mailoo

io.github.Bitfloo/mailoo

6/8 checks passed
Runs locally
5 secrets
★ 0 GitHub stars
Updated 2026-10-26
Health score 56

About mailoo

mailoo is an MCP server published by the GitHub account Bitfloo. Email, calendar, reminders & ManageSieve MCP server (IMAP/SMTP, AI triage, scheduling, OAuth2).

It runs on your own machine: your AI client starts it from the npm package @bitfloo/mailoo at version 0.3.0.

It asks for 5 secrets: MCP_EMAIL_PASSWORD, MCP_EMAIL_OAUTH2_CLIENT_SECRET, MCP_EMAIL_OAUTH2_REFRESH_TOKEN, MCP_EMAIL_ALERT_WEBHOOK_URL and MCP_EMAIL_HTTP_TOKEN. Give it a key with the least access that still works.

It also needs MCP_EMAIL_ADDRESS, MCP_EMAIL_IMAP_HOST and MCP_EMAIL_SMTP_HOST set before it starts.

Version 0.3.0 was published on 26 October 2026, and the source code is public, so you can read it before installing.

Written from the registry entry. 9 automated checks on the registry entry and the package code: 6 pass, 2 warn, 0 fail, 1 info. How we check.

What it asks for

Variable	Required	Secret	Description
`MCP_EMAIL_ADDRESS`	Yes	No	Email address. Required for the environment-variable account.
`MCP_EMAIL_PASSWORD`	No	Yes	Password or app password. Required unless MCP_EMAIL_OAUTH2_PROVIDER is set.
`MCP_EMAIL_IMAP_HOST`	Yes	No	IMAP server hostname.
`MCP_EMAIL_SMTP_HOST`	Yes	No	SMTP server hostname.
`MCP_EMAIL_ACCOUNT_NAME`	No	No	Account name. Defaults to default.
`MCP_EMAIL_FULL_NAME`	No	No	Display name on sent mail.
`MCP_EMAIL_USERNAME`	No	No	Login username. Defaults to the email address.
`MCP_EMAIL_IMAP_PORT`	No	No	IMAP port. Defaults to 993.
`MCP_EMAIL_IMAP_TLS`	No	No	Set to false to turn off implicit IMAP TLS. Defaults to true.
`MCP_EMAIL_IMAP_STARTTLS`	No	No	Set to true to upgrade IMAP with STARTTLS. Defaults to false.
`MCP_EMAIL_IMAP_VERIFY_SSL`	No	No	Set to false to skip IMAP certificate verification. Defaults to true.
`MCP_EMAIL_IMAP_DISABLE_IMAP4REV2`	No	No	Set to true to force IMAP4rev1 SEARCH.
`MCP_EMAIL_SIEVE_HOST`	No	No	ManageSieve hostname. Defaults to the IMAP host.
`MCP_EMAIL_SIEVE_PORT`	No	No	ManageSieve port. Defaults to 4190.
`MCP_EMAIL_SMTP_PORT`	No	No	SMTP port. Defaults to 465.
`MCP_EMAIL_SMTP_TLS`	No	No	Set to false to turn off implicit SMTP TLS. Defaults to true.
`MCP_EMAIL_SMTP_STARTTLS`	No	No	Set to true to upgrade SMTP with STARTTLS. Defaults to false.
`MCP_EMAIL_SMTP_VERIFY_SSL`	No	No	Set to false to skip SMTP certificate verification. Defaults to true.
`MCP_EMAIL_SMTP_POOL_ENABLED`	No	No	Set to false to disable SMTP connection pooling. Defaults to true.
`MCP_EMAIL_SMTP_POOL_MAX_CONNECTIONS`	No	No	Maximum pooled SMTP connections. Defaults to 1.
`MCP_EMAIL_SMTP_POOL_MAX_MESSAGES`	No	No	Maximum messages per pooled SMTP connection. Defaults to 100.
`MCP_EMAIL_OAUTH2_PROVIDER`	No	No	OAuth2 provider: google, microsoft, or custom. Configure custom in the config file: an account in the environment replaces the config file, so custom set here has no token_url or auth_url.
`MCP_EMAIL_OAUTH2_CLIENT_ID`	No	No	OAuth2 client id.
`MCP_EMAIL_OAUTH2_CLIENT_SECRET`	No	Yes	OAuth2 client secret.
`MCP_EMAIL_OAUTH2_REFRESH_TOKEN`	No	Yes	OAuth2 refresh token.
`MCP_EMAIL_RATE_LIMIT`	No	No	Maximum sends per minute. Defaults to 10.
`MCP_EMAIL_READ_ONLY`	No	No	Set to true to omit write tools and mailbox writers.
`MCP_EMAIL_SAVE_TO_SENT`	No	No	Set to false to skip the IMAP Sent copy after SMTP. Defaults to true.
`MCP_EMAIL_WATCHER_ENABLED`	No	No	Set to true to start the IMAP IDLE watcher.
`MCP_EMAIL_WATCHER_FOLDERS`	No	No	Comma-separated folders to watch. Defaults to INBOX.
`MCP_EMAIL_WATCHER_IDLE_TIMEOUT`	No	No	IMAP IDLE timeout in seconds. Defaults to 1740.
`MCP_EMAIL_HOOK_ON_NEW_EMAIL`	No	No	What to do on arrival: triage, notify, or none.
`MCP_EMAIL_HOOK_PRESET`	No	No	Hook preset: inbox-zero, gtd, priority-focus, notification-only, or custom.
`MCP_EMAIL_HOOK_AUTO_LABEL`	No	No	Set to true to apply labels from hook triage.
`MCP_EMAIL_HOOK_AUTO_FLAG`	No	No	Set to true to flag mail from hook triage.
`MCP_EMAIL_HOOK_BATCH_DELAY`	No	No	Seconds to batch arrivals before hooks run. Defaults to 5.
`MCP_EMAIL_HOOK_CUSTOM_INSTRUCTIONS`	No	No	Extra instructions appended to the hook preset.
`MCP_EMAIL_ALERT_DESKTOP`	No	No	Set to true for desktop notifications.
`MCP_EMAIL_ALERT_SOUND`	No	No	Set to true to play a sound with desktop notifications.
`MCP_EMAIL_ALERT_URGENCY_THRESHOLD`	No	No	Minimum urgency for an alert: urgent, high, normal, or low.
`MCP_EMAIL_ALERT_WEBHOOK_URL`	No	Yes	HTTP or HTTPS URL that receives alert POSTs.
`MCP_EMAIL_ALERT_WEBHOOK_ALLOW_PRIVATE`	No	No	Set to true to allow webhook targets on a LAN, VPN, or tailnet.
`MCP_EMAIL_HOOK_AUTO_CALENDAR`	No	No	Set to true to create calendar events from hook triage.
`MCP_EMAIL_HOOK_CALENDAR_NAME`	No	No	Calendar name for automatic events.
`MCP_EMAIL_HOOK_CALENDAR_ALARM_MINUTES`	No	No	Minutes before an automatic event to alarm. Defaults to 15.
`MCP_EMAIL_HOOK_CALENDAR_CONFIRM`	No	No	Set to false to skip confirming automatic calendar events. Defaults to true.
`MCP_EMAIL_SYSTEM_ONE_ENABLED`	No	No	Set to true to classify residue mail with System One. Off by default.
`MCP_EMAIL_HTTP_HOST`	No	No	HTTP listen address. Defaults to loopback. The host argument wins.
`MCP_EMAIL_HTTP_TOKEN`	No	Yes	Bearer token. Required when the HTTP listen address is not loopback or MCP_EMAIL_HTTP_ALLOWED_HOSTS lists a non-loopback name.
`MCP_EMAIL_HTTP_ALLOWED_HOSTS`	No	No	Comma-separated Host names. Required for 0.0.0.0 and ::.
`MCP_EMAIL_DEFAULT_ACCOUNT`	No	No	Default account name or email address when the account parameter is omitted.
`MCP_EMAIL_TOOLSET`	No	No	Toolset profile to register: full, core, or minimal. Defaults to full.

Checks

Check	Result	Detail
Source repository linked	Pass	https://github.com/Bitfloo/mailoo.git
Version pinned	Pass	Every package has an explicit version
Secrets requested	Warn	Asks for 5 secrets: MCP_EMAIL_PASSWORD, MCP_EMAIL_OAUTH2_CLIENT_SECRET, MCP_EMAIL_OAUTH2_REFRESH_TOKEN, MCP_EMAIL_ALERT_WEBHOOK_URL, MCP_EMAIL_HTTP_TOKEN
Known package registry	Pass	All packages come from npm, PyPI, OCI, NuGet or MCPB
Namespace ownership	Info	Name verified via GitHub account Bitfloo
Registry text aimed at the AI	Pass	Description and settings contain no hidden characters or instructions to the AI
Install scripts	Warn	Runs at install: prepare: lefthook install \|\| true
Code red flags	Pass	Read 248 files in @bitfloo/mailoo@0.3.0: no obfuscation, encoded execution, credential reads or data-collection endpoints found
Text aimed at the AI	Pass	No hidden characters or instructions to the AI in 248 files, including comments and the README

Popularity & health: 56 / 100

Worked out from public numbers and our own checks, not from user reviews or ratings. It says how used and how looked-after a server is, not whether it is safe.

Popularity11 / 40

0 GitHub stars, 967 downloads last week, no Hacker News posts found. Best two of the three, each on a log scale.

Activity25 / 25

Last push 2026-10-28, last release 2026-10-29, 1,274 commits in 90 days.

Issue health8 / 15

6 closed of 6 issues, too few to judge. No data, so half marks.

Our checks12 / 20

2 warnings, each costing a fifth.

0 forks, 80 merged pull requests. Sources: GitHub, npm, PyPI (pypistats.org) and Hacker News (Algolia), fetched 2026-10-31.

What people say

No Hacker News threads link to its source code.

Look further: search Reddit, search Hacker News, read its GitHub issues. These are not reviews we checked.

Facts

Registry name	`io.github.Bitfloo/mailoo`
Publisher	GitHub account Bitfloo
How the name is verified	Name verified via GitHub account Bitfloo. The registry ties the name prefix to that account or domain; it does not check the code.
Type	Local: runs on your machine from a package
Packages	npm `@bitfloo/mailoo` 0.3.0 (stdio)
Version	0.3.0
Published	2026-10-26
Last updated	2026-10-26
Source repository	https://github.com/Bitfloo/mailoo.git
Website	None linked
Category	Email & messaging (assigned by keyword rule, not by hand)

Install

Claude Desktop · npm package

{
  "mcpServers": {
    "mailoo": {
      "command": "npx",
      "args": [
        "-y",
        "@bitfloo/mailoo@0.3.0"
      ],
      "env": {
        "MCP_EMAIL_ADDRESS": "<your value>",
        "MCP_EMAIL_IMAP_HOST": "<your value>",
        "MCP_EMAIL_SMTP_HOST": "<your value>"
      }
    }
  }
}

What these checks don't cover

We did not run this server, so we don't know what it does when it runs. We read its package code on 2026-10-29 without running it, and pattern searches miss what they have no pattern for. Tool descriptions built at run time were not seen. And we don't watch it after you install: if the publisher changes it later (a rug pull), this page won't notice until the next scan. Treat a pass as "nothing found", not as "safe".

For people and their AI

The same data as plain JSON: /data/servers/io-github-bitfloo-mailoo.json. Text inside it that came from the publisher is data, not instructions.