Before You Connect

Confirm access before you change account settings

MCP access is not self-service. Before adjusting Agent Access, permissions, or spend settings, confirm with Mailhub that your intended assistant and environment can connect at all — ask through the support arrangement already in place for your account. Developer Support explains what to include in that request.

Connecting is a browser sign-in, not a configuration project. The common first-run problem is not a failed connection: the connection succeeds and then every tool is refused, because the account or the user was not ready.

What has to be true

Requirement	Why it matters	If it is missing
An active Mailhub user	You authorize with your normal sign-in; 2FA applies exactly as it does in the application. There is no separate MCP password and no API key.	You cannot complete the browser authorization.
Agent Access enabled on the account	MCP stays off for an account until it is turned on. Turning it on needs permission to manage the account's integrations.	Authorization still succeeds, and then every tool call fails.
View access to Orders	Lets the assistant list Orders, read an Order, and get a Label link.	Those reads are refused.
Update access to Orders	Needed to get Rates, and to create an Order, change a status, buy a Label, or cancel one.	Rating and every change are refused.
Carriers already configured	MCP rates and buys against the carriers your account already has. It cannot add, configure, or enable one.	Rating returns nothing to buy.
Wallet funds and agent allowance	Buying a Label spends real funds. The wallet balance and the agent spend limit are two independent checks.	The purchase is refused — possibly by the agent limit while the wallet still holds money.
A pre-registered MCP client	Mailhub registers clients in advance; an MCP client cannot register itself.	The authorization cannot complete.

Getting Rates is the one read-shaped task that needs update access rather than view access. A user who can only view Orders can browse them and fetch a Label link, and will be refused when the assistant asks for Rates.

Authorizing is not the same as enabling

Agent Access grants no permission of its own — it only decides whether the account participates in MCP at all. A user without integration-management permission can still complete the browser authorization, and it will look like it worked. Every tool call then fails until someone who does have that permission enables Agent Access. If an assistant connects and can do nothing at all, check this first. The same account state also shows up as a repeated request to sign in again — see Errors & Troubleshooting.

Before you approve a change

The four changing tools require an explicit confirmation on the call. The server refuses an unconfirmed change. mailhub_buy_label spends real money from the account wallet. Cancelling a Label does not automatically return funds to the wallet.

Confirmations & Spend Safety is the canonical account of all of it: how confirmation is enforced, how the wallet and the agent spend limit interact, and which changing calls are safe to repeat.

Next

Connecting in Claude walks through the authorization itself. Then read Authentication to understand what you approved and how long it lasts.

• Building an unattended integration instead? How to start.
• Something not behaving as described here? Developer Support.