The token grants full access to everything on the Postmark server it belongs to, and this MCP server hands all 24 tools to whatever client connects — four of which delete data permanently and four of which send real email. The project's own advice is the right one: create a dedicated Postmark server for MCP traffic, give it only the message streams and verified senders it needs, and set the webhook allowlist so a stray call cannot register a callback you do not own.
A Node MCP server backed by your Postmark account. It covers the full transactional email loop: sending, templates, message search, delivery diagnostics, bounces, suppressions, stats and webhooks.
- 24 tools, with MCP annotations so a client can auto-approve reads and prompt before anything that changes state
- Sending: `sendEmail`, `sendEmailWithTemplate`, `sendBatch`, `sendBatchWithTemplate`, with open and click tracking on every send
- Templates: `listTemplates`, `getTemplate`, `createTemplate`, `editTemplate`, `deleteTemplate` and `validateTemplate`
- Investigation: `searchOutboundMessages`, `getMessageDetails`, and `diagnoseDelivery` for a message that did not land
- Bounces and suppressions: `searchBounces`, `getBounceDump`, `activateBounce`, `listSuppressions`, `createSuppressions`, `deleteSuppressions`
- Account and delivery data: `getDeliveryStats`, `getServerInfo`, plus `listWebhooks`, `createWebhook` and `deleteWebhook`
Node.js v20 or higher and a Postmark account. `POSTMARK_SERVER_TOKEN`, `DEFAULT_SENDER_EMAIL` (a verified sender) and `DEFAULT_MESSAGE_STREAM` are required. Optional: `WEBHOOK_URL_ALLOWLIST` to restrict which HTTPS prefixes `createWebhook` will accept, `AGENT_LABEL` to tag this instance's API traffic, and `LOG_FILE` to persist the structured logs.
One command plus a key — npx -y @activecampaign/postmark-mcp, then supply credentials