Espone API JSON e MCP HTTP per far lavorare gli agenti sul CRM.

Gli agenti autenticati con token Bearer possono leggere today/pipeline e annotare attività, con host MCP allineati a quelli di produzione.

Co-authored-by: Cursor <cursoragent@cursor.com>

config/initializers/filter_parameter_logging.rb

@@ -4,5 +4,6 @@
 # Use this to limit dissemination of sensitive information.
 # See the ActiveSupport::ParameterFilter documentation for supported notations and behaviors.
 Rails.application.config.filter_parameters += [
-  :passw, :email, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, :ssn, :cvv, :cvc
+  :passw, :email, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, :ssn, :cvv, :cvc,
+  :authorization, :plaintext
 ]

config/locales/it.yml

@@ -35,6 +35,7 @@ it:
       mail_template: Template email
       mailing: Invio email
       mailing_recipient: Destinatario
+      api_token: Token API
     attributes:
       organization:
         name: Nome

config/routes.rb

@@ -22,6 +22,24 @@ Rails.application.routes.draw do
   resources :projects, only: %i[create edit update destroy]
   resources :users, except: %i[show]
   resources :mail_identities, except: %i[show]
+  resources :api_tokens, only: %i[index create destroy]
+  match "/mcp", to: "mcp#handle", via: %i[get post delete]
+
+  namespace :api do
+    namespace :v1 do
+      get "projects", to: "projects#index"
+
+      scope "/p/:project_code" do
+        get "today", to: "today#show"
+        get "search", to: "search#show"
+        get "organizations/:id", to: "organizations#show", as: :organization
+        post "tasks", to: "tasks#create"
+        post "tasks/:id/complete", to: "tasks#complete", as: :complete_task
+        post "activities", to: "activities#create"
+        patch "opportunities/:id/stage", to: "opportunities#update_stage", as: :opportunity_stage
+      end
+    end
+  end
 
   # Ogni progetto = istanza CRM dedicata
   scope "/p/:project_code" do