draftgate-mcp

An MCP server for email agents that cannot send mail without a human saying yes — unless you've explicitly told it otherwise for that contact.

Most "AI email assistant" demos either send freely (fine for a toy, unacceptable in production) or gate everything behind approval (safe, but defeats the point of automation for routine, low-stakes contacts). draftgate-mcp does neither: each contact carries its own trust level, and the send path enforces it deterministically — not by asking the model to "please be careful."

The pattern

Every contact has an auth_level:

send_email() returns a status field — sent, draft_created, needs_review, or blocked — and the server's own instructions tell the calling model exactly what each status requires before it's allowed to proceed. The gate lives in code, not in a prompt asking the model nicely not to send things.

Unknown recipients default to the most restrictive level. An agent can't accidentally email someone it's never been told about — it has to be extended a trust level explicitly, by a human, first.

Related MCP server: sabit-mcp

Tools

• read_inbox, read_message — read mail via IMAP

• send_email — the gated send path described above

• list_drafts, confirm_draft, discard_draft — manage held drafts

• list_contacts, add_contact, update_contact_auth — manage trust levels

Setup

pip install -r requirements.txt
cp .env.example .env        # fill in your IMAP/SMTP credentials
cp data/contacts.example.json data/contacts.json   # add your real contacts
python server.py

Point any MCP client (Claude Desktop, Claude Code, etc.) at server.py over stdio.

Why

This was extracted from the trust-tiering logic in a production email agent I run for my own inbox. The rest of that system — voice, telephony, task tracking, internal chat bridges — is specific to my own setup and not worth open-sourcing as-is, but the draft-gate pattern is a genuinely reusable answer to "how do you let an agent act without letting it act unsupervised." This repo is that pattern, stripped down to ~250 lines with no dependencies beyond the standard library, fastmcp, and python-dotenv.

License

MIT — see LICENSE.

Derek Manthorpe · github.com/DRMM101