Gmail Tidy MCP

Name: Gmail Tidy MCP
Author: imkath

作者：imkath版本 0.5.1i★ –i在你的电脑上运行

注册名称io.github.imkath/gmail-tidy-mcp

安装

概览

作者提供的说明（英文原文）

Organize Gmail accounts: threads, attachments, labels, filters, drafts. Never sends or deletes.

PopNx MCP 的三大支柱

这三项永远不会合并成一个分数：意见、测量和人气是不同的东西。

用户评价i暂无评价评价功能将在后续阶段与账户功能一起开放
我们的基础检查i1 项中通过 1 项依据公开信息检查；尚未扫描代码
使用情况i非常新↓ 255/周 · ★ –

它能帮你做什么

我们还没有为它写通俗的介绍。下面是我们从注册中心读取到的事实。

连接方式: 在你的电脑上运行
传输方式: stdio
分类: 聊天与邮件

安装

选择你使用的 AI 应用，然后复制设置。

安装之前

基础检查：1 项中通过 1 项
在你的电脑上运行，拥有你的用户账户的权限（文件、网络、应用）。
注册中心没有列出需要填写的密钥。

你需要

npm已安装 Node.js（用于 npx 命令）

你用的是哪个应用？

ClaudeClaude CodeCursorVS CodeChatGPT

在上方选择你的应用。我们会记住它，下次按钮会显示“安装到 …”。

打开 Claude Desktop → Settings → Developer → Edit Config，把下面的内容粘贴到 claude_desktop_config.json

{
  "mcpServers": {
    "gmail-tidy": {
      "command": "npx",
      "args": [
        "-y",
        "gmail-tidy-mcp"
      ]
    }
  }
}

在终端中运行这条命令

claude mcp add gmail-tidy -- npx -y gmail-tidy-mcp

在 Cursor 中打开

或者自己复制设置

粘贴到项目中的 .cursor/mcp.json，或 ~/.cursor/mcp.json

{
  "mcpServers": {
    "gmail-tidy": {
      "command": "npx",
      "args": [
        "-y",
        "gmail-tidy-mcp"
      ]
    }
  }
}

浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。

在 VS Code 中打开

或者自己复制设置

粘贴到项目中的 .vscode/mcp.json

{
  "servers": {
    "gmail-tidy": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "gmail-tidy-mcp"
      ]
    }
  }
}

浏览器会先询问是否打开应用，然后应用会显示设置并请你确认。密钥的值会留空，由你自己填写。

这个服务器在你的电脑上运行，而 ChatGPT 只能连接互联网上的服务器。请选择其他应用。

你的选择通过 Cookie 保存在这台设备上，无需账户。

这些设置是根据作者在注册中心的条目生成的。如果 README 的写法不同，请以 README 为准。

它能做什么

它在你的电脑上运行；安装后，工具列表会显示在你的 AI 应用中。

基础检查i

我们检查的是任何人都能看到的信息；我们没有阅读代码。不适用的检查项不计入总数。 · 检查于 2026年11月8日

✓ 通过
作者与仓库一致
注册名称已通过 GitHub 账户 imkath 验证，该账户拥有此仓库
… 尚未检查
仍在维护
我们还没有从 GitHub 读取这个仓库
… 尚未检查
有许可证
我们还没有从 GitHub 读取这个仓库
– 不适用
端点有响应
它在你的电脑上运行，没有互联网端点
– 不适用
使用 OAuth 登录
在你的电脑上运行，改用本地设置
… 尚未检查
工具描述中没有隐藏指令
它在你的电脑上运行；我们只能读取互联网端点的工具列表

与“聊天与邮件”中的其他服务器比较i

星标数多于此分类中其他 1856 个服务器的 0%
发布到注册中心的时间比此分类中其他 1856 个服务器的 92% 更新
基础检查结果等于或优于此分类中其他 1856 个服务器的 100%

与注册中心里这个分类中所有活跃的服务器比较。只有当发布者拥有该仓库时，星标数才计入。

常见问题

Gmail Tidy MCP 安全吗？

它在 1 项适用的基础检查中通过了 1 项。我们没有阅读代码。在添加密钥或令牌之前，请先看看这个服务器要求哪些权限，并使用只具备所需权限的密钥。

它需要哪些密钥或代码？

注册中心没有列出必需的密钥，不过有些服务器会在首次使用时要求你登录。

它在我的电脑上运行还是在云端？

它在你的电脑上运行。你的 AI 应用会在需要时启动它，数据不会经过作者的服务器（除非它自己调用在线服务）。

它还在维护吗？

GitHub 仓库最后更新于–，最新版本（0.5.1）于前天进入注册中心。

哪些应用可以使用它？

支持 MCP 的应用，例如 Claude Desktop、Claude Code、Cursor 和 VS Code。你的电脑上还需要有 Node.js。

有什么可以替代它？

同一分类中有：Vexa, emailmd, MCP WhatsApp Cloud

替代选择

同一分类中其他作者的服务器，按星标数排序。

如何看卡片：↓ 每周下载量i★ GitHub 星标i三大支柱：评价 · 检查 · 使用情况i更新 = 最新版本发布到注册中心的时间i

Vexa

Meeting bot and transcripts for Google Meet, Teams and Zoom. Live or after, speakers labelled.

作者：Vexa-ai广泛使用★ 29492个月前更新

在云端运行✓ vexa.ai

安装

emailmd

Render markdown into email-safe HTML, lint drafts for deliverability problems, and preview emails.

作者：anypost正在增长↓ 5342/周★ 138533天前更新

电脑或云端✓ emailmd.dev

安装

MCP WhatsApp Cloud

MCP server for WhatsApp Cloud API (Meta) — messages, media, and templates via Graph API

作者：codespar起步阶段↓ 63/周★ 2775个月前更新

在你的电脑上运行

安装

作者的 README

打开 README

按原文从作者的仓库复制。PopNx MCP 没有审查或背书其内容。HTML、图片和脚本已被移除。链接会离开本站。

gmail-tidy-mcp

An MCP server that lets your AI assistant read and organize several Gmail accounts at once: search, read, label, archive, set up filters and write drafts.

It cannot send or delete email. Not "it asks first": there is no tool for it, and a test fails the build if a send or delete call ever shows up in the code.

Why

Most Gmail MCP servers hand the model full control of your mailbox, including sending, and keep OAuth tokens in plain text on disk. That is a lot of trust to give a model that also reads emails written by strangers.

This one is built around a smaller promise: the assistant can help you get your inbox in order, but it can't send anything or delete anything.

What it can do

Area	Tools
Accounts	`list_accounts`, `check_accounts`, `connect_account`, `finish_connect_account`
Reading	`search_emails` (Gmail search syntax), `search_all_accounts` (one search, every account), `get_email` (lists attachments), `get_thread` (a whole conversation, oldest first, quoted history trimmed), `get_attachment` (text, `.gz` and `.zip` are read inline, e.g. DMARC reports; anything else, like a PDF, is saved to `~/Downloads/gmail-tidy-mcp`), `sender_stats` (who writes most, by address and domain), `newsletters` (mailing lists by volume with the unsubscribe link each declares; it never unsubscribes for you)
Labels	`list_labels`, `create_label` (nest with `Parent/Child`), `update_label` (rename, recolor with the Gmail palette, show or hide in the sidebar)
Organizing	`organize_emails`: add or remove labels by ID or by search, up to 5,000 messages at a time. Archive = remove `INBOX`, mark as read = remove `UNREAD`
Filters	`list_filters`, `create_filter`, `delete_filter`. A filter that skips the inbox needs an explicit `skip_inbox: true`
Drafts	`create_draft`, optionally as a reply inside a thread and with local files attached; `list_drafts`; `update_draft` edits an existing draft (only the fields you pass change, the thread and current attachments stay). You send it yourself from Gmail
Settings	`set_signature`: changes only the signature, never how mail goes out
Audit	`recent_changes`: every change this server made, to review or undo a session

Each account gets a short label, so you can say things like "archive every newsletter older than a month in *work*".

What it will not do

Send, reply, forward or delete email, or move it to Trash or Spam.
Give the model a way to add those later: the tools are fixed in code and the model cannot call arbitrary Gmail endpoints.

Google has no scope that allows drafts but not sending, so the server asks for gmail.modify (which technically includes sending) plus gmail.settings.basic for filters. The guarantee comes from the code, and test/safety.test.js checks it on every run.

Security

Tokens are encrypted with AES-256-GCM in ~/.config/gmail-tidy-mcp/tokens.enc (mode 600). The key lives in the macOS Keychain, the Linux Secret Service (secret-tool), or a DPAPI-protected file on Windows. You can also provide it yourself with GMAIL_TIDY_KEY (64 hex characters).
Sign-in uses PKCE and a random `state`, with the redirect on 127.0.0.1 only.
The signed-in account is verified. After sign-in, the server asks Gmail which address it got. If it is not the one you asked for, or Google granted different scopes, the token is revoked and nothing is saved.
Your own OAuth client. No shared client and no third-party server. Your mail goes from Google to your machine and nowhere else.
Email content is fenced off as untrusted. Everything read from Gmail goes inside a block whose markers carry a random value per call, so an email can't close the block early. Control characters in headers are removed, and HTML is reduced to visible text (scripts, styles, and text hidden with display:none, visibility:hidden, font-size:0 or opacity:0 are dropped).
Invisible text is removed. Unicode tag characters (used to smuggle instructions that a model reads but you can't see), zero-width characters and text-direction controls are stripped from headers, bodies and attachments. Tag characters are reported, since they have no legitimate use in mail.
Security notes come from the server, not the sender. get_email and get_attachment add a short list of findings above the untrusted block: phrasing typical of prompt injection, failed SPF, DKIM or DMARC, a Reply-To that sends answers to a free webmail address when the sender didn't pass DMARC, a display name that pretends to be another address, and links that show one site but lead to another (Gmail and Outlook redirect wrappers are unwrapped first; tracking links in mailing lists are not flagged). They are tuned to stay quiet on normal mail, so a note means something.
Lookalike senders are flagged. A sender whose domain is one or two letters away from one of your connected accounts (or uses letters from other scripts that look Latin) gets a note; for Gmail and other webmail the mailbox name is compared instead. Mail between your own accounts is never flagged.
Drafts only attach files from your user folders. Attachments must live under Downloads, Desktop or Documents (or the folders in GMAIL_TIDY_ATTACH_DIRS), never in a hidden folder and never this server's own config. Links are resolved before the check, so a shortcut can't point at ~/.ssh. That way a model steered by a malicious email can't slip a private key or token into a draft for you to send.
Every change is logged locally. Labels, archiving, filters, drafts, signature changes and saved files are appended to ~/.config/gmail-tidy-mcp/audit.log (mode 600), without message bodies, draft text or the signature itself. recent_changes shows them, so if something odd happened in a session you can see exactly what and undo it.
Dangerous attachments are not saved. Executables and scripts, disguised names (factura.pdf.exe, right-to-left override tricks), files whose bytes don't match their extension, and archives that contain any of those are refused unless the call says allow_risky: true. Password-protected archives, macro-enabled Office files and PDFs with JavaScript or auto-run actions are flagged. Saved files never overwrite anything, can't be written outside the downloads folder, and on macOS get the quarantine flag so Gatekeeper checks them before they open.
Drafts can't smuggle headers. Line breaks in To, Cc, Subject or the reply headers are rejected, so nobody can sneak in a hidden Bcc.
Arguments are validated before anything reaches Gmail, and the tools that change things carry MCP annotations (destructiveHint) so clients can ask you before running them.
Big scans respect Gmail's quota. sender_stats, newsletters and searches fetch a few messages at a time and back off when Gmail asks, so a large mailbox slows the scan down instead of breaking it.
Two runtime dependencies (@modelcontextprotocol/sdk and googleapis), pinned to exact versions, none with install scripts.

What could still go wrong

No server can make prompt injection impossible, and the security notes are heuristics: they catch common tricks, not every one, and a clean result proves nothing. If a malicious email convinces the model, it could still:

relabel or archive mail (you can undo this),
create a filter that hides new mail from the inbox (only with skip_inbox: true, and your client can ask you first),
delete one of your filters (filters can't be recovered),
write a misleading draft. It is never sent unless you send it,
rename or recolor a label, change your signature, or rewrite one of your drafts (all reversible: the audit log keeps what changed),
save an attachment flagged as dangerous, if it also sets allow_risky: true; opening it is still up to you.

Two more things worth knowing:

The token itself can send mail. The "never send" guarantee is in this code, not in the token. If someone steals the token and the key, they get what gmail.modify allows. Keep your machine and keyring locked.
On macOS, the Keychain item trusts `/usr/bin/security`, which means any process running as you can read the key without a prompt. That still keeps the key off the disk, but it is not a barrier against malware running under your user.

Setup

Requires Node.js 22 or newer.

1. Create your Google OAuth client (once)

In Google Cloud Console, create a project and enable the Gmail API.
In Google Auth Platform, set up the app as External, add your email as the support and contact address, and publish it (Audience → Publish app). Unverified apps in production keep their refresh tokens. In testing mode they expire after 7 days.
Under Clients, create a client of type Desktop app and download the JSON.
Save it as ~/.config/gmail-tidy-mcp/oauth-client.json and make it private (chmod 600 on macOS and Linux).

When you connect an account, Google warns that the app is unverified. That is expected: the app is yours. Continue through Advanced.

2. Register it with your MCP client

Claude Code:

claude mcp add -s user gmail-tidy -- npx -y gmail-tidy-mcp

Any other MCP client: run npx -y gmail-tidy-mcp over stdio.

Prefer to run it from source? Clone the repo, run npm ci --ignore-scripts, and point your client at node /path/to/gmail-tidy-mcp/bin/gmail-tidy-mcp.js.

On Linux, install libsecret-tools first so the key can go into your keyring.

3. Connect accounts

Ask your assistant to connect an account. It opens Google's sign-in page in your browser. Or do it from the terminal:

npx gmail-tidy-mcp add you@gmail.com personal

npx gmail-tidy-mcp list npx gmail-tidy-mcp remove you@gmail.com

Removing an account deletes its token locally. To revoke access on Google's side too, go to myaccount.google.com/permissions.

Google Workspace accounts may need an admin to allow unverified apps.

Development

npm test

The tests cover the safety guarantee (no send or delete calls, no Trash or Spam, filter actions limited to labels), token encryption and key handling, the sign-in callback (state, errors, timeouts), the post-login checks, draft headers and body decoding. CI runs them on Linux, macOS and Windows, including the real DPAPI path on Windows.

Credits

This started from gx-55/multi-gmail-mcp (MIT) by Rogers Xie. Some of its building blocks remain: the label-or-address account lookup, the message search and header helpers, the reply threading and the token-error detection. The storage, sign-in flow, tool set and safety model were redesigned.

License

MIT. See LICENSE.