Loading…
Send notifications, manage templates, and configure integrations with Courier.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The @trycourier/courier-mcp MCP server exposes 144 tools, focused primarily on communication capabilities. Its published description reads: "Send notifications, manage templates, and configure integrations with Courier". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates @trycourier/courier-mcp F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Unguarded destructive tools" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check @trycourier/courier-mcp's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add @trycourier/courier-mcp to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://mcp.courier.comStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
List messages you've previously sent. Filter by status, recipient, notification, provider, tags, or tenant.
Get the full details and status of a single message by its ID.
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: create_journey
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
te — create the shell with a trigger node, then call replace_journeyRecommendationAnnotate destructive tools and require human approval.
tool: create_journey
A tool description tries to alter the model’s use of another tool.
node, then call replace_journey to add send nodes after linking notification teRecommendationDescriptions must describe only their own tool.
tool: invoke_automation_template
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: invoke_ad_hoc_automation
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
scription":"The token set when the original automation was invoked (sRecommendationRemove side-channel parameters; constrain tool inputs.
tool: invoke_ad_hoc_automation
A tool description tries to alter the model’s use of another tool.
mation, use the cancel_automation tool instead.RecommendationDescriptions must describe only their own tool.
tool: list_automations
A tool description tries to alter the model’s use of another tool.
before calling invoke_automation_template. Optionally filter by version.RecommendationDescriptions must describe only their own tool.
tool: list_automations
The text tells the model WHEN to call this tool relative to others ("always call first", "before any other tool", "chain to X tool") — a toxic-flow injection that hijacks the agent’s orchestration rather than describing the tool.
the workspace. Always call this first to discover template_id values before calling iRecommendationTool metadata must describe only the tool, never sequence the agent’s calls.
tool: create_bulk_job
A tool description tries to alter the model’s use of another tool.
eate_bulk_job → add_bulk_users → run_bulk_job.RecommendationDescriptions must describe only their own tool.
tool: create_notification
A tool description tries to alter the model’s use of another tool.
sh it first via publish_notification (or pass state: 'PUBLISHED' on create). Link aRecommendationDescriptions must describe only their own tool.
tool: publish_notification
A tool description tries to alter the model’s use of another tool.
e called before send_message_template unless the template was created with state: 'PURecommendationDescriptions must describe only their own tool.
tool: publish_notification
The text tells the model WHEN to call this tool relative to others ("always call first", "before any other tool", "chain to X tool") — a toxic-flow injection that hijacks the agent’s orchestration rather than describing the tool.
le for sending. Must be called before send_message_template unless the template was cRecommendationTool metadata must describe only the tool, never sequence the agent’s calls.
tool: put_notification_locale
A tool description tries to alter the model’s use of another tool.
must reference an existing element by its id. Example for Spanish localRecommendationDescriptions must describe only their own tool.
tool: send_message_template
A tool description tries to alter the model’s use of another tool.
sending — call publish_notification first if needed. Example: { user_id: "user-123"RecommendationDescriptions must describe only their own tool.
tool: update_tenant_preference
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: patch_user_token
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
a specific push token. {"type":"object","properties":{"user_id":{"typRecommendationRemove side-channel parameters; constrain tool inputs.
tool: bulk_replace_user_preferences
A tool description tries to alter the model’s use of another tool.
listed topics are created or updated, and every existing override not inRecommendationDescriptions must describe only their own tool.
tool: list_journeys
A tool description tries to alter the model’s use of another tool.
invoke_journey, get_journey, or replace_journey. Optionally filter by versiRecommendationDescriptions must describe only their own tool.
tool: invoke_journey
A tool description tries to alter the model’s use of another tool.
template. Call list_journeys first to find the template_id. Example: { templRecommendationDescriptions must describe only their own tool.
tool: publish_journey
A tool description tries to alter the model’s use of another tool.
instead of publishing the draft. Returns 404 if there is no draft to publiRecommendationDescriptions must describe only their own tool.
tool: list_journey_templates
A tool description tries to alter the model’s use of another tool.
g send nodes in replace_journey.RecommendationDescriptions must describe only their own tool.
tool: replace_journey_template
A tool description tries to alter the model’s use of another tool.
placement. Call publish_journey_template afterwards to make it live.RecommendationDescriptions must describe only their own tool.
tool: put_journey_template_locale
A tool description tries to alter the model’s use of another tool.
t reference an existing element by its id.RecommendationDescriptions must describe only their own tool.
tool: create_provider
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ce this config, credential or settings mistakes can affect live sends—confRecommendationRemove side-channel parameters; constrain tool inputs.
tool: create_provider
A tool description tries to alter the model’s use of another tool.
ettings against list_provider_catalog before saving. The provider field must be a knoRecommendationDescriptions must describe only their own tool.
tool: update_provider
A tool description tries to alter the model’s use of another tool.
ent config with get_provider first; omitted optional fields are cleared. ChaRecommendationDescriptions must describe only their own tool.
tool: create_preference_section
A tool description tries to alter the model’s use of another tool.
afterwards with create_preference_topic.RecommendationDescriptions must describe only their own tool.
tool: release_digest
A tool description tries to alter the model’s use of another tool.
instead of waiting for the scheduled time. A 204 is also returned when thRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: replace_journey
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: put_journey_template_content
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: delete_audience
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: delete_brand
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: unsubscribe_user_from_list
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: delete_list
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: cancel_message
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: archive_notification
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: cancel_notification_submission
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: replace_profile
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: delete_profile
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: delete_user_list_subscriptions
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: delete_tenant
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: delete_tenant_preference
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: delete_tenant_template
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: delete_user_token
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: delete_user_preference_topic
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: remove_user_from_tenant
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: remove_all_user_tenants
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: bulk_replace_user_preferences
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: archive_request
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: archive_routing_strategy
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: archive_journey
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: archive_journey_template
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: cancel_journey
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: delete_provider
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: archive_preference_section
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: archive_preference_topic
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Get the rendered content (HTML, text, subject) of a previously sent message.
Get the event history for a message, showing each step in the delivery pipeline (enqueued, sent, delivered, etc.).
List notification templates. Optionally filter by cursor.
Get the published content blocks of a notification template.
List configured provider integrations for the workspace.
Fetch a single provider configuration by ID.
Retrieve a routing strategy by ID. Returns the full entity including routing, channels, and providers.
List the workspace's preference sections. Each section embeds its topics.
Create a new journey. Always created as a draft; making it live is a separate step this tool cannot perform. Send nodes are not allowed on create — create the shell with a trigger node, then call repl
Get a journey by ID. Pass version=draft to retrieve the working draft, or version=vN for a historical version. Defaults to published.
Replace (update) a journey draft. Full document replacement — include all nodes and properties in the body. The journey stays a draft; making the change live is a separate step this tool cannot perfor
Create a notification template scoped to a journey. Always created as a draft; making it live is a separate step this tool cannot perform. The template can then be referenced in journey send nodes. Ex
Replace the elemental content of a journey-scoped notification template. Overwrites all elements. The template stays a draft; making it live is a separate step this tool cannot perform.
Get an audience by its ID, including its filter definition.
List all members of an audience.
List all audiences in the workspace.
Create or update an audience with a filter definition.
Delete an audience by its ID.
Get a specific audit event by its ID.
List audit events in the workspace. Useful for tracking API usage and changes.
Generate a JWT authentication token for a user. Used for client-side SDK auth (Inbox, Preferences, etc.).
Invoke an automation run from an existing automation template. Call list_automations first to get the template_id. Example: { template_id: "auto-onboarding", recipient: "user-123", data: { plan: "pro"
Invoke an ad-hoc automation with inline steps. Valid step actions: send, send-list, delay, cancel, update-profile, invoke, fetch-data. To cancel a previously started automation, use the cancel_automat
List automation templates in the workspace. Always call this first to discover template_id values before calling invoke_automation_template. Optionally filter by version.
Cancel a running automation by its cancelation_token. This invokes a second ad-hoc automation with a single cancel step. The token must match the cancelation_token set when the original automation was
Create a new brand. The API requires settings — omitting it returns a 400. If you do not have specific brand colors, omit settings and a safe default will be used automatically (black primary, white s
Get a brand by its ID.
List all brands in the workspace.
Replace an existing brand with new values.
Delete a brand by its ID.
Create a new bulk job for sending messages to multiple recipients. Workflow: create_bulk_job → add_bulk_users → run_bulk_job.
Add users to an existing bulk job.
Run a bulk job, triggering delivery to all added users.
Get the status of a bulk job.
List the users in a bulk job.
Get the Courier SDK installation guide for a specific platform. For client-side SDKs (React, iOS, Android, Flutter, React Native), also generates a sample JWT.
Track an inbound event that can trigger automations. Requires event name, messageId (for deduplication), and properties.
Get all lists. Optionally filter by pattern (e.g. 'example.list.*').
Get a list by its ID.
Get all subscribers of a list.
Create or update a list by list ID.
Subscribe a user to a list. Creates the list if it doesn't exist.
Unsubscribe a user from a list.
Delete a list by its ID.
Restore a previously deleted list.
Replace all subscribers on a list with the given recipients.
Append subscribers to a list without removing existing subscribers.
Cancel a message that is currently being delivered. Returns the message details with updated status.
Resend a previously sent message. Loads the original send request and enqueues a brand-new send to the same recipient with the same content, producing a new messageId; the original message is unchange
Get the draft (unpublished) content blocks of a notification template.
Create a V2 notification template. name is required. Provide content inline or set it immediately after creation via put_notification_content. To send with this template you must publish it first via
Retrieve a notification template by ID. Optionally request draft, published, or a version such as v001.
Replace a notification template entirely (full document PUT).
Archive a notification template by ID.
List version history for a notification template.
Publish a notification template, making it available for sending. Must be called before send_message_template unless the template was created with state: 'PUBLISHED'. Publishes the current draft by de
List checks for a notification submission.
Update check statuses for a notification submission.
Replace the elemental content of a V2 notification template. Overwrites all elements. Use channel elements to target specific channels. Multi-channel example: elements: [{ type: "channel", channel: "e
Update a single element within a V2 notification template.
Set locale-specific content overrides for a V2 notification template. Each element override must reference an existing element by its id. Example for Spanish locale: { notification_id: "nt_01abc", loc
Cancel a notification template submission.
Get a user profile by their ID. Returns profile data including email, phone, and custom properties.
Create a new user profile or merge supplied values into an existing profile (POST). Existing fields not included are preserved.
Fully replace a user profile (PUT). All existing data is overwritten; include every field you want to keep.
Partially update a user profile via JSON Patch (RFC 6902). Use add/replace/remove operations on specific profile paths.
Delete a user profile permanently.
Get all list subscriptions for a user.
Subscribe a user to one or more lists. Creates lists that do not exist.
Delete all list subscriptions for a user.
Send a message to a user using inline title and body content (no template). Optionally specify routing channels.
Send a message to a user using a published notification template. The template must be published before sending — call publish_notification first if needed. Example: { user_id: "user-123", template: "
Send a message to all subscribers of a list using inline title and body content.
Send a message to all subscribers of a list using a notification template.
Get a tenant by its ID.
Create or replace a tenant. Tenants represent organizations or groups that users belong to.
List all tenants in the workspace.
Delete a tenant by its ID.
List users associated with a tenant.
Set the default notification preference for a subscription topic on a tenant. This controls tenant-level defaults — it does NOT set per-user preferences (use the user preferences API for that). The to
Remove default notification preference for a topic from a tenant.
List notification templates configured for a tenant.
Get a tenant notification template association by template ID.
Create or replace a tenant notification template (draft unless published is true).
Publish a version of a tenant notification template.
Get a specific version of a tenant notification template (e.g. latest, published, or v1).
Delete a tenant notification template. Returns 204 on success, 404 if the template does not exist for this tenant.
Get a translation for a specific locale (e.g. "en_US", "fr_FR").
Create or update a translation for a specific locale.
List all push/device tokens for a user.
Get a specific push/device token for a user.
Create or replace a push/device token for a user.
Add multiple push/device tokens for a user in one request. Overwrites matching existing tokens.
Apply a JSON Patch (RFC 6902) to a specific push token.
Delete a specific push token for a user.
Get a user's notification preferences (subscriptions, opt-outs, channel preferences).
Get a user's preference for a specific subscription topic.
Update a user's preference for a specific subscription topic (opt in, opt out, or set channel preferences).
Delete a user's preference for a specific subscription topic, reverting it to the topic's default status.
List all tenants a user belongs to.
Add a user to a tenant.
Remove a user from a tenant.
Add a user to multiple tenants at once. A custom profile can be supplied per tenant.
Remove a user from all tenants.
Additively create or update a user's preferences for one or more topics in a single request. Only the topics in the body are touched; existing overrides for other topics are left untouched. Partial-su
Replace a user's complete set of preference overrides in one request. The topics in the body become the recipient's entire override set: listed topics are created or updated, and every existing overri
Archive a send request and all its associated messages by request ID.
Create a routing strategy defining how notifications are delivered across channels and providers.
Replace a routing strategy. Full document replacement; missing optional fields are cleared.
Archive a routing strategy. The strategy must not have associated notification templates; unlink all templates before archiving.
List routing strategies in the workspace. Returns metadata only; use get for full details.
List notification templates associated with a routing strategy. Useful for checking linked templates before archiving.
List journey templates in the workspace. Call this first to discover journey IDs before calling invoke_journey, get_journey, or replace_journey. Optionally filter by version (published or draft).
Invoke a journey run from a journey template. Call list_journeys first to find the template_id. Example: { template_id: "j-onboarding", user_id: "user-123", data: { plan: "pro" } }.
Publish the current draft of a journey, making it live and invokable. Pass version to roll back to a prior published version instead of publishing the draft. Returns 404 if there is no draft to publis
Archive a journey. Archived journeys cannot be invoked but existing runs continue to completion.
List published versions of a journey, ordered most recent first.
List notification templates scoped to a journey. Journey-scoped templates can only be used by send nodes within the same journey. Call this to discover template IDs before wiring send nodes in replace
Get a journey-scoped notification template by notification ID. Pass version=draft to retrieve the working draft (required before the template has been published). Defaults to published.
Replace the draft of a journey-scoped notification template. Full document replacement. Call publish_journey_template afterwards to make it live.
Archive a journey-scoped notification template. Archived templates cannot be sent.
Publish the current draft of a journey-scoped notification template. Optionally pass version to roll back to a prior version.
List published versions of a journey-scoped notification template, ordered most recent first.
Fetch the elemental content of a journey-scoped notification template. Pass version=draft for the working draft, or vN for a historical version. Defaults to published.
Set locale-specific content overrides for a journey-scoped notification template. Each element override must reference an existing element by its id.
Cancel journey runs. Supply EXACTLY ONE of cancelation_token (cancels every run associated with the token) or run_id (cancels a single run). Cancelation is idempotent: a run that already finished or w
List available provider types from the catalog with their configuration schemas.
Create a new provider (integration) configuration. Once routing strategies or notification templates reference this config, credential or settings mistakes can affect live sends—confirm provider key a
Replace an existing provider configuration. Full replacement — retrieve current config with get_provider first; omitted optional fields are cleared. Changing API keys or settings affects live delivery
Delete a provider configuration. Returns 409 if the provider is still referenced by routing or notifications.
Create a preference section in your workspace. The section id is generated and returned. Add topics afterwards with create_preference_topic.
Retrieve a preference section by id, including its topics.
Replace a preference section. Full document replacement; missing optional fields are cleared. Topics attached to the section are unaffected.
Archive a preference section. The section must be empty: delete its topics first, otherwise the request fails with 409.
Publish the workspace's preferences page. Takes a snapshot of every section with its topics under a new published version, making the current state visible on the hosted preferences page.
List the topics in a preference section.
Create a subscription preference topic inside a section. The topic id is generated and returned. Fails with 404 if the section does not exist.
Retrieve a topic within a section. Returns 404 if the section or topic does not exist, or the topic belongs to a different section.
Replace a topic within a section. Full document replacement; missing optional fields are cleared.
Archive a topic within a section.
Release a digest schedule early — send what users have collected so far now instead of waiting for the scheduled time. A 204 is also returned when the schedule has no in-progress instances to release.
List the digest instances for a schedule. Each instance represents the events accumulated for a single user against the schedule, useful for monitoring accumulation before a digest is released.