Name: Protonlite
Author: Maytrella007

Protonlite MCP

Python Proton Mail, Calendar, Contacts and Drive client with an MCP server. Free plan, no Bridge.

Grade A Local · stdio No auth needed 18 tools v0.1.3 MIT

No reviews yet by Maytrella007PyPI 1,529 Runs on your machine, nothing hosted

94/100

trust score

downloads a day

local

runs on your machine

190

downloads in 30d

What it does

Python Proton Mail, Calendar, Contacts and Drive client with an MCP server. Free plan, no Bridge.

Quickstart

# 1 — add it to Claude Code
claude mcp add --scope user --env 'PROTONLITE_SESSION=${PROTONLITE_SESSION}' --transport stdio protonlite-mcp '--' uvx --from 'protonlite[mcp]' protonlite-mcp

# 2 — ask your agent for something these tools do
#   list_messages, read_message, search_messages and 15 more

It needs PROTONLITE_SESSION: this reads it from your environment, so export it first.

Protonlite costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.

Publishernot claimed

Maytrella0071 server

1 category

All 1 server

Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.

Installation

Where are you running it?

Every route below installs the same thing and ends at the same approval screen. This one runs on your machine: your client starts Protonlite as a process under your own user, with your files and your network, so the tool surface below is what it can do to your computer rather than to a server somewhere else. Its scan result is on the Security tab — read the surface before you approve it.

Claude Codedeclared by this listing

This is a public server: you run it yourself and this marketplace is not in the path. You need uv (docs.astral.sh/uv): uvx comes with it. Claude Code registers it in one command; --scope user makes it available in every project. Claude Code reads PROTONLITE_SESSION (Path to the session file saved by `protonlite login`. The server reuses it and never takes a password) from your environment each time it starts the server, so the value stays out of its config: export it in your shell profile (macOS, Linux), or run setx PROTONLITE_SESSION … and open a new terminal (Windows). The '--' is in quotes so that PowerShell passes it on.

claude mcp add --scope user --env 'PROTONLITE_SESSION=${PROTONLITE_SESSION}' --transport stdio protonlite-mcp '--' uvx --from 'protonlite[mcp]' protonlite-mcp

Reconnect, or start a new session, and the tools appear in the model’s tool list.

Free on mcprush, and it runs from its publisher’s own package: this marketplace is not in the path, so there is no key of ours to hold and no card to add.

What it asks of you

It reaches a system of yours, so it needs settings only you can give it: PROTONLITE_SESSION — Path to the session file saved by `protonlite login`. The server reuses it and never takes a password.. You set it in your own client’s config, on your machine — this marketplace never holds it.

What it writes

One config entry your client uses to start the process locally. A local server runs with your file system and your network, which is why it is priced without metering.

What you approve

18 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.

Tool surface

What the model actually sees. Descriptions are diffed on every release — see version history.

Only tools that write or reach the network

Read from its source code. A server that builds its tool list when it starts can list more tools than this.

List messages in a Proton Mail folder (inbox, sent, archive, spam, trash, starred...).

Parameter	Type	Required	Notes
folder	string	no	—
unread_only	boolean	no	—
limit	integer	no	—

Read one Proton Mail message by id, decrypted, with HTML flattened to prose.

Parameter	Type	Required	Notes
message_id	string	yes	—

Find messages whose sender or subject contains the query.

Parameter	Type	Required	Notes
query	string	yes	—
limit	integer	no	—

Send an email. Plain text by default; set html=true to send the body as HTML.

Parameter	Type	Required	Notes
to	array	yes	—
subject	string	yes	—
body	string	yes	—
html	boolean	no	—
attachments	array	no	—
confirm	boolean	no	—

Show the send policy: which recipients the allowlist permits (or that it is open), any hard ceiling set by the PROTON_ALLOWED_RECIPIENTS env var, and whether a send needs confirmation.

Takes no parameters.

Set the recipient allowlist for send_message. Pass specific addresses or globs (e.g. *@company.com) to restrict sending to them, ["*"] to allow anyone, or [] to block all sending. A hard ceiling from PROTON_ALLOWED_RECIPIENTS still applies on top and cannot be loosened here.

Parameter	Type	Required	Notes
recipients	array	yes	—

Turn the 'confirm before sending' rule on or off. When on, send_message sends nothing until it is called again with confirm=true, so a person can approve first.

Parameter	Type	Required	Notes
required	boolean	yes	—

Show the Proton Calendar agenda for the next N days.

Parameter	Type	Required	Notes
days	integer	no	—

List Proton contacts (name and email), optionally filtered by a query.

Parameter	Type	Required	Notes
query	string	no	—

List a Proton Drive folder by path (folders first); empty path is the root.

Parameter	Type	Required	Notes
path	string	no	—

Download and decrypt a Proton Drive file to a local directory.

Parameter	Type	Required	Notes
path	string	yes	—
dest_dir	string	no	—

Encrypt and upload a local file into a Proton Drive folder (empty dest_folder is the root).

Parameter	Type	Required	Notes
local_path	string	yes	—
dest_folder	string	no	—
name	string	no	—
mime_type	string	no	—

Create a new Proton Drive folder (empty parent_folder is the root).

Parameter	Type	Required	Notes
name	string	yes	—
parent_folder	string	no	—

Move a Proton Drive file or folder into another folder (empty dest_folder is the root).

Parameter	Type	Required	Notes
path	string	yes	—
dest_folder	string	yes	—

Rename a Proton Drive file or folder in place.

Parameter	Type	Required	Notes
path	string	yes	—
new_name	string	yes	—

Move a Proton Drive file or folder to the trash (recoverable in Proton Drive).

Parameter	Type	Required	Notes
path	string	yes	—

Create a public share link for a Proton Drive file or folder. The returned URL is the whole secret (its fragment holds the password) and lets anyone open the file, so only share it when the person asked to make this file public.

Parameter	Type	Required	Notes
path	string	yes	—

Revoke a Proton Drive file or folder's public share link.

Parameter	Type	Required	Notes
path	string	yes	—

Free

$0 forever

Every tool, no call limit
No card, and mcprush charges nothing for it
Source published under MIT
Runs on your machine — nothing of it reaches our gateway
Nothing to cap, because mcprush bills nothing

Nothing here is billable: mcprush charges nothing to install Protonlite or to call it, at any volume.

ATrust score 94 / 100

Release 0.1.3 · scanned 28 Oct 2026

Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.

Threat score100

Client score94

Findings1 threat · 1 capability

Capabilityhigh

Coveragesource

Verificationsource

Surface digest9505ad1fbd915f6cff0d046bc4d543ac58500accb32557f84f73cad848bbc812

Score vectorthreat 100 → client 94

Term	Level	What it prices	Points
capability-exposure	high	capability blast radius (high) — client exposure if the model is manipulated	−6
verification-discount	source	publisher verification (provenance) — cryptographic build provenance ties the artifact to its source	−0
coverage-honesty	source	inspection depth (source) — how much of the target the scan could see	−0

score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.

What the scan could actually read

A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.

Tool surfaceread

Implementation sourceread

Package metadataread

Live transportnot available

Tools were statically extracted from the published source (18 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".

Capability — what it could do if the model were manipulated

Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. high is the level these add up to.

Tool	Capability tags	Why the tag was assigned
list_messages	no tags
read_message	untrusted-input	untrusted-input: keyword "read_message"
search_messages	no tags
send_message	external-sink	external-sink: keyword "send_message"
email_policy_status	no tags
email_allow	no tags
set_send_confirmation	no tags
calendar	no tags
contacts	no tags
drive_list	no tags
drive_download	untrusted-input	untrusted-input: keyword "download"
drive_upload	no tags
drive_mkdir	no tags
drive_move	no tags
drive_rename	no tags
drive_trash	no tags
drive_share_link	no tags
drive_unshare_link	no tags

Toxic-flow graph

The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.

flow-1

Untrusted input can drive an external action even though no sensitive source is exposed.

Supply chain and provenance

Integrityfirst-seen

Surface digest9505ad1fbd915f6c

Scanned2026-10-28

This is the first scan of this surface here, so there is nothing yet to compare it against.

Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.