Apple Mail MCP

Apple Mail MCP

A local, stdio-based Model Context Protocol server for Apple Mail on macOS.

It talks only to the Apple Mail app already configured on the user's Mac. It does not need IMAP/SMTP passwords or open a network port.

Safety model

• Mailbox and message tools are read-only by default.
• create_draft opens an unsent, visible draft in Apple Mail.
• send_email requires user_approved: true. MCP clients should call it only after the user has approved the exact message.
• Message changes such as marking, flagging, and moving also require user_approved: true.
• Dynamic content is passed to osascript as arguments, not interpolated into AppleScript source.
• Every write action has a local, metadata-only JSONL audit entry. Bodies and credentials are never written to that log.
• The approval inbox and relationship context are stored only in the local JSON data store described below.

The MCP server itself is local. However, an MCP client may send tool results to an AI model or another service. Only connect clients and models you trust with mail content.

Requirements

• macOS with Apple Mail configured
• Node.js 20+
• Permission for the host application (for example Codex or Terminal) to control Mail under System Settings → Privacy & Security → Automation

Install

npm (recommended)

npm install -g @jakobf1/apple-mail-mcp

Then configure your MCP client with the installed command:

{

"mcpServers": { "apple-mail": { "command": "apple-mail-mcp" } } }

From source

git clone https://github.com/YOUR_ACCOUNT/apple-mail-mcp.git

cd apple-mail-mcp npm install npm run build

Add to an MCP client

If you installed from source rather than npm, use the compiled server over stdio:

{

"mcpServers": { "apple-mail": { "command": "node", "args": ["/absolute/path/to/apple-mail-mcp/dist/index.js"] } } }

Restart the MCP client after saving its configuration. The first call will trigger the normal macOS automation permission prompt.

Optional sender policy

To allow sending only from specific configured Apple Mail addresses, configure a comma-separated allowlist when launching the server:

{

"env": { "APPLE_MAIL_MCP_ALLOWED_SENDERS": "hello@example.com" } }

Write-action audit metadata is stored locally at ~/.apple-mail-mcp/audit.jsonl by default. Set APPLE_MAIL_MCP_AUDIT_LOG to use another local path.

AI-first local workspace

The approval inbox and relationship context share a local JSON store at ~/.apple-mail-mcp/data.json by default. It contains queued draft bodies and the contact notes you intentionally save, so treat it as private mail data. Set APPLE_MAIL_MCP_DATA_STORE to use another local path.

APPLE_MAIL_MCP_DRY_RUN=true validates sends but prevents delivery. You can also enforce recipient restrictions with APPLE_MAIL_MCP_ALLOWED_RECIPIENTS, APPLE_MAIL_MCP_ALLOWED_RECIPIENT_DOMAINS, and a local time window such as APPLE_MAIL_MCP_SENDING_WINDOW=09:00-18:00.

Tools

Scope and non-goals

This project is local-only. It is not an SMTP server, does not manage credentials, and does not bypass macOS privacy prompts. It deliberately excludes deletion, attachment export, background scheduling, and automatic sending.

Publishing and registry metadata

The package is published as @jakobf1/apple-mail-mcp. Its MCP Registry identity is io.github.jakobfigur/apple-mail-mcp; see server.json for portable install metadata.

License

MIT