{ "data": { "similar": [ { "grade": "A", "json": "https://www.anchorterminal.com/tools/nylas-email.json", "name": "Nylas Email API", "score": 78.7, "shared": [ "mailbox.read", "mailbox.search", "mailbox.send", "mailbox.drafts", "mailbox.sync" ], "slug": "nylas-email" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/gmail-api.json", "name": "Gmail API", "score": 77.8, "shared": [ "mailbox.read", "mailbox.search", "mailbox.send", "mailbox.drafts", "mailbox.sync" ], "slug": "gmail-api" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/outlook-mail-graph.json", "name": "Outlook Mail (Microsoft Graph)", "score": 66.3, "shared": [ "mailbox.read", "mailbox.search", "mailbox.send", "mailbox.drafts", "mailbox.sync" ], "slug": "outlook-mail-graph" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/unipile.json", "name": "Unipile", "score": 58.4, "shared": [ "mailbox.read", "mailbox.search", "mailbox.send", "mailbox.drafts", "mailbox.sync" ], "slug": "unipile" } ], "tool": { "slug": "emailengine", "name": "EmailEngine", "vendor": "Postal Systems OÜ", "vendorUrl": "https://emailengine.app", "kind": "http-api", "category": "mailbox-access", "summary": "EmailEngine is self-hosted software from Postal Systems that puts one REST API over Gmail, Microsoft 365 and IMAP mailboxes, with webhooks for new mail and a beta MCP server. The owner runs it with Redis.", "url": "https://www.anchorterminal.com/tools/emailengine", "markdownUrl": "https://www.anchorterminal.com/tools/emailengine.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/emailengine.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/emailengine.json", "repo": "https://github.com/postalsys/emailengine", "license": "Source available under the EmailEngine licence agreement, version 2.1 of 17 October 2023. Not open source. The PHP SDK is MIT", "transports": [ "http" ], "packages": [ { "registry": "npm", "name": "emailengine-app" }, { "registry": "oci", "name": "postalsys/emailengine" }, { "registry": "packagist", "name": "postalsys/emailengine-php" } ], "auth": "api-key", "authNotes": "Access is granted by whoever runs the instance, with no vendor approval or app review. Every request takes a 64-character token as `Authorization: Bearer`, or in the `access_token` query parameter. Tokens are created in the admin interface, with the CLI (`emailengine tokens issue`) or through POST /v1/tokens, which only mints tokens bound to one account or narrowed by a permissions record. A token carries scopes (`*`, api, metrics, smtp, imap-proxy, mcp, mcp-manage), an optional account binding, allowlists of actions (read, write, send, destructive) and groups, an IP allowlist, an expiry and a rate limit. The beta MCP endpoint also has an optional built-in OAuth 2.1 server. Mailboxes are connected with the operator's own Google and Microsoft OAuth2 apps, service accounts or IMAP passwords, which stay inside the instance.", "pricing": "paid", "pricingNotes": "$1,450 or EUR 1,200 a year, excluding VAT, for unlimited mailboxes, instances and API calls, bought with an account at postalsys.com. Every install can start a 14-day trial with full functionality from its own dashboard, with no sign-up and no card, so an agent's owner can start without a contract. When the trial ends the instance stops processing accounts until a licence key is added. A perpetual licence is sold through sales with no public price. The owner also pays for the server and Redis (https://emailengine.app/, https://postalsys.com/plans, checked 2026-10-08).", "priceSummary": "$120.83 / mo", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 on emailengine.app, in the documentation or in the OpenAPI spec (checked 2026-10-08). Licences are bought by card at postalsys.com, with Stripe named as the payment processor.", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 2237, "npmWeekly": 388, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://learn.emailengine.app/", "llmsTxt": "https://emailengine.app/llms.txt", "openapi": "https://go.emailengine.app/swagger.json", "capabilities": [ "mailbox.read", "mailbox.search", "mailbox.send", "mailbox.drafts", "mailbox.sync" ], "tags": [ "self-hosted", "source-available", "paid", "trial", "api-key", "openapi", "llms-txt", "mcp", "webhooks", "imap", "gmail", "microsoft-365", "docker", "nodejs", "php" ], "lastRelease": "2026-10-05", "graded": true, "anchor": { "graded": true, "score": 71.4, "grade": "BB", "agentReady": true, "rank": 106, "ranked": true, "rankOf": 629, "categoryRank": 3, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 80, "maintenance": 81, "payments": 40, "reliability": 79, "schema": 91, "security": 71, "transparency": 72 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 79, "points": 15.8, "reason": "Read with the local-software lines, since the owner runs EmailEngine and Postal Systems hosts nothing an agent calls. Graded on the REST API. Official npm package emailengine-app 2.82.2 states Node.js 20 or later, with a Docker image, an installer script and binaries for macOS, Linux and Windows (20). The test workflow runs lint, a licence check, unit tests on Node 24 and 20.19, live Dovecot tests and Playwright end-to-end tests, and the last eight runs on master to 8 October 2026 passed per the GitHub API (25). Open crash and regression issues couldn't be counted, because the GitHub API reports issues as disabled on the repository. The changelog shows steady fixes, about 40 in 2.82.1 alone (12 of 25, unchecked). Releases follow conventional commits with a dated changelog, but 2.81.2, a patch release, removed the `bounces` field from message responses, and 2.82.0, a minor release, removed the Document Store and embeddings, none marked as breaking (7 of 15). Version 2.82.2, past 1.0 (15). No status page or SLA applies to software the owner runs." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 91, "points": 14.79, "reason": "Graded on the REST API. A public OpenAPI 3.0 spec for 2.82.2 at go.emailengine.app/swagger.json with 58 paths and 82 operations (25). llms.txt on emailengine.app and learn.emailengine.app, an LLM context page and a capabilities.json manifest (10). 81 of 82 operations carry a description, several with usage guidance such as preferring cursors over page numbers, the note that a 2xx on submit means queued, and a page on when to use MCP or REST. Limits of search by folder are stated in one sentence (16 of 20). Parameters are typed with defaults, minimums, maximums and 115 enum declarations, though account and gateway settings accept wide objects (12 of 15). Every operation documents 401, 403, 429 and 500, an error-codes page lists codes with a retryable flag, and examples come in curl, JavaScript, Python and PHP. Gmail API errors pass through without a code (13 of 15). The API is versioned at /v1 and CHANGELOG.md has 183 dated releases (15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 80, "points": 13, "reason": "Graded on the REST API. Message text is not returned unless `textType` asks for it, `maxBytes` caps it, and `pageSize` runs from 1 to 1,000 with a default of 20. The MCP mail scope reaches 15 tools, and tools/list shows only what the token can call (20 of 25). Cursor paging on every provider and a structured search by sender, subject, body, date, header and thread, limited to one folder outside Gmail and Microsoft Graph (18 of 20). Errors return statusCode, error, message and a documented `code` with a retryable flag and a `fields` array for validation, but 401, 404 for a missing account and 429 carry no code and Gmail errors are not translated (17 of 20). An Idempotency-Key header on both submit routes, Retry-After on 429, provider rate limits retried before an error is reported, and MCP annotations for read-only, destructive and open-world tools. Other writes have no idempotency key (17 of 20). Few required parameters and sensible defaults, with one official SDK, for PHP (8 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 71, "points": 12.43, "reason": "Graded on the REST API with the MCP controls counted where a line covers them. Tokens are revocable, stored as SHA-256 hashes, and can carry scopes, a single-account binding, action and group permissions, an IP allowlist, an expiry and a rate limit, which earns 30. The `access_token` query parameter is a documented alternative to the header, so 10 comes off (20 of 30). Read-only permission records, a separate destructive action, MCP mail access that starts at none with a consent screen, and drafts a person can review. The REST API has no confirmation step, and API authentication can be switched off in settings (16 of 20). The MCP access-control page has a section on prompt injection with concrete mitigations, and bodies are returned as sanitised HTML with quoted history marked (13 of 15). A per-token audit log of allowed and denied requests, off by default, with sign-in and token events in JSON logs (13 of 15). A signed security.txt valid to 1 June 2027, SECURITY.md, private reporting through GitHub advisories, an SBOM and npm provenance. No bug bounty, no SOC 2 or ISO 27001 and no published third-party audit, as the vendor's security page states, and the GitHub API listed no published advisories (9 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 40, "points": 5, "reason": "Read with the self-hosted rule, scoring the paid option, because the software needs a licence after the trial. No x402, MPP or L402 (0 of 40). The price is public without a login, $1,450 or EUR 1,200 a year flat, with no per-call or per-mailbox unit, read as plan pricing (10 of 20). A 14-day trial with full functionality starts from the instance's own dashboard with no sign-up and no card (20). No vendor account is needed for the trial and the CLI can issue tokens, but the trial starts with a button in the admin interface and a licence is bought through a browser sign-up at postalsys.com. The line has no middle step, and 10 is our judgement call for a route that needs one click and no account (10 of 20)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 81, "points": 7.09, "reason": "Version 2.82.2 was tagged on 5 October 2026, three days before this check (30). Ten tags between 7 September and 5 October 2026 and 183 dated changelog entries overall (20). The GitHub API reports issues as disabled, so issue replies couldn't be read. Pull requests are handled within days, with two open on 8 October 2026, both under two days old. Support is by email from the one developer, and the support page says no response time is guaranteed (15 of 25). One official SDK, postalsys/emailengine-php v1.3.0 of 28 January 2026. No entry in the MCP registry was looked for, since the MCP endpoint runs on the owner's host (6 of 15). Dependencies are pinned and updated in most releases, CI runs a licence check, and each install serves an SBOM (10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 72, "points": 6.3, "note": "editorial 68, provenance 76", "reason": "The editorial half. The source is public and readable under the EmailEngine licence agreement 2.1, a proprietary licence with clear terms on trial, keys, resale and source changes. It is not an OSI licence, and the vendor says so (20 of 30). The security page and the compliance page list what Redis holds, state that message bodies are not stored, and list every outbound connection. Postal Systems says it is neither controller nor processor for mailbox data. The website privacy policy gives no retention periods, and the security page calls error reporting opt-in while the licensing page says a trial switches it on (20 of 30). No written deprecation policy was found. Dated notices exist, such as the Document Store removal date of 1 October 2026 announced in July and the pre-2.79 token paths kept as deprecated aliases, and security fixes go to the latest release only (12 of 20). The licence check, feature summary, update check and Sentry reporting are all disclosed, with EENGINE_BEACON_DISABLED and EENGINE_UPDATE_CHECK_DISABLED as opt-outs. The licence check can't be turned off on a subscription (16 of 20). The provenance half is computed from the provenance block." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "Graded on the REST API. Message text is not returned unless `textType` asks for it, `maxBytes` caps it, and `pageSize` runs from 1 to 1,000 with a default of 20. The MCP mail scope reaches 15 tools, and tools/list shows only what the token can call (20 of 25). Cursor paging on every provider and a structured search by sender, subject, body, date, header and thread, limited to one folder outside Gmail and Microsoft Graph (18 of 20). Errors return statusCode, error, message and a documented `code` with a retryable flag and a `fields` array for validation, but 401, 404 for a missing account and 429 carry no code and Gmail errors are not translated (17 of 20). An Idempotency-Key header on both submit routes, Retry-After on 429, provider rate limits retried before an error is reported, and MCP annotations for read-only, destructive and open-world tools. Other writes have no idempotency key (17 of 20). Few required parameters and sensible defaults, with one official SDK, for PHP (8 of 15).", "maintenance": "Version 2.82.2 was tagged on 5 October 2026, three days before this check (30). Ten tags between 7 September and 5 October 2026 and 183 dated changelog entries overall (20). The GitHub API reports issues as disabled, so issue replies couldn't be read. Pull requests are handled within days, with two open on 8 October 2026, both under two days old. Support is by email from the one developer, and the support page says no response time is guaranteed (15 of 25). One official SDK, postalsys/emailengine-php v1.3.0 of 28 January 2026. No entry in the MCP registry was looked for, since the MCP endpoint runs on the owner's host (6 of 15). Dependencies are pinned and updated in most releases, CI runs a licence check, and each install serves an SBOM (10).", "payments": "Read with the self-hosted rule, scoring the paid option, because the software needs a licence after the trial. No x402, MPP or L402 (0 of 40). The price is public without a login, $1,450 or EUR 1,200 a year flat, with no per-call or per-mailbox unit, read as plan pricing (10 of 20). A 14-day trial with full functionality starts from the instance's own dashboard with no sign-up and no card (20). No vendor account is needed for the trial and the CLI can issue tokens, but the trial starts with a button in the admin interface and a licence is bought through a browser sign-up at postalsys.com. The line has no middle step, and 10 is our judgement call for a route that needs one click and no account (10 of 20).", "reliability": "Read with the local-software lines, since the owner runs EmailEngine and Postal Systems hosts nothing an agent calls. Graded on the REST API. Official npm package emailengine-app 2.82.2 states Node.js 20 or later, with a Docker image, an installer script and binaries for macOS, Linux and Windows (20). The test workflow runs lint, a licence check, unit tests on Node 24 and 20.19, live Dovecot tests and Playwright end-to-end tests, and the last eight runs on master to 8 October 2026 passed per the GitHub API (25). Open crash and regression issues couldn't be counted, because the GitHub API reports issues as disabled on the repository. The changelog shows steady fixes, about 40 in 2.82.1 alone (12 of 25, unchecked). Releases follow conventional commits with a dated changelog, but 2.81.2, a patch release, removed the `bounces` field from message responses, and 2.82.0, a minor release, removed the Document Store and embeddings, none marked as breaking (7 of 15). Version 2.82.2, past 1.0 (15). No status page or SLA applies to software the owner runs.", "schema": "Graded on the REST API. A public OpenAPI 3.0 spec for 2.82.2 at go.emailengine.app/swagger.json with 58 paths and 82 operations (25). llms.txt on emailengine.app and learn.emailengine.app, an LLM context page and a capabilities.json manifest (10). 81 of 82 operations carry a description, several with usage guidance such as preferring cursors over page numbers, the note that a 2xx on submit means queued, and a page on when to use MCP or REST. Limits of search by folder are stated in one sentence (16 of 20). Parameters are typed with defaults, minimums, maximums and 115 enum declarations, though account and gateway settings accept wide objects (12 of 15). Every operation documents 401, 403, 429 and 500, an error-codes page lists codes with a retryable flag, and examples come in curl, JavaScript, Python and PHP. Gmail API errors pass through without a code (13 of 15). The API is versioned at /v1 and CHANGELOG.md has 183 dated releases (15).", "security": "Graded on the REST API with the MCP controls counted where a line covers them. Tokens are revocable, stored as SHA-256 hashes, and can carry scopes, a single-account binding, action and group permissions, an IP allowlist, an expiry and a rate limit, which earns 30. The `access_token` query parameter is a documented alternative to the header, so 10 comes off (20 of 30). Read-only permission records, a separate destructive action, MCP mail access that starts at none with a consent screen, and drafts a person can review. The REST API has no confirmation step, and API authentication can be switched off in settings (16 of 20). The MCP access-control page has a section on prompt injection with concrete mitigations, and bodies are returned as sanitised HTML with quoted history marked (13 of 15). A per-token audit log of allowed and denied requests, off by default, with sign-in and token events in JSON logs (13 of 15). A signed security.txt valid to 1 June 2027, SECURITY.md, private reporting through GitHub advisories, an SBOM and npm provenance. No bug bounty, no SOC 2 or ISO 27001 and no published third-party audit, as the vendor's security page states, and the GitHub API listed no published advisories (9 of 20).", "transparency": "The editorial half. The source is public and readable under the EmailEngine licence agreement 2.1, a proprietary licence with clear terms on trial, keys, resale and source changes. It is not an OSI licence, and the vendor says so (20 of 30). The security page and the compliance page list what Redis holds, state that message bodies are not stored, and list every outbound connection. Postal Systems says it is neither controller nor processor for mailbox data. The website privacy policy gives no retention periods, and the security page calls error reporting opt-in while the licensing page says a trial switches it on (20 of 30). No written deprecation policy was found. Dated notices exist, such as the Document Store removal date of 1 October 2026 announced in July and the pre-2.79 token paths kept as deprecated aliases, and security fixes go to the latest release only (12 of 20). The licence check, feature summary, update check and Sentry reporting are all disclosed, with EENGINE_BEACON_DISABLED and EENGINE_UPDATE_CHECK_DISABLED as opt-outs. The licence check can't be turned off on a subscription (16 of 20). The provenance half is computed from the provenance block." }, "sources": [ { "what": "home page, pricing and FAQ", "url": "https://emailengine.app/", "seen": "2026-10-08" }, { "what": "llms.txt", "url": "https://emailengine.app/llms.txt", "seen": "2026-10-08" }, { "what": "security page", "url": "https://emailengine.app/security", "seen": "2026-10-08" }, { "what": "security.txt", "url": "https://emailengine.app/.well-known/security.txt", "seen": "2026-10-08" }, { "what": "about page and legal entity", "url": "https://emailengine.app/about", "seen": "2026-10-08" }, { "what": "privacy policy", "url": "https://emailengine.app/privacy-policy", "seen": "2026-10-08" }, { "what": "plans and prices", "url": "https://postalsys.com/plans", "seen": "2026-10-08" }, { "what": "terms of service", "url": "https://postalsys.com/tos", "seen": "2026-10-08" }, { "what": "OpenAPI 3.0 spec", "url": "https://go.emailengine.app/swagger.json", "seen": "2026-10-08" }, { "what": "capabilities manifest", "url": "https://learn.emailengine.app/capabilities.json", "seen": "2026-10-08" }, { "what": "access tokens, permissions and audit log", "url": "https://learn.emailengine.app/docs/api-reference/access-tokens", "seen": "2026-10-08" }, { "what": "error codes and 429 handling", "url": "https://learn.emailengine.app/docs/api-reference/error-codes", "seen": "2026-10-08" }, { "what": "API reference overview and paging", "url": "https://learn.emailengine.app/docs/api-reference", "seen": "2026-10-08" }, { "what": "MCP overview", "url": "https://learn.emailengine.app/docs/mcp", "seen": "2026-10-08" }, { "what": "MCP access control and prompt injection", "url": "https://learn.emailengine.app/docs/mcp/access-control", "seen": "2026-10-08" }, { "what": "MCP client setup", "url": "https://learn.emailengine.app/docs/mcp/connect-clients", "seen": "2026-10-08" }, { "what": "licensing, trial and licence validation", "url": "https://learn.emailengine.app/docs/licensing", "seen": "2026-10-08" }, { "what": "compliance and outbound connections", "url": "https://learn.emailengine.app/docs/deployment/compliance", "seen": "2026-10-08" }, { "what": "support channels", "url": "https://learn.emailengine.app/docs/support", "seen": "2026-10-08" }, { "what": "repository, changelog, licence, CI workflows and SECURITY.md (git clone)", "url": "https://github.com/postalsys/emailengine", "seen": "2026-10-08" }, { "what": "repository metadata, pull requests and workflow runs", "url": "https://api.github.com/repos/postalsys/emailengine", "seen": "2026-10-08" }, { "what": "npm package", "url": "https://registry.npmjs.org/emailengine-app/latest", "seen": "2026-10-08" }, { "what": "PHP SDK versions", "url": "https://repo.packagist.org/p2/postalsys/emailengine-php.json", "seen": "2026-10-08" }, { "what": "domain registration", "url": "https://rdap.org/domain/emailengine.app", "seen": "2026-10-08" } ], "openQuestions": [ "unchecked: issue history and reply times. The GitHub API reports `has_issues` false for postalsys/emailengine and returned no issues on 8 October 2026, while the support page names GitHub Issues as a channel", "unchecked: Docker Hub pull counts and the Docker image's supported tags", "The security page calls Sentry error reporting opt-in, while the licensing and compliance pages say a trial switches it on to the developers' server since v2.79.0. We treated this as disclosed, with a point lost under data handling", "The vendor's figures of 200 companies in 38 countries and several thousand mailboxes per instance are claims we couldn't verify", "Whether 2.81.2's removal of the `bounces` field was announced anywhere outside the changelog. No notice was found in the changelog or docs we read", "The first release date. llms.txt says 1.0.0 shipped in March 2020, and the earliest npm version we could see is 1.9.0 of 29 July 2021, so `firstReleased` is left empty", "No performance, sync delay or send-limit figure was measured. Provider limits at Google and Microsoft still apply behind the API", "The 10 points for onboarding without a human sign-up are a judgement call, since the trial needs one click in the instance's dashboard" ] }, "negative": -3, "negativeNotes": [ "27 September 2026. Version 2.81.2, a patch release, removed the `bounces` field from the message list, message details and messageNew payloads, listed under bug fixes with no earlier notice found in the changelog. The bounce still arrives through the messageBounce webhook, and the entry is documented, so the smallest deduction applies (https://github.com/postalsys/emailengine/blob/master/CHANGELOG.md)" ], "verdict": "A self-hosted REST API over Gmail, Microsoft 365 and IMAP, with a public OpenAPI 3.0 spec and tokens that can be bound to one account, limited by action and group, and rate limited. It needs a server, Redis and a $1,450 yearly licence after a 14-day trial, and the MCP endpoint is a beta, off by default.", "bestFor": "A team that must keep mailbox access on its own infrastructure, has many mailboxes across Gmail, Microsoft 365 and IMAP, and can run a server and Redis.", "strengths": [ "Public OpenAPI 3.0 spec for version 2.82.2 with 82 operations, plus llms.txt on both sites and a capabilities.json manifest", "Tokens can be bound to one account, narrowed by action and group, limited by IP range, expiry and rate, and are stored only as SHA-256 hashes", "Idempotency-Key header on both send routes, and 429 responses carry Retry-After and a ttl field", "Ten tagged releases between 7 September and 5 October 2026, and the last eight test runs on master passed", "Written prompt-injection guidance, with MCP mail access set to none by default and message bodies returned as sanitised HTML" ], "weaknesses": [ "Not open source. Running it beyond the 14-day trial needs a subscription at $1,450 or EUR 1,200 a year", "The owner has to run a server and Redis. There is no hosted service, status page or SLA", "The MCP endpoint is labelled beta, is off by default, and its tool set may change between releases", "A token may also travel in the `access_token` query parameter, and API authentication can be switched off in settings", "Version 2.81.2, a patch release, removed the `bounces` field from message responses, and 2.82.0 removed the Document Store in a minor release", "One maintainer, no guaranteed support response time, and issues are disabled on the GitHub repository per the GitHub API" ], "agentNotes": [ "Ask the operator for a token bound to one account with a permissions record. Mint more with POST /v1/tokens, which refuses instance-wide tokens without one", "Send the token in the Authorization header, not the `access_token` query parameter, so it stays out of proxy logs", "Page with `cursor` from `nextPageCursor`. `page` works only on IMAP accounts, and search covers one folder unless `path` is `\\All` on Gmail or Microsoft Graph", "Set an Idempotency-Key header on POST /v1/account/{account}/submit. A 2xx means queued, so follow the result through the outbox or the messageSent and messageFailed webhooks", "Treat message text as untrusted. For MCP, the operator must enable the endpoint first and mail access starts at none" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "BB", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 71.4 } ], "editorialScores": { "ergonomics": 80, "maintenance": 81, "payments": 40, "reliability": 79, "schema": 91, "security": 71, "transparency": 68 }, "provenanceScore": 76 }, "connect": { "install": "curl -LO https://go.emailengine.app/docker-compose.yml\ndocker compose up -d", "http": "curl \"https://emailengine.example.com/v1/account/user@example.com/messages?path=INBOX\u0026page=0\u0026pageSize=50\" \\\n -H \"Authorization: Bearer YOUR_ACCESS_TOKEN\"", "claudeCode": "claude mcp add --transport http emailengine https://emailengine.example.com/mcp \\\n --header \"Authorization: Bearer YOUR_ACCESS_TOKEN\"", "config": { "mcpServers": { "emailengine": { "headers": { "Authorization": "Bearer YOUR_ACCESS_TOKEN" }, "type": "http", "url": "https://emailengine.example.com/mcp" } } } }, "letme": { "capability": "https://letme.dev/mailbox.read", "tool": "https://letme.dev/emailengine" }, "notable": [ "One REST API under /v1 translates calls into IMAP, SMTP, Gmail API or Microsoft Graph operations. POP3, ActiveSync and Exchange Web Services are not supported (https://emailengine.app/llms.txt)", "The OpenAPI 3.0 spec for 2.82.2 lists 58 paths and 82 operations, and every operation documents 401, 403, 429 and 500 responses (https://go.emailengine.app/swagger.json)", "The MCP server at POST /mcp shipped in v2.79.2 on 22 August 2026 as a labelled beta, is off by default, and wraps REST routes with the caller's own token (https://learn.emailengine.app/docs/mcp)", "Message bodies are fetched on demand from the mailbox and not stored. Redis holds a sync index, queued jobs, encrypted credentials and token hashes (https://emailengine.app/security)", "Credential encryption with AES-256-GCM is active only once the operator sets EENGINE_SECRET (https://emailengine.app/security)", "The Document Store was removed in 2.82.0 on 1 October 2026, after an interface warning naming that date was added in 2.74.0 on 23 July 2026 (https://github.com/postalsys/emailengine/blob/master/CHANGELOG.md)", "Activating a trial switches on error reporting to a Sentry server run by the developers until the operator sets `sentryEnabled` or adds a full licence (https://learn.emailengine.app/docs/licensing)" ], "area": "communication", "details": [ { "label": "Graded surface", "value": "The REST API under /v1 on the owner's own instance, version 2.82.2. The beta MCP endpoint is described but not the graded surface" }, { "label": "Providers", "value": "IMAP and SMTP for any provider, Gmail API and Microsoft Graph, including Google service accounts and Microsoft 365 shared mailboxes and app-only access. No POP3, ActiveSync or EWS" }, { "label": "Requirements", "value": "A server and Redis run with the noeviction policy. Node.js 20 or later for the npm package, or the Docker image, or prebuilt binaries for macOS, Linux and Windows. Several thousand mailboxes per instance, per the vendor" }, { "label": "Credentials", "value": "Bearer tokens with scopes, account binding, action and group permissions, IP and referrer allowlists, expiry and a per-token rate limit. Stored as SHA-256 hashes (https://learn.emailengine.app/docs/api-reference/access-tokens)" }, { "label": "Rate limits", "value": "No fixed limit. The operator sets `maxRequests` and `timeWindow` per token. A 429 carries Retry-After, X-RateLimit-Limit, X-RateLimit-Reset and a `ttl` field in seconds" }, { "label": "Paging and search", "value": "`pageSize` 1 to 1,000, default 20. Cursors from `nextPageCursor`, the only way to page Gmail API and Microsoft Graph accounts. Search runs inside one folder, with `\\All` on Gmail and Microsoft Graph" }, { "label": "Sending", "value": "POST /v1/account/{account}/submit queues a message, with an Idempotency-Key header, scheduling, retries with exponential backoff and a copy saved to Sent Mail on SMTP accounts" }, { "label": "Events", "value": "24 webhook event types, among them messageNew, messageUpdated, messageSent, messageBounce and authenticationError, signed with HMAC-SHA256 and retried up to ten times. No webhook history is kept" }, { "label": "Errors", "value": "JSON bodies with statusCode, error and message, a `code` on documented cases with a retryable flag, and a `fields` array on validation failures. Gmail API errors are passed through without an EmailEngine code (https://learn.emailengine.app/docs/api-reference/error-codes)" }, { "label": "MCP server", "value": "Beta since v2.79.2. Streamable HTTP at POST /mcp, 60 tools, 15 of them open to the mail scope and the rest for instance management, with readOnlyHint, destructiveHint and openWorldHint annotations. tools/list shows only what the token can call" }, { "label": "Audit", "value": "A per-token audit log of allowed and denied requests, off by default, kept for 1,000 entries or seven days per token by default. Sign-in and token events go to the application log as JSON" }, { "label": "Outbound calls", "value": "Subscription licences check in with postalsys.com at most once every 24 hours with a feature summary that EENGINE_BEACON_DISABLED removes. An update check to the GitHub releases API can be disabled. Trial and perpetual keys verify offline (https://learn.emailengine.app/docs/deployment/compliance)" }, { "label": "SDK", "value": "postalsys/emailengine-php v1.3.0 of 28 January 2026 on Packagist, MIT, PHP 8.1 or later. No other official SDK found" }, { "label": "Releases", "value": "2.82.2 on 5 October 2026. 183 dated entries in CHANGELOG.md, ten tags between 7 September and 5 October 2026. Security fixes go to the latest release only" } ], "unitPrices": [ { "item": "EmailEngine subscription, $1,450 billed yearly", "unit": "month", "usd": 120.83, "note": "unlimited mailboxes, instances and API calls, VAT excluded, 14-day trial without a card" } ], "provenance": { "legalEntity": "Postal Systems OÜ, Narva mnt 5, 10117 Tallinn, Estonia, registry code 14971894", "domain": "emailengine.app", "domainRegistered": "2021-07-28", "endpointOnVendorDomain": null, "terms": "https://postalsys.com/tos", "privacy": "https://emailengine.app/privacy-policy", "statusPage": "", "changelog": "https://github.com/postalsys/emailengine/blob/master/CHANGELOG.md", "securityTxt": "valid", "checked": "2026-10-08", "notes": [ "The about page names Postal Systems OÜ at Narva mnt 5, 10117 Tallinn, with registry code 14971894 and VAT number EE102255902, and says the company is run by one person.", "RDAP for emailengine.app shows registration on 28 July 2021 through Namecheap.", "emailengine.app/.well-known/security.txt is PGP-signed, expires on 1 June 2027 and points to GitHub private advisories and SECURITY.md. postalsys.com has its own security.txt with no Expires field.", "The terms of service at postalsys.com/tos are dated 14 May 2020 and cover the subscription. The software licence is the EmailEngine licence agreement, version 2.1 of 17 October 2023, governed by Estonian law.", "The privacy policy at emailengine.app/privacy-policy has an effective date of 29 July 2026 and covers the website and the licence account, with Stripe named for payments.", "The API runs on the owner's instance, so there is no vendor endpoint and no status page." ], "score": 76, "checks": [ { "check": "Legal entity named", "value": "Postal Systems OÜ, Narva mnt 5, 10117 Tallinn, Estonia, registry code 14971894", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "emailengine.app, registered 2021-07-28 (5 years)", "points": 11, "max": 15, "state": "part" }, { "check": "Endpoint on the vendor's domain", "value": "no hosted endpoint", "points": 0, "max": 0, "state": "na" }, { "check": "Terms of service", "value": "read, states 5 of the 7 things a reader expects, and has 2 clauses that cost points", "points": 4.3, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 7 of the 8 things a reader expects", "points": 9.3, "max": 10, "state": "part" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "valid", "points": 10, "max": 10, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "https://postalsys.com/tos", "state": "read", "readAt": "2026-10-08", "words": 3091, "points": 4.3, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": false }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "These Terms shall be governed and construed in accordance with the laws of Estonia without regard to its conflict of law provisions.", "says": "The law of Estonia" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "EXCEPT AS PROHIBITED BY LAW, IF THERE IS LIABILITY FOUND ON THE PART OF COMPANY, IT WILL BE LIMITED TO THE AMOUNT PAID FOR THE PRODUCTS AND/OR SERVICES, AND UNDER NO" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "We may terminate or suspend your account and bar access to Service immediately, without prior notice or liability, under our sole" }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": true, "quote": "At any time and without notice, Postal Systems OÜ reserves the right to (i) modify Terms of Service of Free Trial offer, or (ii) cancel such", "says": "Says it gives notice of a change" }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "If you do not agree with (or cannot comply with) Agreements, then you may not use the Service, but please let us know by emailing at" }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": false } ], "toKnow": [ { "key": "terms.automated", "label": "Restricts automated access", "found": true, "quote": "(b) Use any robot, spider, or other automatic device, process, or means to access Service for any purpose, including monitoring or copying", "costsPoints": true }, { "key": "terms.nonotice", "label": "Says the terms or the service can change without notice", "found": true, "quote": "We reserve the right to withdraw or amend our Service, and any service or material we provide via", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "We may terminate or suspend your account and bar access to Service immediately, without prior notice or liability, under our sole" } ], "notes": [ { "date": "2026-10-08", "text": "The terms say they govern use of the web pages at postalsys.com, operated by Postal Systems OÜ.", "quote": "https://postalsys.com operated by Postal Systems OÜ." } ] }, { "kind": "privacy", "url": "https://emailengine.app/privacy-policy", "state": "read", "readAt": "2026-10-08", "words": 3106, "points": 9.3, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": false }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "Our Privacy Policy governs your visit to https://emailengine.app/, and explains how we collect, safeguard and disclose information that results from your use of our Service." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "We will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy.", "says": "For as long as needed, with no period named" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "DATA PROCESSORS (OR SERVICE PROVIDERS) means any natural or legal person who processes the data on behalf of the Data Controller." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "We don't sell or rent your personal information to any third parties for any purpose.", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "If you are a resident of the European Union (EU) and European Economic Area (EEA), you have certain data protection rights, covered by GDPR." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you have any questions about this Privacy Policy, please contact us:" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "If you are located outside United States and choose to provide information to us, please note that we transfer the data, including Personal Data, to United States and process it there.", "says": "Data goes to the United States" } ], "notes": [ { "date": "2026-10-08", "text": "The policy defines the Service it covers as the emailengine.app website.", "quote": "SERVICE means the https://emailengine.app/ website operated by Postal Systems OÜ." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/emailengine.json", "live": { "slug": "emailengine", "versions": [ { "registry": "github", "name": "postalsys/emailengine", "version": "v2.83.0", "released": "2026-10-08", "seenAt": "2026-10-08T16:10:38.546496352Z" }, { "registry": "npm", "name": "emailengine-app", "version": "2.83.0", "seenAt": "2026-10-08T16:10:36.788101811Z" } ], "githubStars": 2238, "npmWeekly": 388, "securityTxt": { "url": "https://emailengine.app/.well-known/security.txt", "state": "valid", "expires": "2027-06-01T00:00:00.000Z", "checkedAt": "2026-10-08T15:39:10.386155427Z" }, "updatedAt": "2026-10-08T16:10:38.546496352Z" } }, "verify": { "accepts": "a page on emailengine.app or one of its subdomains, or the README of github.com/postalsys/emailengine", "badgeUrl": "https://www.anchorterminal.com/badges/emailengine.svg", "body": { "slug": "emailengine", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/emailengine", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/emailengine\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/emailengine.svg\" alt=\"EmailEngine on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![EmailEngine on Anchor Terminal](https://www.anchorterminal.com/badges/emailengine.svg)](https://www.anchorterminal.com/tools/emailengine)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/emailengine\"\u003eEmailEngine on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/emailengine", "json": "https://www.anchorterminal.com/tools/emailengine.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/emailengine.md", "slim": "https://www.anchorterminal.com/tools/emailengine.min.md" }, "markdown": "## Overview\n\n**Grade BB · 71.4/100 · rank #106 of 629 · #3 in Mailbox access · agent-ready · confidence medium**\n\n\n## Assessment\n\nA self-hosted REST API over Gmail, Microsoft 365 and IMAP, with a public OpenAPI 3.0 spec and tokens that can be bound to one account, limited by action and group, and rate limited. It needs a server, Redis and a $1,450 yearly licence after a 14-day trial, and the MCP endpoint is a beta, off by default.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | Postal Systems OÜ (https://emailengine.app) |\n| Kind | HTTP API |\n| Category | Mailbox access (https://www.anchorterminal.com/categories/mailbox-access) |\n| Transport | HTTP |\n| Auth | API key · Access is granted by whoever runs the instance, with no vendor approval or app review. Every request takes a 64-character token as `Authorization: Bearer`, or in the `access_token` query parameter. Tokens are created in the admin interface, with the CLI (`emailengine tokens issue`) or through POST /v1/tokens, which only mints tokens bound to one account or narrowed by a permissions record. A token carries scopes (`*`, api, metrics, smtp, imap-proxy, mcp, mcp-manage), an optional account binding, allowlists of actions (read, write, send, destructive) and groups, an IP allowlist, an expiry and a rate limit. The beta MCP endpoint also has an optional built-in OAuth 2.1 server. Mailboxes are connected with the operator's own Google and Microsoft OAuth2 apps, service accounts or IMAP passwords, which stay inside the instance. |\n| Pricing | Paid ($120.83 / mo) · $1,450 or EUR 1,200 a year, excluding VAT, for unlimited mailboxes, instances and API calls, bought with an account at postalsys.com. Every install can start a 14-day trial with full functionality from its own dashboard, with no sign-up and no card, so an agent's owner can start without a contract. When the trial ends the instance stops processing accounts until a licence key is added. A perpetual licence is sold through sales with no public price. The owner also pays for the server and Redis (https://emailengine.app/, https://postalsys.com/plans, checked 2026-10-08). |\n| x402 | No · No x402, MPP or L402 on emailengine.app, in the documentation or in the OpenAPI spec (checked 2026-10-08). Licences are bought by card at postalsys.com, with Stripe named as the payment processor. |\n| Licence | Source available under the EmailEngine licence agreement, version 2.1 of 17 October 2023. Not open source. The PHP SDK is MIT |\n| Packages | npm: `emailengine-app`; oci: `postalsys/emailengine`; packagist: `postalsys/emailengine-php` |\n| Source | https://github.com/postalsys/emailengine |\n| Docs | https://learn.emailengine.app/ |\n| llms.txt | https://emailengine.app/llms.txt |\n| Last release | 2026-10-05 |\n| GitHub stars | 2,237 (as of 2026-10-08) |\n| npm downloads / week | 388 |\n| Graded surface | The REST API under /v1 on the owner's own instance, version 2.82.2. The beta MCP endpoint is described but not the graded surface |\n| Providers | IMAP and SMTP for any provider, Gmail API and Microsoft Graph, including Google service accounts and Microsoft 365 shared mailboxes and app-only access. No POP3, ActiveSync or EWS |\n| Requirements | A server and Redis run with the noeviction policy. Node.js 20 or later for the npm package, or the Docker image, or prebuilt binaries for macOS, Linux and Windows. Several thousand mailboxes per instance, per the vendor |\n| Credentials | Bearer tokens with scopes, account binding, action and group permissions, IP and referrer allowlists, expiry and a per-token rate limit. Stored as SHA-256 hashes (https://learn.emailengine.app/docs/api-reference/access-tokens) |\n| Rate limits | No fixed limit. The operator sets `maxRequests` and `timeWindow` per token. A 429 carries Retry-After, X-RateLimit-Limit, X-RateLimit-Reset and a `ttl` field in seconds |\n| Paging and search | `pageSize` 1 to 1,000, default 20. Cursors from `nextPageCursor`, the only way to page Gmail API and Microsoft Graph accounts. Search runs inside one folder, with `\\All` on Gmail and Microsoft Graph |\n| Sending | POST /v1/account/{account}/submit queues a message, with an Idempotency-Key header, scheduling, retries with exponential backoff and a copy saved to Sent Mail on SMTP accounts |\n| Events | 24 webhook event types, among them messageNew, messageUpdated, messageSent, messageBounce and authenticationError, signed with HMAC-SHA256 and retried up to ten times. No webhook history is kept |\n| Errors | JSON bodies with statusCode, error and message, a `code` on documented cases with a retryable flag, and a `fields` array on validation failures. Gmail API errors are passed through without an EmailEngine code (https://learn.emailengine.app/docs/api-reference/error-codes) |\n| MCP server | Beta since v2.79.2. Streamable HTTP at POST /mcp, 60 tools, 15 of them open to the mail scope and the rest for instance management, with readOnlyHint, destructiveHint and openWorldHint annotations. tools/list shows only what the token can call |\n| Audit | A per-token audit log of allowed and denied requests, off by default, kept for 1,000 entries or seven days per token by default. Sign-in and token events go to the application log as JSON |\n| Outbound calls | Subscription licences check in with postalsys.com at most once every 24 hours with a feature summary that EENGINE_BEACON_DISABLED removes. An update check to the GitHub releases API can be disabled. Trial and perpetual keys verify offline (https://learn.emailengine.app/docs/deployment/compliance) |\n| SDK | postalsys/emailengine-php v1.3.0 of 28 January 2026 on Packagist, MIT, PHP 8.1 or later. No other official SDK found |\n| Releases | 2.82.2 on 5 October 2026. 183 dated entries in CHANGELOG.md, ten tags between 7 September and 5 October 2026. Security fixes go to the latest release only |\n| Capabilities | mailbox.read, mailbox.search, mailbox.send, mailbox.drafts, mailbox.sync |\n| Tags | self-hosted, source-available, paid, trial, api-key, openapi, llms-txt, mcp, webhooks, imap, gmail, microsoft-365, docker, nodejs, php |\n| JSON | https://www.anchorterminal.com/api/v1/tools/emailengine.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-08 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 79 | 15.8 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 91 | 14.8 |\n| Agent ergonomics | 13% | 16.2 | 80 | 13.0 |\n| Security \u0026 auth | 14% | 17.5 | 71 | 12.4 |\n| Payments \u0026 pricing | 10% | 12.5 | 40 | 5.0 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 81 | 7.1 |\n| Transparency \u0026 trust (editorial 68, provenance 76) | 7% | 8.8 | 72 | 6.3 |\n| Negative events | up to −15 | up to −15 | 27 September 2026. Version 2.81.2, a patch release, removed the `bounces` field from the message list, message details and messageNew payloads, listed under bug fixes with no earlier notice found in the changelog. The bounce still arrives through the messageBounce webhook, and the entry is documented, so the smallest deduction applies (https://github.com/postalsys/emailengine/blob/master/CHANGELOG.md) | -3 |\n| **Total** | | | | **71.4 → BB** |\n\n### Why each score\n\n- Reliability 79: Read with the local-software lines, since the owner runs EmailEngine and Postal Systems hosts nothing an agent calls. Graded on the REST API. Official npm package emailengine-app 2.82.2 states Node.js 20 or later, with a Docker image, an installer script and binaries for macOS, Linux and Windows (20). The test workflow runs lint, a licence check, unit tests on Node 24 and 20.19, live Dovecot tests and Playwright end-to-end tests, and the last eight runs on master to 8 October 2026 passed per the GitHub API (25). Open crash and regression issues couldn't be counted, because the GitHub API reports issues as disabled on the repository. The changelog shows steady fixes, about 40 in 2.82.1 alone (12 of 25, unchecked). Releases follow conventional commits with a dated changelog, but 2.81.2, a patch release, removed the `bounces` field from message responses, and 2.82.0, a minor release, removed the Document Store and embeddings, none marked as breaking (7 of 15). Version 2.82.2, past 1.0 (15). No status page or SLA applies to software the owner runs.\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 91: Graded on the REST API. A public OpenAPI 3.0 spec for 2.82.2 at go.emailengine.app/swagger.json with 58 paths and 82 operations (25). llms.txt on emailengine.app and learn.emailengine.app, an LLM context page and a capabilities.json manifest (10). 81 of 82 operations carry a description, several with usage guidance such as preferring cursors over page numbers, the note that a 2xx on submit means queued, and a page on when to use MCP or REST. Limits of search by folder are stated in one sentence (16 of 20). Parameters are typed with defaults, minimums, maximums and 115 enum declarations, though account and gateway settings accept wide objects (12 of 15). Every operation documents 401, 403, 429 and 500, an error-codes page lists codes with a retryable flag, and examples come in curl, JavaScript, Python and PHP. Gmail API errors pass through without a code (13 of 15). The API is versioned at /v1 and CHANGELOG.md has 183 dated releases (15).\n- Agent ergonomics 80: Graded on the REST API. Message text is not returned unless `textType` asks for it, `maxBytes` caps it, and `pageSize` runs from 1 to 1,000 with a default of 20. The MCP mail scope reaches 15 tools, and tools/list shows only what the token can call (20 of 25). Cursor paging on every provider and a structured search by sender, subject, body, date, header and thread, limited to one folder outside Gmail and Microsoft Graph (18 of 20). Errors return statusCode, error, message and a documented `code` with a retryable flag and a `fields` array for validation, but 401, 404 for a missing account and 429 carry no code and Gmail errors are not translated (17 of 20). An Idempotency-Key header on both submit routes, Retry-After on 429, provider rate limits retried before an error is reported, and MCP annotations for read-only, destructive and open-world tools. Other writes have no idempotency key (17 of 20). Few required parameters and sensible defaults, with one official SDK, for PHP (8 of 15).\n- Security \u0026 auth 71: Graded on the REST API with the MCP controls counted where a line covers them. Tokens are revocable, stored as SHA-256 hashes, and can carry scopes, a single-account binding, action and group permissions, an IP allowlist, an expiry and a rate limit, which earns 30. The `access_token` query parameter is a documented alternative to the header, so 10 comes off (20 of 30). Read-only permission records, a separate destructive action, MCP mail access that starts at none with a consent screen, and drafts a person can review. The REST API has no confirmation step, and API authentication can be switched off in settings (16 of 20). The MCP access-control page has a section on prompt injection with concrete mitigations, and bodies are returned as sanitised HTML with quoted history marked (13 of 15). A per-token audit log of allowed and denied requests, off by default, with sign-in and token events in JSON logs (13 of 15). A signed security.txt valid to 1 June 2027, SECURITY.md, private reporting through GitHub advisories, an SBOM and npm provenance. No bug bounty, no SOC 2 or ISO 27001 and no published third-party audit, as the vendor's security page states, and the GitHub API listed no published advisories (9 of 20).\n- Payments \u0026 pricing 40: Read with the self-hosted rule, scoring the paid option, because the software needs a licence after the trial. No x402, MPP or L402 (0 of 40). The price is public without a login, $1,450 or EUR 1,200 a year flat, with no per-call or per-mailbox unit, read as plan pricing (10 of 20). A 14-day trial with full functionality starts from the instance's own dashboard with no sign-up and no card (20). No vendor account is needed for the trial and the CLI can issue tokens, but the trial starts with a button in the admin interface and a licence is bought through a browser sign-up at postalsys.com. The line has no middle step, and 10 is our judgement call for a route that needs one click and no account (10 of 20).\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 81: Version 2.82.2 was tagged on 5 October 2026, three days before this check (30). Ten tags between 7 September and 5 October 2026 and 183 dated changelog entries overall (20). The GitHub API reports issues as disabled, so issue replies couldn't be read. Pull requests are handled within days, with two open on 8 October 2026, both under two days old. Support is by email from the one developer, and the support page says no response time is guaranteed (15 of 25). One official SDK, postalsys/emailengine-php v1.3.0 of 28 January 2026. No entry in the MCP registry was looked for, since the MCP endpoint runs on the owner's host (6 of 15). Dependencies are pinned and updated in most releases, CI runs a licence check, and each install serves an SBOM (10).\n- Transparency \u0026 trust 72: The editorial half. The source is public and readable under the EmailEngine licence agreement 2.1, a proprietary licence with clear terms on trial, keys, resale and source changes. It is not an OSI licence, and the vendor says so (20 of 30). The security page and the compliance page list what Redis holds, state that message bodies are not stored, and list every outbound connection. Postal Systems says it is neither controller nor processor for mailbox data. The website privacy policy gives no retention periods, and the security page calls error reporting opt-in while the licensing page says a trial switches it on (20 of 30). No written deprecation policy was found. Dated notices exist, such as the Document Store removal date of 1 October 2026 announced in July and the pre-2.79 token paths kept as deprecated aliases, and security fixes go to the latest release only (12 of 20). The licence check, feature summary, update check and Sentry reporting are all disclosed, with EENGINE_BEACON_DISABLED and EENGINE_UPDATE_CHECK_DISABLED as opt-outs. The licence check can't be turned off on a subscription (16 of 20). The provenance half is computed from the provenance block.\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (20 items): https://www.anchorterminal.com/fixes/emailengine.md (JSON https://www.anchorterminal.com/fixes/emailengine.json)\n\n### What we couldn't check\n\n- unchecked: issue history and reply times. The GitHub API reports `has_issues` false for postalsys/emailengine and returned no issues on 8 October 2026, while the support page names GitHub Issues as a channel\n- unchecked: Docker Hub pull counts and the Docker image's supported tags\n- The security page calls Sentry error reporting opt-in, while the licensing and compliance pages say a trial switches it on to the developers' server since v2.79.0. We treated this as disclosed, with a point lost under data handling\n- The vendor's figures of 200 companies in 38 countries and several thousand mailboxes per instance are claims we couldn't verify\n- Whether 2.81.2's removal of the `bounces` field was announced anywhere outside the changelog. No notice was found in the changelog or docs we read\n- The first release date. llms.txt says 1.0.0 shipped in March 2020, and the earliest npm version we could see is 1.9.0 of 29 July 2021, so `firstReleased` is left empty\n- No performance, sync delay or send-limit figure was measured. Provider limits at Google and Microsoft still apply behind the API\n- The 10 points for onboarding without a human sign-up are a judgement call, since the trial needs one click in the instance's dashboard\n\n### Sources\n\n- home page, pricing and FAQ: \u003chttps://emailengine.app/\u003e (seen 2026-10-08)\n- llms.txt: \u003chttps://emailengine.app/llms.txt\u003e (seen 2026-10-08)\n- security page: \u003chttps://emailengine.app/security\u003e (seen 2026-10-08)\n- security.txt: \u003chttps://emailengine.app/.well-known/security.txt\u003e (seen 2026-10-08)\n- about page and legal entity: \u003chttps://emailengine.app/about\u003e (seen 2026-10-08)\n- privacy policy: \u003chttps://emailengine.app/privacy-policy\u003e (seen 2026-10-08)\n- plans and prices: \u003chttps://postalsys.com/plans\u003e (seen 2026-10-08)\n- terms of service: \u003chttps://postalsys.com/tos\u003e (seen 2026-10-08)\n- OpenAPI 3.0 spec: \u003chttps://go.emailengine.app/swagger.json\u003e (seen 2026-10-08)\n- capabilities manifest: \u003chttps://learn.emailengine.app/capabilities.json\u003e (seen 2026-10-08)\n- access tokens, permissions and audit log: \u003chttps://learn.emailengine.app/docs/api-reference/access-tokens\u003e (seen 2026-10-08)\n- error codes and 429 handling: \u003chttps://learn.emailengine.app/docs/api-reference/error-codes\u003e (seen 2026-10-08)\n- API reference overview and paging: \u003chttps://learn.emailengine.app/docs/api-reference\u003e (seen 2026-10-08)\n- MCP overview: \u003chttps://learn.emailengine.app/docs/mcp\u003e (seen 2026-10-08)\n- MCP access control and prompt injection: \u003chttps://learn.emailengine.app/docs/mcp/access-control\u003e (seen 2026-10-08)\n- MCP client setup: \u003chttps://learn.emailengine.app/docs/mcp/connect-clients\u003e (seen 2026-10-08)\n- licensing, trial and licence validation: \u003chttps://learn.emailengine.app/docs/licensing\u003e (seen 2026-10-08)\n- compliance and outbound connections: \u003chttps://learn.emailengine.app/docs/deployment/compliance\u003e (seen 2026-10-08)\n- support channels: \u003chttps://learn.emailengine.app/docs/support\u003e (seen 2026-10-08)\n- repository, changelog, licence, CI workflows and SECURITY.md (git clone): \u003chttps://github.com/postalsys/emailengine\u003e (seen 2026-10-08)\n- repository metadata, pull requests and workflow runs: \u003chttps://api.github.com/repos/postalsys/emailengine\u003e (seen 2026-10-08)\n- npm package: \u003chttps://registry.npmjs.org/emailengine-app/latest\u003e (seen 2026-10-08)\n- PHP SDK versions: \u003chttps://repo.packagist.org/p2/postalsys/emailengine-php.json\u003e (seen 2026-10-08)\n- domain registration: \u003chttps://rdap.org/domain/emailengine.app\u003e (seen 2026-10-08)\n\n## Who's behind it (provenance 76/100, checked 2026-10-08)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | Postal Systems OÜ, Narva mnt 5, 10117 Tallinn, Estonia, registry code 14971894 | 20/20 |\n| Domain age | emailengine.app, registered 2021-07-28 (5 years) | 11/15 |\n| Endpoint on the vendor's domain | no hosted endpoint | n/a |\n| Terms of service | read, states 5 of the 7 things a reader expects, and has 2 clauses that cost points | 4.3/10 |\n| Privacy policy | read, states 7 of the 8 things a reader expects | 9.3/10 |\n| Status page | not found | 0/10 |\n| Changelog | published | 10/10 |\n| security.txt | valid | 10/10 |\n\nThe about page names Postal Systems OÜ at Narva mnt 5, 10117 Tallinn, with registry code 14971894 and VAT number EE102255902, and says the company is run by one person.\n\nRDAP for emailengine.app shows registration on 28 July 2021 through Namecheap.\n\nemailengine.app/.well-known/security.txt is PGP-signed, expires on 1 June 2027 and points to GitHub private advisories and SECURITY.md. postalsys.com has its own security.txt with no Expires field.\n\nThe terms of service at postalsys.com/tos are dated 14 May 2020 and cover the subscription. The software licence is the EmailEngine licence agreement, version 2.1 of 17 October 2023, governed by Estonian law.\n\nThe privacy policy at emailengine.app/privacy-policy has an effective date of 29 July 2026 and covers the website and the licence account, with Stripe named for payments.\n\nThe API runs on the owner's instance, so there is no vendor endpoint and no status page.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://postalsys.com/tos), read 2026-10-08, gives no date, states 5 of the 7 things a reader expects.\n\n- To know. Restricts automated access (costs points). \"(b) Use any robot, spider, or other automatic device, process, or means to access Service for any purpose, including monitoring or copying\"\n- To know. Says the terms or the service can change without notice (costs points). \"We reserve the right to withdraw or amend our Service, and any service or material we provide via\"\n- To know. Says access can be ended without notice or for any reason. \"We may terminate or suspend your account and bar access to Service immediately, without prior notice or liability, under our sole\"\n- Not found in the text. Gives the date it was last updated.\n- Names the governing law or courts. The law of Estonia.\n- Says how changes to the terms are announced. Says it gives notice of a change.\n- Not found in the text. Refers to a service level or uptime commitment.\n- Also in the text (2026-10-08). The terms say they govern use of the web pages at postalsys.com, operated by Postal Systems OÜ. \"https://postalsys.com operated by Postal Systems OÜ.\"\n\n**Privacy policy** (https://emailengine.app/privacy-policy), read 2026-10-08, gives no date, states 7 of the 8 things a reader expects.\n\n- Not found in the text. Gives the date it was last updated.\n- Says how long data is kept. For as long as needed, with no period named.\n- Says whether personal data is sold or shared for advertising. Says it does not sell personal data.\n- Says where data is transferred or stored. Data goes to the United States.\n- Also in the text (2026-10-08). The policy defines the Service it covers as the emailengine.app website. \"SERVICE means the https://emailengine.app/ website operated by Postal Systems OÜ.\"\n\n## Live (updated 2026-10-08 16:10 UTC)\n\n- github `postalsys/emailengine` v2.83.0, released 2026-10-08\n- npm `emailengine-app` 2.83.0\n- security.txt: valid, expires 2027-06-01T00:00:00.000Z\n- Always current: https://www.anchorterminal.com/api/v1/live/emailengine.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Prices\n\n| Item | Price | Unit | Note |\n| --- | --- | --- | --- |\n| EmailEngine subscription, $1,450 billed yearly | $120.83 | per month (plan) | unlimited mailboxes, instances and API calls, VAT excluded, 14-day trial without a card |\n\nAcross all listings: https://www.anchorterminal.com/prices/index.md\n\n## Strengths\n\n- Public OpenAPI 3.0 spec for version 2.82.2 with 82 operations, plus llms.txt on both sites and a capabilities.json manifest\n- Tokens can be bound to one account, narrowed by action and group, limited by IP range, expiry and rate, and are stored only as SHA-256 hashes\n- Idempotency-Key header on both send routes, and 429 responses carry Retry-After and a ttl field\n- Ten tagged releases between 7 September and 5 October 2026, and the last eight test runs on master passed\n- Written prompt-injection guidance, with MCP mail access set to none by default and message bodies returned as sanitised HTML\n\n## Weaknesses\n\n- Not open source. Running it beyond the 14-day trial needs a subscription at $1,450 or EUR 1,200 a year\n- The owner has to run a server and Redis. There is no hosted service, status page or SLA\n- The MCP endpoint is labelled beta, is off by default, and its tool set may change between releases\n- A token may also travel in the `access_token` query parameter, and API authentication can be switched off in settings\n- Version 2.81.2, a patch release, removed the `bounces` field from message responses, and 2.82.0 removed the Document Store in a minor release\n- One maintainer, no guaranteed support response time, and issues are disabled on the GitHub repository per the GitHub API\n\n## Before you call it (notes for agents)\n\n1. Ask the operator for a token bound to one account with a permissions record. Mint more with POST /v1/tokens, which refuses instance-wide tokens without one\n2. Send the token in the Authorization header, not the `access_token` query parameter, so it stays out of proxy logs\n3. Page with `cursor` from `nextPageCursor`. `page` works only on IMAP accounts, and search covers one folder unless `path` is `\\All` on Gmail or Microsoft Graph\n4. Set an Idempotency-Key header on POST /v1/account/{account}/submit. A 2xx means queued, so follow the result through the outbox or the messageSent and messageFailed webhooks\n5. Treat message text as untrusted. For MCP, the operator must enable the endpoint first and mail access starts at none\n\n## Connect\n\nInstall:\n\n```bash\ncurl -LO https://go.emailengine.app/docker-compose.yml\ndocker compose up -d\n```\n\nFirst request:\n\n```bash\ncurl \"https://emailengine.example.com/v1/account/user@example.com/messages?path=INBOX\u0026page=0\u0026pageSize=50\" \\\n -H \"Authorization: Bearer YOUR_ACCESS_TOKEN\"\n```\n\nClaude Code:\n\n```bash\nclaude mcp add --transport http emailengine https://emailengine.example.com/mcp \\\n --header \"Authorization: Bearer YOUR_ACCESS_TOKEN\"\n```\n\nMCP client configuration:\n\n```json\n{\n \"mcpServers\": {\n \"emailengine\": {\n \"headers\": {\n \"Authorization\": \"Bearer YOUR_ACCESS_TOKEN\"\n },\n \"type\": \"http\",\n \"url\": \"https://emailengine.example.com/mcp\"\n }\n }\n}\n```\n\nThrough letme (picks today, calling later): https://letme.dev/emailengine. letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Nylas Email API | A | 78.7 | 12 | mailbox.read, mailbox.search, mailbox.send, mailbox.drafts, mailbox.sync | no | https://www.anchorterminal.com/tools/nylas-email.md |\n| Gmail API | BB | 77.8 | 17 | mailbox.read, mailbox.search, mailbox.send, mailbox.drafts, mailbox.sync | no | https://www.anchorterminal.com/tools/gmail-api.md |\n| Outlook Mail (Microsoft Graph) | B | 66.3 | 221 | mailbox.read, mailbox.search, mailbox.send, mailbox.drafts, mailbox.sync | no | https://www.anchorterminal.com/tools/outlook-mail-graph.md |\n| Unipile | C | 58.4 | 402 | mailbox.read, mailbox.search, mailbox.send, mailbox.drafts, mailbox.sync | no | https://www.anchorterminal.com/tools/unipile.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- One REST API under /v1 translates calls into IMAP, SMTP, Gmail API or Microsoft Graph operations. POP3, ActiveSync and Exchange Web Services are not supported (source: \u003chttps://emailengine.app/llms.txt\u003e)\n- The OpenAPI 3.0 spec for 2.82.2 lists 58 paths and 82 operations, and every operation documents 401, 403, 429 and 500 responses (source: \u003chttps://go.emailengine.app/swagger.json\u003e)\n- The MCP server at POST /mcp shipped in v2.79.2 on 22 August 2026 as a labelled beta, is off by default, and wraps REST routes with the caller's own token (source: \u003chttps://learn.emailengine.app/docs/mcp\u003e)\n- Message bodies are fetched on demand from the mailbox and not stored. Redis holds a sync index, queued jobs, encrypted credentials and token hashes (source: \u003chttps://emailengine.app/security\u003e)\n- Credential encryption with AES-256-GCM is active only once the operator sets EENGINE_SECRET (source: \u003chttps://emailengine.app/security\u003e)\n- The Document Store was removed in 2.82.0 on 1 October 2026, after an interface warning naming that date was added in 2.74.0 on 23 July 2026 (source: \u003chttps://github.com/postalsys/emailengine/blob/master/CHANGELOG.md\u003e)\n- Activating a trial switches on error reporting to a Sentry server run by the developers until the operator sets `sentryEnabled` or adds a full licence (source: \u003chttps://learn.emailengine.app/docs/licensing\u003e)\n\n## Compare\n\n- [EmailEngine vs Gmail API](https://www.anchorterminal.com/compare/emailengine-vs-gmail-api.md): BB 71.4 vs BB 77.8\n- [EmailEngine vs Nylas Email API](https://www.anchorterminal.com/compare/emailengine-vs-nylas-email.md): BB 71.4 vs A 78.7\n- [EmailEngine vs Outlook Mail (Microsoft Graph)](https://www.anchorterminal.com/compare/emailengine-vs-outlook-mail-graph.md): BB 71.4 vs B 66.3\n- [EmailEngine vs Unipile](https://www.anchorterminal.com/compare/emailengine-vs-unipile.md): BB 71.4 vs C 58.4\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on emailengine.app or one of its subdomains, or the README of github.com/postalsys/emailengine. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"emailengine\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/emailengine\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/emailengine.svg\" alt=\"EmailEngine on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![EmailEngine on Anchor Terminal](https://www.anchorterminal.com/badges/emailengine.svg)](https://www.anchorterminal.com/tools/emailengine)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/emailengine\"\u003eEmailEngine on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say EmailEngine is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/emailengine-dark.png\n- Light: https://www.anchorterminal.com/assets/share/emailengine-light.png\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Mailbox access", "url": "https://www.anchorterminal.com/categories/mailbox-access" }, { "name": "EmailEngine", "url": "" } ], "description": "EmailEngine is self-hosted software from Postal Systems that puts one REST API over Gmail, Microsoft 365 and IMAP mailboxes, with webhooks for new mail and a beta MCP server. The owner runs it with Redis.", "facts": [ "rank #106 of 629", "API key auth", "0 desk reviews" ], "h1": "EmailEngine", "image": "https://www.anchorterminal.com/assets/og/tools-emailengine.png", "path": "/tools/emailengine", "published": "2026-10-01", "section": "tools", "title": "EmailEngine review for AI agents, grade BB (71.4/100)", "toc": null, "updated": "2026-10-08", "url": "https://www.anchorterminal.com/tools/emailengine" }, "tokens": { "markdown": 8000, "slim": 2030 }, "version": 1 }