Version 1.0 · Effective date: October 15, 2026 · Mailbari LLC
Last Updated: October 15, 2026
The Mailbari APIs and MCP server let your own apps and your AI assistant (such as Claude or ChatGPT) work with your mail, files, calendars, chats, tasks and projects. Everything they do happens with a User's or Admin's permission, within the scopes they approve and the limits below. Anything that sends, shares or costs money asks a person to confirm first. You are responsible for the apps and assistants you connect, and you can cut their access off at any time. The token an assistant receives works only at Mailbari and only for the scopes the User approved; sending and sharing always wait for the User's confirmation.
1.1 The Mailbari Email API (REST, JMAP and SMTP submission), the Drive, Docs, Notes, Calendar, Contacts, Meeting, Team Chat, Booking, Taskboard and Projects APIs, the Admin, Audit and SCIM APIs, webhooks, and the Mailbari MCP server at mcp.mailbari.com (together, the "APIs"). 1.2 These terms add to the Terms of Service, the Acceptable Use Policy and the Anti-Spam & Sending Limits Policy, which all apply to activity through the APIs. API access is available on the plans shown on mailbari.com/pricing. 1.3 The first time an Admin creates an API key or connects an app or AI assistant, they must accept these terms.
2.1 OAuth for apps acting for a person. Apps and AI assistants sign in with OAuth 2.1 and PKCE. The User sees which app is asking and which permissions ("scopes") it wants, such as mail.read or drive.write, and can approve or refuse. Admins can limit which apps Users may connect. 2.2 API keys for your own servers. Admins can create API keys for server-to-server use in Admin › Developers. Each key has its own scopes and can be limited to IP addresses. 2.3 Keep credentials secret. Do not put them in public code, client-side apps or shared documents. If a key or token may have leaked, revoke it at once in Settings › Connected apps or Admin › Developers and tell [email protected]. 2.4 Tokens issued by Mailbari work only with Mailbari. The MCP server checks that every token was issued for it and refuses tokens from anywhere else, and Mailbari never passes your Mailbari token on to another service.
3.1 The APIs have rate limits to keep the Services fast for everyone. The current limits are in the developer documentation and in the response headers of every call. When you exceed one, you receive HTTP 429 with a time to retry. 3.2 Email sent through the API counts towards the same daily recipient limits as email sent from webmail, under the Anti-Spam & Sending Limits Policy. The API is not a bulk or marketing email service. 3.3 We may lower the limits for an app that harms the Services, and we will tell you why.
You may not use the APIs to: 1. Send bulk, unsolicited or marketing email, or relay mail for people outside your organisation. 2. Access data of organisations or Users who have not authorised your app. 3. Scrape, copy or export the Services' data in bulk for anyone other than the Customer it belongs to. 4. Sell, rent or share data obtained through the APIs, or use it for advertising or to build profiles of people. 5. Get around limits, permissions, the Admin's settings, or the confirmation steps in section 6. 6. Build a product that copies Mailbari or resells access to the APIs. 7. Break the law, the Acceptable Use Policy or the rules of any service whose data passes through the APIs.
5.1 Data you get through the APIs belongs to the Customer. Use it only for the purpose the User or Admin approved, keep it secure, and delete it when that purpose ends or the User revokes access. 5.2 If you build an app for other Mailbari customers, you must have a public privacy policy and terms, tell users what your app does with their data, and honour deletion requests. We may review apps that ask for broad scopes before they can be used outside your own organisation. 5.3 Data that came into Mailbari from Google APIs keeps its Limited Use restrictions when it leaves through the APIs: you may not use it for advertising, sell it, or use it to train generalised AI models.
6.1 Connecting. A User adds the Mailbari MCP server address (https://mcp.mailbari.com/mcp) to their AI assistant. The assistant is sent to Mailbari's sign-in and consent screen, where the User chooses which products and actions to allow. The consent lasts until the User or an Admin revokes it. 6.2 What the assistant can do. The assistant can use the tools listed in the developer documentation, such as searching mail, reading files, creating drafts, adding calendar events and updating tasks, only within the scopes the User approved and the User's own permissions. Admin tools are available only to Admins. 6.3 Ask-first actions. Sending an email, sharing a file or link, inviting people from outside the organisation, posting in a chat channel, creating a booking page, adding a User (which uses a paid licence) and moving items to trash always ask the User to confirm in their assistant before Mailbari carries them out. No MCP tool permanently deletes data or changes billing. 6.4 Labelling. Chat messages posted by an assistant are marked as sent by an AI assistant on behalf of the User. 6.5 Your assistant, your choice. The AI assistant and its provider are chosen by you. Data the assistant reads through the MCP server goes to that provider under your agreement with it, not under Mailbari's Data Processing Addendum. Before connecting, check that your assistant's provider meets your own privacy and confidentiality needs. 6.6 Responsibility. Actions an assistant takes with your approval are your actions. Review what it proposes before confirming. Mailbari logs every MCP tool call with the User, app, tool and time in the audit log. 6.7 Turning it off. Users can revoke an assistant in Settings › Connected apps. Admins can see and revoke all connected apps, or turn off the MCP server for the organisation, in Admin › Security › Connected apps.
Webhooks send events (such as a new message, a shared file or a new booking) to an HTTPS address you choose. Each delivery is signed so you can check it came from Mailbari, and we retry failed deliveries for up to 72 hours. Webhook payloads contain only what is needed to identify the event; fetch full content through the API with your own credentials.
8.1 APIs are versioned. We will give at least 6 months' notice before we retire an API version or remove a feature you rely on, unless we must act faster for security or legal reasons. 8.2 The APIs are covered by the Service Level Agreement where it says so. Beta APIs and tools are provided as they are, may change, and are not covered. 8.3 We may suspend an app or key that breaks these terms or puts the Services or Customer Data at risk, and will tell the Admin why.
• Mailbari LLC · 104 Quigley Blvd, Ste 1013, New Castle, DE 19720, USA · +1 302 580 8514 • Bangladesh office · Rafiq Place, Level 1A, BM College Mosque Gate, Barisal-8200, Bangladesh · +880 1805 459129 • Developer support: [email protected] · Security: [email protected]