Extrovert JavaScript packagesCAUTION
TypeScript SDK and MCP server for Extrovert
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Public release source for Extrovert's JavaScript integration surfaces:
@extrovert.dev/sdk- typed TypeScript client for the Extrovert REST API.@extrovert.dev/mcp- MCP SDK v2 server with stdio and stateless Streamable HTTP transports.
Both packages share one contract version. Default commands install stable:
npm install @extrovert.dev/sdk npx -y @extrovert.dev/mcp --help
For opt-in preview features or fixes, use npm install @extrovert.dev/sdk@next or npx --yes --prefer-online @extrovert.dev/mcp@next --help. Exact published versions provide reproducible installs. See switching channels; npm previews do not change hosted MCP or GitHub plugin skills.
The MCP package installs extrovert-mcp for MCP transports and the extrovert CLI alias for setup, authentication, inbox reads, review status, and reviewed sends. OAuth-capable clients can connect directly to the production protected resource at https://mcp.extrovert.dev/mcp; the browser flow avoids putting an Extrovert key in client config.
Remote MCP requires no local SDK or compiler. Use the published CLI when Node >=20 is already available; no TypeScript compiler, pnpm, Git, or Docker is needed at runtime. For an agent with secure HTTP execution only, use the HTTPS recipes.
extrovert review watch --wait-seconds 86400 --json waits quietly across short requests. The SDK equivalents are client.reviews.events.watch() and client.waitForActivation(); client.tasks exposes durable observer handles. Observer completion is not approval, credential exchange, or a sent message. Waiting and resumption explains the optional MCP Tasks extension and fallback behavior.
Choose Connections and access for t
6b6f585b9ba0OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add sdk --env ACTIONS_ID_TOKEN_REQUEST_TOKEN=${ACTIONS_ID_TOKEN_REQUEST_TOKEN} --env ACTIONS_ID_TOKEN_REQUEST_URL=${ACTIONS_ID_TOKEN_REQUEST_URL} --env EXTROVERT_API_KEY=${EXTROVERT_API_KEY} --env EXTROVERT_WEBHOOK_SECRET=${EXTROVERT_WEBHOOK_SECRET} -- npx -y @extrovert.dev/[email protected]{
"mcpServers": {
"sdk": {
"command": "npx",
"args": [
"-y",
"@extrovert.dev/[email protected]"
],
"env": {
"ACTIONS_ID_TOKEN_REQUEST_TOKEN": "${ACTIONS_ID_TOKEN_REQUEST_TOKEN}",
"ACTIONS_ID_TOKEN_REQUEST_URL": "${ACTIONS_ID_TOKEN_REQUEST_URL}",
"EXTROVERT_API_KEY": "${EXTROVERT_API_KEY}",
"EXTROVERT_WEBHOOK_SECRET": "${EXTROVERT_WEBHOOK_SECRET}"
}
}
}
}Exposed tools (79)
51 read · 19 write · 9 destructive. Blast radius: 9 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
add_contact_list_entry | write | Add an allow or block entry to an inbox |
batch_update_messages | write | Mark read/unread and/or move folder for a list of message ids that all belong to one inbox, in a single call. |
cancel_commerce_request | read | Withdraw this agent |
cancel_review | read | Withdraw your own pending review (rr_...) to the terminal cancelled state: you decided not to send it after all. |
check_suppression | read | Pre-check, BEFORE you compose, whether a recipient has opted out of this org |
correct_activation_email | read | Correct the expected human email before activation. Requires the latest revision from check_activation. Clears previous email proof; the human must send a fresh message. The original 24-hour deadline stays fixed. |
create_inbox | write | Provision a real, persistent inbox for this agent in one call. Omit username and domain to create an instant address on a |
delete_contact_list_entry | destructive | Delete a contact-list entry by id (lst_...). The allow/block rule stops applying immediately. |
delete_inbox | destructive | Permanently delete an inbox and all of its messages, and tear down its sender identity. Requires mailbox:delete, |
delete_message | destructive | Delete one message by its opaque id (msg_...). By default it is moved to the Trash folder (a recoverable soft |
delete_thread | destructive | Delete an entire conversation thread by its stable id (thr_...): every message in it (across INBOX and Sent). By |
delete_webhook | destructive | Delete a registered webhook by id (whk_...). Deliveries stop immediately. This cannot be undone. |
describe_administrative_action | read | Get the exact input JSON Schema, read/change classification, and authority required for an action_id from list_administrative_actions. All schema references are included. Supply parameters under path and query and JSON under body. Never guess an organization, project, connection, or agent ID. |
export_email_config | read | Export an inbox |
forward_email | write | Forward an existing message (by its opaque id) to new recipients and submit it for HUMAN REVIEW: the default |
get_attachment | read | Download one attachment |
get_backlog_status | read | Read the category |
get_category | read | Fetch one category by id (cat_...): its name, description, scope, and graduation state. |
get_deliverability_status | read | Read this org |
get_domain | read | Answer whether a domain is ready, whether the customer or Extrovert needs to act, and what to do next. |
get_inbox | read | Fetch one inbox by id or address (includes its metadata). |
get_message | read | Fetch one message by its opaque id (msg_...), as returned by read_messages / search / wait_for_email. The owning |
get_pacing_state | read | Read the category |
get_review | read | Fetch one review request by id (rr_...): its current state, |
get_review_turns | read | Fetch the append-only thread turns for a review (rr_...): the intent, every draft revision, human comments/edits/ |
get_risk_dial | write | Read the brand-risk dial that governs auto-send: the account-wide default plus every category |
get_rule_audit | read | Read the append-only change/undo audit log spanning rules AND categories (D11): the safety net for the shared/house- |
get_rules | read | Get the ORDERED active writing rules for a compose/redraft. The section 7 precedence ladder is applied SERVER-SIDE |
get_submission | read | Check an accepted email |
get_thread | read | Read a full conversation, all messages oldest-first. If you already have a message, pass its exact message_id; |
get_webhook | read | Fetch one registered webhook by id (whk_...). The signing secret is redacted. |
list_attachments | read | List the attachments on a message: their opaque id, filename, content type, and size. Use the returned id with |
list_categories | read | Browse the categories in this account (id + name + description + scope + state) so you can MATCH an existing |
list_commerce_requests | read | List visible domain-purchase and plan-change requests. Use returned ids with get_commerce_request for complete |
list_contact_lists | read | List the allow/block contact-list entries that govern an inbox: its inbox-specific entries plus any |
list_deliverability_findings | read | List this org |
list_domain_events | read | Read durable updates for a visible domain, including ready, action needed and recovered. |
list_domains | read | List visible domains with a plain-language readiness result, who needs to act, and the next step. |
list_inboxes | read | List inboxes visible to this connection, newest first. Follow next_cursor with the same filters for more pages. |
list_outbox | read | List bounded outbound work accepted for an inbox. |
list_review_events | read | Non-blocking drain of the next un-acked review nudges for this agent, in FIFO order (strict per review), with |
list_reviews | read | List the review requests submitted in this account so a sending agent can monitor its submissions in the human |
list_suppressions | read | List this org |
list_threads | read | List conversation threads in an inbox, most-recently-active first. Pass next_cursor back as cursor to continue without restarting the list. |
list_webhooks | read | List a bounded page of inbound webhooks within this connection |
mark_read | destructive | Set or clear a message |
offboard_domain | destructive | Remove a domain from the customer. DESTRUCTIVE AND IRREVERSIBLE: the teardown job |
onboard_domain | write | Add an inbox subdomain the customer controls. The customer publishes the returned nameserver records; |
post_review_chat | write | Ask the human reviewer a clarifying question on a review |
promote_rule | write | Move a rule between the category and general/house-style layers (via a supersession). Promote to |
propose_category | read | Propose a NEW category with a name + a skill-style description (D9). It stands immediately and is shared across |
propose_graduation | read | PROPOSE graduating a category (D16/D6): records your request (with optional evidence) for a human to review and |
quote_domain | read | Check current availability and first-year/renewal pricing for a domain. This never purchases, reserves, or |
read_messages | read | List messages in an inbox, newest first. Narrow with exact-field filters (from/to/subject substring) or |
redeem_enrollment | read | Exchange a single-use enrollment token (pk_enroll_...) for a SCOPED agent key (pk_agent_...) bound to this agent. |
register_webhook | read | Register an HTTPS endpoint to receive HMAC-signed inbound-message deliveries. Each delivery carries |
reply_email | write | Compose a reply within an existing thread and submit it for HUMAN REVIEW: the default path, exactly like |
request_domain_purchase | write | Create a durable domain-purchase request. This tool does NOT approve the request and does NOT assert that a |
request_plan_change | write | Create a durable upgrade or downgrade request for human review. This tool never approves its own request. |
retire_rule | destructive | Soft-delete a rule (status= |
reviewer_decide | write | REVIEWER PLANE (review:act): submit your decision on a review (rr_...) you |
revoke_suppression | destructive | Revoke ONE of this org |
save_rule | write | Maintain a project-level writing rule outside authenticated reviewer feedback. The audit log and undo preserve history. scope= |
search | read | Full-text search across messages (subject, body, sender). Scope to one inbox with |
search_threads | read | Search conversation threads by subject, participant, or latest-message snippet. Results are newest-active first; pass next_cursor back as cursor to continue. |
send_email | write | Compose a new email from one of this agent |
sign_up | read | Reserve a free inbox for your agent. Supply the human email expected to activate it. |
stream_info | read | Describe the Server-Sent-Events (SSE) journal for message.* and review.* events. This tool returns URLs, not an open stream. |
submit_revision | write | Post a NEW draft for a review (rr_...) under a parent_revision CAS: the way to redraft after feedback, a chat |
undo_rule_change | read | Undo a rule change by its audit-row id (udo_...): restore the prior version as a NEW forward supersession (action= |
update_category | write | Update a category |
update_inbox | write | Update an inbox |
update_webhook | write | Update a registered webhook in place by id (whk_...). Change the delivery |
verify_domain | write | Trigger/refresh verification for an onboarded domain and return its (possibly advanced) status. |
verify_signup | read | Complete activation after check_activation reports proven, or supply a legacy emailed OTP. On success the bootstrap key is revoked and you receive a NEW |
wait_for_domain | read | Wait up to 50 seconds for mail readiness without triggering DNS work. Return immediately if the domain is ready, the customer must act, or setup needs attention. |
wait_for_email | read | Block until the next matching message arrives in an inbox, then return it with any OTP code / verification link |
wait_for_review_event | read | Long-poll (~25-55s) for the next review nudge: blocks until one is available OR the deadline, then returns like |
whoami | read | Confirm that this agent is connected, show the organization and project it acts in, and explain which actions |
Trust audit
CAUTIONgrade B · trust 88/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (12 observation(s))
- Shell
- declared (2 observation(s))
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (9)
"review, and a worse one, because it exfiltrates a conversation. Under the default `require_review` policy a " +
const url = new URL(request.url ?? "/", "http://127.0.0.1");
childEnv.EXTROVERT_API_BASE_URL = `http://127.0.0.1:${address.port}`;try { url = new URL(req.url ?? "/", "http://127.0.0.1"); }const redirectUri = `http://127.0.0.1:${(server.address() as AddressInfo).port}/callback`;delete_contact_list_entry, delete_inbox, delete_message, delete_thread, delete_webhook, mark_read, offboard_domain, retire_rule, revoke_suppression
const json = typeof atob === "function" ? atob(b64) : Buffer.from(b64, "base64").toString("utf8");Submit limited evidence with `feedback.submit`, open a tracked conversation with `support.cases.create`, and follow published replies with `support.cases.get` / `.events`. MCP users can use `submit_fe
use other agents' inboxes, change access and policies, create credentials, and
Gates applied: no_behavioural_pass.
6b6f585b9ba0full audit observations/trust-audit/mcp-server/extrovert-dot-dev__extrovert-js.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 6b6f585b9ba0 | CAUTION | B | 88 | first audit |
Questions
What is the @extrovert.dev/sdk MCP server?
TypeScript SDK and MCP server for Extrovert
What tools does @extrovert.dev/sdk expose?
79 in total: 51 read-only, 19 that write, and 9 that can delete or overwrite (delete_contact_list_entry, delete_inbox, delete_message, delete_thread, delete_webhook). Every one is listed on this page with its risk.
Is @extrovert.dev/sdk safe to connect to an agent?
With care. The audit graded it B (88/100) and found 9 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 9 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does @extrovert.dev/sdk need?
It reads ACTIONS_ID_TOKEN_REQUEST_TOKEN, ACTIONS_ID_TOKEN_REQUEST_URL, EXTROVERT_API_KEY and EXTROVERT_WEBHOOK_SECRET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @extrovert.dev/sdk run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @extrovert.dev/sdk at 0.1.8.
How current is this page?
The grade is for one exact copy of the source (6b6f585b9ba0), read on 2026-10-11. The repository is watched and re-audited when it changes.