qorami-mcp
The Qorami MCP server acts as an AI email safety gate, providing two primary tools:
verify_email: Submit an email (recipient, subject, body, and optional policy profile) to get a permission decision before sending. The agent must obey the returned decision, which is one of:send— email is allowedrequest_human_confirmation— a human must review first; poll for the outcome usingcheck_action_statusdo_not_send— email is blocked; thesuggestionsfield explains what to fixOptionally returns a
remediation.safeBodywith sensitive content redacted when auto-remediation is possible
check_action_status: Poll the status of a pending human review using theactionIdreturned byverify_email. Continue polling until the decision becomes eithersend(approved) ordo_not_send(blocked).
Qorami SDK
Official clients, tool schemas and an MCP server for Qorami — a control point between your AI agents and actually sending email. Before each send, the agent asks Qorami, which replies send, request_human_confirmation, or do_not_send.
Get an API key in the dashboard. Full API reference: https://qorami.fr/docs.
Path | What |
Zero-dependency JavaScript / TypeScript client ( | |
Zero-dependency Python client (stdlib only) + LangChain, CrewAI, LlamaIndex & OpenAI-Agents tools. | |
Drop-in OpenAI function-calling & Anthropic tool-use schemas for | |
Stdio MCP server ( | |
n8n community node ( | |
No-code recipe: guard a workflow's email with a plain HTTP Request node (no install). | |
Runnable Node & Python quickstarts. |
JavaScript / TypeScript
import { QoramiClient } from './js/qorami.mjs'
const qorami = new QoramiClient({ apiKey: process.env.QORAMI_API_KEY })
await qorami.guard(
{ recipient: 'client@example.com', subject: 'Our offer', body, policyProfile: 'sales' },
{
send: () => mailer.send(), // allowed
requestHumanConfirmation: (r) => queue(r.action.id), // a human was notified
doNotSend: (r) => log('blocked', r.decision), // do not send
},
)Or step by step with qorami.verify(...) and, after a review, poll
qorami.status(actionId) until nextAction.type === 'send'.
Related MCP server: Impri
Python
from qorami import QoramiClient
qorami = QoramiClient(api_key=os.environ["QORAMI_API_KEY"])
result = qorami.verify(recipient="client@example.com", subject="Our offer",
body=email_body, policy_profile="sales")
if result.next_action_type == "send":
send_email()
elif result.next_action_type == "request_human_confirmation":
queue_for_review(result.action_id) # a human was notified by email
# else: do_not_sendAgent framework tools
pip install qorami[<framework>] ships a drop-in qorami_check_email wrapper —
each returns ALLOWED / NEEDS HUMAN APPROVAL / BLOCKED and reuses the client:
Framework | Install | Import |
LangChain |
|
|
CrewAI |
|
|
LlamaIndex |
|
|
OpenAI Agents SDK |
|
|
from qorami_langchain import build_qorami_tool
tool = build_qorami_tool() # reads QORAMI_API_KEYNo-code workflows (n8n) use a plain HTTP Request node — see n8n/.
MCP server
Register Qorami as a native tool in Claude Desktop / Cursor / any MCP client —
see mcp/. It exposes qorami_health, verify_email and check_action_status over stdio.
The contract
Every client returns the same decision the agent must obey via nextAction.type:
send, request_human_confirmation (a human approves first — poll the action),
or do_not_send. See https://qorami.fr/docs.
Cleaned version (auto-remediation)
When an email is risky only because of mechanically-removable content (a leaked
secret, a suspicious link, an IBAN/card/SSN), the verify result carries a cleaned,
sendable copy — send remediation.safeBody instead of blocking outright:
const r = await qorami.verify({ recipient, subject, body, policyProfile: 'general' })
if (r.nextAction.type === 'do_not_send' && r.remediation?.safeToSend) {
mailer.send({ ...email, body: r.remediation.safeBody }) // safe, redacted copy
}r = qorami.verify(recipient=..., subject=..., body=email_body)
if r.next_action_type == "do_not_send" and (r.remediation or {}).get("safeToSend"):
send_email(body=r.remediation["safeBody"]) # safe, redacted copyremediation.removed lists what was stripped (e.g. ["secret", "link"]). The MCP
server surfaces the same field.
License
MIT — see LICENSE.
Available Tools
2 toolscheck_action_statusA
After request_human_confirmation, poll this with the actionId until nextAction.type becomes "send" (approved) or "do_not_send" (blocked).
Inputs: actionId (required).
verify_emailA
Before sending ANY email, call this to get permission from Qorami. Returns a decision the agent MUST obey: send (allowed), request_human_confirmation (a human must approve first — then poll check_action_status), or do_not_send (blocked). When not allowed, "suggestions" says what to fix.
Inputs: recipient (required), subject (required), body (required), policyProfile.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
TDQS
Scored across 2 tools
The two tools have clearly distinct purposes: verify_email handles the initial permission check, and check_action_status polls the result of a human confirmation request. There is no overlap.
Both tool names follow the verb_noun pattern (verify_email, check_action_status) and use snake_case consistently.
With only 2 tools, the set is on the thin side for a standalone MCP server, but it covers the core email verification workflow without unnecessary additions.
The tools cover the entire permission lifecycle: initial decision via verify_email and subsequent polling for human confirmation via check_action_status. No obvious gaps for the intended domain.
Maintenance
Related MCP Connectors
Check an email before your AI agent sends it: allow, review or block with reasons.
Governed email for AI agents: a sandbox inbox to read and send from, human approval to go external.
Safe email for AI agents: a mailbox with inbound scanning, outbound checks and human review.
Authenticated email gateway for AI agents — per-agent inboxes, HITL approval, SPF/DKIM verified.
Related MCP Servers
- AlicenseBqualityCmaintenanceWAF for AI agents — block prompt injection before it reaches the LLM.591 PyPIMIT
- AlicenseAqualityBmaintenanceHuman-in-the-loop approval inbox for AI agents: an agent proposes an action (send email, post comment, run a command), a human approves, rejects, or edits it from a web, mobile, or Slack/Discord/Telegram inbox, and the agent only runs on approval. Full audit trail, self-hostable (MIT).86MIT
- AlicenseNot gradedqualityCmaintenanceEnables AI agents to send and receive email with enforced security policies, scoped mailboxes, and human approval for external sending.80 npm1MIT
- AlicenseAqualityFmaintenanceAn email operating system for AI agents that provides safe triage, drafting, and searching of emails with unbypassable hard-stops on money, banking changes, first-contact senders, and prompt injection.1284 npmMIT