Email MCP: why it is not safe to use

What we found

Our review did not find hidden instructions, hardcoded secrets, obfuscated code, privilege escalation, or undisclosed remote code fetching in the materials we examined. The documented behavior is generally transparent about using user-chosen mail servers and optional user-configured webhook alerts.

The main concern is the tool scope. The published toolset includes sending, scheduling, moving, deleting, bulk actions, and even mailbox deletion. In the README we reviewed, we did not see a built-in confirmation step described for irreversible actions. That raises the chance of accidental or overly broad changes if the skill is used with high autonomy.

We also noted that the skill is designed to access a connected email account and to receive or store credentials through configuration or environment variables. That is expected for this type of tool, but it is still sensitive because it can expose private message archives and account access if deployed without strong controls.

What to do instead

Prefer email tools that separate read-only and write access, require explicit confirmation for destructive actions, and use narrowly scoped credentials. Use a dedicated account where possible, limit mailbox permissions, and avoid enabling bulk or delete capabilities unless they are operationally necessary.