# Reported issues for IMAP MCP Pro

Pod holds 24 of 155 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [IMAP MCP Pro](/mcp/imap-mcp-pro).

## Most discussed

### Aikido security audit: triage + remediate repo findings (deps, prototype-pollution, CI integrity, XSS)

## Source
Aikido dashboard full-repo scan (provided by maintainer; MCP feed-listing is disabled for the workspace).

## Triaged findings
| # | Finding | Sev | Verdict | Remediation |
|---|---|---|---|---|
| 1 | Secret as CLI option — `distributions/osx/scripts/{notarize,setup-notarize}.sh` | High | **False positive** — `xxxx-xxxx` placeholders + user-supplied `--password`; Team ID/Apple ID public | Optional hardening: accept password via env/stdin, not `--password` arg (process-list leakage) |
|

[Read the thread](https://github.com/Temple-of-Epiphany/imap-mcp-pro/issues/205) · 2026-06-21 · open · 6 comments

### Add local email export to standard files (.eml) with attachments — single/folder/whole-mailbox

## Goal

Add a feature to **export IMAP emails to standard message files** (`.eml` / RFC822) with attachments preserved, plus bulk/folder/whole-mailbox modes, attachment extraction, and search-based selection — all processed **locally** (no cloud), suitable for closed systems.

**Format:** `.eml` (RFC822) is the deliverable — a standard, lossless, portable format that every major mail client (Outlook, Thunderbird, Apple Mail) opens. `.msg` (Outlook) is explicitly **out of scope**. Optionally sup

[Read the thread](https://github.com/Temple-of-Epiphany/imap-mcp-pro/issues/170) · 2026-06-20 · closed · 3 comments

### Add DNS Firewall Provider Configuration UI

## Overview
Add configuration interface for DNS firewall providers with support for multiple validation services beyond Quad9.

## Requirements

### Database Schema
- Add `dns_firewall_providers` table to store provider configurations
- Fields needed:
  - `provider_id` (PRIMARY KEY)
  - `provider_name` (e.g., 'quad9', 'cleandns', 'cloudflare')
  - `provider_type` ('dns-over-https' or 'dns-lookup')
  - `api_endpoint` (for HTTPS providers)
  - `api_key` (optional, for future services requiring aut

[Read the thread](https://github.com/Temple-of-Epiphany/imap-mcp-pro/issues/60) · 2025-11-08 · closed · 3 comments

### Implement full service management with Web UI integration

# Implement Full Service Management with Web UI Integration

## Problem
Currently, `make start/stop/restart/status` are stubs that don't actually manage services. The Web UI must be started manually and isn't integrated with the service management system.

## Requirements

### 1. Service Templates
Create service configuration files for each platform:

**macOS (LaunchAgent/LaunchDaemon)**
- `templates/com.templeofepiphany.imap-mcp-pro.plist`
- Manages both MCP server and Web UI
- Auto-restart on 

[Read the thread](https://github.com/Temple-of-Epiphany/imap-mcp-pro/issues/41) · 2025-11-06 · closed · 3 comments

### Cross-Platform Installation System with Makefile

## Objective

Create a comprehensive cross-platform installation system using Makefiles that handles system service setup, admin account creation, authentication, and automatic updates.

## Background

Currently, installation is manual and requires users to configure system services themselves. This issue implements a production-ready installation system with:
- Automatic OS detection and platform-specific installation
- Admin account creation with secure credentials
- System service integration

[Read the thread](https://github.com/Temple-of-Epiphany/imap-mcp-pro/issues/8) · 2025-11-05 · closed · 3 comments

### Documentation cleanup: re-sync README / manifest / docs / wiki (tool count, keyring claim, new tools, license)

## Goal
Clean up and re-sync the repo documentation (README, `.mcpb` manifest, `docs/`, and the GitHub Wiki) — a lot has drifted as features/licensing/dependencies changed.

## Known drift / inaccuracies (audit + fix)
**Counts & capabilities**
- [ ] README says **"95 MCP tools"** and the `.mcpb` manifest `long_description` says **"80+ tools"** — actual count is now **106**. Make the count single-sourced or accurate.
- [ ] New tools are undocumented: `imap_get_email_sizes` (#169), `imap_export_em

[Read the thread](https://github.com/Temple-of-Epiphany/imap-mcp-pro/issues/201) · 2026-06-21 · closed · 2 comments

### Publish to the MCP Registry (single universal .mcpb)

## Goal
Publish IMAP MCP Pro to the official **MCP Registry** (registry.modelcontextprotocol.io) as a discoverable `registryType: mcpb` server distributed via GitHub Releases.

## Decision record: single universal bundle
Research (and the #181 native-dep removal) settled the per-platform question:
- The `server.json` `Package` schema has **no os/arch field**; per-platform selection isn't first-class.
- **#181 removed the only native deps** (keytar, @journeyapps/sqlcipher — both were dead code). 

[Read the thread](https://github.com/Temple-of-Epiphany/imap-mcp-pro/issues/182) · 2026-06-21 · closed · 2 comments

### Track B: Local message cache for SQL-backed reads + FTS5 body search

## Track B: Local message cache + SQL access for bulk reads

> Sibling issue: #117 (Track A — job persistence for long-running bulk ops). The two tracks compose; strategy comparison below. This issue focuses **only** on caching message data in SQLite for fast repeat reads, SQL aggregation, and full-text search.

## Motivation

Today every read tool against a large folder pays full IMAP cost: fetch wire bytes, parse, return through Claude's context window. Re-running the same query an hour later 

[Read the thread](https://github.com/Temple-of-Epiphany/imap-mcp-pro/issues/119) · 2026-04-30 · open · 2 comments

## Most recent

### Extension data dir defaulted to ~/.imap-mcp-pro (split account store) + no duplicate-instance guard

## Bug — extension used a different data store than everything else
The Claude Desktop extension defaulted its **Data Directory** to `~/.imap-mcp-pro`, while `server-config.ts`, the CLI, the launchd Web UI service, `getOutboxDir`, and the encryption-key sidecar all use `~/.imap-mcp`. Result: an account added via one entry point (e.g. the Web UI service, DB at `~/.imap-mcp/data.db`) is **invisible** to the extension's MCP session (reading `~/.imap-mcp-pro/data.db`) — different DB, and even a diff

[Read the thread](https://github.com/Temple-of-Epiphany/imap-mcp-pro/issues/288) · 2026-07-12 · closed · 0 comments

### Account lifecycle on FTS5-less builds: delete fails (no such module: fts5) + no duplicate-account guard

Two account-lifecycle robustness bugs found in Windows testing.

## Bug 1 — `Failed to delete: no such module: fts5` when deleting an account
`node:sqlite` enables foreign keys by default, so `DELETE FROM accounts` cascades into `messages_cache` (FK `ON DELETE CASCADE`). That fires the `messages_cache_fts_ad` trigger, which touches the `messages_cache_fts` **FTS5** virtual table. On a SQLite build compiled **without FTS5** (seen on some Windows Node builds), any FTS operation throws `no such mod

[Read the thread](https://github.com/Temple-of-Epiphany/imap-mcp-pro/issues/286) · 2026-07-12 · closed · 0 comments

### Submission prep: narrow declared platforms to tested (macOS + Windows)

For the Anthropic Desktop Extensions submission, declare only platforms we actually test. Linux is out of scope for now (untested), though the pure-JS runtime still runs there.

- `compatibility.platforms`: `[darwin, win32, linux]` → `[darwin, win32]`
- Update the release-notes platform wording and the submission dossier.
- The resulting `.mcpb` is the submission candidate (all bug fixes from #278/#279/#280 + honest platform claim).

[Read the thread](https://github.com/Temple-of-Epiphany/imap-mcp-pro/issues/284) · 2026-07-08 · closed · 0 comments

### imap_test_quad9_dns reports Quad9 unreachable when it's actually reachable (false negative)

## Summary

`imap_test_quad9_dns` reports Quad9 unreachable (`quad9Active: false, reachable: false`) on a host where Quad9 DoH is actually reachable and serving production lookups just fine. Same host, same session: `imap_check_domain_dns_firewall { domain: "example.com" }` succeeds against Quad9 in 223 ms and returns `provider: "quad9", isSafe: true`.

## Version

- IMAP MCP Pro (reproduced against the currently-installed extension version — please attach exact version when triaged)

## Observe

[Read the thread](https://github.com/Temple-of-Epiphany/imap-mcp-pro/issues/283) · 2026-07-08 · open · 0 comments

### Concurrency race: folder-scoped tools return cross-contaminated data under parallel calls

## Summary

Folder-scoped read tools return **cross-contaminated / incorrect data** when multiple tool calls execute concurrently against a single account's shared IMAP connection. IMAP selected-folder state from one in-flight command leaks into another, producing wrong counts and wrong search results. Data is correct when the same calls run sequentially.

## Version

- IMAP MCP Pro v2.32.0 (`@temple-of-epiphany/imap-mcp-pro`)
- Provider: Hostinger (imap.hostinger.com:993, TLS)

## Steps to repr

[Read the thread](https://github.com/Temple-of-Epiphany/imap-mcp-pro/issues/280) · 2026-07-08 · closed · 1 comment

### imap_list_categories fails: no such table: categories (missing schema migration)

## Summary

`imap_list_categories` fails with a SQLite error: the `categories` table does not exist in the database.

## Version

- IMAP MCP Pro v2.32.0 (`@temple-of-epiphany/imap-mcp-pro`)

## Steps to reproduce

1. Call `imap_list_categories` (with or without an `accountId` filter).

## Actual result

```json
{
  "success": false,
  "error": "no such table: categories",
  "errorType": "Error",
  "errorCode": "ERR_SQLITE_ERROR",
  "details": {}
}
```

Reproduced on two consecutive runs.

## Exp

[Read the thread](https://github.com/Temple-of-Epiphany/imap-mcp-pro/issues/279) · 2026-07-08 · closed · 1 comment

### imap_folder_status crashes: TypeError: Do not know how to serialize a BigInt

## Summary

`imap_folder_status` throws `TypeError: Do not know how to serialize a BigInt` and returns a failure envelope instead of folder statistics.

## Version

- IMAP MCP Pro v2.32.0 (`@temple-of-epiphany/imap-mcp-pro`)
- Provider: Hostinger (imap.hostinger.com:993, TLS)

## Steps to reproduce

1. `imap_connect` to an account.
2. Call `imap_folder_status` with `folder: "INBOX"`.

## Actual result

```json
{
  "success": false,
  "error": "Do not know how to serialize a BigInt",
  "errorType

[Read the thread](https://github.com/Temple-of-Epiphany/imap-mcp-pro/issues/278) · 2026-07-08 · closed · 0 comments

### Release hygiene: universal-only build + delete malformed draft v2.8.1

Make the release story consistent.

**Done:** Deleted the malformed **draft `v2.8.1`** (duplicate, `draft=true`, bogus `0001-01-01` date). The real published v2.8.1 is untouched.

**This PR:**
- `dxt/build.mjs` → **universal-only**: remove the dead per-platform mode (`platformLabel`, `--universal`, `--skip-rebuild`). Since v2.16 the runtime is pure JS (node:sqlite, no native deps), so the output is always one universal `.mcpb`; the per-OS mode produced identically-behaving bundles under `-linux-

[Read the thread](https://github.com/Temple-of-Epiphany/imap-mcp-pro/issues/276) · 2026-07-06 · closed · 0 comments

### make update-extension — one-command update of the installed Claude Desktop .mcpb

## Problem
`make install` / `make update` only manage the launchd **Web UI service** (`~/.local/share/imap-mcp-pro`). They do **not** touch the **Claude Desktop extension** (`~/Library/Application Support/Claude/Claude Extensions/local.mcpb.colin-bitterfield.imap-mcp-pro`). Because the extension is a *local* `.mcpb` (not installed from the Anthropic directory), Claude Desktop never auto-updates it, so it silently drifts many versions behind the Web UI / registry.

## Ask
Add a `make update-exten

[Read the thread](https://github.com/Temple-of-Epiphany/imap-mcp-pro/issues/272) · 2026-07-05 · closed · 0 comments

### Export: direct write to a user path (destPath) instead of outbox-then-relocate

## Need
Export tools (`imap_export_email`, `imap_export_folder`, `imap_export_account`) can only write under the per-user MCP outbox (`~/.imap-mcp/users/{userId}/outbox/exports/[subfolder]/`). The real requirement is a **direct write to a user-chosen path** (e.g. `~/Downloads/sent-mail`) — *not* export-to-outbox-then-relocate.

## Decision
Add an optional `destPath` (absolute) to the three export tools. When supplied, `.eml` files are written **directly** to that path (folder/account exports sti

[Read the thread](https://github.com/Temple-of-Epiphany/imap-mcp-pro/issues/270) · 2026-07-04 · closed · 0 comments

### Bundled skill never auto-installs from the .mcpb — skills manifest path resolves to server/skills (should be dist/skills)

## Summary
The bundled-skill **auto-install never runs inside the packaged `.mcpb`** — the skills installer looks in the wrong directory, so `manifest.json` is effectively "missing" and no skill is installed to `~/.claude/skills/imap-mcp-pro/`.

## Root cause
`src/index.ts` resolves the bundle dir as:
```ts
const bundleSkillsDir = path.join(__dirname, '..', 'skills'); // lines 151 and 293
```
- `postbuild.mjs` copies `skills/` → **`dist/skills/`**.
- The `.mcpb` ships only `dist/` (as `server/di

[Read the thread](https://github.com/Temple-of-Epiphany/imap-mcp-pro/issues/268) · 2026-07-04 · closed · 0 comments

### Combined spam scan (UserCheck + DNS + allow/deny) + safe Junk-move for DNS firewall

1. DNS firewall autoMarkSpam should MOVE to a Junk folder (reversible), not set \Deleted. 2. Wire per-user allow/deny lists into spam decisions. 3. Add a route that scans a block of messages against both engines.

[Read the thread](https://github.com/Temple-of-Epiphany/imap-mcp-pro/issues/264) · 2026-07-04 · closed · 0 comments

### Sent-copy fails: send path doesn't auto-connect IMAP; APPEND to INBOX.Sent errors 'Command failed' (Hostinger)

## Summary
Live test against Hostinger (`colin@bitterfield.com`, `imap.hostinger.com`) shows **SMTP send succeeds but the copy does not land in the IMAP Sent folder.** Two distinct problems:

### 1. Send path doesn't ensure an IMAP connection for the append
Calling `imap_send_email` when the account is **not connected** returns:
```
result: "sent_not_archived", archiveSkipped: "no-sent-folder-found"
```
The SMTP send self-connects, but the Sent-append relies on an existing IMAP connection; `reso

[Read the thread](https://github.com/Temple-of-Epiphany/imap-mcp-pro/issues/261) · 2026-07-04 · closed · 1 comment

### Per-account email signatures

Add per-account signatures (plain text + optional HTML), appended to outgoing mail by imap_send_email unless suppressed. Tools to set/get; migration adds signature_text/signature_html to accounts.

[Read the thread](https://github.com/Temple-of-Epiphany/imap-mcp-pro/issues/257) · 2026-07-04 · closed · 0 comments

### MCP Desktop Extensions directory submission prep

## Goal
Prepare the `.mcpb` for submission to the Anthropic **Desktop Extensions** directory (`clau.de/desktop-extention-submission`), per the [submission requirements](https://claude.com/docs/connectors/building/submission).

## Requirements → status
- [x] **Every tool has a `title`** — auto-derived from the tool name in `withAnnotations` (overridable), surfaced on the live `tools/list` and `--print-tools-manifest`.
- [x] **Every tool has an applicable `readOnlyHint`/`destructiveHint`** — inclu

[Read the thread](https://github.com/Temple-of-Epiphany/imap-mcp-pro/issues/248) · 2026-07-04 · closed · 0 comments

### UserCheck bulk scans don't dedupe by address or consult the cache (redundant API calls)

## Problem

UserCheck is billed/rate-limited **per email address**, but the bulk spam tools re-check the same sender repeatedly:

1. **`imap_check_folder_spam` and `imap_scan_account_spam` never read the cache.** They call `UserCheckService.checkEmailsBatch()`, which looped `checkEmail()` → API with no `getCachedResult()` consult. So every run re-hits UserCheck for every sender, and `imap_scan_account_spam` re-checks the same sender **once per folder** (a sender in INBOX+Archive+Sent = 3 calls/r

[Read the thread](https://github.com/Temple-of-Epiphany/imap-mcp-pro/issues/238) · 2026-06-23 · closed · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/Temple-of-Epiphany/imap-mcp-pro/issues).