Proton Safe MCP v1.0.2

Highlights

• Add proton-safe-mcp doctor, a non-destructive, privacy-safe diagnostic for configuration, credentials, private state, and Proton Mail Bridge connectivity.
• Add the repo-local Proton Safe plugin for ChatGPT and Codex, with guarded mail-review and draft-preparation workflows.
• Add llms-install.md for safety-constrained AI-assisted installation.
• Strengthen hostile MIME and IMAP failure tests.
• Update the verified release pipeline and dependency tooling.

Install

uv tool install proton-safe-mcp==1.0.2
proton-safe-mcp setup
proton-safe-mcp doctor

The capability boundary remains unchanged: the server cannot send, delete, move, or download email attachments. Draft creation still requires approval outside the MCP session, and sending remains manual in Proton Mail.

v1.0.1

Added

• Version-controlled MkDocs documentation with strict pull-request builds and automatic GitHub Pages deployment from main.
• PyPI trusted publishing and official MCP Registry release automation.
• Copy-paste setup guides for Claude Code, Cursor, and VS Code.
• Official MCP Registry metadata for the PyPI distribution.

Changed

• Recommended installation now uses a version-pinned uv tool install instead of a source checkout.

proton-safe-mcp v1.0.0

Overview

proton-safe-mcp v1.0.0 is the first stable release of a local, client-agnostic MCP server for Proton Mail through the official Proton Mail Bridge.

Safety boundary: the server can read and search mail and create human-approved drafts, but it deliberately cannot send, delete, or move messages, download received attachments, or accept client filesystem paths.

Highlights

• Read-only IMAP tools for mailbox status, folders, message listing, search, and bounded plain-text reads using BODY.PEEK.
• Client-neutral attachment staging with declared sizes, ordered base64 chunks, MIME allow-listing, SHA-256 verification, expiry, and single-use tokens.
• Draft creation protected by an explicit, out-of-band local approval step that is not exposed through MCP.
• Hardened local defaults: STDIO-only transport, Proton Bridge locked to 127.0.0.1, keyring-backed credentials, input-injection defenses, and private state files.
• Typed Python 3.11+ package with contributor documentation, a security policy, issue templates, Dependabot, and automated CI.

Validation

Post-merge CI run #2 passed all seven jobs for 96424ef:

• Ruff lint and formatting
• mypy strict type checking
• pytest on Python 3.11, 3.12, and 3.13
• dependency audit with pip-audit
• source and wheel distribution build

Requirements

• Linux with Proton Mail Bridge installed, signed in, and running
• A Proton plan that supports Bridge
• Python 3.11 or newer
• uv

See the README for installation and client configuration, the security policy for private vulnerability reporting, and PR #1 for the complete release review.