First-party app

CleverReach

Name: CleverReach
Author: w6w

Manage CleverReach receivers, groups, attributes, tags, mailings, reports and the blacklist.

stable MarketingCommunication

About

CleverReach ships in the w6w first-party pack. It declares 24 actions, 2 health checks, and the host runs its code in a sandbox that never sees the credential.

App id: io.w6w.cleverreach
Version: 0.1.0
Author: w6w
Licence: MIT
Categories: Marketing · Communication

Overview

CleverReach is a European email-marketing platform. This app lets a workflow keep its subscriber data in step with the rest of the business: add, update, upsert, activate, deactivate and delete receivers; manage the groups (receiver lists) they belong to; create attributes; tag receivers; and read the blacklist and add to it.

It also reads what happened after a send: list mailings and fetch one, and list and fetch the reports for them, so a workflow can react to a campaign that finished or stop sending to an address that bounced.

It connects with a REST API access token pasted from Account > Extras > REST API, or with an OAuth app’s client id and secret, which the app exchanges for a token and renews itself. The vendor’s forms endpoints are deprecated and are not covered.

Build with CleverReach

Three routes to the same 24 actions. The Workflow tab is generated from CleverReach's own manifest and carries its real ids, so it is copy-pasteable; the Code and CLI examples are the same call for any action on any app, so every app-specific value in them is a blank you fill in.

Actions Workflow Code MCP

Create an attribute

attribute-create

Create a global attribute, or a group attribute when a group id is given (`POST /v3/attributes`). Not idempotent.

List attributes

attribute-list

List global attributes, or one group's local attributes when a group id is given (`GET /v3/attributes`).

Add to the blacklist

blacklist-add

Add an email address to the blacklist (`POST /v3/blacklist`). Not idempotent.

List blacklisted emails

blacklist-list

List every blacklisted email address in the account (`GET /v3/blacklist`). The endpoint documents no paging.

Remove from the blacklist

blacklist-remove

Delete an email address from the blacklist (`DELETE /v3/blacklist/{email}`).

Create a group

group-create

Create a group (receiver list) (`POST /v3/groups`). Not idempotent: each call creates another group.

Delete a group

group-delete

Delete a group (receiver list) (`DELETE /v3/groups/{id}`). A group marked `locked` cannot be deleted.

Get a group

group-get

Fetch one group (receiver list) by id (`GET /v3/groups/{id}`).

List groups

group-list

List the account's groups (receiver lists) (`GET /v3/groups`).

Update a group

group-update

Change a group's name, notes, lock or backup flag (`PUT /v3/groups/{id}`). Send only what you want to change.

Get a mailing

mailing-get

Fetch one mailing by id (`GET /v3/mailings/{id}`).

List mailings

mailing-list

List mailings (`GET /v3/mailings`). `start`/`end` filter by a time that depends on `state`: finished by finish time, draft by creation time, waiting by send time, running by start time. `page` only applies when `state` is not `all`.

Add a receiver

receiver-add

Create a receiver in a group (`POST /v3/groups/{group_id}/receivers`). Omitting `registered`, `activated` and `deactivated` creates an ACTIVATED receiver; provide `activated` only to skip double-opt-in. Not idempotent: an existing email is refused by CleverReach (use Upsert receivers to update-or-create).

Delete a receiver

receiver-delete

Delete a receiver by id or email (`DELETE /v3/receivers/{id}`). The optional group id is sent as the vendor's `group_id` query; the spec gives it no further explanation, so try it on a test account before relying on a group-scoped delete.

Get a receiver

receiver-get

Fetch one receiver by id or email (`GET /v3/receivers/{id}`). Pass a group id to include that group's specific information.

List receivers in a group

receiver-list

List a group's receivers (`GET /v3/groups/{group_id}/receivers`). Pages are zero-based; the page size is capped at 5000.

Activate or deactivate a receiver

receiver-set-active

Set a receiver's status within a group: `PUT /v3/groups/{group_id}/receivers/{id}/activate` or `/deactivate`.

Add tags to a receiver

receiver-tags-add

Add tags to a receiver (`POST /v3/receivers/{id}/tags`). Returns the list of tags actually added. Characters outside letters, digits, `_` and `-` become `_`; `origin.tag` sets an origin.

Update a receiver

receiver-update

Change a receiver's data within a group (`PUT /v3/groups/{group_id}/receivers/{id}`). The email cannot be changed. Leave `deactivated` out unless you mean it.

Upsert receivers

receiver-upsert

Update receivers, or create them when the email is new, in one call (`POST /v3/groups/{group_id}/receivers/upsert`). Takes a JSON array of receiver objects in the vendor's own shape (`email`, `registered`, `activated`, `source`, `attributes`, `global_attributes`, `tags`). With `deactivated` set to 0 an existing inactive receiver may be reactivated.

Get a report

report-get

Fetch one report by id (`GET /v3/reports/{id}`); the id is the mailing id. A split-test version cannot be fetched directly: the vendor answers 403 naming the parent id to call instead.

List reports

report-list

List mailing reports (`GET /v3/reports`). `start` and `end` must be given together. Split-test reports carry their versions in a `versions` array.

List tags

tag-list

List the tags used in the account (`GET /v3/tags`).

Who am I

whoami

Information about the CleverReach client (account) the token belongs to (`GET /v3/debug/whoami`). The response body is undocumented, so it is returned as sent.

A workflow step names the app and the action, and the editor fills in the connection when you pick one. This is the Step shape from the workflow spec, carrying CleverReach's real ids.

{
  "manifestVersion": "2",
  "name": "cleverreach-example",
  "steps": [
    {
      "id": "attribute-create",
      "uses": {
        "app": "io.w6w.cleverreach",
        "action": "attribute-create",
        "connection": "conn_YOUR_CONNECTION_ID"
      },
      "with": {
        "name": "<name>",
        "type": "<type>"
      }
    }
  ]
}

Here are some of the things you can do

Create an attribute
perform
attribute-create
List attributes
search
attribute-list
Add to the blacklist
perform
blacklist-add
List blacklisted emails
search
blacklist-list
Create a group
perform
group-create

+19 more actions available

Every app-specific value here is a blank you have to fill in. An app action is reached through the connection that authenticates it, so the address is a connection id, not the app id — and connections belong to your account, so a public page cannot know yours. Create one for CleverReach, then fill in the three blanks: conn_YOUR_CONNECTION_ID, the action key, and the parameters that action declares. The call itself is real — the shape is transcribed from the studio's own snippet builder, which prints the same kind of blanks — but nothing in it is specific to CleverReach. The Workflow tab is where this app's real ids are.

JS SDK CLI

Install

npm yarn pnpm deno

npm install @w6w/sdk

yarn add @w6w/sdk

pnpm add @w6w/sdk

deno add npm:@w6w/sdk

Code

import { W6wClient, isActionRun } from "@w6w/sdk";

// Reads W6W_BASE_URL and W6W_TOKEN from the environment when omitted.
const client = new W6wClient();

const envelope = await client.run({
  urn: "conn_YOUR_CONNECTION_ID",
  action: "attribute-create",
  payload: {
    name: "<value>",
    type: "<value>",
    // groupId: "<value>",
    // description: "<value>",
    // previewValue: "<value>",
    // defaultValue: "<value>",
  },
});

if (isActionRun(envelope)) console.log(envelope.value);

Install the CLI

npm install -g @w6w/cli

CLI

w6w run conn_YOUR_CONNECTION_ID --action attribute-create --payload '{"name":"<value>","type":"<value>"}'

Give an AI agent CleverReach — without giving it CleverReach's credentials. One MCP endpoint exposes every app, function and workflow the caller is entitled to, as tools it can discover and run. Access is granted per team while we onboard.

One tool call

{
  "name": "w6w_invoke",
  "arguments": {
    "ref": "app:io.w6w.cleverreach#attribute-create",
    "input": {
      "name": "<name>",
      "type": "<type>"
    }
  }
}

Every tool names its target with a single ref. The app: form above doesn't name a connection at all — the host resolves which of the caller's CleverReach connections to sign with, and refuses rather than guesses when the answer is ambiguous.

What the agent gets

Credentials it can't read

The token is attached host-side, at the moment of the call. It is never a tool argument, never in the model's context, and never in a transcript — so a prompt injection has nothing to exfiltrate.

A tool surface scoped to the caller

Tools are derived per end user from what that person has actually connected and is entitled to — not one shared bot identity carrying the union of everyone's access.

A durable workflow in one call

Multi-step work runs on the workflow engine and returns a run handle the agent can poll — retries, branching and state survive the conversation that started them.

Health-aware discovery

CleverReach's declared health checks are on the surface too, so an agent can tell "the vendor is down" from "your credential expired" before it burns a retry on either.

The MCP surface is part of the hosted platform. CleverReach itself is MIT, and the runtime that executes it is source-available (FSL).

Request MCP access

Health checks

CleverReach declares its own checks, so its health is a property of the app rather than something the host guesses at.

service

CleverReach platform status

Component status from status.cleverreach.com (Statuspage). The `Rest-API` component decides the verdict; the other components are reported but never move it.

dependency

API reachable

Unauthenticated GET /v3/debug/ttl. CleverReach's JSON 401 passes: it proves the API is answering. Credential validity is the derived `auth:*` check's job.