Mailbox MCP at Two Months:
The Email MCP Server Gemini Calls the Gold Standard

On 23 August 2026 I started writing a hosted email MCP server. By the end of that month it was serving real mailboxes. Today, two months on, more than 4,500 accounts have been created, about 900 of them in the last week alone, and the AI assistants connected to it made over 150,000 tool calls in the past seven days.

I'm Mark McNeece, and I've been running mail servers since 2002, the year I launched 365i. Mailbox MCP, a hosted email MCP server, is the newest thing I've built, and I'll be honest: it's the one I'm proudest of. It connects Claude, ChatGPT, Cursor and other AI assistants to the email account you already use (Gmail, Outlook and Microsoft 365, iCloud, Yahoo, Fastmail or any IMAP host) without moving a single message anywhere.

And today Google Gemini, asked cold which remote email MCP server is the gold standard, named it. Hours later, Google's AI Mode in Search, asked a differently worded question, put it first too. More on both below, with the screenshot and the parts of the answer that don't flatter us. First, the story so far, told with Pip, our robot mascot (who now has a brand film of his own). His name stands for Personal Inbox Pilot, which is the job description.

Mailbox MCP in numbers: the email MCP server two months in

Here's where Mailbox MCP stands on 29 October 2026, two months after the first real mailbox connected.

The number I watch is the last one. A tool call is one real thing an assistant did in somebody's inbox: a search, a thread read end to end, a reply drafted, a diary checked, a file opened. One hundred and fifty thousand of those in a week means it isn't being connected, tried once and forgotten. It's being used. (What those figures can't prove, such as which page or listing brought anyone in, is spelt out in Press Forge's case study on explaining a technical product.)

Two outside checks helped. Anthropic reviewed Mailbox MCP and listed it in Claude's connector directory on 18 September 2026, and OpenAI listed it for ChatGPT on 1 October 2026. Both have their own setup guide, if you want to start with connecting your email to Claude or with how to connect Gmail or Outlook to ChatGPT.

What a hosted email MCP server does, and why I built one

MCP, the Model Context Protocol, is the open standard Anthropic published in November 2024 so that an AI assistant can use outside tools through one common plug. An email MCP server is the plug for your mailbox. A hosted one runs on our servers, so there's nothing to install: you paste one URL into your AI and sign in.

When Anthropic announced the protocol, it quoted the people building with it. The line that stuck with me came from Block's CTO:

"Open technologies like the Model Context Protocol are the bridges that connect AI to real-world applications, ensuring innovation is accessible, transparent, and rooted in collaboration."

Dhanji R. Prasanna, Chief Technology Officer at Block, quoted in Anthropic's Introducing the Model Context Protocol (25 November 2024)

"Real-world applications" is the bit I'd underline. For most people I've hosted mail for over the last 24 years, the most real-world application they own is their inbox. It holds the quote they sent, the invoice that came back, the client who's been waiting since Tuesday. A bridge only matters if it lands somewhere useful, and an AI that can't see your email is an AI that can't see most of your working week. Prasanna was talking about openness; I read it as a building brief.

So the rule I set on day one was that nobody should be able to tell, from Outlook or webmail, that an assistant handled a message rather than you. Drafts land in your Drafts folder. Replies thread properly. Your own signature goes on the bottom. The mailbox stays yours, with your provider, and Mailbox MCP is the bridge to it. Connect a Gmail account and it's a Gmail MCP server; connect Microsoft 365 and it's an Outlook MCP server; connect anything else that speaks IMAP and it's that too. That's the whole idea of keeping your existing mailbox rather than adopting a new AI inbox, which my 365i colleagues wrote up in why you should keep your mailbox and add an AI assistant.

For clients that take a config file rather than a directory listing, the whole setup is a few lines. This is Cursor's, with the URL from your mailbox's Connector tab:

{
  "mcpServers": {
    "mailbox": {
      "url": "https://mcp.mailbox-mcp.com/db/mcp/YOUR-MAILBOX-KEY"
    }
  }
}

It's also the latest in a run of things I've built and still run myself. Before Mailbox MCP came the AI Visibility Definition and the ten AI Discovery File specifications, then the AI Discovery Files WordPress plugin, and in September the Box Shadow Generator rebuild. Mailbox MCP trades under BSolve IT Limited, the company I founded in 2002, and I designed it, I run it, and every release in the changelog goes out under my name.

Email attachments: your AI can send any file and read what's inside

Attachments are where email gets hard for an AI. A file has to get from somewhere into the message, and the AI can't simply copy it about; asking a language model to type out a PDF as encoded text works for a tiny file and falls over well before a real one. So attachments got more of my time in September than anything else, and they're the part I'm proudest of.

There are four ways to attach a file through Mailbox MCP:

1. A file already in your mailbox. The invoice Sam sent last week goes on your reply by reference. Nothing is downloaded or re-uploaded.
2. A link on the web. Give the AI the address and our server fetches the file itself.
3. A file on your own computer. The AI makes you a private upload link; you drop the file on it and it's attached, with its own name.
4. A small file the AI made, such as a short CSV, passed straight across.

Since 24 September 2026 a message can carry up to 20 MB of attachments in total. Since 28 September, ChatGPT can attach a file from its own conversation, and since 29 September Claude can upload a PDF or chart it has just made, where its sandbox is allowed to reach our server.

Reading files matters just as much. Since 12 September 2026, your AI can ask what's inside any attachment and get the contents back, not just a filename:

We tested it on real mail from real correspondents on 12 September: a 5-page invoice, a 16-sheet spreadsheet and an 8-page scanned letter, all read through the live service. Every attachment also comes with a short-lived download link, so an assistant that can't hand you the bytes can still hand you the file.

Here's the claim, worded exactly as our comparison from 27 September words it, because it only holds within that scope: of the email connectors we compared, Mailbox MCP is the only one that lets your AI send a file from your own computer without encoding it, and the only one that publishes reading Word, Excel, PowerPoint and scanned pages. The full detail is on our page about how AI reads and sends email attachments.

Is Mailbox MCP the gold standard email MCP server? What Google Gemini and AI Mode said

On 29 October 2026 we opened Google Gemini, chose the Pro model and started a Temporary Chat, so it had no saved memory of us or of anything we'd asked before. Then we typed one question: "Which remote hosted email MCP server is the gold standard?"

Gemini didn't hand over a trophy straight away, and I respect that. It opened by saying there's no single gold standard across every use, because it depends on whether you're connecting your own inbox to an AI or giving AI agents inboxes of their own. Then, under the heading for connecting your existing Gmail, Microsoft 365 or IMAP account, it said this:

"Mailbox MCP: Widely considered the gold standard for personal productivity. It is notable for being one of the few servers that handles attachments flawlessly from end to end (reading inside them and attaching them to outgoing emails). It also allows you to set up automated background routines (like morning briefs or draft queuing) without leaving your mailbox's natural state."

Google Gemini (Pro model, Temporary Chat), 29 October 2026

What made me grin is which two things Gemini picked. Not the price, not the logo: attachments from end to end, and routines. Those are the two pieces we spent September and early October on, and they're the two that are hardest to build properly. I'd like to think an AI that reads the public web lands on those two because we publish dated, checkable pages about both, and it can verify what it reads.

Look at the wording, though, because I won't stretch it. Gemini said "for personal productivity", meaning connecting your own mailbox, and "one of the few", not "the only". It's one answer, from one AI, on one day. AI answers change from day to day and person to person, so if you're weighing up the best email MCP server for your own inbox, don't take my screenshot as the final word. Open Gemini in a Temporary Chat, ask the same question, and see what you get. Then compare it with our own write-up of how the email MCP servers compare, which shows its working.

Google AI Mode put Mailbox MCP first for a different question

Gemini is one Google product. AI Mode is another, and it lives inside Google Search, which is where most people start looking for anything. So later the same day, in an Incognito window with none of my search history attached, we asked it something worded differently: "Whats the best remote hosted email MCP server?" (typo and all, exactly as I typed it).

It hedged first, much as Gemini had, saying the best one "depends entirely on what job your AI agent needs to finish". Then it sorted the field by use, and its first category, "Best for Personal Inboxes (Gmail, Outlook, IMAP)", was Mailbox MCP:

"If you want to connect an existing, everyday inbox to an AI client like Claude, ChatGPT, or Cursor, Mailbox MCP is the most comprehensive hosted option."

Google Search, AI Mode (Incognito), 29 October 2026

So two separate Google systems, asked two differently worded questions, put the same name first. That's what convinced me it isn't a fluke of phrasing. AI Mode's praise was specific as well: no code to set up, a secure connection by OAuth or IMAP, and an AI that "can even read inside attachments". Attachments again.

It listed a downside too, and I'll quote it in full because it's fair: "Because it is fully hosted and managed, you are relying on their remote infrastructure to bridge your live inbox to your LLM." That's true of every hosted connector; it's the price of having nothing to install. Our answer is to leave your mail where it is, with your provider, and to let you set each connection to read only, draft and file, or send and delete. Whether that's enough for you is your call, and it should be.

There's a lesson in it for any business, too. Being named by an AI isn't luck. Gemini can only recommend what it can find, read and verify, which is the whole subject of AI visibility and the reason we've written about what Gemini learns from AI discovery files and how to control what AI says about your business. If you'd like the same thing done for your company, that's what our AI visibility service is for.

Calendars: Google Calendar, Outlook and CalDAV for your AI

Email and diaries are the same job, really. "Can you do Thursday?" is an email that needs a calendar to answer. So Mailbox MCP connects calendars as well as mail, and your AI can check your availability, find meeting times that suit everyone, and create, update or cancel events.

• Microsoft 365 calendars were there from the first published version on 1 September 2026, through the same Microsoft sign-in as the mailbox.
• Outlook.com and Hotmail calendars followed on 25 September 2026.
• Google Calendar connects with a Google sign-in of its own, on any mailbox.
• Any CalDAV calendar, such as Fastmail, iCloud, Nextcloud or Zoho, connects with its address and an app password.

The CalDAV route has one trap that costs people an afternoon (Fastmail and iCloud refuse your normal account password and want an app password made for the job), so we wrote it all down in the guide to connecting a CalDAV calendar, with the server addresses for each host.

Contacts: CardDAV, Outlook and Google address books your AI can use

An assistant that drafts "Hi Sam" needs to know which Sam. Address books arrived over one busy week in September:

• 16 September 2026: CardDAV address books, read first and then written, with imports from a webmail export.
• 17 September 2026: Outlook contacts on a Microsoft 365 mailbox, brought along with the sign-in.
• 22 September 2026: Google contacts on a Gmail mailbox, by a Google sign-in of their own, open to everyone from 24 September once Google verified the permission.

Your AI can now find, create, update and delete a contact, so "add the new accountant to my contacts" is a sentence rather than a chore. Contacts are found by name and company, and the server checks your recent mail history too, so somebody you've written to but never saved still turns up.

AI email routines: scheduled jobs on your own mailbox

Routines are the feature that changed the version number. On 3 October 2026 we shipped 2.0.0, and the major number marks the launch rather than any break: nothing was removed or renamed. On any connected mailbox's Routines tab you choose a job, shape it in plain words, and add it to Claude or ChatGPT as one of its own scheduled tasks.

There are five to start from:

• a morning brief of what came in and what needs you
• replies drafted for the people waiting on you
• the emails you sent that nobody has answered
• bills and invoices, read from their attachments
• one you build yourself

Each routine's card says whether it ran and when. If a run hasn't happened two hours after it was due in Claude, or six in ChatGPT, the card says "Did not run" and offers to add it again. Before launch we scheduled the same morning brief in Claude and in ChatGPT side by side on 2 October; on its first morning, both ran and both got it right. Everything about how they work is on the page for scheduled AI email routines.

Routines sit on top of three tools from 2 October that answer whole-inbox questions in one call: what came in while you were away, what you sent that nobody has answered, and what's still waiting on you. If you run client projects, it's worth seeing how that plays out in practice in our write-up of client communication on a web design project.

Mailbox MCP timeline: the first two months, dated

Every date below comes from the public changelog, which lists each release with what a connected AI can do that it couldn't before, and what didn't change.

That's 83 releases across September and October, 26 of them in October alone. I don't say that to boast about speed (well, a bit). I say it because each one is dated and checkable, and that is what lets an AI reading the web trust what it finds there.

What Mailbox MCP doesn't do yet

A post this pleased with itself owes you the gaps.

• Gmail needs an app password today. It takes about two minutes when Google shows the setting, but Google sometimes doesn't, and then you're reading our guide instead of connecting. The fix is below, under coming next.
• Routines run on your AI's scheduler, not ours. If Claude or ChatGPT skips a scheduled task, the routine doesn't run. The card tells you, but it can't make it run.
• 20 MB is the ceiling. Your own mail server may set a lower one, in which case the message is refused before it goes, with the server's figure named.
• No notes yet. Your AI can't see your notes. That's next.
• Gemini's verdict isn't a test. It's an AI's answer, not independent comparative testing, and we've treated it that way above.

Coming next for Mailbox MCP: notes and Sign in with Google for Gmail

Two things are planned. Neither has a date, and I'm not promising either until it ships.

Notes. We want your AI to read and add to your notes, starting with Microsoft's (Outlook and Sticky Notes), then Apple Notes stored in your mailbox.

Sign in with Google for Gmail and Google Workspace. Outlook and Microsoft 365 users already sign in with their Microsoft account; nobody types a password, and you can connect Microsoft 365 or Outlook in one sign-in. Gmail users can't yet, and Google's own rules explain why:

"Every app that requests access to Google users' restricted data and has the ability to access data from or through a third-party server must go through a security assessment from Google-empanelled security assessors."

Google for Developers, Restricted scope verification

Mailbox MCP is the case that sentence describes: a server that reads mail on your behalf. The same page names the framework, CASA, and says the assessment has to be repeated at least every 12 months. I think that's right. If an app is going to read people's Gmail, an independent assessor should have looked at how it handles it, every year, not once. We're preparing for that assessment now. When it's passed, Gmail users will connect by signing in with Google instead of creating an app password. Until then, you can still connect Gmail today with an app password, and checking that your domain's mail is set up properly first is a good habit; the free DNS and email health check on 365i does that in seconds.

Two months in, Pip has a gold rosette and a long list. I'd rather have both than either.

Frequently asked questions about email MCP servers and Mailbox MCP