Create, update, delete and read the Lead/Client and Affiliate records a Credit Repair Cloud account runs on.
Credit Repair Cloud ships in the w6w first-party pack. It declares 8 actions, 1 health check, and the host runs its code in a sandbox that never sees the credential.
io.w6w.creditrepaircloudCredit Repair Cloud is the CRM a credit-repair business runs on, and its Web API is deliberately small: eight endpoints, four for Lead/Client records and four for Affiliate records, each a single-record insert, update, delete or view.
This app is exactly those eight, one action each, so a workflow can create a lead from a form or another CRM, keep a client’s contact details and status fresh, retire records that are no longer wanted, and look one up by id — for clients and for the affiliates who refer them, which are a separate resource with their own statuses, fields and portal access.
Everything talks to the vendor’s own endpoint shape, including the parts its documentation states inconsistently: the two credentials travel in the URL query string (added only by the connection’s sign hook, never by an action) while the XML payload travels as a form-encoded POST body, so both of the vendor’s contradictory instructions are honoured at once. Responses are XML and are read with a small hand-rolled parser, because the vendor’s documentation never shows a successful response body — actions return the vendor’s envelope generically rather than claiming field names nobody has observed.
The health surface answers two questions: whether Credit Repair Cloud’s own status page reports the API component it names as operational, and whether the stored API key and secret key are live, classified from the vendor’s own error codes rather than from an HTTP status (this vendor answers 200 for everything, including a wrong key).
Three routes to the same 8 actions. The Workflow tab is generated from Credit Repair Cloud's own manifest and carries its real ids, so it is copy-pasteable; the Code and CLI examples are the same call for any action on any app, so every app-specific value in them is a blank you fill in.
delete-affiliate Delete a Credit Repair Cloud affiliate by id (POST /api/affiliate/deleteRecord).
delete-lead Delete a Credit Repair Cloud lead or client record by id (POST /api/lead/deleteRecord).
insert-affiliate Create a Credit Repair Cloud affiliate (POST /api/affiliate/insertRecord).
insert-lead Create a Credit Repair Cloud lead or client record (POST /api/lead/insertRecord).
update-affiliate Update a Credit Repair Cloud affiliate by id (POST /api/affiliate/updateRecord).
update-lead Update a Credit Repair Cloud lead or client record by id (POST /api/lead/updateRecord).
view-affiliate Read one Credit Repair Cloud affiliate by id (POST /api/affiliate/viewRecord).
view-lead Read one Credit Repair Cloud lead or client record by id (POST /api/lead/viewRecord).
A workflow step names the app and the action, and the editor fills in the
connection when you pick one. This is the Step shape from the
workflow spec, carrying Credit Repair Cloud's real ids.
{
"manifestVersion": "2",
"name": "creditrepaircloud-example",
"steps": [
{
"id": "insert-affiliate",
"uses": {
"app": "io.w6w.creditrepaircloud",
"action": "insert-affiliate",
"connection": "conn_YOUR_CONNECTION_ID"
},
"with": {
"type": "<type>",
"firstname": "<firstname>",
"lastname": "<lastname>"
}
}
]
}insert-affiliate insert-lead update-affiliate update-lead view-affiliate +3 more actions available
Every app-specific value here is a blank you have to fill in. An
app action is reached through the connection that authenticates it, so the
address is a connection id, not the app id — and connections belong to your account,
so a public page cannot know yours. Create one for Credit Repair Cloud, then fill in
the three blanks: conn_YOUR_CONNECTION_ID, the action key, and the
parameters that action declares. The call itself is real — the shape is transcribed
from the studio's own snippet builder, which prints the same kind of blanks — but
nothing in it is specific to Credit Repair Cloud. The Workflow tab is where this app's
real ids are.
npm install @w6w/sdkyarn add @w6w/sdkpnpm add @w6w/sdkdeno add npm:@w6w/sdkimport { W6wClient, isActionRun } from "@w6w/sdk";
// Reads W6W_BASE_URL and W6W_TOKEN from the environment when omitted.
const client = new W6wClient();
const envelope = await client.run({
urn: "conn_YOUR_CONNECTION_ID",
action: "insert-affiliate",
payload: {
type: "<value>",
firstname: "<value>",
lastname: "<value>",
email: "<value>",
phone: "<value>",
// gender: "<value>",
// company: "<value>",
// company_url: "<value>",
// phone_ext: "<value>",
// alternate_phone: "<value>",
// mailing_address: "<value>",
// city: "<value>",
// state: "<value>",
// zip: "<value>",
// internal_note: "<value>",
// affiliate_portal_access: "<value>",
// affiliate_userid: "<value>",
// send_setup_password_info_via_email: "<value>",
},
});
if (isActionRun(envelope)) console.log(envelope.value); npm install -g @w6w/cli w6w run conn_YOUR_CONNECTION_ID --action insert-affiliate --payload '{"type":"<value>","firstname":"<value>","lastname":"<value>","email":"<value>","phone":"<value>"}' Give an AI agent Credit Repair Cloud — without giving it Credit Repair Cloud's credentials. One MCP endpoint exposes every app, function and workflow the caller is entitled to, as tools it can discover and run. Access is granted per team while we onboard.
One tool call{
"name": "w6w_invoke",
"arguments": {
"ref": "app:io.w6w.creditrepaircloud#insert-affiliate",
"input": {
"type": "<type>",
"firstname": "<firstname>",
"lastname": "<lastname>"
}
}
}
Every tool names its target with a single ref. The
app: form above doesn't name a connection at all — the
host resolves which of the caller's Credit Repair Cloud connections to sign
with, and refuses rather than guesses when the answer is ambiguous.
The token is attached host-side, at the moment of the call. It is never a tool argument, never in the model's context, and never in a transcript — so a prompt injection has nothing to exfiltrate.
Tools are derived per end user from what that person has actually connected and is entitled to — not one shared bot identity carrying the union of everyone's access.
Multi-step work runs on the workflow engine and returns a run handle the agent can poll — retries, branching and state survive the conversation that started them.
Credit Repair Cloud's declared health checks are on the surface too, so an agent can tell "the vendor is down" from "your credential expired" before it burns a retry on either.
The MCP surface is part of the hosted platform. Credit Repair Cloud itself is MIT, and the runtime that executes it is source-available (FSL).
Credit Repair Cloud declares its own checks, so its health is a property of the app rather than something the host guesses at.
Atlassian Statuspage rollup for status.creditrepaircloud.com, tracking the "API" component this app's actions actually call. Unauthenticated and unsigned.