diff --git a/README.md b/README.md
index 73838db..91491e8 100644
--- a/README.md
+++ b/README.md
@@ -13,50 +13,39 @@ An MCP server that bridges IMAP/SMTP email accounts to [Poke](https://poke.com).
 
 ## Quick Start
 
-### Automated setup (recommended)
-
 ```bash
 git clone https://github.com/kacperkwapisz/poke-mail.git
 cd poke-mail
 ```
 
-If you haven't logged into Poke yet, do that first — it lets `setup.sh` pick up your token automatically:
+If you haven't logged into Poke yet, do that first — `start.sh` will pick up your token automatically:
 
 ```bash
 npx poke login
 ```
 
-Then run the setup script:
-
-```bash
-bash setup.sh
-```
-
-`setup.sh` will:
-1. Create a Python virtualenv and install dependencies
-2. Detect your Poke API key from `poke login` credentials (or prompt you to paste one)
-3. Copy `config.example.yml` → `config.yml` and inject the API key automatically
-4. Generate a random `MCP_API_KEY` and write it to `.env`
-5. Ensure the `poke` npm package is installed globally
-
-After setup, open `config.yml` and fill in your email account credentials, then start the server:
+Then just run:
 
 ```bash
 ./start.sh
 ```
 
+On the **first run**, `start.sh` automatically handles the full setup:
+1. Creates a Python virtualenv and installs dependencies
+2. Copies `config.example.yml` → `config.yml`
+3. Reads your Poke API key from `poke login` credentials and injects it into `config.yml`
+4. Generates a random `MCP_API_KEY` and saves it to `.env`
+
+After that first run, open `config.yml` and fill in your email account credentials. Run `./start.sh` again to start the server.
+
+On **subsequent runs**, `start.sh` skips setup and goes straight to starting the server and tunnel.
+
 ### AI coding agent setup
 
 Copy this prompt into your AI coding agent (Claude Code, Cursor, etc.):
 
 ```text
-Set up poke-mail (https://github.com/kacperkwapisz/poke-mail) for me — clone the repo, run 'npx poke login' so I can authenticate with Poke (wait for me to confirm), then run 'bash setup.sh' which will automatically wire up my Poke API key, generate an MCP_API_KEY, and set up the virtualenv — then help me configure config.yml with my email credentials (guide me on IMAP/SMTP host and port for my provider but do NOT type passwords or secrets — tell me to enter those myself and confirm when done) — then run start.sh to start the server and tunnel it to Poke.
-```
-
-To start the server again later:
-
-```bash
-./start.sh
+Set up poke-mail (https://github.com/kacperkwapisz/poke-mail) for me — clone the repo, run 'npx poke login' so I can authenticate with Poke (wait for me to confirm), then run './start.sh' which will automatically wire up my Poke API key, generate an MCP_API_KEY, and set up the virtualenv — then help me fill in my email credentials in config.yml (guide me on IMAP/SMTP host and port for my provider but do NOT type passwords or secrets — tell me to enter those myself and confirm when done) — then run ./start.sh again to start the server and tunnel it to Poke.
 ```
 
 ## Manual Setup
diff --git a/start.sh b/start.sh
old mode 100755
new mode 100644
index b336914..7032b37
--- a/start.sh
+++ b/start.sh
@@ -3,7 +3,7 @@ set -euo pipefail
 
 cd "$(dirname "$0")"
 
-# Check for updates
+# ── Check for updates ─────────────────────────────────────────────────────────
 REPO="kacperkwapisz/poke-mail"
 LOCAL_SHA=$(git rev-parse HEAD 2>/dev/null || echo "unknown")
 REMOTE_SHA=$(curl -sf "https://api.github.com/repos/${REPO}/commits/main" \
@@ -17,19 +17,119 @@ if [ -n "$REMOTE_SHA" ] && [ "$REMOTE_SHA" != "$LOCAL_SHA" ]; then
   echo ""
 fi
 
-# Load .env if present
+# ── One-time setup (skipped on subsequent runs) ───────────────────────────────
+
+# 1. Python virtualenv + dependencies
+if [ ! -d .venv ]; then
+  echo "First run — setting up poke-mail..."
+  echo ""
+  echo "Creating Python virtualenv (.venv)..."
+  python3 -m venv .venv
+fi
+source .venv/bin/activate
+
+if ! python3 -c "import fastmcp" &>/dev/null 2>&1; then
+  echo "Installing Python dependencies..."
+  pip install -q -r requirements.txt
+  echo "  ✓ Dependencies installed"
+  echo ""
+fi
+
+# 2. config.yml — copy example if missing
+if [ ! -f config.yml ]; then
+  echo "Copying config.example.yml → config.yml..."
+  cp config.example.yml config.yml
+  echo "  ✓ config.yml created"
+  echo ""
+fi
+
+# 3. Poke API key — read from 'poke login' credentials, inject into config.yml
+#    The 'poke' npm package writes ~/.config/poke/credentials.json { "token": "..." }
+#    after 'npx poke login'. We auto-read it so the user never has to copy/paste.
+if grep -q 'your-api-key-here' config.yml 2>/dev/null; then
+  POKE_CREDENTIALS_FILE="${XDG_CONFIG_HOME:-$HOME/.config}/poke/credentials.json"
+  POKE_TOKEN=""
+
+  if [ -f "$POKE_CREDENTIALS_FILE" ]; then
+    POKE_TOKEN=$(python3 -c "
+import json
+try:
+    data = json.load(open('$POKE_CREDENTIALS_FILE'))
+    print(data.get('token', ''))
+except Exception:
+    print('')
+" 2>/dev/null || true)
+  fi
+
+  if [ -n "$POKE_TOKEN" ]; then
+    echo "  ✓ Poke API key detected from 'poke login'"
+    python3 - <<PYEOF
+import re
+with open('config.yml', 'r') as f:
+    content = f.read()
+new_content = re.sub(r'(poke_api_key:\s*)[^\n]+', r'\g<1>"${POKE_TOKEN}"', content)
+with open('config.yml', 'w') as f:
+    f.write(new_content)
+PYEOF
+    echo "  ✓ poke_api_key written to config.yml"
+    echo ""
+  else
+    echo "  ⚠  poke_api_key not set in config.yml."
+    echo "     Run 'npx poke login' then restart, or paste your key from poke.com/settings/advanced"
+    echo ""
+    printf "  Poke API key (leave blank to set manually later): "
+    read -r POKE_TOKEN_INPUT
+    POKE_TOKEN_INPUT=$(echo "$POKE_TOKEN_INPUT" | tr -d '[:space:]')
+    if [ -n "$POKE_TOKEN_INPUT" ]; then
+      python3 - <<PYEOF
+import re
+with open('config.yml', 'r') as f:
+    content = f.read()
+new_content = re.sub(r'(poke_api_key:\s*)[^\n]+', r'\g<1>"${POKE_TOKEN_INPUT}"', content)
+with open('config.yml', 'w') as f:
+    f.write(new_content)
+PYEOF
+      echo "  ✓ poke_api_key saved to config.yml"
+    fi
+    echo ""
+  fi
+fi
+
+# 4. MCP_API_KEY — generate once and persist to .env
+if [ ! -f .env ] || grep -q 'your-secret-key-here' .env 2>/dev/null || ! grep -q 'MCP_API_KEY=' .env 2>/dev/null; then
+  RANDOM_KEY=$(python3 -c "
+import secrets, string
+alphabet = string.ascii_letters + string.digits
+print(''.join(secrets.choice(alphabet) for _ in range(48)))
+")
+  if [ -f .env ]; then
+    python3 - <<PYEOF
+import re
+with open('.env', 'r') as f:
+    content = f.read()
+new_content = re.sub(r'MCP_API_KEY=.*', 'MCP_API_KEY=${RANDOM_KEY}', content)
+if 'MCP_API_KEY=' not in new_content:
+    new_content += 'MCP_API_KEY=${RANDOM_KEY}\n'
+with open('.env', 'w') as f:
+    f.write(new_content)
+PYEOF
+  else
+    echo "MCP_API_KEY=${RANDOM_KEY}" > .env
+  fi
+  echo "  ✓ MCP_API_KEY generated and saved to .env"
+  echo ""
+fi
+
+# ── Load .env ─────────────────────────────────────────────────────────────────
 if [ -f .env ]; then
   set -a
   source .env
   set +a
 fi
 
-# Activate virtualenv
-source .venv/bin/activate
-
 : "${MCP_API_KEY:?MCP_API_KEY is not set — add it to .env or export it}"
 
-# Start poke-mail server in background
+# ── Start server + tunnel ─────────────────────────────────────────────────────
 echo "Starting poke-mail server..."
 python src/server.py &
 SERVER_PID=$!