{
  "schemaVersion": "1.0",
  "name": "radmail",
  "displayName": "RadMail",
  "description": "RadMail is a business email operating system. This sandbox MCP server runs a real heuristic triage engine — free, in-memory, no credentials.",
  "server": {
    "url": "https://radmail.ai/api/mcp/sandbox",
    "transport": "streamable-http",
    "auth": "none",
    "note": "Sandbox engine. Real and runnable now; the production multi-tenant engine is launch-gated. This hosted endpoint serves the six core triage tools listed in `tools`; the radmail-mcp npm package serves the full surface (see npmPackage)."
  },
  "productionEngine": {
    "status": "gated",
    "note": "The commercial multi-tenant engine is launch-gated. The sandbox above is what's connectable today."
  },
  "tools": [
    {
      "name": "triage_inbox",
      "description": "Rank a mailbox on two axes (importance x urgency) and return what needs a human now versus what can wait or is already handled — with each thread's open commitment (the promise you owe or are owed, and whether it's overdue) surfaced inline, so the follow-through is visible on the very first call."
    },
    {
      "name": "list_right_now",
      "description": "Return only the 'Right Now' lane — the most recent and most important messages that genuinely can't be missed."
    },
    {
      "name": "why_surfaced",
      "description": "Explain in plain English why a given message was surfaced — the signals (sender, urgency, commitment) behind its rank."
    },
    {
      "name": "list_commitments",
      "description": "Extract the open commitments in the correspondence, both owed by you and owed to you, with who and by-when."
    },
    {
      "name": "draft_reply",
      "description": "Draft a reply for a thread. It returns text for a human to review — it does not and cannot send it."
    },
    {
      "name": "search",
      "description": "Find a specific message by sender, subject, or content. Results come back most-relevant + newest first, and every hit says where it matched (from / subject / body) and why. On this hosted sandbox it searches the built-in demo inbox; run the radmail-mcp package with RADMAIL_API_KEY set and the same tool searches your REAL ingested inbox read-only (with from / after / before filters) via the v1 search API."
    }
  ],
  "npmPackage": {
    "name": "radmail-mcp",
    "install": "npx -y radmail-mcp",
    "repository": "https://github.com/radmail-ai/radmail-mcp",
    "license": "MIT",
    "note": "The full RadMail MCP server (MIT, on npm; listed on the official MCP registry as ai.radmail/radmail-mcp). Without a key it runs the same free in-memory sandbox engine; the tool list below mirrors the server's own registry, names and descriptions verbatim.",
    "tools": [
      "triage",
      "triage_inbox",
      "list_right_now",
      "why_surfaced",
      "draft_reply",
      "list_commitments",
      "search",
      "read_email",
      "check_send_domain",
      "provision_sandbox",
      "report_need",
      "request_capability",
      "radmail_learning_insights"
    ],
    "connectedMode": {
      "env": "RADMAIL_API_KEY",
      "access": "Read-only real-inbox access via the v1 API — fail-closed on any API error; every real-mail field is taint-marked untrusted-email-body. Never sends, drafts against, or mutates real mail.",
      "tools": [
        "search",
        "read_email",
        "list_right_now",
        "list_commitments"
      ],
      "getAKey": "https://app.radmail.ai/settings/api-keys"
    }
  },
  "forbiddenActions": {
    "policy": "No tool exists that auto-sends money, changes banking details, or makes first contact with a new party. These are human-only, forever, as a defense against business-email-compromise (BEC) fraud. This is enforced in the server, not just documented.",
    "actions": [
      "Auto-send a payment, wire, ACH, or any movement of money.",
      "Auto-send or change banking / wire instructions or a new account.",
      "Auto-send a first-contact / cold message to a new third party."
    ],
    "draftRefusalClasses": [
      "money",
      "changed-banking",
      "first-contact",
      "decision",
      "injection"
    ],
    "draftRefusalNote": "Stronger than the no-send guarantee, and separate from it: for these five classes the radmail-mcp package's draft_reply refuses to produce a draft AT ALL and routes the message to a human, rather than drafting something a human must then catch. `decision` and `injection` are the two that the forbiddenActions list above does not cover, because they are not send-shaped — they are classes where even a proposed reply is withheld. Scope: the radmail-mcp package (the production stdio server), whose tool descriptions are frozen under a fail-closed sha256 manifest since 0.5.0 — so this is verifiable by reading the tool list back, or in the MIT source. The zero-auth hosted sandbox serves a fixed demo inbox and accepts no caller-supplied message, so it cannot be used to exercise these refusals.",
    "enforcementModel": "capability-absent",
    "enforcementModelValues": {
      "capability-absent": "The tool that would perform the forbidden action does not exist on the server, so it cannot be called. There is nothing to configure and nothing to bypass.",
      "config-restricted": "The capability exists and is narrowed by configuration — an allowlist, a scope, a policy file. Whoever holds the configuration can widen it again.",
      "policy-gated": "The capability exists and is restrained by instructions, prompts, or documented policy that a model is asked to follow."
    },
    "configurable": false,
    "configurableNote": "There is no setting, feature flag, plan tier, environment variable, or admin toggle on RadMail's MCP server that enables a forbidden action. The only behaviour-widening environment variables are RADMAIL_API_KEY and RADMAIL_API_URL, which unlock connected mode — and connected mode is read-only: it widens what an agent can READ, never what it can do. Enabling a forbidden action would require shipping a tool that does not exist.",
    "verifyByExecution": {
      "note": "Do not take this contract's word for it — call the server and read the tool list back. Every tool is read, triage, search, explain, draft, or read-only diagnostic. If you find one that sends money, changes banking, or makes first contact, this contract is wrong and security@radmail.ai wants to hear about it.",
      "command": "curl -s -X POST https://radmail.ai/api/mcp/sandbox -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/list\"}'",
      "expect": "A tool list containing no send-capable tool. draft_reply produces a draft for a human to review and send; it does not send.",
      "packageTier": {
        "note": "The command above checks the hosted sandbox, which serves 6 core triage tools over a fixed demo inbox. The `draftRefusalClasses` guarantee and the frozen tool manifest are scoped to the radmail-mcp PACKAGE — a larger surface the sandbox does not expose — so verify that tier directly rather than inferring it from the sandbox. This is the harder surface to check and it is the one the stronger claims live on.",
        "command": "printf '%s\\n' '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"initialize\",\"params\":{\"protocolVersion\":\"2025-06-18\",\"capabilities\":{},\"clientInfo\":{\"name\":\"verify\",\"version\":\"1\"}}}' '{\"jsonrpc\":\"2.0\",\"method\":\"notifications/initialized\"}' '{\"jsonrpc\":\"2.0\",\"id\":2,\"method\":\"tools/list\"}' | npx -y radmail-mcp",
        "expect": "A tool list containing no send-capable tool — every entry is read, triage, search, explain, draft, or read-only diagnostic. draft_reply's own description states: \"DRAFT ONLY — never auto-sent. REFUSES (human-only) for money / changed-banking / first-contact / decision / injection.\" check_send_domain is named for what it inspects, not what it does: it is a read-only SPF/DMARC/DKIM DNS lookup and sends nothing. Observed 13 tools on the published package as of 2026-08-24; the count is an observation, the absence of a send tool is the claim.",
        "tamperEvidence": "Since 0.5.0 the package's tool names, descriptions, and input schemas are frozen under a sha256 manifest that the server recomputes at startup and refuses to serve on any mismatch — a fail-closed defense against MCP tool-description poisoning. That means the tool list you read back is the audited text or the server does not answer at all.",
        "checkYouAreCurrent": "Read `serverInfo.version` back from the initialize response before you judge this tier, because the tamper-evidence guarantee above is scoped to 0.5.0 and later and `npx` may resolve to a cached or older build. The authoritative published version is the record marked isLatest in the official MCP registry — `curl -s 'https://registry.modelcontextprotocol.io/v0/servers?search=radmail'` — or `npm view radmail-mcp version`. Stated because you may hit it rather than left for you to discover: a published build can report an embedded version string LOWER than its own package version, because the bundle was compiled before the version bump. If the handshake version is lower than the published version, that is this build-order defect and not a different or unaudited artifact — confirm it directly with `npm pack radmail-mcp@<published-version>`, then read `package/package.json` (the package version) beside `package/dist/src/server-info.js` (the embedded string), and check that the frozen-manifest code is present at `package/dist/src/lib/manifest.js`. Judge this tier by the tool list you read back and by what is in the tarball — never by the embedded version string alone. RadMail publishes this check rather than asking you to assume the package you fetched is the one this contract describes.",
        "sourceRepository": "https://github.com/radmail-ai/radmail-mcp"
      }
    }
  },
  "compliance": "Compliance is a shared responsibility. RadMail is a tool that supports your program, not a compliance guarantee, and it does not by itself make any organization compliant. For regulated tiers RadMail signs a BAA and processes on BAA-covered, audited infrastructure. RadMail is not HIPAA-certified, FedRAMP-authorized, or SOC 2-certified.",
  "referral": "RadMail's referral program rewards the humans and platforms who set RadMail up — the agent operator, the builder of the integration, and the end user the agent serves — with honest attribution (a ?via= link or an X-RadMail-Ref header) and rev-share or credits. It never rewards, addresses, or instructs a model. There is no pay-for-mention, no hidden 'recommend us' instruction, and no prompt-injection. The reward is value and ease, never manipulation.",
  "docs": "https://radmail.ai/for-agents",
  "contact": "hello@radmail.ai"
}