w0h1v/mcp-proton

Presets ·
Capabilities ·
Security model ·
Docs ·
Roadmap
**mcp-proton** is an MCP server that gives AI agents access to Proton Mail through Proton Mail Bridge. You decide what each agent may do, per action: read, organize, draft, send or delete. Every operation goes through one policy engine, whether it comes from an MCP client, the CLI, the review UI or a scheduled job.
> [!IMPORTANT]
> **Beta (0.2.0b2).** Everything in the design is implemented and tested against fake IMAP/SMTP servers, and on one live Proton Mail Bridge 03.27.01 account: the full compatibility probe and one approved send. The reply path, other Bridge versions and Linux/Windows are not yet tested live; see docs/compatibility.md. Capabilities report as unverified until you run the probe against your own Bridge and record the results. Tool schemas and storage formats may still change before 1.0; each change is listed in the changelog.
Independent project. Not affiliated with or endorsed by Proton AG.
Highlights
- **Allow, Ask or Deny per action.** Pick a preset, then override it per client, account or mailbox. Grant temporary access that expires on its own.
- **Approvals bound to the exact request.** An approval covers specific recipients, content and messages. Change anything and it needs a new approval. The agent can't approve its own requests.
- **Honest about email.** Reading never marks mail read. Permanent deletion targets only the messages you named. If a send's outcome is unknown, it is never resent automatically.
- **Effects, not raw IMAP verbs.** Removing a label and destroying a message can be the same IMAP command. mcp-proton classifies operations by what they do in Proton's model, and refuses when that's not established.
- **Audit trail.** Every write is journaled with who asked, what policy decided and what happened, including partial results.
- **No AI calls, no telemetry.** The service talks only to Bridge, to the MCP client that asked, and to webhook destinations you approve. FastMCP's own telemetry is switched off unless you set FASTMCP_TELEMETRY_MODE.
How it works
Quickstart
**Requirements:** a paid Proton Mail plan, with Proton Mail Bridge installed and signed in, and Python 3.11 or newer. Setting up Bridge covers the Bridge side, including which settings matter. macOS is the first development target. Linux and Windows are untested.
mcp-proton init walks through five steps:
1. **Connect Bridge.** Host, ports (default IMAP 1143, SMTP 1025) and connection mode (--security starttls or ssl), and the username and password from Bridge's **Mailbox details**, not your Proton password. In Bridge's split address mode, set up one account per address. The password goes to the OS credential store. On headless systems use --secret-ref env:VAR or --secret-ref file:/path (mode 0600). There is no plaintext fallback.
2. **Trust Bridge's certificate.** Bridge uses a self-signed certificate. Setup shows its SHA-256 fingerprint and pins it after you confirm, or uses --tls-ca-file with Bridge's exported certificate.
3. **Choose an autonomy preset.** Until you choose one, every operation is denied.
4. **Choose storage mode.** live (default) keeps no copy of your mail. metadata and index keep a local cache for faster listing and full-text search.
5. **Print a client configuration** for your MCP client.
Autonomy presets
| Preset | Reading | Organizing and drafts | Sending | Permanent deletion | Import, export, folder/label deletion, automation |
|---|:-:|:-:|:-:|:-:|:-:|
| **Reader** | ✅ Allow | ⛔ Deny | ⛔ Deny | ⛔ Deny | ⛔ Deny |
| **Assistant** | ✅ Allow | ✅ Allow | ✋ Ask | ✋ Ask | ✋ Ask |
| **Autonomous** | ✅ Allow | ✅ Allow | ✅ Allow | ✅ Allow | ✅ Allow |
| **Custom** | your choice | your choice | your choice | your choice | your choice |