# inbox.dog

> Give your agents full Gmail autonomy — read, write, search, and send. CASA Tier 2 verified. MCP-native.

## What this is

inbox.dog is the tool you hand your agents when you need them to have full Gmail access. Not just read-only — write, send, search, label, draft. Most Gmail automations are stuck on read-only because Google requires a CASA Tier 2 security audit for write scopes. inbox.dog already passed that audit.

## Why agents need this

Google blocks Gmail write scopes behind a CASA Tier 2 security audit:
- $550+ third-party assessment
- OWASP ZAP scans, security questionnaire
- Weeks-to-months of back-and-forth with Google Trust & Safety
- Annual recertification

Without this audit, your agent can read emails but can't send, draft, label, or modify them. inbox.dog removes this barrier.

## Three ways to connect

### Connect (browser)

Users link Gmail at inbox.dog/connect. No OAuth redirect in your app. Then fetch tokens with client_id and client_secret via the API (getGmailTokens).

### MCP Server (zero-code)

Drop into Claude Desktop, Cursor, Windsurf, or any MCP client:

```json
{
  "mcpServers": {
    "inbox-dog": {
      "command": "npx",
      "args": ["-y", "inbox.dog", "mcp"],
      "env": {
        "INBOXDOG_KEY": "YOUR_KEY",
        "INBOXDOG_SECRET": "YOUR_SECRET"
      }
    }
  }
}
```

Your agent gets these tools: read_emails, read_email, send_email, search_emails, get_profile.

OAuth is automatic — MCP clients discover endpoints via `/.well-known/oauth-authorization-server`, register dynamically, and run a PKCE flow.

### npm Package (full control)

```bash
npm install inbox.dog
```

```typescript
import { InboxDog } from "inbox.dog";
const dog = new InboxDog();

// 1. Create API key
const key = await dog.createKey("my-app");

// 2. Get auth URL (redirect user here)
const url = dog.getAuthUrl({
  clientId: key.client_id,
  redirectUri: "http://localhost:3000/callback",
});

// 3. Exchange code for tokens
const tokens = await dog.exchangeCode(code, key.client_id, key.client_secret);

// 4. Use tokens with Gmail API — read AND write
const response = await fetch(
  "https://gmail.googleapis.com/gmail/v1/users/me/messages/send",
  {
    method: "POST",
    headers: { Authorization: `Bearer ${tokens.access_token}` },
    body: JSON.stringify({ raw: encodedEmail }),
  }
);
```

## Scopes

| Scope | Access |
|-------|--------|
| gmail:read | Read-only |
| gmail:send | Send emails |
| gmail:full | Read, send, modify, label, draft |

## Pricing

| Item | Cost |
|------|------|
| Hosted | Free |
| Self-host | Free (MIT) |

## Self-hosting

MIT licensed. Full source on GitHub. Self-host on your own Cloudflare account when you outgrow the hosted version or want to own the auth chain.

## Links

- Site: https://inbox.dog
- Docs: https://inbox.dog/docs
- API Reference: https://inbox.dog/docs/api
- MCP Guide: https://inbox.dog/docs/guides/mcp
- Tutorial: https://inbox.dog/docs/tutorial
- GitHub: https://github.com/acoyfellow/inbox.dog
- npm: https://www.npmjs.com/package/inbox.dog