MCP server

Every tool this MCP server serves, the scopes each one needs, the ceilings it is counted against, and what each refusal means. Generated from the running catalogue — the page, the console tab and the server cannot disagree.

Server URL: https://api.agentisend.com/mcp (streamable HTTP). Bearer API key or OAuth 2.1 — both reach the same tools with the same ceilings. A local stdio launcher is published as @agentisend/mcp-server for clients that only speak stdio; it proxies to this server, so the catalogue is identical.

Add it to your client

Every line below carries the same endpoint (https://api.agentisend.com/mcp) and a placeholder key — replace as_YOUR_API_KEY_HERE with a key from the console.

Cursor

cursor://anysphere.cursor-deeplink/mcp/install?name=agentisend&config=eyJ1cmwiOiJodHRwczovL2FwaS5hZ2VudGlzZW5kLmNvbS9tY3AiLCJoZWFkZXJzIjp7IkF1dGhvcml6YXRpb24iOiJCZWFyZXIgYXNfWU9VUl9BUElfS0VZX0hFUkUifX0=

Open this link and Cursor offers to add the server. Replace the placeholder key in Settings → MCP afterwards, or paste the same object into .cursor/mcp.json.

Claude Code

claude mcp add --transport http agentisend https://api.agentisend.com/mcp \
  --header "Authorization: Bearer as_YOUR_API_KEY_HERE"

Or install the plugin, which brings the server and the sending skill together: /plugin marketplace add fortuneflick/agentisend-claude-plugin then /plugin install agentisend@agentisend.

Codex CLI

codex mcp add agentisend --url https://api.agentisend.com/mcp \
  --bearer-token-env-var AGENTISEND_API_KEY

The token stays in your environment; Codex writes only the variable name to ~/.codex/config.toml.

Gemini CLI

gemini mcp add --transport http \
  --header "Authorization: Bearer as_YOUR_API_KEY_HERE" \
  agentisend https://api.agentisend.com/mcp

Check it with gemini mcp list.

VS Code

code --add-mcp '{"name":"agentisend","type":"http","url":"https://api.agentisend.com/mcp","headers":{"Authorization":"Bearer as_YOUR_API_KEY_HERE"}}'

Or write the same server into .vscode/mcp.json under servers.

Windsurf

{
  "mcpServers": {
    "agentisend": {
      "serverUrl": "https://api.agentisend.com/mcp",
      "headers": {
        "Authorization": "Bearer as_YOUR_API_KEY_HERE"
      }
    }
  }
}

Goes in ~/.codeium/windsurf/mcp_config.json, then refresh the MCP panel.

OpenCode

{
  "mcp": {
    "agentisend": {
      "type": "remote",
      "url": "https://api.agentisend.com/mcp",
      "enabled": true,
      "headers": {
        "Authorization": "Bearer {env:AGENTISEND_API_KEY}"
      }
    }
  }
}

Goes in opencode.json; the key is read from your environment rather than written to the file.

Anything else that speaks stdio

AGENTISEND_API_KEY=as_YOUR_API_KEY_HERE npx -y @agentisend/mcp-server

The local launcher proxies to the same server, so the tool list, the budget and the refusals are identical.

Tools (34)

Every tool that changes something accepts idempotency_key: retrying with the same key returns the first result instead of doing the work twice.

Sending

Writes

Reads

Scopes

A key holds scopes; a tool needs some. A tool you cannot call is missing one — whoami returns the scopes this credential holds and the tools they reach.

Rate limits

Per-minute ceilings are the same on every plan and are counted per API key, by operation class. What a plan changes is how much you may send in total.

JSON-RPC error codes

Every refusal arrives as a tool result carrying code, message, fix, reason, retryable and jsonrpc_code. Branch on jsonrpc_code or reason, never on the message.

The refusals you will actually meet

What an agent cannot do here

These are deliberate stops with a person on the other end, not gaps.

• Lift your own kill switch. A rest an agent can cut short is not a rest. _A person, on the Agents screen in the console. You may stop yourself at any time — POST /limits/keys/:id/kill and /limits/kill-all stay open to a key._
• Approve your own held send. Approval you can grant yourself is not approval. _A person, in the approvals inbox. Use request_approval to ask; list_agent_actions to hear the answer._
• Raise your own budget or your own per-minute ceiling. A budget an agent can raise is not a budget. _A person, on the Agents screen in the console. set_limit and PATCH /limits/keys/:id still lower a key, so an agent can always cap itself before a job._
• Raise the account trust standing, or waive a trust pause. Trust is earned by delivery outcomes, not asserted. _Nobody directly — it changes as your sending does. POST /trust/appeal asks a human to look._
• Read the contents of a message you were stopped from sending. A held-mail queue an agent can read verbatim is a way to read the mail it was stopped from sending. _A person, in the console. Tools see shapes: recipient counts, whether there is a body._
• Send to an address that asked not to be contacted. Suppression is the whole reason the account is allowed to send at all. _Nobody, while the suppression stands. remove_suppression clears a hard bounce you have fixed; an unsubscribe or a spam complaint is refused, because somebody said no and only they can change that._
• Send unsolicited mail to people who did not ask for it. This product refuses cold outreach by design. There is no feature for it and asking for one is out of scope. _Nobody, at any tier, by any route. There is no endpoint for it and no plan that adds one._