Mail for Zoho

An unofficial open-source OpenAI plugin and safety package for Zoho's official Mail MCP service.

ChatGPT or Codex -> Zoho official MCP service -> Zoho Mail APIs

OnlineChefGroep is not in the mailbox data path. This project does not operate a proxy, receive Zoho OAuth tokens, store mailbox content or embed generated Zoho MCP URLs.

Mail for Zoho is not affiliated with or endorsed by Zoho Corporation or OpenAI.

What this solves

Zoho already provides the remote MCP server and its OAuth authorization flow. This repository provides a reusable ChatGPT/Codex package with safe workflow instructions, a reviewed capability boundary, validation and a managed-app submission packet.

A managed ChatGPT app or template is still a platform object. The repository intentionally contains no .app.json, app ID or template ID until OpenAI creates and assigns the real record.

Package contents

• .codex-plugin/plugin.json — discovery and interface metadata;
• .mcp.json — local/Codex launcher using the hardened Node wrapper;
• scripts/runtime-security.mjs — protected config parsing, endpoint validation, child-environment isolation and redaction;
• skills/zoho-mail/SKILL.md — inbox routing, live mailbox discovery and safety workflow;
• chatgpt/tool-policy.json — reviewed allow/deny contract and explicit enforcement boundary;
• openai/submission.json — machine-readable review payload;
• openai/APP_TEMPLATE.md — managed-template requirements;
• openai/SUBMISSION.md — directory submission checklist and listing copy;
• openai/evals.json — routing, privacy, injection and destructive-action evals.

Capability baseline

Release 1 supports mailbox and folder discovery, bounded message listing and search, message/thread reading, attachment metadata, mark read/unread, flag/unflag and drafting reply text in ChatGPT without sending.

Sending, replying, forwarding, deleting, trashing, purging, mailbox administration, delegation and security-setting changes are forbidden by the approved baseline.

The repository does not proxy or filter MCP tools at runtime. Enforce the baseline by selecting only approved tools on the Zoho MCP server, reviewing ChatGPT action controls, and running npm run verify:remote before publication and after every upstream tool change.

Managed ChatGPT setup

The intended installation flow is:

1. An administrator creates or selects a Zoho MCP server and enables only the approved Mail tools.
2. Zoho generates a unique secure MCP URL.
3. The administrator installs Mail for Zoho and configures that URL as a masked secret.
4. The administrator scans and reviews the tool surface and action controls before publishing the workspace app.
5. Authorized users connect through Zoho's OAuth flow.

See openai/APP_TEMPLATE.md. Publishing the managed app and assigning its real ID require OpenAI's platform or publisher flow and cannot be simulated in Git.

Direct custom connection

For development or a personal custom app:

1. Create or select a Zoho MCP server.
2. Add only the required Zoho Mail tools.
3. Copy the unique URL from Zoho MCP Console.
4. Store it outside Git as ZOHO_MCP_URL or in the protected config file documented in .env.example.
5. Create a custom remote MCP app in a supported ChatGPT surface and choose OAuth.

Detailed checks are in chatgpt/INSTALL.md.

Local bridge security

The optional local/Codex bridge is pinned to mcp-remote@0.1.37. The protected config file is parsed as data and never sourced as shell. It must be a non-symlink regular file with mode 0600 or stricter and may contain only ZOHO_MCP_URL (a legacy MCP_REMOTE_VERSION line is ignored). Default single-account mode resolves ZOHO_MCP_URL, then ZOHO_MCP_ENV, then ~/.config/mail-for-zoho/env. Profile mode uses ~/.config/mail-for-zoho/profiles/<slug>/env and an isolated MCP_REMOTE_CONFIG_DIR. The launcher spawns process.execPath with npx-cli.js (never npx.cmd) and redacts endpoints from stderr.

The launcher passes a minimal environment to npx, excludes unrelated credentials and code-injection variables, disables npm lifecycle scripts and fixes the npm registry. The endpoint remains visible in the bridge process arguments, so do not use the local bridge on an untrusted shared host.

Multiple mailboxes and identities

There are two different multi-account cases:

1. One authorized Zoho identity can return several mailbox accounts. The assistant always calls ZohoMail_getMailAccounts, maps mailbox addresses to live accountId values and selects automatically only for one returned account or one exact mailbox-address match. Otherwise it lists the available mailbox identities instead of guessing. Results and low-risk mutations stay scoped to one account and retain mailbox provenance.
2. Two independent Zoho identities require two independent MCP server connections. Each connection uses its own Zoho-generated MCP URL and OAuth cache. Grants, tokens, account IDs and message results are never combined.

For clients such as Cursor that support multiple MCP server entries, copy examples/cursor.multi-account.mcp.json. Create one protected file per profile:

~/.config/mail-for-zoho/profiles/work/env
~/.config/mail-for-zoho/profiles/personal/env

Each file must be a non-symlink regular file with mode 0600 and contain only one unquoted ZOHO_MCP_URL=... line. Start a profile with node scripts/run-local.mjs --profile work. Profile names accept only lowercase letters, digits and single hyphens.

The current managed ChatGPT template has one zoho_mcp_url field. Independent multi-login support is therefore guaranteed only in clients that support multiple MCP server connections.

Verification

npm test

export ZOHO_MCP_URL='RETRIEVE_FROM_A_SECRET_STORE'
npm run verify:remote

npm test validates plugin metadata, submission artifacts, public-source hygiene, pinned Actions, policy truthfulness, runtime isolation, config-file safety and the absence of embedded credentials or fabricated OpenAI IDs. verify:remote performs a sanitized MCP handshake and validates the live tool surface without printing the endpoint.

Publishing

This source tree is intended to be imported into a fresh public repository without the private repository's Git history. Do not make the private operational repository public as-is.

Before submission:

• verify privacy, terms and support URLs work without authentication;
• configure required reviewers on the zoho-remote-smoke GitHub environment before storing its secret;
• run the static and live verification suites on the exact release commit;
• create the real OpenAI app/template record;
• add .app.json only after OpenAI supplies a real app ID.

See openai/SUBMISSION.md, PRIVACY.md, TERMS.md, SECURITY.md, SUPPORT.md and NOTICE.