AgentMailSAFE
Email inboxes for AI agents: send, receive, reply, search, and manage threaded email over MCP.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
AgentMail has one MCP tool implementation, hosted at:
https://mcp.agentmail.to/mcp
Use that Streamable HTTP endpoint directly when your client supports remote MCP. It provides the current runtime tool catalog and supports the hosted server's existing OAuth and per-request API-key paths. See the AgentMail MCP documentation.
stdio compatibility
Existing Node configurations continue to work through the npm bridge:
{
"mcpServers": {
"AgentMail": {
"command": "npx",
"args": ["-y", "agentmail-mcp"],
"env": { "AGENTMAIL_API_KEY": "YOUR_API_KEY" }
}
}
}Python users can run the equivalent native bridge:
AGENTMAIL_API_KEY=YOUR_API_KEY uvx agentmail-mcp
Both bridges discover tools and schemas from the hosted server. They do not contain AgentMail SDK, toolkit, REST API, or tool-definition logic. --tools name1,name2 remains available for stdio clients that need a filtered catalog.
Repository
packages/server: the hosted MCP server and only AgentMail tool implementationpackages/npm-stdio-bridge: npmagentmail-mcppython/stdio-bridge: PyPIagentmail-mcpmcp-manifest.json: generated runtime contracttests: contract and transport checksdocs: architecture, compatibility, migration, release, and operations
pnpm install pnpm build pnpm test pnpm check:contract
The old local npm implementation is preserved at legacy-local-v0.2.2. Authentication hardening is a separate project; this consolidation preserves the hosted server's existing behavior.
0e7e917f8140OBSERVED · 2026-10-07Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp-server --env AGENTMAIL_API_KEY=${AGENTMAIL_API_KEY} --env CLERK_PUBLISHABLE_KEY=${CLERK_PUBLISHABLE_KEY} --env CLERK_SECRET_KEY=${CLERK_SECRET_KEY} --env CONSOLE_JWT_PRIVATE_KEY=${CONSOLE_JWT_PRIVATE_KEY} -- npx -y @agentmail/[email protected]{
"mcpServers": {
"mcp-server": {
"command": "npx",
"args": [
"-y",
"@agentmail/[email protected]"
],
"env": {
"AGENTMAIL_API_KEY": "${AGENTMAIL_API_KEY}",
"CLERK_PUBLISHABLE_KEY": "${CLERK_PUBLISHABLE_KEY}",
"CLERK_SECRET_KEY": "${CLERK_SECRET_KEY}",
"CONSOLE_JWT_PRIVATE_KEY": "${CONSOLE_JWT_PRIVATE_KEY}"
}
}
}
}Exposed tools (3)
3 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
echo | read | Remote echo |
list_organizations | read | |
select_organization | read |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (4 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (6)
fetch(`http://127.0.0.1:${port}/mcp`, {const health = await (await fetch(`http://127.0.0.1:${port}/health`)).json()const res = await fetch(`http://127.0.0.1:${port}/mcp`, {const pingRes = await fetch(`http://127.0.0.1:${port}/mcp`, {const health = await fetch(`http://127.0.0.1:${port}/health`)@types/node, typescript
Gates applied: no_behavioural_pass.
0e7e917f8140full audit observations/trust-audit/mcp-server/agentmail-to__agentmail-1.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-07 | 0e7e917f8140 | SAFE | B | 89 | first audit |
Questions
What is the AgentMail MCP server?
Email inboxes for AI agents: send, receive, reply, search, and manage threaded email over MCP.
What tools does AgentMail expose?
3 in total: 3 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is AgentMail safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does AgentMail need?
It reads AGENTMAIL_API_KEY, CLERK_PUBLISHABLE_KEY, CLERK_SECRET_KEY and CONSOLE_JWT_PRIVATE_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does AgentMail run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @agentmail/mcp-server at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (0e7e917f8140), read on 2026-10-07. The repository is watched and re-audited when it changes.