Skills/PyPI/mcp-email-server

mcp-email-server@1.14.0

VERIFIED· not started

Publisher claims: "Full-featured, multi-account MCP email server for Windows, macOS, and Linux—read, search, organize, and send email via IMAP and SMTP." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher wh1isper · publishing for 627 daysInstalls 14,158Last detonated 18 h ago
$claude mcp add mcp-email-server -- uvx mcp-email-server
WatchReport an issue

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
MCP_EMAIL_SERVER_CREDENTIAL_STORAGEMCP_EMAIL_SERVER_IMAP_PASSWORDMCP_EMAIL_SERVER_PASSWORDMCP_EMAIL_SERVER_SMTP_PASSWORDConfiguration, not credentials: LOGURU_LEVEL, MCP_ALLOWED_HOSTS, MCP_ALLOWED_ORIGINS, MCP_EMAIL_SERVER_ACCOUNT_ALLOWED_MUTATIONS, MCP_EMAIL_SERVER_ACCOUNT_NAME, MCP_EMAIL_SERVER_ALLOW_PROTOCOL_COMMANDS, MCP_EMAIL_SERVER_ALLOWED_MUTATIONS, MCP_EMAIL_SERVER_ALLOWED_RECIPIENTS, MCP_EMAIL_SERVER_ALLOWED_SENDERS, MCP_EMAIL_SERVER_CONFIG_PATH, MCP_EMAIL_SERVER_DRAFTS_MAILBOX, MCP_EMAIL_SERVER_EMAIL_ADDRESS, MCP_EMAIL_SERVER_ENABLE_ATTACHMENT_CONTENT, MCP_EMAIL_SERVER_ENABLE_ATTACHMENT_DOWNLOAD, MCP_EMAIL_SERVER_FULL_NAME, MCP_EMAIL_SERVER_IMAP_HOST, MCP_EMAIL_SERVER_IMAP_NON_ASCII_SEARCH, MCP_EMAIL_SERVER_IMAP_PORT, MCP_EMAIL_SERVER_IMAP_SEARCH_MODE, MCP_EMAIL_SERVER_IMAP_SSL, MCP_EMAIL_SERVER_IMAP_START_SSL, MCP_EMAIL_SERVER_IMAP_USER_NAME, MCP_EMAIL_SERVER_IMAP_VERIFY_SSL, MCP_EMAIL_SERVER_LOG_LEVEL, MCP_EMAIL_SERVER_REPORT_BLOCKED_MUTATIONS, MCP_EMAIL_SERVER_SAVE_TO_SENT, MCP_EMAIL_SERVER_SENT_FOLDER_NAME, MCP_EMAIL_SERVER_SMTP_HOST, MCP_EMAIL_SERVER_SMTP_PORT, MCP_EMAIL_SERVER_SMTP_SSL, MCP_EMAIL_SERVER_SMTP_START_SSL, MCP_EMAIL_SERVER_SMTP_USER_NAME, MCP_EMAIL_SERVER_SMTP_VERIFY_SSL, MCP_EMAIL_SERVER_USER_NAME, MCP_ENABLE_DNS_REBINDING_PROTECTION, MCP_HOST
Where it talks to
no vendor host named in the code
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard. It asks for MCP_EMAIL_SERVER_CREDENTIAL_STORAGE, MCP_EMAIL_SERVER_IMAP_PASSWORD, MCP_EMAIL_SERVER_PASSWORD, MCP_EMAIL_SERVER_SMTP_PASSWORD and talks to its vendor. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind. What the tools do with a real credential was not observed.

$vet-skills run --net declared -- uvx mcp-email-server

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-13 and scored it 84/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.2sprocessno install scripts to re-run

Static findings

MEDIUM
Python subprocess execution detecteddev/build_frontend.py:162 · Python subprocess execution detectedsubprocess.run([npm, "run", "build"], cwd=FRONTEND, check=True) # noqa: S603 - maintainer toolFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Destructive file system command detectedDockerfile:44 · Destructive file system command detected&& rm -rf /var/lib/apt/lists/*Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detecteddev/build_frontend.py:160 · Python subprocess execution detectedsubprocess.run([npm, "ci"], cwd=FRONTEND, check=True) # noqa: S603 - maintainer toolFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsdev/verify_container.py:13 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"/app/.env",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathsfrontend/src/api.test.ts:39 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesexpect(second?.[1]?.credentials).toBe('same-origin')Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detecteddev/build_frontend.py:161 · Python subprocess execution detectedsubprocess.run([npm, "run", "check"], cwd=FRONTEND, check=True) # noqa: S603 - maintainer toolFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known package.github/workflows/main.yml:128 · npx invocation of non-well-known package — may execute untrusted coderun: cd frontend && npx playwright install --with-deps chromiumFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detecteddev/verify_container.py:35 · Python subprocess execution detectedprocess = subprocess.run( # noqa: S603 - fixed Docker executable with maintainer-supplied image tagFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL with suspicious TLD.github/workflows/docs.yml:68 · URL with suspicious TLD — commonly used for phishing/malwareurl: https://mcp-email-server.wh1isper.topFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedtests/test_stdio_protocol.py:318 · Python subprocess execution detectedredirected = subprocess.run( # noqa: S603 - exact test-owned executable and argumentsFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_packaging.py:326 · Python subprocess execution detectedsubprocess.run( # noqa: S603 - controlled test commandFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_stdio_protocol.py:345 · Python subprocess execution detectedinitialized = subprocess.run( # noqa: S603 - exact test-owned executable and argumentsFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL with suspicious TLDmkdocs.yml:3 · URL with suspicious TLD — commonly used for phishing/malwaresite_url: https://mcp-email-server.wh1isper.topFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
File permission modification commandmcp_email_server/config.py:899 · File permission modification command — agent changes file ownership/permissions# chmod fails). Instead: write to a same-directory temp file that is 0600Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedtests/test_stdio_protocol.py:265 · Python subprocess execution detectedprocess = subprocess.Popen( # noqa: S603 - exact test-owned executable and argumentsFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Credential pass-through configurationspec/README.md:106 · Credential pass-through configuration — agent relays sensitive credentialsusers off to interactive CLI/UI and never collect or relay credentials.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
Python subprocess execution detectedtests/test_packaging.py:217 · Python subprocess execution detectedsubprocess.run( # noqa: S603 - controlled test commandFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL with suspicious TLDpyproject.toml:47 · URL with suspicious TLD — commonly used for phishing/malwareDocumentation = "https://mcp-email-server.wh1isper.top/"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedtests/test_packaging.py:46 · Python subprocess execution detectedprocess = subprocess.Popen( # noqa: S603 - exact test-owned executable and argumentsFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_stdio_protocol.py:301 · Python subprocess execution detecteddevnull = subprocess.run( # noqa: S603 - exact test-owned executable and argumentsFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_packaging.py:318 · Python subprocess execution detectedsubprocess.run( # noqa: S603 - fixed interpreter and repository scriptFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_stdio_protocol.py:356 · Python subprocess execution detectedcompleted = subprocess.run( # noqa: S603 - exact test-owned plugin executableFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL with suspicious TLDpyproject.toml:45 · URL with suspicious TLD — commonly used for phishing/malwareHomepage = "https://mcp-email-server.wh1isper.top/"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedtests/test_packaging.py:347 · Python subprocess execution detectedsubprocess.run( # noqa: S603 - controlled test commandFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈72 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for mcp-email-server@1.14.0 as of 7d ago. This is the package itself, not its dependencies.