
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@engagelabemail/mcp
Advanced tools
MCP server for EngageLab Agent Email: send, receive, monitor and reply to email from AI agents
English | 简体中文
Official EngageLab Email project.
This repository distributes a local stdio MCP server. It does not provide a hosted OAuth or HTTP MCP endpoint; run it locally with the installation command below.
Send, receive, and reply to email from AI agents — through the Model Context Protocol.
Each agent gets its own mailbox: a real address that sends and receives, with conversations grouped into threads so your agent has context. Works with Claude Desktop, Claude Code, Cursor, Cowork, and any MCP-compatible client.
{
"mcpServers": {
"engagelab-email": {
"command": "npx",
"args": ["-y", "@engagelabemail/mcp"],
"env": { "ENGAGELAB_EMAIL_SECRET_KEY": "sk_sg_your_key" }
}
}
}
Most email APIs are send-only. Agents that need to have a conversation over email — support, scheduling, approvals — need an inbox.
| Tool | What it does | |
|---|---|---|
| Discover | list_mailboxes | List mailboxes; call this first to get IDs |
| Send | send_email | New email (text/html, cc/bcc, attachments, sandbox) |
reply_email | Reply to a message — recipients & thread inferred | |
| Receive | list_inbound_messages | Inbound mail, filter by mailbox/keyword |
get_message | Full message details by UID | |
check_new_messages | One-shot poll for new mail | |
| Threads | list_threads / get_thread / list_thread_messages | Browse conversations |
For local stdio distribution, build an MCPB bundle:
npm run build:mcpb
The bundle is generated at dist/engagelab-agent-email.mcpb and can be uploaded through Smithery publishing.
EngageLab Agent Email is also listed in the official MCP Registry. Clients that consume the Registry can find it by the server name io.github.Metaverse-Cloud/engagelab-email; the underlying npm package remains @engagelabemail/mcp.
1. Get a Secret Key. Create an EngageLab account and generate a key from the console (format sk_sg_xxx — the prefix selects the region). Or use the CLI: engagelab-email-cli login creates one via browser.
2. Create a mailbox. In the console, create a mailbox for your agent (shared subdomain is instant; custom domains need DNS verification). Programmatic mailbox creation is on the roadmap — see Troubleshooting if list_mailboxes returns empty.
3. Register the server.
Claude Desktop — add the JSON block above to claude_desktop_config.json.
Claude Code:
claude mcp add engagelab-email \
-e ENGAGELAB_EMAIL_SECRET_KEY=sk_sg_your_key \
-- npx -y @engagelabemail/mcp
Then ask your agent:
List my mailboxes, then send an email from the first one to bob@example.com saying the invoice is approved.
A typical agent loop for a support bot:
check_new_messages() → [messageUids]
get_message(uid) → body, attachments
list_thread_messages(threadId) → full conversation context
reply_email(uid, { text: ... }) → response lands in the same thread
| Environment variable | Required | Description |
|---|---|---|
ENGAGELAB_EMAIL_SECRET_KEY | Yes | Secret Key starting with sk_ |
ENGAGELAB_EMAIL_BASE_URL | No | Override the API base URL. Inferred from the key region: sg → Singapore, tr → Türkiye |
Limits: up to 10 attachments / 10MB total per message (base64-encoded in the tool schema).
list_mailboxes returns an empty list — your account has no mailbox yet. Create one in the EngageLab console (see Quickstart step 2). Agents cannot self-provision mailboxes yet.code 100101 — the Secret Key is wrong or revoked. Check ENGAGELAB_EMAIL_SECRET_KEY and that the key's region prefix (sk_sg_ / sk_tr_) matches the endpoint you use.ENGAGELAB_EMAIL_BASE_URL explicitly.reply_email (not send_email) so In-Reply-To headers and threading stay intact.check_new_messagesgit clone https://github.com/Metaverse-Cloud/engagelab-email-mcp
cd engagelab-email-mcp
npm install && npm run build
ENGAGELAB_EMAIL_SECRET_KEY=sk_sg_xxx node dist/index.cjs
--json output for agentsFAQs
MCP server for EngageLab Agent Email: send, receive, monitor and reply to email from AI agents
The npm package @engagelabemail/mcp receives a total of 23 weekly downloads. As such, @engagelabemail/mcp popularity was classified as not popular.
We found that @engagelabemail/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.