@sendinel/mcp-server 1.0.117 → 1.0.119

package/build/lib/action-approvals.d.ts

@@ -1,5 +1,11 @@
-/** True when the action name is on the gated or protected list (the default-deny test uses this). */
-export declare function isApprovalGatedAction(action: string): boolean;
+export { isApprovalGatedAction } from './approval-actions.js';
+/**
+ * Action approval tiers:
+ *
+ * Tier 0 (autonomous) — No approval needed. Reads, low-risk writes.
+ * Tier 1 (gated)      — Requires dashboard/Slack approval. Sends to real people, bulk ops.
+ * Tier 2 (protected)  — Requires dashboard approval + typed confirmation. Irreversible data ops.
+ */
 export type ApprovalTier = 'autonomous' | 'gated' | 'protected';
 export declare function getApprovalTier(action: string, params?: Record<string, unknown>): ApprovalTier;
 /**
@@ -58,6 +64,15 @@ export declare function approvalPayloadHash(action: string, params: unknown): st
  * and returns instructions for the agent to wait.
  */
 export declare function requestApproval(action: string, params: Record<string, unknown>, apiKeyId?: string, channelContext?: ChannelExecutionContext, display?: ApprovalDisplay): Promise<ApprovalResult>;
+type AdminApprovalAuthority = {
+    id?: string;
+    action: string;
+    projectId: string;
+    phase: 'preview' | 'approved';
+    decidedBy?: string;
+};
+/** Read by the hosted bridge only; no scope or token is changed. */
+export declare function currentAdminApprovalAuthority(): Readonly<AdminApprovalAuthority> | undefined;
 /**
  * Check if an approval token has been approved.
  * Returns the approval if approved, null if still pending, throws if rejected/expired.
@@ -87,7 +102,7 @@ type ToolResult = {
  */
 export declare function withApproval<A extends object, R extends ToolResult>(action: string, handler: (args: A, extra?: unknown) => Promise<R> | R, options?: {
     display?: (args: A) => Promise<ApprovalDisplay> | ApprovalDisplay;
+    registeredRequestOnly?: boolean;
 }): (args: A & {
     approval_id?: string;
 }, extra?: unknown) => Promise<R | ToolResult>;
-export {};

package/build/lib/action-approvals.js

@@ -1,3 +1,7 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { GATED_ACTIONS, PROTECTED_ACTIONS } from './approval-actions.js';
+export { isApprovalGatedAction } from './approval-actions.js';
+import { isHumanRequestableAdminTool } from './admin-tools.js';
 import { isTesterRequest, isApplyingTesterRequest } from './tester-policy.js';
 import { logTesterRequestAudit } from './tester-request-audit.js';
 import { approvalStore } from './tester-requests-store.js';
@@ -9,97 +13,12 @@ import { captureApprovalSnapshot, withoutApprovalSnapshot } from './approval-sna
 import { fireWebhookEvent } from './webhook-events.js';
 import { offerApprovalApp } from './approval-app.js';
 import { elicitApproval } from './approval-elicitation.js';
-/**
- * Action approval tiers:
- *
- * Tier 0 (autonomous) — No approval needed. Reads, low-risk writes.
- * Tier 1 (gated)      — Requires dashboard/Slack approval. Sends to real people, bulk ops.
- * Tier 2 (protected)  — Requires dashboard approval + typed confirmation. Irreversible data ops.
- */
-const GATED_ACTIONS = new Set([
-    'recheck_domain_dns', // live provider verification may request an EE certificate
-    'draft_agent_reply',
-    'create_agent_mailbox',
-    'launch_campaign', // sends real emails
-    'install_connector_schema', // installs schema into a customer-owned database
-    'install_connector_view', // reinstalls the customer-side snapshot view
-    'set_connector_mapping', // rewrites how customer data maps in
-    'resync_connector', // forces a full resync
-    'publish_dmarc_record', // writes a DNS record into a customer-owned Cloudflare zone
-    'broadcast_to_segment', // creates + activates a real broadcast
-    'send_broadcast', // one-call broadcast; executes a frozen, approved payload (#3669)
-    'activate_campaigns', // turns on a set of campaigns behind one approval (#3669)
-    'rotate_custom_webhook_secret', // immediately invalidates an inbound signing secret
-    'create_campaign_with_content', // can activate + send in one call
-    'enroll_segment', // bulk enrollment
-    'import_subscribers', // bulk data ingestion
-    'subscribe_webhook', // outbound data channel
-    'send_transactional', // sends a real email
-    'update_campaign', // live trigger edits only; the domain rule gates callers
-    'set_campaign_trigger', // changes who starts an active or paused campaign
-    'update_campaign_status', // activation sends real emails (see special case below)
-    'add_list_members', // bulk contact-list membership write
-    'remove_list_members', // bulk contact-list membership write
-    'add_list_members_by_filter', // bulk membership write, unbounded match set
-    'remove_team_member', // revokes workspace access
-    'set_team_member_role', // changes workspace access privileges
-    'delete_provider_credential', // permanently removes or revokes stored provider access
-    // #4005: every outward or destructive tool is approval-gated unless it sits on APPROVAL_EXEMPT
-    // (src/lib/approval-exempt.ts). These are wrapped with withApproval() in their tool files.
-    'send_sms', // texts a real phone number
-    'send_sms_campaign', // can activate an SMS broadcast
-    'send_newsletter_issue', // sends an issue to every subscriber
-    'schedule_newsletter_issue', // queues an issue to every subscriber
-    'reply_to_comment', // queues a public LinkedIn reply
-    'send_awaiting_reply', // sends a real email
-    'send_test_email', // sends a real email to any address
-    'remove_suppression', // re-enables mail to a suppressed address
-    'schedule_social_post', // publishes to a connected social account
-    'invite_team_member', // emails an outside person and grants access
-    'set_member_project_access', // changes workspace access
-    'revoke_invitation', // cancels a pending teammate invitation
-    'create_api_key', // mints new access to the project
-    'revoke_api_key', // breaks every integration using the key
-    'tenant_export_full', // copies all customer data out of Sendinel
-    'enroll_contact', // starts real emails to a contact
-    'identify_subscriber', // may enroll a new signup in sending campaigns
-    'emit_contact_event', // may enroll a real contact in active sending campaigns
-    'enroll_automation', // starts automated messages to a contact
-    'enroll_in_escalation_ladder', // starts email/SMS escalation to a contact
-    'set_contact_sms_consent', // changes the consent record that allows texting
-    'bulk_update_subscribers', // bulk contact data write
-    'update_webhook_subscription', // can redirect event data to a new URL
-    'delete_webhook_subscription', // removes an outbound data channel
-    'delete_campaign', // deletes a campaign and its steps
-    'delete_campaign_step', // deletes an email from a campaign
-    'delete_content_block', // deletes customer content
-    'delete_custom_field', // deletes a field and its values
-    'delete_landing_page', // takes a public page down and deletes it
-    'delete_list', // deletes a contact list
-    'delete_signature', // deletes a saved signature
-    'delete_social_post', // deletes a social post record
-    'delete_subscriber_view', // deletes a saved view
-    'delete_template', // deletes an email template
-    'import_brand_kit_text', // overwrites the brand kit
-    'disconnect_platform', // deletes stored platform credentials
-    'start_provider_switch', // moves a sending domain to another provider
-    'update_landing_page', // publishing makes the page public (see special case below)
-    'create_blog_post', // auto_publish posts to the customer's own site (see special case below)
-    'replay_enrollment_dlq_rows', // confirmed replay sends real emails (see special case below)
-]);
-const PROTECTED_ACTIONS = new Set([
-    'delete_subscriber_data', // GDPR delete — irreversible
-    'merge_subscribers', // data consolidation — irreversible
-    'delete_segment', // affects campaign targeting
-    'identify_inactive', // bulk suppression (when not dry_run)
-    'promote_ab_winner', // deletes losing variants
-    'action_ccpa_request', // CCPA delete completion is irreversible
-]);
-/** True when the action name is on the gated or protected list (the default-deny test uses this). */
-export function isApprovalGatedAction(action) {
-    return GATED_ACTIONS.has(action) || PROTECTED_ACTIONS.has(action);
-}
 export function getApprovalTier(action, params) {
+    // #4308 / #4214: a request-only connection cannot bypass approval via autonomous/preview modes.
+    const scopes = requestContext()?.scopes;
+    if (scopes && !scopes.includes('admin') && !scopes.includes('tester') && !scopes.includes('agent') &&
+        isHumanRequestableAdminTool(action))
+        return PROTECTED_ACTIONS.has(action) ? 'protected' : 'gated';
     if (isTesterRequest(action))
         return isApplyingTesterRequest(action) ? 'autonomous' : 'gated';
     // CRITICAL: Protected actions ALWAYS require approval, even in autonomous mode.
@@ -117,7 +36,7 @@ export function getApprovalTier(action, params) {
     }
     // send_broadcast exists for agents and always needs a person's approval, even in autonomous
     // mode: it must never approve itself (#3669, AI-worker boundary in CLAUDE.md).
-    if (action === 'draft_agent_reply' || action === 'create_agent_mailbox' || action === 'send_broadcast' || action === 'activate_campaigns')
+    if (action === 'draft_agent_reply' || action === 'create_agent_mailbox' || action === 'send_broadcast' || action === 'activate_campaigns' || action === 'invite_team_member')
         return 'gated';
     // Autonomous mode: user explicitly opted out of approval gates for gated actions
     // (request-scoped under HTTP — env is only trustworthy for single-project stdio)
@@ -289,6 +208,10 @@ export function buildApprovalSummary(action, params, display = {}) {
         add_list_members: (p) => `Add ${p.contact_ids?.length ?? 0} contact(s) to list ${p.list_id}`,
         remove_list_members: (p) => `Remove ${p.contact_ids?.length ?? 0} contact(s) from list ${p.list_id}`,
         add_list_members_by_filter: (p) => `Add contacts matching filter rules to list ${p.list_id}`,
+        invite_team_member: (p) => {
+            const invite = p.__approval_snapshot?.invitation;
+            return `Send invitation to ${p.email} as ${p.role}; project_ids: ${JSON.stringify(p.project_ids ?? null)} (null = org-wide, [] = no projects); organization: ${invite?.org_name ?? 'unavailable'} (${invite?.org_id ?? 'unavailable'}); subject: "${invite?.subject ?? 'unavailable'}"`;
+        },
         remove_team_member: (p) => `Remove team member ${p.user_id} from the organization`,
         set_team_member_role: (p) => `Change team member ${p.user_id}'s role to ${p.role}`,
         delete_provider_credential: (p) => `Delete saved ${p.provider ?? 'provider'} credential ${p.credential_id} (${p.source})`,
@@ -338,7 +261,7 @@ export async function requestApproval(action, params, apiKeyId, channelContext,
     const actor = requestContext();
     // Ignore any model-supplied reserved field; freeze facts read by the server.
     const cleanParams = withoutApprovalSnapshot(params);
-    const snapshot = await captureApprovalSnapshot(action, cleanParams, getProjectId());
+    const snapshot = await captureSnapshot(action, cleanParams);
     const payload = cleanParams.payload;
     if (action === 'send_broadcast' && Array.isArray(payload?.contact_ids) && Array.isArray(snapshot.contact_ids) &&
         !approvalParamsEqual({ ids: [...payload.contact_ids].sort() }, { ids: snapshot.contact_ids })) {
@@ -389,11 +312,25 @@ export async function requestApproval(action, params, apiKeyId, channelContext,
         message: `This action requires human approval. A notification has been sent to your dashboard. Approval ID: ${data.id}. Check status with: poll this approval_id, or wait for the webhook callback (event: approval.decided). Token expires in 24 hours.`,
     }, { action, params: frozenParams, summary }, getProjectId());
 }
+const registeredApproval = new AsyncLocalStorage();
+/** Read by the hosted bridge only; no scope or token is changed. */
+export function currentAdminApprovalAuthority() {
+    return registeredApproval.getStore();
+}
+function captureSnapshot(action, params) {
+    if (!isHumanRequestableAdminTool(action))
+        return captureApprovalSnapshot(action, params, getProjectId());
+    return registeredApproval.run({ action, projectId: getProjectId(), phase: 'preview' }, () => captureApprovalSnapshot(action, params, getProjectId()));
+}
 /**
  * Check if an approval token has been approved.
  * Returns the approval if approved, null if still pending, throws if rejected/expired.
  */
 export async function checkApproval(approvalId, options = {}) {
+    const applied = registeredApproval.getStore();
+    if (options.consume && applied?.phase === 'approved' && applied.id === approvalId && applied.action === options.action && applied.projectId === getProjectId()) {
+        return { approved: true, status: 'approved', decided_by: applied.decidedBy };
+    }
     const { data, error } = await approvalStore()
         .from('action_approvals')
         .select('action, status, decided_by, decided_via, expires_at, used_at, params, payload_hash, requested_at')
@@ -425,7 +362,8 @@ export async function checkApproval(approvalId, options = {}) {
     }
     if (data.used_at || data.status === 'used')
         return { approved: false, status: 'consumed' };
-    if (data.status === 'approved' && !isHumanApprovalChannel(data.decided_via)) {
+    if (data.status === 'approved' && (!isHumanApprovalChannel(data.decided_via) ||
+        (isHumanRequestableAdminTool(data.action) && data.decided_via !== 'dashboard'))) {
         return { approved: false, status: 'human_decision_required' };
     }
     if (data.status !== 'approved' || !options.consume) {
@@ -439,7 +377,7 @@ export async function checkApproval(approvalId, options = {}) {
     }
     if (data.params?.__approval_snapshot) {
         try {
-            const current = await captureApprovalSnapshot(data.action, withoutApprovalSnapshot(data.params), getProjectId());
+            const current = await captureSnapshot(data.action, withoutApprovalSnapshot(data.params));
             if (!approvalParamsEqual(current, data.params.__approval_snapshot)) {
                 return { approved: false, status: 'target_changed_after_approval' };
             }
@@ -491,16 +429,21 @@ export function withApproval(action, handler, options = {}) {
         const decision = assertChannelCanExecute(action, params, channelContext);
         if (!decision.allowed)
             return toolText(decision.reason ?? 'This channel cannot request this action.');
-        if (decision.tier !== 'autonomous') {
+        let decidedBy;
+        if (options.registeredRequestOnly || decision.tier !== 'autonomous') {
             if (!approval_id) {
                 const display = options.display ? await options.display(params) : undefined;
                 return toolText(JSON.stringify(await requestApproval(action, params, undefined, channelContext, display), null, 2));
             }
             const check = await checkApproval(approval_id, { consume: true, action, params });
+            decidedBy = check.decided_by;
             if (!check.approved) {
                 return toolText(`Approval ${approval_id} is ${check.status}. ${check.status === 'pending' ? 'Waiting for human approval via dashboard.' : 'Request a new approval.'}`);
             }
         }
+        if (options.registeredRequestOnly) {
+            return registeredApproval.run({ id: approval_id, action, projectId: getProjectId(), phase: 'approved', decidedBy }, () => handler(args, extra));
+        }
         return handler(params, extra);
     };
 }

package/build/lib/admin-tools.d.ts

@@ -0,0 +1,3 @@
+export declare const ADMIN_TOOLS: Set<string>;
+/** #4308 / #4214: request access is derived, never an admin scope grant or a second list. */
+export declare function isHumanRequestableAdminTool(name: string): boolean;

package/build/lib/admin-tools.js

@@ -0,0 +1,31 @@
+import { isApprovalGatedAction } from './approval-actions.js';
+export const ADMIN_TOOLS = new Set([
+    'create_agent_mailbox',
+    // Connector mutations write schema into a customer-owned database and
+    // rewrite how their data maps in (admin, not write: Kevin, 2026-09-11).
+    // NOTE: no apostrophes in comments inside these Sets -- tool-scopes.test.ts
+    // parses the block by matching single-quoted strings.
+    'install_connector_schema', 'install_connector_view', 'set_connector_mapping', 'resync_connector',
+    'delete_subscriber_data', 'list_deletion_log', 'list_ccpa_requests', 'action_ccpa_request',
+    'delete_subscriber_data', 'list_deletion_log', 'list_audit_log', 'get_audit_stats',
+    'unsubscribe_subscriber', 'add_suppression', 'remove_suppression',
+    'create_site', 'update_site',
+    'delete_template', 'register_domain', 'onboard_new_site',
+    'create_api_key', 'revoke_api_key', 'invite_team_member',
+    'connect_platform', 'disconnect_platform', 'configure_platform_trigger',
+    'create_custom_webhook', 'rotate_custom_webhook_secret',
+    'remove_team_member', 'set_team_member_role', 'set_member_project_access',
+    'list_invitations', 'resend_invitation', 'revoke_invitation',
+    'connect_platform', 'disconnect_platform', 'configure_platform_trigger', 'delete_provider_credential',
+    'abuse_monitor_override',
+    'tenant_export_full',
+    'identify_inactive', 'delete_segment',
+    'delete_signature',
+    'merge_subscribers', 'delete_webhook_subscription',
+    'set_white_label_settings', 'add_white_label_domain',
+    'post_ticket_reply',
+]);
+/** #4308 / #4214: request access is derived, never an admin scope grant or a second list. */
+export function isHumanRequestableAdminTool(name) {
+    return ADMIN_TOOLS.has(name) && isApprovalGatedAction(name);
+}

package/build/lib/approval-actions.d.ts

@@ -0,0 +1,4 @@
+export declare const GATED_ACTIONS: Set<string>;
+export declare const PROTECTED_ACTIONS: Set<string>;
+/** True when the action name is on the gated or protected list (the default-deny test uses this). */
+export declare function isApprovalGatedAction(action: string): boolean;

package/build/lib/approval-actions.js

@@ -0,0 +1,83 @@
+export const GATED_ACTIONS = new Set([
+    'recheck_domain_dns', // live provider verification may request an EE certificate
+    'draft_agent_reply',
+    'create_agent_mailbox',
+    'launch_campaign', // sends real emails
+    'install_connector_schema', // installs schema into a customer-owned database
+    'install_connector_view', // reinstalls the customer-side snapshot view
+    'set_connector_mapping', // rewrites how customer data maps in
+    'resync_connector', // forces a full resync
+    'publish_dmarc_record', // writes a DNS record into a customer-owned Cloudflare zone
+    'broadcast_to_segment', // creates + activates a real broadcast
+    'send_broadcast', // one-call broadcast; executes a frozen, approved payload (#3669)
+    'activate_campaigns', // turns on a set of campaigns behind one approval (#3669)
+    'rotate_custom_webhook_secret', // immediately invalidates an inbound signing secret
+    'create_campaign_with_content', // can activate + send in one call
+    'enroll_segment', // bulk enrollment
+    'import_subscribers', // bulk data ingestion
+    'subscribe_webhook', // outbound data channel
+    'send_transactional', // sends a real email
+    'update_campaign', // live trigger edits only; the domain rule gates callers
+    'set_campaign_trigger', // changes who starts an active or paused campaign
+    'update_campaign_status', // activation sends real emails (see special case below)
+    'add_list_members', // bulk contact-list membership write
+    'remove_list_members', // bulk contact-list membership write
+    'add_list_members_by_filter', // bulk membership write, unbounded match set
+    'remove_team_member', // revokes workspace access
+    'set_team_member_role', // changes workspace access privileges
+    'delete_provider_credential', // permanently removes or revokes stored provider access
+    // #4005: every outward or destructive tool is approval-gated unless it sits on APPROVAL_EXEMPT
+    // (src/lib/approval-exempt.ts). These are wrapped with withApproval() in their tool files.
+    'send_sms', // texts a real phone number
+    'send_sms_campaign', // can activate an SMS broadcast
+    'send_newsletter_issue', // sends an issue to every subscriber
+    'schedule_newsletter_issue', // queues an issue to every subscriber
+    'reply_to_comment', // queues a public LinkedIn reply
+    'send_awaiting_reply', // sends a real email
+    'send_test_email', // sends a real email to any address
+    'remove_suppression', // re-enables mail to a suppressed address
+    'schedule_social_post', // publishes to a connected social account
+    'invite_team_member', // emails an outside person and grants access
+    'set_member_project_access', // changes workspace access
+    'revoke_invitation', // cancels a pending teammate invitation
+    'create_api_key', // mints new access to the project
+    'revoke_api_key', // breaks every integration using the key
+    'tenant_export_full', // copies all customer data out of Sendinel
+    'enroll_contact', // starts real emails to a contact
+    'identify_subscriber', // may enroll a new signup in sending campaigns
+    'emit_contact_event', // may enroll a real contact in active sending campaigns
+    'enroll_automation', // starts automated messages to a contact
+    'enroll_in_escalation_ladder', // starts email/SMS escalation to a contact
+    'set_contact_sms_consent', // changes the consent record that allows texting
+    'bulk_update_subscribers', // bulk contact data write
+    'update_webhook_subscription', // can redirect event data to a new URL
+    'delete_webhook_subscription', // removes an outbound data channel
+    'delete_campaign', // deletes a campaign and its steps
+    'delete_campaign_step', // deletes an email from a campaign
+    'delete_content_block', // deletes customer content
+    'delete_custom_field', // deletes a field and its values
+    'delete_landing_page', // takes a public page down and deletes it
+    'delete_list', // deletes a contact list
+    'delete_signature', // deletes a saved signature
+    'delete_social_post', // deletes a social post record
+    'delete_subscriber_view', // deletes a saved view
+    'delete_template', // deletes an email template
+    'import_brand_kit_text', // overwrites the brand kit
+    'disconnect_platform', // deletes stored platform credentials
+    'start_provider_switch', // moves a sending domain to another provider
+    'update_landing_page', // publishing makes the page public (see special case below)
+    'create_blog_post', // auto_publish posts to the customer's own site (see special case below)
+    'replay_enrollment_dlq_rows', // confirmed replay sends real emails (see special case below)
+]);
+export const PROTECTED_ACTIONS = new Set([
+    'delete_subscriber_data', // GDPR delete — irreversible
+    'merge_subscribers', // data consolidation — irreversible
+    'delete_segment', // affects campaign targeting
+    'identify_inactive', // bulk suppression (when not dry_run)
+    'promote_ab_winner', // deletes losing variants
+    'action_ccpa_request', // CCPA delete completion is irreversible
+]);
+/** True when the action name is on the gated or protected list (the default-deny test uses this). */
+export function isApprovalGatedAction(action) {
+    return GATED_ACTIONS.has(action) || PROTECTED_ACTIONS.has(action);
+}

package/build/lib/approval-app.js

@@ -1,3 +1,4 @@
+import { isHumanRequestableAdminTool } from './admin-tools.js';
 import { randomBytes } from 'node:crypto';
 import { buildApprovalPreview } from '@sendinel/domain';
 import { APPROVAL_APP, APPROVAL_APP_SESSION_META } from './approval-app-conventions.js';
@@ -65,6 +66,8 @@ function live(approval) {
  */
 export async function offerApprovalApp(approval) {
     const runtime = calls.getStore(), actor = identity();
+    if (isHumanRequestableAdminTool(approval.action))
+        return {};
     if (!runtime || !runtime.canDecide || !actor || !approvalAppEnabled() || approval.tier === 'protected' || !live(approval))
         return {};
     if (await resolveApprovalChannel(runtime.server.server) !== 'mcp_app')
@@ -92,7 +95,7 @@ export function installApprovalApp(server, options = {}, approvalTool = () => fa
             if (!bound.canDecide || !actor || !approvalAppEnabled() || await resolveApprovalChannel(server.server) !== 'mcp_app')
                 throw unavailable();
             const approval = await loadOwnedPendingApproval(id, actor);
-            if (!approval)
+            if (!approval || isHumanRequestableAdminTool(approval.action))
                 throw unavailable();
             // One outstanding render session per approval. Re-render invalidates the old view.
             const token = await mintApprovalAppSession(approval, actor);
@@ -121,7 +124,7 @@ export function installApprovalApp(server, options = {}, approvalTool = () => fa
                     return refused();
                 const approval = await loadOwnedPendingApproval(approval_id, actor);
                 // Single guarded claim before the callback, so concurrent clicks cannot reuse a session.
-                if (!approval || !await claimApprovalAppSession(app_session, approval, actor))
+                if (!approval || isHumanRequestableAdminTool(approval.action) || !await claimApprovalAppSession(app_session, approval, actor))
                     return refused();
                 const connectionId = `oauth:${actor.oauthTokenId}`;
                 const callback = createHumanApprovalCallback({ approvalId: approval.id, projectId: actor.projectId,

package/build/lib/approval-elicitation.js

@@ -1,3 +1,4 @@
+import { isHumanRequestableAdminTool } from './admin-tools.js';
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { randomUUID } from 'node:crypto';
 import { buildApprovalPreview, isHumanApprovalChannel } from '@sendinel/domain';
@@ -23,6 +24,8 @@ export function runWithApprovalElicitation(server, extra, run) {
 /** All outcomes retain the ordinary approval link/text. Approval never applies the action. */
 export async function elicitApproval(result, frozen, projectId) {
     const pending = { ...result, decision_status: 'decision_pending' };
+    if (isHumanRequestableAdminTool(frozen.action))
+        return pending;
     const context = requests.getStore();
     if (!context || context.projectId !== projectId || result.tier !== 'gated')
         return pending;

package/build/lib/approval-human-callback.js

@@ -1,3 +1,4 @@
+import { isHumanRequestableAdminTool } from './admin-tools.js';
 import { randomUUID } from 'node:crypto';
 import { approvalStore } from './tester-requests-store.js';
 /**
@@ -18,11 +19,16 @@ export function createHumanApprovalCallback(binding) {
             completed = true;
             const source = approvalStore();
             const client = typeof source.schema === 'function' ? source.schema('email') : source;
+            // #4308 / #4214: admin requests can only be decided in a human dashboard session.
+            const { data: approval, error: loadError } = await client.from('action_approvals')
+                .select('action').eq('id', binding.approvalId).eq('project_id', binding.projectId).maybeSingle();
+            if (loadError || typeof approval?.action !== 'string' || !approval.action || isHumanRequestableAdminTool(approval.action))
+                return false;
             const now = new Date().toISOString();
             const { data, error } = await client.from('action_approvals')
                 .update({ status: response.decision === 'approve' ? 'approved' : 'rejected', decided_via: binding.channel,
                 decided_by: binding.userId, decided_at: now })
-                .eq('id', binding.approvalId).eq('project_id', binding.projectId)
+                .eq('id', binding.approvalId).eq('project_id', binding.projectId).eq('action', approval.action)
                 .eq('status', 'pending').is('used_at', null).gt('expires_at', now)
                 .select('id, payload_hash').maybeSingle();
             if (error || !data)

package/build/lib/approval-snapshot.js

@@ -1,6 +1,7 @@
 import { isTesterRequest } from './tester-policy.js';
 import { captureTesterRequestSnapshot } from './tester-request-snapshot.js';
 import { readAllRows, chunkIds, scopeSegmentRulesToSite } from '@sendinel/domain';
+import { callSendinelV1 } from './v1-client.js';
 import { db } from '../db.js';
 import { resolveSendAudience, resolveSegmentContactIds } from './send-audience.js';
 const TARGET_ACTIONS = new Set(['send_broadcast', 'broadcast_to_segment', 'launch_campaign', 'activate_campaigns',
@@ -8,6 +9,14 @@ const TARGET_ACTIONS = new Set(['send_broadcast', 'broadcast_to_segment', 'launc
     'send_transactional', 'send_awaiting_reply', 'send_test_email', 'send_newsletter_issue', 'schedule_newsletter_issue']);
 /** Server-owned display facts, saved inside the hash-bound params. Never supplied by a tool. */
 export async function captureApprovalSnapshot(action, params, projectId) {
+    if (action === 'invite_team_member') {
+        const result = await callSendinelV1('/api/v1/org/invitations', { method: 'POST', body: { ...params, preview_only: true } });
+        const preview = result.ok ? result.data.preview : null;
+        if (!preview || typeof preview.org_id !== 'string' || typeof preview.org_name !== 'string' || typeof preview.subject !== 'string') {
+            throw new Error('Invitation approval preview unavailable; no email was sent.');
+        }
+        return { version: 1, invitation: preview, recipient_count: 1 };
+    }
     const setup = isTesterRequest(action) ? await captureTesterRequestSnapshot(action, params, projectId) : null;
     const snapshot = { version: 1, campaigns: [], steps: [], sites: [], recipient_count: null };
     if (!TARGET_ACTIONS.has(action))

package/build/server.js

@@ -5,7 +5,8 @@ import { runWithToolContext } from './db.js';
 import { TESTER_REQUEST_TOOLS } from './lib/tester-policy.js';
 import { testerRequestTool } from './lib/tester-requests.js';
 export { TESTER_REQUEST_TOOLS } from './lib/tester-policy.js';
-import { isApprovalGatedAction } from './lib/action-approvals.js';
+import { ADMIN_TOOLS, isHumanRequestableAdminTool } from './lib/admin-tools.js';
+import { withApproval, isApprovalGatedAction } from './lib/action-approvals.js';
 import { registerAgentMailboxTools } from './tools/agent-mailboxes.js';
 import { registerAnalyticsTools } from './tools/analytics.js';
 import { registerCampaignTools } from './tools/campaigns.js';
@@ -149,32 +150,6 @@ const WRITE_TOOLS = new Set([
     'commit_staged_import', 'discard_staged_import', 'add_synced_folder', 'remove_synced_folder',
     'retry_send_queue_rows', 'cancel_send_queue_rows', 'add_blackout_date', 'remove_blackout_date',
 ]);
-const ADMIN_TOOLS = new Set([
-    'create_agent_mailbox',
-    // Connector mutations write schema into a customer-owned database and
-    // rewrite how their data maps in (admin, not write: Kevin, 2026-09-11).
-    // NOTE: no apostrophes in comments inside these Sets -- tool-scopes.test.ts
-    // parses the block by matching single-quoted strings.
-    'install_connector_schema', 'install_connector_view', 'set_connector_mapping', 'resync_connector',
-    'delete_subscriber_data', 'list_deletion_log', 'list_ccpa_requests', 'action_ccpa_request',
-    'delete_subscriber_data', 'list_deletion_log', 'list_audit_log', 'get_audit_stats',
-    'unsubscribe_subscriber', 'add_suppression', 'remove_suppression',
-    'create_site', 'update_site',
-    'delete_template', 'register_domain', 'onboard_new_site',
-    'create_api_key', 'revoke_api_key', 'invite_team_member',
-    'connect_platform', 'disconnect_platform', 'configure_platform_trigger',
-    'create_custom_webhook', 'rotate_custom_webhook_secret',
-    'remove_team_member', 'set_team_member_role', 'set_member_project_access',
-    'list_invitations', 'resend_invitation', 'revoke_invitation',
-    'connect_platform', 'disconnect_platform', 'configure_platform_trigger', 'delete_provider_credential',
-    'abuse_monitor_override',
-    'tenant_export_full',
-    'identify_inactive', 'delete_segment',
-    'delete_signature',
-    'merge_subscribers', 'delete_webhook_subscription',
-    'set_white_label_settings', 'add_white_label_domain',
-    'post_ticket_reply',
-]);
 const SCOPE_HIERARCHY = { read: 1, write: 2, admin: 3 };
 export function getRequiredScope(name) {
     if (ADMIN_TOOLS.has(name))
@@ -348,7 +323,7 @@ function createScopeProxy(server, scopes, toolGroup, allowedTools) {
                         const agent = isAgentConnection(scopes);
                         const allowed = () => agent ? agentConnectionAllowsTool(name) : tester
                             ? testerConnectionAllowsTool(name)
-                            : scopeAllows(scopes, required);
+                            : scopeAllows(scopes, required) || (scopeAllows(scopes, 'read') && isHumanRequestableAdminTool(name));
                         if (!allowed()) {
                             // Don't register tools the key can't access — they won't appear in tool list
                             return;
@@ -358,6 +333,10 @@ function createScopeProxy(server, scopes, toolGroup, allowedTools) {
                             config = wrapped.config;
                             handler = wrapped.handler;
                         }
+                        if (!tester && !agent && !scopeAllows(scopes, 'admin') && isHumanRequestableAdminTool(name)) {
+                            config = { ...config, description: `${config.description ?? ''} Request-only: needs a human org admin to approve.` };
+                            handler = withApproval(name, handler, { registeredRequestOnly: true });
+                        }
                         // Wrap handler with runtime scope check (defense in depth)
                         const guardedHandler = (...args) => {
                             if (!allowed()) {

package/build/tools/org.js

@@ -1,5 +1,4 @@
 import { readPlanUsage, readAllRows } from "@sendinel/domain";
-import { randomBytes } from 'crypto';
 import { z } from 'zod';
 import { logAudit } from '../audit.js';
 import { adminDb, db } from '../db.js';
@@ -174,21 +173,20 @@ export function registerOrgTools(server) {
             idempotentHint: false,
             openWorldHint: false,
         },
-        description: 'Create a team invitation for the current project organization.',
-        inputSchema: { approval_id: z.string().uuid().optional().describe('Get this by calling once without it, then have a human approve the returned approve_url. Re-call with the same arguments plus this approval_id to run the action.'), email: z.string().email(), role: z.enum(['owner', 'admin', 'member']).default('member') },
-    }, withApproval('invite_team_member', async ({ email, role }) => {
-        const { data: project } = await db().from('projects').select('org_id').eq('id', getProjectId()).maybeSingle();
-        if (!project?.org_id)
-            return j({ error: 'Project has no organization', code: 'NO_ORG' });
-        const token = randomBytes(16).toString('hex');
-        const expiresAt = new Date(Date.now() + 7 * 86400000).toISOString();
-        const { data, error } = await db().from('org_invitations')
-            .insert({ org_id: project.org_id, email, role, token, expires_at: expiresAt })
-            .select('id, expires_at')
-            .single();
-        if (error)
-            return j({ error: error.message });
-        return j({ invitation_id: data.id, expires_at: data.expires_at });
+        description: 'Invite a team member by email to the current project organization using the system invitation template. Reuses a matching pending invitation. Always requires human approval; request once, then repeat identical email, role and project_ids with approval_id. Owner invitations are unsupported by the API.',
+        inputSchema: {
+            approval_id: z.string().uuid().optional().describe('Get this by calling once without it, then have a human approve the returned approve_url. Re-call with the same arguments plus this approval_id to run the action.'),
+            email: z.string().email(),
+            role: z.enum(['owner', 'admin', 'member', 'tester']).default('member'),
+            project_ids: z.array(z.string().uuid()).optional().describe('Same-org project IDs. Omit for org-wide access; [] grants no projects. Must match an existing pending invitation.'),
+        },
+    }, withApproval('invite_team_member', async (args) => {
+        const result = await callSendinelV1('/api/v1/org/invitations', { method: 'POST', body: args });
+        if (!result.ok)
+            return j({ error: result.error, status: result.status });
+        const data = result.data;
+        // Preserve the original top-level response fields; add the API's send outcome.
+        return j({ ...data, invitation_id: data.invitation.id, expires_at: data.invitation.expires_at });
     }));
     server.registerTool('remove_team_member', {
         title: 'Remove Team Member',
@@ -443,7 +441,7 @@ export function registerOrgTools(server) {
             idempotentHint: false,
             openWorldHint: false,
         },
-        description: "Extend a pending invitation's expiry and return its invite URL. Does not send an email from the MCP server -- relay invite_url to the invitee directly.",
+        description: "Extend a pending invitation's expiry and return its invite URL. Link-only: sends no email. Use invite_team_member with the same email, role and project_ids to request an approval-gated template email.",
         inputSchema: {
             invitation_id: z.string().uuid(),
             org_id: z.string().uuid().optional(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendinel/mcp-server",
-  "version": "1.0.117",
+  "version": "1.0.119",
   "description": "AI-controlled email operations control plane for campaigns, contacts, segments, analytics, and multi-provider sending via MCP.",
   "mcpName": "ai.sendinel/mcp-server",
   "type": "module",