Local MCP server exposing Proton Mail Bridge to Claude over loopback IMAP/SMTP.
概览
A local Model Context Protocol (MCP) server that lets Claude (or any MCP client) read, search, draft, send, and organise email through your running . Everything stays on your Mac — Claude talks to Bridge over 127.0.0.1 IMAP (1143) and SMTP (1025). Nothing transits the public internet via this server. Proton Mail's end-to-end encryption is great for privacy and a problem for automation: there's no public IMAP endpoint and no first-party API. solves that by exposing your decrypted mail over loopback IMAP/SMTP on your own machine. This MCP server wraps that loopback in a small, hardened tool surface that Claude can drive. Several other Proton MCP servers exist on GitHub. Most are functional and some have far larger tool surfaces. This one is built for a different priority: , on the assumption that the people most likely to want to plug an LLM into their email are also the people who most need a credible threat model and a reproducible install.
README
以下为原文 README 节选，完整内容请查看原文。
proton-bridge-mcp
A local Model Context Protocol (MCP) server that lets Claude (or any MCP client) read, search, draft, send, and organise email through your running Proton Mail Bridge. Everything stays on your Mac — Claude talks to Bridge over 127.0.0.1 IMAP (1143) and SMTP (1025). Nothing transits the public internet via this server.
Why this exists
Proton Mail’s end-to-end encryption is great for privacy and a problem for automation: there’s no public IMAP endpoint and no first-party API. Proton Mail Bridge solves that by exposing your decrypted mail over loopback IMAP/SMTP on your own machine. This MCP server wraps that loopback in a small, hardened tool surface that Claude can drive.
Why this one?
Several other Proton MCP servers exist on GitHub. Most are functional and some have far larger tool surfaces. This one is built for a different priority: security and supply-chain hygiene over feature count, on the assumption that the people most likely to want to plug an LLM into their email are also the people who most need a credible threat model and a reproducible install.
| Concern | This server | Typical alternative |
|---|---|---|
| Bridge TLS | Pinned to Bridge’s self-signed cert via TOFU capture, by default; refuses to start without a verified cert unless explicitly downgraded | CERT_NONE on loopback, or TLS handling unspecified |
| Credential storage | macOS Keychain, with /usr/bin/security on the trusted-applications ACL so prompts stop after first install |
.env file, plaintext in config, or env-var only |
| Dependency installation | --require-hashes against a fully resolved requirements.txt lock (every transitive sha256 verified at install) |
pip install (floats to latest) |
| Connection management | Pooled IMAP + SMTP sessions per process, asyncio locks, auto-reconnect on drops | New connection per call (login storms) |
| Read semantics | mark_seen=false is the default; reads never implicitly mark messages read |
Often marks read implicitly |
| Threat model | Documented in the README; explicit prompt-injection caveat for inbound mail content | Usually absent |
安装
This server does not publish a one-line install command.
Open the repository installation guide 新手？先看 mcpskill.org 教程 →