# Oryah Mail

> Oryah Mail is a hosted remote MCP server from Infinihash LLC that connects Gmail, Google Workspace, Microsoft 365 and IMAP mailboxes and calendars to Claude and to AI agents, with per-mailbox permissions, a send-domain allowlist, scoped API keys for agents and an audit log. $1 per mailbox per month or $10 per mailbox per year, 14-day free trial.

MCP endpoint: https://mail-mcp.infinihash.com/mcp (Streamable HTTP). People sign in with OAuth 2.1 (dynamic client registration, PKCE). Agents send `Authorization: Bearer omk_...` with an API key created in the admin console. Official MCP Registry name: com.infinihash/oryah-mail.

## Docs

- [Documentation](https://mail.infinihash.com/docs.html): setup in Claude, Claude Code, Cursor, ChatGPT, Grok, Meta Muse, the OpenAI and xAI APIs and other MCP clients; permissions; API keys; tool reference; troubleshooting.
- [Pricing](https://mail.infinihash.com/pricing.html): one plan, $1 per mailbox per month or $10 per mailbox per year, 14-day free trial, shared mailboxes count as mailboxes.
- [Privacy](https://mail.infinihash.com/privacy.html) and [Terms](https://mail.infinihash.com/terms.html).
- [Store page](https://apps.infinihash.com/apps/oryah-mail) on the Infinihash App Store.

## What it does

- Connects several mailboxes behind one connector: Gmail and Google Calendar, Microsoft 365 mail and calendars including shared mailboxes, and IMAP providers (Yahoo, AOL, iCloud, Zoho, Fastmail, custom) with CalDAV where the provider offers it.
- 30 tools with MCP annotations (readOnlyHint, destructiveHint): 14 read, 9 write, 7 send-or-delete. Send tools send immediately.
- Per-mailbox Controls: Full access, Read + draft, Read only, Off or Custom.
- Send-allowed domains per mailbox; a recipient outside the list (To, Cc, Bcc or Reply-To) makes the send fail, and the refusal is logged.
- API keys for agents: access level (Read only by default), expiry, optional daily send cap, optional send-allowed domains and per-mailbox overrides. A request must pass both the key's access and the mailbox Controls. The owner can pause every key with one button (error api_keys_paused).
- A key only advertises the tools it could use: Read only lists 13 read tools, Read + draft adds drafts and upload links, Full access lists all 30.
- Send tools (send_mail, reply, forward, send_draft) accept idempotency_key: a repeated call with the same key returns the first result with idempotent_replay true and never sends twice (keys kept 7 days).
- Audit log of every draft, send, organize, delete, calendar change and refusal, with the OAuth session or key name. Successful reads are not logged individually.

## What it does not do

- It does not host, sync or back up mail; each request is relayed to the provider.
- It does not add a confirmation step on the server; permissions, send caps and the client's own confirmations are the guard.
- New mailboxes start with Full access; set Controls before giving an agent a key for them.
- Google OAuth verification is not complete; Google shows an unverified-app screen when a Google account is added.

## Optional

- [Infinihash](https://infinihash.com/llms.txt): the company and its other products.
- [Full detail](https://mail.infinihash.com/llms-full.txt): tool reference and setup commands.