# Mailgi (remote · api.mailgi.xyz)

Email for AI agents: register a real inbox with no human, then send, receive and read mail.

- Trust score: 67/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-04

## Components

- remote · `api.mailgi.xyz`: 67/100 (this document), [markdown](https://verifymcp.io/servers/xyz-mailgi-mailgi/api.md), [page](https://verifymcp.io/servers/xyz-mailgi-mailgi/api)

## Channel facts

- Endpoint: `https://api.mailgi.xyz/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.0.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-04.

- **Endpoint Security**: 11/100
  - TLS not yet verified: we couldn't open a connection to check the certificate.
  - Authorisation not yet verified: we couldn't confirm whether this endpoint requires it.
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS not yet verified: we couldn't read the response headers to check for it.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 0/100
  - Transport check failed: declared streamable-http, but we couldn't connect to verify it.
- **Schema Quality & AI Usability**: 0/100
  - Schema not yet verified: we couldn't read the endpoint's schema, or could read only part of its tool list.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 0/100
  - Tool coverage not yet verified: we couldn't read the endpoint's tools, or could read only part of the list.
- **Tool Safety**: 0/100
  - Tool safety not yet verified: we couldn't read the endpoint's tools, or could read only part of the list.
- **Capabilities**: 0/100
  - Capabilities not yet verified: we couldn't read the endpoint's capabilities.

**Unverified: 5 categories.** Categories scored 0 because we could not verify them: authentication we do not have, an unreachable endpoint, or not enough scan history. We only credit what we can confirm.

## Install

### How do I install the Mailgi MCP server?

Mailgi is a hosted endpoint at https://api.mailgi.xyz/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http xyz-mailgi-mailgi 'https://api.mailgi.xyz/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "xyz-mailgi-mailgi": {
      "url": "https://api.mailgi.xyz/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "xyz-mailgi-mailgi": {
      "type": "http",
      "url": "https://api.mailgi.xyz/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.xyz-mailgi-mailgi]
url = "https://api.mailgi.xyz/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "xyz-mailgi-mailgi": {
      "type": "remote",
      "url": "https://api.mailgi.xyz/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add xyz-mailgi-mailgi --url 'https://api.mailgi.xyz/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  xyz-mailgi-mailgi:
    url: "https://api.mailgi.xyz/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "xyz-mailgi-mailgi": {
      "Transport": "http",
      "Url": "https://api.mailgi.xyz/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add xyz-mailgi-mailgi -t streamable-http -u 'https://api.mailgi.xyz/mcp'
```

### Other

```json
{
  "mcpServers": {
    "xyz-mailgi-mailgi": {
      "type": "http",
      "url": "https://api.mailgi.xyz/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-04 (score 67, 0)

- [security regression] Endpoint reachability: reachable → unreachable
- [security regression] Authorization: fail → unverified
- [security regression] Stability: 0.07 → unverified
- [security regression] Tool safety: pass → unverified
- [security regression] TLS certificate: pass → unverified
- [security regression] HSTS header: pass → unverified
- [security regression] Transport: pass → fail
- [functional regression] Schema quality: 100 → unverified
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified

### 2026-11-03 (score 67, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-02 (score 66, 0)

- [functional improvement] Stability: unverified → 0.03

### 2026-11-01 (score 66)

First indexed and scored.

## MCP tools (67)

### `register_agent` (~93 tokens)

Register an agent

Creates a new agent with its own email address and returns its API key, shown once.

Input parameters:

- `did` (string): Optional did:key DID; only changes the alias address.
- `domainToken` (string): Registration token for an organization's domain. Requires localPart.
- `label` (string): A name for your own reference.
- `localPart` (string): Chosen address before the @, used with domainToken.

### `org_login_request_code` (~38 tokens)

Request dashboard login code

Emails a 6-digit dashboard login code to a human's address. Creates the account on first login.

Input parameters:

- `email` (string, required)

### `org_login_verify` (~34 tokens)

Verify dashboard login code

Exchanges an emailed login code for a dashboard session token.

Input parameters:

- `code` (string, required)
- `email` (string, required)

### `topup_lookup` (~42 tokens)

Look up a top-up

Shows which wallet a top-up for a Mailgi address would credit, and the allowed amounts.

Input parameters:

- `address` (string, required): The agent's email or alias address.

### `topup_start` (~62 tokens)

Start a top-up

Creates a card payment link for the wallet behind any Mailgi address. Give it to a human to pay.

Input parameters:

- `address` (string, required): The agent's email or alias address.
- `amountUsd` (number, required): USD, within the range from topup_lookup.

### `topup_status` (~36 tokens)

Check a top-up

Returns whether a top-up payment has been paid and credited.

Input parameters:

- `sessionId` (string, required): Checkout session ID from the payment link.

### `health` (~23 tokens)

Service health

Checks that the Mailgi API, its database and the mail server are up.

### `agent_get` (~21 tokens)

Get agent profile

Returns this agent's profile: its addresses, label and domain.

### `agent_usage` (~55 tokens)

Get agent usage

Returns this agent's daily send and API counters; the latest day is partial.

Input parameters:

- `from` (string): ISO date, inclusive. Defaults to 30 days ago.
- `to`: ISO date, inclusive. Defaults to today.

### `agent_delete` (~22 tokens)

Delete agent

Permanently deletes this agent, its mailbox and all its API keys.

### `mail_list` (~80 tokens)

List messages

Lists message headers in the mailbox, newest first by default; filter by folder with mailboxId.

Input parameters:

- `limit` (integer): Max messages to return.
- `mailboxId` (string): Folder ID from mailbox_list. Omit for all mail.
- `position` (integer): Zero-based offset for pagination.
- `sort` (string): Sort by receivedAt.

### `mail_get` (~31 tokens)

Read a message

Returns one message with its full text and HTML body.

Input parameters:

- `id` (string, required): Message ID from mail_list.

### `mail_send` (~90 tokens)

Send email

Sends an email from this agent's address. Mail to outside addresses is charged to the wallet.

Input parameters:

- `bcc` (array)
- `cc` (array)
- `htmlBody` (string): HTML body.
- `replyTo` (string): Reply-To address.
- `subject` (string, required)
- `textBody` (string): Plain-text body.
- `to` (array, required): Recipient addresses.

### `mail_delete` (~23 tokens)

Move message to Trash

Moves a message to the Trash folder.

Input parameters:

- `id` (string, required)

### `mail_move` (~36 tokens)

Move message

Moves a message to another folder.

Input parameters:

- `id` (string, required)
- `mailboxId` (string, required): Destination folder ID from mailbox_list.

### `mail_set_flags` (~44 tokens)

Set message flags

Marks a message as seen or unseen, flagged or unflagged.

Input parameters:

- `flagged` (boolean)
- `id` (string, required)
- `seen` (boolean)

### `mailbox_list` (~19 tokens)

List folders

Lists all folders, including Inbox, Sent and Trash.

### `mailbox_create` (~39 tokens)

Create folder

Creates a folder, optionally nested under another.

Input parameters:

- `name` (string, required): Folder name.
- `parentId` (string): Parent folder ID for nesting.

### `mailbox_rename` (~28 tokens)

Rename folder

Renames a folder.

Input parameters:

- `id` (string, required)
- `name` (string, required)

### `mailbox_delete` (~20 tokens)

Delete folder

Deletes a custom folder.

Input parameters:

- `id` (string, required)

### `apikey_list` (~23 tokens)

List API keys

Lists this agent's API keys. Key values are never shown again.

### `apikey_create` (~45 tokens)

Create API key

Creates another API key for this agent. The key is shown once.

Input parameters:

- `expiresAt` (string): ISO 8601 expiry date-time.
- `label` (string)

### `apikey_revoke` (~25 tokens)

Revoke API key

Revokes an API key immediately.

Input parameters:

- `keyId` (string, required)

### `billing_get` (~25 tokens)

Get wallet

Returns the wallet this agent spends from: balance, prices and how to top up.

### `billing_topup` (~44 tokens)

Create top-up link

Creates a card payment link for this agent's wallet. Give it to a human to pay.

Input parameters:

- `amountUsd` (number, required): USD; the minimum is in billing_get.

### `billing_transactions` (~30 tokens)

List wallet transactions

Lists the wallet ledger, newest first.

Input parameters:

- `limit` (integer)
- `offset` (integer)

### `webhook_list` (~15 tokens)

List webhooks

Lists this agent's webhook endpoints.

### `webhook_create` (~54 tokens)

Create webhook

Registers an HTTPS URL to be notified when mail arrives. The signing secret is shown once.

Input parameters:

- `eventTypes` (array): Defaults to ["mail.received"].
- `url` (string, required): HTTPS URL to POST notifications to.

### `webhook_delete` (~20 tokens)

Delete webhook

Deletes a webhook endpoint.

Input parameters:

- `id` (string, required)

### `webhook_deliveries` (~26 tokens)

List webhook deliveries

Lists recent delivery attempts for a webhook endpoint.

Input parameters:

- `id` (string, required)

### `webhook_resend` (~34 tokens)

Resend webhook delivery

Queues a delivery attempt to be sent again.

Input parameters:

- `deliveryId` (string, required)
- `id` (string, required)

### `webhook_enable` (~29 tokens)

Re-enable webhook

Re-enables a webhook endpoint that was switched off after repeated failures.

Input parameters:

- `id` (string, required)

### `org_me` (~20 tokens)

Who am I

Returns the signed-in user and the organizations they belong to.

### `org_logout` (~16 tokens)

Sign out

Revokes the current dashboard session token.

### `org_list` (~18 tokens)

List organizations

Lists the organizations the signed-in user belongs to.

### `org_create` (~34 tokens)

Create organization

Creates an organization; the signed-in user becomes its owner.

Input parameters:

- `name` (string, required)
- `slug` (string)

### `org_get` (~25 tokens)

Get organization

Returns one organization.

Input parameters:

- `orgId` (string, required): Organization ID from org_list.

### `org_rename` (~34 tokens)

Rename organization

Renames an organization.

Input parameters:

- `name` (string, required)
- `orgId` (string, required): Organization ID from org_list.

### `org_member_list` (~30 tokens)

List members

Lists an organization's members and their roles.

Input parameters:

- `orgId` (string, required): Organization ID from org_list.

### `org_member_set_role` (~44 tokens)

Change member role

Changes a member's role.

Input parameters:

- `orgId` (string, required): Organization ID from org_list.
- `role` (string, required)
- `userId` (string, required)

### `org_member_remove` (~47 tokens)

Remove member

Removes a member from the organization, or leaves it when userId is your own.

Input parameters:

- `orgId` (string, required): Organization ID from org_list.
- `userId` (string, required)

### `org_invite_create` (~45 tokens)

Invite member

Emails an invitation to join the organization.

Input parameters:

- `email` (string, required)
- `orgId` (string, required): Organization ID from org_list.
- `role` (string)

### `org_invite_list` (~27 tokens)

List invites

Lists pending invitations.

Input parameters:

- `orgId` (string, required): Organization ID from org_list.

### `org_invite_revoke` (~38 tokens)

Revoke invite

Revokes a pending invitation.

Input parameters:

- `inviteId` (string, required)
- `orgId` (string, required): Organization ID from org_list.

### `invite_accept` (~28 tokens)

Accept invite

Accepts an organization invitation with the token from the invite email.

Input parameters:

- `token` (string, required)

### `domain_attach` (~46 tokens)

Attach domain

Attaches a custom domain and returns the DNS records to publish.

Input parameters:

- `domain` (string, required): e.g. example.com
- `orgId` (string, required): Organization ID from org_list.

### `domain_list` (~27 tokens)

List domains

Lists an organization's custom domains.

Input parameters:

- `orgId` (string, required): Organization ID from org_list.

### `domain_get` (~47 tokens)

Get domain

Returns a domain's verification status and the DNS records it needs.

Input parameters:

- `domainId` (string, required): Domain ID from domain_list.
- `orgId` (string, required): Organization ID from org_list.

### `domain_verify` (~50 tokens)

Verify domain

Re-checks the domain's DNS records and verifies it if they are correct.

Input parameters:

- `domainId` (string, required): Domain ID from domain_list.
- `orgId` (string, required): Organization ID from org_list.

### `domain_detach` (~44 tokens)

Detach domain

Detaches a custom domain from the organization.

Input parameters:

- `domainId` (string, required): Domain ID from domain_list.
- `orgId` (string, required): Organization ID from org_list.

### `domain_inbox_list` (~47 tokens)

List inboxes

Lists the inboxes (agents) on a domain.

Input parameters:

- `domainId` (string, required): Domain ID from domain_list.
- `orgId` (string, required): Organization ID from org_list.

### `domain_inbox_create` (~81 tokens)

Create inbox

Creates an inbox with a chosen address on a domain. Its API key is shown once.

Input parameters:

- `domainId` (string, required): Domain ID from domain_list.
- `label` (string)
- `localPart` (string, required): e.g. "support" for support@yourdomain.com
- `orgId` (string, required): Organization ID from org_list.

### `domain_inbox_delete` (~54 tokens)

Delete inbox

Removes an inbox and its mail from a domain.

Input parameters:

- `agentId` (string, required)
- `domainId` (string, required): Domain ID from domain_list.
- `orgId` (string, required): Organization ID from org_list.

### `regtoken_create` (~61 tokens)

Create registration token

Creates a token that lets an agent register its own address on this domain. Shown once.

Input parameters:

- `domainId` (string, required): Domain ID from domain_list.
- `label` (string)
- `orgId` (string, required): Organization ID from org_list.

### `regtoken_list` (~42 tokens)

List registration tokens

Lists a domain's registration tokens.

Input parameters:

- `domainId` (string, required): Domain ID from domain_list.
- `orgId` (string, required): Organization ID from org_list.

### `regtoken_revoke` (~50 tokens)

Revoke registration token

Revokes a registration token.

Input parameters:

- `domainId` (string, required): Domain ID from domain_list.
- `orgId` (string, required): Organization ID from org_list.
- `tokenId` (string, required)

### `org_usage` (~78 tokens)

Get organization usage

Returns daily send, receive and API counters across the organization.

Input parameters:

- `breakdown` (string): Split each day by agent.
- `from` (string): ISO date, inclusive. Defaults to 30 days ago.
- `orgId` (string, required): Organization ID from org_list.
- `to` (string): ISO date, inclusive. Defaults to today.

### `domain_usage` (~91 tokens)

Get domain usage

Returns daily send, receive and API counters for one domain.

Input parameters:

- `breakdown` (string): Split each day by agent.
- `domainId` (string, required): Domain ID from domain_list.
- `from` (string): ISO date, inclusive. Defaults to 30 days ago.
- `orgId` (string, required): Organization ID from org_list.
- `to` (string): ISO date, inclusive. Defaults to today.

### `org_billing_get` (~38 tokens)

Get organization wallet

Returns the organization's shared wallet: balance, prices and how to top up.

Input parameters:

- `orgId` (string, required): Organization ID from org_list.

### `org_billing_topup` (~42 tokens)

Create organization top-up link

Creates a card payment link for the organization wallet.

Input parameters:

- `amountUsd` (number, required)
- `orgId` (string, required): Organization ID from org_list.

### `org_billing_transactions` (~46 tokens)

List organization transactions

Lists the organization wallet ledger, newest first.

Input parameters:

- `limit` (integer)
- `offset` (integer)
- `orgId` (string, required): Organization ID from org_list.

### `org_webhook_list` (~32 tokens)

List organization webhooks

Lists webhook endpoints across the organization's inboxes.

Input parameters:

- `orgId` (string, required): Organization ID from org_list.

### `org_webhook_create` (~77 tokens)

Create organization webhook

Registers an HTTPS URL to be notified when mail arrives at one of the organization's inboxes.

Input parameters:

- `agentId` (string, required): Inbox ID from domain_inbox_list.
- `eventTypes` (array)
- `orgId` (string, required): Organization ID from org_list.
- `url` (string, required): HTTPS URL to POST notifications to.

### `org_webhook_delete` (~35 tokens)

Delete organization webhook

Deletes a webhook endpoint.

Input parameters:

- `id` (string, required)
- `orgId` (string, required): Organization ID from org_list.

### `org_webhook_deliveries` (~41 tokens)

List organization webhook deliveries

Lists recent delivery attempts for a webhook endpoint.

Input parameters:

- `id` (string, required)
- `orgId` (string, required): Organization ID from org_list.

### `org_webhook_resend` (~49 tokens)

Resend organization webhook delivery

Queues a delivery attempt to be sent again.

Input parameters:

- `deliveryId` (string, required)
- `id` (string, required)
- `orgId` (string, required): Organization ID from org_list.

### `org_webhook_enable` (~44 tokens)

Re-enable organization webhook

Re-enables a webhook endpoint that was switched off after repeated failures.

Input parameters:

- `id` (string, required)
- `orgId` (string, required): Organization ID from org_list.

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/xyz-mailgi-mailgi/api#diagnostics

## Score history

- 2026-11-04: 67
- 2026-11-03: 67
- 2026-11-02: 66
- 2026-11-01: 66

## Common questions

### What is the Mailgi MCP server?

Mailgi is an MCP server listed in the public MCP registry as xyz.mailgi/mailgi. Email for AI agents: register a real inbox with no human, then send, receive and read mail. This page covers its hosted endpoint (https://api.mailgi.xyz/mcp).

### Is the Mailgi MCP server safe to use?

Mailgi scores 67 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Mailgi MCP server expose?

Mailgi exposes 67 tools: register_agent, org_login_request_code, org_login_verify, topup_lookup, topup_start, and 62 more. Their descriptions and schemas cost roughly 2,734 tokens of context every time the server is loaded.

### Does the Mailgi MCP server require authentication?

Its publisher declares no required credentials for Mailgi. We have not been able to confirm that against the live endpoint, and a server can require authorisation without declaring it here.

### Is the Mailgi MCP server still maintained?

Mailgi is still listed in the MCP registry, though our most recent checks did not reach this channel. We last reached this channel on 3 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://api.mailgi.xyz/mcp
- Repository: https://github.com/Mailgi/mailgi
- Website: https://www.mailgi.xyz/mcp.html
- Changelog RSS feed: https://verifymcp.io/servers/xyz-mailgi-mailgi/api.xml
- Changelog JSON feed: https://verifymcp.io/servers/xyz-mailgi-mailgi/api.json
- HTML version of this page: https://verifymcp.io/servers/xyz-mailgi-mailgi/api