---
title: "What is an email MCP server?"
description: "How Model Context Protocol exposes email sending as agent tools, what a well-designed email MCP surface looks like, and how authentication and scopes work."
url: https://www.unitpost.com/blog/email-mcp-server
section: Blog
updated: 2026-07-27
---
# What is an email MCP server?

An email MCP server exposes email operations as tools an AI agent can call through the Model Context Protocol. Instead of writing integration code, you point an MCP client like Cursor or Claude Code at the server URL with an API key, and the agent gets typed tools for sending mail, managing contacts, and running campaigns — with the same permissions the key carries.

## What is an email MCP server?

> How Model Context Protocol exposes email sending as agent tools, what a well-designed email MCP surface looks like, and how authentication and scopes work.

Model Context Protocol (MCP) is an open standard for giving AI agents access to external tools. The agent discovers what tools exist, what arguments they take, and calls them — without bespoke glue code per integration.

### Why this matters for email

Before MCP, letting an agent send email meant writing a wrapper: a function definition, argument validation, error handling, credential plumbing. Multiply that by every tool and every agent framework. MCP makes it configuration instead of code — one server URL and a key.

### What a good email MCP surface looks like

The design question is granularity. Too few tools and the agent has to construct complex payloads it will get wrong; too many and it can't decide which to use. Mapping one tool per API operation works well, because the API surface has already been designed for exactly that trade-off.

- emails_send — send one message; emails_send_batch for up to 100
- contacts_create / contacts_update — manage recipients
- segments_list / campaigns_send — one-to-many, through the campaign path
- domains_verify — check sending domain status

### How authentication works

The server authenticates with the same API key the REST API uses, passed as a Bearer token. That is deliberate: there is no second permission system to reason about. A tool call is subject to exactly the scopes its key carries, so an agent with a send-only key cannot delete a contact — the call fails the same way a raw HTTP request would.

```bash
# Claude Code, for example:
claude mcp add --transport http unitpost https://mcp.unitpost.com/mcp \
  --header "Authorization: Bearer pk_live_YOUR_KEY"
```

> **Production keys only:** The most common setup failure is pasting a development key against the production MCP host. Tool discovery can appear to work while every actual tool call returns 401 — which reads as a broken server rather than a wrong key.

### Transport: streamable HTTP vs stdio

Modern MCP clients speak streamable HTTP and connect to a URL directly. Some clients still only support stdio and need a local bridge process that forwards to the HTTP endpoint. That distinction is the usual reason a config that works in one client fails in another.

## FAQ

### Which MCP clients support email tools?

Any MCP-compatible client. In practice that means Cursor, Claude Code, Claude Desktop, OpenAI Codex CLI, GitHub Copilot in VS Code agent mode, Gemini CLI, and Windsurf, plus any agent you build against the protocol. The setup differs per client mainly in where the config file lives and whether it needs a stdio bridge.

### Is MCP secure enough for production email?

The protocol itself is transport plus tool discovery — the security properties come from the server. What matters is that tool calls are authenticated with a scoped, revocable credential and subject to the same gates as the REST API. If an MCP server grants broader access than the equivalent API key would, that is a problem with that server, not with MCP.

### Can an agent send email without me approving each send?

Yes, if you give it a key with send capability — that's the point of the integration. Whether you should depends on the use case. For one-to-one sends triggered by clear instructions, usually fine. For anything reaching many recipients, the one-to-many path deliberately requires an explicit send step rather than a single tool call.

## Related

- [How to fix an SPF record that isn't found](https://www.unitpost.com/blog/spf-record-not-found): Why an SPF lookup returns nothing even after you've added the record, and how to diagnose it: propagation, wrong host, quoting, and the one-SPF-record rule.
- [Why DKIM verification fails (and how to fix each cause)](https://www.unitpost.com/blog/dkim-verification-failing): The concrete reasons a DKIM check fails after you've published the key: selector mismatch, a truncated public key, DNS flattening, and message modification in transit.
- [Why your transactional email goes to spam](https://www.unitpost.com/blog/email-going-to-spam): A diagnostic order of operations for transactional mail landing in spam: authentication, reputation, content, and the engagement signals you can't see.