@agenticmail/mcp 0.9.8 → 0.9.9

package/README.md

@@ -405,6 +405,19 @@ Reply sent to john@example.com with subject "Re: Q2 Budget Review"
 
 ---
 
+## External inbox exposure — surface this before walking the operator through relay setup
+
+> **The MCP tools that configure the relay (`setup_operator_email`, plus any agent advising the operator to run `agenticmail setup-email` or `setup-relay`) open every sub-agent up to the public internet via Gmail / Outlook plus-addressing.** Operators don't always realize this — host agents should warn explicitly:
+
+- **Plus-addresses are publicly guessable.** Once relay is configured, anyone can email `your-relay+secretary@gmail.com`, `your-relay+kepler@gmail.com`, … and the corresponding AgenticMail agent receives it. The `+sub` part is not a secret.
+- **External mail wakes the host dispatcher identically to internal `@localhost` mail.** The MCP server doesn't filter by source; the API publishes an SSE `new-mail` event for any inbound, and the host integration spawns a worker turn.
+- **The host bridges take a different path.** Mail to `your-relay+claudecode@gmail.com` / `your-relay+codex@gmail.com` routes to `handleBridgeMail`, which uses the host SDK's `resume` option to wake the operator's last session headlessly. If resume fails, it falls through to the bridge-escalation email at `setup_operator_email` — exactly why that MCP tool exists.
+- **Spam = worker turns.** Throttles in order of escalation: the `wake-budget` guard in the dispatcher (automatic), the relay-level spam filter, and `metadata.host`-based fencing for agents that should stay internal-only.
+
+When a host agent is about to call any of the relay-setup tools or instruct the operator to run `setup-email`, paraphrase this for the operator first so they can opt in deliberately rather than discovering it the day they get their first spam wake.
+
+---
+
 ## License
 
 [MIT](./LICENSE) - Ope Olatunji ([@ope-olatunji](https://github.com/ope-olatunji))

package/dist/index.js

@@ -22933,7 +22933,7 @@ var toolDefinitions = [
   },
   {
     name: "reply_email",
-    description: "Reply to an email. Fetches the original message, auto-fills To, Subject (Re:), In-Reply-To, and References, then sends with quoted body. **For multi-agent thread coordination, pass `replyAll: true`** \u2014 the original sender lands on To: (so they wake, by default), every other thread participant lands on Cc: (so they see it without waking). This is the correct shape; the tool builds it for you. **Pass `wake` to override** the default wake target (e.g. you want to wake a specific CC'd participant). Outbound guard applies \u2014 HIGH severity content is held for review.",
+    description: 'Reply to an email. Fetches the original message, auto-fills To, Subject (Re:), In-Reply-To, and References, then sends with quoted body. **For multi-agent thread coordination, pass `replyAll: true`** \u2014 the original sender lands on To:, every other thread participant lands on Cc:. **Wake routing is body-aware**: if your reply addresses a specific CC\'d agent ("Marlow \u2014", "@kepler", "handing off to rivet", etc.), the dispatcher wakes them automatically. If your body has no such addressing, the original sender (on To:) wakes by default. **Pass `wake` to override** explicitly (e.g. `wake: ["marlow"]` to force-target one agent, or `wake: []` to deliver silently). Outbound guard applies \u2014 HIGH severity content is held for review.',
     inputSchema: {
       type: "object",
       properties: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenticmail/mcp",
-  "version": "0.9.8",
+  "version": "0.9.9",
   "mcpName": "io.github.agenticmail/mcp",
   "description": "MCP server for AgenticMail — give any AI client real email and SMS capabilities",
   "type": "module",