proton-mail-mcp

An MCP server that lets an AI assistant read your Proton Mail, write drafts and tidy your mailbox, with a preview you approve before mail is moved, deleted or sent. It runs on your own computer, under the same login as Proton Mail Bridge, and listens only on 127.0.0.1.

proton-mail-mcp is unofficial and is not affiliated with or endorsed by Proton AG.

What it does

• Search and read. Search and count mail, read whole threads, and read or save attachments. Nothing gets marked as read.
• Write drafts. Create new drafts, replies and forwards. A draft stays unsent until you send it.
• Clean up. Move, archive, trash, mark read or unread, add or remove labels, unsubscribe, delete drafts and run folder rules (beta), each after a preview you approve.
• Send, if you turn it on. Sending is off by default, and there is no way to send without a saved draft and an approval.
• Show mail in the chat. Clients that support MCP Apps get a thread view, a composer and a send review. Every other client gets the same results as text.

It also keeps a private local index of mail headers so that searches stay fast. The index holds no message bodies.

How it keeps your mail safe

Reading changes nothing. Search and read open mailboxes read-only and never mark mail as seen.

Changes to your mail take two steps.

1. Preview. The assistant asks what a change would do, and nothing changes yet. It shows you the count, samples and target, and gets a token: single use, short-lived and bound to exactly those messages. Before acting, the server checks them again and refuses if anything differs. New mail never slips into an approval.
2. Confirm. Your MCP client shows a form with the exact change, and you accept or decline. A token alone is not enough, and declining retires it. The form is only as good as the client: a client that answers forms automatically defeats this check.

Permanent deletion only ever reaches approved messages in Drafts; removing a label expunges only that label's copy. There is no tool to empty Trash, or to delete or rename a mailbox. Every write call goes into an append-only audit log, which holds no message bodies, subjects, full addresses or tokens.

Sending

Set PROTON_MCP_ENABLE_SEND=1 to add the send tools, plus PROTON_MCP_SEND_FROM (the addresses you send from) and PROTON_BRIDGE_CERT (Bridge's certificate); previews refuse without them.

There is no free-form send: the path is create_draft, then preview_send, then send_draft, and any edit after the preview refuses. A client with a form shows you one. On a client that declares no form, the assistant shows you a plain summary and sends after you type OK in chat. The server cannot prove that a human typed the OK: only the assistant reports it, so a misled assistant could send without asking. PROTON_MCP_SEND_TYPED_OK=0 turns this path off. How approvals work has the details.

Mailbox changes have no typed OK. A client without a form is refused, unless you deliberately set PROTON_MCP_CONFIRM_MUTATIONS=0, which lets the token alone authorize a change.

Protected senders

PROTON_MCP_PROTECTED_CONFIG can name a local list of senders that cleanup, unsubscribe, draft deletion and rules must not touch. No list ships with the project, so by default mail from a bank or a friend can be approved like any other. The list checks who sent the mail being acted on, never who a draft is addressed to. See Protected senders.

Off by default

On by default: the confirmation form, the typed OK once sending is on, the MCP Apps views and index recovery at startup. Configuration has the setting for each.

Install

You need:

• A paid Proton plan, which Bridge requires.
• Linux (Debian/Ubuntu, Fedora/RHEL or Arch) or macOS, with Homebrew unless Bridge is already installed. Native Windows support is new and has run only on Windows Server runners: read docs/windows.md first, or use WSL2.
• uv, which brings Python 3.12 or newer if you have none, and git.

Not on PyPI yet. Install from a clone of this repository, as below. On PyPI the package will be mcp-proton-mail, run as uvx mcp-proton-mail, but do not run that by name yet: until the first release is published, anyone could hold that name on PyPI. Its command is proton-mail-mcp, also installed as mcp-proton-mail. A listing in the MCP Registry comes later.

1. Get the code.

git clone https://github.com/legalaspro/proton-mail-mcp.git
cd proton-mail-mcp

Or unpack an archive of the repository you were given and run the rest there.

2. Quit the Proton Mail Bridge app if it runs, and turn off its start-at-login setting. Setup runs Bridge as a background service, which cannot run beside the app; the app's login carries over. To keep using the app instead, add --skip-bridge-service below.

3. Run the guided setup in your own terminal, naming your MCP client:

uvx --from . proton-mail-mcp setup --client claude-desktop
# or claude-code, chatgpt, codex, gemini, cursor, grok-bot; repeatable

It shows what it will do, asks its questions, prints the full plan and changes nothing else before you approve it (--dry-run stops after the plan). The one exception: when Bridge is installed but setup does not know your account yet, it first offers, at a [Y/n], to open Bridge's CLI so you log in to Bridge. It checks or installs Bridge, stores the Bridge password and a new bearer token in your system's credential store, starts per-user services, checks that the server reads your inbox, and adds the server to your client, keeping a backup of its config. Most clients start proton-mail-mcp connect, which reads the token itself, so their config holds none. The token is never shown. Rerunning it is safe. If it stops on Debian or Ubuntu because python3-venv is missing, run sudo apt-get install python3-venv, or add --managed-python after uvx.

Only you can do these, and setup says when:

• Log in to Bridge, if it is not logged in yet: setup opens Bridge's CLI, where you type login, your Proton email and password and the two-factor code, and open any verification link it prints in a browser. Pasting works. Setup then reads your IMAP username from Bridge.
• Type the Bridge password at a hidden prompt: the one Bridge's info (or the Bridge app) shows, not your Proton password. That is why setup runs in your own terminal.
• On macOS, allow Keychain access when asked: choose Always Allow.
• Restart your client at the end, as setup says.

4. Check it. Ask your assistant which Proton Mail tools it has; it should name tools such as search_mail.

uvx --from . proton-mail-mcp configure-client --client <name> adds another client later, and Connect an MCP client has a page for each client and covers the others. An AI agent setting this up for you follows llms-install.md: it does everything else and hands you only the Bridge login, as one command for your own terminal.

Documentation

• New here: Getting started walks through a first session.
• Setting up: Install, Connect an MCP client, Configuration and Windows.
• Looking something up: Tool reference and Results, refusals and limits.
• Understanding it: How approvals work, and the documentation map for every page.
• What changed: Changelog.

On PyPI these relative links do not resolve; read them in the repository.

For AI assistants and coding agents

• An assistant connected to this server needs nothing from this repository: the server gives it its instructions and tool descriptions when it connects.
• An assistant reading about this project can start at llms.txt, an index of these docs in Markdown.
• An assistant installing it for someone follows llms-install.md, which hands the person the one step only they can do.
• A coding agent changing this repository should read AGENTS.md.

License

Apache-2.0.