mcp-icloud-mail
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@mcp-icloud-mailsummarize my unread iCloud Mail from today"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
mcp-icloud-mail
iCloud メールを Claude などの AI から読むだけの MCP サーバーです。IMAP とアプリ用パスワードで接続します。
A read-only MCP server for iCloud Mail over IMAP, using an app-specific password.
できること
ツール | 内容 |
| フォルダの一覧と、件数・未読数 |
| フォルダの新しいメールの一覧(件名・差出人・日時) |
| 差出人・宛先・件名・本文・期間・未読で検索 |
| 1通の本文(テキスト)と添付ファイル名を読む |
送信・削除・移動・既読にする操作はありません。フォルダは読み取り専用で開くので、読んでも未読のままです。
添付ファイルの中身は取り出しません(ファイル名・種類・サイズだけ)。
Related MCP server: icloud-mcp
準備
Apple アカウントで 2 ファクタ認証をオンにする。
account.apple.com にサインインし、「サインインとセキュリティ」→「App 用パスワード」でパスワードを作る(
xxxx-xxxx-xxxx-xxxxの形)。Node.js 20 以上を入れる。
インストール
このパッケージは npm に未公開のため、GitHub から clone してビルドします。
git clone https://github.com/spa77k/mcp-icloud-mail.git
cd mcp-icloud-mail
npm ci
npm run buildビルドすると dist/index.js ができます。設定ではこのファイルを絶対パスで指定します。
設定
以下の /path/to/mcp-icloud-mail は clone したディレクトリの絶対パス(pwd で確認できます)に置き換えてください。環境変数はプレースホルダのままにせず、自分の値に置き換えます。
Claude Code
claude mcp add icloud-mail -e ICLOUD_EMAIL=you@icloud.com -e ICLOUD_APP_PASSWORD=xxxx-xxxx-xxxx-xxxx -- node /path/to/mcp-icloud-mail/dist/index.jsClaude Desktop など(JSON で設定するクライアント)
{
"mcpServers": {
"icloud-mail": {
"command": "node",
"args": ["/path/to/mcp-icloud-mail/dist/index.js"],
"env": {
"ICLOUD_EMAIL": "you@icloud.com",
"ICLOUD_APP_PASSWORD": "xxxx-xxxx-xxxx-xxxx"
}
}
}
}環境変数 | 内容 |
| iCloud メールアドレス( |
| 準備で作った App 用パスワード |
使い方の例
「今日届いた未読メールを要約して」
「Amazon からの先月のメールを探して」
「受信箱の最新10件を一覧にして」
注意
App 用パスワードは iCloud メール・連絡先・カレンダーなどにアクセスできます。設定ファイルを人に見せたり、リポジトリに入れたりしないでください。漏れたら account.apple.com でそのパスワードを取り消してください。
メール本文はそのまま AI に渡ります。知らない人からのメールに「〇〇を実行して」などの指示が書かれていても、AI がそれに従わないよう、ほかのツール(送信やファイル操作など)と組み合わせるときは操作の確認をオンにしておいてください。
Apple アカウントのパスワードを変えると、App 用パスワードはすべて無効になります。作り直して設定し直してください。
開発
npm ci
npm run build
ICLOUD_EMAIL=you@icloud.com ICLOUD_APP_PASSWORD=xxxx-xxxx-xxxx-xxxx npx @modelcontextprotocol/inspector node dist/index.jsLicense
MIT
Available Tools
4 toolsget_messageARead-only
Read one message by UID: headers, plain-text body and attachment list. Does not mark it as read.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | ||
| mailbox | No | INBOX | |
| maxChars | No | Truncate the body to this many characters |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, but the description adds a genuinely non-obvious side-effect disclosure: retrieving the message 'does not mark it as read.' That is exactly the kind of state-changing behavior an agent needs to know before calling a read tool. It stops short of covering error cases (invalid UID, nonexistent mailbox) or truncation behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences, front-loaded with the operation and payload, followed by the side-effect caveat. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description carries the return-value burden and does outline headers, body, and attachments. It is adequate for a simple single-message read, though the mailbox default and error behavior remain unexplained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 33% (only maxChars is documented), so the description must compensate; it clarifies that uid identifies the single message being fetched, but says nothing about the mailbox parameter or its 'INBOX' default. Partial compensation warrants a baseline 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Read one message by UID') and enumerates the returned payload (headers, plain-text body, attachment list). The singular scope plus the UID key cleanly separates it from list_messages/search_messages without needing to name them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use or when-not-to-use guidance, and no mention of alternatives or prerequisites (e.g., that the UID must first come from list_messages or search_messages). The intended use is only inferable from the verb.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_mailboxesARead-only
List all iCloud Mail mailboxes (folders) with message and unread counts.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the safety profile is covered. The description adds genuinely useful context absent from the structured fields by stating the response includes message and unread counts; it omits pagination/auth details, which is a minor gap for a no-parameter read tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler; the scope and return contents are stated before any detail. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only tool with no output schema, the description says what is returned (mailboxes with message/unread counts), which is enough to call it correctly. Slight gap: no note on auth or empty-state behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the baseline is 4. The description correctly implies no filtering arguments are accepted ('all' mailboxes) and adds nothing that would mislead about inputs.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (list) and resource (iCloud Mail mailboxes/folders) with scope ('all') and even summarizes returned content. It doesn't explicitly contrast with siblings, but the resource is unambiguously distinct from list_messages/search_messages/get_message.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance, no prerequisites, and no mention of alternatives such as list_messages for enumerating message contents. Usage is only weakly implied by the narrow purpose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_messagesARead-only
List the most recent messages in a mailbox (newest first). Returns headers only.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| mailbox | No | Mailbox path, e.g. INBOX | INBOX |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only supply readOnlyHint=true; the description adds two genuinely behavioral facts beyond that: results are ordered newest-first and contain headers only (no message bodies). It stops short of noting pagination or that only the default limit is returned.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the action and scoping, and the return-content caveat placed at the end. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description correctly covers what comes back ('headers only') and the ordering, which is the essential information for a list tool. Missing only detail about paging or how to get full message bodies (get_message).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50% – 'mailbox' is documented in the schema, 'limit' is not (only its type/default/bounds). The description's 'most recent' wording loosely implies the limit's role but adds no paging or format semantics, so it neither compensates nor regresses.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb ('List') plus resource ('messages'), with scope qualifiers: 'most recent', 'in a mailbox', 'newest first'. An agent can tell it apart from get_message and search_messages by the recency/listing framing, though no sibling is named explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied rather than stated – the recency-scoped phrasing suggests browsing a mailbox rather than targeted retrieval (search_messages) or fetching a single item (get_message). There is no explicit when-to-use, when-not-to-use, or named alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_messagesARead-only
Search messages in a mailbox. All conditions are combined with AND. Returns headers only, newest first.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Recipient address or name contains | |
| from | No | Sender address or name contains | |
| text | No | Headers or body contains | |
| limit | No | ||
| since | No | On or after this date (YYYY-MM-DD) | |
| before | No | Before this date (YYYY-MM-DD) | |
| unread | No | true: unread only, false: read only | |
| mailbox | No | INBOX | |
| subject | No | Subject contains |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so safety is covered. The description adds real behavioral value beyond that: all conditions are AND-ed, only headers are returned (not bodies), and results are ordered newest first. It omits pagination behavior, though limit's maximum suggests a cap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, each carrying distinct information (scope, boolean semantics, return shape), with the core purpose front-loaded. No filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description usefully states the return shape (headers only, newest first). The remaining gap is pagination/windowing guidance given a 9-parameter search surface, but otherwise an agent has enough to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 78%, with per-parameter descriptions for the match fields and defaults on limit and mailbox, so the schema does most of the work. The description contributes the AND-combination rule, which is meaningful, but adds no matching semantics (exact vs substring) or date-format guidance beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb and resource ("Search messages in a mailbox") and scopes the operation. It does not explicitly differentiate itself from the sibling list_messages, so the agent must infer that "search" implies filtering while "list" does not.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: the mention of AND-combined conditions suggests this tool is for filtered queries, but there is no statement of when to prefer it over list_messages or get_message, and no stated prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
4 tool updates
v0.1.0- First observed
get_message - First observed
list_mailboxes - First observed
list_messages - First observed
search_messages
TDQS
Scored across 4 tools
Each tool targets a distinct resource and action: list_mailboxes enumerates folders, list_messages lists a mailbox's headers, search_messages queries within a mailbox, and get_message fetches a single message by UID. Boundaries between list_messages and search_messages are clear since one is unfiltered listing and the other is a conditional search.
All four tools follow a strict verb_noun snake_case pattern: list_mailboxes, list_messages, search_messages, get_message. The verb choice is also semantically precise (list vs. search vs. get).
Four tools is a lean but coherent set for a read-only mail client, covering folder listing, message listing, search, and retrieval. It sits slightly under the ideal scope, but nothing is redundant or missing for the read path.
The surface is read-only: there is no send/compose, delete, move, or flag (mark read/unread) operation, which are core mail lifecycle actions. Reading is well covered (mailboxes, list, search, fetch by UID), but agents cannot act on messages beyond inspection.
Maintenance
Related MCP Connectors
- muse.spaceOAuthspace.muse
Let your agent into iCloud Mail, calendar and contacts. It gets actions, never your password.
Your mailboxes in ChatGPT and Claude: Gmail, iCloud, Fastmail, any IMAP. Passwords stay yours.
Connect any mailbox to Claude, ChatGPT & AI: read, send, reply, schedule & search emails.
- PO6 MailboxOAuthcom.po6
Give AI agents secure access to your email via private aliases with dedicated mailbox storage.
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceEnables LLMs to read, search, and manage emails via IMAP with secure, read-only access to email accounts.6-
- AlicenseNot gradedqualityDmaintenanceProvides AI assistants with read-only access to iCloud mail and calendar via IMAP and CalDAV, with opt-in write support for sending mail, managing events, and contacts.1MIT
- AlicenseNot gradedqualityBmaintenanceEnables an AI assistant to read and search iCloud mail, draft messages (never sent), manage calendar events with a preview/commit gate, and look up contacts via IMAP, CalDAV, and CardDAV.248 npm2MIT
- AlicenseNot gradedqualityAmaintenanceEnables AI assistants to securely access IMAP mailboxes with read-focused tools for searching, reading, listing messages, and creating drafts, while deliberately preventing sending or deleting emails.MIT