conduyt-mcp 4.73.0 → 4.75.0

package/README.md

@@ -23,7 +23,10 @@ MCP server for [Conduyt CRM](https://conduyt.app) — expose your CRM as AI-acce
 ### Deals
 | Tool | Description |
 |------|-------------|
-| `conduyt_list_deals` | List deals by pipeline, stage, or assignee |
+| `conduyt_list_deals` | List deals by pipeline, stage, or assignee; rows carry `hasNextStep` and `nextAppointmentAt`. With `health_summary=true` it answers the Pipeline health strip for the same filtered set (`totalOpenDeals`, `atRiskValue`, `checks[]`, `deals`); `health_check`, `health_limit`, `health_offset`, `health_cursor` (the previous `nextCursor`, passed back unchanged) and `health_rows_only` page one check's deals (rows-only answers `{data:{deals:{check, offset, items, hasMore, nextCursor}}}`) |
+| `conduyt_pipeline_health` | Pipeline health for one pipeline or all visible active pipelines (`GET /deals/inspection`): the six checks over open deals by money at risk; `check` adds that check's deals, paged by `cursor` (or `offset`). Cursor 400s carry `health_cursor_invalid` / `_context` / `_blank` / `_needs_check`, `health_filter_conflict` |
+| `conduyt_get_stage_rules` / `conduyt_set_stage_rules` | Read / set one stage's rule (`requiredFields` incl. `custom:<fieldKey>`, `requiredDocuments` 0-20, lost-reason label and options); other stages untouched; revision-aware, retried once on a 409 |
+| `conduyt_get_deal_card_fields` / `conduyt_set_deal_card_fields` | Read / replace the kanban card fields (1-8, built-ins or `custom:<fieldKey>`) |
 | `conduyt_get_deal` | Get deal details with history, including custom-field values |
 | `conduyt_create_deal` | Create a deal with full attributes — currency (e.g. GBP), probability, priority, expected close date, contact/company, and structured custom-field values |
 | `conduyt_update_deal` | Move stage, change value/currency, set probability or close date, reassign, mark won/lost, or write custom-field values; optional `expectedUpdatedAt` pins the `updatedAt` you read, and a stale pin returns 409 `deal_changed` with the current `updatedAt` and writes nothing |
@@ -40,7 +43,7 @@ MCP server for [Conduyt CRM](https://conduyt.app) — expose your CRM as AI-acce
 |------|-------------|
 | `conduyt_list_pipelines` | List pipelines with stages |
 | `conduyt_create_pipeline` | Create a pipeline, optionally with its full set of stages (no stage-count cap; up to 50) |
-| `conduyt_update_pipeline` | Rename a pipeline, change its description, or set it as default |
+| `conduyt_update_pipeline` | Rename a pipeline, change its description, set it as default, or set `automationOnly` (only automations, API keys and owners / admins move or edit its cards; owner / admin key) |
 | `conduyt_delete_pipeline` | Delete a pipeline (move/remove its deals first) |
 | `conduyt_create_stage` | Append a stage to a pipeline (e.g. 'On Hold', 'Declined/Dead') |
 | `conduyt_update_stage` | Rename, recolor, reorder, or change won/lost flags on a stage |
@@ -152,6 +155,13 @@ MCP server for [Conduyt CRM](https://conduyt.app) — expose your CRM as AI-acce
 | `conduyt_update_webhook` | Update URL, events, or enable/disable |
 | `conduyt_delete_webhook` | Delete a webhook endpoint |
 
+### WordPress forms
+| Tool | Description |
+|------|-------------|
+| `conduyt_list_form_intakes` | List the intake addresses: every active one with its full URL, then the revoked history (newest 200) |
+| `conduyt_create_form_intake` | Create an intake address for one Gravity Forms / WPForms / Elementor form (returns its full URL) |
+| `conduyt_revoke_form_intake` | Revoke an intake address (the row is kept for history) |
+
 ### Notifications
 | Tool | Description |
 |------|-------------|

package/dist/client.d.ts

@@ -11,12 +11,16 @@ export declare class ConduytApiError extends Error {
     readonly status: number | null;
     readonly code: "http" | "timeout" | "response_too_large" | "network";
     readonly retryable: boolean;
+    /** The response's Retry-After, in seconds, when it sent one (a busy 503 / a 429): surfaced to the agent, never used
+     *  to replay a mutation. */
+    readonly retryAfterSeconds: number | null;
     constructor(opts: {
         message: string;
         status?: number | null;
         code: ConduytApiError["code"];
         retryable: boolean;
         cause?: unknown;
+        retryAfterSeconds?: number | null;
     });
 }
 /** Per-call overrides for legitimately long/large operations (GDPR export,

package/dist/client.js

@@ -10,12 +10,16 @@ export class ConduytApiError extends Error {
     status;
     code;
     retryable;
+    /** The response's Retry-After, in seconds, when it sent one (a busy 503 / a 429): surfaced to the agent, never used
+     *  to replay a mutation. */
+    retryAfterSeconds;
     constructor(opts) {
         super(opts.message, opts.cause !== undefined ? { cause: opts.cause } : undefined);
         this.name = "ConduytApiError";
         this.status = opts.status ?? null;
         this.code = opts.code;
         this.retryable = opts.retryable;
+        this.retryAfterSeconds = opts.retryAfterSeconds ?? null;
     }
 }
 /** Bounded defaults; each overridable via config / env (see src/index.ts). */
@@ -163,11 +167,14 @@ export class ConduytClient {
             if (text)
                 msg = text.slice(0, 500);
         }
+        const retryAfterRaw = res.headers.get("retry-after");
+        const retryAfter = retryAfterRaw === null || retryAfterRaw.trim() === "" ? NaN : Number(retryAfterRaw);
         return new ConduytApiError({
             message: `Conduyt API ${res.status}: ${msg}`,
             status: res.status,
             code: "http",
             retryable: RETRYABLE_STATUSES.has(res.status),
+            retryAfterSeconds: Number.isFinite(retryAfter) && retryAfter >= 0 ? retryAfter : null,
         });
     }
     retryDelayMs(res, attemptIndex) {

package/dist/index.js

@@ -21,6 +21,8 @@ import { registerCalendarTools } from "./tools/calendar.js";
 import { registerFormTools } from "./tools/forms.js";
 import { registerInvoiceTools } from "./tools/invoices.js";
 import { registerWebhookTools } from "./tools/webhooks.js";
+import { registerFormIntakeTools } from "./tools/form-intakes.js";
+import { registerBoardSettingsTools } from "./tools/board-settings.js";
 import { registerNotificationTools } from "./tools/notifications.js";
 import { registerCustomFieldTools } from "./tools/custom-fields.js";
 import { registerSmartListTools } from "./tools/smart-lists.js";
@@ -93,6 +95,8 @@ registerCalendarTools(server, client);
 registerFormTools(server, client);
 registerInvoiceTools(server, client);
 registerWebhookTools(server, client);
+registerFormIntakeTools(server, client);
+registerBoardSettingsTools(server, client);
 registerNotificationTools(server, client);
 registerCustomFieldTools(server, client);
 registerSmartListTools(server, client);

package/dist/tools/automations.js

@@ -26,7 +26,7 @@ export function registerAutomationTools(server, client) {
         kind: z.enum(["native", "n8n"]).optional().describe("Automation type — 'native' for the built-in graph engine (use `actions`), 'n8n' for an external n8n webhook (requires n8nWorkflowId + n8nWebhookUrl). For agent-built automations use 'native'."),
         n8nWorkflowId: z.string().optional().describe("n8n workflow ID (required when kind='n8n')"),
         n8nWebhookUrl: z.string().optional().describe("n8n webhook URL (required when kind='n8n')"),
-        actions: z.any().optional().describe("Actions graph — v1: [{type, config}], v2: {nodes:[], startNodeId}. A sequence step is the action enroll_in_sequence with config {sequenceId, enrollAction: 'add' (default) | 'remove'}: add puts the contact into the sequence (the sequence must allow automation enrollment, allowAutomationEnroll), remove ends their run."),
+        actions: z.any().optional().describe("Actions graph — v1: [{type, config}], v2: {nodes:[], startNodeId}. A sequence step is the action enroll_in_sequence with config {sequenceId, enrollAction: 'add' (default) | 'remove'}: add puts the contact into the sequence (the sequence must allow automation enrollment, allowAutomationEnroll), remove ends their run. A delay node waits for a fixed duration by default; waitType 'until_field_date' (with fieldKey = a deal DATE / DATETIME custom field key and offsetHours = signed hours added to its date, default 0, e.g. 24 = a day after it) waits until that date stored on the deal, re-read at every wake (an empty or past value continues immediately)."),
         graphVersion: z.number().optional().describe("Graph version — 1 (legacy array) or 2 (node graph). Default 1"),
         schedule: z.string().optional().describe("5-field cron expression (required if triggerEvent='scheduled')"),
         scheduleTimezone: z.string().optional().describe("IANA timezone for scheduled triggers (e.g. 'America/Los_Angeles')"),
@@ -48,7 +48,7 @@ export function registerAutomationTools(server, client) {
             .optional()
             .describe("Updated trigger conditions (replaces the object). Same keys as create — e.g. { untouchedDays: 7 } on 'contact.untouched'. (#16 tri-surface parity: the UI and API could set this; MCP could not.)"),
         isActive: z.boolean().optional().describe("Enable or disable the automation"),
-        actions: z.any().optional().describe("Updated actions graph (same shape as create; e.g. enroll_in_sequence {sequenceId, enrollAction: 'add' | 'remove'})"),
+        actions: z.any().optional().describe("Updated actions graph (same shape as create; e.g. enroll_in_sequence {sequenceId, enrollAction: 'add' | 'remove'}) A delay node waits for a fixed duration by default; waitType 'until_field_date' (with fieldKey = a deal DATE / DATETIME custom field key and offsetHours = signed hours added to its date, default 0, e.g. 24 = a day after it) waits until that date stored on the deal, re-read at every wake (an empty or past value continues immediately)."),
         schedule: z.string().optional().describe("Updated cron schedule"),
         scheduleTimezone: z.string().optional().describe("Updated timezone"),
         stopOnResponse: z.boolean().optional().describe("Stop drip if contact responds"),

package/dist/tools/board-settings.d.ts

@@ -0,0 +1,14 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { ConduytClient } from "../client.js";
+/**
+ * Deal board settings (app 10-08, BDA board): per-stage rules (settings.pipelineStageRules[pipelineId][stageId]) and the
+ * kanban card fields (settings.dealCardFields). The validators mirror the API's settingsPatchSchema entries, which are
+ * the source of truth: the built-in names below are the app's lists, `custom:<fieldKey>` names one of the account's DEAL
+ * custom fields (the API checks it exists at save), and the stage rule object is strict (no other keys).
+ */
+export declare const DEAL_STAGE_REQUIRED_FIELDS: readonly ["value", "expectedCloseDate", "contactId", "assignedTo", "lostReason"];
+export declare const DEAL_CARD_FIELDS: readonly ["value", "contact", "phones", "company", "owner", "priority", "expectedCloseDate", "daysInStage", "nextAction", "tags", "stageHealth", "source"];
+export declare const MAX_DEAL_CARD_FIELDS = 8;
+export declare const MAX_STAGE_REQUIRED_FIELDS = 25;
+export declare const MAX_STAGE_REQUIRED_DOCUMENTS = 20;
+export declare function registerBoardSettingsTools(server: McpServer, client: ConduytClient): void;

package/dist/tools/board-settings.js

@@ -0,0 +1,71 @@
+import { z } from "zod";
+import { formatResult } from "../client.js";
+import { strictInput } from "./strict.js";
+import { patchGeneralSettingsMerged } from "./lifecycle.js";
+/**
+ * Deal board settings (app 10-08, BDA board): per-stage rules (settings.pipelineStageRules[pipelineId][stageId]) and the
+ * kanban card fields (settings.dealCardFields). The validators mirror the API's settingsPatchSchema entries, which are
+ * the source of truth: the built-in names below are the app's lists, `custom:<fieldKey>` names one of the account's DEAL
+ * custom fields (the API checks it exists at save), and the stage rule object is strict (no other keys).
+ */
+export const DEAL_STAGE_REQUIRED_FIELDS = ["value", "expectedCloseDate", "contactId", "assignedTo", "lostReason"];
+export const DEAL_CARD_FIELDS = ["value", "contact", "phones", "company", "owner", "priority", "expectedCloseDate", "daysInStage", "nextAction", "tags", "stageHealth", "source"];
+export const MAX_DEAL_CARD_FIELDS = 8;
+export const MAX_STAGE_REQUIRED_FIELDS = 25;
+export const MAX_STAGE_REQUIRED_DOCUMENTS = 20;
+const CUSTOM_FIELD_RE = /^custom:[a-zA-Z_][a-zA-Z0-9_]*$/;
+const RULE_KEYS = ["requiredFields", "requiredDocuments", "lostReasonLabel", "lostReasonOptions"];
+const requiredField = z.union([
+    z.enum(DEAL_STAGE_REQUIRED_FIELDS),
+    z.string().regex(CUSTOM_FIELD_RE, "custom required fields are custom:<deal custom field key>"),
+]);
+const cardField = z.union([
+    z.enum(DEAL_CARD_FIELDS),
+    z.string().regex(CUSTOM_FIELD_RE, "custom card fields are custom:<deal custom field key>"),
+]);
+const isObj = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+export function registerBoardSettingsTools(server, client) {
+    strictInput(server.tool("conduyt_get_stage_rules", "Read the per-stage rules (settings.pipelineStageRules) as { pipelineId: { stageId: { requiredFields, requiredDocuments, lostReasonLabel, lostReasonOptions } } }, optionally for one pipeline or one stage. A deal may enter a stage only when its requiredFields are filled (built-ins value, expectedCloseDate, contactId, assignedTo, lostReason, or custom:<fieldKey> for a deal custom field) and it has at least requiredDocuments documents attached. Set one stage with conduyt_set_stage_rules. Pipelines your key cannot see are left out.", {
+        pipelineId: z.string().uuid().optional().describe("Only this pipeline's stage rules"),
+        stageId: z.string().uuid().optional().describe("Only this stage's rule (needs pipelineId)"),
+    }, async ({ pipelineId, stageId }) => {
+        if (stageId && !pipelineId)
+            throw new Error("stageId needs pipelineId.");
+        const result = (await client.get("/api/v1/settings"));
+        const all = isObj(result?.data?.pipelineStageRules) ? result.data.pipelineStageRules : {};
+        let out = all;
+        if (pipelineId) {
+            const stages = isObj(all[pipelineId]) ? all[pipelineId] : {};
+            out = { [pipelineId]: stageId ? (stages[stageId] !== undefined ? { [stageId]: stages[stageId] } : {}) : stages };
+        }
+        return formatResult({ data: { pipelineStageRules: out } });
+    }));
+    strictInput(server.tool("conduyt_set_stage_rules", "Set the rule of ONE stage (settings.pipelineStageRules[pipelineId][stageId]; admin key, settings:edit). Only the fields you pass change: they are merged into that stage's current rule, and every other stage and pipeline is left exactly as stored. requiredFields REPLACES the stage's list (max 25 entries; built-ins value, expectedCloseDate, contactId, assignedTo, lostReason, or custom:<fieldKey> for one of the account's DEAL custom fields; [] clears it); requiredDocuments is the number of documents that must be attached before a deal may enter the stage (integer 0-20); lostReasonLabel (1-60 chars) and lostReasonOptions (max 50, trimmed and de-duplicated by the API) configure the stage's lost-reason prompt. Read-merge-write with the settings revision; if another save lands first it is re-read and retried once, then the conflict is returned with the current settings. An unknown custom field key, pipeline or stage is refused by the API.", {
+        pipelineId: z.string().uuid().describe("Pipeline UUID"),
+        stageId: z.string().uuid().describe("Stage UUID within that pipeline"),
+        requiredFields: z.array(requiredField).max(MAX_STAGE_REQUIRED_FIELDS).optional().describe("Fields a deal must have filled to enter the stage: value, expectedCloseDate, contactId, assignedTo, lostReason, or custom:<deal custom field key>. Replaces the list."),
+        requiredDocuments: z.number().int().min(0).max(MAX_STAGE_REQUIRED_DOCUMENTS).optional().describe("Documents that must be attached to the deal before it enters the stage (integer 0-20)"),
+        lostReasonLabel: z.string().trim().min(1).max(60).optional().describe("Label of the stage's lost-reason prompt, e.g. 'Disqualification Reason'"),
+        lostReasonOptions: z.array(z.string()).max(50).optional().describe("Dropdown options of the lost-reason prompt (replaces the list)"),
+    }, async ({ pipelineId, stageId, ...given }) => {
+        const change = Object.fromEntries(Object.entries(given).filter(([, v]) => v !== undefined));
+        if (Object.keys(change).length === 0) {
+            throw new Error("Nothing to set. Pass at least one of requiredFields, requiredDocuments, lostReasonLabel, lostReasonOptions.");
+        }
+        return patchGeneralSettingsMerged(client, (settings) => {
+            const rules = isObj(settings.pipelineStageRules) ? settings.pipelineStageRules : {};
+            const stages = isObj(rules[pipelineId]) ? rules[pipelineId] : {};
+            const current = isObj(stages[stageId]) ? stages[stageId] : {};
+            const kept = Object.fromEntries(RULE_KEYS.filter((k) => current[k] !== undefined).map((k) => [k, current[k]]));
+            // the API merges per pipeline and replaces that pipeline's stage map: send the whole map with this stage changed
+            return { pipelineStageRules: { [pipelineId]: { ...stages, [stageId]: { ...kept, ...change } } } };
+        });
+    }));
+    server.tool("conduyt_get_deal_card_fields", "Read the fields shown on each kanban deal card, in order (settings.dealCardFields; max 8): built-in names (value, contact, phones, company, owner, priority, expectedCloseDate, daysInStage, nextAction, tags, stageHealth, source) and custom:<fieldKey> entries for the account's deal custom fields. Change with conduyt_set_deal_card_fields.", {}, async () => {
+        const result = (await client.get("/api/v1/settings"));
+        return formatResult({ data: { dealCardFields: result?.data?.dealCardFields ?? null } });
+    });
+    strictInput(server.tool("conduyt_set_deal_card_fields", "Set the fields shown on each kanban deal card, in order (settings.dealCardFields; admin key, settings:edit). REPLACES the list: 1 to 8 entries, each a built-in (value, contact, phones, company, owner, priority, expectedCloseDate, daysInStage, nextAction, tags, stageHealth, source) or custom:<fieldKey> for one of the account's DEAL custom fields (the API refuses an unknown key). Read the current list with conduyt_get_deal_card_fields. Saved with the settings revision; a stale revision is re-read and retried once.", {
+        fields: z.array(cardField).min(1).max(MAX_DEAL_CARD_FIELDS).describe("The complete ordered list, 1-8 entries"),
+    }, async ({ fields }) => patchGeneralSettingsMerged(client, () => ({ dealCardFields: fields }))));
+}

package/dist/tools/deals.d.ts

@@ -1,3 +1,5 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { ConduytClient } from "../client.js";
+/** The six Pipeline health checks (GET /deals health_check, GET /deals/inspection check). */
+export declare const PIPELINE_HEALTH_CHECKS: readonly ["high_value_idle", "stale", "unassigned", "needs_action", "missing_close_date", "missing_contact"];
 export declare function registerDealTools(server: McpServer, client: ConduytClient): void;

package/dist/tools/deals.js

@@ -1,7 +1,12 @@
 import { z } from "zod";
 import { formatResult } from "../client.js";
+import { strictInput } from "./strict.js";
+/** The six Pipeline health checks (GET /deals health_check, GET /deals/inspection check). */
+export const PIPELINE_HEALTH_CHECKS = ["high_value_idle", "stale", "unassigned", "needs_action", "missing_close_date", "missing_contact"];
+const healthCheckSchema = z.enum(PIPELINE_HEALTH_CHECKS);
+const HEALTH_ERRORS = "A 400 carries a machine-readable code in the error text: health_cursor_invalid (forged cursor, or cursor with offset), health_cursor_context (cursor from another list or the view/thresholds changed), health_cursor_blank, health_cursor_needs_check (cursor without a check), health_filter_conflict (a filter given twice with different values).";
 export function registerDealTools(server, client) {
-    server.tool("conduyt_list_deals", "List deals with filtering by pipeline, stage, assignee, or status. Returns deal title, value, stage, contact, and dates. Filter by pipeline/stage NAME (the same names you import with) or by UUID — both camelCase (pipelineName) and snake_case (pipeline_name) argument names are accepted. An unknown name returns a clear error, never the whole account.", {
+    strictInput(server.tool("conduyt_list_deals", "List deals with filtering by pipeline, stage, assignee, or status. Returns deal title, value, stage, contact, and dates. Filter by pipeline/stage NAME (the same names you import with) or by UUID — both camelCase (pipelineName) and snake_case (pipeline_name) argument names are accepted. An unknown name returns a clear error, never the whole account. Each deal row carries hasNextStep (boolean: an open task or a booked appointment from a day ago on; the Needs next action rule's own answer) and nextAppointmentAt (ISO string or null; null unless your key can view the calendar, even when hasNextStep is true). PIPELINE HEALTH: pass health_summary=true to get the Pipeline health strip for the same filtered set instead of the deal list: { totalOpenDeals, atRiskValue, checks[] (key, label, severity, color, rule, count, value; the six checks high_value_idle, stale, unassigned, needs_action, missing_close_date, missing_contact, ordered by money at risk), deals }. Add health_check to also get that check's first page of deals (highest value first) as deals: { check, offset, items, hasMore, nextCursor, total }; deals is null without a check. Page with health_cursor (the previous nextCursor, passed back UNCHANGED: an opaque signed token) or health_offset, and health_rows_only=true to get just the page without the summary: the answer is {data:{deals:{check, offset, items, hasMore, nextCursor}}} (the page sits under data.deals). " + HEALTH_ERRORS, {
         pipeline: z.string().optional().describe("Filter by pipeline UUID (canonical). Aliases: pipelineId, pipeline_id."),
         pipelineId: z.string().optional().describe("Filter by pipeline UUID (alias of pipeline)."),
         pipeline_id: z.string().optional().describe("snake_case alias of pipelineId."),
@@ -17,6 +22,12 @@ export function registerDealTools(server, client) {
         search: z.string().optional().describe("Search deal titles"),
         page: z.number().optional().describe("Page number (default 1)"),
         per_page: z.number().optional().describe("Results per page (default 25, max 100)"),
+        health_summary: z.boolean().optional().describe("true: answer the Pipeline health shape (totalOpenDeals, atRiskValue, checks[], deals) for the filtered set instead of the deal list."),
+        health_check: healthCheckSchema.optional().describe("With health_summary: one check whose deals are added to `deals`, highest value first."),
+        health_limit: z.number().int().min(1).max(100).optional().describe("With health_summary and health_check: deals per page, 1-100 (default 5)."),
+        health_offset: z.number().int().min(0).optional().describe("With health_summary and health_check: deals to skip (default 0). Prefer health_cursor; never combine the two."),
+        health_cursor: z.string().optional().describe("With health_summary and health_check: continue after this cursor, the nextCursor of the previous page, passed back UNCHANGED (opaque signed token bound to the list; a blank, forged or foreign one is a 400 with its code)."),
+        health_rows_only: z.boolean().optional().describe("With health_summary and health_check: true answers only the requested page of that check's deals, without the summary (for the next page of a list); the answer is {data:{deals:{check, offset, items, hasMore, nextCursor}}}."),
     }, async (a) => {
         const params = new URLSearchParams();
         // Accept every reasonable casing of each filter (canonical bare name +
@@ -62,10 +73,46 @@ export function registerDealTools(server, client) {
             params.set("page", String(page));
         if (per_page)
             params.set("per_page", String(per_page));
+        // Pipeline health strip: sent only when given, the cursor byte for byte (it is signed; never trimmed or re-encoded by hand)
+        if (a.health_summary !== undefined)
+            params.set("health_summary", String(a.health_summary));
+        if (a.health_check !== undefined)
+            params.set("health_check", a.health_check);
+        if (a.health_limit !== undefined)
+            params.set("health_limit", String(a.health_limit));
+        if (a.health_offset !== undefined)
+            params.set("health_offset", String(a.health_offset));
+        if (a.health_cursor !== undefined)
+            params.set("health_cursor", a.health_cursor);
+        if (a.health_rows_only !== undefined)
+            params.set("health_rows_only", String(a.health_rows_only));
         const result = await client.get(`/api/v1/deals?${params}`);
         return formatResult(result);
-    });
-    server.tool("conduyt_get_deal", "Get a single deal with full details — value, currency, probability, stage, contact, expected close date, custom-field values, activities, tasks, and history. Use this to read structured custom-field data back out of a deal (e.g. for a P&L or balance-sheet model).", {
+    }));
+    strictInput(server.tool("conduyt_pipeline_health", "Pipeline health for one pipeline (or every visible active pipeline) over its OPEN deals (GET /api/v1/deals/inspection): { totalOpenDeals, atRiskValue (total value of the High-value idle deals), checks[] (key, label, severity, color, rule, count, value; the six checks high_value_idle, stale, unassigned, needs_action, missing_close_date, missing_contact, ordered by money at risk), deals, summary (count per check), labels (label per check) }. With check, deals is that check's page { check, offset, items, hasMore, nextCursor, total } (highest value first, each item with its issues); without it deals is null. Page with cursor (the previous nextCursor, passed back UNCHANGED) or offset; never both. For the board's other filters (stage, assignee, saved view) use conduyt_list_deals with health_summary=true. " + HEALTH_ERRORS, {
+        pipeline: z.string().optional().describe("Pipeline UUID; omit for every visible active pipeline."),
+        check: healthCheckSchema.optional().describe("Adds `deals` for that check."),
+        limit: z.number().int().min(1).max(100).optional().describe("With check: deals per page, 1-100 (default 5)."),
+        offset: z.number().int().min(0).optional().describe("With check: deals to skip (default 0)."),
+        cursor: z.string().optional().describe("With check: continue after this cursor, the nextCursor of the previous page, passed back UNCHANGED. Not combined with offset."),
+    }, async ({ pipeline, check, limit, offset, cursor }) => {
+        const params = new URLSearchParams();
+        if (pipeline !== undefined)
+            params.set("pipeline", pipeline);
+        if (check !== undefined)
+            params.set("check", check);
+        if (limit !== undefined)
+            params.set("limit", String(limit));
+        if (offset !== undefined)
+            params.set("offset", String(offset));
+        if (cursor !== undefined)
+            params.set("cursor", cursor);
+        const qs = params.toString();
+        // literal paths on purpose: the coverage scanner reads the first string after client.get(, and a template with a nested template hid this endpoint from it
+        const result = qs ? await client.get("/api/v1/deals/inspection?" + qs) : await client.get("/api/v1/deals/inspection");
+        return formatResult(result);
+    }));
+    server.tool("conduyt_get_deal", "Get a single deal with full details — value, currency, probability, stage, contact, expected close date, custom-field values, activities, tasks, and history. Use this to read structured custom-field data back out of a deal (e.g. for a P&L or balance-sheet model). Deal rows also carry hasNextStep and nextAppointmentAt (null unless your key can view the calendar) when the API returns them.", {
         id: z.string().describe("Deal UUID"),
     }, async ({ id }) => {
         const result = await client.get(`/api/v1/deals/${id}`);

package/dist/tools/form-intakes.d.ts

@@ -0,0 +1,22 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { ConduytClient } from "../client.js";
+/**
+ * WordPress forms intake addresses (app 10-07, tri-surface parity): a per-form URL that Gravity Forms (Webhooks
+ * Add-On), WPForms (Webhooks addon) or Elementor Pro (Webhook action) posts submissions to; each submission becomes a
+ * contact. GET / POST /api/v1/integrations/wordpress-forms/intakes, DELETE /api/v1/integrations/wordpress-forms/intakes/{id}.
+ * Listing and creating need the "form-intakes" AND "contacts" scopes on a write or admin tier key (the URLs are
+ * credentials that create and edit contacts); revoking needs "form-intakes". Create and list answer each active intake's
+ * full `url` (the credential, to paste into the form plugin); a revoked intake's `url` is null.
+ */
+/** What each tool's key must hold: the API names only the FIRST missing scope, so a 403 is surfaced with all of it. */
+export declare const LIST_AND_CREATE_REQUIREMENT = "the form-intakes AND contacts scopes on a write or admin tier key (a member: settings.edit, contacts.create and contacts.edit)";
+export declare const REVOKE_REQUIREMENT = "the form-intakes scope on an admin tier key (a member: settings.edit)";
+/** A 403 names the complete requirement; a busy 503 says when to retry (never replayed here: create is a mutation). */
+export declare function intakeToolError(err: unknown, requirement: string): {
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    isError: true;
+};
+export declare function registerFormIntakeTools(server: McpServer, client: ConduytClient): void;

package/dist/tools/form-intakes.js

@@ -0,0 +1,72 @@
+import { z } from "zod";
+import { ConduytApiError, formatResult, formatToolError } from "../client.js";
+/**
+ * WordPress forms intake addresses (app 10-07, tri-surface parity): a per-form URL that Gravity Forms (Webhooks
+ * Add-On), WPForms (Webhooks addon) or Elementor Pro (Webhook action) posts submissions to; each submission becomes a
+ * contact. GET / POST /api/v1/integrations/wordpress-forms/intakes, DELETE /api/v1/integrations/wordpress-forms/intakes/{id}.
+ * Listing and creating need the "form-intakes" AND "contacts" scopes on a write or admin tier key (the URLs are
+ * credentials that create and edit contacts); revoking needs "form-intakes". Create and list answer each active intake's
+ * full `url` (the credential, to paste into the form plugin); a revoked intake's `url` is null.
+ */
+/** What each tool's key must hold: the API names only the FIRST missing scope, so a 403 is surfaced with all of it. */
+export const LIST_AND_CREATE_REQUIREMENT = "the form-intakes AND contacts scopes on a write or admin tier key (a member: settings.edit, contacts.create and contacts.edit)";
+export const REVOKE_REQUIREMENT = "the form-intakes scope on an admin tier key (a member: settings.edit)";
+/** A 403 names the complete requirement; a busy 503 says when to retry (never replayed here: create is a mutation). */
+export function intakeToolError(err, requirement) {
+    if (err instanceof ConduytApiError) {
+        if (err.status === 403)
+            return formatToolError(`${err.message}. This tool needs ${requirement}.`);
+        if (err.status === 503 && err.retryAfterSeconds !== null) {
+            return formatToolError(`busy; retry after ${err.retryAfterSeconds} s (${err.message})`);
+        }
+    }
+    throw err;
+}
+export function registerFormIntakeTools(server, client) {
+    server.tool("conduyt_list_form_intakes", "List the account's WordPress form intake addresses: every active intake (newest first), then the revoked history (the newest 200 revocations): name, defaultTag, source, assignee, status, receivedCount, lastReceivedAt and `url`: the full address of every ACTIVE intake (the credential, to paste into the form plugin); null for a revoked one. Requires " +
+        LIST_AND_CREATE_REQUIREMENT +
+        " (the URLs are credentials that create and edit contacts).", {}, async () => {
+        try {
+            const result = await client.get("/api/v1/integrations/wordpress-forms/intakes");
+            return formatResult(result);
+        }
+        catch (err) {
+            return intakeToolError(err, LIST_AND_CREATE_REQUIREMENT);
+        }
+    });
+    server.tool("conduyt_create_form_intake", "Create a WordPress form intake address for one form. Answers the row with `url`, the full address (the credential; conduyt_list_form_intakes shows it too while the intake is active). Paste it into the form plugin's webhook URL (Gravity Forms Webhooks Add-On, WPForms Webhooks, Elementor Pro Webhook action). Each submission then creates or updates a contact (by email, then phone), applies defaultTag / source / assignedTo, and adds 'Submitted <form name>' with the message and fields to the contact's timeline. At most 100 active addresses per account; a busy answer (503) says how many seconds to wait before retrying. Requires " +
+        LIST_AND_CREATE_REQUIREMENT +
+        ".", {
+        name: z.string().trim().min(1).max(120).describe("What the form is, e.g. 'Contact page, Smith Roofing'"),
+        defaultTag: z.string().max(100).nullable().optional().describe("Tag NAME applied to every submission unless the submission sends its own tags (created on first use)"),
+        source: z.string().max(64).optional().describe("Contact source for submissions that do not send one (default 'wordpress')"),
+        assignedTo: z.string().uuid().nullable().optional().describe("User id (an active member) who owns new contacts; omit or null = lead routing decides"),
+    }, async ({ name, defaultTag, source, assignedTo }) => {
+        try {
+            // the body as ONE literal: the contract gate reads the request fields from it
+            const result = await client.post("/api/v1/integrations/wordpress-forms/intakes", {
+                name,
+                ...(defaultTag !== undefined ? { defaultTag } : {}),
+                ...(source !== undefined ? { source } : {}),
+                ...(assignedTo !== undefined ? { assignedTo } : {}),
+            });
+            return formatResult(result);
+        }
+        catch (err) {
+            return intakeToolError(err, LIST_AND_CREATE_REQUIREMENT);
+        }
+    });
+    server.tool("conduyt_revoke_form_intake", "Revoke a WordPress form intake address: submissions to it answer 404 from now on and create nothing. The row is kept (status 'revoked', revokedAt) for history; revoking a revoked address answers it unchanged. Requires " +
+        REVOKE_REQUIREMENT +
+        ".", {
+        id: z.string().uuid().describe("Intake UUID (from conduyt_list_form_intakes)"),
+    }, async ({ id }) => {
+        try {
+            const result = await client.del(`/api/v1/integrations/wordpress-forms/intakes/${id}`);
+            return formatResult(result);
+        }
+        catch (err) {
+            return intakeToolError(err, REVOKE_REQUIREMENT);
+        }
+    });
+}

package/dist/tools/lifecycle.d.ts

@@ -8,4 +8,16 @@ export declare function patchGeneralSettings(client: ConduytClient, body: Record
         text: string;
     }>;
 }>;
+/**
+ * Read-merge-write for a settings change that depends on what is stored (a per-stage rule inside settings.pipelineStageRules):
+ * `build` derives the PATCH body from the settings just read, and the save carries that read's settingsRevision. A stale
+ * revision (409: another save landed first) re-reads and re-derives ONCE; a second 409 hands back the conflict with the
+ * current settings, like patchGeneralSettings. Anything other than a 409 is thrown. `build` may throw a plain Error to refuse.
+ */
+export declare function patchGeneralSettingsMerged(client: ConduytClient, build: (settings: Record<string, unknown>) => Record<string, unknown>): Promise<{
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+}>;
 export declare function registerLifecycleTools(server: McpServer, client: ConduytClient): void;

package/dist/tools/lifecycle.js

@@ -19,6 +19,34 @@ export async function patchGeneralSettings(client, body) {
         throw err;
     }
 }
+/**
+ * Read-merge-write for a settings change that depends on what is stored (a per-stage rule inside settings.pipelineStageRules):
+ * `build` derives the PATCH body from the settings just read, and the save carries that read's settingsRevision. A stale
+ * revision (409: another save landed first) re-reads and re-derives ONCE; a second 409 hands back the conflict with the
+ * current settings, like patchGeneralSettings. Anything other than a 409 is thrown. `build` may throw a plain Error to refuse.
+ */
+export async function patchGeneralSettingsMerged(client, build) {
+    let lastRevision = null;
+    for (let attempt = 0; attempt < 2; attempt += 1) {
+        const read = (await client.get("/api/v1/settings"));
+        const settings = read?.data ?? {};
+        const revision = typeof settings.settingsRevision === "string" ? settings.settingsRevision : null;
+        lastRevision = revision;
+        const body = build(settings);
+        try {
+            return formatResult(await client.patch("/api/v1/settings", { ...body, ...(revision ? { expectedSettingsRevision: revision } : {}) }));
+        }
+        catch (err) {
+            if (!(err instanceof ConduytApiError && err.status === 409))
+                throw err;
+            if (attempt === 1) {
+                const current = (await client.get("/api/v1/settings"));
+                return formatResult({ conflict: true, message: err.message, expectedSettingsRevision: lastRevision, current: current?.data ?? null, hint: "the account settings changed twice while this change was being saved — read them again and call again" });
+            }
+        }
+    }
+    throw new Error("unreachable");
+}
 /**
  * Lifecycle v2 settings (master lead status + intake deals). The master lead
  * is the acquisition truth (first-write-wins source, one lifecycle status);

package/dist/tools/pipelines.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { formatResult } from "../client.js";
+import { strictInput } from "./strict.js";
 export function registerPipelineTools(server, client) {
     server.tool("conduyt_list_pipelines", "List all sales pipelines with their stages. Use this to discover pipeline and stage UUIDs before creating or moving deals.", {}, async () => {
         const result = await client.get("/api/v1/pipelines");
@@ -35,15 +36,16 @@ export function registerPipelineTools(server, client) {
         const result = await client.post("/api/v1/pipelines", body);
         return formatResult(result);
     });
-    server.tool("conduyt_update_pipeline", "Update a pipeline's name, description, or default flag. To add/edit/remove stages, use the stage tools.", {
+    strictInput(server.tool("conduyt_update_pipeline", "Update a pipeline's name, description, default flag, or automationOnly flag (owner/admin key only). An automation-only pipeline's cards are moved and edited only by automations, API keys and owners / admins; a member's edit is refused with 403 pipeline_automation_only. conduyt_list_pipelines returns the flag on each pipeline. To add/edit/remove stages, use the stage tools.", {
         id: z.string().describe("Pipeline UUID"),
         name: z.string().optional().describe("Updated pipeline name"),
         description: z.string().optional().describe("Updated description"),
         isDefault: z.boolean().optional().describe("Set as the account's default pipeline"),
+        automationOnly: z.boolean().optional().describe("Automation-only pipeline: only automations, API keys and owners / admins move or edit its cards; a member's edit is refused with 403 pipeline_automation_only. Owner / admin only."),
     }, async ({ id, ...updates }) => {
         const result = await client.patch(`/api/v1/pipelines/${id}`, updates);
         return formatResult(result);
-    });
+    }));
     server.tool("conduyt_delete_pipeline", "Delete a pipeline. Deals in the pipeline must be moved or removed first. Cannot delete the default or an archived pipeline.", {
         id: z.string().describe("Pipeline UUID to delete"),
     }, async ({ id }) => {

package/dist/tools/strict.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The SDK wraps a tool's raw Zod shape in a NON-strict object, so an argument the tool does not declare (a typo, or a
+ * field the API does not take, e.g. lostReasonAllowOther) is silently stripped and the call "succeeds" without it. For a
+ * tool where that would widen or drop a change, `strictInput(server.tool(...))` swaps the registered input schema for
+ * its strict form: an unknown key is an InvalidParams error and the advertised JSON schema says additionalProperties: false.
+ * (The SDK's server.tool() only takes a raw shape, so the swap is done on the registered tool.) A server stub that
+ * returns nothing is left alone.
+ */
+export declare function strictInput<T>(tool: T): T;

package/dist/tools/strict.js

@@ -0,0 +1,14 @@
+/**
+ * The SDK wraps a tool's raw Zod shape in a NON-strict object, so an argument the tool does not declare (a typo, or a
+ * field the API does not take, e.g. lostReasonAllowOther) is silently stripped and the call "succeeds" without it. For a
+ * tool where that would widen or drop a change, `strictInput(server.tool(...))` swaps the registered input schema for
+ * its strict form: an unknown key is an InvalidParams error and the advertised JSON schema says additionalProperties: false.
+ * (The SDK's server.tool() only takes a raw shape, so the swap is done on the registered tool.) A server stub that
+ * returns nothing is left alone.
+ */
+export function strictInput(tool) {
+    const t = tool;
+    if (t && typeof t.inputSchema?.strict === "function")
+        t.inputSchema = t.inputSchema.strict();
+    return tool;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "conduyt-mcp",
-  "version": "4.73.0",
+  "version": "4.75.0",
   "mcpName": "com.conduyt/mcp",
   "description": "MCP server for Conduyt CRM — expose CRM operations as AI-accessible tools",
   "type": "module",

package/scripts/coverage-matrix.json

@@ -1,11 +1,11 @@
 {
-  "generatedAt": "2026-10-04T13:54:51.239Z",
-  "toolCount": 299,
-  "totalEndpoints": 1043,
+  "generatedAt": "2026-10-08T19:42:42.712Z",
+  "toolCount": 307,
+  "totalEndpoints": 1048,
   "counts": {
-    "covered": 273,
-    "excluded": 317,
-    "planned": 453,
+    "covered": 277,
+    "excluded": 319,
+    "planned": 452,
     "uncategorized": 0
   },
   "matrix": {
@@ -1773,6 +1773,10 @@
       "status": "excluded",
       "reason": "CRON_SECRET-gated infrastructure jobs; never key-callable"
     },
+    "GET /api/v1/cron/process-google-ads-conversions": {
+      "status": "excluded",
+      "reason": "CRON_SECRET-gated infrastructure jobs; never key-callable"
+    },
     "GET /api/v1/cron/process-import-side-effects": {
       "status": "excluded",
       "reason": "CRON_SECRET-gated infrastructure jobs; never key-callable"
@@ -2206,8 +2210,10 @@
       "reason": "deal subroutes beyond core CRUD (history, files, links)"
     },
     "GET /api/v1/deals/inspection": {
-      "status": "planned",
-      "reason": "deal subroutes beyond core CRUD (history, files, links)"
+      "status": "covered",
+      "tools": [
+        "conduyt_pipeline_health"
+      ]
     },
     "POST /api/v1/deals/probabilities": {
       "status": "planned",
@@ -2997,6 +3003,24 @@
       "status": "planned",
       "reason": "integration management"
     },
+    "GET /api/v1/integrations/wordpress-forms/intakes": {
+      "status": "covered",
+      "tools": [
+        "conduyt_list_form_intakes"
+      ]
+    },
+    "POST /api/v1/integrations/wordpress-forms/intakes": {
+      "status": "covered",
+      "tools": [
+        "conduyt_create_form_intake"
+      ]
+    },
+    "DELETE /api/v1/integrations/wordpress-forms/intakes/:id": {
+      "status": "covered",
+      "tools": [
+        "conduyt_revoke_form_intake"
+      ]
+    },
     "GET /api/v1/integrations/zapier/sample/:event": {
       "status": "planned",
       "reason": "integration management"
@@ -3846,6 +3870,8 @@
     "GET /api/v1/settings": {
       "status": "covered",
       "tools": [
+        "conduyt_get_stage_rules",
+        "conduyt_get_deal_card_fields",
         "conduyt_get_contact_table_defaults",
         "conduyt_set_contact_table_defaults",
         "conduyt_get_call_recording_settings",
@@ -4577,6 +4603,10 @@
       "status": "excluded",
       "reason": "inbound provider callback receivers (Twilio/Resend/etc.), not client-callable"
     },
+    "POST /api/v1/webhooks/inbound/forms/:token": {
+      "status": "excluded",
+      "reason": "inbound provider callback receivers (Twilio/Resend/etc.), not client-callable"
+    },
     "GET /api/v1/webhooks/manage": {
       "status": "covered",
       "tools": [