@sendinel/mcp-server 1.0.3 → 1.0.5

package/build/tools/org.js

@@ -1,15 +1,123 @@
 import { randomBytes } from 'crypto';
 import { z } from 'zod';
+import { logAudit } from '../audit.js';
 import { db } from '../db.js';
 import { getProjectId } from '../project.js';
 const j = (data) => ({ content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] });
+const PROVIDER_SWITCH_V1_PROVIDERS = ['resend', 'ses', 'elastic-email'];
+async function callProviderSwitchApi(path, init) {
+    const apiKey = process.env.SENDINEL_API_KEY;
+    if (!apiKey)
+        return { ok: false, error: 'SENDINEL_API_KEY is required to drive provider-switch tools from MCP' };
+    const base = (process.env.NEXT_PUBLIC_APP_URL ?? process.env.SENDINEL_APP_URL ?? process.env.APP_URL ?? 'https://sendinel.ai').replace(/\/$/, '');
+    const res = await fetch(`${base}${path}`, {
+        ...init,
+        headers: {
+            Authorization: `Bearer ${apiKey}`,
+            'X-Sendinel-Project-Id': getProjectId(),
+            ...(init?.headers ?? {}),
+        },
+    });
+    const body = await res.text();
+    if (!res.ok) {
+        try {
+            return { ok: false, error: JSON.parse(body) };
+        }
+        catch {
+            return { ok: false, error: body || `HTTP ${res.status}` };
+        }
+    }
+    try {
+        return { ok: true, data: JSON.parse(body) };
+    }
+    catch {
+        return { ok: true, data: body };
+    }
+}
 const PLAN_LIMITS = {
-    free: { contacts: 500, monthly_sends: 1000, sites: 1, ai_drafts: 10, log_retention_days: 30 },
-    byod: { contacts: 50000, monthly_sends: 250000, sites: 10, ai_drafts: 500, log_retention_days: 180 },
-    managed: { contacts: 250000, monthly_sends: 1000000, sites: 50, ai_drafts: 2000, log_retention_days: 365 },
+    free: { contacts: 250, monthly_sends: 500, sites: 1, ai_drafts: 5, log_retention_days: 30, white_label: false },
+    byod: { contacts: -1, monthly_sends: -1, sites: 10, ai_drafts: -1, log_retention_days: 365, white_label: false },
+    managed: { contacts: 50000, monthly_sends: 50000, sites: 10, ai_drafts: -1, log_retention_days: 730, white_label: false },
+    'agency-plus': { contacts: -1, monthly_sends: 500000, sites: -1, ai_drafts: -1, log_retention_days: -1, white_label: true },
+    enterprise: { contacts: -1, monthly_sends: 250000, sites: 50, ai_drafts: -1, log_retention_days: -1, white_label: true },
 };
+const whiteLabelSettingsSchema = z.object({
+    logo_url: z.string().url().nullable().optional(),
+    favicon_url: z.string().url().nullable().optional(),
+    brand_colors: z.record(z.string(), z.unknown()).optional(),
+    product_name: z.string().trim().min(1).max(80).nullable().optional(),
+    remove_sendinel_branding: z.boolean().optional(),
+    custom_from_identity: z.string().trim().min(1).max(255).nullable().optional(),
+    sign_in_branding: z.record(z.string(), z.unknown()).optional(),
+    support_url: z.string().url().nullable().optional(),
+});
+function normalizeHost(host) {
+    if (!host)
+        return null;
+    const value = host.split(':')[0]?.trim().toLowerCase().replace(/\.$/, '');
+    if (!value)
+        return null;
+    if (!/^[a-z0-9.-]+$/.test(value) || !value.includes('.'))
+        return null;
+    return value;
+}
+function isWhiteLabelPlan(plan) {
+    const limits = PLAN_LIMITS[plan || 'free'] ?? PLAN_LIMITS.free;
+    return limits.white_label === true;
+}
+async function getCurrentProjectOrg() {
+    const { data, error } = await db()
+        .from('projects')
+        .select('id, org_id, plan')
+        .eq('id', getProjectId())
+        .maybeSingle();
+    if (error)
+        return { ok: false, error: error.message };
+    if (!data?.org_id)
+        return { ok: false, error: 'Project organization not found', code: 'NOT_FOUND' };
+    return { ok: true, project: data };
+}
+function formatWhiteLabelSettings(row) {
+    return row ? {
+        org_id: row.org_id,
+        custom_domain: row.custom_domain ?? null,
+        custom_domain_verified: row.custom_domain_verified === true,
+        custom_domain_verified_at: row.custom_domain_verified_at ?? null,
+        logo_url: row.logo_url ?? null,
+        favicon_url: row.favicon_url ?? null,
+        brand_colors: row.brand_colors && typeof row.brand_colors === 'object' ? row.brand_colors : {},
+        product_name: row.product_name ?? null,
+        remove_sendinel_branding: row.remove_sendinel_branding === true,
+        custom_from_identity: row.custom_from_identity ?? null,
+        sign_in_branding: row.sign_in_branding && typeof row.sign_in_branding === 'object' ? row.sign_in_branding : {},
+        support_url: row.support_url ?? null,
+        source: row.source ?? null,
+        created_at: row.created_at ?? null,
+        updated_at: row.updated_at ?? null,
+    } : null;
+}
+async function upsertWhiteLabelSettings(orgId, payload) {
+    const { data, error } = await db()
+        .from('white_label_settings')
+        .upsert({ org_id: orgId, ...payload }, { onConflict: 'org_id' })
+        .select('*')
+        .single();
+    if (error) {
+        if (error.code === '23505')
+            return { ok: false, error: 'Custom domain is already claimed', code: 'CONFLICT' };
+        return { ok: false, error: error.message };
+    }
+    return { ok: true, settings: formatWhiteLabelSettings(data) };
+}
 export function registerOrgTools(server) {
     server.registerTool('list_team_members', {
+        title: 'List Team Members',
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
         description: 'List team members for the project organization.',
         inputSchema: { org_id: z.string().uuid().optional() },
     }, async ({ org_id }) => {
@@ -26,6 +134,13 @@ export function registerOrgTools(server) {
         return j({ members: (data ?? []).map((member) => ({ user_id: member.user_id, email: member.email ?? null, role: member.role, joined_at: member.created_at })) });
     });
     server.registerTool('invite_team_member', {
+        title: 'Invite Team Member',
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: false,
+            openWorldHint: false,
+        },
         description: 'Create a team invitation for the current project organization.',
         inputSchema: { email: z.string().email(), role: z.enum(['owner', 'admin', 'member']).default('member') },
     }, async ({ email, role }) => {
@@ -43,6 +158,13 @@ export function registerOrgTools(server) {
         return j({ invitation_id: data.id, expires_at: data.expires_at });
     });
     server.registerTool('get_plan_usage', {
+        title: 'Get Plan Usage',
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
         description: 'Get current plan usage for the project.',
         inputSchema: {},
     }, async () => {
@@ -65,7 +187,179 @@ export function registerOrgTools(server) {
         });
     });
     server.registerTool('get_plan_limits', {
+        title: 'Get Plan Limits',
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
         description: 'Return plan limits for all plan tiers.',
         inputSchema: {},
     }, async () => j(PLAN_LIMITS));
+    server.registerTool('get_white_label_settings', {
+        title: 'Get White Label Settings',
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+        description: 'Read the current project organization white-label branding settings. Returns null settings when no row exists.',
+        inputSchema: {},
+    }, async () => {
+        const context = await getCurrentProjectOrg();
+        if (!context.ok)
+            return j({ error: context.error, code: context.code });
+        const { data, error } = await db()
+            .from('white_label_settings')
+            .select('*')
+            .eq('org_id', context.project.org_id)
+            .maybeSingle();
+        if (error)
+            return j({ error: error.message });
+        return j({
+            org_id: context.project.org_id,
+            plan: context.project.plan ?? 'free',
+            white_label_available: isWhiteLabelPlan(context.project.plan),
+            settings: formatWhiteLabelSettings(data),
+        });
+    });
+    server.registerTool('set_white_label_settings', {
+        title: 'Set White Label Settings',
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+        description: 'Update org-level white-label branding for the current project. Requires an Agency Plus or Enterprise plan.',
+        inputSchema: whiteLabelSettingsSchema.shape,
+    }, async (input) => {
+        const context = await getCurrentProjectOrg();
+        if (!context.ok)
+            return j({ error: context.error, code: context.code });
+        if (!isWhiteLabelPlan(context.project.plan)) {
+            return j({ error: 'White-label requires Agency Plus or Enterprise', code: 'PLAN_REQUIRED' });
+        }
+        const parsed = whiteLabelSettingsSchema.safeParse(input);
+        if (!parsed.success)
+            return j({ error: parsed.error.flatten(), code: 'INVALID_FIELD' });
+        const result = await upsertWhiteLabelSettings(context.project.org_id, {
+            ...parsed.data,
+            source: 'mcp',
+        });
+        if (!result.ok)
+            return j({ error: result.error, code: result.code });
+        void logAudit({
+            action: 'white_label_settings.updated',
+            resourceType: 'white_label_settings',
+            resourceId: context.project.org_id,
+            details: {
+                custom_domain: result.settings?.custom_domain ?? null,
+                remove_sendinel_branding: result.settings?.remove_sendinel_branding ?? false,
+                source: 'mcp',
+            },
+        }).catch(() => { });
+        return j({ settings: result.settings });
+    });
+    server.registerTool('add_white_label_domain', {
+        title: 'Add White Label Domain',
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: false,
+            openWorldHint: false,
+        },
+        description: 'Claim a custom dashboard hostname for white-label setup. Stores it as unverified; DNS/certificate verification must complete before host routing can use it.',
+        inputSchema: { custom_domain: z.string().trim().min(1).max(255) },
+    }, async ({ custom_domain }) => {
+        const context = await getCurrentProjectOrg();
+        if (!context.ok)
+            return j({ error: context.error, code: context.code });
+        if (!isWhiteLabelPlan(context.project.plan)) {
+            return j({ error: 'White-label requires Agency Plus or Enterprise', code: 'PLAN_REQUIRED' });
+        }
+        const normalized = normalizeHost(custom_domain);
+        if (!normalized)
+            return j({ error: 'custom_domain must be a valid hostname', code: 'INVALID_FIELD' });
+        const result = await upsertWhiteLabelSettings(context.project.org_id, {
+            custom_domain: normalized,
+            custom_domain_verified: false,
+            custom_domain_verified_at: null,
+            source: 'mcp',
+        });
+        if (!result.ok)
+            return j({ error: result.error, code: result.code });
+        void logAudit({
+            action: 'white_label_domain.claimed',
+            resourceType: 'white_label_settings',
+            resourceId: context.project.org_id,
+            details: { custom_domain: normalized, verified: false, source: 'mcp' },
+        }).catch(() => { });
+        return j({
+            settings: result.settings,
+            verification_status: 'pending',
+            note: 'The domain is stored but will not resolve to this org until DNS/certificate verification marks custom_domain_verified true.',
+        });
+    });
+    server.registerTool('start_provider_switch', {
+        title: 'Start Provider Switch',
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: false,
+            openWorldHint: true,
+        },
+        description: 'Start moving a sending domain between supported providers using the existing provider-switch flow.',
+        inputSchema: {
+            site_id: z.string().uuid(),
+            to_provider: z.enum(PROVIDER_SWITCH_V1_PROVIDERS),
+        },
+    }, async ({ site_id, to_provider }) => {
+        const result = await callProviderSwitchApi('/api/dashboard/provider-switch/start', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ site_id, to_provider }),
+        });
+        return result.ok ? j(result.data) : j({ error: result.error });
+    });
+    server.registerTool('get_provider_switch_status', {
+        title: 'Get Provider Switch Status',
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: true,
+        },
+        description: 'Poll and return the current status of a provider switch.',
+        inputSchema: {
+            id: z.string().uuid(),
+        },
+    }, async ({ id }) => {
+        const result = await callProviderSwitchApi(`/api/dashboard/provider-switch/status?id=${encodeURIComponent(id)}`, {
+            method: 'GET',
+        });
+        return result.ok ? j(result.data) : j({ error: result.error });
+    });
+    server.registerTool('rollback_provider_switch', {
+        title: 'Rollback Provider Switch',
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: true,
+            idempotentHint: false,
+            openWorldHint: true,
+        },
+        description: 'Roll back an in-progress or failed provider switch to the prior provider/domain state.',
+        inputSchema: {
+            id: z.string().uuid(),
+        },
+    }, async ({ id }) => {
+        const result = await callProviderSwitchApi('/api/dashboard/provider-switch/rollback', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ id }),
+        });
+        return result.ok ? j(result.data) : j({ error: result.error });
+    });
 }

package/build/tools/segments.js

@@ -212,11 +212,18 @@ const txt = (text) => ({ content: [{ type: 'text', text }] });
 const j = (data) => txt(JSON.stringify(data, null, 2));
 export function registerSegmentTools(server) {
     server.registerTool('create_segment', {
+        title: 'Create Segment',
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: false,
+            openWorldHint: false,
+        },
         description: 'Create a saved segment with filter rules. Segments evaluate dynamically at send time.',
         inputSchema: {
             name: z.string().min(1).describe('Segment name (unique per project)'),
             description: z.string().optional(),
-            rules: z.record(z.unknown()).describe('Segment rule tree: {op:"AND"|"OR", conditions:[{field, operator, value}]} or legacy flat rules. Supported fields include lifecycle_stage, engagement_score, source, created_at, last_opened_at, last_clicked_at, tags, custom_properties.<key>, payment.<key>.'),
+            rules: z.record(z.string(), z.unknown()).describe('Segment rule tree: {op:"AND"|"OR", conditions:[{field, operator, value}]} or legacy flat rules. Supported fields include lifecycle_stage, engagement_score, source, created_at, last_opened_at, last_clicked_at, tags, custom_properties.<key>, payment.<key>.'),
         },
     }, async ({ name, description, rules }) => {
         const { data, error } = await db()
@@ -230,6 +237,13 @@ export function registerSegmentTools(server) {
         return j({ ...data, estimated_contacts: ids.length });
     });
     server.registerTool('list_segments', {
+        title: 'List Segments',
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
         description: 'List all saved segments with their contact counts',
         inputSchema: {},
     }, async () => {
@@ -248,12 +262,19 @@ export function registerSegmentTools(server) {
         return j(segments);
     });
     server.registerTool('update_segment', {
+        title: 'Update Segment',
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
         description: 'Update a segment name, description, or rules',
         inputSchema: {
             segment_id: z.string().uuid(),
             name: z.string().optional(),
             description: z.string().optional(),
-            rules: z.record(z.unknown()).optional(),
+            rules: z.record(z.string(), z.unknown()).optional(),
         },
     }, async ({ segment_id, name, description, rules }) => {
         const updates = { updated_at: new Date().toISOString() };
@@ -275,6 +296,13 @@ export function registerSegmentTools(server) {
         return j(data);
     });
     server.registerTool('delete_segment', {
+        title: 'Delete Segment',
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: true,
+            idempotentHint: false,
+            openWorldHint: false,
+        },
         description: 'Delete a saved segment. Campaigns using this segment will lose targeting.',
         inputSchema: {
             segment_id: z.string().uuid(),
@@ -290,10 +318,17 @@ export function registerSegmentTools(server) {
         return j({ deleted: true, segment_id });
     });
     server.registerTool('preview_segment', {
+        title: 'Preview Segment',
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
         description: 'Preview which contacts match a saved segment or inline rules. Returns count and sample.',
         inputSchema: {
             segment_id: z.string().uuid().optional(),
-            rules: z.record(z.unknown()).optional(),
+            rules: z.record(z.string(), z.unknown()).optional(),
         },
     }, async ({ segment_id, rules }) => {
         let segRules;
@@ -327,6 +362,13 @@ export function registerSegmentTools(server) {
         return j({ total_contacts: ids.length, sample: sampleContacts });
     });
     server.registerTool('create_segment_nl', {
+        title: 'Create Segment NL',
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: false,
+            openWorldHint: true,
+        },
         description: 'Create a segment from a natural language description. Parses description into filter rules using AI, previews contacts, creates on confirmation.',
         inputSchema: {
             name: z.string().min(1),

package/build/tools/short-links.d.ts

@@ -0,0 +1,2 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function registerShortLinkTools(server: McpServer): void;

package/build/tools/short-links.js

@@ -0,0 +1,157 @@
+import QRCode from 'qrcode';
+import { z } from 'zod';
+import { db } from '../db.js';
+import { getProjectId } from '../project.js';
+const txt = (text) => ({ content: [{ type: 'text', text }] });
+const j = (data) => txt(JSON.stringify(data, null, 2));
+const VANITY_SLUG_RE = /^[a-zA-Z0-9-]{3,40}$/;
+const PAID_PLANS = new Set(['byod', 'managed', 'agency-plus', 'enterprise']);
+function appBaseUrl() {
+    return (process.env.NEXT_PUBLIC_APP_URL ?? process.env.SENDINEL_APP_URL ?? process.env.APP_URL ?? 'https://sendinel.ai').replace(/\/$/, '');
+}
+function assertHttpUrl(raw) {
+    const url = new URL(raw);
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        throw new Error('Only http and https URLs are supported.');
+    }
+    return url.toString();
+}
+function normalizeColor(input, fallback) {
+    const value = input?.trim() || fallback;
+    if (!/^#([0-9a-f]{3}|[0-9a-f]{4}|[0-9a-f]{6}|[0-9a-f]{8})$/i.test(value))
+        return fallback;
+    return value;
+}
+export function registerShortLinkTools(server) {
+    server.registerTool('create_short_link', {
+        title: 'Create Short Link',
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: false,
+            openWorldHint: false,
+        },
+        description: 'Create a project-scoped short link that redirects to a destination URL with click tracking.',
+        inputSchema: {
+            destination_url: z.string().url(),
+            slug: z.string().optional().describe('Custom slug; paid plans only. Auto-generated when omitted.'),
+            campaign_id: z.string().uuid().optional(),
+        },
+    }, async ({ destination_url, slug, campaign_id }) => {
+        const projectId = getProjectId();
+        const { data: project } = await db().from('projects').select('org_id, plan').eq('id', projectId).maybeSingle();
+        if (!project?.org_id)
+            return j({ error: 'Project not found', code: 'NOT_FOUND' });
+        let destination;
+        try {
+            destination = assertHttpUrl(destination_url);
+        }
+        catch (err) {
+            return j({ error: err instanceof Error ? err.message : 'Invalid destination URL', code: 'INVALID_URL' });
+        }
+        const requestedSlug = slug?.trim() || null;
+        if (requestedSlug) {
+            if (!VANITY_SLUG_RE.test(requestedSlug)) {
+                return j({ error: 'Custom slug must be 3-40 characters and contain only letters, numbers, or hyphens.', code: 'INVALID_SLUG' });
+            }
+            if (!PAID_PLANS.has(project.plan ?? 'free')) {
+                return j({ error: 'Custom slugs require vanity_slug_access on a paid plan.', code: 'VANITY_SLUG_NOT_ALLOWED' });
+            }
+        }
+        const finalSlug = requestedSlug ?? (await db().rpc('next_short_link_slug')).data;
+        if (!finalSlug)
+            return j({ error: 'Unable to allocate short-link slug', code: 'SLUG_UNAVAILABLE' });
+        const { data, error } = await db()
+            .from('short_links')
+            .insert({
+            slug: finalSlug,
+            org_id: project.org_id,
+            project_id: projectId,
+            destination_url: destination,
+            is_vanity: Boolean(requestedSlug),
+            source_type: campaign_id ? 'campaign' : 'generic',
+            source_id: campaign_id ?? null,
+        })
+            .select()
+            .single();
+        if (error)
+            return j({ error: error.message });
+        return j({ short_link: data, short_url: `${appBaseUrl()}/s/${data.slug}` });
+    });
+    server.registerTool('get_short_link_stats', {
+        title: 'Get Short Link Stats',
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+        description: 'Get project-scoped click stats for a short link.',
+        inputSchema: { short_link_id: z.string().uuid() },
+    }, async ({ short_link_id }) => {
+        const projectId = getProjectId();
+        const { data: link, error: linkError } = await db()
+            .from('short_links')
+            .select('id, slug, destination_url, click_count, last_clicked_at, created_at')
+            .eq('id', short_link_id)
+            .eq('project_id', projectId)
+            .maybeSingle();
+        if (linkError)
+            return j({ error: linkError.message });
+        if (!link)
+            return j({ error: 'Short link not found', code: 'NOT_FOUND' });
+        const { data: clicks, error: clickError } = await db()
+            .from('short_link_clicks')
+            .select('clicked_at, ip_hash, referer')
+            .eq('short_link_id', short_link_id)
+            .order('clicked_at', { ascending: false })
+            .limit(500);
+        if (clickError)
+            return j({ error: clickError.message });
+        const uniqueClicks = new Set((clicks ?? []).map((click) => click.ip_hash).filter(Boolean)).size;
+        return j({
+            short_link: link,
+            total_clicks: link.click_count ?? clicks?.length ?? 0,
+            unique_clicks: uniqueClicks,
+            recent_clicks: clicks ?? [],
+        });
+    });
+    server.registerTool('generate_qr_code', {
+        title: 'Generate QR Code',
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+        description: 'Generate a QR code image for a URL. Returns a PNG data URI in JSON text content.',
+        inputSchema: {
+            url: z.string().url(),
+            style: z.object({
+                foreground_color: z.string().optional(),
+                background_color: z.string().optional(),
+                margin: z.number().int().min(0).max(12).optional(),
+                width: z.number().int().min(128).max(2048).optional(),
+            }).optional(),
+        },
+    }, async ({ url, style }) => {
+        let normalizedUrl;
+        try {
+            normalizedUrl = assertHttpUrl(url);
+        }
+        catch (err) {
+            return j({ error: err instanceof Error ? err.message : 'Invalid QR URL', code: 'INVALID_URL' });
+        }
+        const dataUri = await QRCode.toDataURL(normalizedUrl, {
+            type: 'image/png',
+            errorCorrectionLevel: 'H',
+            margin: style?.margin ?? 4,
+            width: style?.width ?? 512,
+            color: {
+                dark: normalizeColor(style?.foreground_color, '#000000'),
+                light: normalizeColor(style?.background_color, '#ffffff'),
+            },
+        });
+        return j({ data_uri: dataUri, url: normalizedUrl, content_type: 'image/png' });
+    });
+}

package/build/tools/sites.js

@@ -103,6 +103,13 @@ async function createSender({ name, slug, domain_id, local_part, sending_domain,
 }
 export function registerSiteTools(server) {
     server.registerTool('get_brand_voice', {
+        title: 'Get Brand Voice',
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
         description: 'Read the brand voice configuration for a sender/site.',
         inputSchema: {
             site_id: z.string().uuid(),
@@ -121,6 +128,13 @@ export function registerSiteTools(server) {
         return j(data);
     });
     server.registerTool('update_brand_voice', {
+        title: 'Update Brand Voice',
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
         description: 'Replace the brand voice configuration for a sender/site. Stores JSON in sites.brand_voice. Use the canonical Brand Brain keys so the dashboard and email generation can read the values: mission (string), audience (string), differentiators (string), tone_words (string[], max 8), forbidden_phrases (string[], max 20), default_signoff_name (string), ps_line (string). This REPLACES the whole object and overrides the org default — read the current value first if you only mean to change one field.',
         inputSchema: {
             site_id: z.string().uuid(),
@@ -139,14 +153,35 @@ export function registerSiteTools(server) {
         return j(data);
     });
     server.registerTool('create_site', {
+        title: 'Create Site',
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: false,
+            openWorldHint: false,
+        },
         description: 'Create a new sender. Accepts preferred domain_id + local_part or legacy sending_domain + from_email.',
         inputSchema: createSenderSchema,
     }, createSender);
     server.registerTool('create_sender', {
+        title: 'Create Sender',
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: false,
+            openWorldHint: false,
+        },
         description: 'Create a new sender under an existing verified domain.',
         inputSchema: createSenderSchema,
     }, createSender);
     server.registerTool('update_site', {
+        title: 'Update Site',
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
         description: 'Update a site name, from address, or other settings',
         inputSchema: {
             site_id: z.string().uuid(),