MailSAFE
A lightweight Model Context Protocol (MCP) server that provides IMAP and SMTP email functionality for AI assistants like Claude in Cursor IDE. Built with TypeScript and optimized for easy deployment via npm/npx.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Give your AI assistant a local bridge to your email.
Search, read, organize, reply to, and send email through supported password- or app-password-based IMAP/SMTP accounts—from Claude, Cursor, Codex, and other MCP clients.
[](https://www.npmjs.com/package/mcp-mail-server) [](https://www.npmjs.com/package/mcp-mail-server) [](https://www.npmjs.com/package/mcp-mail-server) [](LICENSE)
English · 简体中文
Why this server · Quick start · Client setup · Tools · Configuration · Development
“Find the unread messages from Alice this week, summarize them, and move the finished thread to Archive.”
Why this server?
🔎 Find what mattersSearch across folders by sender, recipient, subject, body, date, read state, and reply state. ✉️ Act without leaving the conversationRead, send, reply, move, and delete messages using natural language.
📎 Work with attachmentsInspect metadata, download files, and send local attachments through explicit filesystem allowlists. 🔐 Keep controlRun locally, connect directly to your mail provider, verify TLS certificates, and enforce payload limits.
What can I ask?
cd2280b9ee4bOBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add mcp-mail-server -- npx -y [email protected]
{
"mcpServers": {
"mcp-mail-server": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (12)
7 read · 4 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
check_connection | read | Connect to IMAP when needed, actively verify SMTP, then return structured status for both services. |
continue_email_thread | read | Find the newest sent message with the same normalized subject, optionally narrowed by recipient and date, then continue its thread. Designed for recurring reports; reply-all and quoted history both default to true. |
delete_message | destructive | Permanently delete one existing mailbox-scoped message using targeted UID EXPUNGE. Fails safely when the UID is missing or the IMAP server lacks UIDPLUS, and returns a structured unknown outcome when a transport failure prevents confirmation. |
find_unreplied_messages | read | Find messages from a sender that have no thread-header reply in the sent mailbox. Messages without Message-ID are returned separately as unknown. |
get_message | write | Retrieve one message, including full bodies and attachment metadata. Set markSeen only when the message should be marked as read. |
get_messages | read | Retrieve multiple messages from one mailbox, including full bodies and attachment metadata. Fails if any requested UID is missing or the aggregate response-body budget would be exceeded. |
list_mailboxes | read | List all available mailboxes (folders). Auto-connects to IMAP when needed. |
move_message | write | Move an existing mailbox-scoped message to another existing mailbox. If a move, copy, or source-cleanup outcome cannot be confirmed, returns a structured partial error that must be inspected before retrying. |
reply_to_email | read | Reply to a mailbox-scoped message with threading headers, optional reply-all recipients, signature, and quoted original content. |
save_attachment | write | Save one or all attachments from a mailbox-scoped message into an allowed local directory. Select one attachment by zero-based index or exact filename. If a later write fails, returns the files already saved as a structured partial result. |
search_messages | read | Search one or more mailboxes with combined filters. Defaults to INBOX and the detected sent mailbox. Returns message summaries unless includeBody is true; full-body hydration fails explicitly if a selected message disappears or the aggregate response-body budget would be exceeded. |
send_email | write | Send a new email via SMTP and try to save a MIME-equivalent copy with the accepted Message-ID to the sent mailbox. |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (4)
delete_message
.prettierignore
.prettierrc.json
@modelcontextprotocol/sdk, imap, mailparser, nodemailer, zod, @eslint/js, @rollup/plugin-node-resolve, @rollup/plugin-terser
Gates applied: no_behavioural_pass.
cd2280b9ee4bfull audit observations/trust-audit/mcp-server/yunfeizhu__mail-1.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | cd2280b9ee4b | SAFE | B | 89 | first audit |
Questions
What is the Mail MCP server?
A lightweight Model Context Protocol (MCP) server that provides IMAP and SMTP email functionality for AI assistants like Claude in Cursor IDE. Built with TypeScript and optimized for easy deployment via npm/npx.
What tools does Mail expose?
12 in total: 7 read-only, 4 that write, and 1 that can delete or overwrite (delete_message). Every one is listed on this page with its risk.
Is Mail safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Mail need?
No credential environment variables were found in its source, so it appears to need none.
How does Mail run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as mcp-mail-server at 2.1.0.
How current is this page?
The grade is for one exact copy of the source (cd2280b9ee4b), read on 2026-10-08. The repository is watched and re-audited when it changes.