How to Let an AI Agent Send Email Safely
An agent that can send email can send the wrong email to a real person, and sent mail cannot be recalled. This page lists the controls worth putting in place before you hand an agent a send tool, and says plainly what AISend does and does not enforce for you.
1. Keep a human approval step
AISend's MCP server marks send_email as destructive, because it sends real mail and cannot be undone, and marks its listing, status and validation tools as read-only. Whether your client asks for confirmation on destructive tools depends on the client, so check its permission settings. For anything beyond testing, have the agent draft the message and show the recipient, subject and body, and send only after a person says yes.
2. Understand the verified-domain gate
On AISend, sending to anyone other than your own account email requires a verified domain of your own. The shared test sender only reaches your own account address. That limits an unconfigured agent to emailing you. An account created by the agent_signup tool gets an @agent.aisend.app address that cannot receive mail and cannot log in to the dashboard, so the test-to-self route is no use to it. The agent has to add and verify a sending domain with the REST API (POST /api/v1/domains, same API key) before it can send, and verification needs DNS records, so a person with DNS access is part of the setup.
3. Use the send caps as a blast-radius limit
AISend enforces fixed daily caps. New accounts ramp from 50 emails on day 1, to 200 a day before day 3, 500 before day 7 and 1,000 before day 14. Newly verified domains are held to 100 a day for the first 24 hours, 300 before day 3 and 1,000 before day 7, and domains registered less than 30 days ago stay at 100 a day. Plan caps are 2,500 a day on Pro and 5,000 a day on Business and Scale. A runaway loop hits a ceiling instead of your whole recipient list. These are caps, not a spam filter.
4. Let suppression and validation work
AISend suppresses addresses that hard-bounce or complain, so an agent retrying a dead address is stopped. The validate_email tool checks whether an address is valid and deliverable before a send, and uses your validation quota (100 on the trial, 5,000 on Pro, 25,000 on Business).
5. Make retries safe and keys private
- Pass an idempotency_key to send_email and reuse it on retry, so a timeout does not send two copies.
- create_api_key and agent_signup return a full API key into the conversation log. Put the key in the client's environment configuration and keep it out of prompts and shared transcripts.
- Give each agent its own key so one agent can be cut off without touching the rest. list_api_keys shows prefixes only.
- Run the server with `claude mcp add aisend -e AISEND_API_KEY=re_your_api_key -- npx -y aisend-mcp`, or the equivalent in your client.
6. Send only mail people expect
AISend is for transactional and consented mail. An agent should email people who signed up, bought or asked, and should not harvest addresses or send unsolicited messages. Google and Yahoo both penalize high spam-complaint rates (see our guide to their sender requirements), and complaints from one careless run affect your domain's reputation for the real mail that follows. AISend is newer and has no long shared-IP history, so a bad first week costs more here than on a long-established sender.
The AISend MCP tools
| Tool | What it does | Note |
|---|---|---|
| send_email | Send an email: from, to, subject, html or text, reply_to, idempotency_key | Destructive; cannot be undone |
| get_email_status | One sent email by ID: status, recipients, subject, body | Read-only |
| list_emails | Compact list of sent emails, filter by status or search | Read-only |
| validate_email | Check whether an address is valid and deliverable | Read-only; uses validation quota |
| list_domains | List sending domains and verification status | Read-only |
| list_api_keys | List API keys (prefix only) | Read-only |
| create_api_key | Create a new API key | Key appears in the conversation |
| agent_signup | Provision an account for an autonomous agent | Key appears in the conversation; no inbox; needs a verified domain before sending |
Local server, no hosted endpoint
The aisend-mcp package runs locally over stdio, started with npx, in clients that run local servers, such as Claude Code, Cursor and Claude Desktop. AISend does not host a remote MCP endpoint and has no OAuth sign-in, so it cannot be added as a one-click connector in claude.ai or ChatGPT. By contrast, as checked on October 30, 2026, Resend documents a hosted MCP server at mcp.resend.com with OAuth login, and Brevo documents a hosted MCP endpoint authenticated with an MCP token. If a hosted connector is a requirement, choose accordingly.
AISend's 3-day trial is free: 500 emails, no card, one verified domain. Paid plans are charged when you subscribe. AISend is for transactional and consented mail, and sending to anyone other than your own account email requires a verified domain.
Frequently asked questions
Can an AI agent sign itself up for AISend?
Yes, through the agent_signup tool, which creates an account and an API key. The account's @agent.aisend.app address cannot receive mail, so the agent must verify a sending domain before it can send to anyone.
Can an agent send email before a domain is verified?
Only to the account's own email address. Sending to anyone else requires a verified domain of your own. An agent_signup account has no receivable address, so in practice it must verify a domain first.
Does AISend have a hosted MCP server?
No. aisend-mcp is a local stdio server run with npx. There is no hosted endpoint and no OAuth sign-in.
How do I stop an agent from sending twice?
Pass an idempotency_key to send_email and reuse the same key when you retry after a timeout. AISend returns the first result instead of sending a second copy.
Sources
More guides
Try it with your own address first
Create an account, then run the MCP server locally. 3-day trial, 500 emails, no card; paid plans are charged when you subscribe.