Mailbox MCP

Email routines: your own AI works your inbox on a schedule

Choose a routine, shape it in plain words, and add it to Claude or ChatGPT in one press. At the time you chose, it reads your mailbox and leaves you a brief, drafted replies or a list, and it never sends a thing. Each routine's card says whether it ran.

• Morning brief What came in since the last brief, who needs you first, and what can wait. Starts as Weekdays at 07:00 Each run 2 to 5 calls Needs Read only
• Replies waiting Drafts a reply to each person still waiting on you, ready for you to check and send. Starts as Weekdays at 07:30 Each run 2 to 12 calls Needs Draft and file
• Waiting on The emails you sent that nobody has answered, oldest first, with how long each has waited. Starts as Mondays at 08:30 Each run 2 calls Needs Read only
• Bills and invoices The bills and invoices that arrived, with the totals and due dates read from the attachments. Starts as Weekdays at 08:00 Each run 2 to 12 calls Needs Read only
• Your own routine Your own job for your AI: the mail it looks at, what it does with it, and anything else in your own words. Starts as Weekdays at 09:00 Each run 2 to 5 calls Needs Read only
• If a run does not come Every routine checks in with us first, so its card on your Routines tab says whether it ran, and when one does not, what to check.

Email attachments your AI can really send, even the picture ChatGPT just made

Ask ChatGPT to draw something and email it, and it arrives attached, from your own mailbox, with nothing downloaded first. Of every email MCP server and AI mail connector we compared, Mailbox MCP is the only one that handles attachments all the way through: sending them from anywhere, reading what is inside them, and handing them back.

1. 1 You ask ChatGPT ChatGPT draws the card, then sends it on request
2. 2 It arrives, attached In the recipient's webmail: a 2 MB picture, attached The same picture ChatGPT drew, ready to open or save

• Straight from the ChatGPT chat

  An image it has generated, a document it made, a file you dropped in. On a send, a reply, a forward or a draft.

• From anywhere, never encoded

  A file already in the mailbox, one at a web link, or one off your own computer. The AI never types a file out, up to 20 MB an email.

• Read, not just listed

  PDFs page by page, Word, Excel with its formulas worked out, PowerPoint, and scanned letters and photos as pictures.

Gmail, Microsoft 365, or any IMAP mailbox

You connect the mailbox you already have. There is no new address, no forwarding rule and nothing to migrate.

OAuth, one sign-in

Microsoft 365

Password access ended for Microsoft 365 mailboxes in 2022 and for personal Outlook.com ones in 2024, so Mailbox MCP goes through Microsoft Graph instead. Sending goes through Graph too, which means no Authenticated SMTP and no ticket to IT.

Connect Microsoft 365

App password

Gmail

16 characters from your Google account, and IMAP is already on whether you can find the setting or not. The guide covers the reason the app password screen may refuse to appear for you.

Connect Gmail

Host, port, password

Any IMAP host

Fastmail, Zoho, cPanel, a mailbox your host set up years ago. If it speaks IMAP and SMTP over TLS, it connects with the details already in your mail client.

Connect an IMAP mailbox

Claude, ChatGPT, Cursor, VS Code, or any MCP client

MCP is an open protocol, not one company's feature, and this is an ordinary remote MCP server. Connect a mailbox once and reach it from whichever assistant, editor or agent you actually work in. No extra licence, and no second price.

• Claude Assistant
• ChatGPT Assistant
• Grok Assistant
• Cursor Code editor
• VS Code Code editor
• Zed Code editor
• Windsurf Code editor
• Cline Coding agent

Real mail work, not a chatbot with an outbox

Most email integrations can list messages and send plain text. The difference shows up on the ordinary jobs: attaching the invoice that is already in your inbox, replying so the reply lands in the thread, and forwarding something with everything it arrived with. Connect a calendar as well and the same connector runs your diary: your week, other people's free time, and the meetings themselves.

What came in overnight that actually needs me?

Worked for 184ms

1. list_emails Reading the last 12 messages in INBOX 184ms

7 unread. 3 of them want something from you today:

• Dean Alcott wants a quote for a small site and asks if month end is realistic. He was referred by Priya at Meadowbank.
• Sarah at Harbour Lane is chasing the kickoff and needs to book a room. Thursday.
• A message you sent has bounced. Worth looking at before you resend anything.

The rest can wait: a Companies House reminder with 14 days on it, an uptime alert that already resolved itself after 4 minutes, a newsletter, and Tom at Northgate holding 4 packs of the discontinued card stock for you.

One call. 10 messages read, 7 unread, sorted by what wants an answer. Read the detail

Recorded on 5 and 13 September 2026 against a real mailbox. The tool names, the results and the timings are measured; the correspondents are invented, because real mail from real people does not belong on a public page.

See all 6, and what each one costs in calls

• Attachments that cost nothing to send

  4 ways to attach a file, and 3 of them never pass through the assistant. A file already in the mailbox, one at a web address, or one off your own computer through a one-off link goes straight onto the message. Only a file the assistant writes itself has to be spelled out. So a 6 MB PDF costs you a sentence and arrives in seconds. Spelled out, it would crawl into the conversation a character at a time until the assistant ran out of room and sent the message without it. Several files at once, up to 20 MB a message. How AI email attachments work here.

• It reads the file, not just the message

  Ask what the attached invoice comes to and it reads the PDF. A scanned letter comes back as pictures of its pages, read the way you would read it. Word, Excel and PowerPoint files come back as text, and a photo as a picture. One call reads every file, nothing is kept, and the message stays unread. A file it can't read, a zip or an old.doc, is named, with a link to open it.

• Replies that land in the thread

  A reply carries the headers a mail client uses to nest it under the original, so it appears in the conversation rather than as a stray new message. It can read the whole thread first, so it answers what was actually said and not just the last message. The original is marked answered, exactly as if you had replied yourself.

• Forwards that arrive intact

  Attachments and inline images travel with a forward, under the forwarded-message block a real client produces. Copy other people in, add files of your own alongside the original's, and anything the size ceiling will not take is named rather than dropped quietly. A forward can be saved to Drafts instead of sent, which matters more here than anywhere else, because the part being passed on is somebody else's.

• Send as any of your addresses

  Every alias, each with its own display name and signature, set in your account, not by the AI. A reply-all leaves out every address you own, so you're never copied in on your own thread. Exactly one copy is filed in Sent Items. Or save any message as a real draft, files and all, and press Send yourself in Outlook. Ask for a change and it rewrites that draft, rather than leaving the version you rejected in your bin.

• Ask whether it arrived

  Request a read receipt on the way out, the same tick box Outlook offers, on a send, a reply or a forward. Afterwards it finds what came back: a bounce, a delivery confirmation, or a receipt saying the message was opened. It tells you plainly that a missing receipt proves nothing, because most mail programs never send one.

• Filing, in bulk, on request

  Move up to 500 messages in one go, archive them where your own Archive button would, report spam so the filter learns, create and rename folders, mark things read or flagged. Reading never marks anything read, and nothing is filed unless you ask, so your unread count still means what it did this morning. A one-off link gets a file off your computer into the mailbox, where it waits in Drafts for you to keep or delete.

• A diary, once you connect one

  It reads your week, finds when a group of people are free, books time, invites and reschedules, and answers invitations. Connecting a mailbox does not connect a calendar, so it is one extra step: Microsoft 365 asks on the same sign-in, and anything else takes a Google sign-in or the address of a CalDAV server. On Microsoft it sets your out-of-office too.

You should not be able to tell we were there

Every tool above was built under one constraint: open your mailbox in Outlook afterwards and it should look exactly as it would if you had done the work yourself. Not similar. The same.

This rule decides whether a mail tool survives a real week of email, and a demonstration can't show it. Anything can send a message. The damage from the easy way of building it turns up later, somewhere else: a reply beside the conversation instead of inside it, a draft the AI can see and Outlook can't, a forward that lost the attachment it existed to carry, a delete that took the message away for good rather than to Trash.

Nobody reports any of that as a bug. They just find their mailbox slightly wrong, stop trusting the thing that did it, and go back to doing it by hand. So the convenient way is reliably the wrong one here. The only judge that counts is the mail client: not our API response, not a green test run, but your mailbox opened in another program a week later.

Everything you would do in Outlook yourself, your AI can do through Mailbox MCP, and it leaves behind the mailbox you would have left behind.

A reply that lands where the conversation already is

• A draft waits in Drafts APPENDed, flagged \Draft
• Editing a draft replaces it no second copy left behind
• A forward carries its attachments and its inline images
• A move keeps its dates IMAP MOVE, flags survive
• Deleting moves to Trash a move, never an expunge

Not every server is built to this rule

Of the 3 other hosted email MCP servers we compared, 2 publish no threaded replies, no way to edit a draft that is already in your mailbox, and no reading that leaves a message unread. None of them publishes a way to check bounces, delivery and read receipts after a send.

Email MCP servers compared sets the 4 of us side by side. Every competitor cell is taken from that vendor's own pages and dated.

Why Gmail and Microsoft 365 connections usually fail

Neither of these is a mistake you made. Both are recent changes at the provider, and both are still described incorrectly in most set-up guides you will find.

Microsoft 365

1 October 2022

A password cannot open a Microsoft 365 mailbox

learn.microsoft.com

Deprecation of Basic authentication in Exchange Online

Important

Basic authentication is now disabled in all tenants.

Now no one (you or Microsoft support) can re-enable Basic authentication in your tenant.

The notice at the top of Microsoft's own page, as it reads today.

Microsoft disabled Basic Authentication for IMAP in Exchange Online. Username and password access to those mailboxes ended for every client at once, and it is not a setting anyone can turn back on.

So it is not a policy your administrator forgot or a tool that has not caught up. Anything asking for your Microsoft password to read your mail is describing a world that ended on 1 October 2022.

Sign in with Microsoft instead. It takes one screen, and Mailbox MCP never sees a password.

Source: Microsoft Learn, deprecation of Basic authentication in Exchange Online.

Google

Still current

The app password setting that refuses to appear

myaccount.google.com/apppasswords

App passwords

The setting that you are looking for is not available for your account.

The App passwords page when 2-Step Verification has only a passkey behind it.

App passwords need 2-Step Verification backed by a phone or an authenticator app. A passkey on its own does not qualify, even though Google reports 2-Step Verification as on. Google now steers new accounts towards passkeys, so this is the default route into the dead end rather than an unusual one.

While you are there: do not go looking for the IMAP toggle. Google removed it in January 2025 and IMAP is now always on.

Add a phone number or an authenticator app to 2-Step Verification, and the setting appears.

Source: Google Account Help, sign in with app passwords.

What Mailbox MCP does to your mailbox, measured

These are not targets or design intentions. Each was taken while building the product, against a live mailbox of 26,930 messages, and each is checkable against your own mailbox once you connect it.

• Messages read over IMAP in one session 26,930 across 6.63 GB
• Largest message Microsoft Graph accepted 37,314,092 b64 bytes
• Access token refresh 382 to 432 ms
• Delivery to an external domain, over SMTP ~10s
• Duplicate copies left in Sent Items 0
• Attachment size ceiling, ours not theirs 20 MB

Microsoft's own documentation disagrees with one of these

Graph is documented with a 4 MB message limit. The largest message it actually accepted from us was 37,314,092 base64 bytes, from a 28 MB message, and every file arrived byte for byte. We cap attachments at 20 MB a message, which is our decision rather than the provider's.

What connects to what

One server in the middle. Your mailbox on one side, whichever AI client you work in on the other, and a fixed set of things it can do in between.

Your AI client Claude, ChatGPT, or any AI you already use

Mailbox MCP

What it can do

• Read Search, threads, attachments, who really sent it
• Send As any of your addresses, or as a real draft
• Reply In thread, carrying the right headers
• Forward With everything the original carried
• File Move, archive or junk 500 at once
• Flag Mark read, unread or flagged, on request
• Check Bounces, receipts, trust records, uploads

And in a calendar you connect

• Read the diary A window of days, a search, one event in full
• Find a time Free/busy for several people, and the suggestions
• Book your own time Create, change and delete, with no email sent
• Meet other people Invite, reschedule, cancel, forward
• Answer invitations Accept, decline, or propose another time
• Out of office Read it, set it for a period, turn it off
• Reminders and categories Snooze, dismiss, and the colours Outlook shows

And in the address book it has

• Find a person, read a card In your own address book, never copied
• Add, correct, delete Written to your own book, where your phone sees it
• Import a contacts file A webmail export into the book, each card once

In the mailbox you own

• Gmail App password
• Microsoft 365 One Microsoft sign-in
• Any IMAP host Host, port, password

1. Connect the mailbox

   Sign in to Microsoft, paste a Gmail app password, or enter IMAP details from your existing mail client. One mailbox takes a couple of minutes; the set-up guides cover the awkward parts honestly.

2. Add the server to your AI client

   Mailbox MCP is a remote MCP server, so there is nothing to install and nothing running on your machine. You add one URL and the mail tools appear. Connect Claude first if you have it, since it is the obvious place to start, but the same URL works in ChatGPT, Cursor, VS Code, Zed and anything else that speaks MCP.

3. Ask for what you would have done yourself

   Find the thread with the supplier, reply to it, attach the revised quote, file the original under Clients. Claude does it in your mailbox, and your unread count, your Sent folder and your conversation threads all still mean what they meant before.

What Mailbox MCP does not do

Worth knowing before you connect anything, rather than after.

• 20 MB a message

  Attachments are capped at 20 MB per message in total across every file attached, which is our limit rather than a provider's.

• Not a backup tool

  It does not back up, export or migrate a mailbox, and there is no tool that copies your mail anywhere. Archiving a message files it in your own Archive folder, which is filing rather than a backup.

• A calendar has to be connected separately

  Calendar tools appear once a diary is connected, which is its own step: calendar access approved on a Microsoft 365 sign-in, a Google sign-in for Google Calendar, or the address of a CalDAV calendar server. A mailbox with none of the 3 gets the email tools and no calendar tools at all.

• Deleted mail is gone

  It cannot recover mail that has already been deleted.

• No Exchange shared or delegated mailboxes

  A Microsoft 365 shared or delegated mailbox, the kind with no sign-in of its own that Outlook reaches through Full Access or Send As, cannot be connected. A mailbox you own can be shared with named people through Team Access, which is a different thing: each person gets their own connection at a level you set. A shared CALENDAR is different again and is supported on Microsoft 365: one that has been shared with you can be read, and written to where the person who shared it allowed that.

• No phone line

  There is no phone line. Support is by email, deliberately.

Pro per mailbox, Team Access per account

Every mailbox starts free. Pro is bought per mailbox, so one Pro mailbox beside 5 free ones is a normal way to use it. Giving other people their own connection to your mailboxes is Team Access, bought once for the account, as a tier of 3, 5 or 10 people.

Free

£0 every mailbox, no card required

• 5 MCP calls per mailbox per day
• Every provider: Gmail, Microsoft 365, IMAP
• Every mail tool, not a reduced set
• No card, and no expiry

Pro

£2.92 a month Per mailbox, paid annually at £34.99 + VAT

• Up to 1,000 MCP calls a day, per mailbox
• Bought one mailbox at a time; the others can stay free
• Paid by card through Stripe, VAT worked out at checkout
• Stop the renewal any time; Pro runs to the end of the period you paid for
• Everything it can do

Team Access

from £10.00 a month Per account, paid annually at £119.99 + VAT for 3 people

• Tiers of 3, 5 or 10 named people, on top of your Pro mailboxes
• Each person gets their own connection, permission level and daily cap
• Claim a thread, hand it over, or ask for approval before a send
• Every action in your activity log, with their name on it
• What a team gets, single sign-⁠on included

Questions people ask before connecting a mailbox

Can Claude or ChatGPT actually read and send email from my own mailbox?

Yes. Mailbox MCP is a remote MCP server that connects a mailbox you already own to the AI you already use. Claude or ChatGPT can then list, search and read messages, draft and send them, reply in thread, move mail between folders, archive it, report spam and flag it. Nothing in the server is specific to one assistant, so Cursor or any other MCP client works too. Your mail stays with your provider: no new address, and nothing to migrate.

Can Claude use Outlook? Does this work with Microsoft 365?

Yes. Microsoft switched off password access (Basic Authentication) for IMAP in Microsoft 365 on 1 October 2022, and for personal Outlook.com, Hotmail and Live accounts on 16 September 2024. So Mailbox MCP connects with one Microsoft sign-in, through Microsoft Graph, on a work, school or personal mailbox. Claude, ChatGPT or any MCP client then reads, sends and files that Outlook mail. Sending goes through Graph too, so you need no Authenticated SMTP and no ticket to IT.

Why can Google not show me the app password setting?

Because app passwords need 2-Step Verification backed by a phone or an authenticator app. Google documents the option as unavailable when 2-Step Verification uses only security keys, and a passkey behaves the same way: both replace the sign-in rather than add a second step. Your account still shows 2-Step Verification as on, which is why this is so hard to spot. The fix: add a phone number or an authenticator app to 2-Step Verification, and the setting appears.

Do I need to enable IMAP in my Gmail settings first?

No, and you will not find the toggle if you go looking. Google removed it in January 2025 and IMAP is now always on for every Gmail account. Any guide still telling you to turn it on was written before that change and has not been revisited since.

Does this only work with Claude, or with any AI?

Any client that can connect to a remote MCP server. Mailbox MCP is an ordinary MCP server, reached over HTTPS with a bearer token, and nothing in it is specific to one assistant. That covers Claude and Claude Code, ChatGPT, Cursor, VS Code, Zed, Cline, Goose, LibreChat, Microsoft Copilot Studio and agents you build yourself. A client limited to local servers can reach it through a proxy such as mcp-remote. One with no MCP support cannot connect.

Does Claude reading a message mark it as read?

No. Reading a message through Mailbox MCP leaves the unread flag exactly as it was, so your unread count is still yours and still means something. Marking a message read is a separate action that happens only when you ask for it.

What happens to messages Claude sends? Do they appear in Sent?

They appear in Sent Items once, with the same Message-ID the recipient received, so your sent folder is a true record. Replies carry the In-Reply-To and References headers, which is what makes them land inside the existing conversation in Outlook or Gmail rather than starting a new one alongside it. Both behaviours were checked by comparing the folder before and after each send rather than assumed from the API response.

Can it attach files to the emails it sends?

Yes. A file can come from your mailbox, a web link (SharePoint, Drive or Dropbox), your own computer through a one-off upload link that needs no sign-in, or, in ChatGPT, the chat itself. None of those passes through the assistant: each is streamed into the message as it is built. Several files can go on one message, up to 20 MB in total. Only a file the assistant writes out itself is limited, to a few tens of kilobytes.

Can it read a PDF or a spreadsheet somebody emailed me?

Yes. Ask what the attached invoice comes to and the server reads the PDF, page by page. A Word document keeps its tables, a spreadsheet comes back as rows with the formulas worked out, a slide deck slide by slide, and a photo as a picture. A scanned letter, a PDF with no text behind the picture, comes back as pictures of its pages. One call reads every file on a message, and nothing is marked read or kept.

Can it ask for a read receipt, like Outlook does?

Yes. A send, a reply, a forward or a draft can ask for a read receipt, and a separate tool finds what came back. But a receipt is a request, not a measurement. Consumer Gmail never returns one, Google Workspace only if an administrator allows it, and Apple Mail only behind a setting that ships switched off. So a missing receipt means nothing. A delivery receipt is not offered: the mail providers it connects to don't support one.

What does Mailbox MCP cost?

Every mailbox starts free: 5 MCP calls a day. Pro is £2.92 a month per mailbox, paid annually at £34.99 + VAT, and raises the ceiling to 1,000 calls a day. Buy it for one mailbox and keep the others free. Stop the renewal any time; Pro runs to the end of what you paid for. Team Access, which gives other people their own connection, is from £119.99 + VAT a year per account, on top of Pro.

What can Mailbox MCP not do?

Attachments are capped at 20 MB a message in total, not per file, so 3 files of 7 MB each are refused. That ceiling is ours, not your provider's. It does not back up, export or migrate a mailbox: archiving files a message in your own Archive folder, and no copy of your mail or contacts is kept. A calendar works only once you connect one, a step of its own on any mailbox. It cannot recover deleted mail.