Model Context Protocol (MCP) Server

Connecting IDEs & AI coding assistants

SadaSend runs a hosted, remote Model Context Protocol (MCP) server at https://mcp.sadasend.com over streamable HTTP. There is nothing to install locally and no background daemon to maintain.

Configure your AI coding environment by adding the server block to your client configuration file. Replace sada_live_sk_… with an API key from your dashboard (or an agent key with approval mode):

// Universal MCP JSON Configuration (Antigravity, Cursor, Cline, Claude Desktop, Windsurf)
{
  "mcpServers": {
    "sadasend": {
      "url": "https://mcp.sadasend.com",
      "headers": {
        "Authorization": "Bearer sada_live_sk_your_api_key_here"
      }
    }
  }
}

Connecting Terminal CLIs & LLMs (Claude Code, OpenCode, Codex, cURL)

For command-line agent runners, custom OpenAI Swarm / Codex scripts, or terminal workflows, connect directly using the CLI commands or HTTP JSON-RPC endpoint below:

# 1. Claude Code CLI:
claude mcp add --transport http sadasend https://mcp.sadasend.com \
  --header "Authorization: Bearer $SADASEND_API_KEY"

# 2. OpenCode CLI:
opencode mcp add sadasend --url https://mcp.sadasend.com \
  --header "Authorization: Bearer $SADASEND_API_KEY"

# 3. Raw HTTP / JSON-RPC 2.0 (cURL, ChatGPT Custom Actions, OpenAI Codex):
curl -s -X POST https://mcp.sadasend.com \
  -H "Authorization: Bearer $SADASEND_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 1,
    "method": "tools/call",
    "params": {
      "name": "preview_email",
      "arguments": {
        "from": "notifications@yourdomain.com",
        "to": "user@example.com",
        "subject": "Agent Test Preview",
        "text": "Hello from autonomous agent!"
      }
    }
  }'

The 11 tools an agent gets

Every tool is dynamically filtered by the scopes on the key you connect with. A read-only key sees strictly read tools and never sees send tools — an agent cannot plan around or retry an action it will always be refused.

Automatic agent attribution & provenance

Every email dispatched via MCP is automatically stamped with channel: "mcp" and source: "agent".

The agent can pass an optional agent_name argument (e.g. "Refund Assistant" or "Support Agent"). If omitted, SadaSend auto-resolves the name from the client handshake (claude-code, cursor) or the key’s configured agent persona.

These dimensions are indexed immediately and roll up into GET /account/stats?provenance=true, giving human operators real-time breakdown matrices by channel, source, and top agent across their entire organization.

{
  "name": "send_email",
  "arguments": {
    "from": "support@yourdomain.com",
    "to": "customer@example.com",
    "subject": "Ticket #4092 resolved",
    "html": "<p>Your inquiry has been resolved.</p>",
    "agent_name": "Support Agent",
    "tags": ["support", "resolution"]
  }
}

Model reasonability: refusals vs transport faults

When a guardrail blocks an action — an unauthorized recipient, an unverified domain, or a missing scope — SadaSend answers with standard JSON-RPC tool content flagged with isError: true.

Returned as tool text, the model reads "Recipient stranger@external.com is outside this key's allowlist" and can reason about the restriction or self-correct. Returned as a transport fault, the agent treats the server as broken and retries blindly.

Approval mode: human-in-the-loop

A key minted in approval mode (sada_agent_sk_…) accepts sends and marks them pending_approval. The agent receives confirmation that the email was accepted and held in the account queue.

Nothing hits the wire until a person reviews the draft in the dashboard and clicks Approve. This allows autonomous agents to operate with full drafting power and zero public blast radius.

What is deliberately absent

There is no create_api_key, no delete_domain, and no remove_suppression tool. Not scope-gated — completely absent. Any attempt to invoke them returns standard JSON-RPC -32601 METHOD_NOT_FOUND.

An agent that can mint its own credentials has no ceiling, and one that can remove a suppression can burn your domain reputation with mailbox providers. Those actions live strictly in the dashboard with human session authentication.

Transport security

The server sends no unsolicited notifications, so GET requests for SSE are declined with 405 sse_not_offered. Clients fall back to POST without complaint.

Origin headers from untrusted browser domains are refused with 403 origin_not_allowed to protect against DNS rebinding attacks. Native clients (Claude Code, Cursor) send no Origin header and connect cleanly.