io.github.n24q02m/better-email-mcp

It requires EMAIL_CREDENTIALS to access email accounts, which are highly sensitive secrets. The materials do not describe storage, scope restriction, or rotation controls, so leakage should be assumed to enable email read/send abuse.

No fixed remote host is declared, but as an IMAP/SMTP email server tool it will necessarily send email-related data to user-configured mail servers. There is no explicit evidence of unrelated third-party exfiltration or suspicious unknown endpoints in the provided material.

System checks indicate it executes code / runs a local MCP service process, which is a normal capability for this type of tool. The available materials do not show requests for unusual system privileges or high-risk actions unrelated to email functionality.

By function, it likely accesses mailbox contents, sending capability, and multi-account configuration data, potentially including message bodies, contacts, attachments, and account settings. The materials do not describe least-privilege design or local data access boundaries, so account scope should be tightly limited.

It comes from an official registry and has a public GitHub repository with updates within the last year, which are positive risk-reducing signals. However, the README is missing, the license is unspecified, and community adoption is very low (0 stars), so auditable context remains limited and source/dependency review is advisable before use.