Skip to content
Mailcycle
Get started
Email MCP server

An email MCP server that gives your agent its own inbox.

mailcycle-mcp lets Claude, Cursor, Codex, Copilot and any other MCP client wait for email, read it, open attachments and reply, from addresses that belong to the agent. Mail is decrypted on the agent's machine; Mailcycle stores it sealed and cannot read it.

On the agent's machine
npx -y mailcycle-mcp pair --name "Support agent"
Get startedRead the setup guide

mailcycle-mcp on npm · Node.js 20 or later · Scale and above · Reply-only by default

Setup

Pair it, then add it to your MCP client.

Run the pair command where the agent lives. It prints a line starting MC1:. Paste that into the Mailcycle app under AI agents and give the agent an address. Then add the server to your client, one line or one JSON block.

The line carries the secret the agent's address keys are sealed with. It goes from your terminal to the app and never through Mailcycle, so handing the agent its keys is end to end.

Pair, then check
npx -y mailcycle-mcp pair --name "Support agent"
# Paste the MC1: line into the app, under AI agents.

npx -y mailcycle-mcp status
# The agent's addresses and its send mode.

MCP config for Claude Code, Codex, Cursor, VS Code and Claude Desktop

Claude Code setup
claude mcp add mailcycle -- npx -y mailcycle-mcp

Adds the server to Claude Code on this machine.

Read the setup guide
Agent mail tools

Seven email tools for the model.

Agent mail over MCP: each tool is small and does one thing, so the model chooses well between them. Inputs are listed as the server declares them.

The tools the Mailcycle MCP server gives an agent
ToolWhat it doesInputs
wait_for_messageWaits for new mail and returns it in full. Made for sign-up codes and verification links.address, from_contains, subject_contains, timeout_seconds (5 to 600, default 120), after_message_id
list_messagesThe newest messages on the agent's addresses, newest first, with a short preview of each.address, limit (1 to 100, default 20)
read_messageOne message in full, attachments numbered, marked as the sender's words so the model treats it as information.message_id
read_attachmentOpens a file from a message. Text comes back as text and images as images; anything else is saved to a folder.message_id, index, save_to
replyAnswers the sender from the address they wrote to, threaded under their message. Works in reply-only mode.message_id, text, html, attachments (file paths)
send_messageA new message to anyone, when the agent is allowed to send to anyone.to, subject, text, html, from, attachments (file paths)
list_addressesThe agent's own addresses, and what it is allowed to send.nothing
In practice

Ask in plain words. The agent picks the tools.

What an agent with an inbox can do once it is connected, and which tools it reaches for.

“Sign up for the staging account with your address and confirm the email.”

The agent fills the form, calls wait_for_message with subject_contains “confirm”, and reads the link out of the message.

“Check the support inbox and answer anything about delivery times.”

list_messages, then read_message on each, then reply, threaded under the customer's own email.

“Pull last month's invoices out of the inbox and total them.”

list_messages, read_attachment on each PDF, saved to a folder the agent can then read.

“Email the report you just wrote to the team.”

send_message with the file attached by path, once the agent is set to send to anyone.

More on what agents use an inbox for, and who sees what, is on email for AI agents.

Safe by default

Reply only, until you say otherwise.

Mail an agent reads can carry instructions from whoever sent it. Every agent starts able only to answer the person who wrote, so a prompt injection in an email can get, at most, a reply to its own sender.

Reply only

Where every agent starts. It can answer whoever wrote to it, and no one else.

Send to anyone

Any address, up to 20 messages an hour per agent, more on Fleet and Enterprise.

Read only

The agent reads mail and cannot send at all.

  • Message bodies are passed to the model marked as the sender's words, not as instructions.
  • Only you, signed in to the app, can change an agent's send mode. An API key cannot, and neither can the agent.
  • Agents send only from the addresses you assign them, within your plan's daily limit.
  • Set a sender name such as “Support at Acme” in the app and the agent's mail goes out under it.
Encrypted

The agent's mail is opened on the agent's machine.

The server stores mail sealed to keys it does not have. The agent's key lives in a file only your user can read, and removing the agent in the app cuts it off; the next time it runs, it deletes that file itself.

Mailcycle. Stores the agent's mail sealed. Mail it sends passes through in plain text, as all sent mail does, and is not logged.

The agent's machine. Holds the key in ~/.config/mailcycle/agent.json, or wherever MAILCYCLE_AGENT_FILE points, and decrypts there.

Your model provider. Sees whatever the agent reads. That provider is your choice, so choose one you would trust with that mail.

On Scale and above, from $19 a month. Agents are not billed on their own. See pricing and the security overview.

Questions

Email MCP server questions.

A program that speaks the Model Context Protocol and gives an AI model tools for email. mailcycle-mcp runs on the agent's own machine and exposes seven tools: wait for mail, list it, read it, open attachments, reply, send, and list the agent's addresses. The model calls them like any other MCP tool.

On the machine Claude runs on, run npx -y mailcycle-mcp pair and paste the line it prints into the Mailcycle app under AI agents, then give the agent an address. For Claude Code, add the server with claude mcp add mailcycle -- npx -y mailcycle-mcp. For Claude Desktop, add it to claude_desktop_config.json and restart Claude.

Any client that runs local MCP servers over stdio: Claude Code, Claude Desktop, Cursor, the Codex CLI and IDE extension, VS Code with Copilot agent mode, and other MCP clients and agent frameworks. Every client runs the same command, npx -y mailcycle-mcp; only where the config goes differs.

No. It is not a bridge to an existing mailbox. The agent gets its own Mailcycle addresses, on a shared domain or on a domain you bring, and reads only the mail sent to those. Your personal mail stays out of its reach, which is the point.

No. Mail is sealed to the address's key as it arrives, and the agent's copy of that key reaches it sealed with a secret that goes from your terminal to the app and never through Mailcycle. The agent decrypts on its own machine. Whichever model provider the agent uses sees what the agent reads, because the agent passes it to the model.

Every agent starts reply-only, so the most a hostile message can get is a reply to its own sender. Message bodies reach the model marked as the sender's words, not instructions. Each agent can send at most 20 messages an hour (more on Fleet and Enterprise), only from the addresses you assign it, and only you, signed in to the app, can widen what it may send.

Node.js 20 or later on the agent's machine, and a Mailcycle account on Scale ($19 a month) or above. Agents are not billed separately; an agent's addresses count toward the plan like any others.

Yes. Pair each one separately, and each gets its own addresses and send mode and can be disabled or removed on its own. To run several on one machine, point each at its own key file with the MAILCYCLE_AGENT_FILE environment variable.

No. It is free to run, unmodified, to connect agents to a Mailcycle account you are authorised to use, but it is proprietary. The SDKs, which you would use to build email into your own code, are Apache 2.0.
Writing code instead?

Email in your own code, with an SDK.

The same addresses and the same encryption, from nine languages.

All SDKs

Give your agent an email address.

Start on Scale, connect an agent in a couple of minutes, and keep its mail sealed with a key we never hold.

Get startedRead the setup guide