Email MCP server

An email MCP server that can send, read the reply, and wait for a human.

SendRaven’s MCP server gives an AI agent the whole email API: sending, inbound threads, campaigns, automations, contacts and approvals, as 55 tools in Claude Code, Cursor, Codex, ChatGPT and any other MCP client.

It runs remotely and holds no database or provider credentials of its own, so it reaches exactly what your key can reach and nothing more.

Get a key

Claude Codeterminal

claude mcp add --transport http sendraven https://mcp.sendraven.ai/mcp

Then, in a session

> What replies are waiting on me?

Using list_threads(awaiting_reply=true) …
Two threads. Maya at Acme asked for the
August invoice as a PDF, 40 minutes ago.

Install

Any client that speaks Streamable HTTP.

Claude Code

claude mcp add --transport http sendraven https://mcp.sendraven.ai/mcp

The first call opens a browser to sign in and pick a workspace. Nothing else to configure.

Cursor, Claude Desktop, and other clients with a JSON config

{
  "mcpServers": {
    "sendraven": {
      "url": "https://mcp.sendraven.ai/mcp"
    }
  }
}

Clients that support OAuth will prompt you to authorize on first use.

As a local process, from npm

claude mcp add sendraven -e SENDRAVEN_API_KEY=sk_live_… -- npx -y @sendraven/mcp

The same server, published as @sendraven/mcp. It speaks stdio when no port is set and takes the key from SENDRAVEN_API_KEY. Source and issues at github.com/CommonNinja/sendraven-mcp-server.

Remote server with a key instead of OAuth, for an agent running unattended

{
  "mcpServers": {
    "sendraven": {
      "url": "https://mcp.sendraven.ai/mcp",
      "headers": { "Authorization": "Bearer sk_live_…" }
    }
  }
}

Create the key in the dashboard under Developers. Give an agent’s key a daily limit, an allowlist, or an approval hold; the tools respect all three. Limits for agents.

The tools

Everything the API does, named for what an agent is trying to do.

Descriptions say which tool to reach for and what it costs to get wrong. A failed call returns the API’s own message, so “domain not verified” comes back as those words rather than a bare 403.

Send and read

send_email
send_template_email
reply_to_message
list_emails
get_email
list_scheduled_emails
cancel_scheduled_email

Threads

list_threads
get_thread
mark_thread_handled

Approvals

list_pending_approvals
decide_approval

Sending domains

list_sending_domains
add_sending_domain
verify_sending_domain

Suppressions

list_suppressions
add_suppression
remove_suppression
suppress_many

Templates

list_templates
render_template

Campaigns

list_broadcasts
create_broadcast
get_broadcast
preview_broadcast
send_broadcast
pick_broadcast_winner
resume_broadcast
list_broadcast_recipients

Automations

list_automations
get_automation
list_automation_enrollments
create_automation
update_automation
set_automation_status
enroll_in_automation
emit_event

Topics

list_topics
get_email_preferences
set_email_preferences

Contacts and audiences

list_audiences
add_contact
import_contacts
get_contact
find_contact
update_contact
delete_contact
remove_from_audience
tag_contact
list_tags
list_segments
count_segment

Operations

get_email_metrics
list_webhook_deliveries
get_usage

Why the key matters more than the protocol

MCP is not the differentiator. What the agent may do through it is.

Plenty of email tools have an MCP server now. The question is what happens when an agent calls send_email at three in the morning.

On SendRaven the answer lives on the key it connected with: a daily send limit, a recipient allowlist, and an approval hold that turns every send into a draft for a person.

The tools cannot change those limits, because a key may not edit itself and key management has no MCP tool at all.

See every limit an agent’s key can carry, or how an agent uses email end to end.

Behaviour worth knowing

Three things the server does that a wrapper would not.

A held send is not a failure.

When a key requires approval, send_email returns pending_approval with an id. The right move is to report that it awaits a person, not to retry.

Out of plan is 402, not 429.

get_usage reports plan, usage and remaining so an agent can say “you are near your limit” before a batch rather than surfacing a payment error afterwards.

Two calls cannot be undone.

send_broadcast mails an audience; run preview_broadcast first. remove_suppression lets us mail an address that bounced or complained. Neither should be used to fix a failed send.

Questions

What is the SendRaven MCP server?

It is a Model Context Protocol server that exposes SendRaven's email API to AI agents as 55 tools: sending, reading reply threads, approvals, campaigns, automations, contacts, topics and usage. It is served remotely at https://mcp.sendraven.ai/mcp and published on npm as @sendraven/mcp.

Which MCP clients does it work with?

Any client that speaks Streamable HTTP or stdio, including Claude Code, Claude, Cursor, Codex, ChatGPT, Gemini CLI, VS Code and Windsurf. Clients that support OAuth sign in through the browser; others pass an API key as a Bearer header.

Can an AI agent read email replies over MCP?

Yes. list_threads with awaiting_reply returns the conversations waiting on an answer, get_thread returns the exchange with quoted history stripped, and reply_to_message replies inside the same thread.

Can I stop an agent from sending email through MCP without approval?

Yes. Connect the agent with an API key that has requires_approval, and send_email returns pending_approval instead of sending. A person releases the draft from the dashboard or the API; the key cannot approve its own drafts.