@sendinel/mcp-server 1.0.67 → 1.0.69

package/build/lib/ssrf-pinned-fetch.js

@@ -5,16 +5,23 @@
 // than a cross-package import — keep both in sync if the SSRF guard changes.
 import dns from 'node:dns/promises';
 import net from 'node:net';
-import { Agent } from 'undici';
+// #4049: fetch must come from the same undici as Agent. Node's global fetch bundles its own undici and
+// rejects a foreign dispatcher (UND_ERR_INVALID_ARG) before any request, so every pinned fetch failed.
+import { Agent, fetch as undiciFetch } from 'undici';
 export function createPinnedIpDispatcher(hostname, resolved) {
     const expectedHost = hostname.toLowerCase();
     return new Agent({
         connect: {
-            lookup(requestedHost, _options, callback) {
+            lookup(requestedHost, options, callback) {
                 if (String(requestedHost).toLowerCase() !== expectedHost) {
                     callback(new Error('Pinned fetch attempted to resolve an unexpected host'), []);
                     return;
                 }
+                // Node's connect asks for every address when options.all is set; answer in the shape it asked for.
+                if (options?.all) {
+                    callback(null, [{ address: resolved.address, family: resolved.family }]);
+                    return;
+                }
                 callback(null, resolved.address, resolved.family);
             },
         },
@@ -23,7 +30,7 @@ export function createPinnedIpDispatcher(hostname, resolved) {
 }
 export function fetchPinnedToResolvedIp(url, resolved, init = {}) {
     const dispatcher = createPinnedIpDispatcher(url.hostname, resolved);
-    return fetch(url, { ...init, dispatcher });
+    return undiciFetch(url, { ...init, dispatcher });
 }
 function isPrivateIp(address) {
     if (net.isIPv4(address)) {

package/build/server.d.ts

@@ -16,6 +16,17 @@ export declare const TESTER_CONNECTION_SCOPE = "tester";
 export declare function isTesterConnection(scopes: readonly string[] | null | undefined): boolean;
 /** Tools a tester connection may see and call: reads, plus anything that goes through a person's approval. */
 export declare function testerConnectionAllowsTool(name: string): boolean;
+/**
+ * Tools whose own input already has a top-level `project_id` that means something other than "the project
+ * to act on" (#4033). The per-call project override never reads, strips or checks it for these.
+ * A test keeps this list equal to the registered schemas.
+ */
+export declare const PROJECT_ID_NATIVE_TOOLS: ReadonlySet<string>;
+/**
+ * Tools that need a stated project when the connection is switched away from its home project (#4033):
+ * anything that goes through a person's approval, plus the two always-gated actions.
+ */
+export declare function isProjectPinnedWriteTool(name: string): boolean;
 export declare function testerConnectionRefusal(name: string): string;
 export declare const GATEWAY_TOOL_NAMES: string[];
 /**

package/build/server.js

@@ -191,6 +191,19 @@ export function testerConnectionAllowsTool(name) {
         || name === 'activate_campaigns'
         || isApprovalGatedAction(name);
 }
+/**
+ * Tools whose own input already has a top-level `project_id` that means something other than "the project
+ * to act on" (#4033). The per-call project override never reads, strips or checks it for these.
+ * A test keeps this list equal to the registered schemas.
+ */
+export const PROJECT_ID_NATIVE_TOOLS = new Set(['set_active_project', 'get_outbound_digest']);
+/**
+ * Tools that need a stated project when the connection is switched away from its home project (#4033):
+ * anything that goes through a person's approval, plus the two always-gated actions.
+ */
+export function isProjectPinnedWriteTool(name) {
+    return name === 'send_broadcast' || name === 'activate_campaigns' || isApprovalGatedAction(name);
+}
 export function testerConnectionRefusal(name) {
     return `"${name}" is not available to a tester connection. A tester connection can read, and can ask a person to approve outward actions: call an approval-gated tool (for example send_broadcast) and a person approves it from the approve_url it returns. To change this tool directly, ask the workspace owner to promote the connection in Dashboard > Agent Connect.`;
 }
@@ -337,7 +350,7 @@ export const SENDINEL_SERVER_INSTRUCTIONS = [
     'Sendinel runs email for this workspace: contacts, segments, campaigns, templates and sending.',
     'To send a one-off email, use send_broadcast: call it with an audience and a brief (or html + subject), show the person the subject, recipient count and approve_url it returns, then call it again with only approval_id once they have approved.',
     'Anything that emails real people needs a person to approve it. Never say an email was sent until the tool that sends it has succeeded.',
-    'In gateway mode, find tools with search_tools (plain words work, for example "send email" or "last campaign"), check arguments with describe_tool, then call invoke_tool.',
+    'On the hosted connection, any tool call (and invoke_tool) also accepts an optional project_id to act on one project for that call only; it is checked each time, and approval-gated tools require it when the connection was switched to another project. In gateway mode, find tools with search_tools (plain words work, for example "send email" or "last campaign"), check arguments with describe_tool, then call invoke_tool.',
 ].join(' ');
 export function registerAllTools(server, options) {
     const rawScopes = options?.scopes ?? [];

package/build/tools/analytics.js

@@ -453,7 +453,7 @@ export function registerAnalyticsTools(server) {
             idempotentHint: true,
             openWorldHint: false,
         },
-        description: 'Switch this connection to act on a different project you have access to, without reconnecting. Only available on an OAuth-connected session (claude.ai / Claude Code / Cursor); API keys and Synchronex connections stay pinned to their original project.',
+        description: 'Switch this connection to act on a different project you have access to, without reconnecting. Only available on an OAuth-connected session (claude.ai / Claude Code / Cursor); API keys and Synchronex connections stay pinned to their original project. This switch is shared by every session using the connection; to act on one project without changing it, pass project_id on that tool call instead.',
         inputSchema: {
             project_id: z.string().uuid().describe('Project UUID to switch to. Use list_projects to see what you can access.'),
         },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendinel/mcp-server",
-  "version": "1.0.67",
+  "version": "1.0.69",
   "description": "AI-controlled email operations control plane for campaigns, contacts, segments, analytics, and multi-provider sending via MCP.",
   "mcpName": "ai.sendinel/mcp-server",
   "type": "module",