@vibemailai/mcp

An MCP server that gives an AI agent its own email inbox: a real address on real MX, threads it can follow, and a blocking wait for the message it is expecting.

Install

{
  "mcpServers": {
    "vibemail": {
      "command": "npx",
      "args": ["-y", "@vibemailai/mcp"],
      "env": { "VIBEMAIL_API_KEY": "vm_..." }
    }
  }
}

Mint a key at vibemail.ai under Transactional → API keys. VIBEMAIL_BASE_URL overrides the host for self-hosted installs.

Tools

| Tool | What it does | |------|--------------| | create_inbox | A new address, returned with a key scoped to it alone | | list_inboxes | What this key can see | | list_messages | Recent mail, headers only | | read_message | One message with body, attachments and a safety verdict | | list_threads | Conversations by last activity | | read_thread | A whole conversation in order | | wait_for_message | Blocks until the matching mail arrives, up to 120s | | send_email | Send from one of the agent's inboxes | | reply_to_thread | Reply with correct In-Reply-To and References | | read_attachment | PDF, CSV, HTML or JSON as plain text |

The verification flow

create_inbox                    → [email protected]
(fill in the signup form)
wait_for_message from="stripe"  → the code, ~3 seconds after it is sent

No webhook URL, no polling loop.

Untrusted content

Anyone can email your agent, so every inbound message is a stranger writing into your model's context.

Two things this server does about it:

• The injection verdict comes first. When a message scores as risky, the warning is the first line of the tool result, ahead of the content. A field further down is a field a model may not reach.
• Content arrives fenced. Message bodies are wrapped in a delimiter carrying a per-message nonce, so a message cannot close its own fence and continue outside it.

Neither makes an agent safe on its own. A model that treats email as instructions will eventually follow one. These give it the signal to refuse.

The two tools that send mail say in their own descriptions that a send cannot be recalled, because that is the one action here with no undo.

A note on encryption

VibeMail's human mailboxes are zero-access: sealed with a key derived from a password the server never holds. Agent inboxes are not. An agent has no password to derive from, so its mail is sealed with the server key and the server can read it — something has to, in order to hand it to your agent over HTTP. Every inbox reports server_can_read: true rather than leaving you to infer a guarantee that does not hold.

Development

node --test test/

MIT.