MCP server

Notifyzr ships a Model Context Protocol server at mcp.<DOMAIN>, so an AI assistant can read your contacts, segments, templates and delivery history — and send an email — through the same API and the same permissions as any other client.

Connecting

The server speaks Streamable HTTP at the origin root. Authenticate with the same X-API-Key you use for the REST API.

{
  "mcpServers": {
    "notifyzr": {
      "url": "http://mcp.localhost/",
      "headers": { "X-API-Key": "your-api-key" }
    }
  }
}

A request without the header is rejected with 401 before the session is established, rather than failing later on the first tool call.

How permissions work

The server holds no credentials of its own. Your key is relayed verbatim to the public API, which decides what it may see — so organization scoping, quotas and rate limits apply exactly as they would to a direct API call.

It follows that the server can grant no access your key does not already have, and that a key scoped to one organization exposes exactly that organization through MCP.

Tools

Everything is read-only except send_message.

Tool	Reads
list_contacts, get_contact	Contacts, with search and subscription filtering
list_unsubscribes	The suppression list
list_contact_properties, list_contact_tags	Property and tag definitions
list_segments, get_segment, list_segment_contacts	Segments and their live membership
list_templates, get_template	Templates and their draft/published state
list_forms, list_form_submissions	Forms and what they captured
list_messages, get_message	Delivery history
list_broadcasts, get_broadcast	Broadcast progress
list_automations, get_automation, list_automation_runs, get_automation_metrics	Automations and why a run did what it did
list_domains	Sender domains and verification state
get_usage	Plan, quota limits and current usage

send_message sends real email

send_message is annotated as not read-only and not idempotent, so a well-behaved client will prompt before calling it and will not silently retry it. It spends quota, refuses an unverified sender domain, refuses a draft template, and drops opted-out recipients — the same rules as the REST endpoint.

Deliberately not exposed: creating, updating or deleting records, and POST /v1/broadcasts/{id}/send. Mailing an entire segment is irreversible and its blast radius is however many contacts the filter matches at that moment; that belongs behind a human in the dashboard, not behind a tool annotation.

Notes

• Ids are UUIDs and are validated as such before any call is made upstream, so an assistant cannot guess or construct one.
• Sessions are held in Redis, so they survive across workers and across replicas.
• An upstream rejection comes back as a readable tool error — including the API's own error code — rather than a protocol failure, so the assistant can correct itself and try again.