Proton Safe MCP

Read and search Proton Mail, then create drafts that only you can approve and send.

Proton Safe MCP is a local, client-agnostic Model Context Protocol server for Proton Mail through the official Proton Mail Bridge. It exposes bounded mail-reading tools and a draft workflow with an out-of-band human approval step.

Email remains untrusted input

Any sender can place adversarial instructions in a message. Proton Safe MCP limits what an injected instruction can accomplish, but it does not make email content trustworthy.

Safety boundary

The capability restrictions are part of the product, not optional settings:

• No send tool and no SMTP client.
• No delete or move tools and no received-attachment download.
• No client-supplied filesystem paths. Attachments arrive as bounded base64 chunks.
• Human approval outside MCP. A local terminal command must approve the exact draft proposal.
• Loopback only. The server uses STDIO and the Bridge host is fixed to 127.0.0.1.

How it fits together

MCP client ──STDIO──> proton-safe-mcp ──IMAP on 127.0.0.1──> Proton Bridge
                            │
                            ├── read/search tools
                            ├── bounded attachment staging
                            └── pending draft proposal
                                      │
Local terminal ──show / approve / reject──┘
                                      │
                                      └──> Proton Mail Drafts (never Sent)

Start here

1. Follow Getting started to install the server and connect Proton Bridge.
2. Use the client setup guides for Claude Code, Cursor, or VS Code.
3. Review the security model before combining the server with other tools.
4. Use the MCP tool reference for exact inputs and limits.
5. Read the attachment and draft approval workflows before creating drafts.

The current stable version is v1.0.1.