@suveren/gateway 0.3.16 → 0.4.0

package/content/integrations/crm.json

@@ -12,55 +12,110 @@
   },
   "credentials": {
     "fields": [
-      { "key": "databaseUrl", "label": "Database URL (optional)", "type": "text", "placeholder": "Leave empty for local SQLite", "optional": true }
+      {
+        "key": "databaseUrl",
+        "label": "Database URL (optional)",
+        "type": "text",
+        "placeholder": "Leave empty for local SQLite",
+        "optional": true
+      }
     ],
-    "envMapping": { "DATABASE_URL": "databaseUrl" }
+    "envMapping": {
+      "DATABASE_URL": "databaseUrl"
+    }
   },
   "personalDefault": true,
   "oauth": null,
   "toolGating": {
     "default": {
       "executionMapping": {},
-      "staticExecution": { "contact_type": "customer" }
+      "staticExecution": {
+        "contact_type": "customer"
+      }
     },
     "overrides": {
       "create_contact": {
-        "executionMapping": { "type": "contact_type" },
-        "staticExecution": { "action_type": "write" }
+        "executionMapping": {
+          "type": "contact_type"
+        },
+        "staticExecution": {
+          "action_type": "write"
+        }
       },
       "update_contact": {
         "executionMapping": {},
-        "staticExecution": { "contact_type": "customer", "action_type": "write" }
+        "staticExecution": {
+          "contact_type": "customer",
+          "action_type": "write"
+        }
       },
       "delete_contact": {
         "executionMapping": {},
-        "staticExecution": { "contact_type": "customer", "action_type": "delete" }
+        "staticExecution": {
+          "contact_type": "customer",
+          "action_type": "delete"
+        }
       },
       "log_activity": {
         "executionMapping": {},
-        "staticExecution": { "contact_type": "customer", "action_type": "write" }
+        "staticExecution": {
+          "contact_type": "customer",
+          "action_type": "write"
+        }
       },
       "create_deal": {
         "executionMapping": {},
-        "staticExecution": { "contact_type": "customer", "action_type": "write" }
+        "staticExecution": {
+          "contact_type": "customer",
+          "action_type": "write"
+        }
       },
       "update_deal": {
         "executionMapping": {},
-        "staticExecution": { "contact_type": "customer", "action_type": "write" }
+        "staticExecution": {
+          "contact_type": "customer",
+          "action_type": "write"
+        }
       },
       "create_task": {
         "executionMapping": {},
-        "staticExecution": { "contact_type": "customer", "action_type": "write" }
+        "staticExecution": {
+          "contact_type": "customer",
+          "action_type": "write"
+        }
       },
       "complete_task": {
         "executionMapping": {},
-        "staticExecution": { "contact_type": "customer", "action_type": "write" }
+        "staticExecution": {
+          "contact_type": "customer",
+          "action_type": "write"
+        }
+      },
+      "find_contacts": {
+        "category": "read",
+        "boundField": "read_access",
+        "requiredValue": "unlimited"
+      },
+      "get_timeline": {
+        "category": "read",
+        "boundField": "read_access",
+        "requiredValue": "unlimited"
+      },
+      "get_pipeline": {
+        "category": "read",
+        "boundField": "read_access",
+        "requiredValue": "unlimited"
+      },
+      "list_tasks": {
+        "category": "read",
+        "boundField": "read_access",
+        "requiredValue": "unlimited"
       },
-      "find_contacts": { "category": "read" },
-      "get_timeline": { "category": "read" },
-      "get_pipeline": { "category": "read" },
-      "list_tasks": { "category": "read" },
-      "export_crm": { "category": "read" }
+      "export_crm": {
+        "category": "read",
+        "boundField": "export_access",
+        "requiredValue": "allowed"
+      }
     }
   },
   "templates": [
@@ -69,22 +124,41 @@
       "description": "Search contacts, view pipeline and timeline, log activities. No creates or deletes.",
       "risk": "low",
       "mode": "automatic",
-      "bounds": { "write_daily_max": "50", "delete_daily_max": "0" },
-      "context": { "contact_type": "customer,lead,partner,vendor" },
+      "bounds": {
+        "read_access": "unlimited",
+        "write_daily_max": "50",
+        "delete_daily_max": "0"
+      },
+      "context": {
+        "contact_type": "customer,lead,partner,vendor"
+      },
       "intent": "Allow the agent to browse CRM data and log activities. Read and log only — no creating, editing, or deleting records.",
       "ttl": 2592000,
-      "tags": ["read + log", "no deletes"]
+      "tags": [
+        "read + log",
+        "no deletes"
+      ]
     },
     {
       "name": "Full CRM with Review",
       "description": "Create contacts, deals, and tasks. Update and delete records. Every write requires approval.",
       "risk": "high",
       "mode": "review",
-      "bounds": { "write_daily_max": "50", "delete_daily_max": "10" },
-      "context": { "contact_type": "customer,lead,partner,vendor" },
+      "bounds": {
+        "read_access": "unlimited",
+        "write_daily_max": "50",
+        "delete_daily_max": "10"
+      },
+      "context": {
+        "contact_type": "customer,lead,partner,vendor"
+      },
       "intent": "Full CRM management — create, update, and delete contacts, deals, and tasks. Every write action requires my review before execution.",
       "ttl": 2592000,
-      "tags": ["50 writes/day", "10 deletes/day", "review mode"]
+      "tags": [
+        "50 writes/day",
+        "10 deletes/day",
+        "review mode"
+      ]
     }
   ],
   "setupHint": "No configuration needed — works out of the box.",

package/content/integrations/gmail.json

@@ -9,12 +9,24 @@
   "mcp": {
     "command": "gmail-mcp",
     "args": [],
-    "env": { "PORT": "0" }
+    "env": {
+      "PORT": "0"
+    }
   },
   "credentials": {
     "fields": [
-      { "key": "clientId", "label": "Client ID", "type": "text", "placeholder": "From Google Cloud Console" },
-      { "key": "clientSecret", "label": "Client Secret", "type": "password", "placeholder": "OAuth2 client secret" }
+      {
+        "key": "clientId",
+        "label": "Client ID",
+        "type": "text",
+        "placeholder": "From Google Cloud Console"
+      },
+      {
+        "key": "clientSecret",
+        "label": "Client Secret",
+        "type": "password",
+        "placeholder": "OAuth2 client secret"
+      }
     ],
     "envMapping": {
       "CLIENT_ID": "clientId",
@@ -31,48 +43,149 @@
       "https://www.googleapis.com/auth/gmail.modify",
       "https://www.googleapis.com/auth/gmail.send"
     ],
-    "credentialKeys": { "clientId": "clientId", "clientSecret": "clientSecret" },
+    "credentialKeys": {
+      "clientId": "clientId",
+      "clientSecret": "clientSecret"
+    },
     "tokenStorage": "refreshToken",
-    "extraParams": { "access_type": "offline", "prompt": "consent" }
+    "extraParams": {
+      "access_type": "offline",
+      "prompt": "consent"
+    }
   },
   "toolGating": {
     "default": {
       "executionMapping": {},
-      "staticExecution": { "recipient_count": 0 }
+      "staticExecution": {
+        "recipient_count": 0
+      }
     },
     "overrides": {
       "send_message": {
         "executionMapping": {
           "to": [
-            { "field": "recipient_count", "transform": "length" },
-            { "field": "allowed_recipients", "transform": "join" },
-            { "field": "allowed_domains", "transform": "join_domains" }
+            {
+              "field": "recipient_count",
+              "transform": "length"
+            },
+            {
+              "field": "allowed_recipients",
+              "transform": "join"
+            },
+            {
+              "field": "allowed_domains",
+              "transform": "join_domains"
+            }
           ]
         },
-        "staticExecution": { "action_type": "send" }
+        "staticExecution": {
+          "action_type": "send"
+        }
       },
       "create_draft": {
         "executionMapping": {
           "to": [
-            { "field": "recipient_count", "transform": "length" },
-            { "field": "allowed_recipients", "transform": "join" },
-            { "field": "allowed_domains", "transform": "join_domains" }
+            {
+              "field": "recipient_count",
+              "transform": "length"
+            },
+            {
+              "field": "allowed_recipients",
+              "transform": "join"
+            },
+            {
+              "field": "allowed_domains",
+              "transform": "join_domains"
+            }
           ]
         },
-        "staticExecution": { "action_type": "send" }
+        "staticExecution": {
+          "action_type": "send"
+        }
       },
       "send_draft": {
         "executionMapping": {},
-        "staticExecution": { "recipient_count": 1, "action_type": "send" }
+        "staticExecution": {
+          "recipient_count": 1,
+          "action_type": "send"
+        }
+      },
+      "list_messages": {
+        "category": "read",
+        "read": {
+          "ageField": "read_age_days",
+          "queryArg": "q",
+          "ageConstraint": "newer_than:{days}d",
+          "scopeTermTemplate": "(from:{v} OR to:{v})",
+          "pinnedArgs": {
+            "includeSpamTrash": false
+          },
+          "ageConflictPattern": "older_than:(\\d+)d"
+        }
+      },
+      "get_message": {
+        "category": "read",
+        "read": {
+          "ageField": "read_age_days",
+          "resultDatePath": "internalDate",
+          "participantsPath": "payload.headers",
+          "participantHeaders": [
+            "From",
+            "To"
+          ],
+          "blockResultValues": [
+            "SPAM",
+            "TRASH"
+          ],
+          "resultValuesPath": "labelIds"
+        }
+      },
+      "list_drafts": {
+        "category": "read",
+        "read": {
+          "ageField": "read_age_days",
+          "queryArg": "q",
+          "ageConstraint": "newer_than:{days}d",
+          "pinnedArgs": {
+            "includeSpamTrash": false
+          },
+          "ageConflictPattern": "older_than:(\\d+)d"
+        }
+      },
+      "get_draft": {
+        "category": "read",
+        "read": {
+          "ageField": "read_age_days",
+          "resultDatePath": "message.internalDate",
+          "blockResultValues": [
+            "SPAM",
+            "TRASH"
+          ],
+          "resultValuesPath": "message.labelIds"
+        }
+      },
+      "delete_draft": {
+        "executionMapping": {},
+        "staticExecution": {
+          "recipient_count": 0,
+          "action_type": "delete"
+        }
+      },
+      "get_attachment": {
+        "category": "read",
+        "readGovernance": "none",
+        "readGovernanceReason": "Transitively age-gated: an attachmentId is only obtainable from get_message, which enforces the read-age window. No independently addressable content."
+      },
+      "list_labels": {
+        "category": "read",
+        "readGovernance": "none",
+        "readGovernanceReason": "Enumerates label names/ids, not message content. Label names can be sensitive metadata; F7 will replace this exemption with a container allowlist filter (SPAM/TRASH stripped, then granted labels only)."
       },
-      "list_messages": { "category": "read" },
-      "get_message": { "category": "read" },
-      "get_attachment": { "category": "read" },
-      "list_drafts": { "category": "read" },
-      "get_draft": { "category": "read" },
-      "delete_draft": { "category": "read" },
-      "list_labels": { "category": "read" },
-      "get_profile": { "category": "read" }
+      "get_profile": {
+        "category": "read",
+        "readGovernance": "none",
+        "readGovernanceReason": "Returns the account's own address and message counts — the connector's own identity, no correspondence content."
+      }
     }
   },
   "templates": [
@@ -81,22 +194,46 @@
       "description": "Search and read emails. Cannot send, draft, or delete.",
       "risk": "low",
       "mode": "automatic",
-      "bounds": { "recipient_max": "0", "send_daily_max": "0", "read_max_age_days": "30", "read_daily_max": "100" },
-      "context": { "allowed_recipients": "", "allowed_domains": "" },
+      "bounds": {
+        "recipient_max": "0",
+        "send_daily_max": "0",
+        "read_max_age_days": "30",
+        "read_daily_max": "100"
+      },
+      "context": {
+        "allowed_recipients": "",
+        "allowed_domains": ""
+      },
       "intent": "Allow the agent to search and read my inbox (last 30 days). No sending or deleting.",
       "ttl": 2592000,
-      "tags": ["read-only", "30 days", "100 reads/day"]
+      "tags": [
+        "read-only",
+        "30 days",
+        "100 reads/day"
+      ]
     },
     {
       "name": "Send with Review",
       "description": "Read inbox and compose emails. Every outbound email requires your approval.",
       "risk": "high",
       "mode": "review",
-      "bounds": { "recipient_max": "5", "send_daily_max": "20", "read_max_age_days": "90", "read_daily_max": "200" },
-      "context": { "allowed_recipients": "", "allowed_domains": "" },
+      "bounds": {
+        "recipient_max": "5",
+        "send_daily_max": "20",
+        "read_max_age_days": "90",
+        "read_daily_max": "200"
+      },
+      "context": {
+        "allowed_recipients": "",
+        "allowed_domains": ""
+      },
       "intent": "Read my inbox and compose emails. Every send requires my review — I see the recipient, subject, and body before it goes out.",
       "ttl": 2592000,
-      "tags": ["5 recipients/email", "20 sends/day", "review mode"]
+      "tags": [
+        "5 recipients/email",
+        "20 sends/day",
+        "review mode"
+      ]
     }
   ],
   "setupHint": "Create OAuth credentials at Google Cloud Console.",

package/content/integrations/linkedin.json

@@ -61,9 +61,21 @@
         "executionMapping": {},
         "staticExecution": { "allowed_platforms": "linkedin", "action_type": "delete" }
       },
-      "get_post": { "category": "read" },
-      "list_posts": { "category": "read" },
-      "get_profile": { "category": "read" }
+      "get_post": {
+        "category": "read",
+        "readGovernance": "none",
+        "readGovernanceReason": "Reads the account's own already-published posts — content the owner authored and made public. No third-party or private correspondence."
+      },
+      "list_posts": {
+        "category": "read",
+        "readGovernance": "none",
+        "readGovernanceReason": "Lists the account's own already-published posts. No third-party or private correspondence."
+      },
+      "get_profile": {
+        "category": "read",
+        "readGovernance": "none",
+        "readGovernanceReason": "Returns the account's own public profile — the connector's own identity."
+      }
     }
   },
   "templates": [

package/content/integrations/mollie.json

@@ -7,8 +7,8 @@
   "profile": "charge",
   "npmPackage": "mcp-remote",
   "mcp": {
-    "command": "sh",
-    "args": ["-c", "mcp-remote https://mcp.mollie.com/mcp --header \"Authorization: Bearer $MOLLIE_ACCESS_TOKEN\""]
+    "command": "mcp-remote",
+    "args": ["https://mcp.mollie.com/mcp", "--header", "Authorization: Bearer ${MOLLIE_ACCESS_TOKEN}"]
   },
   "credentials": {
     "fields": [