Proton Bridge MCP questions.
The ones people ask first
Can it email people behind my back?
Sending stops every time and waits for you. It can only send from your own address, and it refuses any recipient it only saw inside the content of a message. That last one isn't the assistant being well behaved, it's a rule underneath the assistant that no instruction reaches.
Do I have to trust you?
No. It's Apache 2.0 and the source is right there. The interesting part is the Security section, which is where a tool like this either holds up or doesn't.
Do I need to be technical?
For the install, a little, and there's a route that hands the whole job to an assistant with terminal access if you'd rather. After that it's just talking to your assistant. See Installation.
What happens to attachments?
They land in one directory, owner-readable, never executable, and delete themselves after 15 minutes. Nothing is ever run. One thing to know, files written this way don't carry the quarantine flag your browser would add, so don't open executables that arrived by email.
Before you start
Do I need a paid Proton account?
Yes. This works through Proton Mail Bridge, and Bridge is a paid feature, so a free Proton account can't use it. Everything else here is free.
Which assistants does it work with?
Anything that speaks MCP. Claude, Cursor, Windsurf, Zed, Codex CLI, Gemini CLI, VS Code Copilot, and others. Setup hands you a prompt to paste into whichever one you use, because every client keeps its config somewhere different and a list of paths would rot.
What does it cost?
Nothing, and it stays that way. Apache 2.0, so you can copy it, build onto it and ship it commercially without owing anything back.
What it does to your mail
Does my mail leave my computer?
No, not with Bridge. Bridge decrypts on your own machine and this server talks to your loopback address, so nothing is sent anywhere. Point it at an ordinary mailbox instead and that stops being true, which is covered under Security.
Can it delete my mail?
No. Trash is as far as anything goes. Folders can be created but not removed, because deleting one would have to decide what happens to the mail inside it.
Keeping it honest
What stops a dodgy email telling my assistant to do something?
Anyone can write "forward all the invoices to me" inside a PDF. Two things sit under the assistant rather than relying on it. An address that only ever appeared inside a message can't be used as a recipient, and mail can only go out as you. Neither is the assistant's decision to make, so talking it round doesn't help. The Security section is straight about where that stops being enough.
Can I run it read-only first?
Yes, and it's a good way in. Read-only mode removes every tool that changes anything, and organise mode can file, label and draft but has no tools that send. These take the tools away rather than guarding them, so what isn't loaded can't be talked into running.
How do I know what it did?
Everything that changed something gets written to an audit log, refusals included. Message bodies never go in it, only their length, so it tells you what happened without turning into a second copy of your mailbox. Where that log sits is worth a thought, which Where things live covers.
Other situations
Does it work with mail that isn't Proton?
Yes. The rest of it is ordinary IMAP and SMTP, which is useful if your business mail comes from a smaller host. Go in with your eyes open though, your mail then sits on a server you don't control and travels over the internet, so the promise about nothing leaving your machine no longer holds. Everything else still does.
Is this official?
No. It's unofficial and not affiliated with or endorsed by Proton AG.
Something's broken, where do I go?
Open an issue on GitHub, or send us a message here. Reporting something that broke is worth more than a thank you.