@sendinel/mcp-server 1.0.63 → 1.0.64

package/build/tools/social-posts.js

@@ -1,4 +1,5 @@
 import Anthropic from '@anthropic-ai/sdk';
+import { withApproval } from '../lib/action-approvals.js';
 import { z } from 'zod';
 import { db } from '../db.js';
 import { getProjectId } from '../project.js';
@@ -558,8 +559,8 @@ export function registerSocialPostTools(server) {
             openWorldHint: true,
         },
         description: 'Archive a social post so it disappears from active planner and list views.',
-        inputSchema: { post_id: z.string().uuid() },
-    }, async ({ post_id }) => {
+        inputSchema: { approval_id: z.string().uuid().optional().describe('Get this by calling once without it, then have a human approve the returned approve_url. Re-call with the same arguments plus this approval_id to run the action.'), post_id: z.string().uuid() },
+    }, withApproval('delete_social_post', async ({ post_id }) => {
         const { data, error } = await db()
             .from('social_posts')
             .update({ status: 'archived', updated_at: new Date().toISOString() })
@@ -571,5 +572,5 @@ export function registerSocialPostTools(server) {
             return txt(`Error: ${error.message}`);
         fireWebhookEvent('social.post.archived', { social_post_id: data.id, title: data.title }, getProjectId()).catch(() => { });
         return j(data);
-    });
+    }));
 }

package/build/tools/social-replies.js

@@ -1,4 +1,5 @@
 import Anthropic from '@anthropic-ai/sdk';
+import { withApproval } from '../lib/action-approvals.js';
 import { z } from 'zod';
 import { parseLinkedInCommentUrl, parseLinkedInPostUrl, parseLinkedInTargetUrl } from '@sendinel/domain';
 import { db, requestContext } from '../db.js';
@@ -144,10 +145,10 @@ export function registerSocialReplyTools(server) {
         inputSchema: { post_url_or_urn: z.string().min(1), text: replyText, target_member_id: z.string().uuid().optional() },
     }, async ({ post_url_or_urn, text, target_member_id }) => proposePersonal('post_comment', post_url_or_urn, text, target_member_id));
     server.registerTool('reply_to_comment', {
-        title: 'Propose LinkedIn Comment Reply', description: 'Create a review card for a personal LinkedIn reply. Never posts.',
+        title: 'Propose LinkedIn Comment Reply', description: 'Create a review card for a personal LinkedIn reply. Never posts. Requires human approval: the first call returns an approve_url and does nothing; call again with the same arguments plus approval_id once approved.',
         annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
-        inputSchema: { comment_url_or_urn: z.string().min(1), text: replyText, target_member_id: z.string().uuid().optional() },
-    }, async ({ comment_url_or_urn, text, target_member_id }) => proposePersonal('comment_reply', comment_url_or_urn, text, target_member_id));
+        inputSchema: { comment_url_or_urn: z.string().min(1), text: replyText, target_member_id: z.string().uuid().optional(), approval_id: z.string().uuid().optional().describe('Get this by calling once without it, then have a human approve the returned approve_url. Re-call with the same arguments plus this approval_id to run the action.') },
+    }, withApproval('reply_to_comment', async ({ comment_url_or_urn, text, target_member_id }) => proposePersonal('comment_reply', comment_url_or_urn, text, target_member_id)));
     server.registerTool('request_social_reply', {
         title: 'Request LinkedIn Reply Proposal',
         description: 'Create a review card for a personal LinkedIn reply from an external trigger or email notification. Never posts; a human Accept posts it.',

package/build/tools/templates.js

@@ -1,3 +1,4 @@
+import { withApproval } from '../lib/action-approvals.js';
 import { snapshotTemplateVersion, versionHasBodySnapshot } from '@sendinel/domain';
 import { z } from 'zod';
 import { logAudit } from '../audit.js';
@@ -377,8 +378,8 @@ export function registerTemplateTools(server) {
             openWorldHint: false,
         },
         description: 'Archive an email template. System templates cannot be deleted.',
-        inputSchema: { id: z.string().uuid() },
-    }, async ({ id }) => {
+        inputSchema: { approval_id: z.string().uuid().optional().describe('Get this by calling once without it, then have a human approve the returned approve_url. Re-call with the same arguments plus this approval_id to run the action.'), id: z.string().uuid() },
+    }, withApproval('delete_template', async ({ id }) => {
         const projectId = getProjectId();
         const { data: existing, error: existingErr } = await db().from('campaign_templates')
             .select('id, project_id')
@@ -395,7 +396,7 @@ export function registerTemplateTools(server) {
         if (error)
             return j({ error: error.message });
         return j({ ok: true, deleted: id });
-    });
+    }));
     server.registerTool('restore_template_version', {
         title: 'Restore Template Version',
         annotations: {

package/build/tools/webhooks.js

@@ -1,3 +1,4 @@
+import { withApproval } from '../lib/action-approvals.js';
 import { z } from 'zod';
 import { db } from '../db.js';
 import { getProjectId } from '../project.js';
@@ -34,11 +35,12 @@ export function registerWebhookTools(server) {
         },
         description: `Register a webhook URL to receive push notifications when events occur. Sendinel signs each payload with HMAC-SHA256 so you can verify authenticity. Valid events: ${VALID_EVENTS.join(', ')}`,
         inputSchema: {
+            approval_id: z.string().uuid().optional().describe('Get this by calling once without it, then have a human approve the returned approve_url. Re-call with the same arguments plus this approval_id to run the action.'),
             url: z.string().url().describe('HTTPS endpoint that will receive POST requests'),
             events: z.array(z.enum(VALID_EVENTS)).min(1).describe('Events to subscribe to'),
             description: z.string().optional().describe('Human-readable label, e.g. "Production orchestrator"'),
         },
-    }, async ({ url, events, description }) => {
+    }, withApproval('subscribe_webhook', async ({ url, events, description }) => {
         // SSRF protection
         const validation = validateWebhookUrl(url);
         if (!validation.valid)
@@ -63,7 +65,7 @@ export function registerWebhookTools(server) {
             message: `Webhook registered. Store the secret — it won't be shown again. Sendinel will POST to ${url} with X-Sendinel-Signature header for verification.`,
             verification_example: `const expected = crypto.createHmac('sha256', secret).update(requestBody).digest('hex'); if (header === 'sha256=' + expected) { /* valid */ }`,
         });
-    });
+    }));
     server.registerTool('list_webhook_subscriptions', {
         title: 'List Webhook Subscriptions',
         annotations: {
@@ -99,13 +101,14 @@ export function registerWebhookTools(server) {
         },
         description: 'Update a webhook subscription — change URL, events, or active status.',
         inputSchema: {
+            approval_id: z.string().uuid().optional().describe('Get this by calling once without it, then have a human approve the returned approve_url. Re-call with the same arguments plus this approval_id to run the action.'),
             subscription_id: z.string().uuid(),
             url: z.string().url().optional(),
             events: z.array(z.enum(VALID_EVENTS)).min(1).optional(),
             active: z.boolean().optional(),
             description: z.string().optional(),
         },
-    }, async ({ subscription_id, url, events, active, description }) => {
+    }, withApproval('update_webhook_subscription', async ({ subscription_id, url, events, active, description }) => {
         if (url) {
             const validation = validateWebhookUrl(url);
             if (!validation.valid)
@@ -130,7 +133,7 @@ export function registerWebhookTools(server) {
         if (error)
             return txt(`Error: ${error.message}`);
         return j(data);
-    });
+    }));
     server.registerTool('delete_webhook_subscription', {
         title: 'Delete Webhook Subscription',
         annotations: {
@@ -141,9 +144,10 @@ export function registerWebhookTools(server) {
         },
         description: 'Permanently delete a webhook subscription. This also deletes all delivery history for this subscription.',
         inputSchema: {
+            approval_id: z.string().uuid().optional().describe('Get this by calling once without it, then have a human approve the returned approve_url. Re-call with the same arguments plus this approval_id to run the action.'),
             subscription_id: z.string().uuid(),
         },
-    }, async ({ subscription_id }) => {
+    }, withApproval('delete_webhook_subscription', async ({ subscription_id }) => {
         const { error } = await db()
             .from('webhook_subscriptions')
             .delete()
@@ -152,5 +156,5 @@ export function registerWebhookTools(server) {
         if (error)
             return txt(`Error: ${error.message}`);
         return txt(`Subscription ${subscription_id} deleted.`);
-    });
+    }));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendinel/mcp-server",
-  "version": "1.0.63",
+  "version": "1.0.64",
   "description": "AI-controlled email operations control plane for campaigns, contacts, segments, analytics, and multi-provider sending via MCP.",
   "mcpName": "ai.sendinel/mcp-server",
   "type": "module",