Skip to main content
Glama

Mailbox MCP

by com.mailbox-mcp.mcp

Reply to an email

reply_email
Destructive

Reply to a message. The reply is threaded onto the original, the original is quoted below the new text the way any mail client quotes it, a copy is filed in Sent, and the original is marked as answered so it shows a reply arrow in Outlook or webmail. Recipients are taken from the original (Reply-To if it set one, otherwise From) and never include this mailbox itself - use cc to copy in anyone who was not already on the thread, exactly as you would type into the Cc line of a reply. Files can be attached with attachments. If the message carries a Reply-To pointing somewhere it did not come from, this tool REFUSES until you name that address in confirmReplyTo - read the refusal and tell the user where the reply is really going. This delivers real mail to real people and cannot be undone.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
ccNoExtra people to copy in, on top of whoever the original message resolves to - the same thing as typing an address into the Cc line of a reply. Someone already being written to in To is not repeated here.
allNoReply to everyone. The sender and the original To recipients go in To; the original Cc stays in Cc; your own addresses are removed from both. Defaults to false.
uidYesThe UID of the message to reply to, from list_emails.
bodyYesPlain text of the reply - your words only. The quoted original is added below them; do not paste it in yourself.
fromNoSend as one of the other addresses on this mailbox instead of its default. Use it only when the user names an address to send from. It must be one already added to the mailbox; anything else is refused with the list of addresses that would have worked. The mail server still decides whether it will carry the address, and may refuse it at send time.
htmlNoOptional HTML body. Send real markup, used exactly as given and never escaped or unescaped by us: `<p>Hi</p>`, never `&lt;p&gt;Hi&lt;/p&gt;`. Escaped markup is delivered as visible tags and nothing will warn you. Leave it out unless you have real markup to send: the message still goes out as HTML, built from `text`, carrying the mailbox owner's HTML signature. Send it only for real markup of your own words: the quoted original is added to the HTML part either way, and is never something you paste in yourself.
mailboxNoIMAP folder the message is in. Defaults to INBOX.
attachmentsNoFiles to attach. FOUR WAYS IN, AND ONLY ONE OF THEM COSTS YOU ANYTHING. For a file already in this mailbox, call read_email on the message holding it and pass the `ref` from its `attachments` list as `fileRef`. For a file on the web, pass its https:// link as `url` and this server fetches it. For a file on the person's own computer, make a link with create_upload_link and pass its `uploadId` once the file is up - one entry attaches everything that arrived there. Those three work at any size, because the bytes never pass through this conversation. `content` is the last resort and is only for something you generated yourself in this conversation that exists nowhere else: it costs roughly 450,000 tokens per megabyte, so keep it under about 50 KB. All attachments TOGETHER must come to under 10 MB - a whole-message limit, not an allowance per file, so three 4 MB files are refused however they arrived.
plainTextOnlyNoSend with no HTML part at all. Leave this out unless the user has asked for plain text or the recipient is a list that rejects HTML - it drops the mailbox owner's HTML signature and their formatting. Do not set it to be cautious; HTML is the normal format and what their own mail client sends.
confirmReplyToNoOnly needed when this tool refuses because the message carries a Reply-To pointing somewhere it did not come from. Read the refusal, TELL THE USER where the reply is actually going, then pass those addresses here to proceed.
requestReadReceiptNoAsk the recipient's mail program to confirm when the message is opened, exactly as Outlook's "request a read receipt" tick box does. Only set it when the user asks for it. TELL THEM WHAT IT REALLY DOES before promising anything: it is a request their mail program may ignore and that many clients ask them to approve, so most messages never produce one however promptly they are read - consumer Gmail never sends one, Workspace only if an administrator enabled it, Apple Mail only behind a setting that ships off. Use check_receipts afterwards to see whether one came back, and never treat silence there as evidence the message was unread. There is no delivery-receipt option: that needs an SMTP feature none of the mail providers this connects to offer.

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. First observed

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations mark destructiveHint=true, and the description goes well beyond that by explicitly warning "This delivers real mail to real people and cannot be undone." It also surfaces the Reply-To refusal behavior, the quoting and Sent-copy mechanics, and the fact that recipients never include the mailbox itself. For a destructive, open-world, non-idempotent tool, this is exemplary transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long, but it is almost entirely high-value for a real-mail side-effecting tool. The opening sentence carries the core purpose, and the attachment section and read-receipt warning earn their length by preventing irreversible mis-sends. A couple of parentheticals are slightly over-explained, but nothing is fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 11-parameter, destructive, real-mail tool with no output schema, the description covers the critical behaviors: recipient resolution, Reply-To refusal, quoting, HTML safety, attachment strategies with size limits, plain-text consequences, and read-receipt caveats. The only thing not spelled out is the exact success/error response shape, which is acceptable because there is no output schema and the tool's side effects are the real outcome.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, but the description adds essential meaning beyond the raw property comments. It tells agents which attachment strategy to prefer (fileRef over url over content), warns that `content` costs ~450k tokens per MB, explains that `uploadId` requires no check_upload call, and clarifies that html is sent literally with no escaping. This is the kind of pragmatic guidance that prevents costly mistakes.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource — "Reply to a message" — and then thoroughly distinguishes itself from forward_email, draft_reply, and send_email by specifying the threading, quoting, Sent copy, and answered-flag behavior. The first sentence alone tells an agent exactly what this tool is for, and the body makes the distinction from siblings unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use and how-to-proceed rules: recipients come from Reply-To or From; use `cc` for additional people; use `all` for reply-all; and it even explains the refusal flow involving `confirmReplyTo`. It does not explicitly name sibling tools like forward_email or draft_reply as alternatives, but the threading/quotation/Sent/answered behaviors create clear boundaries against those siblings, which is substantial usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Mailbox MCP toolsInspect
Try in Browser
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4/5.0
Disambiguation4/5

Most tools target clearly distinct actions, but there are several close pairs that require careful reading: check_bounces vs check_receipts, list_emails vs search_emails, and the send/reply/forward vs draft_email/draft_reply/draft_forward families. The descriptions are strong enough that a careful agent can disambiguate, but the boundaries are not always obvious from the tool names alone.

Naming Consistency5/5

Every tool uses a consistent snake_case verb_noun convention, such as check_bounces, list_mailboxes, send_email, and update_draft. Related operations use parallel forms like mark_read/mark_unread and flag_email/unflag_email, making the naming predictable and coherent.

Tool Count2/5

With 28 tools, this exceeds the 25+ threshold where a tool set starts to feel too heavy. Email is a broad domain and many tools are individually justified, but the surface could be consolidated, especially the draft_forward/draft_reply/draft_email and send_email/reply_email/forward_email variants.

Completeness4/5

The core email lifecycle is thoroughly covered: send, read, search, move, delete, drafts, replies, forwards, folders, flags, attachments, upload links, contacts, identities, deliverability, bounces, and receipts. The main gap is that permanent deletion is referenced as a separate operation but no such tool is actually provided, and contact/identity management is effectively read-only.

Resources