Read a message

This page shows how to print one message in the terminal, read an OpenPGP message and save an attachment to a file.

Find the id

tcli read takes the account and the id of the message. The id is the first column of a cache search:

tcli cache search work lunch

1793894124.2_1.host  2026-11-07 12:00  INBOX  Bob <bob@example.org>  Lunch

Show the message

tcli read work 1793894124.2_1.host

Security: not checked: OpenPGP is off, set enabled = true in the [pgp] section to decrypt and verify messages
From: Bob <bob@example.org>
To: ada@example.org
Date: 2026-11-07 12:00
Subject: Lunch

    Lunch at noon?

The command prints the Security: lines, then From, To, Cc, Date and Subject, the text indented by four spaces, and the list of the attachments with their number, name, type and size. The message is looked for in INBOX. For another folder give it:

tcli read work 1793894124.2_1.host --folder Lists

A message that is not in that folder exits with 1 and says so.

Read an OpenPGP message

With [pgp] on, tcli read decrypts the message and checks the signature. PGP/MIME, inline PGP and the copy that Proton Bridge rebuilds are all opened. The Security: lines tell what was found: none for a plain message, encrypted to <key id>, signature <state>, <user id>, <fingerprint>, and partly protected when some part is neither signed nor encrypted. A bad signature is shown as Bad, never as good. gpg-agent asks for the passphrase with the pinentry you already use.

A message that cannot be decrypted exits with 1 and names the keys it is encrypted to; none of its text is shown. With [pgp] off the message is shown as the store has it, and the first line says it was not checked. Setting it up is on OpenPGP.

Save an attachment

tcli read proton 1793894123.202992_1.indy --attachment 0 --output key.asc

--attachment is the number from the list and --output is the file to write. The two go together: --output alone is a usage error. The file must not exist: tcli never writes over a file or through a link, and it creates the file readable by you only (mode 600). A file that exists or cannot be written exits with 1, and a number the message has no attachment for exits with 2.

What the command does not show

The text is written without the control characters of the message, so a message cannot write on your terminal or fake a Security: line. An HTML-only message says so and its HTML is not shown.

The command opens one connection to the account and drops it, so it starts no other account. Every option is in the reference of tcli.