Skip to content
SecureThreadDocs
securethread.coSign inGet started
All guides
app.securethread.co/agents
AI agents: each assistant with its owner, policy, limits and a pause switchAI agents: each assistant with its owner, policy, limits and a pause switch

AI assistants (MCP)

SecureThread runs a Model Context Protocol (MCP) server. It lets an AI assistant such as Claude, ChatGPT, Cursor or VS Code look things up in SecureThread and prepare email. The assistant acts as one signed-in employee, and only within that person's permissions at the moment it acts.

Three rules apply to every assistant:

  • A person approves each email an assistant asks to send, unless your organization has turned on automatic sending for narrow, low-risk emails. Agents and approvals explains those rules.
  • A scheduled send or a workflow run that an assistant starts always waits for a person.
  • No assistant can approve or reject anything, publish a shared template, invite people, change roles, or change organization settings. Those actions stay in the app.

Before you connect#

  • An administrator turns AI assistant access on. It is off by default for every organization. The switch is under Administration › AI access. While it is off, no assistant can connect or act.
  • Your role must allow assistants. If AI assistants are not part of your role, the AI access page says so.
  • You need the endpoint address. It has this form:

text https://<your SecureThread address>/mcp

For example, https://mail.example.com/mcp. The AI access page shows the address under What assistants can do.

How sign-in works#

Assistants sign in with OAuth 2.1 through SecureThread. You approve each connection yourself, in your browser.

  1. The assistant calls the endpoint without a credential. SecureThread answers that sign-in is needed and points the assistant to its sign-in details.
  2. The assistant opens SecureThread's consent page in your browser. It asks Allow this app to use SecureThread as you?
  3. The consent page shows:
    • the app's name, and whether the app is verified. Verified domain means the app's sign-in details are hosted on the domain shown. It confirms the domain, not who runs the app. Unverified means the app supplied its own name;
    • the address the assistant will act as, under It will act as. Check that it is your address;
    • the address the browser will return to;
    • the access levels, described in plain English below. The levels the app asks for are ticked by default. If it asks for none, View and Write drafts are ticked. You can untick any of them.
  4. Choose Approve to connect, or Deny to refuse. Denying changes nothing.
  5. The assistant continues from there. You can disconnect it at any time.

The consent page warns: "If a link or message brought you here and you didn't start this, deny it." Approve only a connection that you started yourself.

Timing and limits:

  • A consent request expires 10 minutes after it starts. An expired request shows "This request has expired". Start again from the app.
  • Finish the consent in the same browser that started it. In another browser the page shows "This request isn't available".
  • Access renews by itself while the connection lasts. A connection lasts at most 90 days from the day you approved it. After that, reconnect.

Access levels#

An access level is a kind of work the assistant may do. The assistant may only do what its levels allow and what you may do at that moment. SecureThread checks both on every request, so removing a permission or changing your role takes effect on the next request. A connection that asks for no level gets View and Write drafts.

View

What it lets the assistant do

See your mailboxes, the templates you can use, your messages and send requests, your usage, and the mail people send to this assistant’s own inbox address, if it has one.

Write drafts

What it lets the assistant do

Create and edit drafts, check and preview email, and send test emails to your own address.

Send email

What it lets the assistant do

Ask to send email from your mailboxes. You approve each send in SecureThread unless your organization allows low-risk sends without approval. Also lets the assistant withdraw a send that is still waiting, or retry or cancel your messages.

Manage templates

What it lets the assistant do

Create and update templates, publish your personal templates and submit shared ones for review. An assistant can never publish a shared template.

Contacts

What it lets the assistant do

Search the contacts and contact groups you can use.

Test mailboxes

What it lets the assistant do

Run connection tests on mailboxes you manage.

Scheduled sends

What it lets the assistant do

Create and cancel scheduled sends.

Campaigns

What it lets the assistant do

Prepare and manage campaigns.

Workflows

What it lets the assistant do

Run and manage workflows.

Analytics

What it lets the assistant do

Read sending analytics.

Approvals

What it lets the assistant do

Request approvals and check their status.

Administration

What it lets the assistant do

Use the administrator permissions you hold: read every employee's messages and their content, retry or cancel anyone's messages, see and test every mailbox connection, edit any shared template, search the audit log and read organization metrics. Only works when approved from a session that completed two-step verification (with a passkey, if your organization requires one), and lasts 14 days at most.

Set up each app#

These steps follow each app's menus at the time of writing. Apps change their menus often. If a name differs, follow the app's own connector guide.

Claude#

In Claude on the web or the desktop app:

  1. Open Settings › Connectors and choose Add custom connector.
  2. Name it SecureThread and paste the endpoint address. Leave the OAuth fields under Advanced settings empty.
  3. Choose Connect. Claude opens SecureThread, where you choose the access levels.

After you approve, Claude returns you to https://claude.ai/api/mcp/auth_callback. SecureThread accepts that address. You do not type it when you follow the steps above.

On Team and Enterprise plans, an owner may need to add the connector for the organization first. Each person then connects for themselves.

ChatGPT#

Custom connectors in ChatGPT need developer mode. Whether you can turn it on depends on your ChatGPT plan and your workspace's settings. OpenAI changes this menu often.

  1. Turn on developer mode in Settings › Apps & Connectors › Advanced settings.
  2. Create a connector with the endpoint address from What assistants can do, and choose OAuth sign-in.
  3. ChatGPT opens SecureThread, where you choose the access levels.

Cursor#

  1. Add the server to ~/.cursor/mcp.json for all projects, or to .cursor/mcp.json inside one project:

json { "mcpServers": { "securethread": { "url": "https://mail.example.com/mcp" } } }

  1. Open Cursor's MCP settings and find securethread. If Cursor asks you to sign in, follow the prompt. It opens SecureThread so you can approve the connection.

VS Code#

  1. Add the server to .vscode/mcp.json in your workspace, or to your user MCP configuration:

json { "servers": { "securethread": { "type": "http", "url": "https://mail.example.com/mcp" } } }

  1. Start the server from the file or from the MCP servers view. VS Code asks you to sign in and opens SecureThread so you can approve the connection.

Claude Code#

From a terminal:

claude mcp add --transport http securethread https://mail.example.com/mcp

In Claude Code, run /mcp, choose securethread and then Authenticate. Your browser opens SecureThread so you can approve the connection. Claude Code returns to an address on your own computer. SecureThread accepts those addresses on any port.

Other clients#

Any client that supports remote MCP servers over Streamable HTTP with OAuth can use the endpoint address. SecureThread uses OAuth 2.1 with PKCE (method S256). It registers a client as it connects, and it accepts clients that publish their own identity document. A client that cannot open a browser for sign-in can use a personal access token, described below.

Personal access tokens#

A personal access token lets a client that cannot sign in through a browser act as you. Use one only for a client you run on your own computer. Anyone who has the token acts as you.

  1. Open AI access and choose Create token.
  2. Enter your current password. A wrong password counts toward the account lockout limit.
  3. Choose a lifetime of 7, 30 or 90 days.
  4. Copy the token. SecureThread shows it once.

A token with the Administration access level lasts at most 14 days, so only the 7-day choice applies to it. Creating that token also needs a session that completed two-step verification. You can create up to 20 tokens an hour.

Send the token as a header on every request:

Authorization: Bearer <your token>

Never put a token in a web address or a query string. To end a token, choose Revoke on AI access. Revoking stops it at once.

Send requests and approvals#

When an assistant asks to send email, SecureThread creates a send request. The request stores the exact recipients, subject, message, attachments and mailbox. The assistant gives you a link to it.

  • The link opens the request under AI access. Read the preview and the reasons it needs approval. Agents and approvals lists the reasons.
  • Approve and send submits the stored request. Before it goes, SecureThread checks the request against every sending rule under your session. If the request no longer matches what the page showed, SecureThread refuses it and asks you to look again.
  • Decline ends the request. Nothing is sent.
  • A request expires 24 hours after the assistant asked. An expired request never sends.
  • An assistant can withdraw its own request while it is still waiting.
  • A message that a mailbox provider has already accepted cannot be recalled.

Disconnecting and turning access off#

  • Disconnect on AI access ends a connected assistant. Revoke ends a personal token. Either stops it at once, and the send requests it left waiting are declined.
  • Changing your password ends your personal tokens and connections. Losing the permission to use AI assistants ends them too. Reconnect afterwards.
  • An administrator can turn AI assistant access off for the whole organization. Every assistant is then refused at once, and nobody can approve what assistants prepared. While access is off, an assistant's token refresh and code exchange are refused, and standard clients then discard their tokens, so the person must connect again. A revoke sent by an assistant takes effect even while access is off. Disconnect on AI access, and an administrator's revoke, also work while access is off.
  • Administrators see every connection under Administration › AI access, in Connected assistants, and can revoke any of them.

Check the connection#

On AI access, choose Check connection. It makes the three requests an assistant makes first: the discovery document, the sign-in details, and an unauthenticated request to the endpoint, which must be refused with a sign-in challenge. If it reports a different address from the one you use, contact support.

Limits and known limitations#

  • Requests are limited per connection and per person. For example: 600 requests per connection and 900 per person in five minutes; 300 tool calls per connection in five minutes; 60 send requests per person an hour; 20 personal tokens per person an hour. Requests that carry no valid credential are limited per network address.
  • Results are capped at 100,000 characters. Long text is paged. Lists are paged too: most return up to 25 items a page, and some allow up to 50.
  • AI access lists each tool the server offers, with whether your role allows it.
  • The server is stateless. It keeps no session between requests and sends no messages on its own.
  • The older HTTP+SSE transport is not supported. Use the endpoint address with Streamable HTTP.

Troubleshooting#

For sign-in and connection messages, and for each refusal code an assistant can see, see Troubleshooting.

PreviousQuick startNextSending domains and DNS