Atlas / MCP servers / arose26 / mbox-mcp

mbox-mcpSAFE

mcp/arose26/mbox-mcp

Search local email archives (.mbox/.eml) entirely on your machine. No OAuth, no cloud.

Verdict
SAFE
Grade
B
Trust score
89 /100
Exposed tools
3 3r · 0w · 0d
Transport
stdio
License
MIT
Stars
0
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

An MCP server for local email archives. Point it at a Google Takeout .mbox export or a folder of .eml files and ask Claude things like:

  • "Who did I email most in this archive?"
  • "Find the message where the landlord mentioned the lease renewal."
  • "Summarize my correspondence with [email protected] from early 2026."

Everything stays on your machine. No OAuth, no app passwords, no IMAP connection, no cloud. Every other email MCP server connects to a live account — this one reads the archive files you already have, which is exactly what you want for the 15 years of Gmail sitting in a Takeout export.

Quick start

Claude Code

claude mcp add mbox -- npx -y mbox-mcp

Claude Desktop — add to claude_desktop_config.json:

{
"mcpServers": {
"mbox": {
"command": "npx",
"args": ["-y", "mbox-mcp"]
}
}
}

Then: "Open C:\\Takeout\\Mail\\All mail Including Spam and Trash.mbox and tell me about it."

Tools

Built for large archives

A Takeout mbox is often multiple gigabytes with 100k+ messages. The design reads the minimum, lazily:

  • Streaming index — one pass in 8 MiB chunks, recording byte offsets; only the current message's first 16 KiB is ever held for envelope parsing (sender, subject, date, RFC 2047 decoding).
  • Full MIME on demand — reading a message parses just that message (postal-mime: nested multipart, charsets, quoted-printable/base64). Attachments are listed with names and sizes, never dumped into context.
  • Honest body search — body_query o
Read from source at commit be81f6e7ea66OBSERVED · 2026-10-12
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code (npm)
claude mcp add mbox-mcp -- npx -y [email protected]
03

Exposed tools (3)

3 read · 0 write · 0 destructive.

ToolRiskDescription
get_messageread
open_archiveread
search_messagesread
04

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
none-observed
Shell
none-observed
Dependencies
not all pinned
Secrets in source
none-found

Findings (2)

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
package.json
@modelcontextprotocol/sdk, postal-mime, zod, typescript, vitest, @types/node
Why it matters. 6 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
README.md:9
**Everything stays on your machine.** No OAuth, no app passwords, no IMAP connection, no cloud. Every other email MCP server connects to a live account — this one reads the archive files you already h
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine

Gates applied: no_behavioural_pass.

Audited 2026-10-12 · audit v0.4.1 · source sha be81f6e7ea66full audit observations/trust-audit/mcp-server/arose26__mbox-mcp.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-12be81f6e7ea66SAFEB89first audit
06

Questions

What is the mbox-mcp MCP server?

Search local email archives (.mbox/.eml) entirely on your machine. No OAuth, no cloud.

What tools does mbox-mcp expose?

3 in total: 3 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is mbox-mcp safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.

What credentials does mbox-mcp need?

No credential environment variables were found in its source, so it appears to need none.

How does mbox-mcp run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as mbox-mcp at 0.1.1.

How current is this page?

The grade is for one exact copy of the source (be81f6e7ea66), read on 2026-10-12. The repository is watched and re-audited when it changes.

Advertisement