IMAP MCP Pro (Temple-of-Epiphany/imap-mcp-pro) is an MCP server listed on the M8ven Trust Index. It scores 52 out of 100, grade D. It declares 131 tools. No publisher has claimed this listing.

D
Caution
52/100

IMAP MCP Pro

An enterprise-grade MCP server that provides production-ready IMAP email integration with advanced reliability features, comprehensive monitoring, and secure account management.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

Temple-of-Epiphany

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 5 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 1 credential: IMAP_MCP_GITHUB_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes131 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

imap_add_account

Add a new IMAP account with optional SMTP configuration for current user (from MCP_USER_ID environment variable)

imap_list_accounts

List all IMAP accounts for current user (from MCP_USER_ID environment variable)

imap_remove_account

Remove an IMAP account from database

imap_connect

Connect to an IMAP account

imap_disconnect

Disconnect from an IMAP account

imap_list_providers

List all available email provider presets (Gmail, Outlook, Yahoo, etc.) with pre-configured IMAP/SMTP settings

imap_add_account_with_provider

Add a new IMAP account using a provider preset (auto-fills IMAP/SMTP settings). Available providers are listed by imap_list_providers.

imap_add_account_auto

Add a new IMAP account by auto-detecting provider from email address (e.g., @gmail.com → Gmail preset)

imap_get_outbox_dir
imap_test_account
imap_set_account_signature
imap_get_account_signature

Get the per-account email signature (plain text + HTML).

imap_add_list_entry
imap_remove_list_entry

Remove an entry from a per-user allow or deny list (matches the normalized value).

imap_list_entries

List a user's allow/deny entries (optionally filtered to one list).

imap_check_address
imap_import_list
imap_clear_list

Remove ALL entries from a user's allow or deny list. Irreversible.

imap_server_reload
imap_bulk_jobs
imap_bulk_job_status

Get one bulk job's detail: status, done/total progress, error count, ETA, and last error.

imap_bulk_job_cancel
imap_sync_folder_cache
imap_search_cache
imap_get_capabilities

Query IMAP server capabilities and supported extensions (RFC 9051 CAPABILITY command)

imap_apply_categories

Apply Quick Categories to emails in a folder. Scans emails and moves them to target folders based on keyword matches. Default limit is 100 to prevent token overflow.

imap_test_categories
imap_recommend_keywords
imap_list_categories

List all Quick Categories for a user, optionally filtered by account

imap_check_domain_dns_firewall

Check if a domain is blocked by DNS firewall (Quad9 threat intelligence)

imap_test_quad9_dns
imap_bulk_check_domains

Check multiple domains against DNS firewall in bulk

imap_scan_message_domains

Extract and validate all domains from an email message against DNS firewall

imap_bulk_scan_messages

Scan multiple messages for malicious domains and optionally auto-mark as spam

imap_search_emails
imap_get_email
imap_mark_as_read

Mark an email as read

imap_mark_as_unread

Mark an email as unread

imap_delete_email

Delete an email (moves to trash or expunges)

imap_get_email_sizes
imap_get_largest_emails
imap_set_email_priority
imap_get_email_priority
imap_export_email
imap_export_folder
imap_export_account
imap_extract_attachments
imap_get_attachment
imap_bulk_delete_emails

Bulk delete multiple emails by UIDs. Automatically uses chunked processing for >50 UIDs to prevent timeouts.

imap_get_latest_emails
imap_send_email
imap_test_sent_folder
imap_list_unarchived_sends
imap_attachment_stage_init
imap_attachment_stage_append
imap_attachment_stage_finalize
imap_attachment_stage_cancel

Discard a staging session and reclaim its disk space.

imap_list_staged_attachments
imap_test_smtp
imap_get_smtp_metrics
imap_reset_smtp_metrics

Reset SMTP metrics for an account (or all accounts if omitted).

imap_reply_to_email

Reply to an existing email

imap_forward_email

Forward an existing email

imap_bulk_get_emails
imap_bulk_mark_emails

Bulk mark multiple emails with standard IMAP flags. Automatically uses chunked processing for >50 UIDs to prevent timeouts.

imap_copy_email

Copy an email to another folder

imap_bulk_copy_emails

Bulk copy multiple emails to another folder

imap_move_email

Move an email to another folder (copy + delete)

imap_bulk_move_emails

Bulk move multiple emails to another folder (copy + delete)

imap_get_metrics

Get connection metrics and health information for an account

imap_get_operation_metrics

Get detailed metrics for IMAP operations

imap_get_circuit_breaker
imap_reset_circuit_breaker
imap_reset_metrics

Reset connection metrics for an account

imap_add_keyword

Add a custom keyword to emails. RFC 9051 recommended keywords: $Forwarded, $MDNSent, $Junk, $NotJunk, $Phishing

imap_remove_keyword

Remove a custom keyword from emails

imap_append_message

Append a raw RFC822 message to a mailbox (useful for importing emails, saving drafts, or copying messages)

imap_bulk_mark_emails_chunked

Bulk mark emails with chunking for large operations (1000+ messages). Processes in chunks to avoid timeouts and circuit breaker trips. Returns progress summary.

imap_bulk_delete_emails_chunked

Bulk delete emails with chunking for large operations (1000+ messages). Processes in chunks to avoid timeouts and circuit breaker trips. Returns progress summary.

imap_bulk_get_emails_chunked
imap_list_folders

List all folders/mailboxes in an IMAP account

imap_folder_status

Get status information about a folder

imap_get_unread_count

Get the count of unread emails in specified folders

imap_create_folder

Create a new folder/mailbox in an IMAP account

imap_delete_folder

Delete a folder/mailbox from an IMAP account

imap_rename_folder

Rename a folder/mailbox in an IMAP account

imap_subscribe_mailbox

Subscribe to a mailbox (RFC 9051 SUBSCRIBE command)

imap_unsubscribe_mailbox

Unsubscribe from a mailbox (RFC 9051 UNSUBSCRIBE command)

imap_list_subscribed_mailboxes

List all subscribed mailboxes (RFC 9051 LSUB/LIST with SUBSCRIBED)

imap_get_quota
imap_get_mailbox_status

Get mailbox statistics without selecting it (RFC 9051 STATUS command) - more efficient than SELECT

imap_about

Get comprehensive information about the IMAP MCP Pro service including version, features, and capabilities

imap_list_tools

List all available MCP tools with descriptions and parameters

imap_help
imap_open_web_ui
imap_results
imap_score_email_confidence

Analyze email headers to detect spoofing and calculate confidence score (-100 to +100). Returns detailed breakdown of scoring rules, flags, and recommendation.

imap_bulk_score_emails

Analyze multiple emails for spoofing detection. Efficiently processes 100+ emails in < 5 seconds using headers-only analysis. Returns confidence scores and flags for all emails.

imap_analyze_folder_confidence

Analyze all emails in a folder and provide confidence statistics. Useful for identifying patterns of suspicious emails.

imap_check_skill_updates

31 further tools are not listed here. The complete surface is in the source.

// known CVEs in dependencies5 high5 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.22.0GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.22.0GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.22.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highexpress-rate-limit@8.2.1GHSA-46wh-pxpv-q5gq

express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network

highjs-yaml@5.0.0GHSA-pm4m-ph32-ghv5

js-yaml: Exponential parsing time in flow collections leads to denial of service

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configIMAP_MCP_ALLOWED_ATTACHMENT_DIRS
configIMAP_MCP_ALLOWED_EXPORT_DIRS
configIMAP_MCP_ALLOW_DOTFILES
configIMAP_MCP_ATTACHMENT_STAGING_DIR
configIMAP_MCP_AUTO_CREATE_SENT_FOLDER
configIMAP_MCP_DATABASE_PATH
🔐 secretIMAP_MCP_GITHUB_TOKEN
configIMAP_MCP_LOG_LEVEL
configIMAP_MCP_MAX_ATTACHMENT_SIZE_BYTES
configIMAP_MCP_MAX_SEND_SIZE_BYTES
configIMAP_MCP_MAX_STAGING_BYTES_PER_USER
configIMAP_MCP_MAX_TOTAL_ATTACHMENT_SIZE_BYTES
configIMAP_MCP_RESULTS_DIR
configIMAP_MCP_SKILL_GITHUB_OWNER
configIMAP_MCP_SKILL_GITHUB_REF
configIMAP_MCP_SKILL_GITHUB_REPO
configIMAP_MCP_SKIP_MIGRATIONS
configIMAP_MCP_SKIP_SKILLS_INSTALL
configIMAP_MCP_TEST_FAKE
configIMAP_MCP_WEB_UI_PORT
configMCP_USER_ID"": "customer-a"
Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deployPORT
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

131/131 tools missing one or more hints — imap_add_account (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); imap_list_accounts (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); imap_remove_account (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +128 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool test coverage

Only 30/131 tools referenced in tests (23%)

Write tests that reference each tool by name so every tool has at least one test.

Shell command execution

37 child_process calls — runs shell commands

Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.

Production dependencies are patched

0 critical, 5 high severity in production deps — @modelcontextprotocol/sdk@1.22.0 (high), @modelcontextprotocol/sdk@1.22.0 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Dependency freshness

1/21 production deps stale: @iarna/toml@2023-07-15 (3y)

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/temple-of-epiphany/imap-mcp-pro?variant=verified)](https://m8ven.ai/mcp/temple-of-epiphany/imap-mcp-pro)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 525770b9721c03dc05c361f255944bc3cc0b2261
code hash: 85786165d39a6e464e1f44b3ca20cff1e4e27f4063de0293a0bd1ecd1de99a89
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client