@sendinel/mcp-server 1.0.133 → 1.0.134

package/build/lib/email-provider.js

@@ -1,4 +1,4 @@
-import { checkProjectSendAllowlist } from "@sendinel/domain";
+import { checkProjectSendAllowlist, stripActiveEmailContent } from "@sendinel/domain";
 import { Resend } from "resend";
 import { adminDb, db } from "../db.js";
 import { decrypt } from "../crypto.js";
@@ -251,6 +251,7 @@ export async function sendEmailForSite(projectId, siteId, args) {
     const refusal = await checkProjectSendAllowlist(adminDb(), projectId, args, "mcp");
     if (refusal)
         return refusal;
+    args = { ...args, ...(args.html !== undefined ? { html: stripActiveEmailContent(args.html).html } : {}) };
     const config = await resolveProviderConfig(projectId, siteId);
     switch (config.name) {
         case "resend":

package/build/tools/campaigns.js

@@ -2,7 +2,7 @@ import { resolveCampaignReentry, readCampaignPeriods, campaignPeriodFields } fro
 import { CAMPAIGN_BRANCH_CONDITIONS, campaignBranchConditionValue, isContactPropertyConditionList, STEP_PROPERTY_CONDITIONS_ERROR, validateStepPropertyRules } from "@sendinel/domain";
 import { z } from 'zod';
 import Anthropic from '@anthropic-ai/sdk';
-import { assertSendAccepted, providerSendError, sendError, SendRefusedError, BLOCKING_CONTENT_ISSUE_KINDS, computeSendContentKey, findContentIssues, sendingHostOf, NAME_FALLBACKS, ONE_SEND_MATCH_STATUSES, ONE_SEND_SENT_STATUSES, ONE_SEND_WINDOW_DAYS, normalizeTriggerConfig, renderTemplateString as renderTemplateVars, resolveBrandTokens, brandWarnings, readAllRows, isSegmentRulesError, scopeSegmentRulesToSite, SegmentRulesError, validateSegmentRules, validateUnsubFooterTemplate, } from '@sendinel/domain';
+import { stripActiveEmailContent, assertSendAccepted, providerSendError, sendError, SendRefusedError, BLOCKING_CONTENT_ISSUE_KINDS, computeSendContentKey, findContentIssues, sendingHostOf, NAME_FALLBACKS, ONE_SEND_MATCH_STATUSES, ONE_SEND_SENT_STATUSES, ONE_SEND_WINDOW_DAYS, normalizeTriggerConfig, renderTemplateString as renderTemplateVars, resolveBrandTokens, brandWarnings, readAllRows, isSegmentRulesError, scopeSegmentRulesToSite, SegmentRulesError, validateSegmentRules, validateUnsubFooterTemplate, } from '@sendinel/domain';
 // Subpath import, not the barrel above -- reply-actions.ts uses node:crypto,
 // and MCP-server-side that's fine (this never runs in an Edge Function), but
 // keeping it off the shared barrel avoids re-creating the Edge-Function
@@ -1510,7 +1510,7 @@ export function registerCampaignTools(server) {
         });
         return j({
             ...approval,
-            rendered: { subject: content.subject, body_html: content.body_html, body_text: content.body_text },
+            rendered: { subject: content.subject, body_html: stripActiveEmailContent(content.body_html).html, body_text: content.body_text },
             recipient_count: resolved.contactIds.length,
             audience: { label: segmentName, segment_id: segment_id ?? null, ...heldBackLines(resolved) },
             site: { id: site.id, name: site.name, from_email: site.from_email },
@@ -2461,6 +2461,8 @@ Do not include body_html in your response; Sendinel renders body_html from block
             }
             resolvedSubject = subject?.trim() || renderTemplateVars(template.subject_hint ?? '', renderVars, { brandTokens: brandVars });
         }
+        if (resolvedHtml !== undefined)
+            resolvedHtml = stripActiveEmailContent(resolvedHtml).html;
         if (!resolvedSubject?.trim())
             return txt('Error: subject is required');
         const payload = {
@@ -2653,6 +2655,8 @@ Do not include body_html in your response; Sendinel renders body_html from block
             }
             resolvedSubject = subject?.trim() || renderTemplateVars(template.subject_hint ?? '', renderVars, { brandTokens: brandVars });
         }
+        if (resolvedHtml !== undefined)
+            resolvedHtml = stripActiveEmailContent(resolvedHtml).html;
         if (!resolvedSubject?.trim())
             return txt('Error: subject is required');
         const { data: projectContext, error: projectContextError } = await adminDb()
@@ -2871,6 +2875,17 @@ Do not include body_html in your response; Sendinel renders body_html from block
             bodyText: body_text,
             brandSettings: projectRow?.brand_settings ?? null,
         });
+        const active = stripActiveEmailContent(html).removed;
+        if (active.includes('script'))
+            result.warnings.push('The script tag is removed at send time.');
+        if (active.includes('event-handler attribute'))
+            result.warnings.push('Each on* event-handler attribute is removed at send time.');
+        const schemes = active.filter(finding => finding.endsWith(' URL'));
+        if (schemes.length)
+            result.warnings.push(`Active links (${schemes.join(', ')}) are removed at send time.`);
+        const tags = active.filter(finding => finding !== 'script' && finding !== 'event-handler attribute' && !finding.endsWith(' URL'));
+        if (tags.length)
+            result.warnings.push(`Other active tags (${tags.join(', ')}) are removed at send time.`);
         for (const issue of findContentIssues({ subject, body_html: html, body_text }, { sendingHosts, sourcedKeys })) {
             if (BLOCKING_CONTENT_ISSUE_KINDS.has(issue.kind))
                 result.errors.push(`${issue.message} (${issue.excerpt})`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendinel/mcp-server",
-  "version": "1.0.133",
+  "version": "1.0.134",
   "description": "AI-controlled email operations control plane for campaigns, contacts, segments, analytics, and multi-provider sending via MCP.",
   "mcpName": "ai.sendinel/mcp-server",
   "type": "module",