@theronap/cortex-mcp 0.9.9 → 0.9.10

package/lib/capture.mjs

@@ -3,6 +3,7 @@ import { homedir } from 'os'
 import { resolve } from 'path'
 import { createHash } from 'crypto'
 import { fetchCortex, classify, resolveBase } from './diagnose.mjs'
+import { extractSession } from './edge_extract.mjs'
 
 // Project name from the hook cwd — cross-platform. Windows hooks send backslash paths,
 // and splitting on '/' alone turned the WHOLE path into one garbage project slug
@@ -65,6 +66,11 @@ function transcriptTail(path) {
 }
 
 export async function runCapture() {
+  // Recursion guard: edge extraction below shells out to `claude --print` with CORTEX_SUMMARIZING=1.
+  // That headless session fires its own Stop hook → this same capture command. Without this guard it
+  // would recurse (and re-ingest the summarizer's prompt as a phantom session). Bail immediately.
+  if (process.env.CORTEX_SUMMARIZING) { process.stderr.write('cortex: summarizer subprocess, skipping\n'); return }
+
   const token = process.env.CORTEX_TOKEN
   if (!token) { process.stderr.write('cortex: CORTEX_TOKEN not set, skipping\n'); return }
   const base = resolveBase(process.env.CORTEX_URL)
@@ -86,21 +92,32 @@ export async function runCapture() {
     if (Array.isArray(parsed.refs) && Date.now() - (parsed.ts ?? 0) < 12 * 3600 * 1000) hydratedFrom = parsed.refs
   } catch { /* none — guard stays a no-op */ }
 
+  // Extract LOCALLY on the subscription (claude -p): summary + people + non-person entities. The
+  // cloud then receives only the derived digest, never the raw transcript or the metered API
+  // summarizer (which has been the silent point of failure). Fall back to shipping the transcript
+  // tail only if local extraction is unavailable (e.g. `claude` not on PATH) so we never drop a
+  // session. The server re-validates people/entities — the edge is not trusted.
+  const common = {
+    source: 'claude-code',
+    project: repo,
+    sessionId: hook.session_id,
+    title: `Worked in ${repo}`,
+    payload: { session_id: hook.session_id, cwd: hook.cwd },
+    captureSource: 'hook', // T8: fallback writer — never clobbers a cortex-log ('skill') record
+    ...(hydratedFrom.length ? { hydratedFrom } : {}),
+  }
+  const extracted = transcript ? extractSession(transcript) : null
+  if (extracted && /^NOOP\b/i.test(extracted.summary)) { process.stderr.write('cortex: no-op session, skipping\n'); return }
+  const ingestBody = extracted
+    ? { ...common, summary: extracted.summary, people: extracted.people, entities: extracted.namedEntities }
+    : { ...common, transcript }
+
   let res
   try {
     res = await fetchCortex(`${base}/api/ingest`, {
       method: 'POST',
       headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
-      body: JSON.stringify({
-        source: 'claude-code',
-        project: repo,
-        sessionId: hook.session_id,
-        transcript,
-        title: `Worked in ${repo}`,
-        payload: { session_id: hook.session_id, cwd: hook.cwd },
-        captureSource: 'hook', // T8: fallback writer — never clobbers a cortex-log ('skill') record
-        ...(hydratedFrom.length ? { hydratedFrom } : {}),
-      }),
+      body: JSON.stringify(ingestBody),
     })
   } catch (e) {
     // Never break a session — just report and move on.

package/lib/edge_extract.mjs

@@ -0,0 +1,92 @@
+import { spawnSync } from 'child_process'
+
+// Edge session extractor (slice 2c) — ONE `claude --print` call on the user's SUBSCRIPTION that
+// produces summary + people + non-person entities LOCALLY, so the cloud receives only the derived
+// digest. The server-side summarizer (Anthropic API) silently failed in prod ~2026-06-16 and took
+// both session people AND the entity catalogue down; extracting here keeps the engine on `claude -p`
+// (the standing preference) and removes that dependency. Node-native (no bun) to match capture.mjs.
+//
+// edgeSafeEnv() strips EVERY ANTHROPIC_* var + CLAUDE_CODE_OAUTH_TOKEN before spawning, so the call
+// runs on the file-based subscription login and a stray ANTHROPIC_BASE_URL (e.g. a keytunnel proxy)
+// can't reroute "free, local" inference through a billed proxy or ship raw text off-machine. The
+// spawn also sets CORTEX_SUMMARIZING=1 so the headless session's own Stop hook no-ops (runCapture
+// guards on it) instead of recursing.
+//
+// CONTRACT: people[] / namedEntities[] shapes MUST stay compatible with the server validators
+// web/lib/engine/extract_people.ts (parsePeople) + extract_entities.ts (parseEntities). The prompt
+// fragments are copied from there; the SERVER validator is the enforced source of truth — the edge
+// is never trusted. Returns null on any failure → caller falls back to shipping the transcript tail.
+
+export function edgeSafeEnv(base = process.env, extra = {}) {
+  const env = {}
+  for (const [k, v] of Object.entries(base)) {
+    if (v === undefined) continue
+    if (k.startsWith('ANTHROPIC_') || k === 'CLAUDE_CODE_OAUTH_TOKEN') continue
+    env[k] = v
+  }
+  return { ...env, ...extra }
+}
+
+const PEOPLE_FRAGMENT =
+  '"people" (array of important, NAMED individuals mentioned — each an object with ' +
+  '"name" (the person\'s real full name as written — NEVER an email address, handle, or group alias), ' +
+  '"email" (only if explicitly stated, else null), ' +
+  '"company" (their org/employer if stated, else null), ' +
+  '"title" (their role if stated, else null), ' +
+  '"relationship" (one short phrase: how they relate to this work), ' +
+  '"importance" ("high" for people central to the work, "low" for incidental). ' +
+  'Only real named humans; omit anonymous or incidental mentions. Empty array is fine.)'
+
+const ENTITY_FRAGMENT =
+  '"namedEntities" (array of important NON-PERSON things this content is about — concrete, named ' +
+  'projects, processes, systems, products, documents, teams, tools, events, places, or topics. ' +
+  'Each an object with "name" (the specific name as written, NOT a generic word), ' +
+  '"kind" (one of: project|process|system|product|document|team|topic|tool|event|place), ' +
+  '"description" (one short phrase: what it is / how it relates to this work, else null), ' +
+  '"importance" ("high" if central to the work, "low" if incidental). ' +
+  'Do NOT include people or companies (those go in "people"). Omit vague/generic mentions. Empty array is fine.)'
+
+export function extractSession(transcript) {
+  const text = (transcript ?? '').trim()
+  if (!text || process.env.CORTEX_SUMMARIZE_DISABLED) return null
+  const prompt =
+    'You are processing a Claude Code work session for a knowledge base. Return ONLY minified JSON ' +
+    '(no prose, no markdown fences) with EXACTLY these three keys:\n' +
+    '"summary" (ONE concrete sentence under 20 words: what was worked on or decided. If the session ' +
+    'had no real work — greetings, no tasks — set summary to exactly "NOOP"),\n' +
+    PEOPLE_FRAGMENT + ',\n' +
+    ENTITY_FRAGMENT +
+    '\n\n--- SESSION ---\n' + text.slice(0, 12000) + '\n--- END ---'
+  try {
+    const r = spawnSync(
+      'claude',
+      ['--print', '--model', process.env.CORTEX_SUMMARY_MODEL ?? 'claude-haiku-4-5', prompt],
+      { env: edgeSafeEnv(process.env, { CORTEX_SUMMARIZING: '1' }), encoding: 'utf8', timeout: 90_000, maxBuffer: 4 * 1024 * 1024 },
+    )
+    if (r.status !== 0 || !r.stdout) return null
+    return parseEdgeJson(r.stdout.trim())
+  } catch {
+    return null
+  }
+}
+
+// Tolerant JSON extraction: the model may wrap output in prose / ```json fences, so grab the first
+// balanced-looking {...} span. Arrays pass through untouched — the SERVER validates them.
+export function parseEdgeJson(out) {
+  if (!out) return null
+  const start = out.indexOf('{')
+  const end = out.lastIndexOf('}')
+  if (start < 0 || end <= start) return null
+  try {
+    const o = JSON.parse(out.slice(start, end + 1))
+    const summary = typeof o.summary === 'string' ? o.summary.trim() : ''
+    if (!summary) return null
+    return {
+      summary: summary.slice(0, 200),
+      people: Array.isArray(o.people) ? o.people : [],
+      namedEntities: Array.isArray(o.namedEntities) ? o.namedEntities : [],
+    }
+  } catch {
+    return null
+  }
+}

package/lib/imessage_send.mjs

@@ -0,0 +1,88 @@
+// send_imessage — outbound iMessage via Messages.app. This is a personal automation, NOT org
+// intelligence: it writes nothing to Cortex. Three layers of safety (eng-review D3/D6/D10):
+//   D6  argv-safe: recipient + body are passed as osascript `on run argv` arguments, NEVER
+//       interpolated into the script source → no AppleScript injection, no quote/newline breakage.
+//   D3  draft-by-default: nothing sends unless the caller explicitly passes send:true.
+//   D10 recipient gating: an MCP send tool is reachable by any agent context (prompt-injection
+//       surface), so a boolean alone is not enough. Allowlisted recipients send on send:true;
+//       OFF-list recipients additionally require an out-of-band confirm secret the agent context
+//       doesn't have (CORTEX_IMESSAGE_SEND_CONFIRM), else the send is BLOCKED.
+import { spawn } from 'child_process'
+
+// AppleScript reads its inputs from argv — the message text is DATA, never code.
+const SEND_SCRIPT = `on run argv
+  set targetId to item 1 of argv
+  set targetMessage to item 2 of argv
+  tell application "Messages"
+    set targetService to 1st account whose service type = iMessage
+    set targetBuddy to participant targetId of targetService
+    send targetMessage to targetBuddy
+  end tell
+end run`
+
+export function phoneKey(raw) {
+  const d = String(raw).replace(/[^0-9]/g, '')
+  return d.length < 7 ? null : d.slice(-10)
+}
+function handleKey(h) {
+  return h.includes('@') ? h.trim().toLowerCase() : phoneKey(h)
+}
+export function loadSendAllowlist(raw = process.env.CORTEX_IMESSAGE_SEND_ALLOWLIST ?? '') {
+  const set = new Set()
+  for (const item of raw.split(',').map((s) => s.trim()).filter(Boolean)) {
+    set.add(item.includes('@') ? item.toLowerCase() : (phoneKey(item) ?? item))
+  }
+  return set
+}
+
+// Pure decision: what should happen, given inputs + config. Testable without Messages.app.
+//   → { action: 'draft' | 'send' | 'blocked', reason }
+export function decideSend({ recipient, message, send, confirm, allowlist, confirmSecret }) {
+  if (!recipient || !String(recipient).trim()) return { action: 'blocked', reason: 'no recipient' }
+  if (!message || !String(message).trim()) return { action: 'blocked', reason: 'empty message' }
+  if (!send) return { action: 'draft', reason: 'draft-by-default — re-call with send:true to actually send' }
+  const key = handleKey(String(recipient))
+  if (key && allowlist.has(key)) return { action: 'send', reason: 'allowlisted recipient' }
+  // off-list: require the out-of-band confirm secret
+  if (confirmSecret && confirm && confirm === confirmSecret) return { action: 'send', reason: 'off-list send authorized by confirm secret' }
+  return {
+    action: 'blocked',
+    reason: confirmSecret
+      ? 'recipient not allowlisted — pass the out-of-band confirm secret to send, or add them to CORTEX_IMESSAGE_SEND_ALLOWLIST'
+      : 'recipient not allowlisted — add them to CORTEX_IMESSAGE_SEND_ALLOWLIST (or set CORTEX_IMESSAGE_SEND_CONFIRM for an out-of-band override)',
+  }
+}
+
+export function sendViaOsascript(recipient, message) {
+  return new Promise((resolve) => {
+    let err = ''
+    let proc
+    try {
+      proc = spawn('osascript', ['-', String(recipient), String(message)], { stdio: ['pipe', 'ignore', 'pipe'] })
+    } catch (e) {
+      resolve({ ok: false, error: String(e) }); return
+    }
+    proc.stderr.on('data', (d) => { err += d })
+    proc.on('error', (e) => resolve({ ok: false, error: String(e) }))
+    proc.on('close', (code) => resolve({ ok: code === 0, error: err.trim() }))
+    proc.stdin.write(SEND_SCRIPT)
+    proc.stdin.end()
+  })
+}
+
+// Tool entry: decide, then act. Returns MCP content text.
+export async function runSendImessage({ recipient, message, send, confirm }) {
+  const decision = decideSend({
+    recipient, message, send, confirm,
+    allowlist: loadSendAllowlist(),
+    confirmSecret: process.env.CORTEX_IMESSAGE_SEND_CONFIRM ?? null,
+  })
+  if (decision.action === 'draft') {
+    return `📝 DRAFT (not sent) — to ${recipient}:\n${message}\n\n(${decision.reason})`
+  }
+  if (decision.action === 'blocked') {
+    return `🚫 Not sent: ${decision.reason}`
+  }
+  const r = await sendViaOsascript(recipient, message)
+  return r.ok ? `✅ Sent to ${recipient}.` : `❌ Send failed: ${r.error || 'Messages.app returned an error (is it signed in to iMessage? is Automation permission granted?)'}`
+}

package/lib/imessage_send.test.mjs

@@ -0,0 +1,35 @@
+import { test, expect } from 'bun:test'
+import { decideSend, loadSendAllowlist, phoneKey } from './imessage_send.mjs'
+
+const allow = loadSendAllowlist('+18015551234, mom@example.com')
+
+test('draft-by-default: no send flag → draft, never sends (D3)', () => {
+  const d = decideSend({ recipient: '+18015551234', message: 'hi', send: false, allowlist: allow, confirmSecret: null })
+  expect(d.action).toBe('draft')
+})
+
+test('allowlisted recipient + send:true → send (D10)', () => {
+  expect(decideSend({ recipient: '+1 (801) 555-1234', message: 'hi', send: true, allowlist: allow, confirmSecret: null }).action).toBe('send')
+  expect(decideSend({ recipient: 'MOM@example.com', message: 'hi', send: true, allowlist: allow, confirmSecret: null }).action).toBe('send')
+})
+
+test('off-list recipient + send:true, no secret → BLOCKED (D10 prompt-injection guard)', () => {
+  const d = decideSend({ recipient: '+19998887777', message: 'hi', send: true, allowlist: allow, confirmSecret: null })
+  expect(d.action).toBe('blocked')
+})
+
+test('off-list recipient sends only with the correct out-of-band confirm secret', () => {
+  expect(decideSend({ recipient: '+19998887777', message: 'hi', send: true, confirm: 'wrong', allowlist: allow, confirmSecret: 'sesame' }).action).toBe('blocked')
+  expect(decideSend({ recipient: '+19998887777', message: 'hi', send: true, confirm: 'sesame', allowlist: allow, confirmSecret: 'sesame' }).action).toBe('send')
+})
+
+test('empty recipient/message is blocked', () => {
+  expect(decideSend({ recipient: '', message: 'hi', send: true, allowlist: allow, confirmSecret: null }).action).toBe('blocked')
+  expect(decideSend({ recipient: '+18015551234', message: '  ', send: true, allowlist: allow, confirmSecret: null }).action).toBe('blocked')
+})
+
+test('phoneKey + allowlist normalization', () => {
+  expect(phoneKey('+1 (801) 555-1234')).toBe('8015551234')
+  expect(allow.has('8015551234')).toBe(true)
+  expect(allow.has('mom@example.com')).toBe(true)
+})

package/lib/server.mjs

@@ -4,8 +4,9 @@ import { z } from 'zod'
 import { writeFileSync, mkdirSync } from 'fs'
 import { homedir } from 'os'
 import { join } from 'path'
-import { createHash } from 'crypto'
+import { createHash, randomUUID } from 'crypto'
 import { fetchCortex, classify, resolveBase } from './diagnose.mjs'
+import { runSendImessage } from './imessage_send.mjs'
 
 // The Cortex MCP server (stdio). Serves the signed-in employee's scoped org
 // context to their AI assistant. CORTEX_TOKEN identifies the user + org.
@@ -19,6 +20,23 @@ export async function runServer(version) {
     process.exit(1)
   }
 
+  // Self active-sessions (ADR-0017): one MCP process = one AI session. A stable per-process key + the
+  // working dir identify this session; we heartbeat /api/session-ping while alive so the user can see
+  // all THEIR sessions via my_sessions. Self-only on the server; best-effort (never breaks serving).
+  const SESSION_KEY = randomUUID()
+  async function pingSession() {
+    try {
+      await fetchCortex(`${BASE}/api/session-ping`, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+        body: JSON.stringify({ sessionKey: SESSION_KEY, cwd: process.cwd() }),
+      })
+    } catch { /* best-effort heartbeat — never disrupt the session */ }
+  }
+  void pingSession()
+  const _hb = setInterval(() => void pingSession(), 60_000)
+  if (typeof _hb.unref === 'function') _hb.unref()   // don't keep the process alive just for the heartbeat
+
   // Cache context for 5 minutes so repeated tool calls don't re-fetch.
   let cache = null
   async function fetchContext() {
@@ -238,6 +256,160 @@ export async function runServer(version) {
     },
   )
 
+  server.registerTool(
+    'daily_brief',
+    {
+      title: 'Your daily brief',
+      description: 'A short, action-forward brief of what needs YOU today: pending decisions/directives, your stalled or unowned projects, today\'s meetings, who else moved on your work, and where you left off. The inverse of my_context — call it at the start of a session or whenever you want "what should I focus on?". RLS-scoped to you.',
+      inputSchema: {},
+    },
+    async () => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/brief`, { headers: { Authorization: `Bearer ${TOKEN}` } })
+      } catch (e) {
+        return { content: [{ type: 'text', text: `Could not build your brief: ${e.message}` }] }
+      }
+      if (!res.ok) {
+        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
+        return { content: [{ type: 'text', text: `Could not build your brief: ${d.message}` }] }
+      }
+      const { brief } = await res.json()
+      return { content: [{ type: 'text', text: brief || 'Nothing needs you right now.' }] }
+    },
+  )
+
+  server.registerTool(
+    'writing_style',
+    {
+      title: 'How the user writes (for drafting in their voice)',
+      description: 'Returns the user\'s saved writing-style profile so you can DRAFT in their voice (email, message, doc). Call this right before composing anything on their behalf. Self-only — it is always the calling user\'s own profile. If none is saved, it tells you to derive one and save it with set_writing_style.',
+      inputSchema: {},
+    },
+    async () => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/style`, { headers: { Authorization: `Bearer ${TOKEN}` } })
+      } catch (e) {
+        return { content: [{ type: 'text', text: `Could not load writing style: ${e.message}` }] }
+      }
+      if (!res.ok) {
+        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
+        return { content: [{ type: 'text', text: `Could not load writing style: ${d.message}` }] }
+      }
+      const { style } = await res.json()
+      return { content: [{ type: 'text', text: style }] }
+    },
+  )
+
+  server.registerTool(
+    'set_writing_style',
+    {
+      title: 'Save the user\'s writing-style profile',
+      description: 'Save (or update) a description of HOW the user writes — tone, sentence rhythm, structure, formatting habits, signature quirks — derived from prose you have seen them write this session. Store the STYLE, never their private content. Self-only: it always updates the calling user\'s own profile. Pass an empty string to clear it.',
+      inputSchema: { style_md: z.string().describe('a concise markdown description of the user\'s writing voice (tone/structure/quirks), ~1-2 paragraphs') },
+    },
+    async ({ style_md }) => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/style`, {
+          method: 'PUT',
+          headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+          body: JSON.stringify({ style_md }),
+        })
+      } catch (e) {
+        return { content: [{ type: 'text', text: `Could not save writing style: ${e.message}` }] }
+      }
+      if (!res.ok) {
+        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
+        return { content: [{ type: 'text', text: `Could not save writing style: ${d.message}` }] }
+      }
+      const r = await res.json()
+      return { content: [{ type: 'text', text: r.saved ? `Saved your writing-style profile (${r.chars} chars).` : 'Cleared your writing-style profile.' }] }
+    },
+  )
+
+  server.registerTool(
+    'org_report',
+    {
+      title: 'Cross-project status report',
+      description: 'A status digest across all projects you can see: how many are healthy vs slowing/stalled/unowned, what needs attention, and (for managers) cross-source gaps. RLS-scoped to you. Use for "where do things stand?" / a standup or weekly review.',
+      inputSchema: {},
+    },
+    async () => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/report`, { headers: { Authorization: `Bearer ${TOKEN}` } })
+      } catch (e) {
+        return { content: [{ type: 'text', text: `Could not build the report: ${e.message}` }] }
+      }
+      if (!res.ok) {
+        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
+        return { content: [{ type: 'text', text: `Could not build the report: ${d.message}` }] }
+      }
+      const { report } = await res.json()
+      return { content: [{ type: 'text', text: report }] }
+    },
+  )
+
+  server.registerTool(
+    'list_records',
+    {
+      title: 'List activity records (filtered)',
+      description: 'List recent activity records you can see, filtered by type, project, and recency. RLS-scoped. Use to enumerate "what happened on project X this week" or "recent meetings". Returns titles + ids (use an id with story/request_file).',
+      inputSchema: {
+        type: z.string().optional().describe("record type, e.g. 'meeting', 'comm', 'activity', 'ai_session', 'doc', 'note'"),
+        project: z.string().optional().describe('project key to filter to (e.g. "cortex")'),
+        since_days: z.number().optional().describe('only records from the last N days'),
+        limit: z.number().optional().describe('max rows (1-50, default 20)'),
+      },
+    },
+    async ({ type, project, since_days, limit }) => {
+      const qs = new URLSearchParams()
+      if (type) qs.set('type', type)
+      if (project) qs.set('project', project)
+      if (since_days != null) qs.set('since_days', String(since_days))
+      if (limit != null) qs.set('limit', String(limit))
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/records?${qs}`, { headers: { Authorization: `Bearer ${TOKEN}` } })
+      } catch (e) {
+        return { content: [{ type: 'text', text: `Could not list records: ${e.message}` }] }
+      }
+      if (!res.ok) {
+        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
+        return { content: [{ type: 'text', text: `Could not list records: ${d.message}` }] }
+      }
+      const { text } = await res.json()
+      return { content: [{ type: 'text', text }] }
+    },
+  )
+
+  server.registerTool(
+    'my_sessions',
+    {
+      title: 'My active AI sessions',
+      description: "See what all of YOUR OWN active Cortex/AI sessions are doing right now (working directory + how recently each was active), so you can coordinate across windows/devices. Self-only — only your own sessions, never anyone else's.",
+      inputSchema: {},
+    },
+    async () => {
+      let res
+      try {
+        res = await fetchCortex(`${BASE}/api/sessions?current=${encodeURIComponent(SESSION_KEY)}`, {
+          headers: { Authorization: `Bearer ${TOKEN}` },
+        })
+      } catch (e) {
+        return { content: [{ type: 'text', text: `Could not list your sessions: ${e.message}` }] }
+      }
+      if (!res.ok) {
+        const d = classify(res.status, res.headers.get('content-type'), await res.text(), res.headers.get('x-vercel-id'))
+        return { content: [{ type: 'text', text: `Could not list your sessions: ${d.message}` }] }
+      }
+      const { text } = await res.json()
+      return { content: [{ type: 'text', text }] }
+    },
+  )
+
   server.registerTool(
     'set_record_privacy',
     {
@@ -364,5 +536,25 @@ export async function runServer(version) {
     },
   )
 
+  // send_imessage — local outbound texting (NOT org intelligence; writes nothing to Cortex). Runs on
+  // this machine via Messages.app. Draft-by-default + recipient allowlist + OOB confirm (D3/D6/D10).
+  server.registerTool(
+    'send_imessage',
+    {
+      title: 'Send an iMessage (draft-by-default)',
+      description: 'Compose/send an iMessage via the local Messages app. SAFE BY DEFAULT: without send:true it only returns a draft preview. Sending requires the recipient to be on CORTEX_IMESSAGE_SEND_ALLOWLIST (or an out-of-band confirm). Use this to text someone on the user\'s behalf — always show the draft and get the user\'s OK before sending.',
+      inputSchema: {
+        recipient: z.string().describe('phone number (e.g. +18015551234) or iMessage email'),
+        message: z.string().describe('the message body to send'),
+        send: z.boolean().optional().describe('must be true to actually send; omit/false returns a draft preview only'),
+        confirm: z.string().optional().describe('out-of-band confirm secret, required to send to a recipient not on the allowlist'),
+      },
+    },
+    async ({ recipient, message, send, confirm }) => {
+      const text = await runSendImessage({ recipient, message, send, confirm })
+      return { content: [{ type: 'text', text }] }
+    },
+  )
+
   await server.connect(new StdioServerTransport())
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theronap/cortex-mcp",
-  "version": "0.9.9",
+  "version": "0.9.10",
   "description": "Connect your AI assistant to Cortex — your org's projects, activity, gaps, and directives, scoped to you.",
   "type": "module",
   "bin": {
@@ -18,6 +18,12 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "zod": "^3.23.8"
   },
-  "keywords": ["mcp", "cortex", "claude", "ai", "org-intelligence"],
+  "keywords": [
+    "mcp",
+    "cortex",
+    "claude",
+    "ai",
+    "org-intelligence"
+  ],
   "license": "MIT"
 }