# SpacePost (remote · api.spacepost.dev)

Send email and manage domains, contacts and webhooks on SpacePost, the Resend-compatible email API.

- Trust score: 75/100 (medium)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-06

## Components

- remote · `api.spacepost.dev`: 75/100 (this document), [markdown](https://verifymcp.io/servers/dev-spacepost-mcp/api.md), [page](https://verifymcp.io/servers/dev-spacepost-mcp/api)
- npm · `@spacepost/mcp`: 38/100, [markdown](https://verifymcp.io/servers/dev-spacepost-mcp/spacepost-mcp.md), [page](https://verifymcp.io/servers/dev-spacepost-mcp/spacepost-mcp)

## Channel facts

- Endpoint: `https://api.spacepost.dev/mcp`
- Transports: `streamable-http`
- Auth: `required (not validated)`
- Version: `0.2.2`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-06.

- **Endpoint Security**: 83/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation is enforced on tool calls, but the challenge carries no valid RFC 9728 metadata, so a client cannot discover where to get a token.
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 67/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 4787 tokens (~104/item across 46 items; 46 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 83/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 48% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 11 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 47 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the SpacePost MCP server?

SpacePost is a hosted endpoint at https://api.spacepost.dev/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http dev-spacepost-mcp 'https://api.spacepost.dev/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "dev-spacepost-mcp": {
      "url": "https://api.spacepost.dev/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "dev-spacepost-mcp": {
      "type": "http",
      "url": "https://api.spacepost.dev/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.dev-spacepost-mcp]
url = "https://api.spacepost.dev/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "dev-spacepost-mcp": {
      "type": "remote",
      "url": "https://api.spacepost.dev/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add dev-spacepost-mcp --url 'https://api.spacepost.dev/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  dev-spacepost-mcp:
    url: "https://api.spacepost.dev/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "dev-spacepost-mcp": {
      "Transport": "http",
      "Url": "https://api.spacepost.dev/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add dev-spacepost-mcp -t streamable-http -u 'https://api.spacepost.dev/mcp'
```

### Other

```json
{
  "mcpServers": {
    "dev-spacepost-mcp": {
      "type": "http",
      "url": "https://api.spacepost.dev/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-06 (score 75, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-11-05 (score 74, +70)

The score moved with no change recorded against any check. We would rather say so than guess.

### 2026-11-04 (score 4, −70)

- [security regression] Endpoint reachability: reachable → unreachable
- [security regression] Authorization: fail → unverified
- [security regression] HSTS header: fail → unverified
- [security regression] Stability: 0.13 → unverified
- [security regression] TLS certificate: pass → unverified
- [security regression] Tool safety: pass → unverified
- [security regression] Transport: pass → fail
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: pass → fail
- [functional] First check of Schema quality: unverified
- [cosmetic] “create_broadcast” reworded the description of “from”
- [cosmetic] “send_email” reworded the description of “from”
- [cosmetic] “update_broadcast” reworded the description of “from”

### 2026-11-03 (score 74, +1)

No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-01 (score 73, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-31 (score 72, 0)

- [functional improvement] Stability: unverified → 0.03

### 2026-10-30 (score 72)

First indexed and scored.

## MCP tools (46)

### `list_emails` (~107 tokens)

List emails

List emails.

Returns sent and scheduled emails, newest first, without bodies.

Requires a `full_access` API key. API: `GET /emails` (operationId `listEmails`, Emails).

Input parameters:

- `after` (string): Return items older than this id (next page). Cannot be combined with `before`.
- `before` (string): Return items newer than this id (previous page). Cannot be combined with `after`.
- `limit` (integer): Number of items to return.

### `send_email` (~522 tokens)

Send an email

Send an email.

Validates and queues one email. Each recipient counts towards your quota. Use `scheduled_at` to send later (up to 30 days ahead). Pass `tenant_id` to send on behalf of a tenant (not needed when the `from` domain belongs to one). Fails with `422` if `tenant_id` conflicts with the domain's tenant, `403 sending_paused` if the tenant is paused and `429 daily_quota_exceeded` if it reached its daily cap.

\`from` must be on a verified domain (e.g. "Acme <hi@acme.com>"); call list_domains to find one. Provide `html`, `text` or both. Send to delivered@test.spacepost.dev (or bounced@ / complained@) to test without sending real mail. Delivered email cannot be recalled: confirm recipients and content with the user when unsure. Pass `idempotency_key` when retrying so the email is not sent twice.

Request body: Either `html` or `text` is required. `reply_to` is also accepted as `replyTo` and `scheduled_at` as `scheduledAt`.

Works with a `sending_access` or `full_access` API key. API: `POST /emails` (operationId `sendEmail`, Emails).

Input parameters:

- `attachments` (array)
- `bcc`
- `cc`
- `from` (string, required): An email address, optionally with a display name: `Acme <hello@acme.com>`. At most 998 characters, display name included. A display name can't contain `<`, `>` or an encoded word, and a `from` name c…
- `headers` (object)
- `html` (string)
- `idempotency_key` (string): A unique key (1 to 256 characters) that makes the request safe to retry for 24 hours.
- `reply_to`
- `scheduled_at` (string): ISO 8601 date-time or natural language such as "in 1 hour" or "in 2 days". At most 30 days ahead.
- `subject` (string, required)
- `tags` (array)
- `tenant_id` (string): Platform mode. Our tenant id or your `external_id`. Optional when the `from` domain belongs to a tenant; a conflict with the domain's tenant is a 422.
- `text` (string)
- `to` (required)

### `send_batch_emails` (~166 tokens)

Send batch emails

Send batch emails.

Sends up to 100 emails in one call. All-or-nothing, if any email is invalid none are sent. Attachments, `scheduled_at` and a per-email `tenant_id` are supported; the paused-tenant and tenant-cap errors apply to the whole batch.

Put the emails in `body` as an array. Prefer send_email for a single message.

Works with a `sending_access` or `full_access` API key. API: `POST /emails/batch` (operationId `sendBatchEmails`, Emails).

Input parameters:

- `body` (array, required): The JSON request body.
- `idempotency_key` (string): A unique key (1 to 256 characters) that makes the request safe to retry for 24 hours.

### `get_email` (~49 tokens)

Retrieve an email

Retrieve an email.

Requires a `full_access` API key. API: `GET /emails/{id}` (operationId `getEmail`, Emails).

Input parameters:

- `id` (string, required): The email id.

### `update_email` (~102 tokens)

Reschedule an email

Reschedule an email.

Changes `scheduled_at` of an email that is still `scheduled`.

Requires a `full_access` API key. API: `PATCH /emails/{id}` (operationId `updateEmail`, Emails).

Input parameters:

- `id` (string, required): The email id.
- `scheduled_at` (string, required): ISO 8601 date-time or natural language such as "in 1 hour" or "in 2 days". At most 30 days ahead.

### `cancel_email` (~52 tokens)

Cancel a scheduled email

Cancel a scheduled email.

Requires a `full_access` API key. API: `POST /emails/{id}/cancel` (operationId `cancelEmail`, Emails).

Input parameters:

- `id` (string, required): The email id.

### `list_domains` (~94 tokens)

List domains

List domains.

Requires a `full_access` API key. API: `GET /domains` (operationId `listDomains`, Domains).

Input parameters:

- `after` (string): Return items older than this id (next page). Cannot be combined with `before`.
- `before` (string): Return items newer than this id (previous page). Cannot be combined with `after`.
- `limit` (integer): Number of items to return.

### `create_domain` (~243 tokens)

Create a domain

Create a domain.

Registers a domain and returns the DNS records to add (three DKIM CNAMEs, plus MX and SPF on the MAIL FROM subdomain).
Domain names are globally unique. The number of domains is limited by your plan (Free 3, Pro 10, Scale 1,000).

The response lists the DNS records (DKIM CNAMEs, MAIL FROM MX and SPF TXT) the user must add at their DNS provider; afterwards call verify_domain and then get_domain to see the new status. DNS changes can take minutes to hours.

Requires a `full_access` API key. API: `POST /domains` (operationId `createDomain`, Domains).

Input parameters:

- `custom_return_path` (string): Subdomain used for the custom MAIL FROM (bounce handling and SPF).
- `name` (string, required): Domain or subdomain you own. Lower-cased.
- `region` (string): Accepted for compatibility. The region is chosen by the platform and returned on the domain.
- `tenant_id` (string): Platform mode. Make the domain tenant-owned (our tenant id or your `external_id`). Mail from it is attributed to that tenant.

### `get_domain` (~46 tokens)

Retrieve a domain

Retrieve a domain.

Requires a `full_access` API key. API: `GET /domains/{id}` (operationId `getDomain`, Domains).

Input parameters:

- `id` (string, required)

### `update_domain` (~77 tokens)

Update a domain

Update a domain.

Toggles open and click tracking.

Requires a `full_access` API key. API: `PATCH /domains/{id}` (operationId `updateDomain`, Domains).

Input parameters:

- `click_tracking` (boolean)
- `id` (string, required)
- `open_tracking` (boolean)
- `tls` (string)

### `delete_domain` (~46 tokens)

Delete a domain

Delete a domain.

Requires a `full_access` API key. API: `DELETE /domains/{id}` (operationId `deleteDomain`, Domains).

Input parameters:

- `id` (string, required)

### `verify_domain` (~70 tokens)

Verify a domain

Verify a domain.

Re-checks DNS now. Retrieve the domain afterwards to read the new `status` and per-record statuses.

Requires a `full_access` API key. API: `POST /domains/{id}/verify` (operationId `verifyDomain`, Domains).

Input parameters:

- `id` (string, required)

### `list_api_keys` (~100 tokens)

List API keys

List API keys.

Requires a `full_access` API key. API: `GET /api-keys` (operationId `listApiKeys`, API Keys).

Input parameters:

- `after` (string): Return items older than this id (next page). Cannot be combined with `before`.
- `before` (string): Return items newer than this id (previous page). Cannot be combined with `after`.
- `limit` (integer): Number of items to return.

### `create_api_key` (~96 tokens)

Create an API key

Create an API key.

The `token` is returned only in this response.

Requires a `full_access` API key. API: `POST /api-keys` (operationId `createApiKey`, API Keys).

Input parameters:

- `domain_id` (string): Restrict a `sending_access` key to one of your domains. Not allowed with `full_access`.
- `name` (string, required)
- `permission` (string)

### `delete_api_key` (~66 tokens)

Delete an API key

Delete an API key.

The key stops working immediately. The response body is an empty object.

Requires a `full_access` API key. API: `DELETE /api-keys/{id}` (operationId `deleteApiKey`, API Keys).

Input parameters:

- `id` (string, required)

### `list_webhooks` (~99 tokens)

List webhooks

List webhooks.

Requires a `full_access` API key. API: `GET /webhooks` (operationId `listWebhooks`, Webhooks).

Input parameters:

- `after` (string): Return items older than this id (next page). Cannot be combined with `before`.
- `before` (string): Return items newer than this id (previous page). Cannot be combined with `after`.
- `limit` (integer): Number of items to return.

### `create_webhook` (~80 tokens)

Create a webhook

Create a webhook.

In production the endpoint must use https and resolve to a public address.

Requires a `full_access` API key. API: `POST /webhooks` (operationId `createWebhook`, Webhooks).

Input parameters:

- `endpoint` (string, required): Public URL that receives POST requests. https is required in production.
- `events` (array, required)

### `get_webhook` (~49 tokens)

Retrieve a webhook

Retrieve a webhook.

Requires a `full_access` API key. API: `GET /webhooks/{id}` (operationId `getWebhook`, Webhooks).

Input parameters:

- `id` (string, required)

### `update_webhook` (~70 tokens)

Update a webhook

Update a webhook.

Requires a `full_access` API key. API: `PATCH /webhooks/{id}` (operationId `updateWebhook`, Webhooks).

Input parameters:

- `endpoint` (string)
- `events` (array)
- `id` (string, required)
- `status` (string)

### `delete_webhook` (~49 tokens)

Delete a webhook

Delete a webhook.

Requires a `full_access` API key. API: `DELETE /webhooks/{id}` (operationId `deleteWebhook`, Webhooks).

Input parameters:

- `id` (string, required)

### `list_audiences` (~99 tokens)

List audiences

List audiences.

Requires a `full_access` API key. API: `GET /audiences` (operationId `listAudiences`, Audiences).

Input parameters:

- `after` (string): Return items older than this id (next page). Cannot be combined with `before`.
- `before` (string): Return items newer than this id (previous page). Cannot be combined with `after`.
- `limit` (integer): Number of items to return.

### `create_audience` (~47 tokens)

Create an audience

Create an audience.

Requires a `full_access` API key. API: `POST /audiences` (operationId `createAudience`, Audiences).

Input parameters:

- `name` (string, required)

### `get_audience` (~49 tokens)

Retrieve an audience

Retrieve an audience.

Requires a `full_access` API key. API: `GET /audiences/{id}` (operationId `getAudience`, Audiences).

Input parameters:

- `id` (string, required)

### `delete_audience` (~54 tokens)

Delete an audience

Delete an audience.

Also deletes its contacts.

Requires a `full_access` API key. API: `DELETE /audiences/{id}` (operationId `deleteAudience`, Audiences).

Input parameters:

- `id` (string, required)

### `list_contacts` (~109 tokens)

List contacts

List contacts.

Requires a `full_access` API key. API: `GET /audiences/{audienceId}/contacts` (operationId `listContacts`, Contacts).

Input parameters:

- `after` (string): Return items older than this id (next page). Cannot be combined with `before`.
- `audience_id` (string, required)
- `before` (string): Return items newer than this id (previous page). Cannot be combined with `after`.
- `limit` (integer): Number of items to return.

### `create_contact` (~98 tokens)

Create a contact

Create a contact.

Emails are lower-cased. An address can only appear once per audience.

Requires a `full_access` API key. API: `POST /audiences/{audienceId}/contacts` (operationId `createContact`, Contacts).

Input parameters:

- `audience_id` (string, required)
- `email` (string, required)
- `first_name` (string)
- `last_name` (string)
- `unsubscribed` (boolean)

### `get_contact` (~77 tokens)

Retrieve a contact

Retrieve a contact.

Requires a `full_access` API key. API: `GET /audiences/{audienceId}/contacts/{idOrEmail}` (operationId `getContact`, Contacts).

Input parameters:

- `audience_id` (string, required)
- `id_or_email` (string, required): The contact id or its (URL-encoded) email address.

### `update_contact` (~101 tokens)

Update a contact

Update a contact.

Requires a `full_access` API key. API: `PATCH /audiences/{audienceId}/contacts/{idOrEmail}` (operationId `updateContact`, Contacts).

Input parameters:

- `audience_id` (string, required)
- `first_name` (string)
- `id_or_email` (string, required): The contact id or its (URL-encoded) email address.
- `last_name` (string)
- `unsubscribed` (boolean)

### `delete_contact` (~77 tokens)

Delete a contact

Delete a contact.

Requires a `full_access` API key. API: `DELETE /audiences/{audienceId}/contacts/{idOrEmail}` (operationId `deleteContact`, Contacts).

Input parameters:

- `audience_id` (string, required)
- `id_or_email` (string, required): The contact id or its (URL-encoded) email address.

### `list_broadcasts` (~99 tokens)

List broadcasts

List broadcasts.

Requires a `full_access` API key. API: `GET /broadcasts` (operationId `listBroadcasts`, Broadcasts).

Input parameters:

- `after` (string): Return items older than this id (next page). Cannot be combined with `before`.
- `before` (string): Return items newer than this id (previous page). Cannot be combined with `after`.
- `limit` (integer): Number of items to return.

### `create_broadcast` (~192 tokens)

Create a broadcast

Create a broadcast.

Creates a draft. The `from` address must belong to a verified domain of your team and `audience_id` to one of your audiences.

Requires a `full_access` API key. API: `POST /broadcasts` (operationId `createBroadcast`, Broadcasts).

Input parameters:

- `audience_id` (string, required)
- `from` (string, required): An email address, optionally with a display name: `Acme <hello@acme.com>`. At most 998 characters, display name included. A display name can't contain `<`, `>` or an encoded word, and a `from` name c…
- `html` (string)
- `name` (string): Internal name
- `preview_text` (string)
- `reply_to`
- `subject` (string, required)
- `text` (string)

### `get_broadcast` (~49 tokens)

Retrieve a broadcast

Retrieve a broadcast.

Requires a `full_access` API key. API: `GET /broadcasts/{id}` (operationId `getBroadcast`, Broadcasts).

Input parameters:

- `id` (string, required)

### `update_broadcast` (~191 tokens)

Update a broadcast

Update a broadcast.

Only drafts can be updated.

Request body: Any field of the create request; only drafts can be updated.

Requires a `full_access` API key. API: `PATCH /broadcasts/{id}` (operationId `updateBroadcast`, Broadcasts).

Input parameters:

- `audience_id` (string)
- `from` (string): An email address, optionally with a display name: `Acme <hello@acme.com>`. At most 998 characters, display name included. A display name can't contain `<`, `>` or an encoded word, and a `from` name c…
- `html` (string)
- `id` (string, required)
- `name` (string)
- `preview_text` (string)
- `reply_to`
- `subject` (string)
- `text` (string)

### `delete_broadcast` (~63 tokens)

Delete a broadcast

Delete a broadcast.

Only drafts and broadcasts that are scheduled for the future can be deleted.

Requires a `full_access` API key. API: `DELETE /broadcasts/{id}` (operationId `deleteBroadcast`, Broadcasts).

Input parameters:

- `id` (string, required)

### `get_broadcast_readiness` (~147 tokens)

Check a broadcast before sending

Check a broadcast before sending.

SpacePost extension (not part of Resend). Returns a deliverability checklist: sender domain and DMARC, subject, Gmail
clipping (HTML over 102 KB), image-heavy bodies, link shorteners, spam phrases, unsubscribe link and audience quality.
\`ready` is false when any check has level `error`; `POST /broadcasts/{id}/send` is then refused with `validation_error`.
Warnings never block a send.

Requires a `full_access` API key. API: `GET /broadcasts/{id}/readiness` (operationId `getBroadcastReadiness`, Broadcasts).

Input parameters:

- `id` (string, required)

### `send_broadcast` (~160 tokens)

Send or schedule a broadcast

Send or schedule a broadcast.

Queues a draft for delivery to every subscribed contact of its audience. The broadcast needs `html` or `text`.
Without `scheduled_at` it starts immediately; the status becomes `queued`, then `sending` and `sent`.

Sends to every subscribed contact in the audience. Run get_broadcast_readiness first and confirm with the user.

Requires a `full_access` API key. API: `POST /broadcasts/{id}/send` (operationId `sendBroadcast`, Broadcasts).

Input parameters:

- `id` (string, required)
- `scheduled_at` (string): ISO 8601 date-time or natural language such as "in 1 hour" or "in 2 days". At most 30 days ahead.

### `list_suppressions` (~102 tokens)

List suppressions

List suppressions.

Requires a `full_access` API key. API: `GET /suppressions` (operationId `listSuppressions`, Suppressions).

Input parameters:

- `after` (string): Return items older than this id (next page). Cannot be combined with `before`.
- `before` (string): Return items newer than this id (previous page). Cannot be combined with `after`.
- `limit` (integer): Number of items to return.

### `create_suppression` (~71 tokens)

Add a suppression

Add a suppression.

Adds the address with reason `manual`. Adding an address that is already suppressed returns the existing entry.

Requires a `full_access` API key. API: `POST /suppressions` (operationId `createSuppression`, Suppressions).

Input parameters:

- `email` (string, required)

### `delete_suppression` (~69 tokens)

Remove a suppression

Remove a suppression.

Requires a `full_access` API key. API: `DELETE /suppressions/{idOrEmail}` (operationId `deleteSuppression`, Suppressions).

Input parameters:

- `id_or_email` (string, required): The suppression id or the (URL-encoded) email address.

### `list_tenants` (~98 tokens)

List tenants

List tenants.

Requires a `full_access` API key. API: `GET /tenants` (operationId `listTenants`, Tenants).

Input parameters:

- `after` (string): Return items older than this id (next page). Cannot be combined with `before`.
- `before` (string): Return items newer than this id (previous page). Cannot be combined with `after`.
- `limit` (integer): Number of items to return.

### `create_tenant` (~123 tokens)

Create a tenant

Create a tenant.

Creates one of your customers, with its own SES tenant (isolated reputation). `external_id` must be unique within your account.

Requires a `full_access` API key. API: `POST /tenants` (operationId `createTenant`, Tenants).

Input parameters:

- `daily_limit` (integer|null): Max recipients per day for this tenant. Omit or null for no cap.
- `external_id` (string): Your own id for the customer. Unique per account; accepted wherever a tenant id is.
- `name` (string, required)

### `get_tenant` (~58 tokens)

Retrieve a tenant

Retrieve a tenant.

Requires a `full_access` API key. API: `GET /tenants/{ref}` (operationId `getTenant`, Tenants).

Input parameters:

- `ref` (string, required): The tenant id or your own `external_id`.

### `update_tenant` (~106 tokens)

Update a tenant

Update a tenant.

Changes the name, `external_id` or `daily_limit` (`null` removes the cap).

Requires a `full_access` API key. API: `PATCH /tenants/{ref}` (operationId `updateTenant`, Tenants).

Input parameters:

- `daily_limit` (integer|null): Null removes the cap.
- `external_id` (string)
- `name` (string)
- `ref` (string, required): The tenant id or your own `external_id`.

### `delete_tenant` (~74 tokens)

Delete a tenant

Delete a tenant.

Fails with `422` while the tenant still has domains; delete those first.

Requires a `full_access` API key. API: `DELETE /tenants/{ref}` (operationId `deleteTenant`, Tenants).

Input parameters:

- `ref` (string, required): The tenant id or your own `external_id`.

### `pause_tenant` (~103 tokens)

Pause a tenant

Pause a tenant.

Stops all sending for the tenant. Sends return `403 sending_paused`; emails already queued fail. The body is optional.

Requires a `full_access` API key. API: `POST /tenants/{ref}/pause` (operationId `pauseTenant`, Tenants).

Input parameters:

- `reason` (string): Stored as `paused_reason`. Defaults to a generic reason.
- `ref` (string, required): The tenant id or your own `external_id`.

### `unpause_tenant` (~112 tokens)

Unpause a tenant

Unpause a tenant.

Resumes sending. A tenant that was paused by the reputation guard (bounce or complaint rate) can only be unpaused by a
\`trusted` or `internal` team; others get `403 invalid_access` and should contact support.

Requires a `full_access` API key. API: `POST /tenants/{ref}/unpause` (operationId `unpauseTenant`, Tenants).

Input parameters:

- `ref` (string, required): The tenant id or your own `external_id`.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/dev-spacepost-mcp/api#diagnostics

## Score history

- 2026-11-06: 75
- 2026-11-05: 74
- 2026-11-04: 4
- 2026-11-03: 74
- 2026-11-02: 73
- 2026-11-01: 73
- 2026-10-31: 72
- 2026-10-30: 72

## Common questions

### What is the SpacePost MCP server?

SpacePost is an MCP server listed in the public MCP registry as dev.spacepost/mcp. Send email and manage domains, contacts and webhooks on SpacePost, the Resend-compatible email API. This page covers its hosted endpoint (https://api.spacepost.dev/mcp).

### Is the SpacePost MCP server safe to use?

SpacePost scores 75 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the SpacePost MCP server expose?

SpacePost exposes 46 tools: list_emails, send_email, send_batch_emails, get_email, update_email, and 41 more. Their descriptions and schemas cost roughly 4,711 tokens of context every time the server is loaded.

### Does the SpacePost MCP server require authentication?

Yes. SpacePost asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.

### Is the SpacePost MCP server still maintained?

SpacePost is still listed as active in the MCP registry. We last reached this channel on 6 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What did VerifyMCP test on the SpacePost MCP server?

VerifyMCP ran 13 checks on SpacePost, covering TLS certificate, Authorization, HTTPS, HSTS header and 9 more. Supply Chain Security and Provenance & Transparency do not apply to a hosted endpoint, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.

## Links

- Remote endpoint: https://api.spacepost.dev/mcp
- Authorisation metadata: https://api.spacepost.dev/.well-known/oauth-protected-resource/mcp
- Repository: https://github.com/404-studio/spacepost-mcp
- Website: https://docs.spacepost.dev/tools/mcp/
- Changelog RSS feed: https://verifymcp.io/servers/dev-spacepost-mcp/api.xml
- Changelog JSON feed: https://verifymcp.io/servers/dev-spacepost-mcp/api/changelog.json
- Trust report (JSON): https://verifymcp.io/servers/dev-spacepost-mcp/api.json
- HTML version of this page: https://verifymcp.io/servers/dev-spacepost-mcp/api