SpacePost
REMOTE · API.SPACEPOST.DEV · 2 COMPONENTS
Send email and manage domains, contacts and webhooks on SpacePost, the Resend-compatible email API.
Available components
Last scanned (14 hours ago)
Scores higher than 63% of remote servers
Reachable. Last reached 6 Nov 2026.
Category Communication
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security83
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, but the challenge carries no valid RFC 9728 metadata, so a client cannot discover where to get a token. See how to fix → View diagnostics → Fail
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- HSTS check failed: the Strict-Transport-Security header is absent. See how to fix → View diagnostics → Fail
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability67
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 4787 tokens (~104/item across 46 items; 46 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management23
- Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage83
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 48% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 11 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 47 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Checks we ran (13)
- TLS certificate
- Authorization
- HTTPS
- HSTS header
- DNSSEC
- Transport
- Schema quality
- Stability
- Tool coverage
- Injection markers
- Destructive annotations
- Judged manipulation
- MCP protocol
Does not apply to this hosted endpoint (2)
- Supply Chain SecurityScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
- Provenance & TransparencyScored on package channels only. This is a hosted endpoint, so there is nothing to install or inspect.
The score does not measure everything. What the score does not measure →
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 6 Nov 26 +1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 5 Nov 26 +70
The score moved with no change recorded against any check. We would rather say so than guess.
- 4 Nov 26 −70
- Endpoint reachability: reachable → unreachable ▼ security
- Authorization: fail → unverified ▼ security
- HSTS header: fail → unverified ▼ security
- Stability: 0.13 → unverified ▼ security
- TLS certificate: pass → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Transport: pass → fail ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: pass → fail ▼ functional
- First check of Schema quality: unverified functional
- “create_broadcast” reworded the description of “from” cosmetic
- “send_email” reworded the description of “from” cosmetic
- “update_broadcast” reworded the description of “from” cosmetic
- 3 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.
- 1 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.
- 31 Oct 26 0
- Stability: unverified → 0.03 ▲ functional
- 30 Oct 26 72
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 6 Nov 2026 · Probed https://api.spacepost.dev/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=api.spacepost.dev | CN=YE2,O=Let's Encrypt,C=US | 27 Oct 2026 | 25 Jan 2027 | ECDSA 256 | ECDSA-SHA384 | 5cacea2011c5ff3a241a64c2066ea5b4f89 |
| SANs: api.spacepost.dev | ||||||
| CN=YE2,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 4df3b15dd6c0784c507cd37b58e6f115 |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of api.spacepost.dev. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | Trust anchor | 20326, 38696 | 8, 8 | Verified |
| dev. | DS published | 60074 | 8 | Verified |
| spacepost.dev. | No DS | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Challenged, unverified
The endpoint asked for a token, but we could not retrieve and validate the RFC 9728 metadata that tells a client how to obtain one.
| Result | Challenged, unverified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 200 |
Protected resource metadata
| Retrieved | No |
|---|---|
| Problem | No resource metadata |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://api.spacepost.dev/mcp | Verified | 200 | |
| http (plaintext) | http://api.spacepost.dev/mcp | HTTPS enforced | 301 | https://api.spacepost.dev/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
cancel_email Cancel a scheduled email ~52
Cancel a scheduled email. Requires a `full_access` API key. API: `POST /emails/{id}/cancel` (operationId `cancelEmail`, Emails).
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | The email id. |
No output schema declared.
No examples provided.
create_api_key Create an API key ~96
Create an API key. The `token` is returned only in this response. Requires a `full_access` API key. API: `POST /api-keys` (operationId `createApiKey`, API Keys).
| Name | Type | Req | Description |
|---|---|---|---|
| domain_id | string | – | Restrict a `sending_access` key to one of your domains. Not allowed with `full_access`. |
| name | string | yes | – |
| permission | string | – | – |
No output schema declared.
No examples provided.
create_audience Create an audience ~47
Create an audience. Requires a `full_access` API key. API: `POST /audiences` (operationId `createAudience`, Audiences).
| Name | Type | Req | Description |
|---|---|---|---|
| name | string | yes | – |
No output schema declared.
No examples provided.
create_broadcast Create a broadcast ~192
Create a broadcast. Creates a draft. The `from` address must belong to a verified domain of your team and `audience_id` to one of your audiences. Requires a `full_access` API key. API: `POST /broadcasts` (operationId `createBroadcast`, Broadcasts).
| Name | Type | Req | Description |
|---|---|---|---|
| audience_id | string | yes | – |
| from | string | yes | An email address, optionally with a display name: `Acme <hello@acme.com>`. At most 998 characters, display name included. A display name can't contain `<`, `>` or an encoded word, and a `from` name c… |
| html | string | – | – |
| name | string | – | Internal name |
| preview_text | string | – | – |
| reply_to | – | – | – |
| subject | string | yes | – |
| text | string | – | – |
No output schema declared.
No examples provided.
create_contact Create a contact ~98
Create a contact. Emails are lower-cased. An address can only appear once per audience. Requires a `full_access` API key. API: `POST /audiences/{audienceId}/contacts` (operationId `createContact`, Contacts).
| Name | Type | Req | Description |
|---|---|---|---|
| audience_id | string | yes | – |
| string | yes | – | |
| first_name | string | – | – |
| last_name | string | – | – |
| unsubscribed | boolean | – | – |
No output schema declared.
No examples provided.
create_domain Create a domain ~243
Create a domain. Registers a domain and returns the DNS records to add (three DKIM CNAMEs, plus MX and SPF on the MAIL FROM subdomain). Domain names are globally unique. The number of domains is limited by your plan (Free 3, Pro 10, Scale 1,000). The response lists the DNS records (DKIM CNAMEs, MAIL FROM MX and SPF TXT) the user must add at their DNS provider; afterwards call verify_domain and then get_domain to see the new status. DNS changes can take minutes to hours. Requires a `full_access` API key. API: `POST /domains` (operationId `createDomain`, Domains).
| Name | Type | Req | Description |
|---|---|---|---|
| custom_return_path | string | – | Subdomain used for the custom MAIL FROM (bounce handling and SPF). |
| name | string | yes | Domain or subdomain you own. Lower-cased. |
| region | string | – | Accepted for compatibility. The region is chosen by the platform and returned on the domain. |
| tenant_id | string | – | Platform mode. Make the domain tenant-owned (our tenant id or your `external_id`). Mail from it is attributed to that tenant. |
No output schema declared.
No examples provided.
create_suppression Add a suppression ~71
Add a suppression. Adds the address with reason `manual`. Adding an address that is already suppressed returns the existing entry. Requires a `full_access` API key. API: `POST /suppressions` (operationId `createSuppression`, Suppressions).
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | – |
No output schema declared.
No examples provided.
create_tenant Create a tenant ~123
Create a tenant. Creates one of your customers, with its own SES tenant (isolated reputation). `external_id` must be unique within your account. Requires a `full_access` API key. API: `POST /tenants` (operationId `createTenant`, Tenants).
| Name | Type | Req | Description |
|---|---|---|---|
| daily_limit | integer|null | – | Max recipients per day for this tenant. Omit or null for no cap. |
| external_id | string | – | Your own id for the customer. Unique per account; accepted wherever a tenant id is. |
| name | string | yes | – |
No output schema declared.
No examples provided.
create_webhook Create a webhook ~80
Create a webhook. In production the endpoint must use https and resolve to a public address. Requires a `full_access` API key. API: `POST /webhooks` (operationId `createWebhook`, Webhooks).
| Name | Type | Req | Description |
|---|---|---|---|
| endpoint | string | yes | Public URL that receives POST requests. https is required in production. |
| events | array | yes | – |
No output schema declared.
No examples provided.
delete_api_key Delete an API key ~66
Delete an API key. The key stops working immediately. The response body is an empty object. Requires a `full_access` API key. API: `DELETE /api-keys/{id}` (operationId `deleteApiKey`, API Keys).
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
No output schema declared.
No examples provided.
delete_audience Delete an audience ~54
Delete an audience. Also deletes its contacts. Requires a `full_access` API key. API: `DELETE /audiences/{id}` (operationId `deleteAudience`, Audiences).
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
No output schema declared.
No examples provided.
delete_broadcast Delete a broadcast ~63
Delete a broadcast. Only drafts and broadcasts that are scheduled for the future can be deleted. Requires a `full_access` API key. API: `DELETE /broadcasts/{id}` (operationId `deleteBroadcast`, Broadcasts).
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
No output schema declared.
No examples provided.
delete_contact Delete a contact ~77
Delete a contact. Requires a `full_access` API key. API: `DELETE /audiences/{audienceId}/contacts/{idOrEmail}` (operationId `deleteContact`, Contacts).
| Name | Type | Req | Description |
|---|---|---|---|
| audience_id | string | yes | – |
| id_or_email | string | yes | The contact id or its (URL-encoded) email address. |
No output schema declared.
No examples provided.
delete_domain Delete a domain ~46
Delete a domain. Requires a `full_access` API key. API: `DELETE /domains/{id}` (operationId `deleteDomain`, Domains).
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
No output schema declared.
No examples provided.
delete_suppression Remove a suppression ~69
Remove a suppression. Requires a `full_access` API key. API: `DELETE /suppressions/{idOrEmail}` (operationId `deleteSuppression`, Suppressions).
| Name | Type | Req | Description |
|---|---|---|---|
| id_or_email | string | yes | The suppression id or the (URL-encoded) email address. |
No output schema declared.
No examples provided.
delete_tenant Delete a tenant ~74
Delete a tenant. Fails with `422` while the tenant still has domains; delete those first. Requires a `full_access` API key. API: `DELETE /tenants/{ref}` (operationId `deleteTenant`, Tenants).
| Name | Type | Req | Description |
|---|---|---|---|
| ref | string | yes | The tenant id or your own `external_id`. |
No output schema declared.
No examples provided.
delete_webhook Delete a webhook ~49
Delete a webhook. Requires a `full_access` API key. API: `DELETE /webhooks/{id}` (operationId `deleteWebhook`, Webhooks).
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
No output schema declared.
No examples provided.
get_audience Retrieve an audience ~49
Retrieve an audience. Requires a `full_access` API key. API: `GET /audiences/{id}` (operationId `getAudience`, Audiences).
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
No output schema declared.
No examples provided.
get_broadcast Retrieve a broadcast ~49
Retrieve a broadcast. Requires a `full_access` API key. API: `GET /broadcasts/{id}` (operationId `getBroadcast`, Broadcasts).
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
No output schema declared.
No examples provided.
get_broadcast_readiness Check a broadcast before sending ~147
Check a broadcast before sending. SpacePost extension (not part of Resend). Returns a deliverability checklist: sender domain and DMARC, subject, Gmail clipping (HTML over 102 KB), image-heavy bodies, link shorteners, spam phrases, unsubscribe link and audience quality. `ready` is false when any check has level `error`; `POST /broadcasts/{id}/send` is then refused with `validation_error`. Warnings never block a send. Requires a `full_access` API key. API: `GET /broadcasts/{id}/readiness` (operationId `getBroadcastReadiness`, Broadcasts).
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
No output schema declared.
No examples provided.
get_contact Retrieve a contact ~77
Retrieve a contact. Requires a `full_access` API key. API: `GET /audiences/{audienceId}/contacts/{idOrEmail}` (operationId `getContact`, Contacts).
| Name | Type | Req | Description |
|---|---|---|---|
| audience_id | string | yes | – |
| id_or_email | string | yes | The contact id or its (URL-encoded) email address. |
No output schema declared.
No examples provided.
get_domain Retrieve a domain ~46
Retrieve a domain. Requires a `full_access` API key. API: `GET /domains/{id}` (operationId `getDomain`, Domains).
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
No output schema declared.
No examples provided.
get_email Retrieve an email ~49
Retrieve an email. Requires a `full_access` API key. API: `GET /emails/{id}` (operationId `getEmail`, Emails).
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | The email id. |
No output schema declared.
No examples provided.
get_tenant Retrieve a tenant ~58
Retrieve a tenant. Requires a `full_access` API key. API: `GET /tenants/{ref}` (operationId `getTenant`, Tenants).
| Name | Type | Req | Description |
|---|---|---|---|
| ref | string | yes | The tenant id or your own `external_id`. |
No output schema declared.
No examples provided.
get_webhook Retrieve a webhook ~49
Retrieve a webhook. Requires a `full_access` API key. API: `GET /webhooks/{id}` (operationId `getWebhook`, Webhooks).
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
No output schema declared.
No examples provided.
list_api_keys List API keys ~100
List API keys. Requires a `full_access` API key. API: `GET /api-keys` (operationId `listApiKeys`, API Keys).
| Name | Type | Req | Description |
|---|---|---|---|
| after | string | – | Return items older than this id (next page). Cannot be combined with `before`. |
| before | string | – | Return items newer than this id (previous page). Cannot be combined with `after`. |
| limit | integer | – | Number of items to return. |
No output schema declared.
No examples provided.
list_audiences List audiences ~99
List audiences. Requires a `full_access` API key. API: `GET /audiences` (operationId `listAudiences`, Audiences).
| Name | Type | Req | Description |
|---|---|---|---|
| after | string | – | Return items older than this id (next page). Cannot be combined with `before`. |
| before | string | – | Return items newer than this id (previous page). Cannot be combined with `after`. |
| limit | integer | – | Number of items to return. |
No output schema declared.
No examples provided.
list_broadcasts List broadcasts ~99
List broadcasts. Requires a `full_access` API key. API: `GET /broadcasts` (operationId `listBroadcasts`, Broadcasts).
| Name | Type | Req | Description |
|---|---|---|---|
| after | string | – | Return items older than this id (next page). Cannot be combined with `before`. |
| before | string | – | Return items newer than this id (previous page). Cannot be combined with `after`. |
| limit | integer | – | Number of items to return. |
No output schema declared.
No examples provided.
list_contacts List contacts ~109
List contacts. Requires a `full_access` API key. API: `GET /audiences/{audienceId}/contacts` (operationId `listContacts`, Contacts).
| Name | Type | Req | Description |
|---|---|---|---|
| after | string | – | Return items older than this id (next page). Cannot be combined with `before`. |
| audience_id | string | yes | – |
| before | string | – | Return items newer than this id (previous page). Cannot be combined with `after`. |
| limit | integer | – | Number of items to return. |
No output schema declared.
No examples provided.
list_domains List domains ~94
List domains. Requires a `full_access` API key. API: `GET /domains` (operationId `listDomains`, Domains).
| Name | Type | Req | Description |
|---|---|---|---|
| after | string | – | Return items older than this id (next page). Cannot be combined with `before`. |
| before | string | – | Return items newer than this id (previous page). Cannot be combined with `after`. |
| limit | integer | – | Number of items to return. |
No output schema declared.
No examples provided.
list_emails List emails ~107
List emails. Returns sent and scheduled emails, newest first, without bodies. Requires a `full_access` API key. API: `GET /emails` (operationId `listEmails`, Emails).
| Name | Type | Req | Description |
|---|---|---|---|
| after | string | – | Return items older than this id (next page). Cannot be combined with `before`. |
| before | string | – | Return items newer than this id (previous page). Cannot be combined with `after`. |
| limit | integer | – | Number of items to return. |
No output schema declared.
No examples provided.
list_suppressions List suppressions ~102
List suppressions. Requires a `full_access` API key. API: `GET /suppressions` (operationId `listSuppressions`, Suppressions).
| Name | Type | Req | Description |
|---|---|---|---|
| after | string | – | Return items older than this id (next page). Cannot be combined with `before`. |
| before | string | – | Return items newer than this id (previous page). Cannot be combined with `after`. |
| limit | integer | – | Number of items to return. |
No output schema declared.
No examples provided.
list_tenants List tenants ~98
List tenants. Requires a `full_access` API key. API: `GET /tenants` (operationId `listTenants`, Tenants).
| Name | Type | Req | Description |
|---|---|---|---|
| after | string | – | Return items older than this id (next page). Cannot be combined with `before`. |
| before | string | – | Return items newer than this id (previous page). Cannot be combined with `after`. |
| limit | integer | – | Number of items to return. |
No output schema declared.
No examples provided.
list_webhooks List webhooks ~99
List webhooks. Requires a `full_access` API key. API: `GET /webhooks` (operationId `listWebhooks`, Webhooks).
| Name | Type | Req | Description |
|---|---|---|---|
| after | string | – | Return items older than this id (next page). Cannot be combined with `before`. |
| before | string | – | Return items newer than this id (previous page). Cannot be combined with `after`. |
| limit | integer | – | Number of items to return. |
No output schema declared.
No examples provided.
pause_tenant Pause a tenant ~103
Pause a tenant. Stops all sending for the tenant. Sends return `403 sending_paused`; emails already queued fail. The body is optional. Requires a `full_access` API key. API: `POST /tenants/{ref}/pause` (operationId `pauseTenant`, Tenants).
| Name | Type | Req | Description |
|---|---|---|---|
| reason | string | – | Stored as `paused_reason`. Defaults to a generic reason. |
| ref | string | yes | The tenant id or your own `external_id`. |
No output schema declared.
No examples provided.
send_batch_emails Send batch emails ~166
Send batch emails. Sends up to 100 emails in one call. All-or-nothing, if any email is invalid none are sent. Attachments, `scheduled_at` and a per-email `tenant_id` are supported; the paused-tenant and tenant-cap errors apply to the whole batch. Put the emails in `body` as an array. Prefer send_email for a single message. Works with a `sending_access` or `full_access` API key. API: `POST /emails/batch` (operationId `sendBatchEmails`, Emails).
| Name | Type | Req | Description |
|---|---|---|---|
| body | array | yes | The JSON request body. |
| idempotency_key | string | – | A unique key (1 to 256 characters) that makes the request safe to retry for 24 hours. |
No output schema declared.
No examples provided.
send_broadcast Send or schedule a broadcast ~160
Send or schedule a broadcast. Queues a draft for delivery to every subscribed contact of its audience. The broadcast needs `html` or `text`. Without `scheduled_at` it starts immediately; the status becomes `queued`, then `sending` and `sent`. Sends to every subscribed contact in the audience. Run get_broadcast_readiness first and confirm with the user. Requires a `full_access` API key. API: `POST /broadcasts/{id}/send` (operationId `sendBroadcast`, Broadcasts).
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
| scheduled_at | string | – | ISO 8601 date-time or natural language such as "in 1 hour" or "in 2 days". At most 30 days ahead. |
No output schema declared.
No examples provided.
send_email Send an email ~522
Send an email. Validates and queues one email. Each recipient counts towards your quota. Use `scheduled_at` to send later (up to 30 days ahead). Pass `tenant_id` to send on behalf of a tenant (not needed when the `from` domain belongs to one). Fails with `422` if `tenant_id` conflicts with the domain's tenant, `403 sending_paused` if the tenant is paused and `429 daily_quota_exceeded` if it reached its daily cap. `from` must be on a verified domain (e.g. "Acme <hi@acme.com>"); call list_domains to find one. Provide `html`, `text` or both. Send to delivered@test.spacepost.dev (or bounced@ / complained@) to test without sending real mail. Delivered email cannot be recalled: confirm recipients and content with the user when unsure. Pass `idempotency_key` when retrying so the email is not sent twice. Request body: Either `html` or `text` is required. `reply_to` is also accepted as `replyTo` and `scheduled_at` as `scheduledAt`. Works with a `sending_access` or `full_access` API key. API: `POST /emails` (operationId `sendEmail`, Emails).
| Name | Type | Req | Description |
|---|---|---|---|
| attachments | array | – | – |
| bcc | – | – | – |
| cc | – | – | – |
| from | string | yes | An email address, optionally with a display name: `Acme <hello@acme.com>`. At most 998 characters, display name included. A display name can't contain `<`, `>` or an encoded word, and a `from` name c… |
| headers | object | – | – |
| html | string | – | – |
| idempotency_key | string | – | A unique key (1 to 256 characters) that makes the request safe to retry for 24 hours. |
| reply_to | – | – | – |
| scheduled_at | string | – | ISO 8601 date-time or natural language such as "in 1 hour" or "in 2 days". At most 30 days ahead. |
| subject | string | yes | – |
| tags | array | – | – |
| tenant_id | string | – | Platform mode. Our tenant id or your `external_id`. Optional when the `from` domain belongs to a tenant; a conflict with the domain's tenant is a 422. |
| text | string | – | – |
| to | – | yes | – |
No output schema declared.
No examples provided.
unpause_tenant Unpause a tenant ~112
Unpause a tenant. Resumes sending. A tenant that was paused by the reputation guard (bounce or complaint rate) can only be unpaused by a `trusted` or `internal` team; others get `403 invalid_access` and should contact support. Requires a `full_access` API key. API: `POST /tenants/{ref}/unpause` (operationId `unpauseTenant`, Tenants).
| Name | Type | Req | Description |
|---|---|---|---|
| ref | string | yes | The tenant id or your own `external_id`. |
No output schema declared.
No examples provided.
update_broadcast Update a broadcast ~191
Update a broadcast. Only drafts can be updated. Request body: Any field of the create request; only drafts can be updated. Requires a `full_access` API key. API: `PATCH /broadcasts/{id}` (operationId `updateBroadcast`, Broadcasts).
| Name | Type | Req | Description |
|---|---|---|---|
| audience_id | string | – | – |
| from | string | – | An email address, optionally with a display name: `Acme <hello@acme.com>`. At most 998 characters, display name included. A display name can't contain `<`, `>` or an encoded word, and a `from` name c… |
| html | string | – | – |
| id | string | yes | – |
| name | string | – | – |
| preview_text | string | – | – |
| reply_to | – | – | – |
| subject | string | – | – |
| text | string | – | – |
No output schema declared.
No examples provided.
update_contact Update a contact ~101
Update a contact. Requires a `full_access` API key. API: `PATCH /audiences/{audienceId}/contacts/{idOrEmail}` (operationId `updateContact`, Contacts).
| Name | Type | Req | Description |
|---|---|---|---|
| audience_id | string | yes | – |
| first_name | string | – | – |
| id_or_email | string | yes | The contact id or its (URL-encoded) email address. |
| last_name | string | – | – |
| unsubscribed | boolean | – | – |
No output schema declared.
No examples provided.
update_domain Update a domain ~77
Update a domain. Toggles open and click tracking. Requires a `full_access` API key. API: `PATCH /domains/{id}` (operationId `updateDomain`, Domains).
| Name | Type | Req | Description |
|---|---|---|---|
| click_tracking | boolean | – | – |
| id | string | yes | – |
| open_tracking | boolean | – | – |
| tls | string | – | – |
No output schema declared.
No examples provided.
update_email Reschedule an email ~102
Reschedule an email. Changes `scheduled_at` of an email that is still `scheduled`. Requires a `full_access` API key. API: `PATCH /emails/{id}` (operationId `updateEmail`, Emails).
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | The email id. |
| scheduled_at | string | yes | ISO 8601 date-time or natural language such as "in 1 hour" or "in 2 days". At most 30 days ahead. |
No output schema declared.
No examples provided.
update_tenant Update a tenant ~106
Update a tenant. Changes the name, `external_id` or `daily_limit` (`null` removes the cap). Requires a `full_access` API key. API: `PATCH /tenants/{ref}` (operationId `updateTenant`, Tenants).
| Name | Type | Req | Description |
|---|---|---|---|
| daily_limit | integer|null | – | Null removes the cap. |
| external_id | string | – | – |
| name | string | – | – |
| ref | string | yes | The tenant id or your own `external_id`. |
No output schema declared.
No examples provided.
update_webhook Update a webhook ~70
Update a webhook. Requires a `full_access` API key. API: `PATCH /webhooks/{id}` (operationId `updateWebhook`, Webhooks).
| Name | Type | Req | Description |
|---|---|---|---|
| endpoint | string | – | – |
| events | array | – | – |
| id | string | yes | – |
| status | string | – | – |
No output schema declared.
No examples provided.
verify_domain Verify a domain ~70
Verify a domain. Re-checks DNS now. Retrieve the domain afterwards to read the new `status` and per-record statuses. Requires a `full_access` API key. API: `POST /domains/{id}/verify` (operationId `verifyDomain`, Domains).
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | – |
No output schema declared.
No examples provided.
How do I install the SpacePost MCP server?
SpacePost is a hosted endpoint at https://api.spacepost.dev/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · api.spacepost.dev
claude mcp add --transport http dev-spacepost-mcp 'https://api.spacepost.dev/mcp'
What is the SpacePost MCP server?
SpacePost is an MCP server listed in the public MCP registry as dev.spacepost/mcp. Send email and manage domains, contacts and webhooks on SpacePost, the Resend-compatible email API. This page covers its hosted endpoint (https://api.spacepost.dev/mcp).
Is the SpacePost MCP server safe to use?
SpacePost scores 75 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the SpacePost MCP server expose?
SpacePost exposes 46 tools: list_emails, send_email, send_batch_emails, get_email, update_email, and 41 more. Their descriptions and schemas cost roughly 4,711 tokens of context every time the server is loaded.
Does the SpacePost MCP server require authentication?
Yes. SpacePost asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the SpacePost MCP server still maintained?
SpacePost is still listed as active in the MCP registry. We last reached this channel on 6 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What did VerifyMCP test on the SpacePost MCP server?
VerifyMCP ran 13 checks on SpacePost, covering TLS certificate, Authorization, HTTPS, HSTS header and 9 more. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.