Skip to content
Remote MCP · OAuth · 8 tools
Email logo

Email MCP Server: Secure AI Agent Access to Gmail and Outlook

Connect Claude, ChatGPT, and Cursor to Gmail and Outlook through PortEden's remote MCP server. 8 tools, OAuth, and a data firewall that controls every search, send, and delete.

Connect to Claude

Free tier · No credit card required

What is the Email MCP server?

The email MCP server lets AI agents read, search, and send email through the Model Context Protocol. Connect a client like Claude, ChatGPT, or Cursor to one remote endpoint at https://mcp.porteden.com/email and the agent works across Gmail and Outlook at once, including Microsoft 365 mailboxes, with no per-provider setup.

PortEden's server exposes 8 email tools, from search and thread reads to send, reply, forward, and delete. What makes it different from a generic Gmail or Outlook MCP is the data firewall in front of those tools: PortEden inspects every tool-call request, applies your access policy, and redacts sensitive content in the response before the agent ever sees it.

The result is secure email access for AI agents. You decide whether a client can only read or can also send, block individual contacts and domains, redact PII from message bodies, and review every call in an audit log. OAuth handles authentication, so there is no static key to leak.

All 8 Email MCP tools

Every tool can be allowed or denied per client. Access levels are enforced at the firewall on each call.

ToolAccessWhat it does
email_searchreadSearch emails across all connected providers (Gmail and Outlook).
email_getreadGet a single email by its provider-prefixed ID.
email_get_threadreadGet every message in an email thread.
email_sendwriteSend a new email.
email_replywriteReply to an existing email.
email_forwardwriteForward an email to new recipients.
email_modifywriteMark an email read or unread, or add and remove labels.
email_deletedeleteMove an email to Trash.

Connect Email to Claude, ChatGPT, Cursor, and more

Point any MCP-compatible client at the remote URL and sign in to PortEden once with OAuth.

# Claude Web or Desktop, then Settings, Connectors, Add custom connector
https://mcp.porteden.com/email 
 
# Authenticate to PortEden once with OAuth. Claude can now call the
# email tools under the access policy you set.

Available on Claude Pro, Team, and Enterprise. The same flow works for Claude Cowork.

The security-first Email MCP

PortEden is the data firewall for AI.

Granular access control

Decide exactly what each AI client can do with email. Keep an agent read-only, allow drafting but require confirmation before send, or block whole domains, so an over-eager agent cannot email the wrong person.

  • Read-only by default: deny email_send, email_reply, email_forward, and email_delete for a triage agent.
  • Per-contact and per-domain rules: block messages to or from specific senders or external domains.
  • Confirm-before-send on outbound actions so nothing leaves the mailbox without a check.
Learn more about granular access control

Data redaction

PortEden runs a redaction pass on every tool response before it leaves the firewall. Sensitive values in message bodies and headers are replaced with stable placeholders, so the agent can summarize a thread without the raw content entering the model's context.

  • Strip PII, PAN (card numbers), and other email addresses from message bodies before the agent sees them.
  • Mask sender and recipient addresses while keeping the subject and summary readable.
  • Round-trip replies are de-redacted server-side, so a reply aimed at a placeholder reaches the real recipient.
Learn more about data redaction

Audit trail

Every email tool call is recorded: which client, which user, which tool, the arguments passed, the policy decision, and the redacted response. Export it or stream it to your SIEM for review.

  • See exactly which threads an agent read and which messages it sent, with timestamps.
  • Reconstruct any tool call: the request, the rule that fired, and the response returned.
  • Stream to Splunk, Datadog, or S3 for retention and review.
Learn more about audit trail

RBAC and policy groups

Bind each MCP connection to a user or role with a scoped, revocable token. Group policies by team so a new hire inherits the right mailbox access on day one, and revocation is instant and server-side.

  • Issue per-user tokens scoped to the verbs and mailboxes that role needs.
  • Apply one policy group across a team instead of editing rules client by client.
  • Revoke a token server-side the moment a contract ends, with no Google or Microsoft account round-trip.
Learn more about rbac and policy groups

Set up the secure Email MCP in minutes

1

Add the connector

In your AI client, add a custom connector or HTTP MCP server pointing at https://mcp.porteden.com/email.

2

Authenticate with OAuth

Sign in to PortEden once and connect Gmail or Outlook. The client never holds your provider refresh token.

3

Set your email policy

Choose read-only or read-write, block contacts or domains, and turn on redaction for message bodies.

4

Verify in the audit log

Run a prompt, then watch the tool calls land in your PortEden audit log with the rule that fired on each one.

Works with every MCP client
Claude DesktopClaude WebChatGPTCursorWindsurfClineZed

Email MCP FAQ

What is the email MCP server?
It is a remote MCP (Model Context Protocol) server that lets MCP-compatible AI clients like Claude, ChatGPT, and Cursor read, search, and send email through a single hosted endpoint at https://mcp.porteden.com/email. One server covers both Gmail and Outlook, and PortEden puts a data firewall in front of all 8 tools so you control what the AI can see and do.
How do I connect Claude to Gmail using MCP?
In Claude Web or Desktop, open Settings, then Connectors, then Add custom connector, and paste https://mcp.porteden.com/email. Authenticate to PortEden once with OAuth and connect your Gmail account. Claude can then call the email tools. The same URL works in ChatGPT Connectors and in Cursor's MCP settings.
Does the email MCP server work with Outlook too?
Yes. The same server handles Gmail and Outlook (Microsoft 365 and Outlook.com). Tools like email_search return results across every connected provider, and IDs are provider-prefixed so the agent always acts on the right mailbox. You connect each provider once through PortEden's OAuth flow.
Is the email MCP server secure?
That is the whole point of PortEden. The connection uses OAuth, so there is no static key to leak. Every tool call passes through a policy decision, sensitive content in message bodies is redacted before the agent sees it, and every call is written to an audit log. You can keep a client read-only, block contacts or domains, and require confirmation before anything is sent.
Can I give an AI agent read-only email access?
Yes. Deny email_send, email_reply, email_forward, email_modify, and email_delete in your policy and the agent keeps the read tools (email_search, email_get, email_get_thread). You can also allow sending only to approved contacts or require confirmation before each send.
Does redaction stop the agent from summarizing my email?
No. PortEden replaces sensitive values with stable placeholders rather than removing them, so the agent can still summarize a thread, group messages, and draft replies by handle. Round-trip replies are de-redacted server-side, so a reply aimed at a placeholder reaches the real recipient. The raw values never enter the model's context.
What email tools does the MCP server expose?
Eight tools: email_search, email_get, and email_get_thread for reading; email_send, email_reply, and email_forward for outbound mail; email_modify for read state and labels; and email_delete for moving mail to Trash. Each tool can be allowed or denied per client.
Which AI clients work with the email MCP server?
Any MCP-compatible client. That includes Claude Desktop, Claude Web, ChatGPT (via Connectors), Cursor, Windsurf, Cline, and Zed. Point the client at the remote URL and authenticate once.
Does it cost anything to use the email MCP server?
There is a free tier that covers 1,000 tool calls per month. Paid plans raise the limit. A tool call is one MCP request, so a search returning 50 messages is one call, not 50. See the pricing page for current limits.

Keep Exploring

Connect Email to AI, without leaking the underlying data.

Five-minute setup over OAuth. The free tier covers 1,000 tool calls per month.

See pricing