Skip to content

Question: signed receipts for selected CRM MCP actions? #1

Description

@cullenmeyers

Hi — I found sharpspring-mcp-server while looking at MCP projects where agent-triggered CRM actions may need evidence that survives outside the original runtime.

I’m building BoundaryAttest, a small open-source project for portable signed receipts around selected actions, artifacts, or handoffs that cross trust boundaries:

https://github.com/cullenmeyers/BoundaryAttest

The idea is not to replace SharpSpring / Constant Contact Lead Gen & CRM history, API responses, MCP responses, account logs, environment-based credentials, or normal CRM audit workflows. The receipt only proves a narrow claim:

a specific signer signed a specific claim, and the signed claim has not been altered.

Your repo seemed relevant because it exposes CRM data through MCP, including lead reads, field discovery, create/update/delete lead operations, and a generic sharpspring_call tool that can call other documented SharpSpring API methods for accounts, campaigns, opportunities, lists, notes, tasks, and related CRM objects.

A receipt could potentially bind selected events like:

  • MCP tool name;
  • SharpSpring method called;
  • object type, such as lead, account, opportunity, list, note, or task;
  • target object reference where safe;
  • create/update/delete/read action class;
  • input or argument digest;
  • result digest or CRM API response hash;
  • object-level error result, if any;
  • account/config reference without exposing credentials;
  • timestamp/event ID;
  • signer/public key ID.

The strongest use case would be when an agent-created lead, bulk lead update, deleted lead record, opportunity/list/note/task mutation, CRM export, or generated sales/marketing handoff artifact is passed to another person, reviewer, automation, or downstream workflow, and they should not have to fully trust the original MCP runtime or local logs.

BoundaryAttest would not prove the CRM action was correct, authorized, safe, or commercially wise. It would only prove that a specific claim about a selected CRM action or artifact was signed and has not been altered after export.

Does that kind of portable signed receipt fit any workflow you imagine for sharpspring-mcp-server, especially around lead mutations, bulk CRM changes, or handoff/export artifacts? Or are normal SharpSpring API responses and CRM history enough for the current scope?

No pressure if it is not relevant — I’m mainly trying to learn where signed receipts are actually useful around MCP tools with real CRM side effects.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions