mcp-proton-email

Disclaimer. This project was implemented by Claude (Fable and Opus) to meet my own requirement: a safe way to give an LLM access to my Proton Mail. I co-developed and reviewed it to a standard I'm comfortable using with my own mailbox through Claude Code — but that is my judgement, not a guarantee of security. Review it and decide for yourself before trusting it with your mail. I'm sharing it so others don't have to build their own from scratch, or can use it as a starting point.

— Alex

A safe-by-default MCP server that gives Claude access to your Proton Mail through Proton Mail Bridge's localhost IMAP/SMTP. Runs entirely on your Mac — your mail never touches any third-party server, and your credentials live in Proton Pass.

Built on the principle that no tool should exist that a prompt-injected email could exploit:

• Sending is OFF by default, and even when enabled, every single send requires your click on an approval prompt — the model cannot approve itself, and there is no configuration to bypass this.
• No delete tool exists. The most destructive operation is a reversible move to Trash; permanent deletion stays in the Proton apps, with you.
• Email content is untrusted. Bodies and attachments are reduced to plain text and wrapped in a marker telling the model to treat them as data, never instructions. The server contains no HTTP client — nothing can be fetched.
• Everything that changes state is audited to a local log (no message bodies), and reading mail never marks it as read.

Tools

Category	Tools	Default
Read	search_messages, get_message, get_thread, list_folders, list_message_attachments, get_attachment_text (in-memory text from text/HTML/PDF/ics)	on
Draft	create_draft, update_draft, create_reply_draft, create_forward_draft — stored in Proton's Drafts folder, editable in the Proton apps	on
Organize	move_message, archive_message, move_to_trash, add_label, remove_label, mark_read/mark_unread, star_message/unstar_message, create_folder, create_label	on
Attachments	save_attachment — writes only inside an allowlisted download directory, path-traversal safe	on
Send	send_email, reply, reply_all, forward — each gated by a human approval prompt	off
Diagnostics	connection_status, runtime_status, get_audit_log	on

Where next

• Installation — Bridge, pass-cli, the Agent vault, and registering with Claude Code or the Desktop app.
• Configuration — every PROTONMCP_* variable, the three profiles, and how to enable send.
• Tools reference — all 29 tools: parameters, capability gates, and safety notes.
• Security model — the threat model and what is deliberately impossible.
• Troubleshooting — symptoms and fixes.
• Changelog — release notes.

Multiple Proton accounts

Add every account's Bridge username to PROTONMCP_USERNAMES (comma-separated). Each account has its own Bridge password in its own Proton Pass item — by default the item title is the account's username, or set PROTONMCP_PASS_ITEMS (parallel to USERNAMES) to name them explicitly. Every tool takes an optional account selector (defaulting to the first username), so you can read, draft, and organize per account. Each account authenticates with its own credentials and only ever sends as its own addresses.

claude mcp add --scope user proton-mail \
  --env PROTONMCP_USERNAMES=you@example.com,work@company.com \
  --env PROTONMCP_PASS_ITEMS=proton-bridge-personal,proton-bridge-work \
  -- uvx mcp-proton-email

To send from more than one account, list each sending address in PROTONMCP_SEND_FROM (the allowlist stays authoritative — it is never expanded implicitly). runtime_status shows each account and the Pass item it resolves to (never the secret).

Limitations

• Your Mac must be on — Claude reaches Proton only through this machine.
• No OCR: image-only/scanned PDFs yield no extracted text (save_attachment still works on them). Office formats (docx/xlsx) are not extracted.
• forward / create_forward_draft carry the message text, not its attachments.
• Permanent deletion is deliberately impossible — use the Proton apps. (The one expunging operation is update_draft, which replaces the previous version of the draft it edits.)