Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.nikolausm/imap-mcp-server

NPM · IMAP-MCP-SERVER

IMAP/SMTP MCP server to search, read, organize, send, reply & forward email for AI assistants

Available components

0 this week 92 Trust /100

Last scanned (8 hours ago)

Scores higher than 95% of npm servers

Category Communication

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security99
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 46 of 195 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to nikolausm/imap-mcp-server). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 26 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability66
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 7933 tokens (~198/item across 40 items; 40 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety75
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 0 of 9 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "imap_remove_account" implies "remove" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
  • An AI judge read all 40 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 2 Nov 26 0
    • Stability: 0.97 → pass security
  • 1 Nov 26 0
    • Stability: pass → 0.97 functional
  • 23 Oct 26 0
    • Stability: 0.97 → pass security
  • 22 Oct 26 0
    • Stability: pass → 0.97 functional
  • 16 Oct 26 0
    • Stability: 0.97 → pass security
  • 15 Oct 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

  • 14 Oct 26 +41
    • Injection markers: unverified → pass ▲ security
    • Tool coverage: unverified → 100 ▲ functional
    • MCP protocol: unverified → pass ▲ functional
    • Stability: unverified → 0.93 ▲ functional
  • 13 Oct 26 +1
    • Security disclosure: unverified → pass ▲ functional
    • Package version: 2.1.0 → 2.2.0 functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed npm/imap-mcp-server@2.2.0

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem npm
Reason Verified
Discovered via Registry attestation endpoint
Source repo nikolausm/imap-mcp-server
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/nikolausm/imap-mcp-server/.github/workflows/release.yml@refs/tags/v2.2.0
Rekor log index 3164932313
Predicate type SLSA build provenance https://slsa.dev/provenance/v1
Subject digest sha512:48288cfc732f330a405399c5b2f1f10e60bded3c8182a349289c4d35c8a51455c99994500e5ff5b2365ececf7cf1358cf3020944e3b494d9b9b12cb7e

Background: How many MCP packages publish verified provenance →

Dependencies 195 packages
Packages resolved 195
Stale 46
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 40 exposed · ~7,933 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
imap_add_account ~408

Add a new IMAP account configuration

NameTypeReqDescription
allowStartTLSboolean–When tls is false, imapflow still opportunistically upgrades via STARTTLS if the server advertises it, validating the cert against `host` regardless of `tls`. Set to false to disable that upgrade and…
allowedFromarray–Additional sender identities allowed in the From header. The account email and login are always allowed.
defaultBcc––Optional BCC address(es) applied automatically to every outbound send, reply, forward, and draft for this account. Merged with any per-call bcc
emailstring–Email address (From: header). Defaults to user if omitted
hoststringyesIMAP server hostname
namestringyesFriendly name for the account
passwordstringyesPassword for authentication
portnumber–IMAP server port (default: 993)
sentFolderstring–Explicit Sent-folder name for saving sent-mail copies (e.g. "Gesendet"). Only needed when auto-detection fails — the server must lack a \Sent SPECIAL-USE folder. Check names with imap_list_folders
smtpHoststring–SMTP server hostname. Defaults to IMAP host with imap.→smtp. rewrite
smtpPortnumber–SMTP server port (465 for SMTPS, 587 for STARTTLS). Defaults to 587
smtpSecureboolean–Use implicit TLS (SMTPS). Ignored for port 587/25 which always use STARTTLS, and for port 465 which always uses implicit TLS
tlsboolean–Use TLS/SSL (default: true)
userstringyesUsername for authentication

No output schema declared.

No examples provided.

imap_add_keyword ~276

Set an arbitrary custom (non-system) IMAP keyword/label on an email — e.g. a provider color label like Open-Xchange's $cl_1..$cl_10, Apple Mail's $MailFlagBit0..$MailFlagBit2, or an app tag such as $promotion. Unlike imap_flag_email (which only ever sets the system \Flagged flag), this passes the keyword through verbatim, but rejects backslash-prefixed system flags (e.g. \Flagged, \Seen, \Deleted) — use the dedicated flag/read tools for those. Not every IMAP server permits custom keywords (see the mailbox's PERMANENTFLAGS) — if the server rejects or silently ignores the change, this call fails rather than reporting success.

NameTypeReqDescription
accountIdstring–Account ID (from imap_list_accounts). Optional if accountName is given or only one account is configured.
accountNamestring–Account name instead of accountId. Optional if accountId is given or only one account is configured.
folderstring–Folder name
keywordstringyesIMAP keyword to set, passed through verbatim (e.g. "$cl_3", "$MailFlagBit0", "$Junk")
uidnumberyesEmail UID

No output schema declared.

No examples provided.

imap_add_spam_domain ~52

Add a domain to the custom spam list. Emails from this domain will be flagged as spam.

NameTypeReqDescription
domainstringyesDomain to add to spam list (e.g., "spammer.com")

No output schema declared.

No examples provided.

imap_add_whitelist_domain ~48

Add a domain to the whitelist. Emails from whitelisted domains will never be flagged as spam.

NameTypeReqDescription
domainstringyesDomain to whitelist (e.g., "trusted.com")

No output schema declared.

No examples provided.

imap_bulk_delete ~134

Delete multiple emails at once with chunking and auto-reconnection. Processes deletions in batches to prevent connection timeouts.

NameTypeReqDescription
accountIdstring–Account ID (from imap_list_accounts). Optional if accountName is given or only one account is configured.
accountNamestring–Account name instead of accountId. Optional if accountId is given or only one account is configured.
chunkSizenumber–Number of emails to delete per batch (default: 50)
folderstring–Folder name
uidsarrayyesArray of email UIDs to delete

No output schema declared.

No examples provided.

imap_bulk_delete_by_search ~243

Search for emails matching criteria and delete them all. Useful for cleaning up spam or unwanted emails. At least one concrete criterion (from, to, subject, before, or since) is REQUIRED — a call with no criteria is refused so it can never wipe an entire folder. Supports dryRun to preview matches first.

NameTypeReqDescription
accountIdstring–Account ID (from imap_list_accounts). Optional if accountName is given or only one account is configured.
accountNamestring–Account name instead of accountId. Optional if accountId is given or only one account is configured.
beforestring–Delete emails before this date (YYYY-MM-DD)
chunkSizenumber–Number of emails to delete per batch
dryRunboolean–If true, only return what would be deleted without actually deleting
folderstring–Folder name
fromstring–Delete emails from this sender
sincestring–Delete emails since this date (YYYY-MM-DD)
subjectstring–Delete emails with this subject
tostring–Delete emails to this recipient

No output schema declared.

No examples provided.

imap_check_spam ~254

Check emails in a folder for spam. Combines sender-domain checks (known spam/disposable domains, suspicious patterns) with deterministic raw-header analysis: bulk-mailer X-Mailer/User-Agent signatures, Precedence: bulk, DMARC/SPF/DKIM failures in Authentication-Results, and List-Unsubscribe / Reply-To domains that do not match the sender. Header checks catch scam mail from fresh, unlisted domains that pass the domain check. Returns domain-based spam, a separate list of header-flagged mails, and domain statistics.

NameTypeReqDescription
accountIdstringyesAccount ID
folderstring–Folder name
fromstring–Filter by sender (optional)
includeHeaderChecksboolean–Also run deterministic raw-header checks (X-Mailer bulk tools, Precedence: bulk, DMARC/SPF/DKIM failures, List-Unsubscribe/Reply-To domain mismatches) on top of the sender-domain check. Fetches messa…
limitnumber–Maximum number of emails to check
sincestring–Check emails since date (YYYY-MM-DD)

No output schema declared.

No examples provided.

imap_connect ~42

Connect to an IMAP account

NameTypeReqDescription
accountIdstring–Account ID to connect to
accountNamestring–Account name to connect to

No output schema declared.

No examples provided.

imap_create_folder ~155

Create a new IMAP folder/mailbox. Most servers also create any missing parent folders (e.g. creating "Archives/2026/2026-05" auto-creates "Archives" and "Archives/2026"). Returns success even if the folder already exists.

NameTypeReqDescription
accountIdstring–Account ID (from imap_list_accounts). Optional if accountName is given or only one account is configured.
accountNamestring–Account name instead of accountId. Optional if accountId is given or only one account is configured.
folderstringyesFull folder path to create (e.g. "Archives/2026/2026-05" or "INBOX.Archive")

No output schema declared.

No examples provided.

imap_delete_by_domain ~84

Delete all emails from a specific domain. Useful for cleaning up unwanted newsletters or spam.

NameTypeReqDescription
accountIdstringyesAccount ID
domainstringyesDomain to delete emails from (e.g., "spammer.com")
dryRunboolean–If true, only report what would be deleted
folderstring–Folder name

No output schema declared.

No examples provided.

imap_delete_email ~163

Delete ONE email by folder + uid (moves to Trash or expunges, server-dependent). Destructive and not easily undone — confirm the user means this specific message. To remove many at once use imap_bulk_delete (known uids) or imap_bulk_delete_by_search (by criteria, supports dryRun). To file an email away instead of deleting, use imap_move_email.

NameTypeReqDescription
accountIdstring–Account ID (from imap_list_accounts). Optional if accountName is given or only one account is configured.
accountNamestring–Account name instead of accountId. Optional if accountId is given or only one account is configured.
folderstring–Folder name
uidnumberyesEmail UID

No output schema declared.

No examples provided.

imap_delete_spam ~88

Find and delete emails from known spam/disposable email domains.

NameTypeReqDescription
accountIdstringyesAccount ID
dryRunboolean–If true, only report what would be deleted without deleting
folderstring–Folder name
limitnumber–Maximum number of emails to check
minConfidencestring–Minimum confidence level for spam detection

No output schema declared.

No examples provided.

imap_disconnect ~29

Disconnect from an IMAP account

NameTypeReqDescription
accountIdstringyesAccount ID to disconnect from

No output schema declared.

No examples provided.

imap_domain_stats ~76

Get statistics about sender domains in a folder. Useful for identifying bulk senders or spam patterns.

NameTypeReqDescription
accountIdstringyesAccount ID
folderstring–Folder name
limitnumber–Maximum number of emails to analyze
minCountnumber–Minimum email count per domain to include

No output schema declared.

No examples provided.

imap_download_attachment ~263

Download a single attachment from an email (folder + uid + attachment filename/contentId, as listed by imap_get_email). Images are returned inline for viewing; PDFs are saved and their text is extracted inline (extractText); other files are saved to the shared downloads directory (or savePath). Use when the user wants the actual file contents, not just the message body.

NameTypeReqDescription
accountIdstring–Account ID (from imap_list_accounts). Optional if accountName is given or only one account is configured.
accountNamestring–Account name instead of accountId. Optional if accountId is given or only one account is configured.
extractTextboolean–For PDFs, extract and return text content inline
filenamestringyesAttachment filename or contentId as listed by imap_get_email. Matched exactly first, then Unicode-normalized (NFC/NFD spellings of umlauts and accents are treated as equal); a contentId may be given…
folderstring–Folder name
savePathstring–Optional file path to save the attachment to. If not provided, files are saved to the shared downloads directory.
uidnumberyesEmail UID

No output schema declared.

No examples provided.

imap_find_email_by_message_id ~144

Locate an email by its RFC822 Message-ID across folders and return its current { folder, uid } plus basic envelope. Robust to the message having been moved or archived (IMAP UIDs are folder-relative). Pass the returned folder + uid to imap_reply_to_email or imap_get_email. Without `folders`, searches Gmail \All Mail when present, else INBOX → Archive → Sent → remaining folders.

NameTypeReqDescription
accountIdstringyesAccount ID
foldersarray–Explicit folders to search, in order (overrides the default order)
messageIdstringyesRFC822 Message-ID, with or without angle brackets

No output schema declared.

No examples provided.

imap_find_thread_messages ~397

Find messages in `searchFolder` that belong to the same conversation threads as messages already in `sourceFolder`. Useful for catching replies that arrived after a thread was sorted. Works on any IMAP server (uses RFC 3501 HEADER search on In-Reply-To and References). Set `includeBody=true` to also return the parsed body for each found thread message in one round-trip — avoids the N+1 cost of calling imap_get_email per thread member.

NameTypeReqDescription
accountIdstring–Account ID (from imap_list_accounts). Optional if accountName is given or only one account is configured.
accountNamestring–Account name instead of accountId. Optional if accountId is given or only one account is configured.
bodyFormatstring–How to render the body when `includeBody` is true. Mirrors `imap_get_email` — "markdown" (default) returns clean Markdown; "text" returns plain text; "html" returns raw HTML; "auto" prefers substanti…
bodyMaxLengthnumber–Per-message cap (in characters) for each rendered body field when `includeBody` is true. Defaults to 10000 to match `imap_get_email`.
includeBodyboolean–If true, also fetch the parsed message body for each found thread message in the same round-trip and return it alongside headers (avoids the N+1 cost of calling imap_get_email per thread member). Bod…
searchFolderstring–Folder to search for related thread messages (default: INBOX)
searchReferencesboolean–Also search the References header for multi-level threads (default: true)
sourceFolderstringyesFolder containing the already-sorted thread messages (e.g. "Review.Articles")

No output schema declared.

No examples provided.

imap_flag_email ~130

Flag an email — sets the IMAP \Flagged system flag (shows as a star in Gmail / a flag in Apple Mail). Use this tool when a user asks to star, flag, or mark a message as important.

NameTypeReqDescription
accountIdstring–Account ID (from imap_list_accounts). Optional if accountName is given or only one account is configured.
accountNamestring–Account name instead of accountId. Optional if accountId is given or only one account is configured.
folderstring–Folder name
uidnumberyesEmail UID

No output schema declared.

No examples provided.

imap_folder_status ~82

Get status information about a folder

NameTypeReqDescription
accountIdstring–Account ID (from imap_list_accounts). Optional if accountName is given or only one account is configured.
accountNamestring–Account name instead of accountId. Optional if accountId is given or only one account is configured.
folderstringyesFolder name

No output schema declared.

No examples provided.

imap_forward_email ~274

Forward an existing email (folder + uid) to new recipients, quoting the original message and headers. Optionally include the original attachments. Use when the user wants to pass an existing message on to someone else; use imap_reply_to_email instead to respond to the sender. Account defaultBcc addresses are always BCC'd when configured.

NameTypeReqDescription
accountIdstring–Account ID (from imap_list_accounts). Optional if accountName is given or only one account is configured.
accountNamestring–Account name instead of accountId. Optional if accountId is given or only one account is configured.
bcc––BCC recipients. Either an array of addresses or a single comma-separated string; merged with the account defaultBcc when set.
bodystring–Alias for 'text' (backward-compat)
folderstring–Folder containing the original email
fromstring–Sender identity. Must match the account email/login or an address configured in allowedFrom.
includeAttachmentsboolean–Include original attachments
textstring–Additional text to include
to–yesForward to email address(es). Either an array of addresses or a single comma-separated string.
uidnumberyesUID of the email to forward

No output schema declared.

No examples provided.

imap_get_email ~363

Read the FULL content of a single email by its UID (body, sender/recipients, date, attachment list, optional raw headers and text-attachment previews). By default the body is returned as clean Markdown in markdownContent and raw HTML is omitted so it never crosses the boundary; set bodyFormat to "html" for the legacy raw htmlContent, or "text" for plain text only. Use after imap_search_emails or imap_get_latest_emails gives you a uid. Body text is truncated to maxContentLength to protect the context window — raise it for long messages. To fetch attachment bytes, use imap_download_attachment.

NameTypeReqDescription
accountIdstring–Account ID (from imap_list_accounts). Optional if accountName is given or only one account is configured.
accountNamestring–Account name instead of accountId. Optional if accountId is given or only one account is configured.
bodyFormatstring–How to return the body. "markdown" (default): clean Markdown via Turndown in markdownContent, raw htmlContent omitted so HTML never crosses the boundary. "text": plain text only in textContent. "html…
folderstring–Folder name
includeAttachmentTextboolean–Include text attachment previews when available
includeHeadersboolean–Include raw email headers (e.g. List-Unsubscribe, List-Unsubscribe-Post)
maxAttachmentTextCharsnumber–Maximum characters to return per text attachment
maxContentLengthnumber–Maximum characters to return for each body field (text/markdown/html)
uidnumberyesEmail UID

No output schema declared.

No examples provided.

imap_get_latest_emails ~361

Get the most recent emails from a folder, newest first. Use this for "what just came in?" / "show my latest inbox messages" when no search filter is needed. By default returns lightweight headers (uid, from, subject, date); set `includeBody=true` to also return the parsed body in one round-trip instead of paying the N+1 cost of calling imap_get_email per message. To filter by sender/subject/date instead, use imap_search_emails.

NameTypeReqDescription
accountIdstring–Account ID (from imap_list_accounts). Optional if accountName is given or only one account is configured.
accountNamestring–Account name instead of accountId. Optional if accountId is given or only one account is configured.
bodyFormatstring–How to render the body when `includeBody` is true. Mirrors `imap_get_email` — "markdown" (default) returns clean Markdown; "text" returns plain text; "html" returns raw HTML; "auto" prefers substanti…
bodyMaxLengthnumber–Per-message cap (in characters) for each rendered body field when `includeBody` is true. Defaults to 10000 to match `imap_get_email`.
countnumber–Number of emails to retrieve
folderstring–Folder name
includeBodyboolean–If true, also fetch the parsed message body in the same round-trip and return it alongside headers (avoids the N+1 cost of calling imap_get_email per message). Body is rendered per `bodyFormat` and c…

No output schema declared.

No examples provided.

imap_get_unread_count ~128

Count unread (unseen) emails per folder, plus a total. Use for "how many unread do I have?" overviews. Defaults to all folders; pass a folders list to limit scope and speed it up.

NameTypeReqDescription
accountIdstring–Account ID (from imap_list_accounts). Optional if accountName is given or only one account is configured.
accountNamestring–Account name instead of accountId. Optional if accountId is given or only one account is configured.
foldersarray–List of folders to check (default: all)

No output schema declared.

No examples provided.

imap_list_accounts ~17

List all configured IMAP accounts

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

imap_list_folders ~188

List all folders/mailboxes for an account (names, hierarchy delimiter, attributes, RFC 6154 special-use role). Use this first to discover exact folder names before searching, moving, or creating subfolders — folder naming varies by provider (e.g. "Archive" vs "[Gmail]/All Mail" vs "INBOX.Archive"). The specialUse field ("\\Sent", "\\Drafts", "\\Trash", "\\Junk", "\\Archive") identifies a folder's role independent of its localized name (e.g. "Gesendet" is the Sent folder when specialUse is "\\Sent").

NameTypeReqDescription
accountIdstring–Account ID (from imap_list_accounts). Optional if accountName is given or only one account is configured.
accountNamestring–Account name instead of accountId. Optional if accountId is given or only one account is configured.

No output schema declared.

No examples provided.

imap_list_spam_domains ~23

List all known spam domains (built-in and custom).

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

imap_mark_as_read ~166

Mark one or many emails as read. Accepts a single UID or an array — pass an array to flag N messages in one IMAP STORE round-trip (useful when triaging).

NameTypeReqDescription
accountIdstring–Account ID (from imap_list_accounts). Optional if accountName is given or only one account is configured.
accountNamestring–Account name instead of accountId. Optional if accountId is given or only one account is configured.
folderstring–Folder name
uid–yesEmail UID, or array of UIDs to mark as read in one call (avoids N round-trips when triaging). All listed UIDs share the same IMAP STORE command, so the operation is atomic at the server level.

No output schema declared.

No examples provided.

imap_mark_as_unread ~161

Mark one or many emails as unread. Accepts a single UID or an array — pass an array to flag N messages in one IMAP STORE round-trip.

NameTypeReqDescription
accountIdstring–Account ID (from imap_list_accounts). Optional if accountName is given or only one account is configured.
accountNamestring–Account name instead of accountId. Optional if accountId is given or only one account is configured.
folderstring–Folder name
uid–yesEmail UID, or array of UIDs to mark as unread in one call (avoids N round-trips when triaging). All listed UIDs share the same IMAP STORE command, so the operation is atomic at the server level.

No output schema declared.

No examples provided.

imap_move_email ~201

Move an email from one folder to another (e.g., INBOX to Taxes, or INBOX to Archive). Optionally creates the destination folder if it does not exist.

NameTypeReqDescription
accountIdstring–Account ID (from imap_list_accounts). Optional if accountName is given or only one account is configured.
accountNamestring–Account name instead of accountId. Optional if accountId is given or only one account is configured.
createDestinationIfMissingboolean–If true, create the destination folder before moving when it does not exist (default: false)
folderstring–Source folder name
targetFolderstringyesDestination folder name
uid–yesSingle email UID or array of UIDs to move in one call. Pass an array when triaging many messages at once (e.g. "move the 10 invoices I just classified to Archive") to avoid N round-trips.

No output schema declared.

No examples provided.

imap_remove_account ~31

Remove an IMAP account configuration

NameTypeReqDescription
accountIdstringyesID of the account to remove

No output schema declared.

No examples provided.

imap_remove_keyword ~277

Remove an arbitrary custom (non-system) IMAP keyword/label from an email — e.g. a provider color label like Open-Xchange's $cl_1..$cl_10, Apple Mail's $MailFlagBit0..$MailFlagBit2, or an app tag such as $promotion. Unlike imap_unflag_email (which only ever clears the system \Flagged flag), this passes the keyword through verbatim, but rejects backslash-prefixed system flags (e.g. \Flagged, \Seen, \Deleted) — use the dedicated flag/read tools for those. Not every IMAP server permits custom keywords (see the mailbox's PERMANENTFLAGS) — if the server rejects or silently ignores the change, this call fails rather than reporting success.

NameTypeReqDescription
accountIdstring–Account ID (from imap_list_accounts). Optional if accountName is given or only one account is configured.
accountNamestring–Account name instead of accountId. Optional if accountId is given or only one account is configured.
folderstring–Folder name
keywordstringyesIMAP keyword to remove, passed through verbatim (e.g. "$cl_3", "$MailFlagBit0", "$Junk")
uidnumberyesEmail UID

No output schema declared.

No examples provided.

imap_remove_spam_domain ~34

Remove a domain from the custom spam list.

NameTypeReqDescription
domainstringyesDomain to remove from spam list

No output schema declared.

No examples provided.

imap_reply_to_email ~312

Reply to an existing email identified by folder + uid. Automatically sets the recipient to the original sender, prefixes the subject with "Re:", and preserves threading (In-Reply-To/References). Set replyAll to also include the original To (and Cc as Cc), excluding the account's own address; a Reply-To header on the original is honoured. Use this instead of imap_send_email whenever the user is responding to a message already in a mailbox. Account defaultBcc addresses are always BCC'd when configured.

NameTypeReqDescription
accountIdstring–Account ID (from imap_list_accounts). Optional if accountName is given or only one account is configured.
accountNamestring–Account name instead of accountId. Optional if accountId is given or only one account is configured.
attachmentsarray–Email attachments
bcc––BCC recipients. Either an array of addresses or a single comma-separated string; merged with the account defaultBcc when set.
bodystring–Alias for 'text' (backward-compat)
folderstring–Folder containing the original email
fromstring–Sender identity. Must match the account email/login or an address configured in allowedFrom.
htmlstring–HTML reply content
replyAllboolean–Reply to all recipients
textstring–Plain text reply content
uidnumberyesUID of the email to reply to

No output schema declared.

No examples provided.

imap_save_draft ~305

Save an email as a draft in the Drafts folder (no send). Takes the same fields as imap_send_email (including account defaultBcc when configured).

NameTypeReqDescription
accountIdstring–Account ID (from imap_list_accounts). Optional if accountName is given or only one account is configured.
accountNamestring–Account name instead of accountId. Optional if accountId is given or only one account is configured.
attachmentsarray–Email attachments
bcc––BCC recipients. Either an array of addresses or a single comma-separated string; merged with the account defaultBcc when set.
bodystring–Alias for 'text' (backward-compat)
cc––CC recipients. Either an array of addresses or a single comma-separated string.
folderstring–Override the Drafts folder name (defaults to auto-detected Drafts folder)
fromstring–Sender identity. Must match the account email/login or an address configured in allowedFrom.
htmlstring–HTML content
inReplyTostring–Message-Id being replied to
references––References header value(s)
replyTostring–Reply-to address
subjectstring–Email subject
textstring–Plain text content
to––Recipient email address(es). Either an array of addresses or a single comma-separated string.

No output schema declared.

No examples provided.

imap_search_emails ~893

Note: on some servers a 'flagged' or starred message carries a custom keyword (e.g. an Open-Xchange color label or Apple's $MailFlagBit*) instead of, or in addition to, the \Flagged system flag. After any flagged search, inspect each result's customKeywords field before concluding a message is or isn't flagged — do not rely on the flagged filter alone. Search for emails matching criteria (sender, recipient, subject, body text, date range, read/flagged status). Use this to FIND messages when you know something about them but not their UID — e.g. "emails from amazon last week", "unread invoices". By default searches a single folder (INBOX). Set searchAllFolders=true to scan every mailbox at once — this catches messages filed away by rules (e.g. a receipt routed to a custom folder); Trash/Spam/Drafts are skipped unless you opt in. By default returns lightweight headers (uid, from, subject, date, and folder when searching across folders); set `includeBody=true` to also return the parsed body in one round-trip instead of paying the N+1 cost of calling imap_get_email per match. For the newest messages without criteria, prefer imap_get_latest_emails.

NameTypeReqDescription
accountIdstring–Account ID (from imap_list_accounts). Optional if accountName is given or only one account is configured.
accountNamestring–Account name instead of accountId. Optional if accountId is given or only one account is configured.
beforestring–Search emails before date (YYYY-MM-DD)
bodystring–Search in body text
bodyFormatstring–How to render the body when `includeBody` is true. Mirrors `imap_get_email` — "markdown" (default) returns clean Markdown and omits raw HTML so it never crosses the MCP boundary; "text" returns plain…
bodyMaxLengthnumber–Per-message cap (in characters) for each rendered body field when `includeBody` is true. Defaults to 10000 to match `imap_get_email`.
flaggedboolean–Filter by flagged status
folderstring–Folder name to search (default: INBOX). Ignored when searchAllFolders is true.
fromstring–Search by sender
includeBodyboolean–If true, also fetch the parsed message body in the same round-trip and return it alongside headers (avoids the N+1 cost of calling imap_get_email per match). Body is rendered per `bodyFormat` and cap…
includeDraftsboolean–When searchAllFolders is true, also search the Drafts folder (off by default).
includeSpamboolean–When searchAllFolders is true, also search Spam/Junk folders (off by default — noisy).
includeTrashboolean–When searchAllFolders is true, also search Trash/Bin/Deleted folders (off by default — noisy).
keywordsarray–Match messages that have ANY of these CUSTOM keywords (server-side OR; not system flags like \Seen/\Flagged). Read a mailbox's available custom keywords from imap_folder_status's customKeywords field…
limitnumber–Maximum number of results
messageIdstring–Search by RFC822 Message-ID header (substring match)
searchAllFoldersboolean–Search across ALL folders instead of just `folder`. Skips Trash/Spam/Drafts and non-selectable folders by default. Use when a message might have been filed/archived/moved and you do not know which fo…
seenboolean–Filter by read/unread status
sincestring–Search emails since date (YYYY-MM-DD)
subjectstring–Search by subject
tostring–Search by recipient
unKeywordsarray–Exclude messages that have ANY of these CUSTOM keywords (server-side; result has NONE of them). Same keyword source as `keywords` — check imap_folder_status first.

No output schema declared.

No examples provided.

imap_send_email ~386

Compose and send a NEW email via the account's SMTP server (a copy is saved to Sent unless disabled; account defaultBcc addresses are always BCC'd when configured). Use for fresh outbound messages. To respond to an existing message use imap_reply_to_email (keeps threading); to pass a message on use imap_forward_email; to store without sending use imap_save_draft. Supports to/cc/bcc, text and/or HTML, and attachments by base64 content or by file path (see imap_upload_file for large files).

NameTypeReqDescription
accountIdstring–Account ID (from imap_list_accounts). Optional if accountName is given or only one account is configured.
accountNamestring–Account name instead of accountId. Optional if accountId is given or only one account is configured.
attachmentsarray–Email attachments
bcc––BCC recipients. Either an array of addresses or a single comma-separated string; merged with the account defaultBcc when set.
bodystring–Alias for 'text' (backward-compat with clients that pass 'body')
cc––CC recipients. Either an array of addresses or a single comma-separated string.
dryRunboolean–Validate attachments and compose MIME without sending SMTP mail or saving a Sent copy. Use to diagnose attachment payloads safely before sending.
fromstring–Sender identity. Must match the account email/login or an address configured in allowedFrom.
htmlstring–HTML content
replyTostring–Reply-to address
subjectstringyesEmail subject
textstring–Plain text content
to–yesRecipient email address(es). Either an array of addresses or a single comma-separated string; both accept "Name <addr@example.com>" form.

No output schema declared.

No examples provided.

imap_test_account ~46

Test an existing account connection without re-entering credentials. Validates IMAP connectivity and returns folder count and message count.

NameTypeReqDescription
accountIdstringyesAccount ID to test

No output schema declared.

No examples provided.

imap_unflag_email ~201

Unflag an email — removes the IMAP \Flagged system flag (the star in Gmail, the flag in Apple Mail). Note: some servers (e.g. Open-Xchange / Network Solutions) and Apple Mail also write a separate custom keyword such as $cl_N or $MailFlagBit* when a message is flagged in their client. Removing \Flagged alone does not clear that keyword, so the message may still display as flagged. If it does, check the message's customKeywords via imap_get_email and remove the lingering label with imap_remove_keyword.

NameTypeReqDescription
accountIdstring–Account ID (from imap_list_accounts). Optional if accountName is given or only one account is configured.
accountNamestring–Account name instead of accountId. Optional if accountId is given or only one account is configured.
folderstring–Folder name
uidnumberyesEmail UID

No output schema declared.

No examples provided.

imap_update_account ~369

Update an existing IMAP account. Useful for fixing SMTP settings without removing and re-adding the account.

NameTypeReqDescription
accountIdstringyesID of the account to update
allowStartTLSboolean–When tls is false, set to false to also disable imapflow's opportunistic STARTTLS upgrade (see imap_add_account). Defaults to true.
allowedFromarray–Additional sender identities allowed in the From header. Pass an empty array to clear.
defaultBcc––Optional BCC address(es) applied automatically to every outbound message for this account. Pass an empty string to clear
emailstring–Email address (From: header)
hoststring–IMAP host
namestring–New friendly name
passwordstring–New password
portnumber–IMAP port
saveToSentboolean–Save sent emails to the Sent folder
sentFolderstring–Explicit Sent-folder name for saving sent-mail copies (e.g. "Gesendet"). Overrides auto-detection; pass an empty string to clear the override and re-enable auto-detection. Check names with imap_list_…
smtpHoststring–SMTP hostname
smtpPasswordstring–SMTP password (if different from IMAP password)
smtpPortnumber–SMTP port (465 for SMTPS, 587 for STARTTLS)
smtpSecureboolean–Use implicit TLS (SMTPS). Port 587/25 always use STARTTLS regardless
smtpUserstring–SMTP username (if different from IMAP user)
tlsboolean–Use TLS for IMAP
userstring–IMAP username

No output schema declared.

No examples provided.

imap_upload_file ~129

Upload a file to the server for use as an email attachment. Returns a path that can be used with imap_send_email attachments. This allows sending large attachments without hitting context window limits. Max size: 26214400 bytes (configurable via IMAP_MAX_UPLOAD_SIZE). Uploads are auto-deleted after 86400000 ms (configurable via IMAP_UPLOAD_TTL_MS).

NameTypeReqDescription
contentstringyesBase64 encoded file content
contentTypestring–MIME type (optional, used for metadata only)
filenamestringyesFilename to save as

No output schema declared.

No examples provided.

Install

How do I install the io.github.nikolausm/imap-mcp-server server?

io.github.nikolausm/imap-mcp-server runs locally as an npm package, launched with npx -y imap-mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · imap-mcp-server

# add to Claude Code
claude mcp add nikolausm-imap-mcp-server -- npx -y imap-mcp-server
Common questions

What is the io.github.nikolausm/imap-mcp-server server?

io.github.nikolausm/imap-mcp-server is listed in the public MCP registry as io.github.nikolausm/imap-mcp-server. IMAP/SMTP MCP server to search, read, organize, send, reply & forward email for AI assistants. This page covers its npm package (imap-mcp-server).

Is the io.github.nikolausm/imap-mcp-server server safe to use?

io.github.nikolausm/imap-mcp-server scores 92 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.nikolausm/imap-mcp-server server expose?

io.github.nikolausm/imap-mcp-server exposes 40 tools: imap_add_account, imap_update_account, imap_list_accounts, imap_remove_account, imap_connect, and 35 more. Their descriptions and schemas cost roughly 7,933 tokens of context every time the server is loaded.

Is the io.github.nikolausm/imap-mcp-server server still maintained?

io.github.nikolausm/imap-mcp-server is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the io.github.nikolausm/imap-mcp-server server under?

io.github.nikolausm/imap-mcp-server declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.