Changelog
What changed
New endpoints, SDK, CLI and MCP releases, and the features they bring.
MCP
Give a Google ADK agent a mailbox
An agent built on Google’s Agent Development Kit connects McpToolset to https://pidgeon.ai/api/mcp with a key and gets every tool the key allows, with nothing else to install. The guide shows how to confirm before anything is sent.
API · Mail · MCP
A hand-off reaches a person, and a person’s reply takes the conversation
Handing a conversation to a person now notifies the people who can answer it, by push and email, with the reason your agent gives on PATCH /threads/{id}. A person replying from Apple Mail or the inbox takes the conversation over, and thread.updated tells your agent to stop answering.
MCP
Give an OpenAI Agents SDK agent a mailbox
An agent built on the OpenAI Agents SDK, in Python or TypeScript, connects to https://pidgeon.ai/api/mcp with a key and gets every tool the key allows, with nothing else to install. The guide shows how to ask a person before anything is sent.
MCP · Console
Connect the MCP server by signing in
Add https://pidgeon.ai/api/mcp to Claude, ChatGPT, Cursor, Codex or VS Code and sign in, with no key to paste. You choose what it can do and which addresses it reaches, and Disconnect under API keys ends it.
MCP
Install Pidgeon as a plugin in Claude Code, Codex, Cursor and Gemini CLI
/plugin marketplace add pidgeon-ai/pidgeon-plugins in Claude Code, or the same repository in Codex, Cursor or Gemini CLI, adds the MCP server and the skill in one step.
SDK · CLI · MCP
TypeScript SDK 1.14, Python 1.14, CLI 1.7 and MCP server 0.9 are published
Releases 1.6 to 1.14 bring the clients level with everything above: pods and pod keys, the WebSocket, export, GET /v1/messages/await with codes extracted, and Pidgeon Firewall with body=clean, which the MCP server reads by default. Install with npm install @pidgeon-ai/sdk or pip install pidgeon.
API · Security · MCP
Your agent reads email with the hidden text taken out
Pidgeon Firewall now gives every inbound message a clean_text: hidden text and invisible characters removed, fake chat turns marked, and a first line saying what changed. Ask for body=clean, or do nothing — the MCP server and AI SDK tools already read it.
API · Security · MCP
Pidgeon Firewall flags mail that tries to steer your agent
Every inbound message now carries a firewall verdict: hidden text, instructions addressed to an AI, impersonated chat turns, look-alike senders and requests for secrets, each named with what it found. Check it before your agent does what an email asks.
API · SDK
A key for one pod
Create a key with pod_id and it reaches every address in that pod, including ones added later, and nothing outside it. It can manage that pod’s own domains, so each of your customers can bring their domain with the key you gave them.
API
Events over a WebSocket
wss://pidgeon.ai/api/v1/events/socket carries the event log over one socket, with the same filters and resume cursor as the stream. From a browser, send your key as the first message instead of a header.
API · SDK
Export all your mail over the API
GET /v1/export streams every message your key can read as one mbox file, or one address of it with identity_id. Originals come back byte for byte, and each message says which mailbox it came from. In the SDK as exportMail.
API · SDK · MCP
Wait for the next message in one call, with the code already extracted
GET /v1/messages/await holds the request until a message matching your filters arrives at an address, up to 280 seconds, and returns a cursor so nothing arriving between calls is missed. Every message now carries extracted: verification codes and links, most likely first. In the SDK as messagesAwait, and in the MCP server as await_message.
API · SDK · Console
Pods keep each of your customers apart, with their own sending reputation
A pod holds addresses and domains for one of your customers, a client, or test kept apart from production; every account starts with one called Default. Bounces and complaints count against the pod they came from, so one customer’s mail cannot hurt delivery for the rest, and the dashboard has a switcher for them.
MCP
The MCP server is in the official MCP registry
Clients that search the registry can find Pidgeon as ai.pidgeon/mcp, with both the npm package and the hosted endpoint listed. @pidgeon-ai/mcp 0.5.1 carries the registry name.
SDK · CLI · MCP
TypeScript SDK 1.5, Python 1.5, CLI 1.2 and MCP server 0.5 are published
Releases 1.3 to 1.5 bring the clients level with the API: pods, GET /v1/me, the event stream, search across addresses, message headers and authentication results, and the webhook verifier fix. Install with npm install @pidgeon-ai/sdk or pip install pidgeon.
API · SDK
Messages carry their headers and authentication results
A message now has headers (the threading, reply-to, list and auto-reply headers) and authentication with SPF, DKIM and DMARC verdicts, where null means not reported rather than failed. Threads carry folder, from, preview and has_attachments, and a refused send now says whether a sender rule (403 blocked) or the address’s send policy (403 not_permitted) stopped it.
API · MCP
A key can ask what it is allowed to do
GET /v1/me returns the key’s access level, the addresses it reaches and the account it belongs to. npx @pidgeon-ai/mcp init prints the access level too, so a read-only key is caught at setup rather than on the first reply.
API
Search covers every address a key reaches
GET /v1/messages/search no longer requires an address. Leave it out to search every address the key can read, and each hit says which address and folder it came from.
API · Mail
A domain can send through Pidgeon while another provider receives
Set inbound_enabled to false and Pidgeon signs and sends as the domain without asking you to change its MX record. Your existing provider, such as Google Workspace, keeps receiving its mail.
API
Events stream over a single HTTP connection
GET /v1/events/stream sends events as server-sent events while the connection is open. A script or agent without a public HTTPS endpoint can hear about mail as it arrives instead of polling.
Console
One inbox across every address
The web client has an All inboxes view above the address list, and search there covers every address you can read. A workspace with thirty addresses no longer means opening thirty folders.
Console · Mail
Mail can be set to expire
An account can choose how many days to keep mail, in Settings. The default is still to keep it for ever, and nothing expires unless you set it.
API
An agent that signs itself up gets an API key
Verifying an agent signup returns an API key once, so the agent can read and send without a person opening a browser to make one.
SDK · CLI · MCP
The TypeScript SDK reaches 1.0, and the CLI is on npm
@pidgeon-ai/sdk 1.0 is generated from the OpenAPI document, so every operation has a method. @pidgeon-ai/cli has one command for every operation, every request field is now described across all of them, and @pidgeon-ai/mcp 0.2 adds npx @pidgeon-ai/mcp init, which checks your key and writes .mcp.json.
MCP
The MCP server runs over HTTP, with nothing to install
Point Cursor, Windsurf or Claude Code at /api/mcp with your key in an Authorization: Bearer header. It serves the same tools as the npm package.
SDK
A Python SDK
pip install pidgeon installs a client generated from the same OpenAPI document as the TypeScript one, so the two cannot disagree about the API.
MCP
A skill and a Claude Code plugin teach an agent to use Pidgeon
npx skills add patrickcneuhaus/pidgeon --skill pidgeon installs the Pidgeon skill, and the same text is published at /skill.md for any agent to read before it signs up.
API · Mail
A sender rule can name one address, and refuse its mail
Rules can match a single sender as well as a domain, and the more specific rule wins. A rule can refuse mail outright as well as filing it.
Console
The dashboard opens on an overview of the account
The dashboard lands on Overview, with what arrived, what was sent and what happened to it. Every address, domain, webhook and event shows the API call that fetches it, in cURL, TypeScript and Python.
Console · Mail
The web client shows sender authentication and the original message
A message shows its SPF, DKIM and DMARC results and can be read as rendered, text or headers. Download original gives you the exact bytes that arrived.
API
An agent can sign itself up
POST /v1/agent/signup gives an agent a working address that receives mail at once; a person confirms with a code to let it send.
API
Reply, reply all, forward and drafts are in the API
Messages gain reply, reply-all, forward and the raw original. Drafts are a resource you can create, edit, send and schedule, webhooks can carry custom headers, and a domain can return its records as a zone file.
API · Console
Every address has a calendar
Create events and recurring series through the API; a series repeats in its own time zone, so “every Tuesday at 09:00” stays at 09:00 through a clock change. Attendees can be sent invitations, six webhook events cover changes, and the web client has a calendar screen.
API · Mail
An agent can answer a meeting invitation
Invitations that arrive are read onto the message and become events. POST /v1/messages/{id}/invitation/respond accepts or declines, and the organiser’s calendar hears the answer.
Mail · Console
A new account receives mail before it owns a domain
Signing up gives you an address on Pidgeon’s shared domain, with a first message already in it. Connect your own domain when you are ready.
API
A reply comes without the message it quotes
Messages carry reply_text, reply_html and quoted_html, split where the web client folds a quote. You get what the sender wrote, not the thread underneath it.
Mail · Console
Apple Mail and iPhone set themselves up from one link
Download a signed configuration profile and Apple devices add the account without typing a server. The setup panel lists every field for other clients.
MCP
The MCP server is on npm
npx -y @pidgeon-ai/mcp runs a local MCP server that lets an agent read, send and search mail with your key.
Console · Mail
Domain setup is one screen, and Cloudflare and Vercel DNS publish themselves
Enter a domain and Pidgeon finds where its DNS lives. On Cloudflare or Vercel it can add every record for you with your permission; elsewhere it lists them in one place.
Console
The web client works on a phone
Below laptop width the client switches to a phone layout, with swipe gestures and the actions within reach of a thumb.
API · Mail
An address can be limited to replying
Give an address a send policy of reply_only and it cannot start a conversation with somebody who has not written first. Allow and block lists sit beside it.
API · Mail
Routing can match a prefix
A routing rule like inv-* catches every address that starts with it, and the longest matching prefix wins.
API
Addresses can expire, and be grouped by tenant
Give an address an expires_at and it is suspended on that date, with its mail kept. Tag addresses with your own tenant_id and suspend all of a tenant’s addresses in one call.
API · Console
Software can hand a conversation to a person, and take it back
Each thread says who is answering it: software, an agent, or a person. Take over and Hand back move it between them in the web client and the API, and an Activity sheet shows who did what.
API · Security
A key can be allowed to read but not send
Keys carry an access level as well as a list of addresses, so an agent that only needs to read mail cannot send as the address. /v1/identities/{id}/access lists, grants and removes who can reach an address.
API · Console
A webhook endpoint shows how it is doing
Each delivery records how long your server took, and the endpoint shows how many were delivered, are retrying or ran out of attempts, with the typical and slowest response.
API · Console · Mail
Labels, in the API, the web client and IMAP
Apply and remove labels through /v1/labels or the web client, filter with label: in search, and see each label as a mailbox in your mail client.
API · Console
Search takes operators
Narrow a search with from:, to:, in:, is:unread, is:starred and has:attachment, and searching inside a folder searches that folder.
API
The inbox is in the API
List folders and their counts, page through conversations, search, and archive or move messages without a browser. GET /v1/mailboxes/changes returns what changed since your last cursor, deletions included.
API
Attachments can be uploaded before a send
POST /v1/attachments returns an id, and a send names the ids it carries.
API
Domains, routing and narrower keys through the API
Add a domain and get its DNS records in the same response, route addresses and set a catch-all through /v1/routing-rules, and have one key create a narrower key for each of your customers.
API · Console · Security
Each key names the addresses it reaches
A key reaches the addresses you choose at creation and nothing else. Addresses you own are private, the account owner cannot grant themselves access to them, and a person’s mail moves to somebody when they leave.
Console
Shared inboxes: read state per person, and an assignee per thread
Opening a message marks it read for you alone. In a shared inbox, each thread can be assigned to one person.
Console · Mail
Schedule a send, or snooze a message
Write a message now and set when it goes out; snooze one to have it come back to the inbox later. Both have their own folder.
Console
Workspaces with members and invitations
Invite people to your workspace by email and give them a role. An invitation works only for the address it was sent to.
API
The API is described by a published OpenAPI document
/openapi.json is generated from the schemas the API uses, so it cannot drift from what the API does.
API
Webhooks arrive in about a second
Deliveries go out as soon as the event happens instead of waiting for a timer, with signed requests and retries.
Mail
IMAP and SMTP, with app passwords
Connect Apple Mail, Thunderbird or any other client to read, file and send. Each device gets its own app password for one address, which cannot sign in to the web app.
SDK
The TypeScript SDK is on npm
npm install @pidgeon-ai/sdk for a typed client and a webhook signature verifier.
API
The first public API: send, receive, webhooks and an event log
Keyed, versioned, idempotent and rate-limited under /v1, sending through Amazon SES, with a signed webhook for every event.