Gmail MCP Server
Gmail inbox access with granular permission scoping and local credential encryption.
Data last scanned today · Reviewed today
Overview
Gmail MCP Server serves as a demonstration for connecting AI assistants like Claude to email accounts while prioritizing security and user control. It implements a model where the AI receives specific, limited access to Gmail functions rather than broad account control, ensuring it cannot delete messages or modify sensitive account settings. The server emphasizes safe interaction patterns, such as separating the drafting of emails from the final send action. By requiring an explicit, deliberate step for sending mail, it prevents automated actions from occurring as unintended side effects. Credentials are encrypted locally on the user's machine, keeping authentication data off external servers.
Our verdict
This server carries a high risk level with a security score of 22/100. The score reflects that the project is community-maintained rather than vendor-official and lacks an identified license. Given these factors and the high-sensitivity nature of Gmail account access, it is best suited for developers interested in testing experimental, scoped integration patterns rather than for routine use in high-stakes environments.
- Uses zero direct dependencies to minimize supply-chain surface area
- Implements local, encrypted storage for user authentication credentials
- Structurally prevents the AI from accessing Trash, Spam, or Archive
- Provides documented logic for managing sensitive email-sending actions
- Lacks a defined open-source license for legal clarity
- Maintained by a single contributor with a limited bus factor
- No official vendor backing or editorial security review
- Zero GitHub stars suggests very limited community testing or usage
Tools
| Tool | Description | Risk |
|---|---|---|
| gmail_search | Search messages with Gmail search syntax | low |
| gmail_read_message | Fetch one message's full body | low |
| gmail_list_recent | Fast metadata/snippet fetch for periodic triage | low |
| gmail_create_draft | Create a draft (never sends) | medium |
| gmail_send_draft | Send a previously created draft | high |
| gmail_apply_label | Attach a custom (non-system) label | medium |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| ChatGPT | ||||
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf |
Frequently asked questions
›What are the specific Gmail permissions requested by this server?
The server requests three narrow permissions: reading mail, drafting or sending mail, and applying labels to messages.
›How are my Google account credentials stored?
Once you authorize, your credentials are encrypted on your local computer using an encryption key you generate and store in a local .env file.
›Can the AI delete or archive my emails?
No, the server is structurally blocked from accessing or modifying built-in Gmail controls such as Trash, Spam, or Archive.
›Is it possible for the AI to send an email automatically?
No, the server treats drafting and sending as separate steps, requiring an explicit user request for the final send action to occur.
›What are the system requirements for running this server?
You need Python 3.10 or higher and the uv package manager to sync and run the project.
›Can I use this with multiple Gmail accounts?
Yes, you can add additional accounts by following the steps outlined in the project's add_gmail_account.md workflow documentation.
Badge
Maintain this server? Add the live badge to your README.