The allowlists are the design decision that matters: who the server may send to and whose mail it will read are set in a local UI, not negotiable by whatever is driving the model. Reading is metadata-first for the same reason it is cheaper — you fetch bodies for the handful of messages that turned out to matter.
An MCP server for real mailboxes over IMAP and SMTP, on Windows, macOS and Linux. Reading is deliberately two-stage — metadata first, bodies only for the ids you ask for — and the mailbox management surface covers flags, moves, archiving, deletion and attachments. Sending is gated by a recipient allowlist you configure outside the model. Accounts are set up through an authenticated local browser UI or the CLI; there is no MCP tool that adds an account, by design.
- The configured accounts as non-secret capability records, showing which can receive and which can send — `list_available_accounts`
- Message metadata — id, subject, sender, recipients, date — listed without pulling bodies, then full content including reply-thread headers for the ids you choose — `list_emails_metadata`, `get_emails_content`
- Mail sent from a named account with reply threading, or composed and saved into an IMAP folder such as Drafts instead — `send_email`, `save_to_mailbox`
- The recipient allowlist and the inbound sender allowlist readable before you try to use them — `list_allowed_recipients`, `list_allowed_senders`
- Messages marked read, flagged, moved between folders, archived to the RFC-detected Archive folder, or deleted by target-scoped UID expunge — `mark_emails_as_read`, `set_email_flags`, `move_emails`, `archive_emails`, `delete_emails`
- The account's folders with hierarchy delimiters, so a move targets a folder that exists — `list_mailboxes`
- Attachments downloaded to the working directory under a safe randomized name — `download_attachment`
Python 3.11 or later, IMAP credentials for reading and SMTP credentials if the account must send. Run `uvx mcp-email-server@latest stdio` from the client, and configure accounts first with the `ui` command: it binds to 127.0.0.1 on an ephemeral port and opens a one-time browser link. Credentials go into a private SQLite store on Linux and Windows, the system keyring on macOS, and never through the MCP connection or the chat. Two settings decide the blast radius: with no allowed recipients configured, sending is off; with no allowed senders, reading is unrestricted. Installations on PyPI 0.16.0 and earlier keep working in legacy mode, but they expose the older `add_email_account` tool that this version removes — drop it from prompts and allowlists before upgrading, and restart clients so they refresh the tool list.
One command plus a key — uvx mcp-email-server@latest stdio, then supply credentials