Mailwarden MCP server

mailwarden

A reliable, native Gmail MCP server — full mailbox triage for AI assistants, with the feature no other Gmail MCP server ships: mailbox-side snooze.

Highlights

resurface in the inbox on a date. Built on dated labels + a sweep, so it works from any client, is visible in Gmail itself, and survives restarts. (Where another server offers a "snooze", it is a local reminder list — the mail never leaves or re-enters the inbox.)

• Snooze — the only mailbox-side snooze in a Gmail MCP server. Archive a thread now, have it

answer is:unread from a stale thread-level read state: measured in one real mailbox, 86% of the threads it returned held no unread message at all; in a second mailbox, no drift whatsoever. You cannot tell which mailbox you are in without looking, so search re-verifies every hit against its live labels. Paginated via pageToken/nextPageToken. (the measurements)

• Search you can trust. Gmail's threads.list — the call any thread search goes through — can

the receiving server recorded, so "is this really from my bank?" is answered from the message's own headers instead of from how the domain looks. It reads the receiving server's report only — a message can carry forged ones of its own — and says unchecked when nobody checked, because a missing check is not a passing one.

• Sender authentication, not sender spelling. get_thread reports the SPF/DKIM/DMARC results

1000 messages per API request — with per-chunk partial-success reporting instead of all-or-nothing. The snooze sweep uses the same batch path.

• Bulk operations that scale. bulk_modify archives/labels everything matching a query at

structuredContent alongside fenced JSON text — no parsing guesswork for clients. Failures are structured as well: a code and a retryable flag, so a client can tell "try again later" from "re-authorize" without reading prose.

• Structured outputs. Every tool declares an outputSchema and returns validated

optional read-only mode, no telemetry, no open ports by default, symlink-safe download fencing, injection-fenced output. And no code path that could send: every Gmail request passes an egress checkpoint that refuses messages.send, every draft endpoint, permanent deletion and forwarding settings, whatever a compromised or careless caller asks for. One deliberate exception: unsubscribe / bulk_unsubscribe (manage tier) contact the opt-out endpoint named in a message's own header — the only non-Google host mailwarden ever reaches, and a read-tier deployment makes no outbound request at all. Details under Security & privacy and Unsubscribing.

• Small attack surface. No send tools (no exfiltration path for prompt-injected mail),

bodies decoded in their declared charset (no mojibake for ISO-8859-1/Shift_JIS mail), 429/5xx retried with exponential backoff.

• Correct with real-world mail. RFC 2047 headers decoded (=?UTF-8?B?…?= → readable text),

Why

Shortened. The full README is on GitHub.