mailtag
Blog / MCP
IMAP MCP server: connect any mailbox to an AI agent
- If your mailbox has no MCP server of its own (a custom domain, GMX, iCloud, Yahoo), use an IMAP MCP server. It signs in like a mail app.
- It uses your password or an app password, which opens the whole mailbox. Most can send, move and delete by default.
- Turn on read-only mode first. Most won't work with Outlook.com, because it doesn't accept plain passwords.
An IMAP MCP server lets an AI assistant such as Claude or ChatGPT search, read and often send, move or delete the email in your mailbox. MCP (Model Context Protocol) is the standard way these assistants connect to other apps. IMAP is the standard way mail apps reach a mailbox, and almost every mailbox supports it. That makes an IMAP MCP server the universal fallback: if your provider has no official server, and most don't, this is how an agent reaches your mail.
The catch is that IMAP was built for mail apps, not for agents. A server that signs in with your password can do everything your mail app can. This article compares the main options and shows how to give the agent less than everything. For provider-specific options, see email MCP servers compared.
IMAP MCP servers compared
Checked on 27 October 2026, from each project's documentation and the services' own pages.
| Server | Runs on | Read-only mode | Send | Delete | Where the password is kept |
|---|---|---|---|---|---|
| email-mcp | Your computer | Yes | Yes | Yes | System keychain or a file |
| imap-mcp-server | Your computer | Yes | Yes | Yes | Encrypted file on your computer |
| mcp-mail-server | Your computer | No | Yes | Yes | A settings file |
| MCPEmails | Hosted | Yes | Yes | Yes | Their servers |
| MailMCP | Hosted, France | ? | Yes | Yes | Their servers |
| MailTag | Hosted, EU | Yes | Yes | No | Their servers |
? = not documented. imap-mcp-server also lets you pick exactly which actions exist. MCPEmails can hold each send for your approval. With MailTag you choose per agent whether it can change anything, draft or send, and sending is capped at 10, 50 or 200 a day.
What you need
Three things from your provider: the IMAP server and port, the server for sending (SMTP) if the agent should send, and a password. Most large providers want an app password, a separate password for one app: Gmail, iCloud, Yahoo, Fastmail. The server names for each are in IMAP settings.
One exception: Outlook.com requires you to sign in through Microsoft's own page (Microsoft Support). Microsoft 365 work accounts have the same rule. Servers that use a password won't connect there: see Outlook MCP server.
Set one up with read-only first
Both main open-source servers have a read-only mode. With it on, the agent can only search, read and list mail: sending, moving, deleting and labeling disappear. You turn it on in the server's settings when you add it to Claude Desktop, Claude Code or Cursor. Then you add your account with the server's setup wizard, using an app password.
Some servers let you go further and list exactly which actions exist. Note that email-mcp's read-only mode protects the mailbox only, not its calendar, reminders or settings tools. Check the project's instructions before you install it: projects rename things.
Risks to know
- The password opens everything. IMAP has no "read-only password". Read-only is a promise the MCP server makes, not a limit your provider enforces.
- Where the password sits. A plain settings file can be read by any program on your computer. Prefer the system keychain and a password only for this.
- Sending without a check. Most of these servers send as soon as the agent asks. An email with hidden instructions can trigger it. See email prompt injection.
- Hosted services hold the key. A hosted service saves setup but keeps a password to your whole mailbox on someone else's servers.
- Small projects. Many of these projects are a few months old with one maintainer. Look at recent activity before trusting one with your mail.
For developers
- email-mcp: LGPL-3.0, npm package
@codefuturist/email-mcp(the unscopedemail-mcpon npm is a different project), 52 tools, stdio or HTTP, password in the keychain, env or file.MCP_EMAIL_READ_ONLYremoves send, move, delete, label and bulk tools. Experimental OAuth2 for Gmail and Microsoft 365. - imap-mcp-server: MIT, npm package
imap-mcp-server. Run withnpx -y imap-mcp-serverandIMAP_MCP_READ_ONLY=trueinenv;IMAP_MCP_ENABLED_TOOLSfor an allowlist; accounts vianpx -p imap-mcp-server imap-setup. - mcp-mail-server: MIT, npm package
mcp-mail-server, credentials in env, no read-only switch; its delete tools expunge for good. - MCPEmails is AGPL-3.0 and can be self-hosted; its read-only grant opens folders with IMAP
EXAMINE. - Outlook.com requires OAuth2 for IMAP; Microsoft 365 has disabled Basic authentication for IMAP.
IMAP mail and MailTag's MCP server
MailTag connects to any IMAP mailbox with an app password: Gmail, iCloud, Yahoo, Fastmail or a custom domain. It sorts each new email into your own categories, as folders or as keywords. It runs on its servers in the EU without storing email content.
Its MCP server at https://mailtag.app/mcp is a hosted option where the limits are enforced on the server, not left to the agent:
- the agent signs in with your MailTag account (or you give a script a key) and never sees your mailbox password;
- you choose per agent which mailboxes, categories or saved views, how far back, and which fields: sender, subject, read state, text, attachments;
- only if you allow it, the agent can also move emails between your categories, edit categories and saved views, and save drafts in your mailbox's Drafts folder;
- drafts and sending are separate permissions: replies only or new email too, only to people you've replied to or to anyone, up to 10, 50 or 200 a day. Replies always go to the original sender;
- there is no way to delete email or move it out of the mailbox, and every call is listed under Recent activity.
It only sees email MailTag labeled in the last 30 days, so it isn't a replacement for full IMAP search. See the MCP docs and least privilege for email agents.
FAQ
What is an IMAP MCP server?
A small program that signs in to your mailbox like a mail app does. It offers actions like "search", "read" or "send" to an AI agent through MCP.
Which IMAP MCP server should I use?
To run one yourself, email-mcp has the most features and keeps the password in the keychain. imap-mcp-server has a clean read-only mode. Pick one with recent activity and start in read-only.
Does an IMAP MCP server work with Outlook.com?
Only if it supports Microsoft sign-in, as MCPEmails does and email-mcp does in an experimental mode. Outlook.com doesn't accept plain passwords, so most servers won't connect.
Can I make an IMAP MCP server read-only?
Yes, if the server supports it; email-mcp, imap-mcp-server and MCPEmails do. The password itself still allows everything.
Is my email sent to the AI provider?
Whatever the MCP server returns goes into the agent's conversation, so the agent's provider sees it. See AI agent email privacy.
Should I use my main password?
No. Use an app password if your provider offers one, so you can revoke the MCP server without changing your main password.