An AI assistant connected to Arawa Mail can send, but only after you approve that specific tool call in the AI product. Arawa Mail has no send-approval queue and cannot save an MCP draft into the mailbox Drafts folder. The safe gate is a prompt that withholds the send, then a human check of recipients, body, and mailbox changes before you click approve.
The problem: the assistant is about to mail the wrong person
A useful mailbox assistant can search unread mail, summarise a thread, and prepare a reply. The failure mode is a single approved send to the wrong recipient, a Cc that should have stayed private, or a body that followed instructions hidden in an inbound message. On Arawa Mail, that send is a real mailbox action from the address you connected, not a sandbox.
What MCP is, and when a mailbox beats an API key, is covered in MCP for email and give agents a mailbox, not just an API key. This guide owns the approval step before send.
What the connected assistant can and cannot do
The remote server URL on the current billing site is https://app.arawamail.com/mcp/email. Connection is OAuth. The assistant never receives the mailbox password and can use only the mailbox you approve. Confirmed on the Connect an AI Assistant page, checked 3 October 2026.
After you approve access, the assistant can:
- Search by folder, text, sender, recipient, subject, unread status, and date range.
- Read a conversation without marking it read by default.
- Send a new email or reply from this mailbox.
- Mark conversations read or unread, archive or unarchive them, and move them to or restore them from trash.
It cannot access another mailbox, manage drafts or spam, download attachments, permanently delete email, or administer domains. The human mailbox still has a Drafts folder, documented on the Mailbox page. MCP does not write to it.
Three different gates, and only one is the send check
Teams mix these up. They are not the same control.
| Gate | What it actually does | What it does not do |
|---|---|---|
| Prompt that says do not send it yet | Asks the assistant to prepare text in the chat | Does not create a server-side draft in webmail |
| Client tool-call approval | You review the proposed tool call in ChatGPT, Claude, Grok, or Perplexity before it runs | Is not an Arawa-hosted approval queue |
| Host admin step | On Claude Team or Enterprise, an owner adds the connector under Organization settings before a user can connect. Perplexity organizations can use an admin connector page | Is not Arawa enterprise-managed authorization, and is not a company-wide send policy |
Arawa Mail docs do not describe Enterprise-Managed Authorization, DPoP sender-constrained tokens, or a request-time scope challenge that blocks send. The MCP TypeScript SDK can sign DPoP proofs and help servers challenge scope. That is SDK capability. It is not a documented Arawa send gate. The documented control remains: review the tool call.
How to keep send behind a human
1. Connect one mailbox, not a shared secret
Setup for ChatGPT, Claude, Grok, and Perplexity is in connect an AI assistant. Use the MCP URL shown on the docs page for the billing website you are signed into. Team and enterprise accounts may need an administrator before you can add a connector in the AI product. That permission is about the AI host, not an Arawa admin scope.
2. Start with work that never calls send
Triage is the right first job: search unread, summarise, archive newsletters. The classification pattern is in automate email triage with MCP. A prompt that says send follow-ups to everyone who has not replied skips the useful gate and can mail the wrong people. Do not use that pattern.
3. Prepare the reply in chat, then approve a later send
The documented prompt is: Draft a reply to the latest message, but do not send it yet. The text stays in the conversation. It does not appear in the mailbox Drafts folder. When you want it sent, ask for a send or reply tool call and review it before approval.
Check these fields on the tool call:
- To, Cc, and Bcc. Confirm no extra recipient was added from the thread.
- Subject and body. Confirm the text matches what you intended, not instructions pasted from the inbound message.
- Mailbox changes bundled with the call, such as archive or mark-read, if the client shows them.
Email content is untrusted input. A message can contain instructions aimed at the assistant. The docs state this directly: review recipients, message text, and mailbox changes before approving the tool call.
4. Treat the From address as a human reputation asset
A send goes out as the connected mailbox. Reputation still belongs to a person or a named function, which is the point of humans own the From address. Approving a tool call is that ownership step, not a background job.
How we checked this
On 3 October 2026 we re-read the Arawa Mail AI assistants, mailbox, and email-account docs, and compared them with the plan product claims. The can-list, cannot-list, OAuth model, client steps, Inspector command, and revoke path match the current AI assistants page. We did not treat MCP specification work or SDK releases as Arawa product features unless the Arawa docs say so. We did not run a live send.
How to keep an assistant effectively read-only
Arawa Mail does not document a server policy that allows search and denies send. Safety is prompt design plus refusing send approvals. If the client cannot be trusted to show tool calls before they run, revoke the connector. Developers can confirm discovery, OAuth, and the tool list with MCP Inspector:
npx @modelcontextprotocol/inspector --server-url https://app.arawamail.com/mcp/email --transport httpThat checks the server. It is not an approval queue. ChatGPT custom MCP availability depends on plan and is commonly a web workflow. Do not assume the phone app.
How to revoke access
Open the mailbox, go to Settings, then AI assistants, and revoke the connection. You can also remove the connector in the AI product. Disabling the mailbox blocks mailbox, SMTP, mobile, and connected AI-assistant access without deleting stored mail, as described on Email accounts. Enabling the mailbox later does not restore previously revoked integrations. Incident recovery after a compromise is a separate checklist. Do not treat revoke as a substitute for rotating passwords if the mailbox itself was taken over.
FAQ
Can the assistant send without me clicking approve?
Only if the AI client runs the send tool call without showing it to you. Arawa Mail's documented model is that you review and approve the tool call. If a client auto-runs tools, revoke it.
Can it save a draft I review in webmail?
No. Draft a reply, but do not send it yet is a prompt example. MCP cannot manage the Drafts folder. Copy the text, or approve a later send after you check recipients and body.
Does enterprise-managed MCP auth skip the Arawa consent screen?
Arawa Mail docs do not describe enterprise-managed authorization. Each connection is still OAuth for the mailbox you approve.
Why does Claude Team ask an owner to add the connector first?
That is a Claude organization gate under Organization settings, then Connectors. The user still completes Arawa Mail sign-in for one mailbox. It is not a company-wide send policy.
Does DPoP or a scope challenge stop a send on Arawa Mail?
Not as a documented control. Do not rely on SDK DPoP or scope-challenge helpers to block a send on this server.