io.github.Creativestefan/mailbridge

The materials state there are no environment variables or API keys, but accessing email over IMAP/SMTP typically still requires mailbox credentials or an app-specific password. Such credentials are sensitive and misconfiguration could allow mailbox reading or sending mail on the user's behalf. No evidence is shown of requesting credentials beyond normal email access.

The description indicates the tool connects to email infrastructure (IMAP/SMTP) to read and send mail, so normal network traffic to the user's mail provider is expected. The materials do not declare any additional third-party collection endpoint, and there is no red flag suggesting data exfiltration to unrelated services.

The system flags that this MCP executes code / runs a local process, which is a normal characteristic of MCP tools. The provided materials do not show a need for dangerous system privileges or high-privilege operations unrelated to its email function.

By description, the tool can read, search, send, and organize email, so it may access sensitive content such as message bodies, attachments, contacts, and email metadata; this is a normal access scope for its stated purpose. The materials do not indicate extra access to unrelated local files or obviously excessive permissions.

It comes from an official registry, has an auditable open-source repository, and was updated within the last year; these are positive trust signals that lower risk. Community adoption is low and the license is not stated, so the repository and dependencies should still be reviewed, but no clear supply-chain red flag is evident from the provided materials.