Proton Safe MCP

Name: Proton Safe MCP
Author: fbossiere

by fbossiereversion 2.3.2i★ –iRuns on your computer

Registry nameio.github.fbossiere/proton-safe-mcp

Install

Overview

Description from the maker (original English)

Read Proton Mail, extract bounded attachment text, and create explicitly confirmed drafts.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiVery new↓ 52/wk · ★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs on your computer
Transport: stdio
Category: Other
You need to fill in: PROTON_BRIDGE_USER

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on your computer with your user’s permissions (files, network, apps).
You fill in yourself: PROTON_BRIDGE_USER, PROTON_IMAP_PORT

You need

PyPIPython’s uv installed (for the uvx command)

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "proton-safe": {
      "command": "uvx",
      "args": [
        "proton-safe-mcp",
        "serve"
      ],
      "env": {
        "PROTON_BRIDGE_USER": "your-value",
        "PROTON_IMAP_PORT": "your-value"
      }
    }
  }
}

Run this in your terminal

claude mcp add proton-safe --env PROTON_BRIDGE_USER=your-value --env PROTON_IMAP_PORT=your-value -- uvx proton-safe-mcp serve

Fill in the empty values before running it.

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "proton-safe": {
      "command": "uvx",
      "args": [
        "proton-safe-mcp",
        "serve"
      ],
      "env": {
        "PROTON_BRIDGE_USER": "your-value",
        "PROTON_IMAP_PORT": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "proton-safe": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "proton-safe-mcp",
        "serve"
      ],
      "env": {
        "PROTON_BRIDGE_USER": "your-value",
        "PROTON_IMAP_PORT": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.

Your choice stays on this device in a cookie; no account needed.

Values you fill in

PROTON_BRIDGE_USER required env
Proton address configured in Proton Mail Bridge
PROTON_IMAP_PORT env
Local IMAP port shown by Proton Mail Bridge

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Runs on your computer; the tool list appears in your AI app after you install it.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 8, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account fbossiere, which owns the repo
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
– Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
– Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
… Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints

Compared with others in Otheri

More stars than 0% of the other 18590 servers in this category
Published to the registry more recently than 78% of the other 18590 servers in this category
Basic checks equal to or better than 100% of the other 18590 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is Proton Safe MCP safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

You need to fill in: PROTON_BRIDGE_USER

Does it run on my computer or in the cloud?

It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).

Is it still maintained?

The GitHub repo last changed –, and the latest version (2.3.2) reached the registry 11 days ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Python (uv) on your computer.

What can I use instead?

In the same category: Spec Driven Development, Remote Desktop Commander, render.ai Presentations

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:↓ Downloads per weeki★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Spec Driven Development

MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.

by formulahendryEarly↓ 66/wk★ 440Updated 14 months ago

Runs on your computer

Install

Remote Desktop Commander

Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.

by desktop-commanderGrowing★ 211Updated 3 days ago

Runs in the cloud✓ desktopcommander.app

Install

render.ai Presentations

Create, edit, preview and export designed, editable presentations from a brief or outline.

by render.aiEarlyUpdated today

Runs in the cloud✓ render.ai

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

Proton Safe MCP

[Website & download](https://fbossiere.github.io/proton-safe-mcp/) · [En français](https://fbossiere.github.io/proton-safe-mcp/fr/)

A client-agnostic FastMCP server for Proton Mail through the official Proton Mail Bridge. It can read and search mail and create drafts with attachments. It deliberately cannot send email — you review every draft in Proton Mail and press Send yourself.

The server runs locally over STDIO for any MCP-compatible client (Claude Desktop, Claude Code, or anything else that speaks MCP). Received PDF, TXT, and CSV attachments can be inspected through bounded text extraction without exposing their raw bytes. Outgoing attachments are uploaded as bounded base64 chunks, so the server never receives or reads a client filesystem path.

Read the full documentation for setup, configuration, tool inputs, security boundaries, and troubleshooting.

Why "safe"?

Email is attacker-controlled input. Any sender can put adversarial instructions in a message body, and an AI agent that reads mail *and* holds write-capable tools is one prompt injection away from doing something you did not ask for. This project limits the blast radius by construction:

No send. There is no SMTP client and no send_message tool in the codebase — a test asserts it.
No delete, no move, and no raw received-attachment download tool.
Human in the loop. Draft creation requires explicit confirmation of the exact content in the conversation, and Proton Mail still requires manual review and sending.
No filesystem access for clients. Attachment bytes are streamed in chunks with declared size and SHA-256 verification; paths are rejected.
Loopback only. STDIO transport, no listening socket, and the Bridge host is hard-coded to 127.0.0.1.

These controls reduce risk but do not make email trusted. Never expose unrelated write-capable tools in the same unattended agent workflow.

Architecture

Security properties

STDIO only: the server opens no listening network socket.
Proton Bridge host is hard-coded to 127.0.0.1 (PROTON_BRIDGE_HOST is intentionally unsupported).
No SMTP client, send tool, delete tool, move tool, or raw received-attachment download tool.
Message and attachment reads use BODY.PEEK; attachment inspection returns bounded extracted text, metadata, and a SHA-256 digest, never raw bytes or files.
Attachment input is chunked base64 with declared size and SHA-256 verification.
Only PDF, DOCX, XLSX, PPTX, TXT, CSV, PNG, and JPEG uploads are accepted.
Attachment tokens are random, short-lived, single-use, and reverified before draft creation.
Draft creation requires an explicit client assertion that the user confirmed the exact recipients, subject, body, and attachments in the conversation.
The Bridge-generated IMAP password is stored in the operating-system keyring.
Draft bodies are stored as plain text plus a server-generated HTML alternative that HTML-escapes the confirmed body, so quoted markup can never be rendered. Nothing is ever appended to a body server-side, including a reply quote.
Proton Bridge does not preserve reply threading in saved drafts. Reply targets are refused unless the user explicitly accepts a possibly separate draft. Accepted replies submit headers only. Recipients are never derived from the message being replied to, its Message-ID is reverified at the IMAP write, and both identifiers are validated so neither can continue into a header of its own.
Recipient, subject, and folder inputs are validated against header/criteria injection.
State files are private to one account. On Linux: 0700 directories, 0600 files and O_NOFOLLOW. On Windows: a protected DACL granting only the owning user and the system accounts, with reparse points refused in place of O_NOFOLLOW.

Requirements

Linux with the official Proton Mail Bridge installed, signed in, and running (developed and tested on Ubuntu).
A Proton plan that supports Bridge.
Python 3.11–3.14 (tested in CI) for the command-line installation; bundled in the desktop installer.
uv for the command-line installation.
A working Secret Service keyring (gnome-keyring or compatible).

Windows 11 x64 support is implemented in this repository but not released: automated checks run on Windows Server, while end-to-end Windows 11 acceptance remains untested. See the Windows installer notes and its acceptance sheet.

Installation

Desktop assistant — Ubuntu 24.04, x86_64

Download the installer, open it with Ubuntu's package installer, then launch Proton Safe. The assistant guides you through Bridge connection and plugin activation in a compatible local ChatGPT desktop or Codex installation. Python and uv are included; no terminal setup is required.

You still need Proton Mail Bridge, a compatible Proton plan and a session keyring. See the desktop guide for prerequisites, screenshots and repair options. Checksums and build provenance are in the release.

Desktop assistant — Windows 11, x64

Not available yet. The installer, the Windows platform layer and the build pipeline exist, but no acceptance scenario has been run on Windows and there is no download. Two external dependencies remain open: a Windows AI client whose full path is qualified, and a signing identity usable from CI.

Command-line installation — other MCP clients

Install the reviewed release from PyPI with uv:

uv tool install proton-safe-mcp==2.3.2

For development from source instead:

git clone https://github.com/fbossiere/proton-safe-mcp.git

cd proton-safe-mcp uv sync --extra dev

Set the Proton address and Bridge IMAP port in the MCP process environment. No credential is ever set here:

export PROTON_BRIDGE_USER="your-address@proton.me"

export PROTON_IMAP_PORT="1143"

To draft as another Proton address of the same account, add the optional sender allowlist in that same environment, as comma-separated bare addresses:

export PROTON_BRIDGE_ALIASES="billing@example.com,legal@example.com"

Store the Bridge-generated IMAP password (shown in the Bridge UI), not your Proton account password:

proton-safe-mcp setup

The value shown by Bridge is installation-specific and works only against the local Bridge.

Register with an MCP client

Configure a local STDIO server with these logical fields. Use command -v proton-safe-mcp to obtain the absolute command path when your client does not inherit your shell PATH:

"name": "proton-safe", "transport": "stdio", "command": "/absolute/path/to/proton-safe-mcp", "args": ["serve"], "env": { "PROTON_BRIDGE_USER": "your-address@proton.me", "PROTON_IMAP_PORT": "1143" } }

PROTON_BRIDGE_ALIASES goes in the same env block when a draft may use more than one From address. See Sender addresses.

Do not put PROTON_BRIDGE_PASSWORD in the client configuration. The server reads it from the OS keyring established by setup.

Copy-paste instructions are available for Claude Code, Cursor, and VS Code. AI coding agents can follow the safety-constrained llms-install.md guide.

Verify the complete local setup without printing credentials, addresses, or mailbox data:

proton-safe-mcp doctor

OpenAI plugin

The repository includes a private, local-first Proton Safe plugin for ChatGPT and Codex. It packages safety-focused mail review and draft workflows with the same restricted MCP server:

ChatGPT desktop and Codex can launch the bundled STDIO configuration directly on the Bridge machine, with no tunnel or dedicated server;
direct MCP registration remains available when the packaged workflow skills are not needed;
ChatGPT web or a client on another machine can optionally reach the Bridge host through OpenAI Secure MCP Tunnel without an inbound port;
a remote deployment still keeps proton-safe-mcp and Proton Mail Bridge together, with IMAP fixed to 127.0.0.1.

See the OpenAI plugin guide for local ChatGPT desktop/Codex installation, direct MCP registration, and the optional remote tunnel.

Plugin installed but no Proton tools? The bundled MCP configuration forwards

PROTON_BRIDGE_USER and PROTON_IMAP_PORT from the environment that started Codex; it does not

define their values. On Ubuntu, a correct ~/.config/environment.d/*.conf file can still require

a user-manager reload, while GNOME and already-running terminals can keep their earlier

environment. If a menu relaunch still has no tools, start ChatGPT once from a terminal that has

loaded the file. That terminal launch is a diagnostic, not a requirement for every start; the

troubleshooting guide also provides a persistent per-user menu launcher. Follow the privacy-safe

Ubuntu recovery procedure

or the FAQ before reinstalling anything.

Help test the onboarding. Linux and Proton Mail Bridge users can run the

10-minute external test and

submit privacy-safe installation feedback.

Available MCP tools

Category	Tool	Notes
Read-only mail	`mailbox_status`	Bridge connectivity + INBOX counts
	`list_folders`
	`list_sender_addresses`	The fixed From allowlist a draft may use
	`list_messages`	Never marks messages as read
	`search_messages`	Injection-safe IMAP `TEXT` search

| | `read_mess

Only the beginning is shown; read the rest in the repo

Proton Safe MCP

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

Values you fill in

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Otheri

Common questions

Alternatives

Spec Driven Development

Remote Desktop Commander

render.ai Presentations

README from the maker

Proton Safe MCP

Why "safe"?

Architecture

Security properties

Requirements

Installation

Desktop assistant — Ubuntu 24.04, x86_64

Desktop assistant — Windows 11, x64

Command-line installation — other MCP clients

Register with an MCP client

OpenAI plugin

Available MCP tools