All MCP Servers
ProductivityMCP Registrynpm66 toolsA · 80

Mailoo - Email MCP Server

io.github.Bitfloo · Updated

Email MCP server for AI agents: IMAP/SMTP, Gmail, Outlook, calendar, ManageSieve, AI triage, OAuth2.

At a glance

Mailoo - Email MCP Server is an MCP server in the Productivity category. It runs locally over stdio via `npx -y @bitfloo/mailoo`, and needs MCP_EMAIL_ADDRESS, MCP_EMAIL_IMAP_HOST, MCP_EMAIL_SMTP_HOST, MCP_EMAIL_PASSWORD and MCP_EMAIL_OAUTH2_CLIENT_SECRET. It exposes 66 tools, including osascript, notify-send and paplay. It scores A (80/100) on the MCP Skills Hub health score as of Oct 28, 2026.

Source 0GitHub stars

One-click install

Opens your editor and pre-fills the config. Your editor will ask before adding it.

How to install Mailoo - Email MCP Server in your AI client

Setup for Claude Code, Claude Desktop, Cursor, Codex, Windsurf, Cline and VS Code — copy-paste ready.

How to install Mailoo - Email MCP Server in Claude CodeAnthropic's agentic CLI

  1. Add the server

    bash
    claude mcp add mailoo -e 'MCP_EMAIL_ADDRESS=<MCP_EMAIL_ADDRESS>' -e 'MCP_EMAIL_PASSWORD=<MCP_EMAIL_PASSWORD>' -e 'MCP_EMAIL_IMAP_HOST=<MCP_EMAIL_IMAP_HOST>' -e 'MCP_EMAIL_SMTP_HOST=<MCP_EMAIL_SMTP_HOST>' -e 'MCP_EMAIL_OAUTH2_CLIENT_SECRET=<MCP_EMAIL_OAUTH2_CLIENT_SECRET>' -- npx -y @bitfloo/mailoo
  2. Fill in your credentials

    Replace <MCP_EMAIL_ADDRESS>, <MCP_EMAIL_PASSWORD>, <MCP_EMAIL_IMAP_HOST>, <MCP_EMAIL_SMTP_HOST>, <MCP_EMAIL_OAUTH2_CLIENT_SECRET> with your real values. Keep secrets out of any config file you commit.

  3. Verify it's connected

    bash
    claude mcp list
  4. Sharing it with your team?

    Add `--scope project` to write it to .mcp.json in the repository root, which you can commit (with the secrets left as environment variables).

  5. Use it in a session

    Ask Claude to use the tools this server exposes (e.g. osascript, notify-send, paplay). It discovers them automatically.

What does Mailoo - Email MCP Server need from you?

API key — Password or app password. Required unless MCP_EMAIL_OAUTH2_PROVIDER is set.

  • MCP_EMAIL_ADDRESSrequiredEnvironment variable

    Email address. Required for the environment-variable account.

  • MCP_EMAIL_PASSWORDoptionalsecretEnvironment variable

    Password or app password. Required unless MCP_EMAIL_OAUTH2_PROVIDER is set.

  • MCP_EMAIL_IMAP_HOSTrequiredEnvironment variable

    IMAP server hostname.

  • MCP_EMAIL_SMTP_HOSTrequiredEnvironment variable

    SMTP server hostname.

  • MCP_EMAIL_ACCOUNT_NAMEoptionalEnvironment variable

    Account name. Defaults to default.

  • MCP_EMAIL_FULL_NAMEoptionalEnvironment variable

    Display name on sent mail.

  • MCP_EMAIL_USERNAMEoptionalEnvironment variable

    Login username. Defaults to the email address.

  • MCP_EMAIL_IMAP_PORToptionalEnvironment variable

    IMAP port. Defaults to 993.

  • MCP_EMAIL_IMAP_TLSoptionalEnvironment variable

    Set to false to turn off implicit IMAP TLS. Defaults to true.

  • MCP_EMAIL_IMAP_STARTTLSoptionalEnvironment variable

    Set to true to upgrade IMAP with STARTTLS. Defaults to false.

  • MCP_EMAIL_IMAP_VERIFY_SSLoptionalEnvironment variable

    Set to false to skip IMAP certificate verification. Defaults to true.

  • MCP_EMAIL_IMAP_DISABLE_IMAP4REV2optionalEnvironment variable

    Set to true to force IMAP4rev1 SEARCH.

  • MCP_EMAIL_SIEVE_HOSToptionalEnvironment variable

    ManageSieve hostname. Defaults to the IMAP host.

  • MCP_EMAIL_SIEVE_PORToptionalEnvironment variable

    ManageSieve port. Defaults to 4190.

  • MCP_EMAIL_SMTP_PORToptionalEnvironment variable

    SMTP port. Defaults to 465.

  • MCP_EMAIL_SMTP_TLSoptionalEnvironment variable

    Set to false to turn off implicit SMTP TLS. Defaults to true.

  • MCP_EMAIL_SMTP_STARTTLSoptionalEnvironment variable

    Set to true to upgrade SMTP with STARTTLS. Defaults to false.

  • MCP_EMAIL_SMTP_VERIFY_SSLoptionalEnvironment variable

    Set to false to skip SMTP certificate verification. Defaults to true.

  • MCP_EMAIL_SMTP_POOL_ENABLEDoptionalEnvironment variable

    Set to false to disable SMTP connection pooling. Defaults to true.

  • MCP_EMAIL_SMTP_POOL_MAX_CONNECTIONSoptionalEnvironment variable

    Maximum pooled SMTP connections. Defaults to 1.

  • MCP_EMAIL_SMTP_POOL_MAX_MESSAGESoptionalEnvironment variable

    Maximum messages per pooled SMTP connection. Defaults to 100.

  • MCP_EMAIL_OAUTH2_PROVIDERoptionalEnvironment variable

    OAuth2 provider: google, microsoft, or custom. Configure custom in the config file: an account in the environment replaces the config file, so custom set here has no token_url or auth_url.

  • MCP_EMAIL_OAUTH2_CLIENT_IDoptionalEnvironment variable

    OAuth2 client id.

  • MCP_EMAIL_OAUTH2_CLIENT_SECREToptionalsecretEnvironment variable

    OAuth2 client secret.

Pass secrets through your shell environment rather than committing them into a config file.

What tools does Mailoo - Email MCP Server expose? (66)

Taken from the project's README — the server itself was not queried, so check its docs for the exact schemas.

What the code can do

Read from the published package source — never executed. Parsed 80 of 122 source files.

This server can run other programs on your machine, read and write files and make network requests.

How it was published

  • Published by a verified CI identity (github trusted publishing) rather than a personal token.
  • Has a provenance attestation tying this artifact to the commit it was built from.
  • 1 npm maintainer — a single point of compromise · last published by GitHub Actions.

Maintainer of this package and think something here is wrong? Tell us and we'll correct it.

Before you install

Signals gathered from the source repo and package registry — not a safety verdict.

What it can reach

  • Runs code on your machine — Executes as a local process with your user's permissions, including filesystem access.
  • Downloads at launch — The package is fetched from its registry each run unless you pin a version.
  • Last commit today — Actively maintained.
  • Repository created 1 month ago — Very new project with little track record yet.
  • 0 GitHub stars — Very little community usage so far.

Client compatibility

Claude Code: NativeClaude Desktop: NativeCursor: NativeCodex CLI: NativeWindsurf: NativeCline: NativeVS Code: Native

Health score

A · 80

Maintenance, adoption, transparency and packaging — not a safety audit. How this is calculated

  • Maintenance30%100%

    Last commit 0 days ago.

  • Adoption20%0%

    0 stars.

  • Transparency20%100%

    4/4: ✓ public source repo, ✓ declared license, ✓ documentation, ✓ discoverable tool list.

  • Provenance15%100%

    Package and registry entry point at the same repository.

  • Packaging15%100%

    Publishes a pinned version (0.3.1).

Documentation

Full README

Mailoo

Mailoo (@bitfloo/mailoo) is a Model Context Protocol (MCP) server for email (IMAP/SMTP), calendar, reminders, and ManageSieve automation developed and maintained by Bitfloo.

Enables AI assistants and autonomous agents to read, search, send, manage, schedule, and analyze emails, calendars, Reminders, and ManageSieve filter scripts across multiple accounts. Exposes up to 57 tools (with full, core, and minimal toolset profiles), up to 7 prompts, and 6 resources over MCP with outputSchema / structuredContent, OAuth2 support _(experimental)_, email scheduling, calendar extraction, analytics, provider-aware label management, real-time IMAP IDLE watcher with AI-powered triage, customizable presets and static rules, ManageSieve filters, and a guided setup wizard.

Behaviour for Sent copies, IMAP4rev2, Sieve, attachment savePath, read-only side effects, and reconnect backoff is documented in `docs/configuration.md` and `docs/tools.md`.

Highlights

| Feature | In this tree | |---------|:------------:| | Multi-account IMAP/SMTP | ✅ | | Send / reply / forward (with dryRun preview) | ✅ | | Drafts & templates | ✅ | | Provider-aware labels & bulk ops | ✅ | | Schedule future emails | ✅ | | Real-time IMAP IDLE watcher | ✅ | | AI triage with presets | ✅ | | Desktop & webhook alerts | ✅ | | Calendar (ICS, Apple Calendar/Reminders) | ✅ | | Email analytics | ✅ | | OAuth2 (Gmail / M365) | ✅ _experimental_ | | Guided setup wizard | ✅ | | ManageSieve (server-side filters) | ✅ | | Sender auth headers (SPF/DKIM/DMARC) | ✅ | | Toolset profiles (full / core / minimal) & GBNF small-LLM ergonomics | ✅ | | MCP outputSchema & structuredContent | ✅ |

Table of Contents

  • Highlights
  • Security & Sandboxing Architecture
  • LLM Ergonomics & Toolset Profiles
  • Docs
  • Background
  • Install
  • Usage
  • Capabilities & data flows
  • API
  • Maintainers
  • Contributing
  • Attribution & License

Security & Sandboxing Architecture

Policy and how to report a vulnerability: [SECURITY.md](SECURITY.md).

Mailoo is engineered with defense-in-depth sandboxing so AI agents can safely interact with untrusted mail and external servers:

  • Zero Shell Execution (`execFile` only) — Native OS integrations (macOS osascript for Calendar/Reminders/notifications, Linux notify-send, Windows powershell, and crontab installation) invoke child_process.execFile with strict argument arrays (shell: false), eliminating command injection vectors.
  • SSRF & DNS-Rebinding Protection (`net.BlockList`) — Outbound alert webhooks validate URLs against an IPv4/IPv6 net.BlockList covering loopback, RFC 1918 private ranges, link-local/cloud metadata (169.254.169.254, 100.100.100.200), CGNAT, NAT64, 6to4, and reserved prefixes both at configuration time and at socket connection time (createWebhookConnectLookup), preventing DNS-rebinding attacks (src/safety/validation.ts).
  • Symlink-Free Write Containment (`savePath`) — Attachment and .eml exports via savePath are strictly confined to the working directory, walk every path segment with lstat, refuse hidden dotfiles and OS persistence directories (Library/LaunchAgents, .ssh, .gnupg), and open targets with O_CREAT | O_EXCL | O_NOFOLLOW under a 50 MiB cap (5 MiB inline base64 cap). An .eml export is capped by its own size; an attachment by its encoded size in the message, which for base64 runs above the file size (details).
  • Prompt Injection Fencing (`<<<UNTRUSTED_EXTERNAL_CONTENT>>>`) — Untrusted email subjects, sender headers, message bodies, previews, and authentication results are wrapped in <<<UNTRUSTED_EXTERNAL_CONTENT>>> … <<<END_UNTRUSTED_EXTERNAL_CONTENT>>> delimiters (stripping any forged markers inside the payload) so LLMs treat external mail as data, not instructions.
  • Strict Credential File Permissions (`0600`) — config.toml is written and verified with mode 0600 inside a 0700 config directory ($XDG_CONFIG_HOME/mailoo/config.toml). Passwords and message bodies are redacted from the JSONL write audit log (src/safety/audit.ts).
  • TLS & STARTTLS Verification — tls enforces implicit TLS with certificate verification (verify_ssl = true by default); starttls fails closed if the server does not advertise STARTTLS. Turning both off is accepted only for a loopback host. ManageSieve refuses AUTHENTICATE PLAIN over unencrypted sockets without STARTTLS.
  • Operational Guardrails (`MCP_EMAIL_READ_ONLY`, `MCP_EMAIL_TOOLSET`, `dryRun`) —
  • MCP_EMAIL_READ_ONLY=true disables all write tools, background watchers, hooks, and schedulers at startup, exposing only the 31 read-only tools.
  • MCP_EMAIL_TOOLSET=full|core|minimal scopes the registered tool surface to match the agent's capability tier and context budget.
  • dryRun: true on high-risk tools (send_email, reply_email, forward_email, send_draft, delete_email, bulk_action, delete_mailbox, sieve_put_script, sieve_delete_script) validates all parameters and account resolution and returns a [DRY RUN] preview without modifying server state.
  • Per-Account Rate Limiting — rate_limit (default 10 sends/minute) enforces an independent token bucket per account (src/safety/rate-limiter.ts). Buckets live in memory, so each server process and each mailoo scheduler check run counts on its own.

LLM Ergonomics & Toolset Profiles

Mailoo is designed to work across both frontier models (Claude, GPT, Gemini) and local/small 3B–8B parameter models (llama.cpp GBNF grammars, Ollama, vLLM):

Excerpt — the full document is on GitHub.

Maintain Mailoo - Email MCP Server? Add a badge to your README

Shows its health grade, and links readers to install steps for every client.

markdown
[![Mailoo - Email MCP Server on MCP Skills Hub](https://mcp-skills-hub.vercel.app/badge/io-github-bitfloo-mailoo)](https://mcp-skills-hub.vercel.app/mcps/io-github-bitfloo-mailoo)

Catalog data refreshed . Something wrong? Report it.