How do I install Gmail Tidy?

Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does Gmail Tidy need an API key?

No required environment variable is listed on this record.

What transport does Gmail Tidy use?

Gmail Tidy runs locally over stdio.

When was Gmail Tidy last checked?

Last checked 2026-11-09. Organize Gmail accounts: threads, attachments, labels, filters, drafts. Never sends or deletes.

Gmail Tidy MCP server

Power your agent

Add this server

The publisher's own command. Not a PlugMCP endpoint.

Add to Cursor Add to VS Code Run on PlugMCP

Host a copy with our keys and logs.

Local command

npx -y [email protected]

Claude Code has no install link for a local command. Copy the command below and run it in a terminal.

shClaude Code

1claude mcp add io.github.imkath-gmail-tidy-mcp -- npx -y gmail-tidy-mcp@0.5.1

Run in a terminal.

jsonClaude Desktop

1{2  "mcpServers": {3    "io.github.imkath-gmail-tidy-mcp": {4      "command": "npx",5      "args": [6        "-y",7        "[email protected]"8      ]9    }10  }11}

claude_desktop_config.json

Local · npmPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Local

Transport: stdio
Version: 0.5.1
Last checked

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

gmail-tidy-mcp

An MCP server that lets your AI assistant read and organize several Gmail accounts at once: search, read, label, archive, set up filters and write drafts.

It cannot send or delete email. Not "it asks first": there is no tool for it, and a test fails the build if a send or delete call ever shows up in the code.

Why

Most Gmail MCP servers hand the model full control of your mailbox, including sending, and keep OAuth tokens in plain text on disk. That is a lot of trust to give a model that also reads emails written by strangers.

This one is built around a smaller promise: the assistant can help you get your inbox in order, but it can't send anything or delete anything.

What it can do

Area	Tools
Accounts	`list_accounts`, `check_accounts`, `connect_account`, `finish_connect_account`
Reading	`search_emails` (Gmail search syntax), `search_all_accounts` (one search, every account), `get_email` (lists attachments), `get_thread` (a whole conversation, oldest first, quoted history trimmed), `get_attachment` (text, `.gz` and `.zip` are read inline, e.g. DMARC reports; anything else, like a PDF, is saved to `~/Downloads/gmail-tidy-mcp`), `sender_stats` (who writes most, by address and domain), `newsletters` (mailing lists by volume with the unsubscribe link each declares; it never unsubscribes for you)
Labels	`list_labels`, `create_label` (nest with `Parent/Child`), `update_label` (rename, recolor with the Gmail palette, show or hide in the sidebar)
Organizing	`organize_emails`: add or remove labels by ID or by search, up to 5,000 messages at a time. Archive = remove `INBOX`, mark as read = remove `UNREAD`
Filters	`list_filters`, `create_filter`, `delete_filter`. A filter that skips the inbox needs an explicit `skip_inbox: true`
Drafts	`create_draft`, optionally as a reply inside a thread and with local files attached; `list_drafts`; `update_draft` edits an existing draft (only the fields you pass change, the thread and current attachments stay). You send it yourself from Gmail
Settings	`set_signature`: changes only the signature, never how mail goes out
Audit	`recent_changes`: every change this server made, to review or undo a session

Each account gets a short label, so you can say things like "archive every newsletter older than a month in work".

What it will not do

Send, reply, forward or delete email, or move it to Trash or Spam.
Give the model a way to add those later: the tools are fixed in code and the model cannot call arbitrary Gmail endpoints.

Google has no scope that allows drafts but not sending, so the server asks for gmail.modify (which technically includes sending) plus gmail.settings.basic for filters. The guarantee comes from the code, and test/safety.test.js checks it on every run.

Security

Tokens are encrypted with AES-256-GCM in ~/.config/gmail-tidy-mcp/tokens.enc (mode 600). The key lives in the macOS Keychain, the Linux Secret Service (secret-tool), or a DPAPI-protected file on Windows. You can also provide it yourself with GMAIL_TIDY_KEY (64 hex characters).
Sign-in uses PKCE and a random state, with the redirect on 127.0.0.1 only.
The signed-in account is verified. After sign-in, the server asks Gmail which address it got. If it is not the one you asked for, or Google granted different scopes, the token is revoked and nothing is saved.
Your own OAuth client. No shared client and no third-party server. Your mail goes from Google to your machine and nowhere else.
Email content is fenced off as untrusted. Everything read from Gmail goes inside a block whose markers carry a random value per call, so an email can't close the block early. Control characters in headers are removed, and HTML is reduced to visible text (scripts, styles, and text hidden with display:none, visibility:hidden, font-size:0 or opacity:0 are dropped).
Invisible text is removed. Unicode tag characters (used to smuggle instructions that a model reads but you can't see), zero-width characters and text-direction controls are stripped from headers, bodies and attachments. Tag characters are reported, since they have no legitimate use in mail.
Security notes come from the server, not the sender. get_email and get_attachment add a short list of findings above the untrusted block: phrasing typical of prompt injection, failed SPF, DKIM or DMARC, a Reply-To that sends answers to a free webmail address when the sender didn't pass DMARC, a display name that pretends to be another address, and links that show one site but lead to another (Gmail and Outlook redirect wrappers are unwrapped first; tracking links in mailing lists are not flagged). They are tuned to stay quiet on normal mail, so a note means something.
Lookalike senders are flagged. A sender whose domain is one or two letters away from one of your connected accounts (or uses letters from other scripts that look Latin) gets a note; for Gmail and other webmail the mailbox name is compared instead. Mail between your own accounts is never flagged.
Drafts only attach files from your user folders. Attachments must live under Downloads, Desktop or Documents (or the folders in GMAIL_TIDY_ATTACH_DIRS), never in a hidden folder and never this server's own config. Links are resolved before the check, so a shortcut can't point at . That way a model steered by a malicious email can't slip a private key or token into a draft for you to send.

What could still go wrong

No server can make prompt injection impossible, and the security notes are heuristics: they catch common tricks, not every one, and a clean result proves nothing. If a malicious email convinces the model, it could still:

relabel or archive mail (you can undo this),
create a filter that hides new mail from the inbox (only with skip_inbox: true, and your client can ask you first),
delete one of your filters (filters can't be recovered),
write a misleading draft. It is never sent unless you send it,
rename or recolor a label, change your signature, or rewrite one of your drafts (all reversible: the audit log keeps what changed),
save an attachment flagged as dangerous, if it also sets allow_risky: true; opening it is still up to you.

Two more things worth knowing:

The token itself can send mail. The "never send" guarantee is in this code, not in the token. If someone steals the token and the key, they get what gmail.modify allows. Keep your machine and keyring locked.
On macOS, the Keychain item trusts /usr/bin/security, which means any process running as you can read the key without a prompt. That still keeps the key off the disk, but it is not a barrier against malware running under your user.

Setup

Requires Node.js 22 or newer.

1. Create your Google OAuth client (once)

In Google Cloud Console, create a project and enable the Gmail API.
In Google Auth Platform, set up the app as External, add your email as the support and contact address, and publish it (Audience → Publish app). Unverified apps in production keep their refresh tokens. In testing mode they expire after 7 days.
Under Clients, create a client of type Desktop app and download the JSON.
Save it as ~/.config/gmail-tidy-mcp/oauth-client.json and make it private (chmod 600 on macOS and Linux).

When you connect an account, Google warns that the app is unverified. That is expected: the app is yours. Continue through Advanced.

2. Register it with your MCP client

Claude Code:

claude mcp add -s user gmail-tidy -- npx -y gmail-tidy-mcp

Any other MCP client: run npx -y gmail-tidy-mcp over stdio.

Prefer to run it from source? Clone the repo, run npm ci --ignore-scripts, and point your client at node /path/to/gmail-tidy-mcp/bin/gmail-tidy-mcp.js.

On Linux, install libsecret-tools first so the key can go into your keyring.

3. Connect accounts

Ask your assistant to connect an account. It opens Google's sign-in page in your browser. Or do it from the terminal:

npx gmail-tidy-mcp add [email protected] personal
npx gmail-tidy-mcp list
npx gmail-tidy-mcp remove [email protected]

Removing an account deletes its token locally. To revoke access on Google's side too, go to myaccount.google.com/permissions.

Google Workspace accounts may need an admin to allow unverified apps.

Development

npm test

The tests cover the safety guarantee (no send or delete calls, no Trash or Spam, filter actions limited to labels), token encryption and key handling, the sign-in callback (state, errors, timeouts), the post-login checks, draft headers and body decoding. CI runs them on Linux, macOS and Windows, including the real DPAPI path on Windows.

Credits

This started from gx-55/multi-gmail-mcp (MIT) by Rogers Xie. Some of its building blocks remain: the label-or-address account lookup, the message search and header helpers, the reply threading and the token-error detection. The storage, sign-in flow, tool set and safety model were redesigned.

License

MIT. See LICENSE.

Add this server

Host a copy with our keys and logs.

Server facts

Tools

Questions

How do I install Gmail Tidy?

Does Gmail Tidy need an API key?

What transport does Gmail Tidy use?

When was Gmail Tidy last checked?

Documentation

gmail-tidy-mcp

Why

What it can do

What it will not do

Security

What could still go wrong

Setup

1. Create your Google OAuth client (once)

2. Register it with your MCP client

3. Connect accounts

Development

Credits

License