What Can a Lemlist AI Agent Change? A 54-Action Audit

A Lemlist-connected AI agent can do much more than read campaign performance. In a bounded review of Aident Loadout's staging catalog on September 10, 2026, the current Lemlist integration contract contained 54 public Actions: 30 had read-oriented names such as get, list, or search, while 24 had names that clearly create, update, pause, mark, or delete data.

The important result is not the 30-to-24 split. It is that names alone are not a permission system. Two read-named Actions exposed side-effect-sensitive behavior, and all 54 Actions shared the same coarse write operation classification in the reviewed wrapper metadata. A safe agent policy must therefore allow specific Actions and inputs, not the whole integration.

For an initial audit, start with only two jobs:

1. list at most five campaigns to let a human choose the correct campaign; and

2. read that campaign's statistics for one explicit date range.

Do not authorize lead creation, campaign changes, exports, message retrieval, or outreach merely because the account connection works.

The Audit Result

This count came from the exact Action enum behind the current public campaign-list contract, cross-checked against an integration-scoped capability search. The method classifies names, not actual HTTP verbs or business consequences. That distinction matters.

Two read-named operations deserve extra scrutiny

The schema exposed lemlist_get_campaign_export_start, whose description says it starts an asynchronous campaign export. Starting an export is not equivalent to reading one small campaign record. It can prepare a larger data set and create a result that must be polled and handled securely.

The current contact-message retrieval schema also accepts markAsRead. A retrieval request with that flag enabled can alter message state even though the Action name begins with get.

Those examples make a durable rule visible: classify the exact input and consequence, not just the verb embedded in the Action name.

What the 54 Actions Cover

The reviewed surface spans several responsibility levels.

Campaign discovery and analysis

Read-named Actions can list campaigns, retrieve one campaign, inspect sequences, return campaign statistics, list team senders, and retrieve activity. These are the best candidates for a narrow analyst role, but their results can still contain customer, sender, campaign, or performance data.

Lead, contact, and company data

The catalog includes lead lookup, people and company search, unsubscribe data, contact messages, company notes, and exports. These operations can expose personal or commercially sensitive data. A request that is technically read-only may still exceed the user's intended data scope.

Campaign and sequence changes

Write-named Actions can create and pause campaigns, update campaign settings, add or modify sequence steps, associate schedules, and create or change schedules. These can affect who receives outreach, when it runs, and which content is sent.

Lead and task changes

Other write-named Actions can create leads, add variables, change interest state, pause leads, update tasks, ignore tasks, and add unsubscribe entries. Each consequence deserves its own approval boundary. Permission to inspect a campaign does not imply permission to enroll a person or alter their status.

Build a Permission Ladder, Not One Broad Connection

Use a small role ladder that maps to actual jobs.

This ladder separates authentication from authorization. A connected Lemlist account proves that a credential is available. It does not prove that the agent may inspect every campaign, retrieve contact messages, export leads, or change outreach.

A Safe First Test in Aident Loadout

Begin with the installed public CLI and current connection state:

aident account auth status
aident vault status --integrationId "composio:lemlist_tools"

Search the staging catalog by the job rather than guessing an Action name:

aident capabilities search \
  --query "Lemlist list campaigns read only" \
  --types '["action"]' \
  --scope '{"integrationId":"lemlist_tools"}' \
  --targetEnv staging

Copy the exact public name from the result, then inspect the current schema:

aident capabilities get \
  --name "composio:lemlist_tools:lemlist_get_list_campaigns"

The reviewed September 10 input supports a maximum limit of 100 plus status, page or offset, and creation-time sorting. The first request should be smaller:

aident capabilities preflight \
  --name "composio:lemlist_tools:lemlist_get_list_campaigns" \
  --input '{"limit":5,"sortBy":"createdAt","sortOrder":"desc"}'

That exact input passed a free Aident preflight during this audit. It was not executed because the reviewed Vault had no connected Lemlist account. A valid schema and zero-dollar quote do not prove account access, output quality, provider quota, or permission to read real campaign data.

After a human selects the correct campaign ID, inspect the current campaign-stats schema and preflight one bounded date range. The reviewed contract required campaignId, startDate, and endDate, with optional channel, sender, and A/B selection filters.

aident capabilities get \
  --name "composio:lemlist_tools:lemlist_get_campaign_stats"

aident capabilities preflight \
  --name "composio:lemlist_tools:lemlist_get_campaign_stats" \
  --input '{
    "campaignId":"<APPROVED_CAMPAIGN_ID>",
    "startDate":"2026-08-12",
    "endDate":"2026-09-08"
  }'

The placeholder input passed schema validation and returned a free Aident quote. Replace it only after the campaign and dates are approved. Re-run preflight if any field changes.

What Changes With Lemlist's Direct MCP Server

Lemlist also offers an official remote MCP server at https://app.lemlist.com/mcp. Its current setup guide documents OAuth for Codex:

codex mcp add lemlist --url https://app.lemlist.com/mcp
codex mcp login lemlist

The direct route is attractive when Lemlist is the whole job. Lemlist owns the server, OAuth flow, provider vocabulary, and tool updates. That removes an intermediate capability layer.

It does not remove the need for a permission policy. The official documentation says the server can manage campaigns, search leads, and analyze performance. After connecting, inspect the tools actually exposed to the client and establish the same reader-versus-operator boundary. Client confirmation prompts are useful supervision, but they should not substitute for a durable allowlist and an explicit data scope.

Use Aident Loadout when Lemlist is one step in a broader workflow, such as reading campaign statistics, joining them to CRM or product data, and preparing a reviewed workspace summary. Loadout gives the agent one discovery, Vault, preflight, and Audit pattern across those services. The advantage is consistent control across integrations, not automatic authorization for every Action.

A Five-Part Approval Record

Before any provider execution, record:

1. Identity: which Lemlist workspace and account are in scope;

2. Action: the exact current public Action name or MCP tool;

3. Input: campaign, lead, dates, limits, filters, and sensitive fields;

4. Consequence: what can be read, exported, created, updated, paused, or deleted; and

5. Read-back: the smallest returned state that proves the request stayed inside scope.

For a write, add an idempotency or duplicate-prevention plan when the provider contract supports it. Then require a fresh read-back before authorizing another consequence. A successful campaign update does not grant a standing right to modify the sequence, schedule, leads, or messages.

Common Permission Mistakes

Treating a connected integration as a role

The connection is a credential boundary, not a job description. Define whether this agent is a reader, analyst, or operator before its first call.

Approving all get Actions

Read-named operations can start exports, toggle read state through inputs, or return sensitive data. Review each schema and payload.

Using a free quote as a safety verdict

The two reviewed preflights returned $0.00 in Aident cost. Free Actions can still expose data or change provider state. Cost approval and consequence approval are separate.

Letting a read silently become outreach

An analysis may recommend pausing a campaign or adding a lead. Return that recommendation for review. Do not let the same autonomous step cross from evidence into outreach.

Keeping an old allowlist after the catalog changes

Action names, schemas, and provider behavior can change. Rediscover the current contract, diff it against the approved policy, and stop when a new or changed Action lacks a decision.

Use the Audit as a Repeatable Control

Repeat this audit when Lemlist changes its MCP tools or API contract, when Aident changes the Lemlist Action version or risk metadata, or when the agent's role expands. Store the approved Action names and input ceilings in the workflow's control document, not in an informal prompt.

The September 10 result is a contract audit, not a security certification or a live-account performance test. It did not execute a Lemlist Action, inspect private campaigns, compare latency, verify provider-side API quotas, or test every direct MCP tool. Its useful conclusion is narrower: the current surface is broad enough that connection-level permission is insufficient, and method names alone do not reliably describe consequences.

Inspect One Lemlist Reader Before Connecting the Rest

Follow https://aident.ai/SETUP.md

Set up Aident Loadout and inspect one Lemlist reader

Use the risk-versus-spend approval workflow to keep a free but consequential Action gated. Review Aident Loadout credits, BYOK, and Action pricing before any paid step. For the general connection and execution loop, continue with How to Use Aident Loadout.

Sources

• Lemlist MCP setup for Codex and other clients, reviewed September 10, 2026.

• Lemlist API authentication, reviewed September 10, 2026.

• Lemlist API versions, reviewed September 10, 2026.

• Find and use the Lemlist API, reviewed September 10, 2026.

• Lemlist for Aident Loadout, reviewed September 10, 2026.

• Aident Loadout setup, reviewed September 10, 2026.

• Live Aident Loadout staging capability catalog, exact public Action schema, and two exact-free preflights, inspected September 10, 2026.

Refresh this audit when Lemlist changes its remote MCP server, authentication, API versions, or provider tools, or when Aident changes the Lemlist Action set, schemas, operation metadata, connection flow, pricing, or approval behavior.