# @pidgeon-ai/mcp Model Context Protocol server for Pidgeon. A protocol adapter over the API, and nothing more. - **Type:** MCP server - **Trust:** 65/100 (B), scored on the package rubric - **Verification:** verified (build provenance) - **Version:** 0.5.1 - **Author:** Unknown - **License:** MIT - **npm:** @pidgeon-ai/mcp - **Endpoints:** streamable-http https://pidgeon.ai/api/mcp - **Source:** https://github.com/pidgeon-ai/pidgeon-js - **Endpoint health:** reachable (last checked 2026-10-17T11:34:12.819Z, 1 sample) — uptime is not a security property and is not part of the trust score - **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport) ## Trust 65/100 (B), scored on the package rubric - Publisher verified: no - Build provenance: verified attestation - npm trusted publishing (OIDC): yes - Install scripts: suspicious script found - Prompt-injection scan: not run - Obfuscation scan: not run - Evidence age: 0 days ## Security scan - **Status:** warnings - **Scanned:** 2026-10-17T18:26:49.375Z - **Version scanned:** 0.8.0 - **CVEs:** none found by OSV at scan time **Findings** - injection-shaped content (warning) in the `send_message` tool: Exfiltration-shaped instruction ## Tools 26 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `list_addresses` — The addresses this credential can reach. Use `pod_id` to list one pod’s — one of your own customers — or `tenant_id` for your own opaque grouping. - `create_address` - `get_address` — One address, by id. Answers its type, its capabilities, its send policy and its end date, which is how to check what an address is allowed to do before using it - `list_threads` — Conversations in one address, newest first. Filter by `status` for the queue an agent should be working, by `owner_type` for what kind of thing is answering, or - `get_thread` — One conversation, by id. Every webhook payload carries a `thread_id`, so this is how a handler turns an event into the conversation it is about. - `list_messages` — The messages of one conversation, oldest first — the text to read before replying. Bodies are here; attachments are metadata only. - `search_messages` — Full-text search across every address this credential can reach, ranked by relevance. Name an `identity_id` to search exactly one. Every result carries the `ide - `send_message` — Send from an address this credential may send as. Refused if the address’s send policy does not permit the recipient, or if the recipient previously bounced or - `get_message` - `await_message` - `reply_to_message` — The recipients, the subject and the thread are read off the message being answered, so you bring the words and nothing else. Use `to` only to change who it goes - `update_thread` — Who owns a conversation and where it has got to. `owner_type: "human"` hands it to a person — it appears in the web inbox and `thread.updated` tells whatever wa - `update_message` - `list_send_rules` — The allow and block list of one address, and the send policy it hangs off. Read this when a send was refused. - `list_receive_rules` — The rules that decide what reaches one address — reject, spam, trash, archive or inbox, per sender or per domain. Read this when mail you expected did not arriv - `list_folders` — Every folder of one address with its counts. `total` and `unread` are null where we do not count that folder — null is "we do not say", not zero. - `list_folder` — One folder of one address, newest first, a conversation per row — where `list_threads` says which conversations exist, this says where they are filed and what t - `list_changes` — Everything that moved in one mailbox since a `sync_cursor`, arrivals included, so a long-running agent does not re-read a folder to find one new message. `since - `list_events` — Every event across every mailbox this credential reaches — mail received, sent, delivered, bounced, filed. Workspace-wide unless you name an `identity_id`. Pass - `list_labels` — Labels belong to an address, not to the workspace, so the same name on three addresses is three labels with three ids. Read this before applying one. - `create_label` — A label on one address. `colour` is one of eight names — slate, red, amber, green, teal, blue, violet, pink — and defaults to slate; it is not a hex value. - `apply_label` — The label has to belong to the same address the conversation is in — `list_labels` for that address gives you the right id. Applying is how an automation record - `remove_label` — Removes one label from one conversation. The label itself is untouched. - `list_pods` — A pod is a container for one of your own customers: it holds addresses and domains, and **mail sent from it lands on its own sending reputation**, so one custom - `create_pod` — A container for one of your customers, with its own sending reputation. Give it a `name` a person would recognise and, if your own system has an id for this cus - `get_metrics` ## Install **Verdict: do-not-install** — Do not install: 1 injection-shaped pattern found in this entry's own text — it may try to steer the model that loads it. **Blocking** - 1 injection-shaped pattern found in this entry's own text — it may try to steer the model that loads it. — tool:send_message: Exfiltration-shaped instruction **Client configuration withheld.** Client configs are withheld because this entry has a blocking finding. Show the warnings below to the person installing it. If they have seen the findings and still want to proceed, request the plan again with acknowledge_warnings=true. ## Blast radius Extensive blast radius — deletes data; runs locally and hosted. - Floor 56, ceiling 56 (tier: extensive) - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/%40pidgeon-ai%2Fmcp - Install plan: https://forgeregistry.com/api/v1/packages/%40pidgeon-ai%2Fmcp/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/%40pidgeon-ai%2Fmcp - HTML page: https://forgeregistry.com/registry/%40pidgeon-ai%2Fmcp - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.