# dev.mailkite/mailkite (npm · @mailkite/mcp)

Send email, manage domains, DNS, webhooks, templates, and inbound routing on MailKite

- Trust score: 66/100 (medium)
- Change this week: +21
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-04

## Components

- remote · `mcp.mailkite.dev`: 36/100, [markdown](https://verifymcp.io/servers/dev-mailkite-mailkite/mcp.md), [page](https://verifymcp.io/servers/dev-mailkite-mailkite/mcp)
- npm · `@mailkite/mcp`: 66/100 (this document), [markdown](https://verifymcp.io/servers/dev-mailkite-mailkite/mailkite-mcp.md), [page](https://verifymcp.io/servers/dev-mailkite-mailkite/mailkite-mcp)

## Channel facts

- Registry: `npm`
- Package: `@mailkite/mcp`
- Version: `0.13.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-04.

- **Supply Chain Security**: 83/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known medium-severity CVE affects hono 4.12.33, reached via @modelcontextprotocol/sdk > hono. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 1 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 70/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 3350 tokens (~83/item across 40 items; 40 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 30/100
  - Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 88/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 63% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add dev-mailkite-mailkite -- npx -y @mailkite/mcp
```

### Codex

```bash
codex mcp add dev-mailkite-mailkite -- npx -y @mailkite/mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "dev-mailkite-mailkite": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@mailkite/mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add dev-mailkite-mailkite --command npx --arg -y --arg @mailkite/mcp
```

### Hermes

```yaml
mcp_servers:
  dev-mailkite-mailkite:
    command: "npx"
    args: ["-y", "@mailkite/mcp"]
```

### Other

```json
{
  "mcpServers": {
    "dev-mailkite-mailkite": {
      "command": "npx",
      "args": [
        "-y",
        "@mailkite/mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-04 (score 66, −1)

- [security regression] CVE-2026-69207 affects this package: medium
- [security regression] Known CVEs: partial → fail

### 2026-08-03 (score 67, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 66, +46)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Stability: unverified → 0.23
- [functional improvement] Schema quality: unverified → good
- [functional] Licence: MIT

### 2026-08-01 (score 20, −5)

- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional regression] Capabilities: pass → unverified

### 2026-07-31 (score 25, −20)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-27 (score 45)

First indexed and scored.

## MCP tools (40)

### `mailkite_send` (~286 tokens)

Send a message over a verified domain. Pass `templateId` (+ optional `templateData`) to send from a saved or base template. Requires an API key (mk_live_…).

Input parameters:

- `attachments` (array)
- `bcc`
- `cc`
- `from` (string, required): An address on a verified domain.
- `headers` (object): Extra raw MIME headers, applied after threading headers (caller wins). Use for what the structured fields can't express — e.g. `List-Unsubscribe`, a dedup/idempotency key (`X-Entity-Ref-ID`), or a ta…
- `html` (string)
- `inReplyTo` (string)
- `replyTo` (string)
- `subject` (string): Required unless supplied by a template.
- `templateData` (object): Values substituted into the template's {{merge_tags}} (e.g. {"name":"Ann"} fills {{name}}). HTML values are auto-escaped.
- `templateId` (string): Send using a saved template — a user template (tpl_…) or a base template (base_…). Its subject/html/text seed the message; explicit subject/html/text here override them.
- `text` (string)
- `to` (required): One recipient or a list.

### `mailkite_upload_attachment` (~399 tokens)

Upload a file to MailKite storage and get back a secure, time-limited URL. Reference the returned `url` as an attachment in send() (`{ filename, url }`) or link it inline in your HTML — instead of base64-inlining large files on every send. Give the file ONE of four ways: a local `path` (read and streamed as raw bytes by the CLI/SDK/local MCP), a remote `url` (MailKite fetches and re-hosts it), base64 `content`, or — over raw HTTP — the file bytes as the POST body with `?filename=`. `retentionDays` (7/30/90/365, default 7) sets how long the file and URL live. Requires an API key (mk_live_…).

Input parameters:

- `content` (string): The file bytes, base64-encoded. The lowest-common-denominator fallback when you can't send a path, URL, or raw bytes.
- `contentType` (string): MIME type, e.g. "application/pdf". Defaults to application/octet-stream (or is inferred from the file extension / fetched response).
- `filename` (string): The file's name, e.g. "invoice.pdf". Shown to recipients on download. Optional when it can be derived from `path` or `url`.
- `path` (string): Local filesystem path to the file. Read client-side by the CLI, SDKs, and the local MCP server, then uploaded as raw bytes. Not available on the hosted MCP (no filesystem).
- `retentionDays` (integer): How long the file (and its signed URL) stays valid. One of 7, 30, 90, 365. Defaults to 7.
- `url` (string): A remote http(s) URL. MailKite fetches it and re-hosts the bytes under your account. Max 25 MB.

### `mailkite_list_templates` (~37 tokens)

List your saved email templates (light metadata only — no body). Use getTemplate for the full template. Requires a management session token.

### `mailkite_list_base_templates` (~47 tokens)

List the premade base templates (light metadata). Clone one with createTemplate({ baseId }) or send from it directly via send({ templateId }). Requires a management session token.

### `mailkite_get_template` (~56 tokens)

Get one template (full: subject, html, text, theme). Works for your templates (tpl_…) and base templates (base_…). Requires a management session token.

Input parameters:

- `id` (string, required): Path parameter `id`.

### `mailkite_create_template` (~172 tokens)

Create a template. Pass `baseId` to clone a base template into your own, or provide name/subject/html/text/theme directly. Requires a management session token.

Input parameters:

- `baseId` (string): Clone this base template (base_…) into your own. When set, name is optional (defaults to the base's name).
- `html` (string): Rendered, send-ready HTML.
- `json` (string): Editor (TipTap) JSON source, for re-editing in the dashboard.
- `name` (string): Template name. Required unless baseId is given.
- `subject` (string): Default subject line for sends.
- `text` (string): Plaintext fallback.
- `theme` (string): Brand tokens JSON (bg, surface, primary, text, logo, …).

### `mailkite_list_domains` (~26 tokens)

List your domains, each with its webhook URL. Requires a management session token.

### `mailkite_create_domain` (~34 tokens)

Add a domain. Returns the domain + DNS records. Requires a management session token.

Input parameters:

- `domain` (string, required)

### `mailkite_get_domain` (~36 tokens)

Get one domain with DNS records + webhook. Requires a management session token.

Input parameters:

- `id` (string, required): Path parameter `id`.

### `mailkite_delete_domain` (~31 tokens)

Remove a domain. Requires a management session token.

Input parameters:

- `id` (string, required): Path parameter `id`.

### `mailkite_verify_domain` (~33 tokens)

Check DNS and update status. Requires a management session token.

Input parameters:

- `id` (string, required): Path parameter `id`.

### `mailkite_set_webhook` (~45 tokens)

Set or replace the domain's catch-all webhook. Requires a management session token.

Input parameters:

- `id` (string, required): Path parameter `id`.
- `url` (string, required)

### `mailkite_delete_webhook` (~34 tokens)

Remove the domain's webhook. Requires a management session token.

Input parameters:

- `id` (string, required): Path parameter `id`.

### `mailkite_test_webhook` (~39 tokens)

Send a signed test event to the domain's webhook. Requires a management session token.

Input parameters:

- `id` (string, required): Path parameter `id`.

### `mailkite_check_domain_availability` (~49 tokens)

Check whether a domain is available to register, and at what price. Read-only — no charge. Requires a management session token.

Input parameters:

- `domain` (string, required): Query parameter `domain`.

### `mailkite_register_domain` (~103 tokens)

Register (buy) a domain on the customer's behalf; provisions mail DNS and adds it to the account in one call. Charges the registrar. Requires a management session token. Does NOT register automatically — returns a dashboard link for the user to review the price and confirm. An assistant can never purchase a domain on its own.

Input parameters:

- `contact` (object, required)
- `domain` (string, required)
- `dryRun` (boolean)
- `years` (integer)

### `mailkite_list_routes` (~21 tokens)

List inbound routing rules. Requires a management session token.

### `mailkite_create_route` (~102 tokens)

Create a route (match, action, destination). Requires a management session token.

Input parameters:

- `action` (string): What to do with matching mail. Defaults to webhook.
- `agentPrompt` (string): Required for action agent — instructions for the inbox agent.
- `destination` (string): Required for action webhook (URL) or forward (address).
- `match` (string, required): Address pattern: exact, *@domain, addr+*@domain, or /regex/.

### `mailkite_delete_route` (~63 tokens)

Delete an inbound routing rule by id. Pair with createRoute to register and tear down a webhook destination — e.g. an automation platform subscribing on enable and cleaning up on disable. Requires a management session token.

Input parameters:

- `id` (string, required): Path parameter `id`.

### `mailkite_agent` (~260 tokens)

Send a message to one of your inbox agents and get its reply. Defaults to the account's default agent; pass `routeId` or `address` to target a specific agent, or `model` to override the model. This is separate from inbound routing — it does not match or override routes. Requires an API key (mk_live_…).

Input parameters:

- `address` (string): Target the agent whose route matches this address. Alternative to routeId.
- `from` (string): Optional sender address the agent sees as the originator. Defaults to the account's API caller address.
- `html` (string): Optional HTML body. `text` is still required — the agent reasons over the plain-text content.
- `model` (string): Override the model the agent runs on for this call (e.g. claude-sonnet-4-6).
- `routeId` (string): Target a specific agent by its route id (rte_…). Omit to use the account's default agent (its most recently created agent route).
- `subject` (string): Optional subject line the agent sees on the message.
- `text` (string, required): The message for the agent — it reads this as the incoming email body and decides what to do.

### `mailkite_route` (~167 tokens)

Route a message to one of your registered routes (by `routeId` or `address`), running that route's action — agent, webhook, or forward. The route must already exist on your account; arbitrary destinations are not allowed. Requires an API key (mk_live_…).

Input parameters:

- `address` (string): Target route by the address it matches. One of routeId or address is required.
- `from` (string, required): Sender address recorded on the message.
- `html` (string): HTML body.
- `routeId` (string): Target route by id (rte_…). One of routeId or address is required. The route must already be registered on this account.
- `subject` (string): Optional subject line.
- `text` (string): Plain-text body.

### `mailkite_list_messages` (~89 tokens)

List stored messages, newest first. Optionally filter with `search` (matches sender, recipient, or subject) and page with `before` (a `received_at` cursor) and `limit`; omit all for the default newest 100. Response is a bare array — paginate by passing the last row's `received_at` as the next `before`. Requires a management session token.

### `mailkite_get_message` (~35 tokens)

Get a message with deliveries + attachments. Requires a management session token.

Input parameters:

- `id` (string, required): Path parameter `id`.

### `mailkite_retry_delivery` (~37 tokens)

Re-deliver a stored message to its webhook. Requires a management session token.

Input parameters:

- `id` (string, required): Path parameter `id`.

### `mailkite_list_lists` (~33 tokens)

List your contact lists (static, curated broadcast audiences), each with its member count. Requires a management session token.

### `mailkite_create_list` (~46 tokens)

Create a contact list. Returns the list with its id (lst_…); add contacts with addListContacts. Requires a management session token.

Input parameters:

- `name` (string, required)

### `mailkite_get_list` (~36 tokens)

Get one contact list with its member count. Requires a management session token.

Input parameters:

- `id` (string, required): Path parameter `id`.

### `mailkite_update_list` (~39 tokens)

Rename a contact list. Requires a management session token.

Input parameters:

- `id` (string, required): Path parameter `id`.
- `name` (string, required)

### `mailkite_delete_list` (~43 tokens)

Delete a contact list. The list is removed; the contacts themselves are kept. Requires a management session token.

Input parameters:

- `id` (string, required): Path parameter `id`.

### `mailkite_list_list_contacts` (~96 tokens)

List the contacts that are members of a list, newest first. Optionally page with `before` (a `last_seen_at`/`created_at` cursor) and `limit`. Response is a bare array — paginate by passing the last row's `last_seen_at` (or `created_at`) as the next `before`. Requires a management session token.

Input parameters:

- `id` (string, required): Path parameter `id`.

### `mailkite_add_list_contacts` (~64 tokens)

Add contacts (by id, ctr_…) to a list. Returns how many were newly added; contacts already on the list are ignored. Requires a management session token.

Input parameters:

- `contactIds` (array, required)
- `id` (string, required): Path parameter `id`.

### `mailkite_remove_list_contact` (~54 tokens)

Remove one contact from a list (the contact itself is kept). Requires a management session token.

Input parameters:

- `contactId` (string, required): Path parameter `contactId`.
- `id` (string, required): Path parameter `id`.

### `mailkite_list_broadcasts` (~33 tokens)

List your broadcasts (one-to-many sends) with status and send stats. Requires a management session token.

### `mailkite_create_broadcast` (~145 tokens)

Create a broadcast draft. `from` is required; set `audience` to { type: "all" } or { type: "list", id: "lst_…" }. Returns the broadcast with its id (bct_…). Send it with sendBroadcast. Requires a management session token.

Input parameters:

- `audience` (object)
- `footerAddress` (string)
- `from` (string, required)
- `html` (string)
- `name` (string)
- `preview` (string)
- `replyTo` (string)
- `subject` (string)
- `templateId` (string)
- `text` (string)

### `mailkite_get_broadcast` (~38 tokens)

Get one broadcast with its status and recipient summary. Requires a management session token.

Input parameters:

- `id` (string, required): Path parameter `id`.

### `mailkite_update_broadcast` (~121 tokens)

Edit a draft broadcast (any of from/subject/audience/html/… ). Drafts only. Requires a management session token.

Input parameters:

- `audience` (object)
- `footerAddress` (string)
- `from` (string)
- `html` (string)
- `id` (string, required): Path parameter `id`.
- `name` (string)
- `preview` (string)
- `replyTo` (string)
- `subject` (string)
- `templateId` (string)
- `text` (string)

### `mailkite_delete_broadcast` (~33 tokens)

Delete a broadcast draft. Requires a management session token.

Input parameters:

- `id` (string, required): Path parameter `id`.

### `mailkite_send_broadcast` (~102 tokens)

Send a broadcast now, or pass an ISO 8601 `scheduledAt` to schedule it. A one-click unsubscribe is always added. Returns the status and resolved audience count. Requires a management session token. Does NOT register automatically — returns a dashboard link for the user to review the price and confirm. An assistant can never purchase a domain on its own.

Input parameters:

- `id` (string, required): Path parameter `id`.
- `scheduledAt` (string)

### `mailkite_verify_webhook` (~193 tokens)

Verify the `x-mailkite-signature` header on an inbound webhook delivery. Runs entirely locally (HMAC-SHA256 over `${t}.${payload}`) — no network call. Returns true only when the signature matches and the event is within the freshness window. Runs locally (no API call) — no credentials needed.

Input parameters:

- `payload` (string, required): The raw, unparsed webhook request body — the exact bytes you received.
- `secret` (string, required): Your webhook signing secret (from the dashboard).
- `signature` (string, required): The `x-mailkite-signature` header value, e.g. `t=1750000000000,v1=4f1a9c…`.
- `toleranceMs` (integer): Reject events whose timestamp is more than this many milliseconds old, to block replays. Defaults to 300000 (5 minutes). Pass 0 to disable the freshness check.

### `mailkite_semantic_search` (~73 tokens)

Semantic search over the MailKite documentation — returns the most relevant doc sections for a natural-language query (hybrid vector + keyword search over https://mailkite.dev/docs). Public; no authentication required. Requires an API key (mk_live_…).

Input parameters:

- `query` (string, required): Query parameter `query`.

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/dev-mailkite-mailkite/mailkite-mcp#diagnostics

## Score history

- 2026-08-04: 66
- 2026-08-03: 67
- 2026-08-02: 66
- 2026-08-01: 20
- 2026-07-31: 25
- 2026-07-30: 45
- 2026-07-28: 45
- 2026-07-27: 45

## Links

- npm package: https://www.npmjs.com/package/@mailkite/mcp
- Socket report: https://socket.dev/npm/package/@mailkite/mcp
- Repository: https://github.com/mailkite/mailkite-mcp
- Website: https://mailkite.dev/docs/ai-agents
- Changelog RSS feed: https://verifymcp.io/servers/dev-mailkite-mailkite/mailkite-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/dev-mailkite-mailkite/mailkite-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/dev-mailkite-mailkite/mailkite-mcp