@sendora/mcp 1.5.2 → 1.8.6

package/dist/generated/screens/domain-records.html

@@ -356,7 +356,7 @@ button:focus-visible {
   }
 
   // src/version.ts
-  var MCP_VERSION = "1.5.2";
+  var MCP_VERSION = "1.8.6";
 
   // screens/host.ts
   var PROTOCOL_VERSION = "2026-01-26";

package/dist/generated/screens/message-timeline.html

@@ -356,7 +356,7 @@ button:focus-visible {
   }
 
   // src/version.ts
-  var MCP_VERSION = "1.5.2";
+  var MCP_VERSION = "1.8.6";
 
   // screens/host.ts
   var PROTOCOL_VERSION = "2026-01-26";

package/dist/icons.js

@@ -0,0 +1,20 @@
+/*
+ * A client shows a server's icon at 16 to 32 px, where brand/README.md asks
+ * for the small cut on its cobalt tile, which reads on light and dark alike.
+ * The files are written inline, so neither the npm package nor the hosted
+ * image reads brand/ at run time. test/brand.test.ts checks that they decode
+ * to brand/favicon.svg and brand/favicon-64.png.
+ */
+/** The icons that serverInfo lists. */
+export const icons = [
+    {
+        src: 'data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA2NCA2NCI+PHJlY3Qgd2lkdGg9IjY0IiBoZWlnaHQ9IjY0IiByeD0iOCIgZmlsbD0iIzIyNDVkMSIvPjxwYXRoIGZpbGw9IiNmZmZmZmYiIGQ9Ik00IDIwSDEwLjZDMTIuNyAyMCAxNC44IDIwLjggMTYuMyAyMi4zTDI5LjkgMzZINDBWNDRIMjkuNEMyNy4zIDQ0IDI1LjIgNDMuMiAyMy43IDQxLjdMMTAuMSAyOEg0Wk01NCA0NFE1MS41IDQ0IDQ5LjcgNDIuM1E0OCA0MC41IDQ4IDM4UTQ4IDM1LjUgNDkuNyAzMy43UTUxLjUgMzIgNTQgMzJRNTYuNSAzMiA1OC4zIDMzLjdRNjAgMzUuNSA2MCAzOFE2MCA0MC41IDU4LjMgNDIuM1E1Ni41IDQ0IDU0IDQ0WiIvPjwvc3ZnPgo=',
+        mimeType: 'image/svg+xml',
+        sizes: ['any'],
+    },
+    {
+        src: 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAYAAACqaXHeAAAEP0lEQVR42u2bS0xcVRjHf+fOINAyDFAp1LS0ZXCjVAXRmlpsRdChMakLU+MjpQn4rCZCjLpQ042xCwVjqDYtNZamBqUL2yYQacWkunAhFiqlSqkQWkt5TQemM8M87hwXBFKRx6UOE4Z7/6ubOd+d5P+b75zvu+fOEUxRZmHbBgllwGMC1iFYTjRL4pbQg5CnBdT8deq+9puHxcRFlr0zNqR6q5DyZYRQWIqSqCD3xyWbKzrqs/2TALLsnbFq0NsoBI+iA0lJc3yyqbijPtuvAKiq91O9mAcQgoIxZ/ATAJFZ2LYBZOuSTftZpoMwhe5VJJTpzvz45DdJVZQqCArRqSSiSAGZgW4l1yoCkaBX+0IIi4LOZQAwABgADAAGAAOAAcAAYADQq8xTP7jUdM9Muyg4RoJ09fpo/mWUbxoduNxq9D8PZBa1SS0ApsrpUtlT/Tcnf3TqcwokWUxUvZvB68+n6XcNEALKS9J444U0fS+Cb+5Mi9pMCFsVKC9JY/dzK/VdBit2pUcdhLD3ARW70nnt2ZXRWwZn0g57Ch+Wr0YR2r744y+v8UXdwKIHYEq2vbpHS+D5Li8DwwEKHkpEaICwKScBf0Dya7t7aQCYhOAIULBRG4SHcxLw+UO0nPcsDQAA7RfnCSHXwphv8UIw38pNdQ0O4mIV3nvlDk0Q3i5dxZhfUvvd0IIZSVhmouSpFdjzraxfHYuU0HPFR8OZEWqPD+H2hsKTARNq/cODy6PySJ5FU8e4Jc/C9dEg5/70ht181to46ipt2DdbSU2JIcYsiDELUlNi2JSTwJNbk/j5NxeOETV8AABaL3hwe0Lka4XwQCLDI0F+7/SG9Zevq7SxJv22GWOsFhNb8hI59r2DQFCGDwDA2QsevGMhNt+vDcLWBxMZcoYPQtnTqdjzrXPGWS0mbnhD/6lKmvuAufTSjlTeKVsV9vS2PX5u1vGTn9/JXVnxmhfw7bsvLkwneODbQT460BfxVXz9mljNsZnTxIa1Fa45Nsjeg32R/r/P/4oN+7PAwfpBKr+6FjEAPVd8mmO7p4ldkE3RfV8PUHW4PyIAGs6MzCPWGbld4eqj/VQd7p9Xit6Kao8PcbnPP2dc71U/R04MR3ZbvPpoP+V7e3G6Fm732O0NUfZ+N71X/bOaf/GDbjzTdINhK4OzybLcxDPFKRRstGDLiGNFkllTC62lDE5oWbzCzu23U5xvnVztL/X6aPzJyZETw9OajxgA482QAcAAYAAwABgADAAGAAOAAcAAsPgASCldejUvJaMKQlzWcQL0KiBP6dW9gCZFQM34iUrdnZhSlZB6SBk/Syv3688/+7qaczsUgLhkc4VE/qAj+6dTrgfemiyDHfXZ/vgk8zaQ1Ut6OkhUKfks2RHc1tKSF/jX6fEJ2Z44e7dURalEFCHkumg/VieRN5CiR0CTElIPdTXndtw8/g9pUJA+sUHj5gAAAABJRU5ErkJggg==',
+        mimeType: 'image/png',
+        sizes: ['64x64'],
+    },
+];

package/dist/instructions.js

@@ -1,8 +1,8 @@
 import { KEYS_PAGE, } from './connection.js';
 import { INDEX_URI } from './docs.js';
 import { grantNote, LIVE_NOTE, SIMULATOR_NOTE, WRITES_OFF_NOTE } from './tools/server.js';
-const ABOUT = "Sendora is a transactional email service: an HTTP API, SMTP submission, SDKs for TypeScript (@sendora/sdk) and Python (sendora), signed webhooks and a message log with every delivery event. This server carries Sendora's documentation, and with a key, tools for that key's server or account.";
-const DOCS = `Use the SDK for the project's language: @sendora/sdk for TypeScript or JavaScript, sendora for Python, the HTTP API otherwise. Before writing code, find the answer with search_docs and read the document with read_doc; ${INDEX_URI} lists them all, and sendora://sdk/skill and sendora://sdk/python/skill hold the rules an agent must keep with each SDK.`;
+const ABOUT = "Sendora is a transactional email service: an HTTP API, SMTP submission, SDKs for TypeScript (@sendora/sdk), Python (sendora) and PHP (sendora/sendora-php, and sendora/sendora-laravel for Laravel), signed webhooks and a message log with every delivery event. This server carries Sendora's documentation, and with a key, tools for that key's server or account.";
+const DOCS = `Use the SDK for the project's language: @sendora/sdk for TypeScript or JavaScript, sendora for Python, sendora/sendora-php for PHP, or sendora/sendora-laravel in a Laravel app, which installs it; the HTTP API otherwise. Before writing code, find the answer with search_docs and read the document with read_doc; ${INDEX_URI} lists them all, and sendora://sdk/skill, sendora://sdk/python/skill and sendora://sdk/php/skill hold the rules an agent must keep with each SDK.`;
 const KEYS = 'Never print or repeat a Sendora key, and never write one into a file under version control; keys belong in the environment.';
 const LIVE_DASHBOARD = `A person makes and revokes this server's keys, and makes and deletes its webhooks, in the dashboard, ${KEYS_PAGE}, with changes on or off, since a new key or signing secret must not reach this conversation.`;
 const ACCOUNT_DASHBOARD = `A server and a key are made in the dashboard, ${KEYS_PAGE}, since a new key is a secret this conversation must not see; a live server is deleted there too.`;

package/dist/prompts.js

@@ -18,13 +18,13 @@ export function registerPrompts(server) {
             framework: z
                 .string()
                 .optional()
-                .describe('The web framework, such as Express, Next.js, Django or FastAPI.'),
+                .describe('The web framework, such as Express, Next.js, Django, FastAPI or Laravel.'),
         }),
     }, ({ framework }) => asking([
         `Set up Sendora for transactional email in this project, which uses ${forFramework(framework)}.`,
         '',
-        "1. Read sendora://docs/quickstart and the skill for the project's SDK, sendora://sdk/skill for TypeScript or sendora://sdk/python/skill for Python, with read_doc before writing any code, and follow the skill's rules.",
-        "2. Install the SDK for the project's language, @sendora/sdk for TypeScript or JavaScript or sendora for Python, and construct the client once at startup from SENDORA_API_TOKEN in the environment; in any other language, call the HTTP API with that key. Never write a key into a file under version control, and never print one.",
+        "1. Read sendora://docs/quickstart and the skill for the project's SDK, sendora://sdk/skill for TypeScript, sendora://sdk/python/skill for Python or sendora://sdk/php/skill for PHP, with read_doc before writing any code, and follow the skill's rules. In a Laravel app, read sendora://sdk/laravel/readme too.",
+        "2. Install the SDK for the project's language, @sendora/sdk for TypeScript or JavaScript, sendora for Python, sendora/sendora-php for PHP or sendora/sendora-laravel in a Laravel app, and construct the client once at startup from SENDORA_API_TOKEN in the environment; in any other language, call the HTTP API with that key. Never write a key into a file under version control, and never print one.",
         '3. Add a function that sends one message, with the idempotency the SDK gives every send, or an Idempotency-Key header over HTTP.',
         '4. If a test server key is connected here, send a test to delivered@simulator.sendora.se and to hardbounce@simulator.sendora.se, and show me how each ended; otherwise tell me how to connect one (sendora://docs/test-servers).',
         '5. Add a webhook endpoint that verifies every delivery before it parses it, as sendora://docs/webhooks shows.',
@@ -48,11 +48,11 @@ export function registerPrompts(server) {
             framework: z
                 .string()
                 .optional()
-                .describe('The web framework, such as Express, Next.js, Django or FastAPI.'),
+                .describe('The web framework, such as Express, Next.js, Django, FastAPI or Laravel.'),
         }),
     }, ({ framework }) => asking([
         `Make this project's Sendora webhook endpoint in ${forFramework(framework)} verify every delivery.`,
         '',
-        "Read sendora://docs/webhooks first. Before anything parses the body, verify it with the SDK for the project's language: in TypeScript verifyWebhook with the raw body and the Sendora-Signature header, or webhooks.receive with a Fetch Request; in Python verify_webhook with the raw body and the header; in any other language, the recipe in sendora://docs/webhooks. Answer 2xx quickly and do the work afterwards; key the handling on the event id, since deliveries arrive at least once. Keep the secret in the environment. Then test it: if a test server key is connected here, replay a delivery and check that the endpoint accepted it.",
+        "Read sendora://docs/webhooks first. Before anything parses the body, verify it with the SDK for the project's language: in TypeScript verifyWebhook with the raw body and the Sendora-Signature header, or webhooks.receive with a Fetch Request; in Python verify_webhook with the raw body and the header; in PHP WebhookVerifier::verify() with the raw body, the header and the secret; in a Laravel app the package's route, which checks each signature and fires a Laravel event; in any other language, the recipe in sendora://docs/webhooks. Answer 2xx quickly and do the work afterwards; key the handling on the event id, since deliveries arrive at least once. Keep the secret in the environment. Then test it: if a test server key is connected here, replay a delivery and check that the endpoint accepted it.",
     ].join('\n')));
 }

package/dist/search.js

@@ -28,17 +28,20 @@ function singular(word) {
 }
 /**
  * The terms of a text: its words lower-cased and singular, the words of a
- * question that carry nothing left out, and a word joined by underscores also
- * as its parts, so `recipient_suppressed` is found by either word.
+ * question that carry nothing left out, and a word joined by underscores or
+ * written in camelCase also as its parts, so `recipient_suppressed` is found
+ * by either word, and so is `idempotencyKey`.
  */
 export function termsOf(text) {
     return text
-        .toLowerCase()
         .split(/[^\p{L}\p{N}_]+/u)
-        .filter((word) => word !== '' && !STOPWORDS.has(word))
-        .flatMap((word) => {
-        const parts = word.split('_').filter((part) => part !== '' && !STOPWORDS.has(part));
-        return parts.length > 1 ? [word, ...parts] : [word];
+        .map((word) => ({ word: word.toLowerCase(), parts: word.split(/_|(?<=\p{Ll})(?=\p{Lu})/u) }))
+        .filter(({ word }) => word !== '' && !STOPWORDS.has(word))
+        .flatMap(({ word, parts }) => {
+        const kept = parts
+            .map((part) => part.toLowerCase())
+            .filter((part) => part !== '' && !STOPWORDS.has(part));
+        return kept.length > 1 ? [word, ...kept] : [word];
     })
         .map(singular);
 }

package/dist/server.js

@@ -1,5 +1,6 @@
 import { McpServer } from '@modelcontextprotocol/server';
 import { registerDocuments } from './documents.js';
+import { icons } from './icons.js';
 import { instructionsFor } from './instructions.js';
 import { listed, targetsFor } from './listing.js';
 import { registerPrompts } from './prompts.js';
@@ -24,6 +25,7 @@ export function buildServer(docs, connection) {
         title: 'Sendora',
         version: MCP_VERSION,
         websiteUrl: 'https://sendora.se/docs/mcp',
+        icons,
     }, {
         instructions: instructionsFor(connection),
         cacheHints: {

package/dist/tools/docs.js

@@ -52,7 +52,7 @@ export const docsTools = [
         operations: [],
         register: (server, { docs }) => server.registerTool('read_doc', {
             title: 'Read a Sendora document',
-            description: `Read one of Sendora's documents whole, as Markdown: a guide (sendora://docs/…), an API operation (sendora://reference/…), the error codes (sendora://errors) or an SDK's README and rules for agents (sendora://sdk/readme and sendora://sdk/skill for TypeScript, sendora://sdk/python/readme and sendora://sdk/python/skill for Python). ${INDEX_URI} lists every document; search_docs finds the right one.`,
+            description: `Read one of Sendora's documents whole, as Markdown: a guide (sendora://docs/…), an API operation (sendora://reference/…), the error codes (sendora://errors) or an SDK's README and rules for agents (sendora://sdk/readme and sendora://sdk/skill for TypeScript, sendora://sdk/python/readme and sendora://sdk/python/skill for Python, sendora://sdk/php/readme and sendora://sdk/php/skill for PHP, and sendora://sdk/laravel/readme for Laravel). ${INDEX_URI} lists every document; search_docs finds the right one.`,
             inputSchema: z.object({
                 uri: z.string().min(1).describe(`A document's address, such as ${INDEX_URI}.`),
             }),

package/dist/tools/messages.js

@@ -71,13 +71,20 @@ export const messageDetailOutput = messageOutput.extend({
         .describe("The timeline, oldest event first, with the receiver's answer: Reception, Delivery, TransientFailure, Bounce, Feedback for a complaint and more."),
 });
 export const searchInput = z.object({
-    recipient: z.email().optional().describe('Messages to this address, in to, cc or bcc.'),
+    recipient: z
+        .string()
+        .trim()
+        .min(3)
+        .max(254)
+        .optional()
+        .describe('Messages to this address, in to, cc or bcc. A whole address matches exactly. Anything else of three characters or more matches anywhere in an address, such as kommun.se.'),
     streamId: z.uuid().optional().describe('Messages on this stream of the server.'),
     broadcastId: z.uuid().optional().describe('Messages of this broadcast.'),
     tag: z.string().trim().min(1).max(100).optional().describe('Messages sent with this tag.'),
-    status: recipientStatus
+    status: z
+        .union([recipientStatus, z.array(recipientStatus).min(1).max(5)])
         .optional()
-        .describe('Messages with at least one recipient in this state.'),
+        .describe('Messages with at least one recipient in this state, or in any of these states.'),
     from: z.iso
         .datetime({ offset: true })
         .optional()
@@ -95,7 +102,7 @@ export const searchMessagesTool = {
     operations: ['POST /v1/messages/search'],
     register: (server, { connection, targets }) => registerServerTool(server, targets, 'search_messages', {
         title: 'Search the message log',
-        description: "Searches this server's message log, newest first, by recipient, stream, broadcast, tag, a recipient's state and when the message was submitted. Answers each message with its recipients and their state, and next for the following page; get_message reads one message's timeline.",
+        description: "Searches this server's message log, newest first, by a recipient's address or part of one, stream, broadcast, tag, a recipient's state and when the message was submitted. Answers each message with its recipients and their state, and next for the following page; get_message reads one message's timeline.",
         inputSchema: searchInput,
         outputSchema: z.object({
             messages: z.array(messageOutput).describe('The page of messages, newest first.'),

package/dist/tools/server.js

@@ -28,6 +28,14 @@ export const limitOutput = z.object({
     used: z.number().int().describe('Emails the period has taken so far.'),
     resetsAt: z.string().describe('When the period ends and the count starts again.'),
 });
+export const inboundCapOutput = z.object({
+    limit: z
+        .number()
+        .int()
+        .describe("Emails the account may receive in the calendar month in UTC, over every inbound stream; the account's monthly cap on sending until an administrator moves it."),
+    used: z.number().int().describe('Emails received this month so far, one per recipient.'),
+    resetsAt: z.string().describe('When the month ends and the count starts again.'),
+});
 export const streamOutput = z.object({
     streamId: z.string().describe('What a send names as streamId.'),
     kind: z
@@ -76,6 +84,9 @@ const outputSchema = z.object({
     limits: z
         .array(limitOutput)
         .describe('Every limit a send on the server is held to, with its use this minute or month.'),
+    inboundCap: inboundCapOutput
+        .nullable()
+        .describe("The account's monthly cap on received mail, apart from the limits on sending, with its use; past it, mail to the account is refused for now. Null on a test server, which receives no mail."),
     streams: z.array(streamOutput).describe("The server's streams; a send names one as streamId."),
     sendingDomains: z
         .array(sendableDomainOutput)
@@ -128,6 +139,7 @@ export const getServerTool = {
                     createdAt: own.createdAt,
                 },
                 limits: own.limits,
+                inboundCap: own.inboundCap,
                 streams,
                 sendingDomains: own.sendingDomains,
                 connection: { kind: own.mode, changes },

package/dist/tools/webhooks.js

@@ -11,6 +11,8 @@ const eventName = z.enum([
     'cap_warning',
     'cap_reached',
     'inbound',
+    'inbound_cap_warning',
+    'inbound_cap_reached',
 ]);
 export const webhookOutput = z.object({
     webhookId: z.string().describe('What the deliveries and a delete refer to.'),
@@ -198,7 +200,7 @@ export const createWebhookTool = {
     operations: ['POST /v1/webhooks'],
     register: (server, { connection, targets }) => registerServerTool(server, targets, 'create_webhook', {
         title: 'Add a webhook',
-        description: "Adds a webhook to this test server and answers its signing secret, shown this once: put it in the project's environment, such as SENDORA_WEBHOOK_SECRET in .env, never in a file under version control, and verify every delivery with the SDK: webhooks.receive or verifyWebhook in TypeScript, verify_webhook in Python. The API takes only a public https URL, so a local endpoint needs a tunnel. Events arrive as the simulator plays out each message.",
+        description: "Adds a webhook to this test server and answers its signing secret, shown this once: put it in the project's environment, such as SENDORA_WEBHOOK_SECRET in .env, never in a file under version control, and verify every delivery with the SDK: webhooks.receive or verifyWebhook in TypeScript, verify_webhook in Python, WebhookVerifier::verify() in PHP, or in Laravel the package's route. The API takes only a public https URL, so a local endpoint needs a tunnel. Events arrive as the simulator plays out each message.",
         inputSchema: createWebhookInput,
         outputSchema: createdWebhookOutput,
         annotations: {

package/dist/version.js

@@ -1,2 +1,2 @@
 /** This package's version, held equal to its package.json by a test. */
-export const MCP_VERSION = '1.5.2';
+export const MCP_VERSION = '1.8.6';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendora/mcp",
-  "version": "1.5.2",
+  "version": "1.8.6",
   "description": "The official MCP server for Sendora: its documentation and API for coding agents.",
   "license": "MIT",
   "type": "module",
@@ -25,7 +25,7 @@
   "dependencies": {
     "@modelcontextprotocol/server": "^2.1.0",
     "zod": "^4.6.2",
-    "@sendora/sdk": "^4.1.0"
+    "@sendora/sdk": "^4.4.1"
   },
   "devDependencies": {
     "@anthropic-ai/mcpb": "2.1.2",
@@ -40,10 +40,10 @@
     "typescript": "~7.0.2",
     "vitest": "^4.1.11",
     "@sendora/api": "0.0.0",
-    "@sendora/db": "0.0.0",
     "@sendora/domain": "0.0.0",
+    "@sendora/site": "0.0.0",
     "@sendora/observability": "0.0.0",
-    "@sendora/site": "0.0.0"
+    "@sendora/db": "0.0.0"
   },
   "scripts": {
     "build": "pnpm --filter @sendora/sdk build && node scripts/build-docs.ts && node scripts/build-screens.ts && node -e \"fs.rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.build.json && node -e \"fs.mkdirSync('dist/generated',{recursive:true});fs.copyFileSync('src/generated/docs.json','dist/generated/docs.json');fs.cpSync('src/generated/screens','dist/generated/screens',{recursive:true})\"",