Connect an AI assistant (MCP)

The app runs an MCP server, so an AI assistant can inspect your setup, manage your HTTP requests and tidy up your media library directly, instead of you copying configuration back and forth.

Useful things it can do: audit which email layouts reference a secret that is about to rotate, find every uploaded image nothing uses any more, explain why yesterday's sends failed, or build a new HTTP request from a third-party API's documentation.

Endpoint

POST https://shopify.workflow-transactional-email.app/api/mcp

Transport is Streamable HTTP. Authentication is the same bearer key as the REST API - see Authentication and API keys.

Connecting

The MCP tab on the app's Developer page generates a copy-ready command with your URL and key already filled in, for Claude, Claude Desktop, Cursor, VS Code and Gemini CLI. Use that rather than typing it by hand.

For Claude Code the command looks like this:

claude mcp add --transport http flow-transactional-email \
  https://shopify.workflow-transactional-email.app/api/mcp \
  --header "Authorization: Bearer fak_your_key_here"

For editors that use a JSON config, the shape is:

{
  "mcpServers": {
    "flow-transactional-email": {
      "url": "https://shopify.workflow-transactional-email.app/api/mcp",
      "headers": {
        "Authorization": "Bearer fak_your_key_here"
      }
    }
  }
}

Available tools

The tool set reflects your key's level. A read-only key does not merely get refused when it calls a write tool - it never sees that tool in the list at all, so an assistant cannot be talked into attempting it.

Read (11 tools)

Email: list_email_templates, get_email_template, list_smtp_configs, list_senders

Secrets: list_secret_keys (names only)

HTTP requests: list_http_requests, get_http_request

Media: list_files (pass usage: true to see what still references each file)

History: list_history, get_history_entry, get_stats

Read & write (adds 4)

create_http_request, update_http_request, delete_http_request, delete_file

Read, write & execute (adds 1)

test_http_request - runs a configured HTTP request against the real target.

Tidying the media library

A good use for an assistant. Ask it to list your files with usage included, then delete the ones nothing references:

"List my uploaded files with usage and tell me which ones nothing is using. Then delete those."

delete_file is refused with a 409 if any email layout or header/footer preset still references the file, and the refusal names what is using it - so the assistant cannot remove a logo a live email still needs, even if you ask it to.

What the assistant can never see

There is deliberately no tool that returns a secret value, an SMTP username or password, or a mailbox sign-in token. list_secret_keys returns names only.

That is the point of the design: you can ask an assistant to write an HTTP request that authenticates with your payment provider, and it will reference {{ secrets.stripeApiKey }} correctly without the key itself ever entering the model's context.

History returned through MCP is masked exactly as it is over REST. The same caveat applies - masking works on field names and value patterns, and free-text fields can still carry personal data into the conversation. Think about that before pointing an assistant at a large history range.