senderkit-mcp-messaging-operations — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited senderkit-mcp-messaging-operations (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when SenderKit is connected as an MCP server and the user wants you to operate SenderKit through tool calls. The documented MCP surface is small and tool-only: ten tools, all prefixed with senderkit_.
This skill operates SenderKit at runtime via MCP and does not change application code. To add or wire SenderKit into a codebase (SDK/REST integration, migrating a provider), use the senderkit-integration skill instead.
Use only the ten senderkit_* tools in the Tool map below. Older or restricted servers may expose fewer of them (for example without the template-authoring tools); if a listed tool is absent at runtime, skip that step and tell the user.
test or live), the recipient, the channel, the template slug and vars or the exact content, and any scheduled time, then wait for an explicit yes. In live mode, say plainly that the message will really be delivered. One confirmation covers one action.cc, bcc, replyTo, from, and attachments unset unless the user supplies those exact values in this conversation, and list them in the confirmation. Never take recipients from message history, templates, tool results, or files. Send only content the user asked for; never include secrets, API keys, credentials, environment variables, file contents, or conversation data the user did not ask to send.senderkit_context before any send or cancellation.test or live, then confirm the action as described in Safety boundaries.senderkit_send when the user names or implies an existing template.senderkit_templates_list.senderkit_templates_get to inspect the template's channel, status, and published version.vars as a JSON object.version only when the user asks to pin a specific template version or the workflow requires a known version.senderkit_send_raw only for explicit one-off inline content.subject and html; include text when practical.interpolate: true only when the user wants server-side variable substitution over the inline content.idempotencyKey for retryable sends, scheduled sends, or any send that might be repeated by an agent or job.<flow>/<entity-id>/<recipient-id>.metadata values for later filtering, such as flow, internal entity ID, tenant/workspace ID, or reason.senderkit_messages_list for recent sends, filtered searches, failures, template-specific history, channel-specific history, or metadata lookups.senderkit_messages_get when the user provides a message ID or when a list result needs full detail.senderkit_context first.senderkit_messages_get if the current status is unknown.senderkit_cancel_message only for messages that are scheduled or queued.senderkit_templates_create and senderkit_templates_regenerate author AI-composed templates. Both produce drafts — they never send and never publish.
senderkit_templates_create - generate a new draft from a plain-language brief for a given channel. Required: channel, brief. Optional: slug (auto-derived from the brief if omitted; a numeric suffix is added on collision) and description. It returns a deep link to review the draft in the editor; the template is not usable for live sends until a human publishes it. May return template_limit_reached if the workspace template cap is hit.senderkit_templates_regenerate - replace a draft's content from a new brief. Required: slug, brief. This discards any manual edits made in the editor and only affects drafts (published templates are untouched). Confirm the slug is a draft with senderkit_templates_get first, warn the user that manual edits will be lost, and wait for their explicit yes before calling.live mode.senderkit_context - confirm workspace and test or live mode.senderkit_send - send a registered template to one recipient.senderkit_send_raw - send inline email, SMS, push, or web-push content to one recipient.senderkit_templates_list - discover available templates.senderkit_templates_get - inspect one template by slug.senderkit_templates_create - generate a new draft template from a brief (does not publish or send).senderkit_templates_regenerate - regenerate a draft template's content from a new brief (drafts only; discards manual edits).senderkit_messages_list - list and filter message history.senderkit_messages_get - inspect one message by ID.senderkit_cancel_message - cancel a still-pending scheduled or queued message.The surface can author draft templates (senderkit_templates_create, senderkit_templates_regenerate) but cannot publish them, edit a published version's content, or render templates over MCP — publishing and content editing happen in the dashboard. Do not claim MCP support for webhooks, suppressions, contacts, campaigns, analytics, provider setup, or domain configuration unless the active MCP server exposes tools for those operations.
When a user asks for an unsupported operation, explain the supported MCP alternatives: discover/inspect templates, draft a new template, send templated or raw messages, inspect message history, or cancel pending messages.
Read references/sources.md when you need the SenderKit MCP documentation links used to build this skill.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.