If you search for a Gmail MCP server or an Outlook MCP server, you’ll find an official option from each company and dozens of community projects. They differ a lot in what they can do, who can use them, and how much you have to trust them.
This is where things stand as of our last check, in November 2026. These products are changing quickly, so check the linked documentation before you rely on any detail here. If you’re new to the protocol, start with what MCP is, and why it matters for email.
The short version
- Gmail (official): in Developer Preview. It needs preview programme membership, a Google Cloud project and your own OAuth client. It reads, searches and creates drafts, with no send tool listed.
- Outlook (official): Work IQ MCP is generally available, and an older Mail server is in preview. Both sit in a Microsoft 365 tenant, subject to licensing and admin approval. The older server can send; for Work IQ, check its tool reference.
- Community servers: these vary by project. You usually supply your own credentials and run them locally, and many can send.
The official Gmail MCP server
Google offers a remote Gmail MCP server, currently in Developer Preview. To use it you need to be a member of the Google Workspace Developer Preview Program, have a Google Cloud project with the Gmail and Gmail MCP APIs enabled, and create your own OAuth client. That’s reasonable for a developer, and a lot to ask of everyone else.
The tools cover searching and reading threads, listing and applying labels, and creating drafts. No send tool is listed. The documented flow is that an agent prepares a draft, and you review and send it from Gmail.
That limit is a sensible default. An agent that can only draft can’t send something you never saw. It does rule out unattended workflows, and it’s worth testing what your agent reports when you ask it to send: “done” may only mean a draft is waiting.
Google’s documentation doesn’t say which account types are eligible or give quotas, so confirm both for your own account.
The official Outlook MCP server
Microsoft’s picture has two layers, which is why it’s confusing to search for.
The current path is Work IQ MCP, a single endpoint with a set of generic tools, which Microsoft lists as generally available as part of the Work IQ API. Microsoft says tool availability can vary by tenant, region, licensing, administrator approval and organisational policy, so what you get depends on your organisation.
The older Mail server is what many guides still describe. It’s in preview and has explicit tools to send, reply and delete. Microsoft now says these application-specific servers exist for backward compatibility and shouldn’t be used in production or new projects.
Both sit inside a Microsoft 365 tenant, and the older server’s address includes a tenant ID. Neither page describes support for personal Outlook.com accounts. If you have a personal address, assume this route isn’t for you until Microsoft says otherwise.
Community servers
If the official options don’t fit, community servers fill the gap. Many connect to the Gmail or Microsoft Graph APIs with credentials you create yourself, and many can send mail directly. Proton Mail has no official server at all, so community projects there connect through Proton Mail Bridge instead. For providers with neither, a generic IMAP MCP server can connect most mailboxes with an app password.
Some are well maintained. But you’re giving a piece of third-party code access to your whole mailbox, so treat it like any other software with that level of access:
- Read the code, or at least the permissions. Check which OAuth scopes it asks for and whether it needs all of them.
- Know where it runs. A local server keeps your credentials on your machine. A hosted one adds another company between you and your mail.
- Check that it’s maintained. Look for recent releases and how the project handles security reports.
- Start read-only. Add sending only when you’ve seen how your agent behaves.
What to check before you connect any of them
The questions that matter are the same for every server:
- Can it send, and as whom? Can an agent only draft, can it send, and can it ever send from another address? Sending limits are your main defence against prompt injection, where a malicious email tries to steer your agent. Google’s documentation recommends screening content for this too.
- Can you separate read from write? Good servers split access into levels. Fastmail’s MCP server, for example, offers read, write and send as separate choices on its consent screen (how to connect it).
- Who else sees the mail? Everything an agent reads goes to the model you’re using, under that provider’s terms. That’s true of every option here, including ours.
- Can you turn it off? Make sure you know where to revoke access before you grant it.
Which should you choose?
Stay on Gmail or Outlook if your mailbox is staying put. If your organisation runs on Microsoft 365, ask your administrator about Work IQ. If you’re on Gmail and comfortable with Google Cloud, the official server is the cautious route because it’s draft-only. A well-kept community server is the realistic option if you need sending.
Consider a different mailbox if the setup itself is the problem. That applies if you don’t want a Google Cloud project or a Copilot rollout just to connect an assistant, or if you’d rather your mail sat under EU jurisdiction.
That second case is what we built Lettio for. Its email MCP server is part of the mailbox: add a URL, sign in with OAuth, and your agent can read, search, reply and send, attachments included, with sending pinned to your own address.
The trade-offs are real. It only works with a Lettio mailbox, so you’d have to move your mail. Because agents work on your mail, it isn’t end-to-end encrypted either. If that’s a fit, see how it connects.