theleadrouter-mcp 0.3.0 → 0.3.1

package/README.md

@@ -170,7 +170,7 @@ Add the following to your `.mcp.json` file. Replace `lr_your_key_here` with the
 
 #### Role and scope filters
 
-The role picks your tool set: about 930 tools for `admin`, 99 for `buyer`, 88 for `partner` (reads and writes). You can narrow it further to reduce context usage:
+The role picks your tool set: about 900 tools for `admin`, 93 for `buyer`, 84 for `partner` (reads and writes; [sensitive tools](#sensitive-tools) excluded). You can narrow it further to reduce context usage:
 
 | Env var | Values | Effect |
 |---|---|---|
@@ -178,6 +178,27 @@ The role picks your tool set: about 930 tools for `admin`, 99 for `buyer`, 88 fo
 | `ISCALE_MCP_SCOPE` | `read` \| `write` \| `all` (default) | Filter by write flag |
 | `ISCALE_MCP_DOMAINS` | comma list, e.g. `verticals,campaigns,buyers` | Restrict to specific domains |
 | `ISCALE_MCP_INCLUDE_UI` | `true` (default `false`) | Include admin-UI navigation tools (only useful inside the in-app agent) |
+| `ISCALE_MCP_ALLOW_SENSITIVE` | `true` (default: hidden) | Register the [sensitive tools](#sensitive-tools). Only the exact value `true` enables them. |
+
+#### Sensitive tools
+
+Tools that mint, reveal, rotate or redeem a credential, token or secret, or that impersonate another user, are **not registered by default**. An agent cannot call a tool it was never given, so a prompt-injected or confused agent cannot mint an API key, read a provider credential or start impersonation through this server.
+
+Hidden by default (full list in [`src/sensitive-tools.ts`](src/sensitive-tools.ts)):
+
+- API keys: admin, messaging, buyer and partner key create / list / get / update / revoke
+- Posting keys and spec / setup tokens: rotate, regenerate, create, list, revoke
+- Passwords, impersonation, sign-in codes, Stripe billing-portal sessions
+- Provider credentials and intake credential propagation, the Zoho OAuth callback
+- Signed recording URLs, softphone tokens, invitation bearer links
+
+To enable them set `ISCALE_MCP_ALLOW_SENSITIVE=true`. Any other value (`1`, `yes`, `TRUE`, unset) keeps them hidden. Enable it only for a session that needs it.
+
+Recommendations:
+
+- **Least privilege.** Use a key whose role and scopes cover only what you need. Combine `ISCALE_MCP_SCOPE=read` with a read-only key when you only need to look things up.
+- **https only.** Point `ISCALE_API_URL` at an `https://` URL. The server prints a warning to stderr at startup when the URL is not https and not `localhost` / `127.0.0.1` / `[::1]`. It does not refuse to start.
+- **Treat the key as a password.** Keep it in your MCP config's `env`, never in a prompt, and revoke it at System → API Keys if it leaks.
 
 ### 3. Restart Claude Code
 
@@ -189,7 +210,7 @@ Try asking: `"Use search_leads to show me recent leads"`
 
 ## MCP Server Tools
 
-Once connected with a System key, Claude Code can use about 930 tools across these categories (partner and buyer keys get the tools for their own portal):
+Once connected with a System key, Claude Code can use about 900 tools across these categories (partner and buyer keys get the tools for their own portal):
 
 | Category | Examples |
 |----------|----------|

package/dist/index.d.ts

@@ -6,6 +6,7 @@ export { SessionAuthAdapter, ApiKeyAuthAdapter, type AuthAdapter } from './auth-
 export { registerUiTools } from './tools/ui.js';
 export { registerCompositeTools } from './tools/composite.js';
 export { buildRegistry } from './build-registry.js';
+export { SENSITIVE_TOOL_NAMES } from './sensitive-tools.js';
 export declare const ROLES: readonly ["admin", "buyer", "partner"];
 export type Role = (typeof ROLES)[number];
 export type ScopeFilter = {
@@ -14,11 +15,17 @@ export type ScopeFilter = {
     includeUi?: boolean;
     /** Which API key the server runs with. Defaults to admin (a System key). */
     role?: Role;
+    /** Register SENSITIVE_TOOL_NAMES (credential/token/impersonation tools). Defaults to false. */
+    allowSensitive?: boolean;
 };
 export declare function filterTools(registry: ToolRegistry, filter?: ScopeFilter): ToolDefinition[];
 export declare function mountRegistryOnServer(server: McpServer, registry: ToolRegistry, auth: ApiKeyAuthAdapter, filter?: ScopeFilter): number;
 /** ISCALE_MCP_ROLE: unset → admin; anything other than the three roles is an error. */
 export declare function parseRole(value: string | undefined): Role;
+/** ISCALE_MCP_ALLOW_SENSITIVE: only the exact string 'true' enables; anything else keeps them hidden. */
+export declare function parseAllowSensitive(value: string | undefined): boolean;
+/** Warning text when ISCALE_API_URL is neither https nor a local host. Never includes the URL itself. */
+export declare function apiUrlWarning(value: string): string | null;
 export declare function createServer(config: {
     baseUrl: string;
     apiKey: string;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AAGnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAErD,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAEjE,OAAO,EAAE,YAAY,EAAE,KAAK,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,eAAe,CAAA;AACpF,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC3F,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAEnD,eAAO,MAAM,KAAK,wCAAyC,CAAA;AAC3D,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,CAAA;AAEzC,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,KAAK,CAAA;IAChC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,4EAA4E;IAC5E,IAAI,CAAC,EAAE,IAAI,CAAA;CACZ,CAAA;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,GAAE,WAAgB,GAAG,cAAc,EAAE,CAe9F;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,YAAY,EACtB,IAAI,EAAE,iBAAiB,EACvB,MAAM,GAAE,WAAgB,GACvB,MAAM,CAuCR;AAOD,uFAAuF;AACvF,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAIzD;AAQD,wBAAgB,YAAY,CAAC,MAAM,EAAE;IACnC,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB,aASA;AAED,wBAAsB,WAAW,kBA+BhC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AAGnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAErD,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAGjE,OAAO,EAAE,YAAY,EAAE,KAAK,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,eAAe,CAAA;AACpF,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC3F,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAE3D,eAAO,MAAM,KAAK,wCAAyC,CAAA;AAC3D,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,CAAA;AAEzC,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,KAAK,CAAA;IAChC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,4EAA4E;IAC5E,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,+FAA+F;IAC/F,cAAc,CAAC,EAAE,OAAO,CAAA;CACzB,CAAA;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,GAAE,WAAgB,GAAG,cAAc,EAAE,CAiB9F;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,YAAY,EACtB,IAAI,EAAE,iBAAiB,EACvB,MAAM,GAAE,WAAgB,GACvB,MAAM,CAuCR;AAOD,uFAAuF;AACvF,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAIzD;AAED,yGAAyG;AACzG,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEtE;AAID,yGAAyG;AACzG,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAU1D;AAQD,wBAAgB,YAAY,CAAC,MAAM,EAAE;IACnC,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB,aASA;AAED,wBAAsB,WAAW,kBAmChC"}

package/dist/index.js

@@ -3,21 +3,26 @@ import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
 import { z } from 'zod';
 import { ApiKeyAuthAdapter } from './auth-adapter.js';
 import { buildRegistry } from './build-registry.js';
+import { SENSITIVE_TOOL_NAMES } from './sensitive-tools.js';
 export { ToolRegistry } from './registry.js';
 export { SessionAuthAdapter, ApiKeyAuthAdapter } from './auth-adapter.js';
 export { registerUiTools } from './tools/ui.js';
 export { registerCompositeTools } from './tools/composite.js';
 export { buildRegistry } from './build-registry.js';
+export { SENSITIVE_TOOL_NAMES } from './sensitive-tools.js';
 export const ROLES = ['admin', 'buyer', 'partner'];
 export function filterTools(registry, filter = {}) {
     const scope = filter.scope ?? 'all';
     const includeUi = filter.includeUi ?? false;
     const domains = filter.domains?.length ? new Set(filter.domains) : null;
     const role = filter.role ?? 'admin';
+    const allowSensitive = filter.allowSensitive ?? false;
     return registry.getAll().filter(tool => {
         // A tool that declares no roles is admin-only, so it can never leak into a portal scope.
         if (!(tool.metadata.allowedRoles ?? ['admin']).includes(role))
             return false;
+        if (!allowSensitive && SENSITIVE_TOOL_NAMES.has(tool.name))
+            return false;
         if (!includeUi && tool.metadata.domain === 'ui')
             return false;
         if (domains && !domains.has(tool.metadata.domain))
@@ -73,6 +78,26 @@ export function parseRole(value) {
         return value;
     throw new Error(`Invalid ISCALE_MCP_ROLE ${JSON.stringify(value)}. Valid values: ${ROLES.join(', ')}.`);
 }
+/** ISCALE_MCP_ALLOW_SENSITIVE: only the exact string 'true' enables; anything else keeps them hidden. */
+export function parseAllowSensitive(value) {
+    return value === 'true';
+}
+const LOCAL_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]']);
+/** Warning text when ISCALE_API_URL is neither https nor a local host. Never includes the URL itself. */
+export function apiUrlWarning(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return 'Warning: ISCALE_API_URL is not a valid URL.';
+    }
+    if (url.protocol === 'https:')
+        return null;
+    if (url.protocol === 'http:' && LOCAL_HOSTS.has(url.hostname))
+        return null;
+    return 'Warning: ISCALE_API_URL is not https; the API key will be sent unencrypted. Use an https:// URL.';
+}
 function parseDomains(value) {
     if (!value)
         return undefined;
@@ -82,7 +107,7 @@ function parseDomains(value) {
 export function createServer(config) {
     const server = new McpServer({
         name: 'iscale-lead-routing',
-        version: '0.3.0',
+        version: '0.3.1',
     });
     const auth = new ApiKeyAuthAdapter(config.apiKey, config.baseUrl);
     const registry = buildRegistry();
@@ -100,6 +125,9 @@ export async function startServer() {
         console.error('ISCALE_API_KEY environment variable is required');
         process.exit(1);
     }
+    const urlWarning = apiUrlWarning(baseUrl);
+    if (urlWarning)
+        console.error(urlWarning);
     let role;
     try {
         role = parseRole(process.env.ISCALE_MCP_ROLE);
@@ -113,6 +141,7 @@ export async function startServer() {
         scope: parseScope(process.env.ISCALE_MCP_SCOPE),
         domains: parseDomains(process.env.ISCALE_MCP_DOMAINS),
         includeUi: process.env.ISCALE_MCP_INCLUDE_UI === 'true',
+        allowSensitive: parseAllowSensitive(process.env.ISCALE_MCP_ALLOW_SENSITIVE),
     };
     const server = createServer({ baseUrl, apiKey, filter });
     const transport = new StdioServerTransport();

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAA;AAChF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAGnD,OAAO,EAAE,YAAY,EAA0C,MAAM,eAAe,CAAA;AACpF,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAoB,MAAM,mBAAmB,CAAA;AAC3F,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAEnD,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAU,CAAA;AAW3D,MAAM,UAAU,WAAW,CAAC,QAAsB,EAAE,SAAsB,EAAE;IAC1E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,KAAK,CAAA;IACnC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,KAAK,CAAA;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACvE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,OAAO,CAAA;IAEnC,OAAO,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QACrC,yFAAyF;QACzF,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QAC3E,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO,KAAK,CAAA;QAC7D,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAA;QAC/D,IAAI,KAAK,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO;YAAE,OAAO,KAAK,CAAA;QAC3D,IAAI,KAAK,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO;YAAE,OAAO,KAAK,CAAA;QAC7D,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,MAAiB,EACjB,QAAsB,EACtB,IAAuB,EACvB,SAAsB,EAAE;IAExB,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAE3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,YAAY,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;QAC/E,MAAM,WAAW,GACf,IAAI,CAAC,QAAQ,CAAC,eAAe,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO;YACpD,CAAC,CAAC,GAAG,IAAI,CAAC,WAAW,kDAAkD;YACvE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAA;QAEtB,MAAM,WAAW,GAAG;YAClB,YAAY,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO;YACpC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;YAC9G,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ;YACrH,aAAa,EAAE,IAAI;SACpB,CAAA;QAED,MAAM,CAAC,YAAY,CACjB,IAAI,CAAC,IAAI,EACT,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,EAChD,KAAK,EAAE,IAA6B,EAAE,EAAE;YACtC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;gBAC7C,MAAM,IAAI,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;gBAClF,MAAM,OAAO,GACX,MAAM,KAAK,IAAI;oBACf,OAAO,MAAM,KAAK,QAAQ;oBAC1B,OAAO,IAAI,MAAM;oBAChB,MAA6B,CAAC,KAAK,KAAK,IAAI,CAAA;gBAC/C,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,CAAA;YACtF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBAC5D,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,GAAG,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;YACvF,CAAC;QACH,CAAC,CACF,CAAA;IACH,CAAC;IAED,OAAO,KAAK,CAAC,MAAM,CAAA;AACrB,CAAC;AAED,SAAS,UAAU,CAAC,KAAyB;IAC3C,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,KAAK,CAAA;IAC1E,OAAO,KAAK,CAAA;AACd,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,SAAS,CAAC,KAAyB;IACjD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,OAAO,CAAA;IACvC,IAAK,KAA2B,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAa,CAAA;IACtE,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,mBAAmB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACzG,CAAC;AAED,SAAS,YAAY,CAAC,KAAyB;IAC7C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAChE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AACvC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAI5B;IACC,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,OAAO;KACjB,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,IAAI,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;IACjE,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAA;IAChC,qBAAqB,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IAC5D,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAA;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAA;IAEzC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAA;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAA;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,IAAI,IAAU,CAAA;IACd,IAAI,CAAC;QACH,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,MAAM,MAAM,GAAgB;QAC1B,IAAI;QACJ,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC/C,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACrD,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,MAAM;KACxD,CAAA;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IACxD,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAA;IAC5C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;AACjC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAA;AAChF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAEnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAE3D,OAAO,EAAE,YAAY,EAA0C,MAAM,eAAe,CAAA;AACpF,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAoB,MAAM,mBAAmB,CAAA;AAC3F,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAE3D,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAU,CAAA;AAa3D,MAAM,UAAU,WAAW,CAAC,QAAsB,EAAE,SAAsB,EAAE;IAC1E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,KAAK,CAAA;IACnC,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,KAAK,CAAA;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACvE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,OAAO,CAAA;IACnC,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,KAAK,CAAA;IAErD,OAAO,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QACrC,yFAAyF;QACzF,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QAC3E,IAAI,CAAC,cAAc,IAAI,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QACxE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO,KAAK,CAAA;QAC7D,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAA;QAC/D,IAAI,KAAK,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO;YAAE,OAAO,KAAK,CAAA;QAC3D,IAAI,KAAK,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO;YAAE,OAAO,KAAK,CAAA;QAC7D,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,MAAiB,EACjB,QAAsB,EACtB,IAAuB,EACvB,SAAsB,EAAE;IAExB,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAE3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,YAAY,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;QAC/E,MAAM,WAAW,GACf,IAAI,CAAC,QAAQ,CAAC,eAAe,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO;YACpD,CAAC,CAAC,GAAG,IAAI,CAAC,WAAW,kDAAkD;YACvE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAA;QAEtB,MAAM,WAAW,GAAG;YAClB,YAAY,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO;YACpC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;YAC9G,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ;YACrH,aAAa,EAAE,IAAI;SACpB,CAAA;QAED,MAAM,CAAC,YAAY,CACjB,IAAI,CAAC,IAAI,EACT,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,EAChD,KAAK,EAAE,IAA6B,EAAE,EAAE;YACtC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;gBAC7C,MAAM,IAAI,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;gBAClF,MAAM,OAAO,GACX,MAAM,KAAK,IAAI;oBACf,OAAO,MAAM,KAAK,QAAQ;oBAC1B,OAAO,IAAI,MAAM;oBAChB,MAA6B,CAAC,KAAK,KAAK,IAAI,CAAA;gBAC/C,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,CAAA;YACtF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;gBAC5D,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,GAAG,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;YACvF,CAAC;QACH,CAAC,CACF,CAAA;IACH,CAAC;IAED,OAAO,KAAK,CAAC,MAAM,CAAA;AACrB,CAAC;AAED,SAAS,UAAU,CAAC,KAAyB;IAC3C,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,KAAK,CAAA;IAC1E,OAAO,KAAK,CAAA;AACd,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,SAAS,CAAC,KAAyB;IACjD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,OAAO,CAAA;IACvC,IAAK,KAA2B,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAa,CAAA;IACtE,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,mBAAmB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACzG,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,mBAAmB,CAAC,KAAyB;IAC3D,OAAO,KAAK,KAAK,MAAM,CAAA;AACzB,CAAC;AAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAA;AAEhE,yGAAyG;AACzG,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,6CAA6C,CAAA;IACtD,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAC1C,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1E,OAAO,kGAAkG,CAAA;AAC3G,CAAC;AAED,SAAS,YAAY,CAAC,KAAyB;IAC7C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAChE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AACvC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAI5B;IACC,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,OAAO;KACjB,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,IAAI,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;IACjE,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAA;IAChC,qBAAqB,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IAC5D,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAA;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAA;IAEzC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAA;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAA;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;IACzC,IAAI,UAAU;QAAE,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAEzC,IAAI,IAAU,CAAA;IACd,IAAI,CAAC;QACH,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,MAAM,MAAM,GAAgB;QAC1B,IAAI;QACJ,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC/C,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACrD,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,MAAM;QACvD,cAAc,EAAE,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;KAC5E,CAAA;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IACxD,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAA;IAC5C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;AACjC,CAAC"}

package/dist/sensitive-tools.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Tools that mint, reveal, rotate or redeem a credential, token or secret, or that
+ * impersonate another user. They are not registered unless ISCALE_MCP_ALLOW_SENSITIVE=true.
+ *
+ * Single source of truth. Every name must exist in tools/generated/catalog.json —
+ * sensitive-tools.test.ts fails when a regenerated catalog renames or drops one.
+ */
+export declare const SENSITIVE_TOOL_NAMES: ReadonlySet<string>;
+//# sourceMappingURL=sensitive-tools.d.ts.map

package/dist/sensitive-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive-tools.d.ts","sourceRoot":"","sources":["../src/sensitive-tools.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAiDnD,CAAA"}

package/dist/sensitive-tools.js

@@ -0,0 +1,58 @@
+/**
+ * Tools that mint, reveal, rotate or redeem a credential, token or secret, or that
+ * impersonate another user. They are not registered unless ISCALE_MCP_ALLOW_SENSITIVE=true.
+ *
+ * Single source of truth. Every name must exist in tools/generated/catalog.json —
+ * sensitive-tools.test.ts fails when a regenerated catalog renames or drops one.
+ */
+export const SENSITIVE_TOOL_NAMES = new Set([
+    // Admin API keys
+    'create_api_key',
+    'update_api_key',
+    'revoke_api_key',
+    'get_api_key',
+    'list_api_keys',
+    // Messaging / buyer / partner API keys
+    'create_messaging_api_key',
+    'list_messaging_api_keys',
+    'delete_messaging_api_key',
+    'create_buyer_api_key',
+    'list_buyer_api_keys',
+    'revoke_buyer_api_key',
+    'create_partner_api_key',
+    'list_partner_api_keys',
+    'revoke_partner_api_key',
+    // Posting keys
+    'rotate_campaign_browser_posting_key',
+    'regenerate_partner_posting_key',
+    // Passwords, sessions, impersonation
+    'change_auth_password',
+    'start_impersonation',
+    'start_impersonation_redirect',
+    'exit_impersonation',
+    'public_funnel_code_verify',
+    'create_credits_billing_portal_session',
+    // Provider credentials
+    'list_provider_credentials',
+    'get_provider_credential',
+    'test_provider_credential',
+    'apply_intake_credential_propagation',
+    'preview_intake_credential_propagation',
+    'zoho_crm_oauth_callback',
+    // Signed URLs and bearer tokens
+    'get_signed_recording',
+    'mint_call_recording_signed_url',
+    'get_setup_token',
+    'create_campaign_setup_token',
+    'list_campaign_setup_tokens',
+    'revoke_campaign_setup_token',
+    'rotate_campaign_spec_token',
+    'regenerate_spec_token',
+    'create_buyer_softphone_token',
+    'refresh_buyer_softphone_token',
+    // Invitation bearer links
+    'create_invitation_link',
+    'accept_team_invitation',
+    'preview_team_invitation',
+]);
+//# sourceMappingURL=sensitive-tools.js.map

package/dist/sensitive-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive-tools.js","sourceRoot":"","sources":["../src/sensitive-tools.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC;IAC/D,iBAAiB;IACjB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,aAAa;IACb,eAAe;IACf,uCAAuC;IACvC,0BAA0B;IAC1B,yBAAyB;IACzB,0BAA0B;IAC1B,sBAAsB;IACtB,qBAAqB;IACrB,sBAAsB;IACtB,wBAAwB;IACxB,uBAAuB;IACvB,wBAAwB;IACxB,eAAe;IACf,qCAAqC;IACrC,gCAAgC;IAChC,qCAAqC;IACrC,sBAAsB;IACtB,qBAAqB;IACrB,8BAA8B;IAC9B,oBAAoB;IACpB,2BAA2B;IAC3B,uCAAuC;IACvC,uBAAuB;IACvB,2BAA2B;IAC3B,yBAAyB;IACzB,0BAA0B;IAC1B,qCAAqC;IACrC,uCAAuC;IACvC,yBAAyB;IACzB,gCAAgC;IAChC,sBAAsB;IACtB,gCAAgC;IAChC,iBAAiB;IACjB,6BAA6B;IAC7B,4BAA4B;IAC5B,6BAA6B;IAC7B,4BAA4B;IAC5B,uBAAuB;IACvB,8BAA8B;IAC9B,+BAA+B;IAC/B,0BAA0B;IAC1B,wBAAwB;IACxB,wBAAwB;IACxB,yBAAyB;CAC1B,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "theleadrouter-mcp",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "MCP server for theLeadRouter — connect Claude Code to your lead routing platform",
   "type": "module",
   "bin": {
@@ -52,8 +52,8 @@
     "node": ">=18.0.0"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.12.0",
-    "js-yaml": "^4.1.1",
+    "@modelcontextprotocol/sdk": "^1.32.2",
+    "js-yaml": "^4.3.2",
     "zod": "^3.23.0",
     "zod-to-json-schema": "^3.25.1"
   },