The full upstream README, mirrored here for reference. Install config, tool schemas, adoption signals, and an original overview live on the Inboxy listing page.
Endpoint: https://mcp.inboxy.net · Transport: Streamable HTTP · Registry: net.inboxy/inboxy
inboxy is a privacy-first email aliasing service with an
AI-readable inbox. This server exposes your @inboxy.net mail, RSS feeds, and
aliases to any client that speaks the Model Context Protocol,
so an assistant can read, search, summarise, and reply to your mail without
ever touching your real mailbox.
This repository is documentation. The server is hosted — there is nothing here to install, build, or run, and no npm package to pull. It exists so the registry listing has a home and so the connection details are versioned somewhere public. The implementation is closed-source.
Most clients need only the URL. The server speaks OAuth 2.1 with Dynamic Client Registration and PKCE, so interactive clients need no API key:
Claude Desktop: Settings → Developer → Edit Config, paste the above, restart, and sign in when redirected. Claude Code and other MCP clients take the same URL and run the OAuth flow themselves.
Unattended agents (OpenClaw, Hermes, Codex, CI) use a static bearer key instead, minted under Account → API keys:
Keys can be address-scoped to a single alias. A scoped key sees only that
alias's mail, has its outbound From: pinned to it server-side, and is refused
for account-wide operations — so a leaked key exposes one alias, not the
account.
Full setup, including the per-client config quirks that bite (OpenClaw's
--header uses Name=Value, Hermes' YAML uses Name: Value), is at
https://inboxy.net/help/connect-mcp.
48 tools as of v1.0.0, across eight groups, named <group>_<action> so
clients render them under a common heading:
| Group | Covers |
|---|---|
mail_* | List, read, search, render, keep, delete, and send mail |
outbox_* | Inspect what the agent has sent |
feed_* | RSS subscriptions |
article_* | Articles within those feeds |
address_* | Mint and retire @inboxy.net aliases |
account_* | Plan, quota, rate limits, retention |
digest_* | Scheduled digest settings |
mark_* | Cross-domain bulk read-state |
Every tool declares an MCP behavioural annotation — read-only, idempotent, or destructive — so clients can gate the destructive ones behind confirmation.
The canonical, always-current tool reference is https://inboxy.net/help/connect-mcp — deliberately not duplicated here, so it cannot drift.
inboxy gives your AI an inbox, not your Gmail. Every outbound path is scoped server-side, so a leaked credential cannot become a spam cannon:
| Tool | Recipient rule | Cap |
|---|---|---|
mail_reply | Locked to the original sender of the message being replied to | 5/hour |
mail_forward | Locked to your own verified personal email | Idempotent |
mail_send | Any recipient, minus self-loops and reserved local-parts | Debits per-user send quota |
mail_invite | Any external address that isn't already an inboxy user | 10 per rolling 30 days |
No surface anywhere accepts a caller-supplied From:. Mail is always sent from
one of your own aliases, never from your real address.
@inboxy.net → @inboxy.net mail is delivered in-network with no SMTP egress.
Anything leaving the network carries a one-line — inboxy.net — agentic email
attribution footer, injected at a single point so every send path behaves
identically.
eu
jurisdiction.server.json is the manifest published to the official MCP
registry under net.inboxy/inboxy. Its version tracks the version this
server announces to clients on initialize.
hello@inboxy.net · Security disclosures: security@inboxy.net
(security.txt)
The contents of this repository are licensed Apache-2.0. See LICENSE.