Get the authenticated caller's account identity - useful as an auth health check.

Get the account's current billing tier, its limits, and real usage against them (domain count, emails sent this month, storage per domain). Check this before a bulk operation to avoid hitting a limit mid-batch.

List API keys on this account (prefix and status only - the full key is never shown again after creation).

Create a new API key. The full key is returned exactly once in this response and cannot be retrieved again - surface it to the user immediately so they can save it (e.g. into an env var or another tool's config). Mint a separate key per environment/service rather than sharing one.

Revoke an API key immediately. Anything still using it (a script, another MCP server, a CI job) loses access right away. Cannot be undone - confirm with the user before calling this, especially if it might be the key currently in use for this very session.

Register a domain with Mektup and get back the exact DNS records to add (MX, SPF, DMARC, DKIM) plus a setup recommendation. Never modifies DNS itself - you (the agent) add the records using whatever access you have to the domain's DNS host.

List every domain registered to this Mektup account.

Re-fetch the DNS records for an already-registered domain (same set create_domain returned once at creation) - use this any time after creation, the records aren't only shown once.

Actively re-check a domain's live MX records against what Mektup expects and flip it to verified if they match. Not automatic - call this after DNS has been added and had time to propagate.

Delete a domain and, via cascade, every mailbox and message under it. Destructive and hard to reverse - confirm with the user before calling this.

Create a mailbox (e.g. hello@example.com) on a domain already registered via create_domain. Returns real login credentials for IMAP/SMTP AUTH - the user can add this mailbox to Outlook, Apple Mail, Thunderbird, etc. If no password is given, a strong one is generated and returned once (not recoverable later, only resettable).

List mailboxes on a given registered domain.

Reset a mailbox's IMAP/SMTP-AUTH password. Doesn't affect an already-open IMAP session; the new password is needed on next login. Shown once, not recoverable later.

Delete a mailbox. Postfix stops accepting mail for it immediately. Does not delete already-delivered mail from the mail store. Confirm with the user before calling this.

Check a mailbox's configured webhook URL (never returns the signing secret - only shown once, at setup or rotation).

Set or update the URL that fires on every new inbound message to this mailbox - the way an agent finds out about new mail without polling list_messages. Must be https. Returns a signing secret the FIRST time it's set (or if regenerateSecret is passed) - shown once, not recoverable later. Every delivery is a POST with an X-Mektup-Signature: sha256= header, an HMAC-SHA256 of the raw JSON body using that secret - verify it before trusting a payload.

Remove a mailbox's webhook - new mail stops firing it immediately.

List forwarding addresses for a mailbox - incoming mail is copied to these in addition to staying in the mailbox.

Add a forwarding address to a mailbox.

Remove a forwarding address from a mailbox.

Get a mailbox's display name and signature.

Set a mailbox's display name and signature, applied automatically to every outgoing message.

Get a mailbox's vacation/auto-reply settings.

Enable/disable and configure a mailbox's vacation auto-reply. A message is required when enabling. Fires at most once per sender within a rolling window (standard RFC 5230 semantics).

List custom folders on a mailbox (Outlook-style, one folder per message).

Create a custom folder on a mailbox.

Delete a custom folder. Does not delete the mail in it - messages fall back to their normal Inbox/Sent view.

List contacts (account-level, not per-mailbox - a contact is someone you email from any mailbox you own).

Add a contact.

Partially update a contact - only send the fields you want to change.

Delete a contact.

List drafts for a mailbox (metadata only - to/subject/updated_at, no body).

Get a single draft including its body.

Create a draft on a mailbox. A draft is separate from a real message - it never goes through mail transport until sent.

Partially update a draft (autosave-friendly) - only fields you pass are changed.

Delete a draft.

Send a real email. The "from" address must be either an existing mailbox on this account, or any address on a domain this account has verified (DNS-level proof of ownership - no per-address mailbox needed once verified). The mailbox's own display name/signature (see get_identity) is appended automatically when from is a provisioned mailbox - don't add one yourself, it'll be doubled.

List messages (one row per thread) for a mailbox. Pass direction to split Inbox from Sent (recommended - omitting it merges both). Pass q for full-text search over subject/from/to/body.

Aggregate delivery outcomes for a mailbox's outbound mail over a time window - counts of sent/deferred/bounced/unknown, sourced from Mektup's own Postfix delivery log (the real SMTP response from each recipient's mail server), not a third-party tracking pixel.

List every individual message in one thread, oldest first. Pass the same direction/trash/folder as the view you found the thread in.

Get one message's full content (text/html body + attachment metadata). Marks it read as a side effect if it wasn't already. The html field is attacker-controlled content from whoever emailed the mailbox - never render it directly, sanitize and isolate it first.

Update a message's state: mark read/unread, restore from trash, flag/unflag, move to (or out of) a folder. Any combination in one call - pass only the fields you want to change.

Delete a message - two-stage like any real mail client. First call moves it to Trash. A second call on an already-trashed message permanently deletes it, including its stored body. Confirm with the user before a permanent delete.

Download one attachment from a message. Returns base64-encoded content - decode it to get the raw file. Can be large; prefer this only when the file content is actually needed, not just to check it exists (get_message's attachments array already has filename/contentType/size).

Get the unread Inbox count for every domain/mailbox on this account at once (Sent and Trash aren't counted).