Skip to main content
Glama
spa77k

mcp-icloud-mail

by spa77k

日本語 | English | 简体中文 | 한국어

mcp-icloud-mail

iCloud メールを Claude などの AI から読むだけの MCP サーバーです。IMAP とアプリ用パスワードで接続します。

A read-only MCP server for iCloud Mail over IMAP, using an app-specific password.

できること

ツール

内容

list_mailboxes

フォルダの一覧と、件数・未読数

list_messages

フォルダの新しいメールの一覧(件名・差出人・日時)

search_messages

差出人・宛先・件名・本文・期間・未読で検索

get_message

1通の本文(テキスト)と添付ファイル名を読む

  • 送信・削除・移動・既読にする操作はありません。フォルダは読み取り専用で開くので、読んでも未読のままです。

  • 添付ファイルの中身は取り出しません(ファイル名・種類・サイズだけ)。

Related MCP server: icloud-mcp

準備

  1. Apple アカウントで 2 ファクタ認証をオンにする。

  2. account.apple.com にサインインし、「サインインとセキュリティ」→「App 用パスワード」でパスワードを作る(xxxx-xxxx-xxxx-xxxx の形)。

  3. Node.js 20 以上を入れる。

インストール

このパッケージは npm に未公開のため、GitHub から clone してビルドします。

git clone https://github.com/spa77k/mcp-icloud-mail.git
cd mcp-icloud-mail
npm ci
npm run build

ビルドすると dist/index.js ができます。設定ではこのファイルを絶対パスで指定します。

設定

以下の /path/to/mcp-icloud-mail は clone したディレクトリの絶対パス(pwd で確認できます)に置き換えてください。環境変数はプレースホルダのままにせず、自分の値に置き換えます。

Claude Code

claude mcp add icloud-mail -e ICLOUD_EMAIL=you@icloud.com -e ICLOUD_APP_PASSWORD=xxxx-xxxx-xxxx-xxxx -- node /path/to/mcp-icloud-mail/dist/index.js

Claude Desktop など(JSON で設定するクライアント)

{
  "mcpServers": {
    "icloud-mail": {
      "command": "node",
      "args": ["/path/to/mcp-icloud-mail/dist/index.js"],
      "env": {
        "ICLOUD_EMAIL": "you@icloud.com",
        "ICLOUD_APP_PASSWORD": "xxxx-xxxx-xxxx-xxxx"
      }
    }
  }
}

環境変数

内容

ICLOUD_EMAIL

iCloud メールアドレス(@icloud.com / @me.com / @mac.com)

ICLOUD_APP_PASSWORD

準備で作った App 用パスワード

使い方の例

  • 「今日届いた未読メールを要約して」

  • 「Amazon からの先月のメールを探して」

  • 「受信箱の最新10件を一覧にして」

注意

  • App 用パスワードは iCloud メール・連絡先・カレンダーなどにアクセスできます。設定ファイルを人に見せたり、リポジトリに入れたりしないでください。漏れたら account.apple.com でそのパスワードを取り消してください。

  • メール本文はそのまま AI に渡ります。知らない人からのメールに「〇〇を実行して」などの指示が書かれていても、AI がそれに従わないよう、ほかのツール(送信やファイル操作など)と組み合わせるときは操作の確認をオンにしておいてください。

  • Apple アカウントのパスワードを変えると、App 用パスワードはすべて無効になります。作り直して設定し直してください。

開発

npm ci
npm run build
ICLOUD_EMAIL=you@icloud.com ICLOUD_APP_PASSWORD=xxxx-xxxx-xxxx-xxxx npx @modelcontextprotocol/inspector node dist/index.js

License

MIT

Available Tools

4 tools
get_messageA
Read-only

Read one message by UID: headers, plain-text body and attachment list. Does not mark it as read.

ParametersJSON Schema
NameRequiredDescriptionDefault
uidYes
mailboxNoINBOX
maxCharsNoTruncate the body to this many characters

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, but the description adds a genuinely non-obvious side-effect disclosure: retrieving the message 'does not mark it as read.' That is exactly the kind of state-changing behavior an agent needs to know before calling a read tool. It stops short of covering error cases (invalid UID, nonexistent mailbox) or truncation behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences, front-loaded with the operation and payload, followed by the side-effect caveat. No filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries the return-value burden and does outline headers, body, and attachments. It is adequate for a simple single-message read, though the mailbox default and error behavior remain unexplained.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 33% (only maxChars is documented), so the description must compensate; it clarifies that uid identifies the single message being fetched, but says nothing about the mailbox parameter or its 'INBOX' default. Partial compensation warrants a baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Read one message by UID') and enumerates the returned payload (headers, plain-text body, attachment list). The singular scope plus the UID key cleanly separates it from list_messages/search_messages without needing to name them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use or when-not-to-use guidance, and no mention of alternatives or prerequisites (e.g., that the UID must first come from list_messages or search_messages). The intended use is only inferable from the verb.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_mailboxesA
Read-only

List all iCloud Mail mailboxes (folders) with message and unread counts.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, so the safety profile is covered. The description adds genuinely useful context absent from the structured fields by stating the response includes message and unread counts; it omits pagination/auth details, which is a minor gap for a no-parameter read tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler; the scope and return contents are stated before any detail. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only tool with no output schema, the description says what is returned (mailboxes with message/unread counts), which is enough to call it correctly. Slight gap: no note on auth or empty-state behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the baseline is 4. The description correctly implies no filtering arguments are accepted ('all' mailboxes) and adds nothing that would mislead about inputs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (list) and resource (iCloud Mail mailboxes/folders) with scope ('all') and even summarizes returned content. It doesn't explicitly contrast with siblings, but the resource is unambiguously distinct from list_messages/search_messages/get_message.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use guidance, no prerequisites, and no mention of alternatives such as list_messages for enumerating message contents. Usage is only weakly implied by the narrow purpose.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_messagesA
Read-only

List the most recent messages in a mailbox (newest first). Returns headers only.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
mailboxNoMailbox path, e.g. INBOXINBOX

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only supply readOnlyHint=true; the description adds two genuinely behavioral facts beyond that: results are ordered newest-first and contain headers only (no message bodies). It stops short of noting pagination or that only the default limit is returned.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the action and scoping, and the return-content caveat placed at the end. No filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description correctly covers what comes back ('headers only') and the ordering, which is the essential information for a list tool. Missing only detail about paging or how to get full message bodies (get_message).

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50% – 'mailbox' is documented in the schema, 'limit' is not (only its type/default/bounds). The description's 'most recent' wording loosely implies the limit's role but adds no paging or format semantics, so it neither compensates nor regresses.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb ('List') plus resource ('messages'), with scope qualifiers: 'most recent', 'in a mailbox', 'newest first'. An agent can tell it apart from get_message and search_messages by the recency/listing framing, though no sibling is named explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied rather than stated – the recency-scoped phrasing suggests browsing a mailbox rather than targeted retrieval (search_messages) or fetching a single item (get_message). There is no explicit when-to-use, when-not-to-use, or named alternative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_messagesA
Read-only

Search messages in a mailbox. All conditions are combined with AND. Returns headers only, newest first.

ParametersJSON Schema
NameRequiredDescriptionDefault
toNoRecipient address or name contains
fromNoSender address or name contains
textNoHeaders or body contains
limitNo
sinceNoOn or after this date (YYYY-MM-DD)
beforeNoBefore this date (YYYY-MM-DD)
unreadNotrue: unread only, false: read only
mailboxNoINBOX
subjectNoSubject contains

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, so safety is covered. The description adds real behavioral value beyond that: all conditions are AND-ed, only headers are returned (not bodies), and results are ordered newest first. It omits pagination behavior, though limit's maximum suggests a cap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, each carrying distinct information (scope, boolean semantics, return shape), with the core purpose front-loaded. No filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description usefully states the return shape (headers only, newest first). The remaining gap is pagination/windowing guidance given a 9-parameter search surface, but otherwise an agent has enough to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 78%, with per-parameter descriptions for the match fields and defaults on limit and mailbox, so the schema does most of the work. The description contributes the AND-combination rule, which is meaningful, but adds no matching semantics (exact vs substring) or date-format guidance beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb and resource ("Search messages in a mailbox") and scopes the operation. It does not explicitly differentiate itself from the sibling list_messages, so the agent must infer that "search" implies filtering while "list" does not.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: the mention of AND-combined conditions suggests this tool is for filtered queries, but there is no statement of when to prefer it over list_messages or get_message, and no stated prerequisites or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 4 tool updatesv0.1.0
    • First observedget_message
    • First observedlist_mailboxes
    • First observedlist_messages
    • First observedsearch_messages

TDQS

A3.9/5.0

Scored across 4 tools

Disambiguation5/5

Each tool targets a distinct resource and action: list_mailboxes enumerates folders, list_messages lists a mailbox's headers, search_messages queries within a mailbox, and get_message fetches a single message by UID. Boundaries between list_messages and search_messages are clear since one is unfiltered listing and the other is a conditional search.

Naming Consistency5/5

All four tools follow a strict verb_noun snake_case pattern: list_mailboxes, list_messages, search_messages, get_message. The verb choice is also semantically precise (list vs. search vs. get).

Tool Count4/5

Four tools is a lean but coherent set for a read-only mail client, covering folder listing, message listing, search, and retrieval. It sits slightly under the ideal scope, but nothing is redundant or missing for the read path.

Completeness3/5

The surface is read-only: there is no send/compose, delete, move, or flag (mark read/unread) operation, which are core mail lifecycle actions. Reading is well covered (mailboxes, list, search, fetch by UID), but agents cannot act on messages beyond inspection.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • F
    license
    Not graded
    quality
    D
    maintenance
    Enables LLMs to read, search, and manage emails via IMAP with secure, read-only access to email accounts.
    6
    -
  • A
    license
    Not graded
    quality
    D
    maintenance
    Provides AI assistants with read-only access to iCloud mail and calendar via IMAP and CalDAV, with opt-in write support for sending mail, managing events, and contacts.
    1
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables an AI assistant to read and search iCloud mail, draft messages (never sent), manage calendar events with a preview/commit gate, and look up contacts via IMAP, CalDAV, and CardDAV.
    248 npm
    2
    MIT
  • A
    license
    Not graded
    quality
    A
    maintenance
    Enables AI assistants to securely access IMAP mailboxes with read-focused tools for searching, reading, listing messages, and creating drafts, while deliberately preventing sending or deleting emails.
    MIT