generate candidate titles (capacity-gated, nothing scheduled) |
 | `commit_planned_titles` | Approve reviewed titles onto the calendar |
-| `publish_content` | Dry run by default; `confirm: true` publishes |
-| `generate_article` | Write a planned article's body now, slot unchanged; dry run by default |
-| `get_article_settings` / `update_article_settings` | Read / merge-patch the article policy (auto-write, auto-publish, images, links, ...) |
+| `get_content_ideas` / `plan_content_idea` | Scored idea backlog; put an idea on the calendar |
+| `delete_planned_title` | Remove a planned title (returns to the idea pool) |
+| `generate_article` | Write a planned article's body now; dry run by default |
+| `publish_content` | Dry run by default; `confirm: true` publishes to the CMS |
+| `archive_content` | Archive an article (reversible in the dashboard) |
 | `reschedule_article` | Move a planned article to another day (flexible schedule) |
+| `get_article_settings` / `update_article_settings` | Read / merge-patch the article policy |
+| `get_topics` / `set_topics` | Read / replace the pillar list (full-list replace) |
 | `get_internal_links` | Who links to this article internally, and its outbound count |
-| `list_site_pages` / `add_site_pages` | Pages used for in-article internal links |
-| `detect_site_links` | Scan a sitemap or blog root for site pages |
-| `list_repurpose_queue` | Published articles + social draft chips per platform |
-| `get_repurpose_drafts` | Full social drafts for one article (8 platforms) |
-| `generate_repurpose_drafts` | Draft social posts for an article; dry run by default |
-| `update_repurpose_draft` | Edit a draft's body/title before pushing |
-| `mark_repurpose_posted` | Record a draft as posted manually |
-| `list_postiz_channels` | Connected Postiz channels (ids for pushing) |
-| `push_repurpose_draft` | Send a draft to Postiz; dry run by default |
+| `list_site_pages` / `add_site_pages` / `detect_site_links` | Pages used for in-article internal links |
 | `list_content` | Content pages with status |
+
+**Leads and analytics**
+
+| Tool | What it does |
+|---|---|
+| `list_leads` | Captured leads with AI model / query / page attribution |
+| `get_traffic_overview` | Page views, visitors, sessions, bounce rate, time on page |
+| `get_page_engagement` | Per-page views, citations, and a view sparkline |
+| `get_analytics_sources` / `set_analytics_source` | Which source writes traffic and crawler data |
+| `activate_analytics_screen` | One-time activation of the Analytics or Reports screen |
+
+**Reports**
+
+| Tool | What it does |
+|---|---|
+| `get_exec_summary` | Last 30 days vs the 30 before: cite rate, views, crawls, leads |
+| `get_top_wins` | Most-cited page, best cite-rate jump, biggest ranking climb |
+| `get_agent_activity` | Recent pipeline runs per agent lane |
 | `list_jobs` | Async job status (agent runs) |
 
-The plan→commit split is intentional: `plan_content` proposes, a human (or a supervising agent) reviews, `commit_planned_titles` approves. `publish_content` and `generate_article` are dry-run-first for the same reason.
+**Backlinks and outreach**
+
+| Tool | What it does |
+|---|---|
+| `list_backlinks` / `get_backlink_stats` | Backlink table and totals |
+| `list_outreach_prospects` | Outreach pipeline per published article |
+| `find_outreach_contact` | Scrape a prospect site for an outreach email |
+| `draft_outreach_reply` | AI-draft the next reply in a live conversation |
+| `queue_outreach_email` | Queue an email from the workspace's own mailbox |
+| `update_outreach_status` | Move a prospect through the pipeline |
+| `get_link_network` | Credit balance, membership, placements |
+| `set_link_network_opt_in` / `remove_network_placement` | Join/leave, retire placements; dry run by default |
+
+**Social and repurposing**
+
+| Tool | What it does |
+|---|---|
+| `list_repurpose_queue` / `get_repurpose_drafts` | Published articles + social drafts (8 platforms) |
+| `generate_repurpose_drafts` / `update_repurpose_draft` | Draft and edit platform-native posts |
+| `list_postiz_channels` / `push_repurpose_draft` | Push to Postiz; dry run by default |
+| `mark_repurpose_posted` | Record a draft as posted manually |
+| `list_social_threads` / `get_social_stats` | Reddit/X threads where your articles fit |
+| `update_social_thread_status` / `draft_social_reply` | Work a thread; drafts never auto-post |
+
+**Brand, team, workspace**
+
+| Tool | What it does |
+|---|---|
+| `get_brand` | Brand profile, links/CTAs, products, and ICPs in one read |
+| `update_brand_identity` | Name, industry, description, authors (EEAT bylines), style refs |
+| `update_brand_profile` | Voice, colors, meta fields, locale |
+| `write_brand_product` / `write_brand_icp` | Create/update/delete products and buyer profiles |
+| `get_team` / `invite_team_member` / `revoke_team_invite` / `remove_team_member` | Seats, invites, per-screen permissions |
+| `contact_support` | Message the RankControl team with the workspace identified |
+
+**Integration helpers**
+
+| Tool | What it does |
+|---|---|
+| `shopify_install_url` | Mint an install link for the Shopify app |
+| `get_cloudflare_connect_url` / `list_cloudflare_zones` / `select_cloudflare_zone` | Connect read-only Cloudflare crawler analytics |
+| `install_framer_embed` / `install_webflow_custom_code` | Install visit tracking; dry run by default |
+
+The plan→commit split is intentional: `plan_content` proposes, a human (or a supervising agent) reviews, `commit_planned_titles` approves. `publish_content`, `generate_article`, and everything with a public side effect are dry-run-first for the same reason.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rankcontrol",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "RankControl CLI + MCP server: drive your SEO/AI-visibility workspace from the terminal or any AI agent",
   "license": "MIT",
   "homepage": "https://rctrl.com",

package/src/cli.mjs

@@ -33,11 +33,10 @@ export function runCli(argv) {
 
   program
     .command("login")
-    .description("Authenticate via your browser (approves a scoped API key into ~/.rankcontrol)")
-    .option("--scopes <a,b,c>", "Scopes to request (default: reads + write:content + write:publish)")
-    .action(async (opts) => {
+    .description("Authenticate via your browser (full workspace access; billing stays in the dashboard)")
+    .action(async () => {
       const { login } = await import("./login.mjs");
-      await login({ scopes: opts.scopes ? list(opts.scopes) : undefined }).catch(fail);
+      await login().catch(fail);
     });
 
   program
@@ -119,15 +118,154 @@ export function runCli(argv) {
 
   program
     .command("crawler-access")
-    .description("Daily AI-crawler reachability probe: is the site's edge or robots.txt blocking GPTBot/ClaudeBot")
+    .description("Daily AI-crawler reachability probe (a diagnostic, not a metric): is the site's edge or robots.txt blocking GPTBot/ClaudeBot")
     .action(() => api.crawlerAccess().then(out).catch(fail));
 
+  program
+    .command("analytics-sources")
+    .description("Per-org analytics sources: selections, qualified options, Cloudflare/plugin/embed install state")
+    .action(() => api.analyticsSources().then(out).catch(fail));
+
+  program
+    .command("analytics-set-source")
+    .description("Select the writer for a data type (validated against what the setup supports)")
+    .argument("<dataType>", "humanTraffic or aiCrawlers")
+    .argument("<source>", "embed, wordpress_plugin, cloudflare or none")
+    .action((dataType, source) =>
+      api.setAnalyticsSource(dataType, source).then(out).catch(fail)
+    );
+
+  program
+    .command("analytics-activate")
+    .description("Turn on the Analytics or Reports screen for this workspace")
+    .argument("<screen>", "analytics or reports")
+    .action((screen) => api.activateScreen(screen).then(out).catch(fail));
+
+  program
+    .command("cloudflare-connect")
+    .description("Print the Cloudflare OAuth URL to connect read-only crawler analytics")
+    .action(() =>
+      api
+        .cloudflareConnectUrl()
+        .then((d) => out(d?.url ?? d))
+        .catch(fail)
+    );
+
+  program
+    .command("cloudflare-zones")
+    .description("List Cloudflare zones visible to the connected grant")
+    .action(() => api.cloudflareZones().then(out).catch(fail));
+
+  program
+    .command("cloudflare-zone")
+    .description("Pick the polled zone (also selects Cloudflare as the AI-crawler source and starts the first sync)")
+    .argument("<zoneId>", "Zone id from cloudflare-zones")
+    .argument("<zoneName>", "Zone name, e.g. example.com")
+    .action((zoneId, zoneName) =>
+      api.cloudflareSelectZone(zoneId, zoneName).then(out).catch(fail)
+    );
+
+  program
+    .command("framer-install-embed")
+    .description("Install site-wide tracking on the Framer project (dry run without --confirm; installing also publishes the Framer site)")
+    .option("--integration <id>", "Integration id (defaults to the org's Framer integration)")
+    .option("--confirm", "Actually install", false)
+    .action((opts) =>
+      api
+        .framerInstallEmbed({
+          ...(opts.integration ? { integrationId: opts.integration } : {}),
+          confirm: Boolean(opts.confirm),
+        })
+        .then(out)
+        .catch(fail)
+    );
+
+  program
+    .command("webflow-custom-code")
+    .description("Install the tracking loader via Webflow's Custom Code API (dry run without --confirm; live on the customer's next site publish)")
+    .option("--integration <id>", "Integration id (defaults to the org's Webflow integration)")
+    .option("--token <token>", "New site token with CMS + Custom code scopes (replaces the stored one)")
+    .option("--confirm", "Actually install", false)
+    .action((opts) =>
+      api
+        .webflowInstallCustomCode({
+          ...(opts.integration ? { integrationId: opts.integration } : {}),
+          ...(opts.token ? { apiToken: opts.token } : {}),
+          confirm: Boolean(opts.confirm),
+        })
+        .then(out)
+        .catch(fail)
+    );
+
   program
     .command("query-add")
     .description("Add a query to the tracking pool (tracks immediately when a plan slot is free)")
     .argument("<queryText>", "The search/AI query to track")
     .action((queryText) => api.addQuery(queryText).then(out).catch(fail));
 
+  program
+    .command("query-remove")
+    .description("Delete a query from the tracking pool")
+    .argument("<queryId>", "Query id (from the queries command)")
+    .action((queryId) => api.removeQuery(queryId).then(out).catch(fail));
+
+  program
+    .command("query-track")
+    .description("Pause or resume weekly checks on a query. Tracking uses a plan slot; pausing frees it")
+    .argument("<queryId>", "Query id (from the queries command)")
+    .argument("<state>", "on | off")
+    .action((queryId, state) =>
+      api.setQueryTracking(queryId, state === "on").then(out).catch(fail)
+    );
+
+  program
+    .command("query-edit")
+    .description("Rewrite a tracked query's text")
+    .argument("<queryId>", "Query id (from the queries command)")
+    .argument("<queryText>", "New query text")
+    .action((queryId, queryText) =>
+      api.updateQuery(queryId, queryText).then(out).catch(fail)
+    );
+
+  program
+    .command("competitors")
+    .description("Tracked competitors used in share-of-voice and visibility comparisons")
+    .action(() => api.competitors().then(out).catch(fail));
+
+  program
+    .command("competitor-add")
+    .description("Track a competitor (max 10)")
+    .argument("<name>", "Competitor name")
+    .argument("<websiteUrl>", "Competitor website URL")
+    .action((name, websiteUrl) =>
+      api.addCompetitor(name, websiteUrl).then(out).catch(fail)
+    );
+
+  program
+    .command("competitor-remove")
+    .description("Stop tracking a competitor")
+    .argument("<competitorId>", "Competitor id (from the competitors command)")
+    .action((competitorId) =>
+      api.removeCompetitor(competitorId).then(out).catch(fail)
+    );
+
+  program
+    .command("topics")
+    .description("The pillar list (topic clusters): queries, ideas and planned articles group under these")
+    .action(() => api.topics().then(out).catch(fail));
+
+  program
+    .command("topics-set")
+    .description("Replace the full pillar list (create/dedupe/safe-delete reconcile)")
+    .argument("<topics...>", "Topic names, space-separated (quote multi-word topics)")
+    .action((topics) => api.setTopics(topics).then(out).catch(fail));
+
+  program
+    .command("delete-planned")
+    .description("Remove a planned title from the calendar; the title returns to Content Ideas")
+    .argument("<contentId>", "Planned contentPage id")
+    .action((contentId) => api.deletePlanned(contentId).then(out).catch(fail));
+
   program
     .command("capacity")
     .description("Remaining plan slots on the content calendar")
@@ -287,6 +425,11 @@ export function runCli(argv) {
       api.generateContent(contentId, !!opts.confirm).then(out).catch(fail)
     );
 
+  program
+    .command("shopify-install-url <shop>")
+    .description("Mint a Shopify app install link for your store (open it in a browser; the destination is added to the workspace automatically)")
+    .action((shop) => api.shopifyInstallUrl(shop).then(out).catch(fail));
+
   program
     .command("settings")
     .description("Show the article policy: per-article defaults + flexible scheduling")
@@ -592,6 +735,21 @@ export function runCli(argv) {
     .description("Brand profile, products, and buyer profiles (ICPs) in one read")
     .action(() => api.brand().then(out).catch(fail));
 
+  program
+    .command("brand-set")
+    .description("Update brand identity: name, industry, product description, authors, style reference URLs")
+    .option("--name <name>", "Company/brand name")
+    .option("--industry <industry>", "Industry label")
+    .option("--description <text>", "Product description")
+    .option("--json <json>", "Full patch as JSON (or @file.json): {name?, industry?, productDescription?, authors?, styleReferenceUrls?}; authors/styleReferenceUrls replace the stored list")
+    .action((opts) => {
+      const patch = opts.json ? parseJson(opts.json, "brand-set") : {};
+      if (opts.name) patch.name = opts.name;
+      if (opts.industry) patch.industry = opts.industry;
+      if (opts.description) patch.productDescription = opts.description;
+      api.brandIdentitySet(patch).then(out).catch(fail);
+    });
+
   program
     .command("brand-profile-set")
     .description("Patch brand voice/style fields. --json '{\"tone\":\"...\"}' or --json @file.json")

package/src/client.mjs

@@ -113,6 +113,8 @@ export const api = {
     request("POST", "/api/v1/content/publish", { contentId, confirm }),
   generateContent: (contentId, confirm = false) =>
     request("POST", "/api/v1/content/generate", { contentId, confirm }),
+  shopifyInstallUrl: (shop) =>
+    request("POST", "/api/v1/integrations/shopify/install-url", { shop }),
   internalLinks: (contentId) =>
     request(
       "GET",
@@ -143,9 +145,39 @@ export const api = {
   repurposePush: (opts) => request("POST", "/api/v1/repurpose/push", opts),
   trackedQueries: () => request("GET", "/api/v1/queries"),
   addQuery: (queryText) => request("POST", "/api/v1/queries", { queryText }),
+  removeQuery: (queryId) =>
+    request("POST", "/api/v1/queries/remove", { queryId }),
+  setQueryTracking: (queryId, tracked) =>
+    request("POST", "/api/v1/queries/set-tracking", { queryId, tracked }),
+  updateQuery: (queryId, queryText) =>
+    request("POST", "/api/v1/queries/update", { queryId, queryText }),
+  competitors: () => request("GET", "/api/v1/competitors"),
+  addCompetitor: (name, websiteUrl) =>
+    request("POST", "/api/v1/competitors", { name, websiteUrl }),
+  removeCompetitor: (competitorId) =>
+    request("POST", "/api/v1/competitors/remove", { competitorId }),
+  topics: () => request("GET", "/api/v1/topics"),
+  setTopics: (topics) => request("POST", "/api/v1/topics", { topics }),
+  deletePlanned: (contentId) =>
+    request("POST", "/api/v1/content/delete-planned", { contentId }),
   crawlerAccess: () => request("GET", "/api/v1/crawler-access"),
   trafficOverview: (days = 30) =>
     request("GET", `/api/v1/analytics/traffic?days=${days}`),
+  analyticsSources: () => request("GET", "/api/v1/analytics/sources"),
+  setAnalyticsSource: (dataType, source) =>
+    request("POST", "/api/v1/analytics/sources", { dataType, source }),
+  activateScreen: (screen) =>
+    request("POST", "/api/v1/analytics/activate", { screen }),
+  cloudflareConnectUrl: () =>
+    request("POST", "/api/v1/integrations/cloudflare/connect-url"),
+  cloudflareZones: () =>
+    request("GET", "/api/v1/integrations/cloudflare/zones"),
+  cloudflareSelectZone: (zoneId, zoneName) =>
+    request("POST", "/api/v1/integrations/cloudflare/zone", { zoneId, zoneName }),
+  framerInstallEmbed: (opts = {}) =>
+    request("POST", "/api/v1/integrations/framer/install-embed", opts),
+  webflowInstallCustomCode: (opts = {}) =>
+    request("POST", "/api/v1/integrations/webflow/custom-code", opts),
   team: () => request("GET", "/api/v1/team"),
   teamInvite: (opts) => request("POST", "/api/v1/team/invite", opts),
   teamRevoke: (invitationId) =>
@@ -202,6 +234,7 @@ export const api = {
     request("POST", "/api/v1/social/draft-reply", { threadId, mentionMode }),
   support: (opts) => request("POST", "/api/v1/support", opts),
   brand: () => request("GET", "/api/v1/brand"),
+  brandIdentitySet: (opts) => request("POST", "/api/v1/brand", opts),
   brandProfileSet: (opts) => request("POST", "/api/v1/brand/profile", opts),
   brandProductWrite: (opts) => request("POST", "/api/v1/brand/product", opts),
   brandIcpWrite: (opts) => request("POST", "/api/v1/brand/icp", opts),

package/src/login.mjs

@@ -6,13 +6,22 @@ import {
   deleteStoredConfig,
 } from "./client.mjs";
 
+// Owner self-connection gets every grantable scope (server grants the full
+// set on approval regardless; "admin" keys are minted in Settings only).
 const DEFAULT_SCOPES = [
   "read:citations",
   "read:content",
   "read:leads",
   "read:analytics",
   "write:content",
+  "write:queries",
+  "write:leads",
+  "write:backlinks",
+  "write:social",
   "write:publish",
+  "manage:integrations",
+  "manage:org",
+  "trigger:agents",
 ];
 
 function openBrowser(url) {
@@ -31,9 +40,9 @@ function openBrowser(url) {
   }
 }
 
-export async function login({ scopes } = {}) {
+export async function login() {
   const { baseUrl, appUrl } = getBaseUrls();
-  const requested = scopes?.length ? scopes : DEFAULT_SCOPES;
+  const requested = DEFAULT_SCOPES;
 
   const startRes = await fetch(`${baseUrl}/api/v1/auth/device/start`, {
     method: "POST",

package/src/mcp.mjs

@@ -106,11 +106,93 @@ export async function startMcpServer() {
 
   server.tool(
     "get_crawler_access",
-    "Daily AI-crawler reachability probe result: whether the site's edge (e.g. Cloudflare Bot Fight Mode) or robots.txt blocks GPTBot/ClaudeBot — a blocked site cannot be read or cited by AI engines.",
+    "Daily AI-crawler reachability probe result — a DIAGNOSTIC, not a traffic metric: whether the site's edge (e.g. Cloudflare Bot Fight Mode) or robots.txt blocks GPTBot/ClaudeBot. 'shielded' means browsers and bots are both challenged (site-wide shield, ambiguous for real, signed crawlers).",
     {},
     run(() => api.crawlerAccess())
   );
 
+  server.tool(
+    "get_analytics_sources",
+    "Per-workspace analytics source setup: the selected writer for human traffic and AI-crawler data, which sources the setup qualifies for, and install state (Cloudflare zone/sync, WordPress plugin version, embed liveness). Both Analytics and Reports screens ship disabled until activated.",
+    {},
+    run(() => api.analyticsSources())
+  );
+
+  server.tool(
+    "set_analytics_source",
+    "Select the active writer for a data type. Validated server-side against what the customer's setup supports. Switching aiCrawlers to cloudflare starts a backfill sync.",
+    {
+      dataType: z.enum(["humanTraffic", "aiCrawlers"]),
+      source: z
+        .string()
+        .describe("embed, wordpress_plugin, cloudflare or none"),
+    },
+    run(({ dataType, source }) => api.setAnalyticsSource(dataType, source))
+  );
+
+  server.tool(
+    "activate_analytics_screen",
+    "Turn on the Analytics or Reports screen for this workspace (they ship disabled; activation is one-time per screen).",
+    { screen: z.enum(["analytics", "reports"]) },
+    run(({ screen }) => api.activateScreen(screen))
+  );
+
+  server.tool(
+    "get_cloudflare_connect_url",
+    "OAuth URL to connect read-only Cloudflare analytics (AI-crawler data source). Open it in a browser; the grant is scoped to Analytics:Read.",
+    {},
+    run(() => api.cloudflareConnectUrl())
+  );
+
+  server.tool(
+    "list_cloudflare_zones",
+    "Cloudflare zones visible to the connected grant, for picking which zone to poll.",
+    {},
+    run(() => api.cloudflareZones())
+  );
+
+  server.tool(
+    "select_cloudflare_zone",
+    "Pick the Cloudflare zone to poll. Also selects Cloudflare as the AI-crawler source and starts the first sync (backfills up to 7 days).",
+    {
+      zoneId: z.string(),
+      zoneName: z.string().describe("Zone name, e.g. example.com"),
+    },
+    run(({ zoneId, zoneName }) => api.cloudflareSelectZone(zoneId, zoneName))
+  );
+
+  server.tool(
+    "install_framer_embed",
+    "Install site-wide visit tracking on the connected Framer project via its custom-code API. Dry run unless confirm is true. Confirming ALSO PUBLISHES the customer's Framer site.",
+    {
+      integrationId: z.string().optional(),
+      confirm: z.boolean().optional().describe("Actually install (default: dry run)"),
+    },
+    run(({ integrationId, confirm }) =>
+      api.framerInstallEmbed({
+        ...(integrationId ? { integrationId } : {}),
+        confirm: confirm === true,
+      })
+    )
+  );
+
+  server.tool(
+    "install_webflow_custom_code",
+    "Register and apply the tracking loader via Webflow's Custom Code API. Dry run unless confirm is true. Needs a site token with CMS + Custom code scopes (pass apiToken to upgrade the stored one). Goes live on the customer's next Webflow site publish.",
+    {
+      integrationId: z.string().optional(),
+      apiToken: z.string().optional().describe("New site token with CMS + Custom code scopes"),
+      confirm: z.boolean().optional().describe("Actually install (default: dry run)"),
+    },
+    run(({ integrationId, apiToken, confirm }) =>
+      api.webflowInstallCustomCode({
+        ...(integrationId ? { integrationId } : {}),
+        ...(apiToken ? { apiToken } : {}),
+        confirm: confirm === true,
+      })
+    )
+  );
+
   server.tool(
     "add_tracked_query",
     "Add a query to the tracking pool. It starts weekly AI citation checks immediately when a plan slot is free; otherwise it joins the pool untracked.",
@@ -118,6 +200,80 @@ export async function startMcpServer() {
     run(({ queryText }) => api.addQuery(queryText))
   );
 
+  server.tool(
+    "remove_tracked_query",
+    "Delete a query from the tracking pool. Frees its plan slot if it was tracking.",
+    { queryId: z.string().describe("Query id from get_tracked_queries") },
+    run(({ queryId }) => api.removeQuery(queryId))
+  );
+
+  server.tool(
+    "set_query_tracking",
+    "Pause or resume weekly AI citation checks on a pooled query. Tracking consumes one plan slot; pausing frees it. The query stays in the pool either way.",
+    {
+      queryId: z.string().describe("Query id from get_tracked_queries"),
+      tracked: z.boolean().describe("true to track weekly, false to pause"),
+    },
+    run(({ queryId, tracked }) => api.setQueryTracking(queryId, tracked))
+  );
+
+  server.tool(
+    "update_tracked_query",
+    "Rewrite a tracked query's text. Future weekly checks use the new text.",
+    {
+      queryId: z.string().describe("Query id from get_tracked_queries"),
+      queryText: z.string().describe("New query text (min 5 characters)"),
+    },
+    run(({ queryId, queryText }) => api.updateQuery(queryId, queryText))
+  );
+
+  server.tool(
+    "get_competitors",
+    "Tracked competitors used in share-of-voice and visibility comparisons.",
+    {},
+    run(() => api.competitors())
+  );
+
+  server.tool(
+    "add_competitor",
+    "Track a competitor (max 10). They enter weekly share-of-voice comparisons against the org's own citation rate.",
+    {
+      name: z.string().describe("Competitor name"),
+      websiteUrl: z.string().describe("Competitor website URL"),
+    },
+    run(({ name, websiteUrl }) => api.addCompetitor(name, websiteUrl))
+  );
+
+  server.tool(
+    "remove_competitor",
+    "Stop tracking a competitor.",
+    { competitorId: z.string().describe("Competitor id from get_competitors") },
+    run(({ competitorId }) => api.removeCompetitor(competitorId))
+  );
+
+  server.tool(
+    "get_topics",
+    "The org's pillar list (topic clusters). Tracked queries, content ideas and planned articles all group under these.",
+    {},
+    run(() => api.topics())
+  );
+
+  server.tool(
+    "set_topics",
+    "Replace the FULL pillar list. Send every topic that should exist; missing ones are safe-deleted, new ones created, duplicates merged. Read get_topics first and modify that list.",
+    {
+      topics: z.array(z.string()).describe("The complete list of topic names"),
+    },
+    run(({ topics }) => api.setTopics(topics))
+  );
+
+  server.tool(
+    "delete_planned_title",
+    "Remove a planned title from the content calendar. The title returns to Content Ideas as a pool query (deduped), so the topic is not lost. Only planned rows qualify; use archive for generated articles.",
+    { contentId: z.string().describe("Planned contentPage id") },
+    run(({ contentId }) => api.deletePlanned(contentId))
+  );
+
   server.tool(
     "get_traffic_overview",
     "Traffic overview from RankControl's own page analytics: total page views, unique visitors, sessions, bounce rate, and average time on page.",
@@ -272,6 +428,15 @@ export async function startMcpServer() {
     run(({ contentId, confirm }) => api.generateContent(contentId, confirm === true))
   );
 
+  server.tool(
+    "shopify_install_url",
+    "Mint an install link for the RankControl Shopify app. A human opens it in a browser and approves the install in Shopify; the Shopify destination is then added to the workspace automatically. The link expires in 10 minutes and minting it has no side effect on its own.",
+    {
+      shop: z.string().describe("The store's .myshopify.com domain"),
+    },
+    run(({ shop }) => api.shopifyInstallUrl(shop))
+  );
+
   server.tool(
     "get_article_settings",
     "The workspace article policy: per-article defaults (auto-write, auto-publish, images, title-in-hero, section infographics, Related Reading, YouTube, emojis, link counts, global instructions) plus the flexible-scheduling flag.",
@@ -620,6 +785,30 @@ export async function startMcpServer() {
     run((args) => api.brandProfileSet(args))
   );
 
+  server.tool(
+    "update_brand_identity",
+    "Update workspace identity: name, industry, productDescription, authors (EEAT bylines used in article JSON-LD), styleReferenceUrls (articles whose writing style the writer imitates). authors and styleReferenceUrls REPLACE the stored list — call get_brand first and send the full updated list. websiteUrl is immutable and cannot be changed.",
+    {
+      name: z.string().optional(),
+      industry: z.string().optional(),
+      productDescription: z.string().optional(),
+      authors: z
+        .array(
+          z.object({
+            name: z.string(),
+            bio: z.string().optional(),
+            linkedinUrl: z
+              .string()
+              .optional()
+              .describe("Person sameAs URL for article JSON-LD"),
+          })
+        )
+        .optional(),
+      styleReferenceUrls: z.array(z.string()).optional(),
+    },
+    run((args) => api.brandIdentitySet(args))
+  );
+
   server.tool(
     "write_brand_product",
     "Create, update, or delete a product in brand memory (feeds article context + entity triples). Create: name+description+category. Update: productId + changed fields. Delete: productId + del=true.",