JMAP Email

io.github.miklukoPublished by GitHub account miklukov0.10.0Updated Oct 24, 2026

Email management via JMAP — mailboxes, messages, identities, and Sieve scripts

VerifiedSTDIODesktop onlyProductivity & WorkflowCommunication & Collaboration

Overview

AI-generated overview

A local MCP server that connects an assistant to a JMAP email account to browse mailboxes, search and read messages, and manage flags, moves and drafts.

What you can do
List, create, update and delete mailboxes, and list sender identities available for sending messages. Search emails with filters and retrieve full message content by ID. Create drafts, move messages between mailboxes, set or clear flags such as seen, flagged, answered and draft, and delete messages to Trash or permanently. Optionally submit drafts for delivery and manage Sieve filter scripts, including validating a script without saving it.
When to use it
Useful when an assistant should work with a JMAP-based mailbox, such as Fastmail, for triage, search, drafting replies or organizing folders. Sending and Sieve script tools are off by default and must be enabled deliberately.
Requirements
Runs as a local process (Go binary or container image) over stdio. Requires the JMAP session endpoint URL in JMAP_SESSION_URL and a bearer token in JMAP_AUTH_TOKEN. Network access to the JMAP server. Sending requires the -enable-send flag; Sieve tools require -enable-sieve and server support.
Before you install
The bearer token grants access to the mailbox; keep it out of logs and shared configs. Tools can create, move, flag and permanently delete messages, and mailbox tools can destroy mailboxes. Sending is disabled unless explicitly enabled. In HTTP mode, signed attachment links embed the JMAP token and work without further authentication for 30 seconds.

Installation

In SourceWeft

  1. Open JMAP Email in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

jmap-mcp

MCP server exposing JMAP email and Sieve script operations as tools.

Built with the Go MCP SDK (go-sdk) and go-jmap library.

Tools

Tools map closely to JMAP methods. Email mutation tools provide structured convenience wrappers over Email/set patches.

Mailbox (RFC 8621)

ToolJMAP MethodDescription
mailbox_getMailbox/getGet mailboxes by ID, or list all
mailbox_setMailbox/setCreate, update, or destroy mailboxes

Email (RFC 8621)

ToolJMAP MethodDescription
email_queryEmail/querySearch emails with filters, returns IDs and total count
email_getEmail/getGet full content of emails by ID
email_createEmail/setCreate a new email draft in the Drafts mailbox
email_moveEmail/setMove emails to a different mailbox
email_flagEmail/setSet or remove flags (seen, flagged, answered, draft)
email_deleteEmail/setDelete emails (move to Trash or permanently destroy)
email_attachment_urlBlob downloadSigned URL streaming an attachment, expires in 30 s (HTTP mode only)

Identity

ToolJMAP MethodDescription
identity_getIdentity/getList sender identities (email addresses)

Submission (feature-gated)

ToolJMAP MethodDescription
email_submission_setEmailSubmission/setSubmit a draft for delivery (requires -enable-send)

Sieve Scripts (RFC 9661, feature-gated)

ToolJMAP MethodDescription
sieve_getSieveScript/getList all scripts, or get one with full content (requires -enable-sieve)
sieve_setSieveScript/setCreate, update, or destroy Sieve scripts (requires -enable-sieve)
sieve_validateSieveScript/validateValidate a Sieve script without saving (requires -enable-sieve)

Configuration

Env varRequiredDescription
JMAP_SESSION_URLalwaysJMAP session endpoint (e.g. https://api.fastmail.com/jmap/session)
JMAP_AUTH_TOKENstdio modeBearer token for JMAP authentication
ATTACHMENT_URL_SECRETnoSecret sealing signed attachment URLs; set for multi-replica deployments (default: random per-process key)
FlagDefaultDescription
-modestdioServer mode: stdio or http
-listen:8080HTTP listen address (http mode only)
-enable-sendfalseEnable the email_submission_set tool (off by default)
-enable-sievefalseEnable Sieve script tools (off by default, requires JMAP server support)
-external-urlderivedExternal base URL for signed attachment links; default derives from the request (X-Forwarded-Proto/X-Forwarded-Host aware)

In HTTP mode, the token can be passed per-request via Authorization: Bearer <token> header or jmap_token query parameter (query parameter takes precedence).

In HTTP mode, email_attachment_url returns a link served from /attachments/ that expires 30 seconds after issuance. The link is an AES-GCM sealed capability: it embeds the JMAP token, account, and blob IDs, so the endpoint streams the attachment from the JMAP server without any additional authentication and stores nothing on disk.

Installation

Kubernetes (Helm)

bash
helm install jmap-mcp oci://ghcr.io/mikluko/helm-charts/jmap-mcp \  --version 0.1.0 \  --set jmap.sessionURL="https://api.fastmail.com/jmap/session"

In HTTP mode, JMAP auth tokens are passed per-request via Authorization: Bearer header or ?jmap_token= query parameter — no static tokens are stored in the cluster.

Binary

bash
go install github.com/mikluko/jmap-mcp@latest

From source

bash
git clone https://github.com/mikluko/jmap-mcp.gitcd jmap-mcpmake install

Usage

bash
# stdio mode (default)export JMAP_SESSION_URL=https://api.fastmail.com/jmap/sessionexport JMAP_AUTH_TOKEN=your-token./jmap-mcp
# HTTP mode./jmap-mcp -mode http -listen :8080

Build

bash
make build # Build and push container image + Helm chartmake image # Build and push container image with komake package # Package and push Helm chart to OCI registrymake test # Run testsmake install # Install binary locally

References

Source: README.md at commit c0bcbf9

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.10.0LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.