MCP has gone from a developer acronym to a line item in enterprise AI plans. Before it connects an assistant to your mailbox, it is worth knowing what it is, what can go wrong, and what a careful design does about it. The short version: MCP is a plug, not a safety system. Whether it is safe depends on everything built around it.
What MCP is, in plain words
An AI assistant on its own knows only what is in the chat. To look something up in your mail, it needs a way to ask your mail service. MCP is a common way to do that. There are two sides.
- The server belongs to the service. It publishes a list of tools, such as search mail or read a message, each with a description of what it does. XgenPlus also ties its tools to the permissions you give the agent.
- The client is the assistant application. It shows the model the tool list, lets the model choose a tool for your question, runs it, and gives the result back to the model to write the answer.
In ZenithAI, XgenPlus runs the MCP server for XgenPlus mailboxes, and ZenithAI is the client. XgenPlus Mail is the only connector available in ZenithAI today. We do not list others, because none is available yet.
Where the risks are for email
An assistant that can call tools is more useful than one that can only talk, and for the same reason it is riskier. ZenithAI’s wider security and governance controls sit around the connector, and it is one of the ready-made agents and use cases on a private deployment. These are the risks to weigh, and what a careful design does about each. The right-hand column describes how ZenithAI’s XgenPlus Mail connector handles it.
| Risk | What it means for email | What reduces it |
|---|---|---|
| A token that can do too much | Whoever holds the token acts as the agent, with its permissions | The token belongs to a separate agent password with its own permissions. You can pause or delete the agent at any time, and the change takes effect in about 10 seconds. Tick only the permissions you need |
| Tools that write | A tool that sends, moves or deletes mail can do damage if it is misused | In ZenithAI chat only read tools run. Tools that could send or change mail are listed in Settings, marked Read, Write or Destructive, but never offered to the chat |
| Tools that change under you | A server can add a tool or alter one you already accepted | A tool marked New or Changed stays off until you click Accept changes. Review what changed before you accept |
| Runaway use | A loop of calls, or a flood of text returned into the model | At most 12 tool calls and 45 seconds per answer, 20 seconds per call, 20,000 characters per result and 40,000 per answer. At most 60 tools on at once |
| Instructions hidden in an email | Mail is written by strangers. An email can contain text such as “ignore the user and do this”, and a model may follow it | Because the connector only reads, such text cannot make the assistant send, forward or delete mail. It could still steer which mail the assistant reads and how it words the answer, so check anything important in the email itself |
| Wrong people using it | Everyone in the company gets access by default | The administrator switch is off by default, with a “Who may use it” list. Each person connects with their own token, and the administrator never sees it |
The honest reading of the fifth row matters most. Prompt injection, as it is called, is an open problem across the whole field, not something one product has solved. Limiting what the assistant can do is one of the most important defences available today, and that is why read-only comes first.
Seven questions to ask any vendor offering an MCP connector
- Does it read only, or can it also send, delete or change? Can you see which, tool by tool?
- What can the token do, and can you pause or delete it at the source?
- What happens when the server adds or changes a tool after you approved it?
- Are there limits on calls, time and text returned for each answer?
- Where do the models that read your mail run?
- Is a copy of the mailbox kept, and for how long?
- What is recorded, and does the record hold the text of your mail?
For ZenithAI the answers are on the connector documentation page, and the data path is walked through in Can an AI assistant read your company email without sending it to the cloud?
When MCP is not the right tool
- You need a one-off analysis of an export. Upload the file to a normal chat instead of giving an assistant live access.
- You need a fixed, audited integration. A direct API integration that does exactly one thing may be easier to review than a general tool list.
- The server is young or unvetted. MCP servers vary widely in quality. Treat an unknown server like any new software with access to your mail.
- You are weighing personal-data duties. Read the DPDP checklist for AI email assistants first.
- You need the assistant to act. A read-only connector is by design the wrong fit. AI Inbox drafts replies for you to check and send.
Availability
The XgenPlus Mail connector went live on our servers on 31 October 2026. It is not in installer 4.6.0 and comes with the next installer. A server gets it when it is updated and the administrator switches it on. AI Inbox, mentioned here, is also not in installer 4.6.0.
Questions
What is MCP in AI?
MCP, the Model Context Protocol, is an open standard introduced by Anthropic in November 2024. It gives AI assistants a common way to connect to tools and data. A server publishes tools such as search mail or read a message, and the assistant application calls them to answer your question.
Is MCP safe for enterprise email?
MCP itself is a connection standard, not a safety system. Safety depends on the design: read-only tools, a narrowly scoped token you can pause, approval before tools change, limits on calls and text, and a record of use. ZenithAI's XgenPlus Mail connector is read only in chat.
What is prompt injection in email?
It is text inside an email, written by a stranger, that tries to give the assistant instructions. A model may follow it. A read-only connector limits the damage, because such text cannot make the assistant send, forward or delete mail, but it could still steer which mail is read and how the answer is worded.
Can an MCP connector send email on my behalf?
It can if the server offers send tools and the assistant is allowed to use them. ZenithAI's XgenPlus Mail connector cannot. Write tools are listed in Settings but are never offered to the chat, even if switched on.
Does ZenithAI support MCP servers other than XgenPlus Mail?
Not today. XgenPlus Mail is the only connector available in ZenithAI. It follows the MCP standard and is read only in chat. It went live on our servers on 31 October 2026 and comes to customers with the next installer.
To see the connector in action, request a demonstration, or get in touch.