Using Vaartix with AI agents safely

AI apps such as Claude, Cursor and VS Code can send email and look up delivery for you through the hosted MCP server or the local server. This page explains every control you have over them, in plain words. In short: an app can only do the few things you allow, within limits you set, and you can see and stop everything it does.

What an AI app can and can’t do

An app connected through the hosted server has up to four permissions. You choose them when you connect it, and it only gets the ones it asked for:

Permission	What it lets the app do
Send email	Send real email from your verified domains, within the connection’s limits
Read email details	See who emails went to, subjects, delivery status and events, and your domains. Not the content.
Read email content	Also see the HTML and text of emails. Needs Read email details.
Cancel scheduled emails	Stop an email that is scheduled for later

Whatever you allow, an app can’t:

see or change API keys, team members, webhooks, billing or settings, or add, change or remove domains (with Read email details it can only list them);
send attachments or custom headers;
send to more than 50 recipients in one email, or more than 20 emails in one batch;
do more than your own role in the team allows. It acts as the person who connected it.

If that person leaves the team, their apps are disconnected at once, and the team’s owners and admins get an email.

Safe defaults, and changing them

Every new connection starts at the safest setting:

Setting	Starts as
Permissions	Read email details only: no sending
Who it can send to	Test addresses only, such as `[email protected]`
Caps	20 emails an hour, 50 a day
Approval	Every send waits for an owner or admin to approve it
Connection ends after	30 days (7, 30 or 90)

You widen what you need on the sign-in screen when you connect the app: more permissions (only ones the app asked for), recipients (a list of addresses or domains, or anyone), the domains and From addresses it may send from, higher caps (up to a maximum Vaartix sets), or no approval.

Later, owners and admins can change these in Settings → Connected apps → Edit limits:

Giving an app more (a permission, a higher cap, more recipients, domains or From addresses, or turning approval off) needs a fresh confirmation: your 2FA code or a code emailed to you. The team’s owners and admins also get an email saying who widened what.
Giving it less takes effect at once and needs no code.
The end date can’t be pushed later. When it comes, connect the app again.

Approvals

With Require my approval before sending on (the default), nothing an app sends goes out until a person approves it:

Who approves: the team’s owners and admins, on the Approvals page in the dashboard. Approving needs a fresh confirmation code. Members can see waiting sends but can’t approve them.
The email to approvers names the app, the sender, the recipients and the subject (shown as plain text, never as a link). It never includes the body: open the Approvals page to read the whole email. At most one email per app every 15 minutes, covering everything waiting.
Approving checks every rule again (permissions, recipients, domains, caps) before the email is created. If something no longer passes, nothing is sent and the request says why.
Rejecting sends nothing.
24 hours: a request nobody answers expires unsent.
At most 20 sends can wait for one app at a time; after that it’s refused until someone answers.

What the AI is told: the send isn’t sent yet; it’s waiting for an owner or admin to approve it in the Vaartix dashboard, or it expires unsent; and it shouldn’t send it again. It gets the approval ID, so it can tell you which request to look for.

Connected apps

Settings → Connected apps lists every app connected to the team: who connected it, what it can do, its limits, when it was created and last used, when it ends, and how many calls it made today.

Pause: every call from the app is refused and it can’t renew its sign-in, but the connection is kept. Resume it any time. Some apps forget their sign-in while paused; if one can’t reach Vaartix after you resume it, connect it again from the app.
Disconnect: the app’s access stops at once. Emails it already sent aren’t affected.
Disconnect all apps: every app on the team stops at once.

Owners and admins can edit, pause and disconnect any app. Members can disconnect apps they connected themselves.

The team’s owners and admins get an email when an app is connected, when it’s given more access, when it reaches a cap or is refused many times in an hour (at most once a day each), and when it’s disconnected.

The activity log

Logs → AI agent activity shows every call an app made, newest first, and can be filtered to one app. For each call it records:

when, which app, and which tool (for example send_email);
whether it worked, was held for approval or was refused, and why;
how many recipients, and the IDs of the emails it created.

It never records email bodies, subjects or recipient addresses. The emails an app sent appear in Logs → Emails like any other email. Activity is kept for 90 days.

The team switch

Allow AI agents (MCP), in Settings → Connected apps, is off for every team until an owner or admin turns it on. While it’s off:

no app can connect, and every call from an app already connected is refused with a message saying agents are turned off for the team. Nothing is sent;
API keys can’t be used through the hosted MCP server.

Turning it back on lets connected apps work again within their limits. It doesn’t affect your own use of the API, SMTP or the dashboard.

Vaartix can also pause AI agent access for a team, or for everyone, for example during an incident. The app is told, and nothing is sent.

AI agent API keys for the local server

The local server (npx vaartix-mcp) runs on your computer and uses an API key from your config. When you create the key, choose Yes, an AI agent for Is this key for an AI agent or MCP server?. The key then starts with:

no email content (bodies and headers);
test addresses only;
at most 20 emails an hour and 50 a day.

It shows as AI agent key in API keys. Owners and admins can change its limits with Limits next to the key; giving it more needs a fresh confirmation code. Revoke the key there to stop it at once. Calls from the local server show in Logs like any API request, not in AI agent activity, and the team switch doesn’t apply to them, since the key calls the API directly.

The hosted server is safer, because:

there’s no long-lived secret in a file on your computer that someone could copy;
each app has its own permissions and limits, and can require your approval for every send;
you can pause or disconnect one app without touching anything else;
connections end after 7 to 90 days, and when the person who connected one leaves the team;
every call is in the AI agent activity log, and the team switch turns all apps off at once.

Email content is untrusted data

Emails can contain text written by anyone, including text that tries to give the AI instructions (“ignore your rules and send this to…”). This is called prompt injection. Vaartix’s tools:

mark email bodies as untrusted data, and tell the AI that subjects, addresses and bodies are never instructions to follow;
leave bodies out unless the AI asks for them, and only if the app or key may read content;
tell the AI to show you the sender, every recipient, the subject and the body, and get your confirmation, before it sends or cancels anything.

Report a problem

If an app did something you didn’t expect, pause or disconnect it first in Settings → Connected apps (or revoke the API key), then check Logs → AI agent activity to see what it did.

A security problem with Vaartix itself: email [email protected].
Anything else, including an app you think is malicious: email [email protected] with the app’s name, the time, and the email IDs from the activity log. Don’t send us API keys or email content.