Hi all,
We run MDaemon on-premises and want to connect AI agents (Perplexity Computer and similar) to a few role mailboxes, with two tiers of access:
- Read-write (read, search, file/move, draft, send), for example an accounts-payable mailbox used for invoice processing.
- Read-only (read and search only), for other mailboxes.
We want the access to be as narrow as possible and enforced by the server, not just by the agent's own settings. For anyone who has done something like this:
- What setup has worked for you, especially when the agent runs in the cloud without a static IP? A dedicated agent account with shared-folder/ACL access, an XML API Service Account, IMAP with App Passwords, or something else?
- Have you made a mailbox truly read-only for a second account (Lookup + Read only)? Did that block IMAP MOVE/COPY, flag changes, and sending?
- Which auth/API do you use: the XML API, the Webmail API, or IMAP/SMTP with App Passwords? Has anyone gotten OAuth working for IMAP?
- How do you log and audit what the agent does, and how do you cut off its access quickly? Do you restrict its logins by IP, or put a reverse proxy in front?
- How do you guard against prompt injection or phishing, where an agent reads a malicious message and then sends mail that looks real? Outbound recipient limits, rate limits, approval holds?
- If you use MDaemon Hosted or Private Cloud, did any of this work differently?
I'd also like to hear more generally how other MDaemon admins are connecting AI agents or LLM tools, including any MCP servers or IMAP-based agents. I saw the earlier "Email Account Integration with AI" thread and wanted to pick up the conversation from there.
Thanks.
Short answer: MDaemon has no built-in AI connector, and no OAuth for IMAP/SMTP. Any agent that can use IMAP/SMTP can connect with an App Password. Perplexity Computer’s built-in email connectors cover only Gmail and Outlook. It does support custom remote MCP connectors, so run an open-source IMAP/SMTP MCP server on your own network. Perplexity calls that server, and the server logs in to MDaemon.
Recommended setup
- Read-write: the agent logs in as the accounts payable account with an App Password. Its mail is genuinely from the accounts payable account, and the logs show which App Password was used.
- Read-only: use a dedicated agent account that has Lookup + Read on the target folders. Set “Restrict SMTP access to LAN IPs only”, and turn off Webmail and ActiveSync for it. Never make it a global or domain admin: admins can log in to other accounts over IMAP, which bypasses folder permissions. To do this create an account that is used for this purpose, has no content in the local mailbox, but is granted access to shared and public folders.
1. Put the MCP server on your network and add its IP to LAN IPs. Then set “…but only from LAN IPs” for IMAP and SMTP on the agent accounts, so the App Passwords don’t work from anywhere else.
Several open-source MCP servers on GitHub run over HTTPS, and some have a read-only mode (e.g. mcp-imap, imap-mcp-server). Review the code before deploying, since the server holds the App Password. Treat its read-only mode as an extra layer, not a replacement for MDaemon’s own controls. I would avoid hosted MCP services, which hold your credentials and connect from cloud IPs.
2. Lookup + Read only.
- It blocks MOVE, EXPUNGE, APPEND, deletes and folder changes.
- Reading doesn’t mark messages as seen.
- Flag changes return OK but nothing changes.
- COPY into the agent’s own folders is allowed, since that’s still reading.
- Use MDaemon’s letters
l and r, for Lookup and Read access
- Give the agent an explicit entry on every public folder it can reach. Otherwise it gets the public-folder default permissions, which include write access.
- A permission change applies the next time the folder is opened.
- Folder permissions don’t control sending. The two “Credentials used must match…” options (on by default) do. Keep the agent accounts off the Send As and exemption lists.
3. Auth / API.
- App Passwords work for IMAP, SMTP, ActiveSync, CalDAV/CardDAV and the XML API, using plain-text login (PLAIN/LOGIN) over TLS.
- They can’t be limited to one protocol or to read-only. You can revoke each one separately, and MDaemon records its last-used time and IP.
- Turn on “Require app password…” for the agent accounts.
4. Logging and cut-off.
- Turn on detailed, separate log files per service. The IMAP log then records every command, and the SMTP log records which account sent each message.
- There’s no separate per-mailbox audit log.
- To cut off access: delete the App Password, freeze the account, and use Active Sessions → Disconnect for sessions that are already open.
5. Prompt-injection guardrails. These are all per account:
- Outbound Restrictions: allow only listed outside recipients. Send everything else “Sent to…” a reviewer, which is the closest thing to an approval hold.
- Maximum messages sent per day (this counts recipients).
- Hijack Detection, with “Freeze accounts when limit is reached”.
- A Content Filter rule on
X-Authenticated-Sender that copies everything the agent sends to an audit mailbox.
- Optionally Message Recall, which delays outgoing mail briefly.
I'll also add that we are looking into adding an MCP server with MDaemon that would simplify the entire setup and give better control of permissions.
English
Chinese (Simplified)
French
German
Italian
Japanese
Russian
Spanish
Vietnamese
