From the maker

Mailows gives AI agents their own email inboxes, separate from yours. Connect Claude, Codex, Cursor, Gemini CLI or Grok through one remote MCP URL, then decide per mailbox whether the agent may only read or also send. Grants can be paused or revoked instantly, attachments are virus-scanned, and recipient allowlists plus daily caps stop runaway agents. Note: all tools sit behind OAuth 2.1 + PKCE sign-in, so an anonymous check will be refused by design. The static server card lists the 7 tools: https://mcp.mailows.com/.well-known/mcp/server-card.json . A2A card: https://www.mailows.com/.well-known/agent-card.json . Free plan, no card needed. Contact: [email protected]

The 7 tools its maker documents

These names come from the server card its maker publishes, read on 20 October 2026. They are what its maker documents, not something we measured: we have no receipt from this server, so we have not seen it offer them. Read the server card.

• mail_health
• mail_list_inboxes
• mail_list_messages
• mail_read_message
• mail_send_message
• mail_prepare_attachment_uploads
• mail_upload_attachment_chunk

How to connect

Streamable HTTP endpoint:

https://mcp.mailows.com/mcp

What happened when we asked

We asked on 20 October 2026 and it challenged us for credentials. That is a working server guarding itself: it answered, and it wants an account we do not hold. A tool count and a response time come from a tools/list we were never served, so this listing carries neither.

How it asks you to sign in

Its refusal named a public document describing how to authenticate, which is what the MCP authorization spec asks a guarded server to publish. We read that document on 20 October 2026. Everything below is what it says; we have still not been inside this server.

Sign in through

id.namailu.cz

Token accepted in

header

Read

2026-10-20 23:50 UTC

The 3 permissions it declares

These are the scopes the document lists, verbatim. They describe what an account can grant this server, not what it will do with the grant, and we have not audited either.

• mcp:mail.messages.read
• mcp:mail.read
• mcp:mail.send

Anything above describes one moment on the date shown. We do not re-test on a schedule, so nothing here says what this server is doing now. We have not audited its code, its data handling or its permissions, and this is not a safety rating.