mailbox

warnings

mailbox.bot

Physical mail API for AI agents. Send letters, certified mail. Sandbox + live keys via MCP.

https://mailbox.bot/api/mcpWebsiteOAuthMCP 2025-11-25v1.0.1last checked 24 Aug 2026spoke MCP on 2 of 2 checks (30 days)initialize in 777 ms

How to authenticate

Checked against the endpoint by our probe on 24 Aug 2026. These are the capabilities the server advertises, not a prediction about any particular client.

Scheme	OAuth
Issuer	https://mailbox.bot
Dynamic client registration	✕Not advertised A client that cannot register itself needs credentials issued out of band before it can begin the flow.
Client ID Metadata Document	✕Not advertised
PKCE	✕None advertised MCP requires S256; a client that implements only that has no method in common with this server.
Scopes	agent.read, agent.write, mailbox.read, mailbox.write, inbound.item.read, inbound.item.action, inbound.item.scan.read, inbound.read, message.send, webhook.read, webhook.manage, billing.read, mail.send, document.read
Protected-resource metadata	✓Published (RFC 9728)
Anonymous access	Handshake succeeds; 19 tools listable
Credentials demanded in prose	✕send_outbound_mail These tools are listed anonymously and their own descriptions ask for an account or key, but no challenge is issued — so a client has nothing to act on and the refusal arrives as a tool error.

What the probe found

warningTools needing credentials are listed without a challenge

1 of the 19 tools listed anonymously say in their own descriptions that they need an account or a key (send_outbound_mail), but the endpoint issued no WWW-Authenticate challenge. The requirement is stated only in prose, so a call reaches the tool and comes back as a tool error instead of an authorization step.

No CORS headers for browser-based clients

A cross-origin preflight came back without Access-Control-Allow-Origin, so the endpoint is reachable from native clients only — code running in a web page is stopped by the browser before a request is ever sent.

19 tools usable without signing in

The server exposes a public surface before authorization: get_mailbox, get_usage, list_inbound_forwarding_addresses, list_inbound_mail, get_inbound_mail, list_postal_threads, get_postal_thread, get_mailbox_md, propose_mailbox_md_edit, send_facility_message, list_facility_conversations, get_facility_messages, update_webhook, send_outbound_mail, list_outbound_mail, get_outbound_mail, cancel_outbound_mail, create_test_outbound_mail, advance_test_outbound_mail.

Tools

advance_test_outbound_mailcancel_outbound_mailcreate_test_outbound_mailget_facility_messagesget_inbound_mailget_mailboxget_mailbox_mdget_outbound_mailget_postal_threadget_usagelist_facility_conversationslist_inbound_forwarding_addresseslist_inbound_maillist_outbound_maillist_postal_threadspropose_mailbox_md_editsend_facility_messagesend_outbound_mailupdate_webhook

Contract history

24 Aug 2026v1.0.1first recorded contract

Get alerted when this contract changes

Depend on this server? Leave an email and get a message when a probe records a change — a tool removed, an argument newly required, an enum narrowed. Alerts are being built; signing up is what tells us to hurry.

Prefer a feed reader? This page's contract changes are also an Atom feed.

Status badge

Status for a README, from the last probe — cached an hour, so up to seven hours behind the endpoint. Links back to this page.

[![MCP status](https://mcpi.app/servers/mailbox/badge.svg)](https://mcpi.app/servers/mailbox)