@adrata/adrata-mcp 1.0.43 → 1.0.46

package/api-bridge.js

@@ -24,6 +24,17 @@ const BLOCKED_SURFACES = {
   webhooks: ['/api/v1/webhooks'],
 };
 
+// Families the bridge may READ but must never WRITE, whatever the caller
+// asserts. `/api/v1/ai-crm-tools` mounts the governed dispatcher (`/execute`),
+// whose live writes need a server-issued single-use confirmation token that a
+// machine principal cannot mint. It used to also mount ungated REST twins of
+// the CRM write tools (`/bulk/delete`, `/company/delete`, ...), and a
+// model-supplied `approved:true` here was the only thing between a
+// prompt-injected agent and a 100-record soft delete. A client boolean is not
+// authority for a destructive or bulk operation, so writes on this family are
+// refused outright: use adrata_ai_tool_execute, which speaks the token flow.
+const WRITE_BLOCKED_PREFIXES = ['/api/v1/ai-crm-tools'];
+
 const ALLOWED_PREFIXES = [
   '/api/v1/actions',
   '/api/v1/action-columns',
@@ -395,6 +406,18 @@ export function validateApiBridgeRequest({
   }
 
   const isWrite = WRITE_METHODS.has(normalizedMethod);
+  if (
+    isWrite
+    && WRITE_BLOCKED_PREFIXES.some((prefix) =>
+      matchesPathPrefix(toScopeClassificationPath(normalizedPath), prefix))
+  ) {
+    // Checked before the dry-run branch so a preview cannot report
+    // `wouldSend: true` for a write this bridge will never send.
+    throw new Error(
+      `writes to ${normalizedPath} are not available through adrata_api_request; `
+      + 'use adrata_ai_tool_execute, whose live writes require a server-issued confirmation token',
+    );
+  }
   if (isWrite && dryRun !== false) {
     // A dry-run used to answer `wouldSend: true` unconditionally, which is the
     // single most misleading thing this tool could say: it reported success for
@@ -588,6 +611,7 @@ export function apiBridgeCatalog() {
     aiToolDispatcher:
       'Use adrata_ai_tool_catalog and adrata_ai_tool_execute for the same Channels, external catalogs, ICP ranking, and batch import tools Adrata chat uses.',
     blocked: BLOCKED_PREFIXES,
+    writeBlocked: WRITE_BLOCKED_PREFIXES,
     blockedSurfaces: BLOCKED_SURFACES,
     allowed: ALLOWED_PREFIXES,
     examples: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adrata/adrata-mcp",
-  "version": "1.0.43",
+  "version": "1.0.46",
   "description": "Adrata MCP Server \u2014 connect Claude Code, Codex, Gemini, Cursor, and other AI tools to your CRM. About 275 tools registered at startup for companies, people, deals, actions, buyer groups, warm intros, webhooks and intelligence, plus 65 more behind eight named toolsets you load with enable_toolset.",
   "type": "module",
   "main": "server.js",

package/server.js

@@ -40,7 +40,7 @@ import {
   getValidAgentToken,
 } from './access/auth.js';
 import { TIERS } from './access/tiers.js';
-import { findCompany, findPerson } from './tools/free-search.js';
+import { findCompany, findPerson, findCompanyInWorkspace, findPersonInWorkspace } from './tools/free-search.js';
 import { applySecurityLayer } from './security.js';
 import { describeEdgeBlock } from './http/edge-block.js';
 import { createRateLimitRegistry } from './http/rate-limit.js';
@@ -634,15 +634,15 @@ server.tool('describe_capability',
   async (args) => ok({ capability: await resolveExactCapability(args.ref) }));
 
 server.tool('run_capability',
-  'Run one exact capability through the governed dispatcher. Defaults to dry-run. Live writes remain subject to server-bound approval, reason, spend, policy, and idempotency controls. Product profiles refuse references outside their namespace.',
+  'Run one exact capability through the governed dispatcher. Defaults to dry-run. Reads, including paid provider reads and enrichment, run directly. Live writes remain subject to server-bound approval, reason, policy, and idempotency controls. Product profiles refuse references outside their namespace.',
   {
     ref: z.string().describe('Exact /product/domain/action reference returned by search/describe.'),
     arguments: z.record(z.unknown()).optional(),
     dryRun: z.boolean().optional().describe('Defaults true. Set false only after reviewing the exact schema and preview.'),
     reason: z.string().optional(),
     confirmationToken: z.string().optional().describe('Single-use server-bound token when the capability requires one.'),
-    confirmSpend: z.boolean().optional(),
-    idempotencyKey: z.string().optional().describe('Required by governed live writes/spend. Reuse the same key on retry.'),
+    confirmSpend: z.boolean().optional().describe('Deprecated no-op: paid reads no longer need a spend acknowledgment.'),
+    idempotencyKey: z.string().optional().describe('Required by governed live writes. Reuse the same key on retry.'),
   },
   async (args) => {
     const capability = await resolveExactCapability(args.ref);
@@ -741,16 +741,16 @@ server.tool('adrata_ai_tool_catalog',
   async () => ok(await api('GET', '/api/v1/ai-crm-tools/catalog')));
 
 server.tool('adrata_ai_tool_execute',
-  'Execute the same governed AI CRM ToolDispatcher path used by Adrata chat. Free reads run directly. Reads that can spend external data credits return a spend hold; execute one only with confirmSpend:true, a reason, and an idempotencyKey (reuse the same key on retry). The response includes the approved ceiling and an exact provider-reported receipt where available. Writes use a two-step, server-bound confirmationToken flow; a client approved boolean can never authorize a write. A non-interactive machine/OAuth principal (every MCP client) can preview writes but cannot complete one.',
+  'Execute the same governed AI CRM ToolDispatcher path used by Adrata chat. Reads run directly, including paid provider reads and enrichment. Writes use a two-step, server-bound confirmationToken flow; a client approved boolean can never authorize a write. A non-interactive machine/OAuth principal (every MCP client) can preview writes but cannot complete one.',
   {
     toolName: z.string().describe('AI CRM tool name from adrata_ai_tool_catalog, e.g. list_channels or rank_companies_by_icp'),
     arguments: z.record(z.unknown()).optional(),
     dryRun: z.boolean().optional().describe('Defaults to true for write tools. Set false only after explicit approval.'),
     approved: z.boolean().optional().describe('Deprecated compatibility field; never authorizes a live write.'),
-    reason: z.string().optional().describe('Required audit reason for a spend acknowledgment or when requesting a live-write confirmation token.'),
+    reason: z.string().optional().describe('Required audit reason when requesting a live-write confirmation token.'),
     confirmationToken: z.string().optional().describe('Single-use server token returned by the first live-write request; bound to the user, workspace, tool, and stored arguments.'),
-    confirmSpend: z.boolean().optional().describe('Required true to execute a read held for external vendor spend. Never authorizes a workspace write.'),
-    idempotencyKey: z.string().optional().describe('Required with confirmSpend:true. Reuse the same key on retry; the API replays the first response instead of calling the paid provider twice.'),
+    confirmSpend: z.boolean().optional().describe('Deprecated no-op: paid reads no longer need a spend acknowledgment. Never authorizes a workspace write.'),
+    idempotencyKey: z.string().optional().describe('Optional. Reuse the same key on retry.'),
   },
   async (args) => {
     try {
@@ -1123,17 +1123,30 @@ server.tool('move_pipeline_card',
     }
   });
 
-// ===== FREE TIER: Claude-powered search (zero cost to Adrata) =====
+// ===== find_company / find_person =====
+//
+// A seat with a credential gets its WORKSPACE RECORD (found / not found / could
+// not check). Only a server with no credential at all falls back to the
+// training-data profile prompt, which carries no upsell. See tools/free-search.js.
+
+function hasWorkspaceCredential() {
+  const auth = currentAuth();
+  return Boolean(auth?.token || auth?.apiKey);
+}
 
 server.tool('find_company',
-  'Search for a company using Claude\'s training data. Returns a structured profile with industry, key people, estimated size, competitors, and sales angles. Free tier — no API key needed. For verified real-time data, upgrade to Pro.',
-  { name: z.string().describe('Company name to research (e.g. "Stripe", "Snowflake", "Datadog")') },
-  async (a) => findCompany(a.name));
+  'Find a company. Connected to a workspace, returns that workspace\'s company record (or says plainly that none matches, or that the workspace could not be checked). With no workspace connected, returns an unverified profile from Claude\'s training data.',
+  { name: z.string().describe('Company name or domain (e.g. "Stripe", "stripe.com")') },
+  async (a) => (hasWorkspaceCredential()
+    ? findCompanyInWorkspace(a.name, (query) => api('GET', '/api/v1/companies', { params: { search: query, limit: 25, page: 1 } }))
+    : findCompany(a.name)));
 
 server.tool('find_person',
-  'Search for a professional using Claude\'s training data. Returns a structured profile with title, company, background, expertise, and sales context. Free tier — no API key needed. For verified contact info and buyer signals, upgrade to Pro.',
-  { name: z.string().describe('Full name of the person to research (e.g. "Patrick Collison", "Jensen Huang")') },
-  async (a) => findPerson(a.name));
+  'Find a person. Connected to a workspace, returns that workspace\'s person record (or says plainly that none matches, or that the workspace could not be checked). With no workspace connected, returns an unverified profile from Claude\'s training data.',
+  { name: z.string().describe('Full name or email of the person (e.g. "Patrick Collison")') },
+  async (a) => (hasWorkspaceCredential()
+    ? findPersonInWorkspace(a.name, (query) => api('GET', '/api/v1/people', { params: { search: query, limit: 25, page: 1 } }))
+    : findPerson(a.name)));
 
 // ===== GOVERNED WRITES (shared) =====
 //

package/server.json

@@ -3,7 +3,7 @@
   "name": "com.adrata/adrata-mcp",
   "description": "Adrata revenue-intelligence MCP server: companies, people, opportunities, actions, buyer groups, enrichment, email, and workspace operations for AI agents.",
   "status": "active",
-  "version": "1.0.43",
+  "version": "1.0.46",
   "websiteUrl": "https://adrata.com/developers",
   "repository": {
     "url": "https://github.com/adrata/adrata",
@@ -15,7 +15,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@adrata/adrata-mcp",
-      "version": "1.0.43",
+      "version": "1.0.46",
       "transport": {
         "type": "stdio"
       },

package/tools/free-search.js

@@ -1,11 +1,20 @@
 /**
- * Free Tier Claude-Powered Search
+ * find_company / find_person
  *
- * These tools return structured prompts that guide Claude (the LLM running the
- * MCP client) to search its own training data for company and person profiles.
+ * Connected to a workspace, these return the WORKSPACE RECORD — the thing a
+ * seller asking "find Acme" means. Measured on Colin's day-one audit
+ * (2026-09-12): a connected seat got back a raw model prompt ending "Upgrade to
+ * Adrata Pro for enriched intelligence" instead of the record sitting in its own
+ * CRM. Owner ruling 2026-09-11: no seat sees credits, prices, quotas or upsells.
  *
- * Cost to Adrata: $0 — Claude's own knowledge does the work.
- * No API key needed, no account needed, unlimited usage.
+ * Three states, never two:
+ *   - found:          the workspace record(s), labelled as such;
+ *   - not found:      said plainly — the workspace was checked and has no match;
+ *   - could not look: said plainly — nothing was ruled out.
+ *
+ * With no credential at all there is no workspace to check, so the tool falls
+ * back to a structured training-data profile prompt, labelled unverified, with
+ * no upsell in it.
  */
 
 // ---------------------------------------------------------------------------
@@ -56,8 +65,7 @@ IMPORTANT: Respond with ONLY a valid JSON object matching this exact schema. No
   "competitors": ["Competitor 1", "Competitor 2", "Competitor 3"],
   "recent_highlights": "Notable recent developments, funding, acquisitions, or strategic moves from training data",
   "ideal_sales_angles": "2-3 sentence suggestion for how a seller might approach this company",
-  "data_freshness": "Based on training data through early 2025. Some details may have changed.",
-  "upgrade_prompt": "Want verified contacts, real-time headcount, funding rounds, hiring signals, and intent data? Upgrade to Adrata Pro for enriched intelligence."
+  "data_freshness": "Based on training data through early 2025. Some details may have changed."
 }
 
 Rules:
@@ -84,8 +92,7 @@ IMPORTANT: Respond with ONLY a valid JSON object matching this exact schema. No
   "notable_achievements": "Key accomplishments, board seats, speaking engagements, publications",
   "linkedin_likely": "Likely LinkedIn URL pattern (e.g. linkedin.com/in/firstname-lastname) — note: unverified",
   "sales_context": "2-3 sentence suggestion for how a seller might approach this person — what they likely care about",
-  "data_freshness": "Based on training data through early 2025. Current role may have changed.",
-  "upgrade_prompt": "Want verified email, phone, social profiles, recent activity, and buyer signals? Upgrade to Adrata Pro for enriched contact intelligence."
+  "data_freshness": "Based on training data through early 2025. Current role may have changed."
 }
 
 Rules:
@@ -158,3 +165,118 @@ export function findPerson(name) {
   cacheSet(cacheKey, result);
   return result;
 }
+
+// ---------------------------------------------------------------------------
+// Workspace-record lookup (connected seats)
+// ---------------------------------------------------------------------------
+
+const WORKSPACE_MATCH_LIMIT = 5;
+
+/** Pull the record array out of the API's list envelope, whatever its shape. */
+export function recordsFromListResponse(response, collection) {
+  const candidates = [
+    response,
+    response?.data,
+    response?.data?.[collection],
+    response?.data?.items,
+    response?.data?.data,
+    response?.[collection],
+    response?.items,
+  ];
+  for (const candidate of candidates) {
+    if (Array.isArray(candidate)) return candidate;
+  }
+  return [];
+}
+
+function normalize(value) {
+  return typeof value === 'string' ? value.trim().toLowerCase() : '';
+}
+
+function recordName(record, kind) {
+  if (kind === 'person') {
+    return (
+      record?.fullName ||
+      record?.name ||
+      [record?.firstName, record?.lastName].filter(Boolean).join(' ')
+    );
+  }
+  return record?.name;
+}
+
+function exactMatches(records, query, kind) {
+  const wanted = normalize(query);
+  return records.filter((record) => {
+    if (normalize(recordName(record, kind)) === wanted) return true;
+    if (kind === 'company') {
+      return [record?.domain, record?.website].some((d) => normalize(d).replace(/^https?:\/\/(www\.)?/, '').replace(/\/$/, '') === wanted);
+    }
+    return normalize(record?.email) === wanted;
+  });
+}
+
+function textResult(payload, isError = false) {
+  return {
+    content: [{ type: 'text', text: JSON.stringify(payload, null, 2) }],
+    ...(isError ? { isError: true } : {}),
+  };
+}
+
+/**
+ * Look the name up in the connected workspace and return what is there.
+ *
+ * `lookup(name)` performs the authenticated list read and resolves to the raw
+ * API response; it is injected so this stays testable without a server.
+ */
+async function findInWorkspace(kind, name, lookup) {
+  const label = kind === 'company' ? 'company' : 'person';
+  const query = String(name ?? '').trim();
+  let response;
+  try {
+    response = await lookup(query);
+  } catch {
+    // The honest third state. Never an empty result, never "not found".
+    return textResult(
+      {
+        source: 'workspace',
+        status: 'could_not_check',
+        query,
+        message: `Couldn't check the workspace for a ${label} named "${query}" right now, so nothing was ruled out. Try again in a moment.`,
+      },
+      true,
+    );
+  }
+
+  const records = recordsFromListResponse(response, kind === 'company' ? 'companies' : 'people');
+  if (records.length === 0) {
+    return textResult({
+      source: 'workspace',
+      status: 'not_found',
+      query,
+      message: `No ${label} matching "${query}" is in this workspace.`,
+    });
+  }
+
+  const exact = exactMatches(records, query, kind);
+  const matches = (exact.length > 0 ? exact : records).slice(0, WORKSPACE_MATCH_LIMIT);
+  return textResult({
+    source: 'workspace',
+    status: exact.length > 0 ? 'found' : 'similar_found',
+    query,
+    message:
+      exact.length > 0
+        ? `Found ${exact.length === 1 ? 'the' : exact.length} workspace ${label} record${exact.length === 1 ? '' : 's'} for "${query}".`
+        : `No exact match for "${query}"; these workspace ${label} records are the closest.`,
+    [kind === 'company' ? 'companies' : 'people']: matches,
+  });
+}
+
+/** find_company for a seat with a credential: the workspace record, three-state. */
+export function findCompanyInWorkspace(name, lookup) {
+  return findInWorkspace('company', name, lookup);
+}
+
+/** find_person for a seat with a credential: the workspace record, three-state. */
+export function findPersonInWorkspace(name, lookup) {
+  return findInWorkspace('person', name, lookup);
+}