Nylas MCP Server for Claude
Connect Claude Code, Codex, Cursor, Windsurf, VS Code, and other MCP clients to Nylas email, calendar, contacts, and Notetaker tools across Gmail, Outlook, Exchange, Yahoo, iCloud, and IMAP accounts.
Open the source and read safety notes before installing.
Safety notes
- Nylas MCP can read email bodies, search threads, list contacts, inspect calendars, create and update events, create drafts, send messages, delete drafts, delete events, and schedule or send Notetaker bots.
- Nylas documents a two-step send flow: send_message and send_draft require confirm_send_message or confirm_send_draft first; keep that confirmation boundary visible to users.
- delete_draft and delete_event are irreversible tool actions; require explicit user confirmation before allowing them.
- Email and calendar content can contain prompt injection that tries to make the agent leak data or send unauthorized messages; validate instructions against the user's original intent.
- Hosted MCP uses the same API key and grant authority as direct Nylas API calls, so scope grants and application access deliberately.
Privacy notes
- Connected inboxes, email bodies, threads, folders, contacts, calendars, availability, events, grant metadata, Notetaker media links, and search queries may be exposed to the MCP client and model provider.
- Store NYLAS_API_KEY in an environment variable or the Nylas CLI credential store; do not paste raw API keys into prompts, committed config, screenshots, or PR bodies.
- Local Nylas CLI credentials are stored in the operating system credential store, with non-secret grant metadata cached separately.
- When using the hosted endpoint, prompts and tool calls reach Nylas over the selected US or EU regional MCP URL.
- Use narrow date ranges, folders, search filters, and account hints to avoid sending unnecessary mailbox history into the agent context.
Prerequisites
- Nylas account, Nylas application, API key, and at least one connected grant for the mailbox or calendar the agent may access.
- Nylas CLI installed and authenticated, or an MCP client that can connect to the hosted Streamable HTTP endpoint.
- Claude Code, Claude Desktop, Codex, Cursor, Windsurf, VS Code, or another MCP-compatible client.
- US or EU Nylas application region selected before choosing the hosted MCP endpoint.
- User confirmation workflow for send, delete, event, and Notetaker actions.
Schema details
- Install type
- cli
- Troubleshooting
- No
- Scope
- Source repo
- Estimated setup
- 10 minutes
- Difficulty
- intermediate
Full copyable content
nylas mcp install --assistant claude-codeAbout this resource
Overview
Nylas MCP connects AI agents to real email, calendar, contacts, availability, and Notetaker workflows through the Nylas platform. It is useful when Claude Code, Codex, Cursor, Windsurf, or another MCP client needs to check an inbox, search message history, draft a reply, inspect a calendar, create an event, or schedule a Notetaker without custom Gmail, Microsoft Graph, Exchange, Yahoo, iCloud, or IMAP integration code.
There are two practical setup paths:
- Local Nylas CLI MCP server, installed into a supported agent with
nylas mcp install. - Hosted regional MCP endpoint at
https://mcp.us.nylas.comorhttps://mcp.eu.nylas.com, authenticated with a Bearer token.
Setup Paths
Nylas CLI Installer
Install and initialize the Nylas CLI, then register the MCP server with your agent:
brew install nylas/nylas-cli/nylas
nylas init
nylas mcp install --assistant claude-code
nylas mcp status
The same installer supports other clients:
nylas mcp install --assistant cursor
nylas mcp install --assistant windsurf
nylas mcp install --assistant vscode
nylas mcp install --assistant codex
nylas mcp install --all
For local stdio configuration, the server command is:
{
"mcpServers": {
"nylas": {
"command": "nylas",
"args": ["mcp", "serve"]
}
}
}
Hosted MCP Endpoint
Use the hosted endpoint when your client supports Streamable HTTP and you want to skip a local CLI process. Choose the URL that matches the Nylas application region:
| Region | URL |
|---|---|
| US | https://mcp.us.nylas.com |
| EU | https://mcp.eu.nylas.com |
For Codex, store the API key in an environment variable instead of the config file:
[mcp_servers.nylas]
url = "https://mcp.us.nylas.com"
bearer_token_env_var = "NYLAS_API_KEY"
tool_timeout_sec = 90
For Cursor-style JSON configuration:
{
"mcpServers": {
"nylas": {
"type": "streamable-http",
"url": "https://mcp.us.nylas.com",
"headers": {
"Authorization": "Bearer ${NYLAS_API_KEY}"
}
}
}
}
Tool Surface
Nylas documents 36 MCP tools across email, calendar, contacts, time conversion, grant lookup, search syntax, and Notetaker workflows.
| Group | Representative Tools |
|---|---|
| Account and time | get_grant, current_time, datetime_to_epoch, epoch_to_datetime |
| Email read/search | list_messages, get_message, list_threads, list_folders, get_folder_by_id, get_search_syntax |
| Draft and send | create_draft, update_draft, delete_draft, confirm_send_draft, send_draft, confirm_send_message, send_message |
| Calendar | list_calendars, list_events, get_event, availability, create_event, update_event, delete_event |
| Contacts | list_contacts, get_contact |
| Notetaker | list_notetakers, get_notetaker, get_notetaker_media, schedule_notetaker, send_notetaker, standalone Notetaker variants |
Use Cases
- Ask Claude Code to find a recent signup, deploy, billing, or incident email.
- Let Codex check whether a calendar slot is free before proposing a meeting.
- Draft an email reply while keeping final send approval separate.
- Search work and personal grants for a thread when the user does not remember which inbox contains it.
- Use contacts and availability to prepare scheduling or recruiting workflows.
- Send or schedule a Notetaker bot for meeting capture after the user approves the target meeting.
Safety and Privacy
Mailbox and calendar access is a high-trust integration. Treat email bodies, calendar descriptions, invites, attachments, and contact records as untrusted input, because they may include prompt injection or instructions that conflict with the user's request. Do not let a quoted email tell the agent to leak keys, forward confidential data, or bypass confirmation.
Nylas requires confirmation tools before direct send actions, but the user still needs a clear review step. Drafts, event creation, event deletion, and Notetaker actions can affect real people outside the repository. Keep destructive tools behind explicit user approval and prefer narrow search filters so the model sees only the messages and events needed for the task.
Source Review
Verified on 2026-06-18:
- Nylas's MCP documentation confirms the hosted US and EU endpoints, Bearer token authentication, CLI installer commands for Claude Code, Cursor, Windsurf, VS Code, Codex, and all agents, plus manual config examples.
- The Codex MCP guide confirms
bearer_token_env_var, project and global config options, connection verification withget_grant, examples for inbox triage, calendar review, draft replies, availability, and account-scoped search. - The Nylas MCP docs and blog document the 36-tool surface, two-step send confirmation, prompt-injection concerns, and the need to confirm irreversible delete actions.
- The
nylas/clirepository is MIT licensed and documentsnylas mcpfor AI assistant integration, local credential storage, and CLI install options.
Duplicate Check
Checked current content/mcp/, content/tools/, content/skills/, open pull
requests, and repository-wide content for Nylas, nylas mcp, mcp.us.nylas,
mcp.eu.nylas, agent email, email mcp, and calendar mcp. Existing entries
cover Google Workspace, CalendarMCP, Keeper.sh calendar, AgentTrust identity, and
disposable email use cases, but no dedicated Nylas MCP server entry, Nylas CLI
source URL duplicate, or open duplicate PR was found.
Source citations
Add this badge to your README
How it compares
Nylas MCP Server for Claude side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.
| Field | Nylas MCP Server for Claude Connect Claude Code, Codex, Cursor, Windsurf, VS Code, and other MCP clients to Nylas email, calendar, contacts, and Notetaker tools across Gmail, Outlook, Exchange, Yahoo, iCloud, and IMAP accounts. Open dossier | Resend MCP Server for Claude Official Resend MCP server for giving Claude and other MCP clients controlled access to email sending, received email, contacts, broadcasts, domains, segments, topics, API keys, and webhooks through stdio or Streamable HTTP. Open dossier | CalendarMCP MCP Server Hosted Google Calendar MCP server that lets compatible AI clients read, create, update, delete, search, and batch-edit calendar events through an HTTP endpoint and API-key authentication. Open dossier | Context Mode MCP Server MCP server for context-window optimization that routes large tool outputs through sandbox tools, indexes session state, and helps agents retrieve only the context they need. Open dossier |
|---|---|---|---|---|
| Trust | ||||
| Install risk | Review first | Review first | Review first | Review first |
| Notes | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ |
| Category | mcp | mcp | mcp | mcp |
| Source | source-backed | source-backed | source-backed | source-backed |
| Author | Nylas | Resend | CalendarMCP | mksglu |
| Added | 2026-06-18 | 2026-06-04 | 2026-06-05 | 2026-06-05 |
| Platforms | Claude CodeCodexCursorClaude Desktop | Claude CodeClaude Desktop | Claude CodeClaude Desktop | Claude CodeClaude Desktop |
| Source repo | — | — | — | — |
| Safety notes | ✓Nylas MCP can read email bodies, search threads, list contacts, inspect calendars, create and update events, create drafts, send messages, delete drafts, delete events, and schedule or send Notetaker bots. Nylas documents a two-step send flow: send_message and send_draft require confirm_send_message or confirm_send_draft first; keep that confirmation boundary visible to users. delete_draft and delete_event are irreversible tool actions; require explicit user confirmation before allowing them. Email and calendar content can contain prompt injection that tries to make the agent leak data or send unauthorized messages; validate instructions against the user's original intent. Hosted MCP uses the same API key and grant authority as direct Nylas API calls, so scope grants and application access deliberately. | ✓Resend MCP is an executable npm package launched with `npx`, not a HeyClaude-hosted package. Review the official repository and npm package metadata before running it in privileged environments. The server can send, schedule, update, cancel, and batch send emails when the configured API key allows it. Treat every outbound email as a production write unless you are using a controlled test recipient. Tools can manage contacts, segments, topics, broadcasts, domains, webhooks, contact properties, API keys, and received emails. Do not expose broad account-management tools to an autonomous agent without human review. Do not paste real `re_` API keys into prompts, issue comments, screenshots, public MCP configs, shell history, or committed files. Use environment variables or your client's secret handling. For stdio mode, the docs use `RESEND_API_KEY` in the launched process environment. For HTTP mode, each client authenticates with a Bearer token in the `Authorization` header. If reproducibility matters, pin the npm package version after checking the current Resend docs and release metadata instead of relying on the latest `npx -y resend-mcp` package. Attachments can be provided from local paths, URLs, or base64 content. Do not allow the assistant to attach arbitrary local files or downloaded content without reviewing file path, size, type, and recipient. Domain, tracking, TLS, webhook, API-key, and audience changes can affect deliverability, compliance, and production email behavior. Require explicit human approval for those operations. | ✓CalendarMCP is a hosted remote MCP service at `https://calendarmcp.ai/api/mcp`; the public repository contains docs, manifests, and client examples, not the hosted backend source. Calendar write tools can create, update, delete, quick-add, batch-update, and manage attendees for calendar events when the API key has write access. Batch updates can affect up to 50 events in one call, so review target filters, recurrence handling, and proposed edits before allowing broad changes. Use CalendarMCP's per-calendar read/write matrix to limit which calendars each assistant can access. Run `find_free_time` or manually confirm availability before creating meetings that invite other people or reserve shared resources. Keep destructive actions such as deleting events or changing recurring meetings behind explicit human confirmation. | ✓Context Mode encourages agents to execute scripts and route large outputs through sandbox tools; review allowed commands and workspace boundaries. Hook-based installs can affect tool routing automatically. Verify the installed hooks and settings before using it in shared or sensitive workspaces. Indexed session state can influence future retrieval and continuity; purge state when switching projects, clients, or sensitivity levels. Do not rely on compressed or searched summaries for high-stakes decisions without inspecting original files or outputs. |
| Privacy notes | ✓Connected inboxes, email bodies, threads, folders, contacts, calendars, availability, events, grant metadata, Notetaker media links, and search queries may be exposed to the MCP client and model provider. Store NYLAS_API_KEY in an environment variable or the Nylas CLI credential store; do not paste raw API keys into prompts, committed config, screenshots, or PR bodies. Local Nylas CLI credentials are stored in the operating system credential store, with non-secret grant metadata cached separately. When using the hosted endpoint, prompts and tool calls reach Nylas over the selected US or EU regional MCP URL. Use narrow date ranges, folders, search filters, and account hints to avoid sending unnecessary mailbox history into the agent context. | ✓Tool results and prompts can expose email addresses, names, recipient lists, message bodies, subject lines, attachments, contact properties, segments, topics, unsubscribe state, domain names, webhook URLs, logs, and inbound email content. Received emails and attachments can include customer support requests, order confirmations, account details, personal data, credentials, invoices, contracts, or regulated information. Outbound email drafts can leak private customer data if generated from tickets, Slack messages, databases, logs, or other MCP servers without a data-sharing review. MCP client transcripts, terminal logs, debug output, shell history, AI provider logs, screenshots, and issue reports may retain email content or recipient data outside Resend's access controls. Keep marketing audiences, segments, broadcast lists, custom properties, and suppression/unsubscribe data out of prompts unless the workflow owner approved the data handling. Use synthetic recipients, test domains, and non-production content for demos, screenshots, validation, and AI-assisted troubleshooting. | ✓Calendar results can expose meeting titles, attendees, email addresses, locations, descriptions, links, reminders, recurrence patterns, availability, and private schedule context. One CalendarMCP API key can cover multiple connected Google accounts; review which accounts and calendars are attached before sharing a config. Google OAuth tokens and CalendarMCP API keys are sensitive credentials. Keep them out of prompts, issue comments, screenshots, shell history, logs, and repository files. Hosted access means calendar data and tool calls pass through CalendarMCP and the connected MCP client; review retention and data-processing policies before connecting sensitive calendars. Use synthetic calendars or narrow test calendars for demos, screenshots, and workflow testing. | ✓Context Mode can index file edits, git operations, tasks, errors, user decisions, local files, and command output in SQLite/FTS5 stores. Indexed data may include source code, logs, secrets accidentally printed to terminal, customer data, repository paths, and private prompts. Local analytics and statusline data can reveal workflow patterns, tool usage, and project activity. |
| Prerequisites |
|
|
|
|
| Install | | | | |
| Config | | | | |
| Citations | ||||
| Claim | Unclaimed | Unclaimed | Unclaimed | Unclaimed |
Signals
Loading live community signals…
A short, calm digest of reviewed Claude resources. Unsubscribe any time.