Skip to main content
Glama

Mailbox MCP

by com.mailbox-mcp.mcp

Read an email

read_email
Read-onlyIdempotent

Read one message in full, including its body and recipients. Reading does NOT mark it as read. The result includes attachments: one entry per attached file, each with a ref you can pass as an attachment fileRef to send_email, reply_email, forward_email or draft_email. That is how you attach a file that is already in the mailbox to a new message, and it is the only way that works for a file of any real size - the bytes never pass through this conversation. A ref stops working after an hour; call this tool again for a fresh one. Each attachment may also carry a downloadUrl. GIVE THAT LINK TO THE USER WHENEVER THEY WANT THE FILE ITSELF - to open it, save it, or file it somewhere - because you cannot hand them the bytes and a link is how they get it. Show it as a plain clickable link and say which file it is. It lasts fifteen minutes, so read the message again for a fresh one rather than repeating an old link, and it opens that one file for anybody who holds it: give it to the person whose mailbox this is and put it nowhere else. The result also includes replyTo: the message's own Reply-To header, when the sender set one. reply_email sends there instead of to the From address when it is present, so check it before replying and tell the user if the reply is about to go somewhere other than the address they read the message from. THE html IN THIS RESULT IS SANITISED FOR SAFETY AND IS NOT WHAT THE SENDER WROTE: styles, colours, classes, scripts and comments are stripped on the way to you. Never use this tool to check what your own outgoing formatting will look like - it will appear to have been stripped when it was not. Open the message in a mail client instead.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
uidYesThe UID from list_emails.
mailboxNoIMAP folder name. Defaults to INBOX.

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. First observed

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate read-only, open-world, and idempotent behavior, so the bar is lower. The description adds substantial behavioral detail: attachment refs expire after an hour, download URLs expire after 15 minutes and are security-sensitive, HTML is sanitized, replyTo affects reply routing, and the tool must not be used to preview outgoing formatting. This goes well beyond what annotations convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long, but every sentence carries essential operational information that an agent needs to avoid mistakes: non-marking behavior, attachment ref handling, URL expiration, replyTo routing, and HTML sanitization. Key purpose and side-effect information are front-loaded, and the warnings are actionable rather than filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description must explain return-relevant behavior. It covers the body, recipients, attachments with refs and download URLs, replyTo, and the sanitized HTML caveat. For a read tool with rich attachment and security behavior, this is complete enough for an agent to invoke and interpret results correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already documents both parameters with 100% coverage: uid comes from list_emails and mailbox defaults to INBOX. The description does not add new parameter-level semantics beyond what the schema provides. Baseline 3 is appropriate because the schema fully handles parameter meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action and resource: 'Read one message in full, including its body and recipients.' It also distinguishes itself from list/search tools by emphasizing 'one message' and from mark_read by explicitly saying reading does NOT mark as read. This separates it clearly from read_thread and list_emails even without naming them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for when this tool is needed: to see full body, recipients, attachments, replyTo, or sanitized HTML. It notes that it does not mark messages read, which prevents confusion with mark_read. It does not explicitly compare against read_thread or list_emails, so a small gap remains, but the implied usage is strong.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Mailbox MCP toolsInspect
Try in Browser
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4/5.0
Disambiguation4/5

Most tools target clearly distinct actions, but there are several close pairs that require careful reading: check_bounces vs check_receipts, list_emails vs search_emails, and the send/reply/forward vs draft_email/draft_reply/draft_forward families. The descriptions are strong enough that a careful agent can disambiguate, but the boundaries are not always obvious from the tool names alone.

Naming Consistency5/5

Every tool uses a consistent snake_case verb_noun convention, such as check_bounces, list_mailboxes, send_email, and update_draft. Related operations use parallel forms like mark_read/mark_unread and flag_email/unflag_email, making the naming predictable and coherent.

Tool Count2/5

With 28 tools, this exceeds the 25+ threshold where a tool set starts to feel too heavy. Email is a broad domain and many tools are individually justified, but the surface could be consolidated, especially the draft_forward/draft_reply/draft_email and send_email/reply_email/forward_email variants.

Completeness4/5

The core email lifecycle is thoroughly covered: send, read, search, move, delete, drafts, replies, forwards, folders, flags, attachments, upload links, contacts, identities, deliverability, bounces, and receipts. The main gap is that permanent deletion is referenced as a separate operation but no such tool is actually provided, and contact/identity management is effectively read-only.

Resources