@adrata/adrata-mcp 1.0.44 → 1.0.47

package/api-bridge.js

@@ -24,6 +24,17 @@ const BLOCKED_SURFACES = {
   webhooks: ['/api/v1/webhooks'],
 };
 
+// Families the bridge may READ but must never WRITE, whatever the caller
+// asserts. `/api/v1/ai-crm-tools` mounts the governed dispatcher (`/execute`),
+// whose live writes need a server-issued single-use confirmation token that a
+// machine principal cannot mint. It used to also mount ungated REST twins of
+// the CRM write tools (`/bulk/delete`, `/company/delete`, ...), and a
+// model-supplied `approved:true` here was the only thing between a
+// prompt-injected agent and a 100-record soft delete. A client boolean is not
+// authority for a destructive or bulk operation, so writes on this family are
+// refused outright: use adrata_ai_tool_execute, which speaks the token flow.
+const WRITE_BLOCKED_PREFIXES = ['/api/v1/ai-crm-tools'];
+
 const ALLOWED_PREFIXES = [
   '/api/v1/actions',
   '/api/v1/action-columns',
@@ -395,6 +406,18 @@ export function validateApiBridgeRequest({
   }
 
   const isWrite = WRITE_METHODS.has(normalizedMethod);
+  if (
+    isWrite
+    && WRITE_BLOCKED_PREFIXES.some((prefix) =>
+      matchesPathPrefix(toScopeClassificationPath(normalizedPath), prefix))
+  ) {
+    // Checked before the dry-run branch so a preview cannot report
+    // `wouldSend: true` for a write this bridge will never send.
+    throw new Error(
+      `writes to ${normalizedPath} are not available through adrata_api_request; `
+      + 'use adrata_ai_tool_execute, whose live writes require a server-issued confirmation token',
+    );
+  }
   if (isWrite && dryRun !== false) {
     // A dry-run used to answer `wouldSend: true` unconditionally, which is the
     // single most misleading thing this tool could say: it reported success for
@@ -588,6 +611,7 @@ export function apiBridgeCatalog() {
     aiToolDispatcher:
       'Use adrata_ai_tool_catalog and adrata_ai_tool_execute for the same Channels, external catalogs, ICP ranking, and batch import tools Adrata chat uses.',
     blocked: BLOCKED_PREFIXES,
+    writeBlocked: WRITE_BLOCKED_PREFIXES,
     blockedSurfaces: BLOCKED_SURFACES,
     allowed: ALLOWED_PREFIXES,
     examples: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adrata/adrata-mcp",
-  "version": "1.0.44",
+  "version": "1.0.47",
   "description": "Adrata MCP Server \u2014 connect Claude Code, Codex, Gemini, Cursor, and other AI tools to your CRM. About 275 tools registered at startup for companies, people, deals, actions, buyer groups, warm intros, webhooks and intelligence, plus 65 more behind eight named toolsets you load with enable_toolset.",
   "type": "module",
   "main": "server.js",
@@ -9,7 +9,7 @@
   },
   "scripts": {
     "start": "node server.js",
-    "test": "node --test analytics.test.js server.test.js api-bridge.test.js http/edge-block.test.js http/rate-limit.test.js audit-flush.test.js buyer-group-writes.test.js note-writes.test.js mcp-spec.test.js packaging.test.js product-profile.test.js security.test.js security.cap-contract.test.js tool-annotations.test.js toolsets.test.js toolsets/communications.test.js toolsets/prospecting.test.js access/auth.test.js access/oauth-callback.test.js access/oauth-session.test.js access/oauth-capabilities.test.js access/oauth-scope-grantability.test.js scripts/local-dev-server.test.js tools/competitive-coverage.test.js tools/describe-count.test.js tools/email-tools.test.js tools/scheduling.test.js tools/work-board-tools.test.js tools/launches/work-launch-tools.test.js tools/work-hub/audit.test.js tools/work-hub/field-changes.test.js tools/work-hub/criteria-quality.test.js tools/roadmap-tools.test.js tools/provisioning/onboarding-tools.test.js tools/source-control/connection-tools.test.js governance/money.test.js http/rate-limit-policy.test.js tools/free-search.test.js"
+    "test": "node --test analytics.test.js server.test.js api-bridge.test.js http/edge-block.test.js http/rate-limit.test.js audit-flush.test.js buyer-group-writes.test.js note-writes.test.js mcp-spec.test.js packaging.test.js product-profile.test.js security.test.js security.cap-contract.test.js tool-annotations.test.js toolsets.test.js toolsets/communications.test.js toolsets/prospecting.test.js access/auth.test.js access/oauth-callback.test.js access/oauth-session.test.js access/oauth-capabilities.test.js access/oauth-scope-grantability.test.js scripts/local-dev-server.test.js tools/competitive-coverage.test.js tools/describe-count.test.js tools/email-tools.test.js tools/scheduling.test.js tools/work-board-tools.test.js tools/launches/work-launch-tools.test.js tools/work-hub/audit.test.js tools/work-hub/field-changes.test.js tools/work-hub/criteria-quality.test.js tools/roadmap-tools.test.js tools/provisioning/onboarding-tools.test.js tools/source-control/connection-tools.test.js governance/money.test.js http/rate-limit-policy.test.js"
   },
   "keywords": [
     "mcp",

package/server.js

@@ -634,15 +634,15 @@ server.tool('describe_capability',
   async (args) => ok({ capability: await resolveExactCapability(args.ref) }));
 
 server.tool('run_capability',
-  'Run one exact capability through the governed dispatcher. Defaults to dry-run. Live writes remain subject to server-bound approval, reason, spend, policy, and idempotency controls. Product profiles refuse references outside their namespace.',
+  'Run one exact capability through the governed dispatcher. Defaults to dry-run. Reads, including paid provider reads and enrichment, run directly. Live writes remain subject to server-bound approval, reason, policy, and idempotency controls. Product profiles refuse references outside their namespace.',
   {
     ref: z.string().describe('Exact /product/domain/action reference returned by search/describe.'),
     arguments: z.record(z.unknown()).optional(),
     dryRun: z.boolean().optional().describe('Defaults true. Set false only after reviewing the exact schema and preview.'),
     reason: z.string().optional(),
     confirmationToken: z.string().optional().describe('Single-use server-bound token when the capability requires one.'),
-    confirmSpend: z.boolean().optional(),
-    idempotencyKey: z.string().optional().describe('Required by governed live writes/spend. Reuse the same key on retry.'),
+    confirmSpend: z.boolean().optional().describe('Deprecated no-op: paid reads no longer need a spend acknowledgment.'),
+    idempotencyKey: z.string().optional().describe('Required by governed live writes. Reuse the same key on retry.'),
   },
   async (args) => {
     const capability = await resolveExactCapability(args.ref);
@@ -741,16 +741,16 @@ server.tool('adrata_ai_tool_catalog',
   async () => ok(await api('GET', '/api/v1/ai-crm-tools/catalog')));
 
 server.tool('adrata_ai_tool_execute',
-  'Execute the same governed AI CRM ToolDispatcher path used by Adrata chat. Free reads run directly. Reads that can spend external data credits return a spend hold; execute one only with confirmSpend:true, a reason, and an idempotencyKey (reuse the same key on retry). The response includes the approved ceiling and an exact provider-reported receipt where available. Writes use a two-step, server-bound confirmationToken flow; a client approved boolean can never authorize a write. A non-interactive machine/OAuth principal (every MCP client) can preview writes but cannot complete one.',
+  'Execute the same governed AI CRM ToolDispatcher path used by Adrata chat. Reads run directly, including paid provider reads and enrichment. Writes use a two-step, server-bound confirmationToken flow; a client approved boolean can never authorize a write. A non-interactive machine/OAuth principal (every MCP client) can preview writes but cannot complete one.',
   {
     toolName: z.string().describe('AI CRM tool name from adrata_ai_tool_catalog, e.g. list_channels or rank_companies_by_icp'),
     arguments: z.record(z.unknown()).optional(),
     dryRun: z.boolean().optional().describe('Defaults to true for write tools. Set false only after explicit approval.'),
     approved: z.boolean().optional().describe('Deprecated compatibility field; never authorizes a live write.'),
-    reason: z.string().optional().describe('Required audit reason for a spend acknowledgment or when requesting a live-write confirmation token.'),
+    reason: z.string().optional().describe('Required audit reason when requesting a live-write confirmation token.'),
     confirmationToken: z.string().optional().describe('Single-use server token returned by the first live-write request; bound to the user, workspace, tool, and stored arguments.'),
-    confirmSpend: z.boolean().optional().describe('Required true to execute a read held for external vendor spend. Never authorizes a workspace write.'),
-    idempotencyKey: z.string().optional().describe('Required with confirmSpend:true. Reuse the same key on retry; the API replays the first response instead of calling the paid provider twice.'),
+    confirmSpend: z.boolean().optional().describe('Deprecated no-op: paid reads no longer need a spend acknowledgment. Never authorizes a workspace write.'),
+    idempotencyKey: z.string().optional().describe('Optional. Reuse the same key on retry.'),
   },
   async (args) => {
     try {

package/server.json

@@ -3,7 +3,7 @@
   "name": "com.adrata/adrata-mcp",
   "description": "Adrata revenue-intelligence MCP server: companies, people, opportunities, actions, buyer groups, enrichment, email, and workspace operations for AI agents.",
   "status": "active",
-  "version": "1.0.44",
+  "version": "1.0.47",
   "websiteUrl": "https://adrata.com/developers",
   "repository": {
     "url": "https://github.com/adrata/adrata",
@@ -15,7 +15,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@adrata/adrata-mcp",
-      "version": "1.0.44",
+      "version": "1.0.47",
       "transport": {
         "type": "stdio"
       },

package/tools/provisioning/onboarding-tools.js

@@ -392,6 +392,42 @@ export function validateOnboardingArgs(args = {}) {
   return problems;
 }
 
+/**
+ * Whether the adaptive payload (launch, preparedAccountIds, preparedNote,
+ * source) is durable, read FROM the invite response rather than assumed. The
+ * route returns `recorded` alongside `inviteUrl`: `true` means the
+ * workspace_invitation_records row exists; `false` means the link works but
+ * the record was not written. An absent `recorded` is reported as unknown —
+ * `null` — rather than asserted either way.
+ */
+export function describeAdaptivePayloadDurability(payload = {}) {
+  const recorded = payload?.recorded;
+  if (recorded === true) {
+    return {
+      adaptivePayloadDurable: true,
+      adaptivePayloadNote:
+        'The seat and the link are live, and the launch, preparedAccountIds, preparedNote and source'
+        + ' were stored with the invitation (recorded: true).',
+    };
+  }
+  if (recorded === false) {
+    return {
+      adaptivePayloadDurable: false,
+      adaptivePayloadNote:
+        'The seat and the link are live, but the endpoint reported recorded: false — the invitation'
+        + ' record carrying launch, preparedAccountIds, preparedNote and source was not written, so it'
+        + ' will not appear in the issued list and cannot be revoked from it.',
+    };
+  }
+  return {
+    adaptivePayloadDurable: null,
+    adaptivePayloadNote:
+      'The seat and the link are live. The endpoint did not confirm whether the invitation record'
+      + ' carrying launch, preparedAccountIds, preparedNote and source was written (no `recorded`'
+      + ' field in the response), so durability is unknown rather than asserted.',
+  };
+}
+
 /** The exact body this tool would send. Kept in one place so preview and live write cannot drift. */
 export function buildInvitationBody(args = {}) {
   const body = {
@@ -404,19 +440,19 @@ export function buildInvitationBody(args = {}) {
   if (args.managerId) body.managerId = args.managerId;
 
   // ── The adaptive payload ────────────────────────────────────────────────
-  // INTEGRATION POINT (2026-09-06): these four fields are sent and the
-  // DEPLOYED endpoint ignores them. `InviteMemberRequest` in
-  // `code/api/src/routes/v1/entities/org/workspace/members.rs` declares
-  // exactly `email`, `role` and `manager_id`; serde drops unknown fields
-  // silently, so the call succeeds, a link is minted, and the launch is
-  // simply not recorded. They are sent anyway rather than withheld, because
-  // the route change carrying `InvitationContext` is in flight on
-  // `feature/onboarding-grant-record` and the wire shape should not need a
-  // second edit when it lands.
+  // These four fields are stored by the deployed endpoint. `InviteMemberRequest`
+  // in `code/api/src/routes/v1/entities/org/workspace/members.rs` declares
+  // `launch`, `prepared_account_ids`, `prepared_note` and `source` with
+  // `#[serde(default)]` (camelCase via `alias`), and `mint_workspace_invitation`
+  // in `invitations.rs` binds them into `workspace_invitation_records`. The
+  // route answers with `recorded: true|false` saying whether that durable row
+  // was written, and the live-write result below reports durability FROM that
+  // field rather than from an assumption about what the server does.
   //
-  // What this means for a caller TODAY, and it is stated in the tool's own
-  // response rather than only here: the seat and the link are real, and the
-  // adaptive configuration is not yet durable.
+  // (History: until 2026-09-06 the endpoint accepted only email, role and
+  // managerId and dropped the rest; the tool then said so in its response.
+  // That note outlived the fix and told an AE a stored configuration was not
+  // durable — hence the rule above: report what the response says.)
   //
   // Note also that `InviteMemberRequest` carries no
   // `#[serde(rename_all = "camelCase")]` — `manager_id` works only because it
@@ -625,12 +661,12 @@ export function registerProvisioningTools(
           preparedAccountIds: body.preparedAccountIds ?? [],
           preparedAccountCount: body.preparedAccountIds?.length ?? 0,
           preparedNote: body.preparedNote ?? null,
-          adaptivePayloadDurable: false,
+          adaptivePayloadDurable: null,
           adaptivePayloadNote:
-            'INTEGRATION POINT: the deployed invite endpoint accepts email, role and managerId only, so'
-            + ' launch, preparedAccountIds, preparedNote and source are sent but not yet stored. The seat'
-            + ' and the link are real; the adaptive configuration becomes durable when the'
-            + ' workspace_invitation_records route change ships.',
+            'Not known until minted. The invite endpoint stores launch, preparedAccountIds, preparedNote'
+            + ' and source with the invitation (members.rs InviteMemberRequest → invitations.rs'
+            + ' mint_workspace_invitation) and reports `recorded` on the live write; the live result'
+            + ' carries that answer.',
           preview: validation,
           body,
           note:
@@ -712,10 +748,7 @@ export function registerProvisioningTools(
         inviteUrl,
         launch: body.launch ?? null,
         preparedAccountIds: body.preparedAccountIds ?? [],
-        adaptivePayloadDurable: false,
-        adaptivePayloadNote:
-          'The seat and the link are live. launch/preparedAccountIds/preparedNote were sent but the'
-          + ' deployed endpoint does not yet store them — see the integration point in tools/provisioning.js.',
+        ...describeAdaptivePayloadDurability(payload),
         credentialWarning:
           'inviteUrl is a credential: anyone holding it can seat themselves in this workspace. Deliver it'
           + ' over a trusted channel and do not paste it into a log, a ticket, or a shared document.',