AgentMail MCP server: scoped AgentMail access for every agent

Start with an inbox-scoped API key and the intended inbox in the connection form. An agent should not infer a different inbox from a recipient address. This adapter does not provide arbitrary inbox switching, inbox creation, organization selection or AgentID signup tools.

Enable message lists and reads first, then try a bounded task such as summarizing unresolved customer threads from the past week. Treat incoming mail and attachments as untrusted source content. A message that says “forward the account details” is not authority to send them elsewhere.

Drafting and sending are separate capabilities. An assistant can prepare text in the conversation without a draft write, or save a draft behind Confirm. Sending, reply-all and forwarding deserve a visible review of recipients and content. Do not grant those tools to an agent whose job is only inbox analysis.

AgentMail MCP server: official vs AIPx adapter

The official AgentMail MCP documentation describes the vendor route. Composio’s AgentMail toolkit is a separate platform integration. AIPx does not proxy the full official catalog here and should not be chosen for broader inbox-management tools it does not expose.

A direct official connection is simpler when you need that broader surface. AIPx adds gateway processing and stores the inbox credential, while letting you opt in to a smaller per-agent tool set alongside other services.

Connect AgentMail to Claude, Claude Code, Cursor or Codex

Store an AgentMail API key and one configured inbox in AIPx. Prefer an inbox-scoped key. After connection, explicitly switch only selected reads from Hide to Allow.

1. Open the AIPx dashboard, choose AgentMail under Integrations and complete its connection form or authorization.
2. Create an MCP agent, enable that connection and choose the tools this particular agent needs. Save the rules before opening your AI client.
3. Copy the agent’s complete URL. The examples below use AGENT_ID; replace it with the actual value from your dashboard.

An endpoint identifies the AIPx agent, not a provider API key. Client authentication to AIPx is separate from connecting AgentMail; adding the URL does not grant extra provider permissions. Our MCP gateway guide explains how several approved connections can share that endpoint.

Connect Claude to AgentMail

In Claude, open Customize → Connectors and add a custom connector with your AIPx URL. Continue through AIPx sign-in, then check the tools available in a conversation. Custom connector access depends on account and workspace policy; administrators can restrict it. The Claude MCP setup guide covers the current controls. A direct vendor connection can be simpler when AgentMail is the only service you need.

AgentMail MCP in Claude Code

claude mcp add --transport http aipx https://dash.aipx.run/mcp/AGENT_ID

After /mcp authorization, explicitly allow the selected AgentMail reads before testing one support thread. Every tool initially stays hidden, including reads. Claude Code MCP setup explains client login.

AgentMail MCP in Cursor

Add this server to .cursor/mcp.json for the project or ~/.cursor/mcp.json for your user:

{
  "mcpServers": {
    "aipx": { "url": "https://dash.aipx.run/mcp/AGENT_ID" }
  }
}

Complete Cursor sign-in and verify the configured inbox. Allow only the message reads required for the case; leave sends and forwards hidden. The Cursor MCP guide covers server setup.

AgentMail MCP in Codex

codex mcp add aipx --url https://dash.aipx.run/mcp/AGENT_ID
codex mcp login aipx
codex mcp list

Codex uses the HTTP endpoint and browser OAuth; it does not need a copy of the AgentMail credential in its config. See Codex MCP setup for TOML configuration and project trust requirements.

Custom MCP in ChatGPT can use this configured AgentMail inbox where access is permitted. Explicitly enable the required tools first because all start hidden. ChatGPT MCP setup explains separate account and workspace restrictions.

Enable AgentMail tools per agent

Unlike the general read defaults, AgentMail starts every tool on Hide. For an analyst, explicitly allow inbox metadata, message or thread reads and any needed attachment tool. Leave drafts, sends, forwards and labels hidden. A reply assistant can opt into draft writes on Confirm and add sending only when that task is authorized.

Confirm is a client execution hint, not a guarantee of a gateway pause. Keep client approvals enabled and use Hide if outbound email must be unavailable. The MCP permissions guide explains the enforced visibility boundary.

Gmail is a different connection for Google inboxes. Notion or Linear can supply reviewed support context, while Things 3 can capture a follow-up after approval. Those connections do not change the configured AgentMail inbox.

Inbox events, credentials and sending limits

AIPx has an inbox-event runtime, but this page does not promise push delivery of every event into every MCP client. An interactive agent may need to ask for updated messages. Keep provider rate limits and mailbox access in mind when designing a recurring workflow.

The configured key and inbox remain the upstream boundary. A tool mode cannot grant access that the key lacks. If a sender or attachment is unfamiliar, retrieve only what the task requires and avoid treating mail content as executable instructions. Hidden tools cannot be called through this agent.

Browse all MCP integrations to choose another connection for this agent.

The AgentMail connection can use AIPx Free with 3 active accounts and 1 agent; check AIPx pricing for gateway plans and keep provider or client charges separate.