radmail-mcpBLOCK
Email MCP server / email operating system for AI agents: two-axis triage (importance x urgency), a Right Now lane, commitment follow-through, reviewable drafts, and a machine-verifiable BEC hard-stop (money/banking-change/first-contact = human-only). Zero-auth sandbox; the hosted tier never sends ma
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
An email operating system for agents — with a refusal you can trust.
Every inbox got an AI in 2026. None can be trusted to hit send. RadMail is the one that can — because the consequential actions are refused in code, model-independent: money, changed-banking details, first-contact senders, decisions, and prompt-injection are human-only, forever. No prompt can talk RadMail into auto-sending them.
This is the Model Context Protocol (MCP) server, so any AI agent can use the inbox.
If a fleet of MCP agents runs your execution layer while you sit in the decision seat, the inbox is the seat that needs a hard-stop first. It's where a socially-engineered wire or banking change is irreversible — and where an autonomous process that can hit send can be talked into the loss. RadMail lets agents do the inbox's work (triage, the Right Now lane, commitment tracking, drafting) while money, changed banking, first contact, decisions, and prompt-injection stay human-only by construction, not by a policy an agent could be argued out of. That's what makes the company inbox delegable at all.
Start in one call
Call triage_inbox and omit the token — RadMail auto-provisions a free sandbox tenant and returns a working triage in one round-trip. Reuse the returned token. (On the zero-auth hosted sandbox, triage_inbox takes no args — it triages a built-in demo inbox so your very first call returns the full wedge.)
This server runs the sandbox engine (heuristic, in-memory, free, no credentials). It is real and runnable — not the production "99%" engine.
Tools
9d24080c8043OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add radmail-mcp -- npx -y [email protected]
Exposed tools (15)
12 read · 3 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
check_send_domain | write | ZERO-AUTH email-deliverability read for ANY domain (e.g. \ |
draft_reply | read | Draft the reply that discharges a commitment owed in a message. DRAFT ONLY — never auto-sent. REFUSES (human-only) for money / changed-banking / first-contact / decision / injection. |
list_commitments | read | List open promises — what |
list_right_now | read | Return only the |
provision_sandbox | read | Mint a FREE sandbox tenant token instantly — no creds, no signup. Most tools auto-provision for you, so you usually don |
radmail_learning_insights | read | |
read_email | read | CONNECTED MODE: fetch one full email (headers + textBody) from the user |
report_need | read | Tell RadMail something was awkward, missing, or slow. Folds into per-agent learning (call STRUCTURE only — never email content). |
request_capability | read | Request a capability you wish RadMail exposed. Aggregated into unmet-demand that shapes the surface and roadmap. |
search | read | Find a specific message by sender / subject / content — most-relevant + newest first; each hit says where it matched. TWO MODES: pass |
send_email | write | Send an email from the owner |
sync_credentials | write | Always call this first with the user |
triage | read | Score one message on TWO axes (importance × urgency), explain WHY it surfaced, break it into 4 dimensions, flag any hard-stop (BEC), and extract any commitment. OMIT |
triage_inbox | read | ONE round-trip over a batch of messages: the Right Now lane + every open commitment + every hard-stop. The whole RadMail wedge in a single call. OMIT |
why_surfaced | read | Explain in plain English WHY a message was surfaced — the signals (sender, urgency words, commitment, hard-stop) behind its importance × urgency scores. Transparency, not a black box. |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (1 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (17)
const t = text.slice(0, 16_384).replace(/[--]/g, "");
const t = text.slice(0, 16_384).replace(/[--]/g, "");
Money movement, changed-banking-details, first-contact senders, and irreversible decisions are **human-only, forever.** RadMail will never return an auto-sendable draft for those, and no prompt, jailb
const t = text.slice(0, 16_384).replace(/[--]/g, "");
const t = text.slice(0, 16_384).replace(/[--]/g, "");
const injected = r.bundle.slice(0, i) + "export const exfil = globalThis.fetch;\n" + r.bundle.slice(i);
writeFileSync(join(dst, "vendor", "radmail-engine.bundle.ts"), newer.slice(0, j) + "export const exfil = globalThis.fetch;\n" + newer.slice(j));
exfiltrateTo: z.string().optional().describe("Address to forward the email to."),process.env.RADMAIL_DEMAND_SINK_URL = "http://127.0.0.1:9999/sink";
assert.equal(captured[0].url, "http://127.0.0.1:9999/sink");
const zw = ""; // zero-width space, interleaved between letters
@modelcontextprotocol/sdk, zod, @types/node, tsx, typescript
This server sends anonymous demand-signal telemetry to `https://app.radmail.ai/api/mcp-demand` so RadMail can see which tools agents actually use and what capabilities they ask for: **what's sent** is
> An email operating system for agents — with a refusal you can trust. RadMail is the MCP server that lets any AI agent triage, search, and follow through on a mailbox, while the consequential actions
Set the `RADMAIL_API_KEY` environment variable on the local (stdio) server — create a key in about a minute at `https://app.radmail.ai/settings/api-keys` — and four tools go live against the user's RE
The server sends anonymous demand-signal telemetry to `https://app.radmail.ai/api/mcp-demand`: tool name, event type (`call` / `need` / `capability`), the need/capability text explicitly submitted via
Directories and answer engines mirror the `server.json` record in the official MCP registry, not this file. Two publisher-controlled fields drive what their pages show: `title` (optional human-readabl
Gates applied: instruction_override, no_behavioural_pass.
9d24080c8043full audit observations/trust-audit/mcp-server/radmail-ai__radmail-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 9d24080c8043 | BLOCK | D | 69 | first audit |
Questions
What is the radmail-mcp MCP server?
Email MCP server / email operating system for AI agents: two-axis triage (importance x urgency), a Right Now lane, commitment follow-through, reviewable drafts, and a machine-verifiable BEC hard-stop (money/banking-change/first-contact = human-only). Zero-auth sandbox; the hosted tier never sends ma
What tools does radmail-mcp expose?
15 in total: 12 read-only, 3 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is radmail-mcp safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does radmail-mcp need?
It reads RADMAIL_API_KEY and RADMAIL_SEND_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does radmail-mcp run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as radmail-mcp at 0.5.1.
How current is this page?
The grade is for one exact copy of the source (9d24080c8043), read on 2026-10-11. The repository is watched and re-audited when it changes.