Architecture
How inboxmcp is built: portal, REST API, MCP endpoint, and the OAuth 2.1 flow with Dynamic Client Registration.
inboxmcp is a cloud MCP server that makes email mailboxes accessible to AI assistants. You connect a mailbox once through the portal (IMAP/SMTP or Microsoft 365); compatible AI assistants then use the MCP interface to read from — and, depending on plan, write to — those mailboxes.
Components
| Component | Endpoint | Function |
|---|---|---|
| Portal | app.inboxmcp.io |
Account management, mailbox setup, billing |
| REST API | api.inboxmcp.io |
Account control surface used by the portal |
| MCP endpoint | mcp.inboxmcp.io |
The URL AI assistants register as their connector |
| Auth server | mcp.inboxmcp.io |
OAuth 2.1 with Dynamic Client Registration (RFC 7591) |
| Processing | internal | Executes IMAP / SMTP / Microsoft Graph operations; the only component that holds the private key for decrypting stored credentials |
Authentication
The MCP endpoint is protected with OAuth 2.1 and Dynamic Client Registration (RFC 7591). The flow is identical for every compatible client:
- The client points at the MCP URL
https://mcp.inboxmcp.io/mcp. - The client registers with the auth server — either automatically via Dynamic Client Registration or with a Client ID + Secret you provisioned manually in the portal.
- The user is sent to the inboxmcp portal to sign in and confirm access.
- The client receives an access token and a refresh token. All further requests are
signed with the access token in the
Authorization: Bearer …header.
Per-vendor setup guides live under AI assistants.