Human Mailbox

com.humanmailbox/mailboxhumanmailbox.comstreamable-httpv1.0.0Scanned 2 hours ago

A physical postal address in Germany for AI agents. A human opens, scans and forwards your mail.

32 tools: 1 can delete or cancel things, 3 do something that can't be undone, 13 change things and 15 only read.

Reads private data · 8
Reads text others write · 8
Can send data out · 4
1 finding

Anlyon alternative

17 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

32 tools

Deletes or cancels 1Removes, cancels or revokes something.Claude Code: deny

cancel_requestCancel an order that has not started; paid money goes back to your balance.No findings
Why it is in this group
- The name "cancel_request" says "cancel": a word for removing or ending something.
Description, as the server wrote it
Cancel an order that has not started; paid money goes back to your balance.

Can't be undone 3Sends, pays, publishes or merges: once done, it cannot be taken back.Claude Code: ask

pay_itemAn item that arrived without credits or balance waits unopened (payment_status unpaid).No findings
Why it is in this group
- The name "pay_item" says "pay": a word that usually means money moves, which cannot be taken back.
Description, as the server wrote it
An item that arrived without credits or balance waits unopened (payment_status unpaid). Pay it here (credits, balance or x402).
pay_subscriptionPrepay 1–12 mailbox months (15 € each) from your balance or with x402.No findings
Why it is in this group
- The name "pay_subscription" says "pay": a word that usually means money moves, which cannot be taken back.
Description, as the server wrote it
Prepay 1–12 mailbox months (15 € each) from your balance or with x402.
send_messageWrite to the human who handles your mail.Can send data outNo findings
Why it is in this group
- The name "send_message" says "send": a word for sending, and what is sent cannot be taken back.
What it can reach
- outboundThe name "send_message" says "send": it sends or publishes something to other people.
Description, as the server wrote it
Write to the human who handles your mail.

Changes things 13Creates or changes something that can be changed back.Claude Code: ask

accept_quoteAccept the quoted price of an order (status quote_ready) and pay it.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Accept the quoted price of an order (status quote_ready) and pay it.
announce_shipmentTell the human that something is on its way (tracking number helps).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Tell the human that something is on its way (tracking number helps). To have something done as soon as it arrives, call request_action with the returned shipment_id.
buy_bundleBuy a bundle of letter credits (letters_1 5 €, letters_10 40 €, letters_100 300 €) or same-day credits (same_day_10, same_day_100).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Buy a bundle of letter credits (letters_1 5 €, letters_10 40 €, letters_100 300 €) or same-day credits (same_day_10, same_day_100). Every arriving letter uses 1 credit, a parcel 3. Paid from balance or inline with x402.
check_top_upRe-check whether a Bitcoin or PayPal top-up was paid.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Re-check whether a Bitcoin or PayPal top-up was paid.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
contact_humanWorks without an account.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Works without an account. For anything that is not a standard order: topic special_request (a job not in the price list: say what, where, when, budget_eur), is_it_possible (ask before you send mail for it), payment_method (your payment method is missing: give method_wanted), feature_request, problem, question, other. A human answers, usually within one business day. Without api_key you get a ticket: read the answer with check_inquiry.
express_interestNo account needed.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
No account needed. Not ready to register, or need something we do not offer yet (another country, a feature)? Leave a note: kind (agent | human), name, email (optional), country_wanted, use_case, found_via. We tell you when it is available.
register_mailboxCreate your own mailbox at a physical street address in Germany.Reads text others writeCan send data outNo findings
Why it is in this group
- The description's first verb is "create": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a URL (input.webhook_url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it
Create your own mailbox at a physical street address in Germany. Returns an API key (shown once) and a mailbox code HM-XXXXX that must be written on every envelope. operator_* is the responsible human or company (the contract partner). No human? Leave operator_* out: the mailbox runs on its own with limits (250 € in per month, letters only are forwarded, no parcels). address_name = the name on your mail (yours, an artist or made-up name; not a company, brand, authority or famous person). Read https://humanmailbox.com/legal/terms first.
Annotations the server declares
- openWorldHint: true
request_actionAsk the human to do something with your mail, documents or parcels.Reads text others writeCan send data outNo findings
Why it is in this group
- The name "request_action" says "request": a word for a change.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe input takes a destination (input.address.phone): what the tool writes goes there.
Description, as the server wrote it
Ask the human to do something with your mail, documents or parcels. scan = open + scan (included; same_day: true = today, +2 €). forward = 5 € (letter) / 10 € (parcel) handling + postage (express: +5 €). return. send_letter = we print and post a letter you give as text or pdf_base64 (8 € + postage; registered: einschreiben…). ship_out = returns/shipping for goods here with your label_pdf_base64 or an address (20 € + postage). digitize = receipts, QR codes, labels, serial numbers of an item as photo/PDF/JSON (15 €, say what in note). buy_voucher = we buy a permitted gift card (product, value_eur ≤ 100; face value + 10 %, min 5 €; quoted first, code goes to your vault). buy_item = we buy something only sold locally / by post (what, where, max_price_eur; price + 10 %, min 15 €; quoted first). courier, dispose, custom. Fixed parts are paid at once (balance or x402); quoted parts wait for a price (then accept_quote).
Annotations the server declares
- destructiveHint: false
- openWorldHint: true
request_invoiceOnly if you need an invoice: creates one (free, no VAT under § 19 UStG) for your payments that have none yet, or for the given payment_ids, and emails it (default: your operator em…No findings
Why it is in this group
- The name "request_invoice" says "request": a word for a change.
Description, as the server wrote it
Only if you need an invoice: creates one (free, no VAT under § 19 UStG) for your payments that have none yet, or for the given payment_ids, and emails it (default: your operator email). Nothing is invoiced unless you call this. billing.name defaults to the operator name; over €250 the full address is required.
reveal_codesReveal waiting codes (1 € per code, from balance or x402).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Reveal waiting codes (1 € per code, from balance or x402). Give ids, or nothing to reveal all waiting codes. Codes not retrieved within 24 months expire.
start_demoFree demo mailbox, no registration: play money (€20 + letter credits), a scanned sample letter and a sealed sample parcel, a sample gift card code.1 finding
Why it is in this group
- The name "start_demo" says "start": a word for a change.
Findings
- Warn
  The description contains "all other tools", wording about other tools or servers.
  Matched text
  description: "...0 seconds later. Returns an api_key for all other tools. Deleted after 7 days; nothing is shipp..."
  What this check looks for
Description, as the server wrote it
Free demo mailbox, no registration: play money (€20 + letter credits), a scanned sample letter and a sealed sample parcel, a sample gift card code. A simulated human handles your orders about 20 seconds later. Returns an api_key for all other tools. Deleted after 7 days; nothing is shipped.
top_upAdd money (EUR): method x402 (pay now in USDC at the current rate), btc (get a Bitcoin address + amount) or paypal (get a link for your human operator).No findings
Why it is in this group
- The description's first verb is "add": a word for a change.
Description, as the server wrote it
Add money (EUR): method x402 (pay now in USDC at the current rate), btc (get a Bitcoin address + amount) or paypal (get a link for your human operator). Give amount_eur, or bundle to buy that bundle as soon as it is paid.
update_accountSet budget_eur_month (spending limit for orders, null = none), webhook_url, open_policy (standard | same_day | never), address_name (name on your mail), auto_reveal_codes, or name …Can send data outNo findings
Why it is in this group
- The name "update_account" says "update": a word for a change.
What it can reach
- outboundThe input takes a URL (input.webhook_url): a request to a URL can carry data to whoever runs it.
Description, as the server wrote it
Set budget_eur_month (spending limit for orders, null = none), webhook_url, open_policy (standard | same_day | never), address_name (name on your mail), auto_reveal_codes, or name your human operator (operator_name + operator_email).

Only reads 15Looks things up and changes nothing.Show 15 read-only tools

check_inquiryStatus and answers of an inquiry from contact_human.Reads private dataNo findings
Why it is in this group
- The description's first verb is "status": a word for reading.
What it can reach
- private-dataThe description's first sentence says "status" and "contact": it reads contacts.
Description, as the server wrote it
Status and answers of an inquiry from contact_human. Give its id and the ticket (or use your api_key).
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
get_accountYour account, balance, address and counts.No findings
Why it is in this group
- The name "get_account" says "get": a word for reading.
Description, as the server wrote it
Your account, balance, address and counts.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
get_addressThe street address to put on letters and parcels, with your mailbox code in the first line.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "get_address" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "mailbox": it reads mail.
- untrusted-inputThe description's first sentence says "mailbox": it reads inbound email, which other people can write.
Description, as the server wrote it
The street address to put on letters and parcels, with your mailbox code in the first line. For registrations that need a first and last name, style "person" gives your operator's name with "c/o Human Mailbox HM-…" in the next line (never invent a name).
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
get_balanceYour balance and recent transactions.No findings
Why it is in this group
- The name "get_balance" says "get": a word for reading.
Description, as the server wrote it
Your balance and recent transactions.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
get_itemDetails of one arrived item; photos and scans are returned as images you can see.No findings
Why it is in this group
- The name "get_item" says "get": a word for reading.
Description, as the server wrote it
Details of one arrived item; photos and scans are returned as images you can see.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
get_pricesPrices in EUR: mailbox 15 € per 30 days, letter 5 € (open + scan), parcel 15 €, bundles, same-day, forwarding, all 8 services (send letters, vouchers, purchases, digitizing, return…Reads private dataReads text others writeNo findings
Why it is in this group
- The name "get_prices" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "mailbox": it reads mail.
- untrusted-inputThe description's first sentence says "mailbox": it reads inbound email, which other people can write.
Description, as the server wrote it
Prices in EUR: mailbox 15 € per 30 days, letter 5 € (open + scan), parcel 15 €, bundles, same-day, forwarding, all 8 services (send letters, vouchers, purchases, digitizing, returns), payment methods.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
get_requestOne order with result notes, tracking and files.Reads private dataNo findings
Why it is in this group
- The name "get_request" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "note": it reads notes.
Description, as the server wrote it
One order with result notes, tracking and files.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
get_subscriptionThe mailbox costs 15 € per 30 days and renews from your balance: status and paid_until.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "get_subscription" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "mailbox": it reads mail.
- untrusted-inputThe description's first sentence says "mailbox": it reads inbound email, which other people can write.
Description, as the server wrote it
The mailbox costs 15 € per 30 days and renews from your balance: status and paid_until.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
get_summaryThis month: costs by kind, budget used, subscription, open orders, mail and shipments.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "get_summary" says "get": a word for reading.
What it can reach
- private-dataThe description's first sentence says "mail": it reads mail.
- untrusted-inputThe description's first sentence says "mail": it reads inbound email, which other people can write.
Description, as the server wrote it
This month: costs by kind, budget used, subscription, open orders, mail and shipments.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
list_codesGift card / voucher codes that arrived by mail.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "list_codes" says "list": a word for reading.
What it can reach
- private-dataThe description's first sentence says "mail": it reads mail.
- untrusted-inputThe description's first sentence says "mail": it reads inbound email, which other people can write.
Description, as the server wrote it
Gift card / voucher codes that arrived by mail. Waiting codes show only label and last characters; revealed codes include the code.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
list_invoicesInvoices you requested (with full text), plus payments that have no invoice yet.No findings
Why it is in this group
- The name "list_invoices" says "list": a word for reading.
Description, as the server wrote it
Invoices you requested (with full text), plus payments that have no invoice yet.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
list_itemsEverything that arrived for you, newest first, with photo links.No findings
Why it is in this group
- The name "list_items" says "list": a word for reading.
Description, as the server wrote it
Everything that arrived for you, newest first, with photo links.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
list_messagesMessages between you and the human.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "list_messages" says "list": a word for reading.
What it can reach
- private-dataThe name "list_messages" says "list" and "message": it reads messages.
- private-dataThe description's first sentence says "message": it reads messages.
- untrusted-inputThe name "list_messages" says "list" and "message": it reads messages, which other people can write.
- untrusted-inputThe description's first sentence says "message": it reads messages, which other people can write.
Description, as the server wrote it
Messages between you and the human.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
list_requestsYour orders and their status.No findings
Why it is in this group
- The name "list_requests" says "list": a word for reading.
Description, as the server wrote it
Your orders and their status.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
list_shipmentsYour announced shipments.No findings
Why it is in this group
- The name "list_shipments" says "list": a word for reading.
Description, as the server wrote it
Your announced shipments.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

256 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 4 outbound tools breaks every one.

Reads private data8: Reads files, mail, messages, databases, secrets, calendars or repositories.; check_inquiry
get_address
get_prices
get_request
get_subscription
get_summary
list_codes
list_messages
Reads text others write8: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; get_address
get_prices
get_subscription
get_summary
list_codes
list_messages
register_mailbox
request_action
Can send data out4: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; register_mailbox
request_action
send_message
update_account

deny to break every path

{
  "permissions": {
    "deny": [
      "mcp__mailbox__register_mailbox",
      "mcp__mailbox__request_action",
      "mcp__mailbox__send_message",
      "mcp__mailbox__update_account"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

1 warn

Warnstart_demo
The description contains "all other tools", wording about other tools or servers.
Matched text
description: "...0 seconds later. Returns an api_key for all other tools. Deleted after 7 days; nothing is shipp..."
What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http mailbox https://humanmailbox.com/mcp

claude mcp add --transport http mailbox https://humanmailbox.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__mailbox__get_prices",
      "mcp__mailbox__get_account",
      "mcp__mailbox__get_address",
      "mcp__mailbox__list_shipments",
      "mcp__mailbox__list_items",
      "mcp__mailbox__get_item",
      "mcp__mailbox__list_requests",
      "mcp__mailbox__get_request",
      "mcp__mailbox__list_codes",
      "mcp__mailbox__list_invoices",
      "mcp__mailbox__check_inquiry",
      "mcp__mailbox__get_balance",
      "mcp__mailbox__get_summary",
      "mcp__mailbox__get_subscription",
      "mcp__mailbox__list_messages"
    ],
    "ask": [
      "mcp__mailbox__register_mailbox",
      "mcp__mailbox__start_demo",
      "mcp__mailbox__express_interest",
      "mcp__mailbox__buy_bundle",
      "mcp__mailbox__pay_item",
      "mcp__mailbox__announce_shipment",
      "mcp__mailbox__request_action",
      "mcp__mailbox__accept_quote",
      "mcp__mailbox__reveal_codes",
      "mcp__mailbox__request_invoice",
      "mcp__mailbox__contact_human",
      "mcp__mailbox__pay_subscription",
      "mcp__mailbox__update_account",
      "mcp__mailbox__top_up",
      "mcp__mailbox__check_top_up",
      "mcp__mailbox__send_message"
    ],
    "deny": [
      "mcp__mailbox__cancel_request"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as mailbox. Review it before you use it.

Capability tags behind 12 rules

mcp__mailbox__register_mailbox untrusted-input, outbound
mcp__mailbox__get_prices private-data, untrusted-input
mcp__mailbox__get_address private-data, untrusted-input
mcp__mailbox__request_action untrusted-input, outbound
mcp__mailbox__get_request private-data
mcp__mailbox__list_codes private-data, untrusted-input
mcp__mailbox__check_inquiry private-data
mcp__mailbox__get_summary private-data, untrusted-input
mcp__mailbox__get_subscription private-data, untrusted-input
mcp__mailbox__update_account outbound
mcp__mailbox__send_message outbound
mcp__mailbox__list_messages private-data, untrusted-input

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/com.humanmailbox/mailbox/verify?hash=ad4845dd371950e53577905097d84199057a645182ef6b16c909cc85fc6f0247" | jq -e '.changed == false'

Pinned hash ad4845dd3719, from Oct 29, 2026, 22:19 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.humanmailbox/mailbox/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/com.humanmailbox/mailbox.svg)](https://anlyon.dev/servers/com.humanmailbox/mailbox)

Source: MCP Registry. Synced Oct 29, 2026, 22:17 UTC.