AgentStack
MCP verified MIT Self-run

Yahoo Mail Mcp

mcp-hugo-cornu-yahoo-mail-mcp · by hugo-cornu

MCP server for Yahoo Mail over IMAP — read, triage, drafts (no sending). Keychain auth, 11 tools.

No reviews yet
0 installs
5 views
0.0% view→install

Install

$ agentstack add mcp-hugo-cornu-yahoo-mail-mcp

✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.

Security review

✓ Passed

No issues found. Passed automated security review. · v0.1.0 How review works →

  • Prompt-injection patterns
  • Secret / credential exfiltration
  • Dangerous shell & filesystem operations
  • Untrusted network calls
  • Known-malicious package signatures

What it can access

  • Network access Used
  • Filesystem access No
  • Shell / process execution No
  • Environment & secrets No
  • Dynamic code execution No

From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.

View the full security report →

Verified badge

Passed review? Show it. Paste this badge into your README — it links to the public security report.

AgentStack Verified badge Links to your public security report.
[![AgentStack Verified](https://agentstack.voostack.com/badges/verified.svg)](https://agentstack.voostack.com/security/report/mcp-hugo-cornu-yahoo-mail-mcp)

Reliability & compatibility

Security review passed
0 installs to date
no reviews yet
1mo ago

Declared compatibility

Claude CodeClaude DesktopCursorWindsurf

Compatibility is declared by the source manifest. End-to-end runtime verification is coming — see below.

Preview Execution monitoring

We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps — measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.

How agent discovery & health will work →
Are you the author of Yahoo Mail Mcp? Claim this listing to set pricing, connect Stripe payouts, and keep 70% of every sale.
Sign up to claim

About

yahoo-mail-mcp

[](LICENSE) [](package.json) [](https://modelcontextprotocol.io)

MCP server for Yahoo Mail over IMAP. Read, search, triage, folders/labels, trash, permanent deletion (with a safety guard), and draft creation. Never sends email.

Works with Claude Code, Claude Desktop, and any MCP-compatible client.

Why IMAP?

Yahoo has no public REST API for mail, and mail OAuth is closed to individual developers. The official path is IMAP (imap.mail.yahoo.com:993) with an app password.

Setup

1. Get a Yahoo app password

  • Enable two-step verification on your Yahoo account (required)
  • Go to Account → Security → "Generate app password" and copy the 16 characters

2. Store the password securely

On macOS, store it in the Keychain (never in plain-text config):

security add-generic-password -s yahoo-mail-mcp -a "" -w ""

On other platforms, set the YAHOO_APP_PASSWORD environment variable instead (the Keychain lookup is tried first, then this fallback).

3. Install

git clone https://github.com/hugo-cornu/yahoo-mail-mcp.git
cd yahoo-mail-mcp
npm install

4. Register with your MCP client

Claude Code (user scope → available everywhere):

claude mcp add --scope user yahoo-mail --env YAHOO_USER= \
  -- node /path/to/yahoo-mail-mcp/src/server.js

claude mcp list   # yahoo-mail should show as "connected"

Claude Desktop — add to claude_desktop_config.json:

{
  "mcpServers": {
    "yahoo-mail": {
      "command": "node",
      "args": ["/path/to/yahoo-mail-mcp/src/server.js"],
      "env": { "YAHOO_USER": "" }
    }
  }
}

Tools (11)

| Tool | Type | Description | |---|---|---| | list_folders | read | Folders + roles (Yahoo spam = "Bulk Mail") | | mailbox_stats | read | Message/unread counts per folder | | search_emails | read | Search by folder/from/subject/unseen/dates, paginated, newest first | | read_email | read | Headers + text body, attachments listed (not downloaded) | | mark_read / mark_unread | write | Batch \Seen flag | | move_emails | write | Batch move (archive, spam, custom folder) | | create_folder | write | Create a folder | | trash_emails | write | Move to Trash (recoverable ~30 days) | | delete_emails | destructive | Permanent deletion — requires confirm: true | | create_draft | write | Draft in Drafts folder (sending is impossible by design) |

Design notes

  • Single persistent IMAP connection, serialized operations (mutex) — Yahoo caps

at ~3 connections and rate-limits bulk FETCH (fetches are chunked at 50 with exponential-backoff retry).

  • UIDs are per-folder: UIDs from search_emails are only valid for that folder

and while uidValidity is unchanged. Every batch operation takes {folder, uids[]}.

  • Folders are resolved explicitly via LIST (Yahoo's SPECIAL-USE is unreliable); the

role names inbox/sent/drafts/trash/spam/archive are accepted everywhere.

  • Secrets live in the macOS Keychain only (security find-generic-password at

startup). Dev fallback: YAHOO_APP_PASSWORD env var.

  • The IMAP core is generic (connection.js is parameterized by an account

object) → multi-account support is possible later.

Troubleshooting

  • Auth failed: regenerate the app password; your regular Yahoo password does

not work over IMAP.

  • Rate-limited: lower limit, retry after a moment.
  • Logs: written to stderr (view with claude mcp logs yahoo-mail, or run

YAHOO_USER= node src/server.js manually).

License

[MIT](LICENSE)

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

Install and usage instructions live in the source repository linked above.

Reviews

No reviews yet — be the first.

Versions

  • v0.1.0 Imported from the upstream source.