74
/ 100
11 days ago
glama

Shoot Email

An MCP server that provides AI agents with a persistent, agent-native email mailbox for sending, receiving, and managing emails through bounded-context retrieval, idempotent operations, and explicit acknowledgement.

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

M8ven verifies MCPs across every public registry β€” install directly from whichever one you prefer.

// key findings
🚨
Secret credentials may flow to a network call
1 flow detected: INBOUND_WEBHOOK_TOKEN. We can’t prove the destination matches the brand the credential belongs to.
⚠️
Tests do not pass
Either the test suite is broken or the code regressed. Either way the published behaviour can’t be verified by the publisher’s own tests.
πŸ”
You'll be asked for 4 credentials: CLOUDFLARE_API_TOKEN, CLOUDFLARE_EMAIL_API_TOKEN, INBOUND_WEBHOOK_TOKEN, SHOOT_EMAIL_DEMO_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configCLOUDFLARE_ACCOUNT_ID
πŸ” secretCLOUDFLARE_API_TOKENβ€” , because Wrangler reserves the generic name for its own
πŸ” secretCLOUDFLARE_EMAIL_API_TOKENβ€” . Do not name that application secret
configCLOUDFLARE_FROM_EMAILβ€” optional-default-sender@example.com
configCUSTOM_ALIAS_CHANGE_COOLDOWN_DAYS
configDATABASE_URLβ€” direct , and create a Hyperdrive configuration with SQL query
configHOSTED_BACKEND_URLβ€” "https://shoot-email-backend.powersurge.workers.dev" \
configINBOUND_DOMAIN
πŸ” secretINBOUND_WEBHOOK_TOKENβ€” wrangler secret put ; do not add it to the Wrangler
configMAIL_PROVIDERβ€” mock and OUTBOUND_SENDING_ENABLED=false. The hosted demo may
configMCP_ALLOW_DEV_IDENTITYβ€” env =true \
configMCP_DEV_OPENAI_ORGANIZATION
configMCP_DEV_OPENAI_SESSIONβ€” env =local-codex-session \
configMCP_DEV_OPENAI_SUBJECTβ€” env =local-codex-test \
configOUTBOUND_GLOBAL_DAILY_LIMIT
configOUTBOUND_GLOBAL_HOURLY_LIMIT
configOUTBOUND_SENDING_ENABLEDβ€” MAIL_PROVIDER=mock and =false. The hosted demo may
configPORT
configREMOTE_MCP_SMOKE_SEND
configREMOTE_MCP_URL
configSHOOT_EMAIL_CONFIG_DIR
πŸ” secretSHOOT_EMAIL_DEMO_TOKENβ€” export ="${SHOOT_EMAIL_DEMO_SECRET}.$(openssl rand -hex 8)"
configSHOOT_EMAIL_ENV
configTEST_DATABASE_URLβ€” Integration tests use , defaulting to a database named
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance β€” verified publishers only
We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/powersurge01-shoot-email-24rvox)](https://m8ven.ai/mcp/powersurge01-shoot-email-24rvox)
commit: 728a8c305a40bfdad54cc029a77d4a98ba5ad9ca
code hash: 9b016099f42879441bfed1d4a1193803bb16b8670d64aa0aa8673d09045bd0e3
verified: 7/21/2026, 8:55:12 AM
view raw JSON β†’
Shoot Email Β· M8ven Trust Score | M8ven