The full upstream README, mirrored here for reference. Install config, tool schemas, adoption signals, and an original overview live on the JMAP Email listing page.
MCP server exposing JMAP email and Sieve script operations as tools.
Built with the Go MCP SDK (go-sdk) and go-jmap library.
Tools map closely to JMAP methods. Email mutation tools provide structured convenience wrappers over Email/set patches.
| Tool | JMAP Method | Description |
|---|---|---|
mailbox_get | Mailbox/get | Get mailboxes by ID, or list all |
mailbox_set | Mailbox/set | Create, update, or destroy mailboxes |
| Tool | JMAP Method | Description |
|---|---|---|
email_query | Email/query | Search emails with filters, returns IDs and total count |
email_get | Email/get | Get full content of emails by ID |
email_create | Email/set | Create a new email draft in the Drafts mailbox |
email_move | Email/set | Move emails to a different mailbox |
email_flag | Email/set | Set or remove flags (seen, flagged, answered, draft) |
email_delete | Email/set | Delete emails (move to Trash or permanently destroy) |
email_attachment_url | Blob download | Signed URL streaming an attachment, expires in 30 s (HTTP mode only) |
| Tool | JMAP Method | Description |
|---|---|---|
identity_get | Identity/get | List sender identities (email addresses) |
| Tool | JMAP Method | Description |
|---|---|---|
email_submission_set | EmailSubmission/set | Submit a draft for delivery (requires -enable-send) |
| Tool | JMAP Method | Description |
|---|---|---|
sieve_get | SieveScript/get | List all scripts, or get one with full content (requires -enable-sieve) |
sieve_set | SieveScript/set | Create, update, or destroy Sieve scripts (requires -enable-sieve) |
sieve_validate | SieveScript/validate | Validate a Sieve script without saving (requires -enable-sieve) |
| Env var | Required | Description |
|---|---|---|
JMAP_SESSION_URL | always | JMAP session endpoint (e.g. https://api.fastmail.com/jmap/session) |
JMAP_AUTH_TOKEN | stdio mode | Bearer token for JMAP authentication |
ATTACHMENT_URL_SECRET | no | Secret sealing signed attachment URLs; set for multi-replica deployments (default: random per-process key) |
| Flag | Default | Description |
|---|---|---|
-mode | stdio | Server mode: stdio or http |
-listen | :8080 | HTTP listen address (http mode only) |
-enable-send | false | Enable the email_submission_set tool (off by default) |
-enable-sieve | false | Enable Sieve script tools (off by default, requires JMAP server support) |
-external-url | derived | External base URL for signed attachment links; default derives from the request (X-Forwarded-Proto/X-Forwarded-Host aware) |
In HTTP mode, the token can be passed per-request via Authorization: Bearer <token> header or jmap_token query parameter (query parameter takes precedence).
In HTTP mode, email_attachment_url returns a link served from /attachments/ that expires 30 seconds after issuance. The link is an AES-GCM sealed capability: it embeds the JMAP token, account, and blob IDs, so the endpoint streams the attachment from the JMAP server without any additional authentication and stores nothing on disk.
In HTTP mode, JMAP auth tokens are passed per-request via Authorization: Bearer header or ?jmap_token= query parameter — no static tokens are stored in the cluster.