draftgate-mcp

An MCP server for email agents that cannot send mail without a human saying yes — unless you've explicitly told it otherwise for that contact.

Most "AI email assistant" demos either send freely (fine for a toy, unacceptable in production) or gate everything behind approval (safe, but defeats the point of automation for routine, low-stakes contacts). draftgate-mcp does neither: each contact carries its own trust level, and the send path enforces it deterministically — not by asking the model to "please be careful."

The pattern

Every contact has an auth_level:

Level	Behaviour
full	Sends immediately. No gate.
high	Sends immediately, unless the body contains a flagged keyword (contract, invoice, payment, password, confidential, legal) — then it's held for review instead.
ask	Always held as a draft. A human must explicitly call confirm_draft().
ask_before_draft	The agent isn't even allowed to compose a draft without permission first. This is the default for anyone not in contacts.json.

send_email() returns a status field — sent, draft_created, needs_review, or blocked — and the server's own instructions tell the calling model exactly what each status requires before it's allowed to proceed. The gate lives in code, not in a prompt asking the model nicely not to send things.

Unknown recipients default to the most restrictive level. An agent can't accidentally email someone it's never been told about — it has to be extended a trust level explicitly, by a human, first.

Tools

• read_inbox, read_message — read mail via IMAP
• send_email — the gated send path described above
• list_drafts, confirm_draft, discard_draft — manage held drafts
• list_contacts, add_contact, update_contact_auth — manage trust levels

Setup

pip install -r requirements.txt
cp .env.example .env        # fill in your IMAP/SMTP credentials
cp data/contacts.example.json data/contacts.json   # add your real contacts
python server.py

Point any MCP client (Claude Desktop, Claude Code, etc.) at server.py over stdio.

Why

This was extracted from the trust-tiering logic in a production email agent I run for my own inbox. The rest of that system — voice, telephony, task tracking, internal chat bridges — is specific to my own setup and not worth open-sourcing as-is, but the draft-gate pattern is a genuinely reusable answer to "how do you let an agent act without letting it act unsupervised." This repo is that pattern, stripped down to ~250 lines with no dependencies beyond the standard library, fastmcp, and python-dotenv.

License

MIT — see LICENSE.

Derek Manthorpe · github.com/DRMM101