Hand your marketing to an agent, safely

Marketing is the rare job an agent can own end to end, because the loop is closed: ideas become posts, posts produce numbers, numbers produce better ideas. What has been missing is not agent capability but a safe surface to act on: one where the worst case is bounded in dollars and nothing irreversible happens without a human.

marketer.sh is built as that surface. Every action an agent can take runs through the same caps, approval gates, and audit log as the dashboard. The rest of this guide is the order to turn things on.

Any MCP-capable agent, Claude Code among them, connects through marketer-mcp. Add it to your agent's MCP configuration with uvx marketer-mcp as the command and a token in MARKETER_PAT, then restart the agent. It discovers tools like generate_article, enqueue_job, and today_spend on its own.

One design detail matters more than it looks: tool descriptions state costs. An agent reading enqueue_job learns what a video will draw from the balance before it calls anything, so a well-behaved model checks today_spend and estimates before it spends. You will see this in transcripts: agents narrate the budget without being asked, because the tools taught them to.

Create the agent's token in Settings → Access tokens. Tokens are prefixed mkt_, shown once, and hashed at rest. Treat each agent as a separate employee:

• One token per agent. When a token leaks or an experiment goes sideways, you revoke one agent, not your whole automation setup.
• Name tokens for their job. “claude-articles-prod” tells future-you what breaks when it is revoked.
• Keep tokens out of prompts and repos. Pass them through the MCP config's environment, a secret manager, or CI secrets, never inline.

The per-niche daily cap and the global cap are what make agent autonomy boring, in the good sense. Every call the agent makes is pre-checked against both; a job that would cross either is refused before any money moves. The agent gets a clean, machine-readable refusal it can plan around, and your worst day is arithmetic: caps times days, no matter what the agent decides.

Caps bound spending; approval gates bound publishing. With review-before-post on, an agent can research, ideate, and produce all day, and everything it makes stops in a queue for you. This split is the core safety property: the agent controls work, you control the world. Reversible actions are cheap, so let the agent have them. Publishing is the irreversible one, so it waits for a human until the track record says otherwise.

Autonomy should be earned per niche and per format, on evidence you can point to. A reasonable bar: two weeks of transcripts with no surprising tool calls, an approval rate above 90 percent, and zero cap refusals you did not expect. Then widen one notch at a time, let video publish on schedule but keep articles gated, or raise the cap before you drop the gate, never both in the same week.

And keep the exits cheap: every gate you open can be closed in one click, tokens revoke instantly, and the audit log records what the agent did while you were not looking. Trust it the way you trust a new hire: incrementally, with the logs open.