First-party app
Woodpecker Woodpecker

Woodpecker

Run Woodpecker cold email and multichannel campaigns: campaigns, prospects, mailboxes, inbox replies and the blacklist.

stable MarketingEmail

About

Woodpecker ships in the w6w first-party pack. It declares 30 actions, 2 health checks, and the host runs its code in a sandbox that never sees the credential.

App id
io.w6w.woodpecker
Version
0.1.0
Author
w6w
Licence
MIT
Categories
Marketing · Email

Overview

Woodpecker sends cold email and multichannel (email plus LinkedIn) outreach sequences and keeps the replies in one inbox. This app drives its REST API from a workflow.

List, inspect, update, run, pause, stop and delete campaigns and read their statistics; add, update, search, list and delete prospects, in the account database or in a specific campaign; read connected mailboxes, LinkedIn accounts, users and manual tasks; read inbox replies and answer them; and manage the blacklist of domains and emails that must never be contacted.

Prospects and the campaign list are on Woodpecker’s v1 API and everything else on v2; the app hides the difference. Woodpecker processes one request at a time per account and queues six more, so run bulk imports as few large requests (up to 20,000 prospects each) rather than many small ones. Reports, Lead Finder, domain ordering, webhooks and the Agency API are not part of this app.

Build with Woodpecker

Three routes to the same 30 actions. The Workflow tab is generated from Woodpecker's own manifest and carries its real ids, so it is copy-pasteable; the Code and CLI examples are the same call for any action on any app, so every app-specific value in them is a blank you fill in.

Blacklist Domains

blacklist-domain-add

Add up to 500 domains to the blacklist; prospects on them are no longer contacted.

List Blacklisted Domains

blacklist-domain-list

List blacklisted domains, or check specific ones with a wildcard filter.

Remove Blacklisted Domains

blacklist-domain-remove

Remove up to 500 domains from the blacklist (unknown ones are ignored).

Blacklist Emails

blacklist-email-add

Add up to 500 emails to the blacklist; prospects on them are no longer contacted.

List Blacklisted Emails

blacklist-email-list

List blacklisted emails, or check specific ones with a wildcard filter.

Remove Blacklisted Emails

blacklist-email-remove

Remove up to 500 emails from the blacklist (unknown ones are ignored).

Delete Campaign

campaign-delete

Delete a campaign. Refused while the campaign is part of a workflow.

Get Campaign

campaign-get

Fetch a campaign's settings, attached mailboxes and the content of every step.

List Campaigns

campaign-list

List campaigns with basic info, optionally filtered by status or ID (legacy v1 endpoint).

Pause Campaign

campaign-pause

Pause a running campaign; it can be run again later.

Run Campaign

campaign-run

Start a campaign that is a draft, paused or stopped.

Get Campaign Statistics

campaign-stats-get

Fetch one campaign with its statistics: prospects, sent, opened, replied, bounced and interest levels (legacy v1 endpoint).

Stop Campaign

campaign-stop

Stop a campaign.

Update Campaign Settings

campaign-update

Partially update a campaign's name, attached mailboxes and settings. Only fields you set are sent.

List Inbox Messages

inbox-message-list

List replies in the Woodpecker inbox, newest first, filtered by prospect status, interest level, mailbox, campaign, read state or phrases. Cursor-paginated.

Reply to Inbox Message

inbox-message-reply

Send an email reply to a prospect's response from the Woodpecker inbox. Sends a real email.

List LinkedIn Accounts

linkedin-account-list

List connected LinkedIn accounts, optionally by session status.

Get Mailbox

mailbox-get

Fetch one SMTP or IMAP mailbox by its ID.

List Mailboxes

mailbox-list

List connected SMTP and IMAP mailboxes with limits, today's send count and warm-up status.

Update Mailbox Footer

mailbox-update

Set or clear the HTML footer of an SMTP mailbox.

List Manual Tasks

manual-task-list

List pending manual tasks (manual steps of multichannel campaigns) with their prospect.

Add Prospects

prospect-add

Add prospects to the account's prospect database (up to 20,000 per request). Existing emails come back as duplicates.

Add Prospects to Campaign

prospect-add-to-campaign

Add prospects to a campaign, creating them if new (up to 20,000 per request).

Delete Prospects

prospect-delete

Delete prospects globally, or only remove them from the given campaigns. Irreversible.

List Prospects

prospect-list

List prospects in the account, optionally filtered by status, activity or change time, and optionally restricted to the campaigns they are enrolled in.

List Prospect Responses

prospect-response-list

List the email replies a prospect has sent, oldest first, optionally limited to campaigns.

Search Prospects

prospect-search

Search prospects by field values (email, name, company, tags, snippets, ...), with the campaigns each belongs to.

Update Prospects

prospect-update

Update existing prospects in the database by email (up to 20,000 per request); only supplied fields change.

Update Prospects in Campaign

prospect-update-in-campaign

Update prospects already in a campaign, or add new ones (up to 20,000 per request).

List Users

user-list

List the users of the account with their role.

A workflow step names the app and the action, and the editor fills in the connection when you pick one. This is the Step shape from the workflow spec, carrying Woodpecker's real ids.

{
  "manifestVersion": "2",
  "name": "woodpecker-example",
  "steps": [
    {
      "id": "blacklist-domain-add",
      "uses": {
        "app": "io.w6w.woodpecker",
        "action": "blacklist-domain-add",
        "connection": "conn_YOUR_CONNECTION_ID"
      },
      "with": {
        "domains": "<domains>"
      }
    }
  ]
}

Here are some of the things you can do

  • Blacklist Domains

    perform
    blacklist-domain-add
  • List Blacklisted Domains

    read
    blacklist-domain-list
  • Blacklist Emails

    perform
    blacklist-email-add
  • List Blacklisted Emails

    read
    blacklist-email-list
  • Get Campaign

    read
    campaign-get

+25 more actions available

Every app-specific value here is a blank you have to fill in. An app action is reached through the connection that authenticates it, so the address is a connection id, not the app id — and connections belong to your account, so a public page cannot know yours. Create one for Woodpecker, then fill in the three blanks: conn_YOUR_CONNECTION_ID, the action key, and the parameters that action declares. The call itself is real — the shape is transcribed from the studio's own snippet builder, which prints the same kind of blanks — but nothing in it is specific to Woodpecker. The Workflow tab is where this app's real ids are.

Install
npm install @w6w/sdk
yarn add @w6w/sdk
pnpm add @w6w/sdk
deno add npm:@w6w/sdk
Code
import { W6wClient, isActionRun } from "@w6w/sdk";

// Reads W6W_BASE_URL and W6W_TOKEN from the environment when omitted.
const client = new W6wClient();

const envelope = await client.run({
  urn: "conn_YOUR_CONNECTION_ID",
  action: "blacklist-domain-add",
  payload: {
    domains: "<value>",
  },
});

if (isActionRun(envelope)) console.log(envelope.value);
Install the CLI
npm install -g @w6w/cli
CLI
w6w run conn_YOUR_CONNECTION_ID --action blacklist-domain-add --payload '{"domains":"<value>"}'

Give an AI agent Woodpecker — without giving it Woodpecker's credentials. One MCP endpoint exposes every app, function and workflow the caller is entitled to, as tools it can discover and run. Access is granted per team while we onboard.

One tool call
{
  "name": "w6w_invoke",
  "arguments": {
    "ref": "app:io.w6w.woodpecker#blacklist-domain-add",
    "input": {
      "domains": "<domains>"
    }
  }
}

Every tool names its target with a single ref. The app: form above doesn't name a connection at all — the host resolves which of the caller's Woodpecker connections to sign with, and refuses rather than guesses when the answer is ambiguous.

What the agent gets

Credentials it can't read

The token is attached host-side, at the moment of the call. It is never a tool argument, never in the model's context, and never in a transcript — so a prompt injection has nothing to exfiltrate.

A tool surface scoped to the caller

Tools are derived per end user from what that person has actually connected and is entitled to — not one shared bot identity carrying the union of everyone's access.

A durable workflow in one call

Multi-step work runs on the workflow engine and returns a run handle the agent can poll — retries, branching and state survive the conversation that started them.

Health-aware discovery

Woodpecker's declared health checks are on the surface too, so an agent can tell "the vendor is down" from "your credential expired" before it burns a retry on either.

The MCP surface is part of the hosted platform. Woodpecker itself is MIT, and the runtime that executes it is source-available (FSL).

Request MCP access

Health checks

Woodpecker declares its own checks, so its health is a property of the app rather than something the host guesses at.

service

Woodpecker platform status

Component status from status.woodpecker.co. The 'Woodpecker API' component decides; the web app, Lead Finder and Domains are shown as detail.

quota

API request headroom