The lemlist MCP Server: What Changes When the Agent Can Launch the Campaign

Most vendor integrations let software read your data. lemlist's Model Context Protocol server lets an AI assistant create a campaign, add leads to it, and start it. That is a different kind of connection, and the setup instructions take about the same two minutes either way, which is precisely the problem.

lemlist publishes the server on its own developer documentation and markets it on a product page whose headline invites you to stop doing outbound and start prompting it. Both surfaces were fetched on 16 August 2026 and everything below comes from them. We run Email Bison for sending, so this is a documentation read of another vendor's integration rather than an account of running it.

The tool list is the risk assessment

lemlist's developer documentation lists what the server currently exposes, with the caveat that the set evolves and the honest suggestion that you ask your assistant what it can do. The current capabilities are grouped into six areas: campaign management covering create, update, start and pause for campaigns and sequences; lead management covering add, search and update across campaigns; lead sourcing against the B2B database by role, industry, company size and location; email enrichment covering finding and verifying addresses; team and stats; and webhook subscription management.

Read that list as a permission grant rather than a feature table. Three of those six groups change the state of a live sending account. Start a campaign is a send. Add leads to a campaign is a send with a list attached. Update a sequence is a change to copy that is already going out.

The product page's own FAQ puts the total at more than forty actions and describes the scope plainly: everything you do in lemlist, your agent can do too. That sentence is the most useful one on either page, because it sets the correct mental model. This is not a reporting connector with a chat interface. It is delegated access to the account.

Changes what goes outState-changing actions

• Create, update, start and pause campaigns and sequences
• Add and update leads across campaigns
• Manage webhook event subscriptions

Spends moneyCredit-consuming actions

• Email finding and verification
• Phone enrichment
• The documentation states the assistant warns before using these

Only readsThe safe half

• Lead search against the B2B database
• Team information
• Campaign performance metrics

The authentication model is the better one, and worth understanding

lemlist documents two ways to connect, and recommends the stronger of them.

With OAuth, no API key is created at all. The client is pointed at https://app.lemlist.com/mcp and the mcp-remote module handles discovery, client registration, browser-based consent, token exchange using PKCE, and token refresh. The first time a tool is called, a browser consent page opens where you select the team and authorise access. The documentation gives the token lifetimes: an access token lasting one hour and a refresh token lasting thirty days.

The alternative is an API key, created in the application under Settings, then Team, then Integrations, and passed to the server in an X-API-Key header.

Both details matter for a security conversation. A consent screen that names the team makes the grant visible at the moment it is made, which a pasted key never does. Short-lived access tokens with refresh mean revoking access at the source actually ends it, rather than ending it whenever someone remembers which config files hold the key. And a credential carried in a header, rather than in the connection URL, stays out of shell history, process listings and pasted troubleshooting output. Vendors in this category vary on that last point, and it is worth checking per server rather than assuming.

The vendor's own security answer on the product page is that the key stays local on your machine and that the AI client stores no data, passing instructions to lemlist's API and returning results. That is a statement about the client's role, and it is accurate as far as it goes. It says nothing about who at your company holds the grant, which is the question your access review will ask.

Credits are the cost surface nobody models

The developer documentation notes that email finding, verification and phone enrichment consume credits, and that the assistant warns before using them. lemlist's pricing page publishes the rates behind that warning: one credit is one cent, a verified email costs five credits, and a phone number costs twenty. The same page states the arithmetic itself, that a thousand credits buys two hundred emails or fifty phone numbers for ten dollars, and that credits are only charged when an action succeeds.

Work an illustrative example, invented here to show the shape rather than drawn from any account. An agent asked to build and enrich a list of two thousand prospects, at the published five credits per verified email, would spend ten thousand credits, which is one hundred dollars at the published rate. That is not a large number. It is also not a number anybody approved, and the request that produced it was one sentence long.

The gap between how easy an instruction is to give and how much it costs to execute is the genuinely new thing about this integration. A person building that list in the interface passes several screens that make the scale visible. An agent passes none of them. Setting a spending expectation before the connection is made, rather than reading it off an invoice, is the whole of the mitigation.

Before you connect a write-capable server

• ✓Yes: Prefer the OAuth path, so the grant is consented to explicitly and can be revoked at the source.
• ✓Yes: Decide who may hold the grant, since it covers everything the person can do in the account.
• ✓Yes: Agree in advance whether starting a campaign is ever an agent action rather than a person's.
• ✓Yes: Set a credit expectation, since enrichment actions spend real money at published per-action rates.
• ~Depends: Check which figures your prompts rely on, because the vendor's own surfaces disagree on database size.
• ✕No: Assume a warning before a credit-consuming action is the same as an approval step.

The database figure disagrees with itself, on the vendor's own pages

Anyone planning to prompt against lead volume should know that lemlist publishes three different numbers for the same database, and two of them sit on one page.

The product page's headline offers access to more than six hundred million leads. The navigation on that same page advertises a 650 million-plus lead database. The FAQ further down, answering what an agent can actually do, says lead search runs across more than 450 million contacts, and the developer documentation's capability list gives the same 450 million-plus figure.

None of those is presented as superseding the others, and this is ordinary rather than sinister: marketing surfaces and documentation drift apart at every vendor. The doctrine that follows is the useful part. A figure belongs to the page it appears on, so quote it that way, and where a vendor's own pages disagree, say so instead of picking a winner. For a buyer, the number that matters is the one the search actually runs against, which is the documentation's figure rather than the hero's.

The productivity claims beside them deserve the same treatment. The product page states that reps lose twelve minutes per prospect, spend more than twenty copy-pastes per sequence, and take forty-five minutes to launch a campaign that agents on its MCP cut to ninety seconds. Those are the vendor's assertions about a problem the vendor sells the solution to, and they are worth reading as positioning rather than as measurement.

1. Step 1Connect with OAuth

   Consent names the team, tokens expire, and revocation at the source is real.

2. Step 2Use the reading half first

   Lead search, campaign metrics and team information carry no state change.

3. Step 3Draft, then stop

   Let the agent assemble the list and the copy, and leave the campaign unstarted.

4. Step 4Review the rendered output

   Read finished messages against real rows, since a template review proves the template only.

5. Step 5Start it yourself

   Activation stays a person's decision, whatever the tool permits.

What we would and would not delegate

Our operating policy is straightforward and it maps cleanly onto this tool list. Approval gates for anything that leaves the building stay with a person: external sends, list loading and campaign activation are not delegated, whatever an integration makes possible. Research, list assembly, analysis and drafting are a different class of work, and they are where an agent connection earns its keep.

There is a second reason to be careful with the campaign-creation half specifically. We run one message per campaign, with no bumps and no thread replies, and re-approaching an audience means a new campaign with a genuinely different angle rather than another step under the first. On LinkedIn the constraint is stronger, because a second message lands directly beneath the one the recipient already ignored, so we do not run LinkedIn no-reply retargets at all. A tool that generates multichannel sequences on request will happily produce the shape we decline to send, and LinkedIn automation tools covers the account-level limits that apply regardless of what generated the sequence.

The lead-sourcing half raises the ordinary question too. Addresses an agent finds are still addresses that need verifying before they meet a sending domain, which email verification tools covers, and volume still has to be spread across mailboxes, which inbox rotation describes.

The short version

lemlist's MCP server is well documented, sensibly authenticated and genuinely capable. The capability list includes creating, starting and pausing campaigns, which makes it a delegation of sending authority rather than a reporting convenience, and the setup for both is identical in effort.

Use the OAuth path, keep activation with a person, agree a credit expectation before the first enrichment run, and quote database figures from the documentation rather than the headline, because lemlist's own surfaces carry 650 million, 600 million and 450 million for the same thing. If the underlying evaluation is about the platform rather than the integration, lemlist pricing covers the plan ladder and the credit meter, and the alternatives roundup covers the field. For the category shapes, cold email software sets them side by side.

If what you actually want is meetings on the calendar rather than a faster way to launch campaigns, see what a first campaign looks like, booked against a qualification standard agreed in writing before launch.

Integration capabilities, authentication details and credit rates verified as of August 2026 against lemlist's developer documentation, its MCP product page and its pricing page, each figure attributed above to the surface it appears on. Verify current terms with the vendor before relying on them.