# inboxy.net

> Don't give AI your inbox. Give your AI an inbox. inboxy is a privacy-focused email aliasing service with an AI-readable inbox: users hand out `@inboxy.net` addresses instead of their real email, and read what arrives via the web, a REST API, or an MCP server at https://mcp.inboxy.net.

Key facts an agent should know before acting on a user's behalf:

- The user's personal email is sign-in only. inboxy never connects to Gmail, Outlook, or any other mailbox, and never sends from the user's real address. Do not treat inboxy as the user's other mailboxes.
- Outbound mail (`mail_reply`, `mail_forward`, `mail_send`, `mail_invite`) goes only from the user's own `@inboxy.net` aliases, is recipient-locked, capped per plan and calendar month, and carries a visible `— inboxy.net — agentic email` footer.
- MCP endpoint is the bare origin `https://mcp.inboxy.net` (no `/mcp` path). Chat clients use OAuth; headless callers send `Authorization: Bearer ik_…` with an API key minted at https://inboxy.net/account/keys.
- The REST mirror at https://api.inboxy.net exposes the same data; its OpenAPI 3.1 spec is at https://api.inboxy.net/openapi.json.
- Historic mail from elsewhere can be imported as raw `.eml` (`POST /v1/mail/import`, MCP `mail_import_url` / `mail_import`, or the account page): stored, classified and searchable like inbound mail, never forwarded, retained from the import date; 500 per month on the free plan. inboxy never connects to other mailboxes — the user pushes the files.
- Sign-in is passkey + TOTP + recovery codes, no passwords, no SSO. Remote images in mail are proxied so senders never see the reader's IP.
- Controller is in the Bailiwick of Guernsey under the EU adequacy decision; data is held on EU-resident infrastructure. Every user can export or delete their data from the account page.
- Currently in public beta: one plan, Early Adopter, free for the life of the beta (five addresses, 20 outbound emails per calendar month, daily digest, MCP + API).

Every page listed below is also available as raw Markdown: append `.md` to help-article and legal URLs, or use the `.md` links given.

## Product

- [Overview](https://inboxy.net/index.md): what inboxy is, key features, platform, getting started
- [Pricing](https://inboxy.net/pricing): Early Adopter plan and beta terms
- [Sign up](https://inboxy.net/signup): create an account with a magic link to the email that will receive the digest

## For AI agents and developers

- [Agent skill file](https://inboxy.net/docs/skill): drop-in SKILL.md teaching an agent every inboxy tool, auth mode, and guardrail
- [Connecting an AI agent](https://inboxy.net/help/connect-mcp.md): Claude Desktop, Claude Code, Codex, Copilot, custom MCP clients
- [OpenAPI spec](https://api.inboxy.net/openapi.json): REST surface, DPoP-bound API keys
- [API reference UI](https://api.inboxy.net/): hosted rendering of the same spec
- [OAuth protected resource metadata](https://mcp.inboxy.net/.well-known/oauth-protected-resource): RFC 9728 discovery for the MCP server
- [Data export format](https://inboxy.net/help/data-export-format.md): JSON schema of the account export

## Help

- [Help index](https://inboxy.net/help/index.md): every article in one list
- [Getting started](https://inboxy.net/help/getting-started.md): signup, first five addresses, API key
- [Managing addresses](https://inboxy.net/help/addresses.md): mint, label, retire, custom local-parts
- [Forwarding your own domain](https://inboxy.net/help/domain-forwarding.md): route support@yourdomain.com to an alias
- [Importing old mail](https://inboxy.net/help/import-mail.md): push historic .eml files onto an alias for search; 500/month free, never forwarded
- [RSS feeds](https://inboxy.net/help/feeds.md): subscribe to RSS / Atom and read articles through MCP and the API
- [Daily digest](https://inboxy.net/help/digest.md): timing, contents, opting out
- [Sending limits](https://inboxy.net/help/sending-limits.md): quota caps and what counts
- [Browser extension](https://inboxy.net/help/extension.md): auto-fills an alias when a site asks for an email
- [Why emails display raw](https://inboxy.net/help/raw-email-display.md): tracking-pixel and link protection
- [Two-factor authentication](https://inboxy.net/help/about-2fa.md): passkey + TOTP + recovery codes, step-up
- [Account recovery](https://inboxy.net/help/recovery.md): lost passkey, lost TOTP, lost both
- [Privacy self-serve](https://inboxy.net/help/privacy-self-serve.md): GDPR rights you can exercise yourself
- [Why no Single Sign-On](https://inboxy.net/help/sso-privacy.md): SSO brings tracking; we decline it
- [Service status](https://inboxy.net/help/status.md): what can break and what you'd notice

## Legal and trust

- [Privacy policy](https://inboxy.net/privacy.md): what we collect, why, how long, your rights
- [Terms of service](https://inboxy.net/terms.md): the product guarantees in §2 are non-negotiable
- [Report abuse](https://inboxy.net/help/report-abuse.md): for non-users who received unwanted mail from an alias
- [Report a vulnerability](https://inboxy.net/help/report-vulnerability.md): coordinated disclosure, security@inboxy.net
- [Report an issue](https://inboxy.net/help/report-issue.md): bugs and broken features
- [security.txt](https://inboxy.net/.well-known/security.txt): RFC 9116 contact and policy
- [Status page](https://status.inboxy.net): live component state and incident history

## Optional

- [MTA-STS policy](https://mta-sts.inboxy.net/.well-known/mta-sts.txt): enforce mode, Cloudflare Email Routing MX