{"_id":"replylayer-mcp","_rev":"19-1de16e3c2081b2d4528a2853cc181101","name":"replylayer-mcp","dist-tags":{"latest":"0.15.1"},"versions":{"0.3.0":{"name":"replylayer-mcp","version":"0.3.0","keywords":["email","ai","agent","mcp","replylayer","model-context-protocol"],"license":"MIT","_id":"replylayer-mcp@0.3.0","maintainers":[{"name":"ndssguy","email":"mcintosh.james@gmail.com"}],"homepage":"https://github.com/replylayer/ReplyLayer#readme","bugs":{"url":"https://github.com/replylayer/ReplyLayer/issues"},"bin":{"replylayer-mcp":"dist/server.js"},"dist":{"shasum":"c66dd7a6bcfd94857b8ddea8033cdf83228cf0ba","tarball":"https://registry.npmjs.org/replylayer-mcp/-/replylayer-mcp-0.3.0.tgz","fileCount":163,"integrity":"sha512-xYvKg/rOp/uci6rFL9AiUCZj/HSjv8u1/qoUgJz6m8W3UDe7utqRDc7yrtOt4aIdHgflwUBEKqddK2Kws3KJlw==","signatures":[{"sig":"MEQCIGfxP0mTmtbXJZbElTKTLtARzIaQ2wqOVB46WHt9LTahAiB5+Sp7IaI9dH6Quj/iuPbtSdl63RF8m4e7yw2jcLiIoA==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":301973},"type":"module","_from":"file:replylayer-mcp-0.3.0.tgz","engines":{"node":">=22"},"exports":{".":"./dist/server.js","./tools":"./dist/tools/index.js"},"private":false,"scripts":{"dev":"tsx watch src/server.ts","lint":"eslint src/","test":"vitest run","build":"tsc","clean":"rm -rf dist","start":"node dist/server.js","typecheck":"tsc --noEmit","test:watch":"vitest"},"_npmUser":{"name":"ndssguy","email":"mcintosh.james@gmail.com"},"_resolved":"/tmp/claude-1000/4f19230dfe0662fbde4cc551a28c97f6/replylayer-mcp-0.3.0.tgz","_integrity":"sha512-xYvKg/rOp/uci6rFL9AiUCZj/HSjv8u1/qoUgJz6m8W3UDe7utqRDc7yrtOt4aIdHgflwUBEKqddK2Kws3KJlw==","repository":{"url":"git+https://github.com/replylayer/ReplyLayer.git","type":"git","directory":"packages/mcp"},"_npmVersion":"10.9.7","description":"MCP server for ReplyLayer — safe email for AI agents","directories":{},"_nodeVersion":"22.22.2","dependencies":{"zod":"^3.24.0","replylayer":"0.6.1","@modelcontextprotocol/sdk":"^1.29.0"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.0.0","vitest":"^3.2.0","typescript":"^5.8.0","@replylayer/shared":"0.0.1"},"_npmOperationalInternal":{"tmp":"tmp/replylayer-mcp_0.3.0_1780610676729_0.6187893601119043","host":"s3://npm-registry-packages-npm-production"}},"0.4.0":{"name":"replylayer-mcp","version":"0.4.0","keywords":["email","ai","agent","mcp","replylayer","model-context-protocol"],"license":"MIT","_id":"replylayer-mcp@0.4.0","maintainers":[{"name":"ndssguy","email":"mcintosh.james@gmail.com"}],"homepage":"https://github.com/replylayer/ReplyLayer#readme","bugs":{"url":"https://github.com/replylayer/ReplyLayer/issues"},"bin":{"replylayer-mcp":"dist/server.js"},"dist":{"shasum":"9b1cdce1b42191c6ac77cb70c6cf2ed699e01f1c","tarball":"https://registry.npmjs.org/replylayer-mcp/-/replylayer-mcp-0.4.0.tgz","fileCount":195,"integrity":"sha512-vKU9d8PIog3146U57ASb4W1UkPJ4f09YRAE7+7aOR7ATG+ygM1q6fkLh9A8Sl1To2+Ylxg46e9gMEKO+cBs6Iw==","signatures":[{"sig":"MEUCIQCLvZNZ4DHLG/w7V2O8g8UhCsXCVYMYPSm10uqj2GrGAgIgGzAlJhMtHWt2Ju/XnJlgghOk+JcSax25HHW2yigW1Gs=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":741240},"type":"module","_from":"file:replylayer-mcp-0.4.0.tgz","engines":{"node":">=22"},"exports":{".":"./dist/server.js","./tools":"./dist/tools/index.js"},"private":false,"scripts":{"dev":"tsx watch src/server.ts","lint":"eslint src/","test":"vitest run","build":"tsc","clean":"rm -rf dist","start":"node dist/server.js","typecheck":"tsc --noEmit","test:watch":"vitest"},"_npmUser":{"name":"ndssguy","email":"mcintosh.james@gmail.com"},"_resolved":"/tmp/4d3c6ddb6dab1ca4ab447c7a80a45158/replylayer-mcp-0.4.0.tgz","_integrity":"sha512-vKU9d8PIog3146U57ASb4W1UkPJ4f09YRAE7+7aOR7ATG+ygM1q6fkLh9A8Sl1To2+Ylxg46e9gMEKO+cBs6Iw==","repository":{"url":"git+https://github.com/replylayer/ReplyLayer.git","type":"git","directory":"packages/mcp"},"_npmVersion":"10.9.8","description":"MCP server for ReplyLayer — safe email for AI agents","directories":{},"_nodeVersion":"22.22.3","dependencies":{"zod":"^3.24.0","@replylayer/sdk":"^0.15.0","@modelcontextprotocol/sdk":"^1.29.0"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.0.0","vitest":"^3.2.0","typescript":"^5.8.0"},"_npmOperationalInternal":{"tmp":"tmp/replylayer-mcp_0.4.0_1780752095721_0.3937203045344755","host":"s3://npm-registry-packages-npm-production"}},"0.5.0":{"name":"replylayer-mcp","version":"0.5.0","keywords":["email","ai","agent","mcp","replylayer","model-context-protocol"],"license":"MIT","_id":"replylayer-mcp@0.5.0","maintainers":[{"name":"ndssguy","email":"mcintosh.james@gmail.com"}],"homepage":"https://github.com/replylayer/ReplyLayer#readme","bugs":{"url":"https://github.com/replylayer/ReplyLayer/issues"},"bin":{"replylayer-mcp":"dist/server.js"},"dist":{"shasum":"8cea2fc97e2051ae5725ab1d014b462370a6da13","tarball":"https://registry.npmjs.org/replylayer-mcp/-/replylayer-mcp-0.5.0.tgz","fileCount":227,"integrity":"sha512-g3pRE9nZ6z3CrMXzlT4i9ktxYwdJ96ipcfhAyFBzIK2Ygo9IhiL4/ZU3V8y8aGKngyMkCyMg/0KYT7W/j8EG8A==","signatures":[{"sig":"MEUCIDA0lcWHeeG/0Q4sK89TXblCgRf8s2mOMfo0Z+fJXh0hAiEA+M1Mstr8TU3Fp+WbXZgu6BFbT9AiamYWf5TUDiaKPlc=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":811103},"type":"module","_from":"file:replylayer-mcp-0.5.0.tgz","engines":{"node":">=22"},"exports":{".":"./dist/server.js","./tools":"./dist/tools/index.js"},"private":false,"scripts":{"dev":"tsx watch src/server.ts","lint":"eslint src/","test":"vitest run","build":"tsc","clean":"rm -rf dist","start":"node dist/server.js","typecheck":"tsc --noEmit","test:watch":"vitest"},"_npmUser":{"name":"ndssguy","email":"mcintosh.james@gmail.com"},"_resolved":"/tmp/bec56e87ee901199565becde066e9f75/replylayer-mcp-0.5.0.tgz","_integrity":"sha512-g3pRE9nZ6z3CrMXzlT4i9ktxYwdJ96ipcfhAyFBzIK2Ygo9IhiL4/ZU3V8y8aGKngyMkCyMg/0KYT7W/j8EG8A==","repository":{"url":"git+https://github.com/replylayer/ReplyLayer.git","type":"git","directory":"packages/mcp"},"_npmVersion":"10.9.8","description":"MCP server for ReplyLayer — safe email for AI agents","directories":{},"_nodeVersion":"22.22.3","dependencies":{"zod":"^3.24.0","@replylayer/sdk":"^0.16.0","@modelcontextprotocol/sdk":"^1.29.0"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.0.0","vitest":"^3.2.0","typescript":"^5.8.0"},"_npmOperationalInternal":{"tmp":"tmp/replylayer-mcp_0.5.0_1780967350524_0.34143091927311664","host":"s3://npm-registry-packages-npm-production"}},"0.6.0":{"name":"replylayer-mcp","version":"0.6.0","keywords":["email","ai","agent","mcp","replylayer","model-context-protocol"],"license":"MIT","_id":"replylayer-mcp@0.6.0","maintainers":[{"name":"ndssguy","email":"mcintosh.james@gmail.com"}],"bin":{"replylayer-mcp":"dist/server.js"},"dist":{"shasum":"4a5c44361eb8c58275209218a4d34a10ac1056a7","tarball":"https://registry.npmjs.org/replylayer-mcp/-/replylayer-mcp-0.6.0.tgz","fileCount":215,"integrity":"sha512-LrwSJ8APyTEKHnadmWO7mmtPvh3PewvrH1aR3EmwyGfeHv2xUITSvxdALhu3MsBoM1iuo1oO0EoQkY/Zi+ETGg==","signatures":[{"sig":"MEQCICuPfTG5RYeiBe/35jHoiLl7M4HpPxbSmoC7DHsXmllEAiAmh6oWmOCMyIIREQDjn6yFUJ4K0EK7GLh3kJw6sBfhIg==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":662851},"type":"module","_from":"file:replylayer-mcp-0.6.0.tgz","engines":{"node":">=22"},"exports":{".":"./dist/server.js","./tools":"./dist/tools/index.js"},"private":false,"scripts":{"dev":"tsx watch src/server.ts","lint":"eslint src/","test":"vitest run","build":"tsc","clean":"rm -rf dist","start":"node dist/server.js","typecheck":"tsc --noEmit","test:watch":"vitest"},"_npmUser":{"name":"ndssguy","email":"mcintosh.james@gmail.com"},"_resolved":"/tmp/71ec2dba71ca2b9305611b144cdb9e4d/replylayer-mcp-0.6.0.tgz","_integrity":"sha512-LrwSJ8APyTEKHnadmWO7mmtPvh3PewvrH1aR3EmwyGfeHv2xUITSvxdALhu3MsBoM1iuo1oO0EoQkY/Zi+ETGg==","_npmVersion":"10.9.8","description":"MCP server for ReplyLayer — safe email for AI agents","directories":{},"_nodeVersion":"22.22.3","dependencies":{"zod":"^3.24.0","@replylayer/sdk":"^0.18.0","@modelcontextprotocol/sdk":"^1.29.0"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.22.4","vitest":"^3.2.0","typescript":"^6.0.3","@types/node":"^22.0.0"},"_npmOperationalInternal":{"tmp":"tmp/replylayer-mcp_0.6.0_1782316684803_0.03604577261410569","host":"s3://npm-registry-packages-npm-production"}},"0.9.0":{"name":"replylayer-mcp","version":"0.9.0","keywords":["email","ai","agent","mcp","replylayer","model-context-protocol"],"license":"MIT","_id":"replylayer-mcp@0.9.0","maintainers":[{"name":"ndssguy","email":"mcintosh.james@gmail.com"}],"bin":{"replylayer-mcp":"dist/server.js"},"dist":{"shasum":"08d702f467e44fc279545e7a573188b81c3cb9b6","tarball":"https://registry.npmjs.org/replylayer-mcp/-/replylayer-mcp-0.9.0.tgz","fileCount":227,"integrity":"sha512-TVYheVxtd/Q8RWlwWJfhp1x/JPXIszbzaYZcZqqLTiWIUD1ePEZKbyqT+549CHvhBfnNxMyRFEXdz+oJFJx1oQ==","signatures":[{"sig":"MEQCIDZLIMOjelJqjPcK0C0gJhYIujHs7E983AjKMX/VkBpDAiAT9pGm7hhvbxM3b2IlBl5gimTKdLaTXtdo+MU66B1J2w==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":808109},"type":"module","_from":"file:replylayer-mcp-0.9.0.tgz","engines":{"node":">=22"},"exports":{".":"./dist/server.js","./tools":"./dist/tools/index.js"},"private":false,"scripts":{"dev":"tsx watch src/server.ts","lint":"eslint src/","test":"vitest run","build":"tsc","clean":"rm -rf dist","start":"node dist/server.js","typecheck":"tsc --noEmit","test:watch":"vitest"},"_npmUser":{"name":"ndssguy","email":"mcintosh.james@gmail.com"},"_resolved":"/tmp/af779d1cb288d446a6f3bccc6ef794b1/replylayer-mcp-0.9.0.tgz","_integrity":"sha512-TVYheVxtd/Q8RWlwWJfhp1x/JPXIszbzaYZcZqqLTiWIUD1ePEZKbyqT+549CHvhBfnNxMyRFEXdz+oJFJx1oQ==","_npmVersion":"10.9.8","description":"MCP server for ReplyLayer — safe email for AI agents","directories":{},"_nodeVersion":"22.22.3","dependencies":{"zod":"^3.24.0","@replylayer/sdk":"^0.21.0","@modelcontextprotocol/sdk":"^1.29.0"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.22.4","vitest":"^3.2.0","typescript":"^6.0.3","@types/node":"^22.0.0"},"_npmOperationalInternal":{"tmp":"tmp/replylayer-mcp_0.9.0_1782434283903_0.006388981732619703","host":"s3://npm-registry-packages-npm-production"}},"0.10.0":{"name":"replylayer-mcp","version":"0.10.0","keywords":["email","ai","agent","mcp","replylayer","model-context-protocol"],"license":"MIT","_id":"replylayer-mcp@0.10.0","maintainers":[{"name":"ndssguy","email":"mcintosh.james@gmail.com"}],"bin":{"replylayer-mcp":"dist/server.js"},"dist":{"shasum":"9083fb0ee0678ee1384792197451314df107acda","tarball":"https://registry.npmjs.org/replylayer-mcp/-/replylayer-mcp-0.10.0.tgz","fileCount":227,"integrity":"sha512-knDWiJmOs/xSNNLA0cBvbPXbKdYBqbv14lgWZZqA7NeCAUl9S996beiJPdqj9jKYY9l1jY2zdqCYLbGXFP9hGw==","signatures":[{"sig":"MEYCIQCiiRDRc/ertPllXG9QCHhOTXsGUSOBkRcCmBbYOro4fAIhAJBCKpXfFidhj3/ERkPjuMq12nYOX5I+lvWwdhveGrVG","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":905299},"type":"module","_from":"file:replylayer-mcp-0.10.0.tgz","engines":{"node":">=22"},"exports":{".":"./dist/server.js","./tools":"./dist/tools/index.js"},"private":false,"scripts":{"dev":"tsx watch src/server.ts","lint":"eslint src/","test":"vitest run","build":"tsc","clean":"rm -rf dist","start":"node dist/server.js","typecheck":"tsc --noEmit","test:watch":"vitest"},"_npmUser":{"name":"ndssguy","email":"mcintosh.james@gmail.com"},"_resolved":"/tmp/0f78e2ae0db4312e39f361b7f85fc144/replylayer-mcp-0.10.0.tgz","_integrity":"sha512-knDWiJmOs/xSNNLA0cBvbPXbKdYBqbv14lgWZZqA7NeCAUl9S996beiJPdqj9jKYY9l1jY2zdqCYLbGXFP9hGw==","_npmVersion":"10.9.8","description":"MCP server for ReplyLayer — safe email for AI agents","directories":{},"_nodeVersion":"22.23.1","dependencies":{"zod":"^3.24.0","@replylayer/sdk":"^0.22.0","@modelcontextprotocol/sdk":"^1.29.0"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.22.4","vitest":"^3.2.0","typescript":"^6.0.3","@types/node":"^22.0.0"},"_npmOperationalInternal":{"tmp":"tmp/replylayer-mcp_0.10.0_1782914477999_0.929269216628396","host":"s3://npm-registry-packages-npm-production"}},"0.10.1":{"name":"replylayer-mcp","version":"0.10.1","keywords":["email","ai","agent","mcp","replylayer","model-context-protocol"],"license":"MIT","_id":"replylayer-mcp@0.10.1","maintainers":[{"name":"ndssguy","email":"mcintosh.james@gmail.com"}],"homepage":"https://replylayer.ai","bugs":{"url":"https://github.com/replylayer/rly/issues"},"bin":{"replylayer-mcp":"dist/server.js"},"dist":{"shasum":"303d8384cc4ff5706211ecca1fed83897aee4ff9","tarball":"https://registry.npmjs.org/replylayer-mcp/-/replylayer-mcp-0.10.1.tgz","fileCount":227,"integrity":"sha512-TnNziTM2fYOzud1EI/wB6FHNO1bkJ+M7qcL0AXiAuuuoPT+GFlSt8Gp/xuaO4dQPXenQxQCLBVCFBrrrela1gA==","signatures":[{"sig":"MEYCIQCWdbazumb2HgKzOpmhfGqBIq7cVNIvl8yxlT/Efs+ijAIhAP2CQemQLH6lEq+1e4HuFqFIIapxSblHR6/wJ99N4d59","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":905558},"type":"module","_from":"file:replylayer-mcp-0.10.1.tgz","engines":{"node":">=22"},"exports":{".":"./dist/server.js","./tools":"./dist/tools/index.js"},"private":false,"scripts":{"dev":"tsx watch src/server.ts","lint":"eslint src/","test":"vitest run","build":"tsc","clean":"rm -rf dist","start":"node dist/server.js","typecheck":"tsc --noEmit","test:watch":"vitest"},"_npmUser":{"name":"ndssguy","email":"mcintosh.james@gmail.com"},"_resolved":"/tmp/d591b37805b20c1688e575505f4386a2/replylayer-mcp-0.10.1.tgz","_integrity":"sha512-TnNziTM2fYOzud1EI/wB6FHNO1bkJ+M7qcL0AXiAuuuoPT+GFlSt8Gp/xuaO4dQPXenQxQCLBVCFBrrrela1gA==","repository":{"url":"git+https://github.com/replylayer/rly.git","type":"git"},"_npmVersion":"10.9.8","description":"MCP server for ReplyLayer — safe email for AI agents","directories":{},"_nodeVersion":"22.23.1","dependencies":{"zod":"^3.24.0","@replylayer/sdk":"^0.22.1","@modelcontextprotocol/sdk":"^1.29.0"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.22.4","vitest":"^3.2.0","typescript":"^6.0.3","@types/node":"^22.0.0"},"_npmOperationalInternal":{"tmp":"tmp/replylayer-mcp_0.10.1_1782999623139_0.8558934162485554","host":"s3://npm-registry-packages-npm-production"}},"0.11.0":{"name":"replylayer-mcp","version":"0.11.0","keywords":["email","ai","agent","mcp","replylayer","model-context-protocol"],"license":"MIT","_id":"replylayer-mcp@0.11.0","maintainers":[{"name":"ndssguy","email":"mcintosh.james@gmail.com"}],"homepage":"https://replylayer.ai","bugs":{"url":"https://github.com/replylayer/rly/issues"},"bin":{"replylayer-mcp":"dist/server.js"},"dist":{"shasum":"4f7920ade1deb1c39c1a7928e6af09211e2a2d02","tarball":"https://registry.npmjs.org/replylayer-mcp/-/replylayer-mcp-0.11.0.tgz","fileCount":227,"integrity":"sha512-hczgVE9mdmd+ycXlOd2tav1uiE8fRgEit/z2KC6bEI10u2k11uBOrzo5AM6clKVHi2e13etjekO9IOSzGfwieQ==","signatures":[{"sig":"MEUCIBxPRAWQt3OhfjpJdfuc8kNACzbCcCtZ3G/s9D9DtzH8AiEA6uIio0t7PhalPz1e2oGcihqRgtn1XEXYiIYlAYzIiY0=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":905834},"type":"module","_from":"file:replylayer-mcp-0.11.0.tgz","engines":{"node":">=22"},"exports":{".":"./dist/server.js","./tools":"./dist/tools/index.js"},"private":false,"scripts":{"dev":"tsx watch src/server.ts","lint":"eslint src/","test":"vitest run","build":"tsc","clean":"rm -rf dist","start":"node dist/server.js","typecheck":"tsc --noEmit","test:watch":"vitest"},"_npmUser":{"name":"ndssguy","email":"mcintosh.james@gmail.com"},"_resolved":"/tmp/6d567ad06339534214a4382d14d3d80c/replylayer-mcp-0.11.0.tgz","_integrity":"sha512-hczgVE9mdmd+ycXlOd2tav1uiE8fRgEit/z2KC6bEI10u2k11uBOrzo5AM6clKVHi2e13etjekO9IOSzGfwieQ==","repository":{"url":"git+https://github.com/replylayer/rly.git","type":"git"},"_npmVersion":"10.9.8","description":"MCP server for ReplyLayer — safe email for AI agents","directories":{},"_nodeVersion":"22.23.1","dependencies":{"zod":"^3.24.0","@replylayer/sdk":"^0.23.0","@modelcontextprotocol/sdk":"^1.29.0"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.22.4","vitest":"^3.2.0","typescript":"^6.0.3","@types/node":"^22.0.0"},"_npmOperationalInternal":{"tmp":"tmp/replylayer-mcp_0.11.0_1783196342403_0.8102781006205309","host":"s3://npm-registry-packages-npm-production"}},"0.11.1":{"name":"replylayer-mcp","version":"0.11.1","keywords":["email","ai","agent","mcp","replylayer","model-context-protocol"],"license":"MIT","_id":"replylayer-mcp@0.11.1","maintainers":[{"name":"ndssguy","email":"mcintosh.james@gmail.com"}],"homepage":"https://replylayer.ai","bugs":{"url":"https://github.com/replylayer/rly/issues"},"bin":{"replylayer-mcp":"dist/server.js"},"dist":{"shasum":"0cc93a38fbe3518da92da4f4b016f2f251056164","tarball":"https://registry.npmjs.org/replylayer-mcp/-/replylayer-mcp-0.11.1.tgz","fileCount":227,"integrity":"sha512-/46dGjBA8Sgw8gwIiso4N40i764t7cyxSuHyvazXFcreRptYm6UfoUYIfAJYpL6RPkTMlnZYgKYHbyvEJYEtLQ==","signatures":[{"sig":"MEUCICLPd3sZCqEqdbmcqkmiGHwIheaoJ+fWOiYZ4jkZHM8cAiEAnPZheFOmGk8Os0E1tG2Jl8DCJCR2ycezaQ+U1Z+PQdo=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":916725},"type":"module","_from":"file:replylayer-mcp-0.11.1.tgz","engines":{"node":">=22"},"exports":{".":"./dist/server.js","./tools":"./dist/tools/index.js"},"private":false,"scripts":{"dev":"tsx watch src/server.ts","lint":"eslint src/","test":"vitest run","build":"tsc","clean":"rm -rf dist","start":"node dist/server.js","typecheck":"tsc --noEmit","test:watch":"vitest"},"_npmUser":{"name":"ndssguy","email":"mcintosh.james@gmail.com"},"_resolved":"/tmp/f55e70484ad780c786968e72f0df1a61/replylayer-mcp-0.11.1.tgz","_integrity":"sha512-/46dGjBA8Sgw8gwIiso4N40i764t7cyxSuHyvazXFcreRptYm6UfoUYIfAJYpL6RPkTMlnZYgKYHbyvEJYEtLQ==","repository":{"url":"git+https://github.com/replylayer/rly.git","type":"git"},"_npmVersion":"10.9.8","description":"MCP server for ReplyLayer — safe email for AI agents","directories":{},"_nodeVersion":"22.23.1","dependencies":{"zod":"^3.24.0","@replylayer/sdk":"^0.26.0","@modelcontextprotocol/sdk":"^1.29.0"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.22.4","vitest":"^3.2.6","typescript":"^6.0.3","@types/node":"^22.0.0"},"_npmOperationalInternal":{"tmp":"tmp/replylayer-mcp_0.11.1_1784990339264_0.9827727374730775","host":"s3://npm-registry-packages-npm-production"}},"0.12.0":{"name":"replylayer-mcp","version":"0.12.0","keywords":["email","ai","agent","mcp","replylayer","model-context-protocol"],"license":"MIT","_id":"replylayer-mcp@0.12.0","maintainers":[{"name":"ndssguy","email":"mcintosh.james@gmail.com"}],"homepage":"https://replylayer.ai","bugs":{"url":"https://github.com/replylayer/rly/issues"},"bin":{"replylayer-mcp":"dist/server.js"},"dist":{"shasum":"8b5262bd5253b2d0ceb9aaeed2c1468197d05b41","tarball":"https://registry.npmjs.org/replylayer-mcp/-/replylayer-mcp-0.12.0.tgz","fileCount":235,"integrity":"sha512-jT2H+8vWI9WB6VdQL4u2rMtk9rkolWlXr25MiSRrLiyuzszKQI5nJb92Q0gHw19sIkv0Iz+DlwpbXG05D9vJAQ==","signatures":[{"sig":"MEYCIQDVirnyJDO/Wy9+yxXT99VTT9RWIfoZhWzHZ2Y3Vx+6pwIhAKcVp2LD6rUUOoQGzeYR/sMt2+YTrq+dqX0+fFo6FrBi","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEYCIQCOV3GlH4+/dYgB0Vzi0NRCjjiQyILCJfSVfIvru9smEQIhAOXDcCM/1yP6tMeKyAPgjCLWW8u/N1scKO1n7cnTydkb","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":939650},"type":"module","_from":"file:replylayer-mcp-0.12.0.tgz","engines":{"node":">=22"},"exports":{".":"./dist/server.js","./tools":"./dist/tools/index.js"},"private":false,"scripts":{"dev":"tsx watch src/server.ts","lint":"eslint src/","test":"vitest run","build":"tsc","clean":"rm -rf dist","start":"node dist/server.js","typecheck":"tsc --noEmit","test:watch":"vitest"},"_npmUser":{"name":"ndssguy","email":"mcintosh.james@gmail.com"},"_resolved":"/tmp/a2d656b3459a484a8b541fcc1ad772a4/replylayer-mcp-0.12.0.tgz","_integrity":"sha512-jT2H+8vWI9WB6VdQL4u2rMtk9rkolWlXr25MiSRrLiyuzszKQI5nJb92Q0gHw19sIkv0Iz+DlwpbXG05D9vJAQ==","repository":{"url":"git+https://github.com/replylayer/rly.git","type":"git"},"_npmVersion":"10.9.8","description":"MCP server for ReplyLayer — safe email for AI agents","directories":{},"_nodeVersion":"22.23.2","dependencies":{"zod":"^3.24.0","@replylayer/sdk":"^0.27.0","@modelcontextprotocol/sdk":"^1.29.0"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.23.11","vitest":"^3.2.6","typescript":"^6.0.3","@types/node":"^22.0.0"},"_npmOperationalInternal":{"tmp":"tmp/replylayer-mcp_0.12.0_1789269696019_0.049452270575065294","host":"s3://npm-registry-packages-npm-production"}},"0.12.1":{"name":"replylayer-mcp","version":"0.12.1","keywords":["email","ai","agent","mcp","replylayer","model-context-protocol"],"license":"MIT","_id":"replylayer-mcp@0.12.1","maintainers":[{"name":"ndssguy","email":"mcintosh.james@gmail.com"}],"homepage":"https://replylayer.ai","bugs":{"url":"https://github.com/replylayer/rly/issues"},"bin":{"replylayer-mcp":"dist/server.js"},"dist":{"shasum":"f1f1b12c41d975714e0865538d84052121075be3","tarball":"https://registry.npmjs.org/replylayer-mcp/-/replylayer-mcp-0.12.1.tgz","fileCount":235,"integrity":"sha512-Yoxuzewg+Pd/6T/IS+/i3Dc7orOQ8KqaJSi9dVvBM/Aad3nY2CNU4EJwi4NSSWaMdJ5iCqWz0rVXkdmx6g9/gQ==","signatures":[{"sig":"MEYCIQDSB151xnafRO2vjPkHk3Kpb12Er1kbqOAqRQ2GjNpTdQIhAP/P+9i5nAXatcv0LQZkbioJvas//Ud1BicFgSl9H1ef","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEQCICdsiLClTfnFvsVuRYuMYRXT5qf+ZRTh3oT+bSsh9+5jAiAQ2ZpRCgoSkQywdThXkSvkHoU1/eyFD/304qTCDLbKTg==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":940170},"type":"module","_from":"file:replylayer-mcp-0.12.1.tgz","engines":{"node":">=22"},"exports":{".":"./dist/server.js","./tools":"./dist/tools/index.js"},"private":false,"scripts":{"dev":"tsx watch src/server.ts","lint":"eslint src/","test":"vitest run","build":"tsc","clean":"rm -rf dist","start":"node dist/server.js","typecheck":"tsc --noEmit","test:watch":"vitest"},"_npmUser":{"name":"ndssguy","email":"mcintosh.james@gmail.com"},"_resolved":"/tmp/9511064e2db5d0e0f721dc44db79ab61/replylayer-mcp-0.12.1.tgz","_integrity":"sha512-Yoxuzewg+Pd/6T/IS+/i3Dc7orOQ8KqaJSi9dVvBM/Aad3nY2CNU4EJwi4NSSWaMdJ5iCqWz0rVXkdmx6g9/gQ==","repository":{"url":"git+https://github.com/replylayer/rly.git","type":"git"},"_npmVersion":"10.9.8","description":"MCP server for ReplyLayer — safe email for AI agents","directories":{},"_nodeVersion":"22.23.1","dependencies":{"zod":"^3.24.0","@replylayer/sdk":"^0.27.0","@modelcontextprotocol/sdk":"^1.29.0"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.23.11","vitest":"^3.2.6","typescript":"^6.0.3","@types/node":"^22.0.0"},"_npmOperationalInternal":{"tmp":"tmp/replylayer-mcp_0.12.1_1789344676454_0.1668528109764944","host":"s3://npm-registry-packages-npm-production"}},"0.12.2":{"name":"replylayer-mcp","version":"0.12.2","keywords":["email","ai","agent","mcp","replylayer","model-context-protocol"],"license":"MIT","_id":"replylayer-mcp@0.12.2","maintainers":[{"name":"ndssguy","email":"mcintosh.james@gmail.com"}],"homepage":"https://replylayer.ai","bugs":{"url":"https://github.com/replylayer/rly/issues"},"bin":{"replylayer-mcp":"dist/server.js"},"dist":{"shasum":"814c74f2a9cb7e29bdee99439e4e440285a3b326","tarball":"https://registry.npmjs.org/replylayer-mcp/-/replylayer-mcp-0.12.2.tgz","fileCount":235,"integrity":"sha512-F6zE6LXzVQ6IbFAHzBqspzIT71UXv5z3l8vpTvdhnL/AW/Ur0Y+aHiDKa5O1kvPboECd7m87mXEzRbn9M3Ekfw==","signatures":[{"sig":"MEUCIEyIcAXZIlTwbiQooxqPKH25ZMiB05EgxfO5bvPYqIsyAiEAqUmRyA+4CMIxkI/6LfcxclgdnBCLatWGbkixr94UB4E=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEUCIEbOoRMoOP7aJ29po1qOkmpKWOBm3wskErBT2UPYOF/VAiEAiH4ytdjl61gRN8ERdXFZxsLJJ++9zut2VwjXjeVg6r0=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":942362},"type":"module","_from":"file:replylayer-mcp-0.12.2.tgz","engines":{"node":">=22"},"exports":{".":"./dist/server.js","./tools":"./dist/tools/index.js"},"private":false,"scripts":{"dev":"tsx watch src/server.ts","lint":"eslint src/","test":"vitest run","build":"tsc","clean":"rm -rf dist","start":"node dist/server.js","typecheck":"tsc --noEmit","test:watch":"vitest"},"_npmUser":{"name":"ndssguy","email":"mcintosh.james@gmail.com"},"_resolved":"/tmp/518186b240badeb22c0e735797192561/replylayer-mcp-0.12.2.tgz","_integrity":"sha512-F6zE6LXzVQ6IbFAHzBqspzIT71UXv5z3l8vpTvdhnL/AW/Ur0Y+aHiDKa5O1kvPboECd7m87mXEzRbn9M3Ekfw==","repository":{"url":"git+https://github.com/replylayer/rly.git","type":"git"},"_npmVersion":"10.9.8","description":"MCP server for ReplyLayer — safe email for AI agents","directories":{},"_nodeVersion":"22.23.2","dependencies":{"zod":"^3.24.0","@replylayer/sdk":"^0.27.1","@modelcontextprotocol/sdk":"^1.29.0"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.23.11","vitest":"^3.2.6","typescript":"^6.0.3","@types/node":"^22.0.0"},"_npmOperationalInternal":{"tmp":"tmp/replylayer-mcp_0.12.2_1790184767114_0.11266184249999256","host":"s3://npm-registry-packages-npm-production"}},"0.12.3":{"name":"replylayer-mcp","version":"0.12.3","keywords":["email","ai","agent","mcp","replylayer","model-context-protocol"],"license":"MIT","_id":"replylayer-mcp@0.12.3","maintainers":[{"name":"ndssguy","email":"mcintosh.james@gmail.com"}],"homepage":"https://replylayer.ai","bugs":{"url":"https://github.com/replylayer/rly/issues"},"bin":{"replylayer-mcp":"dist/server.js"},"dist":{"shasum":"a135a853fbe1b7f5d1a163bbe940760b825a6fa2","tarball":"https://registry.npmjs.org/replylayer-mcp/-/replylayer-mcp-0.12.3.tgz","fileCount":235,"integrity":"sha512-MnepbGy1gcRjUpOl6r8De2icbwkKIwKF4Su36Ptj0U+4otT6Gi+R3Caqsfzrnk8Xc7O60Oqj+ld06mTX15hSeQ==","signatures":[{"sig":"MEQCICyp84LnYtrAHx+clxq1T6oN8IfWdsQjddZmgEvg5PPbAiBcVRJSByyeTpy832k7CxOFhXfLiRXOtsmuHM1pVKtdzw==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEYCIQCVKh1LQ388DMM3Eq9hz9xX5YPIY2jL+Pq6Dz6MoQvRFAIhAOAZ7bfEnZgZf/3/wDXJ1PtOLldkjVJyMb5+ooxhEj3+","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":943987},"type":"module","_from":"file:replylayer-mcp-0.12.3.tgz","engines":{"node":">=22"},"exports":{".":"./dist/server.js","./tools":"./dist/tools/index.js"},"private":false,"scripts":{"dev":"tsx watch src/server.ts","lint":"eslint src/","test":"vitest run","build":"tsc","clean":"rm -rf dist","start":"node dist/server.js","typecheck":"tsc --noEmit","build:mcpb":"node scripts/build-mcpb.mjs","test:watch":"vitest"},"_npmUser":{"name":"ndssguy","email":"mcintosh.james@gmail.com"},"_resolved":"/tmp/6b0e6d904e928d37b7a40bb016ca2f1d/replylayer-mcp-0.12.3.tgz","_integrity":"sha512-MnepbGy1gcRjUpOl6r8De2icbwkKIwKF4Su36Ptj0U+4otT6Gi+R3Caqsfzrnk8Xc7O60Oqj+ld06mTX15hSeQ==","repository":{"url":"git+https://github.com/replylayer/rly.git","type":"git"},"_npmVersion":"10.9.8","description":"MCP server for ReplyLayer — safe email for AI agents","directories":{},"_nodeVersion":"22.23.2","dependencies":{"zod":"^3.24.0","@replylayer/sdk":"^0.27.1","@modelcontextprotocol/sdk":"^1.29.0"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.23.11","vitest":"^3.2.6","typescript":"^6.0.3","@types/node":"^22.0.0","@anthropic-ai/mcpb":"2.1.2"},"_npmOperationalInternal":{"tmp":"tmp/replylayer-mcp_0.12.3_1790283338497_0.8708823765888378","host":"s3://npm-registry-packages-npm-production"}},"0.13.0":{"name":"replylayer-mcp","version":"0.13.0","keywords":["email","ai","agent","mcp","replylayer","model-context-protocol"],"license":"MIT","_id":"replylayer-mcp@0.13.0","maintainers":[{"name":"ndssguy","email":"mcintosh.james@gmail.com"}],"homepage":"https://replylayer.ai","bugs":{"url":"https://github.com/replylayer/rly/issues"},"bin":{"replylayer-mcp":"dist/server.js"},"dist":{"shasum":"36b94fce5e66784e6974df3ae7b87cf670fc90c1","tarball":"https://registry.npmjs.org/replylayer-mcp/-/replylayer-mcp-0.13.0.tgz","fileCount":243,"integrity":"sha512-siEb7YPj01Zd/4ulywZr0gCXUYrMv1gGehqKEJiTRw7YF0acNWdnDYnuwTeiyP0GwCQ6EREFENFJOxmJ2CjzwQ==","signatures":[{"sig":"MEUCIHIwU+CorsLgEnuz1o7rz+GN03YIQoOO/BmhRFR3vCLjAiEAr1gR7QB4S1oQdV6DLUgdrx/1Uu/mBQpvtta6AGlxplY=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEYCIQDo3gKyE1rkwFCe8QX7gTTtPzup58fG1bXlAoh/mzDp9AIhAJYW1dX5PE0nEiFmspWhVfY+pRC4ShuiiiYTuiDIr9L6","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":1024629},"type":"module","_from":"file:replylayer-mcp-0.13.0.tgz","engines":{"node":">=22"},"exports":{".":"./dist/server.js","./tools":"./dist/tools/index.js"},"private":false,"scripts":{"dev":"tsx watch src/server.ts","lint":"eslint src/","test":"vitest run","build":"tsc","clean":"rm -rf dist","start":"node dist/server.js","typecheck":"tsc --noEmit","build:mcpb":"node scripts/build-mcpb.mjs","test:watch":"vitest"},"_npmUser":{"name":"ndssguy","email":"mcintosh.james@gmail.com"},"_resolved":"/tmp/a3063e9ebbb43ae1439a71eea417fefc/replylayer-mcp-0.13.0.tgz","_integrity":"sha512-siEb7YPj01Zd/4ulywZr0gCXUYrMv1gGehqKEJiTRw7YF0acNWdnDYnuwTeiyP0GwCQ6EREFENFJOxmJ2CjzwQ==","repository":{"url":"git+https://github.com/replylayer/rly.git","type":"git"},"_npmVersion":"10.9.8","description":"MCP server for ReplyLayer — safe email for AI agents","directories":{},"_nodeVersion":"22.23.2","dependencies":{"zod":"^3.24.0","@replylayer/sdk":"^0.28.0","@modelcontextprotocol/sdk":"^1.29.0"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.23.11","fflate":"0.8.3","vitest":"^3.2.6","typescript":"^6.0.3","@types/node":"^22.0.0","@anthropic-ai/mcpb":"2.1.2"},"_npmOperationalInternal":{"tmp":"tmp/replylayer-mcp_0.13.0_1790520482063_0.34197180311285735","host":"s3://npm-registry-packages-npm-production"}},"0.14.0":{"name":"replylayer-mcp","version":"0.14.0","keywords":["email","ai","agent","mcp","replylayer","model-context-protocol"],"license":"MIT","_id":"replylayer-mcp@0.14.0","maintainers":[{"name":"ndssguy","email":"mcintosh.james@gmail.com"}],"homepage":"https://replylayer.ai","bugs":{"url":"https://github.com/replylayer/rly/issues"},"bin":{"replylayer-mcp":"dist/server.js"},"dist":{"shasum":"315826e3c72b37dfc21d9c5e4042ac3ad5ea3deb","tarball":"https://registry.npmjs.org/replylayer-mcp/-/replylayer-mcp-0.14.0.tgz","fileCount":247,"integrity":"sha512-A5whaJ4yeuKsbkxya+1FOp00tvZGqXiw63HZQHEmcc8MennC2ppkCFOUuM4m0fsxh3yb+etCowqBBpHanQwbyw==","signatures":[{"sig":"MEQCIFrMcmwZwrxT74vErN5jCMv1+XMXEMagf2wvyyOGSPCrAiAfKqfGLAoAhRGIkfbXPbi93KH2Ty0iCSAFL4ScPzr9aw==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEUCIQD/cJBb8046Prh4Z/Cptf9f9tFPlYW1TJB01Cdq8snk3QIgLsMI2kS8HOgNNMVOSWZwIuyIE96hKunBTI+5l2LfDyk=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":1467270},"type":"module","_from":"file:replylayer-mcp-0.14.0.tgz","engines":{"node":">=22"},"exports":{".":"./dist/server.js","./tools":"./dist/tools/index.js"},"private":false,"scripts":{"dev":"tsx watch src/server.ts","lint":"eslint src/","test":"vitest run","build":"tsc","clean":"rm -rf dist","start":"node dist/server.js","typecheck":"tsc --noEmit && tsc -p tsconfig.tests.json","build:mcpb":"node scripts/build-mcpb.mjs","test:watch":"vitest","typecheck:tests":"tsc -p tsconfig.tests.json"},"_npmUser":{"name":"ndssguy","email":"mcintosh.james@gmail.com"},"_resolved":"/tmp/aa90eb4e911a10811494abae8b384930/replylayer-mcp-0.14.0.tgz","_integrity":"sha512-A5whaJ4yeuKsbkxya+1FOp00tvZGqXiw63HZQHEmcc8MennC2ppkCFOUuM4m0fsxh3yb+etCowqBBpHanQwbyw==","repository":{"url":"git+https://github.com/replylayer/rly.git","type":"git"},"_npmVersion":"10.9.8","description":"MCP server for ReplyLayer — safe email for AI agents","directories":{},"_nodeVersion":"22.23.2","dependencies":{"zod":"^3.24.0","@replylayer/sdk":"^0.28.1","@modelcontextprotocol/sdk":"^1.29.0"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.23.11","fflate":"0.8.3","vitest":"^3.2.6","typescript":"^6.0.3","@types/node":"^22.0.0","@anthropic-ai/mcpb":"2.1.2"},"_npmOperationalInternal":{"tmp":"tmp/replylayer-mcp_0.14.0_1790601433879_0.8218469526956758","host":"s3://npm-registry-packages-npm-production"}},"0.14.1":{"name":"replylayer-mcp","version":"0.14.1","keywords":["email","ai","agent","mcp","replylayer","model-context-protocol"],"license":"MIT","_id":"replylayer-mcp@0.14.1","maintainers":[{"name":"ndssguy","email":"mcintosh.james@gmail.com"}],"homepage":"https://replylayer.ai","bugs":{"url":"https://github.com/replylayer/rly/issues"},"bin":{"replylayer-mcp":"dist/server.js"},"dist":{"shasum":"c9807ceeba743bf1f17cb40f7d47b4132a6e00c6","tarball":"https://registry.npmjs.org/replylayer-mcp/-/replylayer-mcp-0.14.1.tgz","fileCount":247,"integrity":"sha512-wIfOdjUrq1RAYkKl8G6IsR7qPL6W6cwpv/fA/6IEXcsnRBTARuGqAu4dNMjqe7BSWLZTHv1LAPL0nZltcsxs9A==","signatures":[{"sig":"MEUCIFQjQLNpKHrd7rJS0UaY2DJMAhAFI3FasA9l78umn5aHAiEA4Wv8PuGmXVfFRMFxmvoAL365UYAThBTl9KL9vEAXfnA=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEYCIQCOszLgDTcUmc2mh7MOq9Ey2l8TLxuszSdnZn1EiFgbmAIhAO2PHhMsjiLgNyXM7yyRaydY+LR47TsGhh6xI9wLieXO","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":1467765},"type":"module","_from":"file:replylayer-mcp-0.14.1.tgz","engines":{"node":">=22"},"exports":{".":"./dist/server.js","./tools":"./dist/tools/index.js"},"private":false,"scripts":{"dev":"tsx watch src/server.ts","lint":"eslint src/","test":"vitest run","build":"tsc","clean":"rm -rf dist","start":"node dist/server.js","typecheck":"tsc --noEmit && tsc -p tsconfig.tests.json","build:mcpb":"node scripts/build-mcpb.mjs","test:watch":"vitest","typecheck:tests":"tsc -p tsconfig.tests.json"},"_npmUser":{"name":"ndssguy","email":"mcintosh.james@gmail.com"},"_resolved":"/tmp/3d45bcae5480cbd37c2f0608bd7ef043/replylayer-mcp-0.14.1.tgz","_integrity":"sha512-wIfOdjUrq1RAYkKl8G6IsR7qPL6W6cwpv/fA/6IEXcsnRBTARuGqAu4dNMjqe7BSWLZTHv1LAPL0nZltcsxs9A==","repository":{"url":"git+https://github.com/replylayer/rly.git","type":"git"},"_npmVersion":"10.9.8","description":"MCP server for ReplyLayer — safe email for AI agents","directories":{},"_nodeVersion":"22.23.2","dependencies":{"zod":"^3.24.0","@replylayer/sdk":"^0.28.1","@modelcontextprotocol/sdk":"^1.29.0"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.23.11","fflate":"0.8.3","vitest":"^3.2.6","typescript":"^6.0.3","@types/node":"^22.0.0","@anthropic-ai/mcpb":"2.1.2"},"_npmOperationalInternal":{"tmp":"tmp/replylayer-mcp_0.14.1_1790626761546_0.36037940670106994","host":"s3://npm-registry-packages-npm-production"}},"0.14.3":{"name":"replylayer-mcp","version":"0.14.3","keywords":["email","ai","agent","mcp","replylayer","model-context-protocol"],"license":"MIT","_id":"replylayer-mcp@0.14.3","maintainers":[{"name":"ndssguy","email":"mcintosh.james@gmail.com"}],"homepage":"https://replylayer.ai","bugs":{"url":"https://github.com/replylayer/rly/issues"},"bin":{"replylayer-mcp":"dist/server.js"},"dist":{"shasum":"2abdca3ec6968511c54ff2fa48561c82234c470c","tarball":"https://registry.npmjs.org/replylayer-mcp/-/replylayer-mcp-0.14.3.tgz","fileCount":247,"integrity":"sha512-KDIg5HTuh3oSUf5rCM/9ZPI3dkKO+q5GR1Hrd0GeYdV7E8dOSnpYa7qDotJnLi5Lk3Hp3rJ87tDxy5Xtxi6B0A==","signatures":[{"sig":"MEUCIQDYCiV0XvbhEaAeopNPNAsURwoFhAsXXRzSkWAyIDQSQwIgdnQCrzluT2JEaXnNUsZn4CXyY5PsyJ6yL4yqECyBoVI=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEQCIHWYMEgRshaLqOFYHz90/l4HN1TRgNQ7e70noGZKsscQAiAwN31pFoh5FuydUilk5bMrYhuc0EtoFTLiEpiz9dMHcQ==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":1470790},"type":"module","_from":"file:replylayer-mcp-0.14.3.tgz","engines":{"node":">=22"},"exports":{".":"./dist/server.js","./tools":"./dist/tools/index.js"},"private":false,"scripts":{"dev":"tsx watch src/server.ts","lint":"eslint src/","test":"vitest run","build":"tsc","clean":"rm -rf dist","start":"node dist/server.js","typecheck":"tsc --noEmit && tsc -p tsconfig.tests.json","build:mcpb":"node scripts/build-mcpb.mjs","test:watch":"vitest","typecheck:tests":"tsc -p tsconfig.tests.json"},"_npmUser":{"name":"ndssguy","email":"mcintosh.james@gmail.com"},"_resolved":"/tmp/d3495d1c0df8da60d7c3fa8b1414e292/replylayer-mcp-0.14.3.tgz","_integrity":"sha512-KDIg5HTuh3oSUf5rCM/9ZPI3dkKO+q5GR1Hrd0GeYdV7E8dOSnpYa7qDotJnLi5Lk3Hp3rJ87tDxy5Xtxi6B0A==","repository":{"url":"git+https://github.com/replylayer/rly.git","type":"git"},"_npmVersion":"10.9.8","description":"MCP server for ReplyLayer — safe email for AI agents","directories":{},"_nodeVersion":"22.23.2","dependencies":{"zod":"^3.24.0","@replylayer/sdk":"^0.28.1","@modelcontextprotocol/sdk":"^1.29.0"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.23.11","fflate":"0.8.3","vitest":"^3.2.6","typescript":"^6.0.3","@types/node":"^22.0.0","@anthropic-ai/mcpb":"2.1.2"},"_npmOperationalInternal":{"tmp":"tmp/replylayer-mcp_0.14.3_1790682020745_0.5246975994049223","host":"s3://npm-registry-packages-npm-production"}},"0.15.0":{"name":"replylayer-mcp","version":"0.15.0","keywords":["email","ai","agent","mcp","replylayer","model-context-protocol"],"license":"MIT","_id":"replylayer-mcp@0.15.0","maintainers":[{"name":"ndssguy","email":"mcintosh.james@gmail.com"}],"homepage":"https://replylayer.ai","bugs":{"url":"https://github.com/replylayer/rly/issues"},"bin":{"replylayer-mcp":"dist/server.js"},"dist":{"shasum":"b37199ce2171ec6fd172c4c8581d2338c914a378","tarball":"https://registry.npmjs.org/replylayer-mcp/-/replylayer-mcp-0.15.0.tgz","fileCount":263,"integrity":"sha512-DdYzqH8se3D8h1Qw1sMybyM86qIOuSWIZSGGpnV/PlCuI3UQ4poKykGC13V6HJAz32bWdTS61vNMRBowXZIcVA==","signatures":[{"sig":"MEUCICuqSmjWHJ1JK0vnoKQgrbWMjFfcrsoXzjHMABtQ6p+XAiEApToE5BUxDQuk2t1GAxQWjnuU+ZElrPkaMH7VsiuVzkg=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"sig":"MEUCIQDdCYwju3LC3E/aZZoemy7ga/0h1FHJDk8w5t9BdGnKEwIgSdZZ7Be9K97OaGbmsHJqTcNrCjxn/zqKENbeS1BFOOE=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":1526557},"type":"module","_from":"file:replylayer-mcp-0.15.0.tgz","engines":{"node":">=22"},"exports":{".":"./dist/server.js","./tools":"./dist/tools/index.js"},"private":false,"scripts":{"dev":"tsx watch src/server.ts","lint":"eslint src/","test":"vitest run","build":"tsc","clean":"rm -rf dist","start":"node dist/server.js","typecheck":"tsc --noEmit && tsc -p tsconfig.tests.json","build:mcpb":"node scripts/build-mcpb.mjs","test:watch":"vitest","typecheck:tests":"tsc -p tsconfig.tests.json"},"_npmUser":{"name":"ndssguy","email":"mcintosh.james@gmail.com"},"_resolved":"/tmp/99e4f797f542961f61566ec8c2fde792/replylayer-mcp-0.15.0.tgz","_integrity":"sha512-DdYzqH8se3D8h1Qw1sMybyM86qIOuSWIZSGGpnV/PlCuI3UQ4poKykGC13V6HJAz32bWdTS61vNMRBowXZIcVA==","repository":{"url":"git+https://github.com/replylayer/rly.git","type":"git"},"_npmVersion":"10.9.9","description":"MCP server for ReplyLayer — safe email for AI agents","directories":{},"_nodeVersion":"22.23.3","dependencies":{"zod":"3.25.76","@replylayer/sdk":"^0.28.1","zod-to-json-schema":"3.25.2","@modelcontextprotocol/server":"2.2.0"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.23.11","fflate":"0.8.3","vitest":"^3.2.6","typescript":"^6.0.3","@types/node":"^22.0.0","@anthropic-ai/mcpb":"2.1.2","@modelcontextprotocol/client":"2.2.0"},"_npmOperationalInternal":{"tmp":"tmp/replylayer-mcp_0.15.0_1790809977417_0.4744823206282991","host":"s3://npm-registry-packages-npm-production"}},"0.15.1":{"_id":"replylayer-mcp@0.15.1","bin":{"replylayer-mcp":"dist/server.js"},"bugs":{"url":"https://github.com/replylayer/rly/issues"},"dist":{"shasum":"e3502db91a082b7c4905e58c2cac7af7b6f4071e","tarball":"https://registry.npmjs.org/replylayer-mcp/-/replylayer-mcp-0.15.1.tgz","fileCount":263,"integrity":"sha512-KCq92NGVKzL1Z4A8y3xKXQMk9waVzdXSe6ns/D51tnEy7pWLh4f3nOa68ffa/c9x1AXpudk2QmWv6OsXISjCXg==","signatures":[{"sig":"MEQCIHSvswlyC3uZqR/o22pWshsVZFfgyM6Bo3PCVMLr5xOFAiBHpy8biIYIasmLzild9XhwvrqxPfFcC8fXxz/NcUO9sA==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"},{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEYCIQCRazD0hgQ5qfak2spX253PAbR+8LM2YU6AKHYCS5U85QIhAOQ2E0SM3RnzOaFKPEGkWdU+RmpQjeSek3IXxem95StZ"}],"unpackedSize":1526748},"name":"replylayer-mcp","type":"module","_from":"file:replylayer-mcp-0.15.1.tgz","engines":{"node":">=22"},"exports":{".":"./dist/server.js","./tools":"./dist/tools/index.js"},"license":"MIT","mcpName":"ai.replylayer/replylayer","private":false,"scripts":{"dev":"tsx watch src/server.ts","lint":"eslint src/","test":"vitest run","build":"tsc","clean":"rm -rf dist","start":"node dist/server.js","typecheck":"tsc --noEmit && tsc -p tsconfig.tests.json","build:mcpb":"node scripts/build-mcpb.mjs","test:watch":"vitest","typecheck:tests":"tsc -p tsconfig.tests.json"},"version":"0.15.1","_npmUser":{"name":"ndssguy","email":"mcintosh.james@gmail.com"},"homepage":"https://replylayer.ai","keywords":["email","ai","agent","mcp","replylayer","model-context-protocol"],"_resolved":"/tmp/921fc5f753284aebc66a06f8a22ef9ed/replylayer-mcp-0.15.1.tgz","_integrity":"sha512-KCq92NGVKzL1Z4A8y3xKXQMk9waVzdXSe6ns/D51tnEy7pWLh4f3nOa68ffa/c9x1AXpudk2QmWv6OsXISjCXg==","repository":{"url":"git+https://github.com/replylayer/rly.git","type":"git"},"_npmVersion":"10.9.9","description":"MCP server for ReplyLayer — safe email for AI agents","directories":{},"maintainers":[{"name":"ndssguy","email":"mcintosh.james@gmail.com"}],"_nodeVersion":"22.23.3","dependencies":{"zod":"3.25.76","@replylayer/sdk":"^0.28.1","zod-to-json-schema":"3.25.2","@modelcontextprotocol/server":"2.2.0"},"_hasShrinkwrap":false,"devDependencies":{"tsx":"^4.23.11","fflate":"0.8.3","vitest":"^3.2.6","typescript":"^6.0.3","@types/node":"^22.0.0","@anthropic-ai/mcpb":"2.1.2","@modelcontextprotocol/client":"2.2.0"},"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/replylayer-mcp_0.15.1_1790865201014_0.04352375785775342"}}},"time":{"created":"2026-06-04T22:04:36.618Z","modified":"2026-10-01T14:33:22.204Z","0.3.0":"2026-06-04T22:04:36.894Z","0.4.0":"2026-06-06T13:21:35.891Z","0.5.0":"2026-06-09T01:09:10.718Z","0.6.0":"2026-06-24T15:58:04.992Z","0.9.0":"2026-06-26T00:38:04.042Z","0.10.0":"2026-07-01T14:01:18.193Z","0.10.1":"2026-07-02T13:40:23.358Z","0.11.0":"2026-07-04T20:19:02.555Z","0.11.1":"2026-07-25T14:38:59.418Z","0.12.0":"2026-09-13T03:21:36.147Z","0.12.1":"2026-09-14T00:11:16.609Z","0.12.2":"2026-09-23T17:32:47.219Z","0.12.3":"2026-09-24T20:55:38.585Z","0.13.0":"2026-09-27T14:48:02.146Z","0.14.0":"2026-09-28T13:17:13.963Z","0.14.1":"2026-09-28T20:19:21.815Z","0.14.3":"2026-09-29T11:40:20.865Z","0.15.0":"2026-09-30T23:12:57.511Z","0.15.1":"2026-10-01T14:33:21.203Z"},"bugs":{"url":"https://github.com/replylayer/rly/issues"},"license":"MIT","homepage":"https://replylayer.ai","keywords":["email","ai","agent","mcp","replylayer","model-context-protocol"],"repository":{"url":"git+https://github.com/replylayer/rly.git","type":"git"},"description":"MCP server for ReplyLayer — safe email for AI agents","maintainers":[{"name":"ndssguy","email":"mcintosh.james@gmail.com"}],"readme":"# replylayer-mcp\n\nThe MCP server for **ReplyLayer** — safe email for AI agents. It exposes ReplyLayer's\nemail surface (send, reply, read, monitor, release) as MCP tools so an MCP client\n(Claude Desktop, Cursor, …) can drive transactional and operational email with built-in\nsecurity scanning. Not a bulk or marketing tool.\n\nServer identity: `replylayer` v`0.15.1`. 44 tools. The hosted server\n(`POST /v1/mcp` on `api.replylayer.ai`) reports the same identity and injects the\nsame server-level workflow primer as this binary — both read the version from this\npackage, so neither can drift from it. The hosted sign-in endpoint\n(`POST /v1/mcp/oauth`) lists all of them except the four in\n`AGENT_UNAVAILABLE_TOOL_NAMES`: a sign-in connection is an agent key, which can never\nuse those four, and its primer describes the connection instead of an API key. Its\ntools also carry OAuth linking metadata (`securitySchemes`, top-level and in `_meta`, and\n`_meta[\"mcp/www_authenticate\"]` on a tool error caused by a revoked or expired token).\n\n## Install\n\nPublished to npm as **`replylayer-mcp`**. Most MCP clients launch it via `npx` (no\nglobal install needed) — see [Client config](#client-config-copy-paste). To run or\ninstall it directly:\n\n```bash\nnpx -y replylayer-mcp        # or: npm install -g replylayer-mcp\n```\n\n## Credentials\n\nAuth is a single ReplyLayer API key. The server resolves it from the\n`REPLYLAYER_API_KEY` environment variable first, then from the stored credentials file\nat `~/.replylayer/credentials`. Production (`https://api.replylayer.ai`) is the default\nendpoint; `REPLYLAYER_API_URL` is a testing-only override.\n\nSet up the stored credential interactively (writes `~/.replylayer/credentials`,\nmode 0600):\n\n```bash\nreplylayer-mcp init        # or, without a global install: npx -y replylayer-mcp init\n```\n\nFor CI / automation, skip `init` and pass `REPLYLAYER_API_KEY` in the environment.\n\nA key only works once a human has finished the account's one-time signup verification:\nconfirming the account's email address and then its mobile number (a 6-digit SMS code, texted once the email is verified).\nWeb signup at <https://app.replylayer.ai/signup> walks through both before any key is\ncreated. A key returned by `rly signup` stays **inert** until `rly auth verify` and\n`rly auth verify-phone` succeed; until then calls fail with `EMAIL_NOT_VERIFIED` or\n`PHONE_NOT_VERIFIED`. The server runs with a key a human has already provisioned and\nverified.\n\n## Client config (copy-paste)\n\nClaude Desktop (`claude_desktop_config.json`) or Cursor (`mcpServers`) — launch via\n`npx` so there's no global install or absolute path to manage:\n\n```json\n{\n  \"mcpServers\": {\n    \"replylayer\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"replylayer-mcp\"],\n      \"env\": {\n        \"REPLYLAYER_API_KEY\": \"rly_live_k3m9p2qx7vn4hjd0.uZ8Qb1vK3mN0pR7sT2wX9yA4cF6gH8jL1nP3rT5vW7z\"\n      }\n    }\n  }\n}\n```\n\nIf you ran `replylayer-mcp init` to store the key, the `env` block is optional. With a\nglobal install (`npm i -g replylayer-mcp`), use `\"command\": \"replylayer-mcp\"` and drop\nthe `args`.\n\n## The directional safety model\n\nEvery message is security-scanned, and scanning is **directional**:\n\n- Outbound text that resembles prompt-injection is your agent's own authored content —\n  delivered clean. The secrets scanner is outbound-only.\n- Inbound prompt-injection is quarantined.\n\nThe send tools (`send_email`, `reply_to_message`, `send_draft`) return an outcome —\n**branch on the outcome**, not on success/failure. The discriminator is\n`email_effect.effect_status`: `sent | held_for_review | held_infrastructure | blocked`\n(the Governed Email Effect contract). Treat an\n`effect_status` you do not recognize as held, never as `sent`. Where `email_effect` is\nabsent, fall back to the top-level `status`: `sent | quarantined | pending_review |\nblocked`. `sent` means ReplyLayer **accepted** the message for sending — it is not proof\nthe recipient received it.\n\nThose send responses also carry the *why* inline: `scan` (the scanner\nverdict — inspect `scan.verdict`, `scan.findings`, and `scan.findings[].agent_instructions`)\nand `hold_context` (the hold reason plus `agent_instructions` on held sends — a typed\npolicy cause, a policy change to the scanner's decision, or a genuine scan-explained\nhold; `null` on sent/terminal outcomes and normally on infrastructure holds). A held\nsend's `hold_context.review_url` is the dashboard page where the account owner approves\nor releases it (omitted when the server has no public dashboard URL); a held result\nleads with a `HELD FOR REVIEW — not sent` / `HELD — not sent` line telling the agent to\ntell the account owner (the person the agent acts for) where it waits — and by when, from\n`hold_context.review_expires_at` — and not to send it again. An infrastructure hold gets\nneither the link nor that line (retry later instead). Call\n`read_message` for full detail. A finding with\n`failure_class: \"inference_error\"` is an infrastructure error, not a content judgment —\nretry later, do not rewrite.\n\nRecovery: inbound `quarantined` → `release_quarantined_message`; `firewall_blocked` →\n`release_firewall_blocked_message`; `pending_review` needs the account owner's approval\nin the dashboard (agent keys cannot approve — tell the account owner where, do not resend). `RATE_LIMITED` → if `details.reason` is\n`failed_authentication`, the API key is wrong or revoked: stop and ask a human to fix the\nkey, do not retry; if `details.reset_at` is present it is the daily send quota (back off\nuntil then); otherwise it is a short-window limit — wait for `details.retry_after` (or\nthe time in the error message), then retry. `UNAUTHORIZED` / `API_KEY_REVOKED` → the key\nis wrong or revoked: stop and ask a human, do not retry.\n`RECIPIENT_SUPPRESSED` / `BILLING_*` / `EMAIL_NOT_VERIFIED` → escalate, do not retry.\n\nThis server does **no implicit retry** (neither on `5xx` nor on a `429` `Retry-After`):\nevery tool call fails fast and returns the structured error, so the agent owns retry\ntiming and a tool call is never held open by a silent server-side wait.\n\n## Idempotent sends\n\n`send_email` and `reply_to_message` take an optional `idempotency_key`. Pick **one stable\nkey per send or reply intent** and reuse that exact key for every retry of that intent: a\nreplay returns the original outcome instead of sending a second message. The record is\npermanent. On `IDEMPOTENT_REQUEST_IN_FLIGHT`, retry the same key after the indicated\ndelay. On `IDEMPOTENT_REQUEST_NOT_PROVEN_SENT`, stop and report it for investigation —\nthe message was not re-sent, and minting a new key could duplicate it.\n\n`create_draft`'s `idempotency_key` is a different thing: it is valid only alongside\n`send_at` (scheduled sends) and replays for 24 h, not permanently.\n\n## Trusted instruction sources\n\nBy default every inbound read carries the standing untrusted-content contract:\n`agent_safety_context.untrusted_content: true` plus a `guidance` string telling the\nagent not to follow instructions embedded in the message body. Relaxing that on a given\nread is entirely server-side and operator-configured — this server has no client-side\nopt-in or env var for it. The server relaxes a read only when the customer has (a) put\nthe mailbox into `instruction_trust_mode: 'enabled'`, (b) enabled this API key's\ninstruction-trust capability, and (c) designated that exact sender address (address-grain\nonly — no domain-wide trust) as a trusted instruction source, **and** the message itself\nis `verified_aligned` (Mailgun-verified domain authenticity), clean-scanning, and\n`available` from that sender. When all of that lines up, `guidance` is replaced with\ntrusted-instruction guidance (the agent may act on\nthat verified sender's own explicit requests in *this* message) and a thin\n`instruction_trust` basis object is attached — `untrusted_content` stays `true`. This is\n**read-relaxation only**: it never changes how an outbound send is gated.\n\nDefault is off end to end: no operator configuration → no relaxation → byte-identical\nlegacy reads. There is currently no MCP tool to grant, list, or revoke trusted sources —\nsee the note at the end of [Tool surface](#tool-surface-44-tools).\n\n## Tool surface (44 tools)\n\n**Reads (no side effects):** `list_messages` (search + filters + paging), `read_message`,\n`get_thread`, `list_threads`, `wait_for_message`,\n`list_mailboxes`, `list_recipients`, `list_suppressions`, `list_allowlist`,\n`list_allowlist_blocked_attempts`, `list_drafts`, `get_draft`, `list_inbound_blocklist`,\n`list_inbound_allowlist`, `list_inbound_firewall_blocked_attempts`, `get_account_usage`,\n`get_agent_quota`, `get_attachment_preview`, `get_link_scanning_status`.\n\n`get_link_scanning_status` reports whether malicious link scanning (URL reputation, backed by\nGoogle Web Risk) is active for the account. Turning it on is an admin action (it enables an\naccount-wide sub-processor data flow), so the MCP surface is read-only here — enable it from the\ndashboard, the SDK, or `rly account link-scanning enable`.\n\n**Sends (dispatch outbound mail):** `send_email`, `reply_to_message`, `send_draft`.\n\n**Structured results.** Every tool except `remove_suppression` (which always returns an\nerror) declares an `outputSchema` and returns `structuredContent` — a typed object you can\nconsume without re-parsing the text blob — alongside the text block, on every transport.\nThe text block is the same JSON. Each schema follows the API route's response schema and\ndescribes the result after the fields the tool leaves out (see\n[Tool notes](#tool-notes)): objects accept fields the API adds later, enum-like values are\nplain strings, and only the top-level fields the route always returns are required. A\ntool error (`isError: true`) carries no `structuredContent`, except a blocked or\ninfrastructure-held send, which keeps its send result.\n\n**Drafts:** `create_draft`, `update_draft`, `delete_draft` (plus `send_draft` above).\n\n**Inbound triage:** `release_quarantined_message`, `block_quarantined_message`,\n`report_and_block` (block + blocklist the sender, inbound-only),\n`release_firewall_blocked_message`. Human-in-the-loop (admin-only; agent keys 403):\n`approve_review`, `deny_review`.\n\n**Delete:** `delete_message` — soft-deletes a message (any direction) and purges its\nraw MIME; agent keys require the account delete policy to be enabled (else 403).\n\n**Policy / contacts:** `add_recipient`, `add_suppression`, `add_inbound_blocklist`,\n`add_inbound_allowlist_entry`, `mark_message_read`, `mark_thread_read`.\n\n**Star / unstar:** `star_message` (toggle a message's starred flag),\n`star_thread` (toggle a thread's starred flag).\n\n**Bulk policy mutations:** `add_inbound_allowlist_bulk` (up to 1000 sender addresses for a\nmailbox's inbound allowlist in one call), `add_suppressions_bulk` (up to 1000 addresses to\nthe account-wide do-not-contact list), `add_inbound_blocklist_bulk` (up to 1000 addresses\nto the account-wide inbound blocklist).\n\n**Policy stub (intentionally unavailable):** `remove_suppression` — always returns an\n`isError` result explaining that suppression removal is a per-human admin decision; use\n`rly suppressions remove`, an SDK admin key, or the dashboard instead.\n\n**Not yet a tool:** trusted-instruction-source management (grant / list / revoke, plus the\nmailbox mode and per-key capability toggles — see [above](#trusted-instruction-sources))\nhas no MCP wrapper today. That includes the revoke endpoint, which — like the inbound-triage\nrelease tools — is unprivileged and agent-key-callable server-side; it just isn't exposed\nhere yet. Manage trusted sources from the ReplyLayer dashboard (or the REST API directly)\nin the meantime.\n\n### Tool annotations\n\nEvery tool declares a `title` (mirrored in `annotations.title`, which Anthropic's directory reads) and explicit boolean `readOnlyHint`, `destructiveHint`\nand `openWorldHint`; every tool that changes something also declares `idempotentHint`.\nOne `tools/list` serves every client, so where client guidelines differ the stricter\nreading wins. The hints are advisory for the host. The API enforces the permission gates.\n\n| Group | Tools | read-only | destructive | open-world | idempotent |\n|---|---|---|---|---|---|\n| Reads | the 19 read tools listed above | true | false | false | not declared |\n| Sends | `send_email`, `reply_to_message`, `send_draft`, `approve_review` | false | true | true | false |\n| Scheduled sends | `create_draft`, `update_draft` (a `send_at` dispatches with no further call) | false | true | true | false |\n| Irreversible state changes | `deny_review`, `block_quarantined_message`, `release_quarantined_message`, `release_firewall_blocked_message` | false | true | false | false |\n| Draft delete | `delete_draft` (deleting a scheduled draft sends a `message.schedule_cancelled` webhook to the account's own endpoint) | false | true | true | false |\n| Irreversible, safe to repeat | `delete_message` (a re-delete succeeds), `report_and_block` (a re-report changes nothing further) | false | true | false | true |\n| List and marker writes | `add_suppression`, `add_suppressions_bulk`, `add_inbound_blocklist`, `add_inbound_blocklist_bulk`, `add_inbound_allowlist_entry`, `add_inbound_allowlist_bulk`, `mark_message_read`, `mark_thread_read`, `star_message`, `star_thread` | false | true | false | true |\n| Recipient write | `add_recipient` (emails the recipient a confirmation link; with `attest`, sends nothing but makes the person sendable) | false | true | true | false |\n| Stub | `remove_suppression` (always an error) | true | false | false | not declared |\n\n### Tool notes\n\n- **`add_recipient`** — wraps `POST /v1/recipients` (free Sandbox accounts only; other\n  tiers get `403 FORBIDDEN`, and on a paid plan the description tells the agent that a\n  mailbox restricted to people the account owner approves needs the user to approve\n  the person for that mailbox). Input: `email`, optional `attest: boolean`. Without\n  `attest` the person is emailed a confirmation link and becomes sendable when they\n  click it. With `attest: true` no email is sent and the person is sendable at once: the\n  account vouches for them, spending one of its per-trial attestations (never refunded),\n  and the result carries `attestation: \"account_attested\"` and a `complaint_notice`. The\n  description tells the agent to attest only when the user has said they know the\n  person. If someone added that way reports the account's email as spam, everyone added\n  that way must confirm by link before they can be emailed again and the account loses\n  its attestations; a report from a second person suspends the Sandbox account. An agent\n  key, including every sign-in connection on `/v1/mcp/oauth`, is refused with\n  `INSUFFICIENT_SCOPE` until the operator turns agent recipient writes on, and with\n  `RECIPIENT_WRITE_AGENT_CONTAINED` when a bound mailbox only lets the agent email people\n  the account owner approves; in both cases the hint says to ask the user to add the\n  person (for this tool, `INSUFFICIENT_SCOPE` does not suggest an admin key).\n  Attesting with none left is `TIER_LIMIT` with `attestations_remaining: 0`\n  (`forfeited: true` after a complaint), or `attestations_limit: 0` while attestation is\n  off. `RECIPIENT_WRITE_UNAVAILABLE` means retry once; if it fails again, stop and tell\n  the user. A send refused with `SANDBOX_RECIPIENT_NOT_VERIFIED` gets a hint naming\n  `add_recipient`.\n- **`star_message`** — wraps `PATCH /v1/messages/:id/star`. Input: `message_id`,\n  `starred: boolean`. Use one tool call to star or unstar (matches the SDK/REST `{starred}`\n  shape — there are no separate star/unstar verbs).\n- **`star_thread`** — wraps `PATCH /v1/mailboxes/:id/threads/:thread_id/star`. Input:\n  `mailbox`, `thread_id`, `starred: boolean`.\n- **`get_attachment_preview`** — wraps `GET /v1/messages/:id/attachments/:idx/preview`.\n  Returns derived **text** preview only (PDF, Office, text/plain, text/csv). Surfaces\n  `404 ATTACHMENT_PREVIEW_NOT_AVAILABLE` as an `isError` result when the derivative is not\n  ready, failed, or unavailable.\n- **`add_inbound_allowlist_bulk`** — wraps `POST /v1/mailboxes/:id/inbound-allowlist/bulk`.\n  Input: `mailbox`, `emails: string[]` (max 1000). Returns the full partial-success shape:\n  `added`, `already_existed`, `invalid` (with per-entry `reason`), and `counts`.\n- **`add_suppressions_bulk`** — wraps `POST /v1/suppressions/bulk`. Input:\n  `emails: string[]` (max 1000). Same partial-success shape.\n- **`add_inbound_blocklist_bulk`** — wraps `POST /v1/inbound-blocklist/bulk`. Input:\n  `emails: string[]` (max 1000). Same partial-success shape.\n- **`remove_suppression`** — policy-explanation stub. Always returns `isError` with code\n  `SUPPRESSION_REMOVE_NOT_AVAILABLE`. Improves agent UX by explaining why removal is not\n  available via MCP rather than returning a generic unknown-tool error.\n- **`wait_for_message` timeout** — the tool reflects the real server cap: max 30 s per\n  call (not 120 s). For longer waits, call the tool again.\n- **Fields left out of results** — on every transport the tools drop internal\n  identifiers and bookkeeping from the API response before building the text block and\n  `structuredContent` (`src/lib/trim-response.ts`): `reviewed_by_id` and six attachment\n  bookkeeping fields (`read_message`, `get_thread`), `r2_objects_failed` (becomes\n  `r2_objects_failed_count`, always present, `delete_message`), `added_by_actor_id` (the suppression,\n  blocklist and allowlist tools), `actor_id` (`list_allowlist_blocked_attempts`),\n  `warmup.velocity_gate_mode` (`get_agent_quota`), `attachment.hash` and\n  `preview.extractor` (`get_attachment_preview`), and the scanner, PII-detector,\n  instruction-trust and consent-bookkeeping fields (`list_mailboxes`). A vendor-named suppression\n  `source` reads `provider_webhook` or `provider_sync`, and an unrecognised one reads\n  `system`. A 400 validation error keeps only `instancePath` and `message` per\n  `details.validation` item, and `SELF_HOSTED_DECRYPT_FAILED` drops `details.domain_id`.\n  `next_cursor` is an opaque paging token; pass it back unchanged. The REST API, SDK and CLI are unchanged. The full table is\n  in the [MCP guide](https://replylayer.ai/agents/mcp#fields-mcp-results-leave-out).\n- **`list_drafts`** — returns `has_more` beside `drafts`; pass the last draft's `id` as\n  `before` for the next page.\n\n### Browse & search\n\nInbox search and full thread reads are first-class on MCP: `list_messages` filters by\nkeyword `search`, `sender`, date range, `direction`, `status` (incl. the held-mail states\n`quarantined` / `pending_review` for triage) and `starred`, and pages older via\n`before=<oldest message id from the previous page>`. `list_threads` lists conversations\n(with `starred` / `has_inbound`), and `get_thread` reads a full thread — pass `mailbox`\nto disambiguate a thread key that resolves in more than one mailbox. `list_messages` also\nsupports `has_attachment` (true/false) — it probes `/v1/health` for the\n`messages.has_attachment_filter` capability and returns a structured\n`SEARCH_OPERATOR_UNSUPPORTED` on older servers that don't advertise it.\n\n## Hosted vs local attachments\n\n`send_email`, `reply_to_message`, `create_draft` and `update_draft` take an\n`attachments` array. What that array means depends on which server you are talking to.\n\n**Local server** (this package, `npx -y replylayer-mcp`) — `attachments` are **paths on\nyour own machine**. The server reads each file, uploads it, waits for its content scan,\nand references the resulting handles on the send. This is the normal way to attach files.\n\n**Hosted server** (`POST /v1/mcp` on `api.replylayer.ai`) — **the hosted server never\nreads files.** It runs in ReplyLayer's own infrastructure, so a path in `attachments`\nwould name a file on *our* server, not yours. Supplying a non-empty `attachments` array\nis refused before any file is opened, with a stable code:\n\n```json\n{\n  \"error\": \"The hosted MCP server cannot read files from your machine. To attach files, run the local MCP server (npx -y replylayer-mcp) or upload through the REST API / SDK and send from there; hosted attachment handles are not yet available on MCP.\",\n  \"code\": \"HOSTED_LOCAL_ATTACHMENTS_UNSUPPORTED\",\n  \"details\": { \"attachments\": 1 }\n}\n```\n\n`details` reports only how many paths you sent; the paths themselves are never echoed back.\n\n**To attach a file on the hosted server**, pick one of:\n\n1. **Run the local MCP server** (`npx -y replylayer-mcp`) and use `attachments` as\n   documented above; or\n2. **Upload through the REST API or an SDK** — `POST /v1/attachments` returns a handle id,\n   and `POST /v1/messages/send` accepts `attachment_ids`. Send from there.\n\nTwo details worth knowing:\n\n- An **empty** `attachments: []` is not a rejection — it behaves exactly like omitting the\n  field.\n- A same-key **idempotent retry still replays.** If an earlier send from the *local*\n  server carried real paths and you retry it against the hosted server with the same\n  `idempotency_key`, the replay probe runs first and returns the original result. The\n  `attachments` parameter therefore stays in the hosted schema (so such a retry still\n  parses) — only its description changes, and it is refused on a probe miss.\n\nHosted attachment handles on MCP are not available yet; when they land, they will be an\nexplicit handle-id parameter rather than a path.\n\n## Changelog\n\n- **0.15.1** — Adds `mcpName` (`ai.replylayer/replylayer`) so the official MCP Registry can list this package. No tool, schema or behaviour change.\n- **0.15.0** — Moves to the MCP TypeScript SDK v2 (`@modelcontextprotocol/server`). The stdio binary and the hosted endpoints now serve the **2026-07-28** protocol revision (`server/discover`, which returns the same server instructions `initialize` does) alongside the 2025-era `initialize` handshake, from one server factory; a client that opens with `initialize` is served exactly as before. Tool names, descriptions, input and output schemas, annotations and results are unchanged (the tools stay on zod 3 through an adapter that reproduces the previous JSON Schema). Two SDK-generated error texts change: invalid tool arguments read `Input validation error: Invalid arguments for tool <name>: <field>: Required` (an `isError` result, as before), and calling a tool that is not registered is a JSON-RPC `-32602` \"Tool <name> not found\" error rather than an `isError` result. The `replylayer-mcp/tools` entry now exports `buildReplyLayerMcpServer` and a structural `ToolServer` in place of the SDK's `McpServer` type, so `registerAllTools` no longer depends on the SDK. Breaking for embedders of `replylayer-mcp/tools`; none for stdio users.\n- **0.14.4** — The top-level `releasable` field descriptions now say it is the draft-only flag (always false on sent or received messages) and point to `email_effect` for held messages; the server primer gains one sentence saying the same and that held outbound mail is released only by the account owner in the dashboard. No schema or behaviour change.\n- **0.14.3** — The `create_draft`, `reply_to_message` and `send_email` descriptions now link the ReplyLayer API reference they call (Anthropic directory requirement). No schema or behaviour change.\n- **0.14.2** — Every tool now sets `annotations.title` (Anthropic directory requirement). The top-level `title` is kept. No schema or behaviour change.\n- **0.14.1** — Corrected Sandbox complaint copy in the `add_recipient` description: a spam report from someone added with `attest` also revokes everyone added that way (they must confirm by link again), and only a report from a second person suspends the Sandbox account. No schema or behaviour change.\n- **0.14.0** — Output schemas on every tool (G7). Every tool that returned only a\n  text block now also declares an `outputSchema` and returns matching `structuredContent`\n  (the same JSON as the text block, which is unchanged); `remove_suppression`, which\n  always returns an error, is the one tool without one, so every tool on the sign-in\n  endpoint has one. Each schema follows the API route's response schema, after the\n  fields the tool leaves out; objects are open, enum-like values are strings, and only\n  the top-level fields the route always returns are required. The existing schemas gain\n  the fields they were missing: `hold_context.review_url`, `review_expires_at`,\n  `review_causes` and `agent_instructions`, the review fields and `firewall_block` on\n  message reads, the trimmed attachment fields, and the mailbox fields `list_mailboxes`\n  keeps. `get_attachment_preview` now requires `attachment` and `preview`. Also ships\n  the held-send changes merged after 0.13.0 was published: the `HELD` line on a held send\n  now tells the agent to tell the account owner where the send waits\n  (`hold_context.review_url`) and by when (`hold_context.review_expires_at`), and not to\n  send it again; `send_draft` now shapes its result like `send_email` and\n  `reply_to_message` (a held draft send leads with the same line, and a blocked one is an\n  `isError` result); the primer says the same. No tool name, input, annotation or\n  description changes. Requires `@replylayer/sdk` 0.28.1.\n- **0.13.0** — Tool titles and complete annotations. Every tool declares a `title` and\n  explicit boolean `readOnlyHint`, `destructiveHint` and `openWorldHint`, plus\n  `idempotentHint` on every tool that changes something (see\n  [Tool annotations](#tool-annotations)). `create_draft`, `update_draft`, both release\n  tools, `add_recipient`, and the ten list and marker writes (`add_suppression*`,\n  `add_inbound_blocklist*`, `add_inbound_allowlist*`, `mark_*_read`, `star_*`) are now\n  destructive, so hosts that honour the hints ask before running them.\n  `remove_suppression` is now read-only (it always returns an error). `create_draft`\n  and `update_draft` say that no email is sent unless `send_at` is set. The masking\n  guidance in the `idempotency_key` descriptions and the primer no longer names a\n  specific host. `delete_message` and `report_and_block` declare `idempotentHint: true`.\n  New `grant` registration option (`'any'` by default): the hosted sign-in endpoint\n  registers with `grant: 'agent'`, which leaves out `AGENT_UNAVAILABLE_TOOL_NAMES`\n  (`approve_review`, `deny_review`, `get_account_usage`, `remove_suppression`; the\n  other 40 remain) and ships `OAUTH_SERVER_INSTRUCTIONS`, the primer with its API-key\n  wording replaced by connection wording. A `grant: 'agent'` registration also takes\n  `oauth: { scope, challenge }` (required) and adds OAuth linking metadata: every tool\n  carries `securitySchemes` (`[{ type: 'oauth2', scopes: [scope] }]`) in `_meta` and,\n  through a wrapped `tools/list` handler, top-level too, and a tool\n  error caused by a 401 from the API carries `_meta[\"mcp/www_authenticate\"]: [challenge]`,\n  which a client that signs in per tool (ChatGPT) needs to re-link. The stdio server and\n  `/v1/mcp` are unchanged by the grant. Apart from `add_recipient`'s new `attest` (below),\n  no parameter changes. **Results leave out internal identifiers and bookkeeping on every transport** (see\n  [Tool notes](#tool-notes)): `reviewed_by_id`, `added_by_actor_id`, `actor_id`,\n  `r2_objects_failed` (now `r2_objects_failed_count`), `warmup.velocity_gate_mode`,\n  `preview.extractor`, attachment `hash` and bookkeeping fields, and the mailbox\n  scanner, PII-detector, instruction-trust and consent-bookkeeping fields; a vendor-named\n  suppression `source` reads `provider_webhook` or `provider_sync`; 400 validation\n  details keep only `instancePath` and `message`, and `SELF_HOSTED_DECRYPT_FAILED` drops\n  `details.domain_id`. `get_attachment_preview`'s output schema no longer lists\n  `attachment.hash` or `preview.extractor`, and `list_allowlist_blocked_attempts`'s\n  description no longer names `actor_id`. `list_drafts` returns the API's `has_more`\n  again. Sandbox recipient attestation: `add_recipient` gains an optional `attest: boolean` (sendable now, no confirmation\n  email, spends one of the account's per-trial attestations) and a description that\n  states the Sandbox-only scope, both branches, the complaint consequence and the\n  restricted-mailbox refusal; it stays listed on the sign-in endpoint. It no longer\n  says other accounts \"can email anyone\": they don't use this list, and on a paid plan a\n  mailbox restricted to approved people still binds agent sends, so the agent asks the\n  user to approve the person. The Sandbox-recipient hints likewise say pay-as-you-go\n  credit removes the Sandbox recipient rule, not that it lets the agent email anyone. Tool errors gain\n  hints for `SANDBOX_RECIPIENT_NOT_VERIFIED`, `RECIPIENT_WRITE_AGENT_CONTAINED`,\n  `RECIPIENT_WRITE_UNAVAILABLE` and an attestation `TIER_LIMIT`. Requires\n  `@replylayer/sdk` 0.28.0.\n- **0.12.3** — Idempotency keys must be literal. The `idempotency_key` descriptions on\n  `send_email`, `reply_to_message` and `create_draft`, and the server-level primer, now\n  say: pass the literal key in every call, and if your host masks fields ending in\n  `_key` (OpenClaw does), retry from a new session with the full literal request instead\n  of reusing a masked value. The API refuses a masked key (`***`, a value containing\n  `…`, `__OPENCLAW_REDACTED__`, or a word such as `[REDACTED]`) with\n  `400 IDEMPOTENCY_KEY_INVALID`. The hosted server already carries this text. No tool or\n  schema change. The release also produces the Claude Desktop extension bundle.\n- **0.12.2** — API-key authentication failures. The server-level workflow primer\n  (`SERVER_INSTRUCTIONS`) now tells the agent that a `RATE_LIMITED` whose\n  `details.reason` is `failed_authentication` means the API key is wrong or revoked:\n  stop and ask a human to fix the key, do not retry. It also names `UNAUTHORIZED` /\n  `API_KEY_REVOKED` as stop-and-ask-a-human codes. Tool errors gain matching friendly\n  hints for the failed-authentication `429` (checked before the daily-quota test) and\n  for `API_KEY_REVOKED`. No tool or schema change.\n- **0.12.1** — documentation only; no tool, schema, or runtime change. The auth note no\n  longer describes signup as invite-gated: it states the email and mobile-number\n  verification a new account's key waits on.\n- **0.12.0** — the hosted MCP server now refuses local `attachments` paths before any\n  filesystem access (`HOSTED_LOCAL_ATTACHMENTS_UNSUPPORTED`); see\n  [Hosted vs local attachments](#hosted-vs-local-attachments). Additive public API: the\n  tool registrars exported from `replylayer-mcp/tools` accept an optional third\n  `RegisterToolOptions` argument (`{ transport?: 'local' | 'hosted' }`, default\n  `'local'`), so every existing two-argument call is unchanged. The hosted MCP server\n  also injects the same server-level workflow primer as this binary and advertises the\n  real package version; both transports read the version from `package.json`. The\n  primer branches on `email_effect.effect_status` (with the legacy top-level `status`\n  as a fallback for older servers) and carries the immediate-send idempotency rules.\n  Additive public API: `replylayer-mcp/tools` also exports `SERVER_INSTRUCTIONS` and\n  `MCP_PACKAGE_VERSION`.\n\n## See also\n\n- Public CLI repo (install & package trust): <https://github.com/replylayer/rly>\n- The agent `SKILL.md`, the CLI ↔ MCP ↔ REST verb-parity map, and `ENDPOINTS.md`\n  (the REST API contract) will be published with the hosted docs site when it is\n  available.\n","readmeFilename":"README.md"}