[Feat] Add Resend MCP integration with safer tool defaults

[roomote-roomote]

Created by Roomote. Follow up by mentioning @roomote, in the web UI, or in Slack.

What changed

• Added Resend as a deployment-scoped built-in integration backed by Resend's hosted MCP server and OAuth full_access flow.
• Added reusable first-enable tool defaults and configured Resend to start with direct sends, scheduled-send changes, API-key creation/removal, automation mutation and event-trigger paths, contact/contact-property mutations, domain updates/removals, and webhook creation/updates disabled. Admin choices remain intact across reconnects and disable/re-enable cycles.
• Added Resend to integration discovery, setup recommendations, Slack and web setup copy, branding, and public documentation.

Why this change was made

Teams can now bring shared Resend email infrastructure into Roomote tasks without exposing outbound delivery, credential-creation, automation-trigger, or contact-mutation paths by default. Administrators can explicitly opt in to individual tools through the existing Manage tools flow.

Impact

Deployment admins can connect Resend once for the workspace, while tasks initially receive inspection-oriented access and the existing server-side proxy rejects 23 sensitive tools by default. The integration uses Resend's advertised dynamic OAuth registration; rollout should confirm the hosted service accepts the deployment callback before broad enablement.

[roomote-roomote]

1 issue outstanding. See task

• packages/types/src/mcp-oauth.ts:280-292 The defaults leave create-automation, update-automation, and send-event enabled. A task can create or enable an automation with send_email or contact-mutation steps and trigger it with an event, bypassing the advertised safe defaults. Disable or otherwise constrain these paths by default.
• packages/types/src/mcp-oauth.ts:280-295 create-api-key is still enabled by the default policy. Resend returns the newly minted sending_access or full_access bearer token to the task, which can then call Resend directly and bypass Roomote's proxy filter. Disable it by default.
• packages/types/src/mcp-oauth.ts:280-295 create-contact-property, update-contact-property, and remove-contact-property remain enabled. In particular, removing a property deletes it from every contact, so the deployment still permits contact mutation despite the advertised default. Add these tool names to the disabled defaults.
• packages/types/src/mcp-oauth.ts:280-298 The inspection-oriented default still leaves destructive Resend infrastructure tools enabled, including remove-api-key, update-domain, remove-domain, create-webhook, and update-webhook. A task can revoke a production credential, change delivery capabilities, or route account events to an arbitrary endpoint despite the advertised safe defaults. Default-deny non-read tools (or add all these mutators to the disabled list).
• packages/types/src/mcp-oauth.ts:282-306 The deny-list is still incomplete: getAllowedIntegrationMcpToolNames() has no Resend policy, so the proxy permits every upstream mutator omitted here. remove-automation, action-bearing manage-events, template and broadcast create/update/remove tools, create/remove-segment, suppression and topic mutations, remove-webhook, and domain creation/verification/claim tools can still change delivery, subscription, and infrastructure state despite the inspection-oriented default. Use an allow-list of Resend read tools, or default-disable every non-read tool.

_{Reviewed 603e2f5}

[roomote-roomote]

Fixed the Resend permission bypasses through 44a970d4.

The original create-automation, update-automation, and send-event finding is resolved. The follow-up review also identified adjacent escapes, so create-api-key plus the three contact-property mutation tools now start disabled as well. Resend now defaults 18 sensitive tools off, with exact-list tests and updated setup/docs/UI copy. The PR description and screenshot reflect the final safety posture. There are no line-level review threads to resolve; the top-level review summary is re-evaluating the pushed commit.