Connect Hushmail to Claude,
Cursor, ChatGPT, any MCP client
Give your AI agent a real Hushmail inbox. Read, search, send, reply, schedule and organize mail over IMAP, in every MCP client, with the two-step verification quirk that breaks most setups explained up front.
Claude cannot reach Hushmail on its own. mcpemails is a hosted MCP server that connects it over IMAP at imap.hushmail.com on port 993, and SMTP at smtp.hushmail.com on port 465, so Claude, Cursor or any MCP client can read, search, send and organize that mail. Authentication is your full Hushmail address and your Hushmail password, except that with two-step verification enabled the password field must contain your password, a space, and the 20-character security code from Preferences. One inbox is free, forever.
How Hushmail connects: IMAP and a concatenated security code
Hushmail serves IMAP at imap.hushmail.com on port 993 with SSL, and SMTP at smtp.hushmail.com on port 465, with 587 documented as the fallback if 465 is filtered on your network. The username is always your full email address, even where a client labels the field "username", and that holds for custom-domain Hushmail accounts too. If two-step verification is off, the password is simply your Hushmail password. If it is on, Hushmail does not issue a separate app password: it expects your password and a 20-character security code in the same field, separated by a space.
The exact Hushmail IMAP and SMTP settings
Copy these into the connect form. mcpemails prefills them where it can, and retries the other standard transport if the first does not answer.
| Protocol | Server | Port | Security |
|---|---|---|---|
| IMAP (incoming) | imap.hushmail.com | 993 | TLS (implicit) |
| SMTP (outgoing) | smtp.hushmail.com | 465 | TLS (implicit) |
Verified 2026-08-31: imap.hushmail.com answered a TLS connection and identified itself as an IMAP server under that name. It advertises PLAIN authentication.
Sign in with: Your full Hushmail address, including the domain, even when the field is labelled username.
A Hushmail inbox your agent can actually use
Nine action-based MCP tools: send, reply, forward, schedule, and organize. Your agent finishes the job inside Hushmail.
- 01Read
Read & search mail
List, read and search across folders to find that invoice, summarize a thread, or pull the latest from a sender.
- 02Send
Send, reply & forward
Compose and send real messages, reply in-thread, and forward, directly from your mailbox, not as a draft you finish by hand.
- 03Schedule
Schedule for later
Queue a message to go out at the right time, so your agent can draft now and send on schedule.
- 04Organize
Move, copy, flag, archive, delete
Keep the inbox tidy: file mail into folders, flag what matters, archive the rest, or delete on request.
Connect Hushmail in four steps
From sign-up to first AI email in a couple of minutes.
Create your free mcpemails account
Sign up at mcpemails.com. The free plan connects one inbox, forever, with no card. You get an MCP URL and a key at the end of it.
Collect your security code if two-step verification is on
Sign into Hushmail webmail, open Preferences from the top-right menu, then the Security tab, and scroll to the section headed "Using a desktop or mobile email application". It shows a placeholder followed by a 20-letter code in four groups. If two-step verification is off, skip this step entirely and use your ordinary password.
Add the mailbox in mcpemails
Choose IMAP / SMTP and enter your full Hushmail address. In the password field enter your Hushmail password, then a space, then the four code groups exactly as shown, spaces included and no trailing space. Hosts are prefilled at imap.hushmail.com and smtp.hushmail.com.
Paste the MCP URL into your AI
Drop https://mcpemails.com/api/mcp into Claude, Cursor or ChatGPT, authorize, and your agent has the inbox.
Comparing providers first? See the email provider compatibility matrix
What actually goes wrong with Hushmail
Two-step verification turns your password into password-plus-code
This is the one that catches everybody. Hushmail does not issue app passwords. With two-step verification enabled, every IMAP and SMTP login expects yourpassword xxxxx xxxxx xxxxx xxxxx in a single field: your normal password, one space, then the 20-letter security code split into four groups by spaces. Get a group wrong, add a trailing space, or paste only the code and the server rejects you with an ordinary authentication failure that looks exactly like a bad password. The code lives in webmail under Preferences, Security tab.
Hushmail's IMAP server does not advertise SASL-IR
The server answers with a bare * OK IMAP4 ready and offers only AUTH=PLAIN, with no SASL-IR capability. That means it rejects the one-step authentication that sends credentials along with the AUTHENTICATE command, and clients that assume SASL-IR get a naked BAD with no explanation, which reads like wrong credentials. mcpemails detects the BAD and retries the two-step exchange, so this is already handled, but it is why some IMAP tooling fails against Hushmail while working everywhere else.
Mail you send through SMTP lands in Sent as ciphertext
Hushmail documents that when you send from a third-party client, your copy is saved to the Sent folder encrypted, even when the message itself went out unencrypted. So an agent asked to review what you sent last week will find encrypted blobs rather than readable text in that folder, while the same messages read fine in Hushmail webmail. Outbound messages sent via SMTP are also non-encrypted by default unless the recipient is a Hushmail user or already has a password set for encrypted delivery.
No MOVE and no SPECIAL-USE
Hushmail's IMAP server supports UIDPLUS but advertises neither MOVE nor SPECIAL-USE, and does not offer IDLE. Moves fall back to COPY, STORE \Deleted and EXPUNGE; folder roles are matched by name rather than by role; and there is no push, so new mail is noticed on the next poll rather than the instant it arrives.
Known limits with Hushmail
- Connecting a Hushmail mailbox to an AI client means that AI provider reads the message content. mcpemails fetches mail live from Hushmail per request and does not store message bodies, and credentials are encrypted at rest, but the text still reaches Claude, Cursor or whichever client you connect. Hushmail is heavily used by therapists and clinics operating under a HIPAA business associate agreement. That agreement covers Hushmail, not a third-party AI vendor, so a mailbox carrying patient information is a decision to make with your own compliance obligations in front of you, not a default.
- Encrypted Hushmail messages, including your own Sent copies written by a third-party client, are unreadable to an agent. It sees sender, subject and date, and can flag or file them, but not the body.
- There is no scoped credential to hand over. Hushmail has no app passwords, so the stored secret is your account password, or your password concatenated with the two-step security code.
Hushmail and AI: common questions
Does Claude work with Hushmail?
Not directly. Claude has no built-in Hushmail connector. Connecting an MCP server such as mcpemails to your Hushmail account over IMAP gives Claude read, search, send, reply, schedule and organize access, and the same connection works in Cursor and other MCP clients without repeating the setup.
What are the Hushmail IMAP and SMTP settings?
IMAP is imap.hushmail.com on port 993 with SSL. SMTP is smtp.hushmail.com on port 465 with SSL, and Hushmail documents port 587 as an alternative if 465 is blocked. The username is your full Hushmail email address in every case. Both hosts were verified from a live TLS connection.
Why does Hushmail reject my password in an email client?
Almost always two-step verification. Hushmail expects your password, then a space, then a 20-character security code, all typed into the one password field. Find the code in webmail under Preferences, then the Security tab, in the section about desktop and mobile email applications. Copy it with its internal spaces and do not leave a space at the end.
Does Hushmail issue app passwords?
No. Where other providers give you a revocable app password, Hushmail gives you a security code that is appended to your existing password. It is tied to your two-step verification setup rather than to the individual client, so you cannot revoke access to one connected application without affecting the others.
Can my AI read encrypted Hushmail messages?
No. Anything stored encrypted, which includes messages you sent through a third-party client, arrives over IMAP as ciphertext. mcpemails holds no decryption key for it. The agent can see the headers and can move or flag the message, but the content stays sealed and has to be read in Hushmail webmail.
Is my Hushmail mail stored on your servers?
No. Messages are fetched live from imap.hushmail.com for each request and passed to your AI client. Credentials are encrypted at rest; message bodies are not retained. The AI client itself does receive whatever it reads, which is the part worth weighing before you connect a mailbox that carries confidential client correspondence.
Give your AI a Hushmail inbox
Connect Hushmail in minutes. One inbox free forever, no card required.