How to Connect Email to MCP: Gmail, Outlook, IMAP and JMAP

Short answer: An MCP client needs an MCP server that connects to email through IMAP and SMTP, or JMAP. Major providers require an app password, an API token or OAuth. Give the agent only the access it needs. In Gatana, select a provider preset. Each user then connects their own mailbox.

The three parts of the setup

Part	What it does	Options
1. Protocol	Connects the MCP server to the mail server	IMAP with SMTP, or JMAP
2. Sign-in	Gives the MCP server access to one user’s mailbox	App password, API token or OAuth
3. Access limit	Controls which email tools the agent can use	Read, organize, or send

Your provider determines the available protocols. Your provider and organization set the sign-in requirements. You choose which actions the agent can perform to limit the risk.

IMAP or JMAP

Almost every email provider supports IMAP. It reads and organizes mail, but it cannot send. An agent that sends also needs an SMTP server.

JMAP uses JSON over HTTPS to read, organize and send mail. Fewer providers support it.

	IMAP with SMTP	JMAP
Standard	RFC 9051 (IMAP4rev2); many servers implement RFC 3501 (IMAP4rev1)	RFC 8620 (core) and RFC 8621 (mail)
Connection	TCP with TLS on port 993; SMTP on port 465 or 587	HTTPS
Sending	A separate SMTP server	In the same protocol
Sign-in	Username and password, or OAuth through SASL XOAUTH2	Usually a bearer token
Supported by	Gmail, Microsoft 365, iCloud Mail, Fastmail and almost all self-hosted servers	Fastmail, Stalwart, Cyrus IMAP and Apache James

Use JMAP when the provider supports it. Use IMAP for all other providers.

Settings for the common providers

These settings come from provider documentation read on 27 October 2026. The Gatana presets use the same values.

Provider	Protocol	Incoming	Outgoing	Sign-in
Gmail	IMAP and SMTP	imap.gmail.com, port 993, TLS	smtp.gmail.com, port 465, TLS	App password or OAuth
Microsoft 365	IMAP and SMTP	outlook.office365.com, port 993, TLS	smtp.office365.com, port 587, STARTTLS	OAuth only
Fastmail	JMAP	Session URL https://api.fastmail.com/jmap/session	The same JMAP session	API token
iCloud Mail	IMAP and SMTP	imap.mail.me.com, port 993, TLS	smtp.mail.me.com, port 587, STARTTLS	App-specific password
Other IMAP server	IMAP and SMTP	Your host, usually port 993, TLS	Your host, port 465 with TLS or 587 with STARTTLS	Username and password, or an app password
Other JMAP server	JMAP	Session URL, often https://<host>/.well-known/jmap	The same JMAP session	Usually a bearer token

Gmail

• Since 14 March 2025, Google refuses the account password for IMAP, SMTP and POP. This applies to every Google Account, including personal Gmail.
• App passwords still work. An app password requires 2-Step Verification. Google Workspace policy can block this option.
• IMAP is always on for personal accounts. In Google Workspace, an administrator can turn IMAP off for users.
• For OAuth, IMAP and SMTP accept one scope: https://mail.google.com/. Google classifies it as a restricted scope.
• An OAuth app with the External user type needs Google verification for a restricted scope. An app that stores or transmits Gmail data on servers also needs a security assessment.
• In Google Workspace, set the OAuth consent screen user type to Internal. These apps do not need Google verification. Only accounts in your organization can sign in.
• A personal Gmail account cannot use an internal app. An external app in Testing status gets refresh tokens that expire after 7 days. For personal accounts, an app password is the practical choice.

Microsoft 365

• Exchange Online started to turn off Basic authentication for IMAP and POP on 1 October 2022. It is now off in all tenants and cannot be enabled again. IMAP requires OAuth.
• Register an app in Microsoft Entra ID. Add the delegated permissions IMAP.AccessAsUser.All and SMTP.Send. Also request offline_access to get a refresh token.
• Sending uses SMTP AUTH on port 587. Microsoft recommends that you disable it for the organization and enable it only for mailboxes that need it.
• To turn it on for a mailbox, open the Microsoft 365 admin center. Go to Users → Active users, select the user, then Mail → Manage email apps → Authenticated SMTP.
• If security defaults are on in Microsoft Entra ID, SMTP AUTH is off in Exchange Online.
• Microsoft turns off Basic authentication for SMTP AUTH by default at the end of December 2026. OAuth sign-in is the replacement and continues to work.

Fastmail

• Fastmail supports JMAP. The session URL is https://api.fastmail.com/jmap/session.
• Create an API token in Settings → Privacy & Security → Manage API tokens. The client sends it as Authorization: Bearer <token>.
• Give the token access to mail. Allow sending only if the agent must send.
• Fastmail describes API tokens as the method for personal use. For OAuth, Fastmail must manually register the client.
• IMAP also works, with an app password: imap.fastmail.com on port 993 and smtp.fastmail.com on port 465.

iCloud Mail

• iCloud Mail requires an app-specific password. Create it at account.apple.com under Sign-In and Security → App-Specific Passwords. The Apple Account must use two-factor authentication.
• Apple specifies different usernames for IMAP and SMTP. IMAP usually uses the part before the @ sign; SMTP uses the full email address. For IMAP, use the full address if the short name fails.
• A client with one username for IMAP and SMTP must use the full address.

Other IMAP and JMAP servers

• Use port 993 with TLS for IMAP. On port 143, require STARTTLS. A client that continues without TLS sends the password as plain text.
• For SMTP, use port 465 with TLS, or port 587 with STARTTLS. RFC 8314 recommends implicit TLS.
• A JMAP server publishes its session resource at /.well-known/jmap. Most JMAP servers accept a bearer token.
• Self-hosted servers often accept the normal password. Use an app password if the server offers one.

Decide what the agent may do

An email agent can read private data and messages from strangers. If it can also send mail, an attacker can put instructions in a message that tell it to share private data. An agent that follows those instructions can send data to the attacker, including in a reply.

Access level	The agent can	Use it for
Read only	List folders, search, read messages and attachments	Summaries, search and data extraction
Read and organize	Also flag, move and trash messages, and create drafts	Triage, and reply drafts that a person sends
Read, organize and send	Also send messages and replies	Mailboxes that receive only trusted mail, and tasks that you monitor

Rules that reduce the risk:

1. Start with read only, or with read and organize.
2. Let the agent write drafts. A person reviews and sends them.
3. Do not give the agent a tool that permanently deletes messages. Use Trash so a person can restore them.
4. Give each user their own credentials. Each agent then sees only the mailbox of its user.
5. Record every tool call to see what the agent read and sent.

How it works in Gatana

Gatana connects directly to the mail server and provides the email tools. You do not need to host a separate email MCP server. The agent connects to Gatana as it would to any MCP server.

Add the mailbox

1. Open Servers, add a server and select Email.
2. Select a provider: Gmail, Microsoft 365, Fastmail, iCloud Mail, Other (IMAP) or Other (JMAP). The preset fills in the connection settings.
3. For Other (IMAP), enter the IMAP host. To allow sending, also enter the SMTP host. For Other (JMAP), enter the session URL.
4. Select an authorization method if the provider offers a choice. Gmail has two: app password and OAuth.
5. Select the access scope, then create the server.
6. For OAuth, enter the client ID and secret of your Google or Entra app in the Settings tab of the server.
7. Each user opens Credentials and connects their own mailbox. When a tool call needs credentials, the agent can also give the user a connection link.

The CLI creates the same server in one command:

gatana create server email gmail --login password --access organize

The other presets are microsoft365, fastmail, icloud, imap and jmap.

Preset settings

Preset	Connection	Sign-in	Other settings
Gmail	IMAP 993 TLS, SMTP 465 TLS	App password, or Google OAuth with the scopes openid email https://mail.google.com/	OAuth requests offline access and consent, which Google requires to issue a refresh token. Does not save an extra copy in Sent because Gmail saves sent mail
Microsoft 365	IMAP 993 TLS, SMTP 587 STARTTLS	OAuth only, with IMAP.AccessAsUser.All, SMTP.Send and offline_access	Replace organizations in the issuer and endpoint URLs with your Directory (tenant) ID. Does not save an extra copy in Sent
Fastmail	JMAP session URL	API token, sent as a bearer token	If the token cannot send, set the access scope to Read and organize
iCloud Mail	IMAP 993 TLS, SMTP 587 STARTTLS	App-specific password	Saves a copy in Sent
Other (IMAP)	IMAP 993 TLS, SMTP 465 TLS	Username and password	Without an SMTP host, the server cannot send. Ports and encryption can be changed in Settings
Other (JMAP)	Your session URL	API token, sent as a bearer token	You can change the header format and JMAP account in Settings

You cannot change the protocol of a server after you create it. To switch between IMAP and JMAP, create another server.

The tools

Tool	Minimum access	What it does
list_mailboxes	Read	Lists folders, their roles and message counts
search_messages	Read	Finds messages in one folder by text, sender, recipient, subject, date, read status or flag
get_message	Read	Reads the headers and body, and lists the attachments
get_attachment	Read	Reads one attachment, up to 1 MB by default and 10 MB at most
set_flags	Organize	Marks messages as read or unread, and flags or unflags them
move_messages	Organize	Moves messages to another folder
trash_messages	Organize	Moves messages to Trash
create_draft	Organize	Saves a plain-text message or reply in Drafts
send_message	Send	Sends a plain-text message or reply

No tool deletes a message permanently.

How Gatana handles tool calls

• It uses the credentials of the user who calls the tool.
• It refreshes an expired OAuth token. If the mail server refuses a token, Gatana refreshes it once and tries the call again.
• It reads a message without marking it as read.
• It returns the body as plain text, up to 20,000 characters by default. On request, it converts the HTML body to Markdown.
• On Gmail, the search_messages text filter accepts Gmail search syntax.
• The tool descriptions tell the agent that message content is data, not instructions.
• For IMAP, it provides send_message only when the server has an SMTP host.
• In Gatana Cloud, it refuses mail servers on private network addresses. Self-hosted installations can connect to internal mail servers.
• It records each tool call in the audit log. A tool firewall rule can deny send_message for some users or teams.

Use profiles to give different clients different mailboxes. The email documentation has the full reference, including search limits and reply headers.

Sources

Read on 27 October 2026:

• Google: transition from less secure apps to OAuth, set up Gmail with a third-party email client, IMAP and SMTP with XOAUTH2, Gmail API scopes, OAuth production readiness, refresh token expiration
• Microsoft: deprecation of Basic authentication in Exchange Online, enable or disable SMTP AUTH, authenticate IMAP and SMTP with OAuth, updated SMTP AUTH Basic authentication timeline
• Fastmail: developer documentation
• Apple: iCloud Mail server settings, app-specific passwords
• IETF: RFC 9051, RFC 3501, RFC 8620, RFC 8621, RFC 8314
• Simon Willison: the lethal trifecta for AI agents
• Gatana: email tools, credentials, pricing