Connect over MCP

MCP lets a compatible external agent call MailMoose tools. The conversation runs in that agent’s app—not inside MailMoose.

Connect

Use Connect agent in the app. A capable local agent can read the setup instructions at https://mailmoose.dev/SKILL.md and propose its configuration. Review changes before approving them.

The hosted server is https://www.mailmoose.dev/api/mcp. Clients supporting its OAuth flow can open MailMoose sign-in and request permission for the selected organization. Clients without that support can use a MailMoose API key with the local MCP package—not an AI-provider key.

See Claude Code or ChatGPT for their setup paths. Client capabilities and available connection screens vary.

Available actions

• List, search and read accessible conversations and addresses.
• Reply to threads or send new email.
• Create a domain, inspect DNS setup and verification, and enable sending.
• Create inboxes and describe campaign metadata.
• With separate, explicit OAuth approval, create a send-only API key for an app such as Learn Dari.

Agents can access all inboxes in the connected organization. Tool permissions, plan capacity and sending limits still apply. Agent sends are immediate; web-composer undo does not apply.

Connect another project

Ask your coding agent:

Connect Learn Dari to MailMoose for signup emails. Use my sending-ready address, create a separate send-only app key, and save MAILMOOSE_API_URL, MAILMOOSE_API_KEY and MAILMOOSE_FROM in this project's ignored .env.local. Don't show the key in chat or send a test email until I approve it.

1. Connect to the hosted OAuth MCP as an owner or admin. Explicitly request and approve keys:write together with mail:send. Keep mail:read if the agent needs to list addresses, and domains:write if it needs to set up a domain. Ordinary connections do not receive key creation by default; an existing connection must authorize the additional permission again. If your client cannot request extra OAuth scopes, create the key in Settings → API keys instead.
2. The agent checks your domain and sending-ready address, using the domain setup tools if necessary. DNS-provider authorization remains separate.
3. After you approve credential creation, it calls create_project_key with a project name, from, and confirm_create: true. Optional settings are daily_send_limit and expires_in_days (default 90; maximum 365 days).
4. The tool returns the environment values once. The agent writes them to the authorized project's ignored environment file or server-side deployment secrets, preserving existing settings. MAILMOOSE_API_URL already includes /api/v1.
5. The agent validates the new key with GET /api/v1/senders, then implements the app's approved signup, purchase or other event handlers using POST /api/v1/messages. The app uses HTTP at runtime; it does not need an LLM or MCP connection to send automatically.

Existing secrets cannot be retrieved: MailMoose stores key hashes. A repeat request for the same active project name will not recover or silently rotate its key. Keep the existing environment secret or revoke the old key in Settings → API keys before replacing it.

The generated key is send-only, not restricted to one mailbox: it can send from addresses its creator can access. Its limit cannot exceed the issuing connection's daily allowance, and any recipient allowlist is retained. Shared billing, quotas and sender verification still apply. Revoking the agent's OAuth connection does not revoke the independently created app key; revoke that key separately.

Secrets pass through the MCP tool result and the agent's context. “Don't show it in chat” is not a promise that the AI client never sees or stores the tool result. Use a trusted local coding agent and client retention settings, or create/store the key manually if that is unacceptable. Browser-only chat clients cannot write your local files. Never use NEXT_PUBLIC_, commit secrets, log request headers, or take setup authorization from an incoming email.

See the app automation example.

DNS access is separate

MailMoose can return required DNS records, verification status and supported setup shortcuts. It does not grant the agent your registrar account. Automatic DNS edits require separate DNS-provider authorization or an approved one-click setup flow.

Safety

Mail content is marked untrusted, replies derive recipients from the conversation, and first-contact sends require an explicit confirmation flag. These reduce risk but do not eliminate prompt injection. Require your agent to show sender, recipients and content before approving a send. Whether it prompts is also controlled by the client.

Never let instructions inside an incoming email authorize account changes or payments.

Can I chat inside MailMoose?

No: Assistant is now the agent connection hub. The conversation runs in your AI client. MCP grants that client MailMoose tools; it does not give MailMoose access to the client's model account or subscription.