Klaviyo’s K:BOS 2026 message introducing Klaviyo headless, is easy to misread as “we shipped a chatbot.” The Community write-up is clearer: more of Klaviyo’s data and supported actions can be called from Claude, ChatGPT or a custom agent through MCP and APIs (they cite 400+ tools alongside nearly 500 APIs). You can ask for campaign or flow performance, draft a brief, or take a supported action without living inside the Klaviyo UI. Owner, Admin or Manager is required for remote MCP.

That is useful for Spanish agencies and EU email operators who already live in Claude or ChatGPT. It is also a permissions problem dressed as a productivity launch.

The real story is scopes. Remote MCP defaults are write-capable unless you change them. Klaviyo’s developer docs document query flags on https://mcp.klaviyo.com/mcp: read-only=true turns off write tools; disable-tools-with-user-generated-content=true reduces tools that pull freeform profile/event/review text into the model; core-tools-only=true shrinks the tool surface; toolsets can limit by API scope. The listed Claude connector and listed ChatGPT app cannot set those flags. You need a custom connector (or Cursor/VS Code URL config) for that control. Read-only stops sends and edits. It does not automatically hide profile data. If you need “lists only, no profiles,” use narrower scopes or a local MCP with a private key limited to those scopes.

Write tools are not theoretical. The remote tools table includes send_campaign, subscribe/unsubscribe, profile writes and flow create/update. Treat anything that can hit Send as a deliberate enable, not a default. Composer’s path is different: supported edits still go through human review before going live, per the Community post. MCP write access is the sharper edge.

Two privacy checks before you flip it on for an EU client:

  1. DPA and subprocessor list. Connecting Claude or ChatGPT means another processor path for marketing data. Update the DPA pack and tell the client which AI workspace is attached.
  2. ChatGPT training setting. On Free/Plus (and related consumer plans), OpenAI may use connected-app data to train models if “Improve the model for everyone” is on. Business/Enterprise/Edu default off. Check per client; do not assume.

Compliance Hub is “coming soon” in the K:BOS list. Do not wait for a dashboard to set least privilege.

Composer credit packaging is still moving in public docs, so do not hard-code a euro cost into a workflow yet. Ask what a recurring agent task will burn before you automate weekly audits.

What to do this week: connect one account with read-only=true (and UGC-disable if you can); name the connector by client; review the tool list for send_campaign; update DPA/subprocessors; confirm ChatGPT training is off for any client data. Headless Klaviyo can save UI time. Unscoped write access is the footgun.