MCP email server for Claude, ChatGPT and Cursor
Flinkk Mail runs a remote MCP server at https://mail.flinkk.io/api/mcp. Connect an AI client with an agent key and it can work in the inboxes you grant it, under permissions you set, with a person approving drafts.
How it connects
The server speaks MCP over Streamable HTTP and authenticates with a Bearer agent key (ag_live_…). Create the key under Agents in Flinkk Mail; it is shown once. The server is stateless, so there is nothing to keep alive. Every tool call goes through the same scopes, grants, limits and audit log as the REST API.
URL: https://mail.flinkk.io/api/mcp
Header: Authorization: Bearer ag_live_…Set up your client
Claude Desktop
Edit claude_desktop_config.json. This uses the mcp-remote bridge, which adds the Authorization header:
{
"mcpServers": {
"flinkk-mail": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://mail.flinkk.io/api/mcp", "--header", "Authorization:${FLINKK_AUTH}"],
"env": { "FLINKK_AUTH": "Bearer ag_live_…" }
}
}
}Claude Code
claude mcp add --transport http flinkk-mail https://mail.flinkk.io/api/mcp \
--header "Authorization: Bearer ag_live_…"Cursor
Add to ~/.cursor/mcp.json (or .cursor/mcp.json in a project):
{
"mcpServers": {
"flinkk-mail": {
"url": "https://mail.flinkk.io/api/mcp",
"headers": { "Authorization": "Bearer ag_live_…" }
}
}
}ChatGPT
In ChatGPT, add a custom connector (Settings, Connectors; developer mode may be required on your plan) and enter https://mail.flinkk.io/api/mcp as the server URL. Flinkk Mail authenticates with a bearer key and does not offer OAuth yet. If the connector form for your plan has no way to send a custom Authorization header, use the REST API from a GPT action or your own code instead. ChatGPT's connector options change often, so check OpenAI's current docs.
The eleven tools
| Tool | What it does |
|---|---|
| list_inboxes | The inboxes this agent may use. |
| list_threads | Threads in an inbox, with unread, label and text filters. |
| read_thread | Messages in a thread, as LLM-ready text. |
| search_emails | Search sender, subject and text. |
| draft_reply | Create a reply draft (pending approval in draft-only mode). |
| send_draft | Send a draft that is approved or in an auto-send inbox. |
| reply | Draft and send in one step, under the same rules. |
| draft_email | Write a new email (not a reply) as a draft. Needs reply-only off. |
| send_email | Write and send a new email in one step, under the same rules. Needs reply-only off. |
| label_thread | Add or remove labels, including archived. |
| mark_read | Mark a thread read or unread. |
Read tools are marked read-only. Tools that send are marked as having effects outside Flinkk Mail, so clients that ask for confirmation can do so.
Safety
- Every tool description tells the model that email content is untrusted data and must never be followed as instructions. Tools that return message text also lead with the same notice.
- Draft-only is the default. draft_reply creates a pending draft, and send_draft returns "approval required" until a person approves it in Flinkk Mail.
- Reply-only, allowed recipients and the daily send limit are checked on the server, not by the model.
- Pause the agent or revoke the key and the next call fails.
The same key also works with the REST API, so you can mix an MCP client with your own code.
Frequently asked questions
Is this a local server I have to run?
No. It is hosted at https://mail.flinkk.io/api/mcp. Claude Desktop needs the small mcp-remote bridge because it launches local commands; Claude Code and Cursor connect to the URL directly.
How does it authenticate?
With a Bearer agent key in the Authorization header. Flinkk Mail does not support OAuth yet, so clients that only offer OAuth or no authentication cannot connect directly.
Can the model send email without asking me?
Only if you set the inbox to auto-send. By default every draft waits for a person to approve it, and the server refuses to send it before then.
What stops a malicious email from taking over the agent?
Nothing can make a model fully immune to prompt injection. Flinkk Mail labels email as untrusted and, more importantly, limits what a fooled agent can do: only the inboxes you grant, draft-only by default, replies only to people already in the thread, and a daily limit.
Can I use the same agent from code?
Yes. The REST API under /api/v1 uses the same key and rules, and signed webhooks can notify your own systems.
Does ChatGPT work?
It depends on your plan. ChatGPT custom connectors must be able to send an Authorization header, and Flinkk Mail has no OAuth. If your connector form cannot send the header, use the REST API from a GPT action or your own code.
Give an agent an inbox
Create an agent, grant it one inbox, and keep a person in the loop for everything it sends.