---
title: "What is an email MCP server?"
description: "How Model Context Protocol exposes email sending as agent tools, what a well-designed email MCP surface looks like, and how authentication and scopes work."
url: https://www.unitpost.com/blog/agents/email-mcp-server
section: Blog
updated: 2026-08-28
---
# What is an email MCP server?

An email MCP server exposes email operations as tools an AI agent can call through the Model Context Protocol. Instead of writing integration code, you point an MCP client like Cursor or Claude Code at the server URL with an API key, and the agent gets typed tools for sending mail, managing contacts, and running campaigns — with the same permissions the key carries.

## What is an email MCP server?

> How Model Context Protocol exposes email sending as agent tools, what a well-designed email MCP surface looks like, and how authentication and scopes work.

Model Context Protocol (MCP) is an open standard for giving AI agents access to external tools. The agent discovers what tools exist, what arguments they take, and calls them.

For email that means a URL plus an API key instead of a wrapper per framework. Cursor, Claude Code, and the rest speak the same tools.

### What the tools are

One tool per API operation — the same trade-off as the REST surface:

- email_send — send one message; email_send_batch for up to 100
- contacts_create / contacts_update — manage recipients
- segments_list / email_campaigns_send — one-to-many, through the campaign path
- email_domains_verify — check sending domain status

### How authentication works

The server authenticates with the same API key the REST API uses, passed as a Bearer token. That is deliberate: there is no second permission system to reason about. A tool call is subject to exactly the scopes its key carries, so an agent with a send-only key cannot delete a contact — the call fails the same way a raw HTTP request would.

```bash
# Claude Code, for example:
claude mcp add --transport http unitpost https://mcp.unitpost.com/mcp \
  --header "Authorization: Bearer pk_live_YOUR_KEY"
```

> **Production keys only:** The most common setup failure is pasting a development key against the production MCP host. Tool discovery can appear to work while every actual tool call returns 401 — which reads as a broken server rather than a wrong key.

### Transport: streamable HTTP vs stdio

Modern MCP clients speak streamable HTTP and connect to a URL directly. Some clients still only support stdio and need a local bridge process that forwards to the HTTP endpoint. That distinction is the usual reason a config that works in one client fails in another.

## FAQ

### Which MCP clients support email tools?

Any MCP-compatible client. In practice that means Cursor, Claude Code, Claude Desktop, OpenAI Codex CLI, GitHub Copilot in VS Code agent mode, Gemini CLI, and Windsurf, plus any agent you build against the protocol. The setup differs per client mainly in where the config file lives and whether it needs a stdio bridge.

### Is MCP secure enough for production email?

The protocol itself is transport plus tool discovery — the security properties come from the server. What matters is that tool calls are authenticated with a scoped, revocable credential and subject to the same gates as the REST API. If an MCP server grants broader access than the equivalent API key would, that is a problem with that server, not with MCP.

### Can an agent send email without me approving each send?

Yes, if you give it a key with send capability — that's the point of the integration. Whether you should depends on the use case. For one-to-one sends triggered by clear instructions, usually fine. For anything reaching many recipients, the one-to-many path deliberately requires an explicit send step rather than a single tool call.

## Related

- [How email webhooks work (they're POST)](https://www.unitpost.com/blog/concepts/how-email-webhooks-work): An email webhook is an HTTP POST to your URL when a message is delivered, bounced, opened, or clicked — not polling, not IMAP.
- [Move off SendGrid SMTP after the free plan ended](https://www.unitpost.com/blog/concepts/move-off-sendgrid-smtp): SendGrid retired its free plan. Point the same SMTP client at Unitpost — host, username unitpost, API key as password — without rewriting your app.
- [How to let an AI agent send email safely](https://www.unitpost.com/blog/agents/send-email-from-ai-agent): The concrete controls that make agent-initiated email safe: scoped credentials, a verified-domain gate, idempotency, approval before send, and an audit trail.