Best MCP Servers for Email in 2026 (Ranked + Setup)
The best email MCP for an AI agent depends on the job: Microsoft 365 (@softeria/ms-365-mcp-server) for reading and triaging an Outlook/M365 mailbox, the Gmail MCP for Google mailboxes, and Resend for sending transactional mail from the agent. Reading a mailbox and sending machine email are different jobs with different auth models and different blast radii — below: seven ranked picks split along that line, install commands, and the risk boundaries that matter.
The one decision that matters: mailbox or sender?
Every email MCP falls on one side of a line. Mailbox servers (Microsoft 365, Gmail) authenticate as you via OAuth 2.1 and can read, search, label, and draft inside a human inbox — their leaked-token risk is impersonation. Sender servers (Resend, Postmark, Mailgun, SendGrid) authenticate with an API key against a sending platform and can dispatch mail at your domain's reputation — their leaked-key risk is spend and deliverability, but they read nothing. Most agent stacks eventually want one of each; almost none should start with both.
Setup time
2–15 min per server
Auth split
Mailboxes: OAuth 2.1 · Senders: API key
Riskiest action
Unattended send to external humans
Neither Google nor Microsoft ships an installable mailbox MCP
@gongrzhe/server-gmail-autoauth-mcp and Microsoft 365 through @softeria/ms-365-mcp-server (MIT, Graph API). Both are the most-adopted options in their lane, but neither carries a vendor support contract. If that is a blocker — regulated industries, tenant-wide deployments — drive Gmail or Outlook through a workflow platform's vetted integration instead and give the agent the automation MCP, not the mailbox token.Decision tree — which email MCP for which job
Pick by where the mail lives first, by what the agent does with it second.
| If you… | Install | Why |
|---|---|---|
| Your mail lives in Microsoft 365 / Outlook | Microsoft 365 MCP | One Graph server for mail + calendar + Teams + OneDrive; OAuth 2.1; MIT. |
| Your mail lives in Gmail | Gmail MCP | Most-installed community wrapper; auto-OAuth; triage, search, labels, drafts. |
| The agent sends app or alert email | Resend | Official MCP, API key, 2-minute setup, modern send/broadcast/contact surface. |
| Agent mail must stay strictly transactional | Postmark | Platform-level separation of transactional vs broadcast — the agent cannot drift into campaigns. |
| You operate email infrastructure (DNS, routes, suppressions) | Mailgun | Official MCP aimed at the operational surface the dashboard makes painful. |
| You are already on SendGrid at scale | SendGrid | Delivery investigation, suppression audits, and sender-auth checks from chat. |
| Your tenant has Microsoft 365 Copilot licences | Work IQ | First-party semantic search across mail, Teams and files — not mailbox CRUD. |
| You are compliance-bound and cannot hand tokens to community code | Route via n8n / Zapier | Vendor-maintained Gmail/Outlook integrations with the OAuth handled by the platform. |
The 7 email MCPs worth installing
Ordered by breadth of agent workflows unlocked: the two mailbox servers first, then the senders from greenfield to specialist, then the one first-party niche pick. Stop wherever the rest stops being your stack.
Microsoft 365
10 min setupMicrosoft 365 is where most business email and calendars actually live, and Outlook is only in this directory as a ChatGPT-native app. This is the server that gives Claude, Cursor, and VS Code the same reach outside ChatGPT, without wiring Graph by hand.
npx -y @softeria/ms-365-mcp-server
Gmail
15 min setupEmail is the highest-frequency surface for many users. Google has no official MCP; this community implementation has the highest install count and the cleanest auto-OAuth UX.
npx @gongrzhe/server-gmail-autoauth-mcp
Resend
2 min setupResend is the modern Stripe-style email API. The official MCP is the cleanest path to letting an agent send transactional or marketing email from inside a chat or coding session.
npx -y resend-mcp
Postmark
5 min setupTransactional email from agents is the most common "agent does something in the real world" workflow. Postmark's separation of transactional and broadcast traffic means an agent cannot get pulled into a marketing-blast incident.
npx -y @activecampaign/postmark-mcp
Mailgun
5 min setupMailgun is the long-time canonical transactional email provider. The official MCP lets an agent handle the operational surface (DNS, suppressions, route changes) that is usually painful via the dashboard.
npx -y @mailgun/mcp-server
SendGrid
10 min setupSendGrid (Twilio) is the most-installed transactional email platform globally. An MCP turns delivery investigation, suppression-list audits, and one-off agent sends into chat prompts.
npx -y sendgrid-mcp
Microsoft Work IQ
10 min setupIt answers the questions a Graph API wrapper cannot: "what did my manager say about the deadline" spans mail, chat and documents at once. That semantic layer over an entire M365 tenant is what a per-endpoint server has no way to reach.
npx -y @microsoft/workiq
Draft-and-approve is the pattern for anything leaving your domain
Quick comparison
| MCP | Job | Auth | Provenance |
|---|---|---|---|
| Microsoft 365 | M365 mailbox + calendar + Teams | OAuth 2.1 | Community (MIT), most-adopted |
| Gmail | Gmail triage, search, drafts | OAuth 2.1 | Community, most-installed |
| Resend | Transactional + broadcast send | API key | Official |
| Postmark | Strictly transactional send | API key | Official (ActiveCampaign) |
| Mailgun | Email ops: DNS, routes, suppressions | API key | Official |
| SendGrid | Send + delivery investigation at scale | API key | Community wrapper |
| Work IQ | Semantic search across an M365 tenant | OAuth 2.1 | Official (paid, Copilot licence) |
Common gotchas
Graph API scopes need admin consent in most tenants
The Microsoft 365 MCP requests Graph scopes (Mail.Read, Calendars.Read, and upward) that many tenants gate behind admin consent. If the OAuth flow ends in "need admin approval," that is tenant policy, not a broken server — the catalog entry flags exactly this. Get the scopes consented once by an admin, or scope the request down to read-only.
A mailbox token is an identity, not an integration
Whoever holds a Gmail or M365 token can read everything and write as you. Grant the narrowest scopes the flow offers, prefer draft-only over send where possible, and treat community-wrapper token storage as part of your threat model — this is the single biggest difference between the mailbox picks and the API-key senders.
Sender keys should live on a dedicated subdomain
Send agent mail from mail.yourapp.com, not yourdomain.com. If an agent loop or a leaked key damages sender reputation, the blast radius stays on the subdomain. Every sender platform here supports per-domain keys — use them.
Rate limits amplify inside agent retry loops
An agent that retries a failed send can burn through a per-second rate limit in one conversation. SendGrid and Mailgun both flag this in their catalog entries. For high-volume flows, call the SDK from application code and keep the MCP for investigation and one-offs.
The ChatGPT apps are not the developer servers
Outlook Email and Fyxer exist in this directory as ChatGPT Apps — one-click OAuth, usable only inside chatgpt.com. They are not installable in Claude Code or Cursor and are ranked separately for that reason. The installable path to Outlook mail is the Microsoft 365 MCP.
Frequently asked questions
Which email MCP should I install first?
Answer one question first: does the agent need to read a human mailbox, or send machine-generated mail? For a mailbox, install the Microsoft 365 MCP if your mail lives in Outlook/M365 (one Graph API server covering mail, calendar, Teams, and OneDrive, OAuth 2.1) or the Gmail MCP for Google mailboxes. For sending, install Resend — a 2-minute API-key setup with the cleanest agent ergonomics. These are different jobs with different risk profiles, and most teams need one of each.
Is there an official Gmail MCP from Google?
No. Google ships an official remote MCP for Calendar, but not for Gmail. The most-installed option is the community @gongrzhe/server-gmail-autoauth-mcp, which has the cleanest auto-OAuth setup of the Gmail wrappers. That community provenance matters: there is no vendor support contract, so compliance-bound enterprises should route Gmail through a workflow platform (n8n, Zapier) instead of a community wrapper holding mailbox tokens.
Is there an official Microsoft MCP for Outlook email?
Not as an installable server for Claude or Cursor. Microsoft publishes Outlook Email as a ChatGPT app (usable only inside ChatGPT) and ships Work IQ, a paid first-party server that does semantic search across a Copilot-licensed tenant rather than mailbox CRUD. For actually reading and sending Outlook mail from a developer client, the community @softeria/ms-365-mcp-server (MIT, OAuth 2.1 against the Graph API) is the working path — it is the most-adopted email MCP on npm by a wide margin.
Should an agent send email unattended?
Sending to external humans, no — draft-and-approve is the correct pattern for anything leaving your domain, because a sent email is irreversible. Machine email is different: transactional alerts and notifications through Resend or Postmark, authenticated by an API key with a scoped sender domain, are a routine unattended workflow. The line is not "can the agent send" but "who reads the result and can you take it back."
Resend vs SendGrid vs Postmark vs Mailgun — which sender?
Resend for greenfield projects: modern API, official MCP, 2-minute setup. Postmark when you want a structural guarantee that agent mail stays transactional — it separates transactional and broadcast traffic at the platform level, so an agent cannot drift into campaign sending. SendGrid when you are already on it at scale and want delivery investigation (Activity Feed, suppression audits) from chat. Mailgun when the job is operational — DNS verification, routes, suppression lists — rather than the send itself.
What is the blast radius of a leaked email credential?
Asymmetric between the two families. A mailbox OAuth token (Microsoft 365, Gmail) can read your inbox and impersonate you to anyone you know — treat it like a password to your identity, grant the narrowest scopes offered, and prefer read-plus-draft over full send where the flow allows. A sender API key (Resend, Postmark, SendGrid, Mailgun) can spend money and damage your domain reputation, but reads nothing. Scope sender keys to a single sending domain and rotate them like any production secret.
Which email MCPs work with ChatGPT?
Inside the ChatGPT Apps directory: Outlook Email (Microsoft-published, OAuth in one click, usable only in ChatGPT). Via Developer Mode remote connectors: Microsoft 365 and Resend both expose streamable-http transports, so they can be added as custom connectors against a hosted instance. The stdio-only servers (Gmail, Postmark, Mailgun, SendGrid) need a developer client such as Claude Code, Cursor, or Claude Desktop.
More for email
See the full Email category page for every ranked and tracked entry, live adoption stats, and per-client install snippets.
More guides
Setup Guide
Best MCP Servers for Scheduling & Calendar in 2026
9 min read
Guide
MCP Servers for Agents Running Unattended (2026 Guide)
8 min read
Research
State of MCP, Q3 2026: What 393 Servers Tell Us
7 min read
Research
MCP Category Coverage in 2026: Where the Servers Actually Are
6 min read
Comparison
AWS MCP vs Azure MCP: Which to Use in 2026
7 min read
Comparison
Square MCP vs Stripe MCP: Which to Use in 2026
7 min read
Ranked Guide
Best MCPs for DevOps in 2026 (Ranked)
11 min read
Vertical Guide
Best MCPs for Domains and DNS in 2026 (Ranked)
8 min read
Comparison
Namecheap vs GoDaddy vs Cloudflare MCP (2026)
7 min read
Vertical Guide
Best MCPs for Payments in 2026 (Ranked)
8 min read
Vertical Guide
Best MCPs for Invoicing and Accounting in 2026
9 min read
Comparison
Stripe MCP vs PayPal MCP: Which to Use in 2026
6 min read
Ranked Guide
Best MCP Servers for Postgres in 2026 (Ranked)
12 min read
Ranked Guide
Best MCP Servers for Browser Automation in 2026 (Ranked)
12 min read
Ranked Guide
Best MCP Servers for Vector Databases in 2026 (RAG-Ready)
11 min read
Ranked Guide
Best MCP Servers for Git in 2026 (GitHub, GitLab, Bitbucket, Local)
11 min read
Ranked Guide
Best MCP Servers for Workflow Automation in 2026 (Ranked)
11 min read
Ranked Guide
Best Free MCP Servers in 2026 (No API Key Required)
10 min read
Comparison
GitHub vs GitLab MCP: Which to Use in 2026
8 min read
Comparison
Pinecone vs Qdrant vs Chroma MCP: Which to Use (2026)
9 min read
Comparison
Playwright vs Browserbase MCP: Local vs Cloud (2026)
8 min read
Comparison
Postgres MCP vs Supabase MCP: Which to Use (2026)
8 min read
Comparison
n8n vs Zapier vs Make MCP: Which to Use (2026)
9 min read
Ranked Guide
Best MCP Servers for Deploying Websites in 2026 (Ranked)
11 min read
Comparison
Vercel vs Netlify vs Cloudflare MCP: Which to Use (2026)
9 min read
Tutorial
Deploy to Vercel With an AI Agent (Vercel MCP, 2026)
7 min read
Tutorial
Deploy to Cloudflare With an AI Agent (Cloudflare MCP, 2026)
7 min read
Strategy
Can an AI Agent Deploy to Production? (Safely, in 2026)
8 min read
Fundamentals
What Is MCP? A Plain-English Guide to Model Context Protocol
6 min read
Setup Guide
Best MCPs for Cursor in 2026 (Ranked + Setup)
8 min read
Setup Guide
Best MCPs for Claude Desktop in 2026 (Ranked + Setup)
9 min read
Setup Guide
Best MCPs for Claude Code in 2026 (Ranked + Setup)
8 min read
Setup Guide
Best MCPs for Codex CLI in 2026 (Ranked + config.toml)
8 min read
Setup Guide
Best MCPs for Windsurf in 2026 (Cascade-Ready Setup)
8 min read
Setup Guide
Best MCPs for VS Code in 2026 (Agent Mode + .vscode/mcp.json)
8 min read
Vertical Guide
Best MCPs for Marketing in 2026 (Ranked + Use Cases)
9 min read
Vertical Guide
Best MCPs for SEO in 2026 (Ranked + Workflows)
9 min read
Vertical Guide
Best MCPs for Data Teams in 2026 (Ranked + Workflows)
9 min read
Vertical Guide
Best MCPs for Security in 2026 (Ranked + Posture Workflows)
10 min read
Strategy
MCP Registry vs Curated Directory: Which Should You Use?
5 min read
Setup Guide
Best MCPs for ChatGPT: The Apps and Connectors Worth Installing
9 min read
Tutorial
How to Add an MCP Server to ChatGPT (Developer Mode + Apps Directory)
8 min read
Security
MCP Security: What to Know Before You Install
9 min read
Role Guide
Best MCPs for Marketers in 2026 (SEO, Email, Analytics)
8 min read
Strategy
Remote vs Local MCP Servers: When to Use Each
7 min read
Fundamentals
MCP vs Function Calling: What’s the Difference?
6 min read
Comparison
MCP Directories Compared: Top MCPs vs mcp.so vs PulseMCP vs mcp.directory
8 min read
Security
MCP Prompt Injection: How Tool-Calling Agents Get Hijacked
8 min read
Security
OAuth 2.1 for MCP: What the Spec Standardised and What You Need to Know
8 min read
Security
Sandboxing MCP Servers: Containers, Least Privilege, and Process Isolation
9 min read
Security
Rotating MCP Credentials: A Practical Guide for Leaks, Expiry, and Routine Hygiene
7 min read
Security
Least-Privilege Scoping for MCPs: How to Grant the Smallest Useful Permission
7 min read
Setup Guide
Best MCP Servers for Databases in 2026 (Ranked + Setup)
10 min read
Setup Guide
Best MCP Servers for Research in 2026 (Search, Scrape, Synthesize)
9 min read
Setup Guide
Best MCP Servers for Design-to-Code in 2026 (Figma → React)
9 min read
Setup Guide
Best MCP Servers for Domains in 2026 (Registrars + DNS)
9 min read
Tutorial
How to Buy a Domain From Claude (Cloudflare MCP, Step by Step)
6 min read
Tutorial
How to Search for Domains With an AI Agent (Cross-Registrar Workflow)
7 min read
Tutorial
How to Deploy a Website With an AI Agent (MCP Workflow)
8 min read