The send tool has a TTL of zero, so there is no blanket approval — each send raises a native prompt showing the literal recipients and subject, and your fingerprint is the line between drafted and sent. Around that: the daemon refuses to start if any registered tool lacks an explicit policy entry, screen lock or an idle timer zeroes the in-memory session, and the audit log keeps recipients literal while scrubbing secrets. One trade-off is stated plainly rather than buried — decrypted message bodies are cached in SQLite as plaintext with a TTL, recoverable from an imaged disk until purged.
A signed and notarized macOS bridge between Proton Mail and Claude, running entirely on your Mac. 34 MCP tools cover reading, searching, organizing, drafting, sending and calendar reading; reads are served from a local SQLite mirror, and everything that changes state is deny-by-default and biometrically gated.
- Reading and searching from the local mirror: list, full-text search, read a message, reconstruct a thread, list attachments, list labels and folders, and sync — `mail_list`, `mail_search`, `mail_read`, `mail_read_thread`, `mail_list_attachments`, `mail_sync`
- Organizing: mark read or unread, move, label and trash — `mail_mark_read`, `mail_mark_unread`, `mail_move`, `mail_label`, `mail_trash`
- Drafts, created, updated, listed and deleted — `mail_draft_create`, `mail_draft_update`, `mail_draft_list`, `mail_draft_delete`
- Sending in every shape, each re-prompting: send, reply, reply-all, forward and send-draft — `mail_send`, `mail_reply`, `mail_reply_all`, `mail_forward`, `mail_send_draft`
- Attachments decrypted, downloaded and saved to disk — `mail_download_attachment`, `mail_save_attachment`
- Calendar, read-only: list calendars, browse and search events by date range, and read full event detail — `calendar_list`, `calendar_events`, `calendar_read_event`
- Per-tool policy in one YAML file — decision, rate limit and allowed recipients, plus an idle-lock timer and a cached-body TTL
macOS 13 or newer, and a Proton account — setup signs you in with your Proton password, 2FA and key unlock. Install with `brew install --cask proto-mcp`, then `protonmcp setup`, which backfills the local mirror, installs the background daemon and connects Claude Desktop and Claude Code; it is safe to re-run as a repair. `protonmcp doctor` checks each piece and names the one command that fixes what is broken. After a cask upgrade, run `protonmcp daemon restart`. Building from source needs Go 1.26.5 or newer and Xcode Command Line Tools. GPLv3.
One command — brew install --cask proto-mcp