imap-mcpYour mailbox as tools, without a way to send

Find the mail, read it, file it — every message fenced as untrusted content, and the write tools off unless you turn them on

Get started

Tools reference

GitHub

Mail is evidence, not instruction
Anyone in the world can send you mail, so every body arrives fenced between BEGIN/END UNTRUSTED EMAIL CONTENT markers carrying a random nonce, with that nonce repeated on every line inside. Text outside those markers is the only text this server wrote.
It knows what is new
list_new_messages tracks what the assistant has already seen with its own IMAP keyword, so "anything new?" has an answer that does not depend on whether you have read the mail yourself — and reading it here does not mark it read in your client.
Only the tools you want
IMAP_READ_ONLY=true registers the read tools and nothing else. IMAP_ALLOW_TOOLS cuts finer — essential for a curated handful, your own comma-separated list, or a whole family with list_* — and IMAP_DENY_TOOLS subtracts. Whatever is filtered out does not exist on the protocol rather than failing when called, and a name that matches no tool stops the server at startup instead of quietly going missing.
Safe by default
Destructive tools need a server-issued confirmation token, upstream content is marked untrusted, and read-only mode simply does not register the write tools.

The server holds no state of its own beyond short-lived confirmation tokens; what the assistant has seen lives in the mailbox, as a keyword.

What it looks like

A terminal session: listing the tools registered under the read-only default, listing an inbox, then reading a phishing message — which comes back with the injection shapes named before anything else, the body fenced line by line with a per-call nonce, and the tracking beacon defused

Four calls against a throwaway mailbox. The last two are the point: the message asks the assistant to forward the inbox to a stranger and carries a tracking pixel, and both arrive labelled as what they are rather than acted upon. The recording is reproducible — docs/demo.tape and docs/demo-seed.mjs build the mailbox from scratch, and nothing in it comes from a real account.

imap-mcpYour mailbox as tools, without a way to send

Mail is evidence, not instruction

It knows what is new

Only the tools you want

Safe by default

What it looks like ​

What it looks like