sally_
Documentation
WebsitePricingStart free trial
sally docs

Sally for agents & LLMs

Sally is API-first project management, CRM, marketing automation, and commerce in one workspace — built so humans and AI agents work from the same brand memory, under one permission and approval model. This page is the manifest for an AI agent (Claude, ChatGPT, or your own runtime): what Sally is for you, how to connect, the mandatory context-first workflow, the full tool catalog, and the governance model that decides what you may execute versus what a human must approve.

Sally is runtime-agnostic — any MCP client works. The hosted MCP server is the primary surface; the same operations are available over HTTP.

What Sally is for you

You are an agent acting inside a Sally brand (a workspace). Sally gives you three things a raw API cannot:

  1. Shared context. A single sally.context call grounds you in verified brand memory, active projects, open deals, overdue follow-ups, and standing instructions before you plan or act.
  2. One permission model. Your reach is exactly the reach of the Sally account, key, or connection behind your request — bounded by the same account → customer-account → brand → project role/scope checks a human faces. You are never broader than your credential.
  3. Safe autonomy. You propose actions. Sally's trust policy auto-executes safe, reversible work and quarantines risky actions (sends, deletes, deploys, exports) for human approval — with full evidence and an append-only audit trail.

Vocabulary: brand = workspace (pricing is per brand). Account = a person's login. Customer account = the billing/tenant root that owns brands. Tools are documented in dotted form (task.handoff.create); the MCP connector exposes them underscore-prefixed (mcp__sally__task_handoff_create).

How to connect

Hosted MCP endpoint: POST https://app.usesally.com/mcp. It is a first-party, stateless streamable-HTTP MCP server (no session id; scales horizontally). Flow: initialize → tools/list → tools/call.

Three connect paths, all resolving to one Sally account:

  • OAuth connector (recommended, no code). /mcp is an OAuth-protected MCP resource. Add https://app.usesally.com/mcp as a connector in Claude or ChatGPT and authorize. PKCE flow; tokens are sallyoauth_….
  • Hosted MCP key. Authorization: Bearer sallymcp_… (an AccountMcpKey). Default scopes read/write/mcp, optional expiry, and can be pinned to one workspace (cross-workspace requests are then denied). Manage under /auth/mcp-keys.
  • stdio bridge (legacy). The sally-mcp npm package talks to the web API with a personal API key (atpm_…) or an MCP key. The hosted /mcp endpoint is now primary.

Over HTTP the same surface uses session tokens, personal API keys (atpm_… / X-Api-Key), or hosted MCP keys, under identical account/workspace/project/scope checks.

The mandatory workflow: context first

Call sally.context first in every session, before planning, recommending, or executing. It returns verified memory (semantically ranked by your intent when embeddings are configured), active projects, open deals, overdue follow-ups, recent CRM activity, and standing instructions. Skipping it means acting blind.

Then, depending on the task:

  • Before working a project, call project.runtime_context — it returns the project summary, statuses and task counts, open/blocked tasks, relevant memory, CRM context, open blockers, pending approvals, your trust policy, the safe/risky action lists, approval boundaries, and a recommended workflow. (Reading it records a CONTEXT_READ event.)
  • Before resuming a task, call task.resume_context — latest handoff, decision, evidence, open blockers, pending approvals, and a computed recommendedNextAction.
  • Before editing any email or form design, call marketing.design.builder_schema (and marketing.campaign.builder_schema for flows) — required reading.
  • After meetings or research, write durable facts back with memory.intake (preview) → memory.intake.execute so the next agent inherits what you learned.

Governance model: propose → trust policy → auto-execute or approve

Every action you take flows through the Control Center. You submit an AgentProposal (typed actions JSON + evidence); Sally evaluates the brand's AgentTrustPolicy and either auto-executes or parks the proposal for a human.

Evaluation order:

  1. Evidence check — policies require evidence by default (requireEvidence).
  2. Caps — maxActionsPerProposal (default 5), maxActionsPerDay (default 50).
  3. YOLO — if the policy is yolo, auto-execute anything.
  4. Otherwise — auto-execute only if the policy's allowedActions covers all proposed actions and none are risky; else hold for human approval.

Trust policies are per-brand, per-source (HUMAN, MCP, CHATGPT, CODEX, CREWAI, PI, AGENT, SYSTEM), optionally per-agent.

SAFE actions (auto-executable): memory.intake.execute, memory.create, crm.activity.add, crm.follow_up.add, task.create, task.update, task.move, task.handoff.create, comment.add, task.comment.add, task.todo.*, blocker.create, approval.request, newsletter.draft.create.

RISKY actions (always human-approval; no in-proposal executor by design): email.send, newsletter.send, publish.external, data.export, record.delete, code.deploy, crm.bulk_update, marketing.bulk_update, external.write_back.

Related governance objects: ApprovalRequest (types LIVE_DEPLOY, CREDENTIAL, PAYMENT_DATA, CUSTOMER_DATA, CLIENT_DECISION, DESTRUCTIVE_ACTION, PUBLISHING); Blocker (CREDENTIAL, ACCESS, STAGING_FAILURE, AMBIGUITY, TOOLING_FAILURE, …); OperationalEvent (append-only ledger — every decision writes one plus an audit log). Mass marketing sends are gated separately: agents cannot send directly — they call marketing.message.propose_send, which a human approves.

Evidence discipline: handoffs and proposals carry normalized evidence (sources, checksPerformed, decisions, assumptions, risks, outputs, confidence, nextSteps). Credential safety: proposal JSON is scanned and secret-like values are rejected.

Tool catalog by domain

Names are dotted; the connector exposes them as mcp__sally__<underscored>.

Brand memory & context (call these first)

  • sally.context — verified memory + active projects + open deals + overdue follow-ups + standing instructions. Call first every session.
  • memory.list, memory.search, memory.get, memory.create, memory.update
  • memory.intake, memory.intake.execute — two-step meeting/research capture (preview → write; never sends external outreach)
  • project.runtime_context, task.resume_context — agent onboarding entry points
  • brand.ci.get, brand.ci.update — brand identity / email defaults

Memory types (14): FACT, DECISION, LESSON, CONSTRAINT, PREFERENCE, WORKFLOW, WARNING, BRAND_VOICE, CAMPAIGN_LEARNING, STRATEGIC, PRODUCT, CUSTOMER, MARKET, RELATIONSHIP.

Projects & tasks

  • Projects: project.list, project.get, project.create, project.update, project.archive, project.delete, project.runtime_context
  • Members: project.member.list, project.member.add, project.member.update, project.member.remove
  • Board/statuses: project.status.create, project.status.update, project.status.delete, project.status.reorder
  • Tasks: task.list, task.get, task.create, task.update, task.archive, task.delete, task.move, task.reorder, task.labels.update
  • Task images: task.description.image.add, task.comment.image.add
  • Checklists: task.todo.create, task.todo.update, task.todo.delete, task.todo.reorder
  • Comments: comment.add
  • Handoff / attention (signature agent workflow): task.handoff.create (hands work back to a human — creates a structured attention comment, and a Blocker + BLOCKED move if blocked, or an ApprovalRequest + REVIEW move if it needs review), task.resume_context

Notes: priorities are P1/P2/P3. A task carries both a new people model (owner + participants) and a legacy one (assignee + collaborators), reconciled server-side. Task-to-task dependencies and standalone label creation are REST/UI only (no MCP tool).

CRM

  • Organizations: crm.organization.list/get/create/update
  • People: crm.person.list/get/create/update, crm.person.email (1:1 email via the brand sender, respects the suppressed label). crm.person.get/list also return a commerce value profile (lifetime spend, order count, products) for loyalty/review outreach.
  • Deals: crm.deal.list/get/create/update
  • Activities: crm.activity.list, crm.activity.add
  • Follow-ups: crm.follow_up.list/add/update
  • Add-on info: crm.addon.info
  • Clients: client.list/get/create/update/delete — "Client" is the same user-facing thing as a CRM Organization; client.create is idempotent by name, client.delete is a soft archive that refuses if projects are linked.

There are no CRM delete tools — archive with archived: true.

Relationships (global identity graph, read-only)

  • relationship.person.list, relationship.organization.list — cross-brand "we already know this person from another brand." Creation is implicit via memory intake (no create/update/get tools).

Marketing (largest domain)

  • Contacts & fields: marketing.contact.list/create/update/timeline/convert_to_crm, marketing.field.list/create/update
  • Audiences: marketing.audience.list/create/update/sync/duplicate, marketing.audience.contact.add
  • Forms & submissions: marketing.form.list/create/update/duplicate/submissions, marketing.submission.create
  • Content gates: marketing.content_gate.list/create/update
  • Campaigns / flows: marketing.campaign.builder_schema, marketing.campaign.validate_graph, marketing.campaign.list/create/create_simple_sequence/update/activate/pause/duplicate, marketing.campaign.start_test/runs/clear_test_runs, marketing.campaign.step.retry, marketing.campaign.step.cancel
  • Messages / email builder: marketing.message.list/create/update/duplicate/delete/import_html/preview/send_test, marketing.message.propose_send (mass send → human approval), marketing.design.builder_schema (read before editing designs)
  • Media: marketing.media.list/upload/upload_from_url/duplicate/delete, media.image.list/get/upload, media.asset.update/delete
  • Senders: marketing.sender.list/create/update/delete/check_health/send_test
  • Approvals: marketing.approval.list/approve/reject
  • Deliveries: marketing.delivery.list/get/retry/cancel
  • Website tokens: marketing.website_token.list/create/revoke
  • Settings: marketing.settings.get/update, marketing.addon.info

Flow triggers include CRM and commerce events (crm_deal_won, commerce_order_placed, commerce_value_threshold_reached, …); actions include crm_handoff, score_adjust, add_audience, task_create, memory_create, and agent_job (results pass Control Center approvals). The email builder includes a product block (buy button + optional review link) sourced from the commerce catalog.

Commerce

  • commerce.store.list, commerce.store.connect (Shopify or WooCommerce), commerce.store.register_webhooks, commerce.store.disconnect
  • commerce.product.sync, commerce.product.list

One store per brand. Order events build a per-contact value profile (idempotent, reflects refunds), can auto-promote purchasers to CRM people, and fire lifetime-spend milestone triggers. Commerce settings (autoPromotePurchasers, spendMilestones) live under marketing.settings.*.

Timesheets

  • timesheet.list, timesheet.report, timesheet.users, timesheet.add, timesheet.update, timesheet.delete

Two-stage invoicing lock; client-invoicing fields need workspace billing access.

Workspace & clients

  • workspace.list, workspace.create, workspace.invite

Governance (Control Center)

  • Proposals: proposal.create, proposal.list, proposal.get, proposal.resolve, proposal.execute
  • Opportunities (next-best-action): opportunity.list, opportunity.recommend, opportunity.execute

What is shipped vs roadmap

Honest scope — build on what exists, not on enum values.

Shipped

  • Email sending via SMTP / AWS SES; the full email builder including the product block.
  • GDPR-first consent capture: per-purpose consent, double opt-in, suppression, content gates separate from consent.
  • Commerce: Shopify (OAuth, expiring tokens, GDPR compliance webhooks) and WooCommerce (REST key, auto-registered webhooks), product catalog sync, per-customer value profiles, lifetime-spend milestone triggers.
  • Proposals, trust policies, approvals, blockers, and the append-only operational/audit ledger.
  • Passkey registration.

Roadmap / not yet — do not rely on these

  • SMS / WhatsApp / Telegram sending. These appear in enums but are not implemented; marketing sending is email only.
  • Send-time consent enforcement. Consent is enforced at capture/segment time, not re-checked at mass-send. Do not assume "consent verified on every send."
  • opportunity.execute for all wedges. Only one wedge (meeting-to-memory) executes; the other five are recommend-only.
  • External tracker sync (Linear / Jira / GitHub). WorkItemRef declares these, but only SALLY is wired.
  • Passkey login / assertion. Registration exists; login-with-passkey may be incomplete.
  • Per-tenant security policy config. Password/session/2FA/audit/key policies are deployment-global singletons (except CustomerAccountSecuritySettings.requireTwoFactor).