MCP server

A connected app never gets a key. It gets an OAuth access token, issued for one team, carrying only the scopes you approved on the consent screen, and you can revoke it from Connected apps at any moment.

The scopes you approve decide which tools exist. A grant without domains:write is not a server that refuses create_domain — it is a server that does not have one.

Two scopes reach further than their names suggest, so read them before approving. emails:read can cancel a scheduled send, because cancelling only ever prevents mail. team:write can turn AI assist on, which decides whether content you ask about is sent to the AI provider.

These are not tools that refuse. They are tools that do not exist.

• Mint, change or revoke an API key, or manage the grants it is itself using.
• Change your plan, your billing, or who is on your team.
• Delete anything — a domain, a webhook, a template, a segment, a broadcast, an automation — or erase a contact.
• Remove a suppression — an unsubscribe stays an unsubscribe, whoever is asking.
• Regenerate a domain's DKIM keys, rotate a webhook's signing secret, or take a registrar credential.

No scope reaches them either, so there is no consent screen anywhere that could hand them over. See Authentication for how the scopes and the API-key permissions relate.

74 tools, grouped so a client can load only the ones it needs. Every call goes through the same service the dashboard and the API use, so every rule applies unchanged. A refusal comes back as a tool result marked isError, carrying the error name the API would have answered with — so the assistant can read it and tell you which address unsubscribed, rather than reporting that something broke.

Every list takes limit (at most 25) and after. An html body over 4 KB is left out of what a tool returns, and a sent or received message's HTML is never returned at all.

create_webhook is the one tool that returns a secret: the endpoint's signing secret, once, because your endpoint cannot verify a delivery without it. It is your outbound secret, not a credential into Rasket. A claim started with claim_domain transfers the name by itself once its TXT record resolves, unless the current owner sent or verified recently.

describe_setup needs no scope and is registered whatever the toolset filter says, so it is always the first call an agent can make. It returns the setup recipe — the same steps as the Agents guide — with each step's tool, and a plan marking which steps this connection's scopes allow and which scopes are missing. With format: "json" it returns only the plan:

{
  "steps": [
    { "id": "create_key", "tool": null, "scope": null, "allowed": false, "reason": "No tool creates an API key: …" },
    { "id": "add_domain", "tool": "create_domain", "scope": "domains:write", "allowed": true, "reason": null },
    { "id": "send_broadcast", "tool": "send_broadcast", "scope": "broadcasts:write", "allowed": false, "reason": "Needs the broadcasts:write scope." }
  ],
  "missing_scopes": ["broadcasts:write", "automations:write"]
}

An agent that finds a scope missing should ask you to reconnect with it before starting, rather than stopping halfway through.

Four limits, counted per connected app, on top of your team's ten requests a second. They are deliberately low: an assistant is a person's hands, not a pipeline.

Over any of them, the call answers JSON-RPC error -32000 with a retryAfter in seconds. A refused call is not itself a tool call, so it does not hold the window open; a malformed batch is refused with -32600 before any tool runs and costs nothing. Each accepted broadcast and import is also written to your audit log as mcp.broadcast_sent or mcp.contacts_imported, naming the connected app.

One command. The client does the rest.

claude mcp add --transport http rasket https://api.rasket.com/mcp

Clients that take JSON take the same endpoint:

{
  "mcpServers": {
    "rasket": {
      "type": "http",
      "url": "https://api.rasket.com/mcp"
    }
  }
}

To load only some toolsets, name them in toolset, separated by commas. Leave it out for all seven. A tool outside the named toolsets is not registered: it is missing from tools/list, a call to it is answered as not found, and that call counts against no budget. An unknown toolset name is JSON-RPC error -32602 before any tool runs.

claude mcp add --transport http rasket "https://api.rasket.com/mcp?toolset=setup,send"

There is nothing else to configure. The first unauthenticated call is answered with a 401 whose WWW-Authenticate header names our protected-resource document, so the client discovers the authorization server, registers itself, and opens a browser for your approval. You pick the team; it exchanges its code for a token.

Every request to /api/v1 needs a User-Agent, and this one needs an Accept listing both application/json and text/event-stream. Every MCP client sends both already.

The server is stateless. Each request builds a server, answers, and forgets: no session id, no stream, nothing kept between calls. GET on the endpoint is 405 — there is no stream to open — and DELETE is a 204 that does nothing, because there is no session to end.

Every tool call is logged like any other API request. It appears in your Logs with source of mcp, the tool it ran, and the connected app that ran it, so a send an assistant made is as traceable as one your own code made.