---
title: "CrewAI"
description: "Give the agents of a CrewAI crew the Nextmail tools, through the local bridge and one sign-in."
url: "https://nextmail.sh/docs/mcp/frameworks/crewai"
area: "MCP server"
category: "Frameworks and tools"
---

# CrewAI

Give the agents of a CrewAI crew the Nextmail tools, through the local bridge and one sign-in.

## Install

**Packages**

_pip_

```bash
pip install crewai mcp
```

CrewAI runs on Python 3.10 to 3.13. Its agents call OpenAI unless you give them another model, so set `OPENAI_API_KEY` or pass `llm`.

## Sign in once

**Terminal**

```
npx @nextmail/cli login
```

Choose the browser sign-in. On the approval page, pick the workspace, the access, the addresses the crew may reach and how long the approval lasts. Read only is the default, and it leaves out tools such as `sendEmail`, `replyToEmail` and `createDraft`, so choose Read and send when the agent should draft or reply. The sign-in is saved on this machine and listed in Account → Command line, where you can narrow it or remove it. A sign-in the bridge has not used for 7 days, or one whose approval has ended, has to sign in again.

On a server or over SSH, add `--no-browser`: open the link on any device, approve, and paste the code it shows back into the terminal. A browser sign-in needs a person once, so a CI job cannot make one.

> The MCP server takes an approved sign-in and never an API key. A key sent to it gets `401`, with a `WWW-Authenticate` header that points at the OAuth metadata. Code that holds a key calls the REST API or an SDK instead.

## Run a crew

**Python**

```
from crewai import Agent, Crew, Task
from crewai.mcp import MCPServerStdio
from crewai.mcp.filters import create_static_tool_filter

mailbox = MCPServerStdio(
    command="npx",
    args=["-y", "@nextmail/cli", "mcp", "serve"],
    tool_filter=create_static_tool_filter(
        allowed_tool_names=["whoAmI", "listThreads", "getThread"]
    ),
)

reader = Agent(
    role="Inbox reader",
    goal="Know what is waiting in the inbox",
    backstory="You read mail carefully and never send anything.",
    mcps=[mailbox],
)

summary = Task(
    description="Summarise my unread mail.",
    expected_output="One line per conversation: who wrote, what they want, and whether it needs a reply.",
    agent=reader,
)

print(Crew(agents=[reader], tasks=[summary]).kickoff())
```

The framework starts the local bridge, `npx -y @nextmail/cli mcp serve`, as a stdio MCP server. The bridge sends each call to the MCP server with your saved sign-in and renews the access token when it runs out, so the agent never handles a token. To use another profile of the command line, add `--profile <name>` to the arguments. The bridge runs on Node.js 20.12 or later.

- `mcps` on an agent takes `MCPServerStdio`, which starts the bridge and loads its tools for that agent.
- `create_static_tool_filter` matches the names the server lists. CrewAI then puts the server name in front of each tool it hands the agent.

## What the agent can do

The server registers up to 600 tools, and the crew sees the ones both your role and the approval allow. A tool the approval leaves out is never listed, so the model never tries it. Every tool loaded is sent to the model on each turn, so give the agent the ones its job needs. The example starts from `whoAmI`, `listThreads` and `getThread`.

| Tool | What it does | Access it needs |
| --- | --- | --- |
| `whoAmI` | The role you hold in the active workspace, and every permission it grants | None |
| `listThreads`, `getThread` | List conversations with filters, and read the latest message of one | Read only |
| `waitForEmail` | Wait up to 60 seconds for a message that matches, such as a sign-in code | Read only |
| `createDraft` | Save a draft without sending it, as a reply when given a thread | Read and send |
| `replyToEmail`, `sendEmail` | Reply inside a thread, or send a new email | Read and send |
| `modifyLabels` | Add or remove labels on conversations | Read and send |

> The MCP server never asks before a tool acts, so a tool that sends or deletes does it at once. A few tools make a change the REST API guards with a verification code, such as creating a rule or removing a domain, and the bridge cannot ask for a code. Run `npx @nextmail/cli verify` in a terminal with the same profile, or choose Allow changes for 60 minutes on this sign-in in Account → Command line, and those tools run for the next 60 minutes.

## Why the bridge

The MCP support in CrewAI’s open-source library sends static headers and runs no OAuth sign-in. An access token pasted into `headers` stops working within the hour, while the bridge renews its token by itself, so a crew connects through the bridge.

## Related

- [CrewAI](https://nextmail.sh/agents/crewai.md): The CrewAI page: what an agent can do with a mailbox on Nextmail, and prompts to try.
- [What it can reach](https://nextmail.sh/docs/mcp/scope.md): How your role and the approval decide the tool list.
- [Tools](https://nextmail.sh/docs/mcp/tools.md): All 600, grouped by what they are for.
- [The local bridge](https://nextmail.sh/docs/cli/ai-and-mcp.md): How `mcp serve` forwards calls, renews tokens and reports refusals.