Proton Safe MCP

Name: Proton Safe MCP
Author: fbossiere

作者：fbossiere版本 2.3.2i★ –i在你的电脑上运行

注册名称io.github.fbossiere/proton-safe-mcp

安装

概览

作者提供的说明（英文原文）

Read Proton Mail, extract bounded attachment text, and create explicitly confirmed drafts.

PopNx MCP 的三大支柱

这三项永远不会合并成一个分数：意见、测量和人气是不同的东西。

用户评价i暂无评价评价功能将在后续阶段与账户功能一起开放
我们的基础检查i1 项中通过 1 项依据公开信息检查；尚未扫描代码
使用情况i非常新↓ 52/周 · ★ –

它能帮你做什么

我们还没有为它写通俗的介绍。下面是我们从注册中心读取到的事实。

连接方式: 在你的电脑上运行
传输方式: stdio
分类: 其他
你需要填写：PROTON_BRIDGE_USER

安装

选择你使用的 AI 应用，然后复制设置。

安装之前

基础检查：1 项中通过 1 项
在你的电脑上运行，拥有你的用户账户的权限（文件、网络、应用）。
需要你自己填写： PROTON_BRIDGE_USER, PROTON_IMAP_PORT

你需要

PyPI已安装 Python 的 uv（用于 uvx 命令）

你用的是哪个应用？

ClaudeClaude CodeCursorVS CodeChatGPT

在上方选择你的应用。我们会记住它，下次按钮会显示“安装到 …”。

打开 Claude Desktop → Settings → Developer → Edit Config，把下面的内容粘贴到 claude_desktop_config.json

{
  "mcpServers": {
    "proton-safe": {
      "command": "uvx",
      "args": [
        "proton-safe-mcp",
        "serve"
      ],
      "env": {
        "PROTON_BRIDGE_USER": "your-value",
        "PROTON_IMAP_PORT": "your-value"
      }
    }
  }
}

在终端中运行这条命令

claude mcp add proton-safe --env PROTON_BRIDGE_USER=your-value --env PROTON_IMAP_PORT=your-value -- uvx proton-safe-mcp serve

运行前请先填写空着的值。

在 Cursor 中打开

或者自己复制设置

粘贴到项目中的 .cursor/mcp.json，或 ~/.cursor/mcp.json

{
  "mcpServers": {
    "proton-safe": {
      "command": "uvx",
      "args": [
        "proton-safe-mcp",
        "serve"
      ],
      "env": {
        "PROTON_BRIDGE_USER": "your-value",
        "PROTON_IMAP_PORT": "your-value"
      }
    }
  }
}

浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。

在 VS Code 中打开

或者自己复制设置

粘贴到项目中的 .vscode/mcp.json

{
  "servers": {
    "proton-safe": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "proton-safe-mcp",
        "serve"
      ],
      "env": {
        "PROTON_BRIDGE_USER": "your-value",
        "PROTON_IMAP_PORT": "your-value"
      }
    }
  }
}

浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。

这个服务器在你的电脑上运行，而 ChatGPT 只能连接互联网上的服务器。请选择其他应用。

你的选择通过 Cookie 保存在这台设备上，无需账户。

需要你填写的值

PROTON_BRIDGE_USER 必填 env
Proton address configured in Proton Mail Bridge
PROTON_IMAP_PORT env
Local IMAP port shown by Proton Mail Bridge

这些设置是根据作者在注册中心的条目生成的。如果 README 的写法不同，请以 README 为准。

它能做什么

它在你的电脑上运行；安装后，工具列表会显示在你的 AI 应用中。

基础检查i

我们检查的是任何人都能看到的信息；我们没有阅读代码。不适用的检查项不计入总数。 · 检查于 2026年11月8日

✓ 通过
作者与仓库一致
注册名称已通过 GitHub 账户 fbossiere 验证，该账户拥有此仓库
… 尚未检查
仍在维护
我们还没有从 GitHub 读取这个仓库
… 尚未检查
有许可证
我们还没有从 GitHub 读取这个仓库
– 不适用
端点有响应
它在你的电脑上运行，没有互联网端点
– 不适用
使用 OAuth 登录
在你的电脑上运行，改用本地设置
… 尚未检查
工具描述中没有隐藏指令
它在你的电脑上运行；我们只能读取互联网端点的工具列表

与“其他”中的其他服务器比较i

星标数多于此分类中其他 18603 个服务器的 0%
发布到注册中心的时间比此分类中其他 18603 个服务器的 78% 更新
基础检查结果等于或优于此分类中其他 18603 个服务器的 100%

与注册中心里这个分类中所有活跃的服务器比较。只有当发布者拥有该仓库时，星标数才计入。

常见问题

Proton Safe MCP 安全吗？

它在 1 项适用的基础检查中通过了 1 项。我们没有阅读代码。在添加密钥或令牌之前，请先看看这个服务器要求哪些权限，并使用只具备所需权限的密钥。

它需要哪些密钥或代码？

你需要填写：PROTON_BRIDGE_USER

它在我的电脑上运行还是在云端？

它在你的电脑上运行。你的 AI 应用会在需要时启动它，数据不会经过作者的服务器（除非它自己调用在线服务）。

它还在维护吗？

GitHub 仓库最后更新于–，最新版本（2.3.2）于11天前进入注册中心。

哪些应用可以使用它？

支持 MCP 的应用，例如 Claude Desktop、Claude Code、Cursor 和 VS Code。你的电脑上还需要有 Python (uv)。

有什么可以替代它？

同一分类中有：Spec Driven Development, Remote Desktop Commander, Hominoport

替代选择

同一分类中其他作者的服务器，按星标数排序。

如何看卡片：↓ 每周下载量i★ GitHub 星标i三大支柱：评价 · 检查 · 使用情况i更新 = 最新版本发布到注册中心的时间i

Spec Driven Development

MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.

作者：formulahendry起步阶段↓ 66/周★ 44014个月前更新

在你的电脑上运行

安装

Remote Desktop Commander

Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.

作者：desktop-commander正在增长★ 2113天前更新

在云端运行✓ desktopcommander.app

安装

Hominoport

A human nominee and body in the physical world for autonomous agents. Signed public offer.

作者：hominoport.org今天更新

在云端运行✓ hominoport.org

安装

作者的 README

打开 README

按原文从作者的仓库复制。PopNx MCP 没有审查或背书其内容。HTML、图片和脚本已被移除。链接会离开本站。

Proton Safe MCP

[Website & download](https://fbossiere.github.io/proton-safe-mcp/) · [En français](https://fbossiere.github.io/proton-safe-mcp/fr/)

A client-agnostic FastMCP server for Proton Mail through the official Proton Mail Bridge. It can read and search mail and create drafts with attachments. It deliberately cannot send email — you review every draft in Proton Mail and press Send yourself.

The server runs locally over STDIO for any MCP-compatible client (Claude Desktop, Claude Code, or anything else that speaks MCP). Received PDF, TXT, and CSV attachments can be inspected through bounded text extraction without exposing their raw bytes. Outgoing attachments are uploaded as bounded base64 chunks, so the server never receives or reads a client filesystem path.

Read the full documentation for setup, configuration, tool inputs, security boundaries, and troubleshooting.

Why "safe"?

Email is attacker-controlled input. Any sender can put adversarial instructions in a message body, and an AI agent that reads mail *and* holds write-capable tools is one prompt injection away from doing something you did not ask for. This project limits the blast radius by construction:

No send. There is no SMTP client and no send_message tool in the codebase — a test asserts it.
No delete, no move, and no raw received-attachment download tool.
Human in the loop. Draft creation requires explicit confirmation of the exact content in the conversation, and Proton Mail still requires manual review and sending.
No filesystem access for clients. Attachment bytes are streamed in chunks with declared size and SHA-256 verification; paths are rejected.
Loopback only. STDIO transport, no listening socket, and the Bridge host is hard-coded to 127.0.0.1.

These controls reduce risk but do not make email trusted. Never expose unrelated write-capable tools in the same unattended agent workflow.

Architecture

Security properties

STDIO only: the server opens no listening network socket.
Proton Bridge host is hard-coded to 127.0.0.1 (PROTON_BRIDGE_HOST is intentionally unsupported).
No SMTP client, send tool, delete tool, move tool, or raw received-attachment download tool.
Message and attachment reads use BODY.PEEK; attachment inspection returns bounded extracted text, metadata, and a SHA-256 digest, never raw bytes or files.
Attachment input is chunked base64 with declared size and SHA-256 verification.
Only PDF, DOCX, XLSX, PPTX, TXT, CSV, PNG, and JPEG uploads are accepted.
Attachment tokens are random, short-lived, single-use, and reverified before draft creation.
Draft creation requires an explicit client assertion that the user confirmed the exact recipients, subject, body, and attachments in the conversation.
The Bridge-generated IMAP password is stored in the operating-system keyring.
Draft bodies are stored as plain text plus a server-generated HTML alternative that HTML-escapes the confirmed body, so quoted markup can never be rendered. Nothing is ever appended to a body server-side, including a reply quote.
Proton Bridge does not preserve reply threading in saved drafts. Reply targets are refused unless the user explicitly accepts a possibly separate draft. Accepted replies submit headers only. Recipients are never derived from the message being replied to, its Message-ID is reverified at the IMAP write, and both identifiers are validated so neither can continue into a header of its own.
Recipient, subject, and folder inputs are validated against header/criteria injection.
State files are private to one account. On Linux: 0700 directories, 0600 files and O_NOFOLLOW. On Windows: a protected DACL granting only the owning user and the system accounts, with reparse points refused in place of O_NOFOLLOW.

Requirements

Linux with the official Proton Mail Bridge installed, signed in, and running (developed and tested on Ubuntu).
A Proton plan that supports Bridge.
Python 3.11–3.14 (tested in CI) for the command-line installation; bundled in the desktop installer.
uv for the command-line installation.
A working Secret Service keyring (gnome-keyring or compatible).

Windows 11 x64 support is implemented in this repository but not released: automated checks run on Windows Server, while end-to-end Windows 11 acceptance remains untested. See the Windows installer notes and its acceptance sheet.

Installation

Desktop assistant — Ubuntu 24.04, x86_64

Download the installer, open it with Ubuntu's package installer, then launch Proton Safe. The assistant guides you through Bridge connection and plugin activation in a compatible local ChatGPT desktop or Codex installation. Python and uv are included; no terminal setup is required.

You still need Proton Mail Bridge, a compatible Proton plan and a session keyring. See the desktop guide for prerequisites, screenshots and repair options. Checksums and build provenance are in the release.

Desktop assistant — Windows 11, x64

Not available yet. The installer, the Windows platform layer and the build pipeline exist, but no acceptance scenario has been run on Windows and there is no download. Two external dependencies remain open: a Windows AI client whose full path is qualified, and a signing identity usable from CI.

Command-line installation — other MCP clients

Install the reviewed release from PyPI with uv:

uv tool install proton-safe-mcp==2.3.2

For development from source instead:

git clone https://github.com/fbossiere/proton-safe-mcp.git

cd proton-safe-mcp uv sync --extra dev

Set the Proton address and Bridge IMAP port in the MCP process environment. No credential is ever set here:

export PROTON_BRIDGE_USER="your-address@proton.me"

export PROTON_IMAP_PORT="1143"

To draft as another Proton address of the same account, add the optional sender allowlist in that same environment, as comma-separated bare addresses:

export PROTON_BRIDGE_ALIASES="billing@example.com,legal@example.com"

Store the Bridge-generated IMAP password (shown in the Bridge UI), not your Proton account password:

proton-safe-mcp setup

The value shown by Bridge is installation-specific and works only against the local Bridge.

Register with an MCP client

Configure a local STDIO server with these logical fields. Use command -v proton-safe-mcp to obtain the absolute command path when your client does not inherit your shell PATH:

"name": "proton-safe", "transport": "stdio", "command": "/absolute/path/to/proton-safe-mcp", "args": ["serve"], "env": { "PROTON_BRIDGE_USER": "your-address@proton.me", "PROTON_IMAP_PORT": "1143" } }

PROTON_BRIDGE_ALIASES goes in the same env block when a draft may use more than one From address. See Sender addresses.

Do not put PROTON_BRIDGE_PASSWORD in the client configuration. The server reads it from the OS keyring established by setup.

Copy-paste instructions are available for Claude Code, Cursor, and VS Code. AI coding agents can follow the safety-constrained llms-install.md guide.

Verify the complete local setup without printing credentials, addresses, or mailbox data:

proton-safe-mcp doctor

OpenAI plugin

The repository includes a private, local-first Proton Safe plugin for ChatGPT and Codex. It packages safety-focused mail review and draft workflows with the same restricted MCP server:

ChatGPT desktop and Codex can launch the bundled STDIO configuration directly on the Bridge machine, with no tunnel or dedicated server;
direct MCP registration remains available when the packaged workflow skills are not needed;
ChatGPT web or a client on another machine can optionally reach the Bridge host through OpenAI Secure MCP Tunnel without an inbound port;
a remote deployment still keeps proton-safe-mcp and Proton Mail Bridge together, with IMAP fixed to 127.0.0.1.

See the OpenAI plugin guide for local ChatGPT desktop/Codex installation, direct MCP registration, and the optional remote tunnel.

Plugin installed but no Proton tools? The bundled MCP configuration forwards

PROTON_BRIDGE_USER and PROTON_IMAP_PORT from the environment that started Codex; it does not

define their values. On Ubuntu, a correct ~/.config/environment.d/*.conf file can still require

a user-manager reload, while GNOME and already-running terminals can keep their earlier

environment. If a menu relaunch still has no tools, start ChatGPT once from a terminal that has

loaded the file. That terminal launch is a diagnostic, not a requirement for every start; the

troubleshooting guide also provides a persistent per-user menu launcher. Follow the privacy-safe

Ubuntu recovery procedure

or the FAQ before reinstalling anything.

Help test the onboarding. Linux and Proton Mail Bridge users can run the

10-minute external test and

submit privacy-safe installation feedback.

Available MCP tools

Category	Tool	Notes
Read-only mail	`mailbox_status`	Bridge connectivity + INBOX counts
	`list_folders`
	`list_sender_addresses`	The fixed From allowlist a draft may use
	`list_messages`	Never marks messages as read
	`search_messages`	Injection-safe IMAP `TEXT` search

| | `read_mess

只显示了开头部分；其余内容请在仓库中阅读

Proton Safe MCP

概览

PopNx MCP 的三大支柱

它能帮你做什么

安装

安装之前

需要你填写的值

它能做什么

基础检查i

作者与仓库一致

仍在维护

有许可证

端点有响应

使用 OAuth 登录

工具描述中没有隐藏指令

与“其他”中的其他服务器比较i

常见问题

替代选择

Spec Driven Development

Remote Desktop Commander

Hominoport

作者的 README

Proton Safe MCP

Why "safe"?

Architecture

Security properties

Requirements

Installation

Desktop assistant — Ubuntu 24.04, x86_64

Desktop assistant — Windows 11, x64

Command-line installation — other MCP clients

Register with an MCP client

OpenAI plugin

Available MCP tools