Inbox Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Inbox Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Provider-agnostic email MCP server for AI assistants. Connect any IMAP mailbox to Claude Desktop, Cursor, VS Code, or any MCP-compatible client.
pip install inbox-mcpSet two environment variables:
export INBOX_MCP_EMAIL="[email protected]"
export INBOX_MCP_PASSWORD="your-app-password"| Variable | Required | Default | Description |
|---|---|---|---|
INBOX_MCP_EMAIL | Yes | — | Your email address |
INBOX_MCP_PASSWORD | Yes | — | Password or app password |
INBOX_MCP_HOST | No | Auto-detected | IMAP server hostname |
INBOX_MCP_PORT | No | 993 | IMAP port |
INBOX_MCP_PROVIDER | No | Auto-detected | Force provider: gmail, outlook, gmx, generic |
INBOX_MCP_READ_ONLY | No | false | Set to true to disable write operations |
| Email Domain | Provider | IMAP Host |
|---|---|---|
| gmail.com, googlemail.com | gmail | imap.gmail.com |
| outlook.com, hotmail.com, live.com | outlook | outlook.office365.com |
| gmx.net, gmx.at, gmx.de, gmx.ch, gmx.com | gmx | imap.gmx.net |
| yahoo.com, ymail.com, rocketmail.com | yahoo | imap.mail.yahoo.com |
| anything else | generic | imap.{domain} |
Gmail requires an App Password:
INBOX_MCP_PASSWORDAdd to ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"inbox": {
"command": "inbox-mcp",
"env": {
"INBOX_MCP_EMAIL": "[email protected]",
"INBOX_MCP_PASSWORD": "your-app-password"
}
}
}
}claude mcp add -e [email protected] -e INBOX_MCP_PASSWORD=your-app-password inbox inbox-mcpAdd to .cursor/mcp.json or .vscode/mcp.json:
{
"mcpServers": {
"inbox": {
"command": "inbox-mcp",
"env": {
"INBOX_MCP_EMAIL": "[email protected]",
"INBOX_MCP_PASSWORD": "your-app-password"
}
}
}
}# As entry point
inbox-mcp
# As module
python -m inbox_mcp| Tool | Description | Write? |
|---|---|---|
get_summary | Inbox stats: total, unread, last 7 days | No |
list_messages | List messages with filters (all, unread, today, week) | No |
read_message | Full message body by sequence number | No |
search | Search by subject or sender | No |
list_folders | List all IMAP folders/labels | No |
mark_read | Set messages as read | Yes |
move_message | Move messages between folders | Yes |
create_folder | Create a new IMAP folder | Yes |
Write tools are disabled when INBOX_MCP_READ_ONLY=true.
Run multiple instances with different names:
{
"mcpServers": {
"work-email": {
"command": "inbox-mcp",
"env": {
"INBOX_MCP_EMAIL": "[email protected]",
"INBOX_MCP_PASSWORD": "work-password",
"INBOX_MCP_HOST": "mail.company.com"
}
},
"personal-email": {
"command": "inbox-mcp",
"env": {
"INBOX_MCP_EMAIL": "[email protected]",
"INBOX_MCP_PASSWORD": "gmail-app-password"
}
}
}
}Dual-licensed:
If your project is open-source, you can use inbox-mcp under AGPL-3.0 at no cost. For proprietary/closed-source use, contact [email protected] for a commercial license.
<!-- mcp-name: io.github.p-w-4-z/inbox-mcp -->
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.