Skip to content

MisarMail MCP Server

by Misar-AI · remote · local (npm) · no sign-in to list tools · v5.1.2 · published by GitHub user Misar-AI

Send transactional email, run campaigns, manage contacts and automations, audit deliverability.

Deletes · 6Final · 2Changes · 18
CompareRegistry entry

55 tools: 6 can delete or cancel things, 2 do something that can't be undone, 18 change things and 29 only read.

Scanned Oct 21, 2026

5 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http misarmail https://api.misar.io/mail/mcp --header 'Authorization: <your-authorization>'

Findings

Matches of fixed checks, with the text they matched.

4 warn1 info
  • Warnget_email

    The server marks "get_email" as not read-only (readOnlyHint: false), and its words say it reads.

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "get_email" says "get": a word for reading.

    What this check looks for
  • Warnarchive_email

    The server marks "archive_email" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "archive_email" says "archive": a word for removing or ending something.

    What this check looks for
  • Warngenerate_report

    The server marks "generate_report" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "generate_report" says "generate": a word for a change.

    What this check looks for
  • Warnrun_deliverability_audit

    The server marks "run_deliverability_audit" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "run_deliverability_audit" says "run": a word for a change.

    What this check looks for
  • Infotoggle_integration

    The description mentions "credentials".

    Matched text

    description: "...ps all syncing but preserves the stored credentials."

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

55 tools

Deletes or cancels 6Claude Code: deny
  • archive_emailMove an email to the archive folder.1 finding

    Why it is in this group

    • The name "archive_email" says "archive": a word for removing or ending something.
    • The server marks it not destructive (destructiveHint: false), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "archive_email" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "archive_email" says "archive": a word for removing or ending something.

      What this check looks for
    Description, as the server wrote it
    Move an email to the archive folder. Reversible — the message is not deleted.

    Annotations the server declares

    • title: Archive email
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • clear_sandboxDelete every captured sandbox email.No findings

    Why it is in this group

    • The description's first verb is "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Delete every captured sandbox email. Affects only intercepted test messages, never real sent mail.

    Annotations the server declares

    • title: Clear sandbox
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
  • import_contactsBulk-import up to 5,000 contacts in one call.No findings

    Why it is in this group

    • The name "import_contacts" says "import": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Bulk-import up to 5,000 contacts in one call. By default, addresses that already exist are skipped rather than duplicated — pass update_existing: true to update them instead. Returns per-row results so you can see which rows were rejected and why.

    Annotations the server declares

    • title: Import contacts
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: false
  • select_ab_test_winnerSelect the winning variant and send it to the remaining audience.Reads text others writeNo findings

    Why it is in this group

    • The name "select_ab_test_winner" says "select": a word for a change.
    • The description says "cannot be undone".
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Select the winning variant and send it to the remaining audience. This triggers a real send to everyone who was held back — it cannot be undone.

    Annotations the server declares

    • title: Select A/B winner
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • send_campaignSend a campaign now, or schedule it for a future time by passing scheduled_at.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "send_campaign" says "send": a word for sending, and what is sent cannot be taken back.
    • The description says "cannot be undone".
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "send_campaign" says "send": it sends or publishes something to other people.
    Description, as the server wrote it
    Send a campaign now, or schedule it for a future time by passing scheduled_at. This delivers real email to real recipients and cannot be undone once sending starts — confirm the audience with get_campaign first.

    Annotations the server declares

    • title: Send campaign
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: false
    • openWorldHint: true
  • update_contactUpdate an existing contact by email address, including changing subscription status.No findings

    Why it is in this group

    • The name "update_contact" says "update": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Update an existing contact by email address, including changing subscription status. Setting status to unsubscribed immediately excludes them from every future campaign. Does not support tags, phone, company, or job title — the API has no fields for them.

    Annotations the server declares

    • title: Update contact
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
    • openWorldHint: false
Can't be undone 2Claude Code: ask
  • reply_to_emailReply to an existing email thread.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "reply_to_email" says "reply": a word for sending, and what is sent cannot be taken back.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "reply_to_email" says "reply": it sends or publishes something to other people.
    Description, as the server wrote it
    Reply to an existing email thread. The sender address and threading headers are derived from the original message, so only the body is required.

    Annotations the server declares

    • title: Reply to email
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • send_emailSend a transactional email from a verified MisarMail account.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "send_email" says "send": a word for sending, and what is sent cannot be taken back.
    • The input addresses people (input.to): what it sends cannot be taken back.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "send_email" says "send": it sends or publishes something to other people.
    • outboundThe input takes a destination (input.to): what the tool writes goes there.
    Description, as the server wrote it
    Send a transactional email from a verified MisarMail account. `from.email` must match an email account you have already verified — use list_domains to check which sender domains are available. Returns the message ID and queue status.

    Annotations the server declares

    • title: Send email
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
Changes things 18Claude Code: ask
  • add_domainAdd a sending domain and return the DNS records to publish.No findings

    Why it is in this group

    • The name "add_domain" says "add": a word for a change.
    Description, as the server wrote it
    Add a sending domain and return the DNS records to publish. The domain cannot send until those records are live and verify_domain succeeds.

    Annotations the server declares

    • title: Add domain
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • categorize_inbox_emailsRun AI categorisation over a batch of inbox emails to label intent and priority.No findings

    Why it is in this group

    • The description's first verb is "run": a word for a change.
    Description, as the server wrote it
    Run AI categorisation over a batch of inbox emails to label intent and priority. Consumes AI credits — pass only the emails you actually need triaged.

    Annotations the server declares

    • title: Categorize inbox
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • check_dmarcCheck live SPF, DKIM, and DMARC DNS records for a domain and report alignment problems with the exact record to publish.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Check live SPF, DKIM, and DMARC DNS records for a domain and report alignment problems with the exact record to publish. Works for any domain, not only your own.

    Annotations the server declares

    • title: Check DMARC/SPF/DKIM
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • configure_inbound_domainConfigure inbound email routing for a subdomain so replies land in the MisarMail unified inbox.Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.webhook_url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Configure inbound email routing for a subdomain so replies land in the MisarMail unified inbox. Returns the MX record to publish.

    Annotations the server declares

    • title: Configure inbound
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • create_ab_testCreate one A/B test variant on a campaign.Reads text others writeNo findings

    Why it is in this group

    • The name "create_ab_test" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Create one A/B test variant on a campaign. The real API stores a single variant per call, so build a test by calling this once per variant (e.g. twice for a plain A/B split) using the same campaign_id and distinct `variant` labels. Each variant gets send_percent of the audience; auto_select_winner (with winner_wait_hours) can pick and send the winner automatically, or use select_ab_test_winner to do it manually.

    Annotations the server declares

    • title: Create A/B test
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • create_automationCreate an automation workflow from a trigger, saved as a paused draft.Reads text others writeNo findings

    Why it is in this group

    • The name "create_automation" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Create an automation workflow from a trigger, saved as a paused draft. The API's create endpoint only accepts a name and trigger — it has no fields for workflow steps or starting active; configure the step sequence in the MisarMail dashboard's visual builder, and use toggle_automation to activate once reviewed.

    Annotations the server declares

    • title: Create automation
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • create_campaignCreate a new email marketing campaign as a draft.No findings

    Why it is in this group

    • The name "create_campaign" says "create": a word for a change.
    Description, as the server wrote it
    Create a new email marketing campaign as a draft. Creating never sends or schedules anything — once the content and audience are confirmed, call send_campaign to send it now or schedule it for later.

    Annotations the server declares

    • title: Create campaign
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • create_contactAdd a single contact.No findings

    Why it is in this group

    • The name "create_contact" says "create": a word for a change.
    Description, as the server wrote it
    Add a single contact. Adding a contact records consent to email them — only add addresses that opted in, or the send will damage sender reputation and may breach CAN-SPAM/GDPR.

    Annotations the server declares

    • title: Create contact
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • create_landing_pageCreate a hosted landing page with a single hero block (headline, subheadline, CTA).Reads text others writeNo findings

    Why it is in this group

    • The name "create_landing_page" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Create a hosted landing page with a single hero block (headline, subheadline, CTA). Returns the public URL. The real API stores pages as a page-builder block array with no dedicated headline/CTA fields, so this tool translates your inputs into one 'hero' block — for multi-block pages or a real CTA link, use the landing page editor in the MisarMail dashboard.

    Annotations the server declares

    • title: Create landing page
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • create_templateCreate a reusable email template.No findings

    Why it is in this group

    • The name "create_template" says "create": a word for a change.
    Description, as the server wrote it
    Create a reusable email template. Use {{variable}} placeholders for personalisation — they are substituted at send time and previewable via render_template.

    Annotations the server declares

    • title: Create template
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • generate_reportGenerate a structured analytics report over a date range.1 finding

    Why it is in this group

    • The name "generate_report" says "generate": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "generate_report" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "generate_report" says "generate": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Generate a structured analytics report over a date range. Report types: campaign_performance, engagement_funnel, cohort_analysis, and send_time_heatmap (best hour/day to send).

    Annotations the server declares

    • title: Generate report
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • generate_subject_linesGenerate AI subject-line variants for a campaign topic, optionally tuned to a tone and audience.Reads text others writeNo findings

    Why it is in this group

    • The name "generate_subject_lines" says "generate": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Generate AI subject-line variants for a campaign topic, optionally tuned to a tone and audience. Good input for create_ab_test.

    Annotations the server declares

    • title: Generate subject lines
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • get_emailRead the full content of a single email by ID, including headers, body, and attachments metadata.Reads private dataReads text others write1 finding

    Why it is in this group

    • The name "get_email" says "get": a word for reading.
    • The server marks it as not read-only (readOnlyHint: false).

    What it can reach

    • private-dataThe name "get_email" says "get" and "email": it reads mail.
    • private-dataThe description's first sentence says "read" and "email": it reads mail.
    • untrusted-inputThe name "get_email" says "get" and "email": it reads inbound email, which other people can write.
    • untrusted-inputThe description's first sentence says "read" and "email": it reads inbound email, which other people can write.

    Findings

    • Warn

      The server marks "get_email" as not read-only (readOnlyHint: false), and its words say it reads.

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "get_email" says "get": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Read the full content of a single email by ID, including headers, body, and attachments metadata. Side effect: marks the email as read.

    Annotations the server declares

    • title: Read email
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • render_templateRender a template with sample variables and return the resulting HTML and subject.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Render a template with sample variables and return the resulting HTML and subject. Use this to preview personalisation before sending anything.

    Annotations the server declares

    • title: Render template
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • run_deliverability_auditRun a full deliverability audit across authentication (SPF/DKIM/DMARC), domain reputation, list hygiene, content signals, and blocklist status.Reads text others write1 finding

    Why it is in this group

    • The name "run_deliverability_audit" says "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "run_deliverability_audit" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":true}; The name "run_deliverability_audit" says "run": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Run a full deliverability audit across authentication (SPF/DKIM/DMARC), domain reputation, list hygiene, content signals, and blocklist status. Returns prioritized findings.

    Annotations the server declares

    • title: Deliverability audit
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • toggle_automationActivate or pause an automation.Reads text others writeNo findings

    Why it is in this group

    • The name "toggle_automation" says "toggle": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Activate or pause an automation. Activating starts enrolling contacts and sending on the configured schedule.

    Annotations the server declares

    • title: Toggle automation
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • toggle_integrationEnable or disable an integration.Reads text others write1 finding

    Why it is in this group

    • The name "toggle_integration" says "toggle": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...ps all syncing but preserves the stored credentials."

      What this check looks for
    Description, as the server wrote it
    Enable or disable an integration. Disabling stops all syncing but preserves the stored credentials.

    Annotations the server declares

    • title: Toggle integration
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • verify_domainRe-check a domain's DNS records and mark it verified if they resolve.Reads text others writeNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Re-check a domain's DNS records and mark it verified if they resolve. Safe to retry — DNS propagation can take up to 48 hours.

    Annotations the server declares

    • title: Verify domain
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Only reads 29Claude Code: allow
  • get_analyticsGet delivery and engagement analytics — sent, delivered, opened, clicked, bounced, and complained — for the account or one campaign, grouped by day/week/month.No findings

    Why it is in this group

    • The name "get_analytics" says "get": a word for reading.
    Description, as the server wrote it
    Get delivery and engagement analytics — sent, delivered, opened, clicked, bounced, and complained — for the account or one campaign, grouped by day/week/month.

    Annotations the server declares

    • title: Get analytics
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_analytics_timelineGet a day/week/month breakdown of sent, delivered, opened, clicked, bounced, complained, replied, and unsubscribed — across every send medium (campaigns, inbox compose, API, MCP, S…Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_analytics_timeline" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "get" and "inbox": it reads mail.
    • untrusted-inputThe description's first sentence says "get" and "inbox": it reads inbound email, which other people can write.
    Description, as the server wrote it
    Get a day/week/month breakdown of sent, delivered, opened, clicked, bounced, complained, replied, and unsubscribed — across every send medium (campaigns, inbox compose, API, MCP, SDKs, GraphQL, automations). The timeline counterpart to get_analytics's period totals.

    Annotations the server declares

    • title: Get analytics timeline
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_automationGet one automation workflow in full: trigger, every step with its delay, and per-step completion stats.No findings

    Why it is in this group

    • The name "get_automation" says "get": a word for reading.
    Description, as the server wrote it
    Get one automation workflow in full: trigger, every step with its delay, and per-step completion stats.

    Annotations the server declares

    • title: Get automation
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_campaignGet full details for one campaign: content, audience segment, schedule, and delivery statistics (sent, opened, clicked, bounced, complained).No findings

    Why it is in this group

    • The name "get_campaign" says "get": a word for reading.
    Description, as the server wrote it
    Get full details for one campaign: content, audience segment, schedule, and delivery statistics (sent, opened, clicked, bounced, complained).

    Annotations the server declares

    • title: Get campaign
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_contact_scoreGet engagement score, engagement tier, and churn risk for one contact — or the lowest-engagement contacts across the list when contact_id is omitted.Reads private dataNo findings

    Why it is in this group

    • The name "get_contact_score" says "get": a word for reading.

    What it can reach

    • private-dataThe name "get_contact_score" says "get" and "contact": it reads contacts.
    • private-dataThe description's first sentence says "get" and "contact": it reads contacts.
    Description, as the server wrote it
    Get engagement score, engagement tier, and churn risk for one contact — or the lowest-engagement contacts across the list when contact_id is omitted. Use before a re-engagement campaign.

    Annotations the server declares

    • title: Contact engagement score
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_deliverability_scoreGet the account deliverability score (0–100) and letter grade (A–F) with the factors dragging it down.No findings

    Why it is in this group

    • The name "get_deliverability_score" says "get": a word for reading.
    Description, as the server wrote it
    Get the account deliverability score (0–100) and letter grade (A–F) with the factors dragging it down. Start here when asked why emails are landing in spam.

    Annotations the server declares

    • title: Deliverability score
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_formGet one signup form including its fields, embed code, and redirect behaviour.No findings

    Why it is in this group

    • The name "get_form" says "get": a word for reading.
    Description, as the server wrote it
    Get one signup form including its fields, embed code, and redirect behaviour.

    Annotations the server declares

    • title: Get form
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_form_submissionsList submissions for a signup form, including the submitted field values and timestamps.No findings

    Why it is in this group

    • The name "get_form_submissions" says "get": a word for reading.
    Description, as the server wrote it
    List submissions for a signup form, including the submitted field values and timestamps.

    Annotations the server declares

    • title: Form submissions
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_inbox_conversation_messagesGet every message in one inbox conversation, oldest first, with sender and timestamps.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_inbox_conversation_messages" says "get": a word for reading.

    What it can reach

    • private-dataThe name "get_inbox_conversation_messages" says "get" and "inbox": it reads mail.
    • private-dataThe description's first sentence says "get" and "message": it reads messages.
    • untrusted-inputThe name "get_inbox_conversation_messages" says "get" and "inbox": it reads inbound email, which other people can write.
    • untrusted-inputThe description's first sentence says "get" and "message": it reads messages, which other people can write.
    Description, as the server wrote it
    Get every message in one inbox conversation, oldest first, with sender and timestamps.

    Annotations the server declares

    • title: Conversation messages
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_integrationGet one integration's configuration, scopes, and last sync result.No findings

    Why it is in this group

    • The name "get_integration" says "get": a word for reading.
    Description, as the server wrote it
    Get one integration's configuration, scopes, and last sync result.

    Annotations the server declares

    • title: Get integration
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_marketplace_itemGet one marketplace listing with its full preview, author, and install count.No findings

    Why it is in this group

    • The name "get_marketplace_item" says "get": a word for reading.
    Description, as the server wrote it
    Get one marketplace listing with its full preview, author, and install count.

    Annotations the server declares

    • title: Get marketplace item
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_monetization_statsGet newsletter monetization stats: paid subscribers, MRR, churn, and sponsorship revenue for the period.No findings

    Why it is in this group

    • The name "get_monetization_stats" says "get": a word for reading.
    Description, as the server wrote it
    Get newsletter monetization stats: paid subscribers, MRR, churn, and sponsorship revenue for the period.

    Annotations the server declares

    • title: Monetization stats
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_revenue_attributionAttribute ecommerce revenue to email — revenue per campaign, per contact, and average order value from tracked conversions.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "get_revenue_attribution" says "get": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "email": it reads mail.
    • untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    Attribute ecommerce revenue to email — revenue per campaign, per contact, and average order value from tracked conversions.

    Annotations the server declares

    • title: Revenue attribution
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • get_warmup_statusGet IP/domain warm-up progress and today's remaining send capacity.No findings

    Why it is in this group

    • The name "get_warmup_status" says "get": a word for reading.
    Description, as the server wrote it
    Get IP/domain warm-up progress and today's remaining send capacity. Exceeding warm-up capacity on a new domain is the fastest way to get throttled or blocklisted.

    Annotations the server declares

    • title: Warm-up status
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_ab_testsList A/B tests with per-variant results and whether a winner has been selected yet.No findings

    Why it is in this group

    • The name "list_ab_tests" says "list": a word for reading.
    Description, as the server wrote it
    List A/B tests with per-variant results and whether a winner has been selected yet.

    Annotations the server declares

    • title: List A/B tests
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_api_keysList API keys on the account with their scopes and last-used time.No findings

    Why it is in this group

    • The name "list_api_keys" says "list": a word for reading.
    Description, as the server wrote it
    List API keys on the account with their scopes and last-used time. Key secrets are never returned — only metadata.

    Annotations the server declares

    • title: List API keys
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_automationsList automation workflows (welcome series, re-engagement, drip sequences) with their trigger type and active state.No findings

    Why it is in this group

    • The name "list_automations" says "list": a word for reading.
    Description, as the server wrote it
    List automation workflows (welcome series, re-engagement, drip sequences) with their trigger type and active state.

    Annotations the server declares

    • title: List automations
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_campaignsList email marketing campaigns with their status, audience size, and headline metrics.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "list_campaigns" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "list" and "email": it reads mail.
    • untrusted-inputThe description's first sentence says "list" and "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    List email marketing campaigns with their status, audience size, and headline metrics. Filter by status to find drafts ready to send or campaigns still sending.

    Annotations the server declares

    • title: List campaigns
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_contactsList contacts with their subscription status and engagement metrics.Reads private dataNo findings

    Why it is in this group

    • The name "list_contacts" says "list": a word for reading.

    What it can reach

    • private-dataThe name "list_contacts" says "list" and "contact": it reads contacts.
    • private-dataThe description's first sentence says "list" and "contact": it reads contacts.
    Description, as the server wrote it
    List contacts with their subscription status and engagement metrics. Filter by status to find unsubscribed or bounced addresses that should be excluded from sends.

    Annotations the server declares

    • title: List contacts
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_domainsList sending domains with verification status and their DKIM/SPF/DMARC records.No findings

    Why it is in this group

    • The name "list_domains" says "list": a word for reading.
    Description, as the server wrote it
    List sending domains with verification status and their DKIM/SPF/DMARC records. Check here first when a send fails with an unverified-sender error.

    Annotations the server declares

    • title: List domains
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_emailsList emails from a mailbox folder with optional full-text search across subject and body.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "list_emails" says "list": a word for reading.

    What it can reach

    • private-dataThe name "list_emails" says "list" and "email": it reads mail.
    • private-dataThe description's first sentence says "list" and "email": it reads mail.
    • private-dataThe input names a folder (input.folder), and the tool reads: it reads files.
    • untrusted-inputThe name "list_emails" says "list" and "email": it reads inbound email, which other people can write.
    • untrusted-inputThe description's first sentence says "list" and "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    List emails from a mailbox folder with optional full-text search across subject and body. Use this for reading the unified inbox; use list_campaigns for marketing sends.

    Annotations the server declares

    • title: List emails
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_formsList signup forms with their embed status and conversion counts.No findings

    Why it is in this group

    • The name "list_forms" says "list": a word for reading.
    Description, as the server wrote it
    List signup forms with their embed status and conversion counts.

    Annotations the server declares

    • title: List forms
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_inbox_conversationsList unified-inbox conversations (threads) with their status and detected intent.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "list_inbox_conversations" says "list": a word for reading.

    What it can reach

    • private-dataThe name "list_inbox_conversations" says "list" and "inbox": it reads mail.
    • private-dataThe description's first sentence says "list" and "inbox": it reads mail.
    • untrusted-inputThe name "list_inbox_conversations" says "list" and "inbox": it reads inbound email, which other people can write.
    • untrusted-inputThe description's first sentence says "list" and "inbox": it reads inbound email, which other people can write.
    Description, as the server wrote it
    List unified-inbox conversations (threads) with their status and detected intent. Use this for triage; use list_emails for individual messages in a folder.

    Annotations the server declares

    • title: List conversations
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_integrationsList connected third-party integrations and their sync status.No findings

    Why it is in this group

    • The name "list_integrations" says "list": a word for reading.
    Description, as the server wrote it
    List connected third-party integrations and their sync status.

    Annotations the server declares

    • title: List integrations
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_marketplace_itemsBrowse the MisarMail template marketplace for ready-made email and automation templates.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "list_marketplace_items" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "browse" and "mail": it reads mail.
    • untrusted-inputThe description's first sentence says "browse": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Browse the MisarMail template marketplace for ready-made email and automation templates.

    Annotations the server declares

    • title: Browse marketplace
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_sandbox_sendsList emails captured by sandbox mode.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "list_sandbox_sends" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "list" and "email": it reads mail.
    • untrusted-inputThe description's first sentence says "list" and "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    List emails captured by sandbox mode. Sandbox intercepts sends instead of delivering them — use it to verify templates and automations without emailing anyone.

    Annotations the server declares

    • title: List sandbox sends
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • list_templatesList saved email templates with their variable placeholders, so you can pick one for a campaign or transactional send.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "list_templates" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "list" and "email": it reads mail.
    • untrusted-inputThe description's first sentence says "list" and "email": it reads inbound email, which other people can write.
    Description, as the server wrote it
    List saved email templates with their variable placeholders, so you can pick one for a campaign or transactional send.

    Annotations the server declares

    • title: List templates
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • upgradeShow the current MisarMail plan, how much of each quota is left, and what upgrading unlocks, with the link to upgrade.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The description's first verb is "show": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "show" and "mail": it reads mail.
    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "show" and "mail": it reads inbound email, which other people can write.
    Description, as the server wrote it
    Show the current MisarMail plan, how much of each quota is left, and what upgrading unlocks, with the link to upgrade. Call it any time — not only after hitting a limit. Reads only: it never changes the plan or takes payment; the user upgrades by following the link. On a local install, open=true also opens that link in the user's browser.

    Annotations the server declares

    • title: Plan usage and upgrade
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • validate_emailValidate an email address before sending: syntax, MX records, disposable-domain and role-account detection.Reads text others writeNo findings

    Why it is in this group

    • The name "validate_email" says "validate": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Validate an email address before sending: syntax, MX records, disposable-domain and role-account detection. Use this to protect sender reputation on imported lists.

    Annotations the server declares

    • title: Validate address
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

1352 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 4 outbound tools breaks every one.

Reads private data13
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write26
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out4
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__misarmail__configure_inbound_domain",
      "mcp__misarmail__reply_to_email",
      "mcp__misarmail__send_campaign",
      "mcp__misarmail__send_email"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Install

Pinned to version 5.1.2. Values in angle brackets are yours to fill in.

claude mcp add --transport http misarmail https://api.misar.io/mail/mcp --header 'Authorization: <your-authorization>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__misarmail__list_emails",
      "mcp__misarmail__validate_email",
      "mcp__misarmail__list_campaigns",
      "mcp__misarmail__get_campaign",
      "mcp__misarmail__list_contacts",
      "mcp__misarmail__get_contact_score",
      "mcp__misarmail__list_templates",
      "mcp__misarmail__list_automations",
      "mcp__misarmail__get_automation",
      "mcp__misarmail__list_ab_tests",
      "mcp__misarmail__get_analytics",
      "mcp__misarmail__get_analytics_timeline",
      "mcp__misarmail__get_revenue_attribution",
      "mcp__misarmail__get_monetization_stats",
      "mcp__misarmail__get_deliverability_score",
      "mcp__misarmail__get_warmup_status",
      "mcp__misarmail__list_domains",
      "mcp__misarmail__list_forms",
      "mcp__misarmail__get_form",
      "mcp__misarmail__get_form_submissions",
      "mcp__misarmail__list_marketplace_items",
      "mcp__misarmail__get_marketplace_item",
      "mcp__misarmail__list_inbox_conversations",
      "mcp__misarmail__get_inbox_conversation_messages",
      "mcp__misarmail__list_api_keys",
      "mcp__misarmail__list_integrations",
      "mcp__misarmail__get_integration",
      "mcp__misarmail__list_sandbox_sends",
      "mcp__misarmail__upgrade"
    ],
    "ask": [
      "mcp__misarmail__send_email",
      "mcp__misarmail__get_email",
      "mcp__misarmail__reply_to_email",
      "mcp__misarmail__create_campaign",
      "mcp__misarmail__create_contact",
      "mcp__misarmail__create_template",
      "mcp__misarmail__render_template",
      "mcp__misarmail__create_automation",
      "mcp__misarmail__toggle_automation",
      "mcp__misarmail__create_ab_test",
      "mcp__misarmail__generate_report",
      "mcp__misarmail__run_deliverability_audit",
      "mcp__misarmail__check_dmarc",
      "mcp__misarmail__add_domain",
      "mcp__misarmail__verify_domain",
      "mcp__misarmail__configure_inbound_domain",
      "mcp__misarmail__create_landing_page",
      "mcp__misarmail__categorize_inbox_emails",
      "mcp__misarmail__generate_subject_lines",
      "mcp__misarmail__toggle_integration"
    ],
    "deny": [
      "mcp__misarmail__archive_email",
      "mcp__misarmail__send_campaign",
      "mcp__misarmail__update_contact",
      "mcp__misarmail__import_contacts",
      "mcp__misarmail__select_ab_test_winner",
      "mcp__misarmail__clear_sandbox"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as misarmail. Review it before you use it.

Capability tags behind 28 rules
  • mcp__misarmail__send_email untrusted-input, outbound
  • mcp__misarmail__list_emails private-data, untrusted-input
  • mcp__misarmail__get_email private-data, untrusted-input
  • mcp__misarmail__reply_to_email untrusted-input, outbound
  • mcp__misarmail__validate_email untrusted-input
  • mcp__misarmail__list_campaigns private-data, untrusted-input
  • mcp__misarmail__send_campaign untrusted-input, outbound
  • mcp__misarmail__list_contacts private-data
  • mcp__misarmail__get_contact_score private-data
  • mcp__misarmail__list_templates private-data, untrusted-input
  • mcp__misarmail__create_automation untrusted-input
  • mcp__misarmail__toggle_automation untrusted-input
  • mcp__misarmail__create_ab_test untrusted-input
  • mcp__misarmail__select_ab_test_winner untrusted-input
  • mcp__misarmail__get_analytics_timeline private-data, untrusted-input
  • mcp__misarmail__get_revenue_attribution private-data, untrusted-input
  • mcp__misarmail__run_deliverability_audit untrusted-input
  • mcp__misarmail__check_dmarc untrusted-input
  • mcp__misarmail__verify_domain untrusted-input
  • mcp__misarmail__configure_inbound_domain untrusted-input, outbound
  • mcp__misarmail__create_landing_page untrusted-input
  • mcp__misarmail__list_marketplace_items private-data, untrusted-input
  • mcp__misarmail__list_inbox_conversations private-data, untrusted-input
  • mcp__misarmail__get_inbox_conversation_messages private-data, untrusted-input
  • mcp__misarmail__generate_subject_lines untrusted-input
  • mcp__misarmail__toggle_integration untrusted-input
  • mcp__misarmail__list_sandbox_sends private-data, untrusted-input
  • mcp__misarmail__upgrade private-data, untrusted-input