# inboxy — remote MCP server

**Endpoint:** `https://mcp.inboxy.net` · **Transport:** Streamable HTTP · **Registry:** `net.inboxy/inboxy`

[inboxy](https://inboxy.net) is a privacy-first email aliasing service with an
AI-readable inbox. This server exposes your `@inboxy.net` mail, RSS feeds, and
aliases to any client that speaks the [Model Context Protocol](https://modelcontextprotocol.io),
so an assistant can read, search, summarise, and reply to your mail without
ever touching your real mailbox.

> **This repository is documentation.** The server is hosted — there is nothing
> here to install, build, or run, and no npm package to pull. It exists so the
> registry listing has a home and so the connection details are versioned
> somewhere public. The implementation is closed-source.

## Connecting

Most clients need only the URL. The server speaks OAuth 2.1 with Dynamic Client
Registration and PKCE, so interactive clients need no API key:

```json
{
  "mcpServers": {
    "inboxy": {
      "url": "https://mcp.inboxy.net"
    }
  }
}
```

Claude Desktop: **Settings → Developer → Edit Config**, paste the above,
restart, and sign in when redirected. Claude Code and other MCP clients take
the same URL and run the OAuth flow themselves.

**Unattended agents** (OpenClaw, Hermes, Codex, CI) use a static bearer key
instead, minted under **Account → API keys**:

```
Authorization: Bearer ik_…
```

Keys can be **address-scoped** to a single alias. A scoped key sees only that
alias's mail, has its outbound `From:` pinned to it server-side, and is refused
for account-wide operations — so a leaked key exposes one alias, not the
account.

Full setup, including the per-client config quirks that bite (OpenClaw's
`--header` uses `Name=Value`, Hermes' YAML uses `Name: Value`), is at
**https://inboxy.net/help/connect-mcp**.

## What an agent can do

48 tools as of v1.0.0, across eight groups, named `<group>_<action>` so
clients render them under a common heading:

| Group | Covers |
|---|---|
| `mail_*` | List, read, search, render, keep, delete, and send mail |
| `outbox_*` | Inspect what the agent has sent |
| `feed_*` | RSS subscriptions |
| `article_*` | Articles within those feeds |
| `address_*` | Mint and retire `@inboxy.net` aliases |
| `account_*` | Plan, quota, rate limits, retention |
| `digest_*` | Scheduled digest settings |
| `mark_*` | Cross-domain bulk read-state |

Every tool declares an MCP behavioural annotation — read-only, idempotent, or
destructive — so clients can gate the destructive ones behind confirmation.

The canonical, always-current tool reference is
**https://inboxy.net/help/connect-mcp** — deliberately not duplicated here, so
it cannot drift.

## What an agent can send

inboxy gives your AI an inbox, not your Gmail. Every outbound path is scoped
server-side, so a leaked credential cannot become a spam cannon:

| Tool | Recipient rule | Cap |
|---|---|---|
| `mail_reply` | Locked to the original sender of the message being replied to | 5/hour |
| `mail_forward` | Locked to your own verified personal email | Idempotent |
| `mail_send` | Any recipient, minus self-loops and reserved local-parts | Debits per-user send quota |
| `mail_invite` | Any external address that isn't already an inboxy user | 10 per rolling 30 days |

No surface anywhere accepts a caller-supplied `From:`. Mail is always sent from
one of your own aliases, never from your real address.

`@inboxy.net → @inboxy.net` mail is delivered in-network with no SMTP egress.
Anything leaving the network carries a one-line `— inboxy.net — agentic email`
attribution footer, injected at a single point so every send path behaves
identically.

## Privacy

- **EU data residency.** Storage and compute are pinned to Cloudflare's `eu`
  jurisdiction.
- **Scoped embeddings.** Semantic search runs on per-user vectors.
- **90-day default retention** on message bodies; pinned messages are exempt.
- **Short-lived tokens.** Refresh tokens rotate per OAuth 2.1 §4.3.1.
- Revoke an OAuth grant under **Account → MCP / OAuth clients**, or a key under
  **Account → API keys**. Revocation takes effect on the next request.

[Privacy policy](https://inboxy.net/privacy) · [Terms](https://inboxy.net/terms)

## Registry manifest

[`server.json`](./server.json) is the manifest published to the official MCP
registry under `net.inboxy/inboxy`. Its `version` tracks the version this
server announces to clients on `initialize`.

## Support

`hello@inboxy.net` · Security disclosures: `security@inboxy.net`
([security.txt](https://inboxy.net/.well-known/security.txt))

## License

The contents of this repository are licensed Apache-2.0. See [LICENSE](./LICENSE).