A powerful Model Context Protocol (MCP) server for IMAP email integration with Claude
Server has 23 well-named tools with consistent verb_noun patterns (imap_add_account, imap_search_emails, etc.). All tools have descriptions (avg ~80 chars, within baseline 34-392). Input schemas are present and use Zod with type definitions and descriptions. However, output schemas are NOT documented, responses are JSON.stringify'd without formal schema declarations. Parameter descriptions are adequate but lack format constraints (e.g., date format 'YYYY-MM-DD' is mentioned in descriptions but not enforced via regex/pattern). Error handling is minimal, most tools lack recovery guidance or actionable error messages. No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite clear risk classifications in the spec. Composition is good: tools are single-responsibility and chainable (e.g., imap_search_emails returns UIDs that imap_get_email accepts). Security concern: passwords are accepted as parameters (imap_add_account, imap_update_account), should use server-side secret injection.
Add a new IMAP account configuration
Add a domain to the custom spam list. Emails from this domain will be flagged as spam.
Add a domain to the whitelist. Emails from whitelisted domains will never be flagged as spam.
Check emails in a folder for spam/disposable email domains. Returns spam analysis and domain statistics.
Connect to an IMAP account
Create a new IMAP folder/mailbox. Most servers also create any missing parent folders (e.g. creating "Archives/2026/2026-05" auto-creates "Archives" and "Archives/2026"). Returns success even if the folder already exists.
Output schemas not documented. Tools return JSON.stringify'd responses without formal schema declarations. LLMs cannot predict response structure for downstream planning.
Passwords accepted as tool parameters (imap_add_account, imap_update_account). Credentials will be logged in agent traces and prompt history. Must use server-side secret injection.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite clear risk classifications. Tools like imap_delete_spam and imap_remove_account lack destructiveHint annotation.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 63 | 2026-07-28+ | v2 |
Delete all emails from a specific domain. Useful for cleaning up unwanted newsletters or spam.
Find and delete emails from known spam/disposable email domains.
Disconnect from an IMAP account
Get statistics about sender domains in a folder. Useful for identifying bulk senders or spam patterns.
Download an attachment from an email. Returns image content directly for image attachments, extracts text from PDFs, or saves to a shared downloads directory accessible from the host.
Get status information about a folder
Get the full content of an email, with optional text attachment previews
Get the count of unread emails in specified folders
List all configured IMAP accounts
List all folders/mailboxes in an IMAP account
List all known spam domains (built-in and custom).
Remove an IMAP account configuration
Remove a domain from the custom spam list.
Search for emails in a folder
Test an existing account connection without re-entering credentials. Validates IMAP connectivity and returns folder count and message count.
Update an existing IMAP account. Useful for fixing SMTP settings without removing and re-adding the account.
Upload a file to the server for use as an email attachment. Returns a path that can be used with imap_send_email attachments. This allows sending large attachments without hitting context window limits by passing base64 content through this tool first, then referencing the path.
Destructive operations lack dry-run confirmation or explicit user confirmation step. imap_delete_spam and imap_delete_by_domain have dryRun param but no confirmation workflow.
Error handling lacks recovery guidance. Tools do not return actionable error messages (e.g., 'Account not found. Try imap_list_accounts() to see available accounts.').