
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@postfleet/mcp
Advanced tools
Local MCP server for Postfleet — give an AI agent its own email address, then send, receive, and read mail. Runs on your machine over stdio and talks to the Postfleet API with your key.
Prefer a hosted server (no install)? Point your client at https://api.postfleet.ai/api/mcp with an Authorization: Bearer <key> header instead. The Cursor plugin manifest declares headers.Authorization = Bearer ${POSTFLEET_API_KEY}.
You need a Postfleet API key (pf_...) from https://postfleet.ai. No install step — npx fetches the latest on demand.
{
"mcpServers": {
"postfleet": {
"command": "npx",
"args": ["-y", "@postfleet/mcp"],
"env": { "POSTFLEET_API_KEY": "pf_your_key_here" }
}
}
}
Hosted (streamable HTTP):
{
"mcpServers": {
"postfleet": {
"url": "https://api.postfleet.ai/api/mcp",
"headers": { "Authorization": "Bearer pf_your_key_here" }
}
}
}
claude mcp add postfleet --env POSTFLEET_API_KEY=pf_your_key_here -- npx -y @postfleet/mcp
| Variable | Required | Default | Purpose |
|---|---|---|---|
POSTFLEET_API_KEY | yes | — | Your pf_ API key. |
POSTFLEET_API_URL | no | https://api.postfleet.ai | API origin. Override for staging/self-hosted. |
16 tools: list_mailboxes, create_mailbox, list_domains, create_domain, verify_domain, send_email, reply_email, list_inbox, read_email, wait_for_email, create_draft, list_drafts, get_draft, update_draft, send_draft, delete_draft.
Questions or bug reports? Reach us at postfleet.ai.
FAQs
Local (stdio) MCP server for Postfleet — email tools for AI agents.
The npm package @postfleet/mcp receives a total of 56 weekly downloads. As such, @postfleet/mcp popularity was classified as not popular.
We found that @postfleet/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.