# IMAP MCP vs hosted MCP server for email: which is safer?

> IMAP MCP with a mailbox password or a hosted MCP with OAuth? What your agent holds, where the password lives and which providers still allow IMAP passwords.

Updated: 2026-10-21 · Fact-checked: 2026-10-21 · Canonical: https://commandmail.app/en/learn/imap-mcp-vs-hosted-mcp · Deutsch: https://commandmail.app/de/wissen/imap-mcp-oder-gehosteter-mcp.md

The difference is what your agent's tool holds. A password-based IMAP MCP server signs in to your mail provider with your mailbox password or an app password, while a hosted MCP server that uses OAuth gives your agent a revocable token with the permissions you approved[^9]. IMAP with a password still makes sense for providers without an API and for setups that should stay on one machine, but Google and Microsoft have largely closed that route for their accounts[^5][^6][^7][^8].

Below you will find what a well-built local IMAP server can restrict today, using mcp-email-server as the example[^1][^3], why "hosted" does not always mean "no password"[^10], and how to choose.

## Your agent signs in twice

An email MCP server sits between your AI client and your mailbox, and each side has its own sign-in. Claude, ChatGPT, Cursor or another client first connects to the MCP server. The server then fetches mail from Gmail, Outlook.com, Fastmail or whichever provider holds it.

The MCP specification makes authorization optional for the first sign-in; where it is supported, the rules depend on transport. Servers reached over HTTP should follow its authorization flow, which is based on OAuth 2.1, and servers that run locally over stdio should not, taking credentials from the environment instead[^9]. A stdio server is simply a program on your computer that trusts whoever starts it.

For the second sign-in there are four routes: IMAP and SMTP with a password or app password, IMAP and SMTP with OAuth, the provider's own API with OAuth (Gmail API, Microsoft Graph), or no sign-in to the original mailbox at all because mail arrives by forwarding. Google and Microsoft both support IMAP with OAuth[^6][^7]. Asking "IMAP MCP or hosted MCP" mixes these two layers. A hosted server can speak IMAP with an app password behind the scenes, and a local server can use OAuth.

## A local IMAP MCP server in practice

mcp-email-server is an open-source, BSD-3-licensed[^15] server that reads, searches, organizes and sends mail over IMAP and SMTP on Windows, macOS and Linux[^1]. Setup starts with an email address and password, and the interface suggests common server settings from the domain[^1]. Its configuration, tools and transport documents describe no OAuth sign-in for the mailbox[^2][^3][^4].

The password stays on your machine and travels only to your provider. In managed mode the project stores credentials in a dedicated table of a private SQLite database on Linux and Windows, and in the system keyring on macOS[^2]. The command line accepts passwords through masked input or standard input, never as an ordinary argument[^2].

You can narrow what the agent may do. Write actions fall into five classes (draft, organize, delete, send, append); all five are allowed by default, and an empty list makes an account read-only[^3]. Sending is governed by a recipient allowlist: an empty list switches sending off, and a pattern such as `*@example.com` or an explicit `*` turns it on[^2].

The server also offers SSE and Streamable HTTP and checks `Host` and `Origin` headers by default to block DNS rebinding[^4]. The project still recommends stdio for a local client[^4]. Exposing it to a network means adding your own protection in front of it.

## What handing over a mailbox password means

With IMAP, a mailbox password or app password typically opens the entire mailbox, so any finer limit has to come from the MCP server. mcp-email-server provides exactly that through its permission classes and recipient lists[^2][^3]. Those limits live inside the server, though; anyone who obtains the stored credential can bypass them.

The project is candid about this. It calls its local management interface a single-user trust boundary and notes that a malicious process running as the same operating-system user can generally read or replace that user's files[^13]. On a personal laptop that is a reasonable assumption; on a shared machine it is a weaker one.

Revoking access happens at the provider. You delete an app password in your provider account, or you change the mailbox password, which also disconnects every other app that used it.

## Which providers still accept IMAP with a password

Most large providers have stopped accepting username and password sign-in from other apps. This table shows what that means for an IMAP MCP server.

| Provider | Password-based IMAP for other apps | Source |
|---|---|---|
| Gmail (personal) | Only with an app password; requires 2-Step Verification, and Google advises against it | [^5] |
| Google Workspace | OAuth required since March 14, 2025, with app passwords as the exception | [^6] |
| Microsoft 365 (Exchange Online) | Basic authentication for IMAP and POP disabled in all tenants | [^7] |
| Outlook.com, Hotmail | Basic authentication no longer works since September 16, 2024 | [^8] |

Google says app passwords are not recommended and unnecessary in most cases, and some accounts cannot create them at all, for example accounts with Advanced Protection or some work and school accounts[^5]. Microsoft adds that switching off basic authentication also stops app passwords from working with apps that lack two-step verification support[^7]. A password-only IMAP server therefore cannot reach Outlook.com or Microsoft 365.

Many other providers, including plenty of hosts for custom domains, still allow IMAP with a password. Conditions differ, so check your provider's help pages; we have not verified each one. Where your provider offers no suitable alternative interface, an IMAP MCP server is often the most direct option.

## What a hosted MCP server changes

A hosted MCP server runs at the vendor, and your agent connects over the internet, signing in with OAuth or an API key depending on the service[^9][^10]. With OAuth you approve the token's permissions when connecting and can revoke the connection later without touching your mailbox password. In exchange, a further company runs the server and handles whatever data passes through it.

Hosted does not automatically mean passwordless. MCP Emails, for instance, says it connects Gmail with a Google app password over IMAP and Outlook or Microsoft 365 with Microsoft sign-in over OAuth, and that it keeps one encrypted token or app password per inbox so it can make the next call[^10]. The app password then sits on the service's servers rather than your laptop.

Before choosing any hosted service, find out which credential for your mailbox it keeps, whether it stores mail, and whether sending can be switched off separately from reading. Our [email MCP server comparison](https://commandmail.app/en/compare/best-email-mcp-servers) lays out these criteria across the main options.

## How to choose

Where your mail lives and who you are willing to trust with a credential matter more than the label local or hosted.

- **One mailbox at a provider that allows password IMAP, and everything should stay local:** a local password-based IMAP server such as mcp-email-server, with tight permission classes and a recipient allowlist[^2][^3].
- **Gmail or Microsoft 365, and the agent should work in the original mailbox:** a server that signs in to the provider with OAuth, through its API or IMAP with OAuth, self-hosted or hosted. Our [guide to MCP servers for Google mailboxes](https://commandmail.app/en/guides/gmail-mcp-server) covers the options there[^6].
- **No password leaves your hands, and addresses from several providers should share one inbox:** an agent inbox that receives copies by forwarding.

## Where Command Mail fits

Command Mail is our product: a hosted MCP server that never signs in to your original mailbox. Your addresses forward copies to Command Mail, so it needs neither a mailbox password nor an app password[^11]. Forwarding is not a sync; when the agent sorts or archives mail, the change happens in Command Mail only.

Your agent connects over Streamable HTTP with OAuth 2.1, PKCE and dynamic client registration[^11]. Access tokens last one hour and refresh tokens 30 days, and both can be revoked. OAuth offers the scopes `mail:read`, `mail:draft`, `mail:send-approved`, `mail:send` and `mailboxes`; the consent screen lets you untick any requested permission, and `mail:send` for sending without approval starts unticked[^11] (app code, commit `d6ad1ce`). Sending without approval additionally requires the sending mailbox to be on the `auto` autonomy level, a send key per email and a daily limit[^11][^12].

There are trade-offs. Copies of your mail are held by another company, FYN Labs LLC in the USA, with the app and database at Cloudflare and attachments in Cloudflare's EU jurisdiction[^14]. Read access covers every mailbox in the account, and depending on the autonomy level `mail:read` also allows sorting. The Free plan cannot send. Forwarding a Gmail address does not make it a sending address; each sender address is set up separately[^11][^12].

You can [start for free](https://commandmail.app/login?signup=1) and connect your agent without the send permission at first; for read-only use, also set its mailboxes to the `read` autonomy level.

## Review status

Last checked: 2026-10-21. The mcp-email-server documents, the Google, Microsoft and MCP pages and the MCP Emails site were retrieved that day[^1][^10]. Statements about Command Mail were checked against the app code at commit `d6ad1ce` (`oauth.ts`, `oauth-scopes.ts`, the consent page under `src/routes/oauth/authorize` and `outbox.ts`). We did not install any of the servers named here or test them with a real mailbox.

## Frequently asked questions

### Is a password-based IMAP MCP server a security risk?

Not by itself. A local server such as mcp-email-server keeps the password on your machine and can restrict write actions and recipients. The catch is that a mailbox password or app password usually opens the whole mailbox, so every limit has to be enforced by the server.

### Can I still use IMAP with a password for Gmail or Outlook?

For Gmail only with an app password, which needs 2-Step Verification, and Google advises against it. Outlook.com and Microsoft 365 no longer accept username and password sign-in from other apps, so those accounts need OAuth.

### Does a hosted MCP server mean no password is stored anywhere?

No. Hosted describes where the server runs. How your agent signs in and how the service reaches your mailbox are separate questions. Some hosted services still store an app password for IMAP mailboxes, only on their servers instead of your computer.

### What does my agent hold when it connects to a hosted MCP server with OAuth?

An access token for that server, limited to the permissions you approved. With Command Mail the access token expires after one hour, is renewed with a refresh token and can be revoked; the agent never sees a mailbox password.

### Which option works for a custom-domain mailbox at a small host?

If the host allows password-based IMAP and offers no suitable alternative interface, a local IMAP MCP server can be a direct route into the original mailbox. If you would rather not hand any password to a tool, forward the address to an agent inbox such as Command Mail instead.

## Sources

1. [mcp-email-server: README](https://github.com/Wh1isper/mcp-email-server), accessed 2026-10-21
2. [mcp-email-server: Configuration](https://github.com/Wh1isper/mcp-email-server/blob/main/docs/configuration.md), accessed 2026-10-21
3. [mcp-email-server: MCP tools and mutation permissions](https://github.com/Wh1isper/mcp-email-server/blob/main/docs/tools.md), accessed 2026-10-21
4. [mcp-email-server: Transports](https://github.com/Wh1isper/mcp-email-server/blob/main/docs/transports.md), accessed 2026-10-21
5. [Google: Sign in with app passwords](https://support.google.com/accounts/answer/185833?hl=en), accessed 2026-10-21
6. [Google Workspace: Transition from less secure apps to OAuth](https://support.google.com/a/answer/14114704?hl=en), accessed 2026-10-21
7. [Microsoft Learn: Deprecation of Basic authentication in Exchange Online](https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online), accessed 2026-10-21
8. [Microsoft: Modern authentication now needed for Outlook.com in non-Microsoft email apps](https://support.microsoft.com/en-us/office/modern-authentication-methods-now-needed-to-continue-syncing-outlook-email-in-non-microsoft-email-apps-c5d65390-9676-4763-b41f-d7986499a90d), accessed 2026-10-21
9. [Model Context Protocol: Authorization (2025-06-18)](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization), accessed 2026-10-21
10. [MCP Emails: Hosted email MCP server](https://mcpemails.com/), accessed 2026-10-21
11. [Command Mail: plans, connection and permissions](https://commandmail.app/llms.txt), accessed 2026-10-21
12. [Command Mail: Permissions and autonomy](https://commandmail.app/en/docs/permissions-and-autonomy), accessed 2026-10-21
13. [mcp-email-server: Security](https://github.com/Wh1isper/mcp-email-server/blob/main/docs/security.md), accessed 2026-10-21
14. [Command Mail: Privacy policy](https://commandmail.app/privacy), accessed 2026-10-21
15. [GitHub API: mcp-email-server (license BSD-3-Clause)](https://api.github.com/repos/Wh1isper/mcp-email-server), accessed 2026-10-21

[^1]: [mcp-email-server: README](https://github.com/Wh1isper/mcp-email-server), accessed 2026-10-21
[^2]: [mcp-email-server: Configuration](https://github.com/Wh1isper/mcp-email-server/blob/main/docs/configuration.md), accessed 2026-10-21
[^3]: [mcp-email-server: MCP tools and mutation permissions](https://github.com/Wh1isper/mcp-email-server/blob/main/docs/tools.md), accessed 2026-10-21
[^4]: [mcp-email-server: Transports](https://github.com/Wh1isper/mcp-email-server/blob/main/docs/transports.md), accessed 2026-10-21
[^5]: [Google: Sign in with app passwords](https://support.google.com/accounts/answer/185833?hl=en), accessed 2026-10-21
[^6]: [Google Workspace: Transition from less secure apps to OAuth](https://support.google.com/a/answer/14114704?hl=en), accessed 2026-10-21
[^7]: [Microsoft Learn: Deprecation of Basic authentication in Exchange Online](https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online), accessed 2026-10-21
[^8]: [Microsoft: Modern authentication now needed for Outlook.com in non-Microsoft email apps](https://support.microsoft.com/en-us/office/modern-authentication-methods-now-needed-to-continue-syncing-outlook-email-in-non-microsoft-email-apps-c5d65390-9676-4763-b41f-d7986499a90d), accessed 2026-10-21
[^9]: [Model Context Protocol: Authorization (2025-06-18)](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization), accessed 2026-10-21
[^10]: [MCP Emails: Hosted email MCP server](https://mcpemails.com/), accessed 2026-10-21
[^11]: [Command Mail: plans, connection and permissions](https://commandmail.app/llms.txt), accessed 2026-10-21
[^12]: [Command Mail: Permissions and autonomy](https://commandmail.app/en/docs/permissions-and-autonomy), accessed 2026-10-21
[^13]: [mcp-email-server: Security](https://github.com/Wh1isper/mcp-email-server/blob/main/docs/security.md), accessed 2026-10-21
[^14]: [Command Mail: Privacy policy](https://commandmail.app/privacy), accessed 2026-10-21
[^15]: [GitHub API: mcp-email-server (license BSD-3-Clause)](https://api.github.com/repos/Wh1isper/mcp-email-server), accessed 2026-10-21

---

Command Mail: one inbox for you and your AI agent. Start free: https://commandmail.app/login?signup=1 · Connect your agent: https://commandmail.app/en/agents · MCP: https://commandmail.app/mcp