@velaro/mcp-server 0.6.79 → 0.6.81

package/README.md

@@ -118,6 +118,7 @@ This works with any MCP client that supports HTTP/SSE transport — including Cl
 | `bot_list` | List all bot/AI configurations for this site |
 | `bot_get` | Get full bot config including system prompt |
 | `bot_update_prompt` | Update a bot's system prompt |
+| `ai_config_set_reply_format` | Set reply format: global (plain text), plain, or markdown |
 
 ### CRM Mobile Fields
 | Tool | What It Does |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@velaro/mcp-server",
-  "version": "0.6.79",
+  "version": "0.6.81",
   "description": "Velaro MCP server — connect Claude and other AI agents directly to your Velaro account: KB, workflows, bots, conversations, contacts, routing, and more.",
   "type": "module",
   "bin": {

package/server.js

@@ -299,7 +299,7 @@ async function gatewayInit() {
 const MESSAGING_ADMIN_TOOLS = new Set([
   'workflow_create', 'workflow_list', 'workflow_get', 'workflow_toggle',
   'bot_create', 'bot_list', 'bot_get', 'bot_update_prompt', 'bot_set_knowledge',
-  'ai_config_attach_index', 'call_pop_settings_get', 'call_pop_settings_set',
+  'ai_config_attach_index', 'ai_config_set_reply_format', 'call_pop_settings_get', 'call_pop_settings_set',
   'crm_mobile_fields_get', 'crm_mobile_fields_set',
   'agent_list', 'team_list', 'conversation_list', 'conversation_get', 'conversation_search',
   'contact_search', 'contact_get', 'routing_list', 'routing_get', 'site_info',
@@ -1165,6 +1165,18 @@ For multiSelect dynamic options: the variable named in dynamicOptionsVariable mu
       required: ['id', 'prompt'],
     },
   },
+  {
+    name: 'ai_config_set_reply_format',
+    description: 'Set how a bot formats replies. mode: global (follow global default, plain text, no markdown, no em/en dashes), plain (force plain text), markdown (allow markdown; explicit bullet/table requests are honored). Applies to every channel. Admin UI: Bots > AI Settings > General > Reply format.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        aiConfigId: { type: 'number', description: 'AI configuration ID (from bot_list)' },
+        mode:       { type: 'string', enum: ['global', 'plain', 'markdown'], description: 'Reply format mode' },
+      },
+      required: ['aiConfigId', 'mode'],
+    },
+  },
   {
     name: 'site_identity_secret_status',
     description: 'Check whether a visitor identity signing secret is configured for this site. The secret lets pre-authenticated visitors (already logged in to the customer website) skip the OTP challenge when the bot looks up their CRM data. Returns whether configured and the masked secret. To generate or rotate the secret, the customer goes to Admin → Account Settings → Security → "Visitor Identity Signing Secret".',
@@ -1904,6 +1916,33 @@ For multiSelect dynamic options: the variable named in dynamicOptionsVariable mu
       required: ['indexName'],
     },
   },
+  {
+    name: 'kb_advise_knowledge_strategy',
+    description: 'Recommend, per data source (manual_pdf, spec_sheet, policy_document, faq_or_help_pages, product_catalog, price_list, cross_reference_sheet, images_or_drawings, cad_files, other_documents), whether to embed all, embed some, use exact lookup or query live, exactly what to upload, and a rough size estimate. Pure computation: nothing is read or written. Estimates only. Wraps POST KnowledgeAdvisor/advise.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        sources: {
+          type: 'array',
+          items: {
+            type: 'object',
+            properties: {
+              kind: { type: 'string' },
+              name: { type: 'string' },
+              pages: { type: 'integer' },
+              rows: { type: 'integer' },
+              changeFrequency: { type: 'string', description: 'static | monthly | weekly | daily | realtime' },
+              hasExactIdentifiers: { type: 'boolean' },
+              scanned: { type: 'boolean' },
+              hasLiveSystem: { type: 'boolean' },
+            },
+            required: ['kind'],
+          },
+        },
+      },
+      required: ['sources'],
+    },
+  },
   {
     name: 'index_integrity_check',
     description: 'Read-only integrity report for a knowledge index: orphan chunks, records without chunks, count mismatches, duplicate records. Wraps GET IndexMove/Integrity.',
@@ -3651,6 +3690,51 @@ For multiSelect dynamic options: the variable named in dynamicOptionsVariable mu
     },
   },
 
+  // ── Business actions + SAP (one definition, many surfaces) ─────────────────────
+  {
+    name: 'sap_diagnose',
+    description: 'Run the SAP live diagnostic for a site: configuration completeness, authentication (real HTTP status) and, when deep, a per-capability read-only probe compared with what the capability matrix documents (S/4HANA on-prem/private/public, Business One, ECC via gateway). Never writes; a write capability is never reported as verified; secrets are never returned. Calls messaging GET diagnostics/test-sap?siteId=<id>&deep=<bool>. Velaro staff only.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        siteId: { type: 'number', description: 'Site to diagnose (e.g. 1032)' },
+        deep: { type: 'boolean', description: 'Probe every capability (default true). false = configuration + authentication only.' },
+      },
+      required: ['siteId'],
+    },
+  },
+  {
+    name: 'business_action_list',
+    description: 'List the shared business actions registered on the messaging API (e.g. get_customer_pricing, create_quote): name, whether it is a write, data class, freshness window, request JSON schema and the AI skill tool names that project it. One definition is served by the Velaro catalog or a connected ERP (SAP) beneath it. Site scope comes from the caller\'s auth context. Calls GET /BusinessActions.',
+    inputSchema: { type: 'object', properties: {} },
+  },
+  {
+    name: 'business_action_route',
+    description: 'Deterministically route free text to the business action(s) it means (no model call, no side effects, grants nothing - authorization stays in the executor). Returns ranked matches with score, matched terms and AI skill tool names. Calls POST /BusinessActions/Route.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        text: { type: 'string', description: 'What the customer or agent asked for, e.g. "what is my contract price for BRG-6204"' },
+        max: { type: 'number', description: 'Max matches (default 3)' },
+      },
+      required: ['text'],
+    },
+  },
+  {
+    name: 'business_action_execute',
+    description: 'Execute a business action as the authenticated caller (agent actor; site from auth context, never from arguments). Read actions return data with source system and freshness; write actions are idempotent: repeating the same idempotencyKey (or the same body in the same conversation) returns the stored result and never creates a duplicate, a timed-out write reports OUTCOMEUNKNOWN and must be verified in the system of record before retrying. Prices are never accepted from the caller for ERP-priced actions. Calls POST /BusinessActions/{name}/Execute.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        name: { type: 'string', description: 'Action name from business_action_list, e.g. get_customer_pricing or create_quote' },
+        request: { type: 'object', description: 'The action request body (see requestSchema from business_action_list)' },
+        idempotencyKey: { type: 'string', description: 'For writes: reuse the same key to replay the same result instead of creating another document' },
+        conversationId: { type: 'string', description: 'Optional conversation to attach the result to' },
+      },
+      required: ['name', 'request'],
+    },
+  },
+
   // ── CallRail Attribution ──────────────────────────────────────────────────────
   {
     name: 'callrail_get_attributions',
@@ -4643,14 +4727,15 @@ For multiSelect dynamic options: the variable named in dynamicOptionsVariable mu
   },
   {
     name: 'recruiting_list_applications',
-    description: 'List candidate applications submitted via the Recruiting Bot for this site (name, email, phone, role interest, work authorization, availability, submitted timestamp).',
+    description: 'List candidate applications submitted via the Recruiting Bot for this site (name, email, phone, role interest, work authorization, availability, submitted timestamp). Never contains EEOC self-ID data.',
     inputSchema: { type: 'object', properties: {}, required: [] },
   },
   // Recruiting/Applications/ExportEeoc (voluntary self-ID CSV export) is intentionally NOT
-  // exposed as an MCP tool -- it returns sensitive EEOC/OFCCP self-identification PII in bulk,
-  // and the existing admin-UI export link + `velaro recruiting applications export-eeoc` CLI
-  // command are the appropriate surfaces for a human-initiated compliance export, not an
-  // AI-reachable tool.
+  // exposed as an MCP tool -- it returns sensitive EEOC/OFCCP self-identification PII in bulk.
+  // It is administrator-only and audit-logged server-side (403 for ordinary agents); the
+  // admin-UI export button (Administrators only) and `velaro recruiting applications
+  // export-eeoc` CLI command are the appropriate surfaces for a human-initiated compliance
+  // export, not an AI-reachable tool. EEOC data is never returned per application.
 
   // -- Multi-employer job board: named posting sources --
   // Requires EnableRecruitingBot + EnableJobBoardMultiEmployer. Same siteId-from-auth-context
@@ -5749,6 +5834,9 @@ async function handleTool(name, args) {
     case 'bot_update_prompt':
       return await rpc('bot_update_prompt', args);
 
+    case 'ai_config_set_reply_format':
+      return await rpc('ai_config_set_reply_format', args);
+
     case 'site_identity_secret_status': {
       const settings = await api('GET', '/SiteSettings');
       const configured = settings?.identitySigningSecretConfigured ?? false;
@@ -6826,6 +6914,11 @@ async function handleTool(name, args) {
       const r = await messagingGet(`/IndexMove/MixedContent?index=${encodeURIComponent(args.indexName)}`);
       return JSON.stringify(r, null, 2);
     }
+    case 'kb_advise_knowledge_strategy': {
+      if (!Array.isArray(args.sources) || args.sources.length === 0) throw new Error('sources must be a non-empty array of { kind, ... }');
+      const r = await messagingPost('/KnowledgeAdvisor/advise', { sources: args.sources });
+      return JSON.stringify(r, null, 2);
+    }
     case 'index_integrity_check': {
       const r = await messagingGet(`/IndexMove/Integrity?index=${encodeURIComponent(args.indexName)}`);
       return JSON.stringify(r, null, 2);
@@ -7267,7 +7360,7 @@ async function handleTool(name, args) {
           const alerts = [];
           if (s.disconnectEvents > 0) alerts.push(`⚠ ${s.disconnectEvents} disconnect(s)`);
           if (s.tabHiddenEvents > 0)  alerts.push(`⚠ ${s.tabHiddenEvents} tab hidden`);
-          const recentDisconnects = (a.connectionEvents || []).filter(e => e.event?.toLowerCase().includes('disconnect')).slice(-3);
+          const recentDisconnects = (a.connectionEvents || []).filter(e => e.event?.toLowerCase().includes('disconnect')).slice(0, 3); // connectionEvents are newest-first
           return [
             `  ${a.agentName}${a.email ? ' <' + a.email + '>' : ''}`,
             `    Status time: ${statusParts.join(' | ') || 'no data'}`,
@@ -8708,6 +8801,35 @@ async function handleTool(name, args) {
       return JSON.stringify(r, null, 2);
     }
 
+    // ── Business actions + SAP ────────────────────────────────────────────────
+    case 'sap_diagnose': {
+      if (!args.siteId) return 'siteId is required.';
+      const deep = args.deep === false ? 'false' : 'true';
+      const r = await api('GET', `/diagnostics/test-sap?siteId=${encodeURIComponent(args.siteId)}&deep=${deep}`);
+      return JSON.stringify(r, null, 2);
+    }
+
+    case 'business_action_list': {
+      const r = await api('GET', '/BusinessActions');
+      return JSON.stringify(r, null, 2);
+    }
+
+    case 'business_action_route': {
+      if (!args.text) return 'text is required.';
+      const r = await api('POST', '/BusinessActions/Route', { text: args.text, max: args.max });
+      return JSON.stringify(r, null, 2);
+    }
+
+    case 'business_action_execute': {
+      if (!args.name) return 'name is required.';
+      if (!args.request || typeof args.request !== 'object') return 'request (object) is required.';
+      const qs = [];
+      if (args.idempotencyKey) qs.push(`idempotencyKey=${encodeURIComponent(args.idempotencyKey)}`);
+      if (args.conversationId) qs.push(`conversationId=${encodeURIComponent(args.conversationId)}`);
+      const r = await api('POST', `/BusinessActions/${encodeURIComponent(args.name)}/Execute${qs.length ? '?' + qs.join('&') : ''}`, args.request);
+      return JSON.stringify(r, null, 2);
+    }
+
     // ── CallRail Attribution ──────────────────────────────────────────────────
     case 'callrail_get_attributions': {
       const limit = Math.min(100, args.limit ?? 25);