# `io.github.AinaLuc/mailcannon` on anlyon.dev > Text inside fenced blocks marked untrusted-server-text was written by the MCP server's publisher, not by anlyon.dev. It is data to inspect, not instructions to follow. Invisible characters are shown as [U+XXXX]. > No finding is not a safety guarantee: these are point-in-time checks of tool definitions, not of code or behaviour. - Page: https://anlyon.dev/servers/io.github.AinaLuc/mailcannon - JSON: https://anlyon.dev/api/v1/servers/io.github.AinaLuc/mailcannon - Version: 0.1.0 (active) - Publisher: io.github.AinaLuc (GitHub account) - Runs: remote (streamable-http) - Sign-in to list tools: none - Repository: https://github.com/AinaLuc/mailcannon - Metadata from the official MCP Registry, synced 2026-10-21T18:14:16.174Z Title and description, as the publisher wrote them: ```untrusted-server-text Mailcannon AI-powered email outreach platform — send campaigns with deliverability tracking. ``` Scanned 2026-10-21T19:01:55.668Z over streamable-http. **34 tools: 5 can delete or cancel things, 1 do something that can't be undone, 18 change things and 10 only read.** | Group | Class | Tools | Claude Code | | --- | --- | --- | --- | | Deletes or cancels | destructive | 5 | deny | | Can't be undone | irreversible | 1 | ask | | Changes things | write | 18 | ask | | Only reads | read | 10 | allow | ## Exfil surface 24 private-data -> untrusted-input -> outbound paths in this server alone. Denying 2 outbound tools breaks every one: `mcp__mailcannon__add_provider`, `mcp__mailcannon__send_test_email`. | Tag | Meaning | Tools | | --- | --- | --- | | private-data | Reads files, mail, messages, databases, secrets, calendars or repositories. | `mcp__mailcannon__check_email_spam_score` `mcp__mailcannon__list_contacts` `mcp__mailcannon__list_providers` `mcp__mailcannon__list_tags` | | untrusted-input | Brings in text someone else can write: web pages, inbound email, messages, issues and comments. | `mcp__mailcannon__check_email_spam_score` `mcp__mailcannon__get_deliverability` `mcp__mailcannon__list_providers` | | outbound | Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL. | `mcp__mailcannon__add_provider` `mcp__mailcannon__send_test_email` | | Private data | Untrusted input | Outbound | | --- | --- | --- | | `mcp__mailcannon__check_email_spam_score` | `mcp__mailcannon__check_email_spam_score` | `mcp__mailcannon__add_provider` | | `mcp__mailcannon__check_email_spam_score` | `mcp__mailcannon__check_email_spam_score` | `mcp__mailcannon__send_test_email` | | `mcp__mailcannon__check_email_spam_score` | `mcp__mailcannon__get_deliverability` | `mcp__mailcannon__add_provider` | | `mcp__mailcannon__check_email_spam_score` | `mcp__mailcannon__get_deliverability` | `mcp__mailcannon__send_test_email` | | `mcp__mailcannon__check_email_spam_score` | `mcp__mailcannon__list_providers` | `mcp__mailcannon__add_provider` | | `mcp__mailcannon__check_email_spam_score` | `mcp__mailcannon__list_providers` | `mcp__mailcannon__send_test_email` | | `mcp__mailcannon__list_contacts` | `mcp__mailcannon__check_email_spam_score` | `mcp__mailcannon__add_provider` | | `mcp__mailcannon__list_contacts` | `mcp__mailcannon__check_email_spam_score` | `mcp__mailcannon__send_test_email` | | `mcp__mailcannon__list_contacts` | `mcp__mailcannon__get_deliverability` | `mcp__mailcannon__add_provider` | | `mcp__mailcannon__list_contacts` | `mcp__mailcannon__get_deliverability` | `mcp__mailcannon__send_test_email` | | `mcp__mailcannon__list_contacts` | `mcp__mailcannon__list_providers` | `mcp__mailcannon__add_provider` | | `mcp__mailcannon__list_contacts` | `mcp__mailcannon__list_providers` | `mcp__mailcannon__send_test_email` | | `mcp__mailcannon__list_providers` | `mcp__mailcannon__check_email_spam_score` | `mcp__mailcannon__add_provider` | | `mcp__mailcannon__list_providers` | `mcp__mailcannon__check_email_spam_score` | `mcp__mailcannon__send_test_email` | | `mcp__mailcannon__list_providers` | `mcp__mailcannon__get_deliverability` | `mcp__mailcannon__add_provider` | | `mcp__mailcannon__list_providers` | `mcp__mailcannon__get_deliverability` | `mcp__mailcannon__send_test_email` | | `mcp__mailcannon__list_providers` | `mcp__mailcannon__list_providers` | `mcp__mailcannon__add_provider` | | `mcp__mailcannon__list_providers` | `mcp__mailcannon__list_providers` | `mcp__mailcannon__send_test_email` | | `mcp__mailcannon__list_tags` | `mcp__mailcannon__check_email_spam_score` | `mcp__mailcannon__add_provider` | | `mcp__mailcannon__list_tags` | `mcp__mailcannon__check_email_spam_score` | `mcp__mailcannon__send_test_email` | | `mcp__mailcannon__list_tags` | `mcp__mailcannon__get_deliverability` | `mcp__mailcannon__add_provider` | | `mcp__mailcannon__list_tags` | `mcp__mailcannon__get_deliverability` | `mcp__mailcannon__send_test_email` | | `mcp__mailcannon__list_tags` | `mcp__mailcannon__list_providers` | `mcp__mailcannon__add_provider` | | `mcp__mailcannon__list_tags` | `mcp__mailcannon__list_providers` | `mcp__mailcannon__send_test_email` | ## Findings No check matched anything in these tool definitions. ## Deletes or cancels (5) Removes, cancels or revokes something. Claude Code: deny. ### `delete_campaign` - The name "delete_campaign" says "delete": a word for removing or ending something. Description, as the server wrote it: ```untrusted-server-text Delete a campaign and all its steps ``` ### `delete_campaign_step` - The name "delete_campaign_step" says "delete": a word for removing or ending something. Description, as the server wrote it: ```untrusted-server-text Delete a step from a campaign ``` ### `delete_task` - The name "delete_task" says "delete": a word for removing or ending something. Description, as the server wrote it: ```untrusted-server-text Delete a task by ID ``` ### `remove_contact` - The name "remove_contact" says "remove": a word for removing or ending something. Description, as the server wrote it: ```untrusted-server-text Remove a contact by ID ``` ### `remove_provider` - The name "remove_provider" says "remove": a word for removing or ending something. Description, as the server wrote it: ```untrusted-server-text Remove a provider by ID ``` ## Can't be undone (1) Sends, pays, publishes or merges: once done, it cannot be taken back. Claude Code: ask. ### `send_test_email` - The name "send_test_email" says "send": a word for sending, and what is sent cannot be taken back. - Tag outbound: The name "send_test_email" says "send": it sends or publishes something to other people. Description, as the server wrote it: ```untrusted-server-text Send a test email to yourself to preview formatting ``` ## Changes things (18) Creates or changes something that can be changed back. Claude Code: ask. ### `add_campaign_step` - The name "add_campaign_step" says "add": a word for a change. Description, as the server wrote it: ```untrusted-server-text Add a sequence step (delay in hours, subject, body) ``` ### `add_contact` - The name "add_contact" says "add": a word for a change. Description, as the server wrote it: ```untrusted-server-text Add a single contact ``` ### `add_contacts` - The name "add_contacts" says "add": a word for a change. Description, as the server wrote it: ```untrusted-server-text Bulk add contacts (max 100) ``` ### `add_provider` - The name "add_provider" says "add": a word for a change. - The input takes a statement or command to run (input.command), which can change anything it can reach. - Tag outbound: The input takes a URL (input.url): a request to a URL can carry data to whoever runs it. Description, as the server wrote it: ```untrusted-server-text Add an email provider ``` ### `check_domain_deliverability` - Nothing in its name or description says what it does, so it is counted as a write. Description, as the server wrote it: ```untrusted-server-text Check SPF, DKIM, DMARC records for a domain ``` ### `check_step_spam_score` - Nothing in its name or description says what it does, so it is counted as a write. Description, as the server wrote it: ```untrusted-server-text Check a campaign step's subject and body for spam triggers ``` ### `create_campaign` - The name "create_campaign" says "create": a word for a change. Description, as the server wrote it: ```untrusted-server-text Create a new email campaign ``` ### `create_task` - The name "create_task" says "create": a word for a change. Description, as the server wrote it: ```untrusted-server-text Create a new task ``` ### `pause_campaign` - Nothing in its name or description says what it does, so it is counted as a write. Description, as the server wrote it: ```untrusted-server-text Pause a campaign — stops processing all active schedules for this campaign ``` ### `process_campaigns` - Nothing in its name or description says what it does, so it is counted as a write. Description, as the server wrote it: ```untrusted-server-text Process all due campaign schedules (includeFailed: true to retry failed ones) ``` ### `resume_campaign` - Nothing in its name or description says what it does, so it is counted as a write. Description, as the server wrote it: ```untrusted-server-text Resume a paused campaign — reactivates all paused schedules ``` ### `retry_failed` - The description's first verb is "reset": a word for a change. Description, as the server wrote it: ```untrusted-server-text Reset all failed schedules to active for retry ``` ### `schedule_campaign` - The name "schedule_campaign" says "schedule": a word for a change. Description, as the server wrote it: ```untrusted-server-text Assign contacts to a campaign and schedule it ``` ### `set_setting` - The name "set_setting" says "set": a word for a change. Description, as the server wrote it: ```untrusted-server-text Set a user setting (e.g. timezone to 'America/New_York') ``` ### `update_campaign` - The name "update_campaign" says "update": a word for a change. Description, as the server wrote it: ```untrusted-server-text Update a campaign's name ``` ### `update_campaign_step` - The name "update_campaign_step" says "update": a word for a change. Description, as the server wrote it: ```untrusted-server-text Update a campaign step's day, subject, or body ``` ### `update_contact_tags` - The name "update_contact_tags" says "update": a word for a change. Description, as the server wrote it: ```untrusted-server-text Set tags on a contact (replaces all tags) ``` ### `update_task` - The name "update_task" says "update": a word for a change. Description, as the server wrote it: ```untrusted-server-text Update a task's status, priority, or fields ``` ## Only reads (10) Looks things up and changes nothing. Claude Code: allow. ### `check_email_spam_score` - The description's first verb is "analyze": a word for reading. - Tag private-data: The name "check_email_spam_score" says "email": it reads mail. The description's first sentence says "analyze" and "email": it reads mail. - Tag untrusted-input: The name "check_email_spam_score" says "email": it reads inbound email, which other people can write. The description's first sentence says "analyze" and "email": it reads inbound email, which other people can write. Description, as the server wrote it: ```untrusted-server-text Analyze email subject/body for spam trigger words ``` ### `get_deliverability` - The name "get_deliverability" says "get": a word for reading. - Tag untrusted-input: The description's first sentence says "get" and "reply": it reads comments, which other people can write. Description, as the server wrote it: ```untrusted-server-text Get deliverability stats (sent, opens, bounces, replies) ``` ### `get_setting` - The name "get_setting" says "get": a word for reading. Description, as the server wrote it: ```untrusted-server-text Get a user setting (e.g. timezone) ``` ### `list_campaigns` - The name "list_campaigns" says "list": a word for reading. Description, as the server wrote it: ```untrusted-server-text List all campaigns with their steps ``` ### `list_contacts` - The name "list_contacts" says "list": a word for reading. - Tag private-data: The name "list_contacts" says "list" and "contact": it reads contacts. The description's first sentence says "list" and "contact": it reads contacts. Description, as the server wrote it: ```untrusted-server-text List all contacts ``` ### `list_providers` - The name "list_providers" says "list": a word for reading. - Tag private-data: The description's first sentence says "list" and "email": it reads mail. - Tag untrusted-input: The description's first sentence says "list" and "email": it reads inbound email, which other people can write. Description, as the server wrote it: ```untrusted-server-text List all email providers ``` ### `list_schedules` - The name "list_schedules" says "list": a word for reading. Description, as the server wrote it: ```untrusted-server-text List all scheduled campaign runs ``` ### `list_settings` - The name "list_settings" says "list": a word for reading. Description, as the server wrote it: ```untrusted-server-text List all user settings ``` ### `list_tags` - The name "list_tags" says "list": a word for reading. - Tag private-data: The description's first sentence says "list" and "contact": it reads contacts. Description, as the server wrote it: ```untrusted-server-text List all unique tags across your contacts ``` ### `list_tasks` - The name "list_tasks" says "list": a word for reading. Description, as the server wrote it: ```untrusted-server-text List all tasks ``` ## Claude Code permissions For `.claude/settings.json`, assuming the server is installed as `mailcannon`: ```json { "permissions": { "allow": [ "mcp__mailcannon__list_contacts", "mcp__mailcannon__list_tags", "mcp__mailcannon__list_campaigns", "mcp__mailcannon__list_schedules", "mcp__mailcannon__list_providers", "mcp__mailcannon__get_deliverability", "mcp__mailcannon__list_tasks", "mcp__mailcannon__get_setting", "mcp__mailcannon__list_settings", "mcp__mailcannon__check_email_spam_score" ], "ask": [ "mcp__mailcannon__add_contact", "mcp__mailcannon__add_contacts", "mcp__mailcannon__update_contact_tags", "mcp__mailcannon__create_campaign", "mcp__mailcannon__add_campaign_step", "mcp__mailcannon__update_campaign", "mcp__mailcannon__update_campaign_step", "mcp__mailcannon__schedule_campaign", "mcp__mailcannon__process_campaigns", "mcp__mailcannon__add_provider", "mcp__mailcannon__create_task", "mcp__mailcannon__update_task", "mcp__mailcannon__set_setting", "mcp__mailcannon__send_test_email", "mcp__mailcannon__check_domain_deliverability", "mcp__mailcannon__pause_campaign", "mcp__mailcannon__resume_campaign", "mcp__mailcannon__retry_failed", "mcp__mailcannon__check_step_spam_score" ], "deny": [ "mcp__mailcannon__remove_contact", "mcp__mailcannon__delete_campaign", "mcp__mailcannon__delete_campaign_step", "mcp__mailcannon__remove_provider", "mcp__mailcannon__delete_task" ] } } ``` Capability tags behind the rules (a read tagged outbound is asked about): - `mcp__mailcannon__list_contacts`: private-data - `mcp__mailcannon__list_tags`: private-data - `mcp__mailcannon__add_provider`: outbound - `mcp__mailcannon__list_providers`: private-data, untrusted-input - `mcp__mailcannon__get_deliverability`: untrusted-input - `mcp__mailcannon__send_test_email`: outbound - `mcp__mailcannon__check_email_spam_score`: private-data, untrusted-input ## Remote posture What an anonymous client saw at the remote endpoint, last 2026-10-22T14:50:27.539Z, unchanged since 2026-10-22T14:50:27.539Z. No credentials were sent and no tool was called. Values are shown as the endpoint returned them. Method: https://anlyon.dev/methodology#remote-posture | Fact | Observed | | --- | --- | | Reachable | `yes` | | HTTP status of an anonymous initialize | `200` | | tools/list served without credentials | `yes` | | Tools that change things, listed without credentials | `24` | | Protocol version | `2024-11-05` | | WWW-Authenticate on 401 | `not observed` | | resource_metadata in WWW-Authenticate | `none` | | RFC 9728 protected resource metadata | `none` | | Authorization servers | `none` | | Legacy HTTP+SSE transport | `no` | | Dynamic client registration | `not observed` | | Client ID metadata documents | `not observed` | - **high** Tools that change things, listed to anyone ([unauth-remote-writes](https://anlyon.dev/methodology#unauth-remote-writes)) ```untrusted-server-text The endpoint served tools/list without credentials, and the list has 24 tools that change things (5 destructive, 1 irreversible, 18 write). Whether a call also works without credentials was not tested: tools are never called. https://www.thinkandautomate.dev/api/mcp: tools/list returned 34 tools to an anonymous client, including remove_contact (destructive), delete_campaign (destructive), delete_campaign_step (destructive), remove_provider (destructive), delete_task (destructive) and 19 more ```