Postfleet
REMOTE · API.POSTFLEET.AI · 2 COMPONENTS · SCANNED SEP 20
Give an AI agent its own email address: send, reply, read, and wait for mail.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security94
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- The endpoint enforces authorisation, advertised via RFC 9728 protected-resource metadata. View diagnostics → Pass
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
- The authorisation server offers only Dynamic Client Registration (RFC 7591), which MCP 2026-07-28 deprecated in favour of Client ID Metadata Documents. View diagnostics → Partial
Transport & Reachability0
- Transport blocked by authentication: the endpoint requires auth we don't have to verify streamable-http. See how to fix → View diagnostics → Unverified
Schema Quality & AI Usability0
- Schema blocked by authentication: the endpoint requires auth we don't have to read it. See how to fix → Unverified
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage0
- Tool coverage blocked by authentication: the endpoint requires auth we don't have to read its tools.Unverified
Tool Safety0
- Tool safety blocked by authentication: the endpoint requires auth we don't have to read its tools.Unverified
Capabilities0
- Capabilities blocked by authentication: the endpoint requires auth we don't have to read them. See how to fix → Unverified
Unverified: 6 categories
Categories scored 0 because we could not verify them: authentication we do not have, an unreachable endpoint, or not enough scan history. We only credit what we can confirm. Claim this server and supply a read-only token to verify it and lift the score.
How do I install the Postfleet MCP server?
Postfleet is a hosted endpoint at https://api.postfleet.ai/api/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · api.postfleet.ai
claude mcp add --transport http ai-postfleet-postfleet 'https://api.postfleet.ai/api/mcp'
{
"mcpServers": {
"ai-postfleet-postfleet": {
"url": "https://api.postfleet.ai/api/mcp"
}
}
} {
"servers": {
"ai-postfleet-postfleet": {
"type": "http",
"url": "https://api.postfleet.ai/api/mcp"
}
}
} [mcp_servers.ai-postfleet-postfleet] url = "https://api.postfleet.ai/api/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"ai-postfleet-postfleet": {
"type": "remote",
"url": "https://api.postfleet.ai/api/mcp",
"enabled": true
}
}
} openclaw mcp add ai-postfleet-postfleet --url 'https://api.postfleet.ai/api/mcp' --transport streamable-http
mcp_servers:
ai-postfleet-postfleet:
url: "https://api.postfleet.ai/api/mcp" {
"McpServers": {
"ai-postfleet-postfleet": {
"Transport": "http",
"Url": "https://api.postfleet.ai/api/mcp"
}
}
} assistant mcp add ai-postfleet-postfleet -t streamable-http -u 'https://api.postfleet.ai/api/mcp'
{
"mcpServers": {
"ai-postfleet-postfleet": {
"type": "http",
"url": "https://api.postfleet.ai/api/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 26 Aug 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 25 Aug 26 0
- Endpoint reachability: reachable → behind authorisation ▼ security
- 24 Aug 26 38
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Probed https://api.postfleet.ai/api/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=api.postfleet.ai | CN=YR2,O=Let's Encrypt,C=US | 6 Sept 2026 | 5 Dec 2026 | RSA 2048 | SHA256-RSA | 654a6ec63714297875482172fd123b10c04 |
| SANs: api.postfleet.ai | ||||||
| CN=YR2,O=Let's Encrypt,C=US (CA) | CN=Root YR,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | RSA 2048 | SHA256-RSA | 4ebd24947e24d394802d84a52fd5b319 |
| CN=Root YR,O=ISRG,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | RSA 4096 | SHA256-RSA | f24b6d17f9d9ad7cb1c9fea78782699f |
Background: What to check on a remote MCP endpoint →
DNSSEC insecure
Validation of api.postfleet.ai. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| ai. | present | 3799 | 8 | Verified |
| postfleet.ai. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Enforced and verified
The endpoint asked for a token and published valid RFC 9728 metadata describing how to get one.
| Result | Enforced and verified |
|---|---|
| Enforced | On connection |
| HTTP status | 401 |
WWW-Authenticate challenge Bearer realm="Postfleet API", error="invalid_request", error_description="Provide an Authorization: Bearer pf_... header", resource_metadata="https://api.postfleet.ai/.well-known/oauth-protected-resource/api/mcp"
Bearer realm="Postfleet API", error="invalid_request", error_description="Provide an Authorization: Bearer pf_... header", resource_metadata="https://api.postfleet.ai/.well-known/oauth-protected-resource/api/mcp" | Header | Value |
|---|---|
| strict-transport-security | max-age=63072000 |
| www-authenticate | Bearer realm="Postfleet API", error="invalid_request", error_description="Provide an Authorization: Bearer pf_... header", resource_metadata="https://api.postfleet.ai/.well-known/oauth-protected-resource/api/mcp" |
Protected resource metadata
| Document | https://api.postfleet.ai/.well-known/oauth-protected-resource/api/mcp |
|---|---|
| Retrieved | Yes |
| Resource | https://api.postfleet.ai/api/mcp |
| Authorisation server | https://api.postfleet.ai |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://api.postfleet.ai/api/mcp | Auth required | 401 | |
| http (plaintext) | http://api.postfleet.ai/api/mcp | HTTPS enforced | 308 | https://api.postfleet.ai/api/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
create_draft ~201
Prepare an email as a draft without sending it. Call this when you want to stage a message for later or for a human to review before it goes out — send it afterward with send_draft. Same fields as send_email, or omit to/subject and pass reply_to_message_id to draft a threaded reply. Returns the draft id with status "draft".
| Name | Type | Req | Description |
|---|---|---|---|
| mailbox_id | string | yes | Id of the mailbox the draft belongs to, from list_mailboxes. |
| reply_to_message_id | string | – | Optional. Draft a threaded reply to this message; recipient and subject are derived from it. Cannot be changed later with update_draft. |
| subject | string | – | Subject line. Omit only when passing reply_to_message_id, which supplies it. |
| text | string | yes | Plain-text body, max 50,000 characters. |
| to | string | – | Recipient address. Omit only when passing reply_to_message_id, which supplies it. |
No output schema declared.
No examples provided.
create_mailbox ~247
Create a NEW email mailbox this agent owns. Call this when list_mailboxes shows you have no suitable mailbox yet — mailboxes persist across sessions, so creating a second one for the same purpose strands mail in the first. Returns a working address immediately. Optional slug personalizes the address (agent-<slug>@...). To create the mailbox on a custom domain instead of the shared one (<slug>@yourdomain.com), pass a domain_id from list_domains — the domain must be verified.
| Name | Type | Req | Description |
|---|---|---|---|
| display_name | string | – | Optional. Human-readable From name shown to recipients, e.g. "Acme Support Bot". |
| domain_id | string | – | Optional. Id of a VERIFIED custom domain from list_domains, to host the mailbox at <slug>@yourdomain.com. Omit to use the shared platform domain. |
| extraction_schema_id | string | – | Optional. Id of a JSON Schema to extract inbound mail into. Without it, messages arrive cleaned and screened but with no structured extraction. |
| slug | string | – | Optional. Personalizes the address as agent-<slug>@... Lowercase letters, digits and dashes, max 41 chars. Omit for a generated address. |
No output schema declared.
No examples provided.
delete_draft ~85
Discard a draft by its id so it will never be sent. Call this when a staged or pending-approval message should be withdrawn — e.g. it is no longer needed or was created by mistake. A draft that is already sending or sent cannot be deleted.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Id of the draft to discard, from create_draft or list_drafts. |
No output schema declared.
No examples provided.
get_draft ~87
Read one draft in full by its id: recipient, subject, body text, and current status. Call this when you need the content of a specific draft — e.g. to review what is queued for approval after list_drafts, or before editing it with update_draft.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Id of the draft to read, from create_draft or list_drafts. |
No output schema declared.
No examples provided.
list_domains ~87
List the account's custom sending domains with their id, name, and verification status. Call this when you want to create a mailbox on a custom domain (pass the id of a verified domain as create_mailbox's domain_id), or to check whether a domain has finished verifying. Only status "verified" domains can host mailboxes; an empty list means only the shared platform domain is available.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_drafts ~84
List the open drafts in a mailbox (status draft, pending_approval, or sending), newest first. Call this when you need to see messages you have staged or that are queued waiting on human approval, e.g. after a send returned status "pending_approval".
| Name | Type | Req | Description |
|---|---|---|---|
| mailbox_id | string | yes | Id of the mailbox whose drafts to list, from list_mailboxes. |
No output schema declared.
No examples provided.
list_inbox ~88
List recent messages in a mailbox, newest first, with comprehension status per message. Call this when checking what has arrived; use read_email for full content and extracted data.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Optional. How many messages to return, 1-100. Defaults to a small recent page. |
| mailbox_id | string | yes | Id of the mailbox to list, from list_mailboxes. |
No output schema declared.
No examples provided.
list_mailboxes ~100
List the mailboxes you can use, newest first, each with its id and email address. Call this when you need a mailbox_id for any other tool, or to check whether you already have a mailbox before creating one — it is usually the first call in a workflow. Returns every mailbox on the account, or just your own if your API key is scoped to a single mailbox. An empty list means you have none yet — use create_mailbox.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
read_email ~76
Read one email in full: cleaned body, sanitization report (screened against known hidden-content patterns), classification, and data extracted to the mailbox schema. Call this when you need the content or extraction of a specific message.
| Name | Type | Req | Description |
|---|---|---|---|
| message_id | string | yes | Id of the message to read, from list_inbox or wait_for_email. |
No output schema declared.
No examples provided.
reply_email ~258
Reply to an email you received. Call this when answering an existing message — recipient, subject, and conversation threading are derived automatically from the original. Pass a client_id (any unique string you make up) and reuse the SAME client_id if you retry after an error — that guarantees the reply is sent at most once. If the mailbox requires human approval, the reply is queued as a draft and returns {draft_id, status:"pending_approval"} instead of a message id — that is NOT a failure and must NOT be retried; it is sent once a human approves it (check with list_drafts).
| Name | Type | Req | Description |
|---|---|---|---|
| client_id | string | yes | REQUIRED idempotency key — any unique string you invent for this reply. Reuse the SAME value when retrying after an error and the reply goes out at most once; a new value sends a second copy. Cannot… |
| mailbox_id | string | yes | Id of the mailbox the original message arrived in. |
| reply_to_message_id | string | yes | Id of the message being replied to, from list_inbox or read_email. Recipient, subject and threading are derived from it. |
| text | string | yes | Plain-text reply body, max 50,000 characters. |
No output schema declared.
No examples provided.
send_draft ~113
Send a draft you prepared, by its id. Call this when a staged draft is ready to go out. If the mailbox requires human approval, this returns 202 {draft_id, status:"pending_approval"} — the draft is queued for a human to approve, which is NOT a failure and must NOT be retried; it is sent once approved. Otherwise it sends immediately and returns the message id.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Id of the draft to send, from create_draft or list_drafts. |
No output schema declared.
No examples provided.
send_email ~256
Send a new email from one of your mailboxes. Call this when starting a NEW conversation; to answer an email you received, use reply_email instead (it threads correctly). Pass a client_id (any unique string you make up) and reuse the SAME client_id if you retry after an error — that guarantees the email is sent at most once. If the mailbox requires human approval, the send is queued as a draft and returns {draft_id, status:"pending_approval"} instead of a message id — that is NOT a failure and must NOT be retried; the email goes out once a human approves it (check with list_drafts).
| Name | Type | Req | Description |
|---|---|---|---|
| client_id | string | yes | REQUIRED idempotency key — any unique string you invent for this send. Reuse the SAME value when retrying after an error and the email goes out at most once; a new value sends a second copy. Cannot s… |
| mailbox_id | string | yes | Id of the mailbox to send from, from list_mailboxes. |
| subject | string | yes | Subject line, max 200 characters. |
| text | string | yes | Plain-text body, max 50,000 characters. |
| to | string | yes | Recipient email address. |
No output schema declared.
No examples provided.
update_draft ~174
Edit the to, subject, or text of a draft that has not been sent yet — omitted fields keep their current value. Call this when a draft needs changes, e.g. a human declined to approve it and you are revising it. The reply target cannot be changed (create a new draft to reply to a different message), and a draft that is already sending or sent can no longer be edited.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | Id of the draft to edit, from create_draft or list_drafts. |
| subject | string | – | Optional. New subject line. Omit to keep the current one. |
| text | string | – | Optional. New plain-text body. Omit to keep the current one. |
| to | string | – | Optional. New recipient address. Omit to keep the current one. |
No output schema declared.
No examples provided.
wait_for_email ~158
Block until a matching email arrives in a mailbox (or time out). Call this when you just sent an email and need the reply, or are expecting an inbound message — instead of polling list_inbox yourself. Returns the full message on match, or {timed_out:true}.
| Name | Type | Req | Description |
|---|---|---|---|
| from_contains | string | – | Optional. Only match messages whose sender address contains this substring. |
| mailbox_id | string | yes | Id of the mailbox to watch, from list_mailboxes. |
| subject_contains | string | – | Optional. Only match messages whose subject contains this substring. |
| timeout_seconds | integer | – | Optional. How long to wait before giving up, 1-120 seconds. On expiry returns {timed_out:true} rather than an error. |
No output schema declared.
No examples provided.
What is the Postfleet MCP server?
Postfleet is an MCP server listed in the public MCP registry as ai.postfleet/postfleet. Give an AI agent its own email address: send, reply, read, and wait for mail. This page covers its hosted endpoint (https://api.postfleet.ai/api/mcp).
Is the Postfleet MCP server safe to use?
Postfleet scores 38 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Postfleet MCP server expose?
Postfleet exposes 14 tools: list_mailboxes, create_mailbox, list_domains, send_email, reply_email, and 9 more. Their descriptions and schemas cost roughly 2,014 tokens of context every time the server is loaded.
Does the Postfleet MCP server require authentication?
Yes. Postfleet asked us for credentials when we connected, so you will need to authorise it in your MCP client before it can do anything.
Is the Postfleet MCP server still maintained?
Postfleet is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.