Our grade: 4 checks
Based on public data, not a full audit. See how we grade. Something changed? Request a re-grade.
Community rating
- 5 2
- 4 7
- 3 4
- 2 5
- 1 0
Trust in production
- Trust it - 28%
- With caveats - 44%
- Wouldn't - 28%
61% would recommend this server
How reviewers scored it
- Setup & docs 3.2
- Auth experience 3.6
- Reliability 3.3
- Maintainer responsiveness 3.2
Why it got a C
Yahoo has no official MCP server. This MIT-licensed TypeScript server runs locally over stdio and talks only to Yahoo's IMAP and SMTP servers over TLS, with no shell-out and no advisories on record. It is the only Yahoo Mail server we found with switches the model cannot change: YAHOO_MCP_READ_ONLY removes every write tool and YAHOO_MCP_DRAFTS_ONLY swaps send_email for a save-to-Drafts tool, and mail content comes back marked as untrusted. Without either switch it sends mail, so a prompt-injected email can make it write to anyone. One person maintains it (last commit September 2026). Biggest deduction: Yahoo offers no scoped OAuth for mail, so the app password in your client config opens the whole mailbox, read, move, delete and send, and keeps working after a password change until you delete it.
How to connect
claude mcp add yahoo-mail --env YAHOO_EMAIL=you@yahoo.com --env YAHOO_APP_PASSWORD=xxxxxxxxxxxxxxxx --env YAHOO_MCP_DRAFTS_ONLY=true -- npx -y local-mcp-server-yahoo-mail// claude_desktop_config.json
{
"mcpServers": {
"yahoo-mail": {
"command": "npx",
"args": ["-y", "local-mcp-server-yahoo-mail"],
"env": {
"YAHOO_EMAIL": "you@yahoo.com",
"YAHOO_APP_PASSWORD": "your-16-char-app-password",
"YAHOO_MCP_DRAFTS_ONLY": "true"
}
}
}
}Is Yahoo Mail MCP Server (local-mcp-server-yahoo-mail) safe?
Is Yahoo Mail MCP Server (local-mcp-server-yahoo-mail) safe to use?
Yahoo Mail MCP Server (local-mcp-server-yahoo-mail) grades C (usable with care). Login is required, but access is coarse: one sign-in or key covers more than your agent needs, so grant the narrowest account you can. Updates are occasional, so fixes may be slow to arrive. It runs locally over stdio, so it acts with your machine's access.
Does Yahoo Mail MCP Server (local-mcp-server-yahoo-mail) have known vulnerabilities?
Not in our current data: it has no open CVEs or advisories. We re-check as new ones are published.
Does Yahoo Mail MCP Server (local-mcp-server-yahoo-mail) support authentication?
Yes. It requires a login, so access can be tied to a person or a scoped key.
Alternatives in Collaboration
- A Google Drive MCP ServerOfficial Google-hosted Drive server (Developer Preview) to search, read, download, create, and copy files, with scoped OAuth.
- A Pragor Project Board MCP ServerHosted server that connects an agent to a Pragor project board to read and update messages, tasks and operations, with a per-agent token limited to its project role.
- A Slack MCP ServerOfficial hosted Slack server to search and read messages, files, and canvases, and send messages as you.
- A monday.com MCPmonday.com's official MCP server, hosted at mcp.monday.com or run locally from npm, to read and update boards, items, columns, updates and forms.
- B Asana MCPOfficial hosted Asana server to search, read, create, and update tasks and projects, with OAuth sign-in.
Embed this badge
[](https://trustedmcp.io/servers/yahoo-mail-mcp)<a href="https://trustedmcp.io/servers/yahoo-mail-mcp"><img src="https://trustedmcp.io/badge/yahoo-mail-mcp.svg" alt="TrustedMCP grade C" height="80"></a>Community reviews
Too much access for my comfort
I wanted to like this one. Setting up the token took longer than the server itself, but the scoping options are decent. For anything real I would look elsewhere.
Used for Keeping project boards up to date
- Setup & docs 2/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 3/5
Does what it says, no drama
Started with it as an experiment, now it is a fixture. Issues get answered eventually. Not fast, not abandoned. Auth is there, but the credential still lives in my local config, so I keep that file locked down. I would use it in prod, but only with a human approving writes.
Used for Keeping project boards up to date
- Setup & docs 4/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 3/5
Solid core, fiddly setup
Works well enough for what I need. Auth is there, but the credential still lives in my local config, so I keep that file locked down. Not something I would put in production yet.
Used for Posting daily standup summaries
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 3/5
Would not run this unattended
It works in a demo, but things got shaky under real use. Release pace is moderate, so I pin a version and check in monthly.
Used for Searching old conversations for decisions
- Setup & docs 2/5
- Auth experience 3/5
- Reliability 2/5
- Maintainer responsiveness 3/5
Too many sharp edges
Ran into problems pretty quickly. Auth is there, but the credential still lives in my local config, so I keep that file locked down.
Used for Drafting announcements
- Setup & docs 2/5
- Auth experience 3/5
- Reliability 2/5
- Maintainer responsiveness 3/5
Worth the five minutes to set up
Of the Yahoo Mail (local---yahoo-mail) integrations I tried, this one is the most predictable. You create a token and pass it in. Scope it narrowly, that is the main thing.
Used for Summarising channels I missed
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 5/5
- Maintainer responsiveness 4/5
Trustworthy enough for real work
I use this almost daily. The scope options are worth reading carefully, the defaults are broader than I wanted. You create a token and pass it in. Scope it narrowly, that is the main thing. Updates are a bit slow, but it is stable enough that it has not mattered.
Used for Turning chat threads into tasks
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 3/5
- Maintainer responsiveness 3/5
Not ready for anything that matters
Gave it a fair shot over two weeks. Setting up the token took longer than the server itself, but the scoping options are decent. Release pace is moderate, so I pin a version and check in monthly.
Used for Posting daily standup summaries
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 2/5
- Maintainer responsiveness 2/5
Went back to calling the API directly
Setup was rough and the result was flaky. Setting up the token took longer than the server itself, but the scoping options are decent. Release pace is moderate, so I pin a version and check in monthly.
Used for Summarising channels I missed
- Setup & docs 2/5
- Auth experience 4/5
- Reliability 2/5
- Maintainer responsiveness 2/5
Earned a permanent spot in my config
Simple to set up in Cursor, simple to reason about. Setting up the token took longer than the server itself, but the scoping options are decent.
Used for Posting daily standup summaries
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 5/5
- Maintainer responsiveness 4/5
OK for read-only work
Good for experimenting, still deciding about production. The OAuth flow worked first time in Claude Code. Issues get answered eventually. Not fast, not abandoned. Auth is there, but the credential still lives in my local config, so I keep that file locked down. Worth it, just do not skip the hardening steps.
Used for Keeping project boards up to date
- Setup & docs 2/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 3/5
Quietly reliable
Tried it on a side project first, then rolled it out at work. Setting up the token took longer than the server itself, but the scoping options are decent. Happy to run it in production.
Used for Meeting prep from shared docs
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Does the job, docs could be better
I like it, with reservations. Updates are a bit slow, but it is stable enough that it has not mattered. You create a token and pass it in. Scope it narrowly, that is the main thing. Fine in production if you sandbox it.
Used for Drafting announcements
- Setup & docs 2/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 3/5
Promising, a bit raw
Mostly reliable, with the odd timeout. You create a token and pass it in. Scope it narrowly, that is the main thing.
Used for Searching old conversations for decisions
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 3/5
Our team uses it every day
Hooked Yahoo Mail MCP Server (local-mcp-server-yahoo-mail) into Claude Code and it worked on the first try. Release pace is moderate, so I pin a version and check in monthly. You create a token and pass it in. Scope it narrowly, that is the main thing. Would recommend without hesitation.
Used for Summarising channels I missed
- Setup & docs 5/5
- Auth experience 4/5
- Reliability 5/5
- Maintainer responsiveness 4/5
Better than the DIY script it replaced
Replaced a homegrown script with Yahoo Mail MCP Server (local-mcp-server-yahoo-mail) and have not looked back. It is community maintained, so I pin the version and read the changelog before upgrading. Recommended, with sensible guardrails.
Used for Meeting prep from shared docs
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Solid and well behaved
Clear tool names, sensible outputs, very few surprises. Auth is there, but the credential still lives in my local config, so I keep that file locked down. Updates are a bit slow, but it is stable enough that it has not mattered.
Used for Drafting announcements
- Setup & docs 3/5
- Auth experience 4/5
- Reliability 3/5
- Maintainer responsiveness 3/5
Exactly what I needed from Yahoo Mail (local---yahoo-mail)
Installed it on a Friday, it was part of my workflow by Monday. You create a token and pass it in. Scope it narrowly, that is the main thing. Keep permissions tight and it is a good tool.
Used for Turning chat threads into tasks
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 3/5
- Maintainer responsiveness 4/5
Write a review
Ran this server? Tell other teams how it went. You get one review per server. We email you a link to confirm it, then an editor checks it before it goes up. We never show your email.