pylos-mcp server

pylos-mcp

Read-focused, prompt-injection-hardened email MCP server for any IMAP provider.

Anyone in the world can put text in your inbox, and the moment an AI assistant reads that inbox, anyone in the world can put text in front of your assistant. pylos-mcp is an email MCP server built around that fact. It lets Claude, or any MCP client, search, read and draft your mail while treating every message as what it really is, input from a stranger. Mailbox content is fenced as data before the model sees it, and there is no bcc field for an injected email to quietly copy someone with.

It runs on your machine and speaks plain IMAP, so it works with Gmail, iCloud, Yahoo, GMX, Fastmail, mailbox.org, Posteo, Proton via Bridge, or anything self-hosted, and your credentials never leave home. Out of the box it can read and draft. Anything riskier, moving, sending, deleting, is a separate switch that stays off until you flip it.

What this can never do

Mail is attacker-controlled text, so the hard limits live in the architecture rather than in a prompt. No message can talk the server out of any of these.

• No raw HTML ever reaches the model. Bodies come from the plain-text part when one exists or are converted to text otherwise. Invisible characters that hide instructions from a human reader while staying readable to a model are stripped.
• Untrusted content is fenced. Everything from the mailbox, bodies, subjects, sender names, folder listings, Sieve script text, is wrapped in a labeled delimiter before the model sees it, and the delimiter is neutralized inside the content, so a message cannot forge its way out of the fence. The few lines outside it are server-authored and never carry message content.
• No bcc field exists anywhere, on drafts or sent mail. A bcc recipient receives a full copy of a message while appearing nowhere in it, exactly the invisibility an injected email wants. The field is absent rather than guarded, so there is nothing to talk the model into.
• Deleting a message moves it to Trash. There is no expunge and no permanent-delete option, and the tool result never claims a permanence this server does not offer.
• Sieve access is read-only, permanently. Server-side filter rules can forward, auto-reply and notify, each an exfiltration channel that survives revoking the app password or uninstalling this server. Write access is left out entirely, not defended.

Sending is the other risky door, so it starts closed even with the send capability on. Until SENDALLOWLIST says who may be addressed, every send is refused, and the refusal names the two ways to open the gate. SENDALLOWLIST=* allows anyone, visibly and on purpose.

Fencing reduces prompt-injection risk, nothing eliminates it. The model still reads text written by strangers, so treat every response that includes message content as untrusted input, not ground truth. The finer design notes live in SECURITY.md.

Quick start

Add the server to your MCP client's config. For Claude Desktop that file is claudedesktopconfig.json.

{
  "mcpServers": {
    "pylos-mcp": {
      "command": "npx",
      "args": ["-y", "pylos-mcp"],
      "env": {
        "PROVIDER": "mailbox.org",
        "EMAIL_USER": "you@example.com",
        "EMAIL_PASSWORD": "your-app-password"
      }
    }
  }
}

Use an app password, not your account's regular login password. The next section says which providers insist on one. Restart the client and the read and draft tools appear. Later config changes need the same treatment, a newly enabled capability only registers its tools after a full client restart, and in Claude Desktop toggling the server off and on is not always enough.

Provider setup

Shortened. The full README is on GitHub.