MCP, iPhone, limits
s3mail speaks the Model Context Protocol over stdin/stdout, so Claude can search the mailbox, read, file and write a draft. There is no tool for sending, and that is the point: the sender stays a human technically.
--mcp:claude mcp add s3mail -- /path/to/s3mail --mcp;--mcp-readonlywithout moving, tagging, drafting- iPhone: a native app reads the same bucket with a key of its own, paired by QR code and six digits
- Limits: no IMAP, no thread grouping, Windows packages unsigned
Reachable for a model: --mcp
s3mail speaks the Model Context Protocol over stdin/stdout: no window, no web server, no port. With it Claude can search the mailbox, read, file and write a draft. Prerequisite: s3mail must have run and been set up normally once; --mcp reads the same config.json and starts no wizard.
claude mcp add s3mail -- /path/to/s3mail --mcp
claude mcp list # must show “✔ Connected”
For Claude Desktop in claude_desktop_config.json: {"mcpServers": {"s3mail": {"command": "/path/to/s3mail", "args": ["--mcp"]}}}, then restart Claude Desktop.
| Tool | For |
|---|---|
search | search as in the mailbox: from:, subject:, after:, is:unread, tag: … |
read | read one mail in full, including the names of the attachments |
folders | folders with counts and unread |
move | file; trash and spam are refused, otherwise reversible |
tag, flag | tagging, read/unread, star |
draft | put a draft into the bucket |
There is no tool for sending, and that is the point. An incoming mail is foreign text that lands in the model's context; “send this to …” fits into a mail. The model puts a draft into the bucket, you open s3mail and press Send. The sender stays a human technically, not only organisationally. For the same reason trash and spam are no targets for move: with the lifecycle rule, moving there would be a delayed delete. Whoever wants to allow even less starts with --mcp-readonly.
Every mail read comes with the note in front that the content is data and not instructions. That does not solve prompt injection, it limits what can follow from it. No API key, no network connection to third parties: s3mail calls no model, it makes itself reachable for one.
On the phone
A native iOS app reads the same bucket directly, with its own IAM user and a permission boundary that caps it to this mailbox's prefix. Pairing goes like this: type a name on the desktop, scan a QR code, confirm six digits. The key travels sealed in the code, the PIN does not; that is why a photo of the screen is no access. A lost phone is a single revocation, not a rotation everywhere.
The app lives in its own repository: github.com/ohartwig/s3mail-ios; the reasoning behind it is in IOS.md.
Limits
- No IMAP. A normal mail client cannot open the mailbox. Sending would work through the SES SMTP endpoint, reading would not, SES has no mailbox service. Why that is hard and where the path would run is in
IMAP.md; none of it is built. - No thread grouping. The list shows individual mails. Proper threading needs
References, subject normalisation and a way to handle threads a ticket system cut off. What serves the purpose most of the time exists: History in the mail view shows every mail with that address across all folders. - Push needs a doorbell in AWS: SES notifies an SNS topic that writes into an SQS queue s3mail listens on. Without it,
--refreshruns on a timer (default 60 seconds). s3mail reads the queue from its own IAM policy. - Access hangs on a token, not on users.
- Moving copies the object. Encryption and storage class come along, the version history of a versioned bucket does not.
- With very large mailboxes (above roughly 50,000 objects) the first indexing takes a while; work with a narrower prefix then.
- The Windows packages are not signed, SmartScreen speaks up there. The macOS packages are signed and notarised. For every platform there is
SHA256SUMSwith a cosign signature.
Licence and reporting
Apache-2.0, every source file carries the SPDX identifier, the repository is REUSE-compliant. The patent clause in section 3 is the reason for Apache-2.0 over MIT: it gives every user the patent rights to what is inside, and takes them away from whoever sues over it. Vulnerabilities to security@ole-hartwig.eu, not as an issue.