The official MCP server to send emails and interact with Resend
MCPpedia last refreshed this data
Resend MCP is an MCP server that the official MCP server to send emails and interact with Resend. Its tool list has not been published yet over stdio, sse and http, requires no API key, and scores 83/100 on MCPpedia's security, maintenance and efficiency rubric.
Config is the same across clients - only the file and path differ.
{
"mcpServers": {
"resend": {
"env": {
"RESEND_API_KEY": "re_xxxxxxxxx"
},
"args": [
"-y",
"resend-mcp"
],
"command": "npx"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
An MCP server for the Resend platform. Send and receive emails, manage contacts, broadcasts, domains, and more — directly from any MCP client like Claude Desktop, Cursor, or Claude Code.
Run this in your terminal to verify the server starts. Then let us know if it worked - your result helps other developers.
npx -y 'pnpm' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Five weighted categories - click any category to see the underlying evidence.
pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph
## Summary The virtual store linker constructs package installation directories using `path.join(modules, pkgName)` where `pkgName` is extracted from lockfile `packages` keys via `dp.parse(depPath).name` without validation. A crafted `pnpm-lock.yaml` with traversal sequences in depPath keys (e.g., `../../../tmp/pwned@1.0.0`) causes package content to be written to arbitrary filesystem paths during `pnpm install`. This is an incomplete fix of GHSA-fr4h-3cph-29xv — the `safeJoinModulesDir` conta
pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install
## Summary When resolving a package, pnpm uses the resolved **manifest `name`** as a raw path segment for the isolated-linker import target. A tarball dependency whose `package.json` `name` is a scoped path traversal (`@x/../../…/<abs path>`) is therefore extracted **outside `node_modules`**, to an attacker-chosen absolute path, and can **overwrite existing files** there. Attacker controls the destination, filenames, and contents → arbitrary file write → **code execution** (e.g. `~/.zshrc`, `.gi
pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml
## Summary pnpm expands `${VAR}` environment placeholders in the `httpProxy` / `httpsProxy` / `noProxy` settings read from a project's `pnpm-workspace.yaml`. Because a project manifest is repository-controlled, a malicious repository that a victim merely clones and runs `pnpm install` in can route all install traffic through an attacker proxy whose hostname or userinfo embeds — and thereby exfiltrates — an environment secret such as `NPM_TOKEN` or `GITHUB_TOKEN`. This bypasses a trust boundary
pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml
## Summary pnpm expands `${VAR}` environment placeholders in the `httpProxy` / `httpsProxy` / `noProxy` settings read from a project's `pnpm-workspace.yaml`. Because a project manifest is repository-controlled, a malicious repository that a victim merely clones and runs `pnpm install` in can route all install traffic through an attacker proxy whose hostname or userinfo embeds — and thereby exfiltrates — an environment secret such as `NPM_TOKEN` or `GITHUB_TOKEN`. This bypasses a trust boundary
pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project
## Summary A crafted lockfile alias could reach several install-time filesystem joins. With `--trust-lockfile` or a frozen lockfile, traversal segments could create links outside the intended project or `node_modules` boundary. This patch validates dependency names and every virtual-store slot before creating directories, links, bins, or hoisted entries. ## Security boundary - A shared safe-join helper rejects traversal, absolute, platform-specific, and reserved dependency names before filesy
Click any tool to inspect its schema.
Be the first to review
Have you used this server?
Share your experience - it helps other developers decide.
Sign in to write a review.
Others in communication
Official TypeScript library for the Telnyx API
Open-source SMS gateway. Turn your Android phone into an SMS API: send and receive SMS from your apps over REST and webhooks. Self-hostable, with a free hosted plan.
Send email and newsletters with Mailtea over MCP, plus skills for email and website design.
CVSS scoring, IOC extraction, email header triage, hash/JWT/timestamp decoding, CISA KEV lookup.
MCP Security Weekly
Get CVE alerts and security updates for Resend Mcp and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.
Connect your AI agent to the Resend platform. Send and receive emails, manage contacts, broadcasts, domains, and more, directly from any MCP client like Claude, Cursor, or Claude Code.
We offer both a remote MCP server hosted by Resend and a local MCP server (this package).
Resend hosts the MCP server at:
https://mcp.resend.com/mcp
Connect any MCP client that supports remote servers (Streamable HTTP). There's nothing to install and no local process to run, which makes it the best option for web-based clients like Claude and hosted agent platforms.
When you connect, your client opens a browser window to log in to Resend and approve access using OAuth.
claude mcp add --transport http resend https://mcp.resend.com/mcp
Then run /mcp in Claude Code and select resend to complete the OAuth login.
In Claude (web or desktop), open Settings > Connectors > Add custom connector and enter:
https://mcp.resend.com/mcp
Open the command palette and choose "Cursor Settings" > "MCP" > "Add new global MCP server".
{
"mcpServers": {
"resend": {
"url": "https://mcp.resend.com/mcp"
}
}
}
codex mcp add resend --url https://mcp.resend.com/mcp
To use GitHub Copilot in VS Code, add the following to your settings.json:
{
"mcp": {
"servers": {
"resend": {
"type": "http",
"url": "https://mcp.resend.com/mcp"
}
}
}
}
{
"mcpServers": {
"resend": {
"serverUrl": "https://mcp.resend.com/mcp"
}
}
}
In Warp's Settings, navigate to Agents > MCP servers, and click +Add to add a new server.
{
"resend": {
"serverUrl": "https://mcp.resend.com/mcp"
}
}
If your client runs somewhere a browser login isn't possible (a server, CI, or a headless agent), pass a Resend API key as a Bearer token instead of using OAuth.
Claude Code:
claude mcp add --transport http resend https://mcp.resend.com/mcp --header "Authorization: Bearer re_xxxxxxxxx"
JSON config (Cursor, Windsurf, and others), add an Authorization header:
{
"mcpServers": {
"resend": {
"url": "https://mcp.resend.com/mcp",
"headers": {
"Authorization": "Bearer re_xxxxxxxxx"
}
}
}
}
The hosted server runs the same open-source code that's available on NPM as resend-mcp. If you prefer to run the server yourself, you can integrate it into any supported MCP client using npx. You'll need to:
The local server supports two transport modes: stdio (default) and HTTP.
Choose your preferred mode and client below to get started. Remember to replace re_xxxxxxxxx with your actual API key.
Install for all detected/selected agents and editors:
npx add-mcp resend-mcp --name resend --env "RESEND_API_KEY=re_xxxxxxxxx"
claude mcp add resend -e RESEND_API_KEY=re_xxxxxxxxx -- npx -y resend-mcp
codex mcp add resend \
--env RESEND_API_KEY=re_xxxxxxxxx \
-- npx -y resend-mcp
Open the command palette and choose "Cursor Settings" > "MCP" > "Add new global MCP server".
{
"mcpServers": {
"resend": {
"command": "npx",
"args": ["-y", "resend-mcp"],
"env": {
"RESEND_API_KEY": "re_xxxxxxxxx"
}
}
}
}
Open Claude