Atlas / MCP servers / keyid-ai / Agent Kit

Agent KitSAFE

Name: Agent Kit
Author: keyid-ai

mcp/keyid-ai/agent-kit

MCP server by keyid-ai · agent · ai agent · claude · Audited 2026-09-28

⚑ Report / re-scan Source ↗

Give Claude/Cursor email powers. 27 MCP tools — inbox, send, reply, contacts, search. Free, no signup.

Verdict

SAFE

Grade

Trust score

89 /100

Exposed tools

26 15r · 9w · 2d

Transport

—

License

—

Stars

661

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Give Claude, Cursor, or any MCP client a real email address. Free. No signup.

27 email tools via Model Context Protocol (MCP): send, receive, reply, search inbox, manage contacts, set auto-reply, schedule delivery — everything an AI agent needs to handle email autonomously.

Install

npm install @keyid/agent-kit
# or
yarn add @keyid/agent-kit

Usage

With Claude Desktop

Add to claude_desktop_config.json:

{
"mcpServers": {
"keyid": {
"command": "npx",
"args": ["@keyid/agent-kit"],
"env": {
"KEYID_PUBLIC_KEY": "...hex...",
"KEYID_PRIVATE_KEY": "...hex..."
}
}
}
}

With any MCP client

# Run directly
npx @keyid/agent-kit

# Or with existing keypair
KEYID_PUBLIC_KEY=abc123 KEYID_PRIVATE_KEY=def456 npx @keyid/agent-kit

Environment Variables

Tools (27)

Identity & Auth

Messages

Threads & Drafts

Read from source at commit 7e8a1191580fOBSERVED · 2026-09-28

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add agent-kit --env KEYID_BASE_URL=${KEYID_BASE_URL} --env KEYID_PRIVATE_KEY=${KEYID_PRIVATE_KEY} --env KEYID_PUBLIC_KEY=${KEYID_PUBLIC_KEY} -- npx -y @keyid/[email protected]

claude-desktop

{
  "mcpServers": {
    "agent-kit": {
      "command": "npx",
      "args": [
        "-y",
        "@keyid/[email protected]"
      ],
      "env": {
        "KEYID_BASE_URL": "${KEYID_BASE_URL}",
        "KEYID_PRIVATE_KEY": "${KEYID_PRIVATE_KEY}",
        "KEYID_PUBLIC_KEY": "${KEYID_PUBLIC_KEY}"
      }
    }
  }
}

Exposed tools (26)

15 read · 9 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`keyid_create_contact`	write	Create a new contact.
`keyid_create_draft`	write	Create a draft email for later editing and sending.
`keyid_create_webhook`	write	Create a webhook to receive event notifications.
`keyid_delete_contact`	destructive	Delete a contact.
`keyid_forward`	read	Forward a message to another recipient.
`keyid_get_auto_reply`	read	Get current auto-reply (vacation responder) settings.
`keyid_get_email`	read	Get the current active email address assigned to this agent.
`keyid_get_forwarding`	read	Get email forwarding settings.
`keyid_get_inbox`	read	Fetch inbox messages. Returns messages across all current and historical email addresses. Supports full-text search.
`keyid_get_metrics`	read	Get email metrics with time-series aggregation.
`keyid_get_signature`	read	Get the email signature for this agent.
`keyid_get_thread`	read	Get a thread with all its messages.
`keyid_get_unread_count`	read	Get the count of unread messages in the inbox.
`keyid_get_webhook_deliveries`	read	Get webhook delivery history with status and retry info.
`keyid_list_contacts`	read	List saved contacts.
`keyid_list_threads`	read	List conversation threads with filtering and pagination.
`keyid_list_webhooks`	read	List all configured webhooks.
`keyid_manage_list`	destructive	Add or remove entries from allowlist/blocklist for inbound/outbound filtering.
`keyid_provision`	read	Register this agent with KeyID and get an email address. Call this first before using other KeyID tools.
`keyid_reply`	read	Reply to a message. Automatically sets subject, thread, and in-reply-to headers.
`keyid_send`	write	Send an email from this agent. Supports HTML, CC, BCC, attachments, display name, and scheduled delivery.
`keyid_send_draft`	write	Send a previously created draft.
`keyid_set_auto_reply`	write	Configure auto-reply (vacation responder). Set enabled=false to disable.
`keyid_set_forwarding`	write	Configure email forwarding to another address.
`keyid_set_signature`	write	Set the email signature for this agent.
`keyid_update_message`	write	Update message flags (read/starred status).

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (1 observation(s))
Network: declared (1 observation(s))
Shell: none-observed
Dependencies: pinned
Secrets in source: none-found

Findings (3)

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

keyid_delete_contact, keyid_manage_list

Why it matters. 2 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.no_license · CWE-1104

Why it matters. no LICENSE file and no repo licence

Fix. add a licence

LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427

README.md:7

Powered by [KeyID.ai](https://keyid.ai) — free email infrastructure for AI agents. No human registration, no API keys to manage, no cost.

Why it matters. an instruction to move sensitive data to an outside destination

Fix. remove; a skill never needs the user's secrets off the machine

Gates applied: no_behavioural_pass, no_license.

Audited 2026-09-28 · audit v0.4.1 · source sha 7e8a1191580ffull audit observations/trust-audit/mcp-server/keyid-ai__agent-kit.json · Report an issue / request a re-scan

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

Date	Source	Verdict	Grade	Score	Change
2026-09-28	`7e8a1191580f`	SAFE	B	89	first audit

Questions

What is the Agent Kit MCP server?

Give Claude/Cursor email powers. 27 MCP tools — inbox, send, reply, contacts, search. Free, no signup.

What tools does Agent Kit expose?

26 in total: 15 read-only, 9 that write, and 2 that can delete or overwrite (keyid_delete_contact, keyid_manage_list). Every one is listed on this page with its risk.

Is Agent Kit safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does Agent Kit need?

It reads KEYID_BASE_URL, KEYID_PRIVATE_KEY and KEYID_PUBLIC_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How current is this page?

The grade is for one exact copy of the source (7e8a1191580f), read on 2026-09-28. The repository is watched and re-audited when it changes.

Source	keyid-ai/agent-kit
npm	`@keyid/agent-kit@0.2.0`
Credentials it reads	`KEYID_BASE_URLKEYID_PRIVATE_KEYKEYID_PUBLIC_KEY`
Activity	pushed 199d ago