Let Claude read your mail. Nothing else.
A read-only MCP server that speaks IMAP, so it works with Outlook.com, Gmail, Fastmail, iCloud or your own server. Reading a message doesn't even mark it as read.
$ rubit-mcp-mail doctor config: ~/.config/rubit-mcp-mail/config.toml (found) secrets: keyring (keyring.backends.SecretService) account outlook <you@outlook.com> via outlook ✓ config ✓ credential ✓ connectivity ✓ auth ok folders: inbox (1204/3) sent drafts junk trash archive
Six tools. Every one a read.
There is no delete tool, no move tool, and no send tool — and none are planned. Each of these can be switched off per account if you want the surface even smaller.
list_accountsreadConfigured accounts and whether each is authenticated.
The one tool that is not account-scoped, and the first to call when something reports an auth problem.
list_foldersreadFolders with normalized roles and unread counts.
Roles are stable across providers, so `junk` works without knowing the server calls it "Junk Email".
list_messagesreadBrowse a folder, newest first, paginated.
Summaries only. Every result carries an opaque handle you pass to read_message.
search_messagesreadSearch by text, sender, subject, date range or unread.
Server-side IMAP search, so it covers the whole folder without downloading it.
read_messagereadFull headers, body text and attachment metadata.
Fetched with BODY.PEEK, so reading does not mark the message as read. HTML becomes Markdown.
get_attachmentreadSave one attachment into the download directory.
The only thing that writes anything, and only ever inside that one directory.
Your provider, not ours.
It speaks IMAP, so the provider is a line of config rather than a code change. Outlook signs in with OAuth2; everything else takes an app password.
- Outlook.com
- Gmail
- Fastmail
- iCloud
- Yahoo
- Self-hosted
Not "we promise". Structurally incapable.
Handing an assistant your mailbox is a real decision. The answer here isn't a setting you have to trust — it's that the code to modify your mail was never written, and a test in CI fails the moment someone writes it.
Read the security modelEXAMINE, never SELECT
Folders are opened read-only at the protocol level. The server cannot write even by accident.
BODY.PEEK on every fetch
Reading a message does not set \Seen. Your unread count is exactly where you left it.
No write code paths exist
There is no send, move, delete, flag or expunge anywhere in the codebase. Not disabled — absent.
A test keeps it that way
The fake IMAP server raises on every mutating call, so adding one fails the suite.
One file. No terminal.
Python and every dependency are inside the installer. It asks for your mailbox, signs you in, and registers itself with Claude Desktop and Claude Code.