AgentMail MCP Server: Tools, Setup and Security

The AgentMail MCP server lets an AI agent create and use its own email inboxes. It can send, reply to and forward messages, manage drafts and threads, read attachments and handle calendar events. AgentMail publishes and hosts it at one remote URL, with small stdio bridges for clients that need a local process.

Checked against: AgentMail MCP documentation on 28 October 2026. eSEOspace did not install or test this server.

At a glance

What it can do

AgentMail's MCP page lists these tools:

• Inboxes: list_inboxes, search_inboxes, get_inbox, create_inbox, update_inbox, delete_inbox, authorize_inbox.
• Threads: list_threads, search_threads, get_thread, update_thread, delete_thread.
• Messages: list_messages, search_messages, get_message, update_message, send_message, reply_to_message, forward_message.
• Drafts: create_draft, list_drafts, get_draft, update_draft, send_draft, delete_draft. Deleting a draft also cancels a scheduled send.
• Attachments: get_attachment.
• Calendar: get_agenda, get_event, create_event, update_event, delete_event, respond_to_invitation, get_calendar, update_calendar.
• Allow and block lists: list_list_entries, get_list_entry, create_list_entry, delete_list_entry.
• Agent sign-up and apps: agent_attach_human, agent_verify, list_apps, search_apps, get_app, connect_app, list_accounts.
• Labs: get_labs, join_labs.
• Organizations (OAuth only): list_organizations, select_organization.

The use case is different from a mailbox connector. You might give a support or scheduling agent its own address, so it can email vendors or confirm bookings without touching anyone's personal inbox.

How to connect it

For Claude Code, AgentMail's command is:

claude mcp add --transport http agentmail https://mcp.agentmail.to/mcp

AgentMail recommends OAuth for Claude Desktop, Claude.ai and ChatGPT. You sign in at console.agentmail.to and no API key is needed.

For Cursor, Windsurf (now Devin Desktop) and similar clients, use an API key in a header:

{
  "agentmail": {
    "url": "https://mcp.agentmail.to/mcp",
    "headers": {
      "x-api-key": "${AGENTMAIL_API_KEY}"
    }
  }
}

For clients that only run local processes, the GitHub README gives an npx bridge:

{
  "mcpServers": {
    "AgentMail": {
      "command": "npx",
      "args": ["-y", "agentmail-mcp"],
      "env": { "AGENTMAIL_API_KEY": "YOUR_API_KEY" }
    }
  }
}

The README says the bridges discover tools from the hosted server, and --tools name1,name2 filters the catalog for stdio clients.

Security notes

An agent with its own inbox can still send email to anyone. Inbound mail is also untrusted, because any outside sender can write to that address. That is a direct path for prompt injection through tool results.

Points from AgentMail's docs:

• Keys out of URLs. AgentMail warns that "query-string keys end up in logs and history." Use the header. See MCP secret leakage.
• Confirmation depends on the client. AgentMail notes that ChatGPT asks you to confirm write actions, such as sending mail, before they run.
• Inbox authorization tokens. For authorize_inbox, AgentMail says to take the token only from a sign-in page your human or your own browser opened, "never from an email or a message." Tokens are single-use and expire within minutes.
• AgentID links. Sign-in links are single-use and expire after five minutes.

The MCP tools specification says clients should prompt for confirmation on sensitive operations. Our suggestions: keep approval on for every send and delete tool, and use --tools on stdio bridges to drop tools you do not need. More in our MCP security center.

Alternatives

• Gmail MCP server, if you want an AI to draft from your own Gmail inbox.
• Outlook (Microsoft 365 Mail) MCP server, for Microsoft 365 mailboxes.
• Resend MCP server, which also manages inboxes alongside sending infrastructure.

Next step

If you are building an agent that needs to email customers or vendors, decide early whether it should have its own address. eSEOspace can help design that through our MCP development service. More profiles are in our MCP server directory.

Frequently asked questions