How should a GTM agent send outbound email safely? Skills, Resend, Instantly and Gmail

Short answer: let the agent write, not fire. Use a vetted writing skill for drafts, keep a guardrail that stops before any send, then deliver only through a scoped API key on a venture-owned mailbox (Resend, Instantly or an agent inbox) after the owner approves. Of the 12 outbound writing, sending and guardrail items compared below, 12 passed our security scan; 3 are house items from Avatar 8 LLC and are labeled as such.

Outbound email is the third job in a GTM engineer agent's pipeline (after finding and enriching leads): turn a verified contact list into first lines and sequences, then put approved messages on the wire. It is also where an agent can spam a list, burn a domain, or read the owner's personal mail if the wrong connector is installed.

Item facts below (maker, cost, scan result, commit) come from the library build of 2026-11-05. We have not sent mail through these connectors or measured deliverability, so this is a guide to choosing and limiting them, not a benchmark.

Two jobs: writing and sending

• Writing means ICP-aware first lines, sequences and rewrites. Skills (SKILL.md) are enough.
• Sending means SMTP/API delivery, campaign scheduling and mailbox access. That needs an MCP server or mail API, a key the owner issued, and usually a verified domain.

Most agents need one writing pack and one sender. Mixing five of each is how keys and copy drift.

The tools we have vetted

6 items draft or rewrite copy, 4 can put mail on the wire, and 2 are guardrails that keep the first run from sending. More broadly, 63 catalog items are tagged sales (59 pass) and 84 sit in go-to-market, sales or marketing (80 pass) in the Upskill library.

Six rules for outbound email

1. Draft first, send second

The first outbound run should end in a file. Our house prompt Outbound first run (staging only) pulls ICP contacts, verifies them, finds one verifiable fact each, drafts three touches into a CSV and stops before sending. Disclosure: it is made by Avatar 8 LLC, which runs this site; it went through the same scan and passed.

2. One writing pack, one sender

Start with one skill pack you will actually edit (for example Marketing Skills (Corey Haines) or GTM Engineer Playbook (Othmane Khadri)) and one sending connector. Add Humanizer (anti-AI-slop) only if your drafts read like model output. Do not install every cold-email skill in the library at once (keep-or-remove rules).

3. Scoped keys on a venture-owned mailbox

Prefer a sending domain and API key that belong to the venture, not the owner's personal inbox. Resend MCP server (official) is Resend's official MCP and documents restricting the key to a verified domain. Instantly MCP (community) talks to Instantly's paid campaign API. Agent email inbox (Cooper Email) gives the agent its own address so outreach is not mixed with personal mail. Disclosure: the inbox skill is a house item from Avatar 8 LLC; it passed the same scan.

A public example of the same idea: give each agent a sending-only key so it can send and schedule but cannot change templates or domains (@lettr_com, 2026-10-22).

4. Treat personal Gmail as high-risk

Google Workspace MCP passed our scan and can send through Gmail after OAuth. It also reaches Calendar, Docs and Sheets on the same credential. For cold outbound, that is more access than the job needs. If you must use it, give it the smallest OAuth scopes you can and keep Inbox triage protocol in read-only mode for anything that lands in the inbox.

5. Owner approval for every first send (and for list changes)

Of the 12 items above, 1 need an API key or OAuth, 2 have a free tier, 1 is paid and 8 are free. Keys, domain DNS, paid Instantly seats and any live send should wait for the owner. Our house checklist Credential and entity separation checklist is there so the card, email and account on a send path match the venture.

6. No personal-session LinkedIn as a "send" channel

Do not route "outbound" through the owner's logged-in LinkedIn session. We hold LinkedIn MCP Server (community) at review for policy, not code. In daily vetting since 2026-10-17, 22 of 178 rejections were terms-of-service or platform-policy risk, and 8 rejection notes mention LinkedIn. 18 rejection notes mention Gmail or Google — usually for personal-session or ToS reasons, not because Gmail APIs are banned.

What the scan says, and what it cannot

All 12 of the 12 items above are at pass for the pinned commits shown. Across the full catalog of 113 repos, 42.5% still had at least one medium-or-higher automated finding (research), which is why we pin commits and re-check on upgrade.

A pass does not measure inbox placement, bounce rate, complaint rate or whether your list consented. Those numbers only exist in your own ESP and CRM.

What builders are asking

Of the 198 public posts about skills and MCP servers we collected on 2026-10-25, 2 mention outbound. One open-sourced outbound system runs as "20 Claude Code skills, one orchestrator", with each stage reading the last stage's file (@UdayKang7, 2026-10-14). Another thread argues for per-agent sending-only keys so a mail MCP cannot administer the whole ESP (@lettr_com).

We wrote this because "write and send outbound" is one of the six jobs in our GTM engineer guide, right after lead research and enrichment.

What we have not measured

We have no data on open rate, reply rate, bounce rate, domain reputation or cost per meeting for any of these tools, and we have not sent production mail through them. The table covers maker, connection, cost and scan results only.

Let a coach pick and prune

Agent Coach matches vetted tools to your agent's job, checks in daily on what it used, and says what to keep or remove. It is free. REST and MCP details are in the developer docs. Paste one line into your agent:

Read https://upskill.coach/start and follow it.

Related: CRM access rules, how to vet a skill or MCP server.

FAQ

Should an AI agent send cold email on its own?

No. Writing a draft is fine; putting it on the wire needs the owner's approval. Of the 4 sending connectors compared here, 4 need an API key, OAuth or a paid plan. Our setup tells agents to queue sends for the owner (setup).

What is the safest way for a GTM agent to send email?

Separate writing from sending. Use a free writing skill such as Marketing Skills (Corey Haines) or ColdIQ GTM Skills (Michel Lieben) to draft, run Outbound first run (staging only) so the first pass stops at a CSV, then send only through a scoped key on a venture-owned mailbox such as Resend MCP server (official) or Agent email inbox (Cooper Email) — not the owner's personal Gmail if you can avoid it.

Can the agent use the owner's Gmail?

Google Workspace MCP can reach Gmail after OAuth, and it passed our scan at a pinned commit. That still ties outreach to a personal identity and inbox. Prefer a venture-owned sending domain and a key that can only send, so a buggy prompt cannot read years of personal mail or change domains.

Do outbound writing skills send mail by themselves?

The writing skills in this post (Marketing Skills (Corey Haines), ColdIQ GTM Skills (Michel Lieben), AI Marketing Skills (Eric Siu / Single Grain), GTM Engineer Playbook (Othmane Khadri), Sales Skills (Craig Hewitt), Humanizer (anti-AI-slop)) ship SKILL.md playbooks and templates. They do not include a mail-transport MCP. Sending still needs a separate connector and an approved key.

Is Instantly or Resend better for an agent?

We have no deliverability or reply-rate data. Resend MCP server (official) is Resend's official MCP (free tier) and fits transactional or simple sends from a verified domain. Instantly MCP (community) is a community MCP over Instantly's paid campaign API. Pick the account you already pay for, restrict the key, and measure replies yourself.

Does a passed security scan mean outbound email is compliant?

No. A scan checks the code and instructions at a pinned commit, not CAN-SPAM/GDPR consent, list quality or bounce rates. Compliance and deliverability are the owner's call.

Questions or corrections: ops@avatar33.com.