CherryMail for MCP clients
Bring scoped email tools to your AI client, with you in control of sending and deletion.
Connect with hosted OAuth
Add the endpoint below to an MCP client that supports Streamable HTTP and OAuth. Sign in to CherryMail, choose your account and mailboxes, and consent to the requested permissions.
https://cherrymail.net/mcpThe server uses authorization-code OAuth with S256 PKCE, resource-bound tokens, and rotating refresh tokens. Connecting a client does not automatically grant access to every mailbox.
Use the local stdio bridge
For clients that run a local MCP command, download the CherryMail MCP bridge ↗, extract it, and install its dependencies with Bun. Create a Local MCP credential in Integrations.
cd /absolute/path/cherrymail-mcp
bun install
export CHERRYMAIL_MCP_KEY='your-cm_mcp_-credential'
bun run index.tsThe bridge forwards to the same hosted tool implementation and retains the approval policy. The default server is https://cherrymail.net/mcp; CHERRYMAIL_MCP_URL can override it.
Configure your client
Use an absolute path to the extracted bridge. For Codex, export CHERRYMAIL_MCP_KEY in the environment that starts the client. For the JSON configurations, supply the purpose-bound local MCP key through your client’s secure environment settings where supported.
[mcp_servers.cherrymail]
command = "bun"
args = ["/absolute/path/cherrymail-mcp/index.ts"]
env_vars = ["CHERRYMAIL_MCP_KEY"]These are connection recipes for local stdio. Hosted OAuth setup varies by client and version; use the hosted URL only where that client supports the required flow.
Review actions in CherryMail
Tools use the cherrymail_ prefix. Reads and drafts run within your grants. Sending and destructive operations create an immutable pending action and return a CherryMail approval link.
- Open the approval link and review the exact recipients, message, attachments, or deletion targets.
- Approve or reject in CherryMail. The approval expires after ten minutes and can be used once.
- Check status with
cherrymail_approvals_get. Permissions are rechecked before execution.