Imap MCP Server
Email message organization via IMAP for AI agents with granular OAuth 2.1 authorization.
Data last scanned today · Reviewed today
Overview
Imap MCP Server functions as a multi-tenant bridge, enabling AI agents to interact with email accounts through IMAP protocols. Users can perform operations including searching, reading, moving, deleting, and modifying message status while maintaining distinct permission sets for each AI assistant.
Our verdict
With a high-risk security score of 30/100, this project is recommended only for users comfortable with community-maintained software that has not undergone an independent editorial review. While the author emphasizes security-first design, the single contributor bus-factor and lack of wide adoption necessitate caution for anyone integrating it with sensitive personal or professional email accounts.
- Zero direct dependencies reduces supply-chain attack surface
- Implements Postgres Row-Level Security for tenant isolation
- Uses OAuth 2.1 with PKCE for agent authentication
- Credentials are envelope-encrypted using AES-256
- High risk level due to community-maintained status
- No independent security or editorial audit conducted
- Single-contributor project with zero GitHub stars
Tools
| Tool | Description | Risk |
|---|---|---|
| list_accounts | List every IMAP account linked to this tenant (id, display name, host, status) | low |
| list_mailboxes | List all mailboxes/folders in one account, or every linked account if account is omitted | low |
| search_messages | Search a mailbox by subject, sender, unread status, and/or date, in one account or every linked account | low |
| read_message | Fetch full message content (sanitized HTML, attachment metadata only) | low |
| create_mailbox | Create a new mailbox/folder | medium |
| move_message | Move a message between mailboxes within the same account | medium |
| mark_message | Mark a message read or unread | medium |
| trash_message | Move a message to Trash (soft delete, not permanent expunge) | medium |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| ChatGPT | ||||
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf |
Frequently asked questions
›What are the system requirements for running the server?
The server requires JDK 21 and Docker for local deployment of Postgres and Redis.
›Is OpenBao required for local development?
No, an in-process encryption stand-in is used during local development, so a full OpenBao instance is not required.
›How does the server handle IMAP credentials?
Credentials are encrypted at rest using AES-256 via an OpenBao Transit engine and are never stored in plaintext.
›How do agents gain access to my email?
Agents connect through an OAuth 2.1 authorization-code flow with PKCE, requiring your explicit consent for specific, least-privilege scopes.
›Can I restrict what an AI agent is allowed to do?
Yes, access is enforced via granular scopes like read, write, or delete; an agent granted read access cannot perform delete operations.
›How are multiple user accounts kept separate?
The server uses Postgres Row-Level Security to ensure tenant isolation, making one user's data invisible to others even at the database level.
Alternatives
Badge
Maintain this server? Add the live badge to your README.