ExplainerUpdated October 27, 2026
What is an MCP server, and what does it have to do with email?
An MCP server is a program that gives an AI application such as Claude Code or Claude Desktop tools and data through a shared protocol, the Model Context Protocol (MCP). For email, this means the server offers tools like "search mail", "read message" or "create draft", and the language model can call them. What the agent may do is set by the server and by the permissions you grant when you connect it.
01Why MCP exists
MCP is an open protocol that lets AI applications connect to outside data sources and tools in one standard way[1]. MCP standardizes the interface between AI applications and the services they connect to. A provider writes one server that MCP-capable applications can use.
The specification compares this to the Language Server Protocol, which brought programming languages into code editors in a uniform way[1]. For you as a user, it means the same email server can run in several applications, as long as they support a compatible MCP version and the features it needs. The current version of the specification is dated 2026-07-28.
02Host, client and server
MCP has three roles[2]. The host is the AI application you work in, for example Claude Code or Visual Studio Code. For every server it connects to, the host creates a client that holds exactly one connection. The server is the program that provides tools and data, whether it runs on your computer or at the provider.
Client and server exchange JSON-RPC 2.0 messages[1]. The client first asks what the server offers, for example the list of tools via tools/list, and then calls single tools with tools/call[2]. The model never talks to the server directly. It proposes a tool call, and the host carries it out.
This split matters for email. The host decides whether to ask you before a call. The server decides what it will execute at all. The model in the middle can make mistakes or be tricked.
03Tools, resources and prompts
A server offers three kinds of building blocks[2]. Tools are functions the model can have executed, such as a search or saving a draft. Resources are data that serve as context, such as the contents of a file. Prompts are reusable templates for common tasks.
In the other direction, a server can use elicitation to ask the user for input, for example a missing detail or confirmation of an action[2]. Sampling, which let a server call the host's model, is deprecated as of version 2026-07-28.
An email MCP server can offer tools to search, read, sort, draft and send. Which of them are available, and how finely they are separated, depends on the server.
04Local or hosted
A local MCP server runs as a program on your computer. The host often starts it as a subprocess and talks to it over stdio, the standard input and output streams[4]. Such a server usually serves a single client[2].
A hosted server runs at the provider and typically uses Streamable HTTP. It usually serves many clients[2]. Authorization is optional in MCP. For HTTP servers, the specification recommends a flow based on OAuth 2.1: the MCP server is the protected resource, and the client gets an access token from an authorization server[5]. Servers on stdio should not use this flow and take credentials from their environment instead[5].
For email, this raises a practical question: where do the credentials for your mailbox live? With a password-based IMAP connection, the local server needs your mailbox password or an app password. OAuth between MCP client and MCP server governs the agent's access to the server; how the server itself reaches your mailbox depends on how it is built. Both approaches and their trade-offs are covered in IMAP MCP vs hosted MCP server.
05What an email MCP server does
An email MCP server turns the agent's tool calls into actions in a mailbox. When the agent looks for last week's invoices, the host calls the search tool and the server returns matching messages. When the agent should reply, it uses another tool to save a draft or to send.
When the agent reads incoming mail, outside text flows into the model. If a message hides an instruction, the model may take it for a task. How that works and what helps against it is explained in Prompt injection in email.
Reading is the basic function of an email server. The differences show in the limits. Can the agent send without a person agreeing? Can it delete permanently? Do the limits apply per mailbox? More servers, by account type, sending and hosting, are in the email MCP server comparison.
06Who is responsible for safety
The applications involved have to put MCP's security principles into practice. The specification lists principles such as explicit consent, control over data and caution with tools, and it states that the protocol cannot enforce them at the protocol level[1]. Hosts and servers have to build them.
The specification's security principles require the host to get the user's explicit consent before invoking tools[1]. The tools specification also recommends that there always be a human in the loop who can deny tool calls[3]. Descriptions of a tool's behavior, such as a note that it only reads, count as untrusted unless they come from a trusted server[3].
For email, this leads to three questions to check. First: which permissions does the server request when you connect, and can you deselect some? Second: does the server refuse risky actions itself, or does it rely on the confirmation prompt in the host? Third: what happens if you choose "always allow" in your AI application? Limits enforced by the server still apply then. Which permissions an agent needs for which job is covered in Email agent scopes.
07A hosted email server in practice: Command Mail
Command Mail is our product; its MCP server serves here as an example of the terms above. It is hosted at https://commandmail.app/mcp and uses Streamable HTTP with OAuth 2.1, PKCE and dynamic client registration[6]. Without a token, the endpoint answers with HTTP 401 and points to its OAuth metadata, which lists five permissions: mail:read, mail:draft, mail:send-approved, mail:send and mailboxes[7].
According to the documentation, you can switch off any permission when you connect, and sending without approval starts switched off[6]. The documentation tells agents to call the capabilities tool at the start of every session. It tells the agent the owner, the granted permissions, the mailboxes with their autonomy level, the allowed operations and the limits[6]. Sending starts with Pro; the free plan does not send[6]. According to the documentation, the send_approved_draft tool sends exactly the approved revision of a draft with the mail:send-approved permission. Without approval, the agent needs at least mail:send and a mailbox on the auto level; according to the documentation, a daily limit and at most 20 recipients per message then apply[6]. Whether sending is possible right now is reported by capabilities.
For local use there is also a CLI: after commandmail login, commandmail mcp starts a local server[6]. In Claude Code you add the hosted server with claude mcp add --transport http commandmail https://commandmail.app/mcp. There are limits here too: mail:read reads every mailbox in the account, and, according to the documentation, prompt-injection detection flags suspicious messages without guaranteeing that it catches every attack.
08How we checked
Last checked: 2026-10-27. The MCP specification pages (version 2026-07-28) and the Command Mail sources were retrieved on that day; we called the MCP endpoint without a token and saw the 401 response with OAuth metadata. Tool names come from the app code at commit 9cab1eb. We did not log a full agent run for this page.
You can start for free and connect your agent with mail:read only at first.
Frequently asked questions
What is an MCP server in one sentence?
An MCP server is a program that offers an AI application tools, data and templates through the Model Context Protocol, such as "search mail" or "create draft". The AI application asks what the server can do and then calls its tools on the model's behalf.
Do I need to code to use an MCP server?
Usually not for a hosted server: you add an address in Claude Code, Claude Desktop or another MCP-capable app and sign in. A local server runs as a program on your computer and often needs a configuration file and sometimes credentials.
Is an MCP server secure by default?
No. The specification itself says MCP cannot enforce its security principles at the protocol level. Consent, permissions and limits have to be built by the AI application and the server. For email, what matters is which permissions you grant and what the server refuses on its own side.
What is the difference between a local and a hosted MCP server?
A local server runs on your computer and is often connected over stdio, usually for a single client. A hosted server runs at the provider, typically uses Streamable HTTP and serves many clients. Authorization is optional in MCP; for HTTP servers, the specification recommends a flow based on OAuth 2.1.
Can an email MCP server send email?
That depends on the server and on your permissions. Some offer a send tool that sends at once, others only drafts. In Command Mail, the free plan does not send; from Pro, sending is its own permission. The agent sends approved drafts with mail:send-approved, and without approval only with mail:send from mailboxes on the auto level. That permission starts switched off when you connect.