Connect your inbox to OpenClaw
as a remote MCP server
Let the personal agent you already message read, search, draft, send, reply, forward and file mail across every inbox you have connected, through one MCP endpoint and one sign-in.
Stop the Gateway with openclaw gateway stop, run openclaw mcp add mcpemails --url https://mcpemails.com/api/mcp --transport streamable-http --auth oauth, then openclaw mcp login mcpemails and approve in the browser. Start the Gateway again with openclaw gateway start.
How OpenClaw connects: OAuth, no API key
OpenClaw's built-in MCP client runs the standard MCP OAuth flow for an HTTP server saved with auth: "oauth". It registers itself with RFC 7591 dynamic client registration, so there is no client ID to create, and authorizes with authorization code plus PKCE using S256. The token carries only the scopes you approve on our consent screen, lasts an hour and refreshes itself. OpenClaw stores it on the Gateway, and it is listed in Dashboard, API Keys as OAuth: OpenClaw MCP, which is where you revoke the connection.
The one value you need
Everything on this page is a way of getting this URL into OpenClaw.
| Field | Value |
|---|---|
| MCP server URL | https://mcpemails.com/api/mcp |
| Transport | Streamable HTTP (MCP 2025-06-18) |
| Authentication | OAuth 2.1, authorization code with PKCE. No API key. |
How to connect OpenClaw to your inbox
Four steps. The first two are the same for every client, the rest are specific to this one.
Create a free account and connect a mailbox
Sign up at mcpemails.com, no card required, then go to Dashboard, Inboxes, Connect Inbox. Outlook and Microsoft 365 connect with Sign in with Microsoft; Gmail, iCloud, Fastmail, Yahoo, Zoho and Yandex take an app-specific password; anything else connects over plain IMAP and SMTP. The free plan holds one inbox, forever.
Save the server with OAuth
On the machine that runs your Gateway, run openclaw gateway stop, then openclaw mcp add mcpemails --url https://mcpemails.com/api/mcp --transport streamable-http --auth oauth. That writes the entry under mcp.servers in ~/.openclaw/openclaw.json. OpenClaw refuses to change saved servers while the Gateway is running.
Sign in from the terminal
With the Gateway still stopped, run openclaw mcp login mcpemails. Follow the printed authorization URL and approve the scopes you want OpenClaw to hold. OpenClaw captures the browser callback and saves the credentials, then run openclaw gateway start.
Or sign in from the Control UI
Instead of the terminal login, start the Gateway and open the Control UI on its own loopback address or a public HTTPS address, then go to Settings → MCP. As an administrator, select Sign in for the mcpemails server, approve access in the browser, then return to Settings. On a private or Tailscale-only address, use the terminal login instead.
Check the connection
Run openclaw mcp status --verbose, which works while the Gateway runs. If it reports authorization-required, sign in again. Then ask your agent in any channel to list your inboxes.
openclaw mcp add mcpemails --url https://mcpemails.com/api/mcp --transport streamable-http --auth oauthOfficial OpenClaw documentation for remote MCP servers: https://docs.openclaw.ai/tools/mcp
Wondering which mailbox to connect first? See the provider compatibility matrix
What trips people up in OpenClaw
Set the transport, or it falls back to SSE
When transport is left out of an HTTP entry, OpenClaw uses sse. This server speaks Streamable HTTP, so always pass --transport streamable-http, or pick Streamable HTTP in Settings. In hand-written config, transport: "streamable-http" is the spelling OpenClaw reads; a CLI-style type: "http" is only accepted through openclaw mcp set or repaired by openclaw doctor --fix.
CLI changes need the Gateway stopped
openclaw mcp add, login, probe and doctor --probe refuse to run while a local Gateway owns OpenClaw's state, so stop it first and start it again afterwards. If the Gateway runs on a server and your browser is elsewhere, the loopback callback cannot reach it: copy the code from the browser and finish with the printed openclaw mcp login mcpemails --code command.
Shared sign-in means shared mailbox
By default the OAuth credential is shared and operator-managed: every agent on that Gateway uses the same sign-in, so anyone who can message your agent can ask it to read your mail. Keep it to channels only you use, leave send:email off the consent screen if the agent should only read, or turn on human approval for the inbox so every send waits for a person. OpenClaw also offers per-requester sign-in, where each sender connects their own account; it needs gateway.publicOrigin set to the Gateway's public HTTPS address.
A saved server is not a working server
OpenClaw saves a definition without proving it works, and a server that still needs sign-in is simply left out of the agent's tools rather than failing the turn. If the agent says it has no email tools, run openclaw mcp status --verbose: authorization-required means run the sign-in step again.
Limits worth knowing
- Requests are rate limited to 100 per minute, 1,000 per hour and 10,000 per day per key, plus your plan ceiling on billable actions.
- The server is request and response only. There are no webhooks and no server-initiated events, so new mail never wakes your agent by itself. To react to arriving mail, poll on a schedule.
- Mail is fetched live from your provider on every call and never stored. Only the encrypted OAuth token or app password is kept, so a revoked token or a changed mailbox password ends access immediately.
OpenClaw and email, answered
How do I connect email to OpenClaw?
On the Gateway machine, stop the Gateway, run openclaw mcp add mcpemails --url https://mcpemails.com/api/mcp --transport streamable-http --auth oauth, then sign in with openclaw mcp login mcpemails and start the Gateway again. You can also sign in from Settings, MCP in the Control UI. Your agent then has tools for reading, searching, drafting, sending, replying, forwarding, organizing and scheduling mail.
Do I need an API key for OpenClaw?
No. OpenClaw runs the MCP OAuth flow itself and stores the token on the Gateway. Its HTTP entries also accept a static headers map, so a scoped key sent as an Authorization Bearer header works too, but OpenClaw ignores static Authorization headers on an entry set to auth oauth, so use one or the other.
Can I show my agent only some of the email tools?
Yes. Add --include with a comma-separated list of tool names, or a pattern such as 'email_*', when you run openclaw mcp add, or set toolFilter under the server in config. That narrows what the agent sees. What it may actually do is still set by the scopes you approved on the consent screen.
Which mailboxes can OpenClaw reach this way?
Outlook.com and Microsoft 365 over Sign in with Microsoft, where a work account may need an IT admin to approve the app once; Gmail, iCloud, Fastmail, Yahoo, Zoho and Yandex with an app-specific password; and any other mailbox that speaks IMAP and SMTP on the standard ports. Your agent calls inbox_list first to discover every connected mailbox and its id, so there are no UUIDs to paste anywhere.
Can OpenClaw send email without me seeing it?
Only if you let it. Sending is gated on the send:email scope, so a token without that scope cannot send at all. On top of that, an inbox owner can require human approval in the dashboard, which holds every send, reply, forward, draft send and scheduled send until a person releases it. For an agent that runs unattended across chat channels, both are worth using.
Is my email stored on your servers?
No. Every message is fetched live from your provider for the request that asked for it and handed straight to your agent. Only the encrypted OAuth token or app password is kept, so future calls can authenticate. Deleting the inbox in the dashboard, or revoking access at your provider, ends the connection at once.
Give your OpenClaw agent a real inbox
One server, one sign-in. One inbox free forever, no card required.