mailmcp-distCAUTION
All your mailboxes in ChatGPT and Claude: self-hosted email MCP server (Gmail, Outlook, iCloud, any IMAP/SMTP). Passwords stay yours.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
mailmcp
All your mailboxes in ChatGPT and Claude. Passwords stay yours.
<a href="https://vercel.com/new/clone?repository-url=https%3A%2F%2Fgithub.com%2Fkojott%2Fmailmcp-dist&env=MAILMCPKEY,MAILMCPLICENSE,MAILMCPINVITECODE&envDescription=MAILMCPKEY%3A%2032%20random%20bytes%20as%20base64url.%20MAILMCPLICENSE%3A%20your%20key%2C%20or%20empty%20for%20the%20free%20tier.%20MAILMCPINVITECODE%3A%20the%20code%20your%20users%20type%20on%20%2Fsetup.&envLink=https%3A%2F%2Fmailmcp.ai%2Fstart&project-name=mailmcp&repository-name=mailmcp">
mailmcp is a self-hosted MCP server that gives ChatGPT, Claude and other MCP clients access to your e-mail over IMAP and SMTP: several mailboxes at once, any provider, attachments in both directions. This repository is the prebuilt distribution (minified bundles in dist/, no build step) under a commercial licence; it runs as a free tier without a key. The source code is not provided.
Ask "What came in from accounting this week?" and get one answer across Gmail, iCloud and the company mail server: the invoice as a download link, a reply already drafted.
64fe937a793fOBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mailmcp-dist --env MAILMCP_KEY=${MAILMCP_KEY} -- npx -y [email protected]{
"mcpServers": {
"mailmcp-dist": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"MAILMCP_KEY": "${MAILMCP_KEY}"
}
}
}
}Trust audit
CAUTIONgrade B · trust 88/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (2 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (16)
${yt(t.error)}`);let r=t.data,o=new Set;for(let i of r.accounts){if(o.has(i.id))throw new Error(`Duplicate account id: ${i.id}`);o.add(i.id)}for(let i of r.accounts){if(i.capabilities.send_host_only&&HEALTHCHECK --interval=30s CMD wget -qO- http://127.0.0.1:8080/health || exit 1
var Ss=Object.defineProperty;var Os=(e,t)=>{for(var r in t)Ss(e,r,{get:t[r],enumerable:!0})};import{readFile as qu}from"node:fs/promises";var ur="mmc1";function Q(e){let t="";for(let r of e)t+=String.hono
- Every server that issues user tokens without a licence key (free tier) now enforces **10 sends per hour per mailbox** itself. This is not limited to mailmcp.ai: your own copy running Free in token m
- **Outlook.com and Microsoft 365 mailboxes**, through a Microsoft sign-in and Microsoft Graph instead of a password over IMAP/SMTP. The setup page offers "Sign in with Microsoft" for the provider Out
- Signature with a photo or logo without putting it into the token: tick "signature from my mailbox" on the setup page and keep the signature as the newest message in the mailbox folder `mailmcp-signa
What to tell your users: at most **three** Outlook mailboxes per token; the consented Microsoft permissions follow the capabilities they tick (`Mail.Read` for read-only, otherwise `Mail.ReadWrite` and
**Upgrading to 0.13.** Nothing has to be configured. Server copies now send the daily usage statistics described above unless you set `MAILMCP_NO_STATS=1`. Existing tokens keep protection Off until yo
dist/node.js
dist/server.js
dist/stdio.js
- **Protection levels: existing tokens and configurations stay Off.** A configuration without a level behaves as before and `list_accounts` reports it as `set: false`. New mailboxes on /setup start at
On Vercel: open the project → **Settings → Environment Variables** → add `MAILMCP_INVITE_CODE` for **Production** → save, then deploy 0.8.0 (or **Deployments → ... → Redeploy** if the update is alread
- A Microsoft sign-in is good for **about 90 days**; the date is shown on `/setup` and returned by `list_accounts` as `reauth_by`. A client that refreshes its connection through our own OAuth (claude.
Gates applied: no_behavioural_pass.
64fe937a793ffull audit observations/trust-audit/mcp-server/kojott__mailmcp-dist.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 64fe937a793f | CAUTION | B | 88 | first audit |
Questions
What is the mailmcp-dist MCP server?
All your mailboxes in ChatGPT and Claude: self-hosted email MCP server (Gmail, Outlook, iCloud, any IMAP/SMTP). Passwords stay yours.
Is mailmcp-dist safe to connect to an agent?
With care. The audit graded it B (88/100) and found 16 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does mailmcp-dist need?
It reads MAILMCP_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does mailmcp-dist run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as mailmcp-dist at 0.13.11.
How current is this page?
The grade is for one exact copy of the source (64fe937a793f), read on 2026-10-12. The repository is watched and re-audited when it changes.