Proton Bridge MCP
MCPB · PROTON-BRIDGE-MCP-2.0.0.MCPB
Read, organise and carefully-gated send for Proton Mail, without your mail leaving this machine.
Available components
Last scanned (11 hours ago)
Scores higher than 72% of MCPB servers
Category Communication
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security0
- No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.Unverified
- Known CVEs could not be checked: we found no dependency list to check in this bundle: either it runs a compiled binary, whose bundled manifests we do not read, or none of the package.json, requirements.txt, pyproject.toml or uv.lock files it ships for its runtime declares a dependency we can read (a requirements.txt that only points at a setup.py project, a local path, or a nested requirements file we cannot follow counts as none).Unverified
- Install-script risk not yet assessed.Unverified
- Dependency health could not be checked: we found no dependency list to check in this bundle: either it runs a compiled binary, whose bundled manifests we do not read, or none of the package.json, requirements.txt, pyproject.toml or uv.lock files it ships for its runtime declares a dependency we can read (a requirements.txt that only points at a setup.py project, a local path, or a nested requirements file we cannot follow counts as none).Unverified
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (Apache-2.0).Pass
- Actively maintained (last published 12 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability70
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3664 tokens (~146/item across 25 items; 25 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: two runs of the same published version returned different tool surfaces, so we cannot tell a change in the package from a difference in our own sandbox run.Unverified
Tool Coverage89
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 68% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 6 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 25 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 2 categories
Categories scored 0 because we could not verify them: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 23 Oct 26 −16
- Stability: pass → unverified ▼ security
- Schema quality: 121 → 146 ▼ functional
- 22 Oct 26 +1
- Stability: 0.97 → pass security
- 21 Oct 26 −1
- Stability: pass → 0.97 functional
- 17 Oct 26 +3
- Stability: 0.80 → pass security
- 16 Oct 26 −3
- Stability: pass → 0.80 functional
- 15 Oct 26 +1
- Stability: 0.97 → pass security
- 13 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Oct 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 83 to 90. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed mcpb/https://github.com/Considus/proton-bridge-mcp/releases/download/v2.0.0/proton-bridge-mcp-2.0.0.mcpb
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | mcpb |
| Reason | No attestation published |
Background: How many MCP packages publish verified provenance →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
apply_label Apply a label ~157
Tag one message (uid) or many (uids) with an existing label. Messages stay where they are.
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | – | Preview exactly what would happen and change nothing. Needs no confirmation. |
| folder | string | – | Source folder, default INBOX. |
| label | string | yes | An existing label. On Proton the Labels/ prefix is optional; elsewhere this is an ordinary mailbox name. |
| uid | string | – | One message. Pass this or uids. |
| uids | array | – | Several messages, as explicit uids. No wildcards. |
| uidvalidity | string | – | UIDVALIDITY reported alongside the uid. Pass it back so a mailbox resync cannot make this act on the wrong message. |
No output schema declared.
No examples provided.
create_draft Create a draft ~120
Write a draft into the Proton Drafts folder. Never sends. For a reply, pass in_reply_to (the original Message-ID).
| Name | Type | Req | Description |
|---|---|---|---|
| attach | array | – | Files to attach, by path. Only from the allowed source directories. |
| body | string | yes | – |
| cc | string | – | – |
| dry_run | boolean | – | Preview exactly what would happen and change nothing. Needs no confirmation. |
| in_reply_to | string | – | – |
| references | string | – | – |
| subject | string | yes | – |
| to | string | yes | – |
No output schema declared.
No examples provided.
create_folder_or_label Create a folder or label ~98
Create a new label or folder. GATED: it changes your folder and label structure, so confirm the exact name and type with the user, then call with confirmed=true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirmed | boolean | yes | – |
| dry_run | boolean | – | Preview exactly what would happen and change nothing. Needs no confirmation. |
| kind | string | yes | – |
| name | string | yes | Name only, no 'Labels/' or 'Folders/' prefix. |
No output schema declared.
No examples provided.
delete_draft Delete a draft ~89
Move a draft to Trash. GATED. Nothing here deletes permanently.
| Name | Type | Req | Description |
|---|---|---|---|
| confirmed | boolean | – | – |
| dry_run | boolean | – | Preview exactly what would happen and change nothing. Needs no confirmation. |
| folder | string | – | Defaults to your Drafts folder. |
| uid | string | yes | – |
| uidvalidity | string | – | UIDVALIDITY of the folder; refuses on mismatch. |
No output schema declared.
No examples provided.
delete_label Delete a label ~127
Delete a label outright. Every message that carried it stays exactly where it is and simply loses the tag — no mail is deleted. Labels only; folders are where messages live and are not deletable here. Pass label for one or labels for several. GATED.
| Name | Type | Req | Description |
|---|---|---|---|
| confirmed | boolean | – | – |
| dry_run | boolean | – | Preview it, including how many messages carry each label. Changes nothing, needs no confirmation. |
| label | string | – | The label to delete. On Proton the Labels/ prefix is optional. |
| labels | array | – | Several label names, instead of label. |
No output schema declared.
No examples provided.
find_thread Find a thread ~112
Pull every message of a conversation from All Mail, showing which ones carry documents. ESSENTIAL: Proton's UI groups conversations but IMAP exposes single messages, so an inbox 'Re:' can look attachment-free while the thread's original holds the PDFs. Run this before concluding what a thread needs.
| Name | Type | Req | Description |
|---|---|---|---|
| folder | string | – | Folder of that uid, default INBOX. |
| subject | string | – | Alternatively match on a subject directly. |
| uid | string | – | A message in the thread (its subject is used). |
No output schema declared.
No examples provided.
forward Forward ~156
Forward an existing message to someone on demand. GATED like send: confirm recipient with the user, then call with confirmed=true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirmed | boolean | yes | – |
| dry_run | boolean | – | Preview exactly what would happen and change nothing. Needs no confirmation. |
| folder | string | – | Default INBOX. |
| from_address | string | – | Override the From address (use your alias-owner address when forwarding via an alias reverse-address). |
| note | string | – | Optional note added above the forwarded content. |
| to | string | yes | – |
| uid | string | yes | – |
| uidvalidity | string | – | UIDVALIDITY reported alongside the uid. Pass it back so a mailbox resync cannot make this act on the wrong message. |
No output schema declared.
No examples provided.
get_headers Get message headers ~85
Headers plus SPF/DKIM/DMARC verdicts and Proton metadata, for judging whether a message is what it claims to be. Pass raw=true for the unparsed header block.
| Name | Type | Req | Description |
|---|---|---|---|
| folder | string | – | Default INBOX. |
| raw | boolean | – | Return the full raw header block instead. |
| uid | string | yes | – |
| uidvalidity | string | – | – |
No output schema declared.
No examples provided.
list_attachments List attachments ~119
List a message's attachments, separating real DOCUMENTS from inline cid: images and PGP keys (hidden by default). Call before claiming a message has no attachment — read_message shows body text only and never reveals files.
| Name | Type | Req | Description |
|---|---|---|---|
| folder | string | – | Default INBOX. |
| include_inline | boolean | – | Also list inline images / PGP keys. |
| uid | string | yes | – |
| uidvalidity | string | – | UIDVALIDITY reported alongside the uid. Pass it back so a mailbox resync cannot make this act on the wrong message. |
No output schema declared.
No examples provided.
list_folders List folders and labels ~98
List all Proton folders and labels available over the Bridge. Call this first to learn exact folder/label names for filing and tagging. Pass folder to get that folder's message counts plus UIDNEXT and UIDVALIDITY instead: UIDs are only valid within one UIDVALIDITY generation, so check it before acting on uids noted earlier.
| Name | Type | Req | Description |
|---|---|---|---|
| folder | string | – | Report this one folder's counts and UIDVALIDITY instead of listing every folder. |
No output schema declared.
No examples provided.
mark Mark a message ~133
Mark one message (uid) or many in one pass (uids) read/unread or star/unstar.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | – |
| dry_run | boolean | – | Preview exactly what would happen and change nothing. Needs no confirmation. |
| folder | string | – | Default INBOX. |
| uid | string | – | One message. Pass this or uids. |
| uids | array | – | Several messages, as explicit uids. No wildcards. |
| uidvalidity | string | – | UIDVALIDITY reported alongside the uid. Pass it back so a mailbox resync cannot make this act on the wrong message. |
No output schema declared.
No examples provided.
move_to_folder Move to folder ~184
File one message (uid) or many (uids): move it into another folder (e.g. 'Folders/<name>', 'Archive', 'Trash'). Many at once is GATED: preview with dry_run=true, show the user, then call with confirmed=true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirmed | boolean | – | Required whenever uids is used. |
| dry_run | boolean | – | Preview exactly what would happen and change nothing. Needs no confirmation. |
| folder | string | – | Source folder, default INBOX. |
| to_folder | string | yes | – |
| uid | string | – | One message. Pass this or uids. |
| uids | array | – | Several messages, as explicit uids. No wildcards. |
| uidvalidity | string | – | UIDVALIDITY reported alongside the uid. Pass it back so a mailbox resync cannot make this act on the wrong message. |
No output schema declared.
No examples provided.
poll_folder Poll for new mail ~146
Messages that have arrived since the last poll. The very first poll emits nothing and just records where the mailbox ends, so turning this on does not replay the backlog. Marks nothing as read. Pass commit to commit a checkpoint an advance=false poll returned; repeating that is harmless.
| Name | Type | Req | Description |
|---|---|---|---|
| advance | boolean | – | Default true. Set false to look without committing, then confirm with commit. |
| commit | string | – | A checkpoint '<uidvalidity>:<uid>', exactly as an advance=false poll reported it. Commits it instead of polling. |
| folder | string | – | Default INBOX. |
| limit | integer | – | Most per call, 1 to 100 (default 20). |
No output schema declared.
No examples provided.
purge_attachments Delete saved attachments ~49
Immediately delete all ephemeral saved attachments. Call after reading a saved file so nothing lingers on disk.
| Name | Type | Req | Description |
|---|---|---|---|
| dry_run | boolean | – | Preview exactly what would happen and change nothing. Needs no confirmation. |
No output schema declared.
No examples provided.
read_attachment Read an attachment ~183
Read an attachment inline. Text comes back as text: PDFs via pypdf, plus text/csv/json/ics/eml, for invoices, decks, reports. An image comes back as a viewable image, the only way to see a photo or a scan when the client cannot read local files. Other binary types must use save_attachment instead.
| Name | Type | Req | Description |
|---|---|---|---|
| filename | string | – | Which attachment (partial match OK). Optional if there is only one. |
| folder | string | – | Default INBOX. |
| include_inline | boolean | – | Also consider inline images and PGP keys, which are hidden by default. A filename no document matches is looked for among them anyway. |
| uid | string | yes | – |
| uidvalidity | string | – | UIDVALIDITY reported alongside the uid. Pass it back so a mailbox resync cannot make this act on the wrong message. |
No output schema declared.
No examples provided.
read_message Read a message ~74
Read the full headers and body text of one message by uid within a folder.
| Name | Type | Req | Description |
|---|---|---|---|
| folder | string | – | Default INBOX. |
| uid | string | yes | – |
| uidvalidity | string | – | UIDVALIDITY reported alongside the uid. Pass it back so a mailbox resync cannot make this act on the wrong message. |
No output schema declared.
No examples provided.
remove_label Remove a label ~187
Take a label off one message (uid) or many (uids). The messages stay where they are. GATED: removing a label ends in an expunge against the label mailbox, so confirm it or preview with dry_run=true first.
| Name | Type | Req | Description |
|---|---|---|---|
| confirmed | boolean | – | – |
| dry_run | boolean | – | Preview exactly what would happen and change nothing. Needs no confirmation. |
| folder | string | – | Folder the message lives in, default INBOX. |
| label | string | yes | The label to take off. On Proton the Labels/ prefix is optional. |
| uid | string | – | One message. Pass this or uids. |
| uids | array | – | Several messages, as explicit uids. No wildcards. |
| uidvalidity | string | – | UIDVALIDITY reported alongside the uid. Pass it back so a mailbox resync cannot make this act on the wrong message. |
No output schema declared.
No examples provided.
rename_folder_or_label Rename a folder or label ~152
Rename a folder or label where it stands: a label stays a label and a folder keeps its parent. INBOX and the special mailboxes (Sent, Drafts, Trash, Spam, Archive, All Mail) are refused. GATED: confirm the old and new names with the user, then call with confirmed=true.
| Name | Type | Req | Description |
|---|---|---|---|
| confirmed | boolean | – | – |
| dry_run | boolean | – | Preview exactly what would happen and change nothing. Needs no confirmation. |
| name | string | yes | The folder or label, exactly as list_folders shows it, e.g. 'Labels/Receipts'. |
| new_name | string | yes | The new name only, no 'Labels/' or 'Folders/' prefix. |
No output schema declared.
No examples provided.
reply Reply ~286
Reply to one message with correct threading. Replies to the Reply-To address when there is one, so alias mail stays masked. Pass all=true to reply to everyone, with your own addresses removed from Cc and duplicates dropped. Pass draft=true to save it for review, or confirmed=true to send.
| Name | Type | Req | Description |
|---|---|---|---|
| all | boolean | – | Reply to everyone on the message, not just the sender. Default false. |
| attach | array | – | Files to attach, by path. Only from the allowed source directories. |
| body | string | yes | Your reply text. The original is quoted beneath unless quote=false. |
| confirmed | boolean | – | Required to actually send. Not needed when draft=true. |
| draft | boolean | – | Save to Drafts instead of sending. Needs no confirmation because nothing goes out. |
| dry_run | boolean | – | Preview exactly what would happen and change nothing. Needs no confirmation. |
| folder | string | – | Folder holding the message. Default INBOX. |
| from_address | string | – | Must be on the sender allowlist. Left unset, alias mail automatically uses the alias-owner address. |
| quote | boolean | – | Quote the original beneath your reply. Default true. |
| subject | string | – | Override the auto 'Re: ...' subject. |
| uid | string | yes | – |
| uidvalidity | string | – | UIDVALIDITY for that folder; refuses on mismatch. |
No output schema declared.
No examples provided.
save_attachment Save an attachment ~194
Write attachment(s) to disk and return the path(s). Use for images, scanned PDFs, or anything not text-extractable. EPHEMERAL by default — files self-delete after the TTL.
| Name | Type | Req | Description |
|---|---|---|---|
| dest_dir | string | – | Sub-path under the attachments dir. Writes outside it are refused. |
| dry_run | boolean | – | Preview exactly what would happen and change nothing. Needs no confirmation. |
| filename | string | – | Partial match; omit to save all documents. |
| folder | string | – | Default INBOX. |
| include_inline | boolean | – | – |
| persist | boolean | – | Keep the file permanently. Default false = auto-deleted after the TTL so nothing lingers for the user to open by accident. |
| uid | string | yes | – |
| uidvalidity | string | – | UIDVALIDITY reported alongside the uid. Pass it back so a mailbox resync cannot make this act on the wrong message. |
No output schema declared.
No examples provided.
search_mail Search a folder ~335
Search a folder. Combine any of: text, from, subject, since (DD-Mon-YYYY), unread_only, flagged_only. Returns uids + envelopes, newest first. With no filters it lists the newest messages in the folder. Set include_locations to also report which labels and folders each message carries. Set all_folders to search every mailbox at once when you do not know where something is: duplicates collapse by Message-ID and each row says where the message lives.
| Name | Type | Req | Description |
|---|---|---|---|
| all_folders | boolean | – | Search every mailbox instead of one folder. Takes no folder, uidvalidity or include_locations. |
| before | string | – | DD-Mon-YYYY. Combine with since for a date range. |
| flagged_only | boolean | – | – |
| folder | string | – | Folder to search, e.g. INBOX, 'All Mail', 'Folders/<name>'. Default INBOX. |
| from | string | – | – |
| include_locations | boolean | – | Report every other mailbox each message appears in, so you can tell what it is already labelled or filed as without a second search. Costs one search per mailbox. |
| limit | integer | – | Max results (default 15, or the most recent 25 with all_folders). |
| since | string | – | DD-Mon-YYYY, e.g. 01-Jul-2026 |
| subject | string | – | – |
| text | string | – | – |
| uidvalidity | string | – | UIDVALIDITY reported alongside the uid. Pass it back so a mailbox resync cannot make this act on the wrong message. |
| unread_only | boolean | – | – |
No output schema declared.
No examples provided.
send Send mail ~198
Send a new email. GATED: the agent must show the user the exact To/Subject/Body, get an explicit yes, then call with confirmed=true. Never call unattended.
| Name | Type | Req | Description |
|---|---|---|---|
| attach | array | – | Files to attach, by path. Only from the allowed source directories. |
| body | string | yes | – |
| cc | string | – | – |
| confirmed | boolean | yes | Must be true; set only after the user approves this exact message. |
| dry_run | boolean | – | Preview exactly what would happen and change nothing. Needs no confirmation. |
| from_address | string | – | Override the From address. For replies to a SimpleLogin alias, set this to your alias-owner address (PROTON_ALIAS_FROM) and send 'to' the reverse-alias from the message's Reply-To header. |
| in_reply_to | string | – | – |
| references | string | – | – |
| subject | string | yes | – |
| to | string | yes | – |
No output schema declared.
No examples provided.
send_draft Send a draft ~101
Send a saved draft as written, then move it to Trash. GATED. Sender and recipient checks run again at send time.
| Name | Type | Req | Description |
|---|---|---|---|
| confirmed | boolean | – | – |
| dry_run | boolean | – | Preview exactly what would happen and change nothing. Needs no confirmation. |
| folder | string | – | Defaults to your Drafts folder. |
| uid | string | yes | – |
| uidvalidity | string | – | UIDVALIDITY of the folder; refuses on mismatch. |
No output schema declared.
No examples provided.
unsubscribe Unsubscribe ~112
Report how to unsubscribe from a message using its List-Unsubscribe header, and optionally send the email form. Reports only unless send=true. Web links are never fetched for you.
| Name | Type | Req | Description |
|---|---|---|---|
| confirmed | boolean | – | – |
| dry_run | boolean | – | Preview exactly what would happen and change nothing. Needs no confirmation. |
| folder | string | – | Default INBOX. |
| send | boolean | – | Actually send the mailto: unsubscribe. Requires confirmed. |
| uid | string | yes | – |
| uidvalidity | string | – | – |
No output schema declared.
No examples provided.
update_draft Update a draft ~169
Replace a draft's contents. Threading headers are carried over, the new version is saved before the old one is binned. Omit a field to keep what the draft already had.
| Name | Type | Req | Description |
|---|---|---|---|
| attach | array | – | Files to attach, by path. Only from the allowed source directories. |
| body | string | – | – |
| cc | string | – | – |
| dry_run | boolean | – | Preview exactly what would happen and change nothing. Needs no confirmation. |
| folder | string | – | Defaults to your Drafts folder. |
| from_address | string | – | Must be on the sender allowlist. |
| subject | string | – | – |
| to | string | – | – |
| uid | string | yes | – |
| uidvalidity | string | – | UIDVALIDITY of the folder; refuses on mismatch. |
No output schema declared.
No examples provided.
How do I install the Proton Bridge MCP server?
Proton Bridge MCP ships as an MCPB bundle, a single file you download and open in an MCP host that supports MCPB bundles, such as Claude Desktop. The host reads the launch command from the bundle's own manifest, so there is no command to copy. Before opening it, check the file's SHA-256 matches the one the MCP registry declares for it, 8d78889b76f956de894082e5b35c02dc69b7d3150ad7b9277f59ca3dc269a5ae; the commands to do that are on this page. If it does not match, do not open it.
mcpb · proton-bridge-mcp-2.0.0.mcpb
Download bundleCheck the download matches the SHA-256 the MCP registry declares before you open it. If it does not match, do not open the file.
SHA-256
8d78889b76f956de894082e5b35c02dc69b7d3150ad7b9277f59ca3dc269a5ae
macOS / Linux
echo "8d78889b76f956de894082e5b35c02dc69b7d3150ad7b9277f59ca3dc269a5ae proton-bridge-mcp-2.0.0.mcpb" | shasum -a 256 -c
Windows (PowerShell)
(Get-FileHash -Algorithm SHA256 .\proton-bridge-mcp-2.0.0.mcpb).Hash -eq "8d78889b76f956de894082e5b35c02dc69b7d3150ad7b9277f59ca3dc269a5ae"
Run it in the folder you saved the bundle to, then open the file with an MCPB-capable host such as Claude Desktop.
What is the Proton Bridge MCP server?
Proton Bridge MCP is listed in the public MCP registry as com.considus/proton-bridge-mcp. Read, organise and carefully-gated send for Proton Mail, without your mail leaving this machine. This page covers its MCPB bundle (https://github.com/Considus/proton-bridge-mcp/releases/download/v2.0.0/proton-bridge-mcp-2.0.0.mcpb).
Is the Proton Bridge MCP server safe to use?
Proton Bridge MCP scores 39 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Proton Bridge MCP server expose?
Proton Bridge MCP exposes 25 tools: list_folders, poll_folder, search_mail, get_headers, read_message, and 20 more. Their descriptions and schemas cost roughly 3,664 tokens of context every time the server is loaded.
What licence is the Proton Bridge MCP server under?
Proton Bridge MCP declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.