OutlookSAFE
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A Model Context Protocol (MCP) server that provides access to Microsoft Outlook email functionality, allowing LLMs and other MCP clients to read, search, and manage emails through a standardized interface.
Features
- Folder Management: List available mail folders in your Outlook client
- Email Listing: Retrieve emails from specified time periods
- Email Search: Search emails by contact name, keywords, or phrases with OR operators
- Email Details: View complete email content, including attachments
- Email Composition: Create and send new emails
- Email Replies: Reply to existing emails
Prerequisites
- Windows operating system
- Python 3.10 or later
- Microsoft Outlook installed and configured with an active account
- Claude Desktop or another MCP-compatible client
Installation
- Clone or download this repository
- Install required dependencies:
pip install mcp>=1.2.0 pywin32>=305
- Configure Claude Desktop (or your preferred MCP client) to use this server
Configuration
Claude Desktop Configuration
Add the following to your MCP_client_config.json file:
{
"mcpServers": {
"outlook": {
"command": "python",
"args": ["Your path\\outlook_mcp_server.py"],
"env": {}
}
}
}Usage
Starting the Server
You can start the server directly:
python outlook_mcp_server.py
Or allow an MCP client like Claude Desktop to start it via the configuration.
Available Tools
The server provides the following tools:
list_folders: Lists all available mail folders in Outlooklist_recent_emails: Lists email titles from the specified number of dayssearch_emails: Searches emails by contact name or keywordget_email_by_number: Retrieves detailed content of a specific emailreply_to_email_by_number: Replies to a specific emailcompose_email: Creates and sends a new email
Example Workflow
- Use `list_folders
a2eb0d481db8OBSERVED · 2026-10-08Exposed tools (6)
6 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
compose_email | read | |
get_email_by_number | read | |
list_folders | read | |
list_recent_emails | read | |
reply_to_email_by_number | read | |
search_emails | read |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (2)
mcp, pywin32
Gates applied: no_behavioural_pass, no_license.
a2eb0d481db8full audit observations/trust-audit/mcp-server/wallisking1991__outlook.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | a2eb0d481db8 | SAFE | B | 89 | first audit |
Questions
What tools does Outlook expose?
6 in total: 6 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Outlook safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Outlook need?
No credential environment variables were found in its source, so it appears to need none.
How current is this page?
The grade is for one exact copy of the source (a2eb0d481db8), read on 2026-10-08. The repository is watched and re-audited when it changes.