Because MailCue is a whole mail stack in a container — Postfix, Dovecot, DKIM signing, DMARC verification, SpamAssassin — the mailbox behaves like a production one rather than a capture bucket, which is what makes it usable both for testing email flows and for handing an agent a genuine address. The single-mailbox lock decides how much rope the agent gets: set, it owns exactly one inbox and cannot address or read another; unset, it can operate the whole server.
The MCP server that ships with MailCue, a full mail stack in one container. It talks to a MailCue server over its REST API and gives an agent a real inbox: folders listed and searched, messages read in full, mail sent and replied to with threading headers set, and messages deleted.
- A mailbox folder listed newest first, each summary carrying the uid the other tools need
- Full-text search across a folder by sender, subject or body content
- One message fetched in full — body, headers and attachment metadata
- A new email sent as plain text or HTML, with cc and reply-to
- A reply by uid, with the recipient, the Re: subject and the In-Reply-To and References headers set for you
- A message deleted permanently, which its own tool description flags as irreversible
- Per-folder totals and unread counts for a mailbox
- The mailboxes on the server listed with their addresses and unread counts, when the agent is not locked to one
- An address validated on structure, DNS status, SMTP mailbox availability and whether it is disposable
- Deliverability tooling documented alongside these — scoring a message, running extended checks, listing and comparing reports, evaluating a policy — which reports a capability as unconfigured rather than inventing a result
A running MailCue server — the whole stack is a single Docker container, reachable at http://localhost:8088 by default — and either MAILCUE_API_KEY, an mc_ key generated from the Profile page, or MAILCUE_BEARER_TOKEN. MAILCUE_BASE_URL points at your server. Launch it with npx -y mailcue-mcp@latest over stdio. The setting worth deciding first is MAILCUE_MAILBOX: with it set the agent is locked to one address — the mailbox argument disappears from every tool, sends are forced to that address, and mailbox discovery is hidden — so leave it unset only when you genuinely want an operator agent that can reach every mailbox on the server.
One command plus a key — npx -y mailcue-mcp@latest, then supply credentials