tutamcp

MCP server giving Claude access to a Tuta account: mail, calendar, contacts, and drive. Each module is enabled independently. Built on top of tutaproxy's TutaClient — no direct Tuta API calls.

30 MCP tools across 4 modules. Requires tutaproxy-public ≥ v1.3.10.

Quickstart — Docker

The easiest setup: no local dependencies beyond Docker. The image bundles tutaproxy at build time.

git clone https://github.com/peix2/tutamcp-public.git
cd tutamcp-public
docker build -t tutamcp .

Pin a specific tutaproxy release (default: v1.3.15):

docker build --build-arg TUTAPROXY_REF=v1.3.15 -t tutamcp .

2FA note: logging into an account with two-factor authentication requires tutaproxy ≥ v1.3.15. Older refs will fail the second-factor challenge.

Create a credentials file (chmod 600):

TUTA_EMAIL=your@tuta.com
TUTA_PASSWORD=yourpassword
# only for accounts with 2FA enabled — base32 secret from the Tuta app (spaces ignored):
#TUTA_TOTP_SECRET=jbsw y3dp ehpk 3pxp

Register in Claude Code (.mcp.json or ~/.claude.json):

{
  "mcpServers": {
    "tutamcp": {
      "command": "docker",
      "args": [
        "run", "--rm", "-i",
        "-v", "/path/to/credentials.env:/creds.env:ro",
        "-e", "TUTAMCP_CREDENTIALS_FILE=/creds.env",
        "-e", "TUTAMCP_ENABLE_MAIL=1",
        "-e", "TUTAMCP_MAIL_MODE=dedicated",
        "-e", "TUTAMCP_OWNER_EMAIL=you@tuta.com",
        "tutamcp"
      ]
    }
  }
}

Related MCP server: mcp-email

Without Docker

Requires Python 3.11 and a local clone of tutaproxy-public.

git clone https://github.com/peix2/tutamcp-public.git
cd tutamcp-public
pip install --target=.venv/lib/python3.11/site-packages -r requirements.txt

Register in Claude Code:

{
  "mcpServers": {
    "tutamcp": {
      "command": "python3.11",
      "args": ["/path/to/tutamcp-public/run.py", "/path/to/tutamcp-public/server.py"],
      "env": {
        "TUTAPROXY_PATH": "/path/to/tutaproxy-public",
        "TUTAMCP_CREDENTIALS_FILE": "/path/to/credentials.env",
        "TUTAMCP_ENABLE_MAIL": "1",
        "TUTAMCP_MAIL_MODE": "dedicated",
        "TUTAMCP_OWNER_EMAIL": "you@tuta.com",
        "TUTAMCP_DOWNLOAD_DIR": "/tmp/tutamcp"
      }
    }
  }
}

For Claude Desktop, use the same block in ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows).

Configuration

See config.example.env for all variables. Key options:

Mail modes

Send policy

TUTAMCP_MAIL_SEND=reply_only — only tuta_mail_reply is registered; recipients are derived from the original mail only, no arbitrary addresses accepted.

TUTAMCP_MAIL_SEND=full — also registers tuta_mail_send for initiating new threads.

Default: dedicated → full, shared → reply_only, folder → always reply_only.

Trusted senders

Used for autonomous mail handling (e.g. a background poller that wakes Claude to process incoming commands).

tuta_mail_list and tuta_mail_read return trusted_sender: bool and e2e: bool on every message. Pass only_trusted=True to tuta_mail_list to filter to trusted senders only.

Two-factor authentication (2FA / TOTP)

If the Tuta account has a second factor enabled, add its TOTP secret to your credentials so tutamcp can complete the login challenge:

TUTA_EMAIL=your@tuta.com
TUTA_PASSWORD=yourpassword
TUTA_TOTP_SECRET=jbsw y3dp ehpk 3pxp

• TUTA_TOTP_SECRET is the base32 secret shown by the Tuta app when you set up an authenticator (the same string behind the QR code). Spaces and letter case are ignored, so you can paste it exactly as displayed.

• It can also be passed as a plain environment variable instead of via the credentials file. The value is bridged into the login and never logged.

• tutamcp computes the 6-digit RFC 6238 code at login time — you do not register a separate authenticator app for it.

Treat the secret like a password: keep it in the chmod 600 credentials file, out of version control.

Tools

Status

Mail

Calendar

Note: editing a single occurrence of a recurring series is not supported.

Contacts

Drive

Drive requires a paid Tuta account. Free accounts receive an informative error rather than a crash.

Security

• Credentials are never logged. The server warns if the credentials file permissions are wider than 600.

• All logging goes to stderr or a log file. stdout is reserved for the MCP protocol.

• Tool registration is conditional: a disabled module registers no tools — Claude doesn't see them at all.

• In folder mode, all operations are scoped to the configured folder; attempts to access outside it are rejected at the tool level.

• Reply-only policy is enforced structurally: tuta_mail_send is simply not registered, not blocked at runtime.

• Path traversal on attachment/drive downloads is blocked (basename sanitization + regex).

License

AGPL-3.0 — see LICENSE.