Apple Mail MCP Server

Star History

An MCP server that gives AI assistants full access to Apple Mail -- read, search, compose, organize, and analyze emails via natural language. Built with FastMCP.

Quick Install

Prerequisites: macOS with Apple Mail configured, Python 3.10+

Claude Code Plugin (Recommended)

Two commands — gets you the MCP server, /email-management slash command, and the Email Management Expert skill:

claude plugin marketplace add patrickfreyer/apple-mail-mcp
claude plugin install apple-mail@apple-mail-mcp

Then restart Claude Code.

Other Install Methods

claude mcp add apple-mail -- uvx mcp-apple-mail

Or for Claude Desktop (~/Library/Application Support/Claude/claude_desktop_config.json):

{
  "mcpServers": {
    "apple-mail": {
      "command": "uvx",
      "args": ["mcp-apple-mail"]
    }
  }
}

pip install mcp-apple-mail
claude mcp add apple-mail -- mcp-apple-mail

Installs the Email Management Expert skill via the open skills CLI. The skill does not include the MCP server, so install that too (e.g. with uvx above):

npx skills add patrickfreyer/apple-mail-mcp
claude mcp add apple-mail -- uvx mcp-apple-mail

Add -g to install the skill globally, or -a <agent> to target a specific agent.

1. Download the latest apple-mail-mcp-vX.Y.Z.mcpb from Releases
2. Open Claude Desktop → Settings → Developer → MCP Servers → Install from file
3. Select the .mcpb file and grant Mail.app permissions

git clone https://github.com/patrickfreyer/apple-mail-mcp.git
cd apple-mail-mcp/plugin
python3 -m venv venv
venv/bin/pip install -r requirements.txt

claude mcp add apple-mail -- /bin/bash $(pwd)/start_mcp.sh

Tools (22)

Reading & Search

Organization

Composition

Attachments

Smart Inbox

Analytics & Export

Configuration

Read-Only Mode

Pass --read-only to block delivery. Nothing leaves the machine: compose_email and reply_to_email refuse mode="send", manage_drafts refuses action="send", and forward_email is removed entirely because it has no non-sending mode.

The composing tools stay registered so that mode="draft" and mode="open" keep working. Those never deliver anything, and they are the only place in the compose surface that supports attachments — manage_drafts and create_rich_email_draft cannot attach files.

{
  "mcpServers": {
    "apple-mail": {
      "command": "/path/to/venv/bin/python3",
      "args": ["/path/to/apple_mail_mcp.py", "--read-only"]
    }
  }
}

User Preferences (Optional)

Set the USER_EMAIL_PREFERENCES environment variable to give the assistant context about your workflow:

{
  "mcpServers": {
    "apple-mail": {
      "command": "/path/to/venv/bin/python3",
      "args": ["/path/to/apple_mail_mcp.py"],
      "env": {
        "USER_EMAIL_PREFERENCES": "Default to BCG account, show max 50 emails, prefer Archive and Projects folders"
      }
    }
  }
}

For .mcpb installs, configure this in Claude Desktop under Developer > MCP Servers > Apple Mail MCP.

Safety Limits

Batch operations have conservative defaults to prevent accidental bulk actions:

Override via function parameters when needed.

File Access

By default the server can write and attach files anywhere your user account can, except a hardened denylist of locations an attacker could use for code execution or credential theft. (Attachment bytes come from whoever emailed you, and a prompt-injected email can steer tool arguments.)

Writes (save_email_attachment, export_emails, create_rich_email_draft's output_path) are refused for:

• any dotfile or dot-folder directly in your home folder: shell startup files (~/.zshrc, ~/.zshenv, ~/.zprofile, ~/.zlogin, ~/.bashrc, ~/.bash_profile, ~/.profile), ~/.ssh, ~/.gnupg, ~/.aws, ~/.config (incl. ~/.config/git), ~/.gitconfig, ~/.netrc, ~/.envrc, ~/.local/bin, ...
• .git/hooks, .git/config and .envrc in any folder
• autostart, persistence and app-config folders: ~/Library/LaunchAgents, ~/Library/LaunchDaemons, /Library/LaunchAgents, /Library/LaunchDaemons, ~/Library/Application Support (incl. com.apple.backgroundtaskmanagementagent), ~/Library/Application Scripts, ~/Library/Preferences, ~/Library/Keychains, ~/Library/Mail, ~/Library/Containers, ...
• folders on PATH: ~/bin, /usr/local/bin, /opt/homebrew/bin, and /etc

Attachments (compose_email, reply_to_email, ...) may be any readable file except secrets: ~/.ssh, ~/.gnupg, ~/.aws, ~/.netrc, ~/.git-credentials, ~/.config/gh, .env files, ~/Library/Keychains, and browser profiles and cookie stores (Safari, Chrome, Firefox, Edge, Brave, Arc, ...).

Paths are resolved (~, .., symlinks) before checking, and matching is case-insensitive like APFS.

Restricting further (opt-in). To confine writes or attachments to specific folders, list them (colon-separated) in the server's env, or pass --write-dir / --attach-dir (repeatable) as arguments. Once set, only those folders are allowed for that side, and the denylist still applies inside them. The tool's own cache (~/Library/Caches/apple-mail-mcp, the default rich-draft location) stays writable.

"env": {
  "APPLE_MAIL_MCP_WRITE_DIRS": "~/Downloads:~/Documents/mail-exports",
  "APPLE_MAIL_MCP_ATTACH_DIRS": "~/Documents:~/Desktop"
}

Usage Examples

Show me an overview of my inbox
Search for emails about "project update" in my Gmail
Reply to the email about "Domain name" with "Thanks for the update!"
Move emails with "invoice" in the subject to my Archive folder
Show me email statistics for the last 30 days
Create a rich HTML draft for a weekly update and open it in Mail

Rich HTML Drafts

Use create_rich_email_draft when you need a visually formatted email, newsletter, or leadership update.

• It generates an unsent .eml file with mu