Pod

Yes, this is on purpose. Pod is built for agents, so the default page is plain HTML.
Human? View the normal website.
Agent? You probably prefer /mcp/imap-mcp-pro/issues.md or /mcp/imap-mcp-pro/issues.json, or Pod over MCP.

Reported issues for IMAP MCP Pro

Pod holds 24 of 155 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to IMAP MCP Pro.

Most discussed

Aikido security audit: triage + remediate repo findings (deps, prototype-pollution, CI integrity, XSS)

Source

Aikido dashboard full-repo scan (provided by maintainer; MCP feed-listing is disabled for the workspace).

Triaged findings

# Finding Sev Verdict Remediation
1 Secret as CLI option — distributions/osx/scripts/{notarize,setup-notarize}.sh High False positive — xxxx-xxxx placeholders + user-supplied --password; Team ID/Apple ID public Optional hardening: accept password via env/stdin, not --password arg (process-list leakage)

Read the thread · 2026-06-21 · open · 6 comments

Add local email export to standard files (.eml) with attachments — single/folder/whole-mailbox

Goal

Add a feature to export IMAP emails to standard message files (.eml / RFC822) with attachments preserved, plus bulk/folder/whole-mailbox modes, attachment extraction, and search-based selection — all processed locally (no cloud), suitable for closed systems.

Format: .eml (RFC822) is the deliverable — a standard, lossless, portable format that every major mail client (Outlook, Thunderbird, Apple Mail) opens. .msg (Outlook) is explicitly out of scope. Optionally sup

Read the thread · 2026-06-20 · closed · 3 comments

Add DNS Firewall Provider Configuration UI

Overview

Add configuration interface for DNS firewall providers with support for multiple validation services beyond Quad9.

Requirements

Database Schema

Read the thread · 2025-11-08 · closed · 3 comments

Implement full service management with Web UI integration

Implement Full Service Management with Web UI Integration

Problem

Currently, make start/stop/restart/status are stubs that don't actually manage services. The Web UI must be started manually and isn't integrated with the service management system.

Requirements

1. Service Templates

Create service configuration files for each platform:

macOS (LaunchAgent/LaunchDaemon)

Read the thread · 2025-11-06 · closed · 3 comments

Cross-Platform Installation System with Makefile

Objective

Create a comprehensive cross-platform installation system using Makefiles that handles system service setup, admin account creation, authentication, and automatic updates.

Background

Currently, installation is manual and requires users to configure system services themselves. This issue implements a production-ready installation system with:

Read the thread · 2025-11-05 · closed · 3 comments

Documentation cleanup: re-sync README / manifest / docs / wiki (tool count, keyring claim, new tools, license)

Goal

Clean up and re-sync the repo documentation (README, .mcpb manifest, docs/, and the GitHub Wiki) — a lot has drifted as features/licensing/dependencies changed.

Known drift / inaccuracies (audit + fix)

Counts & capabilities

Read the thread · 2026-06-21 · closed · 2 comments

Publish to the MCP Registry (single universal .mcpb)

Goal

Publish IMAP MCP Pro to the official MCP Registry (registry.modelcontextprotocol.io) as a discoverable registryType: mcpb server distributed via GitHub Releases.

Decision record: single universal bundle

Research (and the #181 native-dep removal) settled the per-platform question:

Read the thread · 2026-06-21 · closed · 2 comments

Track B: Local message cache for SQL-backed reads + FTS5 body search

Track B: Local message cache + SQL access for bulk reads

Sibling issue: #117 (Track A — job persistence for long-running bulk ops). The two tracks compose; strategy comparison below. This issue focuses only on caching message data in SQLite for fast repeat reads, SQL aggregation, and full-text search.

Motivation

Today every read tool against a large folder pays full IMAP cost: fetch wire bytes, parse, return through Claude's context window. Re-running the same query an hour later

Read the thread · 2026-04-30 · open · 2 comments

Most recent

Extension data dir defaulted to ~/.imap-mcp-pro (split account store) + no duplicate-instance guard

Bug — extension used a different data store than everything else

The Claude Desktop extension defaulted its Data Directory to ~/.imap-mcp-pro, while server-config.ts, the CLI, the launchd Web UI service, getOutboxDir, and the encryption-key sidecar all use ~/.imap-mcp. Result: an account added via one entry point (e.g. the Web UI service, DB at ~/.imap-mcp/data.db) is invisible to the extension's MCP session (reading ~/.imap-mcp-pro/data.db) — different DB, and even a diff

Read the thread · 2026-07-12 · closed · 0 comments

Account lifecycle on FTS5-less builds: delete fails (no such module: fts5) + no duplicate-account guard

Two account-lifecycle robustness bugs found in Windows testing.

Bug 1 — Failed to delete: no such module: fts5 when deleting an account

node:sqlite enables foreign keys by default, so DELETE FROM accounts cascades into messages_cache (FK ON DELETE CASCADE). That fires the messages_cache_fts_ad trigger, which touches the messages_cache_fts FTS5 virtual table. On a SQLite build compiled without FTS5 (seen on some Windows Node builds), any FTS operation throws `no such mod

Read the thread · 2026-07-12 · closed · 0 comments

Submission prep: narrow declared platforms to tested (macOS + Windows)

For the Anthropic Desktop Extensions submission, declare only platforms we actually test. Linux is out of scope for now (untested), though the pure-JS runtime still runs there.

Read the thread · 2026-07-08 · closed · 0 comments

imap_test_quad9_dns reports Quad9 unreachable when it's actually reachable (false negative)

Summary

imap_test_quad9_dns reports Quad9 unreachable (quad9Active: false, reachable: false) on a host where Quad9 DoH is actually reachable and serving production lookups just fine. Same host, same session: imap_check_domain_dns_firewall { domain: "example.com" } succeeds against Quad9 in 223 ms and returns provider: "quad9", isSafe: true.

Version

Observe

Read the thread · 2026-07-08 · open · 0 comments

Concurrency race: folder-scoped tools return cross-contaminated data under parallel calls

Summary

Folder-scoped read tools return cross-contaminated / incorrect data when multiple tool calls execute concurrently against a single account's shared IMAP connection. IMAP selected-folder state from one in-flight command leaks into another, producing wrong counts and wrong search results. Data is correct when the same calls run sequentially.

Version

Steps to repr

Read the thread · 2026-07-08 · closed · 1 comment

imap_list_categories fails: no such table: categories (missing schema migration)

Summary

imap_list_categories fails with a SQLite error: the categories table does not exist in the database.

Version

Steps to reproduce

  1. Call imap_list_categories (with or without an accountId filter).

Actual result

{
  "success": false,
  "error": "no such table: categories",
  "errorType": "Error",
  "errorCode": "ERR_SQLITE_ERROR",
  "details": {}
}

Reproduced on two consecutive runs.

Exp

Read the thread · 2026-07-08 · closed · 1 comment

imap_folder_status crashes: TypeError: Do not know how to serialize a BigInt

Summary

imap_folder_status throws TypeError: Do not know how to serialize a BigInt and returns a failure envelope instead of folder statistics.

Version

Steps to reproduce

  1. imap_connect to an account.
  2. Call imap_folder_status with folder: "INBOX".

Actual result

{
  "success": false,
  "error": "Do not know how to serialize a BigInt",
  "errorType

[Read the thread](https://github.com/Temple-of-Epiphany/imap-mcp-pro/issues/278) · 2026-07-08 · closed · 0 comments

### Release hygiene: universal-only build + delete malformed draft v2.8.1

Make the release story consistent.

**Done:** Deleted the malformed **draft `v2.8.1`** (duplicate, `draft=true`, bogus `0001-01-01` date). The real published v2.8.1 is untouched.

**This PR:**
- `dxt/build.mjs` → **universal-only**: remove the dead per-platform mode (`platformLabel`, `--universal`, `--skip-rebuild`). Since v2.16 the runtime is pure JS (node:sqlite, no native deps), so the output is always one universal `.mcpb`; the per-OS mode produced identically-behaving bundles under `-linux-

[Read the thread](https://github.com/Temple-of-Epiphany/imap-mcp-pro/issues/276) · 2026-07-06 · closed · 0 comments

### make update-extension — one-command update of the installed Claude Desktop .mcpb

## Problem
`make install` / `make update` only manage the launchd **Web UI service** (`~/.local/share/imap-mcp-pro`). They do **not** touch the **Claude Desktop extension** (`~/Library/Application Support/Claude/Claude Extensions/local.mcpb.colin-bitterfield.imap-mcp-pro`). Because the extension is a *local* `.mcpb` (not installed from the Anthropic directory), Claude Desktop never auto-updates it, so it silently drifts many versions behind the Web UI / registry.

## Ask
Add a `make update-exten

[Read the thread](https://github.com/Temple-of-Epiphany/imap-mcp-pro/issues/272) · 2026-07-05 · closed · 0 comments

### Export: direct write to a user path (destPath) instead of outbox-then-relocate

## Need
Export tools (`imap_export_email`, `imap_export_folder`, `imap_export_account`) can only write under the per-user MCP outbox (`~/.imap-mcp/users/{userId}/outbox/exports/[subfolder]/`). The real requirement is a **direct write to a user-chosen path** (e.g. `~/Downloads/sent-mail`) — *not* export-to-outbox-then-relocate.

## Decision
Add an optional `destPath` (absolute) to the three export tools. When supplied, `.eml` files are written **directly** to that path (folder/account exports sti

[Read the thread](https://github.com/Temple-of-Epiphany/imap-mcp-pro/issues/270) · 2026-07-04 · closed · 0 comments

### Bundled skill never auto-installs from the .mcpb — skills manifest path resolves to server/skills (should be dist/skills)

## Summary
The bundled-skill **auto-install never runs inside the packaged `.mcpb`** — the skills installer looks in the wrong directory, so `manifest.json` is effectively "missing" and no skill is installed to `~/.claude/skills/imap-mcp-pro/`.

## Root cause
`src/index.ts` resolves the bundle dir as:
```ts
const bundleSkillsDir = path.join(__dirname, '..', 'skills'); // lines 151 and 293

Read the thread · 2026-07-04 · closed · 0 comments

Combined spam scan (UserCheck + DNS + allow/deny) + safe Junk-move for DNS firewall

  1. DNS firewall autoMarkSpam should MOVE to a Junk folder (reversible), not set \Deleted. 2. Wire per-user allow/deny lists into spam decisions. 3. Add a route that scans a block of messages against both engines.

Read the thread · 2026-07-04 · closed · 0 comments

Sent-copy fails: send path doesn't auto-connect IMAP; APPEND to INBOX.Sent errors 'Command failed' (Hostinger)

Summary

Live test against Hostinger (colin@bitterfield.com, imap.hostinger.com) shows SMTP send succeeds but the copy does not land in the IMAP Sent folder. Two distinct problems:

1. Send path doesn't ensure an IMAP connection for the append

Calling imap_send_email when the account is not connected returns:

result: "sent_not_archived", archiveSkipped: "no-sent-folder-found"

The SMTP send self-connects, but the Sent-append relies on an existing IMAP connection; `reso

Read the thread · 2026-07-04 · closed · 1 comment

Per-account email signatures

Add per-account signatures (plain text + optional HTML), appended to outgoing mail by imap_send_email unless suppressed. Tools to set/get; migration adds signature_text/signature_html to accounts.

Read the thread · 2026-07-04 · closed · 0 comments

MCP Desktop Extensions directory submission prep

Goal

Prepare the .mcpb for submission to the Anthropic Desktop Extensions directory (clau.de/desktop-extention-submission), per the submission requirements.

Requirements → status

Read the thread · 2026-07-04 · closed · 0 comments

UserCheck bulk scans don't dedupe by address or consult the cache (redundant API calls)

Problem

UserCheck is billed/rate-limited per email address, but the bulk spam tools re-check the same sender repeatedly:

  1. imap_check_folder_spam and imap_scan_account_spam never read the cache. They call UserCheckService.checkEmailsBatch(), which looped checkEmail() → API with no getCachedResult() consult. So every run re-hits UserCheck for every sender, and imap_scan_account_spam re-checks the same sender once per folder (a sender in INBOX+Archive+Sent = 3 calls/r

Read the thread · 2026-06-23 · closed · 0 comments

The remaining reports are on the project's issue tracker.