Provides IMAP access to Gmail mailboxes using an app password, enabling agents to search and read emails, list folders, create threaded drafts, move messages, mark messages read or unread, and send approved drafts.
Provides IMAP access to iCloud mailboxes using an app-specific password, enabling agents to search and read emails, list folders, create threaded drafts, move messages, mark messages read or unread, and send approved drafts.
This server does not currently have a deployable release on Glama. Follow the repository's setup instructions to install and configure it for your MCP client, including any required credentials and local dependencies.
A personal MCP server that gives AI agents (Claude, ChatGPT, Cursor, VS Code, or any MCP client) access to any IMAP mailbox.
Next.js 16 + Better Auth + shadcn/ui, deployed on Vercel with a Neon Postgres database. One Vercel account covers everything.
OAuth login, nothing secret in the URL. Your agent registers itself (dynamic client registration). You sign in once and approve it on a consent page. Access tokens last 1 hour, refresh tokens 30 days.
Multiple mailboxes, kept apart. Add up to 20 (MAIL_2, MAIL_3, …). Every result says which mailbox it came from, replies go out from the mailbox the original arrived in, and when it's unclear which one you mean, the agent is told to ask instead of guessing.
Nothing is sent without your yes. The agent saves every message as a draft, shows it to you, and can send that exact draft only after you approve it in the chat. Set ALLOW_SEND=false for drafts only.
Mail passwords never touch the database. They live only in Vercel environment variables. The database holds login and OAuth data.
Click Deploy and approve creating the Neon database.
Fill in 4 values: MAIL_1, MAIL_1_PASSWORD, ADMIN_PASSWORD (12+ characters; run openssl rand -base64 24 and save it in your password manager) and BETTER_AUTH_SECRET (run openssl rand -base64 32).
Open your deployment, sign in with your ADMIN_PASSWORD (the username is filled in for you), and check that the mailbox test shows ✅.
The username is admin@imap-mcp.local and doesn't matter. This app has exactly one login, sign-up is disabled, and the sign-in page fills it in for you, so the password is the only thing that protects it. It has to look like an email address because the login system (Better Auth's email-and-password sign-in) only accepts email-formatted usernames. No mail is ever sent to it, and it doesn't need to be a real address or match your mailbox. To change it, set ADMIN_EMAIL.
Add the connector URL (https://<your-app>/api/mcp) to your MCP client as a remote HTTP server with OAuth. For example, in claude.ai use Settings → Connectors → Add custom connector; in Claude Code run the command shown on the page. Other clients that support remote MCP servers with OAuth (ChatGPT connectors, Cursor, VS Code, …) work the same way.
Database tables and your login are created automatically on the first request. There is no migration step.
Related MCP server: MCP Email
Variable | Required | Notes |
| yes | Mailbox address. IMAP and SMTP servers are detected from it. |
| yes | Mailbox password, or an app password (see below). |
| yes | Password for signing in to this app. Must be at least 12 characters; if it's shorter, the app shows a "Finish setup" page and won't let agents connect. |
| yes | Random secret. Rotating it invalidates all sessions and tokens. |
| auto | Set by the Neon integration. |
| no | Login username, prefilled on the sign-in page. Defaults to |
| no | Max emails each mailbox can send per hour. Default 10. |
| no |
|
| no | More mailboxes: |
| no | Friendly name, also used as the From display name. |
| no | IMAP/SMTP login, if it differs from the address. |
| no | Override detection. Port 993/465 use TLS; other ports use STARTTLS or plain. |
After changing any variable in Vercel (adding a mailbox, setting ALLOW_SEND, …), redeploy: Deployments → ⋯ on the latest one → Redeploy. A running deployment keeps the values it was built with.
Many providers don't accept your normal password over IMAP. Instead you create an app password: a separate password for one app that only gives mail access and can be revoked on its own without changing your real password.
Provider | What to put in |
Gmail | An app password (turn on 2-Step Verification first): myaccount.google.com/apppasswords |
iCloud | An app-specific password: account.apple.com → Sign-In and Security → App-Specific Passwords |
Fastmail | An app password with IMAP/SMTP access: Settings → Privacy & Security |
Others | Use an app password if your provider offers one, otherwise your normal mailbox password |
If the mailbox test on the status page shows an authentication error, this is usually why.
Tool | What it does |
| Configured mailboxes |
| Folders in a mailbox |
| Search by text, from, to, subject, date range, unread. Newest first. |
| Headers, plain-text body, attachment list. Doesn't mark as read. |
| Saves to Drafts, threaded when replying. Replies come from the mailbox the original was read in. |
| Move to another folder (Archive, Trash, …) |
| Mark read or unread |
| Sends a draft from |
Every tool takes an account (address, name or number) and every result says which mailbox it came from.
With several mailboxes, the server keeps them apart:
search_emails and list_folders default to the first mailbox when account is left out.
read_email, move_email, mark_read, create_draft and send_draft refuse to run without account. UIDs only mean something inside one mailbox, and mail must go out from the right address. The error tells the agent to ask you which mailbox you mean.
A reply has to pass both the original's UID and its Message-ID (from read_email). If they don't match in the chosen mailbox, which happens when a UID from one mailbox is used in another, nothing is saved or sent.
Who can get in
The MCP endpoint (/api/mcp) accepts only OAuth access tokens issued by this app and bound to this exact URL.
There's a single account, and sign-up is disabled. Sign-in is rate-limited to 5 attempts per minute, stored in the database so the limit holds across serverless instances.
Every new client goes through the consent page, which shows where it's from.
To cut off access: change BETTER_AUTH_SECRET and redeploy. Every token and session stops working, and every agent has to log in again. Changing ADMIN_PASSWORD changes your login and signs out browser sessions.
What happens to your mail
Nothing is stored. Each tool call connects to your mail server, does its job and disconnects. The database holds only your login, OAuth clients and tokens, and rate-limit counters. No message content, addresses or subjects.
Nothing is logged or tracked. The app doesn't log mail content and has no analytics.
Your agent sees what it reads. Messages returned by search_emails and read_email go to the agent you connected, so its provider's privacy policy applies to that content.
Reading doesn't change anything. read_email leaves messages unread.
How sending works
The agent saves the message to your Drafts folder with create_draft and shows you the full draft: From, To, Cc, Bcc, subject and body.
You approve it in the chat. Clients like Claude also ask before running send_draft, and the prompt shows the recipients and subject. Don't set it to always-allow.
send_draft sends that exact draft. If the draft was edited or replaced, or the recipients or subject don't match, nothing is sent.
A copy goes to Sent and the draft is removed.
Each mailbox can send at most 10 emails an hour (SEND_LIMIT_PER_HOUR). There's no way to send arbitrary text or forward messages. Set ALLOW_SEND=false for drafts only.
The remaining risk: the mailbox password sits in Vercel's environment variables, which are encrypted at rest. An app password limits the damage if they ever leak: it only opens mail and you can revoke it without changing your real password.
Only needed if you want to run or change the code yourself. You need Node.js, pnpm and a local Postgres.
createdb imap_mcp
cp .env.example .env.local # fill in values (APP_URL is only needed locally)
pnpm install
pnpm devTo check the whole OAuth + MCP flow from the command line (the same steps an MCP client goes through), run the smoke test with your ADMIN_PASSWORD. It calls list_accounts by default, or any tool you name:
PASSWORD=your-admin-password node scripts/smoke-test.mjs
PASSWORD=your-admin-password node scripts/smoke-test.mjs search_emails '{"limit":3}'Logo: Email Mail from SVG Repo, CC0 license.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
This server cannot be deployed
Email for AI agents: read, search and send from your Gmail, Outlook, Yahoo, iCloud or IMAP inbox.
Email inboxes for AI agents: send, receive, search, drafts with owner approval, and webhooks.
Gmail, Outlook, iCloud, Fastmail and any IMAP mailbox for your agent. Scoped OAuth, approved sends.
Give AI agents their own email inboxes: list, read and send mail via scoped, revocable OAuth grants.
