@sendinel/mcp-server 1.0.118 → 1.0.120

package/build/lib/action-approvals.d.ts

@@ -1,5 +1,11 @@
-/** True when the action name is on the gated or protected list (the default-deny test uses this). */
-export declare function isApprovalGatedAction(action: string): boolean;
+export { isApprovalGatedAction } from './approval-actions.js';
+/**
+ * Action approval tiers:
+ *
+ * Tier 0 (autonomous) — No approval needed. Reads, low-risk writes.
+ * Tier 1 (gated)      — Requires dashboard/Slack approval. Sends to real people, bulk ops.
+ * Tier 2 (protected)  — Requires dashboard approval + typed confirmation. Irreversible data ops.
+ */
 export type ApprovalTier = 'autonomous' | 'gated' | 'protected';
 export declare function getApprovalTier(action: string, params?: Record<string, unknown>): ApprovalTier;
 /**
@@ -58,6 +64,15 @@ export declare function approvalPayloadHash(action: string, params: unknown): st
  * and returns instructions for the agent to wait.
  */
 export declare function requestApproval(action: string, params: Record<string, unknown>, apiKeyId?: string, channelContext?: ChannelExecutionContext, display?: ApprovalDisplay): Promise<ApprovalResult>;
+type AdminApprovalAuthority = {
+    id?: string;
+    action: string;
+    projectId: string;
+    phase: 'preview' | 'approved';
+    decidedBy?: string;
+};
+/** Read by the hosted bridge only; no scope or token is changed. */
+export declare function currentAdminApprovalAuthority(): Readonly<AdminApprovalAuthority> | undefined;
 /**
  * Check if an approval token has been approved.
  * Returns the approval if approved, null if still pending, throws if rejected/expired.
@@ -87,7 +102,7 @@ type ToolResult = {
  */
 export declare function withApproval<A extends object, R extends ToolResult>(action: string, handler: (args: A, extra?: unknown) => Promise<R> | R, options?: {
     display?: (args: A) => Promise<ApprovalDisplay> | ApprovalDisplay;
+    registeredRequestOnly?: boolean;
 }): (args: A & {
     approval_id?: string;
 }, extra?: unknown) => Promise<R | ToolResult>;
-export {};

package/build/lib/action-approvals.js

@@ -1,3 +1,8 @@
+import { humanApprovalEligible } from './approval-human-eligibility.js';
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { GATED_ACTIONS, PROTECTED_ACTIONS } from './approval-actions.js';
+export { isApprovalGatedAction } from './approval-actions.js';
+import { isHumanRequestableAdminTool } from './admin-tools.js';
 import { isTesterRequest, isApplyingTesterRequest } from './tester-policy.js';
 import { logTesterRequestAudit } from './tester-request-audit.js';
 import { approvalStore } from './tester-requests-store.js';
@@ -9,97 +14,12 @@ import { captureApprovalSnapshot, withoutApprovalSnapshot } from './approval-sna
 import { fireWebhookEvent } from './webhook-events.js';
 import { offerApprovalApp } from './approval-app.js';
 import { elicitApproval } from './approval-elicitation.js';
-/**
- * Action approval tiers:
- *
- * Tier 0 (autonomous) — No approval needed. Reads, low-risk writes.
- * Tier 1 (gated)      — Requires dashboard/Slack approval. Sends to real people, bulk ops.
- * Tier 2 (protected)  — Requires dashboard approval + typed confirmation. Irreversible data ops.
- */
-const GATED_ACTIONS = new Set([
-    'recheck_domain_dns', // live provider verification may request an EE certificate
-    'draft_agent_reply',
-    'create_agent_mailbox',
-    'launch_campaign', // sends real emails
-    'install_connector_schema', // installs schema into a customer-owned database
-    'install_connector_view', // reinstalls the customer-side snapshot view
-    'set_connector_mapping', // rewrites how customer data maps in
-    'resync_connector', // forces a full resync
-    'publish_dmarc_record', // writes a DNS record into a customer-owned Cloudflare zone
-    'broadcast_to_segment', // creates + activates a real broadcast
-    'send_broadcast', // one-call broadcast; executes a frozen, approved payload (#3669)
-    'activate_campaigns', // turns on a set of campaigns behind one approval (#3669)
-    'rotate_custom_webhook_secret', // immediately invalidates an inbound signing secret
-    'create_campaign_with_content', // can activate + send in one call
-    'enroll_segment', // bulk enrollment
-    'import_subscribers', // bulk data ingestion
-    'subscribe_webhook', // outbound data channel
-    'send_transactional', // sends a real email
-    'update_campaign', // live trigger edits only; the domain rule gates callers
-    'set_campaign_trigger', // changes who starts an active or paused campaign
-    'update_campaign_status', // activation sends real emails (see special case below)
-    'add_list_members', // bulk contact-list membership write
-    'remove_list_members', // bulk contact-list membership write
-    'add_list_members_by_filter', // bulk membership write, unbounded match set
-    'remove_team_member', // revokes workspace access
-    'set_team_member_role', // changes workspace access privileges
-    'delete_provider_credential', // permanently removes or revokes stored provider access
-    // #4005: every outward or destructive tool is approval-gated unless it sits on APPROVAL_EXEMPT
-    // (src/lib/approval-exempt.ts). These are wrapped with withApproval() in their tool files.
-    'send_sms', // texts a real phone number
-    'send_sms_campaign', // can activate an SMS broadcast
-    'send_newsletter_issue', // sends an issue to every subscriber
-    'schedule_newsletter_issue', // queues an issue to every subscriber
-    'reply_to_comment', // queues a public LinkedIn reply
-    'send_awaiting_reply', // sends a real email
-    'send_test_email', // sends a real email to any address
-    'remove_suppression', // re-enables mail to a suppressed address
-    'schedule_social_post', // publishes to a connected social account
-    'invite_team_member', // emails an outside person and grants access
-    'set_member_project_access', // changes workspace access
-    'revoke_invitation', // cancels a pending teammate invitation
-    'create_api_key', // mints new access to the project
-    'revoke_api_key', // breaks every integration using the key
-    'tenant_export_full', // copies all customer data out of Sendinel
-    'enroll_contact', // starts real emails to a contact
-    'identify_subscriber', // may enroll a new signup in sending campaigns
-    'emit_contact_event', // may enroll a real contact in active sending campaigns
-    'enroll_automation', // starts automated messages to a contact
-    'enroll_in_escalation_ladder', // starts email/SMS escalation to a contact
-    'set_contact_sms_consent', // changes the consent record that allows texting
-    'bulk_update_subscribers', // bulk contact data write
-    'update_webhook_subscription', // can redirect event data to a new URL
-    'delete_webhook_subscription', // removes an outbound data channel
-    'delete_campaign', // deletes a campaign and its steps
-    'delete_campaign_step', // deletes an email from a campaign
-    'delete_content_block', // deletes customer content
-    'delete_custom_field', // deletes a field and its values
-    'delete_landing_page', // takes a public page down and deletes it
-    'delete_list', // deletes a contact list
-    'delete_signature', // deletes a saved signature
-    'delete_social_post', // deletes a social post record
-    'delete_subscriber_view', // deletes a saved view
-    'delete_template', // deletes an email template
-    'import_brand_kit_text', // overwrites the brand kit
-    'disconnect_platform', // deletes stored platform credentials
-    'start_provider_switch', // moves a sending domain to another provider
-    'update_landing_page', // publishing makes the page public (see special case below)
-    'create_blog_post', // auto_publish posts to the customer's own site (see special case below)
-    'replay_enrollment_dlq_rows', // confirmed replay sends real emails (see special case below)
-]);
-const PROTECTED_ACTIONS = new Set([
-    'delete_subscriber_data', // GDPR delete — irreversible
-    'merge_subscribers', // data consolidation — irreversible
-    'delete_segment', // affects campaign targeting
-    'identify_inactive', // bulk suppression (when not dry_run)
-    'promote_ab_winner', // deletes losing variants
-    'action_ccpa_request', // CCPA delete completion is irreversible
-]);
-/** True when the action name is on the gated or protected list (the default-deny test uses this). */
-export function isApprovalGatedAction(action) {
-    return GATED_ACTIONS.has(action) || PROTECTED_ACTIONS.has(action);
-}
 export function getApprovalTier(action, params) {
+    // #4308 / #4214: a request-only connection cannot bypass approval via autonomous/preview modes.
+    const scopes = requestContext()?.scopes;
+    if (scopes && !scopes.includes('admin') && !scopes.includes('tester') && !scopes.includes('agent') &&
+        isHumanRequestableAdminTool(action))
+        return PROTECTED_ACTIONS.has(action) ? 'protected' : 'gated';
     if (isTesterRequest(action))
         return isApplyingTesterRequest(action) ? 'autonomous' : 'gated';
     // CRITICAL: Protected actions ALWAYS require approval, even in autonomous mode.
@@ -342,7 +262,7 @@ export async function requestApproval(action, params, apiKeyId, channelContext,
     const actor = requestContext();
     // Ignore any model-supplied reserved field; freeze facts read by the server.
     const cleanParams = withoutApprovalSnapshot(params);
-    const snapshot = await captureApprovalSnapshot(action, cleanParams, getProjectId());
+    const snapshot = await captureSnapshot(action, cleanParams);
     const payload = cleanParams.payload;
     if (action === 'send_broadcast' && Array.isArray(payload?.contact_ids) && Array.isArray(snapshot.contact_ids) &&
         !approvalParamsEqual({ ids: [...payload.contact_ids].sort() }, { ids: snapshot.contact_ids })) {
@@ -393,11 +313,25 @@ export async function requestApproval(action, params, apiKeyId, channelContext,
         message: `This action requires human approval. A notification has been sent to your dashboard. Approval ID: ${data.id}. Check status with: poll this approval_id, or wait for the webhook callback (event: approval.decided). Token expires in 24 hours.`,
     }, { action, params: frozenParams, summary }, getProjectId());
 }
+const registeredApproval = new AsyncLocalStorage();
+/** Read by the hosted bridge only; no scope or token is changed. */
+export function currentAdminApprovalAuthority() {
+    return registeredApproval.getStore();
+}
+function captureSnapshot(action, params) {
+    if (!isHumanRequestableAdminTool(action))
+        return captureApprovalSnapshot(action, params, getProjectId());
+    return registeredApproval.run({ action, projectId: getProjectId(), phase: 'preview' }, () => captureApprovalSnapshot(action, params, getProjectId()));
+}
 /**
  * Check if an approval token has been approved.
  * Returns the approval if approved, null if still pending, throws if rejected/expired.
  */
 export async function checkApproval(approvalId, options = {}) {
+    const applied = registeredApproval.getStore();
+    if (options.consume && applied?.phase === 'approved' && applied.id === approvalId && applied.action === options.action && applied.projectId === getProjectId()) {
+        return { approved: true, status: 'approved', decided_by: applied.decidedBy };
+    }
     const { data, error } = await approvalStore()
         .from('action_approvals')
         .select('action, status, decided_by, decided_via, expires_at, used_at, params, payload_hash, requested_at')
@@ -429,7 +363,11 @@ export async function checkApproval(approvalId, options = {}) {
     }
     if (data.used_at || data.status === 'used')
         return { approved: false, status: 'consumed' };
-    if (data.status === 'approved' && !isHumanApprovalChannel(data.decided_via)) {
+    if (data.status === 'approved' && (!isHumanApprovalChannel(data.decided_via) ||
+        (isHumanRequestableAdminTool(data.action) && data.decided_via !== 'dashboard' &&
+            (!['mcp_app', 'mcp_elicitation'].includes(data.decided_via) ||
+                !await humanApprovalEligible(data.action, getProjectId(), { projectId: getProjectId(),
+                    actorId: data.decided_by, oauthTokenId: data.oauth_token_id, authKind: 'oauth', channelVerified: true }))))) {
         return { approved: false, status: 'human_decision_required' };
     }
     if (data.status !== 'approved' || !options.consume) {
@@ -443,7 +381,7 @@ export async function checkApproval(approvalId, options = {}) {
     }
     if (data.params?.__approval_snapshot) {
         try {
-            const current = await captureApprovalSnapshot(data.action, withoutApprovalSnapshot(data.params), getProjectId());
+            const current = await captureSnapshot(data.action, withoutApprovalSnapshot(data.params));
             if (!approvalParamsEqual(current, data.params.__approval_snapshot)) {
                 return { approved: false, status: 'target_changed_after_approval' };
             }
@@ -495,16 +433,21 @@ export function withApproval(action, handler, options = {}) {
         const decision = assertChannelCanExecute(action, params, channelContext);
         if (!decision.allowed)
             return toolText(decision.reason ?? 'This channel cannot request this action.');
-        if (decision.tier !== 'autonomous') {
+        let decidedBy;
+        if (options.registeredRequestOnly || decision.tier !== 'autonomous') {
             if (!approval_id) {
                 const display = options.display ? await options.display(params) : undefined;
                 return toolText(JSON.stringify(await requestApproval(action, params, undefined, channelContext, display), null, 2));
             }
             const check = await checkApproval(approval_id, { consume: true, action, params });
+            decidedBy = check.decided_by;
             if (!check.approved) {
                 return toolText(`Approval ${approval_id} is ${check.status}. ${check.status === 'pending' ? 'Waiting for human approval via dashboard.' : 'Request a new approval.'}`);
             }
         }
+        if (options.registeredRequestOnly) {
+            return registeredApproval.run({ id: approval_id, action, projectId: getProjectId(), phase: 'approved', decidedBy }, () => handler(args, extra));
+        }
         return handler(params, extra);
     };
 }

package/build/lib/admin-tools.d.ts

@@ -0,0 +1,3 @@
+export declare const ADMIN_TOOLS: Set<string>;
+/** #4308 / #4214: request access is derived, never an admin scope grant or a second list. */
+export declare function isHumanRequestableAdminTool(name: string): boolean;

package/build/lib/admin-tools.js

@@ -0,0 +1,31 @@
+import { isApprovalGatedAction } from './approval-actions.js';
+export const ADMIN_TOOLS = new Set([
+    'create_agent_mailbox',
+    // Connector mutations write schema into a customer-owned database and
+    // rewrite how their data maps in (admin, not write: Kevin, 2026-09-11).
+    // NOTE: no apostrophes in comments inside these Sets -- tool-scopes.test.ts
+    // parses the block by matching single-quoted strings.
+    'install_connector_schema', 'install_connector_view', 'set_connector_mapping', 'resync_connector',
+    'delete_subscriber_data', 'list_deletion_log', 'list_ccpa_requests', 'action_ccpa_request',
+    'delete_subscriber_data', 'list_deletion_log', 'list_audit_log', 'get_audit_stats',
+    'unsubscribe_subscriber', 'add_suppression', 'remove_suppression',
+    'create_site', 'update_site',
+    'delete_template', 'register_domain', 'onboard_new_site',
+    'create_api_key', 'revoke_api_key', 'invite_team_member',
+    'connect_platform', 'disconnect_platform', 'configure_platform_trigger',
+    'create_custom_webhook', 'rotate_custom_webhook_secret',
+    'remove_team_member', 'set_team_member_role', 'set_member_project_access',
+    'list_invitations', 'resend_invitation', 'revoke_invitation',
+    'connect_platform', 'disconnect_platform', 'configure_platform_trigger', 'delete_provider_credential',
+    'abuse_monitor_override',
+    'tenant_export_full',
+    'identify_inactive', 'delete_segment',
+    'delete_signature',
+    'merge_subscribers', 'delete_webhook_subscription',
+    'set_white_label_settings', 'add_white_label_domain',
+    'post_ticket_reply',
+]);
+/** #4308 / #4214: request access is derived, never an admin scope grant or a second list. */
+export function isHumanRequestableAdminTool(name) {
+    return ADMIN_TOOLS.has(name) && isApprovalGatedAction(name);
+}

package/build/lib/approval-actions.d.ts

@@ -0,0 +1,4 @@
+export declare const GATED_ACTIONS: Set<string>;
+export declare const PROTECTED_ACTIONS: Set<string>;
+/** True when the action name is on the gated or protected list (the default-deny test uses this). */
+export declare function isApprovalGatedAction(action: string): boolean;

package/build/lib/approval-actions.js

@@ -0,0 +1,83 @@
+export const GATED_ACTIONS = new Set([
+    'recheck_domain_dns', // live provider verification may request an EE certificate
+    'draft_agent_reply',
+    'create_agent_mailbox',
+    'launch_campaign', // sends real emails
+    'install_connector_schema', // installs schema into a customer-owned database
+    'install_connector_view', // reinstalls the customer-side snapshot view
+    'set_connector_mapping', // rewrites how customer data maps in
+    'resync_connector', // forces a full resync
+    'publish_dmarc_record', // writes a DNS record into a customer-owned Cloudflare zone
+    'broadcast_to_segment', // creates + activates a real broadcast
+    'send_broadcast', // one-call broadcast; executes a frozen, approved payload (#3669)
+    'activate_campaigns', // turns on a set of campaigns behind one approval (#3669)
+    'rotate_custom_webhook_secret', // immediately invalidates an inbound signing secret
+    'create_campaign_with_content', // can activate + send in one call
+    'enroll_segment', // bulk enrollment
+    'import_subscribers', // bulk data ingestion
+    'subscribe_webhook', // outbound data channel
+    'send_transactional', // sends a real email
+    'update_campaign', // live trigger edits only; the domain rule gates callers
+    'set_campaign_trigger', // changes who starts an active or paused campaign
+    'update_campaign_status', // activation sends real emails (see special case below)
+    'add_list_members', // bulk contact-list membership write
+    'remove_list_members', // bulk contact-list membership write
+    'add_list_members_by_filter', // bulk membership write, unbounded match set
+    'remove_team_member', // revokes workspace access
+    'set_team_member_role', // changes workspace access privileges
+    'delete_provider_credential', // permanently removes or revokes stored provider access
+    // #4005: every outward or destructive tool is approval-gated unless it sits on APPROVAL_EXEMPT
+    // (src/lib/approval-exempt.ts). These are wrapped with withApproval() in their tool files.
+    'send_sms', // texts a real phone number
+    'send_sms_campaign', // can activate an SMS broadcast
+    'send_newsletter_issue', // sends an issue to every subscriber
+    'schedule_newsletter_issue', // queues an issue to every subscriber
+    'reply_to_comment', // queues a public LinkedIn reply
+    'send_awaiting_reply', // sends a real email
+    'send_test_email', // sends a real email to any address
+    'remove_suppression', // re-enables mail to a suppressed address
+    'schedule_social_post', // publishes to a connected social account
+    'invite_team_member', // emails an outside person and grants access
+    'set_member_project_access', // changes workspace access
+    'revoke_invitation', // cancels a pending teammate invitation
+    'create_api_key', // mints new access to the project
+    'revoke_api_key', // breaks every integration using the key
+    'tenant_export_full', // copies all customer data out of Sendinel
+    'enroll_contact', // starts real emails to a contact
+    'identify_subscriber', // may enroll a new signup in sending campaigns
+    'emit_contact_event', // may enroll a real contact in active sending campaigns
+    'enroll_automation', // starts automated messages to a contact
+    'enroll_in_escalation_ladder', // starts email/SMS escalation to a contact
+    'set_contact_sms_consent', // changes the consent record that allows texting
+    'bulk_update_subscribers', // bulk contact data write
+    'update_webhook_subscription', // can redirect event data to a new URL
+    'delete_webhook_subscription', // removes an outbound data channel
+    'delete_campaign', // deletes a campaign and its steps
+    'delete_campaign_step', // deletes an email from a campaign
+    'delete_content_block', // deletes customer content
+    'delete_custom_field', // deletes a field and its values
+    'delete_landing_page', // takes a public page down and deletes it
+    'delete_list', // deletes a contact list
+    'delete_signature', // deletes a saved signature
+    'delete_social_post', // deletes a social post record
+    'delete_subscriber_view', // deletes a saved view
+    'delete_template', // deletes an email template
+    'import_brand_kit_text', // overwrites the brand kit
+    'disconnect_platform', // deletes stored platform credentials
+    'start_provider_switch', // moves a sending domain to another provider
+    'update_landing_page', // publishing makes the page public (see special case below)
+    'create_blog_post', // auto_publish posts to the customer's own site (see special case below)
+    'replay_enrollment_dlq_rows', // confirmed replay sends real emails (see special case below)
+]);
+export const PROTECTED_ACTIONS = new Set([
+    'delete_subscriber_data', // GDPR delete — irreversible
+    'merge_subscribers', // data consolidation — irreversible
+    'delete_segment', // affects campaign targeting
+    'identify_inactive', // bulk suppression (when not dry_run)
+    'promote_ab_winner', // deletes losing variants
+    'action_ccpa_request', // CCPA delete completion is irreversible
+]);
+/** True when the action name is on the gated or protected list (the default-deny test uses this). */
+export function isApprovalGatedAction(action) {
+    return GATED_ACTIONS.has(action) || PROTECTED_ACTIONS.has(action);
+}

package/build/lib/approval-app.js

@@ -1,3 +1,4 @@
+import { humanApprovalEligible } from './approval-human-eligibility.js';
 import { randomBytes } from 'node:crypto';
 import { buildApprovalPreview } from '@sendinel/domain';
 import { APPROVAL_APP, APPROVAL_APP_SESSION_META } from './approval-app-conventions.js';
@@ -67,7 +68,8 @@ export async function offerApprovalApp(approval) {
     const runtime = calls.getStore(), actor = identity();
     if (!runtime || !runtime.canDecide || !actor || !approvalAppEnabled() || approval.tier === 'protected' || !live(approval))
         return {};
-    if (await resolveApprovalChannel(runtime.server.server) !== 'mcp_app')
+    if (await resolveApprovalChannel(runtime.server.server) !== 'mcp_app' ||
+        !await humanApprovalEligible(approval.action, actor.projectId))
         return {};
     return { _meta: { ui: { [APPROVAL_APP.resultUriKey]: resourceUri(approval.id) } } };
 }
@@ -92,7 +94,7 @@ export function installApprovalApp(server, options = {}, approvalTool = () => fa
             if (!bound.canDecide || !actor || !approvalAppEnabled() || await resolveApprovalChannel(server.server) !== 'mcp_app')
                 throw unavailable();
             const approval = await loadOwnedPendingApproval(id, actor);
-            if (!approval)
+            if (!approval || !await humanApprovalEligible(approval.action, actor.projectId))
                 throw unavailable();
             // One outstanding render session per approval. Re-render invalidates the old view.
             const token = await mintApprovalAppSession(approval, actor);
@@ -121,7 +123,7 @@ export function installApprovalApp(server, options = {}, approvalTool = () => fa
                     return refused();
                 const approval = await loadOwnedPendingApproval(approval_id, actor);
                 // Single guarded claim before the callback, so concurrent clicks cannot reuse a session.
-                if (!approval || !await claimApprovalAppSession(app_session, approval, actor))
+                if (!approval || !await humanApprovalEligible(approval.action, actor.projectId) || !await claimApprovalAppSession(app_session, approval, actor))
                     return refused();
                 const connectionId = `oauth:${actor.oauthTokenId}`;
                 const callback = createHumanApprovalCallback({ approvalId: approval.id, projectId: actor.projectId,

package/build/lib/approval-elicitation-relay.d.ts

@@ -0,0 +1,19 @@
+import type { ElicitRequest, JSONRPCRequest } from '@modelcontextprotocol/sdk/types.js';
+import { type HumanDecisionIdentity } from './approval-human-eligibility.js';
+export declare function isElicitationResponse(body: unknown): boolean;
+/** Auth has already run. Unknown and malformed responses are deliberately indistinguishable.
+ * No decision can enter this path via a tools/call, model text, or nested tool arguments.
+ */
+export declare function recordElicitationResponse(body: unknown, identity: HumanDecisionIdentity): Promise<void>;
+/** Insert before sending, using the exact wire id (a UUID, since each stateless SDK starts
+ * its request counter at zero). Poll the persisted prompt; never await a response on the old
+ * SDK Server, because the client's answer necessarily arrives at a fresh Server via POST.
+ */
+export declare function relayElicitation(options: {
+    approvalId: string;
+    action: string;
+    identity: HumanDecisionIdentity;
+    params: ElicitRequest['params'];
+    signal: AbortSignal;
+    send(message: JSONRPCRequest): Promise<void>;
+}): Promise<'approved' | 'rejected' | 'decision_pending'>;

package/build/lib/approval-elicitation-relay.js

@@ -0,0 +1,124 @@
+import { randomUUID } from 'node:crypto';
+import { approvalStore } from './tester-requests-store.js';
+import { humanApprovalEligible } from './approval-human-eligibility.js';
+const TABLE = 'mcp_elicitation_prompts';
+const object = (value) => value !== null && typeof value === 'object' && !Array.isArray(value) ? value : null;
+function email() {
+    const source = approvalStore();
+    return typeof source.schema === 'function' ? source.schema('email') : source;
+}
+export function isElicitationResponse(body) {
+    const message = object(body);
+    return !!message && !('method' in message) && 'id' in message && ('result' in message || 'error' in message);
+}
+/** Auth has already run. Unknown and malformed responses are deliberately indistinguishable.
+ * No decision can enter this path via a tools/call, model text, or nested tool arguments.
+ */
+export async function recordElicitationResponse(body, identity) {
+    const message = object(body);
+    if (!isElicitationResponse(message) || message?.jsonrpc !== '2.0' ||
+        (typeof message.id !== 'string' && typeof message.id !== 'number') ||
+        ('error' in message) || !identity.oauthTokenId || !identity.actorId)
+        return;
+    const result = object(message.result), content = object(result?.content);
+    if (result?.action !== 'accept' || (content?.decision !== 'approve' && content?.decision !== 'reject'))
+        return;
+    try {
+        const client = email(), now = new Date().toISOString();
+        const { data: prompt, error } = await client.from(TABLE).select('*')
+            .eq('oauth_token_id', identity.oauthTokenId).eq('jsonrpc_request_id', String(message.id))
+            .eq('status', 'pending').gt('expires_at', now).maybeSingle();
+        if (error || !prompt || prompt.oauth_token_id !== identity.oauthTokenId || prompt.user_id !== identity.actorId ||
+            prompt.jsonrpc_request_id !== String(message.id) || prompt.status !== 'pending' ||
+            !(Date.parse(prompt.expires_at) > Date.now()) || prompt.channel !== 'mcp_elicitation')
+            return;
+        const { data: approval, error: approvalError } = await client.from('action_approvals')
+            .select('id, project_id, oauth_token_id, action, tier, status, used_at, expires_at')
+            .eq('id', prompt.approval_id).eq('project_id', prompt.project_id)
+            .eq('oauth_token_id', identity.oauthTokenId).eq('status', 'pending').is('used_at', null)
+            .gt('expires_at', now).maybeSingle();
+        if (approvalError || !approval || approval.id !== prompt.approval_id || approval.project_id !== prompt.project_id ||
+            approval.oauth_token_id !== prompt.oauth_token_id || approval.status !== 'pending' || approval.used_at != null ||
+            approval.tier !== 'gated' || typeof approval.action !== 'string' || !approval.action ||
+            !(Date.parse(approval.expires_at) > Date.now()))
+            return;
+        // All-project grants' answer POSTs have no project argument. The authenticated token/user
+        // must match the stored prompt; authorize against THAT approval's project, never a body field.
+        if (!await humanApprovalEligible(approval.action, prompt.project_id, { ...identity, projectId: prompt.project_id }))
+            return;
+        const { data, error: rpcError } = await client.rpc('record_elicitation_decision', {
+            p_prompt_id: prompt.id, p_oauth_token_id: identity.oauthTokenId, p_user_id: identity.actorId,
+            p_decision: content.decision, p_project_id: prompt.project_id, p_action: approval.action,
+        });
+        if (rpcError || data !== true)
+            return;
+    }
+    catch {
+        // Never reveal whether a prompt exists, and never fall back to non-atomic REST writes.
+    }
+}
+/** Insert before sending, using the exact wire id (a UUID, since each stateless SDK starts
+ * its request counter at zero). Poll the persisted prompt; never await a response on the old
+ * SDK Server, because the client's answer necessarily arrives at a fresh Server via POST.
+ */
+export async function relayElicitation(options) {
+    const pending = 'decision_pending';
+    const { identity, signal } = options;
+    if (signal.aborted || !identity.projectId || !identity.oauthTokenId || !identity.actorId ||
+        !await humanApprovalEligible(options.action, identity.projectId, identity))
+        return pending;
+    const client = email(), now = Date.now(), requestId = randomUUID();
+    const promptId = randomUUID();
+    try {
+        const { error: expireError } = await client.from(TABLE).update({ status: 'expired' })
+            .eq('oauth_token_id', identity.oauthTokenId).eq('status', 'pending').lt('expires_at', new Date(now).toISOString());
+        if (expireError)
+            return pending;
+        // Bounded per-token purge; an old backlog is drained in chunks, never one unbounded delete.
+        const { data: old, error: oldError } = await client.from(TABLE).select('id')
+            .eq('oauth_token_id', identity.oauthTokenId).lt('created_at', new Date(now - 3_600_000).toISOString()).limit(100);
+        if (oldError)
+            return pending;
+        if (old?.length) {
+            const { error: deleteError } = await client.from(TABLE).delete().eq('oauth_token_id', identity.oauthTokenId)
+                .in('id', old.map((row) => row.id));
+            if (deleteError)
+                return pending;
+        }
+        const { data: approval, error: approvalError } = await client.from('action_approvals')
+            .select('id, expires_at').eq('id', options.approvalId).eq('project_id', identity.projectId)
+            .eq('oauth_token_id', identity.oauthTokenId).eq('action', options.action)
+            .eq('tier', 'gated').eq('status', 'pending').is('used_at', null).gt('expires_at', new Date(now).toISOString()).maybeSingle();
+        if (approvalError || !approval || !(Date.parse(approval.expires_at) > Date.now()) || signal.aborted)
+            return pending;
+        const { error } = await client.from(TABLE).insert({ id: promptId, approval_id: options.approvalId,
+            project_id: identity.projectId, oauth_token_id: identity.oauthTokenId, user_id: identity.actorId,
+            jsonrpc_request_id: requestId, channel: 'mcp_elicitation', status: 'pending',
+            created_at: new Date(now).toISOString(), expires_at: new Date(Math.min(now + 120_000, Date.parse(approval.expires_at))).toISOString() });
+        if (error || signal.aborted)
+            return pending;
+        // The id is created here and passed unchanged both to the row and the actual transport.
+        await options.send({ jsonrpc: '2.0', id: requestId, method: 'elicitation/create', params: options.params });
+        while (!signal.aborted && Date.now() < now + 60_000) {
+            const { data: prompt, error: readError } = await client.from(TABLE).select('status, answer, expires_at')
+                .eq('id', promptId).eq('oauth_token_id', identity.oauthTokenId).eq('user_id', identity.actorId).maybeSingle();
+            if (signal.aborted || readError || !prompt || !(Date.parse(prompt.expires_at) > Date.now()))
+                return pending;
+            if (prompt.status === 'answered')
+                return prompt.answer === 'approve' ? 'approved' : prompt.answer === 'reject' ? 'rejected' : pending;
+            if (prompt.status !== 'pending')
+                return pending;
+            await new Promise(resolve => {
+                const timer = setTimeout(done, 750);
+                function done() { clearTimeout(timer); signal.removeEventListener('abort', done); resolve(); }
+                signal.addEventListener('abort', done, { once: true });
+                if (signal.aborted)
+                    done();
+            });
+        }
+    }
+    catch {
+        // Refused inserts/updates, missing migrations and disconnected streams keep approve_url.
+    }
+    return pending;
+}

package/build/lib/approval-elicitation.d.ts

@@ -1,3 +1,5 @@
+import { type HumanDecisionIdentity } from './approval-human-eligibility.js';
+import type { ElicitRequest } from '@modelcontextprotocol/sdk/types.js';
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { RequestId } from '@modelcontextprotocol/sdk/types.js';
 type Decision = 'approve' | 'reject';
@@ -10,9 +12,17 @@ type HumanCallback = {
     }): Promise<boolean>;
 };
 /** Injected at authenticated transport startup, never taken from tool arguments. */
-type TransportBinding = {
+export type TransportBinding = {
     projectId: string;
     userId?: string | null;
+    oauthTokenId?: string | null;
+    identity?: HumanDecisionIdentity;
+    relay?(options: {
+        approvalId: string;
+        action: string;
+        params: ElicitRequest['params'];
+        signal: AbortSignal;
+    }): Promise<ElicitationDecision>;
     createHumanDecision(binding: {
         approvalId: string;
         projectId: string;
@@ -25,9 +35,9 @@ type RequestExtra = {
     requestId?: RequestId;
     signal?: AbortSignal;
 };
-export declare function installApprovalElicitation(server: McpServer, binding: TransportBinding): void;
+export declare function installApprovalElicitation(server: Pick<McpServer, 'server'>, binding: TransportBinding): void;
 /** Called by the registry wrapper with SDK-owned extra, outside parsed model arguments. */
-export declare function runWithApprovalElicitation<T>(server: McpServer, extra: RequestExtra | undefined, run: () => T): T;
+export declare function runWithApprovalElicitation<T>(server: Pick<McpServer, 'server'>, extra: RequestExtra | undefined, run: () => T): T;
 type ApprovalFallback = {
     approval_id: string;
     approve_url: string;

package/build/lib/approval-elicitation.js

@@ -1,3 +1,5 @@
+import { isHumanRequestableAdminTool } from './admin-tools.js';
+import { humanApprovalEligible } from './approval-human-eligibility.js';
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { randomUUID } from 'node:crypto';
 import { buildApprovalPreview, isHumanApprovalChannel } from '@sendinel/domain';
@@ -33,7 +35,11 @@ export async function elicitApproval(result, frozen, projectId) {
         channel = 'mcp_elicitation_url';
     if (channel !== 'mcp_elicitation_form' && channel !== 'mcp_elicitation_url')
         return pending;
-    if (channel === 'mcp_elicitation_form' && !context.userId)
+    if (channel === 'mcp_elicitation_form' && (!context.userId ||
+        !await humanApprovalEligible(frozen.action, projectId, context.identity)))
+        return pending;
+    if (channel === 'mcp_elicitation_url' && isHumanRequestableAdminTool(frozen.action) &&
+        !await humanApprovalEligible(frozen.action, projectId, context.identity))
         return pending;
     if (context.signal?.aborted)
         return pending;
@@ -58,14 +64,18 @@ export async function elicitApproval(result, frozen, projectId) {
             `Recipients: ${preview.recipient_count ?? 'unknown'}`, `Footer: ${short(preview.footer_text || 'unknown', 500)}`,
             `Body excerpt:\n${short(preview.body_text, 1500)}`, `Full preview: ${result.approve_url}`].join('\n');
         if (channel === 'mcp_elicitation_form') {
+            const params = { mode: 'form', message, requestedSchema: { type: 'object', properties: {
+                        decision: { type: 'string', enum: ['approve', 'reject'], title: 'Decision' },
+                        note: { type: 'string', title: 'Optional note', maxLength: 500 },
+                    }, required: ['decision'] } };
+            if (context.relay) {
+                const status = await Promise.race([context.relay({ approvalId: result.approval_id,
+                        action: frozen.action, params, signal: controller.signal }), stopped]);
+                return controller.signal.aborted ? pending : { ...result, decision_status: status };
+            }
             const callback = context.createHumanDecision({ approvalId: result.approval_id, projectId,
                 connectionId: context.connectionId, userId: context.userId, channel: 'mcp_elicitation' });
-            const response = await Promise.race([context.server.server.elicitInput({ mode: 'form', message,
-                    requestedSchema: { type: 'object', properties: {
-                            decision: { type: 'string', enum: ['approve', 'reject'], title: 'Decision' },
-                            note: { type: 'string', title: 'Optional note', maxLength: 500 },
-                        }, required: ['decision'] },
-                }, options), stopped]);
+            const response = await Promise.race([context.server.server.elicitInput(params, options), stopped]);
             if (controller.signal.aborted)
                 return pending;
             // Decline/cancel are not explicit rejections. The dashboard link remains usable.

package/build/lib/approval-human-callback.js

@@ -1,3 +1,5 @@
+import { humanApprovalEligible } from './approval-human-eligibility.js';
+import { requestContext } from '../db.js';
 import { randomUUID } from 'node:crypto';
 import { approvalStore } from './tester-requests-store.js';
 /**
@@ -18,11 +20,17 @@ export function createHumanApprovalCallback(binding) {
             completed = true;
             const source = approvalStore();
             const client = typeof source.schema === 'function' ? source.schema('email') : source;
+            const { data: approval, error: loadError } = await client.from('action_approvals')
+                .select('action').eq('id', binding.approvalId).eq('project_id', binding.projectId).maybeSingle();
+            if (loadError || typeof approval?.action !== 'string' || !approval.action ||
+                requestContext()?.actorId !== binding.userId ||
+                !await humanApprovalEligible(approval.action, binding.projectId))
+                return false;
             const now = new Date().toISOString();
             const { data, error } = await client.from('action_approvals')
                 .update({ status: response.decision === 'approve' ? 'approved' : 'rejected', decided_via: binding.channel,
                 decided_by: binding.userId, decided_at: now })
-                .eq('id', binding.approvalId).eq('project_id', binding.projectId)
+                .eq('id', binding.approvalId).eq('project_id', binding.projectId).eq('action', approval.action)
                 .eq('status', 'pending').is('used_at', null).gt('expires_at', now)
                 .select('id, payload_hash').maybeSingle();
             if (error || !data)

package/build/lib/approval-human-eligibility.d.ts

@@ -0,0 +1,13 @@
+export type HumanDecisionIdentity = {
+    projectId?: string;
+    actorId?: string | null;
+    oauthTokenId?: string | null;
+    authKind?: string | null;
+    channelVerified?: boolean;
+    scopes?: readonly string[];
+};
+/** Shared transport boundary, never populated from tool arguments. Re-read the grant and
+ * (for admin requests) the project's org membership on every prompt and every decision.
+ * Missing connection_role is NOT a human grant: it must be exactly SQL NULL.
+ */
+export declare function humanApprovalEligible(action: string, projectId: string, identity?: HumanDecisionIdentity | undefined): Promise<boolean>;

package/build/lib/approval-human-eligibility.js

@@ -0,0 +1,39 @@
+import { requestContext } from '../db.js';
+import { approvalStore } from './tester-requests-store.js';
+import { isHumanRequestableAdminTool } from './admin-tools.js';
+/** Shared transport boundary, never populated from tool arguments. Re-read the grant and
+ * (for admin requests) the project's org membership on every prompt and every decision.
+ * Missing connection_role is NOT a human grant: it must be exactly SQL NULL.
+ */
+export async function humanApprovalEligible(action, projectId, identity = requestContext()) {
+    if (!identity || identity.channelVerified !== true || identity.authKind !== 'oauth' ||
+        !identity.actorId || !identity.oauthTokenId || identity.projectId !== projectId || !projectId ||
+        identity.scopes?.some(scope => scope === 'tester' || scope === 'agent'))
+        return false;
+    try {
+        const source = approvalStore();
+        const client = typeof source.schema === 'function' ? source.schema('email') : source;
+        const { data: grant, error } = await client.from('mcp_oauth_tokens')
+            .select('id, user_id, connection_role, scopes, revoked_at, expires_at')
+            .eq('id', identity.oauthTokenId).maybeSingle();
+        if (error || !grant || grant.id !== identity.oauthTokenId || grant.user_id !== identity.actorId ||
+            grant.connection_role !== null || grant.revoked_at !== null ||
+            !(Date.parse(grant.expires_at) > Date.now()) || !Array.isArray(grant.scopes) ||
+            grant.scopes.some((scope) => scope === 'tester' || scope === 'agent'))
+            return false;
+        if (!isHumanRequestableAdminTool(action))
+            return true;
+        // Same lookup as dashboard getProjectOrgRole: projects.org_id -> org_members.role.
+        // Unlike permissive mocks, PostgREST errors (including {data, error}) grant nothing.
+        const { data: project, error: projectError } = await client.from('projects')
+            .select('org_id').eq('id', projectId).maybeSingle();
+        if (projectError || !project?.org_id)
+            return false;
+        const { data: member, error: roleError } = await client.from('org_members')
+            .select('role').eq('org_id', project.org_id).eq('user_id', identity.actorId).maybeSingle();
+        return !roleError && (member?.role === 'owner' || member?.role === 'admin');
+    }
+    catch {
+        return false;
+    }
+}

package/build/server.js

@@ -5,7 +5,8 @@ import { runWithToolContext } from './db.js';
 import { TESTER_REQUEST_TOOLS } from './lib/tester-policy.js';
 import { testerRequestTool } from './lib/tester-requests.js';
 export { TESTER_REQUEST_TOOLS } from './lib/tester-policy.js';
-import { isApprovalGatedAction } from './lib/action-approvals.js';
+import { ADMIN_TOOLS, isHumanRequestableAdminTool } from './lib/admin-tools.js';
+import { withApproval, isApprovalGatedAction } from './lib/action-approvals.js';
 import { registerAgentMailboxTools } from './tools/agent-mailboxes.js';
 import { registerAnalyticsTools } from './tools/analytics.js';
 import { registerCampaignTools } from './tools/campaigns.js';
@@ -149,32 +150,6 @@ const WRITE_TOOLS = new Set([
     'commit_staged_import', 'discard_staged_import', 'add_synced_folder', 'remove_synced_folder',
     'retry_send_queue_rows', 'cancel_send_queue_rows', 'add_blackout_date', 'remove_blackout_date',
 ]);
-const ADMIN_TOOLS = new Set([
-    'create_agent_mailbox',
-    // Connector mutations write schema into a customer-owned database and
-    // rewrite how their data maps in (admin, not write: Kevin, 2026-09-11).
-    // NOTE: no apostrophes in comments inside these Sets -- tool-scopes.test.ts
-    // parses the block by matching single-quoted strings.
-    'install_connector_schema', 'install_connector_view', 'set_connector_mapping', 'resync_connector',
-    'delete_subscriber_data', 'list_deletion_log', 'list_ccpa_requests', 'action_ccpa_request',
-    'delete_subscriber_data', 'list_deletion_log', 'list_audit_log', 'get_audit_stats',
-    'unsubscribe_subscriber', 'add_suppression', 'remove_suppression',
-    'create_site', 'update_site',
-    'delete_template', 'register_domain', 'onboard_new_site',
-    'create_api_key', 'revoke_api_key', 'invite_team_member',
-    'connect_platform', 'disconnect_platform', 'configure_platform_trigger',
-    'create_custom_webhook', 'rotate_custom_webhook_secret',
-    'remove_team_member', 'set_team_member_role', 'set_member_project_access',
-    'list_invitations', 'resend_invitation', 'revoke_invitation',
-    'connect_platform', 'disconnect_platform', 'configure_platform_trigger', 'delete_provider_credential',
-    'abuse_monitor_override',
-    'tenant_export_full',
-    'identify_inactive', 'delete_segment',
-    'delete_signature',
-    'merge_subscribers', 'delete_webhook_subscription',
-    'set_white_label_settings', 'add_white_label_domain',
-    'post_ticket_reply',
-]);
 const SCOPE_HIERARCHY = { read: 1, write: 2, admin: 3 };
 export function getRequiredScope(name) {
     if (ADMIN_TOOLS.has(name))
@@ -348,7 +323,7 @@ function createScopeProxy(server, scopes, toolGroup, allowedTools) {
                         const agent = isAgentConnection(scopes);
                         const allowed = () => agent ? agentConnectionAllowsTool(name) : tester
                             ? testerConnectionAllowsTool(name)
-                            : scopeAllows(scopes, required);
+                            : scopeAllows(scopes, required) || (scopeAllows(scopes, 'read') && isHumanRequestableAdminTool(name));
                         if (!allowed()) {
                             // Don't register tools the key can't access — they won't appear in tool list
                             return;
@@ -358,6 +333,10 @@ function createScopeProxy(server, scopes, toolGroup, allowedTools) {
                             config = wrapped.config;
                             handler = wrapped.handler;
                         }
+                        if (!tester && !agent && !scopeAllows(scopes, 'admin') && isHumanRequestableAdminTool(name)) {
+                            config = { ...config, description: `${config.description ?? ''} Request-only: needs a human org admin to approve.` };
+                            handler = withApproval(name, handler, { registeredRequestOnly: true });
+                        }
                         // Wrap handler with runtime scope check (defense in depth)
                         const guardedHandler = (...args) => {
                             if (!allowed()) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendinel/mcp-server",
-  "version": "1.0.118",
+  "version": "1.0.120",
   "description": "AI-controlled email operations control plane for campaigns, contacts, segments, analytics, and multi-provider sending via MCP.",
   "mcpName": "ai.sendinel/mcp-server",
   "type": "module",