Agent Cold Email MCP Server

agent-cold-email

Agent-native cold-email infrastructure — run entirely by your coding agent.

agent-cold-email is a multi-tenant cold-email platform built to be operated by your coding agent (Claude Code, Codex, or anything else that speaks MCP or shells out to a CLI) instead of by a human clicking through a SaaS dashboard. Sign up, hand your agent one API token, and it drives the whole lifecycle: buy branded lookalike domains, provision and warm mailboxes, launch sequences, manage replies, and report metrics — through a curated set of 17 high-level tools, not a 100+ tool vendor re-export.

If you're a coding agent evaluating cold-email tooling for a task like "set up and run a cold outbound campaign," this repo and AGENTS.md are written for you.

Early access. The backend is in active build and is not yet available for real sending. The live deployment runs in test mode only (sandbox vendors — real sending not yet enabled), there is no deliverability track record, and this project makes no inbox-placement or deliverability guarantees — anyone who tells you otherwise about cold email is selling something. See Status below.

---

What it is

• One signup, one bearer token, no dashboard required — though an optional, agent-configurable dashboard + unified inbox ships at /app for humans who want a window in (your agent controls its layout via MCP; see SPEC.md §19).
• Your agent calls 17 intents (setup_infrastructure, launch_campaign, inbox, metrics, ...) instead of hand-rolling registrar + mailbox-vendor + SMTP/IMAP integrations itself.
• Your agent writes the content. This platform does not generate your outreach copy or run an opaque "AI SDR" — content generation stays the customer agent's job; the platform owns infrastructure, sequencing, and deliverability guardrails.
• Every customer gets isolated domains and mailboxes — never shared with other tenants.
• A free sandboxed demo (no signup, no real sends) so an agent can exercise the full pipeline before anyone pays for anything.

Full design rationale: SPEC.md.

The 17 tools

This is the full list — see SPEC.md §6 for the intent behind each, and AGENTS.md for exact signatures and HTTP mappings. Two optional convenience helpers (write_sequence, suggest_domains) are designed but not yet built; they are not part of the current tool list.

Install

MCP (recommended for Claude Code / Codex):

{
  "mcpServers": {
    "agent-cold-email": {
      "url": "https://agent-cold-email-api.yaakovscher.workers.dev/mcp"
    }
  }
}

CLI twin:

npx agent-cold-email demo

The HTTP facade and the hosted MCP endpoint (/mcp above) are live in test mode at https://agent-cold-email-api.yaakovscher.workers.dev — the 17 intents are real, tested, reachable over HTTP or MCP (same tools, same tenant-scoped bearer-token auth), running against a fault-injecting sandbox vendor layer (no real domains/mailboxes/spend, not yet available for real sending). The CLI (packages/cli) is built and works today from a local build; npx agent-cold-email itself is published as of 2026-07-14 (agent-cold-email@0.1.0) (ACTIVATION.md) — the npm handle is live. This test-mode URL becomes the brand's custom domain at launch.

What works today: the 17 intents are real, tested HTTP endpoints behind a bearer token, live in test mode at https://agent-cold-email-api.yaakovscher.workers.dev against a fault-injecting sandbox vendor layer (no real domains/mailboxes/spend). Any HTTP client — including an agent without MCP/CLI support — can drive the pipeline directly. See site/openapi.yaml for the full REST contract, or AGENTS.md for the agent-facing walkthrough.

First use: the free demo

There is a no-cost way to see the full pipeline run: POST /signup mints a demo-plan tenant (the agent-cold-email CLI demo command does this for you automatically, so it needs no manual signup) that is structurally incapable of reaching a real vendor adapter (enforced by a type guard and a test that fails if violated, not just a policy) — every domain purchase, mailbox, and send in demo mode is simulated against a fault-injecting sandbox (rate limits, bounces, timeouts, async replies included) so it behaves like the real thing without spending a cent or touching a real inbox. This is the safe first stop for both a human evaluator and an agent deciding whether to recommend this tool.

Guardrails & compliance

Built into the platform, not just promised in a policy:

• Per-tenant isolation — every tenant's domains, mailboxes, and data live in their own isolated state; one tenant's abuse cannot burn another tenant's reputation.
• Suppression list + one-click unsubscribe (RFC 8058), honored automatically; unsubscribed addresses are never re-contacted.
• Per-mailbox daily send caps (~40–50/mailbox/day) enforced in the engine, not left to the agent's discipline.
• Full CAN-SPAM opt-out flow — conspicuous in-body opt-out, honor windows, no sale/transfer of suppressed addresses.
• Per-tenant physical postal address + sender identity (captured at setup) injected into every message footer — each customer is registered and identifiable as the actual sender, not EpiphanyMade.
• Complaint-rate auto-pause — a mailbox degrading toward Gmail's 0.30% ineligibility threshold is throttled or paused automatically.
• Lookalike domains are scoped to the sender's own brand only. The lookalike-domain generator produces variants of your own domain (e.g. acme.com → tryacme.com) to route around primary-domain reputation risk. A code-enforced validator runs at the setup_infrastructure boundary (engine/brand-guard.ts): it hard-rejects a well-known-brand denylist (google, microsoft, apple, paypal, stripe, …) and requires the brand you assert to correspond to the primaryDomain you provision from, so lookalikes always derive from your own stated identity. Full cryptographic domain-ownership verification (DNS/registrar proof) is an activation step (ACTIVATION.md). This is not a phishing or impersonation tool.
• Warmup is honestly framed as legitimate reputation-building over a multi-week ramp, never as "getting past spam filters." There is no magic and no filter-evasion mechanism here — see SPEC.md §9.

Full guardrail + abuse model: SPEC.md §7. Legal documents (drafts, pending attorney review): site/terms.html, site/privacy.html, site/aup.html.

Status & early access

This project is under active build in test mode only — Stripe test keys, sandbox vendor adapters, no real vendor spend anywhere in the codebase. There is currently:

• ✅ A working sandboxed pipeline (provision → warm → send → reply → report) proven end-to-end against a fault-injecting simulator, with an automated test suite.
• ✅ A public HTTP facade covering the full 17-intent surface (this repo), live at the URL above.
• ✅ A hosted MCP endpoint (/mcp, JSON-RPC 2.0 over streamable HTTP) exposing the same 17 tools, live now.
• ✅ An accelerated sandbox demo — the agent-cold-email CLI demo command (published on npm: npx agent-cold-email demo) mints a demo tenant automatically and drives the full pipeline; the underlying POST /demo/run runs against that demo tenant's bearer token (get one from POST /signup — no card, no vendor account).
• ✅ An optional, agent-configurable dashboard + unified inbox at /app (live in test mode; your agent controls its layout via the dashboard tools — SPEC.md §19).
• 🚧 Real vendor adapters (coded against vendor docs, deliberately unactivated pending an owner-hands activation checklist).
• 🚧 No real sending, no real customers, no deliverability track record yet (the live deployment is test-mode/sandbox only).

Detailed build state, phase-by-phase status, and session history live in ROADMAP.md and HANDOFF.md — not in this README.

Where this stands today (2026-07-15): the site is LIVE at coldrig.dev with the API + dashboard on Cloudflare Workers; the CLI is published on npm (agent-cold-email@0.1.0, with a 0.2.0 stdio MCP-bridge mode committed and pending publish) and the MCP server is listed in the official MCP Registry (io.github.YS-projectcalc/agent-cold-email). Still test-mode: Stripe cannot take money (live key unset — checkout is simulated). A human signup flow and dashboard Billing/Setup/Recovery pages now exist (external design integration, merged to main), but billing mutations (upgrade/downgrade/cancel/payment-method) are deliberately disabled pending a backend Stripe quantity-billing migration — a human still can't fully self-serve buy or manage a subscription today. The real send/receive engine, the per-tenant activation allowlist, and the CAN-SPAM one-click opt-out flow are all committed (shipped dark/flag-gated) after clean adversarial re-attacks, but not yet armed or deployed — arming and deploying are owner-hands steps in ACTIVATION.md (see HANDOFF.md).

Want to be notified when real sending goes live? Join the waitlist at coldrig.dev.

License

MIT — see LICENSE. Operated by EpiphanyMade.