Changelog

Self-serve MCP key management.

• Issue, rotate, revoke org API keys from Settings → API keys.
• Per-key invocation history with status + latency.
• One-click Claude Desktop config snippet generation.
• Four new endpoints under /api/mcp/keys/* gated by owner/admin role.

Frontend rebuild foundation — four shells + 12 overlays + design tokens.

• Tailwind v4 semantic tokens (blue/slate) with dark-mode overrides.
• Marketing / App / Admin / Share shells from the Design OS handoff.
• Modal / drawer / banner / toast primitives via Radix UI.
• (marketing) / (auth) / (app) / (admin) / (share) route groups.

Phase 4 hardening — SSRF, webhook idempotency, headers, retention.

• Strict CSP + security headers in next.config.ts.
• SSRF guard tests + Stripe webhook idempotency tests.
• Inngest retention-cleanup function (180d events, 90d invocations).
• pnpm audit:high CI gate.

@pagereflect/mcp standalone npm package — seven tools shipped.

• get_account, start_audit, get_run, get_report, list_sites, get_history, get_schedule.
• Argon2id-hashed org API keys with prefix lookup.
• Per-call audit log via mcp_tool_invocations.
• 60 req/min per key, 600/min per org.

Audit pipeline alive on Inngest — homepage slice end-to-end.

• Four-stage pipeline: start-run → score-run → finalize-run → generate-pdf.
• Hourly Inngest scheduled function replaces Vercel cron for schedule-tick.
• Live snapshot via runs.live_snapshot JSONB.