e2a — email for AI agents

@e2a/mcp-server

Model Context Protocol server for e2a — gives any MCP-aware AI agent its own email inbox to send, receive, reply, and (optionally) review held outbound mail before it ships.

Works with Google ADK, LangChain, OpenAI Agents SDK, Claude Desktop, Cursor, Cline, and any other MCP host.

Connect

e2a's MCP server is hosted. Point your MCP host at the Streamable HTTP endpoint:

https://api.e2a.dev/mcp

Two ways to authenticate:

• OAuth 2.1 (recommended for interactive hosts) — add e2a as a connector and authorize in the browser. No key is pasted into config.
• Bearer API key (programmatic / self-host) — send your e2a dashboard API key in the Authorization: Bearer header.

An agent-scoped credential resolves its agent server-side. Account-scoped callers pass the agent email per tool call.

Quick start

Google ADK (Python)

import os

from google.adk.agents import Agent from google.adk.tools.mcp_tool.mcp_toolset import McpToolset from google.adk.tools.mcp_tool.mcp_session_manager import StreamableHTTPConnectionParams

root_agent = Agent( model="gemini-flash-latest", name="e2a_agent", instruction="Help the user manage their email. Reply to threads with reply_to_message to preserve threading headers.", tools=[ McpToolset( connection_params=StreamableHTTPConnectionParams( url="https://api.e2a.dev/mcp", headers={ "Authorization": f"Bearer {os.environ['E2A_API_KEY']}", }, timeout=30, ), ), ], )

LangChain (Python)

Using langchain-mcp-adapters:

import os

from langchain.agents import create_agent from langchain_mcp_adapters.client import MultiServerMCPClient

client = MultiServerMCPClient({ "e2a": { "transport": "http", "url": os.getenv("E2A_MCP_URL", "https://api.e2a.dev/mcp"), "headers": { "Authorization": f"Bearer {os.environ['E2A_API_KEY']}", }, }, })

tools = await client.get_tools() agent = create_agent( "anthropic:claude-sonnet-4-6", tools=tools, system_prompt="Reply with reply_to_message; pending_review is accepted, so do not retry it.", )

OpenAI Agents SDK (Python)

import os

from agents import Agent, Runner from agents.mcp import MCPServerStreamableHttp

async with MCPServerStreamableHttp( name="e2a", params={ "url": os.getenv("E2A_MCP_URL", "https://api.e2a.dev/mcp"), "headers": { "Authorization": f"Bearer {os.environ['E2A_API_KEY']}", }, "timeout": 30, }, cache_tools_list=True, max_retry_attempts=3, ) as e2a: agent = Agent(name="e2a_agent", mcp_servers=[e2a]) result = await Runner.run(agent, "Reply to the latest unread email politely.")

Claude Desktop / Cline / Cursor

Add e2a as a remote MCP server in the host's config (claude_desktop_config.json, cline_mcp_settings.json, etc.):

{

"mcpServers": { "e2a": { "url": "https://api.e2a.dev/mcp", "headers": { "Authorization": "Bearer YOUR_E2A_API_KEY" } } } }

Hosts that support OAuth connectors can instead add https://api.e2a.dev/mcp as a connector and authorize in the browser — no key pasted.

Tools

The server exposes up to 80 tools spanning agents, messages, human-in-the-loop approval, attachments, domains, events, webhooks, API keys, contacts/outreach, email templates (beta), suppressions, and external sending access requests (beta). The visible set depends on your credential's scope: an agent-scoped credential sees the 21 runtime/inbox tools (read, send, reply, restore messages, per-agent outreach); an account-scoped credential also sees the 59 admin/setup tools (agent/domain/webhook/event/template/API-key/contact/ suppression/sending-access management — and HITL review discovery plus approve/reject, which is an account-owner action, never agent self-approval) — all 80. Every tool carries MCP annotations (readOnlyHint/destructiveHint/ idempotentHint) so hosts can auto-approve reads and flag destructive actions. The tables below highlight the most commonly used ones — your MCP host's tool list shows the set your scope allows, with per-tool descriptions.

Identity

Webhook deliveries are signed — verify them. Push delivery is a top-level

resource (create_webhook), not a per-agent mode. e2a HMAC-signs every webhook

delivery against the webhook's signing secret (returned once from create_webhook

/ rotate_webhook_secret). Your handler must verify the signature on every

request — the e2a SDK exposes

constructEvent(rawBody, signatureHeader, secret) which verifies and returns a

typed event in one call (throws on a bad signature). Or skip webhooks entirely

and poll via list_messages.

Messages

Scheduled sending via send_at / scheduled_at is beta and may change before it is declared stable.

External sending access (beta). On a deployment that restricts it, an

account may be limited to sending through the shared identity only to its

verified account email and to agent inboxes in the same account. A

send_message / reply_to_message / forward_message (or the deprecated

send_email) call with any other To/Cc/Bcc recipient refuses the WHOLE

send with external_sending_not_enabled (403) — nothing is queued, and the

identical call will not succeed on retry. whoami's sending_access object

reports the current state (enforcement_applies, shared_external_approved,

paid_external_sending_entitled, owner_recipient_verified) and

available_unlocks — what can lift the restriction on this deployment:

operator_approval always; verified_domain (send from your own verified

domain) and paid_entitlement (a paid plan) only where listed. The hosted

service lists only operator_approval. To ask for approval, call

request_sending_access once (account scope; also available in the

dashboard at the error's recovery_url): resubmitting while a request is

pending returns the same request, and rate_limited (3 requests per 30 days)

must not be retried. An operator decides and the decision is **emailed to the

account owner**; get_sending_access_request shows the current state. No MCP

tool can grant approval.

| Tool | Description |

| --- | --- |

| request_sending_access | Beta. File one request for an operator to review external sending access (use_case, recipients, expected_daily_volume). Mutating: refused with account_read_only on a frozen account. (Admin/account-scoped.) |

| get_sending_access_request | Beta. The account's latest request and its state (pending / approved / declined). Read-only. (Admin/account-scoped.) |

MCP message output intentionally omits the REST message-read beta thread_id field and adds no thread filter or endpoint. list_conversations / get_conversation remain caller-owned conversation_id application views, not RFC email-thread enumeration. Use reply_to_message with the original message ID to preserve wire topology.

Human-in-the-loop approval

list_reviews/get_review surface every account-scoped hold: outbound drafts awaiting send approval and inbound messages held by a screening gate. The email.review_requested webhook is an additional push notification for either direction and carries the same message_id. The approve_review/reject_review tools branch on direction: approving an inbound hold releases it to the agent's inbox (no send, no draft, override fields ignored); rejecting one drops it so it never reaches the agent.

Domains

API keys

All admin/account-scoped. create_api_key mints agent-scoped keys only — the key is bound to one inbox and can act only as that agent. Account-scoped (workspace-admin) keys cannot be created over MCP; mint those from the dashboard or the raw API, where a human is in the loop.

Contacts (beta)

The people an account corres