MCP server

Let AI apps like Claude, ChatGPT or Cursor send transactional emails and write newsletter drafts for you. No API key needed: the app asks you to log in to obanox and allow access.

The Model Context Protocol (MCP) is the open standard AI apps use to call outside tools. The obanox MCP server gives them two tools that follow the same rules as the transactional email API and the posts API.

Server URL

https://obanox.com/api/v1/mcp

A remote server using the Streamable HTTP transport, with OAuth login. Supported protocol versions: 2025-06-18 and 2025-03-26.

Connect your AI app

Claude (claude.ai and Claude Desktop)

Open Settings → Connectors → Add custom connector, enter obanox as the name and the server URL above, then click Connect.

Claude Code

claude mcp add --transport http obanox https://obanox.com/api/v1/mcp

Then run /mcp in Claude Code and choose Authenticate.

Cursor, VS Code and other apps

Add the server to the app's MCP configuration (e.g. .cursor/mcp.json or .vscode/mcp.json); the app starts the login when it first connects.

{
  "mcpServers": {
    "obanox": { "url": "https://obanox.com/api/v1/mcp" }
  }
}
{
  "servers": {
    "obanox": { "type": "http", "url": "https://obanox.com/api/v1/mcp" }
  }
}

ChatGPT

Where your plan offers custom connectors (developer mode), add a connector with the server URL above and OAuth authentication.

Login and access

  1. The app opens obanox in your browser. Log in with your normal account.
  2. obanox shows which app asks for access. Click Allow access; you return to the app.
  3. The app can now use the tools for all newsletters of your account, until you disconnect it.

Connected apps are listed in your account under Account → API, where you can disconnect each one. An app stays connected while it is used at least once every 30 days.

Tools

Every tool takes a list argument: the slug of the newsletter to use. The app sees the slugs of your newsletters in the tool description and picks one.

send_email

Queues one transactional email to one recipient, such as an order confirmation or a notification. It is not for newsletters to your subscribers.

ArgumentRequiredDescription
listyesSlug of your newsletter.
fromyesSender address on one of your verified sender domains.
toyesRecipient address.
subjectyesSubject line.
html / textat least oneHTML and/or plain-text body.
from_namenoSender name.
reply_tonoAddress replies go to.

The result has the email's id and status: queued, or awaiting_approval while new senders' emails are held for your approval. The same requirements and limits as the transactional email API apply: an approved newsletter, a verified domain, your plan's daily limit, and no email to suppressed recipients.

create_newsletter_draft

Saves a newsletter post as a draft. It is never sent by the app: you review it under Posts and send or schedule it yourself.

ArgumentRequiredDescription
listyesSlug of your newsletter.
subjectyesTitle of the post and subject of the email. Max. 120 characters.
htmlyesContent as HTML; cleaned like in the posts API.
subtitlenoShort teaser below the title. Max. 255 characters.
template_idnoOne of your templates; left out: your default template.

The result has the post's id, status (draft) and edit_url, the link to the post in your account.

Errors

When obanox refuses a call, e.g. because the sender domain is not verified or a field is invalid, the tool returns an error result with the same message as the REST API, so the app can tell you or correct the call. Without a valid login the server answers 401 and the app starts the login again.

Building your own client

Any MCP client library with OAuth support works. Discovery follows the MCP authorization spec:

URL
Protected resource metadata (RFC 9728)https://obanox.com/.well-known/oauth-protected-resource
Authorization server metadata (RFC 8414)https://obanox.com/.well-known/oauth-authorization-server
Client registration (RFC 7591)https://obanox.com/oauth/register
Authorizationhttps://obanox.com/app/mcp/authorize
Tokenhttps://obanox.com/oauth/token

Clients are public: register without a secret (token_endpoint_auth_method: none) and use the authorization code flow with PKCE (S256). Redirect URIs must use https, http on localhost/127.0.0.1, or an app's own scheme. Access tokens last one hour; refresh tokens 30 days and are replaced on every refresh. Send the access token as Authorization: Bearer … with each POST to the server URL. The server is stateless: no sessions and no server-sent event stream (GET answers 405).