scrapeloop-mcp 0.7.0 → 0.8.0

package/README.md

@@ -2,10 +2,10 @@
 
 A [Model Context Protocol](https://modelcontextprotocol.io) server for Scrapeloop.
 **Set up and run Scrapeloop end-to-end from Claude Desktop, Cursor, ChatGPT, or any
-MCP client** — connect integrations, scrape or pull from the lead database, verify
+MCP client**  -  connect integrations, scrape or pull from the lead database, verify
 (incl. catch-all), clean, enrich, tag, and feed Instantly campaigns.
 
-Pair it with the [`scrapeloop-setup` skill](../skill) for a guided, step-by-step
+Pair it with the [`scrapeloop` skill](../skill) for a saved Playbook setup and task
 flow ("set up Scrapeloop").
 
 ## Setup
@@ -52,7 +52,7 @@ integrations:write  scrape  enrich  cleaners  strategies  campaigns:write  insta
 ```
 
 A 403 with `"API key missing scope(s): …"` means the key was minted with a narrower
-set — regenerate it with the full preset.
+set  -  regenerate it with the full preset.
 
 ## Tools
 
@@ -64,14 +64,14 @@ cleaners, strategy tags, vendors, scopes, and the ordered 7 setup steps) and
 |------|-------|
 | Discovery | `get_capabilities`, `get_setup_status`, `get_credits`, `get_meta` |
 | Integrations (BYOK) | `list_integrations`, `create_integration`, `list_credentials`, `add_credential`, `test_credential`, `list_instantly_connections` |
-| Scrape | `list_scrapers`, `estimate_scrape`, `submit_scrape`, `list_jobs`, `get_job`, `cancel_job` |
+| Scrape | `list_scrapers`, `estimate_scrape`, `submit_scrape`, `list_jobs`, `get_job`, `cancel_job`, `attach_job_to_table` |
 | Lead database | `search_leads`, `estimate_leads`, `reveal_lead`, `save_leads`, `bulk_verify_leads` |
 | Verify | `verify_email`, `verify_catchall` |
 | Clean | `list_cleaners`, `preview_cleaners`, `apply_cleaners` |
 | Enrich + strategies | `list_presets`, `create_preset`, `estimate_enrich`, `run_enrich`, `test_recipe`, `get_ai_settings`, `update_ai_settings`, `list_strategies`, `create_strategy`, `assign_strategy` |
 | Campaigns + Instantly | `list_instantly_campaigns`, `list_instantly_lead_lists`, `import_instantly_campaigns`, `import_instantly_lead_list`, `list_segments`, `create_segment`, `preview_segment`, `list_campaigns`, `create_campaign`, `update_campaign`, `activate_campaign`, `pause_campaign`, `sync_campaign`, `campaign_stats`, `get_sender_config`, `update_sender_config` |
 | B2B saved collections | `get_lists`, `create_list`, `add_list_members` |
-| Campaign-ready Tables | `get_tables`, `create_table`, `get_table_columns`, `create_table_column`, `set_table_cells`, `list_table_rows` |
+| Campaign-ready Tables | `get_tables`, `create_table`, `get_table_columns`, `create_table_column`, `create_table_preset_column`, `set_table_cells`, `list_table_rows` |
 
 `import_leads`, `preview_import`, and `import_leads_csv` accept raw identities
 without placeholder emails. Each row needs an email, LinkedIn URL, external ID,
@@ -90,7 +90,16 @@ typed value, with explicit `null` reserved for clearing. `set_table_cells`
 accepts at most 500 cells and 256 KiB of JSON, validates the complete batch,
 then persists it as one atomic upsert.
 
-`create_table`, `create_table_column`, and `create_table_view` are
+`create_table_preset_column` attaches a shipped system preset or an active
+workspace preset as a real enrichment column. It requires a stable
+`operation_id`, defaults `auto_run` to false, and accepts only overrides declared
+by the preset. When auto-run would backfill existing rows, the first call returns
+the exact row and cost estimate without writing. Repeat with `confirm_auto_run`
+and that exact `confirmed_estimated_cost_usd` only after user confirmation. The
+Table master switch and workspace budget caps still gate the queued work.
+
+`create_table`, `create_table_column`, `create_table_preset_column`, and
+`create_table_view` are
 idempotent. The MCP generates one `operation_id` for the logical create and
 reuses it across transient HTTP retries. The API returns the first resource for
 the same key and normalized payload, including concurrent calls, and returns
@@ -121,28 +130,40 @@ successful only after all four conditions are true:
 
 1. The exact `mcp-v<version>` tag matches `package.json`.
 2. Tests pass and the packed tarball contains only the declared package files.
-3. npm accepts the exact tarball with provenance, or already has that same
-   version with the same integrity.
+3. npm accepts the exact tarball through Trusted Publishing, or already has
+   that same version with the same integrity.
 4. `npx scrapeloop-mcp@<version>` reports the expected version and tool count.
 
+The installed-package check removes GitHub Actions' temporary npm authentication
+settings and replaces them with an empty, temporary public-registry config
+before it runs `npx`. That makes the final check use the public registry exactly
+like a customer install, without reusing publishing access.
+
 The Actions summary reports **Build and test** separately from **Publish and
 registry**. A green package build does not mean the version is published. A
-missing or rejected npm credential, a conflicting duplicate version, or a
-registry verification timeout fails the workflow.
+missing OIDC identity, a rejected trusted-publisher match, a conflicting
+duplicate version, or a registry verification timeout fails the workflow.
+
+### Trusted npm publishing
+
+The npm package trusts only the `publish-mcp.yml` GitHub Actions workflow in
+`Hinkam-Lanello/scrapeloop`. The workflow uses GitHub OIDC to request a
+short-lived npm publishing identity. It must run on a GitHub-hosted runner with
+`id-token: write`, Node.js 24, and npm 11.5.1 or newer. Do not add `NPM_TOKEN` or
+another long-lived publish token.
 
-### Human-owned npm credential
+The source repository is private, so the workflow must not force npm
+provenance. npm supports Trusted Publishing from a private GitHub repository,
+but provenance is available only when the source repository is public.
 
-An npm account owner must create a publish-capable access token for
-`scrapeloop-mcp` and store it as the GitHub Actions repository secret
-`NPM_TOKEN`. Agents must not create, reveal, or enter this credential. To recover
-an already tagged but unpublished version, run the workflow manually with its
-exact existing tag. The workflow archives and publishes that tag's source rather
-than the current default branch.
+To recover an already tagged but unpublished version, run the workflow manually
+with its exact existing tag. The workflow archives and publishes that tag's
+source rather than the current default branch.
 
 Local preflight, which never publishes:
 
 ```bash
 npm ci --no-audit --no-fund
 npm test
-npm run release:preflight -- --tag mcp-v0.7.0
+npm run release:preflight -- --tag mcp-v0.7.1
 ```

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "scrapeloop-mcp",
-  "version": "0.7.0",
-  "description": "Scrapeloop MCP server — set up and run Scrapeloop end-to-end (integrations, scraping, lead database, verification, cleaners, enrichment, strategies, Instantly campaigns) from any MCP client (Claude Desktop, Cursor, ChatGPT, …).",
+  "version": "0.8.0",
+  "description": "Scrapeloop MCP server  -  set up and run Scrapeloop end-to-end (integrations, scraping, lead database, verification, cleaners, enrichment, strategies, Instantly campaigns) from any MCP client (Claude Desktop, Cursor, ChatGPT, \u2026).",
   "type": "module",
   "scripts": {
-    "test": "node --check src/index.js && node test/mcp_table_tools.mjs && node test/mcp_community_intent.mjs && node test/mcp_api_key_preflight.mjs && node test/release_readiness.mjs",
+    "test": "node --check src/index.js && node test/mcp_table_tools.mjs && node test/mcp_playbook_plans.mjs && node test/mcp_community_intent.mjs && node test/mcp_api_key_preflight.mjs && node test/mutation_retry_contract.mjs && node test/release_readiness.mjs",
     "release:preflight": "node scripts/release-preflight.mjs",
     "release:verify": "node scripts/release-installed-verify.mjs"
   },
@@ -21,10 +21,26 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0"
   },
-  "keywords": ["mcp", "scrapeloop", "leads", "b2b", "email-verification", "cold-email", "model-context-protocol"],
+  "keywords": [
+    "mcp",
+    "scrapeloop",
+    "leads",
+    "b2b",
+    "email-verification",
+    "cold-email",
+    "model-context-protocol"
+  ],
   "homepage": "https://scrapeloop.com",
-  "repository": { "type": "git", "url": "git+https://github.com/Hinkam-Lanello/scrapeloop.git", "directory": "packages/mcp" },
-  "bugs": { "url": "https://github.com/Hinkam-Lanello/scrapeloop/issues" },
-  "publishConfig": { "access": "public" },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Hinkam-Lanello/scrapeloop.git",
+    "directory": "packages/mcp"
+  },
+  "bugs": {
+    "url": "https://github.com/Hinkam-Lanello/scrapeloop/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
   "license": "UNLICENSED"
 }