ASDCD154 · Nov 11, 2026 · Nov 10, 2026
diff --git a/.cursor-plugin/marketplace.json b/.cursor-plugin/marketplace.json
@@ -6,7 +6,7 @@
   },
   "metadata": {
     "description": "Web data plugins by Decodo: scraping, SERP, and e-commerce extraction",
-    "version": "0.2.2"
+    "version": "0.3.0"
   },
   "plugins": [
     {

diff --git a/plugins/decodo/.cursor-plugin/plugin.json b/plugins/decodo/.cursor-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "decodo",
   "displayName": "Decodo",
-  "version": "0.2.2",
+  "version": "0.3.0",
   "description": "Web scraping, SERP, and e-commerce data for AI agents. Handles JavaScript rendering, anti-bot/CAPTCHA, proxy rotation, and geo-targeting — through the Decodo CLI or the hosted Decodo MCP server.",
   "author": {
     "name": "Decodo",
@@ -38,12 +38,12 @@
       "DECODO_AUTH_TOKEN": {
         "type": "string",
         "title": "Decodo API key or token",
-        "description": "Web Data API key (or, on older plans, basic auth token) from https://dashboard.decodo.com/web-data/playground (free account = up to 2K requests, no card). The same credential authenticates the MCP server, the CLI, and the raw API."
+        "description": "Web Data API key (or, on older plans, basic auth token) from https://dashboard.decodo.com/web-data/playground (free account = up to 10K requests, no card). The same credential authenticates the MCP server, the CLI, and the raw API. Search, map and crawl need an API key."
       },
       "DECODO_TOOLSETS": {
         "type": "string",
         "title": "MCP toolsets (optional)",
-        "description": "Which Decodo MCP toolsets to enable, comma-separated. Defaults to \"web,search\". Available: web, search, ecommerce, social_media, ai. The full server exposes ~30 tools, so enable only what you need — every enabled tool's schema is resident in each request. The decodo CLI covers all targets regardless of this setting."
+        "description": "Which Decodo MCP toolsets to enable, comma-separated. Defaults to \"web,search\". Available: web, search, ecommerce, social_media, ai. Enable only what you need — every enabled tool's schema is resident in each request. The decodo CLI covers all targets regardless of this setting."
       }
     },
     "required": [

diff --git a/plugins/decodo/README.md b/plugins/decodo/README.md
@@ -20,10 +20,11 @@ data instead of a 403.
 | Install | none | none (`npx`) or one installer command |
 | Needs a shell | no | yes |
 | Coverage | the toolsets you enable | every target, always |
-| Best for | plain scrape and search | retail, social, screenshots to file, batches, `jq` |
+| Best for | plain scrape, search and map | crawls, retail, social, screenshots to file, batches, `jq` |
 
-Both ship enabled. The skill routes plain scrape/search through MCP and everything else through
-the CLI, so you don't have to think about it.
+Both ship enabled. The skill routes plain scrape, search and map through MCP and everything else
+through the CLI, so you don't have to think about it. Crawls go through the CLI when a shell is
+available, because it writes pages to a file instead of into the agent's context.
 
 The MCP server defaults to the `web,search` toolsets. Widen it with `DECODO_TOOLSETS` (`web`,
 `search`, `ecommerce`, `social_media`, `ai`) only if you want those targets as direct tool calls
@@ -32,8 +33,8 @@ The MCP server defaults to the `web,search` toolsets. Widen it with `DECODO_TOOL
 ## Setup
 
 **1. Get an API key.** Grab a Web Data API key from the
-[Decodo Playground](https://dashboard.decodo.com/web-data/playground). A free account includes 2,000
-requests, no card required.
+[Decodo Playground](https://dashboard.decodo.com/web-data/playground). A free account includes up to
+10,000 requests, no card required.
 
 **2. Set `DECODO_AUTH_TOKEN`.** Cursor prompts for it when you install the plugin, or set it
 later under Settings → Plugins → Decodo. That one value authenticates the MCP server and the
@@ -44,7 +45,8 @@ export DECODO_AUTH_TOKEN='<your-token>'     # session-scoped
 npx -y @decodo/cli setup --token '<token>'  # CLI only, saved to ~/.config/decodo
 ```
 
-The value can be a Web Data API key or, on older plans, a basic auth token. The plugin's MCP header
+The value can be a Web Data API key or, on older plans, a basic auth token. Search, map and crawl
+need an API key; a basic token works for everything else. The plugin's MCP header
 is `Basic ${DECODO_AUTH_TOKEN}` either way: the hosted server detects the credential type from the
 value, not from the header scheme.
 

diff --git a/plugins/decodo/commands/decodo-setup.md b/plugins/decodo/commands/decodo-setup.md
@@ -26,8 +26,8 @@ Report the result as a two-line status, then continue only for the parts that ar
 
 ## 2. Get an API key or token (needed for either lane)
 
-Both lanes use the same Web Data API key. Older plans only have a basic auth token, which works the same way. Point the user at
-<https://dashboard.decodo.com/web-data/playground> — a free account gives ~2K requests with no card.
+Both lanes use the same Web Data API key. Older plans only have a basic auth token, which works the same way except for search, map and crawl, which need an API key. Point the user at
+<https://dashboard.decodo.com/web-data/playground> — a free account gives up to 10K requests with no card.
 
 **Never read, `cat`, echo, or log the token**, and never write it into a file the user tracks in
 git. If a token is already configured somewhere, do not extract it to reuse it elsewhere — ask

diff --git a/plugins/decodo/commands/decodo-status.md b/plugins/decodo/commands/decodo-status.md
@@ -12,8 +12,8 @@ Diagnose, do not fix. Report what is true, then name the single next step if som
 Check your own tool list for Decodo tools. Report:
 
 - **Tools present?** yes / no
-- **Which ones**, and therefore which toolsets are enabled (`scrape_as_markdown`/`screenshot` →
-  `web`; `google_search`/`bing_search` → `search`; `amazon_*`/`walmart_*`/`target_*` →
+- **Which ones**, and therefore which toolsets are enabled (`scrape_as_markdown`/`screenshot`/`map`/`crawl_*` →
+  `web`; `search`/`google_search` → `search`; `amazon_*`/`walmart_*`/`target_*` →
   `ecommerce`; `reddit_*`/`tiktok_*`/`youtube_*` → `social_media`; `chatgpt`/`perplexity`/
   `google_ai_mode` → `ai`).
 
@@ -46,6 +46,8 @@ Report version and auth source. Two things to state plainly rather than paper ov
   token the API would reject. Report it as "a token is configured", never as "authenticated".
 - **Version below 1.0.0** → flag it. 0.x stored config in a different directory and has no
   migration, so an upgrade looks like lost auth.
+- **Version below 2.0.0** → flag it. It has no `map` or `crawl`, and its `search` flags differ
+  from the skill's; `npx -y @decodo/cli@latest` or reinstalling gets the current version.
 
 Exit 3 means no usable credential (`No API key or auth token found.`) or a rejected one
 (`Invalid credentials` for an API key, `Incorrect username or password` for a basic auth token).
@@ -57,9 +59,9 @@ Give the user a short table — surface, state, next step — and nothing else:
 | Surface | State |
 |---|---|
 | MCP | tools present, toolsets `web,search` |
-| CLI | v1.0.2, token configured (unvalidated) |
+| CLI | v3.0.0, API key configured (unvalidated) |
 
-If both lanes are live, say so and note that plain scrape/search will go through MCP while
-everything else goes through the CLI. If neither is, point at `/decodo-setup`.
+If both lanes are live, say so and note that plain scrape, search and map will go through MCP while
+crawls and everything else go through the CLI. If neither is, point at `/decodo-setup`.
 
 Never print, echo, or partially reveal the token, even masked output copied from `whoami`.
diff --git a/plugins/decodo/rules/install.mdc b/plugins/decodo/rules/install.mdc
@@ -32,7 +32,7 @@ writing to it will not help. Tell the user:
 
 An exported `DECODO_AUTH_TOKEN` also resolves and takes precedence, but Cursor only inherits
 environment variables when it is launched from a shell, so the Settings route is the reliable
-one. API keys come from <https://dashboard.decodo.com/web-data/playground> (free account = up to 2K
+one. API keys come from <https://dashboard.decodo.com/web-data/playground> (free account = up to 10K
 requests, no card).
 
 Reloading is required — the header is resolved when the server connects, so a token set after
@@ -79,7 +79,7 @@ This section is the **CLI's** token store, which is separate from the MCP plugin
 setting one does not affect the other.
 
 The user needs a Web Data API key (or, on older plans, a basic auth token) from
-<https://dashboard.decodo.com/web-data/playground> (free account = up to 2K requests, no card).
+<https://dashboard.decodo.com/web-data/playground> (free account = up to 10K requests, no card).
 
 ```bash
 export DECODO_AUTH_TOKEN='<token>'     # preferred: no interaction, session-scoped
@@ -127,6 +127,9 @@ no "401", "unauthorized", or "auth required". The messages mean different things
 - `Invalid credentials` — an API key *is* configured, and the API rejected it (expired, wrong,
   or truncated).
 - `Incorrect username or password` — a basic auth token *is* configured, and the API rejected it.
+- Any exit 3 from `search`, `map` or `crawl` while `decodo whoami` shows `token:` (not
+  `api key:`) — those three commands need an API key, and a basic token is never accepted there.
+  Ask the user for an API key; `scrape` and target commands keep working with the token.
 
 ```bash
 decodo whoami        # shows the CONFIGURED source + masked token — does NOT validate it