Outreach2day

by outreach2day.com · remote · no sign-in to list tools · v1.0.0 · published by com.outreach2day

Cold email infrastructure: domains, mailboxes, warm-up and campaigns. Never charges a card.

Deletes · 3Changes · 12

Compare Registry entry

24 tools: 3 can delete or cancel things, 12 change things and 9 only read.

Scanned Oct 21, 2026

Deletes or cancels3Claude Code: deny: see these tools
Can't be undone0Claude Code: ask
Changes things12Claude Code: ask: see these tools
Only reads9Claude Code: allow: see these tools

4 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http outreach2day https://public.outreach2day.com/mcp

Findings

Matches of fixed checks, with the text they matched.

1 warn3 info

Warncheck_copy
The server marks "check_copy" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
Matched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "check_copy" says "copy": a word for a change.
What this check looks for
Infolist_mailboxes
The description mentions "credentials".
Matched text
description: "...ss, sender name, status). Never returns credentials."
What this check looks for
Infoexport_mailboxes_to_sequencer
The description mentions "credentials".
Matched text
description: "Send mailboxes' login credentials (SMTP/IMAP) to the user's third-party s..."
What this check looks for
Infoexport_mailboxes_to_sequencer
The input schema at properties.confirm.description mentions "credentials".
Matched text
inputSchema.properties.confirm.description: "...rue, after the user agreed to share the credentials with this sequencer."
What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

24 tools

Deletes or cancels 3Removes, cancels or revokes something.Claude Code: deny

export_mailboxes_to_sequencerSend mailboxes' login credentials (SMTP/IMAP) to the user's third-party sequencer account (Instantly or Smartlead, from list_sequencers) so it can send from them.Reads text others writeCan send data out2 findings
Why it is in this group
- The description's first verb is "send": a word for sending, and what is sent cannot be taken back.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe description's first verb is "send": it sends or publishes something to other people.
Findings
- Info
  The description mentions "credentials".
  Matched text
  description: "Send mailboxes' login credentials (SMTP/IMAP) to the user's third-party s..."
  What this check looks for
- Info
  The input schema at properties.confirm.description mentions "credentials".
  Matched text
  inputSchema.properties.confirm.description: "...rue, after the user agreed to share the credentials with this sequencer."
  What this check looks for
Description, as the server wrote it
Send mailboxes' login credentials (SMTP/IMAP) to the user's third-party sequencer account (Instantly or Smartlead, from list_sequencers) so it can send from them. Omit mailboxes to export all eligible ones. Requires confirm=true after the user explicitly agrees. Large exports answer status pending and finish on the server; list_sequencers shows the counts.
Annotations the server declares
- title: Export mailboxes to a sequencer
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
launch_campaignStart sending a campaign to its contacts.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "start": a word for a change.
- The server marks it destructive (destructiveHint: true).
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Start sending a campaign to its contacts. Refused unless preflight is green and every attached mailbox is ready to send. Requires confirm=true after the user explicitly agrees.
Annotations the server declares
- title: Launch a campaign
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: true
- openWorldHint: true
upsert_campaign_stepAdd an email step to a campaign sequence, or update one (by step_id, or by order when a step with that order exists).No findings
Why it is in this group
- The name "upsert_campaign_step" says "upsert": a word for a change.
- The server marks it destructive (destructiveHint: true).
Description, as the server wrote it
Add an email step to a campaign sequence, or update one (by step_id, or by order when a step with that order exists). delay_days is the wait after this step before the next one.
Annotations the server declares
- title: Add or update a campaign step
- readOnlyHint: false
- destructiveHint: true
- idempotentHint: false
- openWorldHint: false

Changes things 12Creates or changes something that can be changed back.Claude Code: ask

attach_campaign_mailboxesAttach mailboxes to a campaign for sending.No findings
Why it is in this group
- The name "attach_campaign_mailboxes" says "attach": a word for a change.
Description, as the server wrote it
Attach mailboxes to a campaign for sending. Only mailboxes that are ready to send (warm-up started 14+ days ago) are accepted.
Annotations the server declares
- title: Attach mailboxes to a campaign
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
check_copyCheck an email subject and body for spam trigger words before sending.1 finding
Why it is in this group
- The name "check_copy" says "copy": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
  The server marks "check_copy" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
  Matched text
  annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "check_copy" says "copy": a word for a change.
  What this check looks for
Description, as the server wrote it
Check an email subject and body for spam trigger words before sending.
Annotations the server declares
- title: Check email copy for spam words
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
check_domainsCheck whether domain names are available to register (up to 50 domains per call).Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Check whether domain names are available to register (up to 50 domains per call).
Annotations the server declares
- title: Check domain availability
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
connect_own_domainsConnect domains the user already owns (free): returns the nameservers the user must set at their registrar.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Connect domains the user already owns (free): returns the nameservers the user must set at their registrar. Calling again with the same domains is safe.
Annotations the server declares
- title: Connect own domains
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
create_campaignCreate a campaign as a draft.No findings
Why it is in this group
- The name "create_campaign" says "create": a word for a change.
Description, as the server wrote it
Create a campaign as a draft. Nothing is sent until launch_campaign.
Annotations the server declares
- title: Create draft campaign
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
create_checkoutTurn a quote the user explicitly confirmed into a Stripe payment page.Reads text others writeNo findings
Why it is in this group
- The name "create_checkout" says "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Turn a quote the user explicitly confirmed into a Stripe payment page. Charges nothing: the user pays on the page. Requires confirm=true and the quote's due_now_cents.
Annotations the server declares
- title: Create a checkout link
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
import_campaign_contactsImport contacts into a campaign from CSV text (header row with an email column; other columns become variables; up to 10000 rows).No findings
Why it is in this group
- The name "import_campaign_contacts" says "import": a word for a change.
Description, as the server wrote it
Import contacts into a campaign from CSV text (header row with an email column; other columns become variables; up to 10000 rows). Pass import_id alone to check a previous import.
Annotations the server declares
- title: Import campaign contacts
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
pause_campaignStop a campaign from sending.No findings
Why it is in this group
- The description's first verb is "stop": a word for a change.
Description, as the server wrote it
Stop a campaign from sending. Safe to call again.
Annotations the server declares
- title: Pause a campaign
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
preflight_campaignCheck whether a campaign can launch: sequence, contacts, attached mailboxes and their warm-up.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Check whether a campaign can launch: sequence, contacts, attached mailboxes and their warm-up. Returns blocking checks with hints.
Annotations the server declares
- title: Preflight a campaign
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
quote_orderPrice new domains and mailboxes server-side.Reads text others writeCan send data outNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.registrant.phone): what the tool writes goes there.
Description, as the server wrote it
Price new domains and mailboxes server-side. Creates a 15-minute quote; registers and charges nothing. Show human_summary to the user exactly before create_checkout. Ordering domains needs registrant with every one of: first_name, last_name, real_address, city, state_province, postal_code, country, phone, organization_name, job_title (email_address optional); collect them from the user upfront.
Annotations the server declares
- title: Quote an order
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
start_warmupStart warm-up for mailboxes.Reads text others writeNo findings
Why it is in this group
- The name "start_warmup" says "start": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Start warm-up for mailboxes. Retrying with the same mailboxes the same day does not start a second operation.
Annotations the server declares
- title: Start warm-up
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true
suggest_domainsSuggest available sending domains that look like the company's website (brand + one fitting word, e.g.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Suggest available sending domains that look like the company's website (brand + one fitting word, e.g. acmehq.com, acme-partners.com), already checked for availability. Use this instead of inventing names.
Annotations the server declares
- title: Suggest sending domains
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: true

Only reads 9Looks things up and changes nothing.Claude Code: allow

get_account_statusWhat the workspace has (subscription, domains and mailboxes by state, warm-up, open orders, campaigns) and next_action: the one thing to do next.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "get_account_status" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "mailbox": it reads mail.
- untrusted-inputThe description's first sentence says "mailbox": it reads inbound email, which other people can write.
Description, as the server wrote it
What the workspace has (subscription, domains and mailboxes by state, warm-up, open orders, campaigns) and next_action: the one thing to do next. Start here.
Annotations the server declares
- title: Get account status
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_campaign_statsSending and engagement stats for one campaign (sent, replies, bounces).Reads text others writeNo findings
Why it is in this group
- The name "get_campaign_stats" says "get": a word for reading.
What it can reach
- untrusted-inputThe description's first sentence says "reply": it reads comments, which other people can write.
Description, as the server wrote it
Sending and engagement stats for one campaign (sent, replies, bounces).
Annotations the server declares
- title: Get campaign stats
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_orderStatus of an order (payment, per-domain and per-mailbox setup, warm-up estimate) by order_id; without order_id, lists the workspace's recent orders.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "get_order" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "status" and "mailbox": it reads mail.
- untrusted-inputThe description's first sentence says "status" and "mailbox": it reads inbound email, which other people can write.
Description, as the server wrote it
Status of an order (payment, per-domain and per-mailbox setup, warm-up estimate) by order_id; without order_id, lists the workspace's recent orders.
Annotations the server declares
- title: Get order status
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_pricingCurrent prices: mailbox monthly price and minimum, domain prices by TLD, card processing fee rule, worked examples.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "get_pricing" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "mailbox": it reads mail.
- untrusted-inputThe description's first sentence says "mailbox": it reads inbound email, which other people can write.
Description, as the server wrote it
Current prices: mailbox monthly price and minimum, domain prices by TLD, card processing fee rule, worked examples.
Annotations the server declares
- title: Get prices
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
get_warmup_statusWarm-up progress per mailbox (state, days warming, ready flag, ready date, inbox rate) and a workspace summary.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "get_warmup_status" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "mailbox": it reads mail.
- private-dataThe input names a mailbox (input.mailboxes), and the tool reads: it reads mail.
- untrusted-inputThe description's first sentence says "mailbox": it reads inbound email, which other people can write.
Description, as the server wrote it
Warm-up progress per mailbox (state, days warming, ready flag, ready date, inbox rate) and a workspace summary. Mailboxes can send campaigns once ready.
Annotations the server declares
- title: Get warm-up status
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_domainsList the workspace's sending domains with status, mailbox count and, for connected domains, DNS status and nameservers.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "list_domains" says "list": a word for reading.
What it can reach
- private-dataThe description's first sentence says "list" and "mailbox": it reads mail.
- untrusted-inputThe description's first sentence says "list" and "mailbox": it reads inbound email, which other people can write.
Description, as the server wrote it
List the workspace's sending domains with status, mailbox count and, for connected domains, DNS status and nameservers.
Annotations the server declares
- title: List domains
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_mailboxesList the workspace's mailboxes (address, sender name, status).Reads private dataReads text others write1 finding
Why it is in this group
- The name "list_mailboxes" says "list": a word for reading.
What it can reach
- private-dataThe name "list_mailboxes" says "list" and "mailbox": it reads mail.
- private-dataThe description's first sentence says "list" and "mailbox": it reads mail.
- untrusted-inputThe name "list_mailboxes" says "list" and "mailbox": it reads inbound email, which other people can write.
- untrusted-inputThe description's first sentence says "list" and "mailbox": it reads inbound email, which other people can write.
Findings
- Info
  The description mentions "credentials".
  Matched text
  description: "...ss, sender name, status). Never returns credentials."
  What this check looks for
Description, as the server wrote it
List the workspace's mailboxes (address, sender name, status). Never returns credentials.
Annotations the server declares
- title: List mailboxes
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_repliesList recent threads where a contact replied (subject, sender, short snippet, reply intent).Reads private dataReads text others writeNo findings
Why it is in this group
- The name "list_replies" says "list": a word for reading.
What it can reach
- private-dataThe description's first sentence says "list" and "thread": it reads messages.
- untrusted-inputThe name "list_replies" says "list" and "reply": it reads comments, which other people can write.
- untrusted-inputThe description's first sentence says "list" and "thread": it reads messages, which other people can write.
Description, as the server wrote it
List recent threads where a contact replied (subject, sender, short snippet, reply intent). Paginate with cursor.
Annotations the server declares
- title: List replies
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_sequencersList the workspace's connected sequencer accounts (Instantly, Smartlead) that mailboxes can be exported to.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "list_sequencers" says "list": a word for reading.
What it can reach
- private-dataThe description's first sentence says "list" and "mailbox": it reads mail.
- untrusted-inputThe description's first sentence says "list" and "mailbox": it reads inbound email, which other people can write.
Description, as the server wrote it
List the workspace's connected sequencer accounts (Instantly, Smartlead) that mailboxes can be exported to.
Annotations the server declares
- title: List sequencer connections
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

256 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 2 outbound tools breaks every one.

Reads private data8: Reads files, mail, messages, databases, secrets, calendars or repositories.; get_account_status
get_order
get_pricing
get_warmup_status
list_domains
list_mailboxes
list_replies
list_sequencers
Reads text others write16: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; check_domains
create_checkout
export_mailboxes_to_sequencer
get_account_status
get_campaign_stats
get_order
get_pricing
get_warmup_status
launch_campaign
list_domains
list_mailboxes
list_replies
and 4 more
Can send data out2: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; export_mailboxes_to_sequencer
quote_order

deny to break every path

{
  "permissions": {
    "deny": [
      "mcp__outreach2day__export_mailboxes_to_sequencer",
      "mcp__outreach2day__quote_order"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Looked at Oct 22, 2026, 14:37 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable: yes
HTTP status of an anonymous initialize: 200
tools/list served without credentials: yes
Tools that change things, listed without credentials: 15
Protocol version: 2025-06-18
WWW-Authenticate on 401: not observed
resource_metadata in WWW-Authenticate: none
RFC 9728 protected resource metadata: https://public.outreach2day.com/.well-known/oauth-protected-resource/mcp
Authorization servers: https://public.outreach2day.com
Legacy HTTP+SSE transport: no
Dynamic client registration: yes
Client ID metadata documents: yes

HighThe whole server
The endpoint served tools/list without credentials, and the list has 15 tools that change things (3 destructive, 12 write). Whether a call also works without credentials was not tested: tools are never called.
Matched text
https://public.outreach2day.com/mcp: tools/list returned 24 tools to an anonymous client, including upsert_campaign_step (destructive), launch_campaign (destructive), export_mailboxes_to_sequencer (destructive), check_domains (write), suggest_domains (write) and 10 more
What this check looks for

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http outreach2day https://public.outreach2day.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__outreach2day__list_domains",
      "mcp__outreach2day__list_mailboxes",
      "mcp__outreach2day__get_warmup_status",
      "mcp__outreach2day__list_sequencers",
      "mcp__outreach2day__get_campaign_stats",
      "mcp__outreach2day__list_replies",
      "mcp__outreach2day__get_pricing",
      "mcp__outreach2day__get_account_status",
      "mcp__outreach2day__get_order"
    ],
    "ask": [
      "mcp__outreach2day__check_domains",
      "mcp__outreach2day__suggest_domains",
      "mcp__outreach2day__check_copy",
      "mcp__outreach2day__preflight_campaign",
      "mcp__outreach2day__connect_own_domains",
      "mcp__outreach2day__start_warmup",
      "mcp__outreach2day__create_campaign",
      "mcp__outreach2day__import_campaign_contacts",
      "mcp__outreach2day__attach_campaign_mailboxes",
      "mcp__outreach2day__pause_campaign",
      "mcp__outreach2day__quote_order",
      "mcp__outreach2day__create_checkout"
    ],
    "deny": [
      "mcp__outreach2day__upsert_campaign_step",
      "mcp__outreach2day__launch_campaign",
      "mcp__outreach2day__export_mailboxes_to_sequencer"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as outreach2day. Review it before you use it.

Capability tags behind 16 rules

mcp__outreach2day__check_domains untrusted-input
mcp__outreach2day__suggest_domains untrusted-input
mcp__outreach2day__list_domains private-data, untrusted-input
mcp__outreach2day__list_mailboxes private-data, untrusted-input
mcp__outreach2day__get_warmup_status private-data, untrusted-input
mcp__outreach2day__list_sequencers private-data, untrusted-input
mcp__outreach2day__get_campaign_stats untrusted-input
mcp__outreach2day__list_replies private-data, untrusted-input
mcp__outreach2day__start_warmup untrusted-input
mcp__outreach2day__launch_campaign untrusted-input
mcp__outreach2day__export_mailboxes_to_sequencer untrusted-input, outbound
mcp__outreach2day__get_pricing private-data, untrusted-input
mcp__outreach2day__get_account_status private-data, untrusted-input
mcp__outreach2day__quote_order untrusted-input, outbound
mcp__outreach2day__create_checkout untrusted-input
mcp__outreach2day__get_order private-data, untrusted-input

Keep track

Get told when this server's tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.outreach2day/mcp/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Anlyon alternative

15 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Compare with other servers for the same product.

Source: MCP Registry. Synced Oct 21, 2026, 18:00 UTC.

For agents: Markdown · JSON · report this listing