Resend

Name: Resend MCP Server
Availability: InStock
Author: Resend

Communication85 tools

Send transactional email, run broadcasts to a contact list, manage domains and templates, and read inbound mail from your AI assistant. OAuth sign-in, verified-domain requirement, works with any MCP client.

Verified connector

Listed by Anthropic as a partner connector in its Connectors Directory.

Connection checked by Agentman on 18 August 2026.

Anthropic states this reflects the level of review a connector received, not a security audit.

Connect Resend via MCP

https://mcp.resend.com/

Works in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.

Resend Tools & Capabilities (85)

Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.

Limits

This connector sends real email to real people, and nothing on the server stops it. send-email reaches up to 50 recipients per call per Resend's source. send-broadcast reaches an entire contact segment. Resend documents no server-side confirmation step for either, and neither tool carries a safety annotation your client could act on. The only thing standing between a misread instruction and a delivered email is your MCP client's approval prompt. Configure it before connecting a production account.
Resend's own confirmation mechanism is prose, and it does not cover sending. Fourteen tools in Resend's source — every remove-* tool plus revoke-oauth-grant and batch-remove-suppressions — carry an instruction inside the tool description telling the model it must double-check with the user, warn that the action is irreversible, and may only proceed on explicit confirmation. That is a model instruction, not an enforced gate. It is absent from send-email, send-batch-emails and send-broadcast. Resend guarded every deletion this way and no send.
There is no read-only mode. Resend documents no query parameter or environment variable that disables the writing tools, unlike some comparable connectors. If you want a reading-only connection, the local server with a sending_access-scoped API key is the nearest approximation, and it still sends.
create-api-key mints a credential, and the reach boundary is undocumented. The tool takes a permission of full_access or sending_access; Resend describes full_access as able to create, delete, get and update any resource, and sending_access as restricted to sending, with an optional domain_id narrowing it to one domain. Resend's source instructs the model to display the token to the user because it is shown only once. What Resend does not document is whether an OAuth session can mint a key broader than itself. Resend's authorization server advertises the scopes full_access and emails:send, so a narrow grant is expressible — but Resend publishes no rule connecting a grant's scope to the permission an issued key may carry. We did not test it, and we make no claim either way. Treat it as an open question and prefer revoking rather than creating keys through an agent.
The consent screen may not be able to narrow the connection. Resend's RFC 9728 protected-resource descriptor publishes no scopes_supported field at all. Its authorization server separately advertises two — full_access and emails:send — so a send-only grant exists at the platform level. Because the MCP resource declines to enumerate scopes, we cannot say which of the two the connector requests, and we do not claim it requests either. Check what the OAuth screen actually asks for before approving.
A verified domain is a hard prerequisite. Resend states you cannot send or receive until a domain is verified through DNS. Budget up to 72 hours for propagation in the worst case.
Volume is capped by plan, and the Free tier is capped daily. Resend documents 3,000 emails per month on Free with a 100-per-day ceiling, and 1,000 marketing contacts. Exceeding the contact quota blocks broadcasts with a 403 and a validation_error. Both sent and received email count toward the quota, and so do test sends to resend.dev addresses.
10 requests per second per team. Resend documents this as the default cap across all API keys on a team, raisable for trusted senders on request. A bulk operation driven conversationally can reach it.
The directory listing understates the tool surface by seven. Resend's source registers 92 tools against the directory's 85, and the difference includes cancel-broadcast and a six-tool suppression list surface. A page or client sized on the 85-name listing will not know the connector can add and remove suppressions — the mechanism that determines who never hears from the account again.
Inbound mail is unfiltered by address. Resend states that *any* email sent to a receiving domain is received and forwarded, so an agent reading that stream reads mail from anyone who knows the domain. Resend's own guidance is to route on the to field.
We did not read the live tools and never called one. Our only contact with the server was an anonymous handshake that returned HTTP 401. Every statement above about tool behaviour comes from Resend's documentation, Resend's published source, or Anthropic's directory listing — each dated below.

Frequently asked questions

Do you need a verified domain to send email through the Resend connector?

Yes. Resend states that before you can send or receive emails you must have a verified domain associated with your account, added and confirmed through DNS records. Resend says domains often verify within 15 minutes of the DNS records being added, but that propagation can take up to 72 hours. Resend recommends sending from a subdomain rather than a root domain.

Does the Resend MCP server ask you to confirm before an email goes out?

Not for sending. Resend's open-source server writes a confirmation instruction into the descriptions of all 14 of its removal and revocation tools, telling the model it must double-check with the user first. The send tools carry no such instruction and no destructive safety annotation, so whether a send is confirmed depends entirely on your MCP client's approval settings.

Can the Resend connector create an API key with more reach than the session that made it?

Resend's documentation does not say. The create-api-key tool accepts a permission of full_access or sending_access, and Resend describes full_access as able to create, delete, get and update any resource. Resend publishes no rule about how a key's permission relates to the OAuth grant that created it, so treat that boundary as undocumented.

How do you test the Resend connector without emailing a real person?

Send to Resend's reserved resend.dev addresses. Resend documents delivered@resend.dev, bounced@resend.dev, complained@resend.dev and suppressed@resend.dev, each simulating one delivery event, and supports labels after a plus sign. Resend notes test emails still count against your account's sending quota, and blocks example.com and test.com addresses with a 422 error.

What are Resend's rate limits and sending quotas?

Resend documents a default maximum of 10 requests per second per team, applied across every API key on the team, and says it can be raised for trusted senders on request. Separately, the Free plan allows 3,000 emails per month capped at 100 per day. Exceeding a quota returns a 429 with daily_quota_exceeded or monthly_quota_exceeded.

Which Resend plan do you need for the MCP server?

Any plan, including Free. Resend's documentation names no plan requirement for the MCP server itself and gates nothing on tier. What your plan limits is volume: the Free tier covers 3,000 emails per month and 1,000 marketing contacts, and Resend says you cannot send a broadcast once you exceed your contact quota.

Can you run the Resend MCP server locally instead of connecting the hosted one?

Yes. Resend publishes the server as the resend-mcp package on NPM and states the hosted server runs the same open-source code. The local server takes a Resend API key rather than OAuth and supports stdio and HTTP transports. Resend lists creating an API key and verifying a domain as its prerequisites.