| IMAP_HOST | Yes | Hostname of the IMAP server, e.g. imap.example.net |
| IMAP_USER | Yes | Mailbox user name |
| IMAP_PASSWORD | Yes | Mailbox password or app password Secret. |
| IMAP_PORT | No | Defaults to 993 with implicit TLS, 143 otherwise |
| IMAP_TLS | No | implicit (default), starttls or none |
| IMAP_MAILBOX | No | Default mailbox to work in (default: INBOX) |
| IMAP_SEEN_KEYWORD | No | IMAP keyword marking what the assistant has already seen (default: AiSeen) |
| IMAP_READ_ONLY | No | Set to false to register the mailbox write tools; defaults to true |
| IMAP_ALLOW_TOOLS | No | Comma-separated tool names or list_* prefixes to register; 'essential' selects a curated preset (default: all tools) |
| IMAP_DENY_TOOLS | No | Comma-separated tool names or list_* prefixes to remove from whatever IMAP_ALLOW_TOOLS left |
| IMAP_DOWNLOAD_DIR | No | Directory attachments may be written to; unset means the server never touches the filesystem |
| IMAP_INSECURE_TLS | No | Set to true to accept self-signed certificates, scoped to this connection |
| IMAP_DRAFTS_MAILBOX | No | Drafts folder to save into; by default the one flagged \Drafts is used |
| IMAP_MAX_MESSAGES | No | Default number of messages a listing returns (default: 100) |
| IMAP_MAX_ATTACHMENT_BYTES | No | Ceiling for returning an attachment inline (default: 1048576) |
| IMAP_MAX_DOWNLOAD_BYTES | No | Ceiling for writing an attachment to disk (default: 26214400) |
| IMAP_MAX_EXTRACT_BYTES | No | Ceiling for reading a document's text with mode=text (default: 10485760, maximum: 67108864) |
| IMAP_ATTACHMENT_TYPES | No | Comma-separated content-type allowlist for attachments |
| IMAP_TRUSTED_AUTHSERV_ID | No | authserv-id your provider stamps into Authentication-Results; without it every verdict is reported as forgeable |
| IMAP_HOST | Yes | Hostname of the IMAP server, e.g. imap.example.net |
| IMAP_USER | Yes | Mailbox user name |
| IMAP_PASSWORD | Yes | Mailbox password or app password Secret. |
| IMAP_PORT | No | Defaults to 993 with implicit TLS, 143 otherwise |
| IMAP_TLS | No | implicit (default), starttls or none |
| IMAP_MAILBOX | No | Default mailbox to work in (default: INBOX) |
| IMAP_SEEN_KEYWORD | No | IMAP keyword marking what the assistant has already seen (default: AiSeen) |
| IMAP_READ_ONLY | No | Set to false to register the mailbox write tools; defaults to true |
| IMAP_ALLOW_TOOLS | No | Comma-separated tool names or list_* prefixes to register; 'essential' selects a curated preset (default: all tools) |
| IMAP_DENY_TOOLS | No | Comma-separated tool names or list_* prefixes to remove from whatever IMAP_ALLOW_TOOLS left |
| IMAP_DOWNLOAD_DIR | No | Directory attachments may be written to; unset means the server never touches the filesystem |
| IMAP_INSECURE_TLS | No | Set to true to accept self-signed certificates, scoped to this connection |
| IMAP_DRAFTS_MAILBOX | No | Drafts folder to save into; by default the one flagged \Drafts is used |
| IMAP_MAX_MESSAGES | No | Default number of messages a listing returns (default: 100) |
| IMAP_MAX_ATTACHMENT_BYTES | No | Ceiling for returning an attachment inline (default: 1048576) |
| IMAP_MAX_DOWNLOAD_BYTES | No | Ceiling for writing an attachment to disk (default: 26214400) |
| IMAP_MAX_EXTRACT_BYTES | No | Ceiling for reading a document's text with mode=text (default: 10485760, maximum: 67108864) |
| IMAP_ATTACHMENT_TYPES | No | Comma-separated content-type allowlist for attachments |
| IMAP_TRUSTED_AUTHSERV_ID | No | authserv-id your provider stamps into Authentication-Results; without it every verdict is reported as forgeable |