Migadu Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Migadu Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Control your Migadu email hosting from AI assistants via the Model Context Protocol.
Migadu is a Swiss email host that prices on actual usage instead of mailbox count, with standard SMTP/IMAP/POP3 and no lock-in.
Covers the full Migadu API surface as MCP tools:
Get an API key at Migadu Admin → My Account → API Keys.
Add to your MCP client config (e.g. Claude Desktop, ~/.claude.json, etc.):
{
"mcpServers": {
"migadu": {
"command": "uvx",
"args": ["migadu-mcp"],
"env": {
"MIGADU_EMAIL": "[email protected]",
"MIGADU_API_KEY": "your-api-key",
"MIGADU_DOMAIN": "example.com"
}
}
}
}Or via the Claude Code CLI:
claude mcp add migadu \
--env [email protected] \
--env MIGADU_API_KEY=your-api-key \
--env MIGADU_DOMAIN=example.com \
-- uvx migadu-mcpMIGADU_DOMAIN is optional. It's the default domain used by tools like list_mailboxes when you don't pass one explicitly. Skip it if you manage multiple domains and prefer to pass domain on every call.
Once configured, ask your AI assistant things like:
acme.example — walk me through DNS setup and activation"[email protected] as an alias to both Alice and Bob"[email protected] until January 15th"Three built-in prompts are registered to scaffold common workflows: mailbox_creation_wizard, bulk_operation_planner, domain_onboarding.
list_domains, get_domain, create_domain, update_domain, get_domain_records, get_domain_diagnostics, activate_domain, get_domain_usage
list_mailboxes, get_mailbox, create_mailbox, update_mailbox, delete_mailbox, reset_mailbox_password, set_autoresponder
list_aliases, get_alias, create_alias, update_alias, delete_alias
list_identities, get_identity, create_identity, update_identity, delete_identity
list_forwardings, get_forwarding, create_forwarding, update_forwarding, delete_forwarding
list_rewrites, get_rewrite, create_rewrite, update_rewrite, delete_rewrite
All mutation tools (create_*, update_*, delete_*, activate_*, set_autoresponder, reset_mailbox_password) accept a list[dict] of items and return a bulk-result envelope with per-item success/failure. A single-item list works too.
Read-only views addressable by URI:
domains:// — all domains on the accountdomain://{name} — one domain's full configdomain-records://{name} — required DNS records for setupdomain-usage://{name} — message + storage metricsmailboxes://{domain} — mailboxes for a domainmailbox://{domain}/{local_part} — one mailboxidentities://{domain}/{mailbox} — identities on a mailboxforwardings://{domain}/{mailbox} — forwardings on a mailboxaliases://{domain} — aliases for a domainrewrites://{domain} — rewrite rules for a domainhttpx.AsyncClient per server process, closed on shutdown via FastMCP lifespan hook.list_* tools pass responses through a static summarizer when they exceed ~2000 tokens, returning a count plus a sample instead of flooding context.git clone https://github.com/Michaelzag/migadu-mcp.git
cd migadu-mcp
uv sync --group dev
# Quality gates (same as CI)
uv run ruff format --check .
uv run ruff check migadu_mcp/ tests/
uv run ty check migadu_mcp/
uv run pytest
uv run bandit -r migadu_mcp/Tests use respx to mock the Migadu API — no credentials needed. Integration tests (behind @pytest.mark.integration) hit the real API and are skipped by default.
MIT — see LICENSE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.