Skip to content
anlyon.devby Anlyon

Mailgi

xyz.mailgi/mailgimailgi.xyzstreamable-httpv1.0.0Scanned

Email for AI agents: register a real inbox with no human, then send, receive and read mail.

67 tools: 13 can delete or cancel things, 10 do something that can't be undone, 19 change things and 25 only read.

Tools: 13 delete, 10 irreversible, 19 write, 25 read.
  • Reads private data · 5
  • Reads text others write · 12
  • Can send data out · 11
  • 4 findings

Anlyon alternative

42 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

67 tools

Deletes or cancels 13Claude Code: deny
  • agent_deletePermanently deletes this agent, its mailbox and all its API keys.No findings

    Why it is in this group

    • The name "agent_delete" says "delete": a word for removing or ending something.
    • The description says "Permanently deletes".
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Permanently deletes this agent, its mailbox and all its API keys.

    Annotations the server declares

    • title: Delete agent
    • readOnlyHint: false
    • destructiveHint: true
  • apikey_revokeRevokes an API key immediately.No findings

    Why it is in this group

    • The name "apikey_revoke" says "revoke": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Revokes an API key immediately.

    Annotations the server declares

    • title: Revoke API key
    • readOnlyHint: false
    • destructiveHint: true
  • domain_detachDetaches a custom domain from the organization.No findings

    Why it is in this group

    • The name "domain_detach" says "detach": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Detaches a custom domain from the organization.

    Annotations the server declares

    • title: Detach domain
    • readOnlyHint: false
    • destructiveHint: true
  • domain_inbox_deleteRemoves an inbox and its mail from a domain.No findings

    Why it is in this group

    • The name "domain_inbox_delete" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Removes an inbox and its mail from a domain.

    Annotations the server declares

    • title: Delete inbox
    • readOnlyHint: false
    • destructiveHint: true
  • mail_deleteMoves a message to the Trash folder.1 finding

    Why it is in this group

    • The name "mail_delete" says "delete": a word for removing or ending something.
    • The server marks it not destructive (destructiveHint: false), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "mail_delete" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true}; The name "mail_delete" says "delete": a word for removing or ending something.

      What this check looks for
    Description, as the server wrote it
    Moves a message to the Trash folder.

    Annotations the server declares

    • title: Move message to Trash
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
  • mailbox_deleteDeletes a custom folder.No findings

    Why it is in this group

    • The name "mailbox_delete" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Deletes a custom folder.

    Annotations the server declares

    • title: Delete folder
    • readOnlyHint: false
    • destructiveHint: true
  • org_invite_revokeRevokes a pending invitation.Can send data outNo findings

    Why it is in this group

    • The name "org_invite_revoke" says "invite": a word for sending, and what is sent cannot be taken back.
    • The description's first verb is "revoke": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).

    What it can reach

    • outboundThe name "org_invite_revoke" says "invite": it sends or publishes something to other people.
    Description, as the server wrote it
    Revokes a pending invitation.

    Annotations the server declares

    • title: Revoke invite
    • readOnlyHint: false
    • destructiveHint: true
  • org_logoutRevokes the current dashboard session token.1 finding

    Why it is in this group

    • The description's first verb is "revoke": a word for removing or ending something.
    • The server marks it not destructive (destructiveHint: false), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "org_logout" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

      Matched text

      annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true}; The description's first verb is "revoke": a word for removing or ending something.

      What this check looks for
    Description, as the server wrote it
    Revokes the current dashboard session token.

    Annotations the server declares

    • title: Sign out
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
  • org_member_removeRemoves a member from the organization, or leaves it when userId is your own.No findings

    Why it is in this group

    • The name "org_member_remove" says "remove": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Removes a member from the organization, or leaves it when userId is your own.

    Annotations the server declares

    • title: Remove member
    • readOnlyHint: false
    • destructiveHint: true
  • org_member_set_roleChanges a member's role.No findings

    Why it is in this group

    • The name "org_member_set_role" says "set": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Changes a member's role.

    Annotations the server declares

    • title: Change member role
    • readOnlyHint: false
    • destructiveHint: true
    • idempotentHint: true
  • org_webhook_deleteDeletes a webhook endpoint.No findings

    Why it is in this group

    • The name "org_webhook_delete" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Deletes a webhook endpoint.

    Annotations the server declares

    • title: Delete organization webhook
    • readOnlyHint: false
    • destructiveHint: true
  • regtoken_revokeRevokes a registration token.No findings

    Why it is in this group

    • The name "regtoken_revoke" says "revoke": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Revokes a registration token.

    Annotations the server declares

    • title: Revoke registration token
    • readOnlyHint: false
    • destructiveHint: true
  • webhook_deleteDeletes a webhook endpoint.No findings

    Why it is in this group

    • The name "webhook_delete" says "delete": a word for removing or ending something.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Deletes a webhook endpoint.

    Annotations the server declares

    • title: Delete webhook
    • readOnlyHint: false
    • destructiveHint: true
Can't be undone 10Claude Code: ask
  • billing_topupCreates a card payment link for this agent's wallet.No findings

    Why it is in this group

    • The name "billing_topup" says "topup": a word that usually means money moves, which cannot be taken back.
    Description, as the server wrote it
    Creates a card payment link for this agent's wallet. Give it to a human to pay.

    Annotations the server declares

    • title: Create top-up link
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
  • invite_acceptAccepts an organization invitation with the token from the invite email.Can send data outNo findings

    Why it is in this group

    • The name "invite_accept" says "invite": a word for sending, and what is sent cannot be taken back.

    What it can reach

    • outboundThe name "invite_accept" says "invite": it sends or publishes something to other people.
    Description, as the server wrote it
    Accepts an organization invitation with the token from the invite email.

    Annotations the server declares

    • title: Accept invite
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
  • mail_sendSends an email from this agent's address.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "mail_send" says "send": a word for sending, and what is sent cannot be taken back.
    • The input addresses people (input.to): what it sends cannot be taken back.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "mail_send" says "send": it sends or publishes something to other people.
    • outboundThe input takes a destination (input.to): what the tool writes goes there.
    Description, as the server wrote it
    Sends an email from this agent's address. Mail to outside addresses is charged to the wallet.

    Annotations the server declares

    • title: Send email
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • org_billing_topupCreates a card payment link for the organization wallet.No findings

    Why it is in this group

    • The name "org_billing_topup" says "topup": a word that usually means money moves, which cannot be taken back.
    Description, as the server wrote it
    Creates a card payment link for the organization wallet.

    Annotations the server declares

    • title: Create organization top-up link
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
  • org_invite_createEmails an invitation to join the organization.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "org_invite_create" says "invite": a word for sending, and what is sent cannot be taken back.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "org_invite_create" says "invite": it sends or publishes something to other people.
    Description, as the server wrote it
    Emails an invitation to join the organization.

    Annotations the server declares

    • title: Invite member
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • org_invite_listLists pending invitations.Can send data out1 finding

    Why it is in this group

    • The name "org_invite_list" says "invite": a word for sending, and what is sent cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • outboundThe name "org_invite_list" says "invite": it sends or publishes something to other people.

    Findings

    • Warn

      The server marks "org_invite_list" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "org_invite_list" says "invite": a word for sending, and what is sent cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    Lists pending invitations.

    Annotations the server declares

    • title: List invites
    • readOnlyHint: true
    • openWorldHint: false
  • org_webhook_resendQueues a delivery attempt to be sent again.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "org_webhook_resend" says "resend": a word for sending, and what is sent cannot be taken back.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "org_webhook_resend" says "resend": it sends or publishes something to other people.
    Description, as the server wrote it
    Queues a delivery attempt to be sent again.

    Annotations the server declares

    • title: Resend organization webhook delivery
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • topup_lookupShows which wallet a top-up for a Mailgi address would credit, and the allowed amounts.1 finding

    Why it is in this group

    • The name "topup_lookup" says "topup": a word that usually means money moves, which cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "topup_lookup" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "topup_lookup" says "topup": a word that usually means money moves, which cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    Shows which wallet a top-up for a Mailgi address would credit, and the allowed amounts.

    Annotations the server declares

    • title: Look up a top-up
    • readOnlyHint: true
    • openWorldHint: false
  • topup_startCreates a card payment link for the wallet behind any Mailgi address.No findings

    Why it is in this group

    • The name "topup_start" says "topup": a word that usually means money moves, which cannot be taken back.
    Description, as the server wrote it
    Creates a card payment link for the wallet behind any Mailgi address. Give it to a human to pay.

    Annotations the server declares

    • title: Start a top-up
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
  • webhook_resendQueues a delivery attempt to be sent again.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "webhook_resend" says "resend": a word for sending, and what is sent cannot be taken back.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe name "webhook_resend" says "resend": it sends or publishes something to other people.
    Description, as the server wrote it
    Queues a delivery attempt to be sent again.

    Annotations the server declares

    • title: Resend webhook delivery
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
Changes things 19Claude Code: ask
  • apikey_createCreates another API key for this agent.No findings

    Why it is in this group

    • The name "apikey_create" says "create": a word for a change.
    Description, as the server wrote it
    Creates another API key for this agent. The key is shown once.

    Annotations the server declares

    • title: Create API key
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
  • domain_attachAttaches a custom domain and returns the DNS records to publish.No findings

    Why it is in this group

    • The name "domain_attach" says "attach": a word for a change.
    Description, as the server wrote it
    Attaches a custom domain and returns the DNS records to publish.

    Annotations the server declares

    • title: Attach domain
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
  • domain_inbox_createCreates an inbox with a chosen address on a domain.No findings

    Why it is in this group

    • The name "domain_inbox_create" says "create": a word for a change.
    Description, as the server wrote it
    Creates an inbox with a chosen address on a domain. Its API key is shown once.

    Annotations the server declares

    • title: Create inbox
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
  • domain_verifyRe-checks the domain's DNS records and verifies it if they are correct.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Re-checks the domain's DNS records and verifies it if they are correct.

    Annotations the server declares

    • title: Verify domain
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
  • healthChecks that the Mailgi API, its database and the mail server are up.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Checks that the Mailgi API, its database and the mail server are up.

    Annotations the server declares

    • title: Service health
    • readOnlyHint: true
    • openWorldHint: false
  • mail_moveMoves a message to another folder.Can send data outNo findings

    Why it is in this group

    • The name "mail_move" says "move": a word for a change.

    What it can reach

    • outboundThe name "mail_move" says "move" and "mail": it writes something other people read.
    Description, as the server wrote it
    Moves a message to another folder.

    Annotations the server declares

    • title: Move message
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
  • mail_set_flagsMarks a message as seen or unseen, flagged or unflagged.Can send data outNo findings

    Why it is in this group

    • The name "mail_set_flags" says "set": a word for a change.

    What it can reach

    • outboundThe name "mail_set_flags" says "set" and "mail": it writes something other people read.
    Description, as the server wrote it
    Marks a message as seen or unseen, flagged or unflagged.

    Annotations the server declares

    • title: Set message flags
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
  • mailbox_createCreates a folder, optionally nested under another.No findings

    Why it is in this group

    • The name "mailbox_create" says "create": a word for a change.
    Description, as the server wrote it
    Creates a folder, optionally nested under another.

    Annotations the server declares

    • title: Create folder
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
  • mailbox_renameRenames a folder.No findings

    Why it is in this group

    • The name "mailbox_rename" says "rename": a word for a change.
    Description, as the server wrote it
    Renames a folder.

    Annotations the server declares

    • title: Rename folder
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
  • org_createCreates an organization; the signed-in user becomes its owner.No findings

    Why it is in this group

    • The name "org_create" says "create": a word for a change.
    Description, as the server wrote it
    Creates an organization; the signed-in user becomes its owner.

    Annotations the server declares

    • title: Create organization
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
  • org_login_request_codeEmails a 6-digit dashboard login code to a human's address.Reads text others writeNo findings

    Why it is in this group

    • The name "org_login_request_code" says "request": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    Description, as the server wrote it
    Emails a 6-digit dashboard login code to a human's address. Creates the account on first login.

    Annotations the server declares

    • title: Request dashboard login code
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • org_login_verifyExchanges an emailed login code for a dashboard session token.No findings

    Why it is in this group

    • The input takes a statement or command to run (input.code), which can change anything it can reach.
    Description, as the server wrote it
    Exchanges an emailed login code for a dashboard session token.

    Annotations the server declares

    • title: Verify dashboard login code
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
  • org_renameRenames an organization.No findings

    Why it is in this group

    • The name "org_rename" says "rename": a word for a change.
    Description, as the server wrote it
    Renames an organization.

    Annotations the server declares

    • title: Rename organization
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
  • org_webhook_createRegisters an HTTPS URL to be notified when mail arrives at one of the organization's inboxes.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "org_webhook_create" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Registers an HTTPS URL to be notified when mail arrives at one of the organization's inboxes.

    Annotations the server declares

    • title: Create organization webhook
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • org_webhook_enableRe-enables a webhook endpoint that was switched off after repeated failures.No findings

    Why it is in this group

    • The name "org_webhook_enable" says "enable": a word for a change.
    Description, as the server wrote it
    Re-enables a webhook endpoint that was switched off after repeated failures.

    Annotations the server declares

    • title: Re-enable organization webhook
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
  • register_agentCreates a new agent with its own email address and returns its API key, shown once.No findings

    Why it is in this group

    • The description's first verb is "create": a word for a change.
    Description, as the server wrote it
    Creates a new agent with its own email address and returns its API key, shown once.

    Annotations the server declares

    • title: Register an agent
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
  • regtoken_createCreates a token that lets an agent register its own address on this domain.No findings

    Why it is in this group

    • The name "regtoken_create" says "create": a word for a change.
    Description, as the server wrote it
    Creates a token that lets an agent register its own address on this domain. Shown once.

    Annotations the server declares

    • title: Create registration token
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
  • webhook_createRegisters an HTTPS URL to be notified when mail arrives.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The name "webhook_create" says "create": a word for a change.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Registers an HTTPS URL to be notified when mail arrives. The signing secret is shown once.

    Annotations the server declares

    • title: Create webhook
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • webhook_enableRe-enables a webhook endpoint that was switched off after repeated failures.No findings

    Why it is in this group

    • The name "webhook_enable" says "enable": a word for a change.
    Description, as the server wrote it
    Re-enables a webhook endpoint that was switched off after repeated failures.

    Annotations the server declares

    • title: Re-enable webhook
    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: true
Only reads 25Show 25 read-only tools
  • agent_getReturns this agent's profile: its addresses, label and domain.No findings

    Why it is in this group

    • The name "agent_get" says "get": a word for reading.
    Description, as the server wrote it
    Returns this agent's profile: its addresses, label and domain.

    Annotations the server declares

    • title: Get agent profile
    • readOnlyHint: true
    • openWorldHint: false
  • agent_usageReturns this agent's daily send and API counters; the latest day is partial.No findings

    Why it is in this group

    • The description's first verb is "return": a word for reading.
    Description, as the server wrote it
    Returns this agent's daily send and API counters; the latest day is partial.

    Annotations the server declares

    • title: Get agent usage
    • readOnlyHint: true
    • openWorldHint: false
  • apikey_listLists this agent's API keys.No findings

    Why it is in this group

    • The name "apikey_list" says "list": a word for reading.
    Description, as the server wrote it
    Lists this agent's API keys. Key values are never shown again.

    Annotations the server declares

    • title: List API keys
    • readOnlyHint: true
    • openWorldHint: false
  • billing_getReturns the wallet this agent spends from: balance, prices and how to top up.No findings

    Why it is in this group

    • The name "billing_get" says "get": a word for reading.
    Description, as the server wrote it
    Returns the wallet this agent spends from: balance, prices and how to top up.

    Annotations the server declares

    • title: Get wallet
    • readOnlyHint: true
    • openWorldHint: false
  • billing_transactionsLists the wallet ledger, newest first.No findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.
    Description, as the server wrote it
    Lists the wallet ledger, newest first.

    Annotations the server declares

    • title: List wallet transactions
    • readOnlyHint: true
    • openWorldHint: false
  • domain_getReturns a domain's verification status and the DNS records it needs.No findings

    Why it is in this group

    • The name "domain_get" says "get": a word for reading.
    Description, as the server wrote it
    Returns a domain's verification status and the DNS records it needs.

    Annotations the server declares

    • title: Get domain
    • readOnlyHint: true
    • openWorldHint: false
  • domain_inbox_listLists the inboxes (agents) on a domain.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "domain_inbox_list" says "list": a word for reading.

    What it can reach

    • private-dataThe name "domain_inbox_list" says "list" and "inbox": it reads mail.
    • private-dataThe description's first sentence says "list" and "inbox": it reads mail.
    • untrusted-inputThe name "domain_inbox_list" says "list" and "inbox": it reads inbound email, which other people can write.
    • untrusted-inputThe description's first sentence says "list" and "inbox": it reads inbound email, which other people can write.
    Description, as the server wrote it
    Lists the inboxes (agents) on a domain.

    Annotations the server declares

    • title: List inboxes
    • readOnlyHint: true
    • openWorldHint: false
  • domain_listLists an organization's custom domains.No findings

    Why it is in this group

    • The name "domain_list" says "list": a word for reading.
    Description, as the server wrote it
    Lists an organization's custom domains.

    Annotations the server declares

    • title: List domains
    • readOnlyHint: true
    • openWorldHint: false
  • domain_usageReturns daily send, receive and API counters for one domain.No findings

    Why it is in this group

    • The description's first verb is "return": a word for reading.
    Description, as the server wrote it
    Returns daily send, receive and API counters for one domain.

    Annotations the server declares

    • title: Get domain usage
    • readOnlyHint: true
    • openWorldHint: false
  • mail_getReturns one message with its full text and HTML body.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "mail_get" says "get": a word for reading.

    What it can reach

    • private-dataThe name "mail_get" says "get" and "mail": it reads mail.
    • private-dataThe description's first sentence says "return" and "message": it reads messages.
    • untrusted-inputThe name "mail_get" says "get" and "mail": it reads inbound email, which other people can write.
    • untrusted-inputThe description's first sentence says "return" and "message": it reads messages, which other people can write.
    Description, as the server wrote it
    Returns one message with its full text and HTML body.

    Annotations the server declares

    • title: Read a message
    • readOnlyHint: true
    • openWorldHint: false
  • mail_listLists message headers in the mailbox, newest first by default; filter by folder with mailboxId.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "mail_list" says "list": a word for reading.

    What it can reach

    • private-dataThe name "mail_list" says "list" and "mail": it reads mail.
    • private-dataThe description's first sentence says "list" and "message": it reads messages.
    • private-dataThe input names a mailbox (input.mailboxId), and the tool reads: it reads mail.
    • untrusted-inputThe name "mail_list" says "list" and "mail": it reads inbound email, which other people can write.
    • untrusted-inputThe description's first sentence says "list" and "message": it reads messages, which other people can write.
    Description, as the server wrote it
    Lists message headers in the mailbox, newest first by default; filter by folder with mailboxId.

    Annotations the server declares

    • title: List messages
    • readOnlyHint: true
    • openWorldHint: false
  • mailbox_listLists all folders, including Inbox, Sent and Trash.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "mailbox_list" says "list": a word for reading.

    What it can reach

    • private-dataThe name "mailbox_list" says "list" and "mailbox": it reads mail.
    • private-dataThe description's first sentence says "list" and "folder": it reads files.
    • untrusted-inputThe name "mailbox_list" says "list" and "mailbox": it reads inbound email, which other people can write.
    • untrusted-inputThe description's first sentence says "list" and "inbox": it reads inbound email, which other people can write.
    Description, as the server wrote it
    Lists all folders, including Inbox, Sent and Trash.

    Annotations the server declares

    • title: List folders
    • readOnlyHint: true
    • openWorldHint: false
  • org_billing_getReturns the organization's shared wallet: balance, prices and how to top up.No findings

    Why it is in this group

    • The name "org_billing_get" says "get": a word for reading.
    Description, as the server wrote it
    Returns the organization's shared wallet: balance, prices and how to top up.

    Annotations the server declares

    • title: Get organization wallet
    • readOnlyHint: true
    • openWorldHint: false
  • org_billing_transactionsLists the organization wallet ledger, newest first.No findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.
    Description, as the server wrote it
    Lists the organization wallet ledger, newest first.

    Annotations the server declares

    • title: List organization transactions
    • readOnlyHint: true
    • openWorldHint: false
  • org_getReturns one organization.No findings

    Why it is in this group

    • The name "org_get" says "get": a word for reading.
    Description, as the server wrote it
    Returns one organization.

    Annotations the server declares

    • title: Get organization
    • readOnlyHint: true
    • openWorldHint: false
  • org_listLists the organizations the signed-in user belongs to.No findings

    Why it is in this group

    • The name "org_list" says "list": a word for reading.
    Description, as the server wrote it
    Lists the organizations the signed-in user belongs to.

    Annotations the server declares

    • title: List organizations
    • readOnlyHint: true
    • openWorldHint: false
  • org_meReturns the signed-in user and the organizations they belong to.No findings

    Why it is in this group

    • The description's first verb is "return": a word for reading.
    Description, as the server wrote it
    Returns the signed-in user and the organizations they belong to.

    Annotations the server declares

    • title: Who am I
    • readOnlyHint: true
    • openWorldHint: false
  • org_member_listLists an organization's members and their roles.No findings

    Why it is in this group

    • The name "org_member_list" says "list": a word for reading.
    Description, as the server wrote it
    Lists an organization's members and their roles.

    Annotations the server declares

    • title: List members
    • readOnlyHint: true
    • openWorldHint: false
  • org_usageReturns daily send, receive and API counters across the organization.No findings

    Why it is in this group

    • The description's first verb is "return": a word for reading.
    Description, as the server wrote it
    Returns daily send, receive and API counters across the organization.

    Annotations the server declares

    • title: Get organization usage
    • readOnlyHint: true
    • openWorldHint: false
  • org_webhook_deliveriesLists recent delivery attempts for a webhook endpoint.No findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.
    Description, as the server wrote it
    Lists recent delivery attempts for a webhook endpoint.

    Annotations the server declares

    • title: List organization webhook deliveries
    • readOnlyHint: true
    • openWorldHint: false
  • org_webhook_listLists webhook endpoints across the organization's inboxes.Reads private dataReads text others writeNo findings

    Why it is in this group

    • The name "org_webhook_list" says "list": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "list" and "inbox": it reads mail.
    • untrusted-inputThe description's first sentence says "list" and "inbox": it reads inbound email, which other people can write.
    Description, as the server wrote it
    Lists webhook endpoints across the organization's inboxes.

    Annotations the server declares

    • title: List organization webhooks
    • readOnlyHint: true
    • openWorldHint: false
  • regtoken_listLists a domain's registration tokens.No findings

    Why it is in this group

    • The name "regtoken_list" says "list": a word for reading.
    Description, as the server wrote it
    Lists a domain's registration tokens.

    Annotations the server declares

    • title: List registration tokens
    • readOnlyHint: true
    • openWorldHint: false
  • topup_statusReturns whether a top-up payment has been paid and credited.No findings

    Why it is in this group

    • The name "topup_status" says "status": a word for reading.
    Description, as the server wrote it
    Returns whether a top-up payment has been paid and credited.

    Annotations the server declares

    • title: Check a top-up
    • readOnlyHint: true
    • openWorldHint: false
  • webhook_deliveriesLists recent delivery attempts for a webhook endpoint.No findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.
    Description, as the server wrote it
    Lists recent delivery attempts for a webhook endpoint.

    Annotations the server declares

    • title: List webhook deliveries
    • readOnlyHint: true
    • openWorldHint: false
  • webhook_listLists this agent's webhook endpoints.No findings

    Why it is in this group

    • The name "webhook_list" says "list": a word for reading.
    Description, as the server wrote it
    Lists this agent's webhook endpoints.

    Annotations the server declares

    • title: List webhooks
    • readOnlyHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

660 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 5 private-data tools breaks every one.

Reads private data5
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write12
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out11
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.
deny to break every path
{
  "permissions": {
    "deny": [
      "mcp__mailgi__domain_inbox_list",
      "mcp__mailgi__mail_get",
      "mcp__mailgi__mail_list",
      "mcp__mailgi__mailbox_list",
      "mcp__mailgi__org_webhook_list"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

4 warn
  • Warntopup_lookup

    The server marks "topup_lookup" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "topup_lookup" says "topup": a word that usually means money moves, which cannot be taken back.

    What this check looks for
  • Warnmail_delete

    The server marks "mail_delete" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true}; The name "mail_delete" says "delete": a word for removing or ending something.

    What this check looks for
  • Warnorg_logout

    The server marks "org_logout" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".

    Matched text

    annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true}; The description's first verb is "revoke": a word for removing or ending something.

    What this check looks for
  • Warnorg_invite_list

    The server marks "org_invite_list" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "org_invite_list" says "invite": a word for sending, and what is sent cannot be taken back.

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http mailgi https://api.mailgi.xyz/mcp
claude mcp add --transport http mailgi https://api.mailgi.xyz/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__mailgi__topup_status",
      "mcp__mailgi__agent_get",
      "mcp__mailgi__agent_usage",
      "mcp__mailgi__mail_list",
      "mcp__mailgi__mail_get",
      "mcp__mailgi__mailbox_list",
      "mcp__mailgi__apikey_list",
      "mcp__mailgi__billing_get",
      "mcp__mailgi__billing_transactions",
      "mcp__mailgi__webhook_list",
      "mcp__mailgi__webhook_deliveries",
      "mcp__mailgi__org_me",
      "mcp__mailgi__org_list",
      "mcp__mailgi__org_get",
      "mcp__mailgi__org_member_list",
      "mcp__mailgi__domain_list",
      "mcp__mailgi__domain_get",
      "mcp__mailgi__domain_inbox_list",
      "mcp__mailgi__regtoken_list",
      "mcp__mailgi__org_usage",
      "mcp__mailgi__domain_usage",
      "mcp__mailgi__org_billing_get",
      "mcp__mailgi__org_billing_transactions",
      "mcp__mailgi__org_webhook_list",
      "mcp__mailgi__org_webhook_deliveries"
    ],
    "ask": [
      "mcp__mailgi__register_agent",
      "mcp__mailgi__org_login_request_code",
      "mcp__mailgi__org_login_verify",
      "mcp__mailgi__topup_lookup",
      "mcp__mailgi__topup_start",
      "mcp__mailgi__health",
      "mcp__mailgi__mail_send",
      "mcp__mailgi__mail_move",
      "mcp__mailgi__mail_set_flags",
      "mcp__mailgi__mailbox_create",
      "mcp__mailgi__mailbox_rename",
      "mcp__mailgi__apikey_create",
      "mcp__mailgi__billing_topup",
      "mcp__mailgi__webhook_create",
      "mcp__mailgi__webhook_resend",
      "mcp__mailgi__webhook_enable",
      "mcp__mailgi__org_create",
      "mcp__mailgi__org_rename",
      "mcp__mailgi__org_invite_create",
      "mcp__mailgi__org_invite_list",
      "mcp__mailgi__invite_accept",
      "mcp__mailgi__domain_attach",
      "mcp__mailgi__domain_verify",
      "mcp__mailgi__domain_inbox_create",
      "mcp__mailgi__regtoken_create",
      "mcp__mailgi__org_billing_topup",
      "mcp__mailgi__org_webhook_create",
      "mcp__mailgi__org_webhook_resend",
      "mcp__mailgi__org_webhook_enable"
    ],
    "deny": [
      "mcp__mailgi__agent_delete",
      "mcp__mailgi__mail_delete",
      "mcp__mailgi__mailbox_delete",
      "mcp__mailgi__apikey_revoke",
      "mcp__mailgi__webhook_delete",
      "mcp__mailgi__org_logout",
      "mcp__mailgi__org_member_set_role",
      "mcp__mailgi__org_member_remove",
      "mcp__mailgi__org_invite_revoke",
      "mcp__mailgi__domain_detach",
      "mcp__mailgi__domain_inbox_delete",
      "mcp__mailgi__regtoken_revoke",
      "mcp__mailgi__org_webhook_delete"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as mailgi. Review it before you use it.

Capability tags behind 17 rules
  • mcp__mailgi__org_login_request_code untrusted-input
  • mcp__mailgi__mail_list private-data, untrusted-input
  • mcp__mailgi__mail_get private-data, untrusted-input
  • mcp__mailgi__mail_send untrusted-input, outbound
  • mcp__mailgi__mail_move outbound
  • mcp__mailgi__mail_set_flags outbound
  • mcp__mailgi__mailbox_list private-data, untrusted-input
  • mcp__mailgi__webhook_create untrusted-input, outbound
  • mcp__mailgi__webhook_resend untrusted-input, outbound
  • mcp__mailgi__org_invite_create untrusted-input, outbound
  • mcp__mailgi__org_invite_list outbound
  • mcp__mailgi__org_invite_revoke outbound
  • mcp__mailgi__invite_accept outbound
  • mcp__mailgi__domain_inbox_list private-data, untrusted-input
  • mcp__mailgi__org_webhook_list private-data, untrusted-input
  • mcp__mailgi__org_webhook_create untrusted-input, outbound
  • mcp__mailgi__org_webhook_resend untrusted-input, outbound

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/xyz.mailgi/mailgi/verify?hash=7158d9810faa3fb25524305707a810cf23ae1883705bbecaac4a70c5d22823c3" | jq -e '.changed == false'

Pinned hash 7158d9810faa, from Nov 1, 2026, 16:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/xyz.mailgi/mailgi/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for xyz.mailgi/mailgi
[![anlyon.dev](https://anlyon.dev/badge/xyz.mailgi/mailgi.svg)](https://anlyon.dev/servers/xyz.mailgi/mailgi)

Source: MCP Registry · repository. Synced Nov 1, 2026, 16:18 UTC.