AI-Agent-Email-ListBLOCK
Free SMTP relay and email API with an MCP server that AI agents can sign up for themselves. Mailgun-compatible, DKIM signing, automatic warmup, inbound mail.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
An email service an AI agent can sign up for on its own. No credit card, no sales call, no human with a corporate account. Free, with an MCP server, a Mailgun-shaped REST API, DKIM signing, automatic sending warmup and inbound mail.
Live at [ai.agentemaillist.com](https://ai.agentemaillist.com) · Source available · Built in Elixir and Phoenix
For AI agents: start here
This is a remote MCP server. Add it and the whole service arrives as tools:
https://ai.agentemaillist.com/mcp
JSON-RPC 2.0 over HTTP POST. The important part:
`create_account` needs no credentials. An agent that has just found this server can call it, get an API key back, and start sending. Every other transactional email provider stops an agent at a payment form or an identity check. This one does not.
See what is available before committing to anything:
curl -X POST https://ai.agentemaillist.com/mcp \
-H 'content-type: application/json' \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'The tools
Send the key as Authorization: Bearer on every call after the first.
Two things that will stop you
A domain must be verified in DNS before it can send. Publishing DNS usually needs a human with registrar access, so start it early. Until then every send returns a refusal e
8a56db0ac3e4OBSERVED · 2026-10-11Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (8 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (21)
4. Shared “god mode” admin “email anyone” tools rate-limit and audit-log.
HEALTH_URL="${HEALTH_URL:-http://127.0.0.1:4005/health}"curl -sf "http://127.0.0.1:$PORT/health" >/dev/null 2>&1 && break
if curl -sf "http://127.0.0.1:$PORT/health" >/dev/null 2>&1; then
streamable-http
.formatter.exs
.formatter.exs
-d '[email protected]' -d 'password=a sufficiently long password'
-d [email protected] -d password='a sufficiently long password'
Agent Email List’s bet is that Mailgun’s lesson is the more portable one for indies and SaaS teams who do not want AWS as a prerequisite for password resets. Pointing Mailgun-shaped clients at `https:
If you searched **Django SMTP**, **Django email backend**, or **free SMTP Django**, you already know `django.core.mail.backends.console.EmailBackend` is for local theater. Production password resets,
Django’s email framework is the product-facing API most Python developers touch: `send_mail()`, `EmailMessage`, `EmailMultiAlternatives`, and the auth password-reset flow that already knows how to cal
1. Create an API key with at least **Mail Send** permission (Mail Send → Full Access is the usual choice for outbound SMTP-only needs).
1. Create a fresh API key with Mail Send → Full Access (or the least privilege that still includes mail send).
| `create_account` | Open an account, get an API key | **No** |
| **Identity & access** | IAM policies, orgs, SCPs | API keys + domain SMTP users | API key + `smtp_password`; store once-shown secrets |
2. Use raw smtplib when the process intentionally avoids Django — and still read host/port/user/password from the same env vars.
- No CI access for production password on every PR.
The following sketch shows how the pieces snap together in a modern ASP.NET Core host without inventing Agent Email List hostnames. Replace empty host/port with values from docs/dashboard when publish
Gates applied: instruction_override, no_behavioural_pass, no_license.
8a56db0ac3e4full audit observations/trust-audit/mcp-server/lbesecker195__ai-agent-email-list.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 8a56db0ac3e4 | BLOCK | D | 69 | first audit |
Questions
What is the AI-Agent-Email-List MCP server?
Free SMTP relay and email API with an MCP server that AI agents can sign up for themselves. Mailgun-compatible, DKIM signing, automatic warmup, inbound mail.
Is AI-Agent-Email-List safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does AI-Agent-Email-List need?
No credential environment variables were found in its source, so it appears to need none.
How does AI-Agent-Email-List run?
It speaks streamable-http, so it runs as a service you connect to over the network.
How current is this page?
The grade is for one exact copy of the source (8a56db0ac3e4), read on 2026-10-11. The repository is watched and re-audited when it changes.