email-tool
PYPI · EMAIL-TOOL-MCP
IMAP/SMTP email for AI assistants: read, search, draft and send, with CMMC-grade safeguards.
Available components
Last scanned (34 minutes ago)
Scores higher than 62% of PyPI servers
Category Communication
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security32
- Malware scan not yet available for this package.Unverified
- CVE check failed: a known high-severity CVE affects pypdf 6.21.2, a direct dependency. A fixed version is available. View diagnostics → Fail
- Runs hatchling.build at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
- 5 of 63 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to skhan61/email-tool). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 7 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability71
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 2021 tokens (~134/item across 15 items; 15 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management43
- Stability observed for 13 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage97
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 92% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 16 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 −15
- Malware scan: pass → unverified ▼ security
- 4 Nov 26 +16
- Malware scan: unverified → pass ▲ security
- 2 Nov 26 −14
- Malware scan: pass → unverified ▼ security
- 1 Nov 26 +15
- Malware scan: unverified → pass ▲ security
- 31 Oct 26 −5
- CVE-2026-119204 affects this package: high ▼ security
- CVE-2026-119203 affects this package: high ▼ security
- CVE-2026-119205 affects this package: high ▼ security
- CVE-2026-119208 affects this package: high ▼ security
- CVE-2026-119206 affects this package: high ▼ security
- CVE-2026-119207 affects this package: high ▼ security
- CVE-2026-119209 affects this package: high ▼ security
- Known CVEs: pass → fail ▼ security
- 30 Oct 26 −14
- Malware scan: pass → unverified ▼ security
- 28 Oct 26 +23
- Tool safety: pass → unverified ▼ security
- CVE-2026-112913 no longer affects this package ▲ security
- CVE-2026-115580 no longer affects this package ▲ security
- CVE-2026-112907 no longer affects this package ▲ security
- CVE-2026-115585 no longer affects this package ▲ security
- CVE-2026-115572 no longer affects this package ▲ security
- CVE-2026-112940 no longer affects this package ▲ security
- Malware scan: unverified → pass ▲ security
- Known CVEs: fail → pass ▲ security
- Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Stability: unverified → 0.17 ▲ functional
- First check of Schema quality: unverified functional
- Package version: 5.5.0 → 5.6.0 functional
- 25 Oct 26 −15
- Malware scan: pass → unverified ▼ security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed pypi/email-tool-mcp@5.6.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | pypi |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | skhan61/email-tool |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/skhan61/email-tool/.github/workflows/release.yml@refs/heads/main |
| Rekor log index | 3548846324 |
| Predicate type | PyPI publish attestation https://docs.pypi.org/attestations/publish/v1 |
| Subject digest | sha256:e2daa946b9c97f8b84f031163a07dc3737fe98bc0e39ca8dafa5e913914d36e7 |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | allowlisted | hatchling.build |
Background: Why install scripts are a supply-chain risk →
Vulnerabilities 7 findings
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-42gh-23hr-vphw | CVE-2026-119206 | high | yes | |
| GHSA-4vqv-7265-gm2w | CVE-2026-119207 | high | yes | |
| GHSA-5849-834g-hvw5 | CVE-2026-119203 | high | yes | |
| GHSA-62m5-6wh8-28x7 | CVE-2026-119208 | high | yes | |
| GHSA-cggf-277g-3q54 | CVE-2026-119204 | high | yes | |
| GHSA-mfr5-77xh-9j7h | CVE-2026-119205 | high | yes | |
| GHSA-x3rh-gjgm-fmqc | CVE-2026-119209 | high | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 63 packages
| Packages resolved | 63 |
|---|---|
| Stale | 4 |
| No linked repository | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
add_mailbox ~88
Open a setup page in the user's browser to add a mailbox: Gmail, Outlook or Microsoft 365, Google Workspace, or any other. The user types any password on that page only; never ask for it in the chat. Closing the app's page box can read as "canceled" even after a mailbox was added: then call list_mailboxes to see whether it was.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
create_draft ~251
Save a new draft into the drafts folder, with any attachments. Does not send it. For a reply, `in_reply_to_uid` names the message answered, so the draft joins its conversation.
| Name | Type | Req | Description |
|---|---|---|---|
| attachments | – | – | Paths of files to attach, from any folder the user named. Up to 25 MB in total. |
| body | string | – | Plain text body; the fallback when `html` is also given. |
| cc | string | – | Comma-separated Cc addresses. |
| folder | string | yes | Drafts folder, for example '[Gmail]/Drafts' or 'INBOX.Drafts'. |
| html | string | – | Optional HTML body for links and formatting, sent alongside `body`. |
| in_reply_to_folder | string | – | Folder holding the message named by in_reply_to_uid. |
| in_reply_to_uid | integer | – | UID of the message this one answers, so it joins that conversation. 0 when it is not a reply. |
| mailbox | string | – | Mailbox to use, as listed by list_mailboxes. Leave empty when only one is configured. |
| subject | string | – | Subject line. |
| to | string | yes | Comma-separated recipient addresses. |
No output schema declared.
No examples provided.
delete_email ~83
Permanently delete one message by UID. This cannot be undone.
| Name | Type | Req | Description |
|---|---|---|---|
| folder | string | yes | Folder name as shown by list_folders, for example INBOX. |
| mailbox | string | – | Mailbox to use, as listed by list_mailboxes. Leave empty when only one is configured. |
| uid | integer | yes | UID of the message, as shown in listings. |
No output schema declared.
No examples provided.
email_problem_report ~109
Email a report from report_problem to the email-tool maintainer, from one of the user's mailboxes. The user's app always shows them the exact message to approve first. If the app cannot ask, nothing is sent: offer the GitHub link from report_problem instead.
| Name | Type | Req | Description |
|---|---|---|---|
| mailbox | string | – | Mailbox to use, as listed by list_mailboxes. Leave empty when only one is configured. |
| report | string | yes | The report exactly as report_problem returned it and the user read it. |
No output schema declared.
No examples provided.
get_draft ~85
Read one draft in full by UID.
| Name | Type | Req | Description |
|---|---|---|---|
| folder | string | yes | Drafts folder, for example '[Gmail]/Drafts' or 'INBOX.Drafts'. |
| mailbox | string | – | Mailbox to use, as listed by list_mailboxes. Leave empty when only one is configured. |
| uid | integer | yes | UID of the message, as shown in listings. |
No output schema declared.
No examples provided.
get_email ~85
Read one message in full by UID. Does not mark it as read.
| Name | Type | Req | Description |
|---|---|---|---|
| folder | string | – | Folder name as shown by list_folders, for example INBOX. |
| mailbox | string | – | Mailbox to use, as listed by list_mailboxes. Leave empty when only one is configured. |
| uid | integer | yes | UID of the message, as shown in listings. |
No output schema declared.
No examples provided.
list_drafts ~84
List the newest drafts, newest first.
| Name | Type | Req | Description |
|---|---|---|---|
| folder | string | yes | Drafts folder, for example '[Gmail]/Drafts' or 'INBOX.Drafts'. |
| limit | integer | – | How many messages to return, newest first. |
| mailbox | string | – | Mailbox to use, as listed by list_mailboxes. Leave empty when only one is configured. |
No output schema declared.
No examples provided.
list_emails ~81
List the newest messages in a folder, newest first.
| Name | Type | Req | Description |
|---|---|---|---|
| folder | string | – | Folder name as shown by list_folders, for example INBOX. |
| limit | integer | – | How many messages to return, newest first. |
| mailbox | string | – | Mailbox to use, as listed by list_mailboxes. Leave empty when only one is configured. |
No output schema declared.
No examples provided.
list_folders ~42
List every folder in the mailbox.
| Name | Type | Req | Description |
|---|---|---|---|
| mailbox | string | – | Mailbox to use, as listed by list_mailboxes. Leave empty when only one is configured. |
No output schema declared.
No examples provided.
list_mailboxes ~24
List the mailboxes configured on this machine and whether each can log in.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
report_problem ~115
Build a problem report for the email-tool maintainer when the user wants to report a problem. It holds the versions, the app, the kinds of mailbox and the last few failed calls, with addresses, subjects, quoted text, home-folder paths, passwords, tokens and keys removed. It changes nothing and sends nothing; it says how the user can send it.
| Name | Type | Req | Description |
|---|---|---|---|
| description | string | yes | What went wrong, in the user's own words, in one to three sentences. Never include message text, subjects, addresses or passwords. |
No output schema declared.
No examples provided.
save_attachment ~216
Save one attachment of a message into a folder the user names. The file is never opened. A relative folder is taken from the user's home ("Downloads" is ~/Downloads). Saving into a place where a file can run (autostart, .ssh, ...) asks the user first.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm_sensitive | string | – | The code from an earlier refusal that named sensitive attachments or a risky place to save. Pass it only after the user, in this conversation, agreed to go ahead. Leave empty otherwise. |
| directory | string | yes | Folder to save into, as the user named it; created if missing. |
| folder | string | – | Folder name as shown by list_folders, for example INBOX. |
| index | integer | yes | Number of the attachment, as listed by get_email (1 for the first). |
| mailbox | string | – | Mailbox to use, as listed by list_mailboxes. Leave empty when only one is configured. |
| uid | integer | yes | UID of the message, as shown in listings. |
No output schema declared.
No examples provided.
search_emails ~154
Search a folder by sender, subject, body text or date (since, as DD-Mon-YYYY). On Gmail, `gmail_query` takes Gmail's own search syntax instead; other servers ignore it. Supply at least one field.
| Name | Type | Req | Description |
|---|---|---|---|
| body | string | – | – |
| folder | string | – | Folder name as shown by list_folders, for example INBOX. |
| gmail_query | string | – | – |
| limit | integer | – | How many messages to return, newest first. |
| mailbox | string | – | Mailbox to use, as listed by list_mailboxes. Leave empty when only one is configured. |
| sender | string | – | – |
| since | string | – | – |
| subject | string | – | – |
No output schema declared.
No examples provided.
send_email ~288
Send an email immediately from this mailbox, with any attachments. This is not reversible. Attachments that look sensitive (keys, credentials, CUI) are shown to the user to confirm first. For a reply, `in_reply_to_uid` names the message answered, so the reply joins its conversation.
| Name | Type | Req | Description |
|---|---|---|---|
| attachments | – | – | Paths of files to attach, from any folder the user named. Up to 25 MB in total. |
| body | string | yes | Plain text body; the fallback when `html` is also given. |
| cc | string | – | Comma-separated Cc addresses. |
| confirm_sensitive | string | – | The code from an earlier refusal that named sensitive attachments or a risky place to save. Pass it only after the user, in this conversation, agreed to go ahead. Leave empty otherwise. |
| html | string | – | Optional HTML body for links and formatting, sent alongside `body`. |
| in_reply_to_folder | string | – | Folder holding the message named by in_reply_to_uid. |
| in_reply_to_uid | integer | – | UID of the message this one answers, so it joins that conversation. 0 when it is not a reply. |
| mailbox | string | – | Mailbox to use, as listed by list_mailboxes. Leave empty when only one is configured. |
| subject | string | yes | Subject line. |
| to | string | yes | Comma-separated recipient addresses. |
No output schema declared.
No examples provided.
update_draft ~280
Replace an existing draft with new content and attachments, keyed by UID. IMAP has no in-place edit: the replacement is stored first, then the original deleted. A reply draft stays in its conversation; `in_reply_to_uid` moves it to another one.
| Name | Type | Req | Description |
|---|---|---|---|
| attachments | – | – | Paths of files to attach, from any folder the user named. Up to 25 MB in total. |
| body | string | – | Plain text body; the fallback when `html` is also given. |
| cc | string | – | Comma-separated Cc addresses. |
| folder | string | yes | Drafts folder, for example '[Gmail]/Drafts' or 'INBOX.Drafts'. |
| html | string | – | Optional HTML body for links and formatting, sent alongside `body`. |
| in_reply_to_folder | string | – | Folder holding the message named by in_reply_to_uid. |
| in_reply_to_uid | integer | – | UID of the message this one answers, so it joins that conversation. 0 when it is not a reply. |
| mailbox | string | – | Mailbox to use, as listed by list_mailboxes. Leave empty when only one is configured. |
| subject | string | – | Subject line. |
| to | string | yes | Comma-separated recipient addresses. |
| uid | integer | yes | UID of the message, as shown in listings. |
No output schema declared.
No examples provided.
How do I install the email-tool MCP server?
email-tool runs locally as a PyPI package, launched with uvx email-tool-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · email-tool-mcp
claude mcp add skhan61-email-tool -- uvx email-tool-mcp
What is the email-tool MCP server?
email-tool is an MCP server listed in the public MCP registry as io.github.skhan61/email-tool. IMAP/SMTP email for AI assistants: read, search, draft and send, with CMMC-grade safeguards. This page covers its PyPI package (email-tool-mcp).
Is the email-tool MCP server safe to use?
email-tool scores 66 out of 100 on VerifyMCP. We recorded 7 known advisories against it as of 5 November 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the email-tool MCP server expose?
email-tool exposes 15 tools: list_mailboxes, list_folders, list_emails, search_emails, get_email, and 10 more. Their descriptions and schemas cost roughly 1,985 tokens of context every time the server is loaded.
Is the email-tool MCP server still maintained?
email-tool is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the email-tool MCP server under?
email-tool declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.