conduyt-mcp 4.72.1 → 4.74.0

package/README.md

@@ -1,13 +1,13 @@
 # Conduyt MCP Server
 
-MCP server for [Conduyt CRM](https://conduyt.app) — expose your CRM as AI-accessible tools. Covers the core CRM surface (contacts, deals, pipelines, custom fields, automations, messaging, and more); use `conduyt_api_catalog` to discover the full set of 500+ REST endpoints.
+MCP server for [Conduyt CRM](https://conduyt.app) — expose your CRM as AI-accessible tools. Covers the core CRM surface (contacts, deals, pipelines, custom fields, automations, messaging, and more); use `conduyt_api_catalog` to discover the full set of 600+ REST endpoints.
 
 ## 299 Tools
 
 ### Discovery
 | Tool | Description |
 |------|-------------|
-| `conduyt_api_catalog` | Discover all 500+ API endpoints |
+| `conduyt_api_catalog` | Discover all 600+ API endpoints |
 | `conduyt_check_permissions` | Introspect current API key permissions |
 | `conduyt_search` | Global search across contacts, deals, companies, tasks |
 
@@ -26,7 +26,7 @@ MCP server for [Conduyt CRM](https://conduyt.app) — expose your CRM as AI-acce
 | `conduyt_list_deals` | List deals by pipeline, stage, or assignee |
 | `conduyt_get_deal` | Get deal details with history, including custom-field values |
 | `conduyt_create_deal` | Create a deal with full attributes — currency (e.g. GBP), probability, priority, expected close date, contact/company, and structured custom-field values |
-| `conduyt_update_deal` | Move stage, change value/currency, set probability or close date, reassign, mark won/lost, or write custom-field values |
+| `conduyt_update_deal` | Move stage, change value/currency, set probability or close date, reassign, mark won/lost, or write custom-field values; optional `expectedUpdatedAt` pins the `updatedAt` you read, and a stale pin returns 409 `deal_changed` with the current `updatedAt` and writes nothing |
 | `conduyt_import_deals` | Bulk-import deals (pipeline/stage by name, contact by email) via the canonical import engine — dedupes, side-effect-free, owner/admin only |
 
 ### Tasks
@@ -152,6 +152,13 @@ MCP server for [Conduyt CRM](https://conduyt.app) — expose your CRM as AI-acce
 | `conduyt_update_webhook` | Update URL, events, or enable/disable |
 | `conduyt_delete_webhook` | Delete a webhook endpoint |
 
+### WordPress forms
+| Tool | Description |
+|------|-------------|
+| `conduyt_list_form_intakes` | List the intake addresses: every active one with its full URL, then the revoked history (newest 200) |
+| `conduyt_create_form_intake` | Create an intake address for one Gravity Forms / WPForms / Elementor form (returns its full URL) |
+| `conduyt_revoke_form_intake` | Revoke an intake address (the row is kept for history) |
+
 ### Notifications
 | Tool | Description |
 |------|-------------|

package/dist/client.d.ts

@@ -11,12 +11,16 @@ export declare class ConduytApiError extends Error {
     readonly status: number | null;
     readonly code: "http" | "timeout" | "response_too_large" | "network";
     readonly retryable: boolean;
+    /** The response's Retry-After, in seconds, when it sent one (a busy 503 / a 429): surfaced to the agent, never used
+     *  to replay a mutation. */
+    readonly retryAfterSeconds: number | null;
     constructor(opts: {
         message: string;
         status?: number | null;
         code: ConduytApiError["code"];
         retryable: boolean;
         cause?: unknown;
+        retryAfterSeconds?: number | null;
     });
 }
 /** Per-call overrides for legitimately long/large operations (GDPR export,

package/dist/client.js

@@ -10,12 +10,16 @@ export class ConduytApiError extends Error {
     status;
     code;
     retryable;
+    /** The response's Retry-After, in seconds, when it sent one (a busy 503 / a 429): surfaced to the agent, never used
+     *  to replay a mutation. */
+    retryAfterSeconds;
     constructor(opts) {
         super(opts.message, opts.cause !== undefined ? { cause: opts.cause } : undefined);
         this.name = "ConduytApiError";
         this.status = opts.status ?? null;
         this.code = opts.code;
         this.retryable = opts.retryable;
+        this.retryAfterSeconds = opts.retryAfterSeconds ?? null;
     }
 }
 /** Bounded defaults; each overridable via config / env (see src/index.ts). */
@@ -163,11 +167,14 @@ export class ConduytClient {
             if (text)
                 msg = text.slice(0, 500);
         }
+        const retryAfterRaw = res.headers.get("retry-after");
+        const retryAfter = retryAfterRaw === null || retryAfterRaw.trim() === "" ? NaN : Number(retryAfterRaw);
         return new ConduytApiError({
             message: `Conduyt API ${res.status}: ${msg}`,
             status: res.status,
             code: "http",
             retryable: RETRYABLE_STATUSES.has(res.status),
+            retryAfterSeconds: Number.isFinite(retryAfter) && retryAfter >= 0 ? retryAfter : null,
         });
     }
     retryDelayMs(res, attemptIndex) {

package/dist/index.js

@@ -21,6 +21,7 @@ import { registerCalendarTools } from "./tools/calendar.js";
 import { registerFormTools } from "./tools/forms.js";
 import { registerInvoiceTools } from "./tools/invoices.js";
 import { registerWebhookTools } from "./tools/webhooks.js";
+import { registerFormIntakeTools } from "./tools/form-intakes.js";
 import { registerNotificationTools } from "./tools/notifications.js";
 import { registerCustomFieldTools } from "./tools/custom-fields.js";
 import { registerSmartListTools } from "./tools/smart-lists.js";
@@ -93,6 +94,7 @@ registerCalendarTools(server, client);
 registerFormTools(server, client);
 registerInvoiceTools(server, client);
 registerWebhookTools(server, client);
+registerFormIntakeTools(server, client);
 registerNotificationTools(server, client);
 registerCustomFieldTools(server, client);
 registerSmartListTools(server, client);

package/dist/tools/deals.js

@@ -105,7 +105,8 @@ export function registerDealTools(server, client) {
         assignedTo: z.string().optional().describe("Reassign to user (owner) UUID"),
         source: z.string().trim().min(1).max(500).optional().describe("Attribution source for THIS deal (the trigger that produced it) — distinct from the contact's first-touch source. Every deal keeps a source (#129): it can be changed, never cleared (null/blank are rejected). 1-500 chars."),
         lostReason: z.string().optional().describe("Reason for a lost/disqualified deal. Some stages REQUIRE this on entry (the move fails with code STAGE_REQUIREMENTS listing lostReasonOptions when the stage has a configured dropdown — resend with one of those exact values)."),
-        customFields: z.record(z.any()).optional().describe("Structured custom-field values to merge, keyed by field key"),
+        customFields: z.record(z.any()).optional().describe("Structured custom-field values to merge, keyed by field key (send null for a key to clear it; keys you omit keep their current values)"),
+        expectedUpdatedAt: z.string().datetime({ message: "expectedUpdatedAt must be the deal's updatedAt exactly as the API returned it (UTC, trailing Z, e.g. 2026-10-06T23:19:00.000Z)" }).optional().describe("Optional: the deal's updatedAt from your last read, ISO 8601 exactly as returned (e.g. 2026-10-06T23:19:00.000Z). If the deal changed since, the update is refused (409, code deal_changed, with the current updatedAt) and nothing is written — read the deal again and retry. Omit for last-write-wins per field."),
     }, async ({ id, ...updates }) => {
         const result = await client.patch(`/api/v1/deals/${id}`, updates);
         return formatResult(result);

package/dist/tools/form-intakes.d.ts

@@ -0,0 +1,22 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { ConduytClient } from "../client.js";
+/**
+ * WordPress forms intake addresses (app 10-07, tri-surface parity): a per-form URL that Gravity Forms (Webhooks
+ * Add-On), WPForms (Webhooks addon) or Elementor Pro (Webhook action) posts submissions to; each submission becomes a
+ * contact. GET / POST /api/v1/integrations/wordpress-forms/intakes, DELETE /api/v1/integrations/wordpress-forms/intakes/{id}.
+ * Listing and creating need the "form-intakes" AND "contacts" scopes on a write or admin tier key (the URLs are
+ * credentials that create and edit contacts); revoking needs "form-intakes". Create and list answer each active intake's
+ * full `url` (the credential, to paste into the form plugin); a revoked intake's `url` is null.
+ */
+/** What each tool's key must hold: the API names only the FIRST missing scope, so a 403 is surfaced with all of it. */
+export declare const LIST_AND_CREATE_REQUIREMENT = "the form-intakes AND contacts scopes on a write or admin tier key (a member: settings.edit, contacts.create and contacts.edit)";
+export declare const REVOKE_REQUIREMENT = "the form-intakes scope on an admin tier key (a member: settings.edit)";
+/** A 403 names the complete requirement; a busy 503 says when to retry (never replayed here: create is a mutation). */
+export declare function intakeToolError(err: unknown, requirement: string): {
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    isError: true;
+};
+export declare function registerFormIntakeTools(server: McpServer, client: ConduytClient): void;

package/dist/tools/form-intakes.js

@@ -0,0 +1,72 @@
+import { z } from "zod";
+import { ConduytApiError, formatResult, formatToolError } from "../client.js";
+/**
+ * WordPress forms intake addresses (app 10-07, tri-surface parity): a per-form URL that Gravity Forms (Webhooks
+ * Add-On), WPForms (Webhooks addon) or Elementor Pro (Webhook action) posts submissions to; each submission becomes a
+ * contact. GET / POST /api/v1/integrations/wordpress-forms/intakes, DELETE /api/v1/integrations/wordpress-forms/intakes/{id}.
+ * Listing and creating need the "form-intakes" AND "contacts" scopes on a write or admin tier key (the URLs are
+ * credentials that create and edit contacts); revoking needs "form-intakes". Create and list answer each active intake's
+ * full `url` (the credential, to paste into the form plugin); a revoked intake's `url` is null.
+ */
+/** What each tool's key must hold: the API names only the FIRST missing scope, so a 403 is surfaced with all of it. */
+export const LIST_AND_CREATE_REQUIREMENT = "the form-intakes AND contacts scopes on a write or admin tier key (a member: settings.edit, contacts.create and contacts.edit)";
+export const REVOKE_REQUIREMENT = "the form-intakes scope on an admin tier key (a member: settings.edit)";
+/** A 403 names the complete requirement; a busy 503 says when to retry (never replayed here: create is a mutation). */
+export function intakeToolError(err, requirement) {
+    if (err instanceof ConduytApiError) {
+        if (err.status === 403)
+            return formatToolError(`${err.message}. This tool needs ${requirement}.`);
+        if (err.status === 503 && err.retryAfterSeconds !== null) {
+            return formatToolError(`busy; retry after ${err.retryAfterSeconds} s (${err.message})`);
+        }
+    }
+    throw err;
+}
+export function registerFormIntakeTools(server, client) {
+    server.tool("conduyt_list_form_intakes", "List the account's WordPress form intake addresses: every active intake (newest first), then the revoked history (the newest 200 revocations): name, defaultTag, source, assignee, status, receivedCount, lastReceivedAt and `url`: the full address of every ACTIVE intake (the credential, to paste into the form plugin); null for a revoked one. Requires " +
+        LIST_AND_CREATE_REQUIREMENT +
+        " (the URLs are credentials that create and edit contacts).", {}, async () => {
+        try {
+            const result = await client.get("/api/v1/integrations/wordpress-forms/intakes");
+            return formatResult(result);
+        }
+        catch (err) {
+            return intakeToolError(err, LIST_AND_CREATE_REQUIREMENT);
+        }
+    });
+    server.tool("conduyt_create_form_intake", "Create a WordPress form intake address for one form. Answers the row with `url`, the full address (the credential; conduyt_list_form_intakes shows it too while the intake is active). Paste it into the form plugin's webhook URL (Gravity Forms Webhooks Add-On, WPForms Webhooks, Elementor Pro Webhook action). Each submission then creates or updates a contact (by email, then phone), applies defaultTag / source / assignedTo, and adds 'Submitted <form name>' with the message and fields to the contact's timeline. At most 100 active addresses per account; a busy answer (503) says how many seconds to wait before retrying. Requires " +
+        LIST_AND_CREATE_REQUIREMENT +
+        ".", {
+        name: z.string().trim().min(1).max(120).describe("What the form is, e.g. 'Contact page, Smith Roofing'"),
+        defaultTag: z.string().max(100).nullable().optional().describe("Tag NAME applied to every submission unless the submission sends its own tags (created on first use)"),
+        source: z.string().max(64).optional().describe("Contact source for submissions that do not send one (default 'wordpress')"),
+        assignedTo: z.string().uuid().nullable().optional().describe("User id (an active member) who owns new contacts; omit or null = lead routing decides"),
+    }, async ({ name, defaultTag, source, assignedTo }) => {
+        try {
+            // the body as ONE literal: the contract gate reads the request fields from it
+            const result = await client.post("/api/v1/integrations/wordpress-forms/intakes", {
+                name,
+                ...(defaultTag !== undefined ? { defaultTag } : {}),
+                ...(source !== undefined ? { source } : {}),
+                ...(assignedTo !== undefined ? { assignedTo } : {}),
+            });
+            return formatResult(result);
+        }
+        catch (err) {
+            return intakeToolError(err, LIST_AND_CREATE_REQUIREMENT);
+        }
+    });
+    server.tool("conduyt_revoke_form_intake", "Revoke a WordPress form intake address: submissions to it answer 404 from now on and create nothing. The row is kept (status 'revoked', revokedAt) for history; revoking a revoked address answers it unchanged. Requires " +
+        REVOKE_REQUIREMENT +
+        ".", {
+        id: z.string().uuid().describe("Intake UUID (from conduyt_list_form_intakes)"),
+    }, async ({ id }) => {
+        try {
+            const result = await client.del(`/api/v1/integrations/wordpress-forms/intakes/${id}`);
+            return formatResult(result);
+        }
+        catch (err) {
+            return intakeToolError(err, REVOKE_REQUIREMENT);
+        }
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "conduyt-mcp",
-  "version": "4.72.1",
+  "version": "4.74.0",
   "mcpName": "com.conduyt/mcp",
   "description": "MCP server for Conduyt CRM — expose CRM operations as AI-accessible tools",
   "type": "module",

package/scripts/coverage-matrix.json

@@ -1,11 +1,11 @@
 {
-  "generatedAt": "2026-10-02T16:12:21.781Z",
-  "toolCount": 299,
-  "totalEndpoints": 1036,
+  "generatedAt": "2026-10-07T06:35:55.228Z",
+  "toolCount": 302,
+  "totalEndpoints": 1047,
   "counts": {
-    "covered": 273,
-    "excluded": 313,
-    "planned": 450,
+    "covered": 276,
+    "excluded": 318,
+    "planned": 453,
     "uncategorized": 0
   },
   "matrix": {
@@ -189,6 +189,14 @@
       "status": "planned",
       "reason": "invoicing"
     },
+    "POST /api/v1/invoices/:id/overpayments/:overpaymentId/manual-refund": {
+      "status": "planned",
+      "reason": "invoicing"
+    },
+    "POST /api/v1/invoices/:id/overpayments/:overpaymentId/refund": {
+      "status": "planned",
+      "reason": "invoicing"
+    },
     "POST /api/v1/invoices/:id/payment-link": {
       "status": "planned",
       "reason": "invoicing"
@@ -235,6 +243,14 @@
       "status": "excluded",
       "reason": "public unauthenticated surfaces (forms, booking, unsubscribe) — no key semantics"
     },
+    "GET /api/public/unsubscribe/confirm/:token": {
+      "status": "excluded",
+      "reason": "public unauthenticated surfaces (forms, booking, unsubscribe) — no key semantics"
+    },
+    "POST /api/public/unsubscribe/confirm/:token": {
+      "status": "excluded",
+      "reason": "public unauthenticated surfaces (forms, booking, unsubscribe) — no key semantics"
+    },
     "GET /api/track/click/:messageId": {
       "status": "excluded",
       "reason": "email open/click tracking pixels and redirects — recipient-facing"
@@ -1865,6 +1881,14 @@
       "status": "excluded",
       "reason": "CRON_SECRET-gated infrastructure jobs; never key-callable"
     },
+    "GET /api/v1/cron/reconcile-overpayment-refunds": {
+      "status": "excluded",
+      "reason": "CRON_SECRET-gated infrastructure jobs; never key-callable"
+    },
+    "POST /api/v1/cron/reconcile-overpayment-refunds": {
+      "status": "excluded",
+      "reason": "CRON_SECRET-gated infrastructure jobs; never key-callable"
+    },
     "GET /api/v1/cron/reconcile-reply-capture": {
       "status": "excluded",
       "reason": "CRON_SECRET-gated infrastructure jobs; never key-callable"
@@ -2623,6 +2647,10 @@
       "status": "planned",
       "reason": "sending-domain management (reply-capture subpaths ARE covered — see the reply_capture_* tools)"
     },
+    "POST /api/v1/email/opt-out-list/resubscribe": {
+      "status": "planned",
+      "reason": "bulk email send surfaces"
+    },
     "POST /api/v1/email/send": {
       "status": "covered",
       "tools": [
@@ -2969,6 +2997,24 @@
       "status": "planned",
       "reason": "integration management"
     },
+    "GET /api/v1/integrations/wordpress-forms/intakes": {
+      "status": "covered",
+      "tools": [
+        "conduyt_list_form_intakes"
+      ]
+    },
+    "POST /api/v1/integrations/wordpress-forms/intakes": {
+      "status": "covered",
+      "tools": [
+        "conduyt_create_form_intake"
+      ]
+    },
+    "DELETE /api/v1/integrations/wordpress-forms/intakes/:id": {
+      "status": "covered",
+      "tools": [
+        "conduyt_revoke_form_intake"
+      ]
+    },
     "GET /api/v1/integrations/zapier/sample/:event": {
       "status": "planned",
       "reason": "integration management"
@@ -4549,6 +4595,10 @@
       "status": "excluded",
       "reason": "inbound provider callback receivers (Twilio/Resend/etc.), not client-callable"
     },
+    "POST /api/v1/webhooks/inbound/forms/:token": {
+      "status": "excluded",
+      "reason": "inbound provider callback receivers (Twilio/Resend/etc.), not client-callable"
+    },
     "GET /api/v1/webhooks/manage": {
       "status": "covered",
       "tools": [