# io.github.jgalea/mailbox-mcp (npm · mailbox-mcp)

Multi-account email MCP server for Gmail, IMAP, and JMAP: search, send, drafts, labels.

- Trust score: 75/100 (medium)
- Change this week: +29
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `mailbox-mcp`: 75/100 (this document), [markdown](https://verifymcp.io/servers/jgalea-mailbox-mcp/mailbox-mcp.md), [page](https://verifymcp.io/servers/jgalea-mailbox-mcp/mailbox-mcp)

## Channel facts

- Registry: `npm`
- Package: `mailbox-mcp`
- Version: `0.9.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 70/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known high-severity CVE affects nodemailer 8.0.5, a direct dependency. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (143 of 148), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to jgalea/mailbox-mcp).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 22 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 77/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 3442 tokens (~70/item across 49 items; 49 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add jgalea-mailbox-mcp -- npx -y mailbox-mcp
```

### Codex

```bash
codex mcp add jgalea-mailbox-mcp -- npx -y mailbox-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "jgalea-mailbox-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "mailbox-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add jgalea-mailbox-mcp --command npx --arg -y --arg mailbox-mcp
```

### Hermes

```yaml
mcp_servers:
  jgalea-mailbox-mcp:
    command: "npx"
    args: ["-y", "mailbox-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "jgalea-mailbox-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "mailbox-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 75, +4)

- [functional improvement] Stability: unverified → 0.27

### 2026-08-02 (score 71, +50)

- [security regression] GHSA-r7g4-qg5f-qqm2 affects this package: high
- [security regression] GHSA-268h-hp4c-crq3 affects this package: high
- [security regression] GHSA-p6gq-j5cr-w38f affects this package: high
- [security regression] GHSA-wqvq-jvpq-h66f affects this package: high
- [security regression] CVE-2026-41907 affects this package: high
- [security regression] GHSA-frvp-7c67-39w9 affects this package: high
- [security regression] Known CVEs: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Provenance: unverified → pass
- [security improvement] Malware scan: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [security] The attested source repository moved: jgalea/mailbox-mcp
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] License: unverified → pass
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional] First check of Schema quality: unverified
- [functional] Licence: MIT

### 2026-07-31 (score 21, −25)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-27 (score 46)

First indexed and scored.

## MCP tools (49)

### `send_email` (~122 tokens)

Send a new email

Input parameters:

- `account` (string, required): Account alias
- `attachments` (array): Optional list of local file paths to attach. Each path must point to a regular file under 25 MB; total per message is also capped at 25 MB.
- `bcc` (array): BCC recipients
- `body` (string, required): Email body
- `cc` (array): CC recipients
- `html` (boolean): Send as HTML (default false)
- `subject` (string, required): Email subject
- `to` (array, required): Recipient email addresses

### `reply_email` (~134 tokens)

Reply to an email message

Input parameters:

- `account` (string, required): Account alias
- `attachments` (array): Optional list of local file paths to attach. Each path must point to a regular file under 25 MB; total per message is also capped at 25 MB.
- `bcc` (array): Additional BCC recipients
- `body` (string, required): Reply body
- `cc` (array): Additional CC recipients
- `html` (boolean): Send as HTML (default false)
- `message_id` (string, required): Message ID to reply to
- `reply_all` (boolean): Reply to all recipients (default false)

### `forward_email` (~114 tokens)

Forward an email message to new recipients

Input parameters:

- `account` (string, required): Account alias
- `attachments` (array): Optional list of local file paths to attach. Each path must point to a regular file under 25 MB; total per message is also capped at 25 MB.
- `html` (boolean): Send as HTML (default false)
- `message` (string): Optional message to add above the forwarded content
- `message_id` (string, required): Message ID to forward
- `to` (array, required): Recipient email addresses

### `create_draft` (~140 tokens)

Create a draft email

Input parameters:

- `account` (string, required): Account alias
- `attachments` (array): Optional list of local file paths to attach. Each path must point to a regular file under 25 MB; total per message is also capped at 25 MB.
- `bcc` (array): BCC recipients
- `body` (string, required): Email body
- `cc` (array): CC recipients
- `html` (boolean): Send as HTML (default false)
- `in_reply_to` (string): Message ID to create draft as reply to
- `subject` (string, required): Email subject
- `to` (array, required): Recipient email addresses

### `list_accounts` (~21 tokens)

List all configured email accounts with their provider type and email address

### `authenticate` (~215 tokens)

Add a new email account. For Gmail: opens a browser for OAuth. For IMAP/JMAP: stores encrypted credentials. Sensitive fields (username, password) can also be set via environment variables.

Input parameters:

- `alias` (string, required): Short name for this account (e.g. 'personal', 'work')
- `email` (string, required): Email address
- `host` (string): IMAP server hostname (IMAP only)
- `password` (string): IMAP/SMTP password or app password (IMAP only)
- `port` (number): IMAP server port (IMAP only, default 993)
- `provider` (string, required): Email provider type
- `sessionUrl` (string): JMAP session URL override (JMAP only, auto-discovered from host by default)
- `smtpHost` (string): SMTP server hostname (IMAP only)
- `smtpPort` (number): SMTP server port (IMAP only, default 587)
- `username` (string): IMAP/SMTP username (IMAP only)

### `reauth` (~56 tokens)

Re-run OAuth for an existing Gmail account without removing it. Opens a browser for Google sign-in. Use when the refresh token expires (invalid_grant) or scopes change.

Input parameters:

- `alias` (string, required): Account alias to re-authenticate

### `remove_account` (~29 tokens)

Remove a configured email account and its stored credentials

Input parameters:

- `alias` (string, required): Account alias to remove

### `search_emails` (~105 tokens)

Search emails in an account. Gmail supports full Gmail search syntax. IMAP searches subject and body. Optional folder parameter scopes the search to a specific label/folder.

Input parameters:

- `account` (string, required): Account alias
- `folder` (string): Optional folder/label to scope the search (IMAP mailbox path, Gmail label name, or JMAP mailbox name/id)
- `max_results` (number): Max results (default 20)
- `query` (string, required): Search query

### `read_email` (~39 tokens)

Read a single email message with full content

Input parameters:

- `account` (string, required): Account alias
- `message_id` (string, required): Message ID from search results

### `read_thread` (~41 tokens)

Read an entire email conversation thread (Gmail and JMAP only)

Input parameters:

- `account` (string, required): Account alias
- `thread_id` (string, required): Thread ID

### `inbox_summary` (~30 tokens)

Get a summary of recent inbox activity including total and unread counts

Input parameters:

- `account` (string, required): Account alias

### `list_labels` (~34 tokens)

List all labels (Gmail) or folders (IMAP) for an account

Input parameters:

- `account` (string, required): Account alias

### `create_label` (~42 tokens)

Create a new label (Gmail) or folder (IMAP)

Input parameters:

- `account` (string, required): Account alias
- `name` (string, required): Label/folder name

### `delete_label` (~44 tokens)

Delete a label (Gmail) or folder (IMAP)

Input parameters:

- `account` (string, required): Account alias
- `label_id` (string, required): Label/folder ID to delete

### `modify_email` (~59 tokens)

Add or remove labels/flags on a message

Input parameters:

- `account` (string, required): Account alias
- `add_labels` (array): Labels to add
- `message_id` (string, required): Message ID
- `remove_labels` (array): Labels to remove

### `batch_modify_emails` (~61 tokens)

Add or remove labels/flags on multiple messages

Input parameters:

- `account` (string, required): Account alias
- `add_labels` (array): Labels to add
- `message_ids` (array, required): Message IDs
- `remove_labels` (array): Labels to remove

### `trash_emails` (~35 tokens)

Move messages to trash

Input parameters:

- `account` (string, required): Account alias
- `message_ids` (array, required): Message IDs to trash

### `bulk_trash` (~193 tokens)

Trash all messages matching a query. Paginates the search and batch-trashes the IDs in one call. Use dry_run to see the count before committing. Useful for label cleanups (e.g. trash everything in 'Newsletters' or older than 90 days).

Input parameters:

- `account` (string, required): Account alias
- `dry_run` (boolean): If true, return the matching count without trashing anything.
- `folder` (string): Optional folder/label scope. On Gmail this becomes a 'label:' prefix; on IMAP/JMAP it scopes the search to that mailbox.
- `max` (number): Safety cap on number of messages to trash. Defaults to no cap; set this to bound destructive scope.
- `query` (string, required): Search query (Gmail syntax for Gmail accounts, e.g. 'label:Meetups' or 'from:noreply@example.com older_than:30d')

### `bulk_modify` (~224 tokens)

Add or remove labels on all messages matching a query. Same fast search-then-batch pattern as bulk_trash, but for arbitrary label ops. Use this for archive (remove_labels=['INBOX']), bulk star/unstar, mark-read across a label, moving messages between labels, etc. Use dry_run to see the count first.

Input parameters:

- `account` (string, required): Account alias
- `add_labels` (array): Labels to add to each matching message.
- `dry_run` (boolean): If true, return the matching count without modifying anything.
- `folder` (string): Optional folder/label scope. On Gmail becomes a 'label:' prefix; on IMAP/JMAP scopes the search to that mailbox.
- `max` (number): Safety cap on number of messages to modify. Defaults to no cap.
- `query` (string, required): Search query (Gmail syntax for Gmail accounts, e.g. 'in:inbox older_than:30d')
- `remove_labels` (array): Labels to remove from each matching message. Use ['INBOX'] for archive.

### `list_recent_bulk_ops` (~61 tokens)

List recent bulk_modify and bulk_trash operations recorded in the transaction log. Use to find an op id for undo_bulk_op.

Input parameters:

- `account` (string): Optional account filter.
- `limit` (number): Max records to return (default 20).

### `undo_bulk_op` (~76 tokens)

Reverse a previously recorded bulk_modify or bulk_trash by replaying the inverse label change against the exact ids that were touched. Find the op id from list_recent_bulk_ops. Idempotent on already-reversed ops (refuses to re-reverse).

Input parameters:

- `op_id` (string, required): The op id from list_recent_bulk_ops.

### `list_filters` (~21 tokens)

List Gmail filters

Input parameters:

- `account` (string, required): Account alias

### `create_filter` (~105 tokens)

Create a Gmail filter

Input parameters:

- `account` (string, required): Account alias
- `add_label` (string): Label to apply
- `archive` (boolean): Skip inbox
- `from` (string): Filter by sender
- `mark_read` (boolean): Mark as read
- `query` (string): Filter by search query
- `remove_label` (string): Label to remove
- `subject` (string): Filter by subject
- `to` (string): Filter by recipient

### `delete_filter` (~34 tokens)

Delete a Gmail filter

Input parameters:

- `account` (string, required): Account alias
- `filter_id` (string, required): Filter ID to delete

### `save_template` (~58 tokens)

Save an email template (stored as a Gmail draft with TEMPLATE label)

Input parameters:

- `account` (string, required): Account alias
- `body` (string, required): Template body
- `name` (string, required): Template name
- `subject` (string, required): Template subject

### `list_templates` (~22 tokens)

List saved email templates

Input parameters:

- `account` (string, required): Account alias

### `delete_template` (~33 tokens)

Delete a saved template

Input parameters:

- `account` (string, required): Account alias
- `message_id` (string, required): Template message ID

### `send_template` (~45 tokens)

Send an email using a saved template

Input parameters:

- `account` (string, required): Account alias
- `message_id` (string, required): Template message ID
- `to` (array, required): Recipients

### `get_signature` (~26 tokens)

Get the email signature for a Gmail account

Input parameters:

- `account` (string, required): Account alias

### `set_signature` (~36 tokens)

Update the email signature for a Gmail account

Input parameters:

- `account` (string, required): Account alias
- `signature` (string, required): HTML signature content

### `get_vacation` (~26 tokens)

Get vacation auto-reply settings

Input parameters:

- `account` (string, required): Account alias

### `set_vacation` (~135 tokens)

Configure vacation auto-reply

Input parameters:

- `account` (string, required): Account alias
- `body` (string): Auto-reply body (HTML)
- `contacts_only` (boolean): Only reply to contacts
- `domain_only` (boolean): Only reply to same domain
- `enabled` (boolean, required): Enable or disable auto-reply
- `end_time` (string): End date (ISO format, e.g. '2026-03-20')
- `start_time` (string): Start date (ISO format, e.g. '2026-03-10')
- `subject` (string): Auto-reply subject

### `unsubscribe` (~44 tokens)

Unsubscribe from a mailing list by finding the List-Unsubscribe header

Input parameters:

- `account` (string, required): Account alias
- `message_id` (string, required): Message ID from the mailing list

### `bulk_unsubscribe` (~37 tokens)

Find unsubscribe links for multiple mailing list messages

Input parameters:

- `account` (string, required): Account alias
- `message_ids` (array, required): Message IDs

### `update_draft` (~138 tokens)

Replace the contents of an existing Gmail draft. The draft's thread association is preserved automatically.

Input parameters:

- `account` (string, required): Account alias
- `attachments` (array): Optional list of local file paths to attach. Each must be a regular file under 25 MB.
- `bcc` (array): BCC recipients
- `body` (string, required): Email body
- `cc` (array): CC recipients
- `draft_id` (string, required): Draft ID returned by create_draft
- `html` (boolean): Send as HTML (default false)
- `subject` (string, required): Email subject
- `to` (array, required): Recipient email addresses

### `delete_draft` (~42 tokens)

Permanently delete a Gmail draft. This cannot be undone.

Input parameters:

- `account` (string, required): Account alias
- `draft_id` (string, required): Draft ID to delete

### `list_send_as` (~28 tokens)

List send-as aliases configured on a Gmail account

Input parameters:

- `account` (string, required): Account alias

### `download_attachment` (~94 tokens)

Download an email attachment to a safe directory

Input parameters:

- `account` (string, required): Account alias
- `attachment_id` (string, required): Attachment filename (recommended — stable) or ID from read_email (Gmail IDs are ephemeral)
- `message_id` (string, required): Message ID
- `save_to` (string): Directory to save to (default ~/Downloads/mailbox-mcp). Allowed: ~/Downloads/mailbox-mcp or /tmp.

### `mark_read` (~54 tokens)

Mark an email as read or unread

Input parameters:

- `account` (string, required): Account alias
- `message_id` (string, required): Message ID
- `read` (boolean): true to mark read, false to mark unread (default true)

### `star_email` (~52 tokens)

Star or unstar an email

Input parameters:

- `account` (string, required): Account alias
- `message_id` (string, required): Message ID
- `starred` (boolean): true to star, false to unstar (default true)

### `archive_email` (~59 tokens)

Archive an email (remove from inbox). Gmail removes the INBOX label; IMAP moves to the Archive folder; JMAP moves out of the inbox mailbox.

Input parameters:

- `account` (string, required): Account alias
- `message_id` (string, required): Message ID

### `list_drafts` (~40 tokens)

List drafts for an account

Input parameters:

- `account` (string, required): Account alias
- `max_results` (number): Max drafts to return (default 20)

### `send_draft` (~72 tokens)

Send an existing draft as-is. For Gmail/JMAP the draft is finalised and submitted; for IMAP the message is sent via SMTP and removed from the Drafts folder.

Input parameters:

- `account` (string, required): Account alias
- `draft_id` (string, required): Draft ID from list_drafts or create_draft

### `count_unread_by_label` (~36 tokens)

Count unread messages per label/folder. Useful for deciding where to look first.

Input parameters:

- `account` (string, required): Account alias

### `emails_since` (~95 tokens)

List messages received after a given timestamp. Use for polling new mail since a last-check marker.

Input parameters:

- `account` (string, required): Account alias
- `folder` (string): Optional folder/label to scope the search
- `max_results` (number): Max results (default 50)
- `since` (string, required): ISO 8601 timestamp, e.g. '2026-04-20T10:00:00Z'

### `multi_account_search` (~67 tokens)

Run the same search across all configured accounts in parallel. Returns results grouped by account alias.

Input parameters:

- `max_results` (number): Max results per account (default 10)
- `query` (string, required): Search query (Gmail syntax for Gmail accounts; plain text for IMAP/JMAP)

### `export_email` (~87 tokens)

Export an email as a raw RFC 822 .eml file to a safe directory. Useful for archival, legal discovery, or migration.

Input parameters:

- `account` (string, required): Account alias
- `message_id` (string, required): Message ID
- `save_to` (string): Directory to save to (default ~/Downloads/mailbox-mcp). Allowed: ~/Downloads/mailbox-mcp or /tmp.

### `export_thread` (~81 tokens)

Export all messages in a thread as individual .eml files to a safe directory. Gmail/JMAP only.

Input parameters:

- `account` (string, required): Account alias
- `save_to` (string): Directory to save to (default ~/Downloads/mailbox-mcp). Allowed: ~/Downloads/mailbox-mcp or /tmp.
- `thread_id` (string, required): Thread ID

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/jgalea-mailbox-mcp/mailbox-mcp#diagnostics

## Score history

- 2026-08-03: 75
- 2026-08-02: 71
- 2026-08-01: 21
- 2026-07-31: 21
- 2026-07-30: 46
- 2026-07-28: 46
- 2026-07-27: 46

## Links

- npm package: https://www.npmjs.com/package/mailbox-mcp
- Socket report: https://socket.dev/npm/package/mailbox-mcp
- Repository: https://github.com/jgalea/mailbox-mcp
- Changelog RSS feed: https://verifymcp.io/servers/jgalea-mailbox-mcp/mailbox-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/jgalea-mailbox-mcp/mailbox-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/jgalea-mailbox-mcp/mailbox-mcp