Skip to content

External testing

Proton Safe MCP needs feedback from Linux users running the official Proton Mail Bridge. This test checks the complete first-use path without granting send, delete, or move capabilities to an MCP client.

Allow about 10 minutes for the core test. Use only benign test content and stop if any step would require sharing a credential, private message, or confidential attachment.

Before you start

You need:

  • Linux with Proton Mail Bridge installed, signed in, and running;
  • a Proton plan that supports Bridge;
  • Python 3.11 or newer and uv;
  • Claude Code, Cursor, or VS Code;
  • one harmless unread message that you sent to yourself for this test.

Record your Linux distribution, Python version, Bridge version, MCP client, and the time when you start. Never include your Proton password, Bridge-generated password, recovery phrase, 2FA data, email address, message content, or hardware-key material in public feedback.

Core 10-minute test

1. Install and configure

Install the reviewed release:

uv tool install proton-safe-mcp==1.0.2

Follow Getting started to set PROTON_BRIDGE_USER and PROTON_IMAP_PORT, then store the Bridge-generated IMAP password in the operating-system keyring:

proton-safe-mcp setup

Register the server using the instructions for Claude Code, Cursor, or VS Code.

2. Reach the first connected result

Ask the client to call mailbox_status. Stop the timer when the response reports connected: true and record the elapsed time.

Then ask it to call list_folders and list_messages for the inbox. Do not paste tool output into a public issue: it can contain private folder names, senders, and subjects.

3. Confirm that reading is non-destructive

Ask the client to call read_message for the harmless unread message you prepared. Open Proton Mail separately and confirm that the message is still unread. The server uses BODY.PEEK and should not change read state.

4. Exercise the approval boundary

Ask the client to prepare a plain-text draft addressed to your own Proton address. Use a neutral subject such as Proton Safe MCP external test and do not add an attachment yet.

Before approving, ask the client to call commit_approved_draft with the returned draft_id. The call must fail with a local-approval-required result.

In a separate terminal, inspect the exact proposal:

proton-safe-mcp show <draft_id>
proton-safe-mcp approve <draft_id>

After interactive approval, ask the client to call commit_approved_draft again. Confirm that:

  • the draft appears in Proton Mail;
  • the recipient, subject, and body match the approved proposal;
  • the result reports sent: false;
  • the client exposes no send, delete, or move tool.

Review the draft manually and delete it in Proton Mail if you do not want to keep it. Do not send it merely for this test.

Optional attachment check

If the core test succeeds, repeat the draft flow with a newly created, non-confidential TXT or PDF file. Follow the attachment workflow and confirm that the file name, type, size, and SHA-256 digest are checked before the draft is created.

Never use a personal document for this test. Attachment handling depends on the MCP client's ability to obtain bytes and call the chunked upload tools, so record any client-specific friction.

What success looks like

The core path is successful when:

  1. mailbox_status reports connected: true in ten minutes or less;
  2. reading the prepared message does not mark it as read;
  3. draft creation fails before local approval;
  4. the approved draft appears in Proton Mail and is never sent;
  5. no send, delete, move, or received-attachment-download tool is exposed.

Partial and failed tests are equally useful. Report the first point of friction rather than working around it silently.

Send installation feedback

Open the installation feedback form and report the outcome. Redact all identifiers and message content. For a suspected security vulnerability, do not open a public issue; use private vulnerability reporting.