MCP.Market

Openagentemail MCP server

by openagentemail·io.github.openagentemail/mcp·v0.10.0·48 stars
No reviews yet

Unlimited agent mailboxes — create identities, read/wait for mail, extract OTPs, send email.

B74/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B74/100

full report

Adoption
Growing

48 stars285 downloads/wk

Reviews

Write one

Nobody has reviewed Openagentemail yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Openagentemail tools (25, 9 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • mail_list_identities

    List all email identities (addresses) on this server.

  • mail_list_messages

    List messages received by an identity address (newest first), with id/from/to/subject/date/seen/snippet/hasOtp/source.

  • mail_mark_seen

    Mark a message as read (seen=true) or unread (seen=false). This flag is shared across all consumers of the mailbox — agents that only need new-mail detection should prefer GET /v1/messages?since= or mail_wait_for. Reading a message never changes this flag by itself.

  • mail_new_identitywrite action

    Create a new email identity (mailbox address) on this openagent.email server. Admin keys create top-level identities (omit scopes for legacy full permissions). Non-admin tokens need identities:create and mint a child identity owned by the caller (parentIdentity set server-side; default child scopes = [read:messages] when the parent holds that scope, else []; child scopes must be ⊆ parent and canno

  • mail_read_message

    Read a full message: text, html (if any), and extracted OTP verification codes and links.

  • mail_sendwrite action

    Send an email from an existing identity address. 'from' must be an identity created with mail_new_identity.

  • mail_wait_for

    Wait for an incoming message matching optional from/subject filters; skips already-seen matches in the newest-20 window and keeps waiting until a true timeout or a new unread match. Returns the full message (with OTP codes/links) or a timeout error.

  • mail_webhook_createwrite action

    Create an outbound webhook subscription. Returns subscription metadata and the displayed signing secret (whs_...). Deny-by-default for OAuth tokens.

  • mail_webhook_deletewrite action

    Permanently delete an outbound webhook subscription and cancel any pending retries.

  • mail_webhook_disable

    Pause an active webhook subscription by marking it disabled.

  • mail_webhook_list

    List outbound webhook subscriptions. Identity callers see only their own subscriptions; admin callers may see all or filter by address.

  • mail_webhook_testwrite action

    Send an immediate probe ping to test webhook connectivity.

  • notify_agent

    Wake a named agent through the server-side notification route. Prefer the target agent's full identity address (localpart@domain); bare localpart remains compatible for legacy single-domain deployments. The server owns topics and credentials.

  • notify_check

    Read recent notifications for this identity only. The server maps the token to its own topic, so no topic name or ntfy credential is exposed.

  • notify_userwrite action

    Send a human-alert notification. Identity tokens need the server-side can_notify_user grant; this tool never needs a topic or ntfy credential.

  • notify_verifywrite action

    Send a harmless server-side notification check and poll it back. Requires the same human-alert permission as notify_user.

  • task_claim

    Claim a submitted task as its managed recipient for a bounded lease. Each generation is capped at 24 hours and the task cannot claim or renew at or after its first claim plus seven days; a working task may otherwise be reclaimed with an authenticated expired or released lease receipt.

  • task_createwrite action

    Assign a task to another managed identity. The server creates a stamped email thread and wakes that identity's agent route. Typed approval actions are JSON-only, at most 65,536 canonical UTF-8 bytes and depth 10, with expiry at most 30 days from the server clock; approval_action_too_large, approval_action_too_deep, and approval_expiry_too_far are stable client errors. With wait=true it waits up to

  • task_decide

    Approve or reject an approval task as the identity bound to this MCP token. This records a decision only; it never executes the action.

  • task_get

    Read one task thread and its server-stamped state history. A durable lease retained while leases are disabled is visible with leaseStatus=disabled.

  • task_list

    List this identity's email-backed tasks, optionally filtered by their current state. A durable lease retained while leases are disabled is visible with leaseStatus=disabled.

  • task_list_children

    List only direct readable children of a readable parent. Results are viewer-filtered before paging and contain no totals or descendants.

  • task_release

    Release a task lease only with its current active opaque lease token.

  • task_renew

    Renew a task lease only with its current active opaque lease token. Renewal never resets its generation's 24-hour cap or the task's first-claim seven-day cap; equality is rejected.

  • task_updatewrite action

    Advance a task as one of its two participants. The API stamps the state header; completed and failed are terminal. For an active recipient lease, omitting leaseToken retains task_already_terminal, while a supplied wrong or expired token returns task_lease_required. Put structured output in result, which the server writes as a JSON result block in the reply body.

Public scan report

scanner v0.1.10 · 2026-10-03 · same rubric, same numbers if you re-run it

1 medium
  • Code scan3 source files scanned20/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 0 days ago15/15
  • Maintainer identityregistry namespace matches repository owner7/10

Findings (1)

  • mediumeval / new Function usedexec.eval
    dist/main.js: …ourceCode, sch); const validate = new Function(`${names_1.default.self}`, `${names_1.de…
Overall 74/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Openagentemail compares

Against every graded Email MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
74/100
higher than 44% of 916 Email servers
Tools
25
the typical Email server has 7
Tools that change things
36%
typical: 25%. Fewer write tools means less an agent can break
GitHub stars
48
more than 93% of 493 Email servers
Downloads a week
285
more than 76% of 235 Email servers with a package

What its tools let an agent do: 14 read · 7 change · 4 send or post

Release history: 4 versions in the registry since 2026-09-13, latest 2026-09-29, typically one every 7 days.

Install Openagentemail in Claude Code, Cursor or VS Code

Runs npx -y @openagentemail/mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add mcp -- npx -y @openagentemail/mcp
Add to Cursor

What the publisher says

From the Openagentemail repository's README, as published. We do not edit it. Read it on GitHub

OpenAgentEmail

Open communication and task handoffs for AI agents. Self-hosted email, task threads, approvals, and webhooks over MCP and REST—for the agents you already use. Bring your own agents. Keep control of the work.

Get started · Try a task handoff · Documentation · Architecture · 简体中文

See the handoff

Give an agent an address. Send it a task. Read its progress and result in the same thread. OAE keeps the handoff inspectable; your agent's existing harness does the work.

sequenceDiagram
    participant A as Requester agent
    participant O as OpenAgentEmail
    participant B as Recipient agent
    A->>O: Create a task for B
    B->>O: Read the task when activated
    B->>O: Report working
    Note over B: Review in its own environment
    B->>O: Report completed with a result
    A->>O: Read the result and history

This is a protocol walkthrough, not a recorded autonomous run. The two-identity example makes activation explicit and reviews a small code snippet without editing files or calling a model service.

See the existing email and OTP interface

This repository image demonstrates the email capability, not an Agent orchestration console or a newly recorded task run. Tasks also have their own dashboard view:

Why OpenAgentEmail?

Agents running in different terminals or on different devices need a shared way to communicate: who asked for the work, who received it, what is happening, and what came back. They should not have to share an admin credential or switch to one execution environment just to exchange work.

OAE combines ordinary email with structured, authenticated task threads. Use it as an agent mailbox, an inspectable task handoff layer, or both. Email and OTP workflows remain first-class; the project is not limited to being an email-service alternative.

What you can do today

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Openagentemail: common questions

Is Openagentemail MCP server safe?
Mostly: it is graded B (74/100). Read the Openagentemail safety report
How do I install Openagentemail?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Openagentemail need an API key?
Yes. The registry entry asks for OPENAGENTEMAIL_API_KEY.
Is Openagentemail maintained?
The last commit was 31 days ago (2026-10-03). The latest release is v0.10.0.
What can I use instead of Openagentemail?
Servers from other publishers that do the same job: Agenticmail MCP server, Fluxmail MCP server and Agent Email MCP server. Compare all Openagentemail alternatives.
How does Openagentemail compare with other Email MCP servers?
safety score 74/100 (higher than 44% of 916 Email servers); tools 25 (the typical Email server has 7); tools that change things 36% (typical: 25%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Openagentemail

Same job from other publishers: the closest match first, then the best rated.

All Openagentemail alternatives →
  • Agenticmail
    Real email and SMS for AI agents — send mail, receive verification codes, drive a real inbox.
    B
  • Fluxmail
    Read, search, draft, send, and organize email through Gmail, Outlook, and IMAP/SMTP mailboxes.
    B
  • Agent Email
    Local email connectivity for AI agents — read, draft, send, and organize Outlook mail via MCP
    A
  • send0
    Email inboxes for AI agents: create an address, wait for codes and links, send and reply in threads.
    A
  • Proton Mail (unofficial)
    Unofficial Proton Mail MCP — send, read, search & organize email over SMTP and IMAP
    B