Product · Built by Fullspec Studio · 2026

WorkMail MCP server

An open-source MCP server that gives Claude safe, local access to Amazon WorkMail — reading, searching, and sending mail and managing calendar events through seven typed tools, with credentials kept in the macOS Keychain and every write gated behind explicit confirmation.

Project shape
Systems Design 22%Infra 8%DevOps 6%Data 14%AI 22%Backend 26%Frontend 2%
Leading
Backend26%Systems Design22%AI22%
A minimalist line-art in Fullspec coral on paper: an email envelope and a calendar on the left, joined through a central plug-and-socket connector to an assistant chat node on the right, a small padlock marking the local key store, with the brand spectrum strip along the base.

The problem

AI assistants are most useful when they can act inside the tools you already live in — but email and calendar are exactly where you don't want a model reaching in carelessly. Amazon WorkMail speaks Exchange Web Services, not a friendly REST API, and wiring an assistant to it usually means a brittle script or handing your credentials to a cloud service you have to trust. Connecting Claude to a real inbox has to clear a higher bar: local, least-privilege, and impossible to send or schedule anything by accident.

What we built

An open-source Model Context Protocol (MCP) server, in TypeScript, that Claude Desktop talks to over local stdio — no HTTP server, no cloud middleman.

  • Seven typed tools. list_emails, read_email, and search_emails (Amazon's AQS query syntax) for reading; send_email for sending; and list_calendar_events, get_calendar_event, and create_calendar_event for the calendar. List operations paginate.
  • Write-protection by default. The two tools that change anything — sending mail and creating events — refuse to run unless the caller passes an explicit confirm: true. The model can't fire off a message on its own.
  • Credentials that never leave the machine. WorkMail auth lives in the macOS Keychain (hardware-encrypted on Apple Silicon), never in an env var or a config file, and tool output is sanitized so credentials can't leak back through a response.
  • Guardrails around the edges. Every input is validated against a Zod schema, requests are rate-limited (30 per minute by default), and the server connects to WorkMail over EWS at a fixed compatibility level.
  • MIT-licensed and installable straight from GitHub, then registered with Claude Desktop through a small JSON config.

Status

Open source and MIT-licensed. It's the same principle we bring to client automations — give an assistant real tools, but make the safe path the only path — here applied to email and calendar, where the cost of a careless action is highest.

Work

Have a system that needs this level of attention?

See how we evaluate a new engagement.

Start a conversation