bg-imapMCPSever
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@bg-imapMCPSeverlist my unread messages in the inbox"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
bg-imapMCPSever
Read-only MCP server for any standard IMAP-over-TLS mailbox, intended for personal hosting on Linux. No provider details, addresses, or passwords are hardcoded. Written in Python using the official MCP SDK v1 line (pinned to <2 for API stability).
Features
check_connection: verify IMAP TLS/loginlist_folders: list server folder entriesfolder_status: total and unread countslist_messages: latest headers/UIDs, optionally unread-onlysearch_messages: plain-text IMAPTEXTsearch, optionally unread-onlyread_message: subject, sender, recipients, date, text body, attachment names/types/sizesRead-only by design: uses
EXAMINE/select(readonly=True)andBODY.PEEK; no delete, flag, move or send operationsConfigurable message-size and result caps
Security: Email bodies can contain prompt injection. Treat mailbox content as untrusted. The server does not intentionally modify mail, but connecting to a remote service still exposes sensitive mail contents to whichever MCP clients you authorize. This project has not been independently security-audited.
Related MCP server: imap-mcp
Install on horsetooth (Ubuntu/Linux)
git clone https://github.com/junga-com/bg-imapMCPSever.git
cd bg-imapMCPSever
python3 -m venv .venv
source .venv/bin/activate
python -m pip install -e '.[dev]'
cp .env.example .env
chmod 600 .env
$EDITOR .env
pytest -qIn .env, set IMAP_HOST, IMAP_USERNAME and IMAP_PASSWORD to the actual values from your email provider's mail-client setup page. IMAP TLS commonly uses port 993; verify your provider's settings. Do not post passwords in chat or commit .env. An app-specific password, if supported, is preferable.
Test locally
Start the MCP Inspector (requires Node.js/npm):
source .venv/bin/activate
npx -y @modelcontextprotocol/inspectorIn Inspector, select STDIO, set command to the absolute path of .venv/bin/bg-imap-mcp, and set working directory to this repository so .env is loaded. Alternatively, from a terminal in the repository:
bg-imap-mcp --transport streamable-http --host 127.0.0.1 --port 8765Then connect Inspector to http://127.0.0.1:8765/mcp using Streamable HTTP, and call check_connection and folder_status first. The HTTP endpoint is not authenticated; it is deliberately restricted to loopback. Never expose it directly to the Internet or bind to 0.0.0.0.
ChatGPT integration
A local 127.0.0.1 server on horsetooth is not directly reachable from ChatGPT's cloud. To use this server from ChatGPT, deploy a properly authenticated HTTPS MCP endpoint or place it behind a trusted tunnel/reverse proxy that provides authentication and access controls. A tunnel alone without authentication is insufficient. Test locally before building this integration. ChatGPT custom connectors and workspace policies may require additional configuration.
Configuration
Variable | Default | Purpose |
| required | IMAP DNS name |
|
| TLS IMAP port |
| required | Mailbox login |
| required | Mailbox/app password |
|
| Reserved default folder setting |
|
| IMAP socket timeout (seconds) |
|
| Hard cap for listing/search results |
|
| Cap on returned message body characters |
|
| Cap on fetched message size (see note below) |
Size note: the message-byte limit is checked after the server returns the full message, so it is not a download-bandwidth guard. Avoid reading unusually large messages. Attachment contents are not returned, but the MIME parser processes the full message.
Known limitations
The search API uses simple
TEXTsearch; not Gmail syntax or multi-field boolean expressions.Search/list return the newest UIDs, not necessarily the newest Date headers.
Server folder listings are raw IMAP LIST entries rather than decoded folder names.
Attachment contents and HTML originals are not exposed; HTML-only mail gets a basic plaintext extraction.
The current version connects separately for each tool call. No caching or incremental synchronization.
read_messagerequires the UID and folder returned from search/list; IMAP UIDs are scoped to a folder and can be invalidated if its UIDVALIDITY changes.Local HTTP transport uses no authorization and must never be made public directly.
Development
python -m pip install -e '.[dev]'
pytest -qCI runs tests on Python 3.11 and 3.12. No real IMAP account is used in tests.
Available Tools
6 toolscheck_connectionA
Test authenticated IMAP connectivity; never return credentials.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the burden. It does add real value by disclosing that authentication happens with stored credentials and that credentials are never returned, but it says nothing about what a result looks like (success flag, error message, latency) or how failures surface.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single compact sentence with the core action front-loaded and the security constraint trailing. Nothing is wasted, though the 'never return credentials' clause is slightly cryptic in isolation without saying what is returned instead.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a trivial zero-argument connectivity probe, the definition covers purpose and a key safety property. With no output schema and no annotations, the missing piece is the shape of the response and failure behavior, which an agent would need to act on the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is no parameter semantics to explain; the baseline for a no-param tool applies. The description correctly implies no arguments are needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Test authenticated IMAP connectivity'), which clearly separates it from the data-retrieval siblings (list_folders, list_messages, read_message) as a health-check tool. It does not explicitly name a sibling, but the purpose is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: an agent can infer this is a pre-flight/diagnostic check before attempting folder or message operations, but the description never says when to call it or what to do on failure. No exclusions or alternatives are named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
folder_statusB
Count total and unread messages in a folder without marking any read.
| Name | Required | Description | Default |
|---|---|---|---|
| folder | No | INBOX |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does usefully disclose that the operation does not mark messages as read. However, it omits other behavioral details such as whether subfolders are included, permission requirements, pagination, or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with zero wasted words. The key operation and safety behavior are both stated immediately.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter read tool with no output schema, the description is adequate to understand the basic purpose. It is incomplete on folder parameter semantics and on the exact return shape of the counts, which leaves meaningful gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter, folder, has 0% schema description coverage, but the description does not explain accepted folder names, path format, or that it defaults to INBOX. It only says 'in a folder' without adding meaning beyond the bare schema property name.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb and resource: it counts total and unread messages in a folder. It does not explicitly distinguish itself from siblings like list_messages or search_messages, so it falls short of full sibling differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied: use this when you need folder-level counts rather than message contents. The description adds the safety note 'without marking any read' but gives no explicit when-to-use or when-not-to-use guidance relative to list_messages or search_messages.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_foldersA
List IMAP folders (raw server entries; flags and quoted names may be present).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are supplied, so the description carries the full behavioral burden. It does add genuinely useful context that results are raw server entries where flags and quoted names may appear unnormalized, which warns the agent not to expect clean display names. It omits any statement about permissions, account/connection requirements, or folder hierarchy/nesting behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with a parenthetical caveat — no filler or redundant restatement of the name. The parenthetical is dense but every clause carries information the agent needs about output shape.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no parameters, no annotations, and an output schema present, the definition needs little, and the raw-entry caveat covers the main surprise. It still leaves gaps on hierarchy/namespace behavior and on how this differs from folder_status, which matters for selection among five siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is nothing for the description to disambiguate; the baseline of 4 applies. The schema coverage is also 100%, leaving no semantic gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List IMAP folders'), which is clearly distinct from list_messages or search_messages. It does not, however, distinguish itself from the sibling folder_status, which an agent could plausibly confuse with this tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied by the name and the word 'List' — the description gives no explicit when-to-use context, no prerequisites, and never names folder_status as the alternative for checking a single folder's state.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_messagesB
List newest message headers by stable IMAP UID (max configured cap).
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| folder | No | INBOX | |
| unseen_only | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With zero annotations, the description carries the full behavioral burden. It does useful work by disclosing that only headers are returned (not bodies), that results are ordered newest-first by a stable identifier, and that output is capped by a configured maximum. It omits permission requirements, pagination/offset behavior, and what happens when the cap is hit.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler, and the most important constraint (headers only, newest first) appears immediately. The density comes at the cost of leaving out information the agent needs, but no sentence is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a three-parameter read tool with no annotations, no output schema, and 0% schema description coverage, the definition is under-specified: it never says what fields a 'header' contains, whether folder defaults to INBOX, or what unseen_only does. An agent can call it, but only by guessing at the parameters.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate for three undocumented parameters (limit, folder, unseen_only) and it does not — none of the three is explained, and 'max configured cap' actually obscures the limit parameter by suggesting a server-side cap rather than a caller-supplied value. Baseline for three unlabeled parameters would be a 3; the misleading framing pushes it down.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List newest message headers') plus the ordering key ('stable IMAP UID'), which lets an agent separate it from read_message (single full message) and search_messages (query-driven). It never names those siblings, so differentiation is inferential rather than explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance at all: no statement of when to prefer this over search_messages for finding messages, and no mention of when the UID ordering matters. The only usage signal is the word 'newest', which implies a recent-inbox browsing scenario.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_messageA
Read text content and attachment metadata by folder and UID; does not mark read.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | ||
| folder | No | INBOX |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description usefully discloses that reading does not mark the message as read, which is an important side-effect clarification. However, it does not cover other behavioral details such as what happens when the UID is missing, whether permissions are required, or how attachments are represented.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no wasted wording. It conveys the operation, inputs, return content, and a key non-mutating behavior efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter read tool with no output schema, the description adequately explains what is returned and that the read is non-mutating. It still leaves clear gaps around usage relative to sibling tools and parameter details such as the folder default.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description maps both parameters to their purpose: folder and UID locate the message. With 0% schema description coverage, it adds some meaning, but it does not explain the folder default (INBOX) or the UID format and scope.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: reading a message's text content and attachment metadata by folder and UID. It is clearly a single-message read rather than a list or search, though it does not explicitly name the sibling tools it differs from.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied: read a message when you already know its folder and UID. The description gives no explicit guidance on when to use this instead of search_messages or list_messages, nor any exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_messagesC
Search mailbox TEXT for plain text query, returning matching headers and UIDs.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| query | Yes | ||
| folder | No | INBOX | |
| unseen_only | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the full behavioral burden. It does disclose the return shape (headers and UIDs, not bodies), but says nothing about matching semantics (IMAP TEXT covers headers/body, not just subject), result ordering, whether limit truncates silently, or the read-only nature of the call.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, front-loaded with the verb and resource, with no filler. It is efficient, though the terseness borders on under-specification given four undocumented parameters.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 4-parameter search tool with zero schema coverage and no annotations, the description is thin: scope (folder default, unseen filter), pagination via limit, and match semantics are all left unstated. Only the return shape and the query's plain-text nature are covered.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 4 parameters. The description clarifies only the required 'query' parameter as plain text matching; folder, limit, and unseen_only are entirely undefined in both schema and description, leaving three of four parameters undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (search) and resource (mailbox TEXT), plus what comes back ('matching headers and UIDs'). It is distinguishable from read_message, though it never explicitly contrasts itself with the closest sibling list_messages.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The purpose implies when to reach for it (free-text lookup rather than enumerating or reading a message), but there is no explicit when-not guidance, no mention of list_messages as the alternative for unfiltered listing, and no note about folder scoping.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v0.1.0- First observed
check_connection - First observed
folder_status - First observed
list_folders - First observed
list_messages - First observed
read_message - First observed
search_messages
TDQS
Scored across 6 tools
Each tool has a clearly distinct purpose: connectivity check, folder listing, folder statistics, message listing, message search, and message reading. There is no meaningful overlap between tools, so an agent can easily select the right one.
All tool names use snake_case consistently. Most follow a verb_noun pattern, though folder_status is noun-based rather than verb-based, which is a minor deviation but still clear.
Six tools is well-scoped for a read-only IMAP interface, with each tool covering a distinct step in the email access workflow. No tool feels redundant or unnecessary.
The server covers the core read path: connection, folders, status, listing, search, and reading. However, it lacks common IMAP lifecycle operations such as flag updates, moving/deleting messages, folder management, and attachment retrieval, which would limit agents needing write or maintenance tasks.
Maintenance
Related MCP Connectors
Your own IMAP mailbox in any MCP client: search, read, flag, move; send and delete need confirm.
Hosted email MCP for your own Gmail, Outlook.com, Microsoft 365, iCloud or IMAP inbox: read, search, draft, reply in thread, forward and file mail. It moves or flags up to 500 messages in one call, and a send leaves exactly one copy in Sent. A calendar is a separate connection, and connecting one adds diary and scheduling tools.
Your IMAP mailbox as an MCP server: read, search and (if you allow it) organize mail. Open source.
Hosted MCP server for your Gmail, Outlook and IMAP mail, with mailboxes and scopes set per agent.
Related MCP Servers
- AlicenseAqualityCmaintenanceRead-only MCP server that connects to multiple IMAP accounts, enabling cross-account email listing, search, and retrieval without modifying mailboxes.4MIT
- AlicenseAqualityAmaintenanceEnables MCP clients to read, search, organise, and manage IMAP mailbox messages, including saving attachments and drafting replies, while treating mail content as untrusted and keeping write capabilities opt-in.6414 npm4MIT
- AlicenseNot gradedqualityBmaintenanceEnables MCP clients to check, list, search, read, send, draft, and trash email in a single IMAP mailbox using standard IMAP and SMTP settings, with sending and trash moves enabled only when explicitly allowed.13 npmMIT
- AlicenseNot gradedqualityBmaintenanceEnables read-only IMAP email access through MCP, including listing accounts and folders, searching messages, retrieving message bodies and attachments, and viewing threads without modifying mail state.MIT