registry / apple-mail-mcp / 2.8.0

apple-mail-mcp@2.8.0

MCP server for Apple Mail - read, search, send, and manage emails via Claude and other AI assistants

Static Scan Results

scanned 16d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 21 file(s), 366 KB of source

Source & flagged code

4 flagged

build/services/smtpMailer.jsView file

Lines 12-52javascript

12 * ever placed in config. When SMTP is configured, `send-email` auto-prefers it

13 * over AppleScript (opt out per call with `transport: "applescript"`); see

14 * {@link shouldUseSmtp}.

15 *

16 * @module services/smtpMailer

17 */

18import nodemailer from "nodemailer";

19import { execFileSync } from "child_process";

20import { isAbsolute } from "path";

21import { existsSync } from "fs";

22/**

23 * Environment variables consumed by {@link resolveSmtpConfig}. Documented here

24 * (and in the README) so the error path can point users at exactly what to set.

25 */

26export const SMTP_ENV = {

27 host: "APPLE_MAIL_MCP_SMTP_HOST",

28 port: "APPLE_MAIL_MCP_SMTP_PORT",

29 secure: "APPLE_MAIL_MCP_SMTP_SECURE",

30 user: "APPLE_MAIL_MCP_SMTP_USER",

31 from: "APPLE_MAIL_MCP_SMTP_FROM",

32 password: "APPLE_MAIL_MCP_SMTP_PASSWORD",

Medium

Secret Pattern

Package contains a possible secret pattern.

build/services/smtpMailer.jsView on unpkg · L32

33 keychainService: "APPLE_MAIL_MCP_SMTP_KEYCHAIN_SERVICE",

34 keychainAccount: "APPLE_MAIL_MCP_SMTP_KEYCHAIN_ACCOUNT",

35};

36/**

37 * Cheap check for whether the SMTP transport is configured at all, i.e. the two

38 * required settings ({@link SMTP_ENV.host} and {@link SMTP_ENV.user}) are

39 * present. Used to auto-prefer SMTP over AppleScript when no transport is

40 * explicitly requested, and by `doctor`. Does NOT touch the Keychain or verify

41 * the password — a misconfigured password still surfaces a clear error at send

42 * time via {@link resolveSmtpConfig}.

43 */

44export function isSmtpConfigured(env = process.env) {

45 return Boolean(env[SMTP_ENV.host]?.trim() && env[SMTP_ENV.user]?.trim());

46}

47/**

48 * Decides whether `send-email` should use the SMTP transport for this call.

49 *

50 * - explicit `"smtp"` → always SMTP (config errors surface, no fallback);

51 * - explicit `"applescript"` → always the Mail.app path;

52 * - omitted → SMTP when configured, **except** when a non-email `account` label

build/services/smtpMailer.d.tsView file

Lines 56-96typescript

56 user: string;

57 pass: string;

58 from: string;

59}

60/** Result of an SMTP send. */

61export interface SmtpSendResult {

62 success

build/services/imapClient.jsView file

Lines 13-53javascript

13 * Everything is opt-in and additive; un-configured accounts use AppleScript.

14 *

15 * Opt-in via env (mirrors the SMTP transport pattern):

16 * APPLE_MAIL_MCP_IMAP_USER (required — enables

build/services/imapClient.d.tsView file

Lines 1-26typescript

1export declare const IMAP_ENV: {

2 readonly user: "APPLE_MAIL_MCP_IMAP_USER";

3 readonly account: "APPLE_MAIL_MCP_IMAP_ACCOUNT";

Source & flagged code

4 flagged · loading source

build/services/smtpMailer.jsView file

32patternName = generic_password severity = medium line = 32 matchedText = password...RD",

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code