> ## Documentation Index
> Fetch the complete documentation index at: https://docs.migma.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Review Migma MCP

> What the hosted Migma MCP server can do, how browser OAuth works, which permissions it uses, and how to revoke access.

Use this page when an IT or security reviewer is deciding whether to approve Migma as a custom MCP connector in ChatGPT, Claude, or another MCP client.

This is not a setup guide. For connection steps, see [ChatGPT](/agents/mcp-chatgpt), [Claude](/agents/mcp-claude), or [MCP Server](/mcp-server).

## What Migma MCP does

Migma is an AI email marketer. The hosted MCP server lets a signed-in person use ChatGPT, Claude, or another MCP client to work in their Migma account.

With an approved connection, the client can:

* Prepare on-brand email drafts and show previews
* Import contacts and manage lists or segments
* Save lasting brand facts
* Prepare campaign drafts and read campaign stats
* Export reviewed emails to HTML or connected tools such as Klaviyo, Mailchimp, or HubSpot
* Send test or live email only when send permission is granted

Migma is for permission-based email, not cold outreach. See [Sending rules](/get-started/what-you-can-send).

## How sign-in works

Hosted MCP URL:

```text theme={null}
https://migma.ai/mcp
```

Add only that URL. The client opens Migma in the browser. A signed-in Migma user reviews the app name, return host, and requested permissions, then approves or denies access at `migma.ai/connect/authorize`.

Hosted MCP does not ask you to paste an API key. After approval, Migma creates a connection key automatically. That key appears in **Settings → Developers → API Keys**.

Hosted sign-in usually requests the full Migma API permission set so the client can use the matching tools. `email:send` is highlighted as destructive send access (test and live mail). Deny the connection if your policy does not allow this client to send.

ChatGPT, Claude, and similar products may also require a workspace admin to allow custom MCP connectors. That is the client's policy. Migma still requires a signed-in Migma user to consent before the connector can call Migma.

## Permissions

MCP uses the same permission names as the Migma API. A granted permission allows the matching API actions, not extra access.

| Permission       | What it allows                                     |
| ---------------- | -------------------------------------------------- |
| `email:read`     | View emails and sending history                    |
| `email:write`    | Prepare and edit email drafts                      |
| `email:send`     | Send test and live emails. Destructive.            |
| `email:validate` | Run compatibility, link, and deliverability checks |
| `email:preview`  | Generate device and inbox previews                 |
| `audience:read`  | View contacts, lists, and segments                 |
| `audience:write` | Add or update contacts, lists, and segments        |
| `campaign:read`  | View campaigns, stats, and delivery logs           |
| `campaign:write` | Create, schedule, send, and manage campaigns       |
| `domain:read`    | View sending domains                               |
| `domain:write`   | Add, verify, update, or remove sending domains     |
| `project:write`  | Import brands and update brand resources           |
| `webhook:read`   | View webhooks                                      |
| `webhook:write`  | Create, update, or delete webhooks                 |

Full list: [Authentication](/authentication).

<Warning>
  `email:send` allows test and live sends through the connected account. `campaign:write` can also send or schedule campaigns. Only allow those permissions if you trust this client to send for you.
</Warning>

## Data and access

* The connection has the same reach as a Migma API key with those permissions. Treat MCP like direct API access, not a separate broader integration.
* It can act on brands in the signed-in Migma account. API and data contracts use `project` / `projectId` for a brand.
* Migma returns the account data or action result needed for each tool call. Authentication tokens are not included in normal tool results.
* The MCP client (for example ChatGPT or Claude) processes conversation text and tool inputs or results under that vendor's terms. See [Privacy Policy](/legal/privacy-policy).
* Send, campaign, export, and audience-changing tools are marked as writes or as destructive. Clients that honor those hints typically ask the person before running them. Still treat a granted `email:send` as send capability.
* Keep a human in the loop before live sends, exports, audience changes, and campaign sends.
* Sending through Migma must follow [acceptable use](/legal/acceptable-use) and [sending rules](/get-started/what-you-can-send).

## Revoke access

1. Open [migma.ai](https://migma.ai) and go to **Settings → Developers → API Keys**.
2. Find the key created for the ChatGPT, Claude, or other MCP connection.
3. Delete the key and confirm.

Revoking invalidates that key. Reconnect or restart the MCP client so it stops using the old connection.

## Related pages

<CardGroup cols={2}>
  <Card title="ChatGPT setup" icon="https://mintcdn.com/migmaai/kT6TJgF40rDP8_qB/images/logos/chatgpt.png?fit=max&auto=format&n=kT6TJgF40rDP8_qB&q=85&s=f88137fa5b3adadac975427b68304728" href="/agents/mcp-chatgpt" width="120" height="120" data-path="images/logos/chatgpt.png">
    Add Migma as a custom ChatGPT MCP connector.
  </Card>

  <Card title="Claude setup" icon="https://mintcdn.com/migmaai/kT6TJgF40rDP8_qB/images/logos/claude-code.png?fit=max&auto=format&n=kT6TJgF40rDP8_qB&q=85&s=21dc5dcc66f09660a16fbea3297333b4" href="/agents/mcp-claude" width="120" height="120" data-path="images/logos/claude-code.png">
    Connect Claude.ai, Claude Code, or Claude Desktop.
  </Card>

  <Card title="MCP Server" icon="server" href="/mcp-server">
    Hosted and local MCP connection details.
  </Card>

  <Card title="Security & compliance" icon="shield" href="/security/compliance">
    SOC 2, GDPR, and email-law guidance.
  </Card>

  <Card title="Sending rules" icon="envelope-circle-check" href="/get-started/what-you-can-send">
    Permission-based email. No cold outreach.
  </Card>

  <Card title="Authentication" icon="key" href="/authentication">
    API permissions and how to revoke keys.
  </Card>
</CardGroup>