MCP

Email Inbox API + Sending by Sendmux

Email inbox API, inbound mail, and outbound sending MCP and A2A servers for AI agents, with inbound email, clean JSON parsing, webhooks, and multi-provider routing through Sendmux.

This package is the Sendmux MCP. Keep it separate from any documentation-search MCP used by docs tooling.

Documentation

• Sendmux docs: sendmux.ai/docs
• Management API reference: sendmux.ai/docs/api/introduction
• Mailbox API reference: sendmux.ai/docs/mailbox-api/introduction
• Sending API reference: sendmux.ai/docs/sending-api/introduction
• Source repository: Sendmux/sendmux-sdk

Requirements

• Python 3.10 or newer.
• A send-capable smx_mbx_* key or owner-approved Sending-resource smx_agent_* token for Sending tools.
• A mailbox-scoped smx_mbx_* key or scoped smx_agent_* token for Mailbox tools.
• A root smx_root_* key for Management tools.

2.0.0 upgrade

Version 2.0.0 removes local file_path and roots inputs from MCP attachment tools. Before upgrading a self-managed package or server, retain the prior known-working package environment, dependency state, and MCP client and tool configuration. Update attachment callers to use the attachment workflow for agents, then verify tool discovery and each attachment workflow your agents use.

To roll back a self-managed installation, restore the retained package environment, dependency state, and MCP client and tool configuration together. Verify tool discovery and the relevant attachment workflow before resuming agents. A package rollback doesn't reverse uploads or sends that have already completed.

For clients that use Sendmux's hosted endpoint, changing a local pip environment doesn't change the deployed server version. A hosted deployment rollback is a separate operator release action and must be verified against the hosted endpoint.

Installation

pip install sendmux-mcp

Usage

Run a single local server with the per-surface commands.

SENDMUX_API_KEY=smx_mbx_... sendmux-mcp-mailbox
SENDMUX_API_KEY=smx_root_... sendmux-mcp-management
SENDMUX_API_KEY=smx_mbx_... sendmux-mcp-sending

Run a combined local server with sendmux-mcp.

SENDMUX_MCP_SURFACES=mailbox,sending \
SENDMUX_MAILBOX_API_KEY=smx_mbx_... \
SENDMUX_SENDING_API_KEY=smx_mbx_... \
sendmux-mcp

Run all three local surfaces when you have both key types.

SENDMUX_MCP_SURFACES=mailbox,management,sending \
SENDMUX_MAILBOX_API_KEY=smx_mbx_... \
SENDMUX_MANAGEMENT_API_KEY=smx_root_... \
SENDMUX_SENDING_API_KEY=smx_mbx_... \
sendmux-mcp

The generic sendmux-mcp command also accepts --surface or --surfaces. The wrapper commands select exactly one surface.

Transports

stdio is the default transport for local agent clients.

SENDMUX_API_KEY=smx_mbx_... sendmux-mcp-mailbox --transport stdio

http and streamable-http expose the MCP endpoint over HTTP. HTTP mode defaults to 127.0.0.1:8765/mcp and requires a separate MCP bearer token unless you explicitly opt out.

SENDMUX_API_KEY=smx_mbx_... \
SENDMUX_MCP_HTTP_BEARER_TOKEN=local-mcp-token \
sendmux-mcp-mailbox --transport http --host 127.0.0.1 --port 8765 --path /mcp

/health returns a small JSON health response for the selected surfaces.

Hosted Endpoint

The public hosted MCP endpoint is https://mcp.sendmux.ai/mcp.

For hosted clients, use HTTP transport with OAuth. Do not add manual Authorization headers, API keys, custom OAuth endpoints, or custom scopes unless your client explicitly requires them.

Hosted OAuth clients that omit requested scopes during registration or authorization are supported; the server advertises the hosted scope set through discovery and bearer challenges.

The packaged sendmux-mcp-hosted command runs the hosted server runtime. Local and private deployments should use the local commands above unless you are operating a compatible OAuth-backed hosted environment.

Hosted A2A Endpoint

The same hosted runtime exposes deterministic A2A 1.0 over HTTP+JSON at https://a2a.sendmux.ai/a2a/v1. Discover it from https://a2a.sendmux.ai/.well-known/agent-card.json; OAuth resource metadata is at https://a2a.sendmux.ai/.well-known/oauth-protected-resource.

Send exactly one JSON DataPart to the A2A message:send operation. Its data selects a curated Sendmux operation and supplies that operation's inputs:

{
  "operationId": "managementListDomains",
  "pathParameters": {},
  "query": { "limit": 10 },
  "headers": {},
  "body": null,
  "mailboxId": null
}

operationId uses the same curated operation IDs as the hosted MCP service. OAuth grants are audience-bound to the A2A resource and retain their Sendmux surface and permission limits. The service returns one JSON DataPart containing the upstream status, safe response headers, and JSON body (or bodyBase64 for non-JSON responses).

The A2A endpoint is immediate and stateless: streaming, push notifications, persistent tasks, and task cancellation are not advertised or routed.

Configuration

Retries honour Retry-After and X-RateLimit-Reset without applying the local backoff ceiling, and stop for retryable: false. Set the optional retry budget with RetryConfig(max_elapsed_seconds=30), the environment variable above, or --retry-max-elapsed-seconds 30. A retry that would exceed the remaining budget returns the original error; in-flight requests keep their normal HTTP timeouts.

Packaged OpenAPI snapshots are the default so released tool names, schemas, and descriptions stay stable. Path, directory, and URL overrides are available for development, canary, and debugging runs.

Tool Surfaces

• Mailbox: tools for granted mailboxes, profile/session discovery, messages, attachments, bounded message waits, threads, folders, search, counts, and mailbox sends. Requires an smx_mbx_* key or scoped smx_agent_* token. Agent tokens remain limited by server-side scopes; pre-claim self-registered agent tokens do not include email.send.
• Management: tools for domains, mailboxes, logs, metrics, spend summary, and webhooks. Requires an smx_root_* key.
• Sending: tools for attachment upload refs, single sends, and batch sends. Requires an smx_mbx_* key or owner-approved Sending-resource smx_agent_* token.

The server rejects keys with the wrong prefix before starting.

Package Contract For Maintainers

The source checkout includes sendmux_mcp/mcp-contract.json, generated from the actual server factory's public tool discovery. Use its tools.by_surface entries and tools.count instead of maintaining a separate catalogue. Each entry retains the tool's description, input/output schemas, and annotations. The contract also separates hosted resource, local transports, API origins, certified protocol revisions, and the runtime versions used during generation.

After installing a build that contains the contract, read it without credentials or network requests:

from sendmux_mcp.contract import load_contract

contract = load_contract()
print(contract["package"])

The result identifies the installed distribution and version. load_contract() raises ValueError for stale source/version evidence, a mismatched pinned FastMCP runtime, or unsupported certified revisions. The recorded transitive MCP version is provenance, not a narrower dependency constraint. Reading the artifact does not certify a newly resolved dependency version or prove a deployed service matches this build.

uploads distinguishes the locally enforced inline and Mailbox byte caps from Sending's returned max_size_bytes authority. The Sending presign request schema does not impose a numeric maximum; use the upload intent response, not a historical source constant. URL expiry and physical attachment retention are not equivalent, and this artifact does not certify storage cleanup.

From the repository root, pnpm generate:mcp refreshes native editable metadata and writes deterministic contract bytes. With that environment prepared, pnpm exec .tmp/python-venv/bin/python -m sendmux_mcp.contract --check checks freshness without rewriting. pnpm build:mcp verifies tests, wheel/sdist inclusion, installed consumption, and frozen conformance checks. Checkout changes are not available through pip install until their release is published.

Attachment Workflow For Agents

Use mailbox_wait_for_message when a user asks an agent to wait for new mail. The tool is bounded; if it returns matched=false, call it again rather than holding an MCP tool call open indefinitely.

When a message has attachments:

1. Call mailbox_read_attachment with message_id and attachment_id when you need the attachment contents.
2. For small text-like attachments, read the returned text.
3. For binary or oversized attachments, use the returned resource_link / download_url promptly outside model context.
4. Use mailbox_get_attachment only when metadata is enough or you need to refresh the link.

Use mailbox_upload_attachment for outbound attachments over MCP. It accepts exactly one input mode:

• presign_upload_url=true for hosted MCP or shell-capable agents; upload the file to the returned URL with exact headers and no API key, then send with the returned blob_id.
• content_base64 only for tiny agent-authored files, capped at 32 KiB decoded. If it is too large, switch to a presigned upload, CLI --attach, or SDK file helpers.

Presigned uploads use the mailbox attachment cap, currently 7,500,000 bytes per attachment, and pin the exact declared byte length and content type.

For mailbox sends, mailbox_send_message accepts either tiny inline base64 attachment objects (content, filename, content_type) or uploaded attachment references (blob_id, filename, content_type).

For Sending API sends, use sending_upload_attachment only for tiny inline content, or call sending_create_attachment_upload and PUT bytes outside model context. Then pass {"attachment_id": "att_..."} in sending_send_email.attachments[].

Console Scripts

• sendmux-mcp
• sendmux-mcp-mailbox
• sendmux-mcp-management
• sendmux-mcp-sending
• sendmux-mcp-hosted

Support

Open an issue in Sendmux/sendmux-sdk with the package name, version, command, transport, and request ID from any API error.

Licence

MIT. See the licence file.