@sendinel/mcp-server 1.0.138 → 1.0.139

package/README.md

@@ -18,7 +18,7 @@ preserves REST outcomes, and redacts failures. See the
 [event-triggered campaign guide](../../docs/event-triggered-campaigns.md) for
 inputs, idempotency, subscription requirements, and conditional step examples.
 
-Sendinel currently exposes 35 tool groups and 343 tools (gateway mode exposes 4 meta-tools, sharing how_to with full mode). These counts are checked against the tool registry in CI, so this table matches what ships.
+Sendinel currently exposes 35 tool groups and 344 tools (gateway mode exposes 4 meta-tools, sharing how_to with full mode). These counts are checked against the tool registry in CI, so this table matches what ships.
 
 | Group | Count | Purpose |
 |-------|-------|---------|
@@ -34,7 +34,7 @@ Sendinel currently exposes 35 tool groups and 343 tools (gateway mode exposes 4
 | `cloud-import` | 6 | Cloud storage import |
 | `compound` | 4 | Higher-level campaign/template/site setup and delivery diagnosis workflows |
 | `connector` | 6 | BYOD connector status, table discovery, schema/view setup, mapping, resync |
-| `contacts` | 39 | Subscriber CRUD, saved views, tags, email log, suppression, merge, timeline |
+| `contacts` | 40 | Subscriber CRUD, saved views, tags, email log, suppression, merge, timeline |
 | `content` | 14 | Content blocks, gated asset links, blog ingest and auto-publish, sources |
 | `data` | 19 | Platform connectors, imports, API keys, migration jobs, notifications, tenant export |
 | `data-proposals` | 3 | Data-derived campaign proposal generation, listing, approval |

package/build/lib/url-validation.d.ts

@@ -1,3 +1,6 @@
+/** Redirect destinations may use HTTP or HTTPS, but never executable URL schemes. */
+export declare function assertHttpUrl(raw: string): string;
+export declare const RESERVED_LINK_SLUGS: Set<string>;
 export declare function isSafeRedirectUrl(url: unknown): url is string;
 export declare function isAllowedHttpsHostUrl(url: unknown, allowedDomains: readonly string[]): url is string;
 export declare function normalizeActiveCampaignAccountUrl(accountUrl: string): string;

package/build/lib/url-validation.js

@@ -1,3 +1,18 @@
+/** Redirect destinations may use HTTP or HTTPS, but never executable URL schemes. */
+export function assertHttpUrl(raw) {
+    const url = new URL(raw);
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        throw new Error('Only http and https URLs are supported.');
+    }
+    return url.toString();
+}
+// Shared /s namespace: system routes cannot be claimed by a tenant.
+export const RESERVED_LINK_SLUGS = new Set([
+    'admin', 'api', 'app', 'login', 'dashboard', 's', 'a', 'www', 'support', 'billing',
+    'auth', 'static', 'assets', 'aup', 'ccpa', 'changelog', 'cloud-storage', 'demo-video',
+    'developer', 'embed', 'gdpr', 'getting-started', 'invite', 'legal', 'lp', 'oauth',
+    'pricing', 'privacy', 'reset-password', 'sign-in', 'sign-up', 'terms',
+]);
 export function isSafeRedirectUrl(url) {
     if (typeof url !== 'string' || !url)
         return false;

package/build/tools/approvals.js

@@ -42,7 +42,7 @@ export function registerApprovalTools(server, options) {
             idempotentHint: true,
             openWorldHint: false,
         },
-        description: 'List all pending approval requests for this project. Shows what actions are waiting for human approval.',
+        description: 'List all pending approval requests for this project. Excludes expired requests without mutating them. Shows what actions are waiting for human approval.',
         inputSchema: {},
     }, async () => {
         const { data, error } = await db()
@@ -50,10 +50,11 @@ export function registerApprovalTools(server, options) {
             .select('id, action, tier, channel, summary, status, requested_at, expires_at')
             .eq('project_id', getProjectId())
             .eq('status', 'pending')
+            .gt('expires_at', new Date().toISOString())
             .order('requested_at', { ascending: false })
             .limit(25);
         if (error)
-            return txt(`Error: ${error.message}`);
+            return j({ error: error.message, code: 'INTERNAL_ERROR' });
         return j({ pending: data ?? [], count: data?.length ?? 0 });
     });
 }

package/build/tools/campaigns.d.ts

@@ -7,7 +7,8 @@ export declare function buildCampaignFiresOn(campaign: Record<string, unknown>):
 /**
  * Diagnostic warnings indicating why a campaign's trigger configuration cannot fire (#3852).
  */
-export declare function buildCampaignTriggerDiagnostics(campaign: Record<string, unknown>): string[];
+export declare function buildCampaignTriggerDiagnostics(campaign: Record<string, unknown>, seenEvents?: ReadonlySet<string> | null): string[];
+export declare function campaignTriggerKind(campaign: Record<string, unknown>): 'event' | 'tag' | 'date_field' | 'contact_event' | 'manual';
 export declare function applyCampaignTargetingFields(updates: Record<string, unknown>, input: {
     trigger_event_name?: string | null;
     trigger_tag?: string | null;

package/build/tools/campaigns.js

@@ -105,11 +105,18 @@ export function buildCampaignFiresOn(campaign) {
 /**
  * Diagnostic warnings indicating why a campaign's trigger configuration cannot fire (#3852).
  */
-export function buildCampaignTriggerDiagnostics(campaign) {
+export function buildCampaignTriggerDiagnostics(campaign, seenEvents) {
     const config = (campaign.trigger_config && typeof campaign.trigger_config === 'object' ? campaign.trigger_config : {});
     const events = normalizeTriggerList([...normalizeTriggerList(config.events), campaign.trigger_event_name]);
     const tags = normalizeTriggerList([...normalizeTriggerList(config.tags), campaign.trigger_tag]);
     const diagnostics = [];
+    if (events.length && seenEvents === null)
+        diagnostics.push('Event history unavailable; prior receipt of these events is unknown.');
+    if (seenEvents)
+        for (const event of events) {
+            if (!seenEvents.has(event))
+                diagnostics.push(`Event "${event}" has never been seen in this project; check the event name or send a test event.`);
+        }
     if ((events.length || tags.length) && campaign.type !== 'triggered') {
         diagnostics.push(`campaign type is "${String(campaign.type)}"; event and tag triggers only start campaigns of type "triggered" (it will never fire)`);
     }
@@ -133,6 +140,37 @@ export function buildCampaignTriggerDiagnostics(campaign) {
     }
     return diagnostics;
 }
+export function campaignTriggerKind(campaign) {
+    if (campaign.trigger_type === 'date_field' || campaign.trigger_type === 'contact_event')
+        return campaign.trigger_type;
+    const config = normalizeTriggerConfig(campaign.trigger_config);
+    if (normalizeTriggerValue(campaign.trigger_event_name) || config.events.length)
+        return 'event';
+    if (normalizeTriggerValue(campaign.trigger_tag) || config.tags.length)
+        return 'tag';
+    return 'manual';
+}
+async function campaignTriggerOutput(campaign) {
+    let seenEvents;
+    const config = normalizeTriggerConfig(campaign.trigger_config);
+    if (normalizeTriggerValue(campaign.trigger_event_name) || config.events.length) {
+        try {
+            // /v1/events -> intakeContactEvent stores event_type=custom and title=event.
+            // Read all pages: a capped sample cannot establish that an event was never seen.
+            const rows = await readAllRows(db().from('contact_events').select('id, title')
+                .eq('project_id', getProjectId()).eq('event_type', 'custom'));
+            seenEvents = new Set(rows.map(row => normalizeTriggerValue(row.title)).filter((value) => value !== null));
+        }
+        catch {
+            seenEvents = null;
+        }
+    }
+    return {
+        trigger_kind: campaignTriggerKind(campaign),
+        fires_on: buildCampaignFiresOn(campaign),
+        trigger_diagnostics: buildCampaignTriggerDiagnostics(campaign, seenEvents),
+    };
+}
 function applyCampaignSendAtField(updates, sendAt, campaignType) {
     if (sendAt === undefined)
         return null;
@@ -165,13 +203,20 @@ export async function applyCampaignTargetingFields(updates, input, projectId, ex
         if (hasTriggerEvent)
             return 'cannot set trigger_event_name on a date_field campaign';
         const config = input.trigger_config ?? {};
+        const unknown = Object.keys(config).filter(key => !['field', 'days_before', 'recurring'].includes(key));
+        if (unknown.length)
+            return `Unknown date_field keys: ${unknown.join(', ')}; allowed: field, days_before, recurring; use days_before, not offset_days`;
+        if (config.days_before !== undefined && (typeof config.days_before !== 'number' || !Number.isInteger(config.days_before) || config.days_before < 0 || config.days_before > 30))
+            return 'days_before must be an integer from 0 to 30; use days_before, not offset_days';
+        if (config.recurring !== undefined && typeof config.recurring !== 'boolean')
+            return 'recurring must be a boolean';
         const field = typeof config.field === 'string' ? config.field.trim() : '';
         if (!/^[A-Za-z0-9_.-]{1,80}$/.test(field))
             return 'date field is required';
         updates.trigger_type = 'date_field';
         updates.trigger_config = {
             field,
-            days_before: Math.max(0, Math.min(30, Number(config.days_before ?? 0) || 0)),
+            days_before: config.days_before ?? 0,
             recurring: config.recurring !== false,
         };
     }
@@ -197,6 +242,24 @@ export async function applyCampaignTargetingFields(updates, input, projectId, ex
             updates.trigger_config = null;
         }
         else {
+            const unknown = Object.keys(input.trigger_config).filter(key => !['events', 'tags', 'where'].includes(key));
+            if (unknown.length)
+                return `Unknown trigger_config keys: ${unknown.join(', ')}; allowed: events, tags, where`;
+            if ('where' in input.trigger_config) {
+                const where = input.trigger_config.where;
+                if (!where || typeof where !== 'object' || Array.isArray(where))
+                    return 'where must be an object of string, number or boolean values';
+                const keys = new Set();
+                for (const [key, value] of Object.entries(where)) {
+                    const normalizedKey = key.trim().replace(/^ctx\./, '');
+                    if (!normalizedKey || normalizedKey === '__proto__' || keys.has(normalizedKey))
+                        return `where.${key} has an empty or duplicate normalized key`;
+                    keys.add(normalizedKey);
+                    if (!['string', 'number', 'boolean'].includes(typeof value) || (typeof value === 'number' && !Number.isFinite(value))) {
+                        return `where.${key} must be a string, number or boolean; operators like $gt are not supported`;
+                    }
+                }
+            }
             const config = buildCampaignTriggerConfig(input.trigger_config);
             if (!config)
                 return 'trigger_config must include events or tags';
@@ -3188,8 +3251,7 @@ Return ONLY valid JSON with this exact shape:
             send_class: campaign.send_class,
             unsub_footer_template: campaign.unsub_footer_template,
             ...targeting,
-            fires_on: buildCampaignFiresOn({ ...campaign, status: willActivate ? 'active' : 'draft' }),
-            trigger_diagnostics: buildCampaignTriggerDiagnostics({ ...campaign, status: willActivate ? 'active' : 'draft' }),
+            ...await campaignTriggerOutput({ ...campaign, status: willActivate ? 'active' : 'draft' }),
             steps_created: steps.length,
             contacts_enrolled: enrolled,
             status: willActivate ? 'active' : 'draft',
@@ -3381,7 +3443,7 @@ Return ONLY valid JSON with this exact shape:
     server.registerTool('set_campaign_trigger', {
         title: 'Set Campaign Trigger',
         annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
-        description: 'Set or clear what a campaign fires on: trigger event name, tag, date_field, contact_event, or trigger_config events/tags and where event-data filter. Bind billing, payment failed, dunning or trial ending mail to an event trigger such as invoice_payment_failed or trial_ending. Drafts save directly; active/paused campaigns require standard human approval. Archived/completed campaigns cannot change. Returns saved trigger fields, fires_on and trigger_diagnostics.',
+        description: 'Set or clear what a campaign fires on: trigger event name, tag, date_field, contact_event, or trigger_config events/tags and where event-data filter. Bind billing, payment failed, dunning or trial ending mail to an event trigger such as invoice_payment_failed or trial_ending. Drafts save directly; active/paused campaigns require standard human approval. Archived/completed campaigns cannot change. Returns saved trigger fields, derived trigger_kind, fires_on and trigger_diagnostics (including unseen-event warnings).',
         inputSchema: {
             ...reentryFields,
             campaign_id: z.string().uuid().optional(),
@@ -3395,7 +3457,7 @@ Return ONLY valid JSON with this exact shape:
     }, async ({ approval_id, ...args }) => {
         if (approval_id) {
             const result = await resumeCampaignEdit('set_campaign_trigger', approval_id, args);
-            return j(result.error ? result : { ...result, fires_on: buildCampaignFiresOn(result), trigger_diagnostics: buildCampaignTriggerDiagnostics(result) });
+            return j(result.error ? result : { ...result, ...await campaignTriggerOutput(result) });
         }
         if (!args.campaign_id)
             return j({ error: 'campaign_id is required', code: 'INVALID_FIELD' });
@@ -3435,7 +3497,7 @@ Return ONLY valid JSON with this exact shape:
         if (reentry.period_key !== undefined)
             updates.period_key = reentry.period_key;
         const result = await finishCampaignEdit('set_campaign_trigger', args, existing, updates, params => requestApproval('set_campaign_trigger', params));
-        return j(result.error || result.requires_approval ? result : { ...result, fires_on: buildCampaignFiresOn(result), trigger_diagnostics: buildCampaignTriggerDiagnostics(result) });
+        return j(result.error || result.requires_approval ? result : { ...result, ...await campaignTriggerOutput(result) });
     });
     server.registerTool('update_campaign', {
         title: 'Update Campaign',
@@ -3468,7 +3530,7 @@ Return ONLY valid JSON with this exact shape:
     }, async ({ approval_id, ...input }) => {
         if (approval_id) {
             const result = await resumeCampaignEdit('update_campaign', approval_id, input);
-            return j(result.error ? result : { ...result, fires_on: buildCampaignFiresOn(result), trigger_diagnostics: buildCampaignTriggerDiagnostics(result) });
+            return j(result.error ? result : { ...result, ...await campaignTriggerOutput(result) });
         }
         const { campaign_id, name, site_id, segment_id, send_at, topic, trigger_event_name, trigger_tag, trigger_type, trigger_config, type, sends_per_hour, send_in_contact_timezone, send_class, unsub_footer_template, reentry_mode, period_key } = input;
         if (!campaign_id)
@@ -3599,7 +3661,7 @@ Return ONLY valid JSON with this exact shape:
             idempotentHint: true,
             openWorldHint: false,
         },
-        description: 'Get full campaign details including all steps, enrollment counts and saved trigger_type, trigger_event_name, trigger_tag, trigger_config (including where filter), fires_on and trigger_diagnostics. Read what event a dunning campaign fires on; use set_campaign_trigger to change it. ' + ACTIVATION_APPROVAL_DESCRIPTION,
+        description: 'Get full campaign details including all steps, enrollment counts and derived trigger_kind (event/tag/date_field/contact_event/manual), saved trigger_type, trigger_event_name, trigger_tag, trigger_config (including where filter), fires_on and trigger_diagnostics. Read what event a dunning campaign fires on; use set_campaign_trigger to change it. ' + ACTIVATION_APPROVAL_DESCRIPTION,
         inputSchema: { campaign_id: z.string().uuid(), period: z.string().min(1).optional().describe("Return results for one enrollment period; totals remain all-time.") },
     }, async ({ campaign_id, period }) => {
         const projectId = getProjectId();
@@ -3672,8 +3734,7 @@ Return ONLY valid JSON with this exact shape:
             ...campaign,
             reentry_mode: campaign.period_key ? "per_event_period" : "once_ever",
             requires_approval_description: ACTIVATION_APPROVAL_DESCRIPTION,
-            fires_on: buildCampaignFiresOn(campaign),
-            trigger_diagnostics: buildCampaignTriggerDiagnostics(campaign),
+            ...await campaignTriggerOutput(campaign),
             total_sent: periods?.totals?.sent ?? sentCount ?? 0,
             ...(periods?.totals ? { unique_opened: periods.totals.opened, unique_clicked: periods.totals.clicked } : {}),
             ...campaignPeriodFields(periods, period),

package/build/tools/contacts.js

@@ -24,6 +24,40 @@ const CUSTOM_FIELD_TYPES = [
     'multi_select', 'contact_reference',
 ];
 const CUSTOM_FIELD_KEY_RE = /^[a-z][a-z0-9_]{0,49}$/;
+// Core contact columns from 001_core_schema.sql and subsequent subscriber migrations.
+const RESERVED_CUSTOM_FIELD_KEYS = new Set([
+    'email', 'first_name', 'last_name', 'id', 'phone', 'status', 'tags', 'project_id', 'org_id', 'user_id',
+    'created_at', 'updated_at', 'clerk_user_id', 'global_unsubscribed', 'global_unsubscribed_at',
+    'source', 'source_site', 'ip_address', 'opted_in_at', 'last_emailed_at', 'last_opened_at',
+    'last_clicked_at', 'total_emails_sent', 'total_opens', 'total_clicks', 'engagement_score',
+    'lifecycle_stage', 'score_updated_at', 'custom_properties', 'timezone', 'last_engaged_at',
+    'utm_source', 'utm_medium', 'utm_campaign', 'utm_content', 'utm_term', 'best_send_hour',
+    'best_send_hour_confidence', 'best_send_hour_updated_at', 'notes', 'birthday', 'anniversary',
+    'external_id', 'imported_from', 'phone_e164', 'sms_opt_in_status', 'sms_opt_in_at',
+    'sms_opt_out_at', 'is_test', 'company_id', 'source_deleted_at', 'cooled_at', 'cooled_reason',
+    'introduced_by_subscriber_id', 'ccpa_opted_out', 'last_transactional_at',
+    'total_transactional_sent', 'last_activity_at',
+]);
+const CUSTOM_FIELD_COLUMNS = 'id, key, label, type, required, options, display_order';
+async function registeredCustomFields(projectId) {
+    return readAllRows(db().from('custom_field_definitions').select(CUSTOM_FIELD_COLUMNS).eq('project_id', projectId));
+}
+function keyDistance(left, right) {
+    let row = Array.from({ length: right.length + 1 }, (_, index) => index);
+    for (let i = 0; i < left.length; i++) {
+        const next = [i + 1];
+        for (let j = 0; j < right.length; j++)
+            next.push(Math.min(next[j] + 1, row[j + 1] + 1, row[j] + (left[i] === right[j] ? 0 : 1)));
+        row = next;
+    }
+    return row[right.length];
+}
+function unknownCustomPropertyWarnings(patch, fields) {
+    return Object.keys(patch).filter(key => !Object.hasOwn(fields, key)).map(key => {
+        const near = Object.keys(fields).filter(known => keyDistance(key, known) <= 2);
+        return `Unknown custom property "${key}"${near.length ? `; did you mean ${near.map(value => `"${value}"`).join(' or ')}?` : '; no registered definition'}`;
+    });
+}
 const SUBSCRIBER_VIEW_MAX_NAME_LENGTH = 100;
 const SUBSCRIBER_VIEW_MAX_COLUMNS = 150;
 const SUBSCRIBER_VIEW_KEY_RE = /^[a-zA-Z0-9_.:-]{1,160}$/;
@@ -1670,7 +1704,7 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
             idempotentHint: true,
             openWorldHint: false,
         },
-        description: 'Update a contact\'s email, name, phone, timezone, tags, or custom properties. tags replaces the whole tag set; use set_subscriber_tags to add tags.',
+        description: 'Update a contact\'s email, name, phone, timezone, tags, or custom properties. tags replaces the whole tag set; use set_subscriber_tags to add tags. Registered custom properties must match their type/options; unknown keys remain allowed with warnings and near-miss suggestions.',
         inputSchema: {
             contact_id: z.string().uuid(),
             email: z.string().email().optional(),
@@ -1686,6 +1720,33 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
         },
     }, async ({ contact_id, email, first_name, last_name, company_id, company_name, company_domain, tags, custom_properties, phone_e164, timezone }) => {
         const projectId = getProjectId();
+        let propertyWarnings = [];
+        let fields;
+        if (custom_properties !== undefined) {
+            let definitions;
+            try {
+                definitions = await registeredCustomFields(projectId);
+            }
+            catch {
+                return j({ error: 'Custom field definitions unavailable; update not performed', code: 'INTERNAL_ERROR' });
+            }
+            fields = Object.fromEntries(definitions.map(field => [field.key, field]));
+            const values = Object.fromEntries(Object.entries(custom_properties).filter(([, value]) => value !== null));
+            const invalidShape = Object.entries(values).find(([key, value]) => {
+                if (!Object.hasOwn(fields, key))
+                    return false;
+                const type = fields[key].type;
+                if (type === 'multi_select')
+                    return typeof value !== 'string' && (!Array.isArray(value) || value.some(item => typeof item !== 'string'));
+                return typeof value === 'object' && type !== 'contact_reference';
+            });
+            const { anomalies } = normalizeContactProperties(values, { fields });
+            if (invalidShape || anomalies.length) {
+                const key = invalidShape?.[0] ?? anomalies[0].key;
+                return contactInputError('validation_failed', `custom_properties.${key} does not match its registered ${fields[key].type} definition or options`);
+            }
+            propertyWarnings = unknownCustomPropertyWarnings(custom_properties, fields);
+        }
         const embedOk = await hasCompaniesEmbed(projectId);
         const updates = {};
         let customPropertyChanges = [];
@@ -1707,18 +1768,23 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
         if (tags !== undefined)
             updates.tags = tags;
         if (custom_properties !== undefined) {
-            const { data: existing } = await db()
+            const { data: existing, error: existingError } = await db()
                 .from('subscribers')
                 .select('custom_properties')
                 .eq('id', contact_id)
                 .eq('project_id', projectId)
                 .maybeSingle();
+            if (existingError)
+                return j({ error: 'Contact properties unavailable; update not performed', code: 'INTERNAL_ERROR' });
+            if (!existing)
+                return contactInputError('not_found', 'Contact not found');
             const orgId = await getProjectOrgId(projectId);
             const normalizedPatch = await normalizeMcpContactPropertyPatch(custom_properties, {
                 orgId,
                 projectId,
                 subscriberId: contact_id,
                 preserveNullDeletions: true,
+                fields,
             });
             customPropertyChanges = diffCustomProperties(existing?.custom_properties ?? null, normalizedPatch);
             updates.custom_properties = {
@@ -1780,7 +1846,7 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
             }
         }
         if (!Object.keys(updates).length)
-            return txt('No fields to update.');
+            return contactInputError('validation_failed', 'No fields to update.');
         const tagResult = {};
         if (tags !== undefined) {
             let previousTags;
@@ -1820,10 +1886,10 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
             .select(embedOk ? UPDATE_SUBSCRIBER_SELECT_WITH_COMPANY : UPDATE_SUBSCRIBER_SELECT_NO_COMPANY)
             .single();
         if (error?.code === '23505' && updates.phone_e164 !== undefined) {
-            return contactInputError('validation_failed', 'Another contact in this project already has this phone number.');
+            return contactInputError('conflict', 'Another contact in this project already has this phone number.');
         }
         if (error)
-            return txt(`Error: ${error.message}`);
+            return j({ error: `Error: ${error.message}`, code: 'INTERNAL_ERROR' });
         if (customPropertyChanges.length > 0) {
             logAudit({
                 action: 'contact.custom_properties_changed',
@@ -1839,7 +1905,8 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
             ...(updates.tags !== undefined ? { tags: updates.tags } : {}),
             ...(updates.custom_properties !== undefined ? { custom_properties: updates.custom_properties } : {}),
         });
-        return j({ ...data, ...tagResult });
+        const mergedWarnings = [...(tagResult.warnings ?? []), ...propertyWarnings];
+        return j({ ...data, ...tagResult, ...(mergedWarnings.length ? { warnings: mergedWarnings } : {}) });
     });
     server.registerTool('get_subscriber', {
         title: 'Get Subscriber',
@@ -2515,7 +2582,7 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
             idempotentHint: true,
             openWorldHint: false,
         },
-        description: 'Discover all custom_properties keys used across contacts for a site. Returns the list of keys, example values, and merge tag syntax so you can use them in campaigns. Call this before generating emails to know what personalisation data is available.',
+        description: 'Discover registered custom field definitions and all custom_properties keys used across contacts for a site, including unused definitions. Returns the list of keys, example values, and merge tag syntax so you can use them in campaigns. Call this before generating emails to know what personalisation data is available.',
         inputSchema: {
             site_id: z.string().uuid().describe('Site to inspect — only contacts belonging to this site are sampled'),
         },
@@ -2539,20 +2606,34 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
         // site-scoped; project scope is only for a site with no members at all.
         let loaded = await loadSchemaKeys(site_id);
         if ('error' in loaded)
-            return txt(loaded.error);
+            return j({ error: loaded.error, code: 'INTERNAL_ERROR' });
         let scope = 'site';
         if (!loaded.has_membership) {
             loaded = await loadSchemaKeys(null);
             if ('error' in loaded)
-                return txt(loaded.error);
+                return j({ error: loaded.error, code: 'INTERNAL_ERROR' });
             scope = 'project';
         }
-        const schema = loaded.keys.map(({ key, contacts_with_this_key, example_values }) => ({
+        let definitions;
+        try {
+            definitions = await registeredCustomFields(projectId);
+        }
+        catch {
+            return j({ error: 'Custom field definitions unavailable', code: 'INTERNAL_ERROR' });
+        }
+        const byKey = new Map(definitions.map(field => [field.key, field]));
+        const keys = [...loaded.keys];
+        const observed = new Set(keys.map(row => row.key));
+        for (const field of definitions)
+            if (!observed.has(field.key))
+                keys.push({ key: field.key, contacts_with_this_key: 0, example_values: [] });
+        const schema = keys.map(({ key, contacts_with_this_key, example_values }) => ({
             key,
             merge_tag: `{{custom.${key}}}`,
             merge_tag_with_fallback: `{{custom.${key}|fallback}}`,
             example_values,
             contacts_with_this_key,
+            ...(byKey.has(key) ? { definition: byKey.get(key) } : {}),
         }));
         return j({
             site_id,
@@ -2564,6 +2645,20 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
                 : 'Use merge_tag syntax in email body/subject. For sensitive data, add a fallback: {{custom.plan|subscriber}}. ⚠️ custom_properties data passes through the Anthropic API — avoid storing sensitive PII (SSNs, passwords, financial account numbers).',
         });
     });
+    server.registerTool('list_custom_fields', {
+        title: 'List Custom Fields',
+        annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+        description: 'List all registered custom field definitions for the current project, including fields with no contact values yet.',
+        inputSchema: {},
+    }, async () => {
+        try {
+            const fields = await registeredCustomFields(getProjectId());
+            return j({ fields, count: fields.length });
+        }
+        catch {
+            return j({ error: 'Custom field definitions unavailable', code: 'INTERNAL_ERROR' });
+        }
+    });
     server.registerTool('create_custom_field', {
         title: 'Create Custom Field',
         annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
@@ -2577,9 +2672,11 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
             display_order: z.number().int().optional().default(0),
         },
     }, async ({ key, label, type, required, options, display_order }) => {
+        if (RESERVED_CUSTOM_FIELD_KEYS.has(key))
+            return contactInputError('validation_failed', `Custom field key "${key}" is reserved for a core contact column`);
         const optionsError = validateCustomFieldOptions(type, options);
         if (optionsError)
-            return txt(`Error: ${optionsError}`);
+            return contactInputError('validation_failed', `Error: ${optionsError}`);
         const normalizedOptions = type === 'select' || type === 'multi_select'
             ? normalizeCustomFieldOptions(options)
             : null;
@@ -2601,8 +2698,8 @@ Requirements: urgency without desperation, acknowledge the gap, one clear CTA, v
             .single();
         if (error) {
             if (error.code === '23505')
-                return txt(`Error: A custom field with key "${key}" already exists.`);
-            return txt(`Error: ${error.message}`);
+                return contactInputError('conflict', `Error: A custom field with key "${key}" already exists.`);
+            return j({ error: `Error: ${error.message}`, code: 'INTERNAL_ERROR' });
         }
         await logAudit({
             action: 'custom_field.created',

package/build/tools/content.js

@@ -2,6 +2,7 @@ import { withApproval } from '../lib/action-approvals.js';
 import { z } from 'zod';
 import { adminDb, db } from '../db.js';
 import { getProjectId } from '../project.js';
+import { assertHttpUrl } from '../lib/url-validation.js';
 const j = (data) => ({ content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] });
 const BLOG_IMAGE_FORMATS = ['square_image', 'story_image', 'animated_gif', 'short_video', 'carousel'];
 const BLOG_IMAGE_GOALS = ['generate_leads', 'educate', 'launch_offer', 'build_trust'];
@@ -106,6 +107,12 @@ export function registerContentTools(server) {
             gate_body: z.string().max(1000).optional(),
         },
     }, async ({ title, slug, asset_url, asset_type = 'page', site_id, source_attribution, gate_headline, gate_body }) => {
+        try {
+            assertHttpUrl(asset_url);
+        }
+        catch {
+            return j({ error: 'asset_url must use http or https', code: 'validation_failed' });
+        }
         const { data, error } = await db().from('asset_links')
             .insert({
             project_id: getProjectId(),
@@ -120,6 +127,8 @@ export function registerContentTools(server) {
         })
             .select('id, title, slug, asset_type, status, source_attribution, gate_headline, gate_body, total_views, total_captures, created_at')
             .single();
+        if (error?.code === '23505')
+            return j({ error: 'slug already exists', code: 'conflict' });
         if (error)
             return j({ error: error.message, code: error.code });
         const appUrl = process.env.NEXT_PUBLIC_APP_URL ?? process.env.SENDINEL_APP_URL ?? 'https://sendinel.ai';

package/build/tools/delivery-ops.js

@@ -97,8 +97,12 @@ export function registerDeliveryOpsTools(server) {
             reason: z.string().optional().describe('Optional human-readable reason'),
         },
     }, async ({ date, reason }) => {
-        if (Number.isNaN(new Date(`${date}T00:00:00Z`).getTime())) {
-            return j({ error: 'date must be a valid YYYY-MM-DD date' });
+        const parsed = new Date(`${date}T00:00:00Z`);
+        if (!/^\d{4}-\d{2}-\d{2}$/.test(date) || Number.isNaN(parsed.getTime()) || parsed.toISOString().slice(0, 10) !== date) {
+            return j({ error: 'date must be a valid YYYY-MM-DD date', code: 'validation_failed' });
+        }
+        if (date < new Date().toISOString().slice(0, 10)) {
+            return j({ error: 'date must be today or later (UTC)', code: 'validation_failed' });
         }
         const { data, error } = await db()
             .from('blackout_dates')

package/build/tools/forms.js

@@ -1,6 +1,7 @@
 import { z } from 'zod';
 import { db } from '../db.js';
 import { getProjectId } from '../project.js';
+import { assertHttpUrl } from '../lib/url-validation.js';
 const j = (data) => ({ content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] });
 export function registerFormTools(server) {
     server.registerTool('list_forms', {
@@ -14,7 +15,7 @@ export function registerFormTools(server) {
         description: 'List forms with destination, field, and submission counts.',
         inputSchema: { site_id: z.string().uuid().optional() },
     }, async ({ site_id }) => {
-        let query = db().from('signup_forms').select('id, name, slug, fields, status, submissions, site_id, form_type, created_at').eq('project_id', getProjectId()).order('created_at', { ascending: false });
+        let query = db().from('signup_forms').select('id, name, slug, fields, status, submissions, site_id, form_type, settings, created_at').eq('project_id', getProjectId()).order('created_at', { ascending: false });
         if (site_id)
             query = query.eq('site_id', site_id);
         const { data, error } = await query;
@@ -68,13 +69,39 @@ export function registerFormTools(server) {
             form_type: z.enum(['signup', 'management']).optional(),
         },
     }, async ({ site_id, name, fields, redirect_url, double_opt_in, form_type }) => {
+        if (!fields.length)
+            return j({ error: 'fields must contain at least one field', code: 'validation_failed' });
+        const names = new Set();
+        for (const field of fields) {
+            if (typeof field.name !== 'string' || !/^[a-z][a-z0-9_]{0,49}$/.test(field.name) ||
+                typeof field.type !== 'string' || !['email', 'text', 'textarea', 'select', 'checkbox', 'number', 'tel', 'url', 'date'].includes(field.type)) {
+                return j({ error: 'Each field needs a name (lowercase snake_case) and a supported type', code: 'validation_failed' });
+            }
+            if (names.has(field.name))
+                return j({ error: `Duplicate field name: ${field.name}`, code: 'validation_failed' });
+            names.add(field.name);
+        }
+        // The public handler always reads fields.email to identify the subscriber.
+        if (!fields.some(field => field.name === 'email' && field.type === 'email')) {
+            return j({ error: 'fields must include an email field named email', code: 'validation_failed' });
+        }
+        if (redirect_url !== undefined) {
+            try {
+                assertHttpUrl(redirect_url);
+            }
+            catch {
+                return j({ error: 'redirect_url must use http or https', code: 'validation_failed' });
+            }
+        }
         const slug = name.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 80);
         const { data, error } = await db().from('signup_forms')
             .insert({ project_id: getProjectId(), site_id, name, slug, fields, settings: { redirect_url: redirect_url ?? null, double_opt_in: double_opt_in ?? false }, form_type: form_type ?? 'signup', status: 'active' })
-            .select('id, name, slug, fields, status, form_type')
+            .select('id, name, slug, fields, status, form_type, settings')
             .single();
+        if (error?.code === '23505')
+            return j({ error: 'slug already exists', code: 'conflict' });
         if (error)
-            return j({ error: error.message });
+            return j({ error: error.message, code: 'INTERNAL_ERROR' });
         return j({ form: data });
     });
 }

package/build/tools/newsletters.js

@@ -1,5 +1,6 @@
 import { withApproval } from '../lib/action-approvals.js';
 import { z } from 'zod';
+import { stripActiveEmailContent } from '@sendinel/domain';
 import { db } from '../db.js';
 import { getProjectId } from '../project.js';
 import { parseFutureDate } from '../lib/schedule.js';
@@ -23,6 +24,20 @@ async function getProjectOrgId(projectId) {
     const { data } = await db().from('projects').select('org_id').eq('id', projectId).maybeSingle();
     return data?.org_id ?? null;
 }
+async function validateNewsletterSender(projectId, email) {
+    const domain = email.slice(email.lastIndexOf('@') + 1).toLowerCase();
+    const { data: sendingDomain, error } = await db().from('domains').select('id')
+        .eq('project_id', projectId).eq('name', domain).eq('status', 'verified').maybeSingle();
+    if (error)
+        return { error: 'Sending domain verification unavailable', code: 'INTERNAL_ERROR' };
+    if (!sendingDomain)
+        return { error: 'sender_email must use a verified sending domain of a project site', code: 'validation_failed' };
+    const { data: site, error: siteError } = await db().from('sites').select('id')
+        .eq('project_id', projectId).eq('domain_id', sendingDomain.id).limit(1).maybeSingle();
+    if (siteError)
+        return { error: 'Sending site verification unavailable', code: 'INTERNAL_ERROR' };
+    return site ? null : { error: 'sender_email must use a verified sending domain of a project site', code: 'validation_failed' };
+}
 async function loadSendableIssue(newsletterId, issueId, projectId) {
     const [{ data: newsletter, error: newsletterError }, { data: issue, error: issueError }] = await Promise.all([
         db().from('newsletters')
@@ -195,15 +210,15 @@ export function registerNewsletterTools(server) {
             idempotentHint: false,
             openWorldHint: false,
         },
-        description: 'Create a newsletter publication for the current project.',
+        description: 'Create a newsletter publication for the current project. Explicit sender_email must use a verified domain linked to a project site.',
         inputSchema: {
             name: z.string().min(1).max(200),
             slug: z.string().optional(),
             description: z.string().optional(),
             site_id: z.string().uuid().nullable().optional(),
             sender_name: z.string().optional(),
-            sender_email: z.string().optional(),
-            reply_to: z.string().optional(),
+            sender_email: z.string().email().optional(),
+            reply_to: z.string().email().optional(),
             cadence: z.string().optional(),
             branding: z.record(z.string(), z.unknown()).optional(),
             public_signup_enabled: z.boolean().default(true).optional(),
@@ -212,6 +227,11 @@ export function registerNewsletterTools(server) {
         },
     }, async (args) => {
         const projectId = getProjectId();
+        if (args.sender_email) {
+            const senderError = await validateNewsletterSender(projectId, args.sender_email);
+            if (senderError)
+                return j(senderError);
+        }
         const orgId = await getProjectOrgId(projectId);
         if (!orgId)
             return j({ error: 'Organization not found for project', code: 'NOT_FOUND' });
@@ -233,8 +253,10 @@ export function registerNewsletterTools(server) {
             source: 'mcp',
             source_payload: args,
         }).select(NEWSLETTER_COLUMNS).single();
+        if (error?.code === '23505')
+            return j({ error: 'slug already exists', code: 'conflict' });
         if (error)
-            return j({ error: error.message, code: error.code === '23505' ? 'CONFLICT' : undefined });
+            return j({ error: error.message, code: 'INTERNAL_ERROR' });
         return j(data);
     });
     server.registerTool('update_newsletter', {
@@ -245,7 +267,7 @@ export function registerNewsletterTools(server) {
             idempotentHint: true,
             openWorldHint: false,
         },
-        description: 'Update newsletter publication settings.',
+        description: 'Update newsletter publication settings. Explicit sender_email must use a verified domain linked to a project site.',
         inputSchema: {
             newsletter_id: z.string().uuid(),
             name: z.string().max(200).optional(),
@@ -253,8 +275,8 @@ export function registerNewsletterTools(server) {
             description: z.string().nullable().optional(),
             site_id: z.string().uuid().nullable().optional(),
             sender_name: z.string().nullable().optional(),
-            sender_email: z.string().nullable().optional(),
-            reply_to: z.string().nullable().optional(),
+            sender_email: z.string().email().nullable().optional(),
+            reply_to: z.string().email().nullable().optional(),
             cadence: z.string().nullable().optional(),
             branding: z.record(z.string(), z.unknown()).optional(),
             public_signup_enabled: z.boolean().optional(),
@@ -262,6 +284,11 @@ export function registerNewsletterTools(server) {
             status: z.enum(['active', 'paused', 'archived']).optional(),
         },
     }, async ({ newsletter_id, ...fields }) => {
+        if (fields.sender_email) {
+            const senderError = await validateNewsletterSender(getProjectId(), fields.sender_email);
+            if (senderError)
+                return j(senderError);
+        }
         const updates = Object.fromEntries(Object.entries(fields).filter(([, value]) => value !== undefined));
         if (updates.slug && typeof updates.slug === 'string')
             updates.slug = slugifyNewsletter(updates.slug);
@@ -273,8 +300,10 @@ export function registerNewsletterTools(server) {
             .eq('project_id', getProjectId())
             .select(NEWSLETTER_COLUMNS)
             .maybeSingle();
+        if (error?.code === '23505')
+            return j({ error: 'slug already exists', code: 'conflict' });
         if (error)
-            return j({ error: error.message, code: error.code === '23505' ? 'CONFLICT' : undefined });
+            return j({ error: error.message, code: 'INTERNAL_ERROR' });
         if (!data)
             return j({ error: 'Newsletter not found', code: 'NOT_FOUND' });
         return j(data);
@@ -287,7 +316,7 @@ export function registerNewsletterTools(server) {
             idempotentHint: false,
             openWorldHint: false,
         },
-        description: 'Create a draft issue for a newsletter.',
+        description: 'Create a draft issue for a newsletter. Refuses active HTML or executable URLs using the shared email safety filter.',
         inputSchema: {
             newsletter_id: z.string().uuid(),
             subject: z.string().min(1).max(300),
@@ -295,6 +324,9 @@ export function registerNewsletterTools(server) {
             preheader: z.string().optional(),
         },
     }, async ({ newsletter_id, subject, content, preheader }) => {
+        if (content !== undefined && stripActiveEmailContent(content).removed.length) {
+            return j({ error: 'Issue content contains active HTML or executable URLs; remove them before saving', code: 'validation_failed' });
+        }
         const projectId = getProjectId();
         const { data: newsletter, error: newsletterError } = await db().from('newsletters').select('id, org_id').eq('id', newsletter_id).eq('project_id', projectId).maybeSingle();
         if (newsletterError)

package/build/tools/short-links.js

@@ -2,6 +2,7 @@ import QRCode from 'qrcode';
 import { z } from 'zod';
 import { db } from '../db.js';
 import { getProjectId } from '../project.js';
+import { assertHttpUrl, RESERVED_LINK_SLUGS } from '../lib/url-validation.js';
 const txt = (text) => ({ content: [{ type: 'text', text }] });
 const j = (data) => txt(JSON.stringify(data, null, 2));
 const VANITY_SLUG_RE = /^[a-zA-Z0-9-]{3,40}$/;
@@ -9,13 +10,6 @@ const PAID_PLANS = new Set(['byod', 'managed', 'agency-plus', 'enterprise']);
 function appBaseUrl() {
     return (process.env.NEXT_PUBLIC_APP_URL ?? process.env.SENDINEL_APP_URL ?? process.env.APP_URL ?? 'https://sendinel.ai').replace(/\/$/, '');
 }
-function assertHttpUrl(raw) {
-    const url = new URL(raw);
-    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
-        throw new Error('Only http and https URLs are supported.');
-    }
-    return url.toString();
-}
 function normalizeColor(input, fallback) {
     const value = input?.trim() || fallback;
     if (!/^#([0-9a-f]{3}|[0-9a-f]{4}|[0-9a-f]{6}|[0-9a-f]{8})$/i.test(value))
@@ -41,21 +35,31 @@ export function registerShortLinkTools(server) {
         const projectId = getProjectId();
         const { data: project } = await db().from('projects').select('org_id, plan').eq('id', projectId).maybeSingle();
         if (!project?.org_id)
-            return j({ error: 'Project not found', code: 'NOT_FOUND' });
+            return j({ error: 'Project not found', code: 'not_found' });
         let destination;
         try {
             destination = assertHttpUrl(destination_url);
         }
         catch (err) {
-            return j({ error: err instanceof Error ? err.message : 'Invalid destination URL', code: 'INVALID_URL' });
+            return j({ error: err instanceof Error ? err.message : 'Invalid destination URL', code: 'validation_failed' });
+        }
+        if (campaign_id) {
+            const { data: campaign, error } = await db().from('campaigns').select('id').eq('id', campaign_id).eq('project_id', projectId).maybeSingle();
+            if (error)
+                return j({ error: error.message, code: 'INTERNAL_ERROR' });
+            if (!campaign)
+                return j({ error: 'Campaign not found in this project', code: 'not_found' });
         }
         const requestedSlug = slug?.trim() || null;
         if (requestedSlug) {
+            if (RESERVED_LINK_SLUGS.has(requestedSlug.toLowerCase())) {
+                return j({ error: 'This slug is reserved for system routes.', code: 'validation_failed' });
+            }
             if (!VANITY_SLUG_RE.test(requestedSlug)) {
-                return j({ error: 'Custom slug must be 3-40 characters and contain only letters, numbers, or hyphens.', code: 'INVALID_SLUG' });
+                return j({ error: 'Custom slug must be 3-40 characters and contain only letters, numbers, or hyphens.', code: 'validation_failed' });
             }
             if (!PAID_PLANS.has(project.plan ?? 'free')) {
-                return j({ error: 'Custom slugs require vanity_slug_access on a paid plan.', code: 'VANITY_SLUG_NOT_ALLOWED' });
+                return j({ error: 'Custom slugs require vanity_slug_access on a paid plan.', code: 'plan_limit' });
             }
         }
         const finalSlug = requestedSlug ?? (await db().rpc('next_short_link_slug')).data;
@@ -74,8 +78,10 @@ export function registerShortLinkTools(server) {
         })
             .select()
             .single();
+        if (error?.code === '23505')
+            return j({ error: 'slug already exists', code: 'conflict' });
         if (error)
-            return j({ error: error.message });
+            return j({ error: error.message, code: 'INTERNAL_ERROR' });
         return j({ short_link: data, short_url: `${appBaseUrl()}/s/${data.slug}` });
     });
     server.registerTool('get_short_link_stats', {
@@ -99,7 +105,7 @@ export function registerShortLinkTools(server) {
         if (linkError)
             return j({ error: linkError.message });
         if (!link)
-            return j({ error: 'Short link not found', code: 'NOT_FOUND' });
+            return j({ error: 'Short link not found', code: 'not_found' });
         const { data: clicks, error: clickError } = await db()
             .from('short_link_clicks')
             .select('clicked_at, ip_hash, referer')
@@ -140,7 +146,7 @@ export function registerShortLinkTools(server) {
             normalizedUrl = assertHttpUrl(url);
         }
         catch (err) {
-            return j({ error: err instanceof Error ? err.message : 'Invalid QR URL', code: 'INVALID_URL' });
+            return j({ error: err instanceof Error ? err.message : 'Invalid QR URL', code: 'validation_failed' });
         }
         const dataUri = await QRCode.toDataURL(normalizedUrl, {
             type: 'image/png',

package/build/tools/surveys.js

@@ -22,10 +22,25 @@ function normalizeQuestions(questions) {
             ...question,
             id,
             label,
-            type: question.type === 'single_choice' ? 'multiple_choice' : question.type,
+            type: question.type,
         };
     });
 }
+function validateQuestions(questions) {
+    const ids = new Set();
+    for (const question of questions) {
+        if (!question.label.trim())
+            return 'Each question needs a non-empty label or text';
+        if (ids.has(question.id))
+            return `Duplicate question id: ${question.id}`;
+        ids.add(question.id);
+        if (['single_choice', 'multi_choice', 'multiple_choice'].includes(question.type) &&
+            (!Array.isArray(question.options) || question.options.length < 2 || question.options.some(option => !option.trim()))) {
+            return `Question ${question.id} needs at least two non-empty options`;
+        }
+    }
+    return null;
+}
 function tallyResponses(responses, questions) {
     return questions.map((question) => {
         const values = responses
@@ -69,13 +84,17 @@ export function registerSurveyTools(server) {
             status: z.enum(['draft', 'active', 'closed']).optional().default('draft'),
         },
     }, async ({ title, questions, site_id, status }) => {
+        const normalized = normalizeQuestions(questions);
+        const validationError = validateQuestions(normalized);
+        if (validationError)
+            return j({ error: validationError, code: 'validation_failed' });
         const projectId = getProjectId();
         const { data: project } = await db().from('projects').select('org_id, plan').eq('id', projectId).maybeSingle();
         if (!project?.org_id)
             return j({ error: 'Project not found', code: 'NOT_FOUND' });
         const { data: survey, error } = await db()
             .from('surveys')
-            .insert({ project_id: projectId, title, questions: normalizeQuestions(questions), status })
+            .insert({ project_id: projectId, title, questions: normalized, status })
             .select()
             .single();
         if (error)
@@ -200,8 +219,26 @@ export function registerSurveyTools(server) {
         const updates = {};
         if (title !== undefined)
             updates.title = title;
-        if (questions !== undefined)
-            updates.questions = normalizeQuestions(questions);
+        if (questions !== undefined || status === 'active') {
+            let candidate = questions;
+            if (candidate === undefined) {
+                const { data: existing, error } = await db().from('surveys').select('questions').eq('id', survey_id).eq('project_id', projectId).maybeSingle();
+                if (error)
+                    return j({ error: error.message, code: 'INTERNAL_ERROR' });
+                if (!existing)
+                    return j({ error: 'Survey not found', code: 'not_found' });
+                candidate = existing.questions;
+            }
+            const parsed = z.array(QUESTION_SCHEMA).min(1).safeParse(candidate);
+            if (!parsed.success)
+                return j({ error: 'Survey questions are invalid', code: 'validation_failed' });
+            const normalized = normalizeQuestions(parsed.data);
+            const validationError = validateQuestions(normalized);
+            if (validationError)
+                return j({ error: validationError, code: 'validation_failed' });
+            if (questions !== undefined)
+                updates.questions = normalized;
+        }
         if (status !== undefined)
             updates.status = status;
         if (Object.keys(updates).length === 0)

package/build/tools/tool-search.js

@@ -12,6 +12,7 @@ export const STOPWORDS = new Set([
  * Only tools that exist in the registry belong here.
  */
 export const TOOL_ALIASES = {
+    list_custom_fields: ['custom fields', 'field definitions', 'contact schema', 'unused fields'],
     update_site: ['footer', 'email footer', 'unsubscribe text', 'unsubscribe link', 'site footer', 'unsubscribe settings'],
     set_campaign_trigger: ['trigger', 'event', 'fires on', 'fires-on', 'dunning', 'set campaign trigger event name', 'invoice payment failed', 'payment failed', 'trial ending', 'event trigger', 'billing'],
     create_campaign_with_content: ['billing', 'dunning', 'trial ending', 'transactional', 'payment failed', 'product email', 'event-driven billing mail'],

package/build/tools/webhooks.js

@@ -29,14 +29,14 @@ export function registerWebhookTools(server) {
     server.registerTool('list_sandbox_webhook_events', {
         title: 'List Sandbox Webhook Events',
         annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
-        description: 'Read recent captured webhook requests for the active sandbox project (seven-day retention). Never returns sink tokens.',
+        description: 'Read recent captured webhook requests for the active sandbox project (seven-day retention). Returns only allowlisted safe headers; never returns sink tokens.',
         inputSchema: { limit: z.number().int().min(1).max(100).optional().default(20) },
     }, async ({ limit }) => {
         try {
             return j({ events: await listSandboxWebhookEvents(adminDb(), getProjectId(), limit) });
         }
         catch {
-            return txt('Sandbox webhook events unavailable.');
+            return j({ error: 'Sandbox webhook events unavailable.', code: 'forbidden' });
         }
     });
     server.registerTool('subscribe_webhook', {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendinel/mcp-server",
-  "version": "1.0.138",
+  "version": "1.0.139",
   "description": "AI-controlled email operations control plane for campaigns, contacts, segments, analytics, and multi-provider sending via MCP.",
   "mcpName": "ai.sendinel/mcp-server",
   "type": "module",