Send email from Codex

To send email from Codex, paste the Codex install line on the MCP guide, give the key a budget, and ask Codex to send. Codex has no config snippet of its own on this page. The line on the MCP guide is the one to paste. The block below is only the generic remote shape, so you can see the URL and the header that line writes.

Add the server

The line to paste is the Codex CLI block on the MCP guide. It names the server URL and reads the key from the environment, so the token is not written into the config file. Do not invent a second JSON file for Codex. This is the generic shape that line is aiming at:

{
  "url": "https://api.agentisend.com/mcp",
  "headers": {
    "Authorization": "Bearer as_YOUR_API_KEY_HERE"
  }
}

Generic remote-MCP configuration: point any streamable-HTTP MCP client at this URL with this Authorization header.

Replace the placeholder with a key you created for this agent, or set the variable the install line names.

Give the key a budget it cannot raise

Create the key with permission sending_access. It can send, and it can read the messages that key sent. It cannot create another key, edit a limit, or approve a send it was told to hold.

Set the ceiling with PATCH /limits/keys/{id}: budget_per_period, period (hourly, daily or monthly) and rate_ceiling_per_minute. Read it back with GET /limits/keys/{id}. The agent holds the sending key. Only a person, in the console, can raise the ceiling. A spent budget refuses the send. Nothing is queued and nothing is charged.

What the agent can and cannot do

It can call POST /emails and GET /emails/{id}. It cannot raise budget_per_period. There is no request an agent can make that lifts its own ceiling. A looping send is held for a person rather than dropped. GET /agent-actions lists it, and a person uses POST /agent-actions/{id}/approve or POST /agent-actions/{id}/reject. The key that asked cannot approve itself.

Stop one key with POST /limits/keys/{id}/kill, or every key with POST /limits/kill-all. Nothing resumes until a person does it. Longer versions: Budgets and the kill switch and Approvals.

What a refusal looks like

A send past the budget answers with code, message, fix and docs_url. The fix names the call.

{
  "error": {
    "code": "agent_budget_exceeded",
    "message": "Key budget for the current period is exhausted.",
    "fix": "Wait for the period to reset. get_agent_budget and GET /limits/keys/:id both say when. Raising a budget is a person's decision, made in the console; a key cannot raise its own.",
    "docs_url": "https://agentisend.com/docs/errors",
    "retryable": false
  }
}

retryable is false, so a client that reads the field stops instead of spinning. If the key has been paused, the code is kill_switch_active and the fix names GET /trust/standing. Report that to a person. Do not route around it.

Next

• Email for AI agents names every control and the request that calls it.
• Email guardrails maps the usual checklist onto these same fields.
• The MCP guide has the Codex install line, which is the one to paste.