Proton Mail MCP: how to connect it through Bridge, and what to know first

Proton doesn’t offer an official MCP server for Proton Mail. To connect an AI assistant such as Claude, you run Proton Mail Bridge on your computer and add a community-built MCP server that talks to Bridge over IMAP and SMTP. That needs a paid Proton plan, and it only works on the machine where Bridge runs.

Details about Bridge and Proton’s plans are from Proton’s own pages, as of November 2026. We found no announcement of an official server on Proton’s site or blog, but these products change quickly, so check before you rely on any of it. If MCP is new to you, start with what MCP is, and why it matters for email.

The short version

No official server. Every Proton Mail MCP server we found is a community project.
Bridge is the way in. Community servers connect to Proton Mail Bridge, the desktop app that gives mail clients IMAP and SMTP access.
Paid plans only. Proton says Bridge is available only with a paid plan that includes Proton Mail.
Local only. Bridge runs on your computer, so the MCP server has to run there too, and it works only while that computer is on.
Access isn’t limited by the credentials. The Bridge password gives full IMAP and SMTP access. Any limit on what the assistant can do comes from the MCP server you choose.
Zero-access protection ends at the assistant. Bridge decrypts mail on your device, and whatever the assistant reads goes to your AI provider as readable text.

Why is there no official Proton Mail MCP server?

Proton hasn’t said, so we won’t guess at its plans. The design makes it harder than for most providers, though. Proton Mail uses zero-access encryption: stored messages and attachments are encrypted so that Proton itself can’t read them. A server-side MCP endpoint, like the ones Fastmail offers or the ones covered in Gmail MCP and Outlook MCP, would, as far as we can tell, need Proton’s servers to read your mail for the assistant.

Bridge avoids that by doing the decryption on your computer. Proton describes it as a desktop app that runs in the background, “encrypting and decrypting messages as they enter and leave your computer.” To your mail client, or to an MCP server, it looks like an ordinary local mail server. That’s why the same kind of IMAP MCP server that works with other providers can work with Proton too.

Proton does have its own AI products, such as its Lumo assistant, but none of them is an MCP server for your mailbox.

How does a Proton Mail MCP server work?

Three pieces run on your machine:

Proton Mail Bridge signs in to your Proton account, decrypts mail locally and serves it over IMAP and SMTP.
A community MCP server connects to Bridge with the credentials Bridge gives you and turns mailbox actions into tools: search, read, move, draft and, in many projects, send.
Your AI client, such as Claude Desktop or Claude Code, starts the MCP server and calls its tools when you ask for something.

The model itself runs at your AI provider, not on your computer. When the assistant reads a message, the decrypted text goes from Bridge to the MCP server to the client, and from there to the provider.

What do you need before you start?

A paid Proton plan that includes Mail. The Bridge page says it’s available only with a paid plan, and the pricing page lists IMAP and SMTP client support as not included on Free. If you’re on a business plan, check with Proton that yours includes Bridge.
A supported computer. Bridge runs on 64-bit Windows, macOS and Linux. Proton lists the exact versions on its supported systems page. It doesn’t run on phones.
An MCP client that runs local servers. Claude Desktop and Claude Code both can.
A community MCP server you trust. Most are Node.js or Python packages, so you’ll need that runtime too.

How do you connect Proton Mail to Claude?

The steps differ a little between projects, so follow the README of the server you choose. The general pattern is:

Install Bridge from Proton’s installation guide and sign in with your Proton account.
Copy the Bridge credentials. Bridge shows the mailbox details to use in a client: the server, ports, username and a Bridge-specific password. Proton says this password is different from your login password and never leaves your computer.
Choose an MCP server. Search GitHub or an MCP directory for Proton Mail Bridge servers, then check it as described in the next section.
Add it to your client. For Claude Desktop, you edit its configuration file, as described in the MCP project’s guide to connecting local servers. For Claude Code, you add it with claude mcp add, as covered in Anthropic’s Claude Code MCP documentation.
Pass the Bridge credentials as environment variables in that configuration, using the variable names the server’s README gives.
Restart the client and ask something read-only first, such as “list my unread mail from today”.

A Claude Desktop entry usually has this shape. The package name and variable names here are placeholders, not a real project:

{
  "mcpServers": {
    "proton": {
      "command": "npx",
      "args": ["-y", "example-proton-bridge-mcp@1.2.3"],
      "env": {
        "BRIDGE_USERNAME": "you@example.com",
        "BRIDGE_PASSWORD": "the-password-bridge-shows-you"
      }
    }
  }
}

Keep Bridge running. If it’s closed, or the computer is asleep, the assistant can’t reach your mail.

Can you use it in Claude on the web or on your phone?

Not in a practical way. Custom connectors in Claude’s web and mobile apps connect to a remote MCP server over the internet. Bridge serves mail on your own computer, and exposing it to the internet would put a full-access mail login within reach of anyone who finds it, so we don’t recommend it. A Proton Mail MCP setup is a desktop setup.

How do you choose a community server safely?

You’re giving third-party code a password that can read, move, delete and send all of your mail. Treat it like any software with that level of access:

Read the tool list. Bridge credentials can do everything, so the server’s tools are the only limit. If you only want search and drafts, pick a server that doesn’t offer sending or deleting, or one that lets you turn them off.
Read the code, or at least skim it. Check that it talks only to Bridge on your machine and doesn’t send your credentials or mail anywhere else.
Check that it’s maintained. Look for recent releases, open issues and how the project handles security reports.
Pin a version. Commands like npx -y fetch the latest release every time the client starts. Pinning a version means an update can’t change what runs without you knowing.

Even a well-built server can’t stop a model from being misled by text inside an email, which is called prompt injection. An assistant that can send can be steered into sending. We cover the risk, and how to limit it, in giving an AI assistant access to your inbox, safely.

Does connecting an AI assistant break Proton’s encryption?

Not on Proton’s side. Your mail stays encrypted on Proton’s servers, and Bridge decrypts it only on your computer. But zero-access encryption protects mail from Proton, not from tools you choose to give it to. Once an assistant reads a message, that message is sent to your AI provider in readable form and handled under that provider’s terms.

So it’s worth deciding what the assistant should see. If you chose Proton because some of your mail must not leave your control, a local assistant setup still sends that mail to a model provider whenever it’s read. For some people that’s an acceptable trade for help with routine mail. For others it defeats the reason they’re on Proton. Our Proton Mail alternative article covers who should keep zero-access encryption, and why.

How Lettio compares

Lettio makes a different trade. Our email MCP server is part of the mailbox, so there’s no bridge and nothing to keep running: add https://mcp.lettio.eu/mcp in your client, sign in with OAuth, and connect up to 10 mailboxes at once. It also works anywhere remote MCP servers do, such as Claude’s custom connectors.

Sending. A new connection can read, organise and draft, and you send from the card in Claude yourself. Sending on its own is something you allow when you sign in, and then only as your own address.
Access you can revoke. Each connection uses a dedicated app password, not your main login, so you can cut one off without changing anything else.
Jurisdiction. Your mailbox is hosted on our own EU servers, under the GDPR. Your AI provider still processes whatever your agent reads.

The cost is the protection Proton is built on. Lettio isn’t end-to-end encrypted and doesn’t offer zero-access encryption: our servers can read your mail, because search and agents work on it. It also only works with a Lettio mailbox, so you’d move your mail.

If zero-access encryption is why you’re on Proton, Bridge and a carefully chosen community server is the way to add an assistant, and you don’t need to switch. If you’d rather have agents built in, under EU jurisdiction, Lettio is in a closed beta and you can request access.