Your AI assistant just got a Send button. Check whether it is on before you ask it anything about a campaign.
Klaviyo’s remote MCP server, you know, the bridge that lets Claude, ChatGPT, or Cursor talk to your account at https://mcp.klaviyo.com/mcp, now documents tools that do more than draft. In the official available-tools table, campaigns include send_campaign (“Send a campaign to its configured audience”) and cancel_campaign_send. The same remote surface also exposes subscribe and unsubscribe for marketing, profile create/update, and flow create/update. That is not “help me write a subject line.” That is “blast the list” if the agent calls the tool.
Only Owner, Admin, or Manager roles can connect. On a custom connector, query flags decide how dangerous the session is. read-only=true disables any tool that can write to the account. disable-tools-with-user-generated-content=true turns off tools that read profile fields, events, and reviews into the model — the exact places a malicious instruction can hide. Defaults for both flags are false. The listed Claude connector and the listed ChatGPT app cannot set those parameters; you need a custom connector (or Cursor/VS Code URL config) for that control.
Why this matters for an EU SMB or solo operator: the story is not “AI writes better subject lines.” It is prompt injection into an agent that can hit Send. A nasty review, profile property, or event payload can land in context; if write tools are enabled, the model may act on it, like send a campaign, flip a subscription, or rewrite profile data. That is a GDPR-shaped failure mode (unintended processing, possible unlawful messaging), not a creative upgrade.
ChatGPT’s listed Klaviyo app stays read-heavy by design: Klaviyo’s own help page says it cannot send campaigns, build or edit flows, or modify segments or lists. Custom MCP against the remote endpoint is the loaded gun. If Claude or Cursor is already connected, open the tools list and look for send_campaign before you assume you are only drafting.
What to do this week: open the custom connector (or Cursor MCP config). If you only need reports and drafts, point it at a URL like https://mcp.klaviyo.com/mcp?read-only=true&disable-tools-with-user-generated-content=true. Default to read-only unless you deliberately meant an agent to blast a list — and still review every write tool call before you approve it.