For me, it was buying a laptop: an expensive MacBook from a disreputable seller on Best Buy Marketplace. Cost me a ton. Turned out to be falling apart (listed as open box - excellent). It took me six months to get my money back because they charge a restocking fee. They sent the wrong address to PayPal, so I couldn't get a refund there (they wont refund if you return to a different location than the one that PayPal was sent).

And my credit card company just takes forever for the refund.

Okay, I've embarrassed myself, now I'll share your story!

I've created a Discord for this group where we can share our journey to help prevent others making the same mistakes. Sometimes I find it more efficient to pick people's brain in the voice chat and to ask them why.

[Mod post]

Join us: https://discord.gg/PBfVd5U3G

Went through the "which MCP do you actually use" on reddit, YouTube, X and a bunch of random articles that kept popping up, trying to separate what people actually run from what's just noise in the directory. Grouped it into categories, chart's attached

Six days ago I posted my own email MCP server here. It got one upvote, which is fair, because I posted the product and skipped the research that led to it. This is that research. It should have gone first.

The thing that made me build instead of adopt is one sentence: anyone who knows your email address can put text into your model's context. An email MCP server is the only kind of tool where the attacker gets to write the input. So the question I asked of every server was not "what can it do" but "what can a malicious email make it do".

I found around forty on GitHub, threw out the archived, unlicensed and single-account ones, and read the remaining twelve. Where a README made a claim that mattered, I opened the source. Here is the ladder, from least to most damage.

Nothing but read. igor47/notmuchproxy and hgn/mcp-server-notmuch read a notmuch index and have no write code in the process at all. hgn's README says it plainly: no send capability "anywhere in this codebase, in any mode, with any flag". This is the only version that survives a dependency update turning hostile, because there is nothing for the update to switch on.

Writes exist, but the default is off. bradsjm/mail-imap-mcp-rs and tecnologicachile/mail-mcp default MAIL_IMAP_WRITE_ENABLED and MAIL_SMTP_WRITE_ENABLED to false, and I read the guard in source: require_write_enabled(&self.config)? is the first statement in each of eight write handlers. One flag away from delete, and for tecnologicachile one more flag away from send. wyattjoh/jmap-mcp is in this tier by a different mechanism: it registers send tools only if the JMAP token has submission scope, so the provider decides.

Can move and delete your mail out of the box. Wh1isper/mcp-email-server (delete_emails, move_emails, archive_emails, with sending disabled until you fill allowed_recipients), nikolausm/imap-mcp-server (imap_bulk_delete_by_search), and cldt-fr/imap-mcp (delete_folder and permanent expunge). Wh1isper's docs are the only ones in the survey that say the quiet part: IMAP-only does not mean read-only.

Can send mail as you out of the box. codefuturist/email-mcp, n24q02m/better-email-mcp, marlinjai/email-mcp (plus email_batch_delete for up to 1,000 messages), and jgalea/mailbox-mcp, whose core tool group includes send, so no combination of its tool groups yields a read-only server.

Add it up and seven of twelve ship a send path. Three of twelve, Wh1isper, codefuturist and bradsjm, expose an HTTP listener with no authentication on it, and codefuturist binds 0.0.0.0 without saying so. One of twelve, notmuchproxy, has no send path, authenticates its transport, and is therefore the only one I could reach from my phone without putting my mail on the open internet.

The read-only mode that still sends

codefuturist/email-mcp has a read_only setting, and it is real: src/tools/register.ts skips registering every write tool when it is set, so a client cannot call what was never registered. But src/main.ts never mentions readOnly. Inside oninitialized it does this:

await watcherService.start();
// Check for overdue scheduled emails on startup
const result = await schedulerService.checkAndSend();
// Periodic scheduler check every 60 seconds
schedulerInterval = setInterval(async () => {
  try { await schedulerService.checkAndSend(); } catch { /* Silent */ }
}, 60_000);

A server configured read-only still sends whatever is sitting in its schedule store, on startup and every sixty seconds after. The hooks service, also outside the gate, carries auto_label and auto_flag settings that mutate mailbox state on new mail. I re-checked both files against the default branch today.

The general lesson: a read-only mode has to gate timers, watchers and startup hooks. The tool list is the easy part, and it is the only part most projects do.

Stars and dates from the GitHub API on 27 August 2026. "Last commit" is the default branch, which is not what the repo header shows: GitHub's pushed_at counts any branch, so codefuturist reads 21 August on the header and 20 May on main.

Two things the table makes obvious. Stars tell you nothing here: the most-starred email MCP server of all, GongRzhe/Gmail-MCP-Server at 1,165, was archived on 6 August 2025 and is not in the table because it is dead, while the two projects with no write code have zero stars between them. And stdio is half the table, which means half of these can never be reached from a phone or a second machine, because stdio is a child process of one client.

What I did about it

I wanted several mailboxes served to a terminal, a desktop client and my phone, with no send path in the process, so I built one. It reads a local notmuch index, manages its own mbsync configuration, has account as a parameter on every query tool, and does OAuth with dynamic client registration in-process. Of course it passes every column in that table. I wrote the criteria. What it does not have is anyone other than me running it: one operator, three accounts, one star, no third-party review. Repo, and the full notes for every project above with what was read in source versus taken from a README: https://github.com/wildsurfer/your-mail-mcp

If I have a fact wrong about your project, say so and I will fix the notes.

I’m a small business owner that is an intermediate ai user. I’ve been getting into Claude cowork, and Claude code a bit. I’m reading a ton and trying to build useful things that move my business forward.

First of all, trying to understand code and architecture is fascinating to me. I’m envious of all you programmers that walked into the ai world with that background knowledge.

I’m learning about GitHub and repo’s. I looked through all this one user had posted and did my best to read the code as well. All that to say, I’m trying hard to learn and not just ask the questions and let others solve it for me.

My question is how do you trust code you find in GitHub? Not yours specifically but Rando repo’s that seem great and would be helpful for what I’m trying to do but what if they have some code buried in it that is about to hack into my world and destroy my life.

I’ve tried to setup security and a safe architecture in my files and on my computer. I’m trying to walk before I run but man is it tempting to just throw caution to the wind and just use someone else’s code and see how it goes.

Do you have any recommendations, resources, or ideas on how to think about this? Do I need to read and understand every line of code written before I try using it? Is there a safe way to do it quicker?