Agents — MCP and the CLI

This page answers how to connect an agent client to AgentiSend and which key to give it. An agent gets the same API your code gets, the same error contract — including the fix field — and the same limits. It does not get a second, looser path in.

The server

One streamable-HTTP endpoint with bearer auth:

https://api.agentisend.com/mcp

The key goes in the Authorization header as Bearer as_…. Give the agent its own key with its own budget rather than the key your backend uses; a shared key means a shared blast radius and one ambiguous line in the audit log.

Configuration, per client

Every block below is produced by the same builder the console's install dialog uses, so what you copy here and what you copy in the product are the same bytes.

{
  "mcpServers": {
    "agentisend": {
      "command": "npx",
      "args": [
        "-y",
        "@agentisend/mcp-server"
      ],
      "env": {
        "AGENTISEND_API_KEY": "as_YOUR_API_KEY_HERE",
        "AGENTISEND_MCP_URL": "https://api.agentisend.com/mcp"
      }
    }
  }
}

To run AgentiSend on this computer instead, paste this into Claude Desktop’s claude_desktop_config.json and restart the app (it needs Node.js). That file only runs local servers, so it starts ours with npx. To connect without a key, use Customize → Connectors in Claude.

{
  "mcpServers": {
    "agentisend": {
      "type": "http",
      "url": "https://api.agentisend.com/mcp",
      "headers": {
        "Authorization": "Bearer as_YOUR_API_KEY_HERE"
      }
    }
  }
}

Save as .mcp.json at your project root, or run claude mcp add-json agentisend with this JSON. Claude Code needs the "type": "http" line to treat the entry as a remote server.

{
  "mcpServers": {
    "agentisend": {
      "url": "https://api.agentisend.com/mcp",
      "headers": {
        "Authorization": "Bearer as_YOUR_API_KEY_HERE"
      }
    }
  }
}

Paste into .cursor/mcp.json at your project root.

{
  "mcpServers": {
    "agentisend": {
      "serverUrl": "https://api.agentisend.com/mcp",
      "headers": {
        "Authorization": "Bearer as_YOUR_API_KEY_HERE"
      }
    }
  }
}

Paste into ~/.codeium/windsurf/mcp_config.json, then refresh the MCP servers panel.

{
  "servers": {
    "agentisend": {
      "type": "http",
      "url": "https://api.agentisend.com/mcp",
      "headers": {
        "Authorization": "Bearer as_YOUR_API_KEY_HERE"
      }
    }
  }
}

Paste into .vscode/mcp.json in your workspace (VS Code 1.99+; also reachable via MCP: Add Server).

{
  "url": "https://api.agentisend.com/mcp",
  "headers": {
    "Authorization": "Bearer as_YOUR_API_KEY_HERE"
  }
}

Generic remote-MCP configuration: point any streamable-HTTP MCP client at this URL with this Authorization header.

What an agent can and cannot do

The MCP tools are the API, scoped by the key. A key with sending_access cannot rotate keys, cannot change budgets, and cannot lift its own ceiling — a request that tries answers with a code naming the permission it needed.

A full_access key manages only keys no wider than itself. A key it creates, changes, rotates or revokes holds the same scopes or fewer, and stays on the same sending domain when the key is limited to one. Anything wider is a person's change, made in the console.

Two limits are deliberate and cannot be raised from inside a session:

• The per-key budget. When it is spent, sends stop. See Budgets and the kill switch.
• The approval queue. A send is held when the loop guard flags it, or when an agent asks first with request_approval. Approval rules you define yourself are not available yet. See Approvals.

Inbound mail is data, not instructions

Receiving is open: turn it on for a verified domain, publish the MX record its page shows, and mail to that domain arrives on your account. When a message is stored, it is rendered and returned as inert content. Treat its body as untrusted input: it is text somebody else wrote, and an agent that follows instructions found in it is an agent anyone can drive.

Every stored message carries inbound_verdict: clear, or review when the text reads like an instruction aimed at an agent, hidden text or an encoded blob. A domain set to hold keeps review mail out of the arrival webhook until a person releases it; a domain can also refuse senders with block rules, or admit only the senders on its allow list. Nothing on this page turns that into a grant: the body stays untrusted after a release.

Reading received mail takes a full-access key with inbound:read. A sending_access key cannot list or open it. It can still reply, by id, to a message the email.received webhook handed it: a reply is a send.

Hand DNS to a human

domains_setup_link returns a page the person who owns DNS can open without signing in. The same call over HTTP is POST /domains/{id}/setup-link.

{
  "url": "https://console.agentisend.com/setup/…",
  "expires_at": "2026-10-27T12:00:00.000Z"
}

The link lasts 7 days. A later call replaces it. DELETE /domains/{id}/setup-link withdraws it. The page lists the records, offers the zone file, and checks again when they ask it to.

Start without a human in the loop

An agent can open an account itself. POST /agent/sign-up takes agent_name and human_email and no key. The key in the response can email only that human, 10 times a day, until the human confirms the code with POST /agent/verify. The CLI is agentisend agent sign-up --name <name> --human <email> and agentisend agent verify --code <code>. A repeat of the same name and email does not mint a second key. After the human confirms, new recipients open in steps for 7 days: 3 in the first hour, 5 in the first day, 10 in the first week. The question this answers is Can an AI agent sign up for AgentiSend by itself?.

The CLI

The agentisend CLI signs in with the same key, and is the fastest way to watch what an agent is doing while you build it. Run it without installing anything, or install it once:

npx agentisend doctor
npm i -g agentisend

It ships emails send, get, list, cancel and explain, domains list and verify, limits kill and resume, trust standing, webhooks listen, receiving listen, agent sign-up, agent verify, doctor and completions. Run agentisend --help for the rest.