Timbre

Timbre The connector for Apple Mail and Claude

Instant full-text search of all your mail accounts, safe reading, drafting and filing — searched on your Mac, not on Google's servers. Français · English

---

Timbre connects Claude to Apple Mail on your Mac. It is an MCP server packaged as a one-click Claude Desktop extension, and it lets Claude work with the mail you already have in Mail, whatever the account (iCloud, Gmail, Outlook and Exchange, Orange, La Poste, any IMAP…). It reads Mail's own data on disk, so a search across hundreds of thousands of messages — bodies included — answers in tens of milliseconds, and it acts in Mail through the official scripting interface when you ask it to draft, file or flag.

It is built for the reality of an AI assistant reading untrusted email: hidden instructions are stripped and reported, forged senders are flagged, no message is ever deleted for good, and nothing is sent without you.

Status: v0.6, in daily use on a real mailbox of 132,000 messages across six accounts. Feedback welcome in Issues.

Why Timbre

• One search for all your mail. iCloud, Gmail with its labels, Outlook, Orange, La Poste, any IMAP: message bodies and attachment names included, in 20 to 40 ms over 132,000 messages, with Gmail-style operators and folders named as Mail shows them.
• Nothing missed, nothing hidden. Shop and newsletter layouts are read in full, and so is text placed after an attachment; text hidden from you but aimed at an AI is removed and reported.
• Phishing spotted. Forged senders, links that lie about where they lead (behind Outlook's Safe Links too), first-time senders, risky attachments.
• Attachments read. PDF, Word, RTF, ODT, text, CSV, invitations, contact cards, forwarded mail.
• Safe actions. Drafts open in Mail and never leave on their own; archive and trash can be undone; folders are made, and empty ones deleted, even where Mail lets no app do it; Timbre says plainly what it cannot do instead of pretending.
• Private and trusted. Searched on your Mac, not on a server; one app, signed and notarized by Apple, holding its own permission; nothing else to install, nothing to restart.

In practice

Ask Claude in your own words; Timbre does the searching and reading:

• *"Find September's electricity bill and tell me the amount."* Timbre finds it in whichever account it arrived, and reads the attached PDF.
• *"What did the notary send me about the sale?"* Bodies and attachment names are searched too, accents and plurals included (*facture* finds *factures*).
• *"Sum up my conversation with Sophie about the holidays."* The whole thread, each message reduced to what it adds.
• *"Is this email from my bank genuine?"* Sender authentication, look-alike addresses, links that lie about where they go, hidden text.
• *"Draft a reply saying Thursday works for me."* The draft opens in Mail for you to check; nothing is sent.
• *"Archive last month's newsletters."* Moves can be undone.
• *"Delete the empty folders in my La Poste account."* Each is checked empty on the server first; the password is asked once, in a window of Timbre, the first time.

Searched on your Mac, not on Google's servers

Claude's Gmail connector sends each search to Google's servers through the Gmail API, and only reaches Gmail. Timbre searches an index kept on your Mac, built from the mail Apple Mail has already downloaded, for every account at once.

In both cases, what Claude reads goes to Claude to answer you.

Also using the Gmail connector? No need to remove it: Timbre asks Claude to go through Timbre first for anything in your mail, Gmail included. Keep the Gmail connector for what Timbre does not do, such as archiving Gmail mail or filing it under a label (Mail cannot do that for a script), or sending from Gmail while sending is off in Timbre. If Claude still reaches for Gmail, just tell it "search with Timbre".

What it does

• Search everything. Full-text over subjects, people, message bodies and attachment names, ranked by relevance, recency and whether you correspond with the sender, one result per message even when Gmail files it under several labels, accent- and ligature-insensitive (réunion = reunion, cœur = coeur), with filters and Gmail-style operators: from:, to:, cc:, subject:, in:, label:, is:unread, is:flagged, has:attachment, filename:, after:, before:, newer_than:7d, older_than:1y, "exact phrase" (also after an operator: from:"Jean Dupont"), prefix* (3 letters or more), -exclude (also -from:, -"a phrase"), OR. Junk and trash are left out, and their words can still be searched when asked for.
• Read safely. The text a person sees in Mail: hidden HTML content removed, and nothing that is shown lost (shops' MJML layouts, text after an attachment placed inside the message, the text version of mail made of pictures), with warnings about sender authenticity, deceptive links and risky attachments (programs, macros, web pages).
• Follow conversations. A whole thread, each message reduced to its new text.
• Read attachments. PDF, Word, RTF and ODT (converted by macOS in a separate process), text, HTML, CSV, calendars, contact cards and attached emails.
• Act, reversibly. Drafts (new, reply, reply all, forward) open in Mail for you to review; mark read/unread, flag; move to archive, trash or any mailbox — with undo. An account with no archive mailbox is given one, as with Mail's Archive button. Gmail is the exception: Mail lets a script move Gmail mail to the trash or junk only, and Timbre says so rather than pretend.
• Make and delete mailboxes. Folders and Gmail labels are made, and empty ones deleted, even where Mail lets no app do it: Timbre then acts on the mail server itself, with a password asked once (how and why).
• Send, only if you allow it. Off by default. When enabled, every message takes two explicit steps, with an optional recipient allowlist and an hourly cap.

How it compares

Timbre takes the best ideas of the open-source Apple Mail connectors and adds what none of them combines. Facts below come from each project's documentation or code (November 2026); "—" means the project does not describe it.

To our knowledge, Timbre is the only Apple Mail connector that combines a ranked full-text index of message bodies, protection against hidden instructions, sender and link checks, undo, mailbox management with no setup beforehand, and a signed, notarized app that holds its own permission. sweetrb offers more tools for running Mail itself (rules, smart mailboxes, templates); Timbre keeps to what an assistant needs to find, read and file your mail safely.

New in Timbre

• Every account, labels included. Gmail keeps each message once, in All Mail: Timbre reads its labels, so Gmail's Inbox, Sent and your labels work like any mailbox. The sent mail of Orange, Wanadoo and La Poste (OUTBOX) and their spam (QUARANTAINE) are recognised too.
• Sensible ranking. A vague search (*invoice*) puts recent mail first; mail from people you write to ranks higher; mail you send yourself does not.
• Nothing to restart. Once you allow Full Disk Access, Timbre notices within seconds and starts working, in the same conversation. It also tells you when a new version is out.
• Hidden-text removal. display:none, zero-size fonts, white-on-white, off-screen, clipped, shrunk, blurred and transparent text, text that filters or blending make vanish, zero-width and bidi characters are removed from what Claude reads — and counted, and scanned for instructions aimed at an AI. Style sheets are read with the CSS parser and selector engine Firefox uses, and judged as Mail draws them on a Mac: cascade layers, nested rules, @container, @scope, ::first-line, animations and shadow trees included. When what a message shows depends on the width of Mail's window, only what can be seen at any width is kept.
• What you see is what Claude reads. Timbre reads the HTML part Mail displays, not the text/plain alternative an attacker can fill with different content (and warns when they differ).
• Sender checks. SPF/DKIM/DMARC results, display names showing another address, reply-to on another domain, punycode domains, links whose text shows one domain but lead to another, and *first contact* (a sender you have never exchanged with).
• Spotlighting. Every untrusted body is fenced with a random marker the sender cannot predict.
• Attachments. Executables, double extensions (invoice.pdf.app) and macro files are labelled; saved files go to one folder you choose, are never overwritten and are marked for Gatekeeper.
• Least privilege. Read tools are marked read-only so Claude can use them without asking; tools that change anything are marked as such; sending tools do not even exist until you enable them.
• One permission, for Timbre only. Full Disk Access is granted to Timbre's own signed app, with its name and icon, not to Claude or a launcher shared with other extensions: Timbre tells macOS it answers for its own access.

Making and deleting mailboxes

Mai