Configuration

All policy lives as environment variables in the MCP registration — there is no separate config file. Namespace: PROTONMCP_.

Variable	Default	Meaning
`USERNAMES`	— (required)	Bridge IMAP username(s), comma-separated; first is primary (singular `USERNAME` is accepted too)
`PASS_VAULT`	`Agent`	Proton Pass vault holding the Bridge password(s)
`PASS_ITEM`	`proton-bridge`	Item title for a single account
`PASS_ITEMS`	—	Per-account item titles, comma-separated parallel to `USERNAMES` (multi-account). If unset with multiple accounts, each account's item title defaults to its username
`PASS_CLI`	auto-discovered	Path to the pass-cli binary; set only if it lives somewhere unusual (discovery: this override → `PATH` → Homebrew → `~/.local/bin` → `~/.cargo/bin` → MacPorts)
`ALLOW_SEND`	`false`	Register send tools
`READ_ONLY`	`false`	Kill-switch: disables ALL mutation (drafts, organize, send, saves)
`SEND_FROM`	primary username	Allowlist of From addresses, comma-separated
`ATTACHMENT_DOWNLOAD_DIR`	`~/Downloads`	The only directory `save_attachment` may write into
`IMAP_HOST` / `IMAP_PORT`	`127.0.0.1` / `1143`	Bridge IMAP
`SMTP_HOST` / `SMTP_PORT`	`127.0.0.1` / `1025`	Bridge SMTP
`ALLOW_NON_LOOPBACK`	`false`	Refuse non-loopback hosts unless explicitly overridden (discouraged; TLS is then verified — see Security model)
`TLS_CA_FILE`	—	CA/cert to verify a non-loopback self-signed Bridge against (only used off-loopback)
`MAX_RESULTS`	`50` (cap 200)	Search result cap
`MAX_BODY_CHARS`	`50000` (cap 200000)	Body truncation
`MAX_ATTACHMENT_CHARS`	`20000` (cap 200000)	Extracted-text cap (source file ≤ 10 MB)

Profiles

Default (recommended start) — read, draft, organize, save attachments; no send tools exist:

claude mcp add --scope user proton-mail \
  --env PROTONMCP_USERNAMES=you@example.com \
  -- uvx mcp-proton-email

Read-only auditor — nothing can be modified at all:

claude mcp add --scope user proton-mail \
  --env PROTONMCP_USERNAMES=you@example.com \
  --env PROTONMCP_READ_ONLY=true \
  -- uvx mcp-proton-email

Fully trusted — everything enabled, and Claude Code doesn't prompt per tool call:

claude mcp add --scope user proton-mail \
  --env PROTONMCP_USERNAMES=you@example.com \
  --env PROTONMCP_ALLOW_SEND=true \
  --env PROTONMCP_SEND_FROM=you@example.com,alias@yourdomain.com \
  -- uvx mcp-proton-email

plus, in ~/.claude/settings.json, allowlist the tools so Claude Code stops asking permission for each call:

{
  "permissions": {
    "allow": ["mcp__proton-mail__*"]
  }
}

Even in this profile, every send still requires your click on the approval prompt. There is no flag to disable it — "fully trusted" means everything except self-approving sends.

Enabling send

Send tools don't exist until you opt in. Re-register with:

claude mcp add --scope user proton-mail \
  --env PROTONMCP_USERNAMES=you@example.com \
  --env PROTONMCP_ALLOW_SEND=true \
  -- uvx mcp-proton-email

Every send then pops an approval prompt in your MCP client showing from/to/subject and a body preview — the send happens only when you accept it (MCP elicitation). On clients that don't support elicitation, send tools refuse; by design there is no fallback a model could satisfy on its own. The From address must be in the allowlist (PROTONMCP_SEND_FROM, default: your username).