inboxy

inboxy — remote MCP server

Endpoint: https://mcp.inboxy.net · Transport: Streamable HTTP · Registry: net.inboxy/inboxy

inboxy is a privacy-first email aliasing service with an AI-readable inbox. This server exposes your @inboxy.net mail, RSS feeds, and aliases to any client that speaks the Model Context Protocol, so an assistant can read, search, summarise, and reply to your mail without ever touching your real mailbox.

This repository is documentation. The server is hosted — there is nothing

here to install, build, or run, and no npm package to pull. It exists so the

registry listing has a home and so the connection details are versioned

somewhere public. The implementation is closed-source.

Connecting

Most clients need only the URL. The server speaks OAuth 2.1 with Dynamic Client Registration and PKCE, so interactive clients need no API key:

{

"mcpServers": { "inboxy": { "url": "https://mcp.inboxy.net" } } }

Claude Desktop: Settings → Developer → Edit Config, paste the above, restart, and sign in when redirected. Claude Code and other MCP clients take the same URL and run the OAuth flow themselves.

Unattended agents (OpenClaw, Hermes, Codex, CI) use a static bearer key instead, minted under Account → API keys:

Authorization: Bearer ik_…

Keys can be address-scoped to a single alias. A scoped key sees only that alias's mail, has its outbound From: pinned to it server-side, and is refused for account-wide operations — so a leaked key exposes one alias, not the account.

Full setup, including the per-client config quirks that bite (OpenClaw's --header uses Name=Value, Hermes' YAML uses Name: Value), is at https://inboxy.net/help/connect-mcp.

What an agent can do

48 tools as of v1.0.0, across eight groups, named _ so clients render them under a common heading:

Every tool declares an MCP behavioural annotation — read-only, idempotent, or destructive — so clients can gate the destructive ones behind confirmation.

The canonical, always-current tool reference is https://inboxy.net/help/connect-mcp — deliberately not duplicated here, so it cannot drift.

What an agent can send

inboxy gives your AI an inbox, not your Gmail. Every outbound path is scoped server-side, so a leaked credential cannot become a spam cannon:

No surface anywhere accepts a caller-supplied From:. Mail is always sent from one of your own aliases, never from your real address.

@inboxy.net → @inboxy.net mail is delivered in-network with no SMTP egress. Anything leaving the network carries a one-line — inboxy.net — agentic email attribution footer, injected at a single point so every send path behaves identically.

Privacy

• EU data residency. Storage and compute are pinned to Cloudflare's eu jurisdiction.
• Scoped embeddings. Semantic search runs on per-user vectors.
• 90-day default retention on message bodies; pinned messages are exempt.
• Short-lived tokens. Refresh tokens rotate per OAuth 2.1 §4.3.1.
• Revoke an OAuth grant under Account → MCP / OAuth clients, or a key under Account → API keys. Revocation takes effect on the next request.

Privacy policy · Terms

Registry manifest

server.json is the manifest published to the official MCP registry under net.inboxy/inboxy. Its version tracks the version this server announces to clients on initialize.

Support

hello@inboxy.net · Security disclosures: security@inboxy.net (security.txt)

License

The contents of this repository are licensed Apache-2.0. See LICENSE.