# io.github.vaemail/vaemail (npm · vaemail)

Email infrastructure for AI agents: send, authenticate domains, track delivery, diagnose issues.

- Trust score: 84/100 (high trust)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-20

## Components

- npm · `vaemail`: 84/100 (this document), [markdown](https://verifymcp.io/servers/vaemail-vaemail/vaemail.md), [page](https://verifymcp.io/servers/vaemail-vaemail/vaemail)

## Channel facts

- Registry: `npm`
- Package: `vaemail`
- Version: `1.1.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-20.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - No production dependencies, so there is no dependency health to assess.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to vaemail/vaemail-mcp).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 8 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 72/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2454 tokens (~144/item across 17 items; 17 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 47/100
  - Stability observed for 14 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 84/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 52% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 18 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 60/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.

## Install

### How do I install the io.github.vaemail/vaemail MCP server?

io.github.vaemail/vaemail runs locally as an npm package, launched with npx -y vaemail. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add vaemail-vaemail -- npx -y vaemail
```

### Cursor

```json
{
  "mcpServers": {
    "vaemail-vaemail": {
      "command": "npx",
      "args": [
        "-y",
        "vaemail"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "vaemail-vaemail": {
      "command": "npx",
      "args": [
        "-y",
        "vaemail"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add vaemail-vaemail -- npx -y vaemail
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "vaemail-vaemail": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "vaemail"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add vaemail-vaemail --command npx --arg -y --arg vaemail
```

### Hermes

```yaml
mcp_servers:
  vaemail-vaemail:
    command: "npx"
    args: ["-y", "vaemail"]
```

### Netclaw

```json
{
  "McpServers": {
    "vaemail-vaemail": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "vaemail"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add vaemail-vaemail -t stdio -c npx -a -y vaemail
```

### Other

```json
{
  "mcpServers": {
    "vaemail-vaemail": {
      "command": "npx",
      "args": [
        "-y",
        "vaemail"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-19 (score 84, +1)

No change was recorded against any check on this day. Stability & Change Management went from 40 to 43. That category is still filling its 30-day observation window: 12 days of observed history at the previous scan, 13 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-17 (score 83, +1)

No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-15 (score 82, +1)

No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-13 (score 81, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-12 (score 80, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-09-11 (score 65, −15)

- [security regression] Stability: 0.13 → unverified
- [security regression] Malware scan: pass → unverified
- [security regression] Tool safety: pass → unverified
- [functional regression] Capabilities: fail → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: pass → fail
- [functional improvement] Tool coverage: 38% → 52%
- [functional] First check of Schema quality: unverified
- [functional] Package version: 1.0.2 → 1.1.0

### 2026-09-09 (score 80, +1)

No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-07 (score 79, +26)

- [security regression] Tool safety: pass → unverified
- [security improvement] Malware scan: unverified → pass
- [security improvement] Provenance: fail → pass
- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [security] The attested source repository moved: vaemail/vaemail-mcp
- [functional regression] Capabilities: fail → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Stability: unverified → 0.03
- [functional] First check of Schema quality: unverified
- [functional] Package version: 1.0.0 → 1.0.2

## MCP tools (17)

### `vaemail_envoyer_newsletter` (~447 tokens)

Envoyer ou programmer une newsletter

Envoie ou programme une newsletter à une liste de contacts, en un seul appel. Fait tout seul : retrouve la liste par son nom, crée la campagne, envoie un test si demandé, puis programme à la date donnée ou envoie tout de suite, et rend la date, l'audience abonnée à ce jour, l'étalement prévu par la chauffe du domaine et le lien vers la campagne dans l'admin. Ne fait jamais : envoyer sans « quand » explicite (sans ce champ, la campagne reste en brouillon, rien ne part) ; inventer une liste (si le nom est ambigu, l'outil rend les candidates et vous choisissez avec l'humain). Utilisez-le dès que quelqu'un dit « envoie / programme la newsletter à … ». Exemple : { "sujet": "Votre budget formation 2026 se ferme le 31 décembre", "contenu": "<p>…</p>", "liste": "L'actu BienveNum", "quand": "2026-09-17 10:00", "test_vers": "hugo@agencesw.com" }.

Input parameters:

- `apercu` (string): Texte d'aperçu affiché à côté du sujet dans la boîte de réception.
- `contenu` (string, required): Le mail : HTML complet, ou texte brut (mis en paragraphes automatiquement).
- `liste` (string, required): À qui : le nom de la liste (approximatif accepté) ou son numéro.
- `liste_exclue` (string): Liste dont les contacts ne doivent pas recevoir ce mail (nom ou numéro).
- `nom_interne` (string): Nom de la campagne dans l'admin. Par défaut, le sujet.
- `quand` (string): « maintenant », ou une date à venir « 2026-09-17 10:00 » (heure de Paris). Absent = brouillon, rien ne part.
- `sujet` (string, required): Objet du mail, tel que le lecteur le verra.
- `test_vers` (string): Adresse qui reçoit un exemplaire de test AVANT l'envoi ou la programmation.

### `vaemail_ou_en_est_ma_campagne` (~167 tokens)

Où en est ma campagne ?

Dit où en est une newsletter, en phrases : brouillon, programmée (et pour quand), en cours d'envoi (envoyés, restent), ou terminée (envoyés, ouverts, cliqués, rebonds, désinscriptions). Retrouve la campagne par son numéro ou par un bout de son sujet ; si plusieurs correspondent, rend la liste et vous choisissez. Lecture seule, ne change rien. Utilisez-le pour « ça en est où ? », « elle est partie ? », « combien ont ouvert ? ». Exemple : { "campagne": "budget formation" } ou { "campagne": 60 }.

Input parameters:

- `campagne` (string, required): Numéro de la campagne, ou un bout de son sujet.

### `vaemail_qui_est_abonne` (~140 tokens)

Qui est abonné à quoi ?

Sans paramètre : toutes les listes du compte, rangées par dossier, avec le nombre d'abonnés de chacune. Avec une adresse : ses listes, et si elle est désinscrite (auquel cas aucun envoi ne l'atteindra, et il ne faut pas la réabonner). Lecture seule. Utilisez-le avant d'envoyer (pour choisir la liste) et pour « est-ce que untel est inscrit ? ». Exemple : {} ou { "adresse": "marie@exemple.fr" }.

Input parameters:

- `adresse` (string): Une adresse précise, pour connaître ses listes et son statut.

### `vaemail_importer_contacts` (~224 tokens)

Importer des contacts dans une liste

Ajoute des contacts (email, prénom, nom, attributs libres) à une liste, créée si elle n'existe pas. Met à jour les contacts déjà connus. Ne fait jamais : réabonner quelqu'un qui s'est désinscrit (il est ajouté à la liste mais reste désinscrit, aucun envoi ne l'atteindra) ; supprimer quoi que ce soit. Rend un compte-rendu : lignes reçues, lignes ignorées (adresse invalide), abonnés de la liste avant et après. Utilisez-le pour « ajoute ces contacts à … », « importe ce fichier dans … ». Exemple : { "liste": "Prospects salon", "contacts": [{ "email": "a@b.fr", "prenom": "Anne", "nom": "Blin", "attributs": { "SOCIETE": "Blin SA" } }] }.

Input parameters:

- `contacts` (array, required)
- `liste` (string, required): Nom (ou numéro) de la liste cible. Créée si elle n'existe pas.

### `vaemail_capabilities` (~43 tokens)

What VaEmail can do

Return what VaEmail supports: interfaces, capabilities, limits, scopes and region. No API key needed. Call this first when deciding whether VaEmail fits a need.

### `vaemail_send_email` (~195 tokens)

Send an email

Queue a transactional email and return its id. The call returns as soon as the message is ACCEPTED, not when it is delivered: use vaemail_get_message to find out what happened to it. Pass idempotency_key when retrying so a network timeout cannot send the same message twice.

Input parameters:

- `from_name` (string): Display name of the sender.
- `html` (string): HTML body. Required unless template_id is given.
- `idempotency_key` (string): Caller-side unique id for this send. Replays the first response instead of sending again.
- `reply_to` (string)
- `subject` (string): Subject line.
- `tag` (string): Free label, useful to find the message later.
- `template_id` (integer): Transactional template to render instead of html.
- `to` (string, required): Recipient address.
- `variables` (object): Values merged into the template.

### `vaemail_validate_email` (~72 tokens)

Check a send without sending

Dry run: report whether the email would go out, and name what would block it. Sends nothing. Use it right after setup, before the first real message.

Input parameters:

- `html` (string)
- `subject` (string)
- `template_id` (integer)
- `to` (string, required)

### `vaemail_get_message` (~58 tokens)

Delivery status of one message

Return the delivery status of a message and every event known about it (delivered, opened, clicked, bounced, complained), plus the transport error when it failed.

Input parameters:

- `id` (integer, required): Message id returned by vaemail_send_email.

### `vaemail_list_messages` (~66 tokens)

List recent messages

List messages newest first, filtered by status, tag or recipient. Paginate with the returned next_cursor.

Input parameters:

- `cursor` (integer)
- `limit` (integer)
- `status` (string)
- `tag` (string)
- `to` (string)

### `vaemail_list_domains` (~32 tokens)

List sending domains

List the sending domains of the account with the live state of their SPF, DKIM and DMARC records.

### `vaemail_create_domain` (~113 tokens)

Declare a sending domain

Declare a domain and return the DNS records to add at the registrar, each with what it is for. Declaring a domain does not authenticate it: the records must be published, then verified. Adding DNS records is a human step — report them, do not claim the domain is ready.

Input parameters:

- `dkim_selector` (string): DKIM selector, if one is already chosen.
- `domain` (string, required): Domain to send from, e.g. exemple.fr.
- `idempotency_key` (string)

### `vaemail_verify_domain` (~61 tokens)

Verify domain authentication

Read SPF, DKIM and DMARC for a domain in the public DNS and report each record. Without SPF and DMARC, large mailbox providers file the mail as spam.

Input parameters:

- `dkim_selector` (string)
- `domain` (string, required)

### `vaemail_dns_requirements` (~37 tokens)

DNS records expected for a domain

Return the DNS records a declared domain needs, record by record, with the role of each.

Input parameters:

- `domain` (string, required)

### `vaemail_diagnose_deliverability` (~84 tokens)

Why is my email not arriving?

Diagnose deliverability for the account: authentication of every domain, reputation findings (hard bounces, complaints, where the contacts came from) and recommended actions, each with the endpoint that performs it. Answers "why are my emails from example.com landing badly?" in one call.

Input parameters:

- `domain` (string): Restrict the diagnosis to one declared domain.

### `vaemail_list_bounces` (~87 tokens)

Addresses removed from sending

List addresses excluded from sending: hard bounces, complaints and unsubscribes, with the reason for each. Sending to one of them is refused, so read this before retrying a failed recipient.

Input parameters:

- `cursor` (integer)
- `limit` (integer)
- `reason` (string)
- `since` (string): ISO 8601 date to read from.

### `vaemail_get_usage` (~53 tokens)

Usage, quota and key limits

Return the monthly quota and what is left of it, today's sends, and for the key in use: its scopes, its daily cap and the remaining allowance. Read it before a batch to know whether to stop.

### `vaemail_get_audit_log` (~76 tokens)

What this key has done

Return the log of API actions: which key, which operation, which parameters, which result. Message bodies are never stored in it. Use it to report exactly what was done.

Input parameters:

- `cursor` (integer)
- `limit` (integer)
- `operation` (string)
- `since` (string)

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/vaemail-vaemail/vaemail#diagnostics

## Score history

- 2026-09-20: 84
- 2026-09-19: 84
- 2026-09-18: 83
- 2026-09-17: 83
- 2026-09-16: 82
- 2026-09-15: 82
- 2026-09-14: 81
- 2026-09-13: 81
- 2026-09-12: 80
- 2026-09-11: 65
- 2026-09-10: 80
- 2026-09-09: 80
- 2026-09-08: 79
- 2026-09-07: 79
- 2026-09-06: 53

## Common questions

### What is the io.github.vaemail/vaemail MCP server?

io.github.vaemail/vaemail is an MCP server listed in the public MCP registry as io.github.vaemail/vaemail. Email infrastructure for AI agents: send, authenticate domains, track delivery, diagnose issues. This page covers its npm package (vaemail).

### Is the io.github.vaemail/vaemail MCP server safe to use?

io.github.vaemail/vaemail scores 84 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the io.github.vaemail/vaemail MCP server expose?

io.github.vaemail/vaemail exposes 17 tools: vaemail_envoyer_newsletter, vaemail_ou_en_est_ma_campagne, vaemail_qui_est_abonne, vaemail_importer_contacts, vaemail_capabilities, and 12 more. Their descriptions and schemas cost roughly 1,955 tokens of context every time the server is loaded.

### Is the io.github.vaemail/vaemail MCP server still maintained?

io.github.vaemail/vaemail is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the io.github.vaemail/vaemail MCP server under?

io.github.vaemail/vaemail declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/vaemail
- Socket report: https://socket.dev/npm/package/vaemail
- Repository: https://github.com/vaemail/vaemail-mcp
- Website: https://vaemail.fr/agents
- Changelog RSS feed: https://verifymcp.io/servers/vaemail-vaemail/vaemail.xml
- Changelog JSON feed: https://verifymcp.io/servers/vaemail-vaemail/vaemail.json
- HTML version of this page: https://verifymcp.io/servers/vaemail-vaemail/vaemail