# io.inboxguard/email-deliverability

Scan and fix a domain's email deliverability (SPF, DKIM, DMARC, MTA-STS, BIMI, DNS blocklists).

- **Type:** MCP server
- **Trust:** 30/100 (D), scored on the content rubric
- **Verification:** community-indexed — nobody has claimed this listing
- **Version:** 1.2.0
- **Author:** io.inboxguard
- **License:** Unknown
- **Endpoints:** streamable-http https://mcp.inboxguard.io/mcp
- **Source:** https://mcp.inboxguard.io/mcp
- **Endpoint health:** reachable (last checked 2026-09-30T00:24:11.218Z, 6 samples) — uptime is not a security property and is not part of the trust score
- **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport)

## Trust

30/100 (D), scored on the content rubric
- Publisher verified: no
- Install scripts: suspicious script found
- Prompt-injection scan: findings present
- Obfuscation scan: clean
- Evidence age: 33 days

## Security scan

- **Status:** warnings
- **Scanned:** 2026-09-02T21:17:57.203Z
- **Version scanned:** live
- **CVEs:** no coverage — this entry has no package coordinates to query OSV against, so "no known CVEs" is NOT asserted for it.
**Findings**
- injection-shaped content (note) in the `create_share_link` tool: Links to undeclared domain: inboxguard.io
- injection-shaped content (note) in the `connect_snds` tool: Links to undeclared domain: sendersupport.olc.protection.outlook.com
- injection-shaped content (warning) in the `get_deliverability_report` tool: Exfiltration-shaped instruction

## Tools

28 declared. Observed from a live `tools/list` probe.
- `scan_domain` — Run a full email-deliverability scan (SPF, DKIM, DMARC, MTA-STS, TLS-RPT, MX TLS, BIMI, DNS blocklists) for a domain and return a 0-100 score with per-check fin
- `get_deliverability_score` — Return the overall deliverability score and letter grade for a domain (runs a fresh scan).
- `check_blocklists` — Check a domain (apex + MX-host IPs) against supported DNS blocklists and return listings, targets checked, and issues (authoritative-side queries; no public-res
- `get_dmarc_summary` — Summarize ingested DMARC aggregate (RUA) reports for a domain tracked in your InboxGuard account: report volume, pass rate, top sending sources, and the rua inb
- `list_domains` — List the account's tracked domains with latest scan score, last scan time, and open alert count.
- `get_domain` — Full detail for one tracked domain: the domain record, the latest scan with all per-check findings (spf, dmarc, dkim, ptr, mta_sts, tls_rpt, mx_tls, blocklist),
- `list_alerts` — List the account's deliverability alerts (score drops, check failures, blocklist listings). Defaults to open alerts only.
- `list_scans` — List recent scans (id, domain, run time, score) across all tracked domains, or for one domain when a name is given.
- `resolve_alert` — Mark an alert resolved (or reopen it with resolved=false). Requires an API key with write/full scope. Resolving an already-resolved alert is a no-op.
- `get_dns_fix_plan` — Compute the exact DNS-record changes needed to fix a tracked domain's deliverability, based on its latest scan and the org's connected registrar (Cloudflare/Rou
- `apply_dns_fix` — Apply a DNS fix plan to a tracked domain by publishing records at the connected registrar. DESTRUCTIVE: it creates/updates/deletes DNS records. Two-step by desi
- `analyze_headers` — Re-verify SPF, DKIM, DMARC, and ARC from a raw RFC 5322 email (full message or just the headers block). Returns InboxGuard's independent verdict (`ours`), the s
- `scan_domains_batch` — Queue an asynchronous batch scan of up to 50 domains and get a jobId immediately (avoids the 30s per-call limit). Poll get_scan_job with the jobId until status 
- `get_scan_job` — Poll an async batch scan started with scan_domains_batch: returns status (queued/running/succeeded/partial/failed), completed count, and per-domain results (dom
- `remove_domain` — Stop monitoring a domain and delete it (and its scan history) from the account. DESTRUCTIVE and not reversible. Requires an owner/admin API key with write or fu
- `list_registrar_connections` — List the registrar accounts (Cloudflare, Route 53, GoDaddy, Namecheap) connected to the org — provider, verification, last-used time — plus the supported provid
- `create_notification_channel` — Create a channel that InboxGuard alerts are delivered to: webhook (HMAC-signed), Slack, Microsoft Teams, PagerDuty, SMS, or email. Returns the channel id, and f
- `create_share_link` — Create a read-only public share link for a tracked domain's latest report (anyone with the URL can view it; no account). Returns a `token` and the public `url` 
- `connect_snds` — Store this org's Microsoft SNDS (Smart Network Data Services) automated-data-access key so InboxGuard syncs per-IP Outlook/Hotmail reputation daily. Get the key
- `get_snds_status` — Report whether Microsoft SNDS is connected for the org, the last sync time + status, how many sending IPs are tracked, and how many are currently blocked by Out
- `get_snds_ip_stats` — Return the latest per-IP reputation from Microsoft SNDS for the org's sending IPs: filter result (GREEN/YELLOW/RED), complaint-rate band, spam-trap hits, messag
- `connect_inbox_placement` — Store the org's seed-list inbox-placement provider + API key (provider: 'mailreach' or 'glockapps'; GlockApps also needs projectId). Enables start_inbox_placeme
- `get_inbox_placement_status` — Report whether a seed-list inbox-placement provider is connected for the org, which provider, and how many tests have run. Lists the supported providers when no
- `start_inbox_placement_test` — Start a seed-list inbox-placement test. Returns a testId, the seed addresses to mail your campaign to, and (if the provider requires it) a header to insert. Aft
- `get_inbox_placement_test` — Poll a seed-list inbox-placement test by testId. Returns status (running/completed/failed) and, once measured, the Inbox/Spam/Missing counts and inbox-placement
- `list_inbox_placement_tests` — List recent seed-list inbox-placement tests for the org (most recent first) with their status and Inbox/Spam/Missing scores.
- `get_deliverability_report` — Return a structured deliverability report for a tracked domain: the latest score + letter grade + `scoreSubtitle` (explains the denominator when a check was exc
- `get_portfolio` — Org-wide deliverability rollup across every monitored domain: average score + overall grade, the grade distribution (how many domains are A/B/C/D/F/unscored), t

## Install

**Verdict: do-not-install** — Do not install: 1 injection-shaped pattern found in this entry's own text — it may try to steer the model that loads it.
**Blocking**
- 1 injection-shaped pattern found in this entry's own text — it may try to steer the model that loads it. — tool:get_deliverability_report: Exfiltration-shaped instruction
**Cautions** (coverage gaps and advisories — never blocking)
- No CVE coverage: this entry has no npm/PyPI coordinates to query OSV against, so "no known vulnerabilities" is not a claim that can be made about it.
- No publisher has proved control of this listing; it is indexed, not vouched for.
**Client configuration withheld.** Client configs are withheld because this entry has a blocking finding. Show the warnings below to the person installing it.
If they have seen the findings and still want to proceed, request the plan again with acknowledge_warnings=true.

## Blast radius

Moderate to extensive — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: deletes data; runs on someone else's infrastructure.
- Floor 32, ceiling 56 (tier: unknown)
- `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low.
- This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score.

## Machine-readable views of this entry

- Signed JSON: https://forgeregistry.com/api/v1/packages/io.inboxguard%2Femail-deliverability
- Install plan: https://forgeregistry.com/api/v1/packages/io.inboxguard%2Femail-deliverability/install-plan
- Alternatives: https://forgeregistry.com/api/v1/alternatives/io.inboxguard%2Femail-deliverability
- HTML page: https://forgeregistry.com/registry/io.inboxguard%2Femail-deliverability
- MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan`

## About this document

Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.