@sendinel/mcp-server 1.0.10 → 1.0.12

package/build/tools/gateway.js

@@ -0,0 +1,92 @@
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { InMemoryTransport } from '@modelcontextprotocol/sdk/inMemory.js';
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { z } from 'zod';
+import { getRegisteredToolGroups, registerAllTools } from '../server.js';
+const textResult = (text) => ({ content: [{ type: 'text', text }] });
+const jsonResult = (data) => textResult(JSON.stringify(data, null, 2));
+const notFound = (message) => ({
+    isError: true,
+    content: [{ type: 'text', text: message }],
+});
+async function buildCatalog(options) {
+    const innerServer = new McpServer({ name: 'sendinel-gateway-inner', version: '1.0.0' });
+    registerAllTools(innerServer, { scopes: options.scopes, toolGroups: options.toolGroups });
+    const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+    const client = new Client({ name: 'sendinel-gateway', version: '1.0.0' });
+    await innerServer.connect(serverTransport);
+    await client.connect(clientTransport);
+    const toolGroupMap = getRegisteredToolGroups({ scopes: options.scopes, toolGroups: options.toolGroups });
+    const { tools } = await client.listTools();
+    const entries = tools
+        .map((tool) => ({
+        name: tool.name,
+        group: toolGroupMap[tool.name] ?? 'unknown',
+        description: tool.description ?? '',
+        inputSchema: tool.inputSchema,
+    }))
+        .sort((a, b) => {
+        const groupCompare = a.group.localeCompare(b.group);
+        return groupCompare !== 0 ? groupCompare : a.name.localeCompare(b.name);
+    });
+    return { client, entries, byName: new Map(entries.map((entry) => [entry.name, entry])) };
+}
+export function registerGatewayTools(server, options) {
+    let catalogPromise = null;
+    const getCatalog = () => (catalogPromise ??= buildCatalog(options));
+    server.registerTool('search_tools', {
+        title: 'Search Tools',
+        description: 'Search the permitted Sendinel MCP tool catalog by keyword and/or group. Returns name, group, and description. Call describe_tool for the full input schema before invoke_tool.',
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+        inputSchema: {
+            query: z.string().optional().describe('Keyword to match against tool name, group, or description'),
+            group: z.string().optional().describe('Restrict results to one tool group, for example campaigns'),
+        },
+    }, async ({ query, group }) => {
+        const catalog = await getCatalog();
+        const q = query?.trim().toLowerCase() ?? '';
+        const requestedGroup = group?.trim();
+        const results = catalog.entries.filter((tool) => {
+            if (requestedGroup && tool.group !== requestedGroup)
+                return false;
+            if (!q)
+                return true;
+            return (tool.name.toLowerCase().includes(q) ||
+                tool.group.toLowerCase().includes(q) ||
+                tool.description.toLowerCase().includes(q));
+        });
+        return jsonResult({
+            tools: results.map(({ name, group, description }) => ({ name, group, description })),
+            total: results.length,
+        });
+    });
+    server.registerTool('describe_tool', {
+        title: 'Describe Tool',
+        description: 'Return one permitted Sendinel MCP tool input schema by name. Call this before invoke_tool so arguments match the real signature.',
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+        inputSchema: {
+            name: z.string().min(1).describe('Tool name to describe'),
+        },
+    }, async ({ name }) => {
+        const catalog = await getCatalog();
+        const entry = catalog.byName.get(name);
+        if (!entry)
+            return notFound(`Tool not found: ${name}`);
+        return jsonResult(entry);
+    });
+    server.registerTool('invoke_tool', {
+        title: 'Invoke Tool',
+        description: 'Execute one permitted Sendinel MCP tool by name with the same scope and approval enforcement as calling it directly. Use search_tools and describe_tool first.',
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+        inputSchema: {
+            name: z.string().min(1).describe('Tool name to invoke'),
+            args: z.record(z.string(), z.unknown()).optional().default({}).describe('Arguments for the target tool'),
+        },
+    }, async ({ name, args }) => {
+        const catalog = await getCatalog();
+        if (!catalog.byName.has(name)) {
+            return notFound(`Tool not found or not permitted: ${name}`);
+        }
+        return await catalog.client.callTool({ name, arguments: args ?? {} });
+    });
+}

package/build/tools/gdpr.js

@@ -77,4 +77,189 @@ export function registerGdprTools(server) {
             return { content: [{ type: 'text', text: `Error: ${error.message}` }] };
         return { content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] };
     });
+    server.registerTool('list_ccpa_requests', {
+        title: 'List CCPA Requests',
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+        description: 'List CCPA (know/delete/opt_out) requests in this project\'s compliance queue. Excludes full data-export and details payloads; use the dashboard to inspect exported request data.',
+        inputSchema: {
+            status: z.enum(['pending', 'verified', 'completed', 'expired']).optional(),
+            request_type: z.enum(['know', 'delete', 'opt_out']).optional(),
+            search: z.string().optional().describe('Filter by email (partial match)'),
+            limit: z.number().int().min(1).max(200).optional().default(50),
+        },
+    }, async ({ status, request_type, search, limit }) => {
+        let query = db()
+            .from('compliance_requests')
+            .select('id, email, request_type, status, verified_at, processed_at, completed_at, expires_at, created_at')
+            .eq('project_id', getProjectId())
+            .eq('regulation', 'ccpa');
+        if (status)
+            query = query.eq('status', status);
+        if (request_type)
+            query = query.eq('request_type', request_type);
+        if (search)
+            query = query.ilike('email', `%${search}%`);
+        const { data, error } = await query
+            .order('created_at', { ascending: false })
+            .limit(limit ?? 50);
+        if (error)
+            return txt(`Error: ${error.message}`);
+        return j({ requests: data ?? [], count: data?.length ?? 0 });
+    });
+    server.registerTool('action_ccpa_request', {
+        title: 'Action CCPA Request',
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: true,
+            idempotentHint: false,
+            openWorldHint: false,
+        },
+        description: 'Move a CCPA request through pending -> verified -> completed. Verification is allowed only while a pending request is unexpired. Completing a delete request permanently erases all subscriber data for its email address and requires protected human approval; call once without approval_id to see exactly what will be deleted, then call again after approval.',
+        inputSchema: {
+            request_id: z.string().uuid(),
+            status: z.enum(['verified', 'completed']),
+            approval_id: z.string().uuid().optional().describe('Required to complete a delete request after a human approves the summary in the dashboard.'),
+        },
+    }, async ({ request_id, status, approval_id }) => {
+        const projectId = getProjectId();
+        const { data: request, error: fetchErr } = await db()
+            .from('compliance_requests')
+            .select('id, email, request_type, status, expires_at')
+            .eq('id', request_id)
+            .eq('project_id', projectId)
+            .eq('regulation', 'ccpa')
+            .maybeSingle();
+        if (fetchErr)
+            return txt(`Error: ${fetchErr.message}`);
+        if (!request)
+            return txt('CCPA request not found or does not belong to this project.');
+        if (request.status === 'completed' || request.status === 'expired') {
+            return txt(`Request is already "${request.status}" and cannot be actioned further.`);
+        }
+        if (status === 'verified') {
+            if (request.status !== 'pending') {
+                return txt(`Request must be "pending" to verify (currently "${request.status}").`);
+            }
+            const nowIso = new Date().toISOString();
+            if (!request.expires_at || new Date(request.expires_at) <= new Date(nowIso)) {
+                return txt('Request has expired and can no longer be verified.');
+            }
+            const { data, error } = await db()
+                .from('compliance_requests')
+                .update({ status: 'verified', verified_at: nowIso })
+                .eq('id', request_id)
+                .eq('project_id', projectId)
+                .eq('regulation', 'ccpa')
+                .eq('status', 'pending')
+                .gt('expires_at', nowIso)
+                .select('id, email, status, verified_at')
+                .maybeSingle();
+            if (error)
+                return txt(`Error: ${error.message}`);
+            if (!data)
+                return txt('Request changed or expired before it could be verified. Refresh the queue and try again.');
+            void logAudit({
+                action: 'ccpa.request_verified',
+                resourceType: 'compliance_request',
+                resourceId: request_id,
+                details: { email: request.email },
+            });
+            return j({ ok: true, request: data });
+        }
+        if (request.status !== 'verified') {
+            return txt(`Request must be "verified" before it can be completed (currently "${request.status}"). Call this tool with status: "verified" first.`);
+        }
+        if (request.request_type === 'delete') {
+            const approvalParams = {
+                request_id,
+                status: 'completed',
+                request_type: request.request_type,
+                email: request.email,
+            };
+            if (!approval_id) {
+                const channelContext = currentChannelContext();
+                const decision = assertChannelCanExecute('action_ccpa_request', approvalParams, channelContext);
+                if (!decision.allowed)
+                    return txt(decision.reason ?? 'This channel cannot request this action.');
+                return j(await requestApproval('action_ccpa_request', approvalParams, undefined, channelContext));
+            }
+            const check = await checkApproval(approval_id, {
+                consume: true,
+                action: 'action_ccpa_request',
+                params: approvalParams,
+            });
+            if (!check.approved) {
+                return txt(`Approval ${approval_id} is ${check.status}. ${check.status === 'pending' ? 'Waiting for human approval via dashboard.' : 'Request a new approval.'}`);
+            }
+            const { data: contact, error: contactErr } = await db()
+                .from('subscribers')
+                .select('id, email')
+                .eq('project_id', projectId)
+                .eq('email', request.email)
+                .maybeSingle();
+            if (contactErr)
+                return txt(`Error: ${contactErr.message}`);
+            if (contact) {
+                const { error: deleteErr } = await db().rpc('delete_contact_gdpr', {
+                    p_contact_id: contact.id,
+                    p_reason: 'ccpa_delete_request',
+                    p_deleted_by: 'mcp_ccpa_action',
+                });
+                if (deleteErr)
+                    return txt(`Deletion failed: ${deleteErr.message}`);
+            }
+            const completedAt = new Date().toISOString();
+            const { data, error } = await db()
+                .from('compliance_requests')
+                .update({
+                status: 'completed',
+                processed_at: completedAt,
+                completed_at: completedAt,
+                ...(contact ? {} : { data_export: { message: 'No data found for this email address.' } }),
+            })
+                .eq('id', request_id)
+                .eq('project_id', projectId)
+                .eq('regulation', 'ccpa')
+                .eq('status', 'verified')
+                .select('id, email, status, completed_at')
+                .maybeSingle();
+            if (error)
+                return txt(`Error: ${error.message}`);
+            if (!data)
+                return txt('Request changed before it could be completed. Refresh the queue before retrying.');
+            void logAudit({
+                action: 'ccpa.delete_completed',
+                resourceType: 'contact',
+                resourceId: contact?.id ?? request_id,
+                details: { email: request.email, request_id },
+            });
+            return j({ ok: true, request: data, subscriber_deleted: Boolean(contact) });
+        }
+        const completedAt = new Date().toISOString();
+        const { data, error } = await db()
+            .from('compliance_requests')
+            .update({ status: 'completed', processed_at: completedAt, completed_at: completedAt })
+            .eq('id', request_id)
+            .eq('project_id', projectId)
+            .eq('regulation', 'ccpa')
+            .eq('status', 'verified')
+            .select('id, email, status, completed_at')
+            .maybeSingle();
+        if (error)
+            return txt(`Error: ${error.message}`);
+        if (!data)
+            return txt('Request changed before it could be completed. Refresh the queue before retrying.');
+        void logAudit({
+            action: 'ccpa.request_completed',
+            resourceType: 'compliance_request',
+            resourceId: request_id,
+            details: { email: request.email, request_type: request.request_type },
+        });
+        return j({ ok: true, request: data });
+    });
 }

package/build/tools/landing-pages.d.ts

@@ -0,0 +1,2 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerLandingPageTools(server: McpServer): void;

package/build/tools/landing-pages.js

@@ -0,0 +1,202 @@
+import { z } from 'zod';
+import { db } from '../db.js';
+import { getProjectId } from '../project.js';
+import { logAudit } from '../audit.js';
+const j = (data) => ({ content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] });
+const SLUG_RE = /^[a-z0-9][a-z0-9\-]{0,62}$/;
+const VALID_STATUSES = ['draft', 'published', 'archived'];
+const LIST_COLUMNS = 'id, title, slug, site_id, status, form_id, blocks, meta_title, meta_description, conversion_event, views, conversions, background_color, accent_color, custom_css, created_at, updated_at, published_at';
+function slugify(text) {
+    return text
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 63);
+}
+export function registerLandingPageTools(server) {
+    server.registerTool('list_landing_pages', {
+        title: 'List Landing Pages',
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+        description: 'List project-scoped landing pages, optionally filtered by site.',
+        inputSchema: { site_id: z.string().uuid().optional() },
+    }, async ({ site_id }) => {
+        let query = db()
+            .from('landing_pages')
+            .select(LIST_COLUMNS)
+            .eq('project_id', getProjectId());
+        if (site_id)
+            query = query.eq('site_id', site_id);
+        const { data, error } = await query.order('created_at', { ascending: false });
+        if (error)
+            return j({ error: error.message });
+        return j({ pages: data ?? [] });
+    });
+    server.registerTool('get_landing_page', {
+        title: 'Get Landing Page',
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+        description: 'Get one project-scoped landing page, including its full block content.',
+        inputSchema: { page_id: z.string().uuid() },
+    }, async ({ page_id }) => {
+        const { data, error } = await db()
+            .from('landing_pages')
+            .select('*')
+            .eq('project_id', getProjectId())
+            .eq('id', page_id)
+            .maybeSingle();
+        if (error)
+            return j({ error: error.message });
+        if (!data)
+            return j({ error: 'Landing page not found', code: 'NOT_FOUND' });
+        return j(data);
+    });
+    server.registerTool('create_landing_page', {
+        title: 'Create Landing Page',
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+        description: 'Create a draft landing page. Publish it with update_landing_page by setting status to published.',
+        inputSchema: {
+            title: z.string().trim().min(1).max(200),
+            slug: z.string().trim().regex(SLUG_RE, 'Lowercase alphanumeric + hyphens, max 63 chars').optional(),
+            site_id: z.string().uuid().optional(),
+            form_id: z.string().uuid().optional(),
+            blocks: z.array(z.record(z.string(), z.unknown())).optional().describe('Ordered page content blocks'),
+            meta_title: z.string().optional(),
+            meta_description: z.string().optional(),
+            conversion_event: z.string().optional(),
+            background_color: z.string().optional(),
+            accent_color: z.string().optional(),
+            custom_css: z.string().optional(),
+        },
+    }, async ({ title, slug, site_id, form_id, blocks, meta_title, meta_description, conversion_event, background_color, accent_color, custom_css }) => {
+        const projectId = getProjectId();
+        const normalizedTitle = title.trim();
+        const normalizedSlug = (slug ?? slugify(normalizedTitle)).trim();
+        if (!SLUG_RE.test(normalizedSlug))
+            return j({ error: 'Invalid slug (lowercase alphanumeric + hyphens, max 63 chars)' });
+        const insert = {
+            project_id: projectId,
+            title: normalizedTitle,
+            slug: normalizedSlug,
+        };
+        if (site_id)
+            insert.site_id = site_id;
+        if (form_id)
+            insert.form_id = form_id;
+        if (blocks)
+            insert.blocks = blocks;
+        if (meta_title)
+            insert.meta_title = meta_title;
+        if (meta_description)
+            insert.meta_description = meta_description;
+        if (conversion_event)
+            insert.conversion_event = conversion_event;
+        if (background_color)
+            insert.background_color = background_color;
+        if (accent_color)
+            insert.accent_color = accent_color;
+        if (custom_css)
+            insert.custom_css = custom_css;
+        const { data, error } = await db()
+            .from('landing_pages')
+            .insert(insert)
+            .select()
+            .single();
+        if (error) {
+            if (error.code === '23505')
+                return j({ error: 'A page with this slug already exists' });
+            return j({ error: error.message });
+        }
+        await logAudit({
+            action: 'landing_page.created',
+            resourceType: 'landing_page',
+            resourceId: data.id,
+            details: { title: data.title, slug: data.slug, status: data.status },
+        });
+        return j(data);
+    });
+    server.registerTool('update_landing_page', {
+        title: 'Update Landing Page',
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+        description: 'Update a landing page. Setting status to published stamps published_at; pass site_id or form_id as null to clear it.',
+        inputSchema: {
+            page_id: z.string().uuid(),
+            title: z.string().trim().min(1).max(200).optional(),
+            slug: z.string().trim().regex(SLUG_RE, 'Lowercase alphanumeric + hyphens, max 63 chars').optional(),
+            status: z.enum(VALID_STATUSES).optional(),
+            site_id: z.string().uuid().nullable().optional(),
+            form_id: z.string().uuid().nullable().optional(),
+            blocks: z.array(z.record(z.string(), z.unknown())).optional(),
+            meta_title: z.string().optional(),
+            meta_description: z.string().optional(),
+            conversion_event: z.string().optional(),
+            background_color: z.string().optional(),
+            accent_color: z.string().optional(),
+            custom_css: z.string().optional(),
+        },
+    }, async ({ page_id, title, slug, status, site_id, form_id, blocks, meta_title, meta_description, conversion_event, background_color, accent_color, custom_css }) => {
+        const projectId = getProjectId();
+        const updates = { updated_at: new Date().toISOString() };
+        if (title !== undefined)
+            updates.title = title.trim();
+        if (slug !== undefined)
+            updates.slug = slug.trim();
+        if (status !== undefined) {
+            updates.status = status;
+            if (status === 'published')
+                updates.published_at = new Date().toISOString();
+        }
+        if (site_id !== undefined)
+            updates.site_id = site_id;
+        if (form_id !== undefined)
+            updates.form_id = form_id;
+        if (blocks !== undefined)
+            updates.blocks = blocks;
+        if (meta_title !== undefined)
+            updates.meta_title = meta_title;
+        if (meta_description !== undefined)
+            updates.meta_description = meta_description;
+        if (conversion_event !== undefined)
+            updates.conversion_event = conversion_event;
+        if (background_color !== undefined)
+            updates.background_color = background_color;
+        if (accent_color !== undefined)
+            updates.accent_color = accent_color;
+        if (custom_css !== undefined)
+            updates.custom_css = custom_css;
+        const { data, error } = await db()
+            .from('landing_pages')
+            .update(updates)
+            .eq('id', page_id)
+            .eq('project_id', projectId)
+            .select()
+            .single();
+        if (error) {
+            if (error.code === '23505')
+                return j({ error: 'A page with this slug already exists' });
+            return j({ error: error.message });
+        }
+        await logAudit({
+            action: 'landing_page.updated',
+            resourceType: 'landing_page',
+            resourceId: data.id,
+            details: { title: data.title, slug: data.slug, status: data.status },
+        });
+        return j(data);
+    });
+    server.registerTool('delete_landing_page', {
+        title: 'Delete Landing Page',
+        annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+        description: 'Permanently delete a landing page. Set status to archived instead to unpublish without deleting.',
+        inputSchema: { page_id: z.string().uuid() },
+    }, async ({ page_id }) => {
+        const projectId = getProjectId();
+        const { error } = await db()
+            .from('landing_pages')
+            .delete()
+            .eq('id', page_id)
+            .eq('project_id', projectId);
+        if (error)
+            return j({ error: error.message });
+        await logAudit({ action: 'landing_page.deleted', resourceType: 'landing_page', resourceId: page_id });
+        return j({ deleted: true });
+    });
+}

package/build/tools/lists.d.ts

@@ -0,0 +1,2 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerListTools(server: McpServer): void;