Connect your AI assistant to email

Let Claude, ChatGPT or another AI assistant read, search, organize and draft mail in your Box MailLogic mailboxes, and send it only if you allow it.

Overview

MCP (the Model Context Protocol) is a standard way for AI assistants to use outside services through tools. Box runs an MCP server for your mailboxes, as part of the service: you don't install or operate anything. You add its address to your assistant, sign in to Box once, choose what the assistant may do, and then ask it in plain language.

Once connected, you can ask your assistant to:

Read and summarize recent mail, and the attachments that came with it.
Search for a conversation and summarize it from start to finish.
Prepare a reply as a draft that you review, change and send yourself in the webmail.
Mark mail read or unread, move messages to the trash and restore them, and review Junk.
Send, reply and forward, but only if you give it permission to send.
Help set up domains and mailboxes, if you give it access to your whole account.

The assistant works on your real mailboxes. Webmail, the REST API and MCP all open the same mail: a draft your assistant writes appears in Drafts in the webmail, and mail it sends appears in Sent.

Server address: https://box.maillogic.io/mcp
Sign-in: OAuth: you sign in to Box in your browser and choose the assistant's permissions.
Who can connect: The account's owner, signed in with their MailLogic account.
Tools: 38, listed in the MCP tool reference.

Before you start

A Box account with a mailbox. Sign in to the Console with your MailLogic account, add your domain and create a mailbox on it, such as support@example.com. Every Box mailbox is on a domain you own. The API guide's quickstart shows each step.
An AI assistant that can add a remote MCP server. Claude can on every plan. ChatGPT can only in some plans and workspaces: see ChatGPT.
Decide what the assistant should be able to do. You choose it when you connect, and you can change it later by connecting again. See Recommended choices.

Connect your assistant

Every assistant follows the same three stages: add Box's server address in the assistant, sign in to Box and choose permissions on Box's consent page, then try a first request.

Claude Verified with Box

Claude adds Box as a custom connector. Connectors are available on Claude's Free, Pro, Max, Team and Enterprise plans (the Free plan allows one custom connector), and a connector you add works in Claude on the web, the desktop app and the mobile app.

In Claude, open Customize › Connectors and choose Add custom connector.
Give it a name, such as Box MailLogic, and enter the server URL exactly as shown, with no slash at the end: https://box.maillogic.io/mcp
Leave the OAuth client ID and secret empty: Claude registers itself with Box. If the dialog asks how Claude should identify itself, choose Register automatically. Then choose Add.
Choose Connect. Box's sign-in page opens: sign in with your MailLogic account. Box then shows its consent page.
On Box's consent page, check the name (Claude), tick the permissions you want, choose all mailboxes or one, and choose Allow. You return to Claude.
In a new chat, open the + menu, choose Connectors and turn Box on. Then ask: List my Box mailboxes. Claude calls list_mailboxes and shows your mailboxes.

About “Register automatically”. Box lets assistants register themselves (OAuth Dynamic Client Registration). It doesn't support Claude's other option, Use Claude's published identity (a Client ID Metadata Document). Claude's documentation says it falls back to registering automatically when a server doesn't support that option, but we haven't yet confirmed what the current dialog does if you choose it explicitly. If connecting fails, remove the connector and add it again with Register automatically.

Team and Enterprise: an Owner adds the connector once under Organization settings › Connectors (Add › Custom, type Web, the same URL). Each member then finds it under Customize › Connectors with the Custom label, chooses Connect and goes through Box's consent page with their own MailLogic account.

Worth knowing about Claude:

Claude may ask you before it uses a tool. Box marks deleting mail and sending email as destructive, which Claude takes into account, but Claude decides when to ask, and that can change. In Customize › Connectors you can set any Box tool to Blocked.
Claude keeps the list of tools it was shown. If Box adds a tool, start a new chat to see it.
Each time you connect Claude again, it registers anew, and the earlier authorization stays active at Box until you revoke it in the Console. See Revoking access.

ChatGPT Not yet verified with Box

We haven't yet connected Box to ChatGPT ourselves. The steps below follow OpenAI's own documentation and Box follows the MCP and OAuth standards ChatGPT uses, but until we have tested it we can't promise it works.

ChatGPT supports custom MCP servers in only some plans, on the web only, and not in the ChatGPT mobile apps. According to OpenAI:

ChatGPT plan	Custom MCP servers
Business	Full support. Only workspace admins and owners can add a server and publish it to the workspace.
Enterprise and Edu	Full support. Admins and owners, and members an admin allows, can add a server; admins publish it and can turn individual tools on or off.
Pro	Read and fetch tools only: no sending, drafting or other changes.
Plus and Free	Not listed by OpenAI as supporting custom MCP servers.

Where your plan and workspace allow it:

In ChatGPT on the web, open Plugins, choose +, then Add custom MCP server.
Enter a name, such as Box MailLogic, and under Connection the server URL: https://box.maillogic.io/mcp
Choose OAuth as the authentication.
Read the risk warning and tick I understand and want to continue.
Choose Create as a plugin. When Box's sign-in page opens, sign in with your MailLogic account, choose permissions on Box's consent page and choose Allow. ChatGPT then shows the tools it found.
Start a new conversation, type @, select the Box plugin and ask: List my Box mailboxes.

Worth knowing about ChatGPT, from OpenAI's documentation:

ChatGPT may ask you to confirm write actions, depending on the app's permissions and the action's context. It doesn't promise to ask every time.
You select the plugin per message (with @). Mention it again when a follow-up needs new data from your mailbox.
A workspace keeps a snapshot of the tools approved when it was published. When Box changes its tools, an admin refreshes them in the workspace's app settings.

Other MCP apps

Any app that supports remote MCP servers over Streamable HTTP with OAuth can connect to the same address. The app must register itself (Dynamic Client Registration) or use a client you registered, and use PKCE. Apps without a person to sign in can use an API key instead: see For developers. We have tested Box with Claude and the MCP Inspector. Claude Code (claude mcp add --transport http box https://box.maillogic.io/mcp) is expected to work the same way, but its OAuth sign-in hasn't been tested with Box yet.

Permissions

When your assistant connects, Box shows its consent page in your browser. You sign in with your MailLogic account, and Box shows which app is asking, the permissions it can have, and the mailboxes. Only the permissions you leave ticked are granted, and Box enforces them on every request, whatever the assistant tries. The assistant never gets your own access: it can't manage API keys, other apps or billing.

What each permission allows

If you choose Allow without changing anything, the assistant can see your mailboxes, list, read and search mail, and mark messages read or unread. That last one changes your mailbox, so the default is not strictly read-only. Everything else is off until you tick it: sending, drafts, deleting, Junk and every account-wide permission.

Capability	What the assistant can do	Permission	By default
See mailboxes	See which mailboxes it can use	`mailboxes:read`	On
Read and search	List, read and search mail, conversations and attachments	`messages:read`	On
Mark read or unread	Mark messages read or unread	`messages:write`	On
Send	Send, reply, reply to all and forward from the mailbox, to any address. Sent mail can't be recalled.	`messages:send`	Off
Read drafts	Read your drafts, including messages you're still writing	`drafts:read`	Off
Write drafts	Create, change and discard drafts. Sending one still needs `messages:send`.	`drafts:write`	Off
Delete	Move messages to the trash, and restore them from it	`messages:delete`	Off
Delete permanently	Delete messages in the trash for good, and empty the trash. Can't be undone.	`messages:destroy`	Off
Read Junk	See mail held in Junk, which is otherwise hidden from it	`junk:read`	Off
Mark as spam	Move Inbox mail to Junk (also needs Read Junk and Delete)	`junk:write`	Off
Mark as not spam	Move mail from Junk to the Inbox (also needs Read Junk)	`junk:release`	Off
Domains	See domains and their DNS records; add, verify and check them; delete empty ones	`domains:read`, `domains:write`, `domains:delete`	Off, account-wide
Create mailboxes	Create mailboxes on your active domains	`mailboxes:write`	Off, account-wide
Delete mailboxes	Delete mailboxes and all their mail	`mailboxes:delete`	Off, account-wide
Usage	See your plan, its limits and your usage, and whether the account fits another plan	`usage:read`	Off, account-wide

The MCP tool reference lists the consent page's exact wording for each permission and every tool that needs it.

One mailbox or all

Under In, the consent page lets you choose All mailboxes, including new ones or a single mailbox, such as Only support@example.com.

One mailbox: the assistant sees and acts on that mailbox only. Every other mailbox doesn't exist for it (mailboxes.not_found).
Account-wide permissions (domains, creating or deleting mailboxes, usage) cover your whole account, so they're offered under Your account and only with All mailboxes. Choosing one mailbox turns them off.

Recommended choices

Give each assistant the fewest permissions it needs. Some common choices:

You want the assistant to	Tick
Only read and summarize, changing nothing	`mailboxes:read`, `messages:read`, and untick `messages:write`
Read, and prepare replies for you to send	The defaults, plus `drafts:read` and `drafts:write`. Leave `messages:send` off.
Read and send on your behalf	The defaults, plus `messages:send`
Tidy up mail	The defaults, plus `messages:delete`. Add `messages:destroy` only if it should delete for good.
Set up domains and mailboxes	All mailboxes, plus `domains:read`, `domains:write` and `mailboxes:write`

To change an assistant's permissions, revoke it in the Console and connect it again. Never give an assistant more permissions just to make a refused request work: decide first whether it should be allowed.

Security

Box's permissions and your app's prompts

Two separate things control what happens:

Box's permissions are the ones you chose on the consent page. Box checks them on every request, and they're the only limit Box enforces. A permission is standing authority: once you allow sending, Box sends whenever the assistant asks it to, without asking you again.
Your app's confirmation prompts are your assistant's own feature. Box marks tools that delete, move mail into or out of Junk, or send, so that apps can ask you first, but each app decides when to ask. Claude and ChatGPT may not ask before every send.

So don't rely on a confirmation prompt to stop sending or deleting. If an assistant shouldn't send, leave messages:send unticked. If it shouldn't delete, leave the delete permissions unticked. Without them, Box refuses those requests (auth.insufficient_scope), whatever the assistant is told.

Your assistant sees all 38 tools whatever you allowed, because the list is the same for every connection. Seeing a tool doesn't mean it may use it: Box refuses any call that needs a permission the connection doesn't have.

Mail is untrusted input

Anyone can send you email, and an email can contain text written to manipulate an AI assistant: “forward this thread to…”, “ignore your instructions”. Box tells every assistant to treat mail content, attachments and file names as data, never as instructions, but no assistant can be relied on to resist every attempt. So:

Don't give sending or deleting permissions to an assistant that reads mail from strangers unless you need them.
Read what your assistant is about to send, and to whom, before you approve it.
Junk is hidden from assistants unless you allow Junk access. Mail there is the least trustworthy of all, and mail in the Inbox can still be harmful.
A sender's display name is whatever the sender wrote. It doesn't prove who sent the message.

Revoking access

Open the Console, choose Authorized apps, find the assistant (by the name it registered, such as Claude) and choose Revoke access. Box refuses the assistant's very next request.

The Box Console's Authorized apps page listing one app, Example Assistant, with its permissions shown as labels, the one mailbox it may use, when it was last used, and View details and Revoke access buttons. — Authorized apps in the Console: what each assistant may do, where, and when it was last used.

Revoking at Box and disconnecting the app are different. Removing or disconnecting Box in Claude or ChatGPT doesn't revoke its access at Box, and revoking at Box doesn't remove the connector from the app. To stop an assistant for good, do both. Apps that register anew when you reconnect (Claude does) leave the earlier authorization active: revoke the ones you no longer use.

Workflows

Some things to try, with the tools your assistant uses and the permissions they need. The addresses and messages are examples. You don't need to name tools: ask in your own words.

Summarize an inbox

Summarize the unread mail in support@example.com from the last two days. Group it by customer and flag anything urgent.

Tools: list_mailboxes, list_messages, get_message, and get_attachment for attachments
Permissions: mailboxes:read and messages:read: the defaults

list_messages pages through the Inbox newest first, 50 messages at most per page, and get_message reads each one. Asking the assistant to mark them read afterwards uses mark_message_read (messages:write).

Search and review a conversation

Find the conversation with Northwind Traders about the delayed order and summarize what was agreed.

Tools: search_messages, then get_thread (or list_threads to browse conversations)
Permissions: messages:read: the defaults

A conversation holds a message, the replies to it and what the mailbox sent in answer. Search and the Inbox never include Junk.

The assistant drafts, you send

Draft a reply to Ana's last message: confirm Thursday at 10:00 and attach nothing. Don't send it.

Tools: get_message, create_draft, and update_draft to revise it
Permissions: messages:read, drafts:read and drafts:write. Leave messages:send off.

This lets an assistant do the writing while a person keeps the last word. The draft appears in Drafts in the webmail, where you read it, change it and send it yourself. Without messages:send, the assistant can't send it, or anything else: send_draft and send_message are refused.

Each save of a draft has a version. If you edit the draft in the webmail while the assistant is revising it, the assistant's next save is refused (drafts.version_conflict) instead of overwriting your changes, and it reads the draft again before trying again.

Sending with permission

Reply to Ana's last message to say we'll ship on Friday, and send it.

Tools: get_message, then reply_to_message (or send_message, reply_all_to_message, forward_message, send_draft)
Permissions: messages:send, which you tick on the consent page, plus messages:read to reply or forward

Box works out who a reply goes to from the original message, and the assistant is told to say who that is before it sends. Mail is sent from the mailbox's own address, with the display name you set in the Console: an assistant can't choose another. Whether the assistant's app asks you to confirm first is up to the app, so tick messages:send only for an assistant you trust to send. Sending counts toward your plan's monthly sending limit, like any other mail.

Tools

Box's MCP server has 38 tools. Each runs the same operation as the REST API, with the same permissions and limits. The MCP tool reference gives each tool's description, arguments, result and annotations, generated from the server itself.

Group	Tools	Permissions
Mailboxes	`list_mailboxes`, `create_mailbox`, `delete_mailbox`	`mailboxes:read`; `mailboxes:write`, `mailboxes:delete` (account-wide)
Reading and searching	`list_messages`, `get_message`, `search_messages`, `mark_message_read`, `mark_message_unread`	`messages:read`; `messages:write` to mark
Conversations and attachments	`list_threads`, `get_thread`, `get_attachment`	`messages:read`
Sending and replying	`send_message`, `reply_to_message`, `reply_all_to_message`, `forward_message`	`messages:send` (and `messages:read` to reply or forward)
Drafts	`list_drafts`, `get_draft`, `create_draft`, `update_draft`, `discard_draft`, `send_draft`	`drafts:read`, `drafts:write`; `messages:send` to send
Trash	`delete_message`, `restore_message`, `permanently_delete_message`, `empty_trash`	`messages:delete`; `messages:destroy` to delete for good
Junk	`list_junk_messages`, `mark_message_spam`, `mark_message_not_spam`	`junk:read` (with `messages:read` to list Junk), `junk:write` (with `messages:delete`), `junk:release`
Domains	`list_domains`, `get_domain`, `create_domain`, `verify_domain`, `check_domain_dns`, `get_domain_connect`, `prepare_domain_connect`, `delete_domain`	`domains:read`, `domains:write`, `domains:delete` (account-wide)
Account usage	`get_usage`, `check_plan_eligibility`	`usage:read` (account-wide)

Some things are only for you, signed in to the Console, and no assistant can do them: changing a mailbox's display name, managing API keys and authorized apps, and anything to do with your plan or payment.

Troubleshooting

When Box refuses a request, the assistant receives an error with a stable code, such as auth.insufficient_scope. Ask the assistant which error it got: the code says whether Box refused the request or something went wrong in the app or on the way.

What you see	Likely cause	What to do
The app can't connect, or says it couldn't reach the server	A wrong address, often a slash at the end, or the app can't reach Box	Use exactly `https://box.maillogic.io/mcp`. Remove the connector and add it again. In Claude, choose Register automatically if asked.
Sign-in or authorization fails, or you chose Cancel	The sign-in didn't finish, or the consent page was cancelled	Connect again from the app and finish Box's consent page with Allow. Sign in with the MailLogic account that owns the mailboxes.
A request is refused with `auth.insufficient_scope`	The connection doesn't have that permission. The error names the one it needs.	Decide whether the assistant should be allowed. If so, revoke it in the Console and connect again with that permission ticked.
Sending is refused	Usually `auth.insufficient_scope`: sending is off by default. Or the plan's monthly limit (`entitlements.email_limit`), payment needing attention (`billing.payment_required`), sending suspended (`messages.sending_suspended`) or the domain's DNS (`domains.outbound_dns_invalid`).	Tick `messages:send` only if the assistant should send. For the others, check your plan, payment and domain in the Console. Retrying doesn't help.
The assistant can't see a mailbox (`mailboxes.not_found`)	You limited it to another mailbox, or the mailbox was deleted	Check the mailbox in Authorized apps. To give it another mailbox, revoke it and connect again.
The assistant can't find a message you can see (`messages.not_found`)	It's in Junk, which is hidden without Junk access, or it was deleted	Look at it in the webmail. Give Junk access only if the assistant should review Junk.
An expected tool is missing	The app kept an older list of tools, or (ChatGPT) a workspace admin turned the tool off or hasn't refreshed the tools	Start a new chat (Claude), or ask the workspace admin to refresh the app (ChatGPT). Box shows every connection all 38 tools.
The assistant doesn't use Box at all	The connector is off in this chat, or the app wasn't selected	Claude: + › Connectors, turn Box on. ChatGPT: type @ and select the plugin. Mention Box in your request.
Everything is refused with `auth.invalid_token`	The authorization was revoked or has expired	Reconnect from the app and allow it again on Box's consent page.
`auth.rate_limited`	Too many requests, sends or attachment downloads for now	Wait the number of seconds the error gives (`retry_after`), then ask again. Don't loop.
A draft save is refused with `drafts.version_conflict`	Someone saved the draft since the assistant read it	Nothing was lost. Ask the assistant to read the draft again and reapply its change.

MCP, the API and Agent Skills

	For	How it signs in	Where it runs
REST API	Your own applications and scripts calling Box directly	An API key, or OAuth for someone else's app	Your code calls Box over HTTPS
MCP	AI assistants such as Claude and ChatGPT	OAuth, with the permissions you choose on Box's consent page	Box runs the MCP server as part of its service
Agent Skills	Optional instructions that help an assistant use Box well	None of their own: they use the MCP connection	In the assistant's app, on your side

You don't need Agent Skills to connect an assistant or to use any tool on this page: the MCP connection is everything you need. Box's own Agent Skills are in internal beta and not yet published.

For developers

Building your own MCP client, or debugging a connection? These are the details.

Endpoint: https://box.maillogic.io/mcp: MCP over Streamable HTTP. Stateless: each request stands alone and is answered with JSON. Every request is authenticated first (without a credential, 401); then only POST is accepted, and any other method is 405 (Box sends no server-initiated messages). Use the exact path, with no slash at the end.
Discovery: An unauthenticated request is 401 with WWW-Authenticate: Bearer resource_metadata="https://box.maillogic.io/.well-known/oauth-protected-resource". The protected-resource metadata (RFC 9728), also at /.well-known/oauth-protected-resource/mcp, names the authorization server. Its own metadata (RFC 8414) lists the authorization, token and registration endpoints.
OAuth: Authorization code with PKCE (S256), public clients, Dynamic Client Registration (RFC 7591) and refresh tokens (offline_access). Client ID Metadata Documents aren't supported. The authorization server sends the browser to Box's consent page, where the owner chooses the permissions and mailboxes. Box's permissions are not OAuth scope values: the protected-resource metadata advertises openid only, and what a connection may do is what the owner chose.
API keys: Software without a person to sign in can send Authorization: Bearer boxk_… with an API key created in the Console, with the scopes and mailbox the key holds. Keep keys out of prompts and code.
Tools: tools/list is the same for every credential; permissions are checked per call. Each tool's result is structured content (its outputSchema) and the same JSON as text. Tool errors are results with isError and Box's error (code, message, params, request_id), as in the REST API.
Limits: Tool calls share the account's request limits with the REST API, and sending and attachment downloads have their own. A refusal is auth.rate_limited with retry_after seconds. See Rate limits.

The MCP tool reference has every tool's input schema, and the server's own instructions to assistants, word for word.