@adrata/adrata-mcp 1.0.44 → 1.0.46

package/api-bridge.js

@@ -24,6 +24,17 @@ const BLOCKED_SURFACES = {
   webhooks: ['/api/v1/webhooks'],
 };
 
+// Families the bridge may READ but must never WRITE, whatever the caller
+// asserts. `/api/v1/ai-crm-tools` mounts the governed dispatcher (`/execute`),
+// whose live writes need a server-issued single-use confirmation token that a
+// machine principal cannot mint. It used to also mount ungated REST twins of
+// the CRM write tools (`/bulk/delete`, `/company/delete`, ...), and a
+// model-supplied `approved:true` here was the only thing between a
+// prompt-injected agent and a 100-record soft delete. A client boolean is not
+// authority for a destructive or bulk operation, so writes on this family are
+// refused outright: use adrata_ai_tool_execute, which speaks the token flow.
+const WRITE_BLOCKED_PREFIXES = ['/api/v1/ai-crm-tools'];
+
 const ALLOWED_PREFIXES = [
   '/api/v1/actions',
   '/api/v1/action-columns',
@@ -395,6 +406,18 @@ export function validateApiBridgeRequest({
   }
 
   const isWrite = WRITE_METHODS.has(normalizedMethod);
+  if (
+    isWrite
+    && WRITE_BLOCKED_PREFIXES.some((prefix) =>
+      matchesPathPrefix(toScopeClassificationPath(normalizedPath), prefix))
+  ) {
+    // Checked before the dry-run branch so a preview cannot report
+    // `wouldSend: true` for a write this bridge will never send.
+    throw new Error(
+      `writes to ${normalizedPath} are not available through adrata_api_request; `
+      + 'use adrata_ai_tool_execute, whose live writes require a server-issued confirmation token',
+    );
+  }
   if (isWrite && dryRun !== false) {
     // A dry-run used to answer `wouldSend: true` unconditionally, which is the
     // single most misleading thing this tool could say: it reported success for
@@ -588,6 +611,7 @@ export function apiBridgeCatalog() {
     aiToolDispatcher:
       'Use adrata_ai_tool_catalog and adrata_ai_tool_execute for the same Channels, external catalogs, ICP ranking, and batch import tools Adrata chat uses.',
     blocked: BLOCKED_PREFIXES,
+    writeBlocked: WRITE_BLOCKED_PREFIXES,
     blockedSurfaces: BLOCKED_SURFACES,
     allowed: ALLOWED_PREFIXES,
     examples: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adrata/adrata-mcp",
-  "version": "1.0.44",
+  "version": "1.0.46",
   "description": "Adrata MCP Server \u2014 connect Claude Code, Codex, Gemini, Cursor, and other AI tools to your CRM. About 275 tools registered at startup for companies, people, deals, actions, buyer groups, warm intros, webhooks and intelligence, plus 65 more behind eight named toolsets you load with enable_toolset.",
   "type": "module",
   "main": "server.js",
@@ -9,7 +9,7 @@
   },
   "scripts": {
     "start": "node server.js",
-    "test": "node --test analytics.test.js server.test.js api-bridge.test.js http/edge-block.test.js http/rate-limit.test.js audit-flush.test.js buyer-group-writes.test.js note-writes.test.js mcp-spec.test.js packaging.test.js product-profile.test.js security.test.js security.cap-contract.test.js tool-annotations.test.js toolsets.test.js toolsets/communications.test.js toolsets/prospecting.test.js access/auth.test.js access/oauth-callback.test.js access/oauth-session.test.js access/oauth-capabilities.test.js access/oauth-scope-grantability.test.js scripts/local-dev-server.test.js tools/competitive-coverage.test.js tools/describe-count.test.js tools/email-tools.test.js tools/scheduling.test.js tools/work-board-tools.test.js tools/launches/work-launch-tools.test.js tools/work-hub/audit.test.js tools/work-hub/field-changes.test.js tools/work-hub/criteria-quality.test.js tools/roadmap-tools.test.js tools/provisioning/onboarding-tools.test.js tools/source-control/connection-tools.test.js governance/money.test.js http/rate-limit-policy.test.js tools/free-search.test.js"
+    "test": "node --test analytics.test.js server.test.js api-bridge.test.js http/edge-block.test.js http/rate-limit.test.js audit-flush.test.js buyer-group-writes.test.js note-writes.test.js mcp-spec.test.js packaging.test.js product-profile.test.js security.test.js security.cap-contract.test.js tool-annotations.test.js toolsets.test.js toolsets/communications.test.js toolsets/prospecting.test.js access/auth.test.js access/oauth-callback.test.js access/oauth-session.test.js access/oauth-capabilities.test.js access/oauth-scope-grantability.test.js scripts/local-dev-server.test.js tools/competitive-coverage.test.js tools/describe-count.test.js tools/email-tools.test.js tools/scheduling.test.js tools/work-board-tools.test.js tools/launches/work-launch-tools.test.js tools/work-hub/audit.test.js tools/work-hub/field-changes.test.js tools/work-hub/criteria-quality.test.js tools/roadmap-tools.test.js tools/provisioning/onboarding-tools.test.js tools/source-control/connection-tools.test.js governance/money.test.js http/rate-limit-policy.test.js"
   },
   "keywords": [
     "mcp",

package/server.js

@@ -634,15 +634,15 @@ server.tool('describe_capability',
   async (args) => ok({ capability: await resolveExactCapability(args.ref) }));
 
 server.tool('run_capability',
-  'Run one exact capability through the governed dispatcher. Defaults to dry-run. Live writes remain subject to server-bound approval, reason, spend, policy, and idempotency controls. Product profiles refuse references outside their namespace.',
+  'Run one exact capability through the governed dispatcher. Defaults to dry-run. Reads, including paid provider reads and enrichment, run directly. Live writes remain subject to server-bound approval, reason, policy, and idempotency controls. Product profiles refuse references outside their namespace.',
   {
     ref: z.string().describe('Exact /product/domain/action reference returned by search/describe.'),
     arguments: z.record(z.unknown()).optional(),
     dryRun: z.boolean().optional().describe('Defaults true. Set false only after reviewing the exact schema and preview.'),
     reason: z.string().optional(),
     confirmationToken: z.string().optional().describe('Single-use server-bound token when the capability requires one.'),
-    confirmSpend: z.boolean().optional(),
-    idempotencyKey: z.string().optional().describe('Required by governed live writes/spend. Reuse the same key on retry.'),
+    confirmSpend: z.boolean().optional().describe('Deprecated no-op: paid reads no longer need a spend acknowledgment.'),
+    idempotencyKey: z.string().optional().describe('Required by governed live writes. Reuse the same key on retry.'),
   },
   async (args) => {
     const capability = await resolveExactCapability(args.ref);
@@ -741,16 +741,16 @@ server.tool('adrata_ai_tool_catalog',
   async () => ok(await api('GET', '/api/v1/ai-crm-tools/catalog')));
 
 server.tool('adrata_ai_tool_execute',
-  'Execute the same governed AI CRM ToolDispatcher path used by Adrata chat. Free reads run directly. Reads that can spend external data credits return a spend hold; execute one only with confirmSpend:true, a reason, and an idempotencyKey (reuse the same key on retry). The response includes the approved ceiling and an exact provider-reported receipt where available. Writes use a two-step, server-bound confirmationToken flow; a client approved boolean can never authorize a write. A non-interactive machine/OAuth principal (every MCP client) can preview writes but cannot complete one.',
+  'Execute the same governed AI CRM ToolDispatcher path used by Adrata chat. Reads run directly, including paid provider reads and enrichment. Writes use a two-step, server-bound confirmationToken flow; a client approved boolean can never authorize a write. A non-interactive machine/OAuth principal (every MCP client) can preview writes but cannot complete one.',
   {
     toolName: z.string().describe('AI CRM tool name from adrata_ai_tool_catalog, e.g. list_channels or rank_companies_by_icp'),
     arguments: z.record(z.unknown()).optional(),
     dryRun: z.boolean().optional().describe('Defaults to true for write tools. Set false only after explicit approval.'),
     approved: z.boolean().optional().describe('Deprecated compatibility field; never authorizes a live write.'),
-    reason: z.string().optional().describe('Required audit reason for a spend acknowledgment or when requesting a live-write confirmation token.'),
+    reason: z.string().optional().describe('Required audit reason when requesting a live-write confirmation token.'),
     confirmationToken: z.string().optional().describe('Single-use server token returned by the first live-write request; bound to the user, workspace, tool, and stored arguments.'),
-    confirmSpend: z.boolean().optional().describe('Required true to execute a read held for external vendor spend. Never authorizes a workspace write.'),
-    idempotencyKey: z.string().optional().describe('Required with confirmSpend:true. Reuse the same key on retry; the API replays the first response instead of calling the paid provider twice.'),
+    confirmSpend: z.boolean().optional().describe('Deprecated no-op: paid reads no longer need a spend acknowledgment. Never authorizes a workspace write.'),
+    idempotencyKey: z.string().optional().describe('Optional. Reuse the same key on retry.'),
   },
   async (args) => {
     try {

package/server.json

@@ -3,7 +3,7 @@
   "name": "com.adrata/adrata-mcp",
   "description": "Adrata revenue-intelligence MCP server: companies, people, opportunities, actions, buyer groups, enrichment, email, and workspace operations for AI agents.",
   "status": "active",
-  "version": "1.0.44",
+  "version": "1.0.46",
   "websiteUrl": "https://adrata.com/developers",
   "repository": {
     "url": "https://github.com/adrata/adrata",
@@ -15,7 +15,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@adrata/adrata-mcp",
-      "version": "1.0.44",
+      "version": "1.0.46",
       "transport": {
         "type": "stdio"
       },