BumbleBox

ai.bumblebox/mailbumblebox.aistreamable-httpv2.1.0Scanned 1 hour ago

Search and triage all your mailboxes; draft replies and campaigns; send only as you allow.

17 tools: 1 can delete or cancel things, 5 do something that can't be undone, 3 change things and 8 only read.

Reads private data · 7
Reads text others write · 8
Can send data out · 5
2 findings

Anlyon alternative

9 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

17 tools

Deletes or cancels 1Removes, cancels or revokes something.Claude Code: deny

archive_emailMoves one inbox email to its mailbox's archive folder, on the mail server too.1 finding
Why it is in this group
- The name "archive_email" says "archive": a word for removing or ending something.
- The server marks it not destructive (destructiveHint: false), but an annotation never lowers a class.
Findings
- Warn
  The server marks "archive_email" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".
  Matched text
  annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "archive_email" says "archive": a word for removing or ending something.
  What this check looks for
Description, as the server wrote it
Moves one inbox email to its mailbox's archive folder, on the mail server too. Undone by restore_to_inbox. Nothing is deleted.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

Can't be undone 5Sends, pays, publishes or merges: once done, it cannot be taken back.Claude Code: ask

create_campaign_draftWrites one draft inside an existing campaign, to one recipient (added to the campaign list if new), from the campaign's sender.Can send data outNo findings
Why it is in this group
- The name "create_campaign_draft" says "create": a word for a change.
- The input addresses people (input.to): what it sends cannot be taken back.
What it can reach
- outboundThe input takes a destination (input.to): what the tool writes goes there.
Description, as the server wrote it
Writes one draft inside an existing campaign, to one recipient (added to the campaign list if new), from the campaign's sender. Nothing is sent: the draft waits for the user to validate the campaign send in BumbleBox.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
draft_replySaves the text as the reply draft of a received email, from the mailbox that received it.Can send data outNo findings
Why it is in this group
- The name "draft_reply" says "reply": a word for sending, and what is sent cannot be taken back.
What it can reach
- outboundThe name "draft_reply" says "reply": it sends or publishes something to other people.
Description, as the server wrote it
Saves the text as the reply draft of a received email, from the mailbox that received it. Nothing is sent: the draft waits in BumbleBox (Pilotage › prepared replies) until the user reviews it and clicks Send. Saving again replaces the previous draft of the same email.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
list_replies_to_validateReplies received on campaigns that still need the user: prepared reply drafts waiting for validation, and replies with no answer yet (with the stored AI triage: kind, summary, whet…Reads text others write1 finding
Why it is in this group
- The name "list_replies_to_validate" says "list": a word for reading.
- The description's first verb is "reply": a word for sending, and what is sent cannot be taken back.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe name "list_replies_to_validate" says "list" and "reply": it reads comments, which other people can write.
- untrusted-inputThe description's first sentence says "reply" and "reply": it reads comments, which other people can write.
Findings
- Warn
  The server marks "list_replies_to_validate" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
  Matched text
  annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "list_replies_to_validate" says "list": a word for reading.
  What this check looks for
Description, as the server wrote it
Replies received on campaigns that still need the user: prepared reply drafts waiting for validation, and replies with no answer yet (with the stored AI triage: kind, summary, whether a human is needed).
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
send_replyReplies to the sender of one received email, and only to them (no Cc, no Bcc, no attachment), from the mailbox that received it.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "send_reply" says "send": a word for sending, and what is sent cannot be taken back.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe name "send_reply" says "send": it sends or publishes something to other people.
Description, as the server wrote it
Replies to the sender of one received email, and only to them (no Cc, no Bcc, no attachment), from the mailbox that received it. What happens next is the level the user set in BumbleBox for this kind of reply: a draft, a reply waiting for one tap (the default), or a reply that leaves after a delay the user can cancel. Anything that commits the user (amounts, bank details, acceptance, contracts, dates, links) always waits for the user. The result says which one applied.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: true
update_campaign_draftChanges the subject, body or recipient of a draft that is still a draft.Can send data outNo findings
Why it is in this group
- The name "update_campaign_draft" says "update": a word for a change.
- The input addresses people (input.to): what it sends cannot be taken back.
What it can reach
- outboundThe input takes a destination (input.to): what the tool writes goes there.
Description, as the server wrote it
Changes the subject, body or recipient of a draft that is still a draft. Nothing is sent, and a draft the user already validated cannot be changed.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: false
- idempotentHint: true

Changes things 3Creates or changes something that can be changed back.Claude Code: ask

move_emailMoves one inbox email to an existing folder of the same mailbox (see list_folders), on the mail server too.Can send data outNo findings
Why it is in this group
- The name "move_email" says "move": a word for a change.
What it can reach
- outboundThe name "move_email" says "move" and "email": it writes something other people read.
Description, as the server wrote it
Moves one inbox email to an existing folder of the same mailbox (see list_folders), on the mail server too. No folder is created. Undone by restore_to_inbox.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
restore_to_inboxMoves an archived, filed or trashed email back to the inbox, on the mail server too.No findings
Why it is in this group
- The description's first verb is "move": a word for a change.
Description, as the server wrote it
Moves an archived, filed or trashed email back to the inbox, on the mail server too.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
trash_emailMoves one inbox email to its mailbox's trash when BumbleBox certifies it as noise (spam, newsletter, promotion, with a unanimous safety vote and no known contact or action word).No findings
Why it is in this group
- The description's first verb is "move": a word for a change.
Description, as the server wrote it
Moves one inbox email to its mailbox's trash when BumbleBox certifies it as noise (spam, newsletter, promotion, with a unanimous safety vote and no known contact or action word). Any other email is not moved: it becomes a proposal the user confirms in one tap in BumbleBox. Never a permanent deletion; undone by restore_to_inbox.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false

Only reads 8Looks things up and changes nothing.Show 8 read-only tools

get_emailOne email in full: sender, recipients, date, subject, plain-text body, attachment names, folder and BumbleBox classification.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "get_email" says "get": a word for reading.
What it can reach
- private-dataThe name "get_email" says "get" and "email": it reads mail.
- private-dataThe description's first sentence says "email": it reads mail.
- untrusted-inputThe name "get_email" says "get" and "email": it reads inbound email, which other people can write.
- untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
Description, as the server wrote it
One email in full: sender, recipients, date, subject, plain-text body, attachment names, folder and BumbleBox classification.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
list_calendar_eventsEvents of the connected Google calendars between two dates (default: the next 7 days, at most 62 days).Reads private dataNo findings
Why it is in this group
- The name "list_calendar_events" says "list": a word for reading.
What it can reach
- private-dataThe name "list_calendar_events" says "list" and "calendar": it reads calendars.
- private-dataThe description's first sentence says "calendar": it reads calendars.
Description, as the server wrote it
Events of the connected Google calendars between two dates (default: the next 7 days, at most 62 days).
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
list_campaign_draftsThe drafts of one campaign that wait for the user to validate them in BumbleBox (recipient, subject, plain-text body, sender), newest first, with the true totals.No findings
Why it is in this group
- The name "list_campaign_drafts" says "list": a word for reading.
Description, as the server wrote it
The drafts of one campaign that wait for the user to validate them in BumbleBox (recipient, subject, plain-text body, sender), newest first, with the true totals.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
list_foldersThe folders of each connected mailbox, as last synced.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "list_folders" says "list": a word for reading.
What it can reach
- private-dataThe name "list_folders" says "list" and "folder": it reads files.
- private-dataThe description's first sentence says "folder": it reads files.
- untrusted-inputThe description's first sentence says "mailbox": it reads inbound email, which other people can write.
Description, as the server wrote it
The folders of each connected mailbox, as last synced. Trash, spam, sent and drafts are left out.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
list_missionsThe user's prospection campaigns (missions), most recently active first, with the number of drafts waiting, emails sent and prospects who replied.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "list_missions" says "list": a word for reading.
What it can reach
- private-dataThe description's first sentence says "email": it reads mail.
- untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
Description, as the server wrote it
The user's prospection campaigns (missions), most recently active first, with the number of drafts waiting, emails sent and prospects who replied.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
list_to_answerReceived emails BumbleBox classified as needing a reply and still in the inbox, newest first.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "list_to_answer" says "list": a word for reading.
What it can reach
- private-dataThe description's first sentence says "email": it reads mail.
- untrusted-inputThe description's first sentence says "email": it reads inbound email, which other people can write.
Description, as the server wrote it
Received emails BumbleBox classified as needing a reply and still in the inbox, newest first.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
search_contactsContacts BumbleBox knows from the mail history (name, address, organization domain, exchange counts, last exchanges, VIP mark, note), matched on name, address or domain.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "search_contacts" says "search": a word for reading.
What it can reach
- private-dataThe name "search_contacts" says "search" and "contact": it reads contacts.
- private-dataThe description's first sentence says "contact": it reads contacts.
- untrusted-inputThe description's first sentence says "mail": it reads inbound email, which other people can write.
Description, as the server wrote it
Contacts BumbleBox knows from the mail history (name, address, organization domain, exchange counts, last exchanges, VIP mark, note), matched on name, address or domain.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
search_emailsSearches every connected mailbox (sender, subject, preview), newest first.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "search_emails" says "search": a word for reading.
What it can reach
- private-dataThe name "search_emails" says "search" and "email": it reads mail.
- private-dataThe description's first sentence says "search" and "mailbox": it reads mail.
- untrusted-inputThe name "search_emails" says "search" and "email": it reads inbound email, which other people can write.
- untrusted-inputThe description's first sentence says "search" and "mailbox": it reads inbound email, which other people can write.
Description, as the server wrote it
Searches every connected mailbox (sender, subject, preview), newest first. Operators: from:, subject:, before:YYYY-MM-DD, after:YYYY-MM-DD; the rest is free text. Deleted emails are not returned.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

280 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 5 outbound tools breaks every one.

Reads private data7: Reads files, mail, messages, databases, secrets, calendars or repositories.; get_email
list_calendar_events
list_folders
list_missions
list_to_answer
search_contacts
search_emails
Reads text others write8: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; get_email
list_folders
list_missions
list_replies_to_validate
list_to_answer
search_contacts
search_emails
send_reply
Can send data out5: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; create_campaign_draft
draft_reply
move_email
send_reply
update_campaign_draft

deny to break every path

{
  "permissions": {
    "deny": [
      "mcp__mail__create_campaign_draft",
      "mcp__mail__draft_reply",
      "mcp__mail__move_email",
      "mcp__mail__send_reply",
      "mcp__mail__update_campaign_draft"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

2 warn

Warnarchive_email
The server marks "archive_email" not destructive (destructiveHint: false), and its own name, description or input give the class "destructive".
Matched text
annotations: {"readOnlyHint":false,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "archive_email" says "archive": a word for removing or ending something.
What this check looks for
Warnlist_replies_to_validate
The server marks "list_replies_to_validate" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
Matched text
annotations: {"readOnlyHint":true,"openWorldHint":false}; The name "list_replies_to_validate" says "list": a word for reading.
What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 2.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http mail https://api.bumblebox.ai/api/mcp

claude mcp add --transport http mail https://api.bumblebox.ai/api/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__mail__search_emails",
      "mcp__mail__get_email",
      "mcp__mail__list_to_answer",
      "mcp__mail__search_contacts",
      "mcp__mail__list_folders",
      "mcp__mail__list_calendar_events",
      "mcp__mail__list_missions",
      "mcp__mail__list_campaign_drafts"
    ],
    "ask": [
      "mcp__mail__draft_reply",
      "mcp__mail__send_reply",
      "mcp__mail__move_email",
      "mcp__mail__trash_email",
      "mcp__mail__restore_to_inbox",
      "mcp__mail__list_replies_to_validate",
      "mcp__mail__create_campaign_draft",
      "mcp__mail__update_campaign_draft"
    ],
    "deny": [
      "mcp__mail__archive_email"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as mail. Review it before you use it.

Capability tags behind 13 rules

mcp__mail__search_emails private-data, untrusted-input
mcp__mail__get_email private-data, untrusted-input
mcp__mail__list_to_answer private-data, untrusted-input
mcp__mail__search_contacts private-data, untrusted-input
mcp__mail__list_folders private-data, untrusted-input
mcp__mail__list_calendar_events private-data
mcp__mail__draft_reply outbound
mcp__mail__send_reply untrusted-input, outbound
mcp__mail__move_email outbound
mcp__mail__list_missions private-data, untrusted-input
mcp__mail__list_replies_to_validate untrusted-input
mcp__mail__create_campaign_draft outbound
mcp__mail__update_campaign_draft outbound

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/ai.bumblebox/mail/verify?hash=735c7e60d3331df6e49567a64508882646b17a20b26fd199f41c5f4a88e9eef3" | jq -e '.changed == false'

Pinned hash 735c7e60d333, from Oct 22, 2026, 16:17 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/ai.bumblebox/mail/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/ai.bumblebox/mail.svg)](https://anlyon.dev/servers/ai.bumblebox/mail)

Source: MCP Registry · repository. Synced Oct 22, 2026, 16:17 UTC.