Proton Safe MCP server

Proton Safe MCP

Website & download · En français

<!-- mcp-name: io.github.fbossiere/proton-safe-mcp -->

A client-agnostic FastMCP server for Proton Mail through the official Proton Mail Bridge. It can read and search mail and create drafts with attachments. It deliberately cannot send email — you review every draft in Proton Mail and press Send yourself.

The server runs locally over STDIO for any MCP-compatible client (Claude Desktop, Claude Code, or anything else that speaks MCP). Received PDF, TXT, and CSV attachments can be inspected through bounded text extraction without exposing their raw bytes. Outgoing attachments are uploaded as bounded base64 chunks, so the server never receives or reads a client filesystem path.

Read the full documentation for setup, configuration, tool inputs, security boundaries, and troubleshooting.

Why "safe"?

Email is attacker-controlled input. Any sender can put adversarial instructions in a message body, and an AI agent that reads mail and holds write-capable tools is one prompt injection away from doing something you did not ask for. This project limits the blast radius by construction:

• No send. There is no SMTP client and no send_message tool in the codebase — a test asserts it.
• No delete, no move, and no raw received-attachment download tool.
• Human in the loop. Draft creation requires explicit confirmation of the exact content in the conversation, and Proton Mail still requires manual review and sending.
• No filesystem access for clients. Attachment bytes are streamed in chunks with declared size and SHA-256 verification; paths are rejected.
• Loopback only. STDIO transport, no listening socket, and the Bridge host is hard-coded to 127.0.0.1.

These controls reduce risk but do not make email trusted. Never expose unrelated write-capable tools in the same unattended agent workflow.

Architecture

Security properties

Shortened. The full README is on GitHub.