AgentArmorHQ
Sign in

mailcheap

MCP server · GitHub · ★ 1.6k · graded 2026-10-19Source linked

Newsletters where you pay for the emails you send, not for dormant subscribers, at a fraction of the price of beehiiv and the like. Open source: self-host it, or use mailcheap.ai.

No outside reports on file

This tool requires trusted access to real email credentials and subscriber databases, so use it only in controlled environments and verify the code has been reviewed before handling sensitive data.

Based on public adoption and transparency signals as of Oct 19, 2026. Our opinion, not a code audit or security guarantee.

Was this verdict for Mailcheap helpful?

What it can access

  • Local filesNo local folder access notedLOW
  • Command executionNo shell command runner notedLOW
  • Network reachConnects to outside service APINOTED
  • CredentialsRequires API key or tokenREVIEW
  • Package sourceGitHub (marclou/mailcheap)PUBLIC

Inferred from this listing’s public package details and description. Check the project’s source before installing.

Install

No npm or PyPI package is listed. Install from source: github.com/marclou/mailcheap ↗

All setup options ↓

Check this skillWatch it in my stackCompareREADME badgeView project

Everything known

We found nothing about this project in the sources we read (last checked 2026-10-30). That does not mean it has no problems.

0 incidents · 0 advisories · 0 news articles · 0 community threads · checked 2026-10-30

Popularity grade: C (from public signals such as stars and downloads, not a code review). Graded 2026-10-19.

Sources we read: OSV, GitHub Advisory Database, CISA Known Exploited Vulnerabilities, 44 security news feeds and our incident library. Last checked 2026-10-30.

Check a specific version →

About Mailcheap

Mailcheap is an open-source email newsletter platform that charges based on emails sent rather than subscriber count. You can self-host it or use their managed service at mailcheap.ai to send newsletters at lower cost than traditional providers.

Who it’s for

Newsletter creators and small publishers who want to reduce costs by paying only for sent emails. People comfortable self-hosting or managing their own email infrastructure.

Alternatives

  • Mailgun (managed email service with pay-per-send pricing). - SendGrid (similar pay-as-you-go email platform with API access). - Substack (all-in-one newsletter platform, but takes a revenue cut). - Listmonk (open-source newsletter tool with simpler setup).

Setup

Check these steps against the project’s own instructions before running anything.

Clone the repository and follow the project's README at https://github.com/marclou/mailcheap (opens external site) for self-hosting instructions, or use the managed service at mailcheap.ai.

Why this grade

CC — Moderate risk signals

Signal-based grade (3/7 points): well starred on GitHub, public source code. This reflects adoption and transparency, not a code review.

Popularity and upkeep

34/100
GitHub stars
1.6k
Listing last refreshed
2026-10-29

These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.

Risks to watch for

  • Email credential storage: The tool stores email account credentials to send messages, so compromise exposes sending account passwords. - Subscriber data access: It stores full contact lists and subscriber information, which could be leaked if the database is breached. - Email spoofing potential: Direct email sending access means misconfiguration could allow sending fake emails that appear legitimate. - Open-source audit gap: With minimal weekly downloads, few people may review the code for security flaws. - Self-hosting overhead: Running your own instance requires you to maintain security patches and database backups yourself.

How to lower the risk

Least-privilege permissions

  • Run the service with a dedicated user account, not admin or root. - Give email credentials only read+send permissions, not full mailbox access.

Network isolation

  • Keep the instance on a private network or behind strong authentication. - Disable public web access unless absolutely required.

Monitoring

  • Log all email sends and flag unusual volume or recipient patterns. - Set up alerts for failed login attempts or database access errors.

Red flags to watch for

  • Unexpected email sends or new subscriber imports you didn't authorize. - Slow performance suggesting unauthorized processes running in the background. - Code changes in dependencies that add new network requests or data collection.

Questions

How do I install Mailcheap?

Mailcheap does not publish a standalone npm or PyPI package. Clone or follow the setup instructions in its source repository at github.com/marclou/mailcheap.

Are there security reports about Mailcheap?

No reports found for this package in our research (last checked 2026-10-30). Mailcheap currently holds Grade C (Moderate risk signals) based on public adoption and transparency signals. Key risk areas to watch include email credential storage.

Is Mailcheap actively maintained?

Mailcheap has 1.6k GitHub stars. Our directory data was last refreshed on 2026-10-29. Check recent commit activity, release tags, and open issues at github.com/marclou/mailcheap before pinning it in production.

What are alternatives to Mailcheap?

Compare Mailcheap side by side with similar MCP servers in the Related tools section on this page, or browse all MCP servers on AgentArmorHQ.

README badge and team notes

Maintain or use Mailcheap? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.

AgentArmorHQ Risk Grade C for Mailcheap

GitHub README Markdown:

markdown
[![AgentArmorHQ Risk Grade for Mailcheap](https://agentarmorhq.com/api/badge/marclou-mailcheap)](https://agentarmorhq.com/skills/marclou-mailcheap)

HTML embed:

html
<a href="https://agentarmorhq.com/skills/marclou-mailcheap"><img src="https://agentarmorhq.com/api/badge/marclou-mailcheap" alt="AgentArmorHQ Risk Grade for Mailcheap" height="20" /></a>

Terminal check:

terminal
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "marclou-mailcheap"

Share with your security lead

Need sign-off to use mailcheap? Copy this note for Slack, a ticket or a pull request.

### AgentArmorHQ Security Review Memo: mailcheap
- **Listing URL:** https://agentarmorhq.com/skills/marclou-mailcheap
- **Type:** App connector
- **Risk Grade:** Grade C (Moderate risk signals)
- **Outside Security Advisories on File:** 0
- **Public Adoption:** 1.6k GitHub stars

#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Connects to outside service API
- **Credentials:** Requires API key or token
- **Package source:** GitHub (marclou/mailcheap)

#### Recommended Hardened Setup
- **Source Repo:** https://github.com/marclou/mailcheap
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.

_Based on public adoption and transparency signals as of Oct 19, 2026. Our opinion, not a code audit or security guarantee._

Key facts

Type
App connector
Publisher
marclou
Source code
github.com/marclou/mailcheap
Est. context load
~550 tokens / turn (~3 tool schemas, 0.27% of 200k context)
Popularity
1.6k GitHub stars
Last updated
2026-10-29
Last graded
2026-10-19

Community

Discussions for Mailcheap

Ask questions or share configuration tips. Governed by our Community Rules & Terms.

No posts match this filter yet.

Be the first to ask a question or share a working tip.

Was this listing for Mailcheap helpful?

Check before you install, in Claude

Your assistant answers Block, Review or No known issues for any package before it installs it.

Get this check inside Claude