@yunori/agent-mail-mcp

A Model Context Protocol server for Yunori Agent Mail. It gives an AI assistant — Claude, or any MCP client — the email inboxes one API key can reach: read and search mail, draft, reply and send, within each inbox's policy.

Runs over stdio. Node 20 or later. Its only dependencies are the official @modelcontextprotocol/server, zod and @yunori/agent-mail.

Set up

Make a key in Yunori under Agent inboxes → API keys. Start from Drafting agent if the assistant should draft but never send, or Sending agent if it may send within policy, and confine the key to the inboxes it needs.

Then add the server to your MCP client's configuration:

{
  "mcpServers": {
    "yunori-mail": {
      "command": "npx",
      "args": ["-y", "@yunori/agent-mail-mcp"],
      "env": {
        "YUNORI_BASE_URL": "https://yunori.email",
        "YUNORI_API_KEY": "tori_pat_…"
      }
    }
  }
}

With Claude Code:

claude mcp add yunori-mail -e YUNORI_BASE_URL=https://yunori.email -e YUNORI_API_KEY=tori_pat_… -- npx -y @yunori/agent-mail-mcp

Tools

| Tool | What it does | | --- | --- | | list_inboxes | The inboxes the key can reach, with what each can do | | list_threads | Conversations in an inbox, newest first | | read_thread | Every message in a conversation, oldest first | | search_messages | Search across the inboxes the key can reach | | read_message | One message with its text, files and security report | | read_attachment_text | The text of a PDF, Office or text attachment | | create_draft | Save a draft — nothing is sent | | send_message | Send a new message, within the inbox's policy | | reply | Reply to the latest message in a conversation | | send_draft | Send a saved draft, within the inbox's policy | | request_approval | Put a draft in front of a person | | delivery_status | Where a message stands: waiting, declined, sent, delivered, bounced, failed | | label_message | Add or remove labels, and mark read | | list_events | What happened recently, or since a given event |

Safety

Every tool is an API call made with your key, so the key's scopes, its inboxes and each inbox's sending policy apply unchanged. There is no tool to approve, release held mail or change a policy — no key can do those; a person does, in Yunori.

Mail is written by strangers. Every answer that can carry a stranger's words (subjects, names, message text) comes back inside one <untrusted_email_…> fence, with the message's risk and the signals Yunori noticed, and a file's text inside <untrusted_attachment_…>. The end of each fence's name is random and picked for that answer, so a sender can't write its closing tag. The server also removes characters a person can't see and the usual spellings of the fence's tag, and its instructions tell the model to treat mail as data, never as instructions.

The fence is a signal to the model, not a lock. What limits an assistant that believes the wrong message is the key's scopes and the inbox's sending policy, so choose those for the worst case.

Documentation

yunori.email/docs/agent-mail-sdk

License

MIT