
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@eusend_dev/mcp
Advanced tools
Model Context Protocol server for the Eusend API — send email and manage domains, audiences, and broadcasts from any MCP client.
Model Context Protocol server for Eusend. Lets any MCP-compatible AI client — Claude Code, Claude Desktop, Cursor, Windsurf, and others — send email and manage domains, audiences, and broadcasts through your Eusend account.
It's a thin wrapper over @eusend_dev/sdk: each tool is a typed call into the
SDK. The same server runs two ways — stdio (local, launched by your client) and
HTTP (hosted/remote) — from one codebase.
| Area | Tools |
|---|---|
| Emails | send_email, list_emails, get_email, cancel_email |
| Domains | list_domains, get_domain, create_domain |
| Audiences & contacts | list_audiences, create_audience, list_contacts, create_contact |
| Broadcasts | list_broadcasts, get_broadcast, create_broadcast, send_broadcast |
Destructive operations (deleting domains, audiences, contacts, API keys) are intentionally
not exposed. send_broadcast is a bulk send — clients are instructed to confirm first.
Get an API key at https://eusend.dev/settings/api-keys.
claude mcp add eusend --env EUSEND_API_KEY=eusend_live_xxx -- npx -y @eusend_dev/mcp
Add to the client's MCP config (claude_desktop_config.json, .cursor/mcp.json, …):
{
"mcpServers": {
"eusend": {
"command": "npx",
"args": ["-y", "@eusend_dev/mcp"],
"env": {
"EUSEND_API_KEY": "eusend_live_xxx",
"EUSEND_FROM": "you@yourdomain.com"
}
}
}
}
Setting EUSEND_FROM pins a default sender so the agent doesn't have to guess one on
send_email / create_broadcast.
The same binary serves Streamable HTTP. The API key is taken per-request from the
Authorization: Bearer <key> header, so one endpoint serves many accounts.
# run locally on :3000
npx -y @eusend_dev/mcp --http --port 3000
# behind a TLS reverse proxy at mcp.eusend.dev
npx -y @eusend_dev/mcp --http --host 0.0.0.0 --port 3000 --allowed-hosts mcp.eusend.dev
Connect a client to it:
claude mcp add --transport http eusend https://mcp.eusend.dev/mcp
DNS-rebinding protection is on by default (localhost only); pass --allowed-hosts with
your public host when running behind a proxy.
| Flag | Env | Purpose |
|---|---|---|
--key | EUSEND_API_KEY | API key (stdio only; HTTP takes it per-request) |
--from | EUSEND_FROM / SENDER_EMAIL_ADDRESS | Default sender address |
--reply-to | EUSEND_REPLY_TO | Default Reply-To |
--base-url | EUSEND_BASE_URL | Override the API base URL |
--http | — | Run the HTTP transport instead of stdio |
--port | MCP_PORT | HTTP port (default 3000) |
--host | MCP_HOST | HTTP bind host (default 127.0.0.1) |
--allowed-hosts | MCP_ALLOWED_HOSTS | Comma-separated Host allowlist |
bun run build # bundle to dist/ (stdio + http entries)
bun run typecheck
bun run inspect # open the MCP Inspector against the stdio server
FAQs
Model Context Protocol server for the Eusend API — send email and manage domains, audiences, and broadcasts from any MCP client.
The npm package @eusend_dev/mcp receives a total of 228 weekly downloads. As such, @eusend_dev/mcp popularity was classified as not popular.
We found that @eusend_dev/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.