@sendinel/mcp-server 1.0.117 → 1.0.118

package/build/lib/action-approvals.js

@@ -117,7 +117,7 @@ export function getApprovalTier(action, params) {
     }
     // send_broadcast exists for agents and always needs a person's approval, even in autonomous
     // mode: it must never approve itself (#3669, AI-worker boundary in CLAUDE.md).
-    if (action === 'draft_agent_reply' || action === 'create_agent_mailbox' || action === 'send_broadcast' || action === 'activate_campaigns')
+    if (action === 'draft_agent_reply' || action === 'create_agent_mailbox' || action === 'send_broadcast' || action === 'activate_campaigns' || action === 'invite_team_member')
         return 'gated';
     // Autonomous mode: user explicitly opted out of approval gates for gated actions
     // (request-scoped under HTTP — env is only trustworthy for single-project stdio)
@@ -289,6 +289,10 @@ export function buildApprovalSummary(action, params, display = {}) {
         add_list_members: (p) => `Add ${p.contact_ids?.length ?? 0} contact(s) to list ${p.list_id}`,
         remove_list_members: (p) => `Remove ${p.contact_ids?.length ?? 0} contact(s) from list ${p.list_id}`,
         add_list_members_by_filter: (p) => `Add contacts matching filter rules to list ${p.list_id}`,
+        invite_team_member: (p) => {
+            const invite = p.__approval_snapshot?.invitation;
+            return `Send invitation to ${p.email} as ${p.role}; project_ids: ${JSON.stringify(p.project_ids ?? null)} (null = org-wide, [] = no projects); organization: ${invite?.org_name ?? 'unavailable'} (${invite?.org_id ?? 'unavailable'}); subject: "${invite?.subject ?? 'unavailable'}"`;
+        },
         remove_team_member: (p) => `Remove team member ${p.user_id} from the organization`,
         set_team_member_role: (p) => `Change team member ${p.user_id}'s role to ${p.role}`,
         delete_provider_credential: (p) => `Delete saved ${p.provider ?? 'provider'} credential ${p.credential_id} (${p.source})`,

package/build/lib/approval-snapshot.js

@@ -1,6 +1,7 @@
 import { isTesterRequest } from './tester-policy.js';
 import { captureTesterRequestSnapshot } from './tester-request-snapshot.js';
 import { readAllRows, chunkIds, scopeSegmentRulesToSite } from '@sendinel/domain';
+import { callSendinelV1 } from './v1-client.js';
 import { db } from '../db.js';
 import { resolveSendAudience, resolveSegmentContactIds } from './send-audience.js';
 const TARGET_ACTIONS = new Set(['send_broadcast', 'broadcast_to_segment', 'launch_campaign', 'activate_campaigns',
@@ -8,6 +9,14 @@ const TARGET_ACTIONS = new Set(['send_broadcast', 'broadcast_to_segment', 'launc
     'send_transactional', 'send_awaiting_reply', 'send_test_email', 'send_newsletter_issue', 'schedule_newsletter_issue']);
 /** Server-owned display facts, saved inside the hash-bound params. Never supplied by a tool. */
 export async function captureApprovalSnapshot(action, params, projectId) {
+    if (action === 'invite_team_member') {
+        const result = await callSendinelV1('/api/v1/org/invitations', { method: 'POST', body: { ...params, preview_only: true } });
+        const preview = result.ok ? result.data.preview : null;
+        if (!preview || typeof preview.org_id !== 'string' || typeof preview.org_name !== 'string' || typeof preview.subject !== 'string') {
+            throw new Error('Invitation approval preview unavailable; no email was sent.');
+        }
+        return { version: 1, invitation: preview, recipient_count: 1 };
+    }
     const setup = isTesterRequest(action) ? await captureTesterRequestSnapshot(action, params, projectId) : null;
     const snapshot = { version: 1, campaigns: [], steps: [], sites: [], recipient_count: null };
     if (!TARGET_ACTIONS.has(action))

package/build/tools/org.js

@@ -1,5 +1,4 @@
 import { readPlanUsage, readAllRows } from "@sendinel/domain";
-import { randomBytes } from 'crypto';
 import { z } from 'zod';
 import { logAudit } from '../audit.js';
 import { adminDb, db } from '../db.js';
@@ -174,21 +173,20 @@ export function registerOrgTools(server) {
             idempotentHint: false,
             openWorldHint: false,
         },
-        description: 'Create a team invitation for the current project organization.',
-        inputSchema: { approval_id: z.string().uuid().optional().describe('Get this by calling once without it, then have a human approve the returned approve_url. Re-call with the same arguments plus this approval_id to run the action.'), email: z.string().email(), role: z.enum(['owner', 'admin', 'member']).default('member') },
-    }, withApproval('invite_team_member', async ({ email, role }) => {
-        const { data: project } = await db().from('projects').select('org_id').eq('id', getProjectId()).maybeSingle();
-        if (!project?.org_id)
-            return j({ error: 'Project has no organization', code: 'NO_ORG' });
-        const token = randomBytes(16).toString('hex');
-        const expiresAt = new Date(Date.now() + 7 * 86400000).toISOString();
-        const { data, error } = await db().from('org_invitations')
-            .insert({ org_id: project.org_id, email, role, token, expires_at: expiresAt })
-            .select('id, expires_at')
-            .single();
-        if (error)
-            return j({ error: error.message });
-        return j({ invitation_id: data.id, expires_at: data.expires_at });
+        description: 'Invite a team member by email to the current project organization using the system invitation template. Reuses a matching pending invitation. Always requires human approval; request once, then repeat identical email, role and project_ids with approval_id. Owner invitations are unsupported by the API.',
+        inputSchema: {
+            approval_id: z.string().uuid().optional().describe('Get this by calling once without it, then have a human approve the returned approve_url. Re-call with the same arguments plus this approval_id to run the action.'),
+            email: z.string().email(),
+            role: z.enum(['owner', 'admin', 'member', 'tester']).default('member'),
+            project_ids: z.array(z.string().uuid()).optional().describe('Same-org project IDs. Omit for org-wide access; [] grants no projects. Must match an existing pending invitation.'),
+        },
+    }, withApproval('invite_team_member', async (args) => {
+        const result = await callSendinelV1('/api/v1/org/invitations', { method: 'POST', body: args });
+        if (!result.ok)
+            return j({ error: result.error, status: result.status });
+        const data = result.data;
+        // Preserve the original top-level response fields; add the API's send outcome.
+        return j({ ...data, invitation_id: data.invitation.id, expires_at: data.invitation.expires_at });
     }));
     server.registerTool('remove_team_member', {
         title: 'Remove Team Member',
@@ -443,7 +441,7 @@ export function registerOrgTools(server) {
             idempotentHint: false,
             openWorldHint: false,
         },
-        description: "Extend a pending invitation's expiry and return its invite URL. Does not send an email from the MCP server -- relay invite_url to the invitee directly.",
+        description: "Extend a pending invitation's expiry and return its invite URL. Link-only: sends no email. Use invite_team_member with the same email, role and project_ids to request an approval-gated template email.",
         inputSchema: {
             invitation_id: z.string().uuid(),
             org_id: z.string().uuid().optional(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendinel/mcp-server",
-  "version": "1.0.117",
+  "version": "1.0.118",
   "description": "AI-controlled email operations control plane for campaigns, contacts, segments, analytics, and multi-provider sending via MCP.",
   "mcpName": "ai.sendinel/mcp-server",
   "type": "module",