InboxTether MCP — 2.0.0

Your email. Your AI. Your control.

A self-hosted, fixed-account MCP stdio server for compatible AI clients. Reader Mode is the default. Optional reply drafts, bounded folder organization, exact batch approval, optional owner-enabled automatic filing, narrow owner preferences and receipt-linked corrections are included. Email sending is absent: no SMTP transport, sending tools, submission process, Send/Sent settings or send launchers are included. MIME's SMTP formatting policy is used solely to serialize drafts and is not a transport.

This is the refreshed, unreleased 2.0.0 candidate. It adds up to 200-message bulk filing, compact server-side selection references, paginated candidate discovery, a 24-hour owner review/start window and a separate fixed 30-hour execution deadline, plus explicit automatic-policy authority and the verified saved-risk/HTML corrections. It is based on the public rc3/stable-preparation tree, with tested organization improvements adapted to the public clean-install configuration. It has not been published or deployed as this public candidate. See current validation for exact tested and unverified scope; older acceptance is not certification of this revision.

Tools

Organization actions: next, propose, prepare, status, execute, consent, cancel, candidates, automatic_policy, correction_context, preferences, prepare_preference, decide_preference, filed_context, prepare_correction.

There is no server-side AI provider or model key. The connected assistant proposes classifications; local policy independently applies customer, identity, uncertainty, source integrity, exclusion and approved-preference constraints. Proposals and preference rules alone never authorize moves. Manual mode requires exact manifest consent. Optional automatic mode requires the independently enabled owner policy and files only Industry, Marketing, Orders and Suppliers. Customer, potential-customer, mixed and uncertain mail and all Review messages remain in Inbox. Both execution modes are disabled by default. See automatic filing. The tool schema documents exact required fields.

Related MCP server: MailBridge MCP

Quick start: Reader only

Use an isolated Python environment (Python 3.11+; intended server target Linux). From the extracted source directory:

python3 -m venv .venv
.venv/bin/python -m pip install -c constraints-validated.txt -r requirements.txt

Configure the client using examples/stdio-client.json, replacing its example paths, account and host. Provision the IMAP password file privately, owned by the Reader service identity, mode 0600, under a private directory. Do not put credentials in chat, command arguments, environment examples, logs or the repository. The client launches .venv/bin/python server.py and owns its stdin/stdout. This starts no public HTTP endpoint. Read connections use TLS, EXAMINE and BODY.PEEK. The fixed host/account cannot be selected by tool arguments.

Draft saves require a selectable mailbox advertising the IMAP \Drafts special-use flag. Organizer requires exact literal folder paths; its login-name constraints reject *, including master-login names that use it. Folder hierarchy and authentication separators are distinct; see the installation prerequisites below.

See installation for Draft Assistant, organization, browser review, roles, mailbox rights and clean initialization. Read approval and learning before enabling write capabilities. All write switches are off by default.

Compatibility and limitations

The MCP SDK/backend checks and actual signed-in Codex CLI and graphical Claude Desktop acceptance are distinct evidence. Claude completed 19 successful MCP calls; Codex completed the same bounded workflows after two safely blocked initial calls and corrected client permissions/guidance. Both used disposable Dovecot mailboxes. Browser-password-session approval used the real verified HTTPS service driven by an operator harness, not a graphical browser. Draft saves used Basic mode; preference decisions used optional lower-assurance client-session consent. See the exact acceptance matrix and limits before making compatibility claims. Ordinary ChatGPT graphical acceptance, secure browser-approved Drafts, graphical corrections and other provider/client configurations remain unverified in these client passes. Use a client's supported stdio launcher or independently configured MCP transport; no assistant-specific plugin, tunnel or authentication platform is bundled or required by the application protocol. Client prompts may omit details or remember grants. They are not independent proof of an owner decision. See trust guarantees.

Organization/browser processes require POSIX users, Unix sockets and peer credentials; Linux service templates are supplied. Native Windows organization is unsupported. Five logical filing categories are fixed: Industry, Marketing, Orders, Review and Suppliers, plus Inbox / Keep. Exact wire folders and UIDVALIDITY are operator-pinned; custom display labels and automatic folder creation are not supported. Initial discovery is bounded to 20,000 UIDs per discovery page; over-limit inventories fail closed and need operator assessment, not silent truncation. Private journals are bounded to 16 MiB; preference/review record caps also fail closed. There is no automatic compaction, migration, background organization, uncertain-move retry or inverse rollback.

Attachment retrieval is explicitly selected, bounded and returns Base64 rather than a native download UI. Mail and attachments are untrusted; no malware guarantee is made. Practical organization uses content/relationship protections, not a guarantee of sender authenticity, delivery provenance, or independent DKIM verification. Unknown suppliers cannot gain supplier status through a learned category rule. Historical Keeps are not automatically reconsidered. Conservative customer keywords, reply identities, MIME handling and context-omission safeguards can produce false Keeps; owner-reviewed one-message corrections preserve prior history and cannot bypass these safeguards.

Verification and release status

See validation, upgrade/rollback, security and third-party licensing. Run python run_tests.py after installing requirements-test.txt; it uses temporary synthetic resources and rejects IP socket operations in the test process. Never supply production credentials to tests.

Application source, tests and documentation are MIT. The included project icon has separate distribution/reuse terms in assets/BRANDING-RIGHTS.txt; it is not MIT. This is an independent community project, with no affiliation claim for any client or email provider. See release notes. Publication, deployment and acceptance on a new installation require separate owner review.