App reviewers

Notes for app reviewers

This page is for marketplace and MCP directory review teams. Users will find everything on the home page and in the docs.

Test account: use the demo account provided in the directory submission form. It works on sample data, with limited permissions and no real sending unless explicitly requested.

What to check

OAuth sign-in (dynamic client registration, PKCE S256) and consent completed.
Privacy, terms, consent, security and usage limits are public.
Writes, deletions and sends are protected by explicit confirmation (confirm_delete, confirm_send).
Tools never return tokens, API keys or passwords.
74 tools with explicit annotations: 34 read-only, 9 write, 31 destructive.
start_email_spam_test is not read-only: it creates a test and sends a real instructions email to the test account's address. To see a full result an email must then be sent to the test address; without it, get_email_spam_test_result returns waiting.

Suggested test prompts

Show what I can do with my MailSenpai account.
List the demo campaigns and summarize their statistics.
Create a demo segment in a test list.
Create a draft campaign from demo HTML.
Attempt a delete without confirmation and verify it is blocked.
Check whether the IP 8.8.8.8 is on an email blocklist.
Check the email DNS records of example.com.

Test plan

Machine-readable version: /review/test-plan. App metadata: /app/manifest.json. Help: Support.