# @mgcrea/mcp-apple-mail

Search, read and act on Apple Mail — threads, attachments, body search, writes off by default

- **Type:** MCP server
- **Trust:** 85/100 (A), scored on the package rubric
- **Verification:** verified (build provenance)
- **Version:** 1.9.0
- **Author:** io.github.mgcrea
- **License:** MIT
- **npm:** @mgcrea/mcp-apple-mail
- **Source:** https://github.com/mgcrea/cupertino
- **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport)

## Trust

85/100 (A), scored on the package rubric
- Publisher verified: no
- Build provenance: verified attestation
- npm trusted publishing (OIDC): yes
- Install scripts: nothing suspicious found
- Prompt-injection scan: not run
- Obfuscation scan: not run
- Evidence age: 0 days

## Security scan

- **Status:** clean
- **Scanned:** 2026-09-02T04:26:40.730Z
- **Version scanned:** 1.9.0
- **CVEs:** none found by OSV at scan time

## Tools

23 declared. Statically extracted from the shipped source — a floor on the surface, not a census.
- `apple_mail_triage` — Work through what arrived and report what needs a human: who is waiting, what is committed to, what can be ignored. Read-only — it proposes, it does not file or
- `apple_mail_find_thread` — Track down a conversation from a vague description — a project name, a person, something half-remembered — spending the cheap search lanes before the expensive 
- `apple_mail_draft_reply` — Read a thread properly, then leave a written draft in Mail for review. Never sends: the draft waits for a human. Requires writes to be enabled.
- `apple_mail_diagnostics` — Report what this server can currently do and why. Shows whether Mail is running, whether Automation and Full Disk Access are granted, where Mail's data lives, w
- `apple_mail_list_accounts` — List the mail accounts configured in Apple Mail: display name, UUID, type, addresses and mailbox names. Start here — the account name or UUID is what every othe
- `apple_mail_list_mailboxes` — List mailboxes, optionally with message counts. Counts cost one round-trip per mailbox (~0.3s each), so `withCounts` is off by default — turn it on for one acco
- `apple_mail_set_message_flags` — Set read / flagged / junk state on one or more messages. Pass only the fields you want to change; the rest are left alone. This is one tool rather than four bec
- `apple_mail_create_mailbox`
- `apple_mail_move_messages` — Move messages to another mailbox, optionally in another account. The refs you passed in are DEAD afterwards: a moved message gets a new row id, so the response 
- `apple_mail_delete_messages` — Delete messages. This follows the account's own 'move deleted messages to Trash' setting, which this server does not control — for an account with that setting 
- `apple_mail_check_for_new_mail` — Ask Mail to sync now, for one account or all of them. Unlike the read tools this will launch Mail if it is not running, and it causes real network activity agai
- `apple_mail_send_message` — Compose a new message. By DEFAULT this does not send: it opens a draft in Mail for the user to review, which is almost always what you want. Only pass sendNow: 
- `apple_mail_reply_to_message` — Reply to a message. By default it opens a draft in Mail with the original quoted beneath your text, for the user to review. Pass replyToAll to include every ori
- `apple_mail_forward_message` — Forward a message to new recipients. By default it opens a draft in Mail for review. Only pass sendNow: true (with confirm: true) when explicitly asked to send 
- `apple_mail_update_draft`
- `apple_mail_get_message` — Read one message: decoded headers, the plain-text body, and a list of its attachments. HTML-only mail is converted to text. Long bodies are truncated with an ex
- `apple_mail_get_message_source` — Get the raw RFC 5322 source of a message — every header and the undecoded body. Use this for header forensics (Received chains, SPF/DKIM/DMARC results, List-Uns
- `apple_mail_list_attachments` — List a message's attachments: filename, MIME type, size and whether the bytes are present locally. Metadata only — it never returns file contents. A size of 0 w
- `apple_mail_save_attachment` — Save one attachment to disk. It can only write into APPLE_MAIL_ATTACHMENT_DIR (default ~/Downloads) and will not overwrite an existing file unless you ask it to
- `apple_mail_search_messages` — Search mail by any combination of text, body text, sender, recipient, subject, mailbox, account, read/flagged state, attachments and date range. This is the too
- `apple_mail_get_thread` — Get every message in the conversation containing a given message, oldest first, across mailboxes and accounts. Metadata only — use apple_mail_get_message for bo
- `apple_mail_list_messages` — List the newest messages in one mailbox, most recent first. Returns a `ref` per message that the read and action tools take. Without the search index this runs 
- `apple_mail_count_messages` — Count messages in a mailbox. Cheap in both lanes, so this works with no extra permissions. The `unread` figure is reported per source: Mail's own cached count i

## Install

**Verdict: install** — No blocking findings and no open coverage gaps — safe to install as configured.
**Config** (claude-code):
```json
"{\n  \"mcpServers\": {\n    \"mcp-apple-mail\": {\n      \"command\": \"npx\",\n      \"args\": [\n        \"-y\",\n        \"@mgcrea/mcp-apple-mail\"\n      ]\n    }\n  }\n}"
```

## Blast radius

Extensive to critical — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: deletes data; runs on your machine.
- Floor 37, ceiling 61 (tier: unknown)
- `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low.
- This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score.

## Machine-readable views of this entry

- Signed JSON: https://forgeregistry.com/api/v1/packages/%40mgcrea%2Fmcp-apple-mail
- Install plan: https://forgeregistry.com/api/v1/packages/%40mgcrea%2Fmcp-apple-mail/install-plan
- Alternatives: https://forgeregistry.com/api/v1/alternatives/%40mgcrea%2Fmcp-apple-mail
- HTML page: https://forgeregistry.com/registry/%40mgcrea%2Fmcp-apple-mail
- MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan`

## About this document

Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.