Fieldcure Mcp Outbox — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Fieldcure Mcp Outbox (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A multi-channel messaging Model Context Protocol (MCP) server that sends messages through Slack, Telegram, Email (Gmail, Naver, Microsoft Graph API), KakaoTalk, and Discord. Built with C# and the official MCP C# SDK.
list_channels, add_channel, send_message, remove_channelExisting MCP servers are channel-specific — one for Slack, another for Gmail, yet another for Telegram. Each requires separate installation, configuration, and the LLM must know which tool to call for each channel.
Outbox takes a different approach:
send_message abstracts away channel differences. The LLM doesn't need to know Slack API vs SMTP vs Kakao REST.tokens.json with current-user-only file permissions; MCP tool flows can resolve secrets at runtime via env vars or elicitation.dotnet tool install -g gives you 4 channels. No need to install and configure separate servers per channel.dotnet tool install -g FieldCure.Mcp.OutboxAfter installation, the fieldcure-mcp-outbox command is available globally.
git clone https://github.com/fieldcure/fieldcure-mcp-outbox.git
cd fieldcure-mcp-outbox
dotnet buildAdd to claude_desktop_config.json:
{
"mcpServers": {
"outbox": {
"command": "fieldcure-mcp-outbox"
}
}
}Add to .vscode/mcp.json:
{
"servers": {
"outbox": {
"command": "fieldcure-mcp-outbox"
}
}
}{
"mcpServers": {
"outbox": {
"command": "dotnet",
"args": [
"run",
"--project", "C:\\path\\to\\fieldcure-mcp-outbox\\src\\FieldCure.Mcp.Outbox"
]
}
}
}| Tool | Description | Confirmation |
|---|---|---|
list_channels | List all configured messaging channels | — |
add_channel | Add a new channel (MCP elicitation for all channel types; Microsoft/KakaoTalk require a local browser on the MCP host) | — |
send_message | Send a message through a configured channel | Required |
remove_channel | Remove a channel and its stored credentials | Required |
OAuth tokens for Microsoft/KakaoTalk are stored in tokens.json so the server can refresh them across runs (current-user-only file permissions — Windows ACL / Unix 0600).
Static secrets (Slack bot tokens, Discord webhook URLs, SMTP passwords, etc.) resolve at send time in this order: in-memory cache → env var OUTBOX_{CHANNEL_ID}_{FIELD} → plaintext in channels.json → MCP elicitation. The CLI add_channel flow writes directly into channels.json for a zero-configuration local experience. This is an intentional local-trust choice with the same same-user boundary as tokens.json, documented in ADR-001 Principle 2. For shared hosts, CI, or headless deployments, set the env vars explicitly and leave channels.json secret fields empty.
| Channel | Protocol | Setup |
|---|---|---|
| Slack | Web API (chat.postMessage) | Guide |
| Telegram | Client API (WTelegramClient) | Guide |
| Gmail | SMTP | Guide |
| Naver | SMTP | Guide |
| Microsoft | Graph API (/me/sendMail) | Guide |
| KakaoTalk | Kakao REST API | Guide |
| Discord | Webhook API | Guide |
| Custom SMTP | User-defined | Guide |
When a channel requires a static secret at send time, Outbox looks for an environment variable named:
OUTBOX_<CHANNEL_ID>_<FIELD>Examples:
OUTBOX_MICROSOFT_1_CLIENT_SECRETOUTBOX_KAKAOTALK_1_API_KEYOUTBOX_KAKAOTALK_1_CLIENT_SECRETOUTBOX_SMTP_GMAIL_1_PASSWORDIf the variable is unset and the MCP client supports elicitation, Outbox prompts for it interactively and caches it for the current session.
fieldcure-mcp-outbox # Start MCP server (stdio)
fieldcure-mcp-outbox add slack # Add Slack channel
fieldcure-mcp-outbox add telegram # Add Telegram channel
fieldcure-mcp-outbox add gmail # Add Gmail SMTP channel
fieldcure-mcp-outbox add naver # Add Naver SMTP channel
fieldcure-mcp-outbox add smtp # Add custom SMTP channel
fieldcure-mcp-outbox add microsoft # Add Microsoft (Outlook/M365) channel
fieldcure-mcp-outbox add kakaotalk # Add KakaoTalk channel
fieldcure-mcp-outbox add discord # Add Discord channel
fieldcure-mcp-outbox list # List configured channels
fieldcure-mcp-outbox remove <id> # Remove a channel| Data | Location |
|---|---|
| Channel metadata | %LOCALAPPDATA%\FieldCure\Mcp.Outbox\channels.json |
| OAuth tokens | %LOCALAPPDATA%\FieldCure\Mcp.Outbox\tokens.json |
| Telegram sessions | %LOCALAPPDATA%\FieldCure\Mcp.Outbox\sessions\ |
tokens.json is stored in plain JSON and protected by filesystem permissions:
0600This protects against other local users on the same machine, but not against compromise of the same OS user account.
src/FieldCure.Mcp.Outbox/
├── Program.cs # Entry point: MCP server vs CLI branching
├── Channels/
│ ├── IChannel.cs # Channel interface + SendRequest/SendResult
│ ├── ChannelFactory.cs # Channel instantiation by type
│ ├── SlackChannel.cs # Slack Web API
│ ├── TelegramChannel.cs # WTelegramClient
│ ├── SmtpChannel.cs # MailKit SMTP
│ ├── MicrosoftChannel.cs # Microsoft Graph API
│ ├── KakaoTalkChannel.cs # Kakao REST API
│ └── DiscordChannel.cs # Discord Webhook API
├── Tools/
│ ├── ListChannelsTool.cs # list_channels
│ ├── AddChannelTool.cs # add_channel (elicitation + browser OAuth for Kakao/Microsoft)
│ ├── RemoveChannelTool.cs # remove_channel
│ └── SendMessageTool.cs # send_message
├── Interaction/
│ ├── IElicitGate.cs # Minimal MCP elicitation surface for tests
│ └── McpServerElicitGate.cs # Production adapter around McpServer
├── OAuth/
│ └── BrowserOAuthFlow.cs # Localhost callback + Process.Start + elicit race (MCP and CLI entry points)
├── Credentials/
│ └── OutboxSecretResolver.cs # cache → env → channels.json → elicitation
├── Setup/
│ ├── SetupRunner.cs # CLI router (diagnostic path)
│ ├── ConsoleHelper.cs # Masked input, prompts
│ ├── SlackSetup.cs
│ ├── TelegramSetup.cs
│ ├── SmtpSetup.cs
│ ├── MicrosoftSetup.cs
│ ├── KakaoTalkSetup.cs
│ └── DiscordSetup.cs
└── Configuration/
├── ChannelStore.cs # channels.json persistence (metadata + static-secret fallback)
├── OAuthTokenStore.cs # tokens.json persistence (OAuth access/refresh, user-only file perms)
└── SmtpPresets.cs # SMTP preset definitions# Build
dotnet build
# Test
dotnet test
# Pack as dotnet tool
dotnet pack src/FieldCure.Mcp.Outbox -c ReleasePart of the AssistStudio ecosystem.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.