Your own IMAP mailbox in any MCP client: search, read, flag, move; send and delete need confirm.
Scored across 7 tools
Most tools target distinct operations (list, read, search, send, move, flag, empty trash). However, flag_message's 'deleted' action overlaps with move_message to a Trash folder and with empty_trash's permanent deletion, creating a minor boundary ambiguity that descriptions mostly resolve.
All names follow a clear snake_case verb_noun pattern (empty_trash, flag_message, list_folders, move_message, read_message, search_messages, send_email). The convention is predictable and consistent throughout.
Seven tools is well-scoped for a mailroom server. Each tool covers a distinct core email operation without bloat or obvious redundancy.
Core email lifecycle is covered: send, read, search, move, flag, and trash management. Minor gaps exist (e.g., folder creation/renaming, reply/forward, attachment handling), but agents can work around these for most tasks.
Permanently delete every message in the Trash folder. Returns a preview (folder and message count) unless confirm=true.
| Name | Required | Description | Default |
|---|---|---|---|
| confirm | No |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, readOnlyHint=false, and idempotentHint=true. The description adds value beyond them by spelling out that deletion is permanent and that the default path is a non-destructive preview returning folder and message count — the key behavioral nuance an agent needs before invoking a destructive tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the destructive outcome and immediately followed by the preview default. No filler, no repetition of the title or annotations.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values need not be documented, yet the description still notes the preview payload (folder and message count). Combined with the clear destructive semantics, nothing an agent needs to call this safely is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the bare field is just 'confirm' with default false. The description compensates by explaining exactly what confirm=true changes — without it you get a preview, with it messages are permanently deleted — which is more than the schema conveys.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'Permanently delete every message in the Trash folder.' No sibling (flag/list/move/read/search/send) does anything similar, so the agent can select this unambiguously.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description tells the agent the two operating modes: call it and you get a preview, add confirm=true to actually delete. That is clear contextual guidance, though it never explicitly frames it as 'use the default first as a safety check' nor names any alternative (none exists among siblings).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Flag a message. action: seen, unseen, flagged, unflagged, deleted.
deleted moves the message to the mailbox's Trash folder (recoverable). Use empty_trash to delete permanently.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | ||
| action | Yes | ||
| folder | No | INBOX |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare destructiveHint=false, which could look inconsistent with an action literally named 'deleted'; the description resolves this by stating that deleted moves the message to Trash and is recoverable. That is genuine added context. It doesn't cover the side effects of the flag-state actions (seen/unseen/flagged/unflagged), so it isn't exhaustive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short lines, front-loaded with the core purpose followed by the action list and the one caveat. Slight indentation/stray whitespace aside, every sentence carries information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values needn't be explained, and the action list plus Trash caveat cover the main risk. Missing are the uid format/identifier expectations and any note on the folder parameter's scope, leaving gaps for a 3-parameter tool with no schema descriptions.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It does add real value by enumerating the complete action vocabulary (seen, unseen, flagged, unflagged, deleted), which the schema lacks as an enum. But uid is entirely unexplained and folder semantics are left to the schema default, so the compensation is only partial.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a clear verb+resource ('Flag a message') and enumerates the action values, which lets an agent distinguish it from siblings like move_message or read_message. It stops short of explicitly contrasting itself with move_message, whose behavior overlaps with the 'deleted' action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives one useful routing hint — 'Use empty_trash to delete permanently' — which names both the alternative and the condition. However, it offers no guidance on when to choose among seen/unseen/flagged/unflagged, leaving most usage to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List all folders in the connected mailbox.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered by structured data. The description contributes only the 'connected mailbox' scoping detail, which is a modest addition; no rate limits, ordering, or hierarchy behavior is disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler or redundancy. It is appropriately sized for a zero-argument listing tool, though it is so terse that nothing beyond the core action is conveyed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return values need not be explained, and with no parameters there is no argument complexity to cover. For a simple read-only listing tool the description is sufficient, though a hint about folder hierarchy or how the result is consumed would round it out.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the baseline is 4. There is no argument surface for the description to clarify, and adding parameter text would be meaningless.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List all folders') plus the scope ('in the connected mailbox'), which clearly separates it from the message-oriented siblings such as read_message and search_messages. It stops short of explicitly naming an alternative, but the resource noun alone is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no prerequisites, and no mention of alternatives or follow-up tools (e.g., that the returned folder identifiers feed move_message). Usage has to be inferred entirely from the verb 'List'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Move a message to dest_folder.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | ||
| folder | No | INBOX | |
| dest_folder | Yes |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare the safety profile (readOnlyHint=false, destructiveHint=false, idempotentHint=false, openWorldHint=false), which lowers the bar, but the description adds nothing beyond the operation name — no note that the message is removed from its source folder, whether the move is reversible, or how folder names are resolved.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short, front-loaded sentence with no wasted words, but the brevity reflects under-specification rather than disciplined concision. It fits the 'minimum viable' band.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need no explanation, but for a mutation tool with 0% schema description coverage the description leaves the agent without source-folder semantics, destination validation behavior, or error conditions. Incomplete for the operation's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate and it does not: it only repeats the parameter name 'dest_folder' and says nothing about 'uid' (message identifier format) or 'folder' (the source folder, defaulting to INBOX). With three undocumented parameters, this is a significant gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Move a message'), which an agent can distinguish from sibling operations like flag_message or read_message. It stops short of any explicit sibling differentiation, so it lands at a clear-but-generic 4.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives, no prerequisite conditions (does the destination folder need to exist?), and no mention of what happens to the source copy. The description is purely a restatement of the operation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Read one message by IMAP UID.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | ||
| folder | No | INBOX |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds nothing beyond that: it does not say whether reading marks the message as seen (a real IMAP side effect), whether auth is required, or how the folder argument affects lookup.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short sentence, front-loaded with the verb and resource, with zero filler. It is terse to the point of under-specification, but as a structural matter there is no wasted text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described, and annotations cover the safety profile. Still missing for a two-parameter tool at 0% schema coverage is any explanation of the folder default and how a UID is obtained, which leaves the definition only minimally complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, and it only partially does. 'IMAP UID' usefully clarifies that uid is an IMAP UID rather than a sequence number, but the folder parameter, its default of INBOX, and whether a non-default folder is required for non-inbox messages are entirely unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Read one message') and adds the identifying mechanism ('by IMAP UID'), so an agent knows this is a single-item fetch rather than a listing. It does not explicitly contrast itself with search_messages or list_folders, so sibling differentiation is left to inference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no prerequisites, and no mention of the alternatives. The obvious workflow (call search_messages first to obtain a UID, then read that message) is never stated, and no exclusion tells the agent when this tool is the wrong choice.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Search a folder. criteria examples: ALL, UNSEEN, FROM alice@example.com.
| Name | Required | Description | Default |
|---|---|---|---|
| folder | No | INBOX | |
| criteria | No | ALL |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds no behavioral context beyond that: no pagination, result limits, folder-resolution behavior, or what happens with an invalid folder name.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with the action front-loaded and the examples immediately following; nothing is padded. The phrasing "Search a folder" is slightly loose (it searches messages within a folder) but costs no extra length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described. However, for a two-parameter search tool the folder parameter is undocumented and there is no routing guidance against six sibling tools, leaving the definition only minimally complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and neither parameter is documented in the schema, so the description must compensate. The criteria examples (ALL, UNSEEN, FROM alice@example.com) meaningfully clarify that parameter's accepted syntax, but the folder parameter and its INBOX default are left completely unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ("Search") and resource scope ("a folder"), and the name search_messages makes the target unambiguous. It does not differentiate itself from siblings like read_message or list_folders, but the core action is clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no statement of when to use this tool versus read_message or list_folders, nor any mention of prerequisites or when results would be empty. The only guidance is syntax examples for one parameter, which is not usage guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Send email via SMTP. Pass confirm=true to actually send. Otherwise returns a preview.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | ||
| to | Yes | ||
| body | Yes | ||
| confirm | No | ||
| subject | Yes |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, openWorldHint=true, and non-idempotency, so the safety bar is partly covered. The description adds a genuinely non-obvious trait the annotations cannot express: the call is a dry-run preview by default and only destructive when confirm=true. It does not cover auth/credential requirements or send rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the action and immediately followed by the gating rule. Every clause carries information an agent needs; nothing is redundant with the title or schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return-shape detail is not required, and the description still flags that the return may be a preview rather than a send result. Missing pieces are SMTP configuration/credential assumptions and recipient-format expectations, which are minor for a 5-parameter tool with only one unconventional field.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the burden, and it fully explains the one non-obvious parameter (confirm). However, 'to', 'cc', 'subject' and 'body' are left purely to their titles, and recipient formatting (single vs. comma-separated, whether cc accepts a list) is unaddressed despite being the most likely invocation error.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Send email') plus the transport ('via SMTP'), which is enough to separate it from the read/search/list siblings in the same domain. An agent can identify the tool's function without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly gives the condition that switches behavior: confirm=true to actually send, otherwise a preview is returned. That is real when-to-use guidance. It stops short of naming alternatives or exclusions (e.g., that this is the only write path vs. flag_message/move_message), so it is clear but not fully routing-aware.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
empty_trashflag_messagelist_foldersmove_messageread_messagesearch_messagessend_emailYour mailbox for MCP clients: search, read, draft, send, rules and notes. Sending is off by default.
Your IMAP mailbox as an MCP server: read, search and (if you allow it) organize mail. Open source.
Hosted email MCP for your own Gmail, Outlook.com, Microsoft 365, iCloud or IMAP inbox: read, search, draft, reply in thread, forward and file mail. It moves or flags up to 500 messages in one call, and a send leaves exactly one copy in Sent. A calendar is a separate connection, and connecting one adds diary and scheduling tools.
Fully-managed email as MCP tools - register domains, real mailboxes, send and receive mail.
Add one secure layer between your agents and this server.
