tuta_statusLABSCO SUMMARY
The limits are structural, not runtime checks.
Reply-only mode does not block sending at call time — tuta_mail_send is simply never registered, so the model cannot see a tool it is not allowed to use, and the same applies to a disabled module. That is the reason to pick this over a general mail bridge. Two things to decide before you install: which of the three mail modes you want, since folder confines everything to one folder and forces reply-only, and whether TUTAMCP_TRUST_REQUIRE_E2E stays at its default of 1, which is what stops a spoofed From header from counting as a trusted sender.
What it is
An MCP server for a Tuta account. Four modules — mail, calendar, contacts and drive — are enabled independently, and it works through tutaproxy's TutaClient rather than calling the Tuta API directly, so decryption happens where Tuta expects it.
What you get
- Mail read and organised: folders, listing without bodies, full reads with decrypted body and attachment metadata, attachment download, move, delete, mark, labels —
tuta_mail_list_folders,tuta_mail_list,tuta_mail_read,tuta_mail_get_attachment,tuta_mail_move,tuta_mail_mark,tuta_mail_apply_labels - Sending under a policy you set:
tuta_mail_replyderives recipients from the original mail only, andtuta_mail_sendis registered only when the mode allows new threads - Calendar events over a date range, created with optional RRULE recurrence, updated and deleted —
tuta_calendar_list_events,tuta_calendar_create_event,tuta_calendar_update_event,tuta_calendar_delete_event - Contacts searched by name, company or email, and the full CRUD around them —
tuta_contacts_list,tuta_contacts_get,tuta_contacts_create,tuta_contacts_update,tuta_contacts_delete - Drive listing, download, upload, folders, rename, move and delete —
tuta_drive_list,tuta_drive_download,tuta_drive_upload,tuta_drive_mkdir - A trust signal on every message:
tuta_mail_listandtuta_mail_readreturntrusted_senderande2e, andonly_trusted=Truefilters the list to trusted senders - A status tool that reports version, enabled modules, mail mode and send policy —
tuta_status
Requirements
A Tuta account, plus tutaproxy-public — Docker is the documented path and bundles it at build time; without Docker you need Python 3.11 and a local clone of tutaproxy. Credentials go in a chmod 600 file as TUTA_EMAIL and TUTA_PASSWORD, with TUTA_TOTP_SECRET added when the account has a second factor. Version floors matter: tutaproxy ≥ v1.3.10 in general, and ≥ v1.3.15 for the 2FA login challenge. Behaviour is set by environment variables — TUTAMCP_ENABLE_MAIL, TUTAMCP_MAIL_MODE (dedicated, shared or folder), TUTAMCP_MAIL_SEND, TUTAMCP_OWNER_EMAIL, TUTAMCP_DOWNLOAD_DIR. Drive requires a paid Tuta account.
Setup effort
Run a container — build the image from the repository, then point your client at it
USE CASES
01
Letting an assistant work an inbox for you
Enable mail in shared mode so it can read and organise, with sending limited to replies on existing threads.
02
Running an account that belongs to the agent
Use dedicated mode, where the account is the agent's own and sending new mail is enabled by default.
03
Handling incoming commands safely
Filter to trusted senders and keep the end-to-end requirement on, so only mail that really came from your address is acted on.
04
Booking and moving appointments
List a date range, then create or update the event including recurring series.
05
Pulling a file out of the account
Walk the drive by path and download into the configured download directory.
31 tools
Listed in project docs. Your client may show a different list.
tuta_mail_list_folderstuta_mail_listtuta_mail_readtuta_mail_get_attachmenttuta_mail_sendtuta_mail_replytuta_mail_movetuta_mail_deletetuta_mail_marktuta_mail_folder_createtuta_mail_folder_renametuta_mail_folder_deletetuta_mail_list_labelstuta_mail_apply_labelstuta_calendar_list_eventstuta_calendar_create_eventtuta_calendar_update_eventtuta_calendar_delete_eventtuta_contacts_listtuta_contacts_gettuta_contacts_createtuta_contacts_updatetuta_contacts_deletetuta_drive_listtuta_drive_downloadtuta_drive_uploadtuta_drive_mkdirtuta_drive_renametuta_drive_movetuta_drive_deleteBEFORE YOU INSTALL
What to know first
Tools you get
31 tools named in the project's documentation.
Requires
- Docker (or Python 3.11 and a local clone of peix2/tutaproxy-public)
- A Tuta account: TUTA_EMAIL and TUTA_PASSWORD in a chmod 600 credentials file
Optional
TUTA_TOTP_SECRET in your environment
INSTALLATION
Connect your client
MCP Clients
Claude Code — Docker
CLAUDE CODE — DOCKER · TERMINAL
git clone https://github.com/peix2/tutamcp-public.git
cd tutamcp-public
docker build -t tutamcp .CLAUDE CODE — DOCKER · JSON
{
"mcpServers": {
"tutamcp": {
"command": "docker",
"args": [
"run",
"--rm",
"-i",
"-v",
"<YOUR_TUTAMCP_CREDENTIALS_FILE>:/creds.env:ro",
"-e",
"TUTAMCP_CREDENTIALS_FILE=/creds.env",
"-e",
"TUTAMCP_ENABLE_MAIL=1",
"-e",
"TUTAMCP_MAIL_MODE=dedicated",
"-e",
"TUTAMCP_OWNER_EMAIL=<YOUR_TUTAMCP_OWNER_EMAIL>",
"tutamcp"
]
}
}
}Create the credentials file first (chmod 600) with TUTA_EMAIL and TUTA_PASSWORD — plus TUTA_TOTP_SECRET if the account uses two-factor login — ; <YOUR_TUTAMCP_CREDENTIALS_FILE> in the block is its full path.
Claude Code without Docker, Claude Desktop
TERMINAL
git clone https://github.com/peix2/tutamcp-public.git
cd tutamcp-public
pip install --target=.venv/lib/python3.11/site-packages -r requirements.txtJSON
{
"mcpServers": {
"tutamcp": {
"command": "python3.11",
"args": [
"<YOUR_PATH_TO_TUTAMCP_PUBLIC>/run.py",
"<YOUR_PATH_TO_TUTAMCP_PUBLIC>/server.py"
],
"env": {
"TUTAPROXY_PATH": "<YOUR_TUTAPROXY_PATH>",
"TUTAMCP_CREDENTIALS_FILE": "<YOUR_TUTAMCP_CREDENTIALS_FILE>",
"TUTAMCP_ENABLE_MAIL": "1",
"TUTAMCP_MAIL_MODE": "dedicated",
"TUTAMCP_OWNER_EMAIL": "<YOUR_TUTAMCP_OWNER_EMAIL>",
"TUTAMCP_DOWNLOAD_DIR": "/tmp/tutamcp"
}
}
}
}This route also needs a local clone of tutaproxy-public (https://github.com/peix2/tutaproxy-public): <YOUR_TUTAPROXY_PATH> is the full path of that folder, and <YOUR_PATH_TO_TUTAMCP_PUBLIC> the full path of the tutamcp-public folder. Create the credentials file first (chmod 600) with TUTA_EMAIL and TUTA_PASSWORD — plus TUTA_TOTP_SECRET if the account uses two-factor login — ; <YOUR_TUTAMCP_CREDENTIALS_FILE> in the block is its full path.
