I strongly support this, particularly as an **official local MCP server integrated into Proton Mail Bridge**.
For me the primary use case is allowing AI agents such as ChatGPT, Claude and Codex to securely **search and read my Proton Mail**, without giving a third-party cloud service permanent access to my mailbox.
Proton Bridge already solves the difficult architectural problem: it decrypts Proton Mail locally and exposes the mailbox to trusted local applications. MCP seems like a natural extension of that model.
An ideal implementation would:
- run only on localhost by default;
- expose MCP directly from Proton Bridge;
- support read-only access as the safest default;
- provide granular scopes such as:
- search mail;
- read messages/threads;
- list folders/labels;
- read attachments;
- draft messages;
- send messages;
- modify/delete messages;
- allow individual MCP clients to be authorized and revoked;
- provide an audit log showing which client accessed which capability;
- require explicit opt-in for destructive or outbound operations.
This would preserve Proton's zero-access architecture because the plaintext processing would still happen locally after Bridge decrypts the mailbox.
It would also be significantly safer than pushing technically capable Proton users toward unofficial MCP wrappers around Bridge IMAP credentials.
I would personally start with a **read/search-only MCP profile**. Being able to ask an agent:
“Find my correspondence with company X about topic Y and summarize what was agreed”
would already make Proton Mail dramatically more useful in agent-based workflows.
Longer term, the same architecture could potentially expose Proton Calendar and other Proton services through scoped MCP capabilities.
Given Proton's investment in Lumo and privacy-preserving AI, an official privacy-first MCP implementation feels particularly well aligned with Proton's direction.
Joe
I strongly support this, particularly as an **official local MCP server integrated into Proton Mail Bridge**.
For me the primary use case is allowing AI agents such as ChatGPT, Claude and Codex to securely **search and read my Proton Mail**, without giving a third-party cloud service permanent access to my mailbox.
Proton Bridge already solves the difficult architectural problem: it decrypts Proton Mail locally and exposes the mailbox to trusted local applications. MCP seems like a natural extension of that model.
An ideal implementation would:
- run only on localhost by default;
- expose MCP directly from Proton Bridge;
- support read-only access as the safest default;
- provide granular scopes such as:
- search mail;
- read messages/threads;
- list folders/labels;
- read attachments;
- draft messages;
- send messages;
- modify/delete messages;
- allow individual MCP clients to be authorized and revoked;
- provide an audit log showing which client accessed which capability;
- require explicit opt-in for destructive or outbound operations.
This would preserve Proton's zero-access architecture because the plaintext processing would still happen locally after Bridge decrypts the mailbox.
It would also be significantly safer than pushing technically capable Proton users toward unofficial MCP wrappers around Bridge IMAP credentials.
I would personally start with a **read/search-only MCP profile**. Being able to ask an agent:
“Find my correspondence with company X about topic Y and summarize what was agreed”
would already make Proton Mail dramatically more useful in agent-based workflows.
Longer term, the same architecture could potentially expose Proton Calendar and other Proton services through scoped MCP capabilities.
Given Proton's investment in Lumo and privacy-preserving AI, an official privacy-first MCP implementation feels particularly well aligned with Proton's direction.