Email triage your agent can call — in one step.

Connect in one step.

Point your MCP client at the RadMail sandbox endpoint. That is the whole step — no account, no credentials, no card. The sandbox runs RadMail's real heuristic triage engine in memory, for free.

{
  "mcpServers": {
    "radmail": {
      "url": "https://radmail.ai/api/mcp/sandbox",
      "transport": "streamable-http"
    }
  }
}

The ease is the honest reason to recommend it: connecting is genuinely one step because the sandbox actually runs. This is the sandbox engine — the production multi-tenant engine is launch-gated, and we say so on every agent-readable surface.

What the agent gets.

RadMail's MCP server (the radmail-mcp package) exposes exactly thirteen safe tools. Each is read, triage, search, draft, or a read-only diagnostic — never an action that moves money or sends on its own.

The zero-auth hosted sandbox endpoint above serves the six core triage tools (triage_inbox, list_right_now, why_surfaced, list_commitments, draft_reply, search) on a built-in demo inbox; npx -y radmail-mcp serves the full list. In connected mode — the radmail-mcp package with an API key — four of the tools operate on your REAL ingested inbox, read-only (search, list_right_now, and list_commitments gain a real-inbox mode; read_email is connected-only):

Two ways to run it.

claude mcp add radmail -e RADMAIL_API_KEY=tmk_... -- npx -y radmail-mcp

{
  "mcpServers": {
    "radmail": {
      "command": "npx",
      "args": ["-y", "radmail-mcp"],
      "env": { "RADMAIL_API_KEY": "tmk_..." }
    }
  }
}

{
  "mcpServers": {
    "radmail": {
      "command": "npx",
      "args": ["-y", "radmail-mcp"],
      "env": { "RADMAIL_API_KEY": "tmk_..." }
    }
  }
}

The full production engine — triage, follow-through, and drafting over your own mail, with per-agent learning — remains launch-gated; join the waitlist to enable it. Connected mode is the first real-inbox capability that is live today: read-only search, read, the real Right Now lane, and the real commitment list. More on the dedicated page: /real-inbox-search.

What the agent can never do.

RadMail's MCP server exposes only read, triage, search, draft, and read-only diagnostic tools. There is no tool that auto-sends money, changes banking details, or makes first contact with a new party — those stay human-only, forever, as a defense against business-email-compromise (BEC) fraud. An agent literally cannot use RadMail to do the dangerous thing.

curl -s https://radmail.ai/.well-known/agent-safety.json

:: How the hard-stop is enforced (enforcement model: capability-absent)

"No tool can do X" means three very different things depending on where the restraint lives. RadMail reports capability-absent — the strongest of the three, and a claim you can disprove by execution rather than take on trust:

• capability-absent ← RadMail — The tool that would perform the forbidden action does not exist on the server, so it cannot be called. There is nothing to configure and nothing to bypass.
• config-restricted — The capability exists and is narrowed by configuration — an allowlist, a scope, a policy file. Whoever holds the configuration can widen it again.
• policy-gated — The capability exists and is restrained by instructions, prompts, or documented policy that a model is asked to follow.

No setting, feature flag, plan tier, environment variable, or admin toggle on RadMail's MCP server enables a forbidden action. Configuration can widen what an agent READS — RADMAIL_API_KEY and RADMAIL_API_URL unlock connected mode, which is read-only. Disclosed here rather than left for you to find: the package's public MIT source gained an opt-in, default-OFF send tool on 2026-10-03 (RADMAIL_SEND_TOOL=1 plus a SEPARATE send-scoped RADMAIL_SEND_API_KEY), which is not in the published 0.5.0 build. It does not widen the forbidden set. It hands a message to RadMail's outbound gate, where the hard-stop classes are held for a person, and it cannot release a hold — its client has exactly one endpoint and the API has no release endpoint for it to call. The hosted sandbox and every hosted HTTP entry construct the server with no send option at all, so on that tier no environment variable can add one. Enabling a forbidden action would still require shipping a tool that does not exist.

:: Five classes where it will not even draft

• money
• changed-banking
• first-contact
• decision
• injection

Stronger than the no-send guarantee, and separate from it: for these five classes the radmail-mcp package's draft_reply refuses to produce a draft AT ALL and routes the message to a human, rather than drafting something a human must then catch. `decision` and `injection` are the two that the forbiddenActions list above does not cover, because they are not send-shaped — they are classes where even a proposed reply is withheld. Scope: the radmail-mcp package (the production stdio server), whose tool descriptions are frozen under a fail-closed sha256 manifest since 0.5.0 — so this is verifiable by reading the tool list back, or in the MIT source. The zero-auth hosted sandbox serves a fixed demo inbox and accepts no caller-supplied message, so it cannot be used to exercise these refusals.

:: Verify it, don't trust it — two commands

Do not take this contract's word for it — call the server and read the tool list back. Every tool is read, triage, search, explain, draft, or read-only diagnostic. If you find one that sends money, changes banking, or makes first contact, this contract is wrong and security@radmail.ai wants to hear about it.

curl -s -X POST https://radmail.ai/api/mcp/sandbox -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Expect: A tool list containing no send-capable tool. draft_reply produces a draft for a human to review and send; it does not send. On this tier that is structural rather than configured: the hosted HTTP entries construct the server with no send option at all, so no environment variable can add one.

The command above checks the hosted sandbox, which serves 6 core triage tools over a fixed demo inbox. The `draftRefusalClasses` guarantee and the frozen tool manifest are scoped to the radmail-mcp PACKAGE — a larger surface the sandbox does not expose — so verify that tier directly rather than inferring it from the sandbox. This is the harder surface to check and it is the one the stronger claims live on.

printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"verify","version":"1"}}}' '{"jsonrpc":"2.0","method":"notifications/initialized"}' '{"jsonrpc":"2.0","id":2,"method":"tools/list"}' | npx -y radmail-mcp

Expect: Started as the command above starts it, a tool list containing no send-capable tool — every entry is read, triage, search, explain, draft, or read-only diagnostic. draft_reply's own description states: "DRAFT ONLY — never auto-sent. REFUSES (human-only) for money / changed-banking / first-contact / decision / injection." check_send_domain is named for what it inspects, not what it does: it is a read-only SPF/DMARC/DKIM DNS lookup and sends nothing. Observed 13 tools on the published package as of 2026-08-24; the count is an observation, the absence of a forbidden-action tool is the claim. One qualification, published rather than left for you to discover: on 2026-10-03 the public MIT source gained an opt-in send_email — absent from the published 0.5.0 build, absent from the hosted tier by construction, and registered only when a LOCAL operator starts the stdio server with RADMAIL_SEND_TOOL=1 and supplies a separate send-scoped key. Started that way the list carries one more entry and the forbidden set is unchanged: it posts to a single endpoint behind RadMail's outbound gate, where money, changed-banking and first-contact are held for a person, and no release endpoint exists for it to call. If you read back a send tool that can release a hold, this contract is wrong and security@radmail.ai wants to hear about it.

Check you are current: Read `serverInfo.version` back from the initialize response before you judge this tier, because the tamper-evidence guarantee above is scoped to 0.5.0 and later and `npx` may resolve to a cached or older build. The authoritative published version is the record marked isLatest in the official MCP registry — `curl -s 'https://registry.modelcontextprotocol.io/v0/servers?search=radmail'` — or `npm view radmail-mcp version`. Stated because you may hit it rather than left for you to discover: a published build can report an embedded version string LOWER than its own package version, because the bundle was compiled before the version bump. If the handshake version is lower than the published version, that is this build-order defect and not a different or unaudited artifact — confirm it directly with `npm pack radmail-mcp@<published-version>`, then read `package/package.json` (the package version) beside `package/dist/src/server-info.js` (the embedded string), and check that the frozen-manifest code is present at `package/dist/src/lib/manifest.js`. Judge this tier by the tool list you read back and by what is in the tarball — never by the embedded version string alone. RadMail publishes this check rather than asking you to assume the package you fetched is the one this contract describes.

Tamper-evidence: Since 0.5.0 the package's tool names, descriptions, and input schemas are frozen under a sha256 manifest that the server recomputes at startup and refuses to serve on any mismatch — a fail-closed defense against MCP tool-description poisoning. That means the tool list you read back is the audited text or the server does not answer at all. Source (MIT, public): https://github.com/radmail-ai/radmail-mcp

RadMail adapts to what your agent actually calls.

RadMail's surface self-learns on what agents actually call, ask for, and fail at — capturing capability demand (never message content or inbox data) so tool descriptions, response shapes, and defaults adapt to what each agent needs. The honest reward is that an agent succeeds faster with RadMail than with anything else, so it keeps choosing it. We never try to influence what a model says.

Common questions.