Send transactional, templated and bulk email, read delivery logs, statistics, domains, suppressions and templates, and run OTP verifications with Maileroo.
Maileroo ships in the w6w first-party pack. It declares 28 actions, 3 health checks, and the host runs its code in a sandbox that never sees the credential.
io.w6w.mailerooMaileroo is an email delivery platform with an SMTP relay and a REST API. This app sends a transactional email, an email rendered from a dashboard template, or a personalised batch of up to 500, optionally scheduled up to 21 days ahead, and lists or cancels scheduled emails.
It reads the account’s plan and hourly/monthly usage, sending statistics, delivery logs (search by recipient, subject, tags or outcome, fetch the stored raw message, resend it), domains with their DNS-record status and analytics, templates and applications, and manages the suppression list. It also drives Maileroo OTP Verification: send a one-time code by SMS, voice, WhatsApp, Telegram or email, check the code the user enters, and read or cancel verifications.
A connection holds up to two keys, because Maileroo uses two credentials: a Sending Key for the Email API (the sending and scheduled-email actions) and a scoped Account API Key for everything else. Provide the one or both your workflow needs; each action’s description says which.
Health checks report whether both API hosts answer and how much of the plan’s hourly and monthly sending allowance is left.
Three routes to the same 28 actions. The Workflow tab is generated from Maileroo's own manifest and carries its real ids, so it is copy-pasteable; the Code and CLI examples are the same call for any action on any app, so every app-specific value in them is a blank you fill in.
cancel-verification Cancel a verification that is still pending or sent. A verification already verified, expired, failed or cancelled answers 409. Account API Key (verify.verifications.write).
check-verification Check the code a user entered. `status` is approved, incorrect, expired, failed or cancelled; a wrong code is a normal result, not an error. Each check uses an attempt. Account API Key (verify.verifications.write).
create-suppression Add an email address to the suppression list so Maileroo no longer delivers to it. Account API Key (suppressions.write).
delete-scheduled-email Cancel a scheduled email by its reference ID before it is sent. Irreversible. Needs the Sending Key.
delete-suppression Remove an address from the suppression list so it can receive email again. Account API Key (suppressions.delete). A 404 means it was not suppressed.
get-account Read the account overview: identity, plan, hourly/monthly outbound and inbound usage, subscription and billing details. Needs the Account API Key (account.read).
get-application Read one application: SMTP username, authorized domains, IP allowlist, allowed From local parts and recipient domains, outbound IPs and notes. The SMTP password and sending key are deliberately not returned. Account API Key (applications.read).
get-domain Read one domain with its DNS records (DKIM, SPF, DMARC, MX, tracking) and whether each is in place, its tracking settings and sending statistics. Account API Key (domains.read).
get-domain-analytics Aggregate totals, a daily timeline and the top receiving providers for one domain. Account API Key (domains.analytics.read).
get-email-log Fetch the stored raw RFC 822 message for a sent email by its message ID (from Search Email Logs). Account API Key (user_logs.read or domains.logs.read).
get-sender-profile Read one OTP Verification sender profile. Account API Key (verify.sender_profiles.read).
get-statistics-summary Aggregate sending statistics for the current calendar month (delivered, bounced, opens, clicks, suppressions) plus per-country opens and clicks. Account API Key (statistics.read).
get-statistics-timeline Daily sending statistics for the last month, one entry per day, each with aggregate counts and per-country opens and clicks. Account API Key (statistics.read).
get-template Read one template including its HTML and plain-text content. Account API Key (templates.read).
get-verification Read a verification and its lifecycle status (pending, sent, verified, expired, failed, cancelled). The code is never included. Account API Key (verify.verifications.read).
list-applications List the account's applications (SMTP/API credential sets scoped to domains and IPs) with their counts. SMTP password and sending key are deliberately not returned. Account API Key (applications.read).
list-domains List the account's sending domains with basic delivered / bounced / opened / clicked statistics and DNS verification status. Account API Key (domains.read).
list-scheduled-emails List emails scheduled for future delivery, paginated. Needs the Sending Key. A domain-scoped key needs no domain; an application-scoped key must name one.
list-sender-profiles List OTP Verification sender profiles (name, enabled channels, rate limit). Their IDs feed Send Verification Code. Account API Key (verify.sender_profiles.read).
list-suppressions List suppressed email addresses (bounces, complaints, manual entries), paginated and searchable. Account API Key (suppressions.read).
list-templates List email templates (ID, name, type, preview). The ID feeds Send Templated Email and Send Bulk Emails. Account API Key (templates.read).
list-verifications Search verification history (120 days retained), newest first, by status, channel, profile, destination, country, time range or IDs. Account API Key (verify.verifications.read).
resend-email Requeue a previously sent email for another delivery attempt; it is reused as-is under a new reference ID. Limited to 1000 resends per 24 hours. Account API Key (user_logs.write).
search-email-logs Search delivery logs (14 days retained) by message, reference ID, subject, sender, recipient, tags, outcome and time range, across the account or one domain. Account API Key (user_logs.read, or domains.logs.read for a domain).
send-bulk-emails Send up to 500 personalised emails in one call: a shared subject and body (or template) with per-message recipients and template data. Needs the Sending Key.
send-email Send a transactional email (HTML and/or plain text) through the Maileroo Email API, optionally scheduled up to 21 days ahead. Needs the connection's Sending Key.
send-templated-email Send an email rendered from a Maileroo template with per-send template data. Needs the connection's Sending Key. Find template IDs with List Templates.
send-verification Send a one-time code to a phone number (SMS, voice, WhatsApp, Telegram) or an email address through Maileroo OTP Verification. The code is never returned; check what the user enters with Check Verification Code. Spends prepaid balance. Account API Key (verify.verifications.write).
A workflow step names the app and the action, and the editor fills in the
connection when you pick one. This is the Step shape from the
workflow spec, carrying Maileroo's real ids.
{
"manifestVersion": "2",
"name": "maileroo-example",
"steps": [
{
"id": "check-verification",
"uses": {
"app": "io.w6w.maileroo",
"action": "check-verification",
"connection": "conn_YOUR_CONNECTION_ID"
},
"with": {
"verificationId": "<verificationId>",
"code": "<code>"
}
}
]
}check-verification create-suppression get-account get-application get-domain +23 more actions available
Every app-specific value here is a blank you have to fill in. An
app action is reached through the connection that authenticates it, so the
address is a connection id, not the app id — and connections belong to your account,
so a public page cannot know yours. Create one for Maileroo, then fill in
the three blanks: conn_YOUR_CONNECTION_ID, the action key, and the
parameters that action declares. The call itself is real — the shape is transcribed
from the studio's own snippet builder, which prints the same kind of blanks — but
nothing in it is specific to Maileroo. The Workflow tab is where this app's
real ids are.
npm install @w6w/sdkyarn add @w6w/sdkpnpm add @w6w/sdkdeno add npm:@w6w/sdkimport { W6wClient, isActionRun } from "@w6w/sdk";
// Reads W6W_BASE_URL and W6W_TOKEN from the environment when omitted.
const client = new W6wClient();
const envelope = await client.run({
urn: "conn_YOUR_CONNECTION_ID",
action: "check-verification",
payload: {
verificationId: "<value>",
code: "<value>",
},
});
if (isActionRun(envelope)) console.log(envelope.value); npm install -g @w6w/cli w6w run conn_YOUR_CONNECTION_ID --action check-verification --payload '{"verificationId":"<value>","code":"<value>"}' Give an AI agent Maileroo — without giving it Maileroo's credentials. One MCP endpoint exposes every app, function and workflow the caller is entitled to, as tools it can discover and run. Access is granted per team while we onboard.
One tool call{
"name": "w6w_invoke",
"arguments": {
"ref": "app:io.w6w.maileroo#check-verification",
"input": {
"verificationId": "<verificationId>",
"code": "<code>"
}
}
}
Every tool names its target with a single ref. The
app: form above doesn't name a connection at all — the
host resolves which of the caller's Maileroo connections to sign
with, and refuses rather than guesses when the answer is ambiguous.
The token is attached host-side, at the moment of the call. It is never a tool argument, never in the model's context, and never in a transcript — so a prompt injection has nothing to exfiltrate.
Tools are derived per end user from what that person has actually connected and is entitled to — not one shared bot identity carrying the union of everyone's access.
Multi-step work runs on the workflow engine and returns a run handle the agent can poll — retries, branching and state survive the conversation that started them.
Maileroo's declared health checks are on the surface too, so an agent can tell "the vendor is down" from "your credential expired" before it burns a retry on either.
The MCP surface is part of the hosted platform. Maileroo itself is MIT, and the runtime that executes it is source-available (FSL).
Maileroo declares its own checks, so its health is a property of the app rather than something the host guesses at.
Unauthenticated GET to the Account API and the Email API. Maileroo's own JSON auth-error body passes: it proves the application is answering.
Hourly and monthly outbound usage vs the plan, from GET /v1/account. Needs the Account API key with account.read.