hey v1.11.0

Install

macOS:

brew install --cask basecamp/tap/hey
hey auth login

Omarchy:

omarchy-mise-install github:basecamp/hey-cli hey
hey auth login

Arch Linux / other Linux (mise):

mise use -g github:basecamp/hey-cli
hey auth login

Other platforms: download the matching archive from the assets below.

Highlights

Breaking: hey mcp now has its own sign-in — run hey auth login --mcp once, then restart your MCP client. It asks for read/write/send. Sending through hey mcp is now available: turn on Send when you sign in with hey auth login --mcp. Signed in already? Run hey auth login --mcp again to add Send.

Until you sign in, hey mcp exits with Run: hey auth login --mcp, even when the CLI itself is signed in or HEY_TOKEN is set. The hey commands and their own sign-in are unchanged.

• What the new sign-in can reach. It signs in as "HEY MCP (local)", its own entry in HEY's Connected Apps, which you can revoke without signing the CLI out. It never gets full access: only what read and write cover, so no settings, forwarding, trash or HEY World. When you connect it, HEY lets you choose which accounts it reaches; if hey is set to use one you didn't choose, hey mcp now names that account and says how to fix it (#619).
• Sending needs your confirmation. With Send turned on, hey mcp sends a draft only after you confirm that exact email in your MCP client. A client that can't ask you gets a draft and its link in HEY instead. Without Send, hey mcp doesn't offer sending, and says so when it starts.
• Draft links. Every draft save (hey compose --draft, hey reply --draft, hey draft edit, and hey mcp's draft tools) answers with the draft's page in HEY, and hey draft show names it too (#614).
• Draft, review, send. The agent guidance now teaches saving a draft, showing it to you, revising it as you ask, and sending only when you say so, as the default way to write mail for you (#615).

Fixes

• Bcc privacy. When hey reply or the TUI composer works out recipients locally (HEY's prefill unavailable), a reply no longer carries the original's Bcc, so a follow-up can't silently reach someone who was blind copied. Bcc is kept only when nobody else is left to address (#609).
• Security: golang.org/x/net bumped to v0.62.0 for GO-2026-6866 and GO-2026-6860 (#606).

What's Changed

Authentication

• Give hey mcp its own sign-in, and send a draft only on the person's confirmation by @jeremy in #598

TUI

• Select threads with x as well as space by @jwahdatehagh in #359
• A local reply leaves out the people the answered message blind copied by @jeremy in #609

CLI

• Add hey thread comment for private thread notes by @jeissonneira in #383
• Answer every draft save with the draft's page in HEY by @jeremy in #614
• Teach draft, review, send as the default path for mail by @jeremy in #615
• Say which account hey mcp's sign-in wasn't given, and how to reach it by @jeremy in #619

Dependencies

• Bump hey-sdk to v0.34.0 by @jeremy in #602
• Bump golang.org/x/net to v0.62.0 for GO-2026-6866 and GO-2026-6860 by @jeremy in #606
• deps: bump charm.land/bubbletea/v2 from 2.1.0 to 2.1.1 by @dependabot[bot] in #610

Other Changes

• Render nested Action Text attachment content by @nitrnitr in #335
• Pin every hey mcp parameter to the request HEY gets by @jeremy in #618

New Contributors

• @jwahdatehagh made their first contribution in #359
• @jeissonneira made their first contribution in #383
• @nitrnitr made their first contribution in #335

Full Changelog: v1.10.1...v1.11.0