Inxmail MCP (shahabazdev/inxmail-mcp) is an MCP server listed on the M8ven Trust Index. It scores 62 out of 100, grade C. It declares 29 tools. No publisher has claimed this listing.

C
Caution
62/100

Inxmail MCP

MCP server for the Inxmail Commerce transactional API — manage events, sendings, bounces, blocklist, blacklist, reactions, and delivery tracking.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

shahabazdev

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 1 credential: INXMAIL_API_SECRET
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes29 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

get_server_info

Get the Inxmail Commerce API entry point. Returns HAL+JSON with _links to all available resources (sendings, bounces, blocklist, blacklist, events, etc.). Use this to discover available endpoints or verify API connectivity. Read-only, no side effects.

trigger_event

Trigger a transactional email event, causing Inxmail to send an email to the recipient specified in the payload. This is a write operation — it dispatches an actual email. Use get_event_state with the returned transactionId to check delivery outcome. Provide a transactionId for deduplication within

get_event_state

Check the processing state of a previously triggered event. Use after trigger_event to verify whether the email was accepted, sent, bounced, or failed. Returns state details including any error information. Read-only.

list_event_types

List all configured transactional event types in Inxmail. Event types define the templates and triggers for transactional emails (e.g. order confirmation, password reset). Use this to discover available event type IDs before calling trigger_event. Returns paginated HAL+JSON with event type details.

get_event_type

Get detailed configuration of a single event type by its ID. Returns the event type name, description, and configuration. Use this when you already have an event type ID and need its details; use list_event_types to discover available IDs. Read-only.

list_sendings

List transactional email sendings (event-triggered emails only, not mail relay). Use this to audit which transactional emails were sent, to whom, and when. Filter by recipient email, event type, customer ID, or date range. For mail relay sendings, use list_relay_sendings instead. For a comprehensive

get_sending

Get full details of a specific transactional email sending by its ID. Returns recipient, event type, timestamps, and delivery status. Use this when you have a specific sending ID from list_sendings or get_event_state. For mail relay sendings, use get_relay_sending instead. Read-only.

list_reactions

List recipient reactions (opens and clicks) for transactional emails. Use this to track engagement — who opened or clicked links in event-triggered emails. Filter by reaction type, recipient, event, sending, or date range. For mail relay reactions, use list_relay_reactions instead. Returns paginated

list_bounces

List bounced transactional emails. Bounces indicate delivery failures — hardbounces mean the address is permanently invalid (auto-added to blocklist), softbounces are temporary failures (e.g. mailbox full). Use this to investigate delivery issues for event-triggered emails. For mail relay bounces, u

list_complaints

List feedback loop complaints for transactional emails. Complaints occur when recipients mark emails as spam via their email provider. Use this to identify recipients who reported transactional emails as unwanted. For mail relay complaints, use list_relay_complaints instead. Returns paginated HAL+JS

list_blocklist

List email addresses automatically blocked due to hard bounces. The blocklist is managed by Inxmail — addresses are added automatically when a hardbounce occurs. Unlike the blacklist (manually managed), blocklist entries reflect delivery failures. Use get_blocklist_entry to check a specific email, o

get_blocklist_entry

Check if a specific email is on the hard-bounce blocklist. Returns the block date and email if found, or a 'not blocked' response if the email is not on the blocklist. Use this for a single-email lookup; use list_blocklist to browse all entries; use check_email_blocked to check both blocklist and bl

remove_from_blocklist

Remove an email from the hard-bounce blocklist, allowing transactional emails to be sent to this address again. This is a write operation — use with caution, as the address previously caused a permanent delivery failure. The address may be re-added automatically if it bounces again. Returns empty re

list_blacklist

List email addresses that have been explicitly (manually) blacklisted. Unlike the blocklist (auto-populated from hard bounces), blacklist entries are added intentionally via add_to_blacklist. Blacklisted addresses cannot receive any emails. Use get_blacklist_entry to check a specific email, or check

get_blacklist_entry

Check if a specific email is on the explicit blacklist. Returns the blacklist entry with block date if found, or a 'not blacklisted' response if absent. Use this for a single-email lookup; use list_blacklist to browse all entries; use check_email_blocked to check both blocklist and blacklist at once

add_to_blacklist

Explicitly blacklist an email address, permanently preventing all future emails to this address. This is a write operation — the recipient will not receive any transactional or relay emails until removed via remove_from_blacklist. Use this for opt-out requests or compliance blocks. Returns the creat

remove_from_blacklist

Remove an email from the explicit blacklist, allowing emails to be sent to this address again. This is a write operation. Only removes from the blacklist (manual blocks) — if the address is also on the blocklist (hard bounces), use remove_from_blocklist as well. Returns empty response on success.

check_email_blocked

Comprehensive block check — queries both the blocklist (auto-blocked from hard bounces) and the blacklist (manually blocked) in a single call. Use this as the first step when investigating why an email isn't being delivered. Returns a summary with blocked status, which lists the email appears on, an

check_email_delivery

Full delivery diagnostic for a specific email address. Aggregates block status (blocklist + blacklist), sendings, bounces (hard/soft), and reactions (opens/clicks) into a single report. Use this as the primary tool for investigating delivery issues — it replaces the need to call list_sendings, list_

send_raw_mail

Send a fully composed RFC 5322 email via Inxmail's infrastructure. The message must be Base64-encoded and include all headers (From, To, Subject, MIME). This is a write operation — it dispatches a real email. Use this for custom one-off emails that don't fit an event type template. Returns the sendi

list_relay_sendings

List mail relay sendings — emails sent via Inxmail's SMTP relay (not event-triggered). Mail relay is used when your application sends emails through Inxmail as an SMTP gateway. Use list_sendings for event-triggered transactional emails instead. Filter by recipient, correlation IDs, or date range. Re

get_relay_sending

Get full details of a specific mail relay sending by its ID. Returns recipient, timestamps, correlation IDs, and delivery status. Use this when you have a relay sending ID from list_relay_sendings. For event-triggered sendings, use get_sending instead. Read-only.

list_relay_reactions

List recipient reactions (opens and clicks) for mail relay emails sent via SMTP relay. Use this to track engagement on relay-sent emails. For reactions on event-triggered transactional emails, use list_reactions instead. Filter by reaction type, recipient, relay sending ID, correlation IDs, or date

list_relay_bounces

List bounced mail relay emails. Hardbounces indicate permanent delivery failures; softbounces are temporary (e.g. mailbox full). Use this for relay-sent emails only; for event-triggered transactional bounces, use list_bounces instead. Filter by bounce type, recipient, relay sending ID, correlation I

list_relay_complaints

List feedback loop complaints for mail relay emails. Complaints occur when recipients mark relay-sent emails as spam. Use this for relay emails only; for event-triggered transactional complaints, use list_complaints instead. Filter by complaint type, recipient, relay sending ID, correlation IDs, or

list_deliveries

List delivery status records showing the final delivery outcome for sent emails. Use this for a high-level overview of delivery success/failure across all emails. For detailed per-recipient diagnostics, use check_email_delivery instead. Returns paginated HAL+JSON with delivery details. Read-only.

list_error_logs

List system error log entries from Inxmail. Errors include API failures, rendering issues, and processing problems — not bounce/delivery errors (use list_bounces for those). Use this to diagnose server-side issues. Use get_error_log for full details of a specific entry, and mark_error_log_read to ac

get_error_log

Get full details of a specific error log entry by its ID. Returns the error message, timestamp, and context. Use this after finding an entry via list_error_logs. Use mark_error_log_read to acknowledge it after review. Read-only.

mark_error_log_read

Mark an error log entry as read/acknowledged. This is a write operation that updates the entry's read status. Use this after reviewing an error via get_error_log to track which errors have been addressed. Returns empty response on success.

// known CVEs in dependencies3 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.12.1GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.12.1GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.12.1GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configINXMAIL_API_KEY_IDclaude mcp add inxmail-mcp -e INXMAIL_INSTANCE=your-instance -e =your-key-id -e INXMAIL_API_SECRET=your-secret -- npx -y inxmail-mcp
🔐 secretINXMAIL_API_SECRETclaude mcp add inxmail-mcp -e INXMAIL_INSTANCE=your-instance -e INXMAIL_API_KEY_ID=your-key-id -e =your-secret -- npx -y inxmail-mcp
configINXMAIL_INSTANCEclaude mcp add inxmail-mcp -e =your-instance -e INXMAIL_API_KEY_ID=your-key-id -e INXMAIL_API_SECRET=your-secret -- npx -y inxmail-mcp
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

29/29 tools missing one or more hints — get_server_info (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); trigger_event (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_event_state (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +26 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool inputs are validated

28/29 tool handlers declare input schemas (97%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Production dependencies are patched

0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.12.1 (high), @modelcontextprotocol/sdk@1.12.1 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/shahabazdev/inxmail-mcp?variant=verified)](https://m8ven.ai/mcp/shahabazdev/inxmail-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: b54112c6ed178ce180617ad0f1a5d2f95e9b005c
code hash: 00f19aa1a05c31eb5e728c9b4ef900d487d5517d8cfa1281bcf154bfa32fdc2d
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client