MailowsMCP server: e-mail for agents
Give your assistant its own e-mail mailbox — not access to yours. It reads and sends mail over the Model Context Protocol, only from the mailboxes you explicitly allow.
Server address
Enter this single address in your client; nothing is installed and nothing runs on your machine:
https://mcp.mailows.com/mcpThe transport is Streamable HTTP. The server is stateless, the
authorization server is https://id.namailu.cz and the token is bound to
this very address as its audience.
How to connect it
Claude (web and desktop)
- Open Settings → Connectors → Add custom connector.
- Paste the server address above and confirm.
- Claude redirects you to our sign-in. Pick the mailboxes the agent should have access to and confirm with your second factor.
Claude Code
claude mcp add mailows --transport http https://mcp.mailows.com/mcpCodex and other clients
codex mcp add mailows --transport streamable-http --url https://mcp.mailows.com/mcpAny client that supports a remote MCP server over Streamable HTTP and OAuth connects the same way.
Sign-in and consent
- OAuth 2.1, authorization code with PKCE (S256). No password is handed to the client and the token never travels in a URL.
- The client is either registered in advance or uses a Client ID Metadata Document; the callback address must match exactly, with loopback allowed for local clients.
- You confirm consent with your second factor (two-factor authentication). Without it no grant is created — that is a deliberate decision: the agent gains access to real mail, so confirming with a password alone is not enough.
- Consent applies to specific mailboxes and a specific scope. Sending requires a separate permission; without it the agent only reads mail.
- You can revoke access in the portal at any time. Revocation takes effect immediately — it is checked on every request, not only when the token expires.
What the agent can do
| Tool | What it does |
|---|---|
mail_health |
Checks that the service is available. Returns nothing about the account or the mail. |
mail_list_inboxes |
Lists only the mailboxes covered by the granted consent. |
mail_list_messages |
A list of messages in a folder (inbox, archive, trash, sent, spam). Deliberately without subject and body — metadata and opaque IDs only. |
mail_read_message |
Reads a single message by ID and marks it as read. Content from the sender is separated out as untrusted. |
mail_prepare_attachment_uploads |
Prepares an attachment upload in the original bytes, without Base64 in the model's response. |
mail_upload_attachment_chunk |
A fallback path for clients whose sandbox cannot reach the upload address. |
mail_send_message |
Sends a message from an allowed mailbox. Requires the sending permission. |
Limits
- At most 10 attachments and 10 MiB of original data per message.
- Attachments are scanned for malicious content. An encrypted attachment or an unsupported archive will be sent, but we state explicitly that we could not see inside.
- The same hourly, daily and monthly quotas apply as with our REST API — they are safeguards against an agent stuck in a loop, not commercial limits.
- Sending requires an idempotency key, so a repeated attempt does not send the message twice.
Security worth knowing about up front
- The agent never sees mailboxes outside the granted consent — the list is derived from the grant, not from the account.
- The content of someone else's message is data, not instructions for the model. Text from the sender is returned separately and with an explicit warning that it must not be acted upon.
- The server accepts requests only from allowed origins and rejects tokens issued for a different audience.
Before you start
You need an account with Mailows and an agent mailbox in it. The free plan includes one, so trying it out costs nothing. A step-by-step guide is in the portal help once you sign in.