Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Publish blog posts, send newsletters and emails from Claude, Claude Code, Codex and ChatGPT. Send consent-based email and transactional email (OTP and MFA codes), and publish blog posts on your own domain. Connect to the hosted server with OAuth and nothing to install, or run it locally with an API key.
Ask your assistant things like:
Posts are always created as drafts. Before publishing, the assistant shows where the post will go (your blog, the newsletter, connected social accounts) and asks you to approve it. See Action confirmation for how approval works on the hosted and local servers. The newsletter email carries the subject, the cover image when one is set, a summary and a link to the published post, not the full post body. Transactional templates such as OTP codes send right away. Other emails wait until the recipient consents. See Email sending.
Hosted server URL:
https://mcp.goodsender.com/You sign in to GoodSender in the browser the first time the client connects. To use blog tools, you need a GoodSender workspace with a blog. To send the optional newsletter, set up its sender identity and a public blog address first.
On Free, Pro or Max: open Customize → Connectors, choose Add → Add custom connector, and enter https://mcp.goodsender.com/. Keep the sign-in option so the OAuth flow runs the first time you use the connector.
On Team or Enterprise, an organization owner first adds GoodSender in Organization settings → Connectors → Add → Custom → Web. Members can connect it after that.
claude mcp add --transport http goodsender https://mcp.goodsender.com/
claude mcp login goodsenderComplete the OAuth flow in the browser. Check the connection with claude mcp get goodsender, or run /mcp in an interactive session.
codex mcp add goodsender --url https://mcp.goodsender.com/
codex mcp login goodsenderThe Codex CLI and IDE extension share this configuration. The login command completes the browser flow.
Turn on developer mode under Settings → Apps & Connectors → Advanced settings. Create an app with the server URL https://mcp.goodsender.com/ and OAuth authentication, then sign in to GoodSender when prompted. Pick the app from the + menu in a new chat.
Publishing needs MCP apps with write actions. OpenAI offers these as a beta on Business, Enterprise and Edu workspaces, and an admin may have to allow developer mode. Other plans may connect read-only. Menu names change between ChatGPT releases.
Full guide: goodsender.com/docs/mcp.
The local server uses an API key. Create one on the API keys page of your GoodSender dashboard. Treat the key as a secret: never commit or share it.
<details> <summary><b>MCP Bundle (.mcpb file, easiest)</b></summary>
goodsender.mcpb file from the latest release.goodsender.mcpb file to open it in your AI client.<br/>Note: Not every AI client supports MCP bundles or local MCP servers yet. Use a different installation method if nothing happens on double-click.
</details>
<details> <summary><b>Docker image / self-hosting</b></summary>
Run via
docker run -d -e GOODSENDER_API_KEY=<Your API Key> -v goodsender-mcp-data:/data ghcr.io/good-sender/mcp:latestIf your goal is to run the agent using this MCP fully autonomously, set GOODSENDER_DISABLE_ACTION_GUARDS=true to skip all action confirmations completely. See Action confirmation.
or add to docker-compose.yaml on your home server
services:
goodsender-mcp:
image: ghcr.io/good-sender/mcp:latest
ports:
- "9889:9889"
environment:
GOODSENDER_API_KEY: <Your API Key>
# GOODSENDER_DISABLE_ACTION_GUARDS: "true" # skip all action confirmations
volumes:
- goodsender-mcp-data:/data
restart: unless-stopped
volumes:
goodsender-mcp-data:and run via
docker compose up -d</details>
<details> <summary><b>Manual configuration (JSON)</b></summary>
binaries.zip file from the latest release (includes MCP goodsender-mcp-* and CLI goodsender-* binaries). {
...
"mcpServers": {
"GoodSender": {
"command": "<path to the unzipped binaries>/goodsender-mcp-darwin-arm64",
"env": {
"GOODSENDER_API_KEY": "<Your API key>"
}
}
}
...
}_For other platforms you must reference a corresponding binary instead of darwin (macOS)_If your goal is to run the agent using this MCP fully autonomously, set GOODSENDER_DISABLE_ACTION_GUARDS=true to skip all action confirmations completely. See Action confirmation.
</details>
| Variable | Required | Meaning |
|---|---|---|
GOODSENDER_API_KEY | Yes | Your GoodSender API key. |
GOODSENDER_DISABLE_ACTION_GUARDS | No | true makes mutating tools run without a confirmation step. See Action confirmation. |
GOODSENDER_TELEMETRY | No | false opts out of usage and reliability telemetry. See Telemetry & privacy. |
Every tool declares whether it only reads, or changes something. Tools that publish, send, delete or change live state are marked destructive, so clients such as Claude ask you before running them.
mcp.goodsender.com): that client prompt is the approval step. Tools run when you approve the call, and confirm_action is not offered.confirm_action runs it once you approve. Set GOODSENDER_DISABLE_ACTION_GUARDS=true in the server environment to skip that step, for example for unattended loops (scheduled agents, CI).GoodSender sends email as well as blog posts. Permission protects deliverability, so cold outreach is not supported. Email tools work with the hosted server and with a local server.
send_pending_emails) or use another tool that sends email. Nothing is sent while the server is idle.From: identities on a verified domain and refer to them by name.<details> <summary><b>Example email prompts</b></summary>
#### Add 'John Doe <[email protected]>' and 'Jane Doe <[email protected]>' to the AI newsletter subscribers group
ℹ️ This will: - Create/update the recipients in the database - Add them to the "AI newsletter subscribers" recipient group, creating it if needed
#### Create a GoodSender template for a weekly AI news digest sent to the AI newsletter subscribers group
ℹ️ This will: - Create a draft email template in GoodSender format following best practices for email template creation - Display interactive preview of this template draft (if AI client supports it)
#### Increase the number of news in the digest to 5
ℹ️ Done during the template draft creation/editing, this will: - Modify the template accordingly - Display interactive preview of this template draft (if AI client supports it)
#### Send a test email to me: 'Good Sender <[email protected]>'
ℹ️ Done during the template draft creation/editing, this will: - Send an email with mocked data generated from the current template draft only to you
#### Save the template as "Weekly AI news"
ℹ️ Done during the template draft creation/editing, this will: - Convert the current template draft to a persistent template stored in the MCP server's database - Allow sending emails just by mentioning the template name
#### Gather this week's AI news and send them using the "Weekly AI news" template
ℹ️ This will: - Create and enqueue a personalized template-based email for each recipient in the AI newsletter subscribers group - For all recipients who haven't received an email with consent request, will request their consent for receiving emails from you - Send emails to all recipients who granted their email consent - Keep the other emails queued; they go out after the recipient consents, when you send pending emails
</details>
<img width="392" height="539" alt="Example 1" src="https://github.com/user-attachments/assets/155f6fae-61f0-4e56-b503-174793f109e5" /> <img width="392" height="539" alt="Example 2" src="https://github.com/user-attachments/assets/8916165a-68cc-4442-a49a-3f08e93da7ab" />
| Tool | What it does |
|---|---|
| Posts and newsletter | |
list_posts | List all posts, drafts and published, with the blog's byline and taxonomy. |
get_post | Get one post, including its markdown body. |
create_post | Create a draft post. It never publishes or sends. |
edit_post | Change a draft or published post. |
delete_post | Permanently delete a post. |
create_post_preview | Create a signed preview URL for a draft or published post. |
upload_post_image | Upload an image (JPEG, PNG, GIF or WebP) for a post and get back its URL. |
get_post_distribution | Show where a post goes when published: the newsletter and the dev.to, X, LinkedIn, Bluesky and Mastodon destinations. |
set_post_distribution | Choose those destinations and review their text, newsletter subject and summary. |
publish_post | Publish the post to the public blog, then act on its distribution plan. |
send_post_test | Send a test email of the post to one inbox. |
broadcast_post | Email a published post's newsletter to consented subscribers, at most once per post. |
reannounce_post | Post a published post to one announce destination (X, LinkedIn, Bluesky or Mastodon) again. |
| Blog settings and custom domain | |
get_blog | Get blog settings (title, description, sender, theme, custom domain) and whether a custom design is live. |
update_blog | Create or change blog settings, including SEO title and description. |
connect_blog_domain | Claim a custom hostname for the blog and get the DNS records to add. |
get_blog_custom_domain | Check custom domain status and DNS targets. |
remove_blog_custom_domain | Remove the blog's custom domain. |
| Blog design | |
blog_design_template_format | Documentation for the blog design template format. |
blog_design_list | List saved designs, flagging the active one and the stock one. |
blog_design_create | Create a new design from templates and images. |
blog_design_edit | Edit a design's templates. |
blog_design_get_latest_checkpoint | Get the latest version of a design. |
blog_design_checkpoint_list | List the versions of a design. |
blog_design_checkpoint_restore | Go back to an earlier version, deleting the newer ones. |
blog_design_save | Keep a version and delete the older ones. |
blog_design_activate | Make a saved design the live design of the blog. |
blog_design_image_upload_url | Get an upload URL for a logo or favicon. |
| Tool | What it does |
|---|---|
| Sending | |
enqueue_email | Queue an email in plain text, HTML or Markdown to addresses or groups. It is sent once the recipient consents. |
enqueue_template_email | Queue a template-based email. It is sent once the recipient consents. |
send_consentless_email | Send a built-in transactional template (OTP code, MFA enrollment, new device login, password or email changed, order receipt or completion) right away. |
send_pending_emails | Send queued emails whose recipients have consented since they were queued. |
send_template_draft_test_email | Send a test email from a template draft to one recipient. |
| Templates | |
template_format | Documentation for the email template format. |
create_template_draft | Start a new template draft. |
edit_template | Edit a template or draft with search-and-replace changes. |
get_template | Get a saved template by name. |
get_template_content | Get a template's current content, including unsaved edits. |
render_template_preview | Render a template preview with sample data. |
save_template | Save a template draft. |
list_templates | List email templates. |
delete_template | Delete a template and the emails created from it. |
| Recipients and groups | |
create_recipients | Add recipients and request their consent. |
list_recipients | List recipients with group memberships and their last known consent status. |
edit_recipient | Change a recipient's display name. |
delete_recipients | Permanently delete recipients and their emails. |
create_group | Create a recipient group. |
list_groups | List recipient groups. |
add_group_members | Add recipients to a group. |
remove_group_members | Remove recipients from a group. |
| Senders | |
create_sender_identity | Create a From: identity on a verified domain. |
edit_sender_identity | Change a sender identity's display name. |
list_sender_identities | List sender identities and whether each domain is verified. |
check_sender_domain_stats | Show email health metrics for each sender domain. Read-only. |
| Action confirmation (blog and email) | |
confirm_action | Run an action you approved, for both blog and email tools. Present only on a local server with action guards on (see Action confirmation). |
Is there a blog platform with an official MCP server? Yes. GoodSender publishes this server for its blog platform. Connect the hosted server at https://mcp.goodsender.com/ with OAuth, or run it locally. See the MCP connection guide.
How do I publish a blog post from Claude Code? Add the server with claude mcp add --transport http goodsender https://mcp.goodsender.com/ and sign in with claude mcp login goodsender. Then ask Claude Code to draft the post, show the preview and publish it. The MCP connection guide walks through your first publish.
Can Codex publish posts to my blog on my own domain? Yes. Connect Codex with codex mcp add goodsender --url https://mcp.goodsender.com/, then ask it to connect your domain. It returns the DNS records you add at your DNS provider, and published posts appear at that address. Setup steps are in the MCP connection guide.
Can it send the post as a newsletter at the same time? Yes. Select the newsletter in the post's distribution, and publishing emails it to subscribers who have given consent. The blog needs a sending domain, a From: address and a public address first. The email has the subject, the cover image when one is set, a summary and a link to the post, not the full body. See how publishing from Claude and ChatGPT works.
How do I send email from Claude or Claude Code? Connect the server as in Quick start, then ask for the email in plain words, for example "Email the March update to the beta-users group." Recipients who already consented get it right away. Anyone else gets a consent request, and the email goes out after they consent, when you send pending emails.
Which emails skip consent (transactional/OTP)? Only the built-in transactional templates: OTP code, MFA enrollment, new device login, password changed, email changed, order receipt and order completed. send_consentless_email sends them right away. Custom emails and custom templates always wait for consent.
For side-by-side comparisons with other blog and newsletter platforms, see GoodSender vs WordPress, Ghost, beehiiv and Hashnode.
Telemetry is enabled by default. MCP server sends aggregate usage and reliability metrics to GoodSender to help improve the product.
Typical signals include:
We do not intentionally collect email bodies, recipient addresses, or template contents as part of this telemetry.
You can opt out of telemetry collection by setting GOODSENDER_TELEMETRY=false in the MCP server environment.
See the [GoodSender Privacy Policy](https://joylabs.com/legal/privacy-policy) for how personal data is handled by the service.
GOODSENDER_TELEMETRY=false~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.