> Postmark: what your AI agent should know — from The Handover, the-handover.org/services/postmark
> © Captivated Ltd — free to use in your own work, not to redistribute as a collection. the-handover.org/licence

# Postmark

What we tell an AI agent working on a project that uses Postmark: 2 rules, 0 learned the hard way.

Build a full rootnote set for a Postmark project: https://the-handover.org/build?areas=working-agreement,email&email=postmark

The vendor's own file for agents (what Postmark is, where its documentation lives): https://postmarkapp.com/llms.txt. This page covers where it catches agents out.

### Postmark: an unofficial MCP server under Postmark's name copied every email to its publisher

> Reported by Idan Dardikman, Koi Security (archived copy; the original now redirects), "First Malicious MCP in the Wild: The Postmark Backdoor That's Stealing Your Emails" — web.archive.org/web/20250929094654/https://www.koi.security/blog/postmark-mcp-npm-malicious-backdoor-email-theft; ActiveCampaign, "ActiveCampaign/postmark-mcp (official repository)" — github.com/ActiveCampaign/postmark-mcp · distilled by Leon Mallett (captivated.online) with Claude Code · reviewed 2026-10-24

In September 2025 Koi Security reported an npm package named `postmark-mcp`. It
was not Postmark's: it copied the official server's code, which lives on
ActiveCampaign's GitHub, and was published to npm by an unrelated developer.
Versions 1.0.0 to 1.0.15 behaved normally. Version 1.0.16 added one line that BCC'd
every email sent through it to an address the publisher controlled. Koi reported
about 1,500 downloads a week. The package was unpublished on 2025-09-25, but
removing it from npm does not remove copies that were already installed.

- **Install an email MCP server only from the vendor's own repository or the
  package name that repository links to.** Postmark's official server is now
  published as `@activecampaign/postmark-mcp`. A matching name is not proof
  that a package is the vendor's.
- **Pin the version.** The bad release came after fifteen good ones, so a
  package that was safe when you checked can stop being safe on its next update.
- **An agent cannot see what the tool does with the request.** A send reports
  success either way. Check the server's code and your sending logs, not the
  agent's report.
- **If you ran the unofficial package at 1.0.16 or later**, Koi advises removing it,
  rotating any credentials sent by email in that period, and checking your logs
  for BCCs you did not add.

### Postmark: transactional and broadcast streams are not interchangeable

> General guidance · Leon Mallett (captivated.online) with Claude Code · reviewed 2026-10-19

- **Send transactional mail on a transactional stream and anything bulk on a
  broadcast stream.** Mixing them breaches the terms and harms delivery of the
  mail that matters.
- **Use a server token in the application, never the account token.**

Also applies to every transactional email choice, so not repeated here: Email: nothing reaches a real person from development, staging or a test.