0nmcp 2.2.0 → 2.4.0

package/catalog.js

@@ -117,18 +117,110 @@ export const SERVICE_CATALOG = {
   resend: {
     name: "Resend",
     type: "email",
-    description: "Developer-first email API — send transactional emails",
+    description: "Developer-first email API — transactional emails, broadcasts, contacts, domains, templates, segments, webhooks",
     baseUrl: "https://api.resend.com",
     authType: "api_key",
     credentialKeys: ["apiKey"],
     capabilities: [
-      { name: "send_email", actions: ["send"], description: "Send transactional emails" },
-      { name: "manage_domains", actions: ["list"], description: "Manage email domains" },
+      { name: "send_email", actions: ["send"], description: "Send transactional emails with HTML, React templates, scheduling, and attachments" },
+      { name: "batch_emails", actions: ["send"], description: "Send up to 100 emails in a single batch request" },
+      { name: "manage_emails", actions: ["list", "get", "update", "cancel"], description: "List, retrieve, update scheduled, and cancel emails" },
+      { name: "receive_emails", actions: ["list", "get"], description: "List and retrieve received inbound emails" },
+      { name: "manage_attachments", actions: ["list", "get"], description: "List and retrieve attachments from sent and received emails" },
+      { name: "manage_domains", actions: ["create", "list", "get", "update", "verify", "delete"], description: "Create, list, verify, update, and delete email domains" },
+      { name: "manage_api_keys", actions: ["create", "list", "delete"], description: "Create, list, and delete API keys" },
+      { name: "manage_audiences", actions: ["create", "list", "get", "delete"], description: "Create, list, get, and delete audiences (deprecated — use segments)" },
+      { name: "manage_contacts", actions: ["create", "list", "get", "update", "delete"], description: "Create, list, get, update, and delete contacts" },
+      { name: "manage_contact_segments", actions: ["add", "remove", "list"], description: "Add, remove, and list segment memberships for contacts" },
+      { name: "manage_contact_topics", actions: ["get", "update"], description: "Get and update topic subscriptions for contacts" },
+      { name: "manage_broadcasts", actions: ["create", "list", "get", "update", "send", "delete"], description: "Create, list, get, update, send, and delete broadcasts" },
+      { name: "manage_segments", actions: ["create", "list", "get", "delete"], description: "Create, list, get, and delete segments" },
+      { name: "manage_contact_properties", actions: ["create", "list", "get", "update", "delete"], description: "Create, list, get, update, and delete contact properties" },
+      { name: "manage_templates", actions: ["create", "list", "get", "update", "delete", "duplicate", "publish"], description: "Create, list, get, update, delete, duplicate, and publish email templates" },
+      { name: "manage_topics", actions: ["create", "list", "get", "update", "delete"], description: "Create, list, get, update, and delete email topics" },
+      { name: "manage_webhooks", actions: ["create", "list", "get", "update", "delete"], description: "Create, list, get, update, and delete webhooks" },
     ],
     endpoints: {
-      send_email:    { method: "POST", path: "/emails", body: { from: "", to: [], subject: "", html: "" } },
-      list_emails:   { method: "GET",  path: "/emails" },
-      list_domains:  { method: "GET",  path: "/domains" },
+      // ── Emails ──
+      send_email:               { method: "POST",   path: "/emails", body: { from: "", to: [], subject: "", html: "" } },
+      send_batch_emails:        { method: "POST",   path: "/emails/batch", body: [] },
+      list_emails:              { method: "GET",    path: "/emails" },
+      get_email:                { method: "GET",    path: "/emails/{email_id}" },
+      update_email:             { method: "PATCH",  path: "/emails/{email_id}" },
+      cancel_email:             { method: "POST",   path: "/emails/{email_id}/cancel" },
+      // ── Received Emails ──
+      list_received_emails:     { method: "GET",    path: "/emails/receiving" },
+      get_received_email:       { method: "GET",    path: "/emails/receiving/{email_id}" },
+      // ── Attachments ──
+      list_email_attachments:   { method: "GET",    path: "/emails/{email_id}/attachments" },
+      get_email_attachment:     { method: "GET",    path: "/emails/{email_id}/attachments/{attachment_id}" },
+      list_received_attachments:{ method: "GET",    path: "/emails/receiving/{email_id}/attachments" },
+      get_received_attachment:  { method: "GET",    path: "/emails/receiving/{email_id}/attachments/{attachment_id}" },
+      // ── Domains ──
+      create_domain:            { method: "POST",   path: "/domains", body: { name: "" } },
+      list_domains:             { method: "GET",    path: "/domains" },
+      get_domain:               { method: "GET",    path: "/domains/{domain_id}" },
+      update_domain:            { method: "PATCH",  path: "/domains/{domain_id}" },
+      verify_domain:            { method: "POST",   path: "/domains/{domain_id}/verify" },
+      delete_domain:            { method: "DELETE", path: "/domains/{domain_id}" },
+      // ── API Keys ──
+      create_api_key:           { method: "POST",   path: "/api-keys", body: { name: "" } },
+      list_api_keys:            { method: "GET",    path: "/api-keys" },
+      delete_api_key:           { method: "DELETE", path: "/api-keys/{api_key_id}" },
+      // ── Audiences (deprecated) ──
+      create_audience:          { method: "POST",   path: "/audiences", body: { name: "" } },
+      list_audiences:           { method: "GET",    path: "/audiences" },
+      get_audience:             { method: "GET",    path: "/audiences/{audience_id}" },
+      delete_audience:          { method: "DELETE", path: "/audiences/{audience_id}" },
+      // ── Contacts ──
+      create_contact:           { method: "POST",   path: "/contacts", body: { email: "" } },
+      list_contacts:            { method: "GET",    path: "/contacts" },
+      get_contact:              { method: "GET",    path: "/contacts/{contact_id}" },
+      update_contact:           { method: "PATCH",  path: "/contacts/{contact_id}" },
+      delete_contact:           { method: "DELETE", path: "/contacts/{contact_id}" },
+      add_contact_to_segment:   { method: "POST",   path: "/contacts/{contact_id}/segments/{segment_id}" },
+      remove_contact_from_segment: { method: "DELETE", path: "/contacts/{contact_id}/segments/{segment_id}" },
+      list_contact_segments:    { method: "GET",    path: "/contacts/{contact_id}/segments" },
+      get_contact_topics:       { method: "GET",    path: "/contacts/{contact_id}/topics" },
+      update_contact_topics:    { method: "PATCH",  path: "/contacts/{contact_id}/topics" },
+      // ── Broadcasts ──
+      create_broadcast:         { method: "POST",   path: "/broadcasts", body: { segment_id: "", from: "", subject: "" } },
+      list_broadcasts:          { method: "GET",    path: "/broadcasts" },
+      get_broadcast:            { method: "GET",    path: "/broadcasts/{broadcast_id}" },
+      update_broadcast:         { method: "PATCH",  path: "/broadcasts/{broadcast_id}" },
+      send_broadcast:           { method: "POST",   path: "/broadcasts/{broadcast_id}/send" },
+      delete_broadcast:         { method: "DELETE", path: "/broadcasts/{broadcast_id}" },
+      // ── Segments ──
+      create_segment:           { method: "POST",   path: "/segments", body: { name: "" } },
+      list_segments:            { method: "GET",    path: "/segments" },
+      get_segment:              { method: "GET",    path: "/segments/{segment_id}" },
+      delete_segment:           { method: "DELETE", path: "/segments/{segment_id}" },
+      // ── Contact Properties ──
+      create_contact_property:  { method: "POST",   path: "/contact-properties", body: { name: "", type: "string" } },
+      list_contact_properties:  { method: "GET",    path: "/contact-properties" },
+      get_contact_property:     { method: "GET",    path: "/contact-properties/{property_id}" },
+      update_contact_property:  { method: "PATCH",  path: "/contact-properties/{property_id}" },
+      delete_contact_property:  { method: "DELETE", path: "/contact-properties/{property_id}" },
+      // ── Templates ──
+      create_template:          { method: "POST",   path: "/templates", body: { name: "", html: "" } },
+      list_templates:           { method: "GET",    path: "/templates" },
+      get_template:             { method: "GET",    path: "/templates/{template_id}" },
+      update_template:          { method: "PATCH",  path: "/templates/{template_id}" },
+      delete_template:          { method: "DELETE", path: "/templates/{template_id}" },
+      duplicate_template:       { method: "POST",   path: "/templates/{template_id}/duplicate" },
+      publish_template:         { method: "POST",   path: "/templates/{template_id}/publish" },
+      // ── Topics ──
+      create_topic:             { method: "POST",   path: "/topics", body: { name: "" } },
+      list_topics:              { method: "GET",    path: "/topics" },
+      get_topic:                { method: "GET",    path: "/topics/{topic_id}" },
+      update_topic:             { method: "PATCH",  path: "/topics/{topic_id}" },
+      delete_topic:             { method: "DELETE", path: "/topics/{topic_id}" },
+      // ── Webhooks ──
+      create_webhook:           { method: "POST",   path: "/webhooks", body: { endpoint_url: "", events: [] } },
+      list_webhooks:            { method: "GET",    path: "/webhooks" },
+      get_webhook:              { method: "GET",    path: "/webhooks/{webhook_id}" },
+      update_webhook:           { method: "PATCH",  path: "/webhooks/{webhook_id}" },
+      delete_webhook:           { method: "DELETE", path: "/webhooks/{webhook_id}" },
     },
     authHeader: (creds) => ({
       "Authorization": `Bearer ${creds.apiKey}`,
@@ -1517,6 +1609,230 @@ export const SERVICE_CATALOG = {
     }),
   },
 
+  // ── Cloudflare ──────────────────────────────────────────────
+  cloudflare: {
+    name: "Cloudflare",
+    type: "cloud",
+    description: "Edge computing & CDN — Workers, KV, R2 storage, D1 database, DNS, WAF, DDoS protection, analytics",
+    baseUrl: "https://api.cloudflare.com/client/v4",
+    authType: "api_key",
+    credentialKeys: ["apiToken"],
+    capabilities: [
+      { name: "manage_workers", actions: ["list", "create", "update", "delete", "deploy"], description: "Deploy and manage Cloudflare Workers" },
+      { name: "manage_kv", actions: ["list_namespaces", "read", "write", "delete"], description: "Key-Value storage for Workers" },
+      { name: "manage_r2", actions: ["list_buckets", "create_bucket", "list_objects", "put_object", "get_object", "delete_object"], description: "S3-compatible object storage" },
+      { name: "manage_d1", actions: ["list_databases", "create_database", "query"], description: "Serverless SQL database" },
+      { name: "manage_dns", actions: ["list_zones", "list_records", "create_record", "update_record", "delete_record"], description: "DNS zone and record management" },
+      { name: "manage_waf", actions: ["list_rules", "create_rule", "update_rule"], description: "Web Application Firewall rules" },
+      { name: "manage_pages", actions: ["list_projects", "create_deployment"], description: "Cloudflare Pages static site deployments" },
+      { name: "analytics", actions: ["get_zone_analytics", "get_worker_analytics"], description: "Traffic and performance analytics" },
+    ],
+    endpoints: {
+      list_zones:            { method: "GET",  path: "/zones", query: ["name", "status", "page", "per_page"] },
+      get_zone:              { method: "GET",  path: "/zones/{zoneId}" },
+      list_dns_records:      { method: "GET",  path: "/zones/{zoneId}/dns_records", query: ["type", "name", "page", "per_page"] },
+      create_dns_record:     { method: "POST", path: "/zones/{zoneId}/dns_records", body: { type: "", name: "", content: "", ttl: 1, proxied: true } },
+      update_dns_record:     { method: "PUT",  path: "/zones/{zoneId}/dns_records/{recordId}", body: {} },
+      delete_dns_record:     { method: "DELETE", path: "/zones/{zoneId}/dns_records/{recordId}" },
+      list_workers:          { method: "GET",  path: "/accounts/{accountId}/workers/scripts" },
+      get_worker:            { method: "GET",  path: "/accounts/{accountId}/workers/scripts/{scriptName}" },
+      delete_worker:         { method: "DELETE", path: "/accounts/{accountId}/workers/scripts/{scriptName}" },
+      list_kv_namespaces:    { method: "GET",  path: "/accounts/{accountId}/storage/kv/namespaces" },
+      create_kv_namespace:   { method: "POST", path: "/accounts/{accountId}/storage/kv/namespaces", body: { title: "" } },
+      read_kv_value:         { method: "GET",  path: "/accounts/{accountId}/storage/kv/namespaces/{namespaceId}/values/{keyName}" },
+      write_kv_value:        { method: "PUT",  path: "/accounts/{accountId}/storage/kv/namespaces/{namespaceId}/values/{keyName}" },
+      delete_kv_value:       { method: "DELETE", path: "/accounts/{accountId}/storage/kv/namespaces/{namespaceId}/values/{keyName}" },
+      list_r2_buckets:       { method: "GET",  path: "/accounts/{accountId}/r2/buckets" },
+      create_r2_bucket:      { method: "POST", path: "/accounts/{accountId}/r2/buckets", body: { name: "" } },
+      list_d1_databases:     { method: "GET",  path: "/accounts/{accountId}/d1/database" },
+      create_d1_database:    { method: "POST", path: "/accounts/{accountId}/d1/database", body: { name: "" } },
+      query_d1:              { method: "POST", path: "/accounts/{accountId}/d1/database/{databaseId}/query", body: { sql: "" } },
+      list_pages_projects:   { method: "GET",  path: "/accounts/{accountId}/pages/projects" },
+      get_zone_analytics:    { method: "GET",  path: "/zones/{zoneId}/analytics/dashboard", query: ["since", "until"] },
+    },
+    authHeader: (creds) => ({
+      "Authorization": `Bearer ${creds.apiToken}`,
+      "Content-Type": "application/json",
+    }),
+  },
+
+  // ── GoDaddy ───────────────────────────────────────────────────
+  godaddy: {
+    name: "GoDaddy",
+    type: "domains",
+    description: "Domain registrar — search, check availability, manage DNS records, domain registration and management",
+    baseUrl: "https://api.godaddy.com/v1",
+    authType: "api_key",
+    credentialKeys: ["apiKey", "apiSecret"],
+    capabilities: [
+      { name: "search_domains", actions: ["suggest", "check_availability"], description: "Search and check domain name availability" },
+      { name: "manage_domains", actions: ["list", "get", "purchase"], description: "List owned domains and purchase new ones" },
+      { name: "manage_dns", actions: ["list_records", "add_record", "update_record", "delete_record"], description: "Manage DNS records for owned domains" },
+    ],
+    endpoints: {
+      suggest_domains:       { method: "GET",  path: "/domains/suggest", query: ["query", "limit", "tlds"] },
+      check_availability:    { method: "GET",  path: "/domains/available", query: ["domain"] },
+      list_domains:          { method: "GET",  path: "/domains", query: ["limit", "marker", "status"] },
+      get_domain:            { method: "GET",  path: "/domains/{domain}" },
+      purchase_domain:       { method: "POST", path: "/domains/purchase", body: { domain: "", consent: {} } },
+      list_dns_records:      { method: "GET",  path: "/domains/{domain}/records", query: ["type", "name"] },
+      add_dns_records:       { method: "PATCH", path: "/domains/{domain}/records", body: [] },
+      update_dns_record:     { method: "PUT",  path: "/domains/{domain}/records/{type}/{name}", body: [] },
+      delete_dns_record:     { method: "DELETE", path: "/domains/{domain}/records/{type}/{name}" },
+    },
+    authHeader: (creds) => ({
+      "Authorization": `sso-key ${creds.apiKey}:${creds.apiSecret}`,
+      "Content-Type": "application/json",
+    }),
+  },
+
+  // ── n8n ─────────────────────────────────────────────────────
+  n8n: {
+    name: "n8n",
+    type: "automation",
+    description: "Open-source workflow automation — workflows, executions, credentials, triggers, webhooks (self-hosted or cloud)",
+    baseUrl: "https://app.n8n.cloud/api/v1",
+    authType: "api_key",
+    credentialKeys: ["apiKey", "baseUrl"],
+    capabilities: [
+      { name: "manage_workflows", actions: ["list", "get", "create", "update", "delete", "activate", "deactivate"], description: "Create and manage automation workflows" },
+      { name: "manage_executions", actions: ["list", "get", "delete"], description: "View and manage workflow execution history" },
+      { name: "manage_credentials", actions: ["list", "create", "delete"], description: "Manage integration credentials" },
+      { name: "trigger_workflow", actions: ["execute"], description: "Trigger a workflow via webhook or API" },
+    ],
+    endpoints: {
+      list_workflows:        { method: "GET",  path: "/workflows", query: ["active", "limit", "cursor"] },
+      get_workflow:           { method: "GET",  path: "/workflows/{workflowId}" },
+      create_workflow:        { method: "POST", path: "/workflows", body: { name: "", nodes: [], connections: {} } },
+      update_workflow:        { method: "PUT",  path: "/workflows/{workflowId}", body: {} },
+      delete_workflow:        { method: "DELETE", path: "/workflows/{workflowId}" },
+      activate_workflow:      { method: "PATCH", path: "/workflows/{workflowId}", body: { active: true } },
+      deactivate_workflow:    { method: "PATCH", path: "/workflows/{workflowId}", body: { active: false } },
+      list_executions:        { method: "GET",  path: "/executions", query: ["workflowId", "status", "limit", "cursor"] },
+      get_execution:          { method: "GET",  path: "/executions/{executionId}" },
+      delete_execution:       { method: "DELETE", path: "/executions/{executionId}" },
+      list_credentials:       { method: "GET",  path: "/credentials", query: ["limit", "cursor"] },
+      create_credential:      { method: "POST", path: "/credentials", body: { name: "", type: "", data: {} } },
+      delete_credential:      { method: "DELETE", path: "/credentials/{credentialId}" },
+      execute_workflow:        { method: "POST", path: "/workflows/{workflowId}/run", body: {} },
+    },
+    authHeader: (creds) => ({
+      "X-N8N-API-KEY": creds.apiKey,
+      "Content-Type": "application/json",
+    }),
+  },
+
+  // ── Pabbly Connect ──────────────────────────────────────────
+  pabbly: {
+    name: "Pabbly Connect",
+    type: "automation",
+    description: "Workflow automation — connect apps, build automations, manage workflows with webhook triggers",
+    baseUrl: "https://connect.pabbly.com/api",
+    authType: "api_key",
+    credentialKeys: ["apiKey"],
+    capabilities: [
+      { name: "manage_workflows", actions: ["list", "get", "create", "enable", "disable"], description: "Create and manage automation workflows" },
+      { name: "manage_connections", actions: ["list"], description: "View connected app integrations" },
+      { name: "manage_executions", actions: ["list", "get"], description: "View workflow execution history and logs" },
+      { name: "trigger_workflow", actions: ["execute"], description: "Trigger a workflow via webhook" },
+    ],
+    endpoints: {
+      list_workflows:        { method: "GET",  path: "/workflows", query: ["page", "limit"] },
+      get_workflow:           { method: "GET",  path: "/workflows/{workflowId}" },
+      create_workflow:        { method: "POST", path: "/workflows", body: { name: "", trigger: {} } },
+      enable_workflow:        { method: "PUT",  path: "/workflows/{workflowId}/enable" },
+      disable_workflow:       { method: "PUT",  path: "/workflows/{workflowId}/disable" },
+      list_connections:       { method: "GET",  path: "/connections" },
+      list_executions:        { method: "GET",  path: "/workflows/{workflowId}/executions", query: ["page", "limit"] },
+      get_execution:          { method: "GET",  path: "/workflows/{workflowId}/executions/{executionId}" },
+      trigger_webhook:        { method: "POST", path: "/webhooks/{webhookId}", body: {} },
+    },
+    authHeader: (creds) => ({
+      "Authorization": `Bearer ${creds.apiKey}`,
+      "Content-Type": "application/json",
+    }),
+  },
+
+  // ── Make (Integromat) ─────────────────────────────────────
+  make: {
+    name: "Make",
+    type: "automation",
+    description: "Visual automation platform (formerly Integromat) — scenarios, organizations, connections, data stores",
+    baseUrl: "https://us1.make.com/api/v2",
+    authType: "api_key",
+    credentialKeys: ["apiToken"],
+    capabilities: [
+      { name: "manage_scenarios", actions: ["list", "get", "create", "update", "start", "stop", "run"], description: "Create and manage automation scenarios" },
+      { name: "manage_connections", actions: ["list", "get", "verify"], description: "Manage app connections" },
+      { name: "manage_data_stores", actions: ["list", "get_records"], description: "Access internal data stores" },
+      { name: "manage_organizations", actions: ["list", "get"], description: "View organizations and teams" },
+      { name: "manage_executions", actions: ["list"], description: "View scenario execution history" },
+    ],
+    endpoints: {
+      list_scenarios:        { method: "GET",  path: "/scenarios", query: ["teamId", "folderId", "pg[limit]", "pg[offset]"] },
+      get_scenario:          { method: "GET",  path: "/scenarios/{scenarioId}" },
+      create_scenario:       { method: "POST", path: "/scenarios", body: { teamId: 0, name: "", blueprint: {} } },
+      update_scenario:       { method: "PATCH", path: "/scenarios/{scenarioId}", body: {} },
+      start_scenario:        { method: "POST", path: "/scenarios/{scenarioId}/start" },
+      stop_scenario:         { method: "POST", path: "/scenarios/{scenarioId}/stop" },
+      run_scenario:          { method: "POST", path: "/scenarios/{scenarioId}/run", body: {} },
+      list_connections:      { method: "GET",  path: "/connections", query: ["teamId", "pg[limit]"] },
+      get_connection:        { method: "GET",  path: "/connections/{connectionId}" },
+      verify_connection:     { method: "POST", path: "/connections/{connectionId}/test" },
+      list_data_stores:      { method: "GET",  path: "/data-stores", query: ["teamId"] },
+      get_data_store_records:{ method: "GET",  path: "/data-stores/{dataStoreId}/data", query: ["pg[limit]", "pg[offset]"] },
+      list_organizations:    { method: "GET",  path: "/organizations" },
+      get_organization:      { method: "GET",  path: "/organizations/{organizationId}" },
+      list_executions:       { method: "GET",  path: "/scenarios/{scenarioId}/logs", query: ["pg[limit]", "pg[offset]"] },
+    },
+    authHeader: (creds) => ({
+      "Authorization": `Token ${creds.apiToken}`,
+      "Content-Type": "application/json",
+    }),
+  },
+
+  // ── Whimsical ──────────────────────────────────────────────
+  whimsical: {
+    name: "Whimsical",
+    type: "design",
+    description: "Visual collaboration — flowcharts, wireframes, mind maps, docs, sticky notes, and AI-powered diagramming",
+    baseUrl: "https://api.whimsical.com",
+    authType: "oauth",
+    credentialKeys: ["accessToken"],
+    capabilities: [
+      { name: "manage_workspaces", actions: ["list", "get"], description: "List and view workspaces" },
+      { name: "manage_boards", actions: ["list", "get", "create", "update", "delete"], description: "Create and manage whiteboards, flowcharts, wireframes" },
+      { name: "manage_docs", actions: ["list", "get", "create", "update"], description: "Create and manage documents" },
+      { name: "manage_mind_maps", actions: ["list", "get", "create"], description: "Create and manage mind maps" },
+      { name: "generate_diagrams", actions: ["create_from_mermaid", "create_from_text"], description: "AI-powered diagram generation from text or Mermaid markup" },
+      { name: "manage_users", actions: ["list", "create", "update", "deactivate"], description: "SCIM user provisioning and management" },
+    ],
+    endpoints: {
+      list_workspaces:       { method: "GET",  path: "/workspaces" },
+      get_workspace:         { method: "GET",  path: "/workspaces/{workspaceId}" },
+      list_boards:           { method: "GET",  path: "/workspaces/{workspaceId}/boards", query: ["type", "limit", "cursor"] },
+      get_board:             { method: "GET",  path: "/boards/{boardId}" },
+      create_board:          { method: "POST", path: "/workspaces/{workspaceId}/boards", body: { name: "", type: "flowchart" } },
+      update_board:          { method: "PATCH", path: "/boards/{boardId}", body: {} },
+      delete_board:          { method: "DELETE", path: "/boards/{boardId}" },
+      get_board_export:      { method: "GET",  path: "/boards/{boardId}/export", query: ["format"] },
+      list_docs:             { method: "GET",  path: "/workspaces/{workspaceId}/docs", query: ["limit", "cursor"] },
+      get_doc:               { method: "GET",  path: "/docs/{docId}" },
+      create_doc:            { method: "POST", path: "/workspaces/{workspaceId}/docs", body: { title: "", content: "" } },
+      update_doc:            { method: "PATCH", path: "/docs/{docId}", body: {} },
+      create_from_mermaid:   { method: "POST", path: "/boards/from-mermaid", body: { workspaceId: "", mermaid: "", name: "" } },
+      create_from_text:      { method: "POST", path: "/boards/from-text", body: { workspaceId: "", text: "", type: "flowchart" } },
+      list_scim_users:       { method: "GET",  path: "/scim-v2/Users", query: ["filter", "count", "startIndex"] },
+      create_scim_user:      { method: "POST", path: "/scim-v2/Users", body: { schemas: ["urn:ietf:params:scim:schemas:core:2.0:User"], userName: "", name: {} } },
+      update_scim_user:      { method: "PUT",  path: "/scim-v2/Users/{userId}", body: {} },
+      deactivate_scim_user:  { method: "PATCH", path: "/scim-v2/Users/{userId}", body: { Operations: [{ op: "replace", value: { active: false } }] } },
+    },
+    authHeader: (creds) => ({
+      "Authorization": `Bearer ${creds.accessToken}`,
+      "Content-Type": "application/json",
+    }),
+  },
+
 };
 
 // ── Helpers ────────────────────────────────────────────────

package/cli.js

@@ -6,6 +6,9 @@
  * 
  * Usage:
  *   npx 0nmcp              Start MCP server (stdio)
+ *   npx 0nmcp login        Authenticate with 0nmcp.com (device auth flow)
+ *   npx 0nmcp logout       Revoke token and clear local auth
+ *   npx 0nmcp whoami       Show authenticated user info
  *   npx 0nmcp serve        Start HTTP server (REST + MCP + webhooks)
  *   npx 0nmcp run <wf>     Run a .0n workflow from CLI
  *   npx 0nmcp init         Initialize ~/.0n directory
@@ -17,6 +20,8 @@
  *   npx 0nmcp migrate      Migrate from ~/.0nmcp to ~/.0n
  *   npx 0nmcp engine       Engine commands (import, verify, platforms, export, open)
  *   npx 0nmcp app          Application commands (run, build, inspect, validate, list)
+ *   npx 0nmcp vault sync   Push local credentials to cloud (E2E encrypted)
+ *   npx 0nmcp vault pull   Pull credentials from cloud to local
  * 
  * ═══════════════════════════════════════════════════════════════════════════
  */
@@ -71,6 +76,33 @@ async function main() {
     return;
   }
 
+  // ── Auth commands (no login required) ──────────────────────
+
+  if (command === 'login') {
+    console.log(BANNER);
+    const { login } = await import('./auth.js');
+    await login();
+    return;
+  }
+
+  if (command === 'logout') {
+    const { logout } = await import('./auth.js');
+    await logout();
+    return;
+  }
+
+  if (command === 'whoami') {
+    const { whoami } = await import('./auth.js');
+    await whoami();
+    return;
+  }
+
+  if (command === 'version' || command === '--version' || command === '-v') {
+    const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'), 'utf8'));
+    console.log(`0nmcp v${pkg.version}`);
+    return;
+  }
+
   // Help
   if (command === 'help' || command === '--help' || command === '-h') {
     console.log(BANNER);
@@ -78,6 +110,9 @@ async function main() {
 ${c.bright}Usage:${c.reset}
 
   ${c.cyan}npx 0nmcp${c.reset}              Start MCP server (stdio, for Claude Desktop)
+  ${c.cyan}npx 0nmcp login${c.reset}        Authenticate with 0nmcp.com
+  ${c.cyan}npx 0nmcp logout${c.reset}       Revoke token and clear local auth
+  ${c.cyan}npx 0nmcp whoami${c.reset}       Show authenticated user info
   ${c.cyan}npx 0nmcp serve${c.reset}        Start HTTP server (REST + MCP + webhooks)
   ${c.cyan}npx 0nmcp run <wf>${c.reset}     Run a .0n workflow from CLI
   ${c.cyan}npx 0nmcp init${c.reset}         Initialize ~/.0n directory
@@ -157,6 +192,23 @@ ${c.bright}Links:${c.reset}
     return;
   }
 
+  // ── Auth Gate ──────────────────────────────────────────────
+  // All commands below this point require authentication.
+  const AUTH_FREE = ['help', '--help', '-h', 'login', 'logout', 'whoami', 'version', '--version', '-v'];
+  if (!AUTH_FREE.includes(command)) {
+    try {
+      const { isAuthenticated } = await import('./auth.js');
+      if (!await isAuthenticated()) {
+        console.log(`\n${c.red}${c.bright}  Authentication required.${c.reset}`);
+        console.log(`  Run: ${c.cyan}0nmcp login${c.reset}\n`);
+        process.exit(1);
+      }
+    } catch (err) {
+      // Auth module load failure — allow through for local-only ops
+      // This handles cases where the module has issues
+    }
+  }
+
   // Init
   if (command === 'init') {
     console.log(BANNER);
@@ -586,6 +638,12 @@ ${c.bright}Vault Container Commands${c.reset} ${c.yellow}(Patent Pending #63/990
 
   ${c.cyan}vault revoke <id>${c.reset}          Revoke a transfer ID
 
+${c.bright}Vault Sync (E2E Encrypted):${c.reset}
+
+  ${c.cyan}vault sync${c.reset}                   Push local credentials to cloud (encrypted)
+  ${c.cyan}vault pull${c.reset}                   Pull credentials from cloud to local
+  ${c.cyan}vault sync-passphrase${c.reset}        Set/change your sync passphrase
+
 ${c.bright}7 Semantic Layers:${c.reset}
   workflows, credentials, env_vars, mcp_configs,
   site_profiles, ai_brain, audit_trail
@@ -593,6 +651,91 @@ ${c.bright}7 Semantic Layers:${c.reset}
     return;
   }
 
+  // ── Vault Sync Commands ──────────────────────────────────
+
+  if (sub === 'sync' && args[1] !== 'passphrase') {
+    const { getToken } = await import('./auth.js');
+    const { pushToCloud } = await import('./vault/sync.js');
+
+    const token = await getToken();
+    if (!token) {
+      console.log(`${c.red}Not authenticated. Run: ${c.cyan}0nmcp login${c.reset}`);
+      return;
+    }
+
+    const passphrase = getFlag(args, '--passphrase') || await promptInput('Sync passphrase: ');
+    if (!passphrase) {
+      console.log(`${c.red}Passphrase required for E2E encryption.${c.reset}`);
+      return;
+    }
+
+    console.log(`\n${c.bright}Encrypting and pushing to cloud...${c.reset}`);
+    const { pushed, errors } = await pushToCloud(token, passphrase);
+
+    console.log(`\n${c.green}✓${c.reset} Pushed ${c.bright}${pushed}${c.reset} credentials (E2E encrypted)`);
+    if (errors.length > 0) {
+      console.log(`${c.red}Errors:${c.reset}`);
+      for (const err of errors) console.log(`  ${c.red}●${c.reset} ${err}`);
+    }
+    return;
+  }
+
+  if (sub === 'pull') {
+    const { getToken } = await import('./auth.js');
+    const { pullFromCloud } = await import('./vault/sync.js');
+
+    const token = await getToken();
+    if (!token) {
+      console.log(`${c.red}Not authenticated. Run: ${c.cyan}0nmcp login${c.reset}`);
+      return;
+    }
+
+    const passphrase = getFlag(args, '--passphrase') || await promptInput('Sync passphrase: ');
+    if (!passphrase) {
+      console.log(`${c.red}Passphrase required to decrypt credentials.${c.reset}`);
+      return;
+    }
+
+    console.log(`\n${c.bright}Pulling and decrypting from cloud...${c.reset}`);
+    const { pulled, errors } = await pullFromCloud(token, passphrase);
+
+    console.log(`\n${c.green}✓${c.reset} Pulled ${c.bright}${pulled}${c.reset} credentials to ~/.0n/connections/`);
+    if (errors.length > 0) {
+      console.log(`${c.red}Errors:${c.reset}`);
+      for (const err of errors) console.log(`  ${c.red}●${c.reset} ${err}`);
+    }
+    return;
+  }
+
+  if (sub === 'sync-passphrase') {
+    const { markSyncSetup, hasSyncSetup } = await import('./vault/sync.js');
+
+    if (hasSyncSetup()) {
+      console.log(`${c.yellow}Sync passphrase was previously configured.${c.reset}`);
+      console.log(`${c.dim}Use your existing passphrase with ${c.cyan}vault sync${c.reset}${c.dim} and ${c.cyan}vault pull${c.reset}${c.dim}.${c.reset}`);
+      console.log(`${c.dim}To change it, use a new passphrase — but you'll need to re-sync all credentials.${c.reset}\n`);
+    }
+
+    const pass1 = await promptInput('New sync passphrase: ');
+    const pass2 = await promptInput('Confirm passphrase: ');
+
+    if (pass1 !== pass2) {
+      console.log(`${c.red}Passphrases do not match.${c.reset}`);
+      return;
+    }
+
+    if (pass1.length < 8) {
+      console.log(`${c.red}Passphrase must be at least 8 characters.${c.reset}`);
+      return;
+    }
+
+    markSyncSetup();
+    console.log(`\n${c.green}✓${c.reset} Sync passphrase configured.`);
+    console.log(`${c.dim}Use ${c.cyan}vault sync${c.reset}${c.dim} to push credentials to cloud.${c.reset}`);
+    console.log(`${c.dim}Use ${c.cyan}vault pull${c.reset}${c.dim} on another device to pull them down.${c.reset}\n`);
+    return;
+  }
+
   if (sub === 'create') {
     const { assembleContainer, saveContainer } = await import('./vault/container.js');
     const { LAYER_NAMES } = await import('./vault/layers.js');

package/crm/helpers.js

@@ -35,7 +35,7 @@ export function crmHeaders(accessToken) {
  * Every tool automatically receives `access_token` (required) and
  * `location_id` (optional) parameters.
  */
-export function registerTools(server, z, definitions) {
+export function registerTools(server, z, definitions, proxy) {
   for (const def of definitions) {
     const schema = buildSchema(z, def);
 
@@ -93,11 +93,14 @@ export function registerTools(server, z, definitions) {
           }
         }
 
-        const res = await fetch(url, options);
-        const data = await res.json().catch(() => ({
-          status: res.status,
-          statusText: res.statusText,
-        }));
+        // Execute through capability proxy (rate-limited, audited)
+        // CRM tools receive access_token per-call from AI client, not from ConnectionManager
+        const { response: res, data } = proxy
+          ? await proxy.callWithCredentials("crm", def.name, url, options)
+          : await fetch(url, options).then(async r => ({
+              response: r,
+              data: await r.json().catch(() => ({ status: r.status, statusText: r.statusText })),
+            }));
 
         return {
           content: [

package/crm/index.js

@@ -50,8 +50,9 @@ export {
  * Register ALL CRM tools on the MCP server.
  * @param {import("@modelcontextprotocol/sdk/server/mcp.js").McpServer} server
  * @param {import("zod")} z
+ * @param {import("../capability-proxy.js").CapabilityProxy} [proxy]
  */
-export function registerCrmTools(server, z) {
+export function registerCrmTools(server, z, proxy) {
   // 1. Auth & custom-logic tools (OAuth, snapshot deploy, workflow process)
   registerAuthTools(server, z);
 
@@ -72,7 +73,7 @@ export function registerCrmTools(server, z) {
 
   let totalTools = 5; // auth tools count
   for (const cat of categories) {
-    registerTools(server, z, cat.defs);
+    registerTools(server, z, cat.defs, proxy);
     totalTools += cat.defs.length;
   }
 

package/engine/validator.js

@@ -168,9 +168,21 @@ const VERIFICATION_ENDPOINTS = {
     check: (r) => r.status === 200 || r.status === 400, // 400 = auth works, bad params
   },
   crm: {
-    url: "https://services.leadconnectorhq.com/contacts/?limit=1",
+    url: "https://services.leadconnectorhq.com/calendars/services",
     method: "GET",
     headers: (c) => ({ Authorization: `Bearer ${c.access_token}`, Version: "2021-07-28" }),
+    check: (r) => r.status === 200 || r.status === 400 || r.status === 422, // 400/422 = auth works, missing params
+  },
+  anthropic: {
+    url: "https://api.anthropic.com/v1/models",
+    method: "GET",
+    headers: (c) => ({ "x-api-key": c.apiKey, "anthropic-version": "2023-06-01" }),
+    check: (r) => r.status === 200,
+  },
+  vercel: {
+    url: "https://api.vercel.com/v9/projects",
+    method: "GET",
+    headers: (c) => ({ Authorization: `Bearer ${c.apiKey}` }),
     check: (r) => r.status === 200,
   },
 };