listmonk + Memtro

Only when you ask, and only what it has been granted: create a mailing list; create a subscriber, with subscriptions pre-confirmed so no opt-in email is sent; update a subscriber's name, email or status; add subscribers to lists; remove or unsubscribe subscribers from lists; blocklist a subscriber; delete a subscriber; create a draft campaign (not sent); update a campaign's content, lists or send time; start sending a campaign now, or schedule it; pause a running campaign; cancel a running campaign; delete a campaign; send a transactional email to subscribers; update a list's settings; delete a list; send a test copy of a campaign to named addresses; publish a campaign to the public archive, or withdraw it; send a subscriber the double opt-in confirmation email; create an email template; update a template's name, body or subject; make a template the default; delete a template; blocklist several subscribers by id; delete several subscribers by id; delete a subscriber's bounce records; clear a subscriber's recorded views or clicks. Every other tool reads, searches or lists. The Connections page labels the tools that act, an administrator grants each one by name to the teams that may use it, and a personal connection acts only after its owner allows it.

A personal connection serves only your own requests. A shared connection serves the organisation: everyone, or only the teams an admin chooses. Admins can always add shared connections; other members need the permission.

Credentials are encrypted at rest. Tool results are cached briefly so agent loops do not repeat identical calls, and the facts the model extracts are saved to your organisation's memory with provenance (system, record and link) so they can be checked and superseded.

Host, API user and token. In listmonk open Admin → Users → New, choose the type API, and attach a user role and list role with only the permissions Memtro needs. A role without campaign and tx permissions keeps sending out of reach. Copy the token, shown once.