Brevo MCP Server: Tools, Setup and Security

The Brevo MCP server lets an AI app work with your Brevo account in plain English. It covers contacts, email campaigns, templates, CRM deals, SMS, WhatsApp and account settings. Brevo hosts the server and documents setup for several AI clients.

Checked against: Brevo MCP server docs on 28 October 2026. eSEOspace did not install or test this server.

New to MCP? Start with what an MCP server is.

At a glance

What it can do

Brevo's docs describe modules rather than individual tool names. The main server combines "All features combined (27 modules)," including:

• Contacts, lists, segments, attributes, folders and import/export.
• Email campaigns, campaign analytics, templates and transactional templates.
• CRM: deals, companies, tasks, pipelines and notes.
• SMS and WhatsApp.
• Account setup: senders, domains, IPs, accounts, users, webhooks, external feeds and processes.

Brevo's changelog says the server's 193 tools "are now automatically generated from the Brevo OpenAPI specification." Each module also has its own endpoint, following the pattern https://mcp.brevo.com/v1/brevo_<module>/mcp. Examples in the docs include brevo_contacts and brevo_deals.

How to connect it

First, following Brevo's setup guide, create an MCP token in Brevo under Account, then SMTP & API, then API Keys. Check the MCP option when you create the key.

For Claude Code, Brevo gives:

claude mcp add --transport http --scope user brevo https://mcp.brevo.com/v1/brevo/mcp \
  --header "Authorization: Bearer paste-your-mcp-token-here"

For Cursor (~/.cursor/mcp.json):

{
  "mcpServers": {
    "brevo": {
      "url": "https://mcp.brevo.com/v1/brevo/mcp",
      "headers": { "Authorization": "Bearer paste-your-mcp-token-here" }
    }
  }
}

Brevo also documents Claude Desktop (through npx mcp-remote, which needs Node.js), Windsurf, now Devin Desktop (which uses serverUrl), VS Code (.vscode/mcp.json with a servers key) and Cline.

To limit access, swap the main URL for a module URL, such as https://mcp.brevo.com/v1/brevo_contacts/mcp.

Security notes

• One token, wide reach. The docs describe no scopes beyond the MCP option on the key. Use module endpoints to narrow what each connection can touch. Our guide to MCP excessive permissions explains why.
• Keep tokens out of shared files. Brevo's examples paste the token into config files. Use environment variables where your client supports them, as the Claude Desktop example does. See MCP secret leakage.
• Update old configs. Brevo's changelog entry on the MCP server says "All previous URL patterns containing /{token} are no longer valid." If you set it up earlier, move the token to a header.
• Rate limits apply. The same entry says Brevo added request limits to protect its services, so long agent loops may be throttled.
• Account-level modules. Users, senders, domains and webhooks change how your account works. Leave those modules off unless you need them.
• Contact data is personal data. Check your AI provider's data terms before you connect contacts or CRM.

The MCP security hub has more.

Alternatives

• Klaviyo MCP server: email and SMS with a read-only mode.
• HubSpot MCP server: CRM and marketing content.
• Buffer MCP server: social scheduling instead of email.

Next step

Start with one module, such as contacts or campaign analytics, before you connect the full server. Our MCP for marketing teams guide shows where to begin, and you can browse more MCP server profiles.

Frequently asked questions