inboxy MCP server

inboxy — remote MCP server

Endpoint: https://mcp.inboxy.net · Transport: Streamable HTTP · Registry: net.inboxy/inboxy

inboxy is a privacy-first email aliasing service with an AI-readable inbox. This server exposes your @inboxy.net mail, RSS feeds, and aliases to any client that speaks the Model Context Protocol, so an assistant can read, search, summarise, and reply to your mail without ever touching your real mailbox.

This repository is documentation. The server is hosted — there is nothing

here to install, build, or run, and no npm package to pull. It exists so the

registry listing has a home and so the connection details are versioned

somewhere public. The implementation is closed-source.

Connecting

Most clients need only the URL. The server speaks OAuth 2.1 with Dynamic Client Registration and PKCE, so interactive clients need no API key:

{
  "mcpServers": {
    "inboxy": {
      "url": "https://mcp.inboxy.net"
    }
  }
}

Claude Desktop: Settings → Developer → Edit Config, paste the above, restart, and sign in when redirected. Claude Code and other MCP clients take the same URL and run the OAuth flow themselves.

Unattended agents (OpenClaw, Hermes, Codex, CI) use a static bearer key instead, minted under Account → API keys:

Authorization: Bearer ik_…

Keys can be address-scoped to a single alias. A scoped key sees only that alias's mail, has its outbound From: pinned to it server-side, and is refused for account-wide operations — so a leaked key exposes one alias, not the account.

Full setup, including the per-client config quirks that bite (OpenClaw's --header uses Name=Value, Hermes' YAML uses Name: Value), is at https://inboxy.net/help/connect-mcp.

What an agent can do

48 tools as of v1.0.0, across eight groups, named _ so clients render them under a common heading:

Every tool declares an MCP behavioural annotation — read-only, idempotent, or destructive — so clients can gate the destructive ones behind confirmation.

The canonical, always-current tool reference is https://inboxy.net/help/connect-mcp — deliberately not duplicated here, so it cannot drift.

What an agent can send

inboxy gives your AI an inbox, not your Gmail. Every outbound path is scoped server-side, so a leaked credential cannot become a spam cannon:

No surface anywhere accepts a caller-supplied From:. Mail is always sent from one of your own aliases, never from your real address.

@inboxy.net → @inboxy.net mail is delivered in-network with no SMTP egress. Anything leaving the network carries a one-line — inboxy.net — agentic email attribution footer, injected at a single point so every send path behaves identically.

Privacy

Shortened. The full README is on GitHub.