Postmark MCP Server: Tools, Setup and Security

The Postmark MCP server lets an AI agent send transactional email through Postmark, manage templates, search sent messages, diagnose delivery problems and manage bounces, suppressions and webhooks. It is published as the "Official Postmark MCP Server" from ActiveCampaign's GitHub account, under the MIT license. It runs locally and connects with a Postmark server token.

Checked against: Official Postmark MCP Server README on 28 October 2026. eSEOspace did not install or test this server.

At a glance

What it can do

The README groups the 24 tools like this:

• Email: sendEmail, sendEmailWithTemplate, sendBatch, sendBatchWithTemplate. sendEmail reaches one recipient or up to 50.
• Templates: listTemplates, getTemplate, createTemplate, editTemplate, deleteTemplate, validateTemplate.
• Messages: searchOutboundMessages, getMessageDetails.
• Diagnostics: diagnoseDelivery.
• Bounces: searchBounces, getBounceDump, activateBounce.
• Suppressions: listSuppressions, createSuppressions, deleteSuppressions.
• Stats and server: getDeliveryStats, getServerInfo.
• Webhooks: listWebhooks, createWebhook, deleteWebhook.

Postmark's own risk table is useful. It lists four tools as destructive and irreversible (editTemplate, deleteTemplate, deleteWebhook, deleteSuppressions) and four as sending tools. Four more change account state, and the other 12 are read-only.

How to connect it

You need Node.js v22 or higher, a Postmark account and a server token. The README's recommended client config uses npx:

{
  "mcpServers": {
    "postmark": {
      "command": "npx",
      "args": ["-y", "@activecampaign/postmark-mcp"],
      "env": {
        "POSTMARK_SERVER_TOKEN": "your-postmark-server-token",
        "DEFAULT_SENDER_EMAIL": "your-sender-email@example.com",
        "DEFAULT_MESSAGE_STREAM": "outbound"
      }
    }
  }
}

Postmark says this works in Claude Desktop, Cursor and other clients that accept the standard JSON format. The sender must be verified in Postmark. Optional settings include WEBHOOK_URL_ALLOWLIST, AGENT_LABEL (sent as an X-Agent-Label header) and LOG_FILE.

Security notes

Install the right package. In September 2025, Postmark warned that an unofficial npm package called postmark-mcp had added a backdoor in version 1.0.16 that secretly BCC'd emails to an external server. Postmark's statement says it had nothing to do with that package. The Register's report says Koi Security found it. Check that your config names @activecampaign/postmark-mcp. Our guide to MCP supply chain risks covers this pattern.

Other points from the README:

• Full token power: the server acts with the full permissions of POSTMARK_SERVER_TOKEN. Use a dedicated Postmark server with only the streams and senders it needs, and rotate the token if exposed.
• Annotations: tools carry readOnlyHint, destructiveHint and idempotentHint. Postmark says Cursor and Claude Desktop surface confirmation prompts for anything that is not a read. Note that the MCP tools specification says clients must treat annotations as untrusted unless they come from trusted servers, which is one more reason to install the genuine package. Learn more in MCP tool annotations.
• Webhooks persist: once registered, Postmark keeps posting event data to that URL. Set WEBHOOK_URL_ALLOWLIST to URLs you own.
• Logs: email addresses are partly masked in logs by default.
• Prompt injection: Postmark warns that malicious content in an email or template could trick the AI. It says never to auto-approve sending or destructive tools in untrusted environments.

See our MCP security center for more.

Alternatives

• Resend MCP server, hosted or local, with OAuth sign-in.
• Mailgun MCP server, which exposes no delete tools.
• Mailtrap MCP server, with sandbox testing.

Next step

If your product emails run through Postmark, give the agent its own Postmark server before you connect anything. eSEOspace can review the setup in an MCP readiness audit. Compare other providers in our MCP server directory.

Frequently asked questions