io.github.vaemail/vaemail
NPM · VAEMAIL
Email infrastructure for AI agents: send, authenticate domains, track delivery, diagnose issues.
Available components
Last scanned (7 hours ago)
Scores higher than 94% of npm servers
Category Marketing and SEO
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency97
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to vaemail/vaemail-mcp). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 10 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability72
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 2526 tokens (~140/item across 18 items; 18 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management94
- Stability check failed: the tool surface changed between 1.1.0 and 1.2.0: 1 tool removals, 0 breaking changes, 2 additions. See how to fix → Fail
Tool Coverage84
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 53% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 19 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 2 Nov 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 91 to 94.
- 31 Oct 26 −1
No change was recorded against any check on this day. Stability & Change Management went from 94 to 87.
- 25 Oct 26 0
- Stability: 0.97 → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Stability: 0.97 → fail ▼ security
- Stability: 0.97 → pass security
- Capabilities: fail → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
- Package version: 1.1.0 → 1.2.0 functional
- 24 Oct 26 0
- Stability: pass → 0.97 functional
- 18 Oct 26 0
- Stability: 0.97 → pass security
- 16 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 14 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Oct 26 0
- Security disclosure: unverified → fail ▼ functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/vaemail@1.2.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | vaemail/vaemail-mcp |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/vaemail/vaemail-mcp/.github/workflows/publish.yml@refs/tags/v1.2.0 |
| Rekor log index | 3461992121 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:9c9e64f02e01c7a6dbf2cedc9591de918cdb7e9061fadd4e763c428f5bc3ed16ab1b43489697d356bf4af8e4d323a3ce6c650a2671ff1426c2783832a |
Background: How many MCP packages publish verified provenance →
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
vaemail_capabilities What VaEmail can do ~43
Return what VaEmail supports: interfaces, capabilities, limits, scopes and region. No API key needed. Call this first when deciding whether VaEmail fits a need.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
vaemail_confirmer_envoi Confirmer l’envoi d’une newsletter ~58
Exécute l’envoi ou la programmation préparé(e) après confirmation humaine explicite. Le jeton est à usage unique.
| Name | Type | Req | Description |
|---|---|---|---|
| jeton | string | yes | Jeton retourné par vaemail_preparer_envoi. |
No output schema declared.
No examples provided.
vaemail_create_domain Declare a sending domain ~113
Declare a domain and return the DNS records to add at the registrar, each with what it is for. Declaring a domain does not authenticate it: the records must be published, then verified. Adding DNS records is a human step — report them, do not claim the domain is ready.
| Name | Type | Req | Description |
|---|---|---|---|
| dkim_selector | string | – | DKIM selector, if one is already chosen. |
| domain | string | yes | Domain to send from, e.g. exemple.fr. |
| idempotency_key | string | – | – |
No output schema declared.
No examples provided.
vaemail_diagnose_deliverability Why is my email not arriving? ~84
Diagnose deliverability for the account: authentication of every domain, reputation findings (hard bounces, complaints, where the contacts came from) and recommended actions, each with the endpoint that performs it. Answers "why are my emails from example.com landing badly?" in one call.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | – | Restrict the diagnosis to one declared domain. |
No output schema declared.
No examples provided.
vaemail_dns_requirements DNS records expected for a domain ~37
Return the DNS records a declared domain needs, record by record, with the role of each.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | – |
No output schema declared.
No examples provided.
vaemail_get_audit_log What this key has done ~76
Return the log of API actions: which key, which operation, which parameters, which result. Message bodies are never stored in it. Use it to report exactly what was done.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | integer | – | – |
| limit | integer | – | – |
| operation | string | – | – |
| since | string | – | – |
No output schema declared.
No examples provided.
vaemail_get_message Delivery status of one message ~58
Return the delivery status of a message and every event known about it (delivered, opened, clicked, bounced, complained), plus the transport error when it failed.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | Message id returned by vaemail_send_email. |
No output schema declared.
No examples provided.
vaemail_get_usage Usage, quota and key limits ~53
Return the monthly quota and what is left of it, today's sends, and for the key in use: its scopes, its daily cap and the remaining allowance. Read it before a batch to know whether to stop.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
vaemail_importer_contacts Importer des contacts dans une liste ~224
Ajoute des contacts (email, prénom, nom, attributs libres) à une liste, créée si elle n'existe pas. Met à jour les contacts déjà connus. Ne fait jamais : réabonner quelqu'un qui s'est désinscrit (il est ajouté à la liste mais reste désinscrit, aucun envoi ne l'atteindra) ; supprimer quoi que ce soit. Rend un compte-rendu : lignes reçues, lignes ignorées (adresse invalide), abonnés de la liste avant et après. Utilisez-le pour « ajoute ces contacts à … », « importe ce fichier dans … ». Exemple : { "liste": "Prospects salon", "contacts": [{ "email": "a@b.fr", "prenom": "Anne", "nom": "Blin", "attributs": { "SOCIETE": "Blin SA" } }] }.
| Name | Type | Req | Description |
|---|---|---|---|
| contacts | array | yes | – |
| liste | string | yes | Nom (ou numéro) de la liste cible. Créée si elle n'existe pas. |
No output schema declared.
No examples provided.
vaemail_list_bounces Addresses removed from sending ~87
List addresses excluded from sending: hard bounces, complaints and unsubscribes, with the reason for each. Sending to one of them is refused, so read this before retrying a failed recipient.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | integer | – | – |
| limit | integer | – | – |
| reason | string | – | – |
| since | string | – | ISO 8601 date to read from. |
No output schema declared.
No examples provided.
vaemail_list_domains List sending domains ~32
List the sending domains of the account with the live state of their SPF, DKIM and DMARC records.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
vaemail_list_messages List recent messages ~66
List messages newest first, filtered by status, tag or recipient. Paginate with the returned next_cursor.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | integer | – | – |
| limit | integer | – | – |
| status | string | – | – |
| tag | string | – | – |
| to | string | – | – |
No output schema declared.
No examples provided.
vaemail_ou_en_est_ma_campagne Où en est ma campagne ? ~167
Dit où en est une newsletter, en phrases : brouillon, programmée (et pour quand), en cours d'envoi (envoyés, restent), ou terminée (envoyés, ouverts, cliqués, rebonds, désinscriptions). Retrouve la campagne par son numéro ou par un bout de son sujet ; si plusieurs correspondent, rend la liste et vous choisissez. Lecture seule, ne change rien. Utilisez-le pour « ça en est où ? », « elle est partie ? », « combien ont ouvert ? ». Exemple : { "campagne": "budget formation" } ou { "campagne": 60 }.
| Name | Type | Req | Description |
|---|---|---|---|
| campagne | string | yes | Numéro de la campagne, ou un bout de son sujet. |
No output schema declared.
No examples provided.
vaemail_preparer_envoi Préparer l’envoi d’une newsletter ~468
Prépare une newsletter à une liste de contacts sans l’envoyer ni la programmer. Fait tout seul : retrouve la liste par son nom, crée la campagne, envoie un test si demandé, et rend un récapitulatif, un jeton à confirmer et l'audience abonnée à ce jour. l'étalement prévu par la chauffe du domaine et le lien vers la campagne dans l'admin. L’outil vaemail_confirmer_envoi exécute ensuite l’envoi ou la programmation après accord humain explicite. Ne fait jamais : envoyer sans « quand » explicite (sans ce champ, la campagne reste en brouillon, rien ne part) ; inventer une liste (si le nom est ambigu, l'outil rend les candidates et vous choisissez avec l'humain). Utilisez-le dès que quelqu'un dit « envoie / programme la newsletter à … ». Exemple : { "sujet": "Votre budget formation 2026 se ferme le 31 décembre", "contenu": "<p>…</p>", "liste": "L'actu BienveNum", "quand": "2026-09-17 10:00", "test_vers": "hugo@agencesw.com" }.
| Name | Type | Req | Description |
|---|---|---|---|
| apercu | string | – | Texte d'aperçu affiché à côté du sujet dans la boîte de réception. |
| contenu | string | yes | Le mail : HTML complet, ou texte brut (mis en paragraphes automatiquement). |
| liste | string | yes | À qui : le nom de la liste (approximatif accepté) ou son numéro. |
| liste_exclue | string | – | Liste dont les contacts ne doivent pas recevoir ce mail (nom ou numéro). |
| nom_interne | string | – | Nom de la campagne dans l'admin. Par défaut, le sujet. |
| quand | string | – | « maintenant », ou une date à venir « 2026-09-17 10:00 » (heure de Paris). Absent = brouillon, rien ne part. |
| sujet | string | yes | Objet du mail, tel que le lecteur le verra. |
| test_vers | string | – | Adresse qui reçoit un exemplaire de test AVANT l'envoi ou la programmation. |
No output schema declared.
No examples provided.
vaemail_qui_est_abonne Qui est abonné à quoi ? ~140
Sans paramètre : toutes les listes du compte, rangées par dossier, avec le nombre d'abonnés de chacune. Avec une adresse : ses listes, et si elle est désinscrite (auquel cas aucun envoi ne l'atteindra, et il ne faut pas la réabonner). Lecture seule. Utilisez-le avant d'envoyer (pour choisir la liste) et pour « est-ce que untel est inscrit ? ». Exemple : {} ou { "adresse": "marie@exemple.fr" }.
| Name | Type | Req | Description |
|---|---|---|---|
| adresse | string | – | Une adresse précise, pour connaître ses listes et son statut. |
No output schema declared.
No examples provided.
vaemail_send_email Send an email ~195
Queue a transactional email and return its id. The call returns as soon as the message is ACCEPTED, not when it is delivered: use vaemail_get_message to find out what happened to it. Pass idempotency_key when retrying so a network timeout cannot send the same message twice.
| Name | Type | Req | Description |
|---|---|---|---|
| from_name | string | – | Display name of the sender. |
| html | string | – | HTML body. Required unless template_id is given. |
| idempotency_key | string | – | Caller-side unique id for this send. Replays the first response instead of sending again. |
| reply_to | string | – | – |
| subject | string | – | Subject line. |
| tag | string | – | Free label, useful to find the message later. |
| template_id | integer | – | Transactional template to render instead of html. |
| to | string | yes | Recipient address. |
| variables | object | – | Values merged into the template. |
No output schema declared.
No examples provided.
vaemail_validate_email Check a send without sending ~72
Dry run: report whether the email would go out, and name what would block it. Sends nothing. Use it right after setup, before the first real message.
| Name | Type | Req | Description |
|---|---|---|---|
| html | string | – | – |
| subject | string | – | – |
| template_id | integer | – | – |
| to | string | yes | – |
No output schema declared.
No examples provided.
vaemail_verify_domain Verify domain authentication ~61
Read SPF, DKIM and DMARC for a domain in the public DNS and report each record. Without SPF and DMARC, large mailbox providers file the mail as spam.
| Name | Type | Req | Description |
|---|---|---|---|
| dkim_selector | string | – | – |
| domain | string | yes | – |
No output schema declared.
No examples provided.
How do I install the io.github.vaemail/vaemail MCP server?
io.github.vaemail/vaemail runs locally as an npm package, launched with npx -y vaemail. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · vaemail
claude mcp add vaemail-vaemail -- npx -y vaemail
What is the io.github.vaemail/vaemail MCP server?
io.github.vaemail/vaemail is an MCP server listed in the public MCP registry as io.github.vaemail/vaemail. Email infrastructure for AI agents: send, authenticate domains, track delivery, diagnose issues. This page covers its npm package (vaemail).
Is the io.github.vaemail/vaemail MCP server safe to use?
io.github.vaemail/vaemail scores 91 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.vaemail/vaemail MCP server expose?
io.github.vaemail/vaemail exposes 18 tools: vaemail_preparer_envoi, vaemail_confirmer_envoi, vaemail_ou_en_est_ma_campagne, vaemail_qui_est_abonne, vaemail_importer_contacts, and 13 more. Their descriptions and schemas cost roughly 2,034 tokens of context every time the server is loaded.
Is the io.github.vaemail/vaemail MCP server still maintained?
io.github.vaemail/vaemail is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.vaemail/vaemail MCP server under?
io.github.vaemail/vaemail declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.