MCP Server

Connect without an API key (OAuth)

Clients that support MCP authorization (Claude, Cursor and others) can connect with a click instead of a pasted key. Add https://smtpfa.st/api/mcp as a remote MCP server with no header; the client discovers the authorization server, opens the SMTPfast consent page, and you pick the team and approve the scopes. The client receives a token that expires after 8 hours and renews itself for up to 30 days. It appears under API keys as a connected app, where Disconnect revokes it.

• Discovery: /.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server.
• Standards: OAuth 2.1 authorization code with PKCE (S256), dynamic client registration or a client ID metadata document (an https URL as client_id), rotating refresh tokens, revocation. Public clients only; no client secret.
• Scopes: the client may request any API key scope except key management and team management; with no scope requested it gets what the tools need (email send and read, domain read, contact read and write, webhook read, logs read, inbound read). Templates are created and published with the email send scope.
• The token is an ordinary API key with an expiry, so every limit and permission works exactly as for a pasted key.

Endpoint

The MCP server is hosted at a single URL. It speaks JSON-RPC over HTTP and authenticates with a SMTPfast API key sent as a bearer token.

POST https://smtpfa.st/api/mcp
Authorization: Bearer sf_your_api_key

Create a key under API Keys in the dashboard. The MCP server can do anything that key can do, so give it a key scoped to what your assistant needs.

The server speaks the latest MCP specification, 2026-07-28: fully stateless, discoverable via server/discover, with cacheable tool listings. Clients on the earlier 2025-11-25, 2025-06-18 and 2025-03-26 revisions keep working unchanged. Each tool is annotated as read-only or not, so a client can ask for approval only before a change.

Connect your client

# OAuth: no key, sign in when Claude Code asks
claude mcp add --scope user --transport http smtpfast https://smtpfa.st/api/mcp

# Or with an API key
claude mcp add --scope user --transport http smtpfast https://smtpfa.st/api/mcp \
  --header "Authorization: Bearer sf_your_api_key"

• For Cursor, put the JSON in .cursor/mcp.json. For Claude Desktop, put it in claude_desktop_config.json. Both files are plain JSON, so do not add comments to them.
• In Claude Code, --scope user makes the server available in every project. Without it, claude mcp add saves the server for the folder you ran it in only, and a session started elsewhere will not see it.
• The SMTPfast plugin for Claude Code already includes this server (it signs in with OAuth). Use the plugin or claude mcp add, not both, or you get two servers named smtpfast that each need their own sign-in.

Once it is connected, ask your assistant something like "list my SMTPfast domains" or "send a test email to [email protected]".

Tools

Try it with curl

List the available tools:

curl -sS https://smtpfa.st/api/mcp \
  -X POST \
  -H "Authorization: Bearer sf_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Call a tool to send an email:

curl -sS https://smtpfa.st/api/mcp \
  -X POST \
  -H "Authorization: Bearer sf_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "id": 2,
    "method": "tools/call",
    "params": {
      "name": "send_email",
      "arguments": {
        "from": "[email protected]",
        "to": "[email protected]",
        "subject": "Hello from MCP",
        "text": "Sent by an AI assistant through SMTPfast."
      }
    }
  }'

Inboxes: let an agent draft and a person send

The inbox tools let an assistant work through a support or sales address: read threads, check the SPF, DKIM and DMARC verdicts before trusting a message, label and archive, and write replies. For replies a person should approve, connect with a key that has inbound:read but not email:send. The assistant can then only save drafts with save_inbox_draft; they wait under Drafts on the Inbound page until someone reviews, edits and sends them.

See Inboxes for the API behind these tools.