← Inbox

Humanerhello@humaner.io

To
you
Subject
Your own agent

MCP adoption moved fast. Same mailbox tools as Companion — scoped, OAuth, and guarded.

You cannot lie to yourself anymore.

People's way of interacting with software has changed. Humaner ships the same mailbox tools Companion uses — over MCP and scoped REST. Point Cursor, Claude, or any MCP client at your inbox. Memory and learning stay on Companion; your agent gets search, read, draft, assign, send, calendar, and tasks.

How MCP usage has changed

Resend MCP usage grew 10× in four months. On August 28, Zeno Rocha posted their numbers — April 106,719 vs August 1,062,650 — and called it their fastest-growing usage category.

Pinterest is an app made for and with UI. If a single product should stay screen-first, it's that one. In March 2026 they still reported 66,000 MCP calls a month across 844 people, and about 7,000 hours saved — roughly a workday back per person every month.

And the whole market moved. Dec 2025 — Anthropic gives MCP to the Linux Foundation; OpenAI, Google, Microsoft, and AWS join in. Jul 2026 — the official SDK passes ~ 156M monthly npm downloads. Sep 2026 — the registry lists 30,375 servers; 6,265 added in August alone.

Software you don't open is the new software

Before: send an email → open the inbox. Check a number → open the dashboard. Create a ticket → open the support tool.

After: your agent does all three without you seeing a single interface. Nobody ever said “Please give me one more dashboard.” A chatbot inside your product isn't what they want — they want their agent doing the boring stuff.

Search, read, create, update, run. Getting things done faster, because what they want is more time and more money. That's it.

The only question: What should an agent be able to do with my product? Same stuff as in your software.

How to use it through Humaner

Connect on humaner.io/mcp. Paste the config, approve scopes. Claude Code, Cursor, VS Code, and Claude Desktop sign in with OAuth — you approve one app. Scripts use a scoped API key.

Same tools as Companion: read, draft, assign, send, calendar, tasks, Hybrid RAG. Memory and learning stay in-app. Docs: MCP · Inbox Skills.

Why OAuth instead of a forever key? Astrix looked at 5,205 public MCP servers — 53% use long-lived static keys; only 8.5% use OAuth. Mail is the worst place for a leaked master key. We aim for the 8.5%.

How MCP security is handled for Humaner

If an agent can read your data, it can also leak it — and it already happened.

  • GitHub — a malicious issue pushed an agent to leak private repos into a public pull request.
  • Asana — an MCP bug showed some customers' data to other companies for over a month (~1,000 customers).
  • Supabase — instructions hidden in a support ticket got an agent to copy private tokens into a reply the attacker could read.

Simon Willison calls it the lethal trifecta: private data, untrusted content, and an outbound channel. AgentSeal scanned 1,808 public MCP servers — 66% had findings, including 427 critical.

So the question isn't whether a server looks trustworthy. It's what can this agent actually do with it?

  • OAuth first

    Claude, Cursor, and VS Code sign in with OAuth. You approve one app — we aim to stay in the 8.5%, not the 53%.

  • Scopes you choose

    Read, draft, send, calendar, and knowledge search — each grant is explicit on the consent screen. MCP knowledge search is FTS, not Companion Hybrid RAG.

  • Short-lived access

    Access tokens last one hour. Revoke a client in Settings → MCP and it fails on the next call.

  • Guardrails

    Policies and logging so misreads and sensitive leaks are harder — mail is the worst place to be careless.

Why OAuth on Security.

Build a server you'd trust with a mailbox

Consent, scopes, and revoke are table stakes. These are the holes between that and a server you would trust with mail:

  1. List only what the credential can call — filter `tools/list` by mailbox, calendar, and intelligence scopes before the agent sees names or schemas.
  2. Stop treating an empty scope list as full access. Legacy keys with no scopes must migrate; new keys must name mailbox, calendar, or intelligence.
  3. Split send from read — a read-and-draft grant must not send mail.
  4. Default consent to the minimum — mailbox only unless the client requests calendar or intelligence.
  5. Kill access immediately on revoke — the live access token must fail, not only the next refresh.
  6. Log actor, tool, scope, and refusal — refused send vs refused intelligence must be distinguishable from success.
  7. Hide intelligence tools unless the token has intelligence — no teasing tools the credential cannot call.

Paste into your coding agent to deploy your own MCP server securely — OAuth, scopes, revoke, and least privilege.

Your user’s agent must get access to the lobby, not the whole building.