Skills/Glama/mcp-server-imap-smtp

mcp-server-imap-smtp@0.1.0

VERIFIED· not started

Publisher claims: "Enables AI apps to search, read, summarise, thread, flag, file, draft, send and open attachments in IMAP and SMTP mailboxes, with each user signing in to their own mailbox. Self-hosted and bound to operator-configured mail servers, it keeps passwords sealed inside per-connection tokens so every tool call acts only as the mailbox owner." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher wadejbeckett · publishing for 5 daysInstalls 0Last detonated 5d ago
$npx skills add mcp-server-imap-smtp
WatchReport an issue

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
SEALING_SECRETConfiguration, not credentials: CAKEY, DB_PATH, MAIL_PATH, MCP_SERVER_IMAP_SMTP_CONFIG, TLS_KEY
Where it talks to
no vendor host named in the codeAlso cross-site.example, example.org, letsencrypt.org, debian.org, example.test, claude.ai, chatgpt.com, grok.com, cursor.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names cross-site.example, example.org, letsencrypt.org, debian.org, example.test, claude.ai, chatgpt.com, grok.com, cursor.com as well as its own vendor. The guard injects SEALING_SECRET only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-09 and scored it 85/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.2sprocessscript backend runs setup only
0.2sprocessno install scripts to re-run

Static findings

MEDIUM
MCP server using network transport (SSE/HTTP)SKILL.md:5 · MCP server using network transport (SSE/HTTP) — data sent over networkMCP server wadejbeckett/mcp-server-imap-smtp on Glama, built from https://github.com/wadejbeckett/mcp-server-imap-smtp.Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Destructive file system command detectedlab/Dockerfile:9 · Destructive file system command detected&& rm -rf /var/lib/apt/lists/* \Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commanddeploy/e2e.py:97 · File permission modification command — agent changes file ownership/permissionsf"run: chmod 600 {path}")Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commanddeploy/install.sh:70 · File permission modification command — agent changes file ownership/permissions(( (8#$mode & 8#027) == 0 )) || { echo "TLS_KEY $key has mode $mode: it must not be readable by others or writable by its group (chmod 600)"; return 1; }Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commanddeploy/install.sh:46 · Process kill command — agent can terminate processes# cannot kill it half-way.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commanddeploy/install.sh:227 · File permission modification command — agent changes file ownership/permissionschmod 0640 "$CONFIG"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commanddeploy/install.sh:216 · File permission modification command — agent changes file ownership/permissionschmod -R go-w "$REL"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commanddeploy/install.sh:215 · File permission modification command — agent changes file ownership/permissionschown -R root:root "$REL"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commanddeploy/backup.sh:49 · File permission modification command — agent changes file ownership/permissionschmod 0600 "$final"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commanddeploy/backup.sh:48 · File permission modification command — agent changes file ownership/permissionschown root:root "$final"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commanddeploy/build.sh:107 · Process kill command — agent can terminate processesunit, so a dropped SSH connection cannot kill it half-way; its output is in /root/mcp-server-imap-smtp-install.log.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commanddeploy/install.sh:226 · File permission modification command — agent changes file ownership/permissionschown root:"$SERVICE_USER" "$CONFIG"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
LOW
Context shift attemptdocs/RUNNING.md:275 · Context shift attempt — trying to change operational mode · informational: not an instruction file- ChatGPT: enable developer mode, then create a custom MCP connector and paste the URL. Which ChatGPT plans allow write tools changes over time; check OpenAI's current documentation.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
URL to the cloud instance metadata addresstests/test_e2e.py:335 · URL to the cloud instance metadata address — reads the VM's credentialsr = cimd_client.get("/authorize", params={"response_type": "code", "client_id": "http://169.254.169.254/x",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Python subprocess execution detectedtests/_lab.py:179 · Python subprocess execution detectedproc = subprocess.Popen([sys.executable, "-c", "from mcp_server_imap_smtp.app import main; main()",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandscripts/install-test.sh:69 · Process kill command — agent can terminate processeskill "$pid" 2>/dev/null || trueFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandscripts/install-test.sh:241 · File permission modification command — agent changes file ownership/permissionsvm chmod 0600 "/etc/letsencrypt/live/$GATEWAY/privkey.pem"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandscripts/install-test.sh:123 · File permission modification command — agent changes file ownership/permissionsmkdir -p "$d"; chmod 700 "$d"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandscripts/install-test.sh:233 · File permission modification command — agent changes file ownership/permissionsvm chmod 0600 /etc/ssl/install-test/privkey.pemFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
LOW
Refusal suppressiondocs/RUNNING.md:38 · Refusal suppression — attempting to prevent safety responses · informational: not an instruction file…for, so clients that send no scope also still work. Unknown scopes are ignored, never refused (RFC 6749 section 3.3 lets the server grant less than asked): a registration n…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File permission modification commandscripts/install-test.sh:138 · File permission modification command — agent changes file ownership/permissionscp "$d/$MAIL_HOST.key" "$W/mail-tls/server.key"; chmod 600 "$W/mail-tls/server.key"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
URL with embedded credentialstests/test_cimd.py:67 · URL with embedded credentials — may be phishing or credential leaking"https://user:[email protected]/client.json", # userinfoFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
LOW
Prompt injectiondocs/RUNNING.md:275 · Prompt injection — known jailbreak technique reference · informational: not an instruction file- ChatGPT: enable developer mode, then create a custom MCP connector and paste the URL. Which ChatGPT plans allow write tools changes over time; check OpenAI's current documentation.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Process kill commandscripts/install-test.sh:70 · Process kill command — agent can terminate processesfor _ in $(seq 1 20); do kill -0 "$pid" 2>/dev/null || break; sleep 0.5; doneFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Authorization escalation languageSECURITY.md:13 · Authorization escalation language · informational: not an instruction file- **No admin access to mail.** The connector never shows a password back. The admin CLI cannot unseal anything; it can list, revoke and add, never read.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Authorization escalation languagedocs/RUNNING.md:275 · Authorization escalation language · informational: not an instruction file- ChatGPT: enable developer mode, then create a custom MCP connector and paste the URL. Which ChatGPT plans allow write tools changes over time; check OpenAI's current documentation.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File permission modification commandsrc/mcp_server_imap_smtp/store.py:162 · File permission modification command — agent changes file ownership/permissions# chmod main file and any WAL/SHM siblings that existFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandscripts/lab.sh:40 · File permission modification command — agent changes file ownership/permissionschmod 600 "$TLS/server.key" "$CAKEY/ca.key"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandlab/Dockerfile:16 · File permission modification command — agent changes file ownership/permissionsRUN chmod -R go-w /etc/dovecot/lab /etc/postfix/lab && /usr/local/sbin/lab-entrypoint configureFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandscripts/install-test.sh:297 · File permission modification command — agent changes file ownership/permissionschmod 0755 "$W/bin/curl" "$W/bin/openssl"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandscripts/lab.sh:26 · File permission modification command — agent changes file ownership/permissionsmkdir -p "$TLS" "$CAKEY"; chmod 700 "$STATE" "$TLS" "$CAKEY"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcp_server_imap_smtp/mail/tools.py:865 · Python subprocess execution detectedout = subprocess.run(["pdftotext", "-layout", "-", "-"], input=data, capture_output=True, timeout=30)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈44 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.