# MisarMail MCP Server

> Send transactional email, run campaigns, manage contacts and automations, audit deliverability.

- name: io.github.Misar-AI/misarmail-mcp
- version: 5.1.2
- connection class: R1 (autonomous)
- trust: 93/100
- quality: 85/100 (good)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.Misar-AI%2Fmisarmail-mcp
- tools: https://api.protogrid.dev/v1/servers/io.github.Misar-AI%2Fmisarmail-mcp/tools

**An agent can connect on its own if it already holds `MISARMAIL_MCP_TOKEN`.** Remote endpoint behind a static API key or header. The registry never sees the value; the agent fills the placeholder.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "misarmail-mcp": {
      "type": "http",
      "url": "https://api.misar.io/mail/mcp",
      "headers": {
        "Authorization": "Bearer ${MISARMAIL_MCP_TOKEN}"
      }
    }
  }
}
```

Placeholders to fill: `${MISARMAIL_MCP_TOKEN}`.

## Trust

- hygiene: 100
- liveness: 98
- freshness: 85
- provenance: 90
- drivers: +repository +namespace-matches-repo +website +reachable +uptime-96% ~updated-62d-ago
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 85/100 (good)

### protocol: n/a (weight 25)

- n/a `protocol.modern`, `protocol.stateless`, `protocol.transport`, `protocol.list_ttl`: no remote answered a protocol handshake (not probed yet, unreachable, or local-only)

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 86 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 55 of 55 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- warn `tools.token_cost`: about 8,163 tokens to load every tool
- warn `tools.api_dump`: 55 tools, 65% named like REST operations: looks like an API mapped one endpoint per tool

### stability: 100 (weight 15)

- pass `stability.changes`: no tool changes in 30 days
- pass `stability.rug_pull`: no tool changed its meaning under the same name

### dependencies: 67 (weight 15)

- pass `deps.known_vulns`: no known advisory in 98 resolved packages
- fail `deps.mcp_sdk_version`: @modelcontextprotocol/sdk 1.30.1 has 1 known advisory (GHSA-6qxp-vccf-f47h); update @modelcontextprotocol/sdk to 1.31.0 or later
- pass `deps.resolvable`: @misarmail/mcp@5.1.2 resolved: 98 packages

- tools: 55, about 8,163 tokens to load them all
- tool set hash: 2dd67c7cb13f2a354edf508c0a8c40e7
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.Misar-AI/misarmail-mcp.svg)](https://protogrid.dev/servers/io.github.Misar-AI/misarmail-mcp)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Dependencies

- npm @misarmail/mcp@5.1.2: resolved, 97 dependencies, MCP SDK @modelcontextprotocol/sdk 1.30.1
  - GHSA-6qxp-vccf-f47h (high) in `` @modelcontextprotocol/sdk@1.30.1 ``, direct, fixed in `` 1.31.0 ``, advisory summary: "MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server" https://osv.dev/vulnerability/GHSA-6qxp-vccf-f47h

Dependency graphs from deps.dev; advisories from OSV.dev, including the GitHub Advisory Database and the PyPI Advisory Database; all CC BY 4.0.

## Remotes

- https://api.misar.io/mail/mcp (streamable-http, auth api_key ${MISARMAIL_MCP_TOKEN}, reachable true, uptime30d 0.95652175)

## Packages

- npm @misarmail/mcp@5.1.2 secrets: MISARMAIL_API_KEY

## Tools (55)

- `add_domain`: Add a sending domain and return the DNS records to publish. The domain cannot send until those records are live and verify_domain succeeds.
- `archive_email`: Move an email to the archive folder. Reversible — the message is not deleted.
- `categorize_inbox_emails`: Run AI categorisation over a batch of inbox emails to label intent and priority. Consumes AI credits — pass only the emails you actually need triaged.
- `check_dmarc`: Check live SPF, DKIM, and DMARC DNS records for a domain and report alignment problems with the exact record to publish. Works for any domain, not only your own.
- `clear_sandbox`: Delete every captured sandbox email. Affects only intercepted test messages, never real sent mail.
- `configure_inbound_domain`: Configure inbound email routing for a subdomain so replies land in the MisarMail unified inbox. Returns the MX record to publish.
- `create_ab_test`: Create one A/B test variant on a campaign. The real API stores a single variant per call, so build a test by calling this once per variant (e.g. twice for a plain A/B split) using the same campaign_id and distinct `variant` labels. Each variant gets send_percent of the audience; auto_select_winner (with winner_wait_hours) can pick and send the winner automatically, or use select_ab_test_winner to do it manually.
- `create_automation`: Create an automation workflow from a trigger, saved as a paused draft. The API's create endpoint only accepts a name and trigger — it has no fields for workflow steps or starting active; configure the step sequence in the MisarMail dashboard's visual builder, and use toggle_automation to activate once reviewed.
- `create_campaign`: Create a new email marketing campaign as a draft. Creating never sends or schedules anything — once the content and audience are confirmed, call send_campaign to send it now or schedule it for later.
- `create_contact`: Add a single contact. Adding a contact records consent to email them — only add addresses that opted in, or the send will damage sender reputation and may breach CAN-SPAM/GDPR.
- `create_landing_page`: Create a hosted landing page with a single hero block (headline, subheadline, CTA). Returns the public URL. The real API stores pages as a page-builder block array with no dedicated headline/CTA fields, so this tool translates your inputs into one 'hero' block — for multi-block pages or a real CTA link, use the landing page editor in the MisarMail dashboard.
- `create_template`: Create a reusable email template. Use {{variable}} placeholders for personalisation — they are substituted at send time and previewable via render_template.
- `generate_report`: Generate a structured analytics report over a date range. Report types: campaign_performance, engagement_funnel, cohort_analysis, and send_time_heatmap (best hour/day to send).
- `generate_subject_lines`: Generate AI subject-line variants for a campaign topic, optionally tuned to a tone and audience. Good input for create_ab_test.
- `get_analytics`: Get delivery and engagement analytics — sent, delivered, opened, clicked, bounced, and complained — for the account or one campaign, grouped by day/week/month.
- `get_analytics_timeline`: Get a day/week/month breakdown of sent, delivered, opened, clicked, bounced, complained, replied, and unsubscribed — across every send medium (campaigns, inbox compose, API, MCP, SDKs, GraphQL, automations). The timeline counterpart to get_analytics's period totals.
- `get_automation`: Get one automation workflow in full: trigger, every step with its delay, and per-step completion stats.
- `get_campaign`: Get full details for one campaign: content, audience segment, schedule, and delivery statistics (sent, opened, clicked, bounced, complained).
- `get_contact_score`: Get engagement score, engagement tier, and churn risk for one contact — or the lowest-engagement contacts across the list when contact_id is omitted. Use before a re-engagement campaign.
- `get_deliverability_score`: Get the account deliverability score (0–100) and letter grade (A–F) with the factors dragging it down. Start here when asked why emails are landing in spam.
- `get_email`: Read the full content of a single email by ID, including headers, body, and attachments metadata. Side effect: marks the email as read.
- `get_form`: Get one signup form including its fields, embed code, and redirect behaviour.
- `get_form_submissions`: List submissions for a signup form, including the submitted field values and timestamps.
- `get_inbox_conversation_messages`: Get every message in one inbox conversation, oldest first, with sender and timestamps.
- `get_integration`: Get one integration's configuration, scopes, and last sync result.
- `get_marketplace_item`: Get one marketplace listing with its full preview, author, and install count.
- `get_monetization_stats`: Get newsletter monetization stats: paid subscribers, MRR, churn, and sponsorship revenue for the period.
- `get_revenue_attribution`: Attribute ecommerce revenue to email — revenue per campaign, per contact, and average order value from tracked conversions.
- `get_warmup_status`: Get IP/domain warm-up progress and today's remaining send capacity. Exceeding warm-up capacity on a new domain is the fastest way to get throttled or blocklisted.
- `import_contacts`: Bulk-import up to 5,000 contacts in one call. By default, addresses that already exist are skipped rather than duplicated — pass update_existing: true to update them instead. Returns per-row results so you can see which rows were rejected and why.
- `list_ab_tests`: List A/B tests with per-variant results and whether a winner has been selected yet.
- `list_api_keys`: List API keys on the account with their scopes and last-used time. Key secrets are never returned — only metadata.
- `list_automations`: List automation workflows (welcome series, re-engagement, drip sequences) with their trigger type and active state.
- `list_campaigns`: List email marketing campaigns with their status, audience size, and headline metrics. Filter by status to find drafts ready to send or campaigns still sending.
- `list_contacts`: List contacts with their subscription status and engagement metrics. Filter by status to find unsubscribed or bounced addresses that should be excluded from sends.
- `list_domains`: List sending domains with verification status and their DKIM/SPF/DMARC records. Check here first when a send fails with an unverified-sender error.
- `list_emails`: List emails from a mailbox folder with optional full-text search across subject and body. Use this for reading the unified inbox; use list_campaigns for marketing sends.
- `list_forms`: List signup forms with their embed status and conversion counts.
- `list_inbox_conversations`: List unified-inbox conversations (threads) with their status and detected intent. Use this for triage; use list_emails for individual messages in a folder.
- `list_integrations`: List connected third-party integrations and their sync status.
- `list_marketplace_items`: Browse the MisarMail template marketplace for ready-made email and automation templates.
- `list_sandbox_sends`: List emails captured by sandbox mode. Sandbox intercepts sends instead of delivering them — use it to verify templates and automations without emailing anyone.
- `list_templates`: List saved email templates with their variable placeholders, so you can pick one for a campaign or transactional send.
- `render_template`: Render a template with sample variables and return the resulting HTML and subject. Use this to preview personalisation before sending anything.
- `reply_to_email`: Reply to an existing email thread. The sender address and threading headers are derived from the original message, so only the body is required.
- `run_deliverability_audit`: Run a full deliverability audit across authentication (SPF/DKIM/DMARC), domain reputation, list hygiene, content signals, and blocklist status. Returns prioritized findings.
- `select_ab_test_winner`: Select the winning variant and send it to the remaining audience. This triggers a real send to everyone who was held back — it cannot be undone.
- `send_campaign`: Send a campaign now, or schedule it for a future time by passing scheduled_at. This delivers real email to real recipients and cannot be undone once sending starts — confirm the audience with get_campaign first.
- `send_email`: Send a transactional email from a verified MisarMail account. `from.email` must match an email account you have already verified — use list_domains to check which sender domains are available. Returns the message ID and queue status.
- `toggle_automation`: Activate or pause an automation. Activating starts enrolling contacts and sending on the configured schedule.
- `toggle_integration`: Enable or disable an integration. Disabling stops all syncing but preserves the stored credentials.
- `update_contact`: Update an existing contact by email address, including changing subscription status. Setting status to unsubscribed immediately excludes them from every future campaign. Does not support tags, phone, company, or job title — the API has no fields for them.
- `upgrade`: Show the current MisarMail plan, how much of each quota is left, and what upgrading unlocks, with the link to upgrade. Call it any time — not only after hitting a limit. Reads only: it never changes the plan or takes payment; the user upgrades by following the link. On a local install, open=true also opens that link in the user's browser.
- `validate_email`: Validate an email address before sending: syntax, MX records, disposable-domain and role-account detection. Use this to protect sender reputation on imported lists.
- `verify_domain`: Re-check a domain's DNS records and mark it verified if they resolve. Safe to retry — DNS propagation can take up to 48 hours.