Atlas / MCP servers / damientilman / Mailchimp

MailchimpSAFE

Name: Mailchimp
Author: damientilman

mcp/damientilman/mailchimp-3

MCP server by damientilman · ai · ai tools · anthropic · Audited 2026-10-10

The most complete Mailchimp Marketing API MCP server: 227 tools across campaigns, audiences, reports, segments, automations and full e-commerce, with multi-account support and runtime-security guardrails (read-only, dry-run, audit, per-tool risk metadata).

Verdict

SAFE

Grade

Trust score

89 /100

Exposed tools

200 116r · 79w · 32d

Transport

—

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://github.com/damientilman/mailchimp-mcp-server/actions/workflows/ci.yml) [](https://pypi.org/project/mailchimp-mcp/) [](https://pypi.org/project/mailchimp-mcp/) [](https://opensource.org/licenses/MIT) [](https://www.python.org/downloads/) [](https://modelcontextprotocol.io) [](https://github.com/damientilman/mailchimp-mcp-server/pkgs/container/mailchimp-mcp-server)

The most complete Model Context Protocol (MCP) server for the Mailchimp Marketing API: 227 tools to query and manage your Mailchimp account from any MCP-compatible client. It covers the full campaign, audience, member, segment, automation and reporting surface, complete e-commerce (read and write), landing pages, File Manager, surveys, signup forms and verified domains, plus multi-account support and runtime-security guardrails (read-only, dry-run and audit modes, with per-tool risk metadata).

Uses the Mailchimp Marketing API via `requests`. Not based on the official mailchimp-marketing-python client. I hit too many issues with it so I went with raw HTTP calls instead.

Read from source at commit c848116fa0f0OBSERVED · 2026-10-10

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add mailchimp-mcp --env MAILCHIMP_API_KEY=${MAILCHIMP_API_KEY} -- uvx mailchimp-mcp

claude-desktop

{
  "mcpServers": {
    "mailchimp-mcp": {
      "command": "uvx",
      "args": [
        "mailchimp-mcp"
      ],
      "env": {
        "MAILCHIMP_API_KEY": "${MAILCHIMP_API_KEY}"
      }
    }
  }
}

Exposed tools (200)

116 read · 79 write · 32 destructive. Blast radius: 32 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`add_automation_queue_subscriber`	write	Add a subscriber to the queue of a classic automation email.
`add_member`	write	Add a new member to an audience with optional name and tags.
`add_member_event`	write	Record a custom event for an audience member (e.g.
`add_member_note`	write	Add a CRM-style internal note to a member. Not sent to the contact.
`add_members_to_segment`	write	Add members to a static segment or tag by email address.
`batch_subscribe`	write	Add or update up to 500 members in a single synchronous request.
`cancel_send`	write	Cancel a campaign mid-send, stopping delivery to remaining recipients.
`create_account_export`	write	Start an account export job covering the requested categories of account data.
`create_audience`	write	Create a new audience (list) with required contact info, campaign defaults, and permission reminder.
`create_batch`	write	Submit multiple API operations as a single asynchronous batch request.
`create_batch_webhook`	write	Create a new batch webhook that notifies a URL when batch operations complete.
`create_campaign`	write	Create a new email campaign in draft status, with optional segment targeting or A/B variate testing.
`create_campaign_feedback`	write	Add a team collaboration feedback comment to a campaign.
`create_campaign_folder`	write	Create a new folder to organize campaigns.
`create_connected_site`	write	Connect a website to Mailchimp, generating a tracking script for that domain.
`create_interest`	write	Create a new interest option within an interest category (e.g. add
`create_interest_category`	write	Create a new interest category (group container) in an audience for organizing subscriber preferences.
`create_landing_page`	write	Create a new landing page in draft status from a template, optionally linked to a store.
`create_merge_field`	write	Create a new custom merge field in an audience for storing additional member data.
`create_promo_code`	write	Create a redeemable code under an existing promo rule.
`create_promo_rule`	write	Create a promo rule (discount mechanic) in a store. Attach codes to it afterwards
`create_segment`	write	Create a new segment or tag in an audience for grouping members.
`create_store`	write	Create an e-commerce store in Mailchimp to hold products, customers, carts, and orders.
`create_store_cart`	write	Create a cart in a store with line items and a customer reference. Used to push
`create_store_customer`	write	Create a customer in a store, linking their purchase activity to an email address.
`create_store_order`	write	Create an e-commerce order in a store with a customer and line items.
`create_store_order_line`	write	Add a line item to an existing e-commerce order.
`create_store_product`	write	Create a product in a store, including at least one variant.
`create_store_product_image`	write	Add an image to a product in an e-commerce store.
`create_store_product_variant`	write	Add a new variant to an existing product in a store.
`create_template`	write	Create a new reusable email template from HTML content.
`create_template_folder`	write	Create a new folder to organize templates.
`create_verified_domain`	write	Begin domain verification by sending a verification code to an address at that domain.
`create_webhook`	write	Create a webhook that sends HTTP POST notifications to an external URL on audience events.
`customize_signup_form`	read	Customize an audience
`delete_audience`	destructive	Permanently delete an audience and all its members, segments, campaigns, and stats. Irreversible.
`delete_batch_webhook`	destructive	Delete a batch webhook permanently.
`delete_campaign`	destructive	Permanently delete a campaign from the account.
`delete_campaign_feedback`	destructive	Delete a campaign feedback comment permanently.
`delete_campaign_folder`	destructive	Delete a campaign folder permanently.
`delete_connected_site`	destructive	Delete a connected site from the account permanently.
`delete_file`	destructive	Permanently delete a file from the File Manager.
`delete_interest`	destructive	Delete a single interest option from a category, keeping the category and other options intact.
`delete_interest_category`	destructive	Delete an interest category and all its interest options at once.
`delete_landing_page`	destructive	Permanently delete a landing page. Cannot be undone.
`delete_member`	destructive	Permanently delete a member and all their data from an audience.
`delete_member_note`	destructive	Permanently delete a note attached to a member. Cannot be undone.
`delete_member_permanent`	destructive	Permanently and irreversibly erase an audience member (GDPR-style deletion).
`delete_merge_field`	destructive	Delete a custom merge field and all its stored data from an audience.
`delete_promo_code`	destructive	Permanently delete a promo code. Past redemption history is lost. Irreversible.
`delete_promo_rule`	destructive	Permanently delete a promo rule and all its associated promo codes. Irreversible.
`delete_segment`	destructive	Delete a segment or tag from an audience. Members remain in the audience.
`delete_store`	destructive	Permanently delete an e-commerce store from Mailchimp.
`delete_store_cart`	destructive	Permanently delete a cart from a store. Cannot be undone.
`delete_store_customer`	destructive	Permanently delete a customer from a store.
`delete_store_order`	destructive	Permanently delete an e-commerce order from a store.
`delete_store_order_line`	destructive	Permanently delete a line item from an e-commerce order.
`delete_store_product`	destructive	Permanently delete a product and all of its variants from a store.
`delete_store_product_image`	destructive	Permanently delete an image from a product in an e-commerce store.
`delete_store_product_variant`	destructive	Permanently delete a single variant from a product in a store.
`delete_template`	destructive	Delete a user-created template permanently.
`delete_template_folder`	destructive	Delete a template folder permanently.
`delete_verified_domain`	destructive	Delete a verified sending domain from the account permanently.
`delete_webhook`	destructive	Delete a webhook, immediately stopping event notifications to its URL.
`describe_tools`	read	List every tool with its machine-readable risk classification for policy enforcement.
`get_account_export`	read	Retrieve the status and download URL for a single account export job.
`get_account_info`	read	Retrieve Mailchimp account details including name, contact info, total subscribers, and industry benchmarks.
`get_audience_abuse_report`	read	Retrieve the details of a single abuse (spam) complaint report for an audience.
`get_audience_activity`	read	Retrieve the recent daily activity (opens, clicks, sends, subscribes) for an audience.
`get_audience_clients`	read	List the top email clients (Gmail, Apple Mail, Outlook) used by an audience
`get_audience_details`	read	Retrieve full stats, subscribe URL, and rating for a specific audience.
`get_audience_growth_history`	read	Retrieve monthly growth history for an audience (subscribes, unsubscribes, cleaned).
`get_audience_top_locations`	read	List the top geographic locations (countries) of an audience
`get_authorized_app`	read	Retrieve the full record for a single OAuth-authorized application.
`get_automation_email`	read	Get details of a single email in a classic automation workflow.
`get_automation_email_queue`	read	Retrieve the queue of subscribers about to receive a specific automation email, with scheduled send times.
`get_automation_emails`	read	List individual emails within an automation workflow with sequence, delays, and send counts.
`get_automation_queue_subscriber`	read	Get a single subscriber from the queue of a classic automation email.
`get_automation_removed_subscriber`	read	Get a single subscriber removed from a classic automation workflow.
`get_automation_summary`	read	Summarise automation activity across Classic Automations and Customer Journeys.
`get_batch_status`	read	Check the progress and completion status of an asynchronous batch operation.
`get_batch_webhook`	read	Retrieve the details of a single batch webhook.
`get_campaign_abuse_report`	read	Retrieve a single abuse (spam) complaint for a sent campaign.
`get_campaign_abuse_reports`	read	List abuse (spam) complaints filed against a sent campaign.
`get_campaign_advice`	read	Retrieve Mailchimp
`get_campaign_click_details`	read	Retrieve per-link click data for a campaign showing which URLs were clicked and how many times.
`get_campaign_content`	read	Read the rendered body copy of a campaign (plain text, optionally HTML).
`get_campaign_details`	read	Retrieve full configuration of a specific campaign including settings, recipients, and tracking options.
`get_campaign_feedback`	read	Retrieve a single team feedback comment on a campaign.
`get_campaign_folder`	read	Retrieve details for a single campaign folder.
`get_campaign_locations`	read	Retrieve geographic open data for a sent campaign, broken down by country and region.
`get_campaign_recipients`	read	Retrieve the delivery roster for a sent campaign showing each recipient
`get_campaign_report`	read	Retrieve aggregate performance metrics for a sent campaign: opens, clicks, bounces, benchmarks.
`get_campaign_send_checklist`	write	Retrieve the pre-send readiness checklist for a campaign.
`get_campaign_sent_to`	read	List the members a sent campaign was delivered to, with per-recipient status.
`get_campaign_sub_reports`	read	Retrieve child report data for A/B test, variate, or RSS campaign sub-items.
`get_campaign_unsubscribes`	read	Retrieve members who unsubscribed from a specific sent campaign, with reasons.
`get_chimp_chatter`	read	Retrieve the account activity feed (Chimp Chatter) of recent events across the account.
`get_connected_site`	read	Retrieve the full record for a single connected site including its tracking script.
`get_domain_performance`	read	Retrieve campaign performance broken down by recipient email domain (gmail.com, outlook.com, etc.).
`get_ecommerce_product_activity`	read	Retrieve e-commerce product activity for a campaign showing revenue per product.
`get_eepurl_activity`	read	Retrieve social sharing stats for a campaign
`get_email_activity`	read	Retrieve per-recipient activity timeline for a sent campaign (opens, clicks, bounces).
`get_file`	read	Retrieve full metadata for a single File Manager file.
`get_landing_page`	read	Retrieve full details of a landing page including description and tracking settings.
`get_landing_page_report`	read	Get the report for a single landing page.
`get_member_activity`	read	Retrieve a member
`get_member_events`	read	Retrieve custom API-triggered events for a specific member (e.g.
`get_member_goals`	read	Retrieve the last 50 Goal events triggered by a specific audience member.
`get_member_journey_events`	read	Retrieve a member
`get_member_tags`	read	Retrieve all tags currently assigned to a specific member.
`get_open_details`	read	Retrieve per-recipient open data for a sent campaign (who opened, when, how many times).
`get_promo_code`	read	Retrieve a single promo code by ID with its current settings and usage stats.
`get_promo_rule`	read	Retrieve a single promo rule by ID with its full configuration.
`get_segment`	read	Retrieve full details of a specific segment including member count and filter conditions.
`get_store`	read	Retrieve a single e-commerce store with its configuration and connection details.
`get_store_cart`	read	Retrieve a single cart with its full line items, customer, and total breakdown.
`get_store_customer`	write	Retrieve a single store customer with their email, opt-in status, and order totals.
`get_store_order`	write	Retrieve a single e-commerce order with its lines, customer, and totals.
`get_store_order_line`	write	Retrieve a single line item from an e-commerce order.
`get_store_product`	read	Retrieve a single product from a store with its variants and details.
`get_store_product_image`	read	Retrieve a single image attached to a product in an e-commerce store.
`get_store_product_variant`	read	Retrieve a single product variant with its price, SKU, and inventory details.
`get_survey`	read	Retrieve full details for a single survey.
`get_survey_question_answers`	read	List answers for a single survey question.
`get_survey_questions_report`	read	Get the questions report for a single survey.
`get_survey_report`	read	Get the report for a single survey.
`get_survey_response`	read	Get a single survey response.
`get_survey_responses`	read	List responses for a single survey.
`get_template`	read	Retrieve metadata for a template (name, type, dates, folder, thumbnail) without its HTML content.
`get_template_default_content`	read	Retrieve the default HTML content of a template for use in campaign content.
`get_template_folder`	read	Retrieve details for a single template folder.
`get_verified_domain`	read	Retrieve the full verification and authentication record for a single sending domain.
`list_account_exports`	read	List account export jobs that have been requested for this Mailchimp account.
`list_account_orders`	read	List e-commerce orders across every store in the account.
`list_accounts`	read	List the Mailchimp accounts this server is configured to use.
`list_audience_abuse_reports`	read	List abuse (spam) complaint reports filed against an audience.
`list_audience_members`	write	List members of a specific audience with subscription status, merge fields, and engagement stats.
`list_audiences`	read	List audiences (lists) with subscriber counts and engagement rates.
`list_authorized_apps`	read	List applications that have been granted OAuth access to this Mailchimp account.
`list_automation_removed_subscribers`	read	List subscribers removed from a classic automation workflow.
`list_automations`	write	List Classic Automation workflows in the account with status and send counts.
`list_batch_webhooks`	read	List all configured batch webhooks for the account.
`list_batches`	read	List recent batch operations with status and progress.
`list_campaign_feedback`	read	List team collaboration feedback comments on a campaign.
`list_campaign_folders`	read	List campaign folders used to organize campaigns in the Mailchimp dashboard.
`list_campaigns`	write	List campaigns with metadata, send stats, and filtering by status or date.
`list_connected_sites`	read	List all sites connected to this Mailchimp account for tracking and pop-up forms.
`list_ecommerce_stores`	read	List connected e-commerce stores (Shopify, WooCommerce, etc.) with platform and currency info.
`list_file_folders`	read	List folders in the account
`list_files`	read	List images and files stored in the account
`list_interest_categories`	read	List interest categories (group containers) for an audience, showing titles and form types.
`list_interests`	read	List interest options within a category, with subscriber counts per option.
`list_landing_page_reports`	read	List reports for all landing pages.
`list_landing_pages`	read	List landing pages with publication status, URLs, and associated audiences.
`list_member_notes`	read	List CRM-style notes attached to a member by team members (not visible to the contact).
`list_merge_fields`	write	List merge fields (custom data fields) defined for an audience, including tags, types, and defaults.
`list_promo_codes`	read	List the redeemable codes attached to a promo rule (e.g.
`list_promo_rules`	read	List discount/promo rules configured for a store (fixed amount, percentage, free shipping).
`list_segment_members`	read	List individual members belonging to a specific segment or tag.
`list_segments`	read	List segments and tags for an audience with member counts and types.
`list_signup_forms`	read	Get the signup forms (header, body content, and styles) configured for an audience.
`list_store_carts`	read	List carts for a store, including abandoned ones, with customer and total info.
`list_store_customers`	write	List customers from a connected e-commerce store with order counts, total spend, and opt-in status.
`list_store_order_lines`	write	List the line items of a single e-commerce order.
`list_store_orders`	read	List orders from a connected e-commerce store with totals and fulfillment status.
`list_store_product_images`	read	List the images attached to a product in an e-commerce store.
`list_store_product_variants`	read	List the variants of a product in a store, with pagination.
`list_store_products`	read	List products from a connected e-commerce store with titles, URLs, and variant counts.
`list_survey_reports`	read	List reports for all surveys.
`list_surveys`	read	List all surveys for an audience with their status and public URL.
`list_template_folders`	read	List folders used to organize templates.
`list_templates`	read	List email templates in the account (user-created and Mailchimp gallery templates).
`list_verified_domains`	read	List all sending domains verified for use with this Mailchimp account.
`list_webhooks`	read	List webhooks configured for an audience, showing callback URLs, events, and source filters.
`pause_automation`	read	Pause an automation workflow, stopping delivery while preserving the queue.
`pause_automation_email`	read	Pause a specific email in a classic automation workflow.
`pause_rss_campaign`	read	Pause an active RSS-driven campaign so it stops sending scheduled editions.
`ping`	read	Check API connectivity and verify the API key is valid.
`publish_landing_page`	write	Publish a landing page, making it live at its public URL.
`publish_survey`	write	Publish a survey, making it live at its public URL.
`remove_automation_subscriber`	destructive	Remove a subscriber from a classic automation workflow.
`remove_members_from_segment`	destructive	Remove members from a static segment or tag. Members remain in the audience.
`replicate_campaign`	read	Clone an existing campaign into a new draft with identical settings, recipients, and content.
`resend_to_non_openers`	write	Create a new draft campaign targeting only recipients who did not open the original.
`resume_rss_campaign`	read	Resume a paused RSS-driven campaign so it continues sending scheduled editions.
`schedule_campaign`	write	Schedule a campaign draft for sending at a specific future time.
`search_automation_campaigns`	read	List campaigns originated by an automation or a Customer Journey (campaign type=
`search_campaigns`	read	Search campaigns by keyword across titles, subject lines, and list names.
`search_members`	read	Search for members across all audiences by email address or name, returning both exact and fuzzy matches.
`send_campaign`	write	Send a campaign immediately to all targeted recipients. Emails begin delivering within minutes.
`send_test_email`	write	Send a test/preview email to specific addresses without affecting the real audience.
`set_campaign_content`	write	Set the full HTML body of a campaign draft, replacing any existing content entirely.
`start_automation`	write	Start or resume all emails in an automation workflow, activating delivery to queued subscribers.
`start_automation_email`	write	Start a specific email in a classic automation workflow.
`tag_member`	destructive	Add or remove tags from a single member. Does not modify profile data or subscription status.
`trigger_customer_journey`	write	Trigger a contact into a specific step of a Customer Journey workflow.
`unpublish_landing_page`	read	Take a published landing page offline. The public URL stops serving the page.
`unpublish_survey`	read	Unpublish a survey that is currently live, taking it offline.
`unschedule_campaign`	write	Cancel a scheduled campaign send, returning it to draft (

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (1 observation(s))
Network: none-observed
Shell: none-observed
Dependencies: pinned
Secrets in source: none-found

Findings (5)

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

delete_audience, delete_batch_webhook, delete_campaign, delete_campaign_feedback, delete_campaign_folder, delete_connected_site, delete_file, delete_interest, delete_interest_category, delete_landing_

Why it matters. 32 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/mailchimp_mcp_server/server.py:249

return hashlib.md5(email_address.strip().lower().encode()).hexdigest()

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

tests/test_reliability.py:153

result = server.mc_request("/lists/../../pool/members")

LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

SECURITY.md:53

If you find a way this server could leak or mishandle credentials, please report it

Why it matters. an instruction to move sensitive data to an outside destination

Fix. remove; a skill never needs the user's secrets off the machine

INFOPrompt injection · prompt.authority_framing · CWE-94, CWE-1427

SECURITY.md:45

This server requires a Mailchimp API key, which grants full access to a Mailchimp

Gates applied: no_behavioural_pass.

Audited 2026-10-10 · audit v0.4.1 · source sha c848116fa0f0full audit observations/trust-audit/mcp-server/damientilman__mailchimp-3.json · Report an issue / request a re-scan

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

Date	Source	Verdict	Grade	Score	Change
2026-10-10	`c848116fa0f0`	SAFE	B	89	first audit

Questions

What is the Mailchimp MCP server?

What tools does Mailchimp expose?

200 in total: 116 read-only, 79 that write, and 32 that can delete or overwrite (delete_audience, delete_batch_webhook, delete_campaign, delete_campaign_feedback, delete_campaign_folder). Every one is listed on this page with its risk.

Is Mailchimp safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 32 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does Mailchimp need?

It reads MAILCHIMP_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How current is this page?

The grade is for one exact copy of the source (c848116fa0f0), read on 2026-10-10. The repository is watched and re-audited when it changes.

Source	damientilman/mailchimp-mcp-server
PyPI	`mailchimp-mcp`
Credentials it reads	`MAILCHIMP_API_KEY`
License	MIT
Activity	pushed 67d ago