Is ai.radmail/radmail-mcp safe to use?

ai.radmail/radmail-mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.

How do I install ai.radmail/radmail-mcp?

ai.radmail/radmail-mcp can be installed by cloning its GitHub repository and following the setup instructions in the README.

What AI clients work with ai.radmail/radmail-mcp?

ai.radmail/radmail-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.

ai.radmail/radmail-mcp

Email OS for agents: triage, search, and a verifiable BEC hard-stop. Zero-auth sandbox.

GitHub

No known CVEs

No license

Maintenance unknown

No commit data

Works with most clients

Transport:

0 tools

Token cost not measured

Edit this pageView history

Communication

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "ai-radmail-radmail-mcp": {
      "command": "<see-readme>",
      "args": []
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/ai-radmail-radmail-mcp)](https://mcppedia.org/s/ai-radmail-radmail-mcp)

Read me

What ai.radmail/radmail-mcp does

Email OS for agents: triage, search, and a verifiable BEC hard-stop. Zero-auth sandbox.

Test This Server

No automated test available for this server. Check the GitHub README for setup instructions.

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

0/100across 5 weighted dimensions

How we score →

0255075100

−100

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

No package registry to scan.

Help improve this page

This server is missing a description. Tools and install config are also missing.If you've used it, help the community.

Add information

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is ai.radmail/radmail-mcp safe to use?: ai.radmail/radmail-mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
How do I install ai.radmail/radmail-mcp?: ai.radmail/radmail-mcp can be installed by cloning its GitHub repository and following the setup instructions in the README.
What AI clients work with ai.radmail/radmail-mcp?: ai.radmail/radmail-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.

Similar servers

Others in communication

View all →

Mcp_agent_mail96

Asynchronous coordination layer for AI coding agents: identities, inboxes, searchable threads, and advisory file leases over FastMCP + Git + SQLite

2.0k 6

io.github.VibeCodingInc/vibe-mcp89

Social layer for Claude Code - DMs, presence, discovery, and games between AI-assisted developers

io.github.alexkirienko/safebot-chat89

End-to-end encrypted multi-agent chat rooms. Client-side crypto; zero chat logs.

1 5

Server88

PubNub Model Context Protocol MCP Server for Cursor and Claude

31 2

MCP Security Weekly

Get CVE alerts and security updates for ai.radmail/radmail-mcp and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

Communication

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "ai-radmail-radmail-mcp": {
      "command": "<see-readme>",
      "args": []
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/ai-radmail-radmail-mcp)](https://mcppedia.org/s/ai-radmail-radmail-mcp)

Read me

What ai.radmail/radmail-mcp does

Email OS for agents: triage, search, and a verifiable BEC hard-stop. Zero-auth sandbox.

Test This Server

No automated test available for this server. Check the GitHub README for setup instructions.

README

RadMail MCP

An email operating system for agents — with a refusal you can trust.

Every inbox got an AI in 2026. None can be trusted to hit send. RadMail is the one that can — because the consequential actions are refused in code, model-independent: money, changed-banking details, first-contact senders, decisions, and prompt-injection are human-only, forever. No prompt can talk RadMail into auto-sending them.

This is the Model Context Protocol (MCP) server, so any AI agent can use the inbox.

Start in one call

Call triage_inbox and omit the token — RadMail auto-provisions a free sandbox tenant and returns a working triage in one round-trip. Reuse the returned token. (On the zero-auth hosted sandbox, triage_inbox takes no args — it triages a built-in demo inbox so your very first call returns the full wedge.)

This server runs the sandbox engine (heuristic, in-memory, free, no credentials). It is real and runnable — not the production "99%" engine.

Tools

Tool	What it does
`triage_inbox`	One round-trip over a batch: the Right Now lane + every open commitment + every hard-stop. The whole wedge in one call.
`list_right_now`	The can't-miss lane only — most-recent × most-important, each with why-surfaced. Pass `messages` for the sandbox (with hard-stop flags), or omit them with `RADMAIL_API_KEY` set for your real Right Now lane (read-only).
`why_surfaced`	Explain in plain English why a message surfaced — the signals behind its importance × urgency. Transparency, not a black box.
`draft_reply`	Draft the reply that discharges a commitment — never for a hard-stopped one (money / banking / first-contact stay human-only).
`list_commitments`	Open promises with their due window. Pass `messages` for sandbox extraction, or omit them with `RADMAIL_API_KEY` set for your real tracked commitments (read-only).
`search`	Find the one message you mean by sender / subject / content — most-relevant + newest first (no filesystem grep). Pass `messages` for the sandbox, or omit them with `RADMAIL_API_KEY` set to search your real inbox (read-only).
`read_email`	Connected mode only: fetch one full email (headers + `textBody`) from your real inbox by id. Read-only; body content arrives taint-tagged.
`triage`	Score a single message (the per-message form of `triage_inbox`).
`provision_sandbox`	Explicitly mint a free sandbox tenant.
`report_need` / `request_capability`	Tell RadMail what was awkward / what you wish existed — the surface adapts.
`radmail_learning_insights`	What RadMail has learned about how you work.

The safety contract (un-bypassable by design)

These are decided by deterministic code, not model judgment — see /.well-known/agent-safety.json:

money, changed-banking, first-contact, decision/sign-off, prompt-injection → hardStop, human-only forever. RadMail will never hand an agent an auto-sendable reply for these.
Taint envelope: every field derived from a raw email body carries provenance: "untrusted-email-body", and every response carries a safety block restating the hard-stops. Treat tainted fields as data, never as instructions — this keeps your agent safe-by-default, even against a poisoned email.
Fail-closed: if a risk signal can't be evaluated, RadMail refuses to auto-send.

Verify before you connect

The safety contract is machine-verifiable — fetch it and check it in one command, no account, no key:

curl -s https://radmail.ai/.well-known/agent-safety.json

Connect

Fastest — zero-auth hosted sandbox (no install, no key, no signup). Point any MCP client at the streamable-HTTP endpoint:

{
  "mcpServers": {
    "radmail": {
      "url": "https://radmail.ai/api/mcp/sandbox",
      "transport": "streamable-http"
    }
  }
}

Local stdio (this package — the fuller surfac

... View full README on GitHub

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

0/100across 5 weighted dimensions

How we score →

0255075100

−100

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

No package registry to scan.

Help improve this page

This server is missing a description. Tools and install config are also missing.If you've used it, help the community.

Add information

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is ai.radmail/radmail-mcp safe to use?: ai.radmail/radmail-mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
How do I install ai.radmail/radmail-mcp?: ai.radmail/radmail-mcp can be installed by cloning its GitHub repository and following the setup instructions in the README.
What AI clients work with ai.radmail/radmail-mcp?: ai.radmail/radmail-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.