Which MCP tools let an agent verify an email sender on its own? #462

Activity

1. Silthus

   added

   wayfinder:research

   on Oct 14, 2026
2. Silthus

   added a parent issue on Oct 14, 2026

   • Map: send code-managed email templates with one PostHog call #461
3. Silthus

   marked this as blocking on Oct 14, 2026

   • Spec the email send API and slice it into PRs #464
4. Silthus

   self-assigned this

   on Oct 14, 2026
5. Silthus commented on Oct 14, 2026

   

   Silthus

   on Oct 14, 2026

   OwnerAuthor

   More actions

   Claimed by conductor dispatch. Runtime: Claude Code background Agent, worker research-462-sender-verification-tools, Sonnet 5.5 high.
6. Silthus commented on Oct 14, 2026

   

   Silthus

   on Oct 14, 2026

   OwnerAuthor

   More actions

   Runtime: Claude Code background Agent
   Worker: research-462-sender-verification-tools
   Cast: Sonnet 5.5, high (Survey). Wall-time cap: 30 minutes.
7. Silthus commented on Oct 14, 2026

   

   Silthus

   on Oct 14, 2026

   OwnerAuthor

   More actions

   Resolution

   Checked against upstream/master at f7a60dd0c7a (2026-10-14) and open PR state on both repos.

   Answer

   • No. On PostHog/posthog master an agent cannot verify an email sender through the PostHog MCP. None of the four steps has an MCP tool, and the REST routes for steps 2 to 4 reject scoped API keys and OAuth tokens ("This action does not support personal API key access"), because email/verify, PATCH email and both domain-connect actions are in neither scope list of the integrations viewset.
   • The tools exist as a draft only. #343 adds five MCP tools, scopes and schemas for those routes, a setting-up-an-email-domain skill and evals, behind the server flag workflows-email-domain-agent-setup. Its upstream twin PostHog#109703 is closed. No PR with these tools is open on PostHog/posthog.
   • feat(workflows): let agents set up an email sending domain via mcp #343 is conflicting and its last fork CI run had failures. Master has since changed the same serializer area (#115898 reply-to, #114682 default sender), so it needs a rebase before it is recreated upstream.
   • Even with feat(workflows): let agents set up an email sending domain via mcp #343, PostHog never writes DNS. The agent hands the person a Domain Connect URL to approve, or uses its own DNS tooling, or the person adds records by hand.
   • For the map: a task to land the sender tools (rebased feat(workflows): let agents set up an email sending domain via mcp #343, plus #345 and #351) should come before the spec. Otherwise the slice-1 skill must say verification happens in the PostHog UI. The slice-1 skill also has to account for two flags: the map's email send flag and workflows-email-domain-agent-setup.

   Step-by-step gap list (master today)

   Step	Tool on master	Gap	Fixed by
   1. Create sender	none (integrations_create not in tools.yaml)	no tool; route works for integration:write keys	#343 integrations-email-create
   2. Read DNS records	none; integration-get / integrations-list hide sender config	records only in POST email/verify response, route unscoped	#343 integrations-email-verify-create
   3a. Apply (one-click)	none	domain-connect/check and apply-url unscoped; person approves URL	#343 two Domain Connect tools
   3b. Apply (agent writes DNS)	not a PostHog tool	out of PostHog's reach by design	not planned
   4. Confirm verified	none	verify unscoped and writes SES on every call; config.verified hidden in integrations-list	#343, #324 read-only email/status, #351 config.verified
   5. Edit sender	none	unscoped route	#343 integrations-email-partial-update

   PostHog#113091 (open) already flips config.verified in the background for pending senders, but gives the agent no tool.

   PR table

   PR	State	Adds	Upstream?
   Silthus#343	draft, conflicting	5 MCP tools, scopes, skill, evals	needs to move (twin PostHog#109703 closed)
   Silthus#324	draft, conflicting	read-only GET email/status	needs to move (twin PostHog#110516 closed)
   Silthus#336, #337, #339, #341	draft stack on #324	DNS host detection, domain wizard logics, page, entry points	needs to move; not needed for agent verification
   Silthus#345	draft	one MAIL FROM label per domain	needs to move
   Silthus#351	draft	readiness tools, config.verified in integrations-list	needs to move
   Silthus#352	draft	sender access tests and OAuth guide text	moves with #343
   Silthus#353, #349, #350	draft	message category tools, phs_ messaging preferences, transactional email recipe	needs to move; not needed for verification
   Silthus#344, #346, #342	draft	MCP codegen guards, Domain Connect Safari fix	already upstream as drafts: #115566, #115571, #115561
   PostHog#109695	merged	keep existing DMARC in Domain Connect URL	done
   PostHog#113091	open, review required, conflicting	background re-check of pending senders	already upstream

   The local branch t3/native-mail-workflow-blocks (not on the fork) is an older combined version of the wizard and agent setup, now superseded by the stack above.

   Other open Workflows email PRs the email send API may collide with or reuse

   • Sandbox sender stack (PostHog#111368 to #112071): trial sender and recipient rule to reuse; sender validation and send-time routing may collide.
   • PostHog#112003, #112032: first-run sender resolution; reuse the "which sender" logic.
   • PostHog#112885, #112897: EmailService deps object and extracted pacing; every new call site collides.
   • PostHog#112850, #112859, #112870: worker outcome fixes an API send needs too.
   • PostHog#112316, #113056: local SES fake and shared test fixtures; reuse for the dev mail catcher proof.
   • Silthus#374, #376: real test emails to yourself; shares the test recipient rule.

   Context

   Full findings with file-level sources: research/email-sender-verification-tools.md on branch research/email-sender-verification-tools.

   Not checked: PR diffs beyond descriptions and file lists, and whether the agent-setup flag is on for any project.
8. Silthus

   closed this as completedon Oct 14, 2026