@sendinel/mcp-server 1.0.9 → 1.0.11

package/build/server.js

@@ -4,7 +4,9 @@ import { registerCampaignTools } from './tools/campaigns.js';
 import { registerContactTools } from './tools/contacts.js';
 import { registerDraftTools } from './tools/drafts.js';
 import { registerGdprTools } from './tools/gdpr.js';
+import { registerLandingPageTools } from './tools/landing-pages.js';
 import { registerSegmentTools } from './tools/segments.js';
+import { registerListTools } from './tools/lists.js';
 import { registerSiteTools } from './tools/sites.js';
 import { registerAbTestingTools } from './tools/ab-testing.js';
 import { registerAdvisorTools } from './tools/advisor.js';
@@ -24,17 +26,24 @@ import { registerSocialPostTools } from './tools/social-posts.js';
 import { registerDataProposalTools } from './tools/data-proposals.js';
 import { registerSurveyTools } from './tools/surveys.js';
 import { registerShortLinkTools } from './tools/short-links.js';
+import { registerSignatureTools } from './tools/signatures.js';
 import { registerAiWorkTools } from './tools/ai-work.js';
 import { registerBrandKitTools } from './tools/brand-kit.js';
 import { registerNewsletterTools } from './tools/newsletters.js';
+import { registerGatewayTools } from './tools/gateway.js';
+import { registerSkillTools } from './tools/skills.js';
+import { registerConnectorTools } from './tools/connector.js';
+import { registerCloudImportTools } from './tools/cloud-import.js';
 const GROUP_REGISTRY = {
     analytics: registerAnalyticsTools,
     campaigns: registerCampaignTools,
     contacts: registerContactTools,
     segments: registerSegmentTools,
+    lists: registerListTools,
     drafts: registerDraftTools,
     sites: registerSiteTools,
     gdpr: registerGdprTools,
+    'landing-pages': registerLandingPageTools,
     'ab-testing': registerAbTestingTools,
     advisor: registerAdvisorTools,
     webhooks: registerWebhookTools,
@@ -53,36 +62,46 @@ const GROUP_REGISTRY = {
     'data-proposals': registerDataProposalTools,
     surveys: registerSurveyTools,
     'short-links': registerShortLinkTools,
+    signatures: registerSignatureTools,
     'ai-work': registerAiWorkTools,
     brand_kit: registerBrandKitTools,
     newsletters: registerNewsletterTools,
+    skills: registerSkillTools,
+    connector: registerConnectorTools,
+    'cloud-import': registerCloudImportTools,
 };
 export const ALL_TOOL_GROUPS = Object.keys(GROUP_REGISTRY);
 // ── Scope enforcement ─────────────────────────────────────────────────────
 // Maps tool names to required scope. Mirrors dashboard's WRITE_TOOLS/ADMIN_TOOLS.
 const WRITE_TOOLS = new Set([
-    'add_subscriber', 'import_subscribers', 'update_subscriber',
+    'add_subscriber', 'import_subscribers', 'update_subscriber', 'bulk_update_subscribers',
+    'create_subscriber_view', 'update_subscriber_view', 'delete_subscriber_view',
     'enrich_subscriber',
     'create_campaign', 'update_campaign', 'delete_campaign', 'add_campaign_step', 'update_campaign_status',
     'review_campaign_portfolio',
     'list_campaign_steps', 'update_campaign_step', 'delete_campaign_step',
-    'enroll_contact', 'enroll_segment', 'broadcast_to_segment', 'get_enrollment_status', 'clone_campaign', 'generate_email',
+    'enroll_contact', 'enroll_segment', 'broadcast_to_segment', 'get_enrollment_status', 'clone_campaign', 'clone_sequence_template', 'generate_email',
     'create_social_campaign', 'schedule_social_post',
     'create_social_post', 'update_social_post', 'delete_social_post',
     'create_draft', 'approve_draft', 'reject_draft',
     'create_site', 'create_sender', 'update_site',
-    'create_template', 'update_template', 'delete_template', 'translate_template',
+    'create_template', 'update_template', 'delete_template', 'restore_template_version', 'delete_provider_credential', 'translate_template',
     'delete_subscriber_data', 'identify_inactive', 'set_subscriber_tags',
     'update_hygiene_config',
+    'create_custom_field', 'update_custom_field', 'delete_custom_field',
     'create_segment', 'update_segment', 'delete_segment', 'create_segment_nl',
+    'create_list', 'update_list', 'delete_list', 'add_list_members', 'remove_list_members', 'add_list_members_by_filter',
     'launch_campaign', 'merge_subscribers', 'create_campaign_with_content',
     'send_test_email', 'send_transactional', 'subscribe_webhook', 'update_webhook_subscription',
     'create_ab_test', 'promote_ab_winner', 'optimize_subject_lines',
     'unsubscribe_subscriber', 'add_suppression', 'remove_suppression',
     'trigger_automation', 'enroll_automation', 'create_escalation_ladder', 'enroll_in_escalation_ladder',
-    'update_scoring_rules', 'register_domain',
+    'update_scoring_rules', 'register_domain', 'publish_dmarc_record',
     'update_warmup_schedule', 'pause_warmup', 'resume_warmup',
     'create_form', 'invite_team_member',
+    'remove_team_member', 'set_team_member_role', 'set_member_project_access',
+    'resend_invitation', 'revoke_invitation',
+    'create_landing_page', 'update_landing_page', 'delete_landing_page',
     'start_provider_switch', 'get_provider_switch_status', 'rollback_provider_switch',
     'create_api_key', 'revoke_api_key', 'mark_notifications_read',
     'migrate_campaigns_from', 'start_platform_migration',
@@ -90,30 +109,48 @@ const WRITE_TOOLS = new Set([
     'create_asset_link',
     'set_white_label_settings', 'add_white_label_domain',
     'create_blog_post',
+    'generate_blog_post_image',
     'run_list_hygiene', 'run_portfolio_analysis',
     'abuse_monitor_override',
     'send_sms', 'send_sms_campaign', 'set_contact_sms_consent',
     'setup_campaign_from_brief', 'create_template_from_brief', 'diagnose_delivery_issue', 'onboard_new_site',
     'connect_platform', 'disconnect_platform', 'configure_platform_trigger',
+    'create_custom_webhook', 'rotate_custom_webhook_secret',
     'update_brand_voice', 'promote_draft_to_campaign',
     'propose_campaign_from_data', 'approve_data_proposal',
     'create_survey', 'update_survey', 'create_short_link', 'generate_qr_code',
+    'create_signature', 'update_signature',
     'mark_ai_work_item_seen', 'snooze_ai_work_item', 'dismiss_ai_work_item',
     'submit_ai_context_event',
-    'import_brand_kit_text', 'ingest_brand_assets_by_url', 'upload_brand_asset',
+    'import_brand_kit_text', 'rehost_brand_asset', 'ingest_brand_assets_by_url', 'upload_brand_asset',
     'create_newsletter', 'update_newsletter', 'create_newsletter_issue', 'schedule_newsletter_issue',
     'send_newsletter_issue', 'subscribe_to_newsletter', 'unsubscribe_from_newsletter',
+    'retry_send_queue_rows', 'cancel_send_queue_rows',
+    'replay_enrollment_dlq_rows',
+    'commit_staged_import', 'discard_staged_import', 'add_synced_folder', 'remove_synced_folder',
+    'retry_send_queue_rows', 'cancel_send_queue_rows', 'add_blackout_date', 'remove_blackout_date',
 ]);
 const ADMIN_TOOLS = new Set([
-    'delete_subscriber_data', 'list_deletion_log',
+    // Connector mutations write schema into a customer-owned database and
+    // rewrite how their data maps in (admin, not write: Kevin, 2026-09-11).
+    // NOTE: no apostrophes in comments inside these Sets -- tool-scopes.test.ts
+    // parses the block by matching single-quoted strings.
+    'install_connector_schema', 'install_connector_view', 'set_connector_mapping', 'resync_connector',
+    'delete_subscriber_data', 'list_deletion_log', 'list_ccpa_requests', 'action_ccpa_request',
+    'delete_subscriber_data', 'list_deletion_log', 'list_audit_log', 'get_audit_stats',
     'unsubscribe_subscriber', 'add_suppression', 'remove_suppression',
     'create_site', 'update_site',
     'delete_template', 'register_domain', 'onboard_new_site',
     'create_api_key', 'revoke_api_key', 'invite_team_member',
     'connect_platform', 'disconnect_platform', 'configure_platform_trigger',
+    'create_custom_webhook', 'rotate_custom_webhook_secret',
+    'remove_team_member', 'set_team_member_role', 'set_member_project_access',
+    'list_invitations', 'resend_invitation', 'revoke_invitation',
+    'connect_platform', 'disconnect_platform', 'configure_platform_trigger', 'delete_provider_credential',
     'abuse_monitor_override',
     'tenant_export_full',
     'identify_inactive', 'delete_segment',
+    'delete_signature',
     'merge_subscribers', 'delete_webhook_subscription',
     'set_white_label_settings', 'add_white_label_domain',
 ]);
@@ -129,12 +166,27 @@ function scopeAllows(keyScopes, required) {
     const requiredLevel = SCOPE_HIERARCHY[required] ?? 99;
     return keyScopes.some((s) => (SCOPE_HIERARCHY[s] ?? 0) >= requiredLevel);
 }
+// Names of the meta-tools gateway mode registers in place of the real catalog
+// (see tools/gateway.ts). Grouped as 'gateway' rather than any real tool
+// group -- a gateway-mode client's toolGroups list holds the groups it can
+// reach *through* invoke_tool, not a group these three tools belong to.
+export const GATEWAY_TOOL_NAMES = ['search_tools', 'describe_tool', 'invoke_tool'];
 /**
  * Collects tool-name → group metadata from the same group registry used by
  * registerAllTools(). Scope filtering and definition scanning are applied
  * through the same proxy path as real MCP registration.
  */
 export function getRegisteredToolGroups(options) {
+    const rawScopes = options?.scopes ?? [];
+    if (rawScopes.includes('gateway')) {
+        // Mirrors registerAllTools()'s own gateway branch: a client with only
+        // 'gateway' and no real permission scope (read/write/admin) alongside it
+        // gets nothing registered, so it must get nothing labeled here either.
+        const permissionScopes = rawScopes.filter((scope) => scope !== 'gateway');
+        if (!scopeAllows(permissionScopes, 'read'))
+            return {};
+        return Object.fromEntries(GATEWAY_TOOL_NAMES.map((name) => [name, 'gateway']));
+    }
     const groups = options?.toolGroups === undefined
         ? ALL_TOOL_GROUPS
         : options.toolGroups;
@@ -245,6 +297,13 @@ function createScopeProxy(server, scopes, toolGroup) {
     });
 }
 export function registerAllTools(server, options) {
+    const rawScopes = options?.scopes ?? [];
+    if (rawScopes.includes('gateway')) {
+        const permissionScopes = rawScopes.filter((scope) => scope !== 'gateway');
+        const proxied = createScopeProxy(server, permissionScopes, 'gateway');
+        registerGatewayTools(proxied, { scopes: permissionScopes, toolGroups: options?.toolGroups });
+        return;
+    }
     const groups = options?.toolGroups === undefined
         ? ALL_TOOL_GROUPS
         : options.toolGroups;

package/build/tools/analytics.js

@@ -9,6 +9,7 @@ const percent = (rate) => `${(rate * 100).toFixed(1)}%`;
 const pctNumber = (rate) => Math.round(rate * 1000) / 10;
 const roundRate = (rate) => Math.round(rate * 1000) / 1000;
 const clamp = (value, min, max) => Math.min(max, Math.max(min, value));
+const stripeLifecycleStatuses = ['active', 'trialing', 'past_due', 'canceled', 'unpaid', 'incomplete', 'incomplete_expired', 'paused'];
 const socialPlatforms = ['instagram', 'linkedin', 'twitter', 'facebook', 'tiktok', 'youtube', 'pinterest', 'uploadpost', 'other'];
 const socialPublishers = ['uploadpost', 'buffer'];
 const UPLOADPOST_API_BASE = process.env.UPLOADPOST_API_BASE || 'https://api.upload-post.com/api';
@@ -142,6 +143,61 @@ function addDeviationFlag(flags, metric, recent, baseline) {
         flags.push(`${metric} ${deviation > 0 ? 'up' : 'down'} ${(Math.abs(deviation) * 100).toFixed(1)}% vs 30d baseline`);
     }
 }
+function monthlyNormalizedCents(amountCents, interval, intervalCount) {
+    const count = intervalCount && intervalCount > 0 ? intervalCount : 1;
+    switch (interval) {
+        case 'month':
+            return amountCents / count;
+        case 'year':
+            return amountCents / (12 * count);
+        case 'week':
+            return (amountCents * 52) / (12 * count);
+        case 'day':
+            return (amountCents * 365) / (12 * count);
+        default:
+            return amountCents;
+    }
+}
+function buildRevenueAnalytics(params) {
+    const now = new Date().toISOString();
+    const lifecycle = Object.fromEntries(stripeLifecycleStatuses.map(status => [status, 0]));
+    for (const subscription of params.subscriptions) {
+        if (subscription.status && lifecycle[subscription.status] !== undefined) {
+            lifecycle[subscription.status] += 1;
+        }
+    }
+    const mrr = params.subscriptions
+        .filter(subscription => subscription.status === 'active' || subscription.status === 'trialing')
+        .reduce((sum, subscription) => {
+        const amount = subscription.amount_cents ?? 0;
+        return sum + monthlyNormalizedCents(amount, subscription.billing_interval, subscription.billing_interval_count);
+    }, 0);
+    const activeAtPeriodStart = params.subscriptions.filter(subscription => (subscription.stripe_created_at
+        && subscription.stripe_created_at < params.start
+        && (!subscription.canceled_at || subscription.canceled_at >= params.start))).length;
+    const canceledInPeriod = params.subscriptions.filter(subscription => (subscription.canceled_at
+        && subscription.canceled_at >= params.start
+        && subscription.canceled_at <= now)).length;
+    const newSubscriptionsInPeriod = params.subscriptions.filter(subscription => (subscription.stripe_created_at && subscription.stripe_created_at >= params.start)).length;
+    const revenueCollectedCents = params.invoices
+        .filter(invoice => invoice.paid === true && invoice.stripe_created_at && invoice.stripe_created_at >= params.start)
+        .reduce((sum, invoice) => sum + (invoice.amount_paid_cents ?? 0), 0);
+    const failedPaymentsInPeriod = params.invoices.filter(invoice => (invoice.paid === false && invoice.stripe_created_at && invoice.stripe_created_at >= params.start)).length;
+    return {
+        period_days: params.days,
+        period: { days: params.days, start: params.start },
+        connection_id: params.connectionId,
+        mrr_cents: Math.round(mrr),
+        lifecycle,
+        active_at_period_start: activeAtPeriodStart,
+        canceled_in_period: canceledInPeriod,
+        churn_rate: activeAtPeriodStart > 0 ? roundRate(canceledInPeriod / activeAtPeriodStart) : 0,
+        new_subscriptions_in_period: newSubscriptionsInPeriod,
+        revenue_collected_cents: revenueCollectedCents,
+        failed_payments_in_period: failedPaymentsInPeriod,
+        failed_payments_note: 'Best-effort count of unpaid invoices in the period; stripe_invoices does not store a dedicated payment_failed flag.',
+    };
+}
 function distinctEventCount(events, eventType, logIds) {
     return new Set(events
         .filter(event => event.event_type === eventType && event.email_log_id && logIds.has(event.email_log_id))
@@ -1003,6 +1059,47 @@ export function registerAnalyticsTools(server) {
             },
         });
     });
+    server.registerTool('get_revenue_analytics', {
+        title: 'Get Revenue Analytics',
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+        description: 'Get Stripe connector revenue, churn, MRR, subscription lifecycle, and failed-payment analytics for the current project.',
+        inputSchema: {
+            days: z.number().int().min(1).max(365).optional().default(30),
+            connection_id: z.string().uuid().optional(),
+        },
+    }, async ({ days = 30, connection_id }) => {
+        const projectId = getProjectId();
+        const start = new Date(Date.now() - days * 86_400_000).toISOString();
+        let subscriptionQuery = db()
+            .from('stripe_subscriptions')
+            .select('status, amount_cents, billing_interval, billing_interval_count, stripe_created_at, canceled_at')
+            .eq('project_id', projectId);
+        let invoiceQuery = db()
+            .from('stripe_invoices')
+            .select('paid, status, amount_paid_cents, stripe_created_at')
+            .eq('project_id', projectId);
+        if (connection_id) {
+            subscriptionQuery = subscriptionQuery.eq('connection_id', connection_id);
+            invoiceQuery = invoiceQuery.eq('connection_id', connection_id);
+        }
+        const [subscriptionRes, invoiceRes] = await Promise.all([subscriptionQuery, invoiceQuery]);
+        if (subscriptionRes.error)
+            return j({ error: subscriptionRes.error.message });
+        if (invoiceRes.error)
+            return j({ error: invoiceRes.error.message });
+        return j(buildRevenueAnalytics({
+            days,
+            start,
+            subscriptions: (subscriptionRes.data ?? []),
+            invoices: (invoiceRes.data ?? []),
+            connectionId: connection_id ?? null,
+        }));
+    });
     server.registerTool('abuse_monitor_status', {
         title: 'Abuse Monitor Status',
         annotations: {

package/build/tools/brand-kit.js

@@ -2,38 +2,15 @@ import { z } from 'zod';
 import { adminDb } from '../db.js';
 import { getProjectId } from '../project.js';
 import { downloadPublicAsset } from '../lib/ssrf-pinned-fetch.js';
+import { callSendinelV1 } from '../lib/v1-client.js';
 import { BRAND_ASSET_KINDS, isValidKind, persistBrandAsset, resolveKind, resolveMime, } from '../lib/brand-asset-persist.js';
 const j = (data) => ({ content: [{ type: 'text', text: JSON.stringify(data, null, 2) }] });
-function brandKitApiBase() {
-    return (process.env.NEXT_PUBLIC_APP_URL ?? process.env.SENDINEL_APP_URL ?? process.env.APP_URL ?? 'https://sendinel.ai').replace(/\/$/, '');
-}
 // import_brand_kit_text parses free-form Brand Core/Brand Brain/Content Library
 // markdown into voice fields, colors, templates, and social posts — a different,
-// more complex capability than the media-library asset tools below. Left on the
-// HTTP-proxy path (still requires SENDINEL_API_KEY) rather than re-implemented
-// here; see #2356 for the media-library-scoped fix this file otherwise contains.
+// more complex capability than the media-library asset tools below. Hosted MCP
+// calls it in-process; stdio keeps the authenticated v1 HTTP path.
 async function callBrandKitApi(path, body) {
-    const apiKey = process.env.SENDINEL_API_KEY;
-    if (!apiKey)
-        return { ok: false, error: 'SENDINEL_API_KEY is required to drive this brand_kit tool from MCP' };
-    const res = await fetch(`${brandKitApiBase()}${path}`, {
-        method: 'POST',
-        headers: {
-            Authorization: `Bearer ${apiKey}`,
-            'X-Sendinel-Project-Id': getProjectId(),
-            'Content-Type': 'application/json',
-        },
-        body: JSON.stringify(body),
-    });
-    const text = await res.text();
-    let parsed = text;
-    try {
-        parsed = JSON.parse(text);
-    }
-    catch { }
-    if (!res.ok)
-        return { ok: false, error: parsed || `HTTP ${res.status}` };
-    return { ok: true, data: parsed };
+    return callSendinelV1(path, { body });
 }
 async function getProjectOrgId(projectId) {
     const { data, error } = await adminDb()
@@ -66,6 +43,24 @@ export function registerBrandKitTools(server) {
         const result = await callBrandKitApi('/api/v1/brand-kit/import-text', { text });
         return result.ok ? j(result.data) : j({ error: result.error });
     });
+    server.registerTool('rehost_brand_asset', {
+        title: 'Rehost Drive-Linked Brand Asset',
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: false,
+            openWorldHint: false,
+        },
+        description: 'Convert a brand asset into a real hosted copy that can be used in email or social content. Drive-linked assets have a null url in list_brand_assets and the v1 brand-kit API; call this first to get a usable copy before referencing the asset in generated content.',
+        inputSchema: {
+            asset_id: z.string().uuid(),
+            purpose: z.enum(['email', 'social']),
+            platforms: z.array(z.string()).optional().describe('Required context when purpose is "social" and TikTok is a target platform (JPEG/WebP only).'),
+        },
+    }, async ({ asset_id, purpose, platforms }) => {
+        const result = await callBrandKitApi(`/api/v1/brand-kit/assets/${asset_id}/rehost`, { purpose, platforms });
+        return result.ok ? j(result.data) : j({ error: result.error });
+    });
     server.registerTool('list_brand_assets', {
         title: 'List Brand Assets',
         annotations: {
@@ -88,7 +83,7 @@ export function registerBrandKitTools(server) {
         const { data, error } = await sb
             .schema('email')
             .from('brand_media_assets')
-            .select('id, kind, filename, storage_path, mime_type, size_bytes, collection, tags, last_referenced_at, last_referenced_source, last_referenced_resource_id, reference_count, created_at, storage_backend')
+            .select('id, kind, filename, storage_path, description, backstory, mime_type, size_bytes, collection, tags, last_referenced_at, last_referenced_source, last_referenced_resource_id, reference_count, created_at, storage_backend')
             .eq('project_id', projectId)
             .eq('review_status', 'confirmed')
             .order('created_at', { ascending: false });
@@ -110,7 +105,7 @@ export function registerBrandKitTools(server) {
         }
         const totalMatching = rows.length;
         const page = rows.slice(0, cappedLimit);
-        const paths = page.filter((r) => r.storage_backend !== 'r2').map((r) => r.storage_path);
+        const paths = page.filter((r) => r.storage_backend !== 'r2' && r.storage_backend !== 'drive_link').map((r) => r.storage_path);
         const signedByPath = new Map();
         if (paths.length > 0) {
             const { data: signed } = await sb.storage.from('brand-assets').createSignedUrls(paths, 3600, { download: true });
@@ -124,6 +119,8 @@ export function registerBrandKitTools(server) {
                 id: r.id,
                 kind: r.kind,
                 filename: r.filename,
+                description: r.description ?? null,
+                backstory: r.backstory ?? null,
                 collection: r.collection,
                 tags: r.tags ?? [],
                 mime_type: r.mime_type,
@@ -159,8 +156,9 @@ export function registerBrandKitTools(server) {
             collection: z.string().max(120).optional(),
             tags: z.array(z.string()).max(50).optional(),
             brand_kit_id: z.string().uuid().optional(),
+            backstory: z.string().max(2000).optional().describe('Character backstory/profile text for avatar assets. Ignored for non-avatar assets.'),
         },
-    }, async ({ filename, content_base64, kind, collection, tags, brand_kit_id }) => {
+    }, async ({ filename, content_base64, kind, collection, tags, brand_kit_id, backstory }) => {
         const projectId = getProjectId();
         let bytes;
         try {
@@ -193,6 +191,7 @@ export function registerBrandKitTools(server) {
                 collection: collection ?? null,
                 tags: tags ?? [],
                 brandKitId: brand_kit_id ?? null,
+                backstory: resolvedKind === 'avatar' ? backstory?.trim() || null : null,
             });
             return j({
                 ok: true,