A real inbox for AI agents: send, receive and thread email, behind a prompt-injection firewall.
Inferred from the transports this listing declares (stdio). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.
MAILS_API_KEYAPI keyrequiredYour mails.ai API key. Use an mk_test_ key to run against the sandbox or an mk_live_ key to send real mail. Free key at https://mails.ai
Declared by the author in the official MCP registry. Forge does not store, broker, or ever see these values — the config below is scaffolded with placeholders you fill in locally.
Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.
Read out of the source npm actually ships, at scan time. The package was never executed. Tools registered dynamically at runtime, or hidden inside bundled or minified code, can be missed — so this is a floor on the tool surface, not a complete census of it.
mails.sendSend an email. `agent` is OPTIONAL: omit it and the workspace's single agent is used, or one is created for you (named from `from`) — so a first send needs no setup. Pass `agent` only when the workspace has several and you must say which. The reputation firewall runs on every send: an agent auto-su…Send an email. `agent` is OPTIONAL: omit it and the workspace's single agent is used, or one is created for you (named from `from`) — so a first send needs no setup. Pass `agent` only when the workspace has several and you must say which. The reputation firewall runs on every send: an agent auto-su…
No input schema was published for this tool.
mails.replyReply to a previously-received message. Sets In-Reply-To + Re: subject server-side.Reply to a previously-received message. Sets In-Reply-To + Re: subject server-side.
No input schema was published for this tool.
mails.forwardForward a message to new recipients.Forward a message to new recipients.
No input schema was published for this tool.
mails.list_threadsList threads (conversations) for the workspace or a specific agent.List threads (conversations) for the workspace or a specific agent.
No input schema was published for this tool.
mails.get_threadGet a full thread with all messages in chronological order.Get a full thread with all messages in chronological order.
No input schema was published for this tool.
mails.list_receivedList recently received messages.List recently received messages.
No input schema was published for this tool.
mails.get_receivedGet one received message including extracted reply text.Get one received message including extracted reply text.
No input schema was published for this tool.
mails.list_agentsList the agents in the workspace. Returns SENDABLE agents by default (status=live); archived agents cannot send, so they are excluded unless you ask for them. Pass status="all" to see archived ones too.List the agents in the workspace. Returns SENDABLE agents by default (status=live); archived agents cannot send, so they are excluded unless you ask for them. Pass status="all" to see archived ones too.
No input schema was published for this tool.
mails.create_agentCreate a new agent.Create a new agent.
No input schema was published for this tool.
mails.list_repliesList recent reply events (reply.received) for an agent.List recent reply events (reply.received) for an agent.
No input schema was published for this tool.
mails.list_messagesList recent cold/first-contact inbound (message.received) for an agent — senders that are NOT replying to one of your sends.List recent cold/first-contact inbound (message.received) for an agent — senders that are NOT replying to one of your sends.
No input schema was published for this tool.
mails.get_eventGet a specific inbound event by ID.Get a specific inbound event by ID.
No input schema was published for this tool.
mails.get_reputationGet an agent's sending-reputation health (0-1) + its 30-day bounce/complaint/reply counts. The firewall auto-suspends an agent that crosses a 0.3% complaint rate — well before the upstream provider's 0.5% line — so check this to catch an at-risk agent before it gets paused.Get an agent's sending-reputation health (0-1) + its 30-day bounce/complaint/reply counts. The firewall auto-suspends an agent that crosses a 0.3% complaint rate — well before the upstream provider's 0.5% line — so check this to catch an at-risk agent before it gets paused.
No input schema was published for this tool.
mails.check_suppressionCheck if an address is suppressed.Check if an address is suppressed.
No input schema was published for this tool.
mails.allowlist_addressOverride suppression for one address with a >=20 char attestation.Override suppression for one address with a >=20 char attestation.
No input schema was published for this tool.
mails.create_draftStage a draft. Optionally pass send_at to schedule.Stage a draft. Optionally pass send_at to schedule.
No input schema was published for this tool.
mails.send_draftSend a previously-created draft.Send a previously-created draft.
No input schema was published for this tool.
mails.get_usageGet the current billing period usage.Get the current billing period usage.
No input schema was published for this tool.
mails.meWho am I — returns the authenticated workspace, agent, tier, and API-key scopes. Call this first to confirm the connection is live.Who am I — returns the authenticated workspace, agent, tier, and API-key scopes. Call this first to confirm the connection is live.
No input schema was published for this tool.
mails.test_inboundNo description publishedThis tool published no description. Forge does not invent one.
19 of 20 tools published a description.
Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.
A real inbox for AI agents: send, receive and thread email, behind a prompt-injection firewall.
Linked names open Forge’s index of every entry observed exposing that tool. Browse all indexed tools.
The crawl stopped at the depth-4 limit. Anything below that level was never resolved.
The crawl stopped at the 60-package limit. The rest of the tree was never resolved.
36 more resolved packages are not drawn here (display cap: 24). Every dependency carrying an advisory is drawn regardless of the cap. Full inventory (CycloneDX SBOM)
54 declared dependencies never landed in the tree. They are missing from Forge's resolution, not from the package.
+42 more not listed. The counts by reason above cover all of them.
Not followed: peerDependencies. This tree covers runtime dependencies only, so anything those pull in was never resolved.