conduyt-mcp 4.99.0 → 4.100.0

package/README.md

@@ -36,6 +36,7 @@ MCP server for [Conduyt CRM](https://conduyt.app) — expose your CRM as AI-acce
 | `conduyt_get_stage_rules` / `conduyt_set_stage_rules` | Read / set one stage's rule (`requiredFields` incl. `custom:<fieldKey>`, `requiredDocuments` 0-20, lost-reason label and options, `lostReasonAllowOther`, `entryByAutomationOnly`: only an automation can move or create a deal into the stage, every other entry is refused 422 `stage_automation_only`; `conduyt_list_pipelines` shows it on each stage; `closesOtherOpenDeals` (+ `closesOtherOpenDealsReason`, 1-200 characters): a deal entering the stage marks the contact's other open deals lost; `assignsContactOwner`: the entering deal's owner becomes the contact owner, the previous contact owner stays a collaborator); other stages untouched; revision-aware, retried once on a 409 |
 | `conduyt_get_calling_hours` / `conduyt_update_calling_hours` | Read the window the dialer enforces (`effectiveCallingWindow`: `source`, `enabled`, `start`/`end` HH:MM, `timezone` or null = contact zone, then number area code, then account) / set `settings.callingWindow` (`enabled`, `start`, `end` always sent, `end` after `start`, `timezone` trimmed and recognised by the API (omit keeps the stored zone, null clears it); `enabled: false` needs `acknowledgeAnyHour: true`, else 400 `calling_hours_acknowledgement_required`) |
 | `conduyt_list_email_opt_outs` / `conduyt_add_email_opt_out` / `conduyt_resubscribe_email_opt_out` | The email opt-out list (owner / admin key; hash-only rows `{ id, source, reason, createdAt }`): list (`page`, `perPage` 1-100), add an address by hand (`reason` 1-200 required; 201 new row, 200 when an unsubscribe-link or Mailchimp row is promoted to manual, 409 with the existing row when already listed by hand) and take an address off (`{ removed }`) |
+| `conduyt_get_my_profile` | Read the caller's own identity (`GET /users/me`, same as `/auth/me`): `data.user` incl. `ringtone` (the incoming-ring slug, null = Conduyt Default), `data.account`, role, permissions, `apiKey`, `accounts`. Editing the profile is a signed-in person's action and is not exposed to API keys |
 | `conduyt_create_short_link` | Make (or reuse) the workspace's Conduyt short link for a public link-shortener address the Message check flagged (`POST /short-links`, body `{ url }`; key needs the `messages` scope, member needs communications.create). Not shortenable: our own host, merge fields, `mailto:`/`tel:`/`sms:`, or any address the Message check does not flag as a link shortener (400 `not_shortenable`). Other errors verbatim, never retried: 400 `invalid_body`, 403 `forbidden`, 413 `body_too_large`, 429 `rate_limited` (with Retry-After), 503 `short_link_unavailable` (nothing changed) |
 | `conduyt_get_deal_card_fields` / `conduyt_set_deal_card_fields` | Read / replace the kanban card fields (1-8, built-ins or `custom:<fieldKey>`) |
 | `conduyt_get_settings_revision` | The account `settingsRevision` (plus stored stage rules and rot days): pass it as `expectedSettingsRevision` to `conduyt_archive_pipeline` / `conduyt_delete_stage` so a stale one is refused 409 `stale_settings_revision` |

package/dist/register-all.js

@@ -33,6 +33,7 @@ import { registerBatchOperationTools } from "./tools/batch-operations.js";
 import { registerDncTools } from "./tools/dnc.js";
 import { registerEmailOptOutTools } from "./tools/email-opt-out.js";
 import { registerShortLinkTools } from "./tools/short-links.js";
+import { registerMyProfileTools } from "./tools/my-profile.js";
 import { registerSavedFilterTools } from "./tools/saved-filters.js";
 import { registerDripCampaignTools } from "./tools/drip-campaigns.js";
 import { registerScoringTools } from "./tools/scoring.js";
@@ -93,6 +94,7 @@ export function registerAllTools(server, client) {
     registerDncTools(server, client);
     registerEmailOptOutTools(server, client);
     registerShortLinkTools(server, client);
+    registerMyProfileTools(server, client);
     registerSavedFilterTools(server, client);
     registerDripCampaignTools(server, client);
     registerScoringTools(server, client);

package/dist/tool-annotations.js

@@ -221,6 +221,7 @@ export const TOOL_ANNOTATIONS = {
     conduyt_list_email_opt_outs: ro("List Email Opt-Outs"),
     conduyt_add_email_opt_out: update("Add Email Opt-Out"), // a repeat is refused 409 (already listed by hand) before any write, so it lands on the same state; adding a block is protective
     conduyt_resubscribe_email_opt_out: destroy("Resubscribe Email Address"), // consent change: removing the row re-enables every customer-facing email to the address
+    conduyt_get_my_profile: ro("Get My Profile"),
     conduyt_create_short_link: update("Create Short Link"), // one link per account and target: a repeat returns the same link (idempotent), nothing existing is changed
     conduyt_list_saved_filters: ro("List Saved Filters"),
     conduyt_create_saved_filter: create("Create Saved Filter"),

package/dist/tools/my-profile.d.ts

@@ -0,0 +1,8 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { ConduytClient } from "../client.js";
+/**
+ * The caller's own profile read (app route GET /api/v1/users/me, the same handler as GET /auth/me). data.user carries the
+ * incoming-ring slug (#385) as `ringtone`. PATCH /users/me is deliberately not a tool: it is a signed-in person's action
+ * (profile, ringtone, password) and the API refuses an API key, so a tool for it would only ever return 403.
+ */
+export declare function registerMyProfileTools(server: McpServer, client: ConduytClient): void;

package/dist/tools/my-profile.js

@@ -0,0 +1,10 @@
+import { formatResult } from "../client.js";
+import { strictInput } from "./strict.js";
+/**
+ * The caller's own profile read (app route GET /api/v1/users/me, the same handler as GET /auth/me). data.user carries the
+ * incoming-ring slug (#385) as `ringtone`. PATCH /users/me is deliberately not a tool: it is a signed-in person's action
+ * (profile, ringtone, password) and the API refuses an API key, so a tool for it would only ever return 403.
+ */
+export function registerMyProfileTools(server, client) {
+    strictInput(server.tool("conduyt_get_my_profile", "Read the caller's own identity (GET /api/v1/users/me, identical to GET /auth/me): data.user (id, email, firstName, lastName, avatarUrl, phone, birthdayMonth, birthdayDay, tourSeenAt, and ringtone: the slug of the incoming ring this person hears, or null = Conduyt Default; the slug is one of classic, soft-bell, marimba, digital-pulse, rising-chime, office-trill, double-ring, pocket-melody, retro-cell, kalimba, uplift), data.account (the current account, name at data.account.name), role, permissions, leadVisibilityMode, apiKey (the key's own metadata when called with an API key, else null) and accounts. Any authenticated caller, including a scoped key, may read it. Editing the profile (name, phone, birthday, ringtone, password) is a signed-in person's action in the app and is not available to an API key.", {}, async () => formatResult(await client.get("/api/v1/users/me"))));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "conduyt-mcp",
-  "version": "4.99.0",
+  "version": "4.100.0",
   "mcpName": "com.conduyt/mcp",
   "description": "MCP server for Conduyt CRM — expose CRM operations as AI-accessible tools",
   "type": "module",

package/scripts/coverage-manifest.json

@@ -200,6 +200,11 @@
       "status": "planned",
       "reason": "company subroutes beyond core CRUD"
     },
+    {
+      "match": "PATCH /api/v1/users/me",
+      "status": "excluded",
+      "reason": "a signed-in person's own profile edit (name, phone, birthday, ringtone, password): session only (assertSessionOnly), never an API key's; GET /users/me is covered by conduyt_get_my_profile"
+    },
     {
       "match": "/api/v1/users",
       "status": "planned",

package/scripts/coverage-matrix.json

@@ -1,11 +1,11 @@
 {
-  "generatedAt": "2026-10-25T02:48:35.925Z",
-  "toolCount": 365,
+  "generatedAt": "2026-10-25T09:09:54.777Z",
+  "toolCount": 366,
   "totalEndpoints": 1107,
   "counts": {
-    "covered": 321,
-    "excluded": 330,
-    "planned": 456,
+    "covered": 322,
+    "excluded": 331,
+    "planned": 454,
     "uncategorized": 0
   },
   "matrix": {
@@ -4854,12 +4854,14 @@
       ]
     },
     "GET /api/v1/users/me": {
-      "status": "planned",
-      "reason": "team management subroutes beyond list/invite"
+      "status": "covered",
+      "tools": [
+        "conduyt_get_my_profile"
+      ]
     },
     "PATCH /api/v1/users/me": {
-      "status": "planned",
-      "reason": "team management subroutes beyond list/invite"
+      "status": "excluded",
+      "reason": "a signed-in person's own profile edit (name, phone, birthday, ringtone, password): session only (assertSessionOnly), never an API key's; GET /users/me is covered by conduyt_get_my_profile"
     },
     "GET /api/v1/users/me/tour": {
       "status": "planned",