CocoInbox MCP Server
# CocoInbox MCP Server
Thin MCP wrapper around the existing CocoInbox REST API. Does **not** modify or rebuild `cocoInboxFrontend` / `cocoInboxBackend`.
## Tools (v1)
| Tool | Maps to |
|------|---------|
| `login` | `POST /api/auth/login` + `GET /api/auth/me` |
| `logout` | Clears process session |
| `get_current_user` | `GET /api/auth/me` |
| `auth_status` | Local session snapshot |
| `list_emails` | `GET /api/emails/user/:userId` |
| `create_email` | `POST /api/emails/create` |
| `select_email` | Picks From address for send |
| `get_email` | `GET /api/emails/:id/messages` |
| `send_email` | `POST /api/mail/send` |
## Typical flow
1. `login({ email, password })`
2. `list_emails()` → pick an id
3. `select_email({ emailId })` **or** `create_email({ aliasName })`
4. `send_email({ to, subject, body })`
## Setup
```bash
cd mcp-server
npm install
cp .env.example .env
# set COCOINBOX_API_URL to your running backend
```
### Cursor (stdio)
Project file `.cursor/mcp.json` is already configured. Reload MCP in Cursor Settings → Tools & MCP.
### HTTP MCP URL (optional)
```bash
npm run start:http
# → http://127.0.0.1:3100/mcp
```
## Env
| Variable | Default | Meaning |
|----------|---------|---------|
| `COCOINBOX_API_URL` | `http://localhost:4000` | Existing REST API base |
| `COCOINBOX_TOKEN` | — | Optional pre-set Bearer token |
| `MCP_HTTP_PORT` | `3100` | HTTP transport port |
# cocoinbox-mcp
TDQS
Scored across 35 tools
Several tools overlap heavily: login, connect, complete_login, and login_with_password all handle authentication, while request_missing_tool is an alias for submit_idea and list_my_tool_requests is an alias for list_my_ideas. create_folder and create_folder_for_email also have blurred boundaries. The CRM and security clusters are clearer, but overall an agent could easily select the wrong auth or alias tool.
Most tools consistently use snake_case verb_noun naming, and the crm_* cluster is very coherent. However, bare/alias names like connect, request_missing_tool, and list_my_tool_requests break the pattern, and domain prefixes are inconsistently applied across auth, mail, security, and company tools.
With 35 tools, this exceeds the 25+ threshold for 'too many'. The set spans auth, mail, security, ideas, CRM, and company profile, but several tools are aliases or near-duplicates, so the count feels inflated rather than well-scoped. Consolidating auth entry points and removing aliases would bring it closer to a reasonable size.
Core workflows exist for authentication, ephemeral email, dark-web scanning, ideas, company profile, and CRM lead/task management. However, lifecycle coverage has notable gaps: there is no delete for folders, emails, leads, groups, or tasks, and no general task creation outside generated prospect tasks. These gaps create dead ends that agents can partially work around but not fully resolve.