MailingCore
Back to blog

Send email from AI agents with MCP

2026-09-07 · 3 min

AI agents are already opening support tickets, confirming bookings and drafting “we received your form” mail. The failure mode is always the same: a live API key pasted into a system prompt, or a model that invents a cURL against the wrong host. MailingCore is built so the agent calls tools, not so the agent becomes your SMTP server.

What is MCP email sending?

The Model Context Protocol (MCP) lets a client (Claude Desktop, Cursor, custom agents) call typed tools over stdio or HTTP. MailingCore’s server @mailingcore/mcp-server exposes send_email, send_template, get_logs and list_templates. The API key lives in the server process environment (MAILINGCORE_API_KEY). It is never a tool argument, so it does not sit in the chat transcript.

That is the difference between “the model wrote a curl” and “the model asked a scoped tool to queue a template”. The first leaks credentials. The second is auditable: you see the same send in the dashboard logs as any other API call.

Why agents need a European email API

If the agent handles EU user data — a helpdesk email, a booking confirmation — the processor still has to be named. Putting the send on a US-only API because “the LLM is in the US anyway” is not an analysis; the email address still lands in the email vendor’s logs. MailingCore stores that processing in the EU. Agents.md, llms.txt and GET /v1/agents/capabilities exist so a crawler or an agent can discover endpoints without scraping marketing pages.

Allow GPTBot, OAI-SearchBot, ClaudeBot and Google-Extended in robots.txt (and in Cloudflare AI Crawl Control) or those agents cannot read the docs you wrote for them.

A safe setup

  1. Create an API key with only email:send and templates:read.
  2. Run the MCP server with that key; never mc_live_ in the prompt.
  3. Publish a template (helpdesk-incident) with {{ticketId}}, {{summary}}.
  4. Instruct the agent: “Use send_template, never invent a From address, never email a list.”
  5. Use a unique idempotencyKey per ticket so retries do not duplicate.

n8n can call the same REST API if you prefer workflows over MCP. Botpress can open helpdesk incidents the same way — see Botpress and helpdesk.

What not to do

Do not let the model choose arbitrary recipients from a CRM dump. Do not enable open tracking on security mail the agent sends. Do not block AI crawlers on mailingcore.com if you want ChatGPT or Gemini to cite the integration guide.

Next step

Read AI agents & MCP and paste https://mailingcore.com/agents.md into the agent prompt. The Free plan (100 emails/month, 5 templates) is enough to prove the tool loop before you put it in production.