{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "inbound", "name": "Inbound", "vendor": "Exon Enterprise LLC", "vendorUrl": "https://inbound.new", "kind": "http-api", "category": "agent-inboxes", "summary": "Inbound is an email API from Exon Enterprise LLC for sending, receiving and replying on a customer's own domains. Agents use its REST API, webhooks, scoped IMAP and SMTP mailboxes, a hosted MCP server and the `inboundctl` CLI.", "url": "https://www.anchorterminal.com/tools/inbound", "markdownUrl": "https://www.anchorterminal.com/tools/inbound.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/inbound.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/inbound.json", "repo": "https://github.com/inboundemail/inbound", "license": "MIT for the platform repository. The TypeScript SDK, `inboundctl` and the MCP server are Apache-2.0", "transports": [ "http", "streamable-http" ], "remoteUrl": "https://inbound.new/api/e2", "packages": [ { "registry": "npm", "name": "inboundemail" }, { "registry": "npm", "name": "inboundctl" } ], "auth": "mixed", "authNotes": "A person signs up at inbound.new in a browser and creates an account API key, sent as a Bearer token to `https://inbound.new/api/e2`. The key covers the whole account. The MCP server at `https://inbound.new/mcp` takes OAuth (PKCE, dynamic client registration, scope `inbound:account`, also whole account), the account key, or a mailbox password. A mailbox password (prefix `mail_`) is limited to its address or domain scopes and sender policy, and also works for IMAP and SMTP. `inboundctl login` uses a browser device flow.", "pricing": "paid", "pricingNotes": "No free plan or trial on the pricing page, and no sandbox. Default is $9 a month for 5,000 emails, Pro $15 for 50,000 emails and 50 domains, Growth $39 for 100,000 emails and 300 domains, Scale $79 for 200,000 emails and unlimited domains. Extra domains cost $3.50 a month each, and an extra 50,000 received plus 50,000 sent costs $16 a month. The terms make fees non-refundable once any email has been sent or received (https://inbound.new/pricing, checked 2026-10-08).", "priceSummary": "$9 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, the OpenAPI document or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": 50, "popularity": { "githubStars": 359, "npmWeekly": 1704, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://inbound.new/docs", "llmsTxt": "https://inbound.new/docs/llms.txt", "openapi": "https://inbound.new/openapi.json", "capabilities": [ "email.inbox", "email.send", "email.inbound", "email.threads", "email.domains" ], "tags": [ "hosted", "paid", "mcp", "oauth", "openapi", "llms-txt", "typescript", "cli", "webhooks", "imap", "smtp", "open-source", "status-page" ], "lastRelease": "2026-10-06", "graded": true, "anchor": { "graded": true, "score": 63.7, "grade": "B", "agentReady": false, "rank": 300, "ranked": true, "rankOf": 722, "categoryRank": 4, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 78, "maintenance": 63, "payments": 15, "reliability": 83, "schema": 74, "security": 58, "transparency": 56 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 83, "points": 16.6, "reason": "Graded on the hosted lines. status.inbound.new runs on incident.io with uptime history, but its two components are Website and App, with none for the API, webhooks, SMTP or IMAP (15 of 20). No incident in the 90 days to 8 October 2026. The page's feed holds two incidents in total, the latest a sending outage of 2 hours 44 minutes on 18 February 2026 (30). 100 requests a second per account is published, with SMTP and IMAP connection and size limits (15). 429s carry `retry-after` and `ratelimit-*` headers, the product page documents `Idempotency-Key` on sends and replies, and SMTP deduplicates identical bytes. The API reference and OpenAPI document omit the idempotency header and the SDK does not retry (13 of 15). No SLA, and the terms disclaim any uptime guarantee (0). No beta label on the `/api/e2` surface (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 74, "points": 12.03, "reason": "Public OpenAPI 3.1 document at inbound.new/openapi.json with 35 paths and 54 operations, and typed Zod inputs on the MCP tools (25). `llms.txt`, `llms-full.txt` and a Markdown copy of each docs page (10). Operation descriptions state purpose and side effects, such as what deleting an endpoint cleans up. MCP tool descriptions run from 32 to 286 characters and rarely say when not to call (12 of 20). 110 enums and required fields in the spec, with `headers` as a free-form object and `scheduled_at` accepting natural language (12 of 15). An error page lists messages by status, errors are free-text strings with no stable code, and the spec holds 13 examples (10 of 15). The API is versioned as 2.0.0 under `/api/e2`, but no changelog was found (5 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 78, "points": 12.68, "reason": "List endpoints take `limit` up to 100 with no field selection. The MCP server lists 50 tools with an account credential, cut by `?toolsets=`, and 8 tools with a mailbox password (20 of 25). Offset pagination on most lists, cursor pagination on threads, and filters for status, time range, domain, address, unread and search (20). Errors are documented by status with free-text messages and optional `message` and `details`, and the SMTP page maps reply codes to actions (13 of 20). `Idempotency-Key` on sends and replies per the product page and the repository's end-to-end tests, and every MCP tool carries readOnly, destructive and idempotent hints. The header is missing from the API reference (17 of 20). A send needs only `from`, `to` and `subject`. One official SDK, TypeScript, last published on 10 January 2026 (8 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 58, "points": 10.15, "reason": "Mailbox passwords are scoped to 1 to 100 addresses or domains, rotate by API and can be disabled. Account API keys cover the whole account and can be revoked by API. OAuth on the MCP server uses PKCE and dynamic client registration with one scope, `inbound:account`, which the docs say grants full access. No secret travels in a URL (26 of 30). A mailbox can be read-only over IMAP and limited to one sending address, though a read-only mailbox can still send. The MCP server's instructions ask the model to confirm before deleting or sending, and `inboundctl` has dry runs (14 of 20). The agents page tells builders to treat bodies and files as untrusted and Guard rules filter incoming mail, but the MCP tool descriptions carry no such warning (9 of 15). A dashboard log of deliveries and `lastUsedAt` on credentials. No API audit log found (6 of 15). `security.txt` returned 404, no disclosure policy or bug bounty was found, and SOC 2 and ISO 27001 were described as on the roadmap in December 2025. Webhooks are verified with a static token, not a signature (3 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 15, "points": 1.88, "reason": "No x402, MPP or L402 in the docs, the OpenAPI document or the pricing page (0 of 40). Four plans are public with their email and domain allowances, plus unit add-ons of $3.50 a month per domain and $16 a month per extra 50,000 received and 50,000 sent (15 of 20). No free plan or trial on the pricing page. The free plan was retired on 3 December 2025 (0 of 20). A person signs up in a browser, and `inboundctl login` also needs a browser approval (0 of 20)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 63, "points": 5.51, "reason": "The service is built from a public repository with commits to the main branch on 6 October 2026, and the MCP server was rebuilt on 1 October (30). No changelog or tagged releases. The repository shows commits on 23 separate days since 10 July 2026 and `inboundctl` 0.1.0 reached npm on 1 August, so half credit (10 of 20). Three open issues on GitHub, the oldest a request for webhook signatures opened on 1 November 2025. We could not read the replies, and support is by email (10 of 25). The TypeScript SDK is at 0.20.0 from 10 January 2026, before the mailbox endpoints, and the MCP registry could not be reached (5 of 15). CI runs unit, end-to-end and gateway tests, and the MCP server pins its SDK version (8 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 56, "points": 4.9, "note": "editorial 47, provenance 65", "reason": "The platform repository is public under MIT, and the SDK, CLI and MCP server declare Apache-2.0. The MCP repository has no licence file (28 of 30). The privacy policy is dated 1 January 2025, still describes an email receiving service, and says email data is typically kept for 30 days, which agrees with the terms. No DPA, no statement on model training and no retention detail by plan (12 of 30). No deprecation policy. The terms allow the service to be changed or discontinued without notice, with 30 days' notice for price and terms changes (3 of 20). The policy names AWS and payment processors. No subprocessor list or data location was found (4 of 20)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "List endpoints take `limit` up to 100 with no field selection. The MCP server lists 50 tools with an account credential, cut by `?toolsets=`, and 8 tools with a mailbox password (20 of 25). Offset pagination on most lists, cursor pagination on threads, and filters for status, time range, domain, address, unread and search (20). Errors are documented by status with free-text messages and optional `message` and `details`, and the SMTP page maps reply codes to actions (13 of 20). `Idempotency-Key` on sends and replies per the product page and the repository's end-to-end tests, and every MCP tool carries readOnly, destructive and idempotent hints. The header is missing from the API reference (17 of 20). A send needs only `from`, `to` and `subject`. One official SDK, TypeScript, last published on 10 January 2026 (8 of 15).", "maintenance": "The service is built from a public repository with commits to the main branch on 6 October 2026, and the MCP server was rebuilt on 1 October (30). No changelog or tagged releases. The repository shows commits on 23 separate days since 10 July 2026 and `inboundctl` 0.1.0 reached npm on 1 August, so half credit (10 of 20). Three open issues on GitHub, the oldest a request for webhook signatures opened on 1 November 2025. We could not read the replies, and support is by email (10 of 25). The TypeScript SDK is at 0.20.0 from 10 January 2026, before the mailbox endpoints, and the MCP registry could not be reached (5 of 15). CI runs unit, end-to-end and gateway tests, and the MCP server pins its SDK version (8 of 10).", "payments": "No x402, MPP or L402 in the docs, the OpenAPI document or the pricing page (0 of 40). Four plans are public with their email and domain allowances, plus unit add-ons of $3.50 a month per domain and $16 a month per extra 50,000 received and 50,000 sent (15 of 20). No free plan or trial on the pricing page. The free plan was retired on 3 December 2025 (0 of 20). A person signs up in a browser, and `inboundctl login` also needs a browser approval (0 of 20).", "reliability": "Graded on the hosted lines. status.inbound.new runs on incident.io with uptime history, but its two components are Website and App, with none for the API, webhooks, SMTP or IMAP (15 of 20). No incident in the 90 days to 8 October 2026. The page's feed holds two incidents in total, the latest a sending outage of 2 hours 44 minutes on 18 February 2026 (30). 100 requests a second per account is published, with SMTP and IMAP connection and size limits (15). 429s carry `retry-after` and `ratelimit-*` headers, the product page documents `Idempotency-Key` on sends and replies, and SMTP deduplicates identical bytes. The API reference and OpenAPI document omit the idempotency header and the SDK does not retry (13 of 15). No SLA, and the terms disclaim any uptime guarantee (0). No beta label on the `/api/e2` surface (10).", "schema": "Public OpenAPI 3.1 document at inbound.new/openapi.json with 35 paths and 54 operations, and typed Zod inputs on the MCP tools (25). `llms.txt`, `llms-full.txt` and a Markdown copy of each docs page (10). Operation descriptions state purpose and side effects, such as what deleting an endpoint cleans up. MCP tool descriptions run from 32 to 286 characters and rarely say when not to call (12 of 20). 110 enums and required fields in the spec, with `headers` as a free-form object and `scheduled_at` accepting natural language (12 of 15). An error page lists messages by status, errors are free-text strings with no stable code, and the spec holds 13 examples (10 of 15). The API is versioned as 2.0.0 under `/api/e2`, but no changelog was found (5 of 15).", "security": "Mailbox passwords are scoped to 1 to 100 addresses or domains, rotate by API and can be disabled. Account API keys cover the whole account and can be revoked by API. OAuth on the MCP server uses PKCE and dynamic client registration with one scope, `inbound:account`, which the docs say grants full access. No secret travels in a URL (26 of 30). A mailbox can be read-only over IMAP and limited to one sending address, though a read-only mailbox can still send. The MCP server's instructions ask the model to confirm before deleting or sending, and `inboundctl` has dry runs (14 of 20). The agents page tells builders to treat bodies and files as untrusted and Guard rules filter incoming mail, but the MCP tool descriptions carry no such warning (9 of 15). A dashboard log of deliveries and `lastUsedAt` on credentials. No API audit log found (6 of 15). `security.txt` returned 404, no disclosure policy or bug bounty was found, and SOC 2 and ISO 27001 were described as on the roadmap in December 2025. Webhooks are verified with a static token, not a signature (3 of 20).", "transparency": "The platform repository is public under MIT, and the SDK, CLI and MCP server declare Apache-2.0. The MCP repository has no licence file (28 of 30). The privacy policy is dated 1 January 2025, still describes an email receiving service, and says email data is typically kept for 30 days, which agrees with the terms. No DPA, no statement on model training and no retention detail by plan (12 of 30). No deprecation policy. The terms allow the service to be changed or discontinued without notice, with 30 days' notice for price and terms changes (3 of 20). The policy names AWS and payment processors. No subprocessor list or data location was found (4 of 20)." }, "sources": [ { "what": "home page", "url": "https://inbound.new", "seen": "2026-10-08" }, { "what": "pricing", "url": "https://inbound.new/pricing", "seen": "2026-10-08" }, { "what": "docs index", "url": "https://inbound.new/docs/llms.txt", "seen": "2026-10-08" }, { "what": "full docs text", "url": "https://inbound.new/docs/llms-full.txt", "seen": "2026-10-08" }, { "what": "OpenAPI document", "url": "https://inbound.new/openapi.json", "seen": "2026-10-08" }, { "what": "rate limits", "url": "https://inbound.new/docs/api-reference/rate-limits.md", "seen": "2026-10-08" }, { "what": "error codes", "url": "https://inbound.new/docs/api-reference/errors.md", "seen": "2026-10-08" }, { "what": "webhook verification", "url": "https://inbound.new/docs/api-reference/security.md", "seen": "2026-10-08" }, { "what": "MCP server docs", "url": "https://inbound.new/docs/integrations/mcp.md", "seen": "2026-10-08" }, { "what": "mailbox scopes and permissions", "url": "https://inbound.new/docs/mailboxes/scopes-and-permissions.md", "seen": "2026-10-08" }, { "what": "SMTP limits and reply codes", "url": "https://inbound.new/docs/mailboxes/connect-smtp.md", "seen": "2026-10-08" }, { "what": "agents product page (idempotency, webhook retries, untrusted input)", "url": "https://inbound.new/email-api-for-ai-agents", "seen": "2026-10-08" }, { "what": "MCP endpoint, unauthenticated 401 with OAuth metadata", "url": "https://inbound.new/mcp", "seen": "2026-10-08" }, { "what": "OAuth authorisation server metadata", "url": "https://inbound.new/.well-known/oauth-authorization-server", "seen": "2026-10-08" }, { "what": "status page", "url": "https://status.inbound.new", "seen": "2026-10-08" }, { "what": "status incident feed", "url": "https://status.inbound.new/api/v2/incidents.json", "seen": "2026-10-08" }, { "what": "terms of service", "url": "https://inbound.new/terms", "seen": "2026-10-08" }, { "what": "privacy policy", "url": "https://inbound.new/privacy", "seen": "2026-10-08" }, { "what": "free plan retirement post", "url": "https://inbound.new/blog/inbound-is-retiring-the-free-plan", "seen": "2026-10-08" }, { "what": "security.txt (404)", "url": "https://inbound.new/.well-known/security.txt", "seen": "2026-10-08" }, { "what": "platform repository, licence, CI and commit history", "url": "https://github.com/inboundemail/inbound", "seen": "2026-10-08" }, { "what": "open issues", "url": "https://github.com/inboundemail/inbound/issues", "seen": "2026-10-08" }, { "what": "MCP server repository and tool definitions", "url": "https://github.com/inboundemail/mcp", "seen": "2026-10-08" }, { "what": "TypeScript SDK on npm", "url": "https://registry.npmjs.org/inboundemail", "seen": "2026-10-08" }, { "what": "inboundctl on npm", "url": "https://registry.npmjs.org/inboundctl", "seen": "2026-10-08" }, { "what": "domain registration", "url": "https://pubapi.registry.google/rdap/domain/inbound.new", "seen": "2026-10-08" } ], "openQuestions": [ "The lead's docs link, https://inboundctl.com/docs, did not resolve on 8 October 2026. The docs are at https://inbound.new/docs and `inboundctl` is an npm package from the same repository.", "The vendor's legal name is EXON ENTERPRISE LLC per the terms, not Inbound.", "Whether sign-up needs a card before any use. The pricing page shows no free plan, and the sign-up flow sits behind a login.", "The home page says unlimited mailboxes on every plan, while the docs say accounts can create up to 100 managed credentials by default.", "Whether `Idempotency-Key` is honoured on every write. It is documented only on the agents product page and exercised in the repository's tests.", "unchecked: the official MCP registry (registry.modelcontextprotocol.io did not answer from our network), so `registryName` is empty", "unchecked: replies and comment counts on the three open GitHub issues (the GitHub API refused us for its rate limit)", "unchecked: whether an audit log of API calls exists in the dashboard, which is behind a login" ] }, "negative": 0, "verdict": "A mailbox password limits an agent to chosen addresses and one sending identity across REST, IMAP, SMTP and MCP, and the platform's source is public under MIT. There is no free plan, sign-up needs a browser, webhooks are verified with a static token and are not retried automatically, and no changelog, DPA or security contact was found.", "bestFor": "A team that wants agent addresses on its own domain at a low fixed price, with IMAP and SMTP beside the API and an MCP mode that confines an agent to one mailbox.", "strengths": [ "Mailbox credentials scope reading to chosen addresses or domains and sending to one identity, and the same password works over REST, IMAP, SMTP and MCP", "Public OpenAPI 3.1 document with 54 operations, plus `llms.txt`, `llms-full.txt` and Markdown copies of every docs page", "The hosted MCP server takes OAuth with PKCE and dynamic client registration, marks every tool with read-only and destructive hints, and narrows its 50 tools with `?toolsets=`", "Rate limit of 100 requests a second per account is published, with `ratelimit-*` and `retry-after` headers on responses", "The platform repository is public under MIT with CI that runs unit, end-to-end and gateway tests" ], "weaknesses": [ "No free plan or trial on the pricing page. Plans start at $9 a month and the free plan was retired on 3 December 2025", "Webhooks carry a static `X-Webhook-Verification-Token` header, not a signature, and failed deliveries are not retried automatically", "Account API keys and OAuth tokens (scope `inbound:account`) grant the whole account. Only mailbox passwords are scoped", "No changelog, deprecation policy, DPA, subprocessor list, `security.txt` or disclosure policy was found", "The only SDK is TypeScript, last published on 10 January 2026, and the home page's unlimited mailboxes sit beside a documented default of 100 managed credentials" ], "agentNotes": [ "Ask the owner to create a mailbox and hand over its `mail_` password. Use that as the Bearer token at `https://inbound.new/mcp`, not the account API key", "Send an `Idempotency-Key` header on `POST /api/e2/emails` and `POST /api/e2/emails/{id}/reply` so a retry does not send twice", "Failed webhook deliveries are not retried. Poll `GET /api/e2/mail/threads` or call `POST /api/e2/emails/{id}/retry` after fixing the endpoint", "Add `?toolsets=mailboxes,emails` to the MCP URL to avoid loading all 50 account tools", "Treat message bodies and attachments as untrusted input, and set `sendingMode` to `identity` so a credential cannot send as other addresses on the domain" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 63.7 } ], "editorialScores": { "ergonomics": 78, "maintenance": 63, "payments": 15, "reliability": 83, "schema": 74, "security": 58, "transparency": 47 }, "provenanceScore": 65 }, "connect": { "install": "npm install inboundemail", "http": "curl -X POST https://inbound.new/api/e2/emails \\\n -H \"Authorization: Bearer $INBOUND_API_KEY\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"from\":\"agent@yourdomain.com\",\"to\":\"recipient@example.com\",\"subject\":\"Hello\",\"text\":\"Hello from Inbound\"}'", "claudeCode": "claude mcp add --transport http inbound https://inbound.new/mcp", "config": { "mcpServers": { "inbound": { "headers": { "Authorization": "Bearer YOUR_API_KEY" }, "type": "http", "url": "https://inbound.new/mcp" } } } }, "letme": { "capability": "https://letme.dev/email.inbox", "tool": "https://letme.dev/inbound" }, "notable": [ "A mailbox password (prefix `mail_`) is a mail-scoped API key. It authenticates IMAP, SMTP, HTTP sends and the MCP server, and cannot manage account resources (https://inbound.new/docs/mailboxes/overview)", "The hosted MCP server at `https://inbound.new/mcp` lists 50 tools with OAuth or an account key and 8 tools with a mailbox password, and `?toolsets=` narrows the list (https://inbound.new/docs/integrations/mcp)", "The whole platform (Next.js app, IMAP and SMTP gateways, `inboundctl`) is public under MIT at github.com/inboundemail/inbound, with commits on 6 October 2026 (https://github.com/inboundemail/inbound)", "The free plan was retired on 3 December 2025. The same post puts SOC 2 and ISO 27001 on the roadmap (https://inbound.new/blog/inbound-is-retiring-the-free-plan)", "Webhook verification compares a static per-endpoint token sent in `X-Webhook-Verification-Token`. A request for signed webhooks has been open since 1 November 2025 (https://inbound.new/docs/api-reference/security; https://github.com/inboundemail/inbound/issues)", "status.inbound.new records two incidents in total, the latest a sending outage of 2 hours 44 minutes on 18 February 2026 (https://status.inbound.new/api/v2/incidents.json)" ], "area": "communication", "details": [ { "label": "Inbox creation", "value": "`POST /api/e2/mailboxes` returns a login address and a one-time password. The address must be on a verified domain, and new accounts get an instant `*.inbnd.dev` domain. Up to 100 managed credentials an account by default" }, { "label": "How replies arrive", "value": "Webhook (`email.received` JSON with parsed content, attachment URLs and `threadId`), polling of `/api/e2/mail/threads` or mailbox messages, or IMAP with IDLE at `imap.inboundemail.com:993`. No WebSocket" }, { "label": "Threading", "value": "`POST /api/e2/emails/{id}/reply` takes an email ID or a thread ID and sets In-Reply-To and References. Threads list with cursor pagination" }, { "label": "Custom domains", "value": "`POST /api/e2/domains` returns the DNS records. Catch-all routing and per-address endpoints. 50 domains on Pro, 300 on Growth, unlimited on Scale, extra domains $3.50 a month" }, { "label": "Credentials", "value": "Account API key (Bearer, whole account, revocable by API), OAuth on MCP (PKCE, dynamic client registration, scope `inbound:account`), mailbox password scoped to 1 to 100 addresses or domains with `read` or `read_write` IMAP access" }, { "label": "MCP server", "value": "`https://inbound.new/mcp`, streamable HTTP, stateless. 50 account tools in six toolsets, 8 tools in mailbox mode. Source at github.com/inboundemail/mcp" }, { "label": "CLI", "value": "`inboundctl` 0.1.0 on npm (1 August 2026), JSON output, dry-run sends, browser device-flow login, and an agent skill installed with `npx skills add inboundemail/inbound`" }, { "label": "Rate limits", "value": "100 requests a second per account across the API, with `ratelimit-limit`, `ratelimit-remaining`, `ratelimit-reset` and `retry-after`. SMTP 3 MiB a message, 50 recipients, 10 connections an IP. IMAP 20 connections an IP" }, { "label": "Webhooks", "value": "Static token in `X-Webhook-Verification-Token`. No automatic retry of failed deliveries, manual retry by API or dashboard" }, { "label": "SDK", "value": "TypeScript `inboundemail` 0.20.0 (10 January 2026), generated with Stainless, Apache-2.0. No Python SDK on PyPI" }, { "label": "Retention", "value": "The privacy policy says email data is typically kept for 30 days. The terms say up to 30 days by default, or longer" }, { "label": "Status", "value": "status.inbound.new on incident.io, components Website and App, both at 100 per cent for July to October 2026" } ], "unitPrices": [ { "item": "Default plan", "unit": "month", "usd": 9, "note": "5,000 emails a month" }, { "item": "Pro plan", "unit": "month", "usd": 15, "note": "50,000 emails a month, 50 domains" }, { "item": "Growth plan", "unit": "month", "usd": 39, "note": "100,000 emails a month, 300 domains" }, { "item": "Scale plan", "unit": "month", "usd": 79, "note": "200,000 emails a month, unlimited domains" }, { "item": "Extra domain", "unit": "month", "usd": 3.5, "note": "per domain" }, { "item": "Extra email capacity", "unit": "month", "usd": 16, "note": "50,000 received plus 50,000 sent a month" } ], "provenance": { "legalEntity": "EXON ENTERPRISE LLC", "domain": "inbound.new", "domainRegistered": "2025-06-04", "endpointOnVendorDomain": true, "terms": "https://inbound.new/terms", "privacy": "https://inbound.new/privacy", "statusPage": "https://status.inbound.new", "changelog": "", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "The terms of service (last updated 3 December 2025) name EXON ENTERPRISE LLC, a Florida limited liability company, and govern the Inbound service itself.", "The privacy policy is dated 1 January 2025 and describes an email receiving service. It names AWS and payment processors and no other subprocessor.", "The API and MCP server answer on inbound.new. IMAP and SMTP answer on imap.inboundemail.com and smtp.inboundemail.com.", "https://inbound.new/.well-known/security.txt returned 404 on 8 October 2026.", "No changelog was found. https://inbound.new/changelog redirects to the blog, whose latest post is dated 3 December 2025.", "RDAP at the .new registry gives a registration date of 2025-06-04." ], "score": 65, "checks": [ { "check": "Legal entity named", "value": "EXON ENTERPRISE LLC", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "inbound.new, registered 2025-06-04 (1 year)", "points": 3, "max": 15, "state": "part" }, { "check": "Endpoint on the vendor's domain", "value": "inbound.new", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 7 of the 7 things a reader expects, and has 1 clause that costs points", "points": 8, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 7 of the 8 things a reader expects", "points": 9.3, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.inbound.new", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://inbound.new/terms", "state": "read", "readAt": "2026-10-08", "statedDate": "2025-12-03", "words": 3135, "points": 8, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": true, "quote": "Effective Date: January 1, 2025 · Last Updated: December 3, 2025", "says": "Last updated 2025-12-03" }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "These Terms and any dispute or claim arising out of or in connection with them or their subject matter or formation (including non-contractual disputes or claims) shall be governed by and construed in accordance with the laws of the State of Florida, United States, without regard to its conflict of law provisions.", "says": "The law of the State of Florida" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "…ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICE, WHETHER IN CONTRACT, TORT, OR OTHERWISE, SHALL NOT EXCEED THE GREATER OF: (A) THE TOTAL FEES PAID BY YOU TO US DURING THE THREE (3) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM, OR (B) ONE HUNDRED DOLLARS ($100.00).", "says": "Capped at the greater of $100.00 and the fees paid in the 3 months before the claim" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "Your account will be immediately suspended or terminated without prior notice You will forfeit all fees paid, and no refund will be provided We may report your activities to relevant authorities, blacklist operators, and industry organizations You may be held liable for all damages, costs, and expenses incurred by us…" }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "…will take effect at the end of the current billing period We reserve the right to change pricing with 30 days' prior notice 7.3 Refund Policy and Service Usage Acknowledgment YOU EXPRESSLY ACKNOWLEDGE AND AGREE THAT:", "says": "Gives 30 days of notice before a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "…accurate and complete You will maintain the confidentiality and security of your account credentials and will not share them with any third party You accept full responsibility for all activities that occur under your account, whether or not authorized by you You will immediately notify us of any unauthorized access t…" }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": true, "quote": "We do not guarantee 100% uptime or uninterrupted access to the Service We may perform scheduled or emergency maintenance that temporarily affects service availability Support response times and availability vary according to your plan level We reserve the right to modify, update, or discontinue any features or functio…" } ], "toKnow": [ { "key": "terms.nonotice", "label": "Says the terms or the service can change without notice", "found": true, "quote": "We reserve the right to modify, suspend, or discontinue the Service or any part thereof at any time, with or without notice, and without liability to you.", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "We reserve the right to refuse registration, suspend, or terminate any account at our sole discretion, without prior notice or liability, for any reason whatsoever, including but not limited to a breach of these Terms." }, { "key": "terms.arbitration", "label": "Requires arbitration or waives class actions", "found": true, "quote": "YOU AND THE COMPANY AGREE THAT EACH MAY BRING CLAIMS AGAINST THE OTHER ONLY IN YOUR OR ITS INDIVIDUAL CAPACITY AND NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS OR REPRESENTATIVE PROCEEDING." } ], "notes": [ { "date": "2026-10-08", "text": "A chargeback the vendor treats as fraudulent carries liquidated damages of 500 US dollars.", "quote": "Liquidated damages in the amount of $500 per fraudulent chargeback to compensate for administrative burden and reputational harm" }, { "date": "2026-10-08", "text": "When an account is terminated for a breach of the terms, the vendor may delete the customer's data immediately.", "quote": "We may delete your data immediately without any obligation to retain or provide copies" }, { "date": "2026-10-08", "text": "No prorated refund is given for a partial billing period, a downgrade or an early cancellation.", "quote": "Prorated Refunds Not Available: We do not provide prorated refunds for partial billing periods, downgrades, or early cancellation." } ] }, { "kind": "privacy", "url": "https://inbound.new/privacy", "state": "read", "readAt": "2026-10-08", "statedDate": "2025-01-01", "words": 483, "points": 9.3, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Effective Date: January 1, 2025 · Last Updated: January 1, 2025", "says": "Last updated 2025-01-01" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "Email data is typically retained for 30 days unless you configure different retention settings.", "says": "Names a period of 30 days" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "To service providers who assist in our operations (AWS, payment processors)" }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "We do not sell, trade, or otherwise transfer your personal information to third parties except as described below:", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": false }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you have questions about this Privacy Policy, please contact us at:" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "Your information may be transferred to and processed in countries other than your own." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/inbound.json", "live": { "slug": "inbound", "probe": { "target": "https://inbound.new/api/e2", "method": "get", "lastAt": "2026-10-08T21:12:12.442571767Z", "lastOk": true, "lastStatus": 404, "lastMs": 239, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 156, "p95ms24h": 270, "samples24h": 21, "samples30d": 21, "days": [ { "date": "2026-10-08", "probes": 21, "ok": 21 } ] }, "vendorStatus": { "page": "https://status.inbound.new", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-08T21:06:08.641974354Z" }, "updatedAt": "2026-10-08T21:12:12.442571767Z" } } }