conduyt-mcp 4.9.0 → 4.11.0

package/README.md

@@ -2,7 +2,7 @@
 
 MCP server for [Conduyt CRM](https://conduyt.app) — expose your CRM as AI-accessible tools. Covers the core CRM surface (contacts, deals, pipelines, custom fields, automations, messaging, and more); use `conduyt_api_catalog` to discover the full set of 500+ REST endpoints.
 
-## 136 Tools
+## 161 Tools
 
 ### Discovery
 | Tool | Description |
@@ -252,6 +252,12 @@ MCP server for [Conduyt CRM](https://conduyt.app) — expose your CRM as AI-acce
 | `conduyt_ai_task_segment_and_act` | AI task (preview only): segment by filter, then tag/assign/update — execution is human-session-only |
 | `conduyt_ai_task_pipeline_cleanup` | AI task (preview only): find stale deals and tag/move/notify/report — execution is human-session-only |
 
+### Privacy (GDPR)
+| Tool | Description |
+|------|-------------|
+| `conduyt_export_contact_data` | GDPR data-portability export — full portable JSON of everything held about a contact (owner/admin) |
+| `conduyt_forget_contact` | IRREVERSIBLE GDPR right-to-be-forgotten erasure — requires `confirm='FORGET'` (owner only) |
+
 ## Setup
 
 ```bash

package/dist/index.js

@@ -34,6 +34,7 @@ import { registerTemplateTools } from "./tools/templates.js";
 import { registerDashboardTools } from "./tools/dashboard.js";
 import { registerAiExtendedTools } from "./tools/ai-extended.js";
 import { registerWorkflowSandboxTools } from "./tools/workflow-sandbox.js";
+import { registerPrivacyTools } from "./tools/privacy.js";
 const apiUrl = process.env.CONDUYT_API_URL;
 const apiKey = process.env.CONDUYT_API_KEY;
 if (!apiUrl || !apiKey) {
@@ -85,5 +86,6 @@ registerTemplateTools(server, client);
 registerDashboardTools(server, client);
 registerAiExtendedTools(server, client);
 registerWorkflowSandboxTools(server, client);
+registerPrivacyTools(server, client);
 const transport = new StdioServerTransport();
 await server.connect(transport);

package/dist/tools/bulk.js

@@ -127,4 +127,24 @@ export function registerBulkTools(server, client) {
         const result = await client.post("/api/v1/bulk/deals/update", params);
         return formatResult(result);
     });
+    server.tool("conduyt_import_preflight", "Pre-check a contact import BEFORE running it — returns criticalWarnings (phone-less list bound for SMS, heavy create-only duplicate skips, double-mapped columns), duplicate/existing-match estimates, invalid emails, DNC/litigator hits, SMS-provider readiness, and plan-limit impact. Same engine the import wizard uses; call this before conduyt_ai_import_contacts on any sizeable list.", {
+        objectType: z.enum(["contacts", "opportunities", "companies"]).default("contacts").describe("What the import creates"),
+        importMode: z.enum(["create_and_update", "create_only", "update_only"]).optional().describe("Duplicate handling mode the import will use"),
+        totalRows: z.number().describe("Total rows in the file/payload"),
+        emails: z.array(z.string()).optional().describe("All email values from the file (order-free)"),
+        phones: z.array(z.string()).optional().describe("All phone values from the file (order-free)"),
+        mappedFields: z.array(z.string()).optional().describe("The Conduyt field names your columns map to, e.g. ['firstName','phone']"),
+        removeDuplicates: z.boolean().optional().describe("Whether explicit dedupe is on"),
+        duplicateCheckFields: z.array(z.enum(["email", "phone"])).optional().describe("Identifiers explicit dedupe checks"),
+        rowIdentifiers: z.array(z.object({
+            email: z.string().nullable().optional(),
+            phone: z.string().nullable().optional(),
+            country: z.string().nullable().optional(),
+            firstName: z.string().nullable().optional(),
+            lastName: z.string().nullable().optional(),
+        })).optional().describe("Per-row {email, phone, country, firstName, lastName} for the exact name-aware skip estimate (recommended; falls back to a conservative estimate without it)"),
+    }, async (params) => {
+        const result = await client.post("/api/v1/imports/preflight", params);
+        return formatResult(result);
+    });
 }

package/dist/tools/contacts.js

@@ -100,4 +100,11 @@ export function registerContactTools(server, client) {
         const result = await client.post(`/api/v1/deals/${dealId}/contacts`, { contactId, role });
         return formatResult(result);
     });
+    server.tool("conduyt_verify_line_type", "Verify contacts' phone LINE TYPE (mobile/landline/VoIP) + carrier + validity via the tenant's own Twilio Lookup, stamping the results on each contact (Phone Verification custom fields). OPT-IN + TENANT-PAID (~$0.008/number on their Twilio): requires the account's lineTypeVerificationEnabled Twilio setting, configured Twilio credentials, and org-wide contact access (owner/admin/view_all). BATCHED + idempotent: each call verifies up to 50 not-yet-stamped contacts and returns { verified, remaining, done, byLineType } — CALL REPEATEDLY until done=true. Provide exactly ONE scope: smartListId or contactIds.", {
+        smartListId: z.string().uuid().optional().describe("Verify the unstamped members of this smart list"),
+        contactIds: z.array(z.string().uuid()).max(50000).optional().describe("Explicit contact UUIDs to verify (max 50,000)"),
+    }, async (params) => {
+        const result = await client.post("/api/v1/contacts/verify-line-type", params);
+        return formatResult(result);
+    });
 }

package/dist/tools/messaging.js

@@ -66,4 +66,22 @@ export function registerMessagingTools(server, client) {
         const result = await client.get(`/api/v1/messages?${params}`);
         return formatResult(result);
     });
+    server.tool("conduyt_sms_delivery_report", "SMS provider delivery-outcome report for external-workflow SMS drips: per-automation entered vs delivered / rejected (invalid, litigator, DNC) / provider-error / workflow dead-end, plus a send-attempt 'why rejected' reason breakdown (line_type = 'not mobile' often WRONGLY rejected; landline_skipped / no_phone_skipped = Conduyt's own recorded skips). Use to answer 'what did the SMS provider do with our drips?'", {
+        from: z.string().optional().describe("ISO start (omit both for the last 180 days; spans clamp to 180d)"),
+        to: z.string().optional().describe("ISO end"),
+        automationId: z.string().uuid().optional().describe("Scope to one automation"),
+        smartListId: z.string().uuid().optional().describe("Scope to contacts in this smart list"),
+    }, async ({ from, to, automationId, smartListId }) => {
+        const params = new URLSearchParams();
+        if (from)
+            params.set("from", from);
+        if (to)
+            params.set("to", to);
+        if (automationId)
+            params.set("automationId", automationId);
+        if (smartListId)
+            params.set("smartListId", smartListId);
+        const result = await client.get(`/api/v1/reports/sms-delivery?${params}`);
+        return formatResult(result);
+    });
 }

package/dist/tools/privacy.d.ts

@@ -0,0 +1,11 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { ConduytClient } from "../client.js";
+/**
+ * GDPR privacy tools — tri-surface parity for the /gdpr-export and /gdpr-forget
+ * endpoints (audit F7). The API enforces role independently (export =
+ * owner/admin, forget = owner-only); these tools work with whatever role the
+ * API key carries. The forget is IRREVERSIBLE, so the tool requires an explicit
+ * confirm="FORGET" literal (mirroring the API contract) — a model cannot erase a
+ * contact without deliberately supplying it.
+ */
+export declare function registerPrivacyTools(server: McpServer, client: ConduytClient): void;

package/dist/tools/privacy.js

@@ -0,0 +1,31 @@
+import { z } from "zod";
+import { formatResult } from "../client.js";
+/**
+ * GDPR privacy tools — tri-surface parity for the /gdpr-export and /gdpr-forget
+ * endpoints (audit F7). The API enforces role independently (export =
+ * owner/admin, forget = owner-only); these tools work with whatever role the
+ * API key carries. The forget is IRREVERSIBLE, so the tool requires an explicit
+ * confirm="FORGET" literal (mirroring the API contract) — a model cannot erase a
+ * contact without deliberately supplying it.
+ */
+export function registerPrivacyTools(server, client) {
+    server.tool("conduyt_export_contact_data", "GDPR data-portability export: returns the full portable JSON of everything held about a contact — profile, custom fields, tags, messages, notes, deals, activities, calls, appointments, files, and consent/suppression records. Read-only. Requires an owner or admin API key (the API enforces this).", {
+        // Strict UUID + encode: a raw id with slashes could otherwise traverse
+        // into a different subroute. Keep this export-only regardless of key role.
+        id: z.string().uuid().describe("Contact UUID to export"),
+    }, async ({ id }) => {
+        const result = await client.get(`/api/v1/contacts/${encodeURIComponent(id)}/gdpr-export`);
+        return formatResult(result);
+    });
+    server.tool("conduyt_forget_contact", "IRREVERSIBLE GDPR right-to-be-forgotten erasure: permanently anonymizes the contact and erases their personal data EVERYWHERE it appears — messages, notes, deals, files, automations, and exports — across the whole account. Suppression/consent tombstones are kept so they are not re-contacted. THERE IS NO UNDO. Requires an owner API key (the API enforces this) and an explicit confirm='FORGET'. On a large tenant this can legitimately take tens of seconds. A 409 is retryable (a concurrent merge or in-flight automation) — retry once.", {
+        // Strict UUID + encode — this must stay a forget of exactly this contact,
+        // never a traversal into another destructive endpoint.
+        id: z.string().uuid().describe("Contact UUID to erase"),
+        confirm: z
+            .literal("FORGET")
+            .describe("Must be exactly the string 'FORGET'. This is a hard safety gate for an irreversible erasure — do not supply it unless the erasure is intended."),
+    }, async ({ id, confirm }) => {
+        const result = await client.post(`/api/v1/contacts/${encodeURIComponent(id)}/gdpr-forget`, { confirm });
+        return formatResult(result);
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "conduyt-mcp",
-  "version": "4.9.0",
+  "version": "4.11.0",
   "description": "MCP server for Conduyt CRM — expose CRM operations as AI-accessible tools",
   "type": "module",
   "main": "dist/index.js",