Multi Gmail Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Multi Gmail Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Model Context Protocol (MCP) server that lets Claude Desktop manage multiple Gmail accounts simultaneously. Listed on the official Anthropic MCP registry and published on npm.
demo
~/.gmail-mcp-tokens.db — never committed to gitnpm install -g multi-gmail-mcpThis registers two global commands: gmail-mcp (the MCP server) and gmail-mcp-cli (account manager).
You only need to do this once.
gmail.readonly, gmail.send, gmail.modify, gmail.labels~/.gmail-mcp-oauth.jsonAlternatively, set environment variables in the Claude Desktop config (see below).
# Add accounts (opens browser for Google sign-in)
gmail-mcp-cli add [email protected]
gmail-mcp-cli add [email protected]
# List authenticated accounts
gmail-mcp-cli list
# Remove an account
gmail-mcp-cli remove [email protected]Tokens are saved to ~/.gmail-mcp-tokens.db and refreshed automatically.
Edit ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"multi-gmail": {
"command": "gmail-mcp"
}
}
}If you prefer environment variables over ~/.gmail-mcp-oauth.json:
{
"mcpServers": {
"multi-gmail": {
"command": "gmail-mcp",
"env": {
"GOOGLE_CLIENT_ID": "your-client-id.apps.googleusercontent.com",
"GOOGLE_CLIENT_SECRET": "your-client-secret"
}
}
}
}Restart Claude Desktop after saving. Click the hammer icon to confirm 19 tools are loaded.
| Tool | Description |
|---|---|
list_accounts | List all authenticated Gmail accounts |
initiate_auth | Start OAuth flow — returns a URL to open in browser |
complete_auth | Finalize auth after completing Google sign-in |
remove_account | Remove an account and its stored credentials |
| Tool | Description |
|---|---|
search_emails | Search with Gmail syntax (is:unread, from:, after:, etc.) |
get_email | Fetch full email content by message ID |
| Tool | Description |
|---|---|
send_email | Send an email (supports To, CC, BCC) |
reply_to_email | Reply in thread, preserving References headers |
create_draft | Save an email as a draft |
| Tool | Description |
|---|---|
list_labels | List all Gmail labels for an account |
add_label | Add one or more labels to a message |
remove_label | Remove one or more labels from a message |
archive_email | Remove from Inbox |
mark_as_read | Remove the UNREAD label |
mark_as_unread | Add the UNREAD label |
List all my authenticated Gmail accounts.Search my [email protected] inbox for unread emails from this week.Reply to that email from my personal account saying I'll be there Saturday.Send an email from [email protected] to [email protected]
with subject "Dinner plans" and body "Are you free Saturday?"Archive everything older than a week in my side-project inbox that's already read.Check both my accounts for emails from GitHub and summarize them.~/.gmail-mcp-oauth.json and ~/.gmail-mcp-tokens.db live in your home directory — outside the project, never committed.gitignore excludes *.db, .gmail-mcp-oauth.json, and .envSee SECURITY.md for full details: token storage, network behavior, scope rationale, revocation steps, and how to report a vulnerability.
Listed on the official Anthropic MCP registry:
io.github.gx-55/multi-gmail-mcpcurl "https://registry.modelcontextprotocol.io/v0.1/servers?search=io.github.gx-55"multi-gmail-mcp/
├── bin/
│ ├── gmail-mcp.js # Entry point for the MCP server command
│ └── gmail-mcp-cli.js # Entry point for the CLI command
├── src/
│ ├── server.js # MCP server — all 19 tools
│ ├── gmail-client.js # Gmail API wrapper
│ ├── auth.js # OAuth2 flow with auto-refresh
│ ├── db.js # SQLite token storage (node:sqlite)
│ └── cli.js # Account management CLI
└── package.json"No OAuth credentials found" Make sure ~/.gmail-mcp-oauth.json exists or set GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET in the Claude Desktop config.
"Account not found. Authenticate it first" Run gmail-mcp-cli add [email protected] before using that account in Claude.
Tools not appearing in Claude Desktop Confirm gmail-mcp is in your PATH (which gmail-mcp) and restart Claude Desktop.
Token expired errors Tokens auto-refresh if a valid refresh token is stored. If refresh fails, remove the account and re-authenticate: gmail-mcp-cli remove [email protected] && gmail-mcp-cli add [email protected].
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.