Is io.github.zayansalman/gmail-attachments-mcp safe to use?

io.github.zayansalman/gmail-attachments-mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.

How do I install io.github.zayansalman/gmail-attachments-mcp?

io.github.zayansalman/gmail-attachments-mcp supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What can io.github.zayansalman/gmail-attachments-mcp do?

io.github.zayansalman/gmail-attachments-mcp provides 7 tools: Features, Install, Configuration, Security, Troubleshooting and 2 more. See the full tools list on the server page for descriptions and parameters.

What AI clients work with io.github.zayansalman/gmail-attachments-mcp?

io.github.zayansalman/gmail-attachments-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.

Is io.github.zayansalman/gmail-attachments-mcp actively maintained?

io.github.zayansalman/gmail-attachments-mcp is actively maintained — last commit was 21 days ago.

io.github.zayansalman/gmail-attachments-mcp

gmail-attachments-mcp

Minimal MCP server for downloading Gmail attachments to disk. Read-only OAuth by default.

7 tools GitHub PyPI

No known CVEs

No license

Actively maintained

Last commit 21d ago

Works with most clients

Transport: stdio

7 tools · ~278 tok

Grade A · 0.1% of 200K ctx

Edit this pageView history

Communication Security

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "gmail-attachments": {
      "args": [
        "serve"
      ],
      "command": "gmail-attachments-mcp"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-zayansalman-gmail-attachments-mcp)](https://mcppedia.org/s/io-github-zayansalman-gmail-attachments-mcp)

Read me

What io.github.zayansalman/gmail-attachments-mcp does

A focused Model Context Protocol server (and standalone CLI) for downloading Gmail attachments to disk. Three tools, read-only OAuth scope, no extra surface area.

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

uvx 'gmail-attachments-mcp' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

83/100across 5 weighted dimensions

How we score →

0255075100

−17

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

Checked gmail-attachments-mcp against OSV.dev.

Inventory

Tools (7)

Click any tool to inspect its schema.

~278 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.zayansalman/gmail-attachments-mcp safe to use?: io.github.zayansalman/gmail-attachments-mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
How do I install io.github.zayansalman/gmail-attachments-mcp?: io.github.zayansalman/gmail-attachments-mcp supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can io.github.zayansalman/gmail-attachments-mcp do?: io.github.zayansalman/gmail-attachments-mcp provides 7 tools: Features, Install, Configuration, Security, Troubleshooting and 2 more. See the full tools list on the server page for descriptions and parameters.
What AI clients work with io.github.zayansalman/gmail-attachments-mcp?: io.github.zayansalman/gmail-attachments-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.
Is io.github.zayansalman/gmail-attachments-mcp actively maintained?: io.github.zayansalman/gmail-attachments-mcp is actively maintained — last commit was 21 days ago.

Similar servers

Others in communication / security

View all →

Mcp_agent_mail96

Asynchronous coordination layer for AI coding agents: identities, inboxes, searchable threads, and advisory file leases over FastMCP + Git + SQLite

2.0k 6

Ida Pro Mcp92

AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.

9.8k 3

io.github.jasonxkensei/xproof92

Proof primitive for AI agents on MultiversX. Anchor file hashes on-chain as verifiable proofs.

1 1

Mcp Windbg91

Model Context Protocol for WinDBG

1.4k 7

MCP Security Weekly

Get CVE alerts and security updates for io.github.zayansalman/gmail-attachments-mcp and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

Communication Security

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "gmail-attachments": {
      "args": [
        "serve"
      ],
      "command": "gmail-attachments-mcp"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-zayansalman-gmail-attachments-mcp)](https://mcppedia.org/s/io-github-zayansalman-gmail-attachments-mcp)

Read me

What io.github.zayansalman/gmail-attachments-mcp does

A focused Model Context Protocol server (and standalone CLI) for downloading Gmail attachments to disk. Three tools, read-only OAuth scope, no extra surface area.

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

uvx 'gmail-attachments-mcp' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

README

gmail-attachments-mcp

A focused Model Context Protocol server (and standalone CLI) for downloading Gmail attachments to disk. Three tools, read-only OAuth scope, no extra surface area.

Built because the hosted claude.ai Gmail connector in Claude Desktop returns attachment IDs and metadata only — not the actual bytes. This server fills that gap for any MCP client (Claude Code, Claude Desktop, Cursor, Cline, etc.), and also works as a plain CLI for cron jobs and shell scripts.

If you used @GongRzhe/Gmail-MCP-Server (1.1k★, archived 2026-03-03) for its attachment-download workflow, this is a minimal successor focused on that single capability.

Features

3 MCP tools — gmail_search, gmail_download_thread_attachments, gmail_download_latest_matching. That's the whole API.
Read-only OAuth scope (gmail.readonly) — can't send, delete, or modify mail.
Works as both an MCP server and a standalone CLI — same code, same auth token, both surfaces.
Env-var-driven config — GMAIL_MCP_CREDENTIALS, GMAIL_MCP_TOKEN, GMAIL_MCP_DEFAULT_DEST_DIR.
Cron-friendly — once authorized, the cached refresh token lets headless jobs run indefinitely.

Install

pip install gmail-attachments-mcp
# or, with uv:
uv tool install gmail-attachments-mcp

One-time setup (~10 minutes)

You need a Google Cloud OAuth client. The server runs entirely on your machine; nothing leaves it.

Sign in to Google Cloud Console with the Gmail account whose attachments you want to download.
Create a project (or pick an existing one).
Enable the Gmail API: console.cloud.google.com/apis/library/gmail.googleapis.com.
Configure the OAuth consent screen under APIs & Services → OAuth consent screen:
- Google Workspace users: User type = Internal (no app verification needed).
- Personal Gmail users: User type = External. Add your own Gmail address as a test user under "Test users".
APIs & Services → Credentials → + Create credentials → OAuth client ID
- Application type: Desktop app
- Download the JSON.
Run setup:

gmail-attachments-mcp setup --import-credentials ~/Downloads/client_secret_*.json

A browser window opens for OAuth consent. After consent, a refresh token is cached at ~/.config/gmail-attachments-mcp/token.json (or $XDG_CONFIG_HOME/gmail-attachments-mcp/).

Verify:

gmail-attachments-mcp status
gmail-attachments-mcp search "has:attachment newer_than:7d" --max 3

See docs/setup-google-oauth.md for screenshots and troubleshooting.

Use it from Claude Code

claude mcp add --scope user gmail-attachments gmail-attachments-mcp -- serve

Then in any Claude Code session:

Use the gmail-attachments MCP to download the latest CV from careers@example.com to ~/CVs.

Use it from Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json (Mac) or %APPDATA%/Claude/claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "gmail-attachments": {
      "command": "gmail-attachments-mcp",
      "args": ["serve"]
    }
  }
}

Restart Claude Desktop. See docs/claude-desktop.md for details.

Use it from Cursor / Cline / Continue / others

Any MCP client that supports stdio servers. Point it at the same gmail-attachments-mcp serve command. See docs/other-clients.md.

Use it from the shell or cron

# Search
gmail-attachments-mcp search "from:noreply@stripe.com has:attachment newer_than:30d"

# Download every attachment from a specific thread
gmail-attachments-mcp thread 19db831fab15b507 --dest ~/Invoices

# Download from the lat

... [View full README on GitHub](https://github.com/zayansalman/gmail-attachments-mcp#readme)

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

83/100across 5 weighted dimensions

How we score →

0255075100

−17

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

Checked gmail-attachments-mcp against OSV.dev.

Inventory

Tools (7)

Click any tool to inspect its schema.

~278 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is io.github.zayansalman/gmail-attachments-mcp safe to use?: io.github.zayansalman/gmail-attachments-mcp has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
How do I install io.github.zayansalman/gmail-attachments-mcp?: io.github.zayansalman/gmail-attachments-mcp supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can io.github.zayansalman/gmail-attachments-mcp do?: io.github.zayansalman/gmail-attachments-mcp provides 7 tools: Features, Install, Configuration, Security, Troubleshooting and 2 more. See the full tools list on the server page for descriptions and parameters.
What AI clients work with io.github.zayansalman/gmail-attachments-mcp?: io.github.zayansalman/gmail-attachments-mcp is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.
Is io.github.zayansalman/gmail-attachments-mcp actively maintained?: io.github.zayansalman/gmail-attachments-mcp is actively maintained — last commit was 21 days ago.