Anyone who wants to use AI in their company ends up at the email inbox sooner or later. A large part of day-to-day business lives there: offers, agreements, follow-up questions. An AI can sort through these messages, sum up a long thread in a few sentences and take into account what has already been agreed when drafting a reply.
To do that, it needs access to the emails. For Gmail and Outlook, ready-made integrations exist; ChatGPT, for example, ships plugins for both services. But many company mailboxes live elsewhere, with a different hosting provider or on a company's own mail server. For these, AI tools often offer no suitable connection.
That is why we at q23 built Mailbox MCP. The server connects AI agents directly to your existing IMAP mailbox. Nobody has to forward emails to Gmail or Outlook or move the mailbox there. We use Mailbox MCP in production ourselves and make it available free of charge as open source.
What the Agent Can Do With It
MCP (Model Context Protocol) is an open standard that lets AI programs use additional tools. It is supported by Claude Code and Codex, among others. Mailbox MCP is one such tool and gives the agent access to the mail server. With it, the agent can:
- show a mailbox's folders with their unread counts and list the latest emails,
- search emails by sender, recipient, subject, text or date range,
- retrieve individual messages in full,
- send and reply to emails, if SMTP access is set up on the server.
A typical case: before a client meeting, the agent pulls up all messages about an offer and summarizes where things stand. Based on that, it can draft the next reply right away.
The roles are clearly divided. Mailbox MCP fetches the messages from the mailbox; the summary and the draft are written by the connected AI system. Whether the agent may send emails itself, and when it needs your approval to do so, is set in the AI system and the respective workflow. If you want to rule out sending altogether, simply don't set up SMTP access on the server. The sending functions then don't exist at all. An overview of all functions is available in the documentation on GitHub.
Where the Emails Are Processed
Mailbox MCP only establishes the connection to the mailbox and does not store any emails itself. What happens to the retrieved content afterwards is determined by the connected AI system. Even if the server runs in Germany or in your own data center, an external AI service may process the emails somewhere else. That depends on the provider and on how you have configured it.
Which AI system you use and which email content you are allowed to process with it is something you need to check yourself. This applies to cloud services just as much as to a self-hosted AI. Mailbox MCP alone does not make the workflow GDPR-compliant. A good starting point is the guidance on artificial intelligence and data protection published by the German Data Protection Conference (DSK) on May 6, 2024 (in German). Among other things, it advises checking whether a provider uses inputs to train its models and whether that can be switched off.
Where the Credentials Are Stored
You enter your mailbox credentials in the MCP settings of your AI program on your own computer. There is no password storage on the MCP server; it does not write credentials to disk.
Still, the credentials don't stay on your computer alone. With every request, they are sent to the server, which uses them in memory to log in to the mail server. It keeps the connection open for further requests and closes it once it has been idle for a while. This means:
- If the server does not run locally on your own computer, the connection to it must use HTTPS.
- The local configuration contains access to your mailbox and must be protected accordingly.
- Where your mail provider offers app passwords, use them instead of the mailbox's main password.
Instead of a username and password, Mailbox MCP can also work with an encrypted access token. The password then doesn't have to be kept in the configuration permanently. The token is tied to the server's key, and if that key is replaced, all tokens become invalid immediately. You still need to keep the token confidential, because anyone who has it can reach the mailbox through the server. The details are described in the Mailbox MCP security model.
From Our Own Operations
Mailbox MCP is part of our daily work. We bring that experience with us when we set up the connection for other companies.
Every mail environment is a little different. Each server instance is set up for one mail server; address, port and encryption can be configured freely for IMAP and SMTP. An additional hosting provider, an extra domain or special sign-in requirements may still call for adjustments. For anything beyond configuration, the source code is open.
Before we set anything up, we therefore check whether your provider and its sign-in method are supported, and we tailor the connection to the mail server you actually use.
Open Source Under the MIT License
Mailbox MCP is released under the MIT License. You may use the software free of charge, including in your company, and adapt it to your own requirements. The main condition is that the license notice is retained. The source code and setup guide are publicly available on GitHub. If you want to set up and run the server yourself, you can do so without us.
Help With the Setup
Would you like to use Mailbox MCP but not handle the setup yourself? Get in touch. We host the server with us in Germany or install it on your own servers. We coordinate the connection to your mail environment and to the intended AI agent with you or your IT team.
If we host the server, email content and credentials pass through our infrastructure. Under data protection law, this is processing on your behalf under Art. 28 GDPR. We cover it with a data processing agreement (DPA) that we conclude with you.
The software remains free of charge. Setup, hosting, support and custom adaptations are separate services.