v1.0.1

• The README is shorter and explains the lethal trifecta, and which of its three parts pylos leaves out. Outlook setup moved to docs/providers.md, the details of each suspicion warning to SECURITY.md, and development notes to CONTRIBUTING.md.
• A new logo, in the README and as the icon clients and the Claude Desktop bundle show.

v1.0.0

pylos-mcp is 1.0. Your mail client shows you the message. pylos-mcp shows your assistant what it hides.

Anyone can put text in your inbox, and the moment an AI assistant reads that inbox, anyone can put text in front of your assistant. pylos-mcp lets Claude, Cursor or any MCP client search, read and draft your mail while every message arrives fenced as data, with a Warnings line naming hidden text, lookalike letters, phrases aimed at an AI and now a failed DMARC check. Sending, moving and deleting stay off until you turn them on.

Stable from here

Tool names and parameters, settings and their defaults, the capability tiers and the guarantees under "What this can never do" now change only in a major release. SECURITY.md has the full promise and which versions get security fixes. Requires Node.js 22 or later.

New since 0.6

• get_thread lists a whole conversation, oldest first.
• get_email warns with dmarc_fail when your own provider's DMARC check failed.
• IMAP_STARTTLS=true for servers such as Proton Bridge.
• Attachments download in 1 MB pieces, and reading a message fetches only what it needs.

Security

• Three checks on sender text ran in quadratic time, so one crafted message could stall the server. All three are linear now.
• Release builds run without the npm publishing identity, and the Claude Desktop bundle ships with a signed build attestation.

Install and verify

npx -y pylos-mcp

Claude Desktop: download pylos-mcp.mcpb below, open it and fill in the form. The README covers Claude Code, Cursor, VS Code and other clients.

gh attestation verify pylos-mcp.mcpb --repo adamVass/pylos-mcp

Full list in the changelog.

v0.6.0

Added

• Outlook.com and Microsoft 365 accounts work with PROVIDER=outlook. The first tool call opens Microsoft's sign-in in the browser, and the sign-in is kept and renewed without asking again. MS_CLIENT_ID and MS_TENANT point it at an app registered in an organization's own tenant.
• Each release carries pylos-mcp.mcpb, a Claude Desktop bundle that installs the server in one click.

Changed

• Provider presets carry their own SMTP port. outlook sends over STARTTLS on port 587, and every other preset stays on 465.

v0.5.0

Added

• create_draft and send_email take in_reply_to with the original's folder and uid, so a reply carries the headers mail clients use to thread it under the original. The server builds the threading headers itself and never takes recipients from the original. After a reply is sent, the original is marked as answered, and the result says so if that could not be done.
• get_email shows when a message was sent and when it was received, and a Cc line.
• search_emails takes flagged_only.
• Text parts the body does not show, such as the second half of a body split around an image, are listed with the attachments instead of disappearing.

Changed

• Search results show the date each message was received, which is the date since and before filter on.
• Base64 attachments are listed at about the size of the file they hold, rather than its larger encoded size.
• MAX_ATTACHMENT_MB now caps all the attachments of one message together, and of every message being composed at once. Ten 25 MB attachments no longer fit in one call.

Security

• <img in plain text is defused like Markdown images, so a client that renders the result fetches no tracking pixel.
• An HTML document sent as plain text is converted and inspected like any HTML mail, so text it hides now raises a warning.
• Hidden text nested about 500 levels deep could reach the model without a warning, in fragments and in full HTML documents. The text is now converted from exactly what the hidden-text check inspected.
• More Cyrillic letters that pass for Latin ones raise mixed_script.
• HTML inside xmp, noscript, iframe, noembed, noframes and plaintext elements is inspected and converted as ordinary text, so it can no longer slip hidden text past the warning or replace the message body.

Fixed

• A forwarded message could be shown as the body of the message forwarding it. It is now listed as a downloadable .eml.
• A message with an empty plain-text part showed no text. Its HTML version is used instead.
• An attachment whose name contained ![ was saved under a different name from the one reported.

v0.4.1

Fixed

• A message whose Date header could not be parsed made get_email fail with an internal error, and took down every search_emails page it appeared on. Its date now shows as unknown.

Changed

• The README opens with an animated example of what the server finds in one message, and the setup instructions now come before the security details.

v0.4.0

Security

• The fence markers around mailbox content now carry a random tag chosen for each tool call, repeated on a reminder line after the content, so a lookalike closing marker typed into a message no longer reads as the real one.
• Markdown image syntax in message text is defused, so a client that renders Markdown no longer fetches an image through it.
• Saved attachments are readable by their owner only, and on macOS carry the quarantine flag, so a saved app goes through Gatekeeper before it runs.

Added

• get_email warns with mixed_script when a word mixes Latin letters with Cyrillic or Greek lookalikes. FLAG_MIXED_SCRIPT turns it off.

Changed

• Instruction-like phrases are matched regardless of extra spaces or line breaks, and are also looked for in subjects, sender lines and attachment names.
• Headings in HTML mail keep their original case instead of being converted to capitals.
• Table rows in HTML mail each get their own line, with cells separated, instead of running together into one word that could raise false warnings.
• Updated nodemailer to 10, which clears the last open audit advisory.

Fixed

• A message nesting its HTML thousands of levels deep could not be read. Content past 500 levels is now cut and marked.

v0.3.0

A configuration that loaded on 0.2.0 can now fail at startup, if SEND_ALLOWLIST holds an entry that never matched anything or TLS_CA_FILE is unreadable. The error names the variable to fix. With delete off, move_email no longer accepts Trash as a destination.

Security

• A message could forge the end of the untrusted-content fence by placing certain invisible characters, such as U+034F, variation selectors or Hangul fillers, between the < characters of the closing marker. Invisible characters are now matched by Unicode's Default_Ignorable_Code_Point property instead of a hand-maintained list, and the marker check also spans combining marks and format characters.
• get_attachment printed the saved path, which ends in a filename the sender chose, outside the fence. The path is now fenced, and the content type is printed only when it is a plain MIME type.
• A Reply-To display name carrying an address on the From domain could suppress the Reply-To mismatch warning. The warning now compares the actual Reply-To address.
• With manage on and delete off, move_email could still move a message into Trash. It now refuses Trash unless delete is enabled too.

Fixed

• A body or Sieve script cut at the size limit could arrive without its truncation marker when HTML conversion or invisible-character stripping brought it back under the limit. The marker now follows whether the download itself was cut.
• A message declaring thousands of attachments produced an unbounded listing. get_email lists the first 50 and says how many more exist.
• delete_email on a message already in Trash reported a successful move. It now says the message is already there.
• The server now exits when the client closes its input, instead of lingering with an open IMAP connection.
• Attachments whose filenames exceeded the filesystem's limit could not be saved. Long names are now shortened, keeping the extension.
• A certificate issued for another hostname produced advice about TLS_CA_FILE, which cannot fix that. The error now names the mismatch.

Changed

• SEND_ALLOWLIST entries that could never match, such as a bare domain, now fail at startup instead of silently refusing every send.
• An unreadable TLS_CA_FILE now fails at startup instead of at the first tool call.
• EMAIL_PASSWORD_CMD has 60 seconds to finish, so a command waiting on input no longer hangs startup.
• Updated the MCP SDK and transitive dependencies to clear security advisories. The remaining nodemailer advisory needs a major version upgrade and is left for the next release.