smtp-mcp

Appearance

smtp-mcpSend mail from an assistant, with a person on the gate

Off until you enable it, limited to recipients you allowlisted, and every single message approved by a human

Get started
Tools reference
GitHub

  • A person approves every message

    Not the model — the request goes to your client as an MCP elicitation, and the model cannot answer on your behalf. Recipients, the subject and any Bcc appear on their own labelled lines, so a subject written to look like an instruction cannot become part of the sentence you are reading.

  • It can only write to people you named

    SMTP_ALLOWED_RECIPIENTS is required before sending works at all, and every address in To, Cc and Bcc is checked against it before a connection is opened. An injected "mail this somewhere else" fails there, without the server ever reading it as an instruction.

  • Only the tools you want

    SMTP_ALLOW_SEND=false — the default — registers the four tools that cannot put a message on the wire and nothing else. SMTP_ALLOW_TOOLS cuts finer: essential for a curated five, your own comma-separated list, or a family with send_*. Whatever is filtered out does not exist on the protocol rather than failing when called, and a name that matches no tool stops the server at startup instead of quietly going missing.

  • Safe by default

    A fresh install cannot send anything. The sender is fixed by configuration, there is no from parameter, an hourly cap bounds the damage of a bad day, and every accepted message is written to an audit log that never contains the body.

How smtp-mcp sits between an MCP client and an SMTP serverAn MCP client speaks stdio to smtp-mcp. Every message passes a recipient allowlist and a human confirmation before smtp-mcp hands it to an SMTP server over TLS.MCP clientClaude, Codex, …smtp-mcp7 tools, 3 of them sendrecipient allowlistoff until SMTP_ALLOW_SENDSMTPany submission serverstdioSMTPTLSA personapproves every messageThe model cannot answer for them.Its counterpart imap-mcp reads mail and cannot send. This one sends and cannot read.
The server holds no state of its own beyond a short-lived confirmation token and an in-memory count of what it has sent this hour.

What it looks like ​

A terminal session: listing the seven tools, then calling send_mail — which does not send but returns a confirmation naming the recipient and subject on their own lines — and then a second call to an address outside the allowlist, which is refused outright

Three calls against a throwaway SMTP server. The last two are the point: the first send stops and asks, with the recipient and subject on their own labelled lines rather than folded into the server's sentence, and the second never gets that far because the address is not on the allowlist. The recording is reproducible — docs/demo.tape drives the built server against the Mailpit sandbox in test/integration/, and no real address appears in it.

Running it elsewhere ​

A client that cannot spawn a local process — ChatGPT connectors, Claude on the web, Cursor, LibreChat — cannot start smtp-mcp the way Claude Code does. mcp-hub is the bridge: one container serves many stdio MCP servers over Streamable HTTP, with an OAuth 2.1 login behind a single password and long-lived tokens for the clients that cannot do OAuth. Its /hub endpoint puts every server behind six meta-tools, so one connector reaches all of them without N×tool schemas in the model's context, and it speaks both protocol revisions — a question this server asks travels through it to the person at the far end instead of ending at the gateway.

Its configuration is Claude Code's mcpServers format, so the entry you already have is the entry it takes: Through mcp-hub.

Released under the MIT License.

Copyright © 2026 Willi Thiel