Presend over MCP
Agents send messages now too, and they make the same mistakes people do. MCP connects Presend in both directions: agents can call the gate, and the gate can call your systems.
Give an agent the gate
An agent that drafts and sends messages can run each one through the same check the extension does, before it sends. In Claude Code:
claude mcp add --transport http presend https://api.getpresend.com/mcp \
--header "Authorization: Bearer $PRESEND_TOKEN"Streamable HTTP, one POST per message. The server is stateless: it holds no session and keeps no stream open, so there is nothing to reconnect and nothing to clean up.
The three tools
| check_draft | Runs the full gate on a draft. Returns findings with a level, the offending text and a suggested fix, plus voice and slop scores. |
| rewrite_draft | Rewrites the draft while keeping the sender's voice. |
| list_rules | The caller's own rules: what each checks and how hard it blocks. Lets an agent explain itself before it stops. |
Every result carries both prose the model reads and the same answer as structured data, so an agent can act on it without parsing English.
check_draft defaults to depth: "send", unlike the REST endpoint. An agent calls this once, deliberately, at the moment it is about to send. There is no keystroke to keep fast, so the full gate is the right default. Pass "live" to skip the external calls.
A failing tool is not a failing call
When a tool cannot do its job it comes back as a successful response carrying an error flag, so the model can read what went wrong and react. Protocol-level codes stay reserved for genuine protocol faults: an unknown method, a missing argument, an unparseable body.
The difference matters for agents. A hard transport error is something a model can only retry blindly; a readable error is something it can fix.
Authentication
The same bearer token as the API, on every request. It is required unconditionally here, even where anonymous checks are allowed elsewhere.
The reason is honesty about the answer. A check with no account attached has no custom rules and no voice profile to compare against, so an anonymous agent would get a quieter result and no way to know it was quieter. The authenticated account also overrides any user passed in the arguments, so a caller cannot check as somebody else.
Create a key in the dashboard under Settings, API keys, and use it as the bearer token above. It does not expire, which matters here: an agent configuration written once should not quietly stop working a month later.
This is bearer-only, which covers Claude Code and Claude Desktop. Listing Presend as a remote connector inside claude.ai additionally needs OAuth 2.1 with dynamic client registration, which is an auth-server project rather than an MCP one. It is not built.
The other direction: your tools as rules
The same protocol works the other way round. Add your own MCP server as a connection in the dashboard, and a rule can call its tools before deciding whether to stop a message.
That is what turns a check about wording into a check about facts. "Do not promise a delivery date that contradicts the Jira ticket" is a rule that has to go and read the ticket.
Presend calls your server itself rather than handing the address to a model provider, so a server on a private network or behind your VPN still works. Your credentials are stored write-only: never returned by any endpoint, never shown again after you save them.
Calling it from code instead
If the caller is your own software rather than an agent, the REST API exposes the same checks without the protocol wrapper.