Multi-account SMTP/IMAP MCP server for AI agents: per-mailbox read/send tools, a unified inbox/sent overview, and hardening against prompt injection and command injection
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"unr-mail-mcp","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# unr-mail-mcp: a multi-mailbox email MCP server for Obot You will end up with one Obot MCP server that gives an agent **a clear picture of all incoming and outgoing mail across your mailboxes** (`overview`), **two tools per mailbox** (`<address>_read`, `<address>_send`) and a few shared tools (`reply`, `mark`, `move`, …), usable from Obot chat, agents, and any MCP client. An agent that reads mail reads text written by strangers. This server is built for that: it validates everything an agent passes in, cleans everything that comes out of a mailbox, and puts hard limits on what can leave. Read [Security model](#step-6--security-model) before you give it to an agent. Time: ~15 minutes. Needs: Python 3.11+, [`uv`](https://docs.astral.sh/uv/), an Obot instance where you can add MCP servers (admin), and mailbox credentials. --- ## Step 0 — The tools you get | Tool | What it does | Needs approval? | |---|---|---| | `overview` | **Start here.** For every mailbox (or the ones you name): unread count, newest incoming mail (INBOX), newest outgoing mail (Sent), and the *conversations* linking them, each marked with who wrote last and whether it is still awaiting a reply | no (read-only) | | `<slug>_read` | List a folder (`unread_only`, `since`, `search` in text/from/to/subject) or open one message by `uid` | no (read-only) | | `list_accounts`, `list_folders` | Mailboxes with what an agent may do with each; folders with their role (inbox, sent, drafts, trash, …) | no (read-only) | | `reply` | Answers a message **by saving a draft** with correct threading; a person reviews and sends it | no | | `save_draft` | Saves a new message to Drafts | no | | `mark` | Read/unread, flagged/unflagged | optional | | `<slug>_send` | Sends mail **immediately and irreversibly** | **yes** | | `send_reply` | Sends a reply immediately; the first call only returns the recipients, a second call with `confirm_recipients` sends | **yes** | | `move` | Moves messages to another folder (archive, tr…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.