Guardrails

The MCP tools are safe by construction, so an agent can operate real email infrastructure without a human watching every call. The guarantees are enforced in the shared cores — not the tool layer — so they hold no matter who calls them.

No blasts

email_send_email is single-recipient by design — there is no list parameter. Broad sending happens only through automations, which enroll contacts one at a time (each send still flows through the suppression check, kill switch, and daily cap). An agent cannot email a whole list in one call.

Kill switch + send caps

Every project has a sendsPaused kill switch (set via email_set_sends_paused) plus daily and monthly send caps. The ceiling comes from the provider plan; dailySendCap is an optional operator tightening on top of it (unset = rely on the plan, 0 = unlimited). All of them are re-checked on the worker path, so scheduled and automation sends respect them too.

Suppression matrix

Bounces and complaints auto-suppress from provider webhooks. Bounce/complaint/manual suppressions block all sends; an unsubscribe blocks lifecycle mail only (transactional receipts/resets still deliver). Complaint suppressions are never removable — not even by an agent.

Automations are created paused

email_create_automation always creates a paused automation. Enabling it (email_set_automation_status) is a separate call that requires confirm: true and validates every step's template is published — a deliberate human decision point.

Provider keys never travel over MCP

email_connect_provider returns a settings-page URL; the Resend/SendGrid key is pasted by a human in the dashboard and stored AES-256-GCM-encrypted. No tool can read or set it.

Confirm literals + scope

Destructive tools (delete, un-suppress, pause) carry a confirm: z.literal(true) gate. And a read-scoped token exposes none of the write tools in the first place — the surface an agent sees is bounded by the token you mint.