Security model¶
Proton Safe MCP reduces the blast radius of prompt injection by restricting capabilities in code. It does not classify email as safe.
Threats considered¶
- Adversarial instructions embedded in email bodies or headers.
- A model selecting recipients or attachments from untrusted mail content.
- Header, folder, or IMAP search injection.
- Client attempts to make the server read arbitrary local paths.
- Oversized, reordered, truncated, substituted, or expired attachment uploads.
- Draft changes after human approval.
- Accidental exposure of the Proton account password.
Enforced controls¶
| Boundary | Control |
|---|---|
| Email actions | No SMTP, send, delete, move, or received-attachment download implementation |
| Transport | STDIO only; no listening network socket |
| Bridge target | Host fixed to 127.0.0.1 |
| Reads | BODY.PEEK, bounded plain text, no received attachment bytes |
| Attachments | No paths; type, size, order, lifetime, and SHA-256 validation |
| Drafts | Exact out-of-band approval with digest binding and expiry |
| Credentials | Bridge-generated IMAP password in the OS keyring |
| State | 0700 directories, 0600 files, defensive no-follow behavior |
| Inputs | Length, format, recipient, header, folder, and search validation |
Non-goals and limitations¶
- The server is not an antivirus, phishing detector, spam filter, or sender-authentication product.
- A model sees the content of mail it reads and attachments it uploads.
- Attachment bytes are temporarily readable by the local Unix account; use full-disk encryption.
- An MCP client with unrestricted shell access as the same user may be able to forge local approval state.
- Tool annotations are client hints, not authorization controls.
- Bridge uses a self-signed TLS certificate. Verification is disabled only because the target is fixed to loopback.
- Unrelated write-capable tools in the same autonomous workflow can defeat the project's intended blast-radius reduction.
Credential boundary¶
Use only the password generated by Proton Mail Bridge. The server must never receive a Proton account password, recovery phrase, 2FA secret, or hardware-key material.
If local compromise is suspected:
- Stop Proton Safe MCP and Proton Mail Bridge.
- Rotate the Bridge-generated client credential in the Bridge UI.
- Preserve logs and the exact deployed commit for investigation.
Report a vulnerability¶
Do not open a public issue. Use GitHub private vulnerability reporting and include the affected version or commit, reproduction steps, and impact assessment.
The canonical support policy is maintained in SECURITY.md.