Coding agent send-only emailSet up scoped sending without giving the agent inbox access.

Send-only on a Send mail grant means the agent can send transactional mail through POST /v1/emails or the MCP send_email tool. It cannot use Inbox or Full tools: no listing inbox conversations, no reading inbox message bodies, no contact or campaign changes. If the session is hijacked, the attacker can send from your verified addresses on that domain but cannot browse your inbox or audience data through Inbox or Full grants.

That is different from the inbox products that dominate search results. AgentMail, email-agent-mcp and most Gmail OAuth tutorials wire read plus send by default. They are the right shape when the agent must triage mail. They are the wrong default when you only want password resets, deploy notifications or receipt emails from your app.

The threat model for why read-plus-send is dangerous is on /guides/ai-agent-email-permissions. This page is the setup: how to wire send-only in about thirty minutes.

Meta's Agents Rule of Two (October 2025) says an agent may satisfy at most two of three properties in one session: [A] it processes untrustworthy inputs; [B] it can reach sensitive systems or private data; [C] it can change state or communicate externally.

A transactional send agent has property C (it sends email). It should not also have A (reading mail from strangers) or B (your inbox or contact list) in the same session. Receipts, magic links, deploy alerts and webhook-driven notifications are all two of three: external communication without reading untrusted mail or your private list.

On a SendBunny install, every agent connection gets one of three presets, scoped to the domains an admin chooses. Pick the smallest preset that covers the job.

For a coding agent that only fires transactional mail, choose Send mail for one sending domain. Disconnecting from the dashboard revokes access within a minute. Grants are per domain today, not per inbox address, so two agents on the same domain share the same grant. Per-inbox grants are not available today.

Both paths hit the same /v1 API. The difference is how the agent authenticates and who approves the scope.

Never paste either credential into the model context, a committed config file or a chat log. Use a secrets manager or your host's secret store. Bastion's March 2026 survey found 22% of MCP server docs still recommend plaintext .env files; treat that as a last resort on a laptop, not in production.

The in-app connect guide covers Cursor, Claude Code, Claude Desktop, Codex and VS Code. The steps below are the send-only path.

1. An admin opens Settings → API keys → Agents (MCP) on the install.
2. The developer runs the connect command (replace YOUR-INSTALL with the CloudFront hostname from the API keys page).
3. The browser opens for OAuth sign-in. An admin approves Send mail for the sending domain only.
4. The agent's first call on any grant is list_domains. Then it may call send_email for verified From addresses on that domain.

claude mcp add --transport http sendbunny https://YOUR-INSTALL/mcp
# sign in in the browser; admin picks Send mail for chosen domains
# first call: list_domains

For a backend service or a headless agent on a VPS, an API key is simpler than OAuth.

1. Open Settings → API keys on the install.
2. Click Create key, name it for the agent (for example ci-deploy-bot).
3. Leave Send mail selected (the default preset). Open Show scope ids and confirm only `email:send` is checked.
4. Store the key in your secrets manager as soon as it is created.
5. Point the agent at POST /v1/emails on the install's /v1 base URL (shown on the same page).

POST /v1/emails
x-api-key: <API_KEY>
Content-Type: application/json

{"from":"alerts@yourdomain.com","to":["user@example.com"],"subject":"Deploy finished","text":"Build 4821 is live."}

Send-only scope limits what the credential can reach. It does not limit how many messages the agent sends or who it picks. You still need discipline on volume and recipients.

• Fixed recipients in your code. The to array should come from your database or event payload, not from free-form model output. If the model can set arbitrary recipients, a prompt injection can turn send-only into an exfiltration channel.
• One job per key or grant. A CI notification bot gets its own key. Do not reuse the same credential for an inbox triage agent.
• Respect SES quotas. Amazon SES enforces a 24-hour sending quota and a maximum send rate per account. AWS can pause sending when bounce or complaint rates climb. SendBunny surfaces SES account status in Settings; it does not add a per-agent send cap today.
• Suppression is automatic. Hard bounces and complaints go on an account-wide suppression list that every send path enforces. A suppressed recipient returns 422.
• Test with simulator addresses. While the SES account is in sandbox, use success@simulator.amazonses.com and the other SES mailbox simulator addresses so a confused agent cannot mail real people during setup.

1. Confirm the job is send-only (no inbox read needed). If it needs read and send, add a draft gate per the permissions guide.
2. Create a scoped API key with email:send only, or an MCP grant with Send mail for one domain.
3. Store the credential in a secrets manager, not in repo or chat.
4. Set to from your app logic, not from model output.
5. Send a test to an SES simulator address. Confirm delivery in the transactional list.
6. Disconnect or rotate the credential and confirm the next call fails.
7. After the test, review the transactional send list for the test message. Rotate or disconnect the credential when the job ends.

• The agent must read and reply inside your personal Gmail. Use a read-only connector, keep send manual, and read the permissions guide first.
• You need per-inbox grants for many agents on one domain today. Grants are per domain; per-inbox grants are not available today.
• You will not run an AWS account. The send-only pattern still applies with any ESP that offers scoped send credentials; the product section below is SendBunny-specific.
• You need SMTP. SendBunny is HTTPS API and MCP only today.