AI and MCP

The Model Context Protocol (MCP) connection lets a compatible AI client work with your Elite workspace through a remote, authenticated endpoint. It does not give a model your password. OAuth grants named scopes, connections can be revoked, and each tool call is audited.

Connect a client

Open Connect your AI in the dashboard. Choose ChatGPT, Codex, Claude, Grok, Muse, or another compatible client to see only its setup instructions. ChatGPT, Codex, and Muse Code have separate instructions. Add Elite in your client, then review the access it requests on Elite’s connection screen.

For Muse Code, copy the displayed mcp_servers entry into your user settings.json, then run muse mcp login elite-email-tracker. Muse Code discovers Elite's OAuth metadata, opens the browser consent flow, and stores and refreshes the resulting grant. The consumer Muse app uses a separate reviewed connector directory; a listing there is available only after Muse approves and publishes it.

Permissions are grouped into reading, preparing and organizing, and sending or running workflows. Expand Permission details to adjust individual actions. Administrative access is optional and initially unselected. When sending is requested, full email-content access is initially selected so you can review the exact message; you can deselect it. Workspace redaction still applies. Your client’s available features and organization settings may affect setup.

After authorization, ask your agent to call get_workspace_context. It discovers connected mailboxes, effective plan capabilities, permissions, and usage limits. Everyday MCP use does not require manually creating an agent identity or policy. If a task requires more access, compatible clients can request the additional permissions and continue after consent.

For sending, choose Inside your AI app to confirm the exact preview in your conversation or its email panel. This delegates confirmation to that client under the grant you approve. Compatible clients show an MCP accept/decline/cancel prompt; other clients use their own confirmation controls. You can instead choose Elite dashboard for separate review. Existing connections retain dashboard review until you change Email confirmation in Connect your AI. A preview token binds an action; it does not itself prove a human click.

Your connection appears under Your connected agents. You can inspect permissions, disconnect, and view recent activity here. Dedicated identities, budgets, and specialized controls remain under Advanced settings. Templates, progress, and reviews are available in Workflows.

Organization access

Owners and admins configure the maximum AI access for Managers and Members under Team workspace → Roles & access:

• Work with AI: read, prepare, and act, subject to consent and existing reviews and limits.
• Read and prepare: read and update drafts or records; no AI sends or automation execution.
• Read only: analysis without changes or sends.
• No AI access: block AI requests for that role.

Changes apply to existing connections on subsequent requests as well as future connections. OAuth consent cannot exceed the organization’s limits. Team roles do not automatically give an agent access to other members’ data. Administrative MCP permissions are limited to owners and admins within teams.

Invitations show the chosen role’s permissions and AI access. Owners can invite admins; admins can invite and manage managers and members. Managers may invite members only when an administrator enables that permission. Billing and administrator appointments remain owner controlled.

Permission scopes

Read scopes cover workspace context, activity, contacts, campaigns, documents, signatures, polls, workflows, integrations, and notification preferences. Draft/write scopes separately cover contacts, campaigns, one-to-one messages, documents, signatures, polls, workflows, integrations, notifications, and activity:write for reply corrections plus mute/stop-tracking triage. messages:send, campaigns:execute, signatures:send, and workflows:execute cover external effects. Sending or reminding signature requests requires signatures:send; signatures:write alone cannot send them. Resuming a paused workflow or creating/resuming send_follow_up engagement rules also requires workflows:execute. Embedding a poll in a draft requires polls:read in addition to the draft scope. sensitive:read exposes configured private fields unless the workspace uses always-redact mode; administration:write covers access revocation and retention. OpenID/email/profile scopes are used only for host account/domain verification. A tool called without its exact scope is denied and recorded.

What AI can do

Depending on scope, available tools can:

• read workspace counts and connected mailboxes;
• search activity/messages and inspect message engagement;
• search contacts, manage cursor-paged list membership, and preview/save dynamic segments;
• read campaigns and performance summaries;
• list tracked documents and analyze viewers, pages, slides, sheets, row ranges, dwell, and downloads;
• read signature-request progress and audit events;
• create/update contacts and lists;
• create and revise campaign drafts, preview personalization, independently review a launch, inspect delivery, and pause/resume/cancel remaining work;
• draft, preview, independently review, send/schedule, reconcile, and cancel one-to-one tracked messages or replies;
• upload allowlisted tracked documents and create confidential watermarked share links;
• create a signature-request draft, send an envelope, queue reminders, revoke signer sharing, or cancel a request;
• list and control CRM/messaging integrations without exposing tokens;
• read and update notification preferences;
• create, update, close, and inspect polls, including response tallies;
• embed an active poll into a one-to-one tracked email draft or campaign draft with poll_id;
• suppress/archive contacts and reactivate only with consent or bounce-resolution evidence;
• mute, unmute, or stop tracking on a live message;
• correct reply classifications that drive follow-ups;
• inspect supported Outlook inbox sync state and trigger an Outlook sync;
• create, version, archive, and preview reusable outreach templates;
• create and control custom engagement rules.

Built-in prompts support a weekly email review, relationship brief, campaign postmortem, and document content review.

One tracked message

Use this sequence for an ordinary tracked email or reply:

1. create_tracked_email_draft stores the explicit sender, displayed To/Cc/Bcc audience, content, attachment hashes, reply linkage, tracking state, and optional schedule under an idempotency key. It sends nothing.
2. preview_tracked_email revalidates mailbox and recipient policy, freezes an immutable binding, and returns safe formatted content, a client-bound confirmation_token, and the connection’s confirmation mode. Remote images and links are disabled in previews.
3. Review the sender, all recipients, subject/body, attachments, tracking and send time, then confirm in your AI app. Connections choosing dashboard review use the authenticated review link instead. Drafting and previewing send nothing.
4. send_tracked_email accepts the original confirmation_token and one stable idempotency key. get_tracked_email_review refreshes that original preview and operation without creating a new action. Approval is consumed only after a provider result is durably recorded.
5. get_send_status reports accepted, scheduled, retrying, reconciling, failed, or canceled. After an ambiguous provider response, enable reconciliation; do not create another send key.

cancel_scheduled_email works only before provider processing. Provider-accepted messages cannot be recalled.

Campaign launch safety

An AI cannot launch a campaign in the same call that drafts it. Launch uses two explicit tools:

1. prepare_campaign_launch validates the draft and audience, excludes ineligible recipients, and binds the exact campaign version, sender, schedule, content, and eligible audience to an exact review, including frozen personalization and rendered recipient samples. It sends nothing.
2. The user reviews every sequence step, full audience, exclusions and personalized examples, then confirms in the AI app under its connection policy. Dashboard review is available for connections choosing it.
3. execute_campaign_launch revalidates the current campaign against approval, durably leases the operation, and records a replayable result. Approval is consumed only after recipient enrollment succeeds.

Always inspect eligible/rejected counts, sender, schedule, content version, and warning before review. Use get_campaign_execution_status for cursor-paged provider delivery state and control_campaign to pause, resume, or cancel remaining work. Messages already sent cannot be recalled by revoking MCP.

Prompt-injection and data safety

Email bodies, subjects, contact notes, document text, and external content are untrusted data. They can contain text that looks like instructions to an AI. The MCP server tells clients to treat stored content as data and to read before writing, but you should still review consequential changes and sends.

Audit and revocation

Recent agent activity shows tool, risk, outcome, duration, and time. It is an operational audit, not a replacement for reviewing the actual campaign/contact/signature state. Revoking a client stops future token use; completed writes remain.

Limitations

MCP still does not expose CSV/PDF export downloads, team/billing settings, video management, or mailbox preference editors. Integration connect URLs are human OAuth handoffs; agents never receive CRM tokens. Confidential watermarks are share-link settings, not document encryption. A PDF attached in an agent conversation is not automatically uploaded unless the client calls upload_tracked_document. Poll creation never sends email by itself; outbound mail with an embedded poll still requires human approval before send_tracked_email or execute_campaign_launch.

• The AI client must support remote Streamable HTTP MCP and OAuth 2.1.
• Ordinary clients use stateless Streamable HTTP. Clients advertising form elicitation use authenticated client-bound sessions so the confirmation request and response remain inside the client.
• AI recommendations can be wrong and engagement does not prove intent.
• Role, plan, recipient policy, and account boundaries still apply server-side.
• Never paste access tokens, review bindings, or operation identifiers into public messages or logs.

Workflow templates and human review

Open Workflows → New workflow to browse templates or build a custom workflow. Your remembered profession only chooses the library’s starting view. Every profession and template remains available, and you can switch views without changing that preference.

Save incomplete setups as drafts. Activation checks real workspace resources and creates durable work. Review is enabled by default; pending messages appear in Needs review with their recipient, sender, and content. Activating an unattended authorization policy requires a human in the dashboard. Exact tracked-email, campaign-launch and proposal-follow-up reviews can collect human confirmation inside the AI app when the connection chooses it and grants the corresponding execution permission. Drafting never authorizes a send.

Checklist workflows track outstanding items, schedule bounded follow-ups, and finish from recorded completion. Campaign workflows monitor the campaign’s existing review and launch process; activating a template does not launch the campaign. Shared send budgets are enforced by the worker, including retries and uncertain delivery. Advanced agent identities, permissions, and usage controls remain available through Connect your AI → Advanced settings.

Google Workspace data boundary

Native and browser Gmail mailbox data, historical copied Gmail content, recipients and associations are excluded from cloud AI and external Apple Writing Tools. Available selected Sheets and their derivatives remain Google Workspace data: they may only reach a configured provider with operator-verified endpoint, model, upstream provider, plan/tier and retention evidence that forbids generalized and foundational model training. Missing or mismatched evidence disables the gateway; a client acknowledgement cannot enable it. Independent authored data and Outlook use only their permitted cloud sources.