Run email marketing from Codex.
Paste one line into Codex. It writes the MCP config, opens the browser sign-in, and starts reading analytics, organizing subscribers and drafting campaigns. No token in config.toml.
Read lumail.io/codex/install and set up the Lumail connection for me.Takes about a minute. Prefer to do it by hand? Everything is below.
- No token in config.toml
- One browser sign-in
- Scoped to one organization
Read lumail.io/cli/install and set up the Lumail CLI for me.The CLI reaches the full API, including sending — same browser sign-in, plus the lumail skill.
Ask for the work, not the menu path.
Codex picks the right Lumail tools and runs them against the one organization you authorized. Read tools inspect live data, write tools create real drafts and real subscribers.
How did last week's newsletter perform compared to the one before?
Add every trial signup from this CSV and tag them trial-2026.
Draft a re-engagement campaign for subscribers who have not opened in 60 days.
Create a workflow that welcomes new subscribers over five days.
Sign in once. Nothing to copy.
Lumail exposes an OAuth 2.1 endpoint with dynamic client registration, so Codex registers itself, runs PKCE, and keeps the token in its own credential store. config.toml holds a URL and nothing else.
- 01
Codex registers itself
One command opens lumail.io in your browser. No client ID to configure, no environment variable to export, no secret in your dotfiles.
- 02
You pick the organization
Sign in to Lumail and choose exactly which organization the agent may reach. Only owners and admins can authorize one.
- 03
You approve the scopes
Lumail asks for lumail.read and lumail.write, and shows you what each one covers before you grant it.
Your token carries the organization as a signed claim, so a session can never reach another organization in your account. Revoke it from Lumail settings and access stops on the next request.
What Codex can and cannot do.
The OAuth connection exposes a deliberately narrow tool set: everything needed to research, organize and draft, and nothing that reaches your audience's inbox.
Available over OAuth
Read subscribers, tags, custom fields and segments
Read campaigns, their content, analytics and send progress
Read workflows, workflow groups and org-wide stats
Add subscribers and apply or remove tags in bulk
Create and edit campaign drafts, and duplicate existing ones
Create and configure workflow drafts
Not exposed at all
Send or schedule a campaign
Publish or activate a workflow
Unsubscribe a contact
Delete anything at all
Reach another organization in your account
Change billing or organization settings
These are not permission prompts you could click through by accident — the tools are not registered on the OAuth endpoint, so the agent never sees them. Sending stays in the Lumail app, or in your terminal with npx lumail.
One config block and a browser tab.
Codex reads MCP servers from ~/.codex/config.toml. Lumail runs over streamable HTTP, so there is no local process to install and no wrapper to maintain.
Let your agent do it
Paste this into Codex. It reads the install guide at lumail.io/codex/install, writes the config block, runs the browser login, and verifies the connection.
Read lumail.io/codex/install and set up the Lumail connection for me.Or do it yourself
Three steps. If your Codex build supports plugin marketplaces you can install the packaged plugin instead, and skip straight to the login.
- 01
Declare the server
Add this to ~/.codex/config.toml. Note there is no bearer_token_env_var line: if you had one from the old token setup, remove it or it will shadow the OAuth credential.
[mcp_servers.lumail] url = "https://lumail.io/mcp" oauth_resource = "https://lumail.io/mcp" - 02
Sign in through your browser
A Lumail tab opens. Sign in, pick the organization the agent may reach, and approve the scopes. That is the whole credential step.
codex mcp login lumail - 03
Verify, then start a new session
codex mcp list should show lumail as connected, and /mcp shows the same inside the TUI. Start a fresh session, then open with a read-only question.
codex mcp list
Connection details
- Name
- lumail
- Server URL
https://lumail.io/mcp- Transport
- HTTP (streamable)
- Auth
- OAuth 2.1 + PKCE, with DCR
- Scopes
lumail.read, lumail.write- Marketplace
lumail
Need to send from an agent?
The OAuth connection cannot send, by design. The Lumail CLI reaches the full API including sending, and it signs in with the same browser flow — still no token to paste.
npx lumail auth loginUseful access, clear boundaries.
Every request is checked against the organization baked into your access token, and against your membership in it. Your config file holds nothing worth stealing.
One organization per authorization
The token carries a signed organization claim. Other organizations in your account stay invisible to Codex, even if you are an owner of all of them.
Nothing sensitive on disk
config.toml holds a URL. The access token lives in the Codex credential store and refreshes itself, so committing your dotfiles leaks nothing.
Revoke without touching your setup
Disconnect from Lumail settings and the next request fails. No config to edit, no environment variable to unset.
Frequently asked questions
What is the Lumail plugin for Codex?
It is an OAuth MCP connection to your Lumail organization, packaged as a Codex plugin with two skills. Once connected, Codex can read subscribers, campaigns, tags, workflows and analytics, and create drafts.
Do I need an API token?
No. Codex registers itself with Lumail through dynamic client registration and runs the browser OAuth flow. config.toml contains only the server URL, so there is nothing sensitive to protect or rotate.
How do I install it?
Paste 'Read lumail.io/codex/install and set up the Lumail connection for me.' into Codex and it does the setup. Manually: add the mcp_servers.lumail block to ~/.codex/config.toml, then run codex mcp login lumail.
I already had Lumail set up with an API token. What changes?
Remove the bearer_token_env_var line from your mcp_servers.lumail block and add oauth_resource, then run codex mcp login lumail. A leftover bearer token shadows the OAuth credential and keeps you on the old endpoint.
Does it work in the Codex app as well as the CLI?
Yes. Both surfaces read the same MCP configuration and the same stored authorization, so the Lumail tools appear wherever Codex runs on your machine.
Can Codex send a campaign?
Not over this connection. Send, schedule, publish, unsubscribe and delete tools are not registered on the OAuth endpoint, so the agent never sees them. Sending happens in the Lumail app, or through the Lumail CLI.
Do I need a paid plan?
No. The free plan includes MCP access with 100 requests per minute. Premium raises it to 700 and Business to 2,000, counted per organization.
How do I revoke access?
Disconnect the app from your Lumail settings, which cuts access immediately, or delete the mcp_servers.lumail block from config.toml to remove it locally.
Put your email operation in the same session as your code.
One config block, one browser sign-in, and Codex handles campaigns, subscribers and analytics between commits.
Read lumail.io/codex/install and set up the Lumail connection for me.