AgentiSend MCP server — send email from Claude, Cursor and any MCP client

AgentiSend is a transactional email API for AI agents. Every tool this MCP server serves, the scopes each one needs, the ceilings it is counted against, and what each refusal means. Generated from the running catalogue: the page, the console tab and the server cannot disagree.

Server URL: https://api.agentisend.com/mcp (streamable HTTP). Bearer API key or OAuth 2.1 — both reach the same tools with the same ceilings. A local stdio launcher is published as @agentisend/mcp-server for clients that only speak stdio; it proxies to this server, so the catalogue is identical.

Each client also has its own page: Cursor, Claude, Claude Code, Claude Desktop, Windsurf, VS Code and GitHub Copilot, Codex, Gemini CLI, Lovable, Bolt, v0, Replit, Zed, OpenCode and Cline.

Claude (web and desktop)

AgentiSend is listed in Claude's connector directory: open https://claude.ai/directory/agentisend in claude.ai or the desktop app and click Connect. To add it by hand instead, open Customize → Connectors, click +, choose Add custom connector and paste https://api.agentisend.com/mcp, then click Connect. Either way, sign in to AgentiSend and approve; Claude holds the connection, so there is no key to copy. Then ask Claude to send a short note from onboarding@agentisend.com to your sign-in address. That sender delivers only to member sign-in addresses, and it needs no domain of yours. An address ending in @simulator.agentisend.com also works before a domain is verified: it costs nothing and reaches nobody.

Claude Desktop's config file runs local servers only, so the URL does not go there; the stdio launcher at the end of the next section does. A connection starts with the same budget as any key, and a person can lower it on the console's Agents screen.

Add it to your client

Every line below carries the same endpoint (https://api.agentisend.com/mcp) and a placeholder key — replace as_YOUR_API_KEY_HERE with a key from the console.

Cursor

cursor://anysphere.cursor-deeplink/mcp/install?name=agentisend&config=eyJ1cmwiOiJodHRwczovL2FwaS5hZ2VudGlzZW5kLmNvbS9tY3AiLCJoZWFkZXJzIjp7IkF1dGhvcml6YXRpb24iOiJCZWFyZXIgYXNfWU9VUl9BUElfS0VZX0hFUkUifX0=

Open this link and Cursor offers to add the server. Replace the placeholder key in Settings → MCP afterwards, or paste the same object into .cursor/mcp.json.

Claude Code

claude mcp add --transport http agentisend https://api.agentisend.com/mcp \
  --header "Authorization: Bearer as_YOUR_API_KEY_HERE"

Or install the plugin, which brings the server and the sending skill together: /plugin marketplace add fortuneflick/agentisend-claude-plugin then /plugin install agentisend@agentisend.

Codex CLI

codex mcp add agentisend --url https://api.agentisend.com/mcp \
  --bearer-token-env-var AGENTISEND_API_KEY

The token stays in your environment; Codex writes only the variable name to ~/.codex/config.toml.

Gemini CLI

gemini mcp add --transport http \
  --header "Authorization: Bearer as_YOUR_API_KEY_HERE" \
  agentisend https://api.agentisend.com/mcp

Check it with gemini mcp list.

VS Code

code --add-mcp '{"name":"agentisend","type":"http","url":"https://api.agentisend.com/mcp","headers":{"Authorization":"Bearer as_YOUR_API_KEY_HERE"}}'

Or write the same server into .vscode/mcp.json under servers.

Windsurf

{
  "mcpServers": {
    "agentisend": {
      "serverUrl": "https://api.agentisend.com/mcp",
      "headers": {
        "Authorization": "Bearer as_YOUR_API_KEY_HERE"
      }
    }
  }
}

Goes in ~/.codeium/windsurf/mcp_config.json, then refresh the MCP panel.

OpenCode

{
  "mcp": {
    "agentisend": {
      "type": "remote",
      "url": "https://api.agentisend.com/mcp",
      "enabled": true,
      "headers": {
        "Authorization": "Bearer {env:AGENTISEND_API_KEY}"
      }
    }
  }
}

Goes in opencode.json; the key is read from your environment rather than written to the file.

Anything else that speaks stdio

AGENTISEND_API_KEY=as_YOUR_API_KEY_HERE npx -y @agentisend/mcp-server

The local launcher proxies to the same server, so the tool list, the budget and the refusals are identical.

Tools (92)

Every tool that changes something accepts idempotency_key: retrying with the same key returns the first result instead of doing the work twice.

Sending

Writes

Reads

Scopes

A key holds scopes; a tool needs some. A tool you cannot call is missing one — whoami returns the scopes this credential holds and the tools they reach.

Rate limits

Per-minute ceilings are the same on every plan and are counted per API key, by operation class. What a plan changes is how much you may send in total. No paid plan has a daily cap; delivery to each inbox provider is paced by our sending addresses and rises as they warm.

JSON-RPC error codes

Every refusal arrives as a tool result carrying code, message, fix, reason, retryable and jsonrpc_code. Branch on jsonrpc_code or reason, never on the message.

The refusals you will actually meet

What an agent cannot do here

These are deliberate stops with a person on the other end, not gaps.

• Lift your own kill switch. A rest an agent can cut short is not a rest. _A person, on the Agents screen in the console. You may stop yourself at any time — POST /limits/keys/:id/kill and /limits/kill-all stay open to a key._
• Approve your own held send. Approval you can grant yourself is not approval. _A person, in the approvals inbox. Use request_approval to ask; list_agent_actions to hear the answer._
• Raise your own budget or your own per-minute ceiling. A budget an agent can raise is not a budget. _A person, on the Agents screen in the console. set_limit and PATCH /limits/keys/:id still lower a key, so an agent can always cap itself before a job._
• Raise the account trust standing, or waive a trust pause. Trust is earned by delivery outcomes, not asserted. _Nobody directly — it changes as your sending does. POST /trust/appeal asks a human to look._
• Read the contents of a message you were stopped from sending. A held-mail queue an agent can read verbatim is a way to read the mail it was stopped from sending. _A person, in the console. Tools see shapes: recipient counts, whether there is a body._
• Send to an address that asked not to be contacted. Suppression is the whole reason the account is allowed to send at all. _Nobody, while the suppression stands. remove_suppression clears a hard bounce you have fixed; an unsubscribe or a spam complaint is refused, because somebody said no and only they can change that._
• Send unsolicited mail to people who did not ask for it. Unsolicited mail is refused; there is no tool for it. _Nobody, at any tier, by any route. There is no endpoint for it._