# email-tool (pypi · email-tool-mcp)

IMAP/SMTP email for AI assistants: read, search, draft and send, with CMMC-grade safeguards.

- Trust score: 66/100 (medium)
- Change this week: −17
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- pypi · `email-tool-mcp`: 66/100 (this document), [markdown](https://verifymcp.io/servers/skhan61-email-tool/email-tool-mcp.md), [page](https://verifymcp.io/servers/skhan61-email-tool/email-tool-mcp)

## Channel facts

- Registry: `pypi`
- Package: `email-tool-mcp`
- Version: `5.6.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 32/100
  - Malware scan not yet available for this package.
  - CVE check failed: a known high-severity CVE affects pypdf 6.21.2, a direct dependency. A fixed version is available.
  - Runs hatchling.build at install time, a recognised build step with no custom scripting around it.
  - 5 of 63 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 100/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to skhan61/email-tool).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 7 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 71/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2021 tokens (~134/item across 15 items; 15 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 43/100
  - Stability observed for 13 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 97/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 92% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 16 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### How do I install the email-tool MCP server?

email-tool runs locally as a PyPI package, launched with uvx email-tool-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add skhan61-email-tool -- uvx email-tool-mcp
```

### Cursor

```json
{
  "mcpServers": {
    "skhan61-email-tool": {
      "command": "uvx",
      "args": [
        "email-tool-mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "skhan61-email-tool": {
      "command": "uvx",
      "args": [
        "email-tool-mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add skhan61-email-tool -- uvx email-tool-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "skhan61-email-tool": {
      "type": "local",
      "command": [
        "uvx",
        "email-tool-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add skhan61-email-tool --command uvx --arg email-tool-mcp
```

### Hermes

```yaml
mcp_servers:
  skhan61-email-tool:
    command: "uvx"
    args: ["email-tool-mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "skhan61-email-tool": {
      "Transport": "stdio",
      "Command": "uvx",
      "Arguments": [
        "email-tool-mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add skhan61-email-tool -t stdio -c uvx -a email-tool-mcp
```

### Other

```json
{
  "mcpServers": {
    "skhan61-email-tool": {
      "command": "uvx",
      "args": [
        "email-tool-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 66, −15)

- [security regression] Malware scan: pass → unverified

### 2026-11-04 (score 81, +16)

- [security improvement] Malware scan: unverified → pass

### 2026-11-02 (score 65, −14)

- [security regression] Malware scan: pass → unverified

### 2026-11-01 (score 79, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-10-31 (score 64, −5)

- [security regression] CVE-2026-119204 affects this package: high
- [security regression] CVE-2026-119203 affects this package: high
- [security regression] CVE-2026-119205 affects this package: high
- [security regression] CVE-2026-119208 affects this package: high
- [security regression] CVE-2026-119206 affects this package: high
- [security regression] CVE-2026-119207 affects this package: high
- [security regression] CVE-2026-119209 affects this package: high
- [security regression] Known CVEs: pass → fail

### 2026-10-30 (score 69, −14)

- [security regression] Malware scan: pass → unverified

### 2026-10-28 (score 83, +23)

- [security regression] Tool safety: pass → unverified
- [security improvement] CVE-2026-112913 no longer affects this package
- [security improvement] CVE-2026-115580 no longer affects this package
- [security improvement] CVE-2026-112907 no longer affects this package
- [security improvement] CVE-2026-115585 no longer affects this package
- [security improvement] CVE-2026-115572 no longer affects this package
- [security improvement] CVE-2026-112940 no longer affects this package
- [security improvement] Malware scan: unverified → pass
- [security improvement] Known CVEs: fail → pass
- [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet.
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional improvement] Stability: unverified → 0.17
- [functional] First check of Schema quality: unverified
- [functional] Package version: 5.5.0 → 5.6.0

### 2026-10-25 (score 60, −15)

- [security regression] Malware scan: pass → unverified

## MCP tools (15)

### `list_mailboxes` (~24 tokens)

List the mailboxes configured on this machine and whether each can log in.

### `list_folders` (~42 tokens)

List every folder in the mailbox.

Input parameters:

- `mailbox` (string): Mailbox to use, as listed by list_mailboxes. Leave empty when only one is configured.

### `list_emails` (~81 tokens)

List the newest messages in a folder, newest first.

Input parameters:

- `folder` (string): Folder name as shown by list_folders, for example INBOX.
- `limit` (integer): How many messages to return, newest first.
- `mailbox` (string): Mailbox to use, as listed by list_mailboxes. Leave empty when only one is configured.

### `search_emails` (~154 tokens)

Search a folder by sender, subject, body text or date (since, as DD-Mon-YYYY).

On Gmail, `gmail_query` takes Gmail's own search syntax instead; other servers ignore it.
Supply at least one field.

Input parameters:

- `body` (string)
- `folder` (string): Folder name as shown by list_folders, for example INBOX.
- `gmail_query` (string)
- `limit` (integer): How many messages to return, newest first.
- `mailbox` (string): Mailbox to use, as listed by list_mailboxes. Leave empty when only one is configured.
- `sender` (string)
- `since` (string)
- `subject` (string)

### `get_email` (~85 tokens)

Read one message in full by UID. Does not mark it as read.

Input parameters:

- `folder` (string): Folder name as shown by list_folders, for example INBOX.
- `mailbox` (string): Mailbox to use, as listed by list_mailboxes. Leave empty when only one is configured.
- `uid` (integer, required): UID of the message, as shown in listings.

### `save_attachment` (~216 tokens)

Save one attachment of a message into a folder the user names. The file is never opened.

A relative folder is taken from the user's home ("Downloads" is ~/Downloads). Saving
into a place where a file can run (autostart, .ssh, ...) asks the user first.

Input parameters:

- `confirm_sensitive` (string): The code from an earlier refusal that named sensitive attachments or a risky place to save. Pass it only after the user, in this conversation, agreed to go ahead. Leave empty otherwise.
- `directory` (string, required): Folder to save into, as the user named it; created if missing.
- `folder` (string): Folder name as shown by list_folders, for example INBOX.
- `index` (integer, required): Number of the attachment, as listed by get_email (1 for the first).
- `mailbox` (string): Mailbox to use, as listed by list_mailboxes. Leave empty when only one is configured.
- `uid` (integer, required): UID of the message, as shown in listings.

### `delete_email` (~83 tokens)

Permanently delete one message by UID. This cannot be undone.

Input parameters:

- `folder` (string, required): Folder name as shown by list_folders, for example INBOX.
- `mailbox` (string): Mailbox to use, as listed by list_mailboxes. Leave empty when only one is configured.
- `uid` (integer, required): UID of the message, as shown in listings.

### `create_draft` (~251 tokens)

Save a new draft into the drafts folder, with any attachments. Does not send it.

For a reply, `in_reply_to_uid` names the message answered, so the draft joins its conversation.

Input parameters:

- `attachments`: Paths of files to attach, from any folder the user named. Up to 25 MB in total.
- `body` (string): Plain text body; the fallback when `html` is also given.
- `cc` (string): Comma-separated Cc addresses.
- `folder` (string, required): Drafts folder, for example '[Gmail]/Drafts' or 'INBOX.Drafts'.
- `html` (string): Optional HTML body for links and formatting, sent alongside `body`.
- `in_reply_to_folder` (string): Folder holding the message named by in_reply_to_uid.
- `in_reply_to_uid` (integer): UID of the message this one answers, so it joins that conversation. 0 when it is not a reply.
- `mailbox` (string): Mailbox to use, as listed by list_mailboxes. Leave empty when only one is configured.
- `subject` (string): Subject line.
- `to` (string, required): Comma-separated recipient addresses.

### `list_drafts` (~84 tokens)

List the newest drafts, newest first.

Input parameters:

- `folder` (string, required): Drafts folder, for example '[Gmail]/Drafts' or 'INBOX.Drafts'.
- `limit` (integer): How many messages to return, newest first.
- `mailbox` (string): Mailbox to use, as listed by list_mailboxes. Leave empty when only one is configured.

### `get_draft` (~85 tokens)

Read one draft in full by UID.

Input parameters:

- `folder` (string, required): Drafts folder, for example '[Gmail]/Drafts' or 'INBOX.Drafts'.
- `mailbox` (string): Mailbox to use, as listed by list_mailboxes. Leave empty when only one is configured.
- `uid` (integer, required): UID of the message, as shown in listings.

### `update_draft` (~280 tokens)

Replace an existing draft with new content and attachments, keyed by UID.

IMAP has no in-place edit: the replacement is stored first, then the original deleted.
A reply draft stays in its conversation; `in_reply_to_uid` moves it to another one.

Input parameters:

- `attachments`: Paths of files to attach, from any folder the user named. Up to 25 MB in total.
- `body` (string): Plain text body; the fallback when `html` is also given.
- `cc` (string): Comma-separated Cc addresses.
- `folder` (string, required): Drafts folder, for example '[Gmail]/Drafts' or 'INBOX.Drafts'.
- `html` (string): Optional HTML body for links and formatting, sent alongside `body`.
- `in_reply_to_folder` (string): Folder holding the message named by in_reply_to_uid.
- `in_reply_to_uid` (integer): UID of the message this one answers, so it joins that conversation. 0 when it is not a reply.
- `mailbox` (string): Mailbox to use, as listed by list_mailboxes. Leave empty when only one is configured.
- `subject` (string): Subject line.
- `to` (string, required): Comma-separated recipient addresses.
- `uid` (integer, required): UID of the message, as shown in listings.

### `send_email` (~288 tokens)

Send an email immediately from this mailbox, with any attachments. This is not reversible.

Attachments that look sensitive (keys, credentials, CUI) are shown to the user to confirm first.
For a reply, `in_reply_to_uid` names the message answered, so the reply joins its conversation.

Input parameters:

- `attachments`: Paths of files to attach, from any folder the user named. Up to 25 MB in total.
- `body` (string, required): Plain text body; the fallback when `html` is also given.
- `cc` (string): Comma-separated Cc addresses.
- `confirm_sensitive` (string): The code from an earlier refusal that named sensitive attachments or a risky place to save. Pass it only after the user, in this conversation, agreed to go ahead. Leave empty otherwise.
- `html` (string): Optional HTML body for links and formatting, sent alongside `body`.
- `in_reply_to_folder` (string): Folder holding the message named by in_reply_to_uid.
- `in_reply_to_uid` (integer): UID of the message this one answers, so it joins that conversation. 0 when it is not a reply.
- `mailbox` (string): Mailbox to use, as listed by list_mailboxes. Leave empty when only one is configured.
- `subject` (string, required): Subject line.
- `to` (string, required): Comma-separated recipient addresses.

### `add_mailbox` (~88 tokens)

Open a setup page in the user's browser to add a mailbox: Gmail, Outlook or Microsoft 365, Google
Workspace, or any other. The user types any password on that page only; never ask for it in the chat.
Closing the app's page box can read as "canceled" even after a mailbox was added: then call
list_mailboxes to see whether it was.

### `report_problem` (~115 tokens)

Build a problem report for the email-tool maintainer when the user wants to report a problem.

It holds the versions, the app, the kinds of mailbox and the last few failed calls, with
addresses, subjects, quoted text, home-folder paths, passwords, tokens and keys removed.
It changes nothing and sends nothing; it says how the user can send it.

Input parameters:

- `description` (string, required): What went wrong, in the user's own words, in one to three sentences. Never include message text, subjects, addresses or passwords.

### `email_problem_report` (~109 tokens)

Email a report from report_problem to the email-tool maintainer, from one of the user's mailboxes.

The user's app always shows them the exact message to approve first. If the app cannot ask,
nothing is sent: offer the GitHub link from report_problem instead.

Input parameters:

- `mailbox` (string): Mailbox to use, as listed by list_mailboxes. Leave empty when only one is configured.
- `report` (string, required): The report exactly as report_problem returned it and the user read it.

## Diagnostics

Captured diagnostic sections: Provenance, Install scripts, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/skhan61-email-tool/email-tool-mcp#diagnostics

## Score history

- 2026-11-05: 66
- 2026-11-04: 81
- 2026-11-03: 65
- 2026-11-02: 65
- 2026-11-01: 79
- 2026-10-31: 64
- 2026-10-30: 69
- 2026-10-29: 83
- 2026-10-28: 83
- 2026-10-27: 60
- 2026-10-26: 60
- 2026-10-25: 60
- 2026-10-24: 75
- 2026-10-23: 60

## Common questions

### What is the email-tool MCP server?

email-tool is an MCP server listed in the public MCP registry as io.github.skhan61/email-tool. IMAP/SMTP email for AI assistants: read, search, draft and send, with CMMC-grade safeguards. This page covers its PyPI package (email-tool-mcp).

### Is the email-tool MCP server safe to use?

email-tool scores 66 out of 100 on VerifyMCP. We recorded 7 known advisories against it as of 5 November 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the email-tool MCP server expose?

email-tool exposes 15 tools: list_mailboxes, list_folders, list_emails, search_emails, get_email, and 10 more. Their descriptions and schemas cost roughly 1,985 tokens of context every time the server is loaded.

### Is the email-tool MCP server still maintained?

email-tool is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the email-tool MCP server under?

email-tool declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- PyPI project: https://pypi.org/project/email-tool-mcp/
- Socket report: https://socket.dev/pypi/package/email-tool-mcp
- Repository: https://github.com/skhan61/email-tool
- Changelog RSS feed: https://verifymcp.io/servers/skhan61-email-tool/email-tool-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/skhan61-email-tool/email-tool-mcp.json
- HTML version of this page: https://verifymcp.io/servers/skhan61-email-tool/email-tool-mcp