protonmail-mcp
Provides tools to search, read, draft, send, and manage emails in Proton Mail via Proton Bridge.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@protonmail-mcpCheck my unread mail and summarize anything that needs a reply today"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
proton-mail-bridge-mcp
Give your AI coding agent access to your ProtonMail — search, read, draft, and send — from Claude Code, Claude Desktop, Cursor, or any MCP client.
"Check my Proton and tell me anything I need to deal with today." "Find Sarah's last email and draft a reply saying Thursday at 2pm works — don't send it yet."
Because Proton is end-to-end encrypted, there's no public mail API — so this talks to Proton
Bridge, the official local gateway Proton ships for exactly this. Everything stays on 127.0.0.1;
your decrypted mail never leaves your machine, and nothing here is a hosted service.
Quick start
The whole path, in order — about 10 minutes from scratch. Steps 1–3 are one-time prerequisites (mostly Proton's); the tool itself is the last two.
Have a paid Proton plan (Mail Plus / Unlimited). Free Proton can't do this — it's a Proton limit, not ours.
Install & connect Proton Bridge — download it, sign in to Proton (this opens a browser — that login is Proton's, not this tool), and wait until Bridge shows "Connected" and finishes its first sync. (details)
Install Node.js if you don't have it — check with
node -v. (details)Run the setup wizard. Open Bridge's Mailbox details and paste each value when asked (it tests the connection and saves):
npx proton-mail-bridge-mcp setupRegister it with your AI client (e.g. Claude Code):
claude mcp add protonmail --scope user -- npx -y proton-mail-bridge-mcpStart a fresh session in your client (MCP tools load at session start), then try it: "Search my Proton inbox and tell me what needs a reply."
The rest of this README is detail on each step.
Related MCP server: ProtonMail MCP Server
Before you start
Two prerequisites: Node.js (it provides the npx command everything below uses) and Proton Bridge.
1. Node.js 18+
First check whether you already have it — in a terminal:
node -v # prints something like v20.x → you're set, skip to Proton BridgeIf that says command not found, install Node. Pick one of these:
Quickest — no admin password, no website (macOS / Linux):
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash \
&& export NVM_DIR="$HOME/.nvm" && . "$NVM_DIR/nvm.sh" && nvm install --ltsWith Homebrew (macOS) — if you don't have brew yet, install it first (it asks for your Mac
password and may take a few minutes):
# 1) install Homebrew, then add it to your PATH (these two PATH lines are for Apple-Silicon Macs;
# the installer also prints the exact lines for your machine at the end):
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
echo 'eval "$(/opt/homebrew/bin/brew shellenv)"' >> ~/.zprofile && eval "$(/opt/homebrew/bin/brew shellenv)"
# 2) install Node:
brew install nodeWindows (PowerShell):
winget install OpenJS.NodeJSThen open a fresh terminal and confirm it worked: npx -v should print a version number.
2. Proton Bridge
Proton Bridge is Proton's official app that runs an IMAP/SMTP server on your machine so mail clients (and this tool) can reach your encrypted mailbox. Set it up first:
Download and install Bridge, then open it.
Sign in to your Proton account — this opens a browser window (that's Proton's login, nothing to do with this tool).
Wait until Bridge shows "Connected" and its first sync finishes — it re-reads its mailbox on startup and can take a few minutes. Trying to connect before it's synced fails.
Good to know:
Bridge requires a paid Proton plan (Mail Plus / Proton Unlimited). Free Proton accounts can't use Bridge, and therefore can't use this. That's a Proton limitation, not ours.
Bridge runs on macOS, Windows, and Linux (headless via
protonmail-bridge --clion servers).Bridge gives each account its own generated IMAP/SMTP username & password (in its Mailbox details panel) — you'll paste those into the setup wizard, not your normal Proton login.
Install
Quickest — run the setup wizard. It mirrors Bridge's Mailbox details panel field-for-field (paste each value using Bridge's copy buttons), tests reading and sending, and writes the config:
npx proton-mail-bridge-mcp setupThen register it with your MCP client, e.g. Claude Code:
claude mcp add protonmail --scope user -- npx -y proton-mail-bridge-mcp@latestFinally, start a fresh session in your client — MCP tools load when a session starts, so they won't appear in a session that was already open. Then ask it something like "search my Proton inbox and tell me what needs a reply."
That's it. Prefer to configure by hand instead of the wizard? Read on.
Manual configuration
Tell it how to reach Bridge — either environment variables or a config file.
Config file (~/.config/proton-mail-bridge-mcp/config.json):
{
"user": "you@proton.me",
"pass": "your-bridge-generated-password",
"imapPort": 1143,
"smtpPort": 1025,
"imapSecurity": "STARTTLS",
"smtpSecurity": "STARTTLS"
}Copy all of these from Bridge → your account → Mailbox details (the panel with IMAP and SMTP columns). Two things people get wrong:
Copy the password, don't type it. Use Bridge's copy button. A single mis-transcribed character (an
lvsI, anOvs0) fails as"no such user"— see Troubleshooting.Match the
Securityfield for each of IMAP and SMTP — they can differ. Bridge shows a Security value under both columns (STARTTLSorSSL), and on some setups IMAP is STARTTLS while SMTP is SSL. SetimapSecurity/smtpSecurityto exactly what Bridge shows, or sending can fail even though reading works.
Or environment variables: PROTONMAIL_USER, PROTONMAIL_PASS, PROTONMAIL_IMAP_PORT,
PROTONMAIL_SMTP_PORT, PROTONMAIL_IMAP_SECURITY, PROTONMAIL_SMTP_SECURITY. (See
config.example.json for every option, including downloadDir and readOnly.)
Check it works before wiring it into an agent:
npx proton-mail-bridge-mcp doctorThat connects to Bridge, authenticates, and lists your mailboxes — so any setup problem shows up here with a clear message instead of failing cryptically mid-conversation.
Other MCP clients
Any MCP client works — point it at the proton-mail-bridge-mcp command over stdio. For a JSON-config client
(Claude Desktop, Cursor, …):
{
"mcpServers": {
"protonmail": {
"command": "npx",
"args": ["-y", "proton-mail-bridge-mcp"],
"env": { "PROTONMAIL_USER": "you@proton.me", "PROTONMAIL_PASS": "…" }
}
}
}Tools
Deliberately small — eight, and only eight.
Tool | What it does | |
| Find messages by text / from / to / subject / date (no filter = your recent inbox) | read |
| Read one message in full (quoted history trimmed by default) | read |
| Save an inbound attachment to disk (into your download directory) | read |
| Compose a new email, saved to Drafts — never sends | write |
| Send a new email immediately | write |
| Reply to the sender, threaded and quoting the original | write |
| Reply to sender + everyone else (never you), threaded | write |
| Forward a message to new recipients, carrying its attachments | write |
Any outgoing tool (create_draft / send_message / reply / reply_all / forward) can:
send plain text (
body) or a formatted HTML email (html) — HTML messages get an auto-generated plain-text alternative so they render in any client, and replies quote the original as an HTML blockquote;attach local files by path — absolute, or relative to the working directory, so you can email a file straight out of the project you're working in (e.g.
attachments: ["./report.pdf"]).
reply / reply_all / forward send immediately unless you pass draft: true, which saves to
Drafts instead.
Signatures. Proton's own signature is a composer feature and isn't applied when sending over SMTP, so set one here to have it appended automatically — at the end of new mail, and above the quoted original on replies:
{
"signature": "Simon\nApexx Apps · apexx.app",
"signatureHtmlPath": "~/.config/proton-mail-bridge-mcp/signature.html"
}signature is plain text; signatureHtml (inline) or signatureHtmlPath (a file) supplies a formatted
HTML signature used on HTML emails. Set either or both — if only one is given, the other is derived.
signatureHtmlPath is live — the file is re-read on every send, so editing it changes what goes out
on your next email, no restart. Keep your signature in one HTML file and it stays in sync everywhere.
Emails are sent as HTML by default. Even when the agent composes plain text, the body is wrapped in
minimal HTML (with a plain-text alternative kept) so it renders in a normal proportional font everywhere
instead of monospace — and any formatted signature always appears. Set "plainText": true to send plain
text instead.
Missing-signature guard. If you've set a signatureHtmlPath and the file can't be read at send time
(moved, renamed, deleted), the tool refuses to send rather than quietly firing off an unsigned email —
with a clear message telling you to restore the file or fix the path. Set "requireSignature": false to
send-without instead of blocking. (No effect if you haven't configured a signature.)
Set "readOnly": true (or PROTONMAIL_READONLY=1) to register only the three read tools — a
hard guarantee the agent can never compose, send, reply, or forward, whatever the client's approval
settings.
Safety model
The tools that leave the building — send_message, reply, reply_all, forward — are named and
described so your MCP client's per-tool approval is the natural gate; searching, reading, and
downloading never prompt. Prefer drafting: create_draft (or draft: true on a reply/forward) lets
the agent write while you review in Proton and hit send yourself. For an unattended/headless setup,
run readOnly and there's simply nothing that can send. Downloaded attachments are confined to the
configured directory (filenames are basename-sanitised, so a crafted name can't escape it); outgoing
attachments read local files by path, so treat send/reply/forward as the trust boundary they
are.
On your phone
This is a local server, so it's reachable wherever your agent is. Pair the machine with BrainBoxx and you can do the whole thing from your pocket — "check my Proton and tell me what needs dealing with" on the train, replies drafted by the time you're home.
How it works
MCP client (Claude Code / Cursor / …)
│ MCP over stdio
▼
proton-mail-bridge-mcp ──IMAP──► 127.0.0.1:1143 ┐
│ ──SMTP──► 127.0.0.1:1025 ├─ Proton Bridge ──► Proton Mail
└── clean JSON in, tool calls out ┘ (local, TLS, your machine only)Bridge presents a self-signed cert on localhost (expected); this trusts it by default for
127.0.0.1. Set "allowSelfSigned": false to enforce full verification if you've given Bridge a
trusted cert.
Updating
If you registered it with @latest (as above), you get new versions automatically — npx
re-checks the registry for the newest version each time your MCP client starts the server. A running
session keeps its version (the server is a long-lived process), so just start a fresh session to
pick up a release. No manual step.
Rarely, if you try to install within a minute or two of a brand-new release, the registry may not have
propagated yet — you'll see a "no matching version" error or the old version. Wait a moment (or run
npm cache clean --force) and retry.
Prefer to pin a fixed version rather than track latest? Register it with an explicit version and update on your own schedule:
claude mcp add protonmail --scope user -- npx -y proton-mail-bridge-mcp@0.1.13Troubleshooting
Run npx proton-mail-bridge-mcp doctor first — it names the actual failure. Common ones:
no such user— Bridge reports every auth failure this way, including a wrong password. It almost never means the username is genuinely unknown. Re-copy both username and password from Bridge → Mailbox details (copy buttons, don't type), and double-check forl/IandO/0mix-ups.Reading works but sending fails — your SMTP
Securityis probablySSLwhile you've leftsmtpSecurityatSTARTTLS(or vice-versa). SetimapSecurity/smtpSecurityto exactly what Bridge shows under each column.too many login attempts— Bridge rate-limits repeated logins; it resets after a few minutes of quiet. Stop retrying, wait, try once. (Restarting Bridge also resets it.)Nothing connects /
connection refused— Bridge isn't running, or is mid-sync. Start it, let the first sync finish (the progress bar must reach 100%), then try.Just added the account and it won't authenticate — let the initial sync complete, and if it still refuses, quit Bridge fully and reopen it once.
Licence
MIT © 2026 Apexx Apps. Not affiliated with or endorsed by Proton AG.
Available Tools
8 toolscreate_draftA
Compose a new email and save it to Drafts. Does NOT send — you review and send it yourself in Proton. Can include local file attachments.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | ||
| to | Yes | Recipient address(es). | |
| bcc | No | ||
| body | No | Plain-text body. Provide this OR html. | |
| html | No | HTML body for a formatted email. A plain-text alternative is generated automatically. | |
| subject | Yes | Subject line. | |
| attachments | No | Local file paths to attach — absolute, or relative to the working directory (e.g. "./report.pdf" from the project you're in). A leading ~ is expanded. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral burden. It discloses the most critical behavioral trait: this tool does not send, only saves a draft. It also mentions local file attachment support. However, it doesn't detail other behaviors such as whether a draft confirmation is returned or how drafts are stored, but the key non-sending distinction from send_message is covered.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, each with a distinct purpose: the main action, the non-sending clarification, and the attachment capability. It is front-loaded with the primary function and contains no filler words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 7-parameter tool with no output schema and no annotations, the description covers the most important behavioral caveat (no sending) and the basic draft workflow. It does not explain return values, but that isn't required without an output schema. cc/bcc and html/body alternatives are left to the schema, which documents them adequately. Overall, it is complete for the core use case.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 71%, so the schema documents most parameters. The description adds minimal parameter-specific information beyond the schema—it only mentions 'local file attachments', which the schema already covers. cc and bcc lack descriptions in both the schema and the description, so there is no compensation for those gaps. Overall, the description adds little value for parameter understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses a specific verb ('Compose'), names the resource ('new email'), and the action ('save it to Drafts'). The explicit 'Does NOT send' distinguishes it from send_message, and 'new email' distinguishes it from reply/forward tools. This gives clear differentiation from siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly states that after using this tool, the user reviews and sends the email manually in Proton, implying this tool is for draft creation rather than sending. It explicitly negates sending, which tells an agent when NOT to use it, but it doesn't name alternative tools like send_message. The workflow guidance is clear but not fully explicit about sibling selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
download_attachmentA
Save an attachment from a message to disk (into the configured download directory). Identify it by filename or 0-based index (from get_message); if the message has just one attachment, neither is needed. Returns the saved file path.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | The message uid. | |
| index | No | 0-based attachment index (alternative to filename). | |
| mailbox | No | The mailbox the uid belongs to (default "INBOX"). | |
| filename | No | The attachment filename to save. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral burden. It clearly discloses the disk-write side effect, the configured destination directory, and the return value. Minor omissions like overwrite behavior and permission requirements exist, but the core behavioral traits are transparently stated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three concise sentences front-load the primary action and destination, then provide identification rules and the return value. There is no repetition of schema details or wasted wording.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a straightforward four-parameter tool with no output schema, the description covers what the tool does, how to identify the target attachment, the special single-attachment case, and the returned saved file path. The schema handles the remaining parameter details, so nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already describes all four parameters at 100% coverage. The description adds valuable semantic relationships: filename and index are alternatives, and neither is needed for a single-attachment message. This goes beyond the schema's isolated parameter descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Save') with a clear resource ('an attachment from a message to disk'), making the tool's function immediately obvious. It also distinguishes itself from the sibling mail-handling tools by focusing on attachment persistence rather than message composition or search.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear practical context: identify the attachment by filename or 0-based index from get_message, and omit both when there is only one attachment. It does not explicitly name alternatives or exclusions, but the workflow guidance makes appropriate use clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
forwardA
Forward a message to new recipients, carrying its original attachments. Optional intro note via body. Sends immediately unless draft=true. Can add further local file attachments.
| Name | Required | Description | Default |
|---|---|---|---|
| to | Yes | Recipient address(es) to forward to. | |
| uid | Yes | The message to forward. | |
| body | No | An optional plain-text note above the forwarded message. | |
| html | No | An optional HTML note above the forwarded message. | |
| draft | No | Save to Drafts instead of sending (default false). | |
| mailbox | No | The mailbox the uid belongs to (default "INBOX"). | |
| attachments | No | Local file paths to attach — absolute, or relative to the working directory (e.g. "./report.pdf" from the project you're in). A leading ~ is expanded. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses the key side effect ('Sends immediately unless draft=true'), that original attachments are carried, and that additional local file attachments can be added. This is meaningful behavioral transparency, though it stops short of mentioning irreversibility or the exact return/response behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is only three sentences, each earning its place: core action, optional body note, and send-vs-draft plus extra attachments. It is front-loaded with the essential purpose and contains no redundant or filler language.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 7-parameter mutation tool with no output schema and no annotations, the description covers the essential decision-critical behavior: immediate send versus draft, preservation of original attachments, and the ability to add local files. The remaining details (mailbox semantics, return value) are adequately handled by the schema or are minor for this operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and each parameter already has a clear description. The description's references to 'intro note via body' and 'further local file attachments' merely restate what the schema already says, so it adds no new meaning beyond the structured definitions. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Forward a message to new recipients, carrying its original attachments.' This clearly differentiates forward from reply/reply_all (new recipients) and from send_message (carries the original message's attachments). The action and scope are unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the use case — forwarding an existing message to new recipients — but it never explicitly contrasts this with siblings like reply_all, create_draft, or send_message, nor does it state when not to use it. 'Sends immediately unless draft=true' gives operational context, not usage guidance among alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_messageA
Read one full message by uid (from a search result). Quoted reply history and signatures are trimmed by default for readability; pass full=true to keep everything. The result lists any attachments (name/type/size) — use download_attachment to save one.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | The message uid from a search result. | |
| full | No | Keep the entire body including quoted history (default false). | |
| mailbox | No | The mailbox the uid belongs to (default "INBOX"). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the burden of disclosure. It reveals that quoted reply history and signatures are trimmed by default, that full=true retains them, and that the result lists attachments with name/type/size. This is useful behavioral context beyond the schema, though error handling and side effects are not covered.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each earning its place: purpose, default behavior, and attachment handling with a pointer to the sibling tool. The core message is front-loaded and there is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read tool with no output schema and no annotations, the description adequately explains the purpose, input origin, default trimming behavior, and attachment metadata in the result. It could be more explicit about what else the response contains (headers, subject) and about using search_mail first, but it leaves no ambiguity about how to invoke it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%: all three parameters already have descriptions. The description adds only minor framing (e.g., 'for readability' and 'to keep everything') but doesn't materially extend the schema semantics for uid, full, or mailbox.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Read') and resource ('one full message by uid'), and adds the origin context 'from a search result.' This clearly differentiates it from action-oriented siblings like reply, forward, and send_message, and no sibling duplicates this read operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: the message is read by uid obtained from a search result, indicating the agent should first use search_mail. It explicitly names download_attachment as the tool to use when an attachment needs to be saved, providing an alternative for a sub-task. It doesn't explicitly exclude other uses, but the context is strong.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
replyA
Reply to a message (to its sender), correctly threaded, quoting the original. Sends immediately unless draft=true (saves to Drafts for you to review). Can include local file attachments.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | The message being replied to. | |
| body | No | Plain-text body. Provide this OR html. | |
| html | No | HTML body for a formatted email. A plain-text alternative is generated automatically. | |
| draft | No | Save to Drafts instead of sending (default false). | |
| mailbox | No | The mailbox the uid belongs to (default "INBOX"). | |
| attachments | No | Local file paths to attach — absolute, or relative to the working directory (e.g. "./report.pdf" from the project you're in). A leading ~ is expanded. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It reveals key traits: sends immediately, supports draft mode for review, preserves threading/quoting, and allows local file attachments. This is meaningful behavioral context beyond the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences that front-load the core purpose before mentioning the draft behavior and attachments. Every sentence adds useful information without fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no annotations and no output schema, the description covers the essential behavioral aspects (send vs. draft, threading, quoting, attachments). The rich schema fills parameter details. Minor gaps like return values and mailbox semantics are not critical for an email reply tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters. The description reinforces draft and attachments but does not add significant meaning beyond what the schema provides. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: 'Reply to a message (to its sender)', which is specific and differentiates it from reply_all by singling out the sender. It also mentions 'correctly threaded, quoting the original', which further distinguishes it from forward.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: use this tool to reply to a message's sender, and the draft parameter provides an alternative behavior. It does not explicitly mention sibling tools or exclusions, but the purpose statement makes the tool's primary use unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
reply_allA
Reply to a message and everyone on it (sender + all other recipients, excluding you), threaded and quoting the original. Sends immediately unless draft=true. Can include local file attachments.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | The message being replied to. | |
| body | No | Plain-text body. Provide this OR html. | |
| html | No | HTML body for a formatted email. A plain-text alternative is generated automatically. | |
| draft | No | Save to Drafts instead of sending (default false). | |
| mailbox | No | The mailbox the uid belongs to (default "INBOX"). | |
| attachments | No | Local file paths to attach — absolute, or relative to the working directory (e.g. "./report.pdf" from the project you're in). A leading ~ is expanded. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of disclosing behavior. It explicitly states that the message is sent immediately unless draft=true, that it quotes the original, that it is threaded, and that local file attachments are supported. This gives an agent a strong mental model of the tool's side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact, front-loaded with the core purpose, and each sentence adds distinct value: first the recipient/thread/quote behavior, then the send/draft and attachment behavior. There is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the essential behavior of the tool well, including side effects and key options. It is slightly incomplete in that it does not mention what return value or confirmation an agent should expect after sending, and no output schema exists to fill that gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all six parameters fully. The description adds some context around draft behavior and attachments, but it does not substantially extend parameter meaning beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a precise action: reply to a message and everyone on it, with the recipient scope explicitly defined as sender plus all other recipients excluding the user. It also clarifies threading and quoting behavior. This clearly distinguishes it from siblings like 'reply' and 'forward'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description makes the intended use clear by specifying the full recipient list and the immediate-send behavior unless draft=true. It does not explicitly name alternatives or say 'use reply for sender-only', but the recipient-scope language effectively implies when this tool is appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_mailA
Search email by any combination of free-text, sender, recipient, subject, and date range. With NO filters it returns your most recent inbox messages. Returns summaries (no body) newest first — use get_message with a result's uid to read the full text.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Match a recipient. | |
| from | No | Match the sender (name or address substring). | |
| limit | No | Max results (default 20). | |
| query | No | Free text to match in the message body. | |
| since | No | Only messages on/after this date (ISO 8601, e.g. 2026-08-01). | |
| before | No | Only messages before this date (ISO 8601). | |
| unread | No | Restrict to unread messages. | |
| mailbox | No | Mailbox to search (default "INBOX"). | |
| subject | No | Match the subject. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the behavioral burden; it discloses that results are summaries, excludes bodies, and are ordered newest first. It does not cover auth/rate-limit/error behavior, but nothing in the description is misleading.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences front-load the search capability and then add the no-filter behavior and follow-up action. Every sentence contributes new information without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only search tool with fully documented optional parameters, the description covers invocation defaults, output shape, ordering, and how to get full content. No output schema exists, so the explicit summary/uid guidance is sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, giving a baseline of 3. The description adds value by stating filters can be combined arbitrarily and clarifying the no-filter default, which is not evident from the individual schema fields alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a concrete action — searching email — with the exact dimensions it searches: free-text, sender, recipient, subject, and date range. It also differentiates itself from get_message by noting it returns summaries, so an agent can select it correctly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit guidance on the no-filter case (returns recent inbox) and explicitly routes to get_message when full text is needed. This makes the boundary between search_mail and its retrieval sibling clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
send_messageA
Send a new email immediately. This goes out the moment it runs — the client should confirm first. To let a human review before sending, use create_draft instead. Can include local file attachments.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | ||
| to | Yes | Recipient address(es). | |
| bcc | No | ||
| body | No | Plain-text body. Provide this OR html. | |
| html | No | HTML body for a formatted email. A plain-text alternative is generated automatically. | |
| subject | Yes | Subject line. | |
| attachments | No | Local file paths to attach — absolute, or relative to the working directory (e.g. "./report.pdf" from the project you're in). A leading ~ is expanded. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral burden. It clearly discloses that the email is sent irrevocably and immediately: 'This goes out the moment it runs — the client should confirm first.' It also notes local file attachments. It doesn't mention failure behavior or permissions, but the core irreversible side effect is well communicated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each earning its place: immediate behavior, user confirmation requirement, and the alternative tool. The most important operational fact—immediate sending—is front-loaded first.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a sending tool with no annotations and no output schema, the description covers the critical execution context: the action is immediate, irreversible in practice, and should be confirmed by the client. It also provides the sibling alternative. It doesn't describe return values or error conditions, but these are less critical for an email-send operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 71% and the schema already documents to, body, html, subject, and attachments. The description adds only that attachments are local files, which is slightly redundant with the schema. It does not clarify cc/bcc semantics, but those parameter names are reasonably self-explanatory. Overall the description adds minimal meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'Send a new email immediately.' It clearly distinguishes this from reply, forward, and draft tools by emphasizing 'new email' and 'immediately.' An agent can confidently identify what the tool does and how it differs from siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly tells the agent when not to use this tool: 'To let a human review before sending, use create_draft instead.' This is a direct, usable routing instruction that names the alternative and the condition that selects it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
8 tool updates
v0.1.13- First observed
create_draft - First observed
download_attachment - First observed
forward - First observed
get_message - First observed
reply - First observed
reply_all - First observed
search_mail - First observed
send_message
TDQS
Most tools are clearly distinct: search/get/download form a retrieval pipeline, and create_draft/send_message are explicitly contrasted. reply, reply_all, and forward could be confused, but their descriptions precisely define recipient behavior and threading.
Most tools follow a clear verb_noun pattern like search_mail, get_message, download_attachment, create_draft, send_message. However, reply and forward are bare verbs, and reply_all mixes a verb with an adverb, creating minor inconsistency.
Eight tools is a well-scoped set for an email-focused server. Each tool covers a distinct core email action without unnecessary redundancy or bloat.
The set covers search, read, download attachments, reply, reply-all, forward, draft, and send — the essential email workflows. Minor gaps like delete, move, or archive exist, but agents can handle common tasks end-to-end.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Email infrastructure for AI agents — send, receive, search, and reply to email over MCP.
Email safety MCP server. Detects phishing, prompt injection, CEO fraud for AI agents.
Email inboxes for AI agents: send, receive, reply, search, and manage threaded email over MCP.
Hosted email MCP for AI agents with inboxes, send/receive, memory, recovery, and credits.
Related MCP Servers
- AlicenseAqualityDmaintenanceA read-only MCP server that connects to Proton Mail via Proton Bridge, enabling AI assistants to search, list, and read emails securely without leaving your machine.4441MIT
- FlicenseNot gradedqualityFmaintenanceAn MCP server that connects to ProtonMail via Bridge, enabling AI assistants like Claude to manage your email.3-
- FlicenseNot gradedqualityBmaintenanceA lightweight MCP server providing AI agents a scoped, read-and-draft-only view into Proton Mail via Proton Bridge, with code-enforced restrictions preventing external access or sending.-
- FlicenseNot gradedqualityBmaintenanceA security-first MCP server that provides AI agents with a scoped, read-and-draft-only view into Proton Mail via Proton Bridge, ensuring no emails can be sent and access is restricted to configured workspaces.-
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/apexxapps/proton-mail-bridge-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server