naver-mail-mcp
Integrates with Naver Mail via IMAP/SMTP, providing Gmail MCP-compatible tools to search, read, summarize, send, reply to, forward, draft, label, organize, trash, and mark emails as spam.
naver-mail-mcp
AI 에이전트가 지메일처럼 네이버 메일도 읽고, 요약하고, 답장하게 해 주는 MCP 서버입니다.
Claude, Grok, Meta Muse, ChatGPT, Codex에 연결하면 "이번 주 중요한 메일 요약해줘", "카드 결제 내역 메일만 모아줘", "이 메일에 회신해줘"가 네이버 메일에서도 됩니다. 도구 이름과 사용법이 Gmail MCP와 같아서, 지메일로 쓰던 에이전트 흐름을 그대로 쓸 수 있습니다.
네이버의 공식 서비스가 아닙니다. 네이버 메일이 제공하는 IMAP/SMTP로 동작합니다.
무엇이 다른가
이 프로젝트 | 다른 네이버 메일 MCP들 | |
검색·읽기·첨부 | ✅ | ✅ |
지메일 검색 문법 ( | ✅ | 일부 |
대화(스레드) 묶어 보기 | ✅ | 일부 |
답장·전체 답장·전달 | ✅ | ❌ |
임시보관함 만들기·고치기·보내기 | ✅ | 일부 |
정리 (메일함 이동, 별표, 읽음, 휴지통, 스팸) | ✅ | ❌ |
Gmail MCP와 같은 도구 이름·입력 | ✅ | ❌ |
클라우드 에이전트 연결 (Muse·Grok·Claude 앱, 설치 없이 주소만) | ✅ | 대부분 PC 전용 |
한국어 인코딩 메일 (EUC-KR, | ✅ | — |
Related MCP server: NAVER Mail MCP
시작하기
1. 네이버 메일 준비 (한 번만, 약 3분)
연결하려면 2단계 인증이 필수입니다. 평소 로그인 비밀번호가 아니라, 2단계 인증을 켜야 만들 수 있는 애플리케이션 비밀번호로 연결합니다.
① 2단계 인증 켜기
네이버 로그인 → 오른쪽 위 프로필 → 네이버 ID (또는 nid.naver.com)
보안설정 → 2단계 인증 → 설정하기
휴대폰 번호(또는 네이버 앱)로 본인 확인을 마치면 켜집니다. 이미 켜져 있으면 ②로 넘어갑니다.
② 애플리케이션 비밀번호 만들기
네이버 ID → 보안설정 → 2단계 인증 → 관리 (본인 확인을 한 번 더 할 수 있음)
아래쪽 애플리케이션 비밀번호 관리에서 종류를 고르고 생성하기. 종류는 아무거나(예: Windows, 기타) 괜찮습니다.
나온 비밀번호를 복사해 둡니다. 창을 닫으면 다시 볼 수 없습니다. 잃어버리면 새로 만들면 됩니다.
③ POP3/IMAP 설정에서 IMAP 켜기
네이버 메일 → 왼쪽 아래 환경설정 (톱니바퀴)
POP3/IMAP 설정 탭 → IMAP/SMTP 설정
IMAP/SMTP 사용: 사용함 → 저장. POP3는 켤 필요가 없습니다.
네이버는 메뉴 이름·위치를 가끔 바꿉니다. 메뉴가 안 보이면 네이버 ID 페이지에서 "애플리케이션 비밀번호"를 검색하세요.
2. 연결하기 (쉬운 순서)
방법 A. 주소만 넣기 — 추천, 설치 없음
공개 서버 주소: https://naver-mail-mcp.yeonuunim521.workers.dev/mcp
에이전트 | 넣는 곳 |
Claude (웹·데스크톱·모바일) | 설정 → 커넥터 → 커스텀 커넥터 추가 |
Grok | grok.com/connectors → New Connector → Custom |
Meta Muse | 설정에서 커넥터 URL 추가, 또는 대화창에 주소를 주고 "연결해줘" |
ChatGPT | 설정 → 앱/커넥터 → 개발자 모드에서 커스텀 커넥터 추가 |
Claude Code |
|
Codex |
|
주소를 넣으면 로그인 화면이 열립니다. 네이버 아이디와 애플리케이션 비밀번호를 넣으면 끝입니다.
같은 서비스(예: Claude 앱)라면 PC·태블릿·폰 어디서든 한 번만 로그인하면 됩니다.
Claude Code나 Codex에는 "네이버 메일 MCP 설치해줘. 주소는 https://naver-mail-mcp.yeonuunim521.workers.dev/mcp, 이름은 naver-mail"이라고만 해도 AI가 설치합니다. 로그인만 직접 하세요.
방법 B. 내 PC에서 실행 — 비밀번호가 내 컴퓨터 밖으로 안 나감
Node.js 20 이상이 필요하고, Claude Desktop·Claude Code·Codex 같은 PC 프로그램에서만 쓸 수 있습니다.
Claude Desktop (claude_desktop_config.json):
{
"mcpServers": {
"naver-mail": {
"command": "npx",
"args": ["-y", "naver-mail-mcp"],
"env": { "NAVER_ID": "내아이디", "NAVER_APP_PASSWORD": "애플리케이션비밀번호" }
}
}
}Claude Code: claude mcp add naver-mail -e NAVER_ID=내아이디 -e NAVER_APP_PASSWORD=앱비밀번호 -- npx -y naver-mail-mcp
방법 C. 내 서버 만들기 — 클라우드 에이전트 + 내 서버
버튼을 누르면 내 Cloudflare 계정(무료로 됨)에 똑같은 서버가 만들어집니다. 다 되면 나오는 https://naver-mail-mcp.<내 계정>.workers.dev/mcp를 방법 A처럼 넣으면 됩니다.
ALLOWED_USERS에 내 네이버 아이디를 넣으면 나만 쓸 수 있습니다. 비우면 누구나 자기 계정으로 연결할 수 있습니다.직접 배포하려면:
npm install→npx wrangler kv namespace create OAUTH_KV로 만든 id를wrangler.jsonc에 넣기 →npx wrangler deploy
npx wrangler secret put MCP_BEARER_TOKEN # 긴 무작위 문자열
npx wrangler secret put NAVER_ID
npx wrangler secret put NAVER_APP_PASSWORD요청 헤더에 Authorization: Bearer <MCP_BEARER_TOKEN>를 넣으면 OAuth 없이 위 계정으로 접속합니다.
보안과 개인정보
비밀번호: 로그인할 때 넣은 애플리케이션 비밀번호는 연결된 앱의 토큰으로 암호화되어 저장되고(
@cloudflare/workers-oauth-provider), 메일을 읽고 보낼 때만 쓰입니다. 평문으로 남기지 않습니다.메일 내용: 서버에 저장하지 않습니다. 요청이 올 때 네이버에서 읽어 에이전트에 전달할 뿐입니다. 비밀번호와 메일 내용은 로그에 남기지 않습니다.
연결 끊기: 네이버에서 그 애플리케이션 비밀번호를 삭제하면 모든 에이전트에서 즉시 끊깁니다.
메일 발송: 보내기·답장·전달 전에는 사용자에게 확인하라고 에이전트에게 안내합니다.
공개 서버가 꺼려지면: 공개 서버를 쓰는 것은 그 운영자를 믿는다는 뜻입니다. 코드는 모두 이 리포에 공개되어 있고, 불안하면 방법 B(내 PC)나 방법 C(내 서버)를 쓰세요.
도구 (Gmail MCP와 같은 이름)
분류 | 도구 |
찾기·읽기 |
|
보내기 |
|
임시보관함 |
|
라벨 |
|
휴지통·스팸 |
|
get_profile과 get_attachment는 Gmail MCP에는 없는 추가 도구입니다.
Gmail과 다른 점 (IMAP의 한계)
라벨은 메일함입니다.
INBOX,SENT,DRAFT,TRASH,SPAM은 해당 메일함, 사용자 라벨은 메일함 경로입니다. 한 메일은 한 메일함에만 있으므로 메일함 라벨을 붙이면 이동합니다.STARRED(중요 표시)와UNREAD(안읽음)는 플래그입니다.메일 ID는 메일함과 UID로 만듭니다. 메일을 옮기면 ID가 바뀌고, 옮기는 도구가 새 ID를 돌려줍니다. 임시보관 메일을 고칠 때도 ID가 바뀝니다.
보관(archive)이 없습니다. 받은메일함에서 빼려면 다른 메일함 라벨을 붙이세요.
대화(thread)는 Message-ID/References 헤더로 묶습니다. 네이버 IMAP은 헤더 검색이 잘 안 돼서, 메일함마다 최근 1,000통의 헤더를 직접 읽어 찾습니다.
낱말 검색은 제목, 보낸 사람, 본문을 따로 찾아 합칩니다 (네이버 IMAP은 OR·전체 텍스트 검색을 처리하지 못함).
has:attachment,filename:은 메일 구조를 직접 확인하며 메일함마다 최근 3,000통까지 봅니다. 더 오래된 메일은after:같은 기간 조건을 함께 쓰세요.기본 검색 범위는 휴지통, 스팸, 임시보관함을 뺀 모든 메일함입니다.
category:같은 Gmail 전용 조건은 무시하고 결과의warnings에 알려 줍니다.서명 자동 붙이기와 카테고리 탭은 지원하지 않습니다.
실제 네이버 계정에서 확인한 것
2026년 10월, Meta Muse로 연결해 확인했습니다.
2단계 인증 + 애플리케이션 비밀번호로 연결
계정·안 읽은 메일 수 확인, 최근 메일 요약
검색: 한글 낱말(
결제), 제목(subject:), 기간(newer_than:30d), 첨부(has:attachment,filename:pdf), 보낸메일함(in:sent)대화 묶어 보기(
get_thread), 첨부 이름 읽기메일 발송과 보낸메일함 저장
답장·전달·임시보관함·라벨 이동·휴지통은 가짜 메일 서버 통합 테스트로 확인했고, 실제 계정 확인은 진행 중입니다. 문제를 발견하면 이슈로 알려 주세요.
개발
npm install
npm test # 가짜 IMAP/SMTP 서버 통합 테스트 + 단위 테스트
npm run typecheck
npm run dev # 로컬 Worker: http://localhost:8787/mcp
npm run stdio # 로컬 stdio (NAVER_ID, NAVER_APP_PASSWORD 환경 변수)
npm run build:stdio # npm 배포용 dist/stdio.js접속 정보: IMAP imap.naver.com:993(SSL), SMTP smtp.naver.com:465(SSL). 바뀐 내용은 CHANGELOG에 있습니다.
라이선스
MIT
Available Tools
30 toolscreate_draftAInspect
Creates a draft in the Naver Mail drafts folder (임시보관함). If replyToMessageId is given, threading headers are set and the original message is quoted below the body; recipients default to the original sender. Returns the draft id.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | Cc recipients. Plain email addresses (e.g. "user@example.com"); "Name <user@example.com>" also works. | |
| to | No | Primary recipients. Plain email addresses (e.g. "user@example.com"); "Name <user@example.com>" also works. | |
| bcc | No | Bcc recipients. Plain email addresses (e.g. "user@example.com"); "Name <user@example.com>" also works. | |
| body | No | Plain text body. Do NOT format with Markdown; use htmlBody for rich text. If htmlBody is also given, this is the plain-text alternative. | |
| subject | No | ||
| htmlBody | No | HTML body (valid HTML tags). | |
| attachments | No | Attachments. Combined size must not exceed 25MB. | |
| replyToMessageId | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false and destructiveHint=false, so the description's job is to add context, which it does: threading headers set, original message quoted, recipients defaulting to the original sender, and the draft id returned. It omits auth requirements and the 25MB attachment cap (the latter covered in schema), but the added behavioral detail is substantive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences, front-loaded with what is created and where, then conditional behavior, then return value. No filler sentences.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 8-parameter tool with no output schema, the description covers the operation, the important conditional mode, and the return value, so an agent can call it correctly. Missing only permission/limit context that the schema partially supplies.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 75% schema coverage, the schema already documents most fields; the description still adds real meaning for replyToMessageId by explaining its threading and quoting side effects and the recipient defaulting rule. Other parameters (to, cc, bcc, body, htmlBody, attachments) are left entirely to the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Creates a draft') plus the target location (Naver Mail drafts folder with the Korean name), which is unambiguous. It does not name siblings such as send_message or update_draft, so the differentiation is left implicit rather than stated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains the conditional behavior when replyToMessageId is supplied, which implies a reply-draft use case, but never says when to prefer this over send_message/reply or when not to use it. Usage is inferable rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_labelAInspect
Creates a new user label (a Naver Mail folder). Nested labels use '/', e.g. 'Projects/Alpha'; missing parents are created.
| Name | Required | Description | Default |
|---|---|---|---|
| displayName | Yes | Label name, e.g. 'Receipts' or 'Projects/Alpha'. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare this is a non-readonly, non-destructive, non-idempotent write, so the safety profile is covered. The description adds a genuinely non-obvious side effect the annotations cannot express: missing parent labels are created automatically along the '/' path. It stops short of saying what happens when the label already exists, which matters given idempotentHint=false.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero filler, with the core action stated first and the naming/side-effect detail packed into the second. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter creation tool with no output schema and annotations covering the safety profile, this is nearly complete: it explains the resource, the path syntax, and the parent auto-creation behavior. The remaining gap is duplicate-name handling, which an agent calling a non-idempotent create would reasonably want to know.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the single parameter's schema already includes the same 'Projects/Alpha' style example, so the description adds little new parameter detail. Its nesting syntax remark reinforces the schema rather than extending it; baseline 3 applies when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Creates') and resource ('a new user label'), and adds the clarifying gloss '(a Naver Mail folder)' so the agent knows what a label is in this domain. The create/update/delete/list distinction against siblings like update_label and list_labels is unambiguous from the verb alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage context is implied rather than stated: the agent can infer this is the tool for making a new label, and the nested-path syntax tells it how to name one. However, there is no explicit guidance on when to prefer this over update_label, or on checking list_labels first to avoid duplicates.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_draftCDestructiveIdempotentInspect
Deletes a draft.
| Name | Required | Description | Default |
|---|---|---|---|
| draftId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and idempotentHint=true, so the safety profile is known. The description adds nothing beyond that: it does not say whether the deletion is permanent, whether the draft is recoverable or moved to trash, or what authorization is required — all valuable context for a destructive operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is front-loaded and completely free of waste, but it is under-specified rather than concise: one four-word sentence leaves no room for scope, consequences, or parameter notes.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive, irreversible-sounding mutation with no output schema and no annotation-level detail about permanence, the description should confirm what happens to the draft and whether recovery is possible. Neither is covered, so an agent cannot fully predict the effect of calling it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the single required parameter draftId is undocumented everywhere. The description does not mention the identifier at all, leaving the agent to infer its meaning and format entirely from the property name.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description pairs a specific verb with a specific resource ("Deletes a draft"), so the operation itself is unambiguous. However, it offers nothing to separate it from the many sibling mutation tools such as trash_message, update_draft, or delete_label, and the title is null so no extra signal exists.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no statement of when to use this versus update_draft, trash_message, or any other removal path. The only implied guidance is the obvious mapping of "delete" to "draft"; no prerequisites, alternatives, or exclusions are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_labelADestructiveIdempotentInspect
Deletes a user label. WARNING: in Naver Mail a label is a folder, so the messages inside it are deleted too. Confirm with the user first.
| Name | Required | Description | Default |
|---|---|---|---|
| labelId | Yes | User label id from list_labels. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare destructiveHint=true, but the description adds the thing annotations cannot convey: the blast radius. It explains that deleting a label cascades to the messages inside it, which is the single most important behavioral fact for this tool and directly changes how an agent should behave.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, zero filler, and the destructive warning is placed immediately after the purpose statement so it is read before any parameter detail. Nothing repeats the schema or annotations verbatim.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers the critical gap (cascading deletion of contained messages) for a destructive, non-open-world, idempotent tool whose parameter is fully documented. It stops short of saying whether the deletion is reversible or what happens to messages that are also in other labels, which would complete the picture for a high-stakes mutation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With one parameter at 100% schema coverage and the schema already pointing at list_labels as the id source, the description adds no further semantics such as format or validation rules. Baseline 3 applies since the schema fully carries this burden.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Deletes a user label') that cleanly separates it from sibling create_label/update_label/list_labels. It also disambiguates the domain term by noting that a label is actually a folder in Naver Mail, which an agent could not infer from the name alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit precondition ('Confirm with the user first'), which is actionable guidance for a destructive operation. It does not name a safer alternative sibling (e.g. unlabel_message/unlabel_thread to remove the label from messages without deleting them), so the routing guidance is strong but not complete.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
forwardAInspect
Forwards a message with its original attachments. Optional comments go above the forwarded message via forwardText (plain) or htmlBody. Confirm with the user before sending.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | Cc recipients. Plain email addresses (e.g. "user@example.com"); "Name <user@example.com>" also works. | |
| to | No | Primary recipients. Plain email addresses (e.g. "user@example.com"); "Name <user@example.com>" also works. | |
| bcc | No | Bcc recipients. Plain email addresses (e.g. "user@example.com"); "Name <user@example.com>" also works. | |
| htmlBody | No | HTML comments above the forwarded message. | |
| messageId | Yes | ||
| attachments | No | Extra attachments in addition to the original ones (25MB total). | |
| forwardText | No | Plain text comments above the forwarded message. No Markdown. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare destructiveHint=false and openWorldHint=true, so the external-side-effect profile is already partly covered; the description still adds real value by warning that sending is user-visible and should be confirmed first and that the original attachments ride along. It does not describe failure modes or what the call returns.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loading the forward-plus-original-attachments behavior, then the comment-placement options, then the safety instruction. Nothing is redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no output schema, the description covers the essential behaviors: original attachments included, where comments land, and the confirmation requirement. Missing only return-value expectations and whether forwardText and htmlBody can be combined.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 86%, so the baseline is 3; the description only restates the forwardText/htmlBody distinction already spelled out in the schema and adds nothing for messageId, the required parameter, or the 25MB attachment constraint. Marginal value over structured fields.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("Forwards a message") plus a distinguishing scope fact: original attachments are carried along, which separates it from send_message and reply. It never names those siblings explicitly, so the differentiation is inferred rather than stated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The sentence "Confirm with the user before sending" gives a clear operational guardrail for when this fires, and the verb implies forward-an-existing-message. But there is no explicit routing versus reply, send_message, or create_draft, which are all plausible alternatives for the same intent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_attachmentARead-onlyInspect
Downloads one attachment of a message. Returns text for text-like files (txt, csv, html, json, ics) and base64 data (up to 8MB).
| Name | Required | Description | Default |
|---|---|---|---|
| messageId | Yes | ||
| attachmentId | Yes | attachmentId from get_message (zero-based index). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds genuinely useful behavior beyond that: text decoding for txt/csv/html/json/ics, base64 for everything else, and an 8MB ceiling. That's real context an agent needs before calling, though error behavior is unstated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the action and scoped by the second on return format. No filler, no repetition of the name or title.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter read tool with no output schema, the description covers the operation, the return encoding rule, and the size limit – essentially everything needed to call it and interpret the result correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%: attachmentId is documented, messageId is not. The description adds no parameter-level detail, so the undocumented messageId carries on being self-evident from its name only. Baseline 3 is appropriate given partial schema coverage and no compensating description text.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Downloads') and resource ('one attachment of a message'), which cleanly separates it from get_message and other sibling tools. It doesn't explicitly name a sibling alternative, but the resource is unambiguous enough that an agent can pick it out of the list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by 'one attachment of a message' and the schema note pointing at get_message as the source of the attachmentId. There is no explicit when-to-use or when-not statement, and no mention of what to do if the attachment is too large or unsupported.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_draftCRead-onlyInspect
Retrieves a draft by id.
| Name | Required | Description | Default |
|---|---|---|---|
| draftId | Yes | ||
| messageFormat | No | MINIMAL: subject, snippet, sender, recipients, date, labels. METADATA_ONLY: no subject/snippet/body. PLAIN_TEXT (recommended): MINIMAL + plaintextBody + attachments (HTML converted to text if needed). FULL_CONTENT (default): also htmlBody. RAW: raw MIME. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered structurally. The description adds nothing beyond that: no behavior for a missing/invalid draftId, no note on which account or mailbox is queried, and no mention of the messageFormat default (FULL_CONTENT) that materially changes payload size.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero padding, but the brevity comes from omission rather than economy. It is efficient but under-specified for a tool with a non-trivial format enum.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read tool with annotations carrying the safety profile and no output schema to explain, the definition is minimally sufficient to invoke. It falls short on failure behavior and on the format-selection tradeoff, which is the only real decision an agent must make here.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%: messageFormat is documented in detail in the schema, but draftId has no description and the description compensates for neither parameter. Nothing in the text clarifies id format or the cost/size implications of choosing FULL_CONTENT or RAW.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Retrieves') and resource ('a draft') keyed by id, so the operation is unambiguous. It does not distinguish itself from near-neighbors like get_message or list_drafts, relying on the name alone for that separation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this instead of list_drafts, get_message, or search_threads, and no prerequisites or exclusions. The agent must infer selection purely from the tool name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_messageARead-onlyInspect
Retrieves a single email message by id, including body and attachment metadata. For whole conversations use get_thread. Use PLAIN_TEXT to prevent context exhaustion.
| Name | Required | Description | Default |
|---|---|---|---|
| messageId | Yes | Message id from search_threads or get_thread. | |
| messageFormat | No | MINIMAL: subject, snippet, sender, recipients, date, labels. METADATA_ONLY: no subject/snippet/body. PLAIN_TEXT (recommended): MINIMAL + plaintextBody + attachments (HTML converted to text if needed). FULL_CONTENT (default): also htmlBody. RAW: raw MIME. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds useful behavioral context by noting that the response includes body and attachment metadata, and by warning that PLAIN_TEXT helps avoid context exhaustion. It does not cover error behavior, but with annotations present this is a strong addition.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no wasted words, with the core purpose front-loaded and the alternative and format recommendation following immediately. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read tool with no output schema, the description supplies enough to call it correctly: the id-based single-message scope, the sibling alternative, and a format recommendation. Minor gaps remain around per-format return differences and error behavior, but the schema already covers the format details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline would be 3, but the description adds meaning beyond the schema by tying PLAIN_TEXT to a concrete rationale: preventing context exhaustion. The schema itself documents the enum modes thoroughly, so the description complements rather than repeats.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource ('Retrieves a single email message by id') and explicitly distinguishes this tool from the sibling get_thread by noting that get_thread is for whole conversations. An agent can immediately tell what this tool does and when it differs from the conversation-level alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It states the key usage condition directly: use get_thread for whole conversations, implying get_message for single messages. It also gives explicit parameter guidance by recommending PLAIN_TEXT to prevent context exhaustion, which is actionable and reduces misuse.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_profileARead-onlyInspect
Returns the connected Naver Mail address, total messages and unread count in the inbox. Use it to confirm which account is connected.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds useful behavioral detail beyond annotations by enumerating the returned fields (address, total, unread), which matters because no output schema exists. It doesn't mention authentication requirements or whether counts are scoped to inbox only vs all folders — the unread count is tied to 'inbox' but 'total messages' scope is ambiguous.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the return values and followed by the use case. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-param read tool with no output schema, the description covers the essential return shape and the reason to call it. A slight gap remains around what 'total messages' spans (inbox only, or all folders) versus the explicitly inbox-scoped unread count.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Zero parameters, so there is nothing to document and the baseline is 4. The description correctly implies a no-argument call.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Returns') and names the exact values returned: connected address, total messages, unread count. This is clearly distinct from every sibling, which are all mail/draft/label mutation or retrieval tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The sentence 'Use it to confirm which account is connected' gives a concrete triggering scenario. It stops short of stating when not to use it or naming alternatives, but no sibling overlaps meaningfully (no other account/session tool exists).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_threadARead-onlyInspect
Retrieves an email thread (conversation) with all its messages, oldest first, across folders (inbox, sent, user folders). Drafts are omitted. Threads are reconstructed from Message-ID/References headers. Use PLAIN_TEXT to save context.
| Name | Required | Description | Default |
|---|---|---|---|
| threadId | Yes | Thread id from search_threads. | |
| messageFormat | No | MINIMAL: subject, snippet, sender, recipients, date, labels. METADATA_ONLY: no subject/snippet/body. PLAIN_TEXT (recommended): MINIMAL + plaintextBody + attachments (HTML converted to text if needed). FULL_CONTENT (default): also htmlBody. RAW: raw MIME. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already establish readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds useful behavior beyond annotations: messages are returned oldest first, folders include inbox/sent/user folders, drafts are omitted, and threads are reconstructed from Message-ID/References headers. It does not cover permissions, pagination, or response shape, but with annotations present this is a strong disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is four compact sentences, front-loads the core action and scope, then adds ordering, draft exclusion, reconstruction behavior, and format advice. Every sentence earns its place with no repetition or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only tool with fully documented parameters and annotations covering safety, the description gives enough behavioral context to call it correctly: thread scope, ordering, folder coverage, draft omission, and format recommendation. It does not mention pagination or response size limits, and with no output schema those details remain slightly underspecified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the schema already documents both threadId and the full messageFormat enum, explicitly labeling PLAIN_TEXT as recommended. The description's 'Use PLAIN_TEXT to save context' largely repeats the schema's recommendation rather than adding new parameter meaning, so the baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: retrieves an email thread with all its messages, oldest first, across folders. The thread-level scope and 'all its messages' distinguish it from single-message tools like get_message and from search-oriented siblings like search_threads without requiring the schema to be opened.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no explicit when-to-use or when-not-to-use guidance and does not route the agent to alternatives such as get_message or search_threads. The only directive, 'Use PLAIN_TEXT to save context,' addresses messageFormat selection rather than whether to call get_thread at all.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
label_messageAIdempotentInspect
Adds labels to a message: STARRED marks important, UNREAD marks unread, a folder label moves it. Moving changes the message id; the new id is returned.
| Name | Required | Description | Default |
|---|---|---|---|
| labelIds | Yes | Label ids: STARRED, UNREAD, INBOX, TRASH, SPAM, or a user label id from list_labels. Adding a folder label moves the message to that folder (one folder per message); removing the current folder label moves it back to INBOX. | |
| messageId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, idempotentHint=true and destructiveHint=false, so safety is covered. The description then adds genuinely non-derivable behavior: moving a message to a folder changes its id and the new id is returned, and a message can hold only one folder label at a time. It stops short of stating failure behavior for invalid label ids or permission requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences, front-loaded with the action, then the label vocabulary, then the one side effect that matters. No filler, nothing repeated from structured fields except where it aids scanning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter mutation with no output schema, the description covers the important gap (the id-changing side effect and the returned value) plus folder semantics. Missing only edge-case behavior: what happens with an invalid label id, and how folder replacement interacts with the existing INBOX label.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only 50% of the schema is documented: `labelIds` carries a rich enum-like description in the schema (and the description redundantly restates parts of it), while `messageId` has no description anywhere. The description partly compensates by implying the id may change and be re-issued, but the primary identifier's semantics remain undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("Adds labels to a message") and enumerates what each label class does (STARRED, UNREAD, folder label). However, it never distinguishes itself from the near-identical sibling `update_message_labels`, nor from `label_thread`, leaving real ambiguity about which add-labels tool to pick.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use or when-not-to-use guidance and no named alternative. With siblings `update_message_labels`, `unlabel_message`, and `label_thread` in the same namespace, the agent is left to infer whether this tool replaces, complements, or duplicates them.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
label_threadAIdempotentInspect
Adds labels to every message in a thread (e.g. STARRED, or a folder label to move the conversation).
| Name | Required | Description | Default |
|---|---|---|---|
| labelIds | Yes | Label ids: STARRED, UNREAD, INBOX, TRASH, SPAM, or a user label id from list_labels. Adding a folder label moves the message to that folder (one folder per message); removing the current folder label moves it back to INBOX. | |
| threadId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, destructiveHint=false, idempotentHint=true, and openWorldHint=false. The description adds useful behavioral context beyond that: labels are applied to every message in the thread, and a folder label moves the conversation. It does not cover permissions or return behavior, but with annotations present the bar is lower.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no wasted wording. The key scope, thread-wide labeling, and a representative example are communicated immediately.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple, has only two required parameters, no output schema, and annotations that cover safety and idempotency. The description is nearly complete for correct invocation, missing only explicit sibling-routing guidance, which is a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50%: labelIds is richly documented with valid values and folder-move semantics, while threadId has no schema description. The description adds examples such as STARRED and folder labels, but does not add meaning beyond what the labelIds schema already provides. Baseline 3 is appropriate for this coverage level.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: "Adds labels to every message in a thread." This clearly distinguishes thread-level labeling from message-level siblings like label_message, though it does not explicitly name alternatives. The examples (STARRED, folder label) further sharpen the operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the thread-level scope and folder-label example, but there is no explicit guidance on when to choose this over label_message, update_message_labels, or unlabel_thread. The agent must infer the alternative from the sibling names.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_draftsARead-onlyInspect
Lists drafts, optionally filtered by a query (same syntax as search_threads).
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | DRAFT_VIEW_FULL adds subject and plaintextBody. | |
| query | No | ||
| pageSize | No | Default 20, max 50. | |
| pageToken | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so safety and closed-world behavior are covered. The description adds only the query-syntax equivalence; it says nothing about pagination behavior or what fields come back by default, leaving gaps that annotations don't fill.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler; the filter behavior and the syntax pointer each carry information an agent needs. Nothing is redundant or buried.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only list tool with four optional params and no output schema, the description is adequate but thin: it omits pagination expectations, the default view, and any statement of what a draft record contains. Those are the details an agent would still have to discover from the schema alone.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%: view and pageSize are documented inline, while query and pageToken are not. The description adds real value by tying 'query' to search_threads syntax, but it does nothing for pageToken and doesn't clarify view defaulting, so it only partly compensates for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Lists drafts') plus the optional filter behavior, which separates it cleanly from get_draft (single draft) and search_threads (threads, not drafts). It stops short of noting the draft-specific scope details (which mailbox/account scope) that would pin it down fully.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The word 'optionally' implies you can call it without a query, and the reference to search_threads hints at the query mechanism, but there is no explicit when-to-use vs. siblings like search_threads or get_draft. Usage is inferable rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_labelsARead-onlyInspect
Lists labels with message and unread counts. In Naver Mail labels are folders: system labels INBOX, SENT, DRAFT, TRASH, SPAM map to the matching folders; user labels are folder paths. STARRED (important mark) and UNREAD are flags. Use the returned id with label tools.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so safety is covered; the description still adds real value by explaining that system labels map to folders while STARRED and UNREAD are flags, preventing misinterpretation of returned ids. It stops short of noting whether system labels are mutable or how counts are computed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short sentences, front-loaded with the purpose, then domain semantics, then the follow-up action. Dense and waste-free, though the folder-mapping sentence is long and could be tightened.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description carries the return-value burden and does so by naming the fields (id, message count, unread count) and referencing them downstream. It leaves minor gaps such as ordering or whether nested/user-label hierarchy is returned.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the baseline is 4; the description correctly implies an unfiltered, account-wide listing without inventing parameter distinctions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("Lists labels") plus the payload returned (message and unread counts), which distinguishes it cleanly from the sibling mutators create_label/update_label/delete_label. The Naver-Mail folder semantics further pin down what a "label" is in this domain.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
"Use the returned id with label tools" explicitly positions this as the discovery step preceding label_message/label_thread/update_label etc. No exclusion guidance is given (e.g., when to skip listing), so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mark_message_spamCIdempotentInspect
Moves a message to the Spam folder.
| Name | Required | Description | Default |
|---|---|---|---|
| messageId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly=false, idempotent=true and destructive=false, so the safety profile is covered. The description adds essentially nothing beyond that: it doesn't say whether the move is reversible, what happens if the message is already in Spam, or that it returns no/limited data.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short sentence with the action and destination front-loaded; nothing is wasted, though it is arguably under-specified rather than genuinely concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter mutation tool with no output schema, the description should at minimum pin down the messageId format and note the reversibility/idempotency behavior. It does neither, so an agent must probe or guess before calling.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for the single messageId parameter, so the schema gives no format information. The description says only 'a message' and never clarifies whether messageId is an internal ID, an RFC 822 Message-ID, or a thread-scoped identifier, leaving the caller to guess.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Moves') and resource ('a message') with the destination ('the Spam folder'), which distinguishes it from unmark_message_spam and trash_message. It does not explicitly contrast with the sibling mark_thread_spam, so the message-vs-thread distinction must be inferred from the name.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The intent (message is spam → move it to Spam) is implied clearly enough by the description, but there is no explicit guidance on when to prefer this over mark_thread_spam or when to use unmark_message_spam to reverse it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mark_thread_spamAIdempotentInspect
Moves every message of a thread to the Spam folder.
| Name | Required | Description | Default |
|---|---|---|---|
| threadId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, idempotentHint=true and destructiveHint=false, so safety/repeatability is covered structurally. The description adds useful scope context ('every message' of the thread), but says nothing about whether the thread disappears from the inbox, who can perform it, or what happens to already-spammed messages.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single tight sentence with the action and destination front-loaded and zero filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-param action tool with no output schema and annotations carrying the idempotency/safety profile, the description covers the essential behavior. Minor gaps (return value, inbox removal semantics) keep it from a 5.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is one parameter (threadId) with 0% schema description coverage; the description refers to 'a thread' which lightly implies the parameter, but never confirms it accepts a thread ID or any format. Given the single self-evident parameter, this is adequate but adds little.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
A specific verb ('Moves') plus resource ('every message of a thread') and destination ('Spam folder'). The thread-level scope implicitly distinguishes it from the sibling mark_message_spam, but no sibling is named explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied by the scope wording: the agent can infer it should use this over mark_message_spam when a whole thread is spam. There is no explicit when/when-not statement or named alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
replyAInspect
Replies to a message (to the sender, or everyone with replyAll). The original is quoted below the reply and threading headers are set. To reply in a thread, use the id of its latest message from get_thread. body or htmlBody is required. Confirm with the user before sending.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | Overrides the default Cc recipients. Plain email addresses (e.g. "user@example.com"); "Name <user@example.com>" also works. | |
| to | No | Overrides the default reply recipients. Plain email addresses (e.g. "user@example.com"); "Name <user@example.com>" also works. | |
| bcc | No | Bcc recipients. Plain email addresses (e.g. "user@example.com"); "Name <user@example.com>" also works. | |
| body | No | Plain text body. Do NOT format with Markdown; use htmlBody for rich text. If htmlBody is also given, this is the plain-text alternative. | |
| htmlBody | No | HTML body (valid HTML tags). | |
| replyAll | No | Reply to all recipients. Default false. | |
| messageId | Yes | ||
| attachments | No | Attachments. Combined size must not exceed 25MB. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish that this is a non-read-only, non-idempotent, open-world action, and the description adds useful behavioral detail beyond them: the original is quoted below the reply, threading headers are set, and the agent should confirm with the user before sending. It does not cover rate limits or delivery behavior, but the key side effects are disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three compact sentences, front-loaded with the core action and scope. Each sentence adds operational value: reply mode, threading behavior, required content, and confirmation guidance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an open-world send action with annotations and a rich schema, the description covers what the agent needs: reply-vs-replyAll behavior, threading, quoted original, required body content, and a user-confirmation safeguard. No output schema exists, but return-value explanation is not necessary for successful invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is high at 88%, so most parameter meaning is already documented structurally. The description still adds important context not captured by the schema's required list: that body or htmlBody must be supplied, and that messageId for threaded replies should come from get_thread.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('Replies to a message') and immediately distinguishes the two modes (sender vs. everyone with replyAll). It also distinguishes this from competing actions like send_message and forward by describing reply-specific behavior such as quoting the original and setting threading headers.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit routing guidance: use get_thread and the latest message id to reply within a thread. It also states the body/htmlBody requirement and a safety condition ('Confirm with the user before sending'), leaving little ambiguity about when and how to use the tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_threadsARead-onlyInspect
IMPORTANT: results are previews (up to 5 messages per thread, from this page only). Never answer questions about the latest or unread email from previews alone; call get_thread to read relevant threads in full. Lists email threads in the Naver Mail account matching a query, newest first, with pagination. Each thread has its id, messageCount (messages from this page) and messages with id, sender, recipients, date, labelIds, subject and snippet. Use it to find thread ids before reading full threads or acting on emails.
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | THREAD_VIEW_MINIMAL (default) includes subject and snippet; THREAD_VIEW_METADATA_ONLY excludes them. | |
| query | No | Gmail search syntax, converted to IMAP for Naver Mail. Supported: from:, to:, cc:, bcc:, subject:, "exact phrase", bare keywords, after:YYYY/MM/DD (inclusive), before:YYYY/MM/DD (exclusive), newer_than:/older_than: (e.g. 7d, 2m, 1y), is:unread, is:read, is:starred, has:attachment, filename:, larger:/smaller: (e.g. 5M), in:inbox|sent|trash|spam|draft|anywhere, label:<folder name>, OR, { }, -exclude, ( ). Bare keywords match subject, sender or body. has:attachment/filename: check message structure of the newest 3000 messages per folder (add a date filter for older mail). Default scope: all folders except trash, spam and drafts. Unsupported operators (category:, AROUND …) are ignored and reported in warnings. Prefer short keyword queries. | |
| pageSize | No | Max messages to return (grouped into threads). Default 20, max 50. | |
| pageToken | No | nextPageToken from a previous call. | |
| includeTrash | No | Include messages in Trash. Default false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint/openWorldHint, but the description adds critical behavior beyond them: results are previews capped at 5 messages per thread, scoped to the current page, and messageCount reflects only this page. That caveat materially changes how an agent should interpret and trust the output.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The critical preview warning is front-loaded before the purpose statement, which is the right priority ordering. Slightly redundant, since the closing sentence repeats the "read full threads" advice already given in the opening warning, but no sentence is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, yet the description spells out the shape of each thread and message, so an agent knows what it receives. Combined with the preview limitation and the get_thread escalation path, nothing needed to call this correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the query syntax, view enum, pageSize bounds and pageToken meaning are all fully documented in the schema. The description only restates "with pagination" and preview semantics, adding little parameter-level meaning beyond structured fields.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("Lists email threads in the Naver Mail account matching a query"), plus ordering (newest first) and pagination. It also enumerates the returned fields (id, messageCount, messages with sender/recipients/date/labelIds/subject/snippet), which makes it easy to distinguish from get_thread.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says "Use it to find thread ids before reading full threads or acting on emails" and names the alternative (get_thread) with the condition that selects it. It also gives a when-not rule: never answer questions about the latest or unread email from previews alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
send_messageAInspect
Sends an email immediately from the Naver Mail account (SMTP) and saves a copy in Sent. To send an existing draft, give draftId. To thread under an existing conversation give replyThreadId or replyToMessageId. Confirm recipients and content with the user before sending.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | Cc recipients. Plain email addresses (e.g. "user@example.com"); "Name <user@example.com>" also works. | |
| to | No | Primary recipients. Required unless draftId is given. Plain email addresses (e.g. "user@example.com"); "Name <user@example.com>" also works. | |
| bcc | No | Bcc recipients. Plain email addresses (e.g. "user@example.com"); "Name <user@example.com>" also works. | |
| body | No | Plain text body. Do NOT format with Markdown; use htmlBody for rich text. If htmlBody is also given, this is the plain-text alternative. | |
| draftId | No | Send this draft as is; other fields are ignored. The draft is removed after sending. | |
| subject | No | ||
| htmlBody | No | HTML body (valid HTML tags). | |
| attachments | No | Attachments. Combined size must not exceed 25MB. | |
| replyThreadId | No | Thread the message under this thread (replies to its latest message). | |
| replyToMessageId | No | Thread the message as a reply to this message. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds context beyond annotations: the send is immediate, a copy is stored in Sent, and user confirmation is expected first — meaningful for a non-idempotent, open-world mutation. It doesn't cover failure behavior, whether drafts are consumed on partial errors (that detail lives only in the schema), or attachment size limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short sentences, front-loaded with the core action, then mode selection, then the safety precondition. No repetition of schema details and nothing wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 10-parameter, output-schema-less send tool with strong annotations and 90% schema coverage, the description covers the essential decision points (new message vs draft vs thread) plus the confirmation requirement. Missing only post-send/error semantics, which are low-value for selection.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 90%, so the schema already documents draftId, replyThreadId, replyToMessageId, body/htmlBody, and attachments in detail. The description only restates the draft and threading modes at a higher level, adding no syntax or edge-case meaning beyond the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (sends an email immediately via SMTP, saves a copy in Sent), which cleanly separates it from create_draft. However, the threading instructions ('give replyThreadId or replyToMessageId') blur the boundary with the `reply` sibling, which the description never mentions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives concrete routing rules for two modes: send an existing draft via draftId, and thread via replyThreadId/replyToMessageId. It also adds a real safety instruction ('Confirm recipients and content with the user before sending'). It stops short of saying when to use `reply` or `forward` instead of this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
trash_messageAIdempotentInspect
Moves a message to Trash (soft delete). Default tool when the user asks to delete a message without asking for permanent deletion.
| Name | Required | Description | Default |
|---|---|---|---|
| messageId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=false and idempotentHint=true, but that leaves reversibility ambiguous; the description resolves this by labeling the operation a soft delete, implying recovery is possible. It doesn't mention that a sibling (untrash_message) reverses it, which would have closed the loop.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with the operation and the default-selection rule front-loaded; nothing is redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter, non-destructive mutation with no output schema, this covers what it does and when to prefer it. Missing only the reversible counterpart and any note on where the message ID comes from.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% and the single parameter messageId is never described or formatted. 'A message' weakly implies the target, but the description adds no syntax, format, or ID-source guidance beyond the schema's bare string type.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Moves a message to Trash') plus the soft-delete semantics. It does not explicitly contrast with the sibling trash_thread, though 'message' vs 'thread' is implied by the name.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly declares this the default tool when the user asks to delete without requesting permanent deletion, which is a clear selection rule. It stops short of naming the permanent-delete alternative, leaving the agent to infer which tool that is.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
trash_threadAIdempotentInspect
Moves every message of a thread to Trash (soft delete).
| Name | Required | Description | Default |
|---|---|---|---|
| threadId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover safety profile (readOnly=false, destructive=false, idempotent=true), and the description adds the key extra fact that this is a soft delete affecting all messages in the thread — consistent with destructiveHint=false. It stops short of stating recoverability or that thread metadata/labels persist.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero filler; the scope ('every message of a thread') and semantics ('soft delete') are delivered immediately.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter soft-delete tool with rich annotations and no output schema, this is nearly sufficient. A note on reversibility (via untrash_thread) and any effect on thread labels would close the remaining gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter (threadId) with 0% schema description coverage, so the description carries the burden. It implies the identifier refers to a thread rather than a message, but adds no format, source, or example for the ID.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Moves ... to Trash') and resource ('every message of a thread'), plus the 'soft delete' qualifier. The thread-level scope implicitly separates it from trash_message, though no sibling is named outright.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied by the name and phrasing; the description never states when to prefer this over trash_message (single message) or how it relates to untrash_thread for reversal. No exclusions or prerequisites are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
unlabel_messageAIdempotentInspect
Removes labels from a message, e.g. remove UNREAD to mark as read, STARRED to unstar. Moving changes the message id; the new id is returned.
| Name | Required | Description | Default |
|---|---|---|---|
| labelIds | Yes | Label ids: STARRED, UNREAD, INBOX, TRASH, SPAM, or a user label id from list_labels. Adding a folder label moves the message to that folder (one folder per message); removing the current folder label moves it back to INBOX. | |
| messageId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare idempotent=true, destructive=false, readOnly=false, so the safety profile is covered. The description adds a genuinely non-obvious behavioral trait: moving changes the message id and the new id is returned, which an agent cannot get from annotations. It stops short of covering failure modes (e.g., removing a label that is not present).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences, zero waste, with the core action first and the id-change caveat second. Every clause carries information an agent needs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter, low-complexity mutation with no output schema, the description covers the non-obvious return value (new id) and the label effect. Minor gaps remain around idempotent behavior when a label is absent and the lack of messageId documentation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%: labelIds is richly documented in the schema while messageId has no description anywhere. The description reinforces label semantics with UNREAD/STARRED examples but adds no messageId guidance or id-format detail, so baseline 3 fits.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("Removes labels from a message") and adds concrete examples (UNREAD to mark read, STARRED to unstar) that make the effect unambiguous. It implicitly contrasts with the sibling label_message but never names it, so differentiation relies on the agent inferring the inverse.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The examples imply the use case (marking read/unstarring), but there is no explicit when-to-use versus alternatives such as label_message, update_message_labels, or unlabel_thread. Folder-move semantics from the schema suggest editing scenarios, yet the description does not route the agent among these overlapping tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
unlabel_threadAIdempotentInspect
Removes labels from every message in a thread, e.g. remove UNREAD to mark the whole conversation as read.
| Name | Required | Description | Default |
|---|---|---|---|
| labelIds | Yes | Label ids: STARRED, UNREAD, INBOX, TRASH, SPAM, or a user label id from list_labels. Adding a folder label moves the message to that folder (one folder per message); removing the current folder label moves it back to INBOX. | |
| threadId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare safe, idempotent, non-destructive mutation, so the bar is lower. The description's real addition is batch scope — that the label change cascades across every message in the thread rather than one message — which is exactly the behavior an agent needs to know before committing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence, front-loaded with the action, with the example earning its space by translating the mechanic into a user-visible outcome. No filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter idempotent mutation with annotations covering safety and no output schema, the description gives action, scope, and a worked example. Minor gap: no mention of behavior when a label is absent from some messages in the thread.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage sits at 50%: labelIds carries a rich description (allowed values, folder-moving semantics) while threadId has none. The description only echoes 'UNREAD' from the schema and adds no format or constraint detail, so it neither compensates for nor worsens the gap. Baseline 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('removes labels from every message in a thread') and the 'every message' qualifier implicitly separates it from unlabel_message. It does not explicitly name the sibling, but the thread-level scope is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The example ('remove UNREAD to mark the whole conversation as read') gives one concrete use case, which implies when to reach for this tool. It offers no exclusions or comparison to unlabel_message / update_message_labels for single-message or mixed-operation cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
unmark_message_spamAIdempotentInspect
Moves a message out of Spam back to the Inbox.
| Name | Required | Description | Default |
|---|---|---|---|
| messageId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare idempotentHint=true, destructiveHint=false, and readOnlyHint=false, so the agent knows this is a safe, repeatable mutation. The description adds the meaningful state change (Spam to Inbox), but does not say what happens if the message is not in Spam, whether failure is silent, or what is returned.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, front-loaded with the action and resource, with zero filler. Nothing to remove and nothing redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter, non-destructive, idempotent mutation with annotations covering the safety profile and no output schema, the definition is nearly sufficient. The only missing piece is edge-case behavior when the message is not currently in Spam.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is a single required parameter, messageId, with 0% schema description coverage, so the description carries no additional format or semantics guidance. The parameter is self-evident for an email domain and does not require explanation, so this is adequate but unhelpful.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (moves out of Spam) and resource (a message), and names the destination (Inbox). This cleanly distinguishes it from mark_message_spam (opposite direction) and unmark_thread_spam (thread-level).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The implied usage (restore a spam-classified message to the Inbox) is inferable from the description, but there is no explicit statement of when to use it versus unmark_thread_spam or why one would choose the message-level over the thread-level variant. It also says nothing about preconditions, such as whether the message must currently be in Spam.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
unmark_thread_spamBIdempotentInspect
Moves the messages of a thread out of Spam.
| Name | Required | Description | Default |
|---|---|---|---|
| threadId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds that the effect applies to all messages in a thread rather than one message, but says nothing about permissions, behavior when the thread is not in Spam, or any resulting label/state changes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short sentence with zero filler, and the resource and effect are front-loaded. Nothing could be removed without losing meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter, non-destructive, idempotent tool with annotations and no output schema, this is close to adequate. Still missing are edge-case behavior (thread not in Spam, partial failures) and any hint of the required authorization scope.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for the single required threadId, so the description carries some burden. Saying 'a thread' implies threadId identifies the thread whose messages are moved, but it adds no format, example, or accepted-ID detail beyond that weak implication.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Moves ... out of') and a specific resource ('the messages of a thread'), and the thread/message distinction implicitly separates it from the sibling unmark_message_spam. It does not explicitly name that sibling, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this versus unmark_message_spam or mark_thread_spam, and no stated preconditions (e.g., thread must currently be in Spam). The use case is only inferable from the name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
untrash_messageAIdempotentInspect
Moves a message out of Trash (to Sent if you sent it, otherwise Inbox).
| Name | Required | Description | Default |
|---|---|---|---|
| messageId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, destructiveHint=false and idempotentHint=true, so the bar is lower; the description still adds genuine context by disclosing the resulting folder (Sent vs Inbox depending on whether the user was the sender), which annotations cannot express. It omits error behavior when the message is not in Trash, keeping it short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with zero padding, with the core action front-loaded and the conditional outcome parenthetical kept tight.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter, non-destructive, idempotent restore operation with no output schema, the description covers the action and its outcome well enough to call correctly. The only real gap is the undocumented messageId, which is a parameter-semantics issue rather than a missing context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must carry the meaning of messageId, but it never mentions the parameter or its expected format. Only the phrase 'a message' hints at a single message identifier, leaving the sole parameter effectively undocumented across both sources.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
A specific verb ('Moves... out of Trash') plus an explicit state transition and destination logic, so an agent knows exactly what effect it has. It also implicitly distinguishes itself from the sibling untrash_thread by operating on a single message, though it never names that sibling.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the name and the Trash reference — call it to restore a trashed message. There is no explicit statement of prerequisites (the message must currently be in Trash) and no routing to untrash_thread or trash_message when the agent has the wrong operand.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
untrash_threadBIdempotentInspect
Moves the messages of a thread out of Trash.
| Name | Required | Description | Default |
|---|---|---|---|
| threadId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare idempotent, non-destructive, non-read-only behavior, so the bar is lower. The description usefully clarifies that the operation acts on the thread's messages rather than the thread container itself, but says nothing about return values, partial-failure behavior, or what happens to messages not in Trash.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler; the action and resource come first. It is efficient, though it may be slightly too terse for a mutation tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With annotations covering the safety profile and only one parameter, the description is close to adequate, but it omits where to obtain threadId and what state change to expect (e.g., thread no longer appears in trash listings). No output schema exists, so a short note on the effect would have helped.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the single threadId parameter has no documented format or source (e.g., obtained from search_threads or get_thread). The description only implies the parameter by saying 'of a thread', leaving the agent to infer the identifier's origin and type.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (moves out of Trash) and a specific resource (the messages of a thread), which distinguishes it from the sibling untrash_message. It is clear what the tool does, though it does not explicitly name the sibling it contrasts with.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use guidance, no prerequisites, and no mention of alternatives such as untrash_message for single messages. The restore-from-Trash scenario is only implied by the name and description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update_draftAInspect
Updates a draft with merge semantics: given (non-empty) fields overwrite, omitted fields are kept. If only body is given the HTML body is cleared. WARNING: attachments are NOT merged; re-provide them or they are removed. The draft id changes (returned).
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | Cc recipients. Plain email addresses (e.g. "user@example.com"); "Name <user@example.com>" also works. | |
| to | No | Primary recipients. Plain email addresses (e.g. "user@example.com"); "Name <user@example.com>" also works. | |
| bcc | No | Bcc recipients. Plain email addresses (e.g. "user@example.com"); "Name <user@example.com>" also works. | |
| body | No | Plain text body. Do NOT format with Markdown; use htmlBody for rich text. If htmlBody is also given, this is the plain-text alternative. | |
| draftId | Yes | ||
| subject | No | ||
| htmlBody | No | HTML body (valid HTML tags). | |
| attachments | No | Attachments. Combined size must not exceed 25MB. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses behavior far beyond the annotations: precise merge semantics, the body-only side effect that clears htmlBody, the warning that attachments are NOT merged and are removed if omitted, and the non-obvious fact that the draft id changes and is returned. These are exactly the traps an agent would otherwise hit.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three dense sentences, front-loaded with the merge rule before the edge cases, and the highest-risk warning (attachments deleted) is capitalized. No filler or restatement of the name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a non-idempotent mutation with no output schema, the description covers the destructive edge case, the identity change, and the update contract. An agent has everything needed to call it without silently destroying data.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 75%, but the description adds real semantics the schema cannot express: per-field overwrite-vs-keep behavior across all 8 parameters, the body/htmlBody interaction, and the attachment replacement rule. It meaningfully reduces ambiguity about how omitted vs. provided values are treated.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("Updates a draft") and immediately qualifies it with the operative semantics ("merge semantics"). This clearly separates it from create_draft, get_draft, delete_draft and list_drafts without needing the schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives concrete conditions that govern correct use: non-empty fields overwrite, omitted fields are kept, body-only clears htmlBody, and attachments must be re-provided. It never explicitly routes the agent to a sibling (e.g. create_draft for a new draft, or send_message instead of updating), so it stops short of full when/when-not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update_labelCIdempotentInspect
Renames a user label (folder).
| Name | Required | Description | Default |
|---|---|---|---|
| labelId | Yes | User label id from list_labels. | |
| displayName | Yes | New name. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, idempotentHint=true, destructiveHint=false, openWorldHint=false, so the safety profile is fully covered elsewhere. The description adds only the "(folder)" gloss and says nothing about side effects such as the new name propagating to all messages/threads already carrying the label, and nothing about the response.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short sentence with the key information front-loaded and zero waste. It is arguably too terse for a rename operation, but nothing is redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
A simple two-parameter mutation whose annotations and schema carry most of the load, so the description is close to sufficient. It nonetheless omits the propagation effect of a rename and any indication of the response, which a caller would want for a mutating tool with no output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with both labelId ("User label id from list_labels") and displayName ("New name") documented. The description adds no meaning beyond that, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (renames) and resource (user label), and the parenthetical "(folder)" clarifies what a label is in this API's vocabulary. It does not explicitly distinguish itself from create_label/delete_label/list_labels, but the verb makes the distinction reasonably evident.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this versus create_label or delete_label, nor any prerequisites (e.g., that the label must already exist). The only routing hint, that labelId comes from list_labels, lives in the schema rather than the description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update_message_labelsAIdempotentInspect
Adds and/or removes labels on a message in one call. Moving changes the message id; the new id is returned.
| Name | Required | Description | Default |
|---|---|---|---|
| messageId | Yes | ||
| addLabelIds | No | Label ids: STARRED, UNREAD, INBOX, TRASH, SPAM, or a user label id from list_labels. Adding a folder label moves the message to that folder (one folder per message); removing the current folder label moves it back to INBOX. | |
| removeLabelIds | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare idempotent, non-destructive, and non-read-only, so the safety profile is covered. The description adds a genuinely non-obvious behavioral fact beyond that: moving a message between folders changes its id, and the new id is returned. It still omits what a folder move implies for permissions or concurrent access, keeping it short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero waste, with the core purpose front-loaded and the id-mutation caveat immediately after. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The single biggest gotcha (id changes on move) is captured, but there is no output schema and the description does not cover the remove path, the required messageId, or what the response looks like beyond the new id. Adequate but with clear gaps for a 3-parameter mutation tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 33% and the description adds no parameter-level meaning at all — it does not explain messageId (required), removeLabelIds (fully undocumented anywhere), or the add/remove interaction. It relies entirely on the schema's addLabelIds prose, leaving an agent guessing about removal and the required id.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: adds and/or removes labels on a message, explicitly combined 'in one call'. That is clear, but it never names the sibling tools (label_message / unlabel_message) it subsumes, so an agent must infer the distinction itself.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'in one call' implies this is the tool to pick when both adding and removing are needed, but there is no explicit when/when-not guidance relative to label_message, unlabel_message, or label_thread, and no stated prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
30 tool updates
v0.1.0- First observed
create_draft - First observed
create_label - First observed
delete_draft - First observed
delete_label - First observed
forward - First observed
get_attachment - First observed
get_draft - First observed
get_message - First observed
get_profile - First observed
get_thread - First observed
label_message - First observed
label_thread - First observed
list_drafts - First observed
list_labels - First observed
mark_message_spam - First observed
mark_thread_spam - First observed
reply - First observed
search_threads - First observed
send_message - First observed
trash_message - First observed
trash_thread - First observed
unlabel_message - First observed
unlabel_thread - First observed
unmark_message_spam - First observed
unmark_thread_spam - First observed
untrash_message - First observed
untrash_thread - First observed
update_draft - First observed
update_label - First observed
update_message_labels
TDQS
Scored across 30 tools
Most tools target a clear resource+action pair (message vs thread vs label vs draft), but there is real redundancy: update_message_labels duplicates what label_message + unlabel_message already do, and reply overlaps heavily with send_message when replyToMessageId is supplied. The message-vs-thread variants (trash_message/trash_thread, mark_message_spam/mark_thread_spam) are distinguishable only via the name suffix, which descriptions support but don't strongly disambiguate.
Strong verb_noun snake_case pattern with predictable prefixes (label_/unlabel_, trash_/untrash_, mark_/unmark_, create_/update_/delete_). A few bare-verb outliers (reply, forward, send_message) break the pattern slightly, but overall it is highly predictable.
30 tools is heavy and crosses the comfortable range, though a full mail client (messages, threads, drafts, labels, spam/trash, sending) is a genuinely broad domain. Removing the redundant update_message_labels and collapsing mark/unmark pairs would bring it to a well-scoped size.
Covers the full lifecycle for messages, threads, drafts (create/get/update/delete), labels (CRUD), plus send/reply/forward and attachment download. Minor gaps: no way to attach files when sending and no permanent-delete operation, but these are likely deliberate and workaroundable.
Maintenance
Related MCP Connectors
Email infrastructure for AI agents — send, receive, search, and reply to email over MCP.
Remote streamable-HTTP MCP server running on a single Cloudflare Worker. Your assistant gets live Airbnb, Amazon, Booking.com, Google Flights, Maps and Reddit data, social search on X, Instagram and TikTok, the Meta Ad Library, and image/video generation without any keys. Connect your own accounts to let it send WhatsApp or Telegram messages, work an IMAP inbox, manage Meta Ads campaigns and publish to X and LinkedIn. OAuth 2.1 with PKCE; stored credentials are AES-256-GCM encrypted.
Email for AI agents: read, search and send from your Gmail, Outlook, Yahoo, iCloud or IMAP inbox.
Your agent needs a mailbox of its own — to receive, thread, draft and send, with attachments, without borrowing your personal inbox or your company's SMTP. **What you can ask for** • "Create an inbox for this agent and tell me its address." • "Read the new messages in this thread and draft a reply." • "Send this message with the attachment and wait for the response." • "Search this inbox for everything from that domain." • "Show delivery metrics and the events on this inbox." **How to use it** Point any MCP client at https://mcp.aisa.one/mail/mcp and sign in with OAuth — there is no key to create or paste. 49 tools: create and delete inboxes, list and read messages, raw message bodies, attachments, threads, drafts and draft attachments, send and reply, message search, inbox events, metrics, and list entries — reads and writes. **Why this rather than the source** A real inbox an agent owns, rather than an SMTP credential it borrows from a human. **It is also a door to the rest** The same login reaches 26 sources and 580+ operations. Find the contact elsewhere in the catalogue, then write to them from here — without adding a second server. **What it costs** Finding and inspecting an operation is free. Running one is billed per call at API prices, with no seat and no monthly minimum, and every call takes max_price_usd so an agent cannot overspend by accident. **Where else it reaches** https://mcp.aisa.one/sales/mcp finds the person to write to.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceStreamable HTTP MCP server for Gmail that enables AI agents to search threads, read messages, manage drafts, and organize the inbox via OAuth authentication.530 npm10MIT
- AlicenseAqualityAmaintenanceEnables local AI apps such as Codex and Claude Desktop to search, read, send, and manage NAVER Mail through IMAP/SMTP, including HTML emails and attachments.8MIT
- AlicenseNot gradedqualityAmaintenanceGives AI agents a self-hosted Cloudflare mailbox they can use to receive, search, wait for, read, send, reply to and forward email, with attachments and threads, over MCP or REST behind a single bearer token.5MIT
- AlicenseNot gradedqualityAmaintenanceEnables AI assistants to read, search, send, reply, forward, schedule, and analyze email across multiple IMAP/SMTP accounts, with drafts and templates, provider-aware labels and bulk operations, calendar extraction, real-time inbox watching with AI triage, and verification-code capture. Exposes 52 tools, 7 prompts, and 6 resources over stdio or Streamable HTTP, with OAuth2 support for Gmail and Microsoft 365.11 npmISC