MCPUpdated 2026-05-25
MCP OAuth Setup
Connect Claude, Cursor, Codex, or another MCP client to Mailbase with OAuth-scoped workspace access.
Canonical: /docs/mcp-oauth
Remote MCP Server
Mailbase exposes a remote Streamable HTTP MCP server. OAuth is the preferred auth path, so clients do not need a Mailbase API token or shared secret.
| Resource | Path |
|---|---|
| Streamable HTTP endpoint | /api/mcp/mcp |
| SSE endpoint | /api/mcp/sse |
| Manifest | /api/mcp/manifest |
| MCPB bundle | /api/mcp/manifest.mcpb |
| OAuth metadata | /.well-known/oauth-authorization-server |
| Protected resource metadata | /.well-known/oauth-protected-resource |
Connect A Client
Use the Mailbase origin plus /api/mcp/mcp as the remote server URL. The client discovers OAuth metadata, opens the authorization screen, and receives tokens scoped to the approved workspace.
codex mcp add mailbase --url https://mailbase.example.com/api/mcp/mcp
claude mcp add mailbase --transport http https://mailbase.example.com/api/mcp/mcpWorkspace Scope
- OAuth tokens are pinned to the workspace approved during the authorization flow.
- Legacy bearer-token clients must explicitly choose a workspace and are not allowed to silently fall back to the first workspace.
- MCP tools return current workspace context so AI clients can confirm where they are operating before writing drafts or changing data.
Review And Revoke
- Open Settings, then API & webhooks, to review connection status and available tools.
- Revoke OAuth clients when a teammate leaves, a client is replaced, or a machine is retired.
- Nothing an MCP client writes is sent: drafts land in the app for a person to review and send.