
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
AI Inbox Manager — MCP Server with 15 tools. Unified inbox + email send/reply/poll via IMAP + SMTP.
AI Inbox Manager — MCP Server with 15 tools for unified inbox management + email send/reply/poll via IMAP + SMTP.
Give your AI assistant full email powers: read, search, triage, send, reply, and manage a multi-channel inbox with lead scoring and priority detection.
npm install
# Set DATABASE_URL in .env or environment
export DATABASE_URL="postgresql://user:pass@localhost:5432/inbox"
# Push schema to database
npx prisma db push
# .env
EMAIL_DOMAIN=yourdomain.com
EMAIL_ORG_NAME="Your Company"
# IMAP (for polling incoming emails)
IMAP_HOST=imap.yourdomain.com
IMAP_PORT=993
IMAP_PASS=your-imap-password
# SMTP (for sending emails)
SMTP_HOST=smtp.yourdomain.com
SMTP_PORT=587
SMTP_USER=your-smtp-user
SMTP_PASS=your-smtp-password
npm run build
npm start # stdio mode (for Claude Desktop, Cursor, etc.)
npm start -- --http # HTTP mode on port 4008
Add to your claude_desktop_config.json:
{
"mcpServers": {
"inbox": {
"command": "node",
"args": ["/path/to/mcp-inbox/dist/server.js"],
"env": {
"DATABASE_URL": "postgresql://user:pass@localhost:5432/inbox",
"EMAIL_DOMAIN": "yourdomain.com",
"EMAIL_ORG_NAME": "Your Company",
"IMAP_HOST": "imap.yourdomain.com",
"IMAP_PASS": "your-password",
"SMTP_HOST": "smtp.yourdomain.com",
"SMTP_PORT": "587",
"SMTP_USER": "your-user",
"SMTP_PASS": "your-password"
}
}
}
}
| Tool | Description | Parameters |
|---|---|---|
inbox_list | List/filter inbox items | channel?, status?, search?, fromDate?, toDate?, limit?, offset? |
inbox_get | Get single item with body + triage | id |
inbox_search | Full-text search across all fields | query, limit? |
inbox_stats | Overview: total, by status/channel, high-priority count | — |
inbox_threads | Email threads with message counts | limit? |
inbox_get_thread | Thread details with all messages | threadKey |
inbox_high_priority | Items needing immediate attention | — |
inbox_notes | Triage notes: TLDR, intent, urgency, score | inboxItemId |
inbox_recent | Last N items across all channels | limit? |
inbox_channel_summary | Per-channel breakdown | — |
| Tool | Description | Parameters |
|---|---|---|
inbox_update_status | Change status: new -> processed -> notified -> archived | id, status |
inbox_archive_old | Auto-archive old processed items | olderThanDays? (default: 30) |
| Tool | Description | Parameters |
|---|---|---|
email_send | Send email via SMTP with optional attachments | to, subject, text, html?, replyTo?, mailbox?, attachments? |
email_reply | Reply to existing inbox thread (auto-threading) | inboxItemId, text, html? |
email_poll | Poll IMAP for unseen emails (read-only) | maxCount?, mailbox? |
| Resource | URI | Description |
|---|---|---|
| Inbox Stats | inbox://stats | Current inbox statistics |
| High Priority | inbox://high-priority | Items needing attention |
Three Prisma models included:
Enums: Channel (web/telegram/email/form), InboxStatus (new/processed/notified/archived), Urgency (low/mid/high)
4 configurable mailboxes, each with its own IMAP user and SMTP sender:
| Mailbox | Sender Name | |
|---|---|---|
hello (default) | hello@{domain} | {org} |
support | support@{domain} | {org} Support |
sales | sales@{domain} | {org} Sales |
info | info@{domain} | {org} Info |
Set EMAIL_DOMAIN and EMAIL_ORG_NAME environment variables to configure.
src/
server.ts — MCP server with 15 tool registrations
core/
db.ts — Prisma database queries (inbox, notes, threads, stats)
email.ts — IMAP polling + SMTP sending + thread replies
lib/
dual-transport.ts — stdio + Streamable HTTP transport
logger.ts — Structured stderr logging
prisma/
schema.prisma — Database schema (3 models, 3 enums)
| Variable | Required | Description |
|---|---|---|
DATABASE_URL | Yes | PostgreSQL connection string |
EMAIL_DOMAIN | No | Email domain (default: example.com) |
EMAIL_ORG_NAME | No | Organization name for sender (default: My Organization) |
IMAP_HOST | No* | IMAP server hostname |
IMAP_PORT | No | IMAP port (default: 993) |
IMAP_PASS | No* | IMAP password |
IMAP_TLS | No | Enable TLS (default: true) |
SMTP_HOST | No* | SMTP server hostname |
SMTP_PORT | No | SMTP port (default: 587) |
SMTP_USER | No* | SMTP username |
SMTP_PASS | No* | SMTP password |
MCP_HTTP | No | Set to 1 to enable HTTP transport |
MCP_PORT | No | HTTP port override (default: 4008) |
MCP_HOST | No | HTTP bind address (default: 127.0.0.1) |
MCP_DEBUG | No | Set to 1 for debug logging |
* Required for email tools (email_send, email_reply, email_poll). Inbox tools work without email configuration.
npm run build
docker build -t mcp-inbox .
docker run -p 4008:4008 \
-e DATABASE_URL="postgresql://..." \
-e MCP_HTTP=1 \
-e EMAIL_DOMAIN=yourdomain.com \
mcp-inbox
MIT
FAQs
AI Inbox Manager — MCP Server with 15 tools. Unified inbox + email send/reply/poll via IMAP + SMTP.
The npm package mcp-inbox receives a total of 0 weekly downloads. As such, mcp-inbox popularity was classified as not popular.
We found that mcp-inbox demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.