io.github.Melvynx/lumail is an MCP server that official Lumail email marketing MCP for campaigns, subscribers, and workflows. Its tool list has not been published yet over http, requires no API key, and scores 34/100 on MCPpedia's security, maintenance and efficiency rubric.
Config is the same across clients — only the file and path differ.
{
"mcpServers": {
"io-github-melvynx-lumail": {
"args": [
"-y",
"lumail"
],
"command": "npx"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Install Lumail's agent skills or connect Lumail to Claude Code and Codex. The repository includes reusable marketing and copywriting skills alongside the Lumail CLI and OAuth MCP plugin skills.
Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.
npx -y 'lumail' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Five weighted categories — click any category to see the underlying evidence.
No known CVEs.
Checked lumail against OSV.dev.
Be the first to review
Have you used this server?
Share your experience — it helps other developers decide.
Sign in to write a review.
Others in communication / marketing
Asynchronous coordination layer for AI coding agents: identities, inboxes, searchable threads, and advisory file leases over FastMCP + Git + SQLite
DataForSEO API modelcontextprotocol server
Programmable email inbox for AI agents — JMAP, PoW auth, stdio MCP server.
A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API
MCP Security Weekly
Get CVE alerts and security updates for io.github.Melvynx/lumail and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.
Install Lumail's agent skills or connect Lumail to Claude Code and Codex. The repository includes reusable marketing and copywriting skills alongside the Lumail CLI and OAuth MCP plugin skills.
Authentication is browser OAuth. There is no API token to create, paste, or store.
The fastest path is to let your agent do it. Paste this into Claude Code:
Read lumail.io/claude-code and install the Lumail plugin for me.
or into Codex:
Read lumail.io/codex and set up the Lumail connection for me.
or, for the terminal workflow (full API, including sending), into any agent:
Read lumail.io/cli and set up the Lumail CLI for me.
Prefer to run it yourself:
claude plugin marketplace add https://github.com/Melvynx/lumail-skills.git
claude plugin install lumail@lumail
claude mcp login plugin:lumail:lumail
Full guides: docs/claude-code-install.md · docs/codex-install.md
| Path | What it is |
|---|---|
.claude-plugin/marketplace.json | Claude Code marketplace descriptor |
claude/.claude-plugin/plugin.json | Claude Code plugin, declares the MCP server inline |
codex/.codex-plugin/plugin.json | Codex plugin metadata |
codex/.mcp.json | Codex MCP server configuration |
.agents/plugins/marketplace.json | Codex marketplace descriptor |
skills/lumail/ | The lumail CLI skill (npx lumail) — canonical copy |
skills/lumail-plugin/ | How to drive the MCP connection, its limits and errors |
skills/marketing/ | Marketing strategy, positioning, offers, funnels, and launches |
skills/copywritting/ | Conversion copy for emails, pages, ads, scripts, and CTAs |
claude/skills and codex/skills are real copies of skills/ (symlinks break
on Windows checkouts), so both hosts ship the same skills. Edit the
top-level skills/ first, then sync the copies.
The plugin points both hosts at https://lumail.io/mcp, an OAuth 2.1 protected
resource. The host registers itself through dynamic client registration, runs
PKCE, and stores the access token itself. During the browser flow you sign in,
pick which organization the agent may reach, and approve the scopes. Only
owners and admins of an organization can authorize it.
Access tokens carry the organization as a claim, so a session can never reach another organization in your account. Revoke from the connected-apps list in Lumail settings and access stops on the next request, with no local config to clean up.
Read — subscribers, tags, campaigns, campaign analytics and progress, workflows and workflow groups, org stats, subscriber growth, senders, custom fields, snippets, writing style.
Write — add subscribers, create and apply tags, create and edit campaign drafts, duplicate campaigns, create and configure workflow drafts.
Not available over OAuth — sending, scheduling, publishing or activating a
workflow, unsubscribing, and every delete. Those tools are not registered on
this endpoint, so an agent cannot reach them even with your approval. Do that
work in the Lumail app, or with npx lumail if you want it in a terminal.
npx lumail reaches the full API, including sending. It authenticates with the
same browser flow:
npx lumail auth login
The lumail skill in this repository teaches agents the whole CLI.