Is there an MCP server?

Not yet. It is on the integrations page marked as coming, and we are not going to describe it in the present tense until it exists. The REST API is available today and is what an MCP server would wrap.

How do I stop an agent from sending to everyone?

Do not give it emails:send. Scopes are checked on every request, so a key issued for tagging and enrollment cannot be persuaded into a bulk send no matter what it is asked to do.

Can a model read the documentation directly?

Yes. Every endpoint page has a markdown twin at the same address with .md on the end, the whole reference is one markdown document, and llms.txt indexes the site.

What happens if an automated caller goes too fast?

It gets a 429. Four rate-limit windows apply at once, from 60 a minute to 2,000 a day, and they are documented so a script can be written to stay inside them rather than back off by trial and error.

Automation

Scriptable by agents

Scoped tokens and a plain REST surface, so an agent or a cron job can enroll contacts and send email without a browser session.

What it does

Anything that can make an HTTP request can drive SendHeron. There is no browser session to maintain, no CSRF dance and no scraping: a bearer token and a JSON body is the whole interface.

That matters for the things that increasingly act on your behalf. A cron job, a background worker, or an agent following an instruction can attach a tag, enrol a contact and send a templated email with nobody at a keyboard.

The same properties that make it good for an agent make it good for a shell script at three in the morning, which is the more common case and the one that has to keep working.

The shape of it

01
Issue a narrow key
One job, the smallest set of scopes that does it.
02
Point it at the docs
Every endpoint has a markdown twin, and llms.txt indexes the site.
03
Let it call the API
A bearer token and a JSON body. No session to keep alive.
04
Scopes bound the damage
A key that cannot send bulk email cannot be talked into sending bulk email.

How it works

Scopes are the safety model, and they are what makes giving a key to an automated caller a reasonable thing to do at all. Give an agent contacts:write and it can tag people and let sequences pick them up. It cannot send bulk mail, because emails:send is a different scope and the check happens on every request rather than at key creation.

The documentation is machine-readable by design. Every endpoint page has a markdown twin at the same address with .md appended, the whole reference is available as a single markdown document, and llms.txt indexes the site for tools that read documentation directly. Nothing has to parse our HTML to learn the API.

Rate limits are published rather than discovered, in four windows that all apply at once. An automated caller that respects them will not surprise you, and one that does not gets a 429 rather than a silent partial result.

One key, one job

# Key scoped to contacts:write only.
curl -X POST \
  https://api.sendheron.com/api/v1/contacts/$CONTACT_ID/tags \
  -H "Authorization: Bearer $SENDHERON_AGENT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"tagNames": ["cancel-pending"]}'

# The tag starts the churn-save sequence.
# The same token calling /emails/send-bulk gets a 403.

Bearer token auth, no session or cookie handling
Scopes limit what any single key can do
Every endpoint documented in markdown as well as HTML
An llms.txt index for tools that read the docs directly

Browse the API reference

What makes it different, honestly

Blast radius is a design parameter here rather than an afterthought. The interesting question about an automated sender is not what it can do but what it cannot, and scopes are how you answer that in advance instead of auditing it afterwards.

There is no MCP server yet. It is listed under integrations and marked as coming, and we would rather say so on this page than let a feature list imply it already exists. What does exist is a plain REST surface documented in a form a model can read, which is most of what an MCP server would be wrapping.

There are also no outbound webhooks today. An agent can ask SendHeron things and tell it to do things, but SendHeron will not call the agent back, so anything event-driven on your side has to poll or be triggered by your own systems.

Questions