万屋猫Labs

Building a Bridge-Free ProtonMail MCP Server

Thu, 02 Apr 2026 00:00:00 +0900

The Problem

Every existing ProtonMail MCP server requires Proton Bridge — a paid desktop app. Free ProtonMail users have no way to integrate their email with AI assistants.

I found 11 existing ProtonMail MCP projects on GitHub. All of them require Bridge.

The Solution

I built protonmail-mcp — a Go MCP server that talks directly to Proton’s API using only their official open-source libraries:

go-proton-api — The same library used by Proton Bridge itself
go-srp — SRP authentication
gopenpgp — PGP encryption/decryption

No third-party API wrappers. No supply chain risk from unknown packages handling your passwords and private keys.

Disclosure under the Specified Commercial Transactions Act

Thu, 02 Apr 2026 00:00:00 +0900

Item	Details
Business Name	Yorozuya Neko Labs (万屋猫Labs)
Contact	contact@yn-labs.com
Pricing	See Services page
Payment Method	Bank transfer
Payment Terms	Invoiced after delivery, due within 30 days
Service Delivery	Per agreed timeline after contract
Cancellation Policy	No refund after work begins. Full refund if cancelled before work starts
Representative	Ichiburn (Yorozuya Neko Labs)
Address / Phone	Disclosed upon request without delay

KalmarCTF 2026 RootBabyKalmarCTF Writeup — Zip Slip (CVE-2026-30345) for CTFd Root

Sun, 29 Mar 2026 00:00:00 +0900

Overview

KalmarCTF 2026 Web challenge “RootBabyKalmarCTF” (170pts).
A CTFd 3.8.1 instance is provided with admin credentials for the management panel.
The goal is to read /flag2-<random>.txt as root, not admin.

Vulnerability

CVE-2026-30345: CTFd 3.8.1 Zip Slip (Path Traversal)

The /admin/import backup import function checks if ZIP file entry names contain ...
However, the check can be bypassed using the uploads//absolute/path format (double slash).

The Check

for f in members:
 if f.startswith("/") or ".." in f:
 raise zipfile.BadZipfile

The Bypass

Entry name: uploads//opt/CTFd/manage.py

About

Mon, 01 Jan 0001 00:00:00 +0000

About Yorozuya Neko Labs

Who is Ichiburn?

Sole proprietor specializing in AI automation and security.
“Yorozuya” (万屋) means “general store” — we solve any technical challenge you throw at us.

Skills

AI Automation: MCP Development, LLM Integration, AI Workflow Automation
Security: Bug Bounty, Web Pentesting, CTF (Pwn/Web), Security Review Automation
Infrastructure: Terraform, Cloudflare, AWS, OCI, Docker, GitHub Actions
Development: Go, Rust, Python, TypeScript, Next.js, .NET

OSS

protonmail-mcp — Bridge-free ProtonMail MCP server for AI assistants

Contact

Reach out via the inquiry form or contact@yn-labs.com.

Services

Mon, 01 Jan 0001 00:00:00 +0000