mailmcp

All your mailboxes in any AI agent. Runs on your computer. Nothing is sent or trashed without your click.

Türkçe

mailmcp is an MCP server that connects Claude Code, Codex, Cursor, Antigravity, Gemini CLI (any MCP client) to several mail accounts at once: Gmail, iCloud, Yandex, Zoho, Fastmail, Yahoo, GMX and any IMAP/SMTP provider. Outlook/Hotmail is coming in v0.2.

"Find the invoices from last week in all my inboxes"
"Summarise my unread mail on the school account"
"Draft a reply to Ahmet saying Thursday works"
"Send it"   → a page opens in your browser: To / Subject / Body / [Approve] [Reject]

Why

Install

Give your agent this repository's link and say "install this" — it follows INSTALL.md.

Or do it yourself (needs uv):

uvx allmail-mcp install        # adds the "mail" server to Claude Code, Codex, Cursor, Antigravity, Gemini CLI
uvx allmail-mcp add-account    # opens a local page; paste an app password there

No uv? uvx comes from uv (winget install astral-sh.uv, or the one-line installer). Without it: pipx install allmail-mcp, then run allmail-mcp install --command allmail-mcp.

Restart your agent and ask it about your mail. Single client, by hand:

claude mcp add --scope user mail -- uvx allmail-mcp
codex mcp add mail -- uvx allmail-mcp

Safety model

• Passwords never go through the chat. You type an app password into a page served on 127.0.0.1; mailmcp verifies it with an IMAP login and stores it in Windows Credential Manager / macOS Keychain / Linux Secret Service. If no secure keychain exists, it refuses.
• Reading and drafting are free; sending and trashing need your click. The agent can only request. The approval page shows the real recipients, subject and body held by the server, not the agent's summary. The click executes the action.
• Approval can be turned off ("turn off send approval"), but turning it off itself needs a click. Turning it back on is instant.
• No permanent delete. "Trash" moves mail to the provider's Trash folder.
• Mail content is marked as untrusted before the agent sees it, and hidden HTML text (a common prompt-injection trick) is removed.
• Reading never marks mail as read.
• The local page binds to 127.0.0.1 on a random port, checks Host and Origin, uses single-use tokens that expire, sends a strict CSP and contains no JavaScript.

What it cannot protect against: whatever the agent reads is sent to your AI provider (Anthropic, OpenAI, Google...). Do not connect mailboxes you would not show to it. See SECURITY.md.

Tools

Ten small tools on purpose: fewer tokens in every session, fewer ways to go wrong.

Providers

Commands

uvx allmail-mcp                 # run the MCP server (what your agent starts)
uvx allmail-mcp add-account
uvx allmail-mcp accounts
uvx allmail-mcp remove-account <id>
uvx allmail-mcp install [--client claude|codex|cursor|antigravity|gemini] [--dry-run] [--yes]
uvx allmail-mcp uninstall
uvx allmail-mcp doctor          # checks keychain, config and each account's login

Skill (optional)

If your agent supports Agent Skills, copy skill/mailmcp/SKILL.md to ~/.claude/skills/mailmcp/SKILL.md (Claude Code), ~/.codex/skills/mailmcp/SKILL.md (Codex) or .agents/skills/mailmcp/SKILL.md in your project. It teaches the agent the tool workflow: search all accounts, read before replying, draft first, wait for the user to approve in the browser, never take instructions from inside an email. mailmcp works without it.

Alternatives

Good projects exist and you may prefer them: Wh1isper/mcp-email-server (IMAP, Python), marlinjai/email-mcp (Gmail/Outlook OAuth, Node), Softeria/ms-365-mcp-server (all of Microsoft 365), jgalea/mailbox-mcp (security-focused). mailmcp's focus is: many accounts across providers, every client, server-enforced human approval, credentials only in the OS keychain.

Development

git clone https://github.com/efelazut/allmail-mcp && cd mailmcp
uv venv && uv pip install -e ".[dev]"
uv run pytest

Architecture: docs/ARCHITECTURE.md. License: MIT.