Read-only access

What a read-only connection can do

• It holds the read:email permission, and optionally search:email, which adds nothing on top.
• It can list, read and search messages, download attachments, and list inboxes and folders.
• It cannot send, reply, draft, move, flag, mark as read, delete, schedule or create automations.

How to choose it

• When you connect an AI client, the consent screen offers access levels. Pick Read-only ("Read and search your mail. Can't send, change, or delete anything.") or open Customize permissions and grant read only. You can also limit the connection to some of your inboxes.
• ChatGPT opens this screen on Full access, because it cannot come back and ask for more access later. Select Read-only before you click Allow access.
• API keys created in the dashboard can be limited to the same permissions.

How the limits are enforced

• Every tool call is checked against the connection's permissions before we contact your mail server. A call outside the grant is refused with insufficient_scope.
• On IMAP mailboxes, a read-only connection opens each folder with EXAMINE, the read-only form of SELECT. Your mail provider then refuses any flag change, move or delete in that session, whatever our code does.
• Messages are fetched with BODY.PEEK, so reading a message never marks it as read. This holds for every connection, not only read-only ones.
• The reading tool never changes your mailbox. Its old mark_as_read option was removed; marking as read is a separate action that needs the manage:folders permission.
• AI clients that sign in with OAuth see the full tool list, so they can ask you for more access. Those calls still fail until you grant it.

What happens when you connect

• We open a TLS connection, verify the server's certificate, sign in once to check your password or app password, and sign out.
• Nothing is downloaded, copied or indexed. Messages are fetched from your provider only when a tool asks for them.
• Background work runs only for automations and scheduled sends, and both need write permissions a read-only connection does not have.
• If you never want to send from the address, choose Advanced settings → Connection type → Receive only (IMAP) when you connect it. No SMTP server is configured or contacted.

Searching large mailboxes

• On IMAP mailboxes, search runs on your provider's server with IMAP SEARCH. We download only the page of results that was asked for, up to 100 messages, and the AI pages through the rest.
• Search covers the inbox unless a folder is named, because searching every folder of a large account is slow.
• Each search has a 30-second limit. On a mailbox with tens of thousands of messages, narrow a broad search by sender, subject or date.

Check it yourself

mcpemails is open source. These files implement and test what this page describes:

• imap-read-only.ts EXAMINE for read-only connections
• imap-read-only.test.ts Tests for EXAMINE, including the provider refusing a flag change
• scopes.ts The permission list
• argument-aliases.ts Removal of mark_as_read from the reading tool
• imap-client.ts The IMAP client: every body fetch uses BODY.PEEK