Proton Bridge MCP.
Let an assistant work your Proton inbox, without handing your mail to anybody.
Proton end to end encrypts your email, so nobody but you can read it. Not Proton, not an advertiser, not an AI company. That's the whole reason to use it, and it's also why there's no API for an assistant to plug into. An API would mean your mail sitting on somebody else's server, and at that point the encryption was never worth much.
Proton Mail Bridge already solves this on your own machine. It decrypts locally and connects via ordinary IMAP and SMTP to your localhost loopback address. This server then sits on top of that, so an assistant can search, read, file, draft and reply to your mail without a single email leaving the computer it's already sitting on.
It's free, and it stays that way. The longer story of why it exists is in the Journal, Proton Bridge MCP, and the problem with encrypted mail.
Installation · Security · Questions · Source
What you'd use it for
Find out what came in overnight and what actually needs a reply. Get the total off a PDF invoice without opening it. Clear 100 newsletters into a folder while the kettle boils. Track down the message with the contract attached, in the thread you half remember, from 3 months ago.
It writes and it sends too, but never quietly. Anything that puts mail on the wire stops and asks you first, and it can only ever send as you.
If you build things
Thirty-odd MCP tools over IMAP and SMTP, against Bridge or any ordinary mailbox.
Three modes, readonly, organise and full. They remove tools rather than guard them, because a tool that isn't loaded can't be talked into running. Everything that changes something gets appended to an audit log, refusals included. Recipient addresses are tracked by where they were seen, so an address that only ever appeared inside a message body can't be written to, which closes the obvious route for an instruction buried in a PDF to mail your invoices to whoever wrote it.
Under the Apache 2.0 licence you can copy the code, build onto it, ship it commercially and owe nothing back.
What it won't do
Bridge is a paid Proton feature, so a free account can't use this. Point it at an ordinary mailbox instead and everything still works, but the part about your mail never leaving your machine stops being true, and that part was Proton doing the work rather than anything here.
Nothing completely deletes, Trash is as far as it goes. Folders can be created but not removed, because deleting one would have to decide what happens to the mail inside it. Proton's server-side filters stay a job for the web app.
Unofficial, and not affiliated with or endorsed by Proton AG.
Installation · Security · Questions · Source
Other mail providers
Bridge is what this was built for, and it's the case with no alternative, since Proton has no API to point anything else at. The rest of it is ordinary IMAP and SMTP though, so it works against a normal mailbox too, which is useful if your business mail comes from a smaller host rather than Google or Microsoft.
Labels are the one place the two differ. Proton keeps them in their own namespace, so Marketing and Labels/Marketing both work and mean the same thing. An ordinary IMAP server has no such idea, so a label there is just another folder and tagging copies the message into it. The server works out which kind it's talking to rather than assuming, and if the name matches nothing it tells you what does exist.
Set the hostname and ports to whatever your provider gave you. There's no autodiscovery here. Nothing guesses the server name from your email domain, and there's no lookup of the usual mail. records, so you enter the exact values from your provider's IMAP/SMTP settings page, for example mail.lcn.com with its IMAP and SMTP ports. Once you've typed the name your operating system resolves it to an address the normal way. What isn't automated is working out *which* name to use. Security is worked out from the port, 993 and 465 mean TLS from the first byte, 143 and 587 mean it gets negotiated, and you can say which explicitly if your host is unusual. Plain unencrypted connections aren't offered, since sending your password in clear isn't a trade worth making.
Go in with your eyes open on one thing. Every guarantee in Security still holds except the first one, because your mail now lives on a server you don't control and travels over the internet to get here. That's a fair trade if the alternative is no assistant access at all, it just isn't the same promise.