Verified

Proton Safe MCP Server

Proton Mail draft creation and email searching via the Proton Mail Bridge.

Data last scanned today · Reviewed today

5813 tools★ 3PythonMIT

Overview

Proton Safe MCP provides a secure bridge between MCP-compatible clients and the official Proton Mail Bridge. It allows users to search their email inbox and generate new drafts, including those with attachments, while maintaining strict limitations on what an AI agent can perform on your mailbox. The server is built on FastMCP and operates entirely over STDIO for local communication. Designed with a focus on security, the project explicitly omits features that could be abused by prompt injection, such as the ability to send, delete, or move messages. Attachments are handled through bounded text extraction and base64 chunking, ensuring the server does not access client filesystem paths directly.

Our verdict

With a security score of 38/100, this server is currently classified as high risk. This rating reflects the fact that the project is community-maintained and has not yet undergone independent editorial review regarding its authentication methods or read-only status. While the implementation employs several technical safeguards—such as preventing direct SMTP sending—users should exercise caution given its status as an unverified third-party tool and the inherent risks of connecting AI models to sensitive email data.

Zero direct dependencies reduce the supply-chain attack surface.
Explicitly prohibits sending, deleting, or moving emails.
Uses strict typing with mypy and linting with Ruff.
Processes attachments through chunked streams rather than raw file access.

High-risk security score due to lack of editorial review.
Community-maintained project with no official vendor support.
Limited community engagement with only 3 GitHub stars.

Tools

Tool	Description	Risk
mailbox_status	Bridge connectivity and INBOX counts	low
list_folders	List available mail folders	low
list_sender_addresses	List the fixed From allowlist a draft may use	low
list_messages	List messages in a folder without marking them as read	low
search_messages	Perform an injection-safe IMAP TEXT search	low
read_message	Read message content as bounded plain text without retrieving attachment bytes	low
extract_attachment_text	Extract bounded text from PDF, TXT, or CSV attachments without returning raw bytes	low
get_reply_context	Get candidate reply recipients, Re: subject, and a bounded quote	low
begin_attachment_upload	Declare filename, type, size, and SHA-256 for an attachment upload	medium
upload_attachment_chunk	Upload ordered base64 chunks of an attachment	medium

Compatibility

Client	Local	Docker	Remote	Read-only
ChatGPT
Claude Desktop
Cursor
VS Code
Windsurf

Frequently asked questions

›Can this server send emails directly?

No, the server deliberately lacks an SMTP client and a send_message tool. All drafts must be reviewed and sent manually by the user within the Proton Mail interface.

›What are the system requirements for this server?

The server requires a Linux system with the official Proton Mail Bridge installed and running. It also requires a Proton plan supporting the Bridge, Python 3.11–3.14, and a compatible Secret Service keyring such as gnome-keyring.

›How does the server handle file attachments?

Attachments are processed via bounded text extraction or base64 chunking, and the server never receives or reads raw client filesystem paths. The server only accepts specific file types including PDF, DOCX, XLSX, PPTX, TXT, CSV, PNG, and JPEG.

›Is the Proton Mail Bridge host configurable?

No, the Proton Bridge host is hard-coded to 127.0.0.1 to maintain security, and the PROTON_BRIDGE_HOST environment variable is intentionally unsupported.

›Does the server have access to delete or move emails?

No, the server does not have tools for deleting, moving, or downloading raw received attachments. It is limited to reading, searching, and creating drafts.