@sendinel/mcp-server 1.0.138 → 1.0.140

package/build/tools/content.js

@@ -2,6 +2,7 @@ import { withApproval } from '../lib/action-approvals.js';
 import { z } from 'zod';
 import { adminDb, db } from '../db.js';
 import { getProjectId } from '../project.js';
+import { assertHttpUrl } from '../lib/url-validation.js';
 const j = (data) => ({ content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] });
 const BLOG_IMAGE_FORMATS = ['square_image', 'story_image', 'animated_gif', 'short_video', 'carousel'];
 const BLOG_IMAGE_GOALS = ['generate_leads', 'educate', 'launch_offer', 'build_trust'];
@@ -106,6 +107,12 @@ export function registerContentTools(server) {
             gate_body: z.string().max(1000).optional(),
         },
     }, async ({ title, slug, asset_url, asset_type = 'page', site_id, source_attribution, gate_headline, gate_body }) => {
+        try {
+            assertHttpUrl(asset_url);
+        }
+        catch {
+            return j({ error: 'asset_url must use http or https', code: 'validation_failed' });
+        }
         const { data, error } = await db().from('asset_links')
             .insert({
             project_id: getProjectId(),
@@ -120,6 +127,8 @@ export function registerContentTools(server) {
         })
             .select('id, title, slug, asset_type, status, source_attribution, gate_headline, gate_body, total_views, total_captures, created_at')
             .single();
+        if (error?.code === '23505')
+            return j({ error: 'slug already exists', code: 'conflict' });
         if (error)
             return j({ error: error.message, code: error.code });
         const appUrl = process.env.NEXT_PUBLIC_APP_URL ?? process.env.SENDINEL_APP_URL ?? 'https://sendinel.ai';

package/build/tools/delivery-ops.js

@@ -97,8 +97,12 @@ export function registerDeliveryOpsTools(server) {
             reason: z.string().optional().describe('Optional human-readable reason'),
         },
     }, async ({ date, reason }) => {
-        if (Number.isNaN(new Date(`${date}T00:00:00Z`).getTime())) {
-            return j({ error: 'date must be a valid YYYY-MM-DD date' });
+        const parsed = new Date(`${date}T00:00:00Z`);
+        if (!/^\d{4}-\d{2}-\d{2}$/.test(date) || Number.isNaN(parsed.getTime()) || parsed.toISOString().slice(0, 10) !== date) {
+            return j({ error: 'date must be a valid YYYY-MM-DD date', code: 'validation_failed' });
+        }
+        if (date < new Date().toISOString().slice(0, 10)) {
+            return j({ error: 'date must be today or later (UTC)', code: 'validation_failed' });
         }
         const { data, error } = await db()
             .from('blackout_dates')

package/build/tools/forms.js

@@ -1,6 +1,7 @@
 import { z } from 'zod';
 import { db } from '../db.js';
 import { getProjectId } from '../project.js';
+import { assertHttpUrl } from '../lib/url-validation.js';
 const j = (data) => ({ content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] });
 export function registerFormTools(server) {
     server.registerTool('list_forms', {
@@ -14,7 +15,7 @@ export function registerFormTools(server) {
         description: 'List forms with destination, field, and submission counts.',
         inputSchema: { site_id: z.string().uuid().optional() },
     }, async ({ site_id }) => {
-        let query = db().from('signup_forms').select('id, name, slug, fields, status, submissions, site_id, form_type, created_at').eq('project_id', getProjectId()).order('created_at', { ascending: false });
+        let query = db().from('signup_forms').select('id, name, slug, fields, status, submissions, site_id, form_type, settings, created_at').eq('project_id', getProjectId()).order('created_at', { ascending: false });
         if (site_id)
             query = query.eq('site_id', site_id);
         const { data, error } = await query;
@@ -68,13 +69,39 @@ export function registerFormTools(server) {
             form_type: z.enum(['signup', 'management']).optional(),
         },
     }, async ({ site_id, name, fields, redirect_url, double_opt_in, form_type }) => {
+        if (!fields.length)
+            return j({ error: 'fields must contain at least one field', code: 'validation_failed' });
+        const names = new Set();
+        for (const field of fields) {
+            if (typeof field.name !== 'string' || !/^[a-z][a-z0-9_]{0,49}$/.test(field.name) ||
+                typeof field.type !== 'string' || !['email', 'text', 'textarea', 'select', 'checkbox', 'number', 'tel', 'url', 'date'].includes(field.type)) {
+                return j({ error: 'Each field needs a name (lowercase snake_case) and a supported type', code: 'validation_failed' });
+            }
+            if (names.has(field.name))
+                return j({ error: `Duplicate field name: ${field.name}`, code: 'validation_failed' });
+            names.add(field.name);
+        }
+        // The public handler always reads fields.email to identify the subscriber.
+        if (!fields.some(field => field.name === 'email' && field.type === 'email')) {
+            return j({ error: 'fields must include an email field named email', code: 'validation_failed' });
+        }
+        if (redirect_url !== undefined) {
+            try {
+                assertHttpUrl(redirect_url);
+            }
+            catch {
+                return j({ error: 'redirect_url must use http or https', code: 'validation_failed' });
+            }
+        }
         const slug = name.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 80);
         const { data, error } = await db().from('signup_forms')
             .insert({ project_id: getProjectId(), site_id, name, slug, fields, settings: { redirect_url: redirect_url ?? null, double_opt_in: double_opt_in ?? false }, form_type: form_type ?? 'signup', status: 'active' })
-            .select('id, name, slug, fields, status, form_type')
+            .select('id, name, slug, fields, status, form_type, settings')
             .single();
+        if (error?.code === '23505')
+            return j({ error: 'slug already exists', code: 'conflict' });
         if (error)
-            return j({ error: error.message });
+            return j({ error: error.message, code: 'INTERNAL_ERROR' });
         return j({ form: data });
     });
 }

package/build/tools/newsletters.js

@@ -1,5 +1,6 @@
 import { withApproval } from '../lib/action-approvals.js';
 import { z } from 'zod';
+import { stripActiveEmailContent } from '@sendinel/domain';
 import { db } from '../db.js';
 import { getProjectId } from '../project.js';
 import { parseFutureDate } from '../lib/schedule.js';
@@ -23,6 +24,20 @@ async function getProjectOrgId(projectId) {
     const { data } = await db().from('projects').select('org_id').eq('id', projectId).maybeSingle();
     return data?.org_id ?? null;
 }
+async function validateNewsletterSender(projectId, email) {
+    const domain = email.slice(email.lastIndexOf('@') + 1).toLowerCase();
+    const { data: sendingDomain, error } = await db().from('domains').select('id')
+        .eq('project_id', projectId).eq('name', domain).eq('status', 'verified').maybeSingle();
+    if (error)
+        return { error: 'Sending domain verification unavailable', code: 'INTERNAL_ERROR' };
+    if (!sendingDomain)
+        return { error: 'sender_email must use a verified sending domain of a project site', code: 'validation_failed' };
+    const { data: site, error: siteError } = await db().from('sites').select('id')
+        .eq('project_id', projectId).eq('domain_id', sendingDomain.id).limit(1).maybeSingle();
+    if (siteError)
+        return { error: 'Sending site verification unavailable', code: 'INTERNAL_ERROR' };
+    return site ? null : { error: 'sender_email must use a verified sending domain of a project site', code: 'validation_failed' };
+}
 async function loadSendableIssue(newsletterId, issueId, projectId) {
     const [{ data: newsletter, error: newsletterError }, { data: issue, error: issueError }] = await Promise.all([
         db().from('newsletters')
@@ -195,15 +210,15 @@ export function registerNewsletterTools(server) {
             idempotentHint: false,
             openWorldHint: false,
         },
-        description: 'Create a newsletter publication for the current project.',
+        description: 'Create a newsletter publication for the current project. Explicit sender_email must use a verified domain linked to a project site.',
         inputSchema: {
             name: z.string().min(1).max(200),
             slug: z.string().optional(),
             description: z.string().optional(),
             site_id: z.string().uuid().nullable().optional(),
             sender_name: z.string().optional(),
-            sender_email: z.string().optional(),
-            reply_to: z.string().optional(),
+            sender_email: z.string().email().optional(),
+            reply_to: z.string().email().optional(),
             cadence: z.string().optional(),
             branding: z.record(z.string(), z.unknown()).optional(),
             public_signup_enabled: z.boolean().default(true).optional(),
@@ -212,6 +227,11 @@ export function registerNewsletterTools(server) {
         },
     }, async (args) => {
         const projectId = getProjectId();
+        if (args.sender_email) {
+            const senderError = await validateNewsletterSender(projectId, args.sender_email);
+            if (senderError)
+                return j(senderError);
+        }
         const orgId = await getProjectOrgId(projectId);
         if (!orgId)
             return j({ error: 'Organization not found for project', code: 'NOT_FOUND' });
@@ -233,8 +253,10 @@ export function registerNewsletterTools(server) {
             source: 'mcp',
             source_payload: args,
         }).select(NEWSLETTER_COLUMNS).single();
+        if (error?.code === '23505')
+            return j({ error: 'slug already exists', code: 'conflict' });
         if (error)
-            return j({ error: error.message, code: error.code === '23505' ? 'CONFLICT' : undefined });
+            return j({ error: error.message, code: 'INTERNAL_ERROR' });
         return j(data);
     });
     server.registerTool('update_newsletter', {
@@ -245,7 +267,7 @@ export function registerNewsletterTools(server) {
             idempotentHint: true,
             openWorldHint: false,
         },
-        description: 'Update newsletter publication settings.',
+        description: 'Update newsletter publication settings. Explicit sender_email must use a verified domain linked to a project site.',
         inputSchema: {
             newsletter_id: z.string().uuid(),
             name: z.string().max(200).optional(),
@@ -253,8 +275,8 @@ export function registerNewsletterTools(server) {
             description: z.string().nullable().optional(),
             site_id: z.string().uuid().nullable().optional(),
             sender_name: z.string().nullable().optional(),
-            sender_email: z.string().nullable().optional(),
-            reply_to: z.string().nullable().optional(),
+            sender_email: z.string().email().nullable().optional(),
+            reply_to: z.string().email().nullable().optional(),
             cadence: z.string().nullable().optional(),
             branding: z.record(z.string(), z.unknown()).optional(),
             public_signup_enabled: z.boolean().optional(),
@@ -262,6 +284,11 @@ export function registerNewsletterTools(server) {
             status: z.enum(['active', 'paused', 'archived']).optional(),
         },
     }, async ({ newsletter_id, ...fields }) => {
+        if (fields.sender_email) {
+            const senderError = await validateNewsletterSender(getProjectId(), fields.sender_email);
+            if (senderError)
+                return j(senderError);
+        }
         const updates = Object.fromEntries(Object.entries(fields).filter(([, value]) => value !== undefined));
         if (updates.slug && typeof updates.slug === 'string')
             updates.slug = slugifyNewsletter(updates.slug);
@@ -273,8 +300,10 @@ export function registerNewsletterTools(server) {
             .eq('project_id', getProjectId())
             .select(NEWSLETTER_COLUMNS)
             .maybeSingle();
+        if (error?.code === '23505')
+            return j({ error: 'slug already exists', code: 'conflict' });
         if (error)
-            return j({ error: error.message, code: error.code === '23505' ? 'CONFLICT' : undefined });
+            return j({ error: error.message, code: 'INTERNAL_ERROR' });
         if (!data)
             return j({ error: 'Newsletter not found', code: 'NOT_FOUND' });
         return j(data);
@@ -287,7 +316,7 @@ export function registerNewsletterTools(server) {
             idempotentHint: false,
             openWorldHint: false,
         },
-        description: 'Create a draft issue for a newsletter.',
+        description: 'Create a draft issue for a newsletter. Refuses active HTML or executable URLs using the shared email safety filter.',
         inputSchema: {
             newsletter_id: z.string().uuid(),
             subject: z.string().min(1).max(300),
@@ -295,6 +324,9 @@ export function registerNewsletterTools(server) {
             preheader: z.string().optional(),
         },
     }, async ({ newsletter_id, subject, content, preheader }) => {
+        if (content !== undefined && stripActiveEmailContent(content).removed.length) {
+            return j({ error: 'Issue content contains active HTML or executable URLs; remove them before saving', code: 'validation_failed' });
+        }
         const projectId = getProjectId();
         const { data: newsletter, error: newsletterError } = await db().from('newsletters').select('id, org_id').eq('id', newsletter_id).eq('project_id', projectId).maybeSingle();
         if (newsletterError)

package/build/tools/segments.js

@@ -1,3 +1,4 @@
+import { dbErrorResult } from '../lib/db-errors.js';
 import { withApproval } from '../lib/action-approvals.js';
 import { z } from 'zod';
 import Anthropic from '@anthropic-ai/sdk';
@@ -80,31 +81,36 @@ export function registerSegmentTools(server) {
             rules: z.record(z.string(), z.unknown()).describe('Segment rule tree: {op:"AND"|"OR", conditions:[{field, operator, value}]} or legacy flat rules. Supported fields include lifecycle_stage, engagement_score, source, created_at, last_opened_at, last_clicked_at, introduced_by_subscriber_id, tags, custom_properties.<key>, payment.<key>, email_sends (eq only, value: {min_count: positive integer, within_days: positive number}; at most one per segment). tag may be a plain string (one tag) or {values: string[], mode: "any"|"all"} to match several tags at once.'),
         },
     }, async ({ name, description, rules }) => {
-        let storedRules;
         try {
-            storedRules = prepareSegmentRulesForStorage(rules);
+            let storedRules;
+            try {
+                storedRules = prepareSegmentRulesForStorage(rules);
+            }
+            catch (rulesError) {
+                const invalid = invalidRules(rulesError);
+                if (invalid)
+                    return invalid;
+                throw rulesError;
+            }
+            const { data, error } = await db()
+                .from('segments')
+                .insert({ project_id: getProjectId(), name, description, rules: storedRules })
+                .select('id, name, description, rules, created_at')
+                .single();
+            if (error)
+                return dbErrorResult(error);
+            // Count against the stored (normalized) tree, not the raw input: a tree skips
+            // applySegmentRules' SQL push-down and filters in JS, which is what list_segments
+            // does for this same segment a moment later. Pushing the flat rules down instead
+            // makes the two disagree wherever SQL and JS compare differently -- notably
+            // custom_property against a non-string JSONB value (boolean/number), where
+            // `@> {"k":"true"}` misses a stored `true` but String(actual)===String(expected) matches.
+            const ids = await getSegmentContactIds(data.rules);
+            return j({ ...data, estimated_contacts: ids.length });
         }
-        catch (rulesError) {
-            const invalid = invalidRules(rulesError);
-            if (invalid)
-                return invalid;
-            throw rulesError;
+        catch (error) {
+            return dbErrorResult(error);
         }
-        const { data, error } = await db()
-            .from('segments')
-            .insert({ project_id: getProjectId(), name, description, rules: storedRules })
-            .select('id, name, description, rules, created_at')
-            .single();
-        if (error)
-            return txt(`Error: ${error.message}`);
-        // Count against the stored (normalized) tree, not the raw input: a tree skips
-        // applySegmentRules' SQL push-down and filters in JS, which is what list_segments
-        // does for this same segment a moment later. Pushing the flat rules down instead
-        // makes the two disagree wherever SQL and JS compare differently -- notably
-        // custom_property against a non-string JSONB value (boolean/number), where
-        // `@> {"k":"true"}` misses a stored `true` but String(actual)===String(expected) matches.
-        const ids = await getSegmentContactIds(data.rules);
-        return j({ ...data, estimated_contacts: ids.length });
     });
     server.registerTool('list_segments', {
         title: 'List Segments',
@@ -157,32 +163,37 @@ export function registerSegmentTools(server) {
             rules: z.record(z.string(), z.unknown()).optional(),
         },
     }, async ({ segment_id, name, description, rules }) => {
-        const updates = { updated_at: new Date().toISOString() };
-        if (name)
-            updates.name = name;
-        if (description !== undefined)
-            updates.description = description;
-        if (rules) {
-            try {
-                updates.rules = prepareSegmentRulesForStorage(rules);
-            }
-            catch (rulesError) {
-                const invalid = invalidRules(rulesError);
-                if (invalid)
-                    return invalid;
-                throw rulesError;
+        try {
+            const updates = { updated_at: new Date().toISOString() };
+            if (name)
+                updates.name = name;
+            if (description !== undefined)
+                updates.description = description;
+            if (rules) {
+                try {
+                    updates.rules = prepareSegmentRulesForStorage(rules);
+                }
+                catch (rulesError) {
+                    const invalid = invalidRules(rulesError);
+                    if (invalid)
+                        return invalid;
+                    throw rulesError;
+                }
             }
+            const { data, error } = await db()
+                .from('segments')
+                .update(updates)
+                .eq('id', segment_id)
+                .eq('project_id', getProjectId())
+                .select('id, name, description, rules, updated_at')
+                .single();
+            if (error)
+                return dbErrorResult(error);
+            return j(data);
+        }
+        catch (error) {
+            return dbErrorResult(error);
         }
-        const { data, error } = await db()
-            .from('segments')
-            .update(updates)
-            .eq('id', segment_id)
-            .eq('project_id', getProjectId())
-            .select('id, name, description, rules, updated_at')
-            .single();
-        if (error)
-            return txt(`Error: ${error.message}`);
-        return j(data);
     });
     server.registerTool('delete_segment', {
         title: 'Delete Segment',

package/build/tools/short-links.js

@@ -2,6 +2,7 @@ import QRCode from 'qrcode';
 import { z } from 'zod';
 import { db } from '../db.js';
 import { getProjectId } from '../project.js';
+import { assertHttpUrl, RESERVED_LINK_SLUGS } from '../lib/url-validation.js';
 const txt = (text) => ({ content: [{ type: 'text', text }] });
 const j = (data) => txt(JSON.stringify(data, null, 2));
 const VANITY_SLUG_RE = /^[a-zA-Z0-9-]{3,40}$/;
@@ -9,13 +10,6 @@ const PAID_PLANS = new Set(['byod', 'managed', 'agency-plus', 'enterprise']);
 function appBaseUrl() {
     return (process.env.NEXT_PUBLIC_APP_URL ?? process.env.SENDINEL_APP_URL ?? process.env.APP_URL ?? 'https://sendinel.ai').replace(/\/$/, '');
 }
-function assertHttpUrl(raw) {
-    const url = new URL(raw);
-    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
-        throw new Error('Only http and https URLs are supported.');
-    }
-    return url.toString();
-}
 function normalizeColor(input, fallback) {
     const value = input?.trim() || fallback;
     if (!/^#([0-9a-f]{3}|[0-9a-f]{4}|[0-9a-f]{6}|[0-9a-f]{8})$/i.test(value))
@@ -41,21 +35,31 @@ export function registerShortLinkTools(server) {
         const projectId = getProjectId();
         const { data: project } = await db().from('projects').select('org_id, plan').eq('id', projectId).maybeSingle();
         if (!project?.org_id)
-            return j({ error: 'Project not found', code: 'NOT_FOUND' });
+            return j({ error: 'Project not found', code: 'not_found' });
         let destination;
         try {
             destination = assertHttpUrl(destination_url);
         }
         catch (err) {
-            return j({ error: err instanceof Error ? err.message : 'Invalid destination URL', code: 'INVALID_URL' });
+            return j({ error: err instanceof Error ? err.message : 'Invalid destination URL', code: 'validation_failed' });
+        }
+        if (campaign_id) {
+            const { data: campaign, error } = await db().from('campaigns').select('id').eq('id', campaign_id).eq('project_id', projectId).maybeSingle();
+            if (error)
+                return j({ error: error.message, code: 'INTERNAL_ERROR' });
+            if (!campaign)
+                return j({ error: 'Campaign not found in this project', code: 'not_found' });
         }
         const requestedSlug = slug?.trim() || null;
         if (requestedSlug) {
+            if (RESERVED_LINK_SLUGS.has(requestedSlug.toLowerCase())) {
+                return j({ error: 'This slug is reserved for system routes.', code: 'validation_failed' });
+            }
             if (!VANITY_SLUG_RE.test(requestedSlug)) {
-                return j({ error: 'Custom slug must be 3-40 characters and contain only letters, numbers, or hyphens.', code: 'INVALID_SLUG' });
+                return j({ error: 'Custom slug must be 3-40 characters and contain only letters, numbers, or hyphens.', code: 'validation_failed' });
             }
             if (!PAID_PLANS.has(project.plan ?? 'free')) {
-                return j({ error: 'Custom slugs require vanity_slug_access on a paid plan.', code: 'VANITY_SLUG_NOT_ALLOWED' });
+                return j({ error: 'Custom slugs require vanity_slug_access on a paid plan.', code: 'plan_limit' });
             }
         }
         const finalSlug = requestedSlug ?? (await db().rpc('next_short_link_slug')).data;
@@ -74,8 +78,10 @@ export function registerShortLinkTools(server) {
         })
             .select()
             .single();
+        if (error?.code === '23505')
+            return j({ error: 'slug already exists', code: 'conflict' });
         if (error)
-            return j({ error: error.message });
+            return j({ error: error.message, code: 'INTERNAL_ERROR' });
         return j({ short_link: data, short_url: `${appBaseUrl()}/s/${data.slug}` });
     });
     server.registerTool('get_short_link_stats', {
@@ -99,7 +105,7 @@ export function registerShortLinkTools(server) {
         if (linkError)
             return j({ error: linkError.message });
         if (!link)
-            return j({ error: 'Short link not found', code: 'NOT_FOUND' });
+            return j({ error: 'Short link not found', code: 'not_found' });
         const { data: clicks, error: clickError } = await db()
             .from('short_link_clicks')
             .select('clicked_at, ip_hash, referer')
@@ -140,7 +146,7 @@ export function registerShortLinkTools(server) {
             normalizedUrl = assertHttpUrl(url);
         }
         catch (err) {
-            return j({ error: err instanceof Error ? err.message : 'Invalid QR URL', code: 'INVALID_URL' });
+            return j({ error: err instanceof Error ? err.message : 'Invalid QR URL', code: 'validation_failed' });
         }
         const dataUri = await QRCode.toDataURL(normalizedUrl, {
             type: 'image/png',

package/build/tools/surveys.js

@@ -22,10 +22,25 @@ function normalizeQuestions(questions) {
             ...question,
             id,
             label,
-            type: question.type === 'single_choice' ? 'multiple_choice' : question.type,
+            type: question.type,
         };
     });
 }
+function validateQuestions(questions) {
+    const ids = new Set();
+    for (const question of questions) {
+        if (!question.label.trim())
+            return 'Each question needs a non-empty label or text';
+        if (ids.has(question.id))
+            return `Duplicate question id: ${question.id}`;
+        ids.add(question.id);
+        if (['single_choice', 'multi_choice', 'multiple_choice'].includes(question.type) &&
+            (!Array.isArray(question.options) || question.options.length < 2 || question.options.some(option => !option.trim()))) {
+            return `Question ${question.id} needs at least two non-empty options`;
+        }
+    }
+    return null;
+}
 function tallyResponses(responses, questions) {
     return questions.map((question) => {
         const values = responses
@@ -69,13 +84,17 @@ export function registerSurveyTools(server) {
             status: z.enum(['draft', 'active', 'closed']).optional().default('draft'),
         },
     }, async ({ title, questions, site_id, status }) => {
+        const normalized = normalizeQuestions(questions);
+        const validationError = validateQuestions(normalized);
+        if (validationError)
+            return j({ error: validationError, code: 'validation_failed' });
         const projectId = getProjectId();
         const { data: project } = await db().from('projects').select('org_id, plan').eq('id', projectId).maybeSingle();
         if (!project?.org_id)
             return j({ error: 'Project not found', code: 'NOT_FOUND' });
         const { data: survey, error } = await db()
             .from('surveys')
-            .insert({ project_id: projectId, title, questions: normalizeQuestions(questions), status })
+            .insert({ project_id: projectId, title, questions: normalized, status })
             .select()
             .single();
         if (error)
@@ -200,8 +219,26 @@ export function registerSurveyTools(server) {
         const updates = {};
         if (title !== undefined)
             updates.title = title;
-        if (questions !== undefined)
-            updates.questions = normalizeQuestions(questions);
+        if (questions !== undefined || status === 'active') {
+            let candidate = questions;
+            if (candidate === undefined) {
+                const { data: existing, error } = await db().from('surveys').select('questions').eq('id', survey_id).eq('project_id', projectId).maybeSingle();
+                if (error)
+                    return j({ error: error.message, code: 'INTERNAL_ERROR' });
+                if (!existing)
+                    return j({ error: 'Survey not found', code: 'not_found' });
+                candidate = existing.questions;
+            }
+            const parsed = z.array(QUESTION_SCHEMA).min(1).safeParse(candidate);
+            if (!parsed.success)
+                return j({ error: 'Survey questions are invalid', code: 'validation_failed' });
+            const normalized = normalizeQuestions(parsed.data);
+            const validationError = validateQuestions(normalized);
+            if (validationError)
+                return j({ error: validationError, code: 'validation_failed' });
+            if (questions !== undefined)
+                updates.questions = normalized;
+        }
         if (status !== undefined)
             updates.status = status;
         if (Object.keys(updates).length === 0)

package/build/tools/tool-search.js

@@ -12,6 +12,7 @@ export const STOPWORDS = new Set([
  * Only tools that exist in the registry belong here.
  */
 export const TOOL_ALIASES = {
+    list_custom_fields: ['custom fields', 'field definitions', 'contact schema', 'unused fields'],
     update_site: ['footer', 'email footer', 'unsubscribe text', 'unsubscribe link', 'site footer', 'unsubscribe settings'],
     set_campaign_trigger: ['trigger', 'event', 'fires on', 'fires-on', 'dunning', 'set campaign trigger event name', 'invoice payment failed', 'payment failed', 'trial ending', 'event trigger', 'billing'],
     create_campaign_with_content: ['billing', 'dunning', 'trial ending', 'transactional', 'payment failed', 'product email', 'event-driven billing mail'],

package/build/tools/webhooks.js

@@ -29,14 +29,14 @@ export function registerWebhookTools(server) {
     server.registerTool('list_sandbox_webhook_events', {
         title: 'List Sandbox Webhook Events',
         annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
-        description: 'Read recent captured webhook requests for the active sandbox project (seven-day retention). Never returns sink tokens.',
+        description: 'Read recent captured webhook requests for the active sandbox project (seven-day retention). Returns only allowlisted safe headers; never returns sink tokens.',
         inputSchema: { limit: z.number().int().min(1).max(100).optional().default(20) },
     }, async ({ limit }) => {
         try {
             return j({ events: await listSandboxWebhookEvents(adminDb(), getProjectId(), limit) });
         }
         catch {
-            return txt('Sandbox webhook events unavailable.');
+            return j({ error: 'Sandbox webhook events unavailable.', code: 'forbidden' });
         }
     });
     server.registerTool('subscribe_webhook', {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendinel/mcp-server",
-  "version": "1.0.138",
+  "version": "1.0.140",
   "description": "AI-controlled email operations control plane for campaigns, contacts, segments, analytics, and multi-provider sending via MCP.",
   "mcpName": "ai.sendinel/mcp-server",
   "type": "module",