grade C

2 days ago

npm

codefuturist/email-mcp

Email MCP server with IMAP + SMTP support

→ codefuturist/email-mcp· npm: @codefuturist/email-mcp· listed on npm

Install from

npm npm npm

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

⚠️

Tool annotations don’t match behaviour

1 read-only tool performs write/delete/exec — analyze_email_for_scheduling (line 644: REMINDER_KEYWORDS.exec(combined))

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

🔐

You'll be asked for 3 credentials: MCP_EMAIL_OAUTH2_CLIENT_SECRET, MCP_EMAIL_OAUTH2_REFRESH_TOKEN, MCP_EMAIL_PASSWORD

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configMCP_EMAIL_ACCOUNT_NAME— default Account name

configMCP_EMAIL_ADDRESS— "": "you@gmail.com",

configMCP_EMAIL_ALERT_DESKTOP

configMCP_EMAIL_ALERT_SOUND

configMCP_EMAIL_ALERT_URGENCY_THRESHOLD

configMCP_EMAIL_ALERT_WEBHOOK_URL

configMCP_EMAIL_FULL_NAME— Display name

configMCP_EMAIL_HOOK_AUTO_CALENDAR

configMCP_EMAIL_HOOK_AUTO_FLAG

configMCP_EMAIL_HOOK_AUTO_LABEL

configMCP_EMAIL_HOOK_BATCH_DELAY

configMCP_EMAIL_HOOK_CALENDAR_ALARM_MINUTES

configMCP_EMAIL_HOOK_CALENDAR_CONFIRM

configMCP_EMAIL_HOOK_CALENDAR_NAME

configMCP_EMAIL_HOOK_CUSTOM_INSTRUCTIONS

configMCP_EMAIL_HOOK_ON_NEW_EMAIL

configMCP_EMAIL_HOOK_PRESET

configMCP_EMAIL_IMAP_HOST— "": "imap.gmail.com",

configMCP_EMAIL_IMAP_PORT— 993 IMAP port

configMCP_EMAIL_IMAP_STARTTLS

configMCP_EMAIL_IMAP_TLS— true IMAP TLS

configMCP_EMAIL_IMAP_VERIFY_SSL

configMCP_EMAIL_OAUTH2_CLIENT_ID

🔐 secretMCP_EMAIL_OAUTH2_CLIENT_SECRET

configMCP_EMAIL_OAUTH2_PROVIDER

🔐 secretMCP_EMAIL_OAUTH2_REFRESH_TOKEN

🔐 secretMCP_EMAIL_PASSWORD— "": "your-app-password",

configMCP_EMAIL_RATE_LIMIT— 10 Max sends per minute

configMCP_EMAIL_READ_ONLY

configMCP_EMAIL_SMTP_HOST— "": "smtp.gmail.com"

configMCP_EMAIL_SMTP_POOL_ENABLED— true Enable SMTP transport pooling

configMCP_EMAIL_SMTP_POOL_MAX_CONNECTIONS— 1 Max pooled SMTP connections

configMCP_EMAIL_SMTP_POOL_MAX_MESSAGES— 100 Max messages per pooled connection

configMCP_EMAIL_SMTP_PORT— 465 SMTP port

configMCP_EMAIL_SMTP_STARTTLS— false SMTP STARTTLS

configMCP_EMAIL_SMTP_TLS— true SMTP TLS

configMCP_EMAIL_SMTP_VERIFY_SSL— true Verify SSL certificates

configMCP_EMAIL_USERNAME— email Login username

configMCP_EMAIL_WATCHER_ENABLED

configMCP_EMAIL_WATCHER_FOLDERS

configMCP_EMAIL_WATCHER_IDLE_TIMEOUT

configXDG_CONFIG_HOME— Located at $/email-mcp/config.toml (default: ~/.config/email-mcp/config.toml).

configXDG_DATA_HOME

configXDG_STATE_HOME

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/codefuturist-email-mcp-1sd042)](https://m8ven.ai/mcp/codefuturist-email-mcp-1sd042)

commit: c24dd3e56fdfa71a11ee433e8edb11afda0302c9

code hash: 5f85d18fac38061e88ec6def29ce4c6313e50c5365e4a14574a184a753426ca5

verified: 4/18/2026, 4:11:08 PM

view raw JSON →