---
title: "OpenClaw"
description: "Connect OpenClaw to a mailbox on Nextmail, with its own MCP registry and an OAuth sign-in."
url: "https://nextmail.sh/docs/mcp/frameworks/openclaw"
area: "MCP server"
category: "Frameworks and tools"
---

# OpenClaw

Connect OpenClaw to a mailbox on Nextmail, with its own MCP registry and an OAuth sign-in.

## Add the server

**Terminal**

```
openclaw gateway stop
openclaw mcp add nextmail --url https://api.nextmail.sh/mcp --transport streamable-http --auth oauth
openclaw mcp login nextmail
openclaw gateway start
```

Run these where OpenClaw is installed. Adding a server and signing in from the terminal need the Gateway stopped, and `--transport streamable-http` matters: without it OpenClaw connects over SSE.

`login` prints a link and waits for your browser. Sign in, pick the workspace, the access, the addresses OpenClaw may reach and how long the approval lasts, and approve. When the browser runs on another machine and cannot reach the callback, copy the `code` from the address it was sent to and pass it with `openclaw mcp login nextmail --code <code>`. The Control UI can do the same under Settings → MCP, where Sign in starts the approval for a server that uses OAuth.

## Keep the tool list short

The server registers up to 600 tools, and OpenClaw sees the ones both your role and the approval allow. With the Gateway stopped, `openclaw mcp tools` keeps it to the ones you name, and `openclaw mcp doctor nextmail --probe` connects and reports what the server offers.

**Terminal**

```
openclaw mcp tools nextmail --include 'whoAmI,listThreads,getThread,createDraft,replyToEmail,sendEmail'
```

- OpenClaw is listed in Account → Connected apps, where you can narrow what it reaches or remove it.
- The MCP server never asks before a tool acts, so a tool that sends or deletes does it at once.
- A tool that needs a verification code is refused, because OpenClaw cannot ask you for one. Choose Allow changes for 60 minutes on OpenClaw in Account → Connected apps when it has to make such a change.

## Or reuse the command line sign-in

OpenClaw can start the local bridge instead of signing in itself. Sign in once with `npx @nextmail/cli login` on the same machine, then, with the Gateway stopped, add the server as a command. Remove that sign-in with `npx @nextmail/cli logout`.

**Terminal**

```
openclaw mcp add nextmail --command npx --arg -y --arg @nextmail/cli --arg mcp --arg serve
```

## Related

- [OpenClaw](https://nextmail.sh/agents/openclaw.md): The OpenClaw page: what an agent can do with a mailbox on Nextmail, and prompts to try.
- [What it can reach](https://nextmail.sh/docs/mcp/scope.md): How your role and the approval decide the tool list.
- [Tools](https://nextmail.sh/docs/mcp/tools.md): All 600, grouped by what they are for.
- [The local bridge](https://nextmail.sh/docs/cli/ai-and-mcp.md): How `mcp serve` forwards calls, renews tokens and reports refusals.