Mailgun API + MCP (2026): Battle-Tested REST, Official MCP Since Dec 2025

Mailgun’s REST API v3 has been production-stable since 2013, ships seven official SDKs, and covers the full transactional sending, tracking, validation, and inbound routing lifecycle. What sets it apart in 2026 is that Mailgun now ships an official Model Context Protocol server, released December 19, 2025 under Apache 2.0. That puts Mailgun six months behind Postmark on MCP but well ahead of Amazon SES, SparkPost, and SMTP2GO, none of which have shipped an official MCP as of August 2026. This tab inventories the API surface, the MCP setup path, authentication, rate limits, official SDKs, regional endpoints, and the developer gotchas a buyer should internalise before committing.

At a glance

MCP integration in 2026

Model Context Protocol is the emerging standard for connecting LLM agents (Claude, ChatGPT, Cursor, Windsurf, custom OpenAI Agents SDK deployments) to external tools. Mailgun’s official MCP server closes a gap that had defined Postmark’s differentiation for most of 2025, and gives Mailgun customers a first-party path to AI-driven email operations without a Zapier bridge.

Available MCP servers for Mailgun

Two options as of August 2026. The official server covers most use cases; the Zapier bridge exists for teams that already run Zapier and want to reuse its authentication and quota model.

REST API v3 essentials

The API follows REST conventions with a few Mailgun-specific quirks that trip up first-time users: region-scoped base URLs, HTTP Basic auth with a fixed username, and form-encoded POST bodies rather than JSON on most write endpoints.

The API surface is a mix of domain-scoped operations (send, events, logs, suppressions, webhooks, templates) and account-scoped operations (domains, IPs, mailing lists, routes). Domain-scoped paths always start with /{domain}/. Account-scoped paths do not.

Authentication methods

One primary mechanism, with domain-scoping as the main permission control.

HTTP Basic Auth (API key)

Send the API key as the HTTP Basic password with the fixed username api. Every SDK handles the base64 encoding of the Authorization header automatically. Domain-scoped keys limit blast radius to a single sending domain; account-wide keys can act on everything. Basic plan allows 2 API keys; higher tiers allow more. Rotate keys through the Control Panel under API Security. HMAC webhook signing is standard on every webhook payload (SHA-256 of timestamp + token in the X-Mailgun-Signature header).

Rate limits and quotas

Mailgun does not publish hard per-second rate limits publicly. Practical throughput is governed by the plan email quota per month, reputation-based throttling on new domains, and per-recipient rate limits on major mailbox providers (Gmail, Outlook, Yahoo).

The complaint-rate threshold is the number one thing that surprises new Mailgun customers, especially those migrating from marketing-first ESPs where 0.1—0.3% complaint rates are considered normal. Mailgun applies transactional-grade thresholds to all sending, and hitting 0.05% for even a short window can trigger a suspension. Segment marketing sends onto a separate provider or a separate account, and monitor the Optimize dashboard for early warning.

Official SDKs

Seven first-party libraries maintained by Mailgun engineering. All official SDKs implement send, templates, mailing lists, events, suppressions, and webhooks. Compare with Postmark (13 SDKs), SendGrid (7 SDKs), Amazon SES (SDK per AWS language).

Mailgun does not ship official SDKs for Rust, Kotlin, Swift, or Elixir. Community wrappers exist for all four; quality varies. For Rust and Elixir most teams call the REST API directly with the standard HTTP client of the language.

Endpoints reference

The nine endpoint groups you will actually use. Full reference at documentation.mailgun.com/docs/mailgun/api-reference.

Code examples

Two representative snippets covering the two most common first-day tasks: send an email, then set up a webhook to receive delivery events.

Python: send a transactional email

import requests

API_KEY = "key-your-mailgun-api-key"
DOMAIN = "mg.yourdomain.com"

response = requests.post(
    f"https://api.mailgun.net/v3/{DOMAIN}/messages",
    auth=("api", API_KEY),
    data={
        "from": f"SMTPedia <hello@{DOMAIN}>",
        "to": "user@example.com",
        "subject": "Your receipt from SMTPedia",
        "text": "Thanks for your order.",
        "html": "<h1>Thanks for your order.</h1>",
        "o:tag": ["receipt", "python-example"],
        "o:tracking": "yes"
    }
)
print(response.status_code, response.json())

Node.js: verify a webhook signature

const crypto = require('crypto');
const express = require('express');

const SIGNING_KEY = process.env.MAILGUN_WEBHOOK_SIGNING_KEY;

function verify(timestamp, token, signature) {
    const hmac = crypto.createHmac('sha256', SIGNING_KEY);
    hmac.update(timestamp + token);
    return hmac.digest('hex') === signature;
}

const app = express();
app.use(express.json());

app.post('/mailgun/webhook', (req, res) => {
    const { timestamp, token, signature } = req.body.signature;
    if (!verify(timestamp, token, signature)) {
        return res.status(401).send('bad signature');
    }
    console.log('event', req.body['event-data'].event);
    res.status(200).send('ok');
});

app.listen(3000);

Regional endpoints and data residency

Mailgun offers two regions with strict data isolation. Region is set at domain creation and cannot be changed without a full re-add and DNS re-verification.

Common developer gotchas

Deprecations and changelog

Mailgun maintains public release notes at documentation.mailgun.com/docs/mailgun/release-notes. Key items to know:

• Official MCP server shipped December 19, 2025. Node.js, Apache 2.0. Local execution only, no hosted variant. Available on all plans including Free.
• REST API v3 is current. Stable since 2013. No v4 announced as of August 2026. Individual endpoint deprecations get 12-month sunset windows with warning headers on responses.
• Analytics endpoint replaced legacy stats endpoint in 2024. Legacy stats endpoint still returns data but is documented as deprecated; new integrations should use /{domain}/analytics/metrics.
• Sinch Email became the legal entity on the Terms of Service in 2022 following the Sinch acquisition of Pathwire, closed December 7, 2021. The Mailgun product brand, API surface, and control panel URL did not change.

Frequently asked questions