MailgunBLOCK
Implementation of Model Context Protocol server for Mailgun APIs
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://www.npmjs.com/package/@mailgun/mcp-server) [](https://github.com/modelcontextprotocol) [](LICENSE)
Overview
A Model Context Protocol (MCP) server for Mailgun that gives AI agents a practical, workflow-oriented interface to send email, diagnose deliverability, and manage account operations.
[!NOTE] This MCP server runs locally on your machine and communicates over stdio. Mailgun does not currently offer a hosted version of this server.
Capabilities
- Messaging — Send emails, retrieve stored messages, resend messages
- Domains — View domain details, verify DNS configuration, manage tracking settings (click, open, unsubscribe)
- Webhooks — List, create, and update event webhooks
- Routes — View and update inbound email routing rules
- Mailing Lists — Create, view, and update mailing lists and their members
- Templates — Create, view, and update email templates with versioning
- Analytics — Query sending metrics, usage metrics, and logs
- Stats — View aggregate statistics by domain, tag, provider, device, and country
- Suppressions — View bounces, unsubscribes, complaints, and allowlist entries
- IPs & IP Pools — View IP assignments and dedicated IP pool configuration
- Bounce Classification — Analyze bounce types and delivery issues
- Validation — Validate email address deliverability and syntax before sending (
validate) - Optimize (Inbox Placement) — Retrieve inbox placement / seed test results to gauge deliverability (
optimize) - Inspect (Email Preview) — Retrieve email rendering and preview test results across clients (
inspect) - Account Limits — View custom monthly sending limits
The parenthetical label
62eb99dbeb1dOBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp-server --env MAILGUN_API_KEY=${MAILGUN_API_KEY} -- npx -y @mailgun/[email protected]Exposed tools (1)
1 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
get_metrics_summary | read |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (1 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (5)
return yaml.load(fileContents) as OpenApiSpec;
.oxlintrc.json
} from "../../src/custom-tools/get-metrics-summary.js";
import { registerCustomTools } from "../../src/custom-tools/index.js";@modelcontextprotocol/sdk, js-yaml, zod, @types/js-yaml, @types/node, husky, lint-staged, oxfmt
Gates applied: no_behavioural_pass.
62eb99dbeb1dfull audit observations/trust-audit/mcp-server/mailgun__mailgun-1.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | 62eb99dbeb1d | BLOCK | D | 69 | first audit |
Questions
What is the Mailgun MCP server?
Implementation of Model Context Protocol server for Mailgun APIs
What tools does Mailgun expose?
1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Mailgun safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does Mailgun need?
It reads MAILGUN_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Mailgun run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @mailgun/mcp-server at 2.1.3.
How current is this page?
The grade is for one exact copy of the source (62eb99dbeb1d), read on 2026-10-08. The repository is watched and re-audited when it changes.