Vexa
by Vexa-ai
Meeting bot and transcripts for Google Meet, Teams and Zoom. Live or after, speakers labelled.
Runs in the cloud★ 2,949Apache-2.0Updated 2 months ago
Install
Radmail MCP
Overview
Description from the maker (original English)
Email OS for agents - real-inbox search, triage, commitments, and a verifiable BEC hard-stop.
PopNx MCP’s three pillars
These three are never merged into one score: opinions, measurements and popularity are different things.
- User voiceiNo reviews yetReviews open together with accounts in a later step
- Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
- UsageiNot measured yet★ –
What you can do with it
We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.
- Connection: Computer or cloud
- Transport: stdio, Streamable HTTP
- Category: Chat & email
Install
Pick the AI app you use, then copy the settings.
Before you install
- Basic checks: 1 of 1 passed
- Runs on the maker’s server: what you ask it goes through their server.
- The registry lists no key to fill in.
You need
- Runs in the cloudNothing to install; it connects over the internet
- npmNode.js installed (for the npx command)
Which app do you use?
Pick your app above. We remember it, so next time the button says “Install in …”.
Works in Claude on the web, desktop and mobile:
- Open Settings → Connectors
- Press Add custom connector
- Paste the address below and press Add
- If it asks you to sign in, sign in with the maker
https://radmail.ai/api/mcp/sandboxOr run it on your computer
Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json
{
"mcpServers": {
"radmail": {
"command": "npx",
"args": [
"-y",
"radmail-mcp"
]
}
}
}Run this in your terminal
claude mcp add --transport http radmail https://radmail.ai/api/mcp/sandboxOr run it on your computer
claude mcp add radmail -- npx -y radmail-mcpOr copy the settings yourself
Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json
{
"mcpServers": {
"radmail": {
"url": "https://radmail.ai/api/mcp/sandbox"
}
}
}Or run it on your computer
Or copy the settings yourself
Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json
{
"mcpServers": {
"radmail": {
"command": "npx",
"args": [
"-y",
"radmail-mcp"
]
}
}
}Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.
Or copy the settings yourself
Paste into .vscode/mcp.json in your project
{
"servers": {
"radmail": {
"type": "http",
"url": "https://radmail.ai/api/mcp/sandbox"
}
}
}Or run it on your computer
Or copy the settings yourself
Paste into .vscode/mcp.json in your project
{
"servers": {
"radmail": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"radmail-mcp"
]
}
}
}Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.
ChatGPT connects only to servers on the internet:
- Open ChatGPT on the web → Settings → Connectors (Apps)
- Press Create or Add (some plans need Developer mode under Advanced first)
- Paste the address below, give it a name and save
- If it asks you to sign in, sign in with the maker
https://radmail.ai/api/mcp/sandboxMenu names can differ slightly by plan and over time.
Your choice stays on this device in a cookie; no account needed.
These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.
What it can do
We have not read this server’s tool list yet; we check endpoints in rotation.
Basic checksi
We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 7, 2026
- ✓ Pass
Maker matches the repo
The registry name was verified against the domain radmail.ai (the registry checks domain ownership)
- … Not checked yet
Still maintained
We have not read this repo from GitHub yet
- … Not checked yet
Has a licence
We have not read this repo from GitHub yet
- … Not checked yet
Endpoint responds
Not checked yet; we check endpoints in rotation
- … Not checked yet
Sign-in with OAuth
Not checked yet; we check endpoints in rotation
- … Not checked yet
No hidden instructions in tool descriptions
Not checked yet; we read the tool list when we check the endpoint
Compared with others in Chat & emaili
- More stars than 0% of the other 1771 servers in this category
- Published to the registry more recently than 24% of the other 1771 servers in this category
- Basic checks equal to or better than 100% of the other 1771 servers in this category
Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.
Common questions
Is Radmail MCP safe?
It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.
What keys or codes does it need?
The registry does not list a required key, though some servers ask you to sign in on first use.
Does it run on my computer or in the cloud?
Either way works: install it on your computer or connect to the cloud version.
Is it still maintained?
The GitHub repo last changed –, and the latest version (0.5.0) reached the registry 3 months ago.
Which apps can use it?
Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. It connects by URL, so apps that accept remote MCP servers work too, such as ChatGPT in developer mode.
What can I use instead?
In the same category: Vexa, emailmd, MCP WhatsApp Cloud
Alternatives
Servers in the same category from other makers, sorted by stars.
Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi
emailmd
by anypost
Render markdown into email-safe HTML, lint drafts for deliverability problems, and preview emails.
Computer or cloud★ 1,385MITUpdated 31 days ago
Install
MCP WhatsApp Cloud
by codespar
MCP server for WhatsApp Cloud API (Meta) — messages, media, and templates via Graph API
Runs on your computer★ 277MITUpdated 5 months ago
Install
README from the maker
Open the README
Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.
RadMail MCP
An email operating system for agents — with a refusal you can trust.
Every inbox got an AI in 2026. None can be trusted to hit *send*. RadMail is the one that can — because the consequential actions are refused in code, model-independent: money, changed-banking details, first-contact senders, decisions, and prompt-injection are human-only, forever. No prompt can talk RadMail into auto-sending them.
This is the Model Context Protocol (MCP) server, so any AI agent can use the inbox.
If a fleet of MCP agents runs your execution layer while you sit in the decision seat, the inbox is the seat that needs a hard-stop first. It's where a socially-engineered wire or banking change is irreversible — and where an autonomous process that can hit send can be talked into the loss. RadMail lets agents do the inbox's *work* (triage, the Right Now lane, commitment tracking, drafting) while money, changed banking, first contact, decisions, and prompt-injection stay human-only by construction, not by a policy an agent could be argued out of. That's what makes the company inbox delegable at all.
Why it withholds the draft, not just the send
Ask this category how it keeps a person in the loop and the published answer is a draft: the agent composes, a human approves, nothing auto-sends. For ordinary mail that is the right design, and it is exactly what RadMail does — draft_reply returns text a person reviews and sends, and the hosted tier lists no send tool at all.
For five classes RadMail does something stricter, and the reason is the whole product: money, changed banking, first contact, a decision, and prompt-injection get no draft at all. On a wire-change thread a draft is not a safeguard — it is the last mile of the attack. Business email compromise does not fail at the send button; it succeeds at the approval button, by putting a plausible, well-written reply in front of a busy person who only has to say yes. Handing that person a pre-written answer makes approving *easier than reading*. So RadMail withholds the draft and hands over the message and the signals instead, and the person writes the reply.
Both halves are verifiable by execution, with no account — run these two commands and compare:
# Ordinary mail: a draft comes back.echo '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"draft_reply","arguments":{"from":"sam@client.example","subject":"Re: the deck","body":"Can you send me the updated deck by Thursday?","knownSender":true}}}' | npx -y radmail-mcp
A banking change: no draft comes back.
echo '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"draft_reply","arguments":{"from":"cfo@vendor.example","subject":"Updated wire instructions","body":"Our bank details changed. Remit the $48,200 to the new account by Friday.","knownSender":true}}}' | npx -y radmail-mcp
Both commands were run verbatim against the published package on 2026-10-14. The first returns a draft plus "mcpEnforcement": "No hard-stop. Still a DRAFT — the MCP surface never sends mail." The second returns "draft": null, "hardStop": "changed-banking", and "mcpEnforcement": "HARD-STOP (changed-banking). No draft offered — human-only forever (BEC defense)." Note what the second one still gives you: the extracted commitment and the reason, taint-tagged — the withheld thing is the *proposed reply*, not the information.
The five classes are published as draftRefusalClasses in the contract, and the refusal is a one-way ratchet: it may be tightened, never loosened.
The cost, stated plainly. This is a worse experience on precisely the mail you most want handled for you. If a wire-change notice lands at 2am and you wanted a reply waiting, RadMail will have nothing for you to approve — by design. That trade *is* the product. If what you need is a reply ready to approve on every thread including the ones that move money, a draft-and-approve server is the right tool and this is the wrong one.
Start in one call
Call triage_inbox and omit the token — RadMail auto-provisions a free sandbox tenant and returns a working triage in one round-trip. Reuse the returned token. (On the zero-auth hosted sandbox, triage_inbox takes no args — it triages a built-in demo inbox so your very first call returns the full wedge.)
This server runs the sandbox engine (heuristic, in-memory, free, no credentials). It is real and runnable — not the production "99%" engine.
Tools
| Tool | What it does |
|---|---|
triage_inbox | One round-trip over a batch: the Right Now lane + every open commitment + every hard-stop. The whole wedge in one call. |
list_right_now | The can't-miss lane only — most-recent × most-important, each with why-surfaced. Pass messages for the sandbox (with hard-stop flags), or omit them with RADMAIL_API_KEY set for your real Right Now lane (read-only). |
why_surfaced | Explain in plain English why a message surfaced — the signals behind its importance × urgency. Transparency, not a black box. |
draft_reply | Draft the reply that discharges a commitment — never for a hard-stopped one (money / banking / first-contact stay human-only). |
list_commitments | Open promises with their due window. Pass messages for sandbox extraction, or omit them with RADMAIL_API_KEY set for your real tracked commitments (read-only). |
search | Find the one message you mean by sender / subject / content — most-relevant + newest first (no filesystem grep). Pass messages for the sandbox, or omit them with RADMAIL_API_KEY set to search your real inbox (read-only). |
read_email | Connected mode only: fetch one full email (headers + textBody + attachment names) from your real inbox by RadMail's id; returns rfcMessageId, the RFC 5322 Message-ID a reply threads on. Read-only; body content arrives taint-tagged. |
read_thread | Connected mode only: one conversation by threadId — the thread and its received emails oldest first, each with id, rfcMessageId and inReplyTo. Metadata only; coverage says what is left out. Read-only. |
list_emails | Connected mode only: your real inbox newest first, metadata only, with since and a nextCursor for polling. Fails closed on a RadMail deployment too old to honour since / cursor. Read-only. |
list_prepared_drafts | Connected mode only: RadMail's own AI-prepared reply drafts (optionally for one emailId). Read-only — RadMail never sends a prepared draft on its own. |
list_watched_threads | Connected mode only: the threads you watch, with who spoke last (me_last / them_last / unknown) and a stalled flag. Read-only. |
get_attachment | Connected mode only: save one file attached to a real email to RADMAIL_ATTACHMENT_DIR and return its path. Read-only; the server decides whether the file may be served (key scope, mailbox, sender allowlist, size cap). |
check_send_domain | Zero-auth, works on any domain: read-only SPF / DKIM / DMARC health read (verdicts + raw records + plain-language advice). Probes the common DKIM selectors (default, google, resend, sendgrid, mail, k1, s1, s2). Read-only DNS — no key, no send capability. |
check_before_send | Connected mode only: ask RadMail whether an email your agent will send through its own provider should go — pass / review / human_only, with reasons — without sending it. Nothing is sent or stored. human_only means a person sends it from their own mail, or discards it; review means show the owner first; pass means no known risk pattern matched, not a clearance. Any answer without a verdict (the check switched off, a refused key, a timeout) comes back checked: false, verdict: null — unchecked, never pass. Needs a key that is not limited to one mailbox. See *Checking a message your agent sends itself*. |
triage | Score a single message (the per-message form of triage_inbox). |
provision_sandbox | Explicitly mint a free sandbox tenant. |
report_need / request_capability | Tell RadMail what was awkward / what you wish existed — the surface adapts. |
radmail_learning_insights | What RadMail has learned about how you work. |
Two opt-in surfaces add tools on a local server only, never on a hosted one: send_email (see *Opt-in: sending*) and five inbox actions — archive_email, snooze_email, mark_read, label_email, act_on_emails (see *Opt-in: inbox actions*). Every connected read tool is annotated readOnlyHint: true — except get_attachment, which writes a file on the local machine and so carries no read-only claim; the annotations are inside the frozen manifest, so flipping one fails the startup check like a description edit would.
"How many tools?" — and the second number that matters more
Public round-ups of email MCP servers commonly quote a tool count as a measure of depth. Tool count measures surface area, not judgment — and for a server trusted with an inbox, the useful number is the second one: of those tools, how many can send?
RadMail publishes both, as dated observations you can reproduce against any MCP server — this one included:
| Tier | Tools | Send-capable |
|---|---|---|
Hosted zero-auth sandbox (https://radmail.ai/api/mcp/sandbox) | 6 | 0 |
This package at 0.6.0, default (also this package's hosted /api/mcp, with or without a bearer) | 19 | 0 |
… with RADMAIL_SEND_TOOL=1 (local stdio only) | 20 | 1 — send_email, which hands mail to RadMail's outbound gate and cannot release a hold |
| … with the opt-in inbox actions (local stdio only) | 24 | 0 — the five added tools change inbox state (archive, snooze, read state, labels); none sends, trashes or deletes |
Row 1 observed 2026-10-09; rows 2-4 read from this repository's frozen manifests at 0.6.0 (2026-10-26), which is not yet on npm — the published 0.5.0 predates send_email, the inbox actions, check_before_send and the 0.6.0 read tools. Reproduce row 1 with the tools/list command under *Verify before you connect*. Reproduce row 2 from the frozen manifest — the surface the server refuses to deviate from (src/send-tool-manifest.ts and src/triage-tool-manifest.ts hold the opt-in rows):
node -e 'const s=require("fs").readFileSync("src/tool-manifest.ts","utf8");const n=[...s.matchAll(/"name": "([a-z_]+)"/g)].map(m=>m[1]); console.log(n.length, n.join(" "))'
⚠️ One honest caveat, because the naive version of this check gets it wrong: grepping that list for send matches `check_send_domain`, which is a read-only SPF/DKIM/DMARC *lookup* over DNS — it reads a domain's published records and sends nothing — and `check_before_send`, which asks RadMail whether a message *should* be sent and sends nothing either. Read each tool's description, not just its name. That caveat applies to whatever server you are evaluating, not only to this one.
The ratio is the point, and it is not a verdict on anyone else. A wide, send-capable tool surface is a legitimate design for an agent that is *supposed* to send, and most of this category is built for exactly that job. It is the wrong design for the one class of email where being argued into sending *is* the whole attack. RadMail reports 0 send-capable tools on every hosted endpoint — see *The safety contract* for why that is capability-absent rather than a setting someone could switch.
Which of the three shapes is this? (a fourth one — and the difference *is* the product)
Published round-ups of this category sort email MCP servers into roughly three shapes:
- Transactional / lifecycle sending for an application — deliverability, templates, logs, domain management.
- An inbox the agent owns — the agent has its own address and receives, threads and answers mail
Only the beginning is shown; read the rest in the repo