@sendora/mcp 1.0.0 → 1.2.12

package/README.md

@@ -2,12 +2,12 @@
 
 The official [Model Context Protocol](https://modelcontextprotocol.io) server for
 [Sendora](https://sendora.se), transactional email delivery. It helps a coding
-agent such as Claude Code, Cursor or VS Code build against the API or
-`@sendora/sdk`: it reads Sendora's documentation, sends a test mail and reads what
+agent such as Claude Code, Cursor or VS Code build against the API,
+`@sendora/sdk` for TypeScript or `sendora` for Python: it reads Sendora's documentation, sends a test mail and reads what
 happened to it, and sets up streams, webhooks and sending domains.
 
 The documentation is built into it: the guides, every operation of the API
-reference, the error codes and the SDK's README and rules for agents, from the
+reference, the error codes and each SDK's README and rules for agents, from the
 same sources as [sendora.se/docs](https://sendora.se/docs), bundled with the
 release. It works offline and cannot describe a different version of the API
 than the one it shipped with.
@@ -63,12 +63,14 @@ on a test server, and what cannot be undone happens only to a test server.
   `read_inbound_message`, `list_inbound_domains`, `check_inbound_domain` and
   `add_inbound_domain`. The text of a received mail was written by a stranger:
   it reaches the model only from `read_inbound_message`, fenced and marked as
-  data, which lessens prompt injection without preventing it.
+  data, in an answer that is text alone so that every client shows the model
+  the fence, which lessens prompt injection without preventing it.
 - The account key: `list_servers`, `list_domains`, `check_domain`,
   `add_domain` and `delete_test_server`, which refuses a live server.
 
 The documents are resources under `sendora://docs/…`, `sendora://reference/…`,
-`sendora://errors`, `sendora://sdk/readme` and `sendora://sdk/skill`, listed by
+`sendora://errors`, `sendora://sdk/readme`, `sendora://sdk/skill`,
+`sendora://sdk/python/readme` and `sendora://sdk/python/skill`, listed by
 `sendora://index`. Three prompts: `set_up_sendora`, `why_not_delivered` and
 `verify_webhooks`.
 

package/dist/docs.js

@@ -23,6 +23,7 @@ function indexOf(documents) {
         ].join('\n'),
     };
 }
+const SKILLS = new Set(['sendora://sdk/skill', 'sendora://sdk/python/skill']);
 /** The bundle as `scripts/build-docs.ts` writes it, checked, with the index in front. */
 export function docsFrom(bundle) {
     const built = bundleSchema.parse(bundle).documents;
@@ -31,7 +32,9 @@ export function docsFrom(bundle) {
     if (byUri.size !== documents.length) {
         throw new Error('two documents of the bundle share an address');
     }
-    const index = searchIndex(documents);
+    // The skills are rules an agent reads whole, as the instructions say; searched,
+    // their condensed code ranked above the guides it condenses.
+    const index = searchIndex(documents.filter((doc) => !SKILLS.has(doc.uri)));
     return {
         documents,
         find: (uri) => byUri.get(uri.split('#')[0] ?? uri),
@@ -46,7 +49,7 @@ export function loadDocs(from = bundleUrl) {
         raw = readFileSync(from, 'utf8');
     }
     catch (error) {
-        throw new Error('The documentation bundle is missing; in the repository, run node apps/mcp/scripts/build-docs.ts', { cause: error });
+        throw new Error('The documentation bundle is missing; in the repository, run pnpm --filter @sendora/sdk build && node apps/mcp/scripts/build-docs.ts', { cause: error });
     }
     return docsFrom(JSON.parse(raw));
 }

package/dist/errors.js

@@ -41,7 +41,7 @@ const hints = {
     server_reserved: null,
     server_in_flight: null,
     request_too_large: null,
-    from_domain_not_verified: () => `The from address's domain must be a verified sending domain of the account. Sending domains are the account's, not a server's: with the account key, add_domain adds one and answers the DNS records to publish, and check_domain looks them up; or an administrator adds it under Domains (Domäner) in the dashboard, ${DASHBOARD}/domains.`,
+    from_domain_not_verified: () => `The from address's domain must be one of the account's sending domains that get_server lists as sendingDomains. To add one, which is the account's and not a server's: with the account key, add_domain adds it and answers the DNS records to publish, and check_domain looks them up; or an administrator adds it under Domains (Domäner) in the dashboard, ${DASHBOARD}/domains.`,
     stream_not_found: null,
     stream_archived: null,
     stream_paused: null,

package/dist/exclusions.js

@@ -5,7 +5,7 @@
  * operation arrives with its tool or its line here.
  */
 export const exclusions = {
-    'POST /v1/email/batch': 'An agent sends one message and reads its outcome; a batch is code’s work, which the SDK serves.',
+    'POST /v1/email/batch': 'An agent sends one message and reads its outcome; a batch is code’s work, which the SDKs serve.',
     'GET /v1/inbound/{id}/raw': 'The raw MIME is bytes for a parser; read_inbound_message gives the parsed message inside the fence.',
     'GET /v1/inbound/{id}/attachments/{attachmentId}': 'A stranger’s attachment bytes are not for a model’s context; the read describes each attachment.',
     'GET /v1/inbound/domains/{id}': 'list_inbound_domains returns every field.',
@@ -25,4 +25,6 @@ export const exclusions = {
     'DELETE /v1/servers/{id}/tokens/{tokenId}': 'Revoking a key can break a live integration and cannot be undone.',
     'GET /v1/domains/{id}': 'list_domains returns every field.',
     'DELETE /v1/domains/{id}': 'A sending domain serves every server, live ones included; deleting it stops their mail and cannot be undone.',
+    'POST /v1/erasures': 'It deletes a person’s data on every server and cannot be undone; the customer’s staff or code asks for it.',
+    'GET /v1/erasures/{id}': 'It reads an erasure, which no tool requests.',
 };