MCP server

Corral, from the tools
you already work in.

Cursor, Claude and any client that speaks MCP can look up a lead, read the Unibox and draft a reply the way you would: cited from your knowledge base, checked against Never say, and waiting for you before anything goes out.

Connect a client.

Add the server, then the first call opens Corral in your browser: you pick what the client may do, per area, and Allow. Or connect from Settings → Developers → MCP, which writes this for you and tells you when the first call lands.

1Open ~/.cursor/mcp.json (Cursor Settings → MCP → Add new global MCP server).
2Paste this in, or merge it with the servers you have.
3The first call opens Corral in your browser. Pick what it may do, then Allow.

Config~/.cursor/mcp.json

{
  "mcpServers": {
    "corral": {
      "url": "https://mcp.corral.app/mcp"
    }
  }
}

A person signs in. A job gets a key.

For a person’s AI client

Sign in with Corral

OAuth, no key to paste or leak. The client acts as you: your Unibox, your mailboxes, your Never say. It’s the only way to hold unibox:send, and even then a send waits out the same undo as the button.

For a job that runs without you

An API key

A Bearer key for n8n, Zapier or your own code, scoped per area and shown once. It expires after 90 days by default; rotating keeps the old one working 24 hours. Keys read and draft. They never send.

Companies and contactsAdd, tag and change a lead’s status
NoneReadWrite
SegmentsCreate and change segments
NoneReadWrite
SequencesRead sequences, steps and results
NoneReadWrite
UniboxTriage and save drafts; nothing leaves your mailboxesKeys can draft but can’t send. Sending needs a signed-in MCP connection.
NoneReadWrite
Knowledge baseSearch the knowledge base and Never say
NoneReadWrite
ScoringRead scores and why
NoneReadWrite

Create key → What it may do. The Unibox stops at Write for a key.

15 tools, and nothing else.

A client only sees the tools its access allows; the rest aren’t listed. Billing, team and mailbox settings stay in the app, on purpose.

Companies and contacts

search_companiesReadFind companies in your workspace by fit, country, industry or stage.leads:read
get_companyReadOne company: its contacts, fit and the checks behind it, and where it is in a sequence.leads:read
update_lead_statusWriteMove a contact to a new status, with a note on why.leads:write

Segments

list_segmentsReadYour saved segments with how many companies each holds.segments:read
create_segmentWriteSave a segment from filters. It updates as companies change.segments:write

Sequences

list_sequencesReadSequences with their steps, who is in them and how they’re doing.sequences:read
enroll_in_sequenceWriteAdd contacts to a sequence.sequences:write

Unibox

list_threadsReadUnibox threads by tab and triage, newest first.unibox:read
get_threadReadA thread’s messages, the lead behind it and Corral’s draft if there is one.unibox:read
draft_replyWriteHave Corral draft a reply, cited from your knowledge base and checked against Never say. It waits in the Unibox.unibox:write
send_replySends emailSend a saved draft from the thread’s mailbox. Signed-in clients only.unibox:send

Knowledge base

search_knowledgeReadSearch the knowledge base and Never say; each hit names its source line.knowledge:read
add_knowledge_sourceWriteAdd a URL or text as a source.knowledge:write

Scoring

explain_fitReadWhy a company scored what it did: each check, its points and the evidence.scoring:read
score_companyWriteScore a company you haven’t scored yet, from its site and public records. 1 credit, the same as in the app.scoring:write

The same rules as the Send button.

Nothing sends by default. Only a signed-in connection can hold unibox:send, and a send waits out the 10-second undo and the Never-say check.
Drafts show their work. draft_reply cites the knowledge base and lists what it left out.
A thread that moved stops a send. If the lead or a teammate wrote since the draft, send_reply answers 409 and nothing goes out.
Enrolling isn’t launching. Step one waits for the sequence’s launch checks. New knowledge sources wait in Review.

When it says no.

Status	Code	What it means	What to do
401	invalid_token	The key or sign-in is wrong, expired or revoked.	Sign in again from the client, or use a key that’s Active.
403	insufficient_scope	The tool needs a scope this connection wasn’t given.	Reconnect and allow it, or give the key that area.
403	key_cannot_send	An API key called send_reply. Keys draft; only a person’s signed-in connection sends.	Save the draft with the key, and send it from the Unibox or a signed-in client.
409	thread_changed	Someone wrote in the thread after the draft was made.	Read the thread again and redraft; nothing was sent.
422	never_say	The reply says something on your Never-say list.	Change the text; the error names the rule.
429	rate_limited	Over the limit for this key or connection.	Wait for Retry-After seconds. Reads and writes count separately.

Limits.

Calls: 60 a minute per key or connection
Writes: 20 a minute
Sends: 30 an hour, never past a mailbox’s daily cap
Log: Every call, 90 days

Corral, from the toolsyou already work in.