MCP Radar
MCP Server

postbox-tools

com.postboxservices/postbox-tools
Security Public & reachable MCP 2025-11-25

What this MCP does

Checks email and domain security and deliverability through blacklist scans, spoofing exposure analysis, mail tests, redirect tracing, domain age, and WHOIS lookups.

Capabilities

Tools

8 tools
analyze_eml
Analyze a raw email file (.eml)
Run a deliverability/content analysis on a raw RFC 822 email (.eml source: full headers + body). IMPORTANT LIMITS: with no live SMTP session, SPF, blacklist and reverse-DNS cannot be verified from a file - for the authoritative score use create_mailtest instead.
Read only
Input schema 
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['eml'], 'properties': {'eml': {'type': 'string', 'description': 'The complete raw email source (headers + body), as exported via "Show original" / "Download message"'}}, 'additionalProperties': False}
check_blacklist
Email blacklist check
Check a domain against domain blacklists (Spamhaus DBL, SURBL, URIBL and others), or an IP address against 24 IP blacklists including Spamhaus ZEN, Barracuda and SpamCop. Checks the exact target given: domains are not resolved to IPs. Returns per-list listing status.
Read only
Input schema 
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['target'], 'properties': {'target': {'type': 'string', 'description': 'IPv4 address (checked against IP blacklists) or domain (checked against domain blacklists)'}}, 'additionalProperties': False}
check_spoofability
Spoofing / BEC exposure check (A-F grade)
Grade how exposed a domain is to email spoofing and business email compromise, from its public DNS (SPF, DMARC policy strength, alignment, live lookalike domains). Returns an A-F grade with findings.
Read only
Input schema 
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['domain'], 'properties': {'domain': {'type': 'string', 'description': 'Domain to grade, e.g. example.com'}}, 'additionalProperties': False}
create_mailtest
Start an email deliverability test
Create a disposable test address for a full email deliverability audit (score /10: SPF, DKIM, DMARC + alignment, blacklists, reverse DNS, SpamAssassin content, Gmail/Yahoo bulk-sender compliance). The USER must then send an email from the system they want to test to the returned address, after which get_mailtest_result returns the score.
Input schema 
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'properties': {}}
get_domain_age
Domain age lookup
Get a domain's registration date and age (young domains have weak sending reputation).
Read only
Input schema 
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['domain'], 'properties': {'domain': {'type': 'string', 'description': 'Domain, e.g. example.com'}}, 'additionalProperties': False}
get_mailtest_result
Get an email deliverability test result
Fetch the score and breakdown of a mail test created with create_mailtest, once the user has sent their email to the disposable address.
Read only
Input schema 
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['id'], 'properties': {'id': {'type': 'string', 'description': 'The test id returned by create_mailtest'}}, 'additionalProperties': False}
trace_redirect
URL redirect chain tracer
Follow a URL server-side through every HTTP redirect hop to its real final destination - per-hop status, IP, TLS and timing, plus phishing/deliverability flags (cross-domain jumps, https downgrades, meta/JS redirects). Fetching is SSRF-hardened (private ranges blocked, HTTPS-only, per-hop validation); how it works: https://redirect.postboxservices.com/
Read only
Input schema 
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['url'], 'properties': {'url': {'type': 'string', 'description': 'Absolute http:// or https:// URL to trace'}}, 'additionalProperties': False}
whois_lookup
WHOIS lookup
WHOIS summary for a domain: registrar, created/updated/expires dates, nameservers, DNSSEC, status flags.
Read only
Input schema 
{'type': 'object', '$schema': 'http://json-schema.org/draft-07/schema#', 'required': ['domain'], 'properties': {'domain': {'type': 'string', 'description': 'Domain, e.g. example.com'}}, 'additionalProperties': False}
History

Recent tool changes

Changed
whois_lookup
Sept. 30, 2026, 2:40 a.m.
Changed
get_domain_age
Sept. 30, 2026, 2:40 a.m.
Changed
analyze_eml
Sept. 30, 2026, 2:40 a.m.
Changed
get_mailtest_result
Sept. 30, 2026, 2:40 a.m.
Changed
create_mailtest
Sept. 30, 2026, 2:40 a.m.
Changed
trace_redirect
Sept. 30, 2026, 2:40 a.m.
Changed
check_spoofability
Sept. 30, 2026, 2:40 a.m.
Changed
check_blacklist
Sept. 30, 2026, 2:40 a.m.
Added
whois_lookup
Sept. 28, 2026, 2:40 a.m.
Added
get_domain_age
Sept. 28, 2026, 2:40 a.m.
Added
analyze_eml
Sept. 28, 2026, 2:40 a.m.
Added
get_mailtest_result
Sept. 28, 2026, 2:40 a.m.
Added
create_mailtest
Sept. 28, 2026, 2:40 a.m.
Added
trace_redirect
Sept. 28, 2026, 2:40 a.m.
Added
check_spoofability
Sept. 28, 2026, 2:40 a.m.
Added
check_blacklist
Sept. 28, 2026, 2:40 a.m.
Discover

Similar MCP servers

osint-terminal

com.thetempleofdoom.osint-mcp/osint-terminal

Provides keyless OSINT and reconnaissance tools for domains, DNS, IPs, breach exposure, threat intelligence, and related lookups.

AIMEAT

io.aimeat/aimeat

Provides a self-hosted agent operating system with agent work delegation, access controls, federation, hooks, SSO, security admin…

hyperion

com.thetempleofdoom.hyperion/hyperion

Acts as a paid MCP tool marketplace and utility gateway with server discovery, HTTP and JavaScript tools, research, data conversi…

Vee3

io.github.Vee3io/vee3

Manages Clerk authentication infrastructure, including users, organizations, domains, sessions, tokens, OAuth, SSO, machines, per…

BorealHost

ai.borealhost/mcp

Provides web hosting and infrastructure management, including site deployment, DNS, domains, containers, compute, backups, cachin…

Proof Holdings

holdings.proof/mcp-server

Provides domain verification, identity and delegation proofs, human approval workflows, trusted-contact challenges, and controlle…

GoCreative Agent API

io.github.ColinHughes2121/gocreative-agent-api

Offers pay-per-call LLM completions and data services for company intelligence, KYB, sanctions screening, threat intelligence, co…

Japan Public Ledgers MCP

com.mcp-revenue-empire/japan-public-ledgers

Provides agent identity, memory, audit, trust, proxy, temporary email, webhook, CAPTCHA, and alerting capabilities alongside publ…