Notify
NPM · NOTIFYCX-MCP
Transactional email for coding agents: send, test, verify domains, webhooks, logs.
Available components
Last scanned (15 hours ago)
Scores higher than 30% of npm servers
Category Communication
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security63
- No malware found by supply-chain analysis.Pass
- Known CVEs could not be checked: the version this server declares is not published in its registry.Unverified
- No install/post-install scripts declared.Pass
- Dependency health could not be checked: the version this server declares is not published in its registry.Unverified
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability72
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 1483 tokens (~70/item across 21 items; 21 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability observed for 0 of 30 days with no destabilising changes; credit accrues until the full window elapses.Unverified
Tool Coverage95
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 84% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 4 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "send_email" implies "send" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 21 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 57
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 4 Nov 2026 · Analysed npm/notifycx-mcp@1.2.3
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_domain ~97
Add a sending domain and start SPF/DKIM verification. Returns dnsRecords (type/name/value) the user must add at their DNS host — Notify does not publish DNS. After DNS is configured, call check_domain. Then use send_email with a from address on that domain.
| Name | Type | Req | Description |
|---|---|---|---|
| dnsProvider | string | – | Optional DNS provider hint for host/name formatting |
| domain | string | yes | Domain hostname to verify, e.g. example.com |
No output schema declared.
No examples provided.
bootstrap_confirm ~104
Confirm the email OTP from bootstrap_start. Returns api_key once — instruct the user to put it in MCP env NOTIFY_API_KEY (do not leave the secret in chat). Then use add_domain / send_email. No NOTIFY_API_KEY required for this call.
| Name | Type | Req | Description |
|---|---|---|---|
| clientHint | string | – | e.g. cursor, chatgpt |
| code | string | yes | 6-digit code from email |
| string | yes | – | |
| intent | string | – | – |
No output schema declared.
No examples provided.
bootstrap_start ~106
Start Notify agent signup or key recovery without the dashboard. Sends a 6-digit email OTP. No NOTIFY_API_KEY required. Ask the user to paste the code, then call bootstrap_confirm. Requires acceptTerms: true (https://notify.cx/terms).
| Name | Type | Req | Description |
|---|---|---|---|
| acceptTerms | boolean | yes | Must be true — user accepts Terms and AUP |
| string | yes | User email for the Notify account | |
| intent | string | – | signup (default) or recover existing account |
No output schema declared.
No examples provided.
check_domain ~60
Poll SES for domain SPF/DKIM verification status after DNS records were added. Call after add_domain. When both succeed, production send_email with that from domain is unlocked and the plan email limit lifts.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | Domain hostname to check |
No output schema declared.
No examples provided.
create_api_key ~59
Create an API key (full_access required). Free plan allows one key. Prefer sending_access + domainId for app keys on Pro+.
| Name | Type | Req | Description |
|---|---|---|---|
| domainId | string | – | – |
| name | string | yes | – |
| permission | string | – | – |
No output schema declared.
No examples provided.
create_billing_checkout ~46
Get a Stripe Checkout URL for Pro or Scale (full_access key). User opens the URL in a browser to pay — not the Notify dashboard.
| Name | Type | Req | Description |
|---|---|---|---|
| plan | string | – | – |
No output schema declared.
No examples provided.
create_webhook ~126
Create a Notify webhook for delivery events on a verified domain. Requires Pro or Scale (free plan has 0 webhooks). Use list_domains to get domainId.
| Name | Type | Req | Description |
|---|---|---|---|
| domainId | string | yes | Verified sending domain id from list_domains |
| matchFroms | array | – | When matchMode is froms |
| matchHosts | array | – | When matchMode is hosts |
| matchMode | string | – | Optional match scope (default domain) |
| subscribedEvents | array | yes | Event types to subscribe to |
| webhookUrl | string | yes | HTTPS URL to receive webhook events |
No output schema declared.
No examples provided.
delete_api_key ~34
Deactivate an API key by keyId. Cannot delete the last full_access key.
| Name | Type | Req | Description |
|---|---|---|---|
| keyId | string | yes | – |
No output schema declared.
No examples provided.
delete_webhook ~28
Delete a Notify webhook subscription by id.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Webhook subscription id |
No output schema declared.
No examples provided.
get_domain ~63
Get one Notify sending domain by hostname, including dnsRecords (type/name/value) and raw DNS tokens for pending verification. Show dnsRecords to the user so they can add them at their hosting provider.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | Domain hostname, e.g. example.com |
No output schema declared.
No examples provided.
get_usage ~33
Get Notify plan usage and quota (hourly/monthly sends, account_verified). Use when debugging limits or confirming production unlock.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_webhook ~27
Get one Notify webhook by id.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Webhook subscription id |
No output schema declared.
No examples provided.
list_api_keys ~29
List API key metadata for the account (id, name, prefix only — never the full secret).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_domains ~41
List Notify sending domains and verification status (SPF/DKIM). Includes structured dnsRecords (type/name/value) for the user to publish at their DNS host.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_email_logs ~76
List recent Notify email delivery logs. Use after a send to check delivery, bounce, open, or click status.
| Name | Type | Req | Description |
|---|---|---|---|
| eventType | string | – | Filter logs by analytics event type |
| limit | integer | – | Page size (default 20, max 100) |
| page | integer | – | Page number (default 1) |
No output schema declared.
No examples provided.
list_webhooks ~21
List Notify webhook subscriptions (URL, events, domain scope).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
regenerate_api_key ~42
Rotate an API key secret by keyId. Returns the new api_key once — update NOTIFY_API_KEY / app secrets.
| Name | Type | Req | Description |
|---|---|---|---|
| keyId | string | yes | – |
No output schema declared.
No examples provided.
send_email ~153
Send transactional email via Notify (password reset, receipt, magic link, invoice, etc.) with a verified from domain. Use when the user wants production delivery. Prefer html for the body. For non-delivering API rehearsal before domain verification, use send_test_email instead.
| Name | Type | Req | Description |
|---|---|---|---|
| from | string | yes | Sender address or Name <email@verified-domain.com>. Production custom from requires a verified domain. |
| html | string | – | HTML (or plain text) body. Prefer html; message/text also work. |
| message | string | – | Alias for html/body content |
| subject | string | yes | Email subject line |
| text | string | – | Alias for html/body content |
| to | string | yes | Recipient email address |
No output schema declared.
No examples provided.
send_test_email ~148
API rehearsal for Notify: same request shape as production send but does not deliver and does not count toward quota. Use before domain verification or when testing the HTTP contract. For real inbox delivery, use send_email after verifying SPF/DKIM.
| Name | Type | Req | Description |
|---|---|---|---|
| from | string | yes | Sender address or Name <email@verified-domain.com>. Production custom from requires a verified domain. |
| html | string | – | HTML (or plain text) body. Prefer html; message/text also work. |
| message | string | – | Alias for html/body content |
| subject | string | yes | Email subject line |
| text | string | – | Alias for html/body content |
| to | string | yes | Recipient email address |
No output schema declared.
No examples provided.
test_webhook ~73
Send a test Notify webhook payload to a URL (does not require an existing subscription id).
| Name | Type | Req | Description |
|---|---|---|---|
| domainId | string | – | Optional verified domain id for scoped test payloads |
| eventType | string | yes | Event type for the test payload |
| webhookUrl | string | yes | HTTPS URL to receive the test payload |
No output schema declared.
No examples provided.
update_webhook ~117
Update an existing Notify webhook (URL, events, domain scope).
| Name | Type | Req | Description |
|---|---|---|---|
| domainId | string | – | Verified sending domain id from list_domains |
| id | string | yes | Webhook subscription id |
| matchFroms | array | – | When matchMode is froms |
| matchHosts | array | – | When matchMode is hosts |
| matchMode | string | – | Optional match scope (default domain) |
| subscribedEvents | array | – | Event types to subscribe to |
| webhookUrl | string | – | HTTPS URL to receive webhook events |
No output schema declared.
No examples provided.
How do I install the Notify MCP server?
Notify runs locally as an npm package, launched with npx -y notifycx-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · notifycx-mcp
claude mcp add notifycx-notifycx-mcp -- npx -y notifycx-mcp
What is the Notify MCP server?
Notify is an MCP server listed in the public MCP registry as io.github.notifycx/notifycx-mcp. Transactional email for coding agents: send, test, verify domains, webhooks, logs. This page covers its npm package (notifycx-mcp).
Is the Notify MCP server safe to use?
Notify scores 57 out of 100 on VerifyMCP. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Notify MCP server expose?
Notify exposes 21 tools: bootstrap_start, bootstrap_confirm, send_email, send_test_email, list_domains, and 16 more. Their descriptions and schemas cost roughly 1,483 tokens of context every time the server is loaded.
Is the Notify MCP server still maintained?
Notify is still listed as active in the MCP registry. We last reached this channel on 4 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Notify MCP server under?
Notify declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.