Skip to content

Update Sent MCP workflows and resolve marketplace security findings #15

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sent-dm merged 1 commit into from
Oct 2, 2026
Merged

Update Sent MCP workflows and resolve marketplace security findings #15

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .claude-plugin/marketplace.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,13 +6,13 @@
},
"metadata": {
"description": "Official Sent skills and remote MCP integration for messaging engineering, operations, migration, and specialist channel workflows.",
"version": "0.1.0"
"version": "0.2.0"
},
"plugins": [
{
"name": "sent",
"source": "./claude-plugins/sent",
"description": "Official Sent business messaging plugin for SMS, WhatsApp, RCS, API integration, webhooks, routing, two-way messaging, Sender Profiles, migration, compliance, analytics, and agent-safe operations.",
"description": "Official Sent plugin for SMS, WhatsApp, RCS, scheduled template sends, Sender Profiles, SMS compliance, authorized feedback, contacts, analytics, API integration, webhooks, routing, and migration.",
"category": "Productivity"
}
]
Expand Down
29 changes: 24 additions & 5 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,11 +63,13 @@ The repository root is directly discoverable as an Agent Plugins 1.0.0 package.
| Skill | Use for | Example searches and requests | Path |
|---|---|---|---|
| `sent` | Route broad, ambiguous, or multi-step Sent work | “What can Sent do?”, “set up business messaging”, “which Sent skill should I use?” | [`skills/sent/SKILL.md`](skills/sent/SKILL.md) |
| `sent-messaging` | Send SMS, WhatsApp, or RCS messages; inspect one message and its activity timeline; handle ambiguous send outcomes | “send this approved template”, “did message `msg_123` deliver?”, “the send timed out” | [`skills/sent-messaging/SKILL.md`](skills/sent-messaging/SKILL.md) |
| `sent-messaging` | Send or schedule existing SMS, WhatsApp, or RCS templates; inspect one message and its activity timeline; handle ambiguous send outcomes | “send this approved template”, “did message `msg_123` deliver?”, “the send timed out” | [`skills/sent-messaging/SKILL.md`](skills/sent-messaging/SKILL.md) |
| `sent-contacts` | List, find, inspect, bulk-create, summarize, or delete Sent contacts | “import these contacts”, “find this contact”, “show messaging history”, “delete contact” | [`skills/sent-contacts/SKILL.md`](skills/sent-contacts/SKILL.md) |
| `sent-templates` | List, find by name or ID, inspect, or delete existing templates | “find an approved template”, “get template status”, “delete this template” | [`skills/sent-templates/SKILL.md`](skills/sent-templates/SKILL.md) |
| `sent-analytics` | Query message volume, aggregate deliverability, contact metrics, or phone-number capabilities | “delivery rate last week”, “messages sent this month”, “look up this number” | [`skills/sent-analytics/SKILL.md`](skills/sent-analytics/SKILL.md) |
| `sent-account-readiness` | Check the authorized account, balance, onboarding/KYC status, organization, and Sender Profile scope | “am I ready to send?”, “check balance”, “what is blocking onboarding?” | [`skills/sent-account-readiness/SKILL.md`](skills/sent-account-readiness/SKILL.md) |
| `sent-feedback` | Report user-authorized bugs, feature requests, confusing results, or praise to Sent | “report this bug”, “request this feature” | [`skills/sent-feedback/SKILL.md`](skills/sent-feedback/SKILL.md) |
| `sent-compliance` | Inspect SMS market requirements and setup plans | “what fields does this market need?”, “which documents are required?” | [`skills/sent-compliance/SKILL.md`](skills/sent-compliance/SKILL.md) |
| `messaging-performance-analyzer` | Diagnose MDR/message-activity funnels, delivery failures, error-code clusters, read-rate gaps, and channel fallback | “why did SMS delivery drop?”, “analyze this MDR”, “why are RCS messages falling back?” | [`skills/messaging-performance-analyzer/SKILL.md`](skills/messaging-performance-analyzer/SKILL.md) |
| `sms-10dlc-registration` | Prepare US A2P 10DLC brand, campaign, TCR, opt-in, sample-message, and rejection-remediation evidence | “register a 10DLC campaign”, “TCR brand vetting”, “carrier filtering”, “opt-in proof” | [`skills/sms-10dlc-registration/SKILL.md`](skills/sms-10dlc-registration/SKILL.md) |
| `waba-embedded-signup` | Connect a WhatsApp Business Account, map WABA and phone-number identifiers, and verify webhook/profile readiness | “connect WhatsApp”, “Embedded Signup failed”, “map this WABA to a Sender Profile” | [`skills/waba-embedded-signup/SKILL.md`](skills/waba-embedded-signup/SKILL.md) |
Expand All @@ -79,7 +81,7 @@ The repository root is directly discoverable as an Agent Plugins 1.0.0 package.
| `sent-webhook-engineer` | Build and debug webhook receivers: signature verification, replay window, dedupe, retries, auto-disable recovery | “401 on every webhook”, “verify the signature header”, “our endpoint went inactive” | [`skills/sent-webhook-engineer/SKILL.md`](skills/sent-webhook-engineer/SKILL.md) |
| `sent-routing-strategist` | Choose channels and diagnose routes: broadcast versus automatic routing, reroute behavior, and delivery outcomes | “RCS then SMS fallback?”, “why is channel auto?”, “recipients got two messages” | [`skills/sent-routing-strategist/SKILL.md`](skills/sent-routing-strategist/SKILL.md) |
| `sent-two-way-messaging` | Design inbound flows: keyword consent, opt-out state, the WhatsApp 24-hour window, RCS STOP chips, conversation history | “do I handle STOP myself?”, “auto-reply stopped working”, “page conversation history” | [`skills/sent-two-way-messaging/SKILL.md`](skills/sent-two-way-messaging/SKILL.md) |
| `sent-profile-provisioning` | Execute the Sender Profile lifecycle: create, inheritance, completion callback, campaigns, users and roles | “create a profile via the API”, “completion callback never arrived”, “invite a developer” | [`skills/sent-profile-provisioning/SKILL.md`](skills/sent-profile-provisioning/SKILL.md) |
| `sent-profile-provisioning` | Manage Sender Profiles through MCP; guide REST inheritance, completion callbacks, campaigns, users and roles | “create a profile via the API”, “completion callback never arrived”, “invite a developer” | [`skills/sent-profile-provisioning/SKILL.md`](skills/sent-profile-provisioning/SKILL.md) |
| `migrate-to-sent` | Migrate from Twilio, Sinch, Infobip, Vonage, or Bird: concept mapping, dual-run, staged cutover, rollback | “moving off Sinch”, “Vonage failover equivalent”, “dual-run comparison metrics” | [`skills/migrate-to-sent/SKILL.md`](skills/migrate-to-sent/SKILL.md) |

Use `sent-analytics` for aggregate dashboard totals and trends. Use `messaging-performance-analyzer` for message-level evidence, funnel drop-off, and root-cause analysis. Use `sent-templates` for existing records, `waba-template-author` for WhatsApp content and policy decisions, and `template-builder-ui` for product UX.
Expand All @@ -97,13 +99,16 @@ The plugin declares the Streamable HTTP endpoint `https://mcp.sent.dm/mcp` and e
| Templates | `templates.list`, `templates.get`, `templates.get_by_name`, `templates.delete` |
| Lookup and analytics | `numbers.lookup`, `dashboard.messages_sent`, `dashboard.deliverability`, `dashboard.contacts` |
| Account | `account.get`, `balance.get`, `onboarding.status` |
| Feedback | `feedback.send` |
| Sender Profiles | `sender_profiles.list`, `sender_profiles.get`, `sender_profiles.create`, `sender_profiles.update`, `sender_profiles.delete` |
| SMS compliance | `compliance.requirements`, `compliance.setup_plan` |

The MCP client performs OAuth 2.1 authorization with PKCE and Dynamic Client Registration. The user selects an organization and Sender Profile during authorization; the client stores the resulting grant. Reauthorize to change scope and revoke access from **Sent Dashboard → Settings → MCP Connections**. Do not paste API keys or tokens into prompts.
The MCP client performs OAuth 2.1 authorization with PKCE and Dynamic Client Registration. The user selects an organization and Sender Profile during authorization; the client stores the resulting grant. An organization grant can use a schema-supported `profileId` to act as an owned profile; profile grants cannot. `sender_profiles.*` uses target `id` and rejects acting `profileId`. Reauthorize for another organization or scope outside the grant and revoke access from **Sent Dashboard → Settings → MCP Connections**. Do not paste API keys or tokens into prompts.

## Mutation and data-safety contract

- Preview the exact organization, Sender Profile, target, and payload before every send, contact creation, or deletion.
- Require explicit confirmation immediately before the mutation. Any changed payload or retry needs a fresh preview and confirmation.
- Preview the exact organization, Sender Profile, target, and payload before every send, contact creation, profile change, feedback report, or deletion.
- Require explicit confirmation immediately before the mutation, including profile changes and feedback reports. Any changed payload or retry needs a fresh preview and confirmation.
- Never retry an ambiguous send automatically; inspect the message and activity history first when possible.
- Treat `accepted` or `queued` as processing states, not proof of delivery.
- Mask phone numbers where practical and avoid repeating message bodies, contact data, KYC data, or billing details.
Expand Down Expand Up @@ -152,3 +157,17 @@ See [`CONTRIBUTING.md`](CONTRIBUTING.md) for the public-data policy, [`docs/PUBL
- [Sent API documentation](https://docs.sent.dm/reference/api)
- [Agent Skills specification](https://agentskills.io/specification)
- [Agent Plugins specification](https://agent-plugins.org/specification)

## Additional MCP behavior

The public MCP surface includes 27 tools. `messages.send` uses an existing template with all required parameters; it supports `scheduledAt` with an explicit timezone offset, from 1 minute to 30 days ahead. Acceptance is not delivery, and quiet hours can defer release.

Feedback goes to Sent staff only with user authorization and a reviewed, sanitized report. It is limited to 2000 characters and 20 calls per authenticated account scope per UTC day, shared across acting profiles. Its note does not guarantee storage, open a support ticket, or promise a response. Number lookup is paid and limited to 1000 calls per authenticated account scope per UTC day.

Profile create and delete require `idempotencyKey`; interrupted outcomes require reconciliation before another operation. MCP update changes only name, short name, or description. Compliance setup plans create a new profile, support SMS only, and hand required document uploads to the dashboard or REST API.

Dashboard volume counts delivered/read outbound SMS and WhatsApp over supported windows; deliverability is an all-time outbound percentage including SENT, and contacts is a current total. Do not claim unsupported date filters or trends.

Use the connected server's tool schemas for argument names and availability. The [public MCP landing page](https://mcp.sent.dm) lists the current surface; some documentation pages may describe an earlier catalog.

The bundled migration inventory scanner reads local regular files in the selected repository and makes no network requests. It skips symbolic links and environment files and omits source excerpts from reports. Other bundled utilities validate supplied local payloads or analyze supplied local exports. Remote account reads and authorized writes use the declared Sent MCP endpoint.
29 changes: 24 additions & 5 deletions adapter-sources/shared/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,11 +7,13 @@ This generated host adapter packages the official Sent Agent Skills and remote M
| Skill | Use for | Path |
|---|---|---|
| `sent` | Route broad or multi-step Sent requests | [`skills/sent/SKILL.md`](skills/sent/SKILL.md) |
| `sent-messaging` | Send messages and inspect message status or activity | [`skills/sent-messaging/SKILL.md`](skills/sent-messaging/SKILL.md) |
| `sent-messaging` | Send or schedule templates and inspect message status or activity | [`skills/sent-messaging/SKILL.md`](skills/sent-messaging/SKILL.md) |
| `sent-contacts` | List, inspect, bulk-create, summarize, or delete contacts | [`skills/sent-contacts/SKILL.md`](skills/sent-contacts/SKILL.md) |
| `sent-templates` | Find, inspect, or delete existing templates | [`skills/sent-templates/SKILL.md`](skills/sent-templates/SKILL.md) |
| `sent-analytics` | Query aggregate messaging, deliverability, contact, or number data | [`skills/sent-analytics/SKILL.md`](skills/sent-analytics/SKILL.md) |
| `sent-account-readiness` | Check account scope, balance, onboarding, and readiness | [`skills/sent-account-readiness/SKILL.md`](skills/sent-account-readiness/SKILL.md) |
| `sent-feedback` | Report user-authorized feedback about Sent tools | [`skills/sent-feedback/SKILL.md`](skills/sent-feedback/SKILL.md) |
| `sent-compliance` | Inspect live SMS market requirements and setup plans | [`skills/sent-compliance/SKILL.md`](skills/sent-compliance/SKILL.md) |
| `messaging-performance-analyzer` | Diagnose MDR funnels, delivery failures, and fallback | [`skills/messaging-performance-analyzer/SKILL.md`](skills/messaging-performance-analyzer/SKILL.md) |
| `sms-10dlc-registration` | Prepare US A2P 10DLC and TCR registration evidence | [`skills/sms-10dlc-registration/SKILL.md`](skills/sms-10dlc-registration/SKILL.md) |
| `waba-embedded-signup` | Connect WhatsApp Business Accounts and Sender Profiles | [`skills/waba-embedded-signup/SKILL.md`](skills/waba-embedded-signup/SKILL.md) |
Expand All @@ -23,7 +25,7 @@ This generated host adapter packages the official Sent Agent Skills and remote M
| `sent-webhook-engineer` | Build and debug verified webhook receivers | [`skills/sent-webhook-engineer/SKILL.md`](skills/sent-webhook-engineer/SKILL.md) |
| `sent-routing-strategist` | Choose channels and diagnose route outcomes | [`skills/sent-routing-strategist/SKILL.md`](skills/sent-routing-strategist/SKILL.md) |
| `sent-two-way-messaging` | Design inbound, consent, and conversational flows | [`skills/sent-two-way-messaging/SKILL.md`](skills/sent-two-way-messaging/SKILL.md) |
| `sent-profile-provisioning` | Execute the Sender Profile and user lifecycle | [`skills/sent-profile-provisioning/SKILL.md`](skills/sent-profile-provisioning/SKILL.md) |
| `sent-profile-provisioning` | Manage live Sender Profiles; guide REST users | [`skills/sent-profile-provisioning/SKILL.md`](skills/sent-profile-provisioning/SKILL.md) |
| `migrate-to-sent` | Migrate from another CPaaS provider onto Sent | [`skills/migrate-to-sent/SKILL.md`](skills/migrate-to-sent/SKILL.md) |

To install the skills without the host adapter, list or select them with the Skills CLI:
Expand All @@ -35,15 +37,18 @@ npx skills add https://github.com/sentdm/sent-plugin --skill sent

## MCP and authorization

The adapter connects only to `https://mcp.sent.dm/mcp`. The MCP client performs OAuth 2.1 with PKCE and Dynamic Client Registration; no credentials or credential placeholders are included. The grant is tied to the organization and Sender Profile selected during authorization. Reauthorize to change scope and revoke access from **Sent Dashboard → Settings → MCP Connections**.
The adapter connects only to `https://mcp.sent.dm/mcp`. The MCP client performs OAuth 2.1 with PKCE and Dynamic Client Registration; no credentials or credential placeholders are included. The grant is tied to the organization and Sender Profile selected during authorization. An organization grant can use a schema-supported `profileId` to act as an owned profile; profile grants cannot. `sender_profiles.*` uses target `id` and rejects acting `profileId`. Reauthorize for another organization or scope outside the grant and revoke access from **Sent Dashboard → Settings → MCP Connections**.

MCP-backed live operations cover:

- messaging: send, get status, and list activity;
- messaging: send or schedule templates, get status, and list activity;
- contacts: list, get, bulk-create, delete, and summarize messaging;
- templates: list, get by ID or name, and delete;
- analytics: number lookup, message volume, deliverability, and contact metrics; and
- account: account details, balance, and onboarding status.
- account: account details, balance, and onboarding status;
- feedback: user-authorized reports to Sent with `feedback.send`;
- Sender Profiles: `sender_profiles.list`, `.get`, `.create`, `.update`, and `.delete`; and
- SMS compliance: `compliance.requirements` and `compliance.setup_plan`.

Mutating workflows preview the exact scope and payload, then require explicit confirmation immediately before execution. They do not retry ambiguous sends blindly and do not equate an accepted message with delivery.

Expand All @@ -52,3 +57,17 @@ Mutating workflows preview the exact scope and payload, then require explicit co
For source, full installation options, developer workflow, and security reporting, visit [github.com/sentdm/sent-plugin](https://github.com/sentdm/sent-plugin). Current machine-readable Sent product documentation is indexed at [docs.sent.dm/llms.txt](https://docs.sent.dm/llms.txt).

This directory is generated. Make source changes in `packages/sent` or `adapter-sources`, then run `python3 scripts/generate_adapters.py`.

## Additional MCP behavior

The public MCP surface includes 27 tools. `messages.send` uses an existing template with all required parameters; it supports `scheduledAt` with an explicit timezone offset, from 1 minute to 30 days ahead. Acceptance is not delivery, and quiet hours can defer release.

Feedback goes to Sent staff only with user authorization and a reviewed, sanitized report. It is limited to 2000 characters and 20 calls per authenticated account scope per UTC day, shared across acting profiles. Its note does not guarantee storage, open a support ticket, or promise a response. Number lookup is paid and limited to 1000 calls per authenticated account scope per UTC day.

Profile create and delete require `idempotencyKey`; interrupted outcomes require reconciliation before another operation. MCP update changes only name, short name, or description. Compliance setup plans create a new profile, support SMS only, and hand required document uploads to the dashboard or REST API.

Dashboard volume counts delivered/read outbound SMS and WhatsApp over supported windows; deliverability is an all-time outbound percentage including SENT, and contacts is a current total. Do not claim unsupported date filters or trends.

Use the connected server's tool schemas for argument names and availability. The [public MCP landing page](https://mcp.sent.dm) lists the current surface; some documentation pages may describe an earlier catalog.

The bundled migration inventory scanner reads local regular files in the selected repository and makes no network requests. It skips symbolic links and environment files and omits source excerpts from reports. Other bundled utilities validate supplied local payloads or analyze supplied local exports. Remote account reads and authorized writes use the declared Sent MCP endpoint.
8 changes: 6 additions & 2 deletions adapter-sources/shared/marketplace.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,10 @@
"long_description": "Use Sent MCP operations for safe account, contact, template, analytics, and messaging workflows. Focused specialist skills add API integration, webhook engineering, contact-aware routing, two-way messaging, Sender Profile architecture and provisioning, CPaaS migration, delivery diagnosis, US A2P 10DLC, WhatsApp Business, RCS launch readiness, and cross-channel template design.",
"developer_name": "Sent",
"category": "Productivity",
"capabilities": ["Interactive", "Write"],
"capabilities": [
"Interactive",
"Write"
],
"website_url": "https://github.com/sentdm/sent-plugin#readme",
"privacy_policy_url": "https://www.sent.dm/en/legal/privacy-policy",
"terms_of_service_url": "https://www.sent.dm/en/legal/terms-of-service",
Expand All @@ -13,5 +16,6 @@
"Use $sent-routing-strategist to explain the safest channel and reroute policy for this workflow.",
"Use $migrate-to-sent to plan a staged migration from our current messaging provider."
],
"marketplace_description": "Official Sent skills and remote MCP integration for messaging engineering, operations, migration, and specialist channel workflows."
"marketplace_description": "Official Sent skills and remote MCP integration for messaging engineering, operations, migration, and specialist channel workflows.",
"support_url": "https://www.sent.dm/en/company/contact-support"
}
Loading