@sendinel/mcp-server 1.0.159 → 1.0.160

package/build/lib/action-approvals.d.ts

@@ -1,3 +1,4 @@
+import type { DecisionEvidence } from './approval-elicitation-evidence.js';
 export { isApprovalGatedAction } from './approval-actions.js';
 /**
  * Action approval tiers:
@@ -84,6 +85,13 @@ export declare function checkApproval(approvalId: string, options?: {
     consume?: boolean;
     action?: string;
     params?: Record<string, unknown>;
+}): Promise<Awaited<ReturnType<typeof checkApprovalState>> & {
+    decision_evidence?: DecisionEvidence;
+}>;
+declare function checkApprovalState(approvalId: string, options?: {
+    consume?: boolean;
+    action?: string;
+    params?: Record<string, unknown>;
 }): Promise<{
     approved: boolean;
     status: string;

package/build/lib/action-approvals.js

@@ -371,6 +371,31 @@ function captureSnapshot(action, params) {
  * Returns the approval if approved, null if still pending, throws if rejected/expired.
  */
 export async function checkApproval(approvalId, options = {}) {
+    const result = await checkApprovalState(approvalId, options);
+    if (options.consume || result.status === 'not_found')
+        return result;
+    try {
+        const source = approvalStore();
+        const client = typeof source.schema === 'function' ? source.schema('email') : source;
+        const { data: approval, error } = await client.from('action_approvals')
+            .select('decided_via, decided_by').eq('id', approvalId).eq('project_id', getProjectId()).maybeSingle();
+        if (error || approval?.decided_via !== 'mcp_elicitation' || !approval.decided_by)
+            return result;
+        const { data: rows, error: auditError } = await client.from('audit_log').select('details')
+            .eq('project_id', getProjectId()).eq('resource_type', 'approval').eq('resource_id', approvalId)
+            .eq('actor_id', approval.decided_by).in('action', ['approval.elicitation_answered', 'approval.submitted']).limit(10);
+        if (auditError)
+            return result;
+        const evidence = rows?.map((row) => row.details).find((details) => details?.channel === 'mcp_elicitation' && Number.isInteger(details.answer_latency_ms) &&
+            details.answer_latency_ms >= 0 && typeof details.auto_accept_suspected === 'boolean');
+        return evidence ? { ...result, decision_evidence: { answer_latency_ms: evidence.answer_latency_ms,
+                auto_accept_suspected: evidence.auto_accept_suspected, channel: 'mcp_elicitation' } } : result;
+    }
+    catch {
+        return result;
+    }
+}
+async function checkApprovalState(approvalId, options = {}) {
     const applied = registeredApproval.getStore();
     if (options.consume && applied?.phase === 'approved' && applied.id === approvalId && applied.action === options.action && applied.projectId === getProjectId()) {
         return { approved: true, status: 'approved', decided_by: applied.decidedBy, ...(applied.decisionChannel ? { decision_channel: applied.decisionChannel } : {}) };

package/build/lib/approval-capabilities.d.ts

@@ -19,9 +19,11 @@ export declare function declaredAppMimeTypes(declared: unknown): string[];
  */
 export declare function approvalAppEnabled(env?: NodeJS.ProcessEnv): boolean;
 export declare function approvalAppClientAllowed(clientName: unknown, env?: NodeJS.ProcessEnv): boolean;
-export declare function rememberApprovalCapabilities(session: object, declared: unknown, clientName?: unknown): ApprovalClientCapabilities;
+export declare function rememberApprovalCapabilities(session: object, declared: unknown, clientName?: unknown, clientVersion?: unknown): ApprovalClientCapabilities;
 /** Name from this in-process session's initialize clientInfo; undefined when none was declared. */
 export declare function approvalClientName(session: object): string | undefined;
+export declare function approvalClientVersion(session: object): string | undefined;
+export declare function approvalDeclaredCapabilities(session: object): unknown;
 /**
  * Declared-capability probe for this in-process session. `appsAllowed: false` removes the Apps
  * tier from the choice (flag off / client not allowlisted), so a lower tier can still be used.

package/build/lib/approval-capabilities.js

@@ -1,6 +1,7 @@
 export const MCP_APP_EXTENSION = 'io.modelcontextprotocol/ui';
 export const MCP_APP_MIME_TYPE = 'text/html;profile=mcp-app';
 const sessions = new WeakMap();
+const clientVersions = new WeakMap();
 const clientNames = new WeakMap();
 const object = (value) => value !== null && typeof value === 'object' && !Array.isArray(value) ? value : null;
 /** Reads only declared initialize capabilities. No user agent or client-name guessing. */
@@ -40,19 +41,33 @@ export function approvalAppClientAllowed(clientName, env = process.env) {
     const allowed = (env.MCP_APPROVAL_APP_CLIENTS ?? '').split(',').map(name => name.trim()).filter(Boolean);
     return allowed.includes(clientName.trim());
 }
-export function rememberApprovalCapabilities(session, declared, clientName) {
+export function rememberApprovalCapabilities(session, declared, clientName, clientVersion) {
     const capabilities = probeApprovalCapabilities(declared);
     sessions.set(session, capabilities);
     if (typeof clientName === 'string')
         clientNames.set(session, clientName);
     else
         clientNames.delete(session);
+    if (typeof clientVersion === 'string')
+        clientVersions.set(session, clientVersion);
+    else
+        clientVersions.delete(session);
     return capabilities;
 }
 /** Name from this in-process session's initialize clientInfo; undefined when none was declared. */
 export function approvalClientName(session) {
     return clientNames.get(session);
 }
+export function approvalClientVersion(session) {
+    return clientVersions.get(session);
+}
+export function approvalDeclaredCapabilities(session) {
+    const caps = sessions.get(session);
+    return { ...(caps?.elicitation_form || caps?.elicitation_url ? { elicitation: {
+                ...(caps.elicitation_form ? { form: {} } : {}), ...(caps.elicitation_url ? { url: {} } : {}),
+            } } : {}), extensions: caps?.mcp_app
+            ? { [MCP_APP_EXTENSION]: { mimeTypes: [MCP_APP_MIME_TYPE] } } : {} };
+}
 /**
  * Declared-capability probe for this in-process session. `appsAllowed: false` removes the Apps
  * tier from the choice (flag off / client not allowlisted), so a lower tier can still be used.
@@ -72,7 +87,7 @@ export function installApprovalCapabilityProbe(session) {
     const previous = session.oninitialized;
     session.oninitialized = () => {
         const info = object(session.getClientVersion?.());
-        rememberApprovalCapabilities(session, session.getClientCapabilities(), info?.name);
+        rememberApprovalCapabilities(session, session.getClientCapabilities(), info?.name, info?.version);
         previous?.call(session);
     };
 }

package/build/lib/approval-elicitation-evidence.d.ts

@@ -0,0 +1,34 @@
+export declare const ELICITATION_AUTO_ACCEPT_SUSPECT_MS = 2000;
+export type ElicitationEvidence = ReturnType<typeof elicitationEvidence>;
+export type DecisionEvidence = {
+    answer_latency_ms: number;
+    auto_accept_suspected: boolean;
+    channel: 'mcp_elicitation';
+};
+export declare function elicitationEvidence(input: {
+    promptShownAt: string;
+    answeredAt: string;
+    action: 'accept' | 'decline';
+    content?: unknown;
+    requestId?: string | number;
+    clientName?: unknown;
+    clientVersion?: unknown;
+    capabilities?: unknown;
+    userAgent?: unknown;
+}): {
+    prompt_shown_at: string;
+    answered_at: string;
+    answer_latency_ms: number;
+    auto_accept_suspected: boolean;
+    client_name?: string | undefined;
+    client_version?: string | undefined;
+    client_capabilities: {
+        elicitation_form: boolean;
+        elicitation_url: boolean;
+        apps: boolean;
+    };
+    response_action: "accept" | "decline";
+    response_content_keys: string[];
+    user_agent?: string | undefined;
+    jsonrpc_request_id_hash?: string | undefined;
+};

package/build/lib/approval-elicitation-evidence.js

@@ -0,0 +1,27 @@
+import { createHash } from 'node:crypto';
+import { probeApprovalCapabilities } from './approval-capabilities.js';
+export const ELICITATION_AUTO_ACCEPT_SUSPECT_MS = 2000;
+// Metadata is client-declared, never proof of a human. Reject obvious private text.
+const metadata = (value, max) => typeof value === 'string' && !/[@\r\n]|bearer\s|\b(?:sk_|snk_|eyJ)/i.test(value)
+    ? value.slice(0, max) : undefined;
+export function elicitationEvidence(input) {
+    const latency = Math.max(0, Math.trunc(Date.parse(input.answeredAt) - Date.parse(input.promptShownAt)));
+    const capabilities = probeApprovalCapabilities(input.capabilities);
+    const name = metadata(input.clientName, 200), version = metadata(input.clientVersion, 100);
+    const userAgent = metadata(input.userAgent, 120);
+    return {
+        prompt_shown_at: input.promptShownAt, answered_at: input.answeredAt,
+        answer_latency_ms: latency,
+        auto_accept_suspected: input.action === 'accept' && latency < ELICITATION_AUTO_ACCEPT_SUSPECT_MS,
+        ...(name ? { client_name: name } : {}), ...(version ? { client_version: version } : {}),
+        client_capabilities: { elicitation_form: capabilities.elicitation_form,
+            elicitation_url: capabilities.elicitation_url, apps: capabilities.mcp_app },
+        response_action: input.action,
+        response_content_keys: input.content && typeof input.content === 'object' && !Array.isArray(input.content)
+            ? Object.keys(input.content).filter(key => /^[A-Za-z_][A-Za-z0-9_]{0,119}$/.test(key)) : [],
+        ...(userAgent ? { user_agent: userAgent } : {}),
+        ...(input.requestId !== undefined ? {
+            jsonrpc_request_id_hash: createHash('sha256').update(String(input.requestId)).digest('hex').slice(0, 8),
+        } : {}),
+    };
+}

package/build/lib/approval-elicitation-relay.d.ts

@@ -5,7 +5,9 @@ export declare function isElicitationResponse(body: unknown): boolean;
 /** Auth has already run. Unknown and malformed responses are deliberately indistinguishable.
  * No decision can enter this path via a tools/call, model text, or nested tool arguments.
  */
-export declare function recordElicitationResponse(body: unknown, identity: HumanDecisionIdentity): Promise<void>;
+export declare function recordElicitationResponse(body: unknown, identity: HumanDecisionIdentity, metadata?: {
+    userAgent?: string | null;
+}): Promise<void>;
 /** Insert before sending, using the exact wire id (a UUID, since each stateless SDK starts
  * its request counter at zero). Poll the persisted prompt; never await a response on the old
  * SDK Server, because the client's answer necessarily arrives at a fresh Server via POST.

package/build/lib/approval-elicitation-relay.js

@@ -1,3 +1,4 @@
+import { elicitationEvidence } from './approval-elicitation-evidence.js';
 import { ELICITATION_HOLD_MS } from './approval-elicitation.js';
 import { randomUUID } from 'node:crypto';
 import { approvalStore } from './tester-requests-store.js';
@@ -16,7 +17,8 @@ export function isElicitationResponse(body) {
 /** Auth has already run. Unknown and malformed responses are deliberately indistinguishable.
  * No decision can enter this path via a tools/call, model text, or nested tool arguments.
  */
-export async function recordElicitationResponse(body, identity) {
+export async function recordElicitationResponse(body, identity, metadata = {}) {
+    const answeredAt = new Date().toISOString();
     const message = object(body);
     if (!isElicitationResponse(message) || message?.jsonrpc !== '2.0' ||
         (typeof message.id !== 'string' && typeof message.id !== 'number') ||
@@ -55,6 +57,36 @@ export async function recordElicitationResponse(body, identity) {
         });
         if (rpcError || data !== true)
             return;
+        // Evidence is additive. Neither metadata lookup nor audit failure can undo the decision.
+        try {
+            const { data: declared, error: declarationError } = await client.from('mcp_client_capabilities')
+                .select('client_name, client_version, elicitation_form, elicitation_url, mcp_app')
+                .eq('oauth_token_id', identity.oauthTokenId).gt('expires_at', answeredAt).maybeSingle();
+            const info = declarationError ? null : declared;
+            const capabilities = { elicitation: {
+                    ...(info?.elicitation_form === true ? { form: {} } : {}),
+                    ...(info?.elicitation_url === true ? { url: {} } : {}),
+                }, extensions: info?.mcp_app === true
+                    ? { 'io.modelcontextprotocol/ui': { mimeTypes: ['text/html;profile=mcp-app'] } } : {} };
+            // Absent support must not become the legacy elicitation:{} form declaration.
+            if (!info?.elicitation_form && !info?.elicitation_url)
+                delete capabilities.elicitation;
+            const { error: auditError } = await client.from('audit_log').insert({
+                project_id: prompt.project_id, actor_type: 'user', actor_id: identity.actorId,
+                action: 'approval.elicitation_answered', resource_type: 'approval', resource_id: prompt.approval_id,
+                details: { channel: 'mcp_elicitation', ...elicitationEvidence({
+                        promptShownAt: new Date(prompt.created_at).toISOString(), answeredAt,
+                        action: result.action, content: result.content, requestId: message.id,
+                        clientName: info?.client_name, clientVersion: info?.client_version,
+                        capabilities, userAgent: metadata.userAgent,
+                    }) },
+            });
+            if (auditError)
+                console.warn('[approval_evidence]', { reason: 'audit_write_failed' });
+        }
+        catch {
+            console.warn('[approval_evidence]', { reason: 'audit_write_failed' });
+        }
     }
     catch {
         // Never reveal whether a prompt exists, and never fall back to non-atomic REST writes.

package/build/lib/approval-elicitation.d.ts

@@ -1,3 +1,4 @@
+import { type ElicitationEvidence } from './approval-elicitation-evidence.js';
 import { type HumanDecisionIdentity } from './approval-human-eligibility.js';
 import type { ElicitRequest } from '@modelcontextprotocol/sdk/types.js';
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
@@ -9,6 +10,7 @@ type HumanCallback = {
         interactionId: string;
         connectionId: string;
         decision: Decision;
+        evidence?: ElicitationEvidence;
     }): Promise<boolean>;
 };
 /** Injected at authenticated transport startup, never taken from tool arguments. */

package/build/lib/approval-elicitation.js

@@ -1,10 +1,11 @@
+import { elicitationEvidence } from './approval-elicitation-evidence.js';
 import { isHumanRequestableAdminTool } from './admin-tools.js';
 import { humanApprovalEligible } from './approval-human-eligibility.js';
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { randomUUID } from 'node:crypto';
 import { approvalDisplayFact, buildApprovalPreview, isEmailApprovalAction, isHumanApprovalChannel } from '@sendinel/domain';
 import { approvalStore } from './tester-requests-store.js';
-import { approvalAppClientAllowed, approvalClientName, approval_channel_available, probeApprovalCapabilities } from './approval-capabilities.js';
+import { approvalAppClientAllowed, approvalClientName, approvalClientVersion, approvalDeclaredCapabilities, approval_channel_available, probeApprovalCapabilities } from './approval-capabilities.js';
 // Keyed by the SDK Server, not the McpServer wrapper: other installers (the Apps tier) wrap
 // McpServer in a Proxy, which changes the wrapper's identity but never the connection's Server.
 const sessions = new WeakMap();
@@ -100,7 +101,9 @@ export async function elicitApproval(result, frozen, projectId) {
             }
             const callback = context.createHumanDecision({ approvalId: result.approval_id, projectId,
                 connectionId: context.connectionId, userId: context.userId, channel: 'mcp_elicitation' });
+            const promptShownAt = new Date().toISOString();
             const response = await Promise.race([context.server.server.elicitInput(params, options), stopped]);
+            const answeredAt = new Date().toISOString();
             if (controller.signal.aborted)
                 return exit(endReason ?? 'request_aborted');
             // Only the client's action is a decision. Extra content is untrusted and ignored.
@@ -108,7 +111,12 @@ export async function elicitApproval(result, frozen, projectId) {
                 return exit('client_cancelled');
             const decision = response.action === 'accept' ? 'approve' : 'reject';
             const recorded = await Promise.race([callback.complete({ interactionId: callback.interactionId,
-                    connectionId: context.connectionId, decision }), stopped]);
+                    connectionId: context.connectionId, decision, evidence: elicitationEvidence({
+                        promptShownAt, answeredAt, action: response.action, content: response.content,
+                        requestId: context.requestId, clientName: approvalClientName(context.server.server),
+                        clientVersion: approvalClientVersion(context.server.server),
+                        capabilities: approvalDeclaredCapabilities(context.server.server),
+                    }) }), stopped]);
             return recorded ? { ...result, decision_status: decision === 'approve' ? 'approved' : 'rejected' } : exit('decision_refused');
         }
         const elicitationId = randomUUID();

package/build/lib/approval-human-callback.d.ts

@@ -1,3 +1,4 @@
+import type { ElicitationEvidence } from './approval-elicitation-evidence.js';
 /**
  * Server integration only. The transport creates this closure for one authenticated human
  * interaction and retains it outside the tool registry. Neither its id nor decision is a tool
@@ -15,5 +16,6 @@ export declare function createHumanApprovalCallback(binding: {
         interactionId: string;
         connectionId: string;
         decision: 'approve' | 'reject';
+        evidence?: ElicitationEvidence;
     }): Promise<boolean>;
 };

package/build/lib/approval-human-callback.js

@@ -38,7 +38,7 @@ export function createHumanApprovalCallback(binding) {
             const { error: auditError } = await client.from('audit_log').insert({
                 project_id: binding.projectId, actor_type: 'user', actor_id: binding.userId,
                 action: 'approval.submitted', resource_type: 'approval', resource_id: binding.approvalId,
-                details: { status: response.decision === 'approve' ? 'approved' : 'rejected', channel: binding.channel,
+                details: { ...(binding.channel === 'mcp_elicitation' ? response.evidence : {}), status: response.decision === 'approve' ? 'approved' : 'rejected', channel: binding.channel,
                     connection_id: binding.connectionId, interaction_id: interactionId, payload_hash: data.payload_hash },
             });
             if (auditError)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendinel/mcp-server",
-  "version": "1.0.159",
+  "version": "1.0.160",
   "description": "AI-controlled email operations control plane for campaigns, contacts, segments, analytics, and multi-provider sending via MCP.",
   "mcpName": "ai.sendinel/mcp-server",
   "type": "module",