Integrations

Verified against this repository on 2026-07-30. Only vendors/services actually present in code or .env.example are listed. Variable names only — never values.

In this section

File	Purpose
This file	Overview of every wired service, plus what is verified absent
mcp-server.md	The MCP endpoint, request_dev_consultation, OpenAPI mirror, and playbook claims not yet implemented
lead-capture.md	Validation contract, CRM_WEBHOOK_URL delivery, WhatsApp caveat, known gaps

The GEO/structured-data artifacts these surfaces advertise are catalogued in ../architecture/geo-stack.md.

Lead capture (core capability)

Validation and delivery are shared in lib/leads.ts; three surfaces feed into it.

Surface	Path	Notes
MCP (Streamable HTTP)	/api/mcp/sse (canonical agent URL), /api/mcp/mcp	@modelcontextprotocol/sdk ^1.29.0, stateless mode (no Redis). Clients POST JSON-RPC initialize.
REST / OpenAPI	POST /api/leads/submit	Mirrors the MCP tool. CORS * with POST, OPTIONS. Node runtime. Spec at /docs/openapi.json (alias /api/openapi.json), both CORS *.
On-site contact form	POST /api/contact	Different payload (name, email, platforms[], budget, scope) validated against lib/content.ts allow-lists. Not the consultation-lead schema.

MCP tool: request_dev_consultation — captures a development consultation lead. Inputs: client_name, client_email_or_phone, project_type, budget_range_usd, optional requirements_notes.

Accepted project_type values: flutter_mobile_app, web_application, geo_ai_integration.

Endpoint internals: mcp-server.md. Validation and delivery: lead-capture.md.

CRM webhook (Google Apps Script → Google Sheets)

Item	Detail
Env var	CRM_WEBHOOK_URL
Receives	Validated lead JSON (lead_id, contact fields, project type, budget, notes)
Recommended target	Google Apps Script Web App appending rows to a Google Sheet
Setup docs	scripts/google-apps-script/SETUP.md
Script source	scripts/google-apps-script/Code.gs
Deploy settings	Web app, Execute as: Me, Who has access: Anyone
Sheet columns	Includes human-readable date / time in Asia/Dubai timezone
When unset	Leads are validated and logged server-side, so local dev works without a webhook

No npm package or Google Cloud project is required for this path.

The deployed Web App URL is a secret — keep it in .env.local / host env only, never in this knowledge base.

Email delivery (placeholder only)

.env.example reserves these for future contact-form email:

• RESEND_API_KEY
• CONTACT_TO_EMAIL

No email package (Resend or otherwise) is in package.json at inspection time, so this is not wired yet.

GEO / structured data

Asset	Purpose
components/GeoSchema.tsx	Schema.org JSON-LD — ProfessionalService, SoftwareApplication, UAE/Dubai location and compliance signals, pricing offers
components/json-ld.tsx	Small JSON-LD script helper
public/llms.txt	High-density facts for LLM search crawlers
public/.well-known/llms.txt	Same, at the well-known path
lib/openapi-spec.ts + app/docs/openapi.json/route.ts	Machine-readable lead API for agent platforms (CORS *; alias /api/openapi.json)

Full inventory of the GEO layer, including what each llms.txt section is doing: ../architecture/geo-stack.md.

Theming

next-themes ^0.4.6 via components/theme-provider.tsx and components/theme-toggle.tsx (dark / light).

Not integrated (verified absent)

Category	Status
Auth	None
Database / ORM	None
Payments	None
Analytics SDK	None in package.json
Redis / MCP session store	Intentionally unused (stateless MCP)
CI provider	No .github/workflows

Update this file whenever a dependency or external service is added or removed.

Production security

Public MCP/OpenAPI lead surfaces are intentionally discoverable for GEO, but several production blockers remain (unauthenticated Apps Script webhook, spoofable client_id routing, unrate-limited MCP, PII in logs). Full findings: ../operations/production-security-audit.md.