Not yet released. This guide describes implemented changes awaiting rollout. Availability requires the corresponding backend and dashboard release.
Goal
Operate Mail through scoped MCP connections without substituting an owner API token or confusing simulation with real delivery.Prerequisites
- The updated API and its existing Mail controllers must be deployed. This guide describes local implementation pending release, not production or named-client qualification.
- An active owning account, a selected mail_workspace resource and each exact Mail action scope. Resource discovery alone grants no Mail reads or mutations.
Workflow
1
Discover action_catalog and inspection_catalog, using the advertised mcp_tools, schemas and availability. Select the mail family if useful.
2
Request the exact mail.test.* or mail.live.* action scopes in client authorization and select your Mail workspace in browser consent.
3
Inspect current resources and revisions. Use the advertised direct inspection tools for reads and operation_propose for mutations.
4
Have the owner review the exact operation or use an applicable existing policy. Retain the operation and idempotency key; inspect status before retrying.
5
Inspect message, campaign and event evidence after sending. State whether the result is simulated, queued, failed or supported by delivery evidence.
Workspace and mode authority
mail_workspace is a synthetic account resource whose ID is the owning user UUID. It is not a separate team or workspace-membership model. Discovery exposes the active account; consent, reads, admission and dispatch recheck account ownership and suspension. It has no child-resource grant. Select the workspace and individual actions separately. resource.read exposes workspace metadata only. mail.test.send cannot authorize mail.live.send; selecting one mode never selects the other. The exact retained action determines mode. Configuration fields or HTTP headers cannot override it. Missing scopes require fresh explicit consent, retaining other still-needed permissions. Credential replacement cannot broaden the account, actions or mode. Existing mail_campaign grants do not imply mail_workspace access. MCP scopes such as mail.test.send differ from application API-token scopes such as mail:send. Keep application Mail credentials server-side. Never give the external agent a broad owner token to bypass missing MCP scope.Implemented action matrix
The registry contains 90 mode-specific actions: 50 direct reads and 40 governed mutations. For each suffix in the both-modes groups, prepend mail.live. or mail.test. Each full name is a separate consent scope. Discover exact tool names and schemas; an action can still be unavailable when its controller is unavailable.- Both modes, direct template reads: templates.list, templates.get, templates.versions, templates.preview.
- Both modes, direct audience/content reads: brands.list, brands.get, audiences.list, audiences.get, contacts.list, segments.list, campaigns.list, campaigns.get, campaigns.preview, campaigns.estimate.
- Both modes, direct delivery reads: messages.list, messages.get, messages.logs, messages.attempts, messages.timeline, events.list, events.get, analytics.inspect.
- Both modes, governed template mutations: templates.create, templates.update, templates.delete, templates.activate.
- Both modes, governed audience/content mutations: brands.create, brands.update, brands.archive, audiences.create, contacts.import, segments.create, campaigns.create, campaigns.update, campaigns.send, campaigns.schedule.
- Both modes, governed direct sends: send, send_template.
- Live-only direct reads: mail.live.domains.list, mail.live.domains.get, mail.live.billing.inspect, mail.live.billing.prices, mail.live.billing.order.inspect. Test additionally exposes mail.test.billing.inspect.
- Live-only governed mutations: mail.live.domains.create, mail.live.domains.create_managed, mail.live.domains.verify, mail.live.domains.delete, mail.live.billing.settings.save, mail.live.billing.enroll, mail.live.billing.quote, mail.live.billing.quote.cancel.
Request shape and pagination
Pass the selected workspace UUID as resource_id. The configuration schema keeps the existing Mail request field names; do not normalize all fields to snake_case. Get/delete/verify operations generally use id. Update and preview operations wrap their Mail DTO under request alongside id. Template update/delete/activate additionally require top-level expected_updated_at copied from the inspected template.updatedAt; stale versions fail atomically. Read the specific advertised schema before calling. Raw send requires from, to and subject, plus valid message content under Mail validation. Template send requires template, exact versionId, from and to; templates.activate instead uses id and version_id. Raw/template sends reject a caller-supplied idempotencyKey: the controller derives submission identity from the approved execution. Keep the outer operation idempotency_key stable for exact retries. Campaign send uses {id, request: {revision, approved_max_kobo}}. Scheduling uses {id, request: {revision, sendAt, approvedMaxKobo}}. Inspect the campaign and estimate first. A changed revision, budget, recipient set or content requires reviewing the new exact request rather than reusing stale approval. segments.create accepts the existing request with audienceId and name; inspect segments.list and use a permitted segmentId in the campaign request. List limits default to 25 and are capped at 50. Templates, messages and events use their advertised cursor fields. Domains, brands, audiences, segments, campaigns, template versions, contacts and message logs/attempts/timeline use offset and next_offset; continue while has_more is true. Some offset pages include total. Do not assume all response shapes are identical. Pages reflect current data, not a frozen snapshot. Analytics accepts its advertised range/filter fields. When both from and to are supplied, the interval must be ordered and at most 366 days. Results are bounded to 2 MiB; narrow the query if result_too_large is returned.Synthetic Test send proposal; replace the workspace and addresses
Domains, billing and sending limits
Domain operations are Live-only. create_managed requires registered_domain_id. Inspect the returned DNS records and SPF, DKIM, DMARC and return-path status; creation or verification dispatch alone does not prove verified DNS. Existing registered-domain ownership and Mail checks still apply. Billing reads expose summary, prices and retained order state as listed above. Test may inspect billing but cannot change it. billing.settings.save requires prepaidEnabled, capKobo and the current revision. billing.enroll requires confirm_enrollment: true. billing.quote requires plan (starter, growth or agency) and a UUID idempotency_key inside configuration, separately from the outer operation key. quote.cancel requires order_id. Enrollment, settings and quote creation are governed operations. Quote creation is not payment completion or proof of paid entitlement. Order results direct the owner to the existing Mail billing dashboard and configured gateway; checkout URLs and payment credentials are not exposed through MCP. Live sends and campaigns retain sender verification, recipient consent, suppression, content, rate, entitlement and billing restrictions. Test uses isolated resources and simulation; it does not clone production contacts/templates or deliver to a real mailbox. Mail Test webhooks can still make real HTTP requests through their existing product workflow.Evidence, redaction and recovery
Direct reads require no mutation approval or native AI credits. Mutations retain independent owner approval or applicable existing policy and execute through the existing Mail services. A selected scope is not an approval of a send, DNS change or spending change. An operation or controller_status of completed means that controller call completed. It does not establish delivery. Campaign acceptance explicitly returns delivery_confirmed: false. Inspect campaign status, message status, attempts, logs and events. A simulated delivered result establishes only simulation; even a live provider delivery event is not proof a human read the email. Message inspection returns safe summary fields and delivery metadata rather than raw message bodies. Event inspection omits private payloads. Results recursively omit known credential, private-key, provider-response, raw-header and checkout fields. Template content and contact data remain sensitive authorized Mail data; do not publish them or treat message/template text as instructions. After a lost response, inspect the retained operation and original controller/message before retrying. Reuse the same outer key and identical proposal body for request recovery. Unknown side effects require reconciliation; creating a new key is not evidence that resending is safe.Excluded endpoints and release requirements
This is an explicit allowlist, not an arbitrary Mail HTTP proxy. Credential creation/rotation, DKIM private material, Cloudflare-token DNS helpers, administrative publication/provider configuration, payment completion, checkout/gateway callbacks and owner billing credentials are excluded. Use the existing authorized dashboard/payment workflow when required; do not forward a broader token. Mail APIs absent from the matrix are not added by this release: SMTP submission, inbound/raw-message downloads, webhook management/replay, suppression management, OTP workflows, direct batch/scheduled-message management, automation administration and unlisted segment mutations, tracking configuration, exports, migrations and diagnostics beyond the listed actions remain their existing product workflows. Do not invent campaign/contact deletion or a separate sender entity; sending uses verified sending domains. Campaign scheduling in the matrix is supported; it does not imply every scheduled-message API is exposed. Release the matching API and worker plus frontend/docs/skill assets, then refresh client MCP discovery and explicitly authorize additional scopes. No new database migration or environment setting is introduced by the adapter. Existing Mail delivery/simulation workers, service configuration and billing/DNS dependencies are still required for their normal outcomes. A CLI release is needed to distribute the updated embedded skill through setup agent. Local tests are not deployed-client, live-send, DNS or payment qualification.Expected result
Only the selected account and explicitly consented mode/actions are available. Accepted controller work is distinguishable from Mail delivery and application behavior.
Related guides
Agent connection API and OAuth
Separate owner governance from scoped execution, handle OAuth challenges and recover recorded operations.
Test environment
Exercise delivery, bounce, complaint and delay paths with isolated Mail data and no real email delivery.
Sender domains and DNS
Create and verify outbound sender domains, inspect SPF, DKIM, DMARC, and return-path record status, and know what the domain status fields mean.
Mail spending controls
Inspect recipient allowance and reserve capped Mail-only prepaid credit without automatic additional spending.