# MCP server for Amazon SES email | Wraps

Source: https://wraps.dev/mcp

![Wraps Logo](https://wraps.dev/wraps-light-logo.png)![Wraps Logo](https://wraps.dev/wraps-dark-logo.png)

](https://wraps.dev/)

[](https://github.com/wraps-team/wraps)[Log in](https://app.wraps.dev/auth?mode=signin)[Sign up](https://app.wraps.dev/auth?mode=signup)

Toggle menu

wraps · mcp server

# The MCP server for email your agent owns.

$ npx -y @wraps.dev/mcp

Six tools over the AWS SES stack in your account — seven in enforced mode — covering send history, delivery events, domain status, suppressions, and guarded sending. Runs locally over stdio; your credentials never leave your machine.

[Read the MCP docs](https://wraps.dev/docs/mcp-reference)[View on npm](https://www.npmjs.com/package/@wraps.dev/mcp)

wraps · 6 tools · 7 in enforced mode

-   list\_recent\_sends
    
    Recent sends from your email history
    
    read
-   get\_email\_event\_log
    
    Full delivery timeline for a message
    
    read
-   verify\_domain\_status
    
    DKIM + verification status of a domain
    
    read
-   list\_suppressions
    
    Bounce and complaint suppression list
    
    read
-   estimate\_cost
    
    Real Wraps + AWS cost for a volume
    
    read
-   send\_email
    
    Send via your SES account, once write is on
    
    write
-   check\_send\_status
    
    Poll a send awaiting approval (enforced mode)
    
    read

## Your agent can answer email questions itself.

Deliverability debugging, domain checks, suppression lookups — the questions you'd open the AWS console for become one tool call in Claude Code, Claude Desktop, Cursor, or any MCP client.

list\_recent\_sends

read

List recent sends from your email history table — who, what, when, and current status.

“What did we send to acme.com this week?”

get\_email\_event\_log

read

The full delivery event log for one message: Send, Delivery, Bounce, Complaint, Open, Click.

“Why did the reset email to dana@ bounce?”

verify\_domain\_status

read

Verification and DKIM status of a sending domain, straight from SES.

“Is mail.myapp.com verified yet?”

list\_suppressions

read

Addresses on your SES suppression list, filterable by BOUNCE or COMPLAINT.

“Who complained in the last import?”

estimate\_cost

read

What a given send volume actually costs on Wraps + AWS, itemized — including whether the account is on the SES rate it should be.

“What would 500K emails a month cost us?”

send\_email

write

Send a transactional email through your SES account. Refuses to send until you set WRAPS\_WRITE\_ENABLED, and caps recipients per call.

“Email the weekly report to the team.”

check\_send\_status

read

Poll the outcome of a send that's waiting on operator approval (enforced mode).

“Did anyone approve that send yet?”

## One config block. No API key.

The server resolves AWS credentials from your environment — the same chain the AWS CLI uses. One difference from the CLI: the server reads the region from its own environment, so set `AWS_REGION` (or `AWS_DEFAULT_REGION`) in the MCP config or it won't start.

### Claude Code — project root

.mcp.json

```
{  "mcpServers": {    "wraps": {      "command": "npx",      "args": ["-y", "@wraps.dev/mcp"],      "env": {        "AWS_REGION": "us-east-1"      }    }  }}
```

Claude Code inherits your shell's AWS environment, so credentials carry over. Region doesn't come from your AWS profile, so pin it here.

### Claude Desktop, Cursor, Windsurf

claude\_desktop\_config.json

```
{  "mcpServers": {    "wraps": {      "command": "npx",      "args": ["-y", "@wraps.dev/mcp"],      "env": {        "AWS_REGION": "us-east-1",        "AWS_PROFILE": "your-aws-profile"      }    }  }}
```

GUI clients don't inherit your shell, so pass the region and profile explicitly. Full per-client setup lives in [the MCP reference](https://wraps.dev/docs/mcp-reference).

Both servers are published to the official MCP Registry as `dev.wraps/email` and `dev.wraps/docs`, and are listed on Smithery: [wraps/email](https://smithery.ai/servers/wraps/email) and [wraps/docs](https://smithery.ai/servers/wraps/docs).

## An agent with a send button needs a leash.

Your SES account carries your domain reputation. The Wraps MCP server treats sending as the privileged operation it is — three layers, from cautious default to hard enforcement.

Read-only by default

Out of the box, the server can look but not touch. send\_email stays disabled until you set WRAPS\_WRITE\_ENABLED=true — an explicit decision, not a default you have to find and turn off.

Allowlists and caps for write mode

When you do enable sending, you scope it: exact recipient addresses, allowed domains, a per-call recipient cap, and a locked from address. The agent sends what you permitted, nothing else.

Enforced mode for provisioned agents

Provisioned agents get a credential that can only invoke an enforcer Lambda in your account — never SES directly. Kill-switch, allowlist, and hourly/daily caps are decided server-side, with operator approval for anything outside policy.

Every guardrail variable is documented in [the MCP reference](https://wraps.dev/docs/mcp-reference).

Your SES. Your credentials. One config block.

[Read the MCP reference](https://wraps.dev/docs/mcp-reference)[Wraps for agents](https://wraps.dev/agents)