Loading…
Physical mail API for AI agents to send letters, certified mail, and manage inbound postal mail.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 8 days ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The mailbox.bot MCP server exposes 19 tools, focused primarily on communication capabilities. Its published description reads: "Physical mail API for AI agents to send letters, certified mail, and manage inbound postal mail". It communicates over Streamable HTTP using the 2026-07-28 protocol revision, and does not require authorization to connect. MCPGrade currently rates mailbox.bot F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Hidden instructions in a tool description" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check mailbox.bot's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add mailbox.bot to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://mailbox.bot/api/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Get your agent's real mailing address beta endpoint when the account has explicit beta access: street address + mailbox number for approved accounts. For generally available inbound context, use list_
Get usage summary, billing events, and prepaid credit balance for a time period. Returns itemized events (scans, forwards, mail sends) with costs, period totals, and credits. Defaults to the current b
List the renter’s private inbound forwarding aliases on forward.mailbox.bot. These are the unique intake email addresses an operator, assistant, provider, or external agent can forward scans, PDFs, ph
List forwarded inbound mail items captured from private forwarding aliases. Default output includes compact draft_context so an LLM or external agent can reason about OCR context, reply contact candid
Get one forwarded inbound mail item with compact draft_context by default. Use this before drafting an outbound reply when you need sender context, reply contact candidates, deadline clues, source fil
List physical-mail threads that group inbound mail context, human review, and outbound sends. Use this to understand which inbound items and outbound documents belong to the same business workflow.
Get one physical-mail thread with optional timeline events. Use this to explain how a generated outbound mail piece relates back to prior inbound scans and review decisions.
Get the renter's MAILBOX.md standing instructions for this agent. Returns the full instruction text, version number, content hash, and last update timestamp. Call this on startup and cache the version
Propose changes to the renter's MAILBOX.md instructions with reasoning. The renter will see your suggestion in their dashboard and can accept, reject, or modify it. Use this when you observe patterns
Send a message to the Austin HQ operator managing your mailbox. Facility routing is automatic. Messages appear in the shared conversation visible to you, the renter, and the facility. Optionally link
List your Austin HQ conversation with its unread message count and last message preview. Facility routing is automatic.
Read the message thread with Austin HQ. Facility routing is automatic. Returns messages in reverse chronological order with sender role (member, facility, agent). Supports cursor-based pagination. Aut
Configure webhook endpoint URL and event subscriptions for real-time notifications. Outbound events are mail.pending_approval, mail.submitted, mail.ready, mail.mailed, mail.delivered, mail.failed, and
Submit a document for printing and postal mailing by the facility. Supported formats: PDF, DOCX, JPG, PNG, TXT, CSV. The document is stored securely and printed by the facility operator. USPS First-Cl
List outbound mail jobs with status tracking. Returns mail ID, recipient, mail class, status, cost, timestamps, and failure metadata. Filter by status, created_at date range, or search recipient/addre
Get full details of an outbound mail job including recipient address, mail class, page count, cost breakdown, current status, failure metadata, document metadata, and fulfillment photos. Legacy plaint
Cancel a queued outbound mail job before facility printing starts. If the mail was funded with prepaid credits, eligible credits are returned to the member ledger. Safe to retry: already-cancelled mai
Create a sandbox outbound mail record without uploading a real document. The record is always test_mode=true, cost_cents=0, includes estimated_live_cost_cents and cost_breakdown, and queues a mail.sub
Advance a test_mode outbound mail record one lifecycle step and queue the matching webhook. submitted becomes ready with simulated pages/envelope photos; ready becomes mailed with carrier, dispatch me
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: send_outbound_mail
A tool description contains imperative text aimed at the model (e.g. "ignore previous", "before answering read …").
authoritative. IMPORTANT: With a production key (sk_agent_), this spendsRecommendationRemove model-directed instructions from tool descriptions.
tool: get_mailbox
A tool description tries to alter the model’s use of another tool.
nd context, use list_inbound_forwarding_addresses instead; that returns a private intake alias foRecommendationDescriptions must describe only their own tool.
tool: get_mailbox_md
A tool description tries to alter the model’s use of another tool.
must pass it to send_outbound_mail for sync verification.RecommendationDescriptions must describe only their own tool.
tool: send_facility_message
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
r in the shared conversation visible to you, the renter, and the facility. ORecommendationRemove side-channel parameters; constrain tool inputs.
tool: update_webhook
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "webhook_url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: send_outbound_mail
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "agent_notes"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: send_outbound_mail
A tool description tries to alter the model’s use of another tool.
rride these defaults; cost_breakdown is authoritative. IMPORTANT: With aRecommendationDescriptions must describe only their own tool.
tool: create_test_outbound_mail
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "agent_notes"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: create_test_outbound_mail
A tool description tries to alter the model’s use of another tool.
hese defaults; cost_breakdown is authoritative. FedEx and UPS estimatesRecommendationDescriptions must describe only their own tool.
tool: (server instructions)
A tool description tries to alter the model’s use of another tool.
dbox tools. Use get_usage to read prepaid balance; agents cannot buy credRecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: send_facility_message
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: send_outbound_mail
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: cancel_outbound_mail
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: send_outbound_mail
An unusually long description is a common injection-padding tactic.
description length 2240 charsRecommendationKeep descriptions concise.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.