@adrata/adrata-mcp 1.0.8 → 1.0.30

package/access/oauth.js

@@ -163,6 +163,33 @@ export const OAUTH_WRITE_SCOPE = [
  *
  *     curl -s https://api.adrata.com/health | jq -r .build_sha
  *     git show <sha>:code/api/crates/security/src/scopes.rs | grep -c write:integrations
+ *
+ * **Do not add an `admin:` scope to this list, or to any list in this file.**
+ * That check above is necessary and not sufficient, and `admin:audit` is the
+ * case that proves it. Measured 2026-09-04 against the deployed production
+ * build `5d4d3141e9`, while trying to let a QA lane read login audit receipts:
+ *
+ *   - `admin:audit` IS a real `ApiScope`. It parses, it is in `all()`, and it
+ *     therefore clears `canonicalize_api_scopes` — so the version check above
+ *     answers "recognised" and the scope looks available.
+ *   - It is nonetheless ungrantable through this client, permanently and by
+ *     design. `consented_scope_grant` (consent_scopes.rs) refuses every scope
+ *     starting with `admin:` BEFORE it consults the client's registration,
+ *     under every role including `super_admin`, and even when an administrator
+ *     provisioned the scope on the client. `CONSENT_ELEVATABLE_SCOPES` names
+ *     the reason: "workspace administration. Never grantable through this path
+ *     under any role."
+ *
+ * So requesting it would be a strictly worse #2435 — not an outage that heals
+ * when the API catches up, but one that never heals. The route that does work
+ * is a confidential client provisioned by an admin at `POST /oauth/clients`
+ * and the client-credentials grant, which checks the registration alone and
+ * carries no `admin:` refusal. That is an owner decision and a credential this
+ * package does not hold.
+ *
+ * `access/oauth-scope-grantability.test.js` now enforces all of this against
+ * the API's own source, so the next attempt fails in CI rather than in
+ * production.
  */
 export const OAUTH_PENDING_SCOPE = ['write:integrations'].join(' ');
 

package/access/tiers.js

@@ -27,6 +27,12 @@ export const TOOL_TIERS = {
   // or reach a second workspace from the CLI at all.
   list_workspaces: TIERS.ENTERPRISE,
   switch_workspace: TIERS.ENTERPRISE,
+  // Provisioning a customer's workspace: reading who is seated, and seating
+  // somebody with the onboarding link that reaches them. Enterprise because it
+  // is workspace administration -- the API separately requires the connected
+  // user to be a workspace admin and answers 403 otherwise.
+  list_workspace_seats: TIERS.ENTERPRISE,
+  create_onboarding_link: TIERS.ENTERPRISE,
   adrata_api_catalog: TIERS.FREE,
   paper_app_audit: TIERS.FREE,
   adrata_desktop_app_audit: TIERS.FREE,
@@ -220,6 +226,7 @@ export const TOOL_TIERS = {
   list_work_boards: TIERS.ENTERPRISE,
   list_source_control_connections: TIERS.ENTERPRISE,
   get_source_control_connection_events: TIERS.ENTERPRISE,
+  bind_repository_to_board: TIERS.ENTERPRISE,
   get_work_item_delivery_evidence: TIERS.ENTERPRISE,
   audit_work_hub: TIERS.ENTERPRISE,
   list_work_item_acceptance_criteria: TIERS.ENTERPRISE,
@@ -251,11 +258,18 @@ export const TOOL_TIERS = {
   create_work_item: TIERS.ENTERPRISE,
   add_work_item_acceptance_criterion: TIERS.ENTERPRISE,
   classify_work_item_acceptance_criterion: TIERS.ENTERPRISE,
+  edit_work_item_acceptance_criterion: TIERS.ENTERPRISE,
+  delete_work_item_acceptance_criterion: TIERS.ENTERPRISE,
   satisfy_work_item_acceptance_criterion: TIERS.ENTERPRISE,
   record_work_item_criterion_engineering_proof: TIERS.ENTERPRISE,
   unsatisfy_work_item_acceptance_criterion: TIERS.ENTERPRISE,
   comment_on_work_item: TIERS.ENTERPRISE,
   flag_work_item: TIERS.ENTERPRISE,
+  // Retiring a card and bringing it back. Same reasoning as every board write:
+  // these change a real workspace record.
+  archive_work_item: TIERS.ENTERPRISE,
+  delete_work_item: TIERS.ENTERPRISE,
+  unarchive_work_item: TIERS.ENTERPRISE,
   // The containers above the cards, and the "add this to the roadmap" verb.
   // Same reasoning as every board tool: scopes are real workspace records.
   list_work_scopes: TIERS.ENTERPRISE,

package/api-bridge.js

@@ -251,6 +251,32 @@ export function normalizeApiPath(path) {
   if (!path || typeof path !== 'string') throw new Error('path is required');
   if (!path.startsWith('/')) throw new Error('path must start with /');
   if (path.includes('://')) throw new Error('path must be relative, not an absolute URL');
+  // Authorize the pathname that api() will actually send, not a raw prefix
+  // that WHATWG URL parsing can turn into a different route. Query values
+  // belong in `params`; fragments, backslashes and controls are never paths.
+  if (/[\\?#\u0000-\u0020\u007f]/.test(path) || path.includes('//')) {
+    throw new Error('path must be a canonical pathname; use params for query values');
+  }
+  const base = 'https://mcp-path.invalid';
+  const resolved = new URL(path, base);
+  if (resolved.origin !== base || resolved.pathname !== path) {
+    throw new Error('path must not change origin or pathname during URL normalization');
+  }
+  // One ordinary percent-encoded opaque segment is supported (spaces/UTF-8,
+  // for example). Refuse encoded structural characters and residual percent
+  // signs so another decoder cannot reveal a separator or dot segment later.
+  // Do not repeatedly decode and then bless a different path as authorized.
+  for (const segment of path.split('/')) {
+    let decoded;
+    try {
+      decoded = decodeURIComponent(segment);
+    } catch {
+      throw new Error('path contains invalid percent encoding');
+    }
+    if (decoded === '.' || decoded === '..' || /[%/\\?#\u0000-\u001f\u007f]/.test(decoded)) {
+      throw new Error('path contains an ambiguous encoded or dot segment');
+    }
+  }
   return path;
 }
 

package/governance/governed-args.js

@@ -161,7 +161,7 @@ const PREVIEW_LABELS = {
  * that was withheld plus what is missing to authorize it. So it always prints
  * the method and path, never a bare "ok".
  */
-export function previewMarkdown(heading, preview = {}) {
+export function previewMarkdown(heading, preview = {}, { executionAvailable = true } = {}) {
   const {
     method,
     path,
@@ -180,6 +180,7 @@ export function previewMarkdown(heading, preview = {}) {
   let text = `## ${heading} — Preview Only (nothing was written)\n\n`;
   text += `- **Method:** ${method}\n`;
   text += `- **Path:** ${path}\n`;
+  if (wouldSend === false) text += '- **Would send:** false\n';
   text += `- **Required scope:** ${requiredScope}\n`;
   text += `- **Scope held:** ${scopeHeld}\n`;
 
@@ -199,7 +200,11 @@ export function previewMarkdown(heading, preview = {}) {
     text += `\n### Body that would be sent\n\n\`\`\`json\n${JSON.stringify(body, null, 2)}\n\`\`\`\n`;
   }
 
-  text += `\n### To execute\n\nRe-call with \`dryRun:false\`, \`approved:true\`, a \`reason\`, and an \`idempotencyKey\`.\n`;
+  if (executionAvailable) {
+    text += `\n### To execute\n\nRe-call with \`dryRun:false\`, \`approved:true\`, a \`reason\`, and an \`idempotencyKey\`.\n`;
+  } else {
+    text += '\n### Live execution unavailable\n\nThis preview cannot be executed while the safety hold remains. Approval does not lift it.\n';
+  }
   if (note) text += `\n${note}\n`;
   return text;
 }

package/http/edge-block.js

@@ -97,22 +97,31 @@ export function describeEdgeBlock({ status, text, method, path, requestBody } =
   const found = offendingContent(requestBody);
   const because = found.length
     ? `The request body contains ${found.join(' and ')}, which the edge's path-traversal rule matches.`
-    : 'No known trigger was found in this request body, so the matching rule is not one already measured. Report the request id and the body, and check the WAF sampled requests.';
+    : 'No known trigger was found in this request body, the HTML response alone cannot identify the rule. IP rate limiting can return the same page even for a bodyless GET. Check WAF sampled requests using the request time and request id if available; redact credentials and private payloads.';
 
   return [
     `API ${method} ${path} → ${status}, refused at the network edge before it reached Adrata.`,
     '',
     'This is NOT an authentication or scope failure, and reconnecting the workspace will not',
     'change it. The proof is the response body: the Adrata API serialises every error as JSON,',
-    'so an HTML error page from this host was produced by something in front of it (an AWS WAF',
-    'managed rule on the ALB). Your session is unaffected — do not call connect_workspace, and',
+    'so an HTML error page from this host was produced by something in front of it (for example an AWS WAF',
+    'content or rate rule on the ALB). Your session is unaffected — do not call connect_workspace, and',
     'do not ask the owner to reconnect.',
     '',
     because,
     '',
-    'What to do: rewrite the offending text and resend. A relative path reads the same as',
-    '`code/desktop` or `<repo root>/packages/client-runtime`, and the record is no worse for it.',
-    'Do NOT strip out markdown tables or fenced code blocks — those were measured to pass, and',
-    'removing them only makes the record vaguer.',
+    ...(found.length
+      ? [
+          'What to do: confirm the original write did not apply before correcting the measured path token.',
+          'A changed payload needs a new idempotency key; retries of unchanged payloads keep the original key.',
+          'A relative path can be written as `code/desktop` or `<repo root>/packages/client-runtime`.',
+          'If the block persists, check rate limiting and WAF sampled requests before retrying again.',
+          'Do NOT strip out markdown tables or fenced code blocks — those were measured to pass.',
+        ]
+      : [
+          'Pause the batch and reduce request concurrency. Resume after the rate window clears,',
+          'preserving idempotency keys and checking which writes already succeeded.',
+          'Do not rewrite harmless content or keep retrying immediately without identifying the rule.',
+        ]),
   ].join('\n');
 }

package/http/rate-limit.js

@@ -78,7 +78,7 @@ const BASE_DELAY_MS = 500;
  * returns `null` for anything it cannot read. `null` means "we were told
  * nothing", which is different from "we were told zero", and the caller treats
  * them differently: an absent value falls back to our own backoff, while an
- * explicit `0` is honoured as the server saying "immediately is fine".
+ * explicit `0` adds no server floor (our own backoff still applies).
  */
 export function parseRetryAfterMs(headerValue, nowMs = Date.now()) {
   if (headerValue == null) return null;
@@ -91,7 +91,7 @@ export function parseRetryAfterMs(headerValue, nowMs = Date.now()) {
     // header. Guessing zero from it would hand the caller a no-wait retry,
     // which is the exact behaviour this module exists to prevent.
     if (seconds < 0) return null;
-    return Math.min(seconds * 1000, RATE_LIMIT_MAX_WAIT_MS);
+    return seconds * 1000;
   }
 
   // An HTTP-date always carries letters (a month name and a zone). Requiring
@@ -103,7 +103,7 @@ export function parseRetryAfterMs(headerValue, nowMs = Date.now()) {
   if (Number.isNaN(asDate)) return null;
   // A date already in the past means "you may retry now", not "wait a negative
   // amount of time" — clamp at zero rather than returning a nonsense delay.
-  return Math.min(Math.max(asDate - nowMs, 0), RATE_LIMIT_MAX_WAIT_MS);
+  return Math.max(asDate - nowMs, 0);
 }
 
 /**
@@ -122,7 +122,7 @@ export function rateLimitDelayMs(attempt, retryAfterMs, rng = Math.random) {
   const jittered = exponential + Math.floor(rng() * BASE_DELAY_MS);
   const own = Math.min(jittered, RATE_LIMIT_MAX_WAIT_MS);
   if (typeof retryAfterMs !== 'number' || Number.isNaN(retryAfterMs)) return own;
-  return Math.min(Math.max(own, retryAfterMs), RATE_LIMIT_MAX_WAIT_MS);
+  return Math.max(own, retryAfterMs);
 }
 
 /** Render a wait as something a person or a model reads without ambiguity. */
@@ -130,7 +130,8 @@ function describeWait(retryAfterMs) {
   if (typeof retryAfterMs !== 'number' || Number.isNaN(retryAfterMs) || retryAfterMs <= 0) {
     return 'at least a minute';
   }
-  const seconds = Math.max(1, Math.round(retryAfterMs / 1000));
+  if (!Number.isFinite(retryAfterMs)) return "the server-specified cooldown";
+  const seconds = Math.max(1, Math.ceil(retryAfterMs / 1000));
   return `${seconds}s`;
 }
 
@@ -146,7 +147,9 @@ function describeWait(retryAfterMs) {
 export function describeRateLimit({ method, path, attempts, retryAfterMs }) {
   return [
     `Rate limited (HTTP 429) by the Adrata API on ${method} ${path}.`,
-    `Already retried with backoff ${attempts} times; the limit is still in force.`,
+    attempts === 0
+      ? "No request was sent: a previous response established an active cooldown."
+      : `Made ${attempts} request attempt${attempts === 1 ? '' : 's'}; the limit is still in force.`,
     '',
     `DO NOT retry this call immediately. Wait ${describeWait(retryAfterMs)} before trying again,`,
     'or hand the work back and let a later pass pick it up.',
@@ -157,3 +160,63 @@ export function describeRateLimit({ method, path, attempts, retryAfterMs }) {
     'will expire on its own; a stuck release does not require a hot loop to resolve.',
   ].join('\n');
 }
+
+/**
+ * One authenticated caller's process-local cooldown. Retry-After is a floor, not
+ * permission to retry at our shorter tool timeout. Keep it across tool calls
+ * and check again after async auth refresh and every retry wait. Already
+ * in-flight requests may extend this deadline; they must never shorten it.
+ */
+export function createRateLimitPolicy({
+  now = Date.now,
+  sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+  rng = Math.random,
+} = {}) {
+  let retryAt = 0;
+  const beforeRequest = ({ method, path }) => {
+    const remaining = retryAt - now();
+    if (remaining > 0) {
+      throw new Error(describeRateLimit({ method, path, attempts: 0, retryAfterMs: remaining }));
+    }
+  };
+  const retry = async (response, request, { method, path }) => {
+    let attempts = 1;
+    while (response.status === 429) {
+      const retryAfterMs = parseRetryAfterMs(response.headers.get('retry-after'), now());
+      const delay = rateLimitDelayMs(attempts, retryAfterMs, rng);
+      retryAt = Math.max(retryAt, now() + delay);
+      if (attempts >= RATE_LIMIT_MAX_ATTEMPTS && retryAfterMs === null) {
+        retryAt = Math.max(retryAt, now() + 60_000);
+      }
+      const remaining = retryAt - now();
+      if (attempts >= RATE_LIMIT_MAX_ATTEMPTS || remaining > RATE_LIMIT_MAX_WAIT_MS) {
+        throw new Error(describeRateLimit({ method, path, attempts, retryAfterMs: remaining }));
+      }
+      await sleep(remaining);
+      beforeRequest({ method, path });
+      attempts += 1;
+      response = await request();
+    }
+    return response;
+  };
+  return { beforeRequest, retry, isCoolingDown: () => retryAt > now() };
+}
+
+/** Keep hosted callers separate; only idle, expired policies may be retired. */
+export function createRateLimitRegistry({ now = Date.now, ...options } = {}) {
+  const policies = new Map();
+  return (principal) => {
+    for (const [key, entry] of policies) {
+      if (key !== principal && now() - entry.lastUsed > 300_000 && !entry.policy.isCoolingDown()) {
+        policies.delete(key);
+      }
+    }
+    let entry = policies.get(principal);
+    if (!entry) {
+      entry = { policy: createRateLimitPolicy({ now, ...options }), lastUsed: now() };
+      policies.set(principal, entry);
+    }
+    entry.lastUsed = now();
+    return entry.policy;
+  };
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@adrata/adrata-mcp",
-  "version": "1.0.8",
-  "description": "Adrata MCP Server \u2014 connect Claude Code, Codex, Gemini, Cursor, and other AI tools to your CRM. 80+ tools for companies, people, deals, actions, buyer groups, warm intros, webhooks, intelligence, and more.",
+  "version": "1.0.30",
+  "description": "Adrata MCP Server \u2014 connect Claude Code, Codex, Gemini, Cursor, and other AI tools to your CRM. About 275 tools registered at startup for companies, people, deals, actions, buyer groups, warm intros, webhooks and intelligence, plus 65 more behind eight named toolsets you load with enable_toolset.",
   "type": "module",
   "main": "server.js",
   "bin": {
@@ -9,7 +9,7 @@
   },
   "scripts": {
     "start": "node server.js",
-    "test": "node --test analytics.test.js server.test.js api-bridge.test.js http/edge-block.test.js http/rate-limit.test.js audit-flush.test.js buyer-group-writes.test.js note-writes.test.js mcp-spec.test.js packaging.test.js product-profile.test.js security.test.js tool-annotations.test.js toolsets.test.js access/auth.test.js access/oauth-callback.test.js access/oauth-session.test.js access/oauth-capabilities.test.js scripts/local-dev-server.test.js tools/competitive-coverage.test.js tools/email-tools.test.js tools/scheduling.test.js tools/work-board-tools.test.js tools/work-hub/audit.test.js tools/roadmap-tools.test.js tools/source-control/connection-tools.test.js governance/money.test.js"
+    "test": "node --test analytics.test.js server.test.js api-bridge.test.js http/edge-block.test.js http/rate-limit.test.js audit-flush.test.js buyer-group-writes.test.js note-writes.test.js mcp-spec.test.js packaging.test.js product-profile.test.js security.test.js security.cap-contract.test.js tool-annotations.test.js toolsets.test.js toolsets/communications.test.js access/auth.test.js access/oauth-callback.test.js access/oauth-session.test.js access/oauth-capabilities.test.js access/oauth-scope-grantability.test.js scripts/local-dev-server.test.js tools/competitive-coverage.test.js tools/describe-count.test.js tools/email-tools.test.js tools/scheduling.test.js tools/work-board-tools.test.js tools/work-hub/audit.test.js tools/work-hub/criteria-quality.test.js tools/roadmap-tools.test.js tools/provisioning/onboarding-tools.test.js tools/source-control/connection-tools.test.js governance/money.test.js http/rate-limit-policy.test.js"
   },
   "keywords": [
     "mcp",

package/security.js

@@ -143,18 +143,169 @@ export function rateLimitResponse(retryAfterMs) {
 // 2. Input Validation
 // ---------------------------------------------------------------------------
 
+/**
+ * Length caps for TOP-LEVEL string tool arguments, by argument name.
+ *
+ * `applySecurityLayer` wraps every tool this server registers, so these caps
+ * are the FIRST thing any argument meets — before Zod, before the handler,
+ * before the API. Until 2026-09-05 they TRUNCATED, silently, and the tool then
+ * returned success: a card flag ended mid-word at exactly 1000 characters
+ * ("Do not substitute API SHA or bounce the card merely t") and the
+ * prohibition was gone for every subsequent reader including its author.
+ *
+ * Every comparable cap in the Rust API refuses instead — comments 2000,
+ * criterion parts 600, engineering-proof fields 600, reviewer model 120,
+ * evidence summary 600 — several enforced twice, once in the handler and
+ * again as a database CHECK. So every caller already handles a refusal. This
+ * layer was the only one that cut, and it ran first, which is why the cut was
+ * invisible from both ends.
+ */
+const DEFAULT_STRING_CAP = 1000;
+
+/**
+ * The API's own cap on a card comment, and on every free-text `reason` that
+ * routes through `validate_body`: flag, block, dependency, sharing, QA-flow
+ * note. Rust calls it `MAX_COMMENT_BODY_CHARS`
+ * (`code/api/crates/routes-gtm/src/work_boards/mod.rs`).
+ *
+ * `security.cap-contract.test.js` reads that constant out of the Rust
+ * source and fails if this number ever drops below it, because THAT is the
+ * divergence this whole change is about: a cap here that sits below the cap
+ * downstream cuts a value the API would have accepted, and the API never gets
+ * to refuse it.
+ */
+const API_COMMENT_BODY_CAP = 2000;
+
+/**
+ * Sanity ceiling for an argument that carries a document or a data file rather
+ * than prose (a CSV to import, a knowledge file's markdown, a paper's HTML).
+ * Deliberately far above any product rule: the point is to bound the transport,
+ * and to let the API be the layer that says how big a document may be.
+ */
+const BULK_PAYLOAD_CAP = 1_000_000;
+
+const STRING_CAPS_BY_KEY = {
+  // Long-form prose the API caps far lower anyway (a comment body is refused
+  // at 2000). 10000 here is a sanity ceiling, not the product rule.
+  body: 10000,
+  message: 10000,
+  description: 10000,
+
+  // The reason family. These were the DANGEROUS truncations and the reason
+  // this cap exists as its own class:
+  //
+  //   flag_work_item.reason          API cap 2000 — a 1000-cut value was
+  //                                  ACCEPTED truncated. This is the flag
+  //                                  defect: a prohibition ended mid-word at
+  //                                  exactly 1000 characters and read as
+  //                                  complete to every later reader.
+  //   block_work_item.reason         API cap 2000 — same shape.
+  //   move_work_item.reason          NO API cap at all, so nothing downstream
+  //   transfer_...between_boards     could ever catch the cut. Permanently and
+  //                                  silently shortened to 1000.
+  //   every X-Adrata-Reason header   NO API cap anywhere in Rust
+  //   (api-bridge.js)                (presence-only). Same silence.
+  //
+  // Raising these to the API's own 2000 is what keeps this change from
+  // trading a silent cut for a refusal of honest input: a 1400-character
+  // reason is legitimate, the API accepts it, and until now this layer cut it.
+  reason: API_COMMENT_BODY_CAP,
+
+  // `auditReason` is the same field family under a different name: the shared
+  // `moneyWrite` envelope (server.js) spreads it into EVERY money write, so it
+  // was the one reason-shaped argument the first version of this table missed.
+  auditReason: API_COMMENT_BODY_CAP,
+
+  // `record_work_item_qa_failure_and_release.details` is composed into a flag
+  // reason (`"QA criterion failure (<id>): " + details`) and so lands under
+  // the same 2000 API cap. A 1000-character cut plus that ~14-character prefix
+  // stayed comfortably under 2000, which is exactly why the "~1,014 characters,
+  // 200 OK" measurement was silent. Known rough edge: a `details` near 2000
+  // composes to over 2000 and the API refuses the composed value with its own
+  // message. That is a refusal rather than a silence, which is the property
+  // this change is about.
+  details: API_COMMENT_BODY_CAP,
+
+  // Search terms. A query longer than this is a paste, not a search.
+  query: 500,
+  search: 500,
+
+  // --- Payloads, not prose ---
+  //
+  // These carry a document or a data file, and at the old 1000 default they
+  // were the WORST instances of the truncation: `bulk_import`/`manage_data`
+  // took a CSV — any real one is past 1000 in its first few rows — cut it to
+  // 1000, imported the fragment, and reported success. A partial import that
+  // announces itself as complete is harder to notice than a lost sentence.
+  //
+  // The ceiling here is a transport sanity bound, NOT a product rule. This
+  // layer has no business deciding how large a knowledge file may be; the API
+  // owns that, and it can refuse. What this layer must never again do is
+  // decide it silently.
+  csvData: BULK_PAYLOAD_CAP,
+  content: BULK_PAYLOAD_CAP,
+};
+
+/** The cap that applies to a top-level string argument named `key`. */
+export function maxLengthForKey(key) {
+  return Object.prototype.hasOwnProperty.call(STRING_CAPS_BY_KEY, key)
+    ? STRING_CAPS_BY_KEY[key]
+    : DEFAULT_STRING_CAP;
+}
+
+/**
+ * The refusal text. It names the actual length, the cap, and how much to cut,
+ * because the caller is usually an agent that can shorten and retry — and it
+ * says plainly that nothing was written, since the whole point of the defect
+ * this replaces was a caller believing a truncated write had landed.
+ */
+export function overLengthMessage(field, length, maxLength) {
+  return `Parameter "${field}" is ${length} characters and the cap is ${maxLength} — `
+    + `remove ${length - maxLength}. Nothing was written: the value was refused whole `
+    + `rather than cut, so shorten it and call again.`;
+}
+
 /**
  * Common validation schemas for tool parameters.
  * These wrap and tighten the existing Zod schemas.
  */
 export const validators = {
-  /** Sanitize a string — strip control characters, limit length. */
-  sanitizeString(value, maxLength = 1000) {
-    if (typeof value !== 'string') return value;
-    // Strip control characters except newline/tab
-    // eslint-disable-next-line no-control-regex
-    const cleaned = value.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, '');
-    return cleaned.slice(0, maxLength);
+  /**
+   * Strip control characters, and REFUSE a string longer than `maxLength`.
+   *
+   * Returns `{ value, error }` rather than a bare string on purpose. Until
+   * 2026-09-05 this ended `return cleaned.slice(0, maxLength)` — the value was
+   * cut, `validateToolInput` still reported `valid: true`, and the write went
+   * on to return 200. The object shape means a caller cannot use the result as
+   * a string without noticing, so the refusal cannot be dropped the way the
+   * silent slice was.
+   *
+   * Length is counted in CODE POINTS (`[...cleaned].length`), matching the
+   * Rust API's `chars().count()` downstream rather than UTF-16 code units, so
+   * a value this layer accepts is not one the next layer measures differently.
+   */
+  sanitizeString(value, maxLength = DEFAULT_STRING_CAP, field = 'value') {
+    if (typeof value !== 'string') return { value, error: null };
+    // Vertical tab (0x0B) and form feed (0x0C) ARE whitespace: they separate
+    // words. Deleting them outright fuses the tokens either side into one —
+    // "evidence<VT>01M1RAMY" becomes "evidence01M1RAMY" — and that is worse to
+    // read than a truncation, because the sentence still looks complete, so a
+    // reader has no tell at all. They collapse to a space. Every other control
+    // character in the class is not a separator, so removing it stays correct.
+    //
+    // Tab (0x09), newline (0x0A) and carriage return (0x0D) sit outside both
+    // classes and pass through untouched, as they always have.
+    const cleaned = value
+      // eslint-disable-next-line no-control-regex
+      .replace(/[\x0B\x0C]/g, ' ')
+      // eslint-disable-next-line no-control-regex
+      .replace(/[\x00-\x08\x0E-\x1F\x7F]/g, '');
+    // Measured AFTER stripping: control characters must not eat the budget.
+    const length = [...cleaned].length;
+    if (length > maxLength) {
+      return { value: cleaned, error: overLengthMessage(field, length, maxLength) };
+    }
+    return { value: cleaned, error: null };
   },
 
   /** Validate that a string doesn't contain obvious injection patterns. */
@@ -223,13 +374,15 @@ export function validateToolInput(toolName, args) {
         continue;
       }
 
-      // Sanitize string values
-      const maxLen = key === 'body' || key === 'message' || key === 'description'
-        ? 10000
-        : key === 'query' || key === 'search'
-          ? 500
-          : 1000;
-      sanitized[key] = validators.sanitizeString(value, maxLen);
+      // Sanitize string values. An over-long value is REFUSED, not cut:
+      // see the cap table above for why this layer used to truncate silently.
+      const { value: cleaned, error: lengthError } =
+        validators.sanitizeString(value, maxLengthForKey(key), key);
+      if (lengthError) {
+        errors.push(lengthError);
+        continue;
+      }
+      sanitized[key] = cleaned;
 
       // Validate specific field types
       if (key === 'id' || key.endsWith('Id')) {

package/server.js

@@ -43,12 +43,7 @@ import { TIERS } from './access/tiers.js';
 import { findCompany, findPerson } from './tools/free-search.js';
 import { applySecurityLayer } from './security.js';
 import { describeEdgeBlock } from './http/edge-block.js';
-import {
-  parseRetryAfterMs,
-  rateLimitDelayMs,
-  describeRateLimit,
-  RATE_LIMIT_MAX_ATTEMPTS,
-} from './http/rate-limit.js';
+import { createRateLimitRegistry } from './http/rate-limit.js';
 import { registerMemoryTools, wrapWithEventLogging, registerProfileResource } from './tools/memory.js';
 import { registerBillingTools } from './tools/billing.js';
 import { registerMorningBrief } from './tools/morning-brief.js';
@@ -60,6 +55,7 @@ import { registerEmailTools } from './tools/email-tools.js';
 import { registerWorkBoardTools } from './tools/work-board-tools.js';
 import { registerSourceControlTools } from './tools/source-control/connection-tools.js';
 import { registerRoadmapTools } from './tools/roadmap-tools.js';
+import { registerProvisioningTools } from './tools/provisioning/onboarding-tools.js';
 import { registerPaperTools } from './tools/paper-tools.js';
 import { register as registerAlwaysLoadedTools } from './toolsets/revenue/always-loaded.js';
 import { register as registerExtensibilityTools } from './toolsets/extensibility.js';
@@ -129,7 +125,15 @@ function refreshFailureError(err) {
   return err instanceof Error ? err : new Error(String(err));
 }
 
+const rateLimitForPrincipal = createRateLimitRegistry();
+
 async function api(method, path, { params, body, headers: extraHeaders } = {}) {
+  const auth = currentAuth();
+  // Hosted requests carry a validated principal fingerprint. Stdio retains
+  // its auth object across token refresh. Never share one user's API cooldown
+  // with another user of the hosted MCP process.
+  const rateLimitPolicy = rateLimitForPrincipal(auth.securityPrincipal ?? auth);
+  rateLimitPolicy.beforeRequest({ method, path });
   const url = new URL(path, API_BASE);
   if (params) {
     for (const [k, v] of Object.entries(params)) {
@@ -138,7 +142,6 @@ async function api(method, path, { params, body, headers: extraHeaders } = {}) {
   }
 
   // For stored OAuth tokens, auto-refresh if expired before the request
-  const auth = currentAuth();
   assertOAuthIssuerMatchesTarget(auth, API_BASE);
   let currentToken = auth.token;
   if (auth.source === 'stored' || auth.source === 'stored_pool') {
@@ -177,6 +180,7 @@ async function api(method, path, { params, body, headers: extraHeaders } = {}) {
   Object.assign(headers, extraHeaders || {});
 
   const request = (token) => {
+    rateLimitPolicy.beforeRequest({ method, path });
     const requestHeaders = { ...headers };
     if (token) requestHeaders.Authorization = `Bearer ${token}`;
     return fetch(url.toString(), {
@@ -225,21 +229,7 @@ async function api(method, path, { params, body, headers: extraHeaders } = {}) {
   // against production on 2026-09-02. Wait, retry a bounded number of times,
   // and if the limit still holds, fail with a message that says so. See
   // rate-limit.js for the measured incident.
-  let rateLimitAttempts = 1;
-  let retryAfterMs = null;
-  while (res.status === 429 && rateLimitAttempts < RATE_LIMIT_MAX_ATTEMPTS) {
-    retryAfterMs = parseRetryAfterMs(res.headers.get('retry-after'));
-    const waitMs = rateLimitDelayMs(rateLimitAttempts, retryAfterMs);
-    await new Promise((resolve) => setTimeout(resolve, waitMs));
-    rateLimitAttempts += 1;
-    res = await request(currentToken);
-  }
-  if (res.status === 429) {
-    retryAfterMs = parseRetryAfterMs(res.headers.get('retry-after')) ?? retryAfterMs;
-    throw new Error(
-      describeRateLimit({ method, path, attempts: rateLimitAttempts, retryAfterMs }),
-    );
-  }
+  res = await rateLimitPolicy.retry(res, () => request(currentToken), { method, path });
 
   const text = await res.text();
   let data;
@@ -2405,7 +2395,29 @@ registerWorkBoardTools(server, {
   getGrantedScope: () => loadTokens()?.scope,
 });
 
-registerSourceControlTools(server, { z, api, ok });
+registerSourceControlTools(server, {
+  z,
+  api,
+  ok,
+  validateApiBridgeRequest,
+  buildMutationHeaders,
+  getGrantedScope: () => loadTokens()?.scope,
+});
+
+// Seating a customer's people and minting the onboarding link an AE hands them.
+// The first path from MCP that can actually finish: `invite_user` through
+// `adrata_ai_tool_execute` refuses every machine principal at the confirmation
+// step (ai_crm_tools/mod.rs:427), so the bridge could preview a seat forever and
+// create none. See tools/provisioning.js for why this is one tool and not two.
+registerProvisioningTools(server, {
+  z,
+  api,
+  ok,
+  validateApiBridgeRequest,
+  buildMutationHeaders,
+  getGrantedScope: () => loadTokens()?.scope,
+  getWorkspaceId: () => loadTokens()?.workspaceId ?? AUTH?.workspaceId ?? null,
+});
 
 // The containers above the cards, and the "add this to the roadmap" verb
 // (company/decisions/2026-08-06-spoq-roadmap-sync.md).

package/server.json

@@ -3,7 +3,7 @@
   "name": "com.adrata/adrata-mcp",
   "description": "Adrata revenue-intelligence MCP server: companies, people, opportunities, actions, buyer groups, enrichment, email, and workspace operations for AI agents.",
   "status": "active",
-  "version": "1.0.8",
+  "version": "1.0.30",
   "websiteUrl": "https://adrata.com/developers",
   "repository": {
     "url": "https://github.com/adrata/adrata",
@@ -15,7 +15,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@adrata/adrata-mcp",
-      "version": "1.0.8",
+      "version": "1.0.30",
       "transport": {
         "type": "stdio"
       },