MCP server

Connect AI agents like Claude and OpenAI to Messy over the Model Context Protocol. Agents sign in with OAuth, act only in the environment you approve, and every call is logged.

Messy exposes a Model Context Protocol server, so an AI agent can work your account the way a teammate would: send messages, manage templates and segments, run campaigns and drips, configure channels, work the inbox and read analytics. Every capability of the REST API is exposed as an MCP tool, scoped to the permissions of the user who connected.

Turn it on first. In the app, open Settings → MCP Server and flip the master switch. Until it’s on, connections are rejected.

Connection URL

Point any MCP client at this URL. It’s a Streamable-HTTP endpoint with OAuth built in, so there is no key to paste:

text
https://api.messy.sh/mcp

Self-hosting? Use your own deployment’s host with the same /mcp path.

Connect an agent

Claude

In Claude, add a custom connector and paste the URL above. Claude discovers the authorization server automatically, opens the Messy sign-in, and asks you to approve an environment. Once approved, Messy’s tools appear in the conversation.

OpenAI

Add the same URL as a remote MCP server (for example in the Responses API’s tools with type: "mcp", or in a client that supports remote MCP). The OAuth flow runs the same way.

How authorization works

Messy is a full OAuth 2.1 authorization server. The flow is standard, with PKCE required and no shared secret:

  • The client registers itself and starts an authorization request.
  • You sign in to the Messy dashboard and land on a consent screen, where you pick which environment the agent may act in and approve the requested scopes.
  • The client exchanges the resulting code for an access token (short-lived) and a refresh token (rotated on use). Tokens are stored hashed and are bound to the one connection.

Every tool call runs at the connecting user’s own permission level. A member can’t reach admin-only tools; an admin can. All the usual rules apply exactly as they do in the app: delivery rules, consent, template rendering and environment scoping.

What agents can do

Tools are grouped into scopes, which the client requests and you approve at consent. tools/list returns only the tools your scopes and role allow.

FieldTypeDescription
messagingscopeSend and trigger messages, list and retry deliveries.
templatesscopeTemplates, layouts, folders and repo sync.
audiencescopeIdentify, list and manage contacts, device tokens and imports.
segmentsscopeBuild, preview and clean segments.
campaignsscopeCreate, send and measure broadcast campaigns.
automationsscopeDrip campaigns and delivery rules.
channelsscopeIntegrations, sending identities and environments.
inboxscopeConversations, mailboxes, canned responses and help-desk stats.
socialsscopeSocial regions, calendar, posts and publishing.
analyticsscopeDashboard metrics.
adminscopeAccount, user and environment management. Admin users only.

Access controls and audit log

Access is gated at three levels, re-checked on every call:

FieldTypeDescription
Master switchaccountOne toggle turns the whole MCP server on or off for the account.
Per-useruserDisable a teammate to block all of their connections at once.
Per-connectionagentRevoke a single agent without touching the others.

Every tool call an agent makes is written to a usage log: the tool, the user, the outcome and how long it took. Find it, along with the switches above and the list of connected agents, under Settings → MCP Server.

An MCP connection carries the same power the connecting user has in the app. Only enable it for people you’d trust to run those actions, approve the narrowest environment that fits, and revoke connections you no longer recognise.