IMAP MCP Pro (Temple-of-Epiphany/imap-mcp-pro) is an MCP server listed on the M8ven Trust Index. It scores 52 out of 100, grade D. It declares 131 tools. No publisher has claimed this listing.
An enterprise-grade MCP server that provides production-ready IMAP email integration with advanced reliability features, comprehensive monitoring, and secure account management.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
Temple-of-Epiphany
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
imap_add_accountAdd a new IMAP account with optional SMTP configuration for current user (from MCP_USER_ID environment variable)
imap_list_accountsList all IMAP accounts for current user (from MCP_USER_ID environment variable)
imap_remove_accountRemove an IMAP account from database
imap_connectConnect to an IMAP account
imap_disconnectDisconnect from an IMAP account
imap_list_providersList all available email provider presets (Gmail, Outlook, Yahoo, etc.) with pre-configured IMAP/SMTP settings
imap_add_account_with_providerAdd a new IMAP account using a provider preset (auto-fills IMAP/SMTP settings). Available providers are listed by imap_list_providers.
imap_add_account_autoAdd a new IMAP account by auto-detecting provider from email address (e.g., @gmail.com → Gmail preset)
imap_get_outbox_dirimap_test_accountimap_set_account_signatureimap_get_account_signatureGet the per-account email signature (plain text + HTML).
imap_add_list_entryimap_remove_list_entryRemove an entry from a per-user allow or deny list (matches the normalized value).
imap_list_entriesList a user's allow/deny entries (optionally filtered to one list).
imap_check_addressimap_import_listimap_clear_listRemove ALL entries from a user's allow or deny list. Irreversible.
imap_server_reloadimap_bulk_jobsimap_bulk_job_statusGet one bulk job's detail: status, done/total progress, error count, ETA, and last error.
imap_bulk_job_cancelimap_sync_folder_cacheimap_search_cacheimap_get_capabilitiesQuery IMAP server capabilities and supported extensions (RFC 9051 CAPABILITY command)
imap_apply_categoriesApply Quick Categories to emails in a folder. Scans emails and moves them to target folders based on keyword matches. Default limit is 100 to prevent token overflow.
imap_test_categoriesimap_recommend_keywordsimap_list_categoriesList all Quick Categories for a user, optionally filtered by account
imap_check_domain_dns_firewallCheck if a domain is blocked by DNS firewall (Quad9 threat intelligence)
imap_test_quad9_dnsimap_bulk_check_domainsCheck multiple domains against DNS firewall in bulk
imap_scan_message_domainsExtract and validate all domains from an email message against DNS firewall
imap_bulk_scan_messagesScan multiple messages for malicious domains and optionally auto-mark as spam
imap_search_emailsimap_get_emailimap_mark_as_readMark an email as read
imap_mark_as_unreadMark an email as unread
imap_delete_emailDelete an email (moves to trash or expunges)
imap_get_email_sizesimap_get_largest_emailsimap_set_email_priorityimap_get_email_priorityimap_export_emailimap_export_folderimap_export_accountimap_extract_attachmentsimap_get_attachmentimap_bulk_delete_emailsBulk delete multiple emails by UIDs. Automatically uses chunked processing for >50 UIDs to prevent timeouts.
imap_get_latest_emailsimap_send_emailimap_test_sent_folderimap_list_unarchived_sendsimap_attachment_stage_initimap_attachment_stage_appendimap_attachment_stage_finalizeimap_attachment_stage_cancelDiscard a staging session and reclaim its disk space.
imap_list_staged_attachmentsimap_test_smtpimap_get_smtp_metricsimap_reset_smtp_metricsReset SMTP metrics for an account (or all accounts if omitted).
imap_reply_to_emailReply to an existing email
imap_forward_emailForward an existing email
imap_bulk_get_emailsimap_bulk_mark_emailsBulk mark multiple emails with standard IMAP flags. Automatically uses chunked processing for >50 UIDs to prevent timeouts.
imap_copy_emailCopy an email to another folder
imap_bulk_copy_emailsBulk copy multiple emails to another folder
imap_move_emailMove an email to another folder (copy + delete)
imap_bulk_move_emailsBulk move multiple emails to another folder (copy + delete)
imap_get_metricsGet connection metrics and health information for an account
imap_get_operation_metricsGet detailed metrics for IMAP operations
imap_get_circuit_breakerimap_reset_circuit_breakerimap_reset_metricsReset connection metrics for an account
imap_add_keywordAdd a custom keyword to emails. RFC 9051 recommended keywords: $Forwarded, $MDNSent, $Junk, $NotJunk, $Phishing
imap_remove_keywordRemove a custom keyword from emails
imap_append_messageAppend a raw RFC822 message to a mailbox (useful for importing emails, saving drafts, or copying messages)
imap_bulk_mark_emails_chunkedBulk mark emails with chunking for large operations (1000+ messages). Processes in chunks to avoid timeouts and circuit breaker trips. Returns progress summary.
imap_bulk_delete_emails_chunkedBulk delete emails with chunking for large operations (1000+ messages). Processes in chunks to avoid timeouts and circuit breaker trips. Returns progress summary.
imap_bulk_get_emails_chunkedimap_list_foldersList all folders/mailboxes in an IMAP account
imap_folder_statusGet status information about a folder
imap_get_unread_countGet the count of unread emails in specified folders
imap_create_folderCreate a new folder/mailbox in an IMAP account
imap_delete_folderDelete a folder/mailbox from an IMAP account
imap_rename_folderRename a folder/mailbox in an IMAP account
imap_subscribe_mailboxSubscribe to a mailbox (RFC 9051 SUBSCRIBE command)
imap_unsubscribe_mailboxUnsubscribe from a mailbox (RFC 9051 UNSUBSCRIBE command)
imap_list_subscribed_mailboxesList all subscribed mailboxes (RFC 9051 LSUB/LIST with SUBSCRIBED)
imap_get_quotaimap_get_mailbox_statusGet mailbox statistics without selecting it (RFC 9051 STATUS command) - more efficient than SELECT
imap_aboutGet comprehensive information about the IMAP MCP Pro service including version, features, and capabilities
imap_list_toolsList all available MCP tools with descriptions and parameters
imap_helpimap_open_web_uiimap_resultsimap_score_email_confidenceAnalyze email headers to detect spoofing and calculate confidence score (-100 to +100). Returns detailed breakdown of scoring rules, flags, and recommendation.
imap_bulk_score_emailsAnalyze multiple emails for spoofing detection. Efficiently processes 100+ emails in < 5 seconds using headers-only analysis. Returns confidence scores and flags for all emails.
imap_analyze_folder_confidenceAnalyze all emails in a folder and provide confidence statistics. Useful for identifying patterns of suspicious emails.
imap_check_skill_updates31 further tools are not listed here. The complete surface is in the source.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network
js-yaml: Exponential parsing time in flow collections leads to denial of service
IMAP_MCP_ALLOWED_ATTACHMENT_DIRSIMAP_MCP_ALLOWED_EXPORT_DIRSIMAP_MCP_ALLOW_DOTFILESIMAP_MCP_ATTACHMENT_STAGING_DIRIMAP_MCP_AUTO_CREATE_SENT_FOLDERIMAP_MCP_DATABASE_PATHIMAP_MCP_GITHUB_TOKENIMAP_MCP_LOG_LEVELIMAP_MCP_MAX_ATTACHMENT_SIZE_BYTESIMAP_MCP_MAX_SEND_SIZE_BYTESIMAP_MCP_MAX_STAGING_BYTES_PER_USERIMAP_MCP_MAX_TOTAL_ATTACHMENT_SIZE_BYTESIMAP_MCP_RESULTS_DIRIMAP_MCP_SKILL_GITHUB_OWNERIMAP_MCP_SKILL_GITHUB_REFIMAP_MCP_SKILL_GITHUB_REPOIMAP_MCP_SKIP_MIGRATIONSIMAP_MCP_SKIP_SKILLS_INSTALLIMAP_MCP_TEST_FAKEIMAP_MCP_WEB_UI_PORTMCP_USER_ID"": "customer-a"PORTTool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
131/131 tools missing one or more hints — imap_add_account (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); imap_list_accounts (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); imap_remove_account (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +128 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool test coverage
Only 30/131 tools referenced in tests (23%)
Write tests that reference each tool by name so every tool has at least one test.
Shell command execution
37 child_process calls — runs shell commands
Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.
Production dependencies are patched
0 critical, 5 high severity in production deps — @modelcontextprotocol/sdk@1.22.0 (high), @modelcontextprotocol/sdk@1.22.0 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Dependency freshness
1/21 production deps stale: @iarna/toml@2023-07-15 (3y)
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/temple-of-epiphany/imap-mcp-pro)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check