inboxy

inboxy — remote MCP server

Endpoint: https://mcp.inboxy.net · Transport: Streamable HTTP · Registry: net.inboxy/inboxy

inboxy is a privacy-first email aliasing service with an AI-readable inbox. This server exposes your @inboxy.net mail, RSS feeds, and aliases to any client that speaks the Model Context Protocol, so an assistant can read, search, summarise, and reply to your mail without ever touching your real mailbox.

This repository is documentation. The server is hosted — there is nothing here to install, build, or run, and no npm package to pull. It exists so the registry listing has a home and so the connection details are versioned somewhere public. The implementation is closed-source.

Connecting

Most clients need only the URL. The server speaks OAuth 2.1 with Dynamic Client Registration and PKCE, so interactive clients need no API key:

{
  "mcpServers": {
    "inboxy": {
      "url": "https://mcp.inboxy.net"
    }
  }
}

Claude Desktop: Settings → Developer → Edit Config, paste the above, restart, and sign in when redirected. Claude Code and other MCP clients take the same URL and run the OAuth flow themselves.

Unattended agents (OpenClaw, Hermes, Codex, CI) use a static bearer key instead, minted under Account → API keys:

Authorization: Bearer ik_…

Keys can be address-scoped to a single alias. A scoped key sees only that alias's mail, has its outbound From: pinned to it server-side, and is refused for account-wide operations — so a leaked key exposes one alias, not the account.

Full setup, including the per-client config quirks that bite (OpenClaw's --header uses Name=Value, Hermes' YAML uses Name: Value), is at https://inboxy.net/help/connect-mcp.

What an agent can do

48 tools as of v1.0.0, across eight groups, named <group>_<action> so clients render them under a common heading:

Group	Covers
mail_*	List, read, search, render, keep, delete, and send mail
outbox_*	Inspect what the agent has sent
feed_*	RSS subscriptions
article_*	Articles within those feeds
address_*	Mint and retire @inboxy.net aliases
account_*	Plan, quota, rate limits, retention
digest_*	Scheduled digest settings
mark_*	Cross-domain bulk read-state

Every tool declares an MCP behavioural annotation — read-only, idempotent, or destructive — so clients can gate the destructive ones behind confirmation.

The canonical, always-current tool reference is https://inboxy.net/help/connect-mcp — deliberately not duplicated here, so it cannot drift.

What an agent can send

inboxy gives your AI an inbox, not your Gmail. Every outbound path is scoped server-side, so a leaked credential cannot become a spam cannon:

Tool	Recipient rule	Cap
mail_reply	Locked to the original sender of the message being replied to	5/hour
mail_forward	Locked to your own verified personal email	Idempotent
mail_send	Any recipient, minus self-loops and reserved local-parts	Debits per-user send quota
mail_invite	Any external address that isn't already an inboxy user	10 per rolling 30 days

No surface anywhere accepts a caller-supplied From:. Mail is always sent from one of your own aliases, never from your real address.

@inboxy.net → @inboxy.net mail is delivered in-network with no SMTP egress. Anything leaving the network carries a one-line — inboxy.net — agentic email attribution footer, injected at a single point so every send path behaves identically.

Privacy

• EU data residency. Storage and compute are pinned to Cloudflare's eu jurisdiction.
• Scoped embeddings. Semantic search runs on per-user vectors.
• 90-day default retention on message bodies; pinned messages are exempt.
• Short-lived tokens. Refresh tokens rotate per OAuth 2.1 §4.3.1.
• Revoke an OAuth grant under Account → MCP / OAuth clients, or a key under Account → API keys. Revocation takes effect on the next request.

Privacy policy · Terms

Registry manifest

server.json is the manifest published to the official MCP registry under net.inboxy/inboxy. Its version tracks the version this server announces to clients on initialize.

Support

[email protected] · Security disclosures: [email protected] (security.txt)

License

The contents of this repository are licensed Apache-2.0. See LICENSE.