Skip to main content
Provider credential setup can be enabled separately with MCP_PUSH_CREDENTIALS_ENABLED=true. This exposes only FCM, APNs and Web Push configuration to keys with push_providers.write and the provider-management role; messaging and administration can remain disabled. Check account_get.credential.features.push_credentials and project_get.capabilities.push.apps.configure_provider_credentials. If the switch is omitted, existing messaging-enabled deployments retain provider setup; an explicit false disables it. Phase 2 is independently controlled by MCP_MESSAGING_ENABLED. Tool discovery and project_get show the operations available to the current personal key. Existing keys receive no new scopes automatically. Owners select new permissions through Account → Personal API Keys; current membership, project grants and role capabilities still apply. Billing, plans, payments, credits, invoices and subscription management are excluded. Use account_get, teams_list, projects_list({team_id}) and project_get({project_id}). Every project tool requires project_id. The SDK uses its explicit projectId option; HTTP calls use X-Sendrealm-Project-Id. Choose UUIDs returned by discovery, including the push app’s id rather than its public device-SDK ID for the new project operations.

​
Author, preview, commit, inspect

Email, push and cross-channel campaigns remain safe drafts while editing. Inspect effective targeting, renderability, sender/provider setup and exact reachable counts before preparing delivery. Empty audience selections never mean everyone. all_contacts is explicit and still respects subscription and suppression policies. Cross-channel targeting changes use cross_channel_campaigns_update to synchronize both channels atomically; conflicting parent/channel definitions block delivery.
  1. Create/edit templates or campaign drafts. Read detailed content before merging edits. messages replaces the complete locale list; omitted draft fields remain unchanged.
  2. Preview the content and recipients. Use published, owned template versions for delivery; their content is materialized into the existing delivery pipeline.
  3. Call the domain-specific <operation>_prepare tool. Read the exact saved input, recipient counts, readiness and consequential effects. Preparations expire after ten minutes and bind the actor, key, grant version, project and resource versions.
  4. Commit that operation with only project_id, prepared_action_id and a stable idempotency_key (plus optional response mode). Changed inputs require a new review. Template/automation lifecycle tools also retain their existing resource id argument.
  5. New project operations return a durable receipt, usually pending. Poll project_operations_get({project_id,id}) using poll_after_ms. completed confirms the requested operation completed, such as entering campaign review; it does not mean every recipient received a message.
Sending uses the existing spam-review/scheduling pipeline. campaigns_send and its push/cross-channel equivalents request the earliest reviewed delivery, currently scheduled at least five minutes ahead. They do not bypass review. Cancellation is supported before processing; sent messages cannot be recalled. Campaign archival is limited to drafts. Repeated commits with the same preparation/idempotency pair return the original receipt. Workers claim an intent once, serialize project dispatch, and recheck authorization, readiness and resource state. Scheduled and recipient workers recheck the originating personal key. Changed grants, lost membership, role changes or revocation can stop queued work. A stale preparation requires a new review, never automatic reapproval. outcome_unknown means a worker/provider result could not be confirmed. Inspect the resource and delivery history and reconcile through support. Do not create another preparation to repeat an uncertain effect. No automatic external mutation replay occurs.

​
Permissions and workflows

Read-only discovery uses resources.read; Cloudflare connection status additionally requires current domain-management capability. Export/import and deletion permissions remain separate. No new billing permissions exist. Effect-emitting preparations default to automation_effects: "suppress". Explicit trigger additionally requires automations.trigger and current automation-management capability. The policy and originating action survive campaign queues, delivery records and derived events. Suppression prevents new live runs and waiting-run resumption, including replay. Existing integration-key behavior is preserved. The dedicated one-device push and owned Live Activity test tools retain their existing explicit test workflow and permissions. A Live Activity start returns a server-issued test_id; update/end never accept production activity IDs. New template delivery tests use preparations. Automation sandbox runs remain no-send tests with immutable definitions.

​
Credentials and assets

push_providers_configure_fcm, push_providers_configure_apns and push_providers_configure_web apply provider settings directly using write-only inputs and push_providers.write. FCM accepts the service-account JSON file contents and Android package name; APNs accepts the .p8 PEM, key ID, team ID, bundle ID and environment. The existing dashboard validation applies. Credentials are never returned or staged in preparations/receipts. Inspect push_providers_list afterward. push_providers_configure_handoff remains an optional browser setup path. domains_cloudflare_authorize returns a dashboard link for OAuth authorization; poll project_handoffs_get afterward. OAuth callback codes remain in the browser. Cloudflare’s provider authorization is separate from MCP authentication; MCP OAuth remains deferred. Asset tools return a Sendrealm-controlled upload_url and file_key. Upload the file bytes with PUT, then call the matching finish tool with that exact key and resource ID. Arbitrary remote fetches are not supported. Configuration handoffs select and validate the intended project before loading its app/domain. Channel upsert follows dashboard replacement semantics: omitted nullable configuration is cleared; importance defaults to high, vibration to true, visibility to public, and is_default to false. Retrieve channels before preparing edits.

​
SDK example

New SDK methods disable automatic mutation retries even when a client has a global retry policy. List methods preserve pagination metadata and support getNextPage(). Preserve filters and opaque cursors; automation deliveries paginate the combined email/push timeline with keyset bounds. MCP lists/diagnostics default to concise output; use detailed output to inspect message content or traces. Structured errors retain safe field issues, request IDs and retry guidance. These are ordinary MCP tools over hosted Streamable HTTP and local stdio. Optional MCP Tasks, sampling or elicitation are not required. Local fixture tests exercise protocol compatibility; vendor-specific client testing is described in MCP compatibility.