MCP OAuth setup
Connect Claude, Cursor, Codex, or another MCP client to Mailbase with OAuth-scoped workspace access.
Remote MCP server
Mailbase exposes a remote Streamable HTTP MCP server. OAuth is the preferred auth path, so clients do not need a Mailbase API token or shared secret.
Its tools cover the whole app: domains and DNS health, senders and mailboxes, campaigns and A/B tests, templates, audiences, contacts, signup forms, the reply inbox, pipeline and follow-ups, workflows, prospecting targets, the prospect pool, drafts and the sequence, and analytics. Claude Code users get them, plus workflow skills, from the Claude Code plugin.
| Resource | Path |
|---|---|
| Streamable HTTP endpoint | /api/mcp/mcp |
| SSE endpoint | /api/mcp/sse |
| Manifest | /api/mcp/manifest |
| MCPB bundle | /api/mcp/manifest.mcpb |
| OAuth metadata | /.well-known/oauth-authorization-server |
| Protected resource metadata | /.well-known/oauth-protected-resource |
Connect a client
Use the Mailbase origin plus /api/mcp/mcp as the remote server URL. The client discovers OAuth metadata, opens the authorization screen, and receives tokens scoped to the approved workspace.
codex mcp add mailbase --url https://mailbase.example.com/api/mcp/mcp
claude mcp add mailbase --transport http https://mailbase.example.com/api/mcp/mcpWorkspace scope
- OAuth tokens are pinned to the workspace approved during the authorization flow.
- Older clients that connect with a plain API token must name the workspace they work in; Mailbase never picks one for them.
- MCP tools return current workspace context so AI clients can confirm where they are operating before writing drafts or changing data.
Review and revoke
- Open Settings, then API & webhooks, to review connection status and available tools.
- Revoke OAuth clients when a teammate leaves, a client is replaced, or a machine is retired.
- Every tool says what it does: read-only tools are marked read-only, and every tool that emails people or deletes something is marked destructive, so clients ask before running it. The plugin's skills tell the agent to show the exact email and get the user's yes first.
- Mailbase's own rules still apply to every send, whatever the client: unsubscribed, bounced and complained addresses are skipped, daily caps and warm-up hold, and scam screening runs before anything leaves.