readNdraft IMAP MCP
This server provides safe IMAP email management through MCP: searching, reading, flagging, moving, and drafting email—without sending, submitting, or deleting ordinary mail.
List configured accounts and their safe account aliases.
List exact mailbox names for 1–10 accounts with isolated per-account failures.
Search 1–500 email metadata rows across targets, with filters (sender, recipient, subject, text, read/starred state, date range, attachment filename), pagination, truncation, and per-target status.
Read one email's safe headers and plain text without setting the Seen flag.
Batch-read plain text for up to 10 email identities with ordered partial results.
Read strictly filtered/sanitized HTML without loading remote content.
List safe files available in readNdraft's fixed attachment input directory.
Save one selected attachment to a fixed private output directory and return its absolute native path.
Create plain-text or rich HTML server-side drafts (with optional attachments and reply threading); no send capability.
Update only drafts previously created by this MCP, after confirmation.
Star/unstar and mark read/unread for a single message or batches of up to 50 messages.
Move one or up to 50 ordinary messages within one account to an ordinary mailbox, with safe UID MOVE/UIDPLUS fallback behavior.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@readNdraft IMAP MCPFind unread emails from my boss about the Q3 report and draft a response."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
readNdraft IMAP MCP
Safely search, read, flag, move, and draft email through IMAP. readNdraft can save and replace MCP-created drafts, but it cannot send, submit, or delete ordinary mail and contains no SMTP implementation.
Installation
1. Check the prerequisites
You need:
Windows 10/11 with Windows Credential Manager, or Linux with a working Secret Service-compatible keyring.
An IMAP account that permits password or app-password authentication using
LOGINorPLAINover implicit TLS. OAuth is not implemented.uv on
PATH.Codex, ChatGPT desktop, or Claude Code.
Confirm that uv is available:
uv --versionNo repository clone or permanent readNdraft installation is required. uvx
runs the published package in an isolated environment.
2. Configure an account
Run guided setup in a real interactive terminal:
uvx readndraft-imap-mcp@0.10.0 setupThis configures only readNdraft's local account, credential, and private state. Claude Code and Codex own their plugin, MCP registration, updates, and removal. ChatGPT desktop remains a separate manual MCP configuration target.
Client | Setup value | Detailed guide |
Codex |
| |
ChatGPT desktop |
| |
Claude Code |
|
Linux users should also follow the Linux platform guide to verify Secret Service and D-Bus before setup. Windows users can use the Windows platform guide.
The wizard will:
Check the operating-system credential backend and create private local state.
Ask for an account alias, IMAP host, port, username, and authentication method.
Read the password or app password through a hidden terminal prompt.
Test the IMAP connection before saving the account.
Never put an IMAP password in a command argument, environment variable, MCP configuration, issue, chat, or test report.
3. Install the marketplace plugin
The repository is the marketplace source; this is not GitHub Marketplace.
For Codex:
codex plugin marketplace add LeoPhoenixT/readNdraft-imap-mcp
codex plugin add readndraft@readndraftFor Claude Code, run these commands inside Claude Code:
/plugin marketplace add LeoPhoenixT/readNdraft-imap-mcp
/plugin install readndraft@readndraftThe plugin supplies one shared readndraft-email skill and a local stdio MCP
definition pinned to readndraft-imap-mcp@0.10.0. It does not contain secrets,
account data, or a send capability.
4. Restart and verify
Start a new client session after installing the plugin. Then run an online diagnostic from a terminal:
uvx readndraft-imap-mcp@latest doctor --onlineFor Codex, you can also confirm that the entry was loaded:
codex mcp get readndraftOpen a new task and ask: List my readNdraft accounts and mailboxes. A
successful response confirms that the client can start the MCP and reach the
local broker.
What setup stores
Item | Location or behavior |
Runtime | Version-pinned by the plugin and run in uv's isolated cache. |
Client integration | Marketplace/plugin state owned by Claude Code or Codex; it contains no IMAP password. |
Agent Skill |
|
IMAP password | Stored only in Windows Credential Manager or the Linux Secret Service keyring. |
Account metadata and app state | Stored in private per-user readNdraft application directories. |
If setup reports a credential-backend or connection error, see
Windows installation,
Linux installation, and
troubleshooting.
The first MCP start may take longer
while uv downloads the pinned package. If a stored password has changed, run
uvx readndraft-imap-mcp account rotate-secret ALIAS.
Related MCP server: multi-email
What it can do
List administratively pinned accounts and mailboxes.
Search 1-500 results (50 by default) with explicit truncation, stable single-mailbox cursor pagination, per-target
complete,partial,error, orpendingstatus, attempted/pending legacy fields, selectable safe header fields, and server arrival timestamps. Attachment filename matching uses bounded MIME BODYSTRUCTURE metadata, never downloaded attachment payloads. Requests above 50 require one account and one mailbox.Read safe headers and preferred plain text without setting the Seen flag. HTML-only messages are converted into a bounded, readable plain-text representation;
get_email_htmlremains available for sanitized rich HTML. When the server supplies a valid MIME BODYSTRUCTURE, these reads fetch only the selected text section; malformed or nested-message structures use the existing bounded full-message fallback.Batch-read plain text for up to 10 selected messages across 2 accounts.
Read strictly filtered HTML without loading remote content; remote-resource elements, attributes, and CSS are removed, and empty paragraphs are preserved.
Save one selected, bounded attachment into a fixed private output directory and return its absolute native-platform path. Attachment listings report nullable decoded
sizeuntil a selected attachment is downloaded, plus nullable IMAP transfer-encodedencoded_sizewhen BODYSTRUCTURE or exact wire bytes are known.Star/unstar and mark read/unread without replacing unrelated flags.
Batch one star or read state across up to 50 selected messages and 3 accounts; batches return ordered per-item results.
Move one or up to 50 selected messages within one account. The broker prefers native UID MOVE and otherwise uses a private UIDPLUS COPY, source-only
\Deleted, and targeted UID EXPUNGE sequence. Both source and destination must be existing selectable ordinary mailboxes; movement into or out of\Trash,\Junk,\Drafts, or\SentSPECIAL-USE mailboxes is prohibited.Create a plain-text or rich HTML server-side draft using bounded files from a fixed private input directory. Rich drafts require equivalent
bodyplain text and optionalhtml_bodyHTML. They are stored asmultipart/alternative, with plain text first and HTML second, so modern mail clients normally display HTML while other clients retain a plain fallback. Rich input may be an HTML fragment or a complete HTML document. Supported authored CSS is permissive and inlined for broad mail-client compatibility. Draft requests are rejected when CSS could fetch remote resources, hide content, or escape the message box; empty paragraphs are always preserved. To, Cc, and Bcc may all be empty when the user wants an unaddressed draft. Each list item is one bare or named mailbox (for example,Ada <ada@example.com>).create_draftmay receive an exact source message identity asreply_to_messageto add safe reply threading; it does not derive recipients or rewrite subjects.Update only a draft previously created by this MCP, after confirmation.
Inspect and repair local draft tracking with
drafts listanddrafts repair.drafts forgetremoves only the local tracking record; it never deletes or expunges the server message.
It exposes no send, submission, ordinary-message deletion, raw IMAP, arbitrary
flag, credential, or account-administration MCP tool. Updating a tracked draft
replaces it and expunges the previous draft version. A successful move reports
its method and invalidates the source identity. Native MOVE may succeed without
COPYUID, leaving the destination identity unavailable. The fallback requires
COPYUID before marking the source deleted; otherwise it reports partial_move,
retains the source, and requires both mailboxes to be reviewed. Never
automatically retry an ambiguous move outcome.
Manual setup and administration
The setup wizard is recommended. Individual human-only commands are also available:
uvx readndraft-imap-mcp account add work --host imap.example.com --username login@imap.example.com --sender-address user@example.com --sender-name "Display Name"
uvx readndraft-imap-mcp account test work
uvx readndraft-imap-mcp account list
uvx readndraft-imap-mcp account set-sender work leo@example.com
uvx readndraft-imap-mcp account clear-sender work
uvx readndraft-imap-mcp account set-sender-name work "Display Name"
uvx readndraft-imap-mcp account clear-sender-name work
uvx readndraft-imap-mcp account rotate-secret work
uvx readndraft-imap-mcp account disable work
uvx readndraft-imap-mcp account enable work
uvx readndraft-imap-mcp account delete workPasswords are accepted only through a hidden local prompt. Account configuration
and credential operations are not MCP tools. username is the IMAP login identity;
sender_address is the bare email address placed in the draft's From header and
may differ from that username. If omitted or cleared, the address falls back to the
username. sender_name is an optional display name, producing a header such as
From: "Display Name" <user@example.com>; clearing it restores address-only
behavior. MCP list_accounts exposes both effective sender settings so an agent can
confirm them, but MCP cannot change or override them per draft. Downstream SMTP
servers, mailing lists, and other mail systems may rewrite headers after the draft
leaves the client; the MCP controls only the MIME draft it creates.
Configure ChatGPT desktop
Generate a secret-free configuration:
uvx readndraft-imap-mcp@latest configure chatgpt-desktopThis manual configuration path is retained for ChatGPT desktop, which is not
covered by the Claude Code/Codex marketplace migration. The configure codex
and configure claude-code forms remain temporarily available only for legacy
0.3.x compatibility and are not the normal installation path.
The unified mcp command uses the authenticated on-demand launcher. It reuses a
healthy broker, starts exactly one when needed, and holds an authenticated lease
while the MCP frontend is connected. A launcher-owned broker exits only after
the final frontend disconnects and the idle period expires. Always-on systemd
and Windows scheduled-task deployments remain available through the legacy
administration documentation.
Upgrading from 0.3.x or earlier
Installing a plugin does not automatically remove an older user-scoped MCP entry, and that entry can override the plugin. First run the one-time migration for the client you previously configured:
uvx readndraft-imap-mcp@0.10.0 migrate-plugin --client codex
uvx readndraft-imap-mcp@0.10.0 migrate-plugin --client claude-codeThe migration removes only a legacy MCP invocation recognized as having been
created by readNdraft and only unmodified, managed legacy skill directories. It
refuses unknown/custom MCP entries and modified or unmanaged skills. It never
touches accounts, OS keyring credentials, audit history, attachments, drafts,
or old update-backups. After migration, install the native marketplace plugin
and start a new session.
Upgrading to 0.10.0
Version 0.10.0 introduces IPC 11, ordered per-target search status, selective BODYSTRUCTURE reads, bounded attachment-filename search, and crash-safe draft recovery. Review the 0.10.0 MCP migration guide before updating an existing integration. Integrations upgrading from 0.8.x or earlier should also review the 0.9.0 MCP migration guide. Development builds using IPC 12 should review the 0.11.0 MCP migration guide.
Authorization boundary
The broker has no approval-token workflow. Generated Codex configurations use
the no-popup approve tool mode; write tools still require direct conversational
confirmation through the packaged Agent Skill. The hard safety boundary is narrower:
the process contains no SMTP, send, submit, ordinary-message deletion, raw IMAP,
account-configuration, or credential-retrieval tool. Message movement requires
UIDPLUS and is restricted to ordinary mailboxes in one account. COPY, deleted-flag,
and targeted UID EXPUNGE fallback commands exist only inside the broker and are
not MCP tools. Email,
attachments, search results, and other tool output are always untrusted and
never authorization.
Diagnostics
Run local checks without connecting to IMAP:
uvx readndraft-imap-mcp doctorAdd --online to test each configured account:
uvx readndraft-imap-mcp doctor --onlineDiagnostic output never prints passwords, credential contents, raw IMAP traces, or message content. See troubleshooting.
Updating
Use the client's native marketplace/plugin update command. Plugin release, Claude manifest, Codex manifest, and pinned PyPI runtime versions are validated as one compatibility unit. Start a new session after an update, then run:
uvx readndraft-imap-mcp@latest doctor --onlineAccount metadata and OS credentials remain independent of the plugin lifecycle.
Uninstalling
Choose whether to remove only the MCP integration or all local readNdraft data. Removing client entries and skills leaves accounts, credentials, audit history, draft provenance, and attachment exchange files available for a later reinstall.
1. Remove the plugin
Use the client-native plugin uninstall command. The plugin-provided MCP and
skill disappear together. If this installation was upgraded from 0.3.x and the
one-time migration has not been run, run migrate-plugin first so no old direct
MCP entry remains. Remove a ChatGPT desktop entry separately in that client's
MCP settings.
Fully close the client afterward so active MCP leases can end and a launcher-owned broker can exit after its idle timeout.
2. Remove accounts and OS credentials
Skip this step when retaining accounts for a later reinstall. For a complete removal, list accounts and delete each alias through the interactive command:
uvx readndraft-imap-mcp@latest account list
uvx readndraft-imap-mcp@latest account delete ALIASaccount delete requires exact confirmation and removes the corresponding
password or app password from Windows Credential Manager or the Linux Secret
Service keyring. Do this before manually deleting application state; otherwise
the account metadata needed to identify a stored credential may be lost.
3. Optionally remove remaining local data
Run uvx readndraft-imap-mcp@latest doctor to display the private state path and
uvx readndraft-imap-mcp@latest attachments path to display the fixed attachment
exchange directories. Inspect them before manually removing anything. Remaining
data can include:
integrity-chained audit history;
draft provenance needed to update MCP-created drafts;
downloaded and upload-staging attachments;
the local IPC key and broker state;
an unused
approvalsdirectory left by an older build.
Remove these directories only when their audit, recovery, and attachment data is no longer needed. readNdraft does not delete them automatically.
There is no permanently installed uv tool to uninstall when readNdraft is used
only through uvx. uv may retain ordinary download/build cache entries shared
with other tools; clearing uv's global cache is not required to uninstall
readNdraft.
Security and privacy
The stdio MCP frontend cannot read the account file or OS credential store. It
communicates over authenticated per-user IPC with a separate broker that enforces
capabilities, quotas, provenance, and audit. Email and attachments are always
untrusted input. Received HTML is sanitized for rich reads while preserving
useful email structure, safe links, and a conservative set of presentation
styles; HTML-only mail is converted to plain text for normal reads. Draft HTML
is also sanitized and normalized before storage. It accepts common modern email
markup, complete HTML documents, safe links, and allowlisted CSS; stylesheet
rules are inlined for mail-client compatibility. Active content, event handlers,
unsafe URL schemes, external stylesheets, and images cause draft creation or
update to be rejected. Remote images, stylesheets, links,
or other URLs are never fetched automatically.
MCP tools never accept arbitrary local paths: draft files come only from the
readNdraft attachment input directory and downloaded attachments are written
only to its output directory. Run readndraft-imap-mcp attachments path to
locate them. save_attachment also returns the saved file's absolute path using
the MCP server host's native path format; clients must use that value verbatim.
Read SECURITY.md for the current security boundary. Security issues should not contain credentials or private mail.
IPC 12 pins request validation, structured nested SafeError records, and
aggregate resource health data. Inspect error.code rather than matching error
message text. A draft_busy
result means another update holds the draft lock; recovery_required needs
draft recovery before retrying; outcome_unknown means the IMAP write may have
completed, so inspect the draft state instead of retrying automatically.
Development
See CONTRIBUTING.md before proposing a change. Security reports must use the private route documented in SECURITY.md.
uv sync --extra dev
uv run pytest
uv run python scripts/security_check.py
uv build --no-sourcesRelease validation and publication steps are documented in docs/RELEASE.md.
License
readNdraft, including its packaged Agent Skill and documentation, is licensed under the Apache License 2.0. Dependency licensing is summarized in THIRD_PARTY_NOTICES.md.
Available Tools
16 toolscreate_draftB
Save a draft; authored HTML permits normal mail layout CSS but rejects remote resources, hidden content, and message-box escapes. Empty paragraphs are preserved. No send capability.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | ||
| to | Yes | ||
| bcc | No | ||
| body | Yes | ||
| subject | Yes | ||
| html_body | No | ||
| account_id | Yes | ||
| attachment_names | No | ||
| reply_to_message | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| uid | Yes | |
| mailbox | Yes | |
| draft_id | Yes | |
| account_id | Yes | |
| message_id | Yes | |
| uid_validity | Yes | |
| attachment_hashes | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are all false, so the description must carry behavioral context. It discloses that HTML is constrained (rejects remote resources, hidden content, message-box escapes), preserves empty paragraphs, and cannot send. These details add value beyond annotations and do not contradict them. It stops short of discussing result side-effects or failure modes, but is reasonably transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences in length, opens with the core action, and delivers key constraints efficiently. Every sentence adds meaningful information without repetition or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (9 parameters, 0% schema coverage), the description is inadequate. It fails to explain most required and optional parameters, so an agent cannot confidently construct correct calls. The presence of an output schema doesn't compensate for missing parameter semantics. Only the HTML-related behavior is covered.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description must compensate for all 9 parameters. It only touches on the html_body parameter through 'authored HTML' constraints and vaguely references content preservation. It offers no guidance on account_id, to, subject, body, cc, bcc, attachment_names, or reply_to_message, leaving most parameters poorly specified.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Save a draft' – a specific verb and resource. It also clarifies 'No send capability,' which disambiguates from any sending tool. However, it does not explicitly differentiate from the sibling 'update_draft,' so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit guidance on when to use this tool versus alternatives like update_draft. The only hint is 'No send capability,' which implicitly rules out sending but doesn't name alternatives or conditions for selection. This leaves the agent to infer usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_emailCRead-onlyIdempotent
Read safe headers/plain text using one complete returned identity.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | ||
| mailbox | Yes | ||
| account_id | Yes | ||
| uid_validity | Yes | ||
| max_text_chars | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| text | Yes | |
| flags | Yes | |
| headers | Yes | |
| identity | Yes | |
| attachments | Yes | |
| text_truncated | Yes | |
| text_total_chars | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, and openWorldHint=false, so the safety profile is covered. The description adds that only 'safe headers/plain text' is read, which is useful context, but it does not clarify truncation, what 'safe' means, or any auth/rate-limit behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely short for a tool with four required identity parameters and one optional content-limit parameter. It is not bloated, but it is under-specified to the point that brevity is a defect rather than conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and annotations cover safety hints. Still, the input identity is completely undocumented in both schema and description, and no usage context is supplied, leaving the definition inadequate for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are five input parameters, four of them required, with 0% schema description coverage. The description does not explain account_id, mailbox, uid_validity, uid, or max_text_chars, and the vague phrase 'one complete returned identity' does not provide usable semantics for the identity tuple.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a verb ('Read') and a narrow content type ('safe headers/plain text'), so it is not a bare tautology. However, it never names the resource as an email and does not distinguish itself from siblings such as get_email_html or get_emails, and the phrase 'using one complete returned identity' is opaque.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no when-not-to-use guidance, and no named alternative. The phrase 'using one complete returned identity' hints at a prerequisite identity from another call, but it does not identify which call or explain the selection context versus get_email_html, get_emails, or search_emails.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_email_htmlARead-onlyIdempotent
Read strictly filtered HTML without remote loading; empty paragraphs are preserved.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | ||
| mailbox | Yes | ||
| account_id | Yes | ||
| uid_validity | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| html | Yes | |
| flags | Yes | |
| identity | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds valuable behavioral context: 'strictly filtered HTML without remote loading' discloses that remote content is not loaded (privacy/security feature), and 'empty paragraphs are preserved' indicates a specific formatting behavior. This goes beyond what annotations provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is concise and front-loaded with the core purpose ('Read strictly filtered HTML'). Every word adds value: 'strictly filtered' and 'without remote loading' convey important behavioral constraints, and 'empty paragraphs are preserved' adds a specific detail. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has an output schema (not shown in detail), which likely explains the return format, so the description doesn't need to cover that. The description covers the key behavioral aspects (filtering, no remote loading, empty paragraph preservation). Given the tool's moderate complexity (4 parameters, all required), the description is reasonably complete, though it could benefit from explaining the parameters or providing more context on when to use it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for parameter meaning. However, the description doesn't explain any of the four parameters (account_id, mailbox, uid_validity, uid). The parameter names are somewhat self-explanatory (identifying an email), but the description adds no additional semantics beyond what the schema provides. With 0% coverage, the description should have provided more detail, but the parameters are standard email identifiers.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reads filtered HTML from an email, specifying 'strictly filtered HTML without remote loading' and 'empty paragraphs are preserved'. It distinguishes itself from sibling tools like get_email and get_emails by focusing on HTML content with specific filtering behavior, though it doesn't explicitly name alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for retrieving HTML content with specific filtering requirements, but it doesn't explicitly state when to use this tool versus alternatives like get_email or get_emails. The context of 'strictly filtered' and 'without remote loading' suggests safety considerations, but no explicit when/when-not guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_emailsBRead-onlyIdempotent
Read plain text for 1-10 exact identities with ordered partial results.
| Name | Required | Description | Default |
|---|---|---|---|
| identities | Yes | ||
| max_text_chars | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly=true, idempotent=true, non-destructive, closed-world, so the safety profile is covered. The description adds 'ordered partial results', which is genuinely beyond the annotations, but it is left vague – it never explains what causes partiality or what the ordering is keyed on.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler; the scope (plain text), the count bound (1-10), and the ordering/partiality note all earn their place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and annotations cover the safety profile. However, with two parameters at 0% schema coverage, the description leaves the input contract (identity shape, text truncation) unexplained, which is a real gap for a batch read tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description adds no parameter meaning at all. The required 'identities' array of nested objects (account_id, mailbox, uid_validity, uid) and the optional max_text_chars are both undocumented, and the description does not compensate – it never says how an identity is expressed or what max_text_chars truncates.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Read) and resource (plain text of emails) scoped to '1-10 exact identities', which implicitly distinguishes it from get_email_html (HTML) and search_emails (search rather than exact lookup). It does not name a sibling explicitly, so it falls just short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'exact identities' and '1-10' imply the context of use (batch fetch when you already hold precise message references), but there is no explicit when-to-use statement, no when-not-to-use, and no named alternative such as get_email for single messages or get_email_html for HTML bodies.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_accountsARead-onlyIdempotent
List safe account aliases. Call this before using an unknown alias.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and non-destructive behavior. The description adds a small amount of context with 'safe' and the prerequisite guidance, but does not elaborate on return characteristics, ordering, or any other behavior beyond what annotations provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the core action, and every word earns its place. The prerequisite instruction is direct and adds meaningful guidance without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter listing tool with a full output schema and safety-related annotations, the description is complete. It tells the agent what to call and when to call it, leaving no critical gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
This tool has zero parameters, so the description does not need to explain parameter semantics. The baseline of 4 applies because there are no parameter-related gaps to compensate for.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('List') and the resource ('safe account aliases'), making it distinct enough from sibling tools like list_mailboxes. It is concise and unambiguous, though it does not explicitly differentiate itself from all siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The instruction 'Call this before using an unknown alias' provides an explicit when-to-use recommendation. It does not mention when not to use it or compare it to alternatives, but the usage context is concrete and actionable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_attachment_inputsARead-onlyIdempotent
List safe files available in readNdraft's fixed attachment input directory.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare the tool as read-only, idempotent, and non-destructive. The description adds context beyond those by mentioning 'safe files' and the 'fixed attachment input directory', which clarifies the source and filtering behavior. It does not contradict annotations, though 'safe' is not further explained.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence (12 words) that is front-loaded with the action 'List' and delivers all necessary information without wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a simple list operation with no parameters and an output schema available, so the description need not cover return values. The description provides the essential context (read-only, fixed directory, safe files), but leaves a minor gap by not defining what qualifies as 'safe'.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4. The description correctly omits parameter details, and the empty schema requires no additional semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'List' and identifies a unique resource: 'safe files available in readNdraft's fixed attachment input directory'. This clearly distinguishes it from sibling tools like list_accounts or save_attachment, which target different resources.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context through the phrase 'attachment input directory', suggesting it is used to enumerate files available for attachments. However, it gives no explicit when-to-use or when-not-to-use guidance, nor does it mention alternatives among the sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_mailboxesARead-onlyIdempotent
List exact mailbox names for 1-10 accounts with isolated failures.
| Name | Required | Description | Default |
|---|---|---|---|
| account_ids | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, and non-destructive behavior. The description adds meaningful beyond-annotation context with 'isolated failures', disclosing that failures on one account do not prevent results for others. It also emphasizes 'exact' mailbox names, which hints at precision behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single concise sentence that front-loads the core operation ('List exact mailbox names') and packs in the key constraints: account count and isolated failure behavior. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter read-only tool with a rich annotation set and an output schema, the description covers the essential constraints: what is listed, for how many accounts, and what happens on partial failure. Nothing critical is missing for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the single parameter account_ids is largely self-explanatory. The description adds value by specifying the '1-10 accounts' count constraint and per-account isolation, but it does not detail ID format, ordering, or error semantics beyond isolation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('List exact mailbox names') and scopes it clearly to '1-10 accounts'. It is immediately distinguishable from sibling tools like list_accounts, which lists accounts rather than mailbox names.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when the tool is appropriate: when you need exact mailbox names for a bounded set of 1-10 accounts. It does not name explicit alternatives or exclusion cases, but the resource and scope make the intended use apparent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
move_emailADestructive
Move one ordinary message to an existing ordinary mailbox.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | ||
| mailbox | Yes | ||
| account_id | Yes | ||
| uid_validity | Yes | ||
| destination_mailbox | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| method | Yes | |
| identity | Yes | |
| destination_mailbox | Yes | |
| destination_identity | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructiveHint=true and readOnlyHint=false, so the agent knows this is a destructive write. The description adds the constraints that the destination must already exist ('existing') and that the message/mailbox are 'ordinary' (not special types), providing some extra context. However, it does not disclose details about source deletion or failure behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, tightly worded sentence that front-loads the core purpose without filler. Every word contributes meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite the annotations and output schema, the description is too sparse for a mutation tool with 5 required parameters and no parameter documentation. It lacks context on how to obtain the identifiers, the relationship between uid and uid_validity, and any prerequisites for moving an 'ordinary' message. The tool's overall behavior is underspecified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not compensate. It mentions 'message' and 'destination_mailbox' but does not explain the meaning or format of uid, uid_validity, mailbox, or account_id. For a tool with 5 required params including the non-obvious uid_validity, this is a significant gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('Move'), the resource ('one ordinary message'), and the destination ('an existing ordinary mailbox'). The word 'one' distinguishes it from the batch sibling move_emails_batch, making its sole purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The singular 'one' implies this tool is for single-message moves, suggesting batch moves should go elsewhere, but it does not explicitly name alternatives or state when not to use this tool. The guidance is implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
move_emails_batchADestructive
Move 1-50 ordinary messages from one account to one mailbox.
| Name | Required | Description | Default |
|---|---|---|---|
| identities | Yes | ||
| destination_mailbox | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds meaningful behavioral context beyond the annotations: it specifies the batch size limit (1-50), restricts messages to 'ordinary' types, and clarifies that all messages must originate from one account and go to one mailbox. This complements the destructiveHint annotation without contradicting it, though it does not mention potential partial failures or atomicity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that conveys the core action and key constraints without any fluff. Every word carries meaning, making it highly concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (batch operation, 2 parameters, output schema present), the description covers the essential selection criteria: what it does, batch limits, and account/mailbox constraints. However, it leaves some ambiguity around 'ordinary messages' and does not address error handling or atomicity, which would be helpful but is not critical given the annotations and output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description compensates by explaining that 'identities' represents the 1-50 messages to move (all from one account) and 'destination_mailbox' is the target mailbox. This adds crucial meaning that the schema property names alone do not convey, and it aligns with the required parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Move'), the resource ('ordinary messages'), and the scope ('1-50', 'from one account to one mailbox'). It also implicitly distinguishes itself from the sibling tool 'move_email' by specifying batch size, making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for batch moves of 1-50 messages, but it does not explicitly state when to use this tool versus the single-message sibling 'move_email' or any other alternative. There is no mention of exclusions or conditions, so guidance is only implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
save_attachmentCRead-onlyIdempotent
Save one attachment; saved_path is its absolute native-platform location.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | ||
| mailbox | Yes | ||
| account_id | Yes | ||
| uid_validity | Yes | ||
| attachment_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| size | Yes | |
| sha256 | Yes | |
| saved_name | Yes | |
| saved_path | No | |
| content_type | Yes | |
| original_name | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotation declares readOnlyHint=true, but the description says 'Save one attachment,' implying a write operation to the filesystem. This is a direct contradiction, and the description does not clarify the tool's side effects, permissions, or overwriting behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that conveys the core function and a key output detail. It is efficient and well-structured, though it omits critical behavioral context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool requires 5 parameters, has no parameter descriptions, and includes a contradictory annotation, the description is far from complete. It does not address usage context, side effects, or parameter relationships, making it inadequate for reliable tool invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 5 required parameters with 0% description coverage. The description does not explain the role of any parameter, relying solely on parameter names. This is insufficient for an agent to understand how to correctly populate the parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool saves one attachment and specifies that saved_path is the absolute native-platform location. This clearly defines the tool's action and distinguishes it from sibling tools like list_attachment_inputs or get_email.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives, nor any prerequisites or exclusions. It only describes the action without contextualizing its usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_emailsCRead-onlyIdempotent
Search 1-500 metadata rows in stable mailbox order with optional paging.
| Name | Required | Description | Default |
|---|---|---|---|
| read | No | ||
| text | No | ||
| after | No | ||
| limit | No | ||
| before | No | ||
| cursor | No | ||
| fields | No | ||
| sender | No | ||
| starred | No | ||
| subject | No | ||
| targets | Yes | ||
| recipient | No | ||
| attachment_filename | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| order | Yes | |
| errors | Yes | |
| results | Yes | |
| truncated | Yes | |
| next_cursor | Yes | |
| target_statuses | Yes | |
| targets_pending | Yes | |
| targets_searched | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and openWorldHint=false, covering the safety profile. The description adds a result-size range (1-500), stable ordering, and optional paging, which are useful behavioral details beyond annotations, though 'stable mailbox order' is ambiguous.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with no wasted words. Efficient, though the phrasing 'metadata rows in stable mailbox order' is slightly jargon-heavy and could be clearer.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 13 parameters, zero schema descriptions, and an output schema that covers returns, the description is far too sparse. It omits all search criteria and filter semantics, leaving an agent unable to select or invoke the tool effectively.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description does not describe any of the 13 parameters. 'Optional paging' weakly hints at cursor/limit, but no meaning is added for filters like text, sender, subject, etc.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a verb ('Search') and resource ('metadata rows') but does not explicitly say 'emails' and lacks any differentiation from siblings like get_emails or list_emails. The purpose is implied by context but vague and not clearly distinguished.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives such as get_emails or list_mailboxes. No prerequisites, exclusions, or use-case scenarios are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
set_read_stateCIdempotent
Set one read state idempotently.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | ||
| read | Yes | ||
| mailbox | Yes | ||
| account_id | Yes | ||
| uid_validity | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| state | Yes | |
| changed | Yes | |
| enabled | Yes | |
| identity | Yes | |
| new_flags | Yes | |
| old_flags | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare idempotentHint=true, readOnlyHint=false, and destructiveHint=false. The description's 'idempotently' repeats the annotation, and the word 'one' adds minimal scoping context. It does not disclose additional behaviors like auth requirements or response semantics, but it does not contradict the annotations either.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with no filler and front-loaded purpose. However, it is almost too sparse, functioning as a fragment rather than a complete thought, which slightly reduces clarity despite its efficiency.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 5 required parameters, including IMAP-specific uidd_validity concepts, no schema descriptions, and the existence of a batch sibling, the description is insufficient. It does not explain how to identify the message or when to prefer the single vs batch variant, leaving the tool under-documented for reliable use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description explains none of the 5 parameters. Terms like uid_validity and mailbox are left undefined, so the description fails to compensate for the sparse schema and offers little meaning beyond parameter names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Set one read state idempotently.' uses a specific verb 'Set' and a clear resource 'read state', making the operation obvious. The word 'one' distinguishes it from the batch sibling set_read_state_batch, although it does not explicitly name the alternative, so it falls short of perfect sibling differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus set_read_state_batch or set_star. The singular 'one' implies a single-message use case, but there is no explicit context about prerequisites, exclusions, or alternatives, leaving the agent to infer usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
set_read_state_batchAIdempotent
Set one read state for 1-50 identities.
| Name | Required | Description | Default |
|---|---|---|---|
| read | Yes | ||
| identities | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already disclose idempotent and non-read-only nature. The description adds the constraint that a single read state is applied to all identities, and the batch size limit. It does not discuss failure modes or whether the operation is atomic, but the annotations reduce the burden.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence that conveys the core operation without any wasted words. Every word contributes to meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description minimally covers the operation but lacks details on batch semantics (e.g., whether partial failures occur) or when to choose this over the singular set_read_state. The output schema exists, so return values are covered, but overall the tool is underspecified for a batch mutation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must explain parameters. It loosely maps 'read state' to the 'read' parameter and 'identities' to the identity array, but does not clarify that 'read' is a boolean (true/false) or describe the structure of identity objects. Significant gaps remain.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the action ('Set'), the resource ('read state for identities'), and the batching scope ('1-50 identities'). It distinguishes from the singular sibling set_read_state by indicating the batch capability.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The range '1-50 identities' gives clear context for when to use this batch version over the singular sibling. However, it does not explicitly mention alternatives or exclusion cases, so it misses the highest level of guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
set_starCIdempotent
Set one starred state idempotently.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | ||
| mailbox | Yes | ||
| starred | Yes | ||
| account_id | Yes | ||
| uid_validity | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| state | Yes | |
| changed | Yes | |
| enabled | Yes | |
| identity | Yes | |
| new_flags | Yes | |
| old_flags | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description says "idempotently," which merely repeats the idempotentHint annotation. It adds no new behavioral context such as authentication requirements, error behavior, or the effect on other email metadata. Since annotations already declare idempotency and non-read-only status, the description adds minimal value beyond structured data.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no wasted words. It is front-loaded with the operation (Set) and immediate qualifiers (one starred state, idempotently). Structurally, it is as concise as possible for the content it provides.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with five required parameters and no parameter documentation, the description is grossly incomplete. It lacks any mention of how to identify the target email, what the starred value means, or how to handle the response. While annotations cover idempotency and write behavior, they do not compensate for missing parameter context and usage instructions.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description provides zero explanation of the five parameters (account_id, mailbox, uid_validity, uid, starred). It does not indicate how these parameters relate to the email being starred, what the starred boolean controls, or how uid_validity is used. The tool is unusable without schema-level or description-level parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool sets one starred state, using the verb "Set" with a specific resource ("one starred state"). The qualifier "one" distinguishes it from the sibling set_star_batch, and "starred" separates it from set_read_state. While terse, it conveys the exact operation and primary scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like set_star_batch or set_read_state. The description does not mention batch operations, read-state operations, or any exclusions or prerequisites, leaving the agent to infer usage from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
set_star_batchBIdempotent
Set one starred state for 1-50 identities.
| Name | Required | Description | Default |
|---|---|---|---|
| starred | Yes | ||
| identities | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint=false, idempotentHint=true, and destructiveHint=false. The description adds only the 1-50 batch limit; it does not disclose behavior on partial failures, return format, or whether existing star states are overwritten. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, succinct sentence with no redundant words. It is front-loaded with the action and scope, making it easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with a nested object array and boolean parameter, the description is under-specified. It lacks context about uniform state application, error behavior, relationship to set_star, and what constitutes an identity. The output schema exists but does not substitute for usage clarity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It hints at the 'starred' boolean ('one starred state') and mentions the identities array with a count bound, but it does not explain the structure of identity objects, the uniform application of the state, or the meaning of each parameter beyond what the schema types imply.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('Set'), the resource ('starred state'), and the scope ('identities', 1-50). It conveys batch behavior and distinguishes from the singular set_star tool via the count limit, though it does not explicitly mention the sibling tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description offers no guidance on when to use this batch tool versus alternatives like set_star or set_read_state_batch. It does not mention prerequisites, exclusions, or a recommended context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update_draftBDestructive
Replace a draft; authored HTML permits normal mail layout CSS but rejects remote resources, hidden content, and message-box escapes. Empty paragraphs are preserved. No send capability.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | ||
| to | Yes | ||
| bcc | No | ||
| body | Yes | ||
| subject | Yes | ||
| draft_id | Yes | ||
| html_body | No | ||
| account_id | Yes | ||
| attachment_names | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| uid | Yes | |
| method | Yes | |
| mailbox | Yes | |
| draft_id | Yes | |
| account_id | Yes | |
| message_id | Yes | |
| uid_validity | Yes | |
| attachment_hashes | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark destructiveHint=true, and the description aligns by saying 'Replace a draft'. It adds valuable behavioral detail: HTML restrictions (permits normal layout CSS but rejects remote resources, hidden content, message-box escapes) and that empty paragraphs are preserved. It also clarifies it cannot send emails – useful context beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, with the primary purpose front-loaded. It adds only relevant details about HTML constraints and capabilities, with no verbosity. Every sentence earns its place, making it highly efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex tool with 9 parameters and 0% schema coverage, the description is thin. It covers purpose and HTML constraints but omits parameter semantics, required field explanations, and side effects beyond replacement. The presence of an output schema doesn't offset the missing parameter guidance, so completeness is low.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, but it provides no information about any of the 9 parameters. It mentions 'authored HTML' but does not tie it to the html_body parameter. Required parameters like account_id, draft_id, to, subject, body are unexplained, leaving the agent without guidance on how to construct a valid call.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Replace a draft' – a specific verb and resource. It clarifies scope with HTML constraints and 'No send capability', which helps distinguish from send-related tools. However, it does not explicitly name siblings like create_draft, though 'replace' implies updating an existing draft.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use guidance is provided. The description implies use for updating existing drafts rather than creating new ones, but does not state conditions or alternatives. It also omits prerequisites like having a draft_id, so an agent must infer usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
3 tool updates
v0.10.0- Changed
get_email4 fields changed- added
Output schema / $defs / AttachmentMetadataOutput / properties / encoded_sizeAdded value: +{ + "anyOf": [ + { + "type": "integer" + }, + { + "type": "null" + } + ], + "title": "Encoded Size" +} - added
Output schema / $defs / AttachmentMetadataOutput / properties / size / anyOfAdded value: +[ + { + "type": "integer" + }, + { + "type": "null" + } +] - removed
Output schema / $defs / AttachmentMetadataOutput / properties / size / typeRemoved value: -"integer" - changed
Output schema / $defs / AttachmentMetadataOutput / requiredPrevious value: -[ - "attachment_id", - "filename", - "content_type", - "size" -]New value: +[ + "attachment_id", + "filename", + "content_type", + "size", + "encoded_size" +]
- Changed
get_emails4 fields changed- added
Output schema / $defs / AttachmentMetadataOutput / properties / encoded_sizeAdded value: +{ + "anyOf": [ + { + "type": "integer" + }, + { + "type": "null" + } + ], + "title": "Encoded Size" +} - added
Output schema / $defs / AttachmentMetadataOutput / properties / size / anyOfAdded value: +[ + { + "type": "integer" + }, + { + "type": "null" + } +] - removed
Output schema / $defs / AttachmentMetadataOutput / properties / size / typeRemoved value: -"integer" - changed
Output schema / $defs / AttachmentMetadataOutput / requiredPrevious value: -[ - "attachment_id", - "filename", - "content_type", - "size" -]New value: +[ + "attachment_id", + "filename", + "content_type", + "size", + "encoded_size" +]
- Changed
search_emails3 fields changed- added
Output schema / $defs / SearchTargetStatusOutputAdded value: +{ + "properties": { + "account_id": { + "title": "Account Id", + "type": "string" + }, + "cursor": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ], + "title": "Cursor" + }, + "error": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ], + "title": "Error" + }, + "mailbox": { + "title": "Mailbox", + "type": "string" + }, + "status": { + "enum": [ + "complete", + "partial", + "error", + "pending" + ], + "title": "Status", + "type": "string" + } + }, + "required": [ + "account_id", + "mailbox", + "status", + "cursor", + "error" + ], + "title": "SearchTargetStatusOutput", + "type": "object" +} - added
Output schema / properties / target_statusesAdded value: +{ + "items": { + "$ref": "#/$defs/SearchTargetStatusOutput" + }, + "title": "Target Statuses", + "type": "array" +} - changed
Output schema / requiredPrevious value: -[ - "results", - "errors", - "next_cursor", - "truncated", - "order", - "targets_searched", - "targets_pending" -]New value: +[ + "results", + "errors", + "next_cursor", + "truncated", + "order", + "targets_searched", + "targets_pending", + "target_statuses" +]
4 tool updates
v0.9.0- Changed
get_email4 fields changed- added
Input schema / properties / max_text_charsAdded value: +{ + "anyOf": [ + { + "type": "integer" + }, + { + "type": "null" + } + ], + "default": null, + "title": "Max Text Chars" +} - added
Output schema / properties / text_total_charsAdded value: +{ + "title": "Text Total Chars", + "type": "integer" +} - added
Output schema / properties / text_truncatedAdded value: +{ + "title": "Text Truncated", + "type": "boolean" +} - changed
Output schema / requiredPrevious value: -[ - "identity", - "headers", - "text", - "flags", - "attachments" -]New value: +[ + "identity", + "headers", + "text", + "flags", + "attachments", + "text_total_chars", + "text_truncated" +]
- Changed
get_emails4 fields changed- added
Input schema / properties / max_text_charsAdded value: +{ + "anyOf": [ + { + "type": "integer" + }, + { + "type": "null" + } + ], + "default": null, + "title": "Max Text Chars" +} - added
Output schema / $defs / MessageOutput / properties / text_total_charsAdded value: +{ + "title": "Text Total Chars", + "type": "integer" +} - added
Output schema / $defs / MessageOutput / properties / text_truncatedAdded value: +{ + "title": "Text Truncated", + "type": "boolean" +} - changed
Output schema / $defs / MessageOutput / requiredPrevious value: -[ - "identity", - "headers", - "text", - "flags", - "attachments" -]New value: +[ + "identity", + "headers", + "text", + "flags", + "attachments", + "text_total_chars", + "text_truncated" +]
- Changed
list_mailboxes5 fields changed- removed
Input schema / properties / account_idRemoved value: -{ - "title": "Account Id", - "type": "string" -} - added
Input schema / properties / account_idsAdded value: +{ + "items": { + "type": "string" + }, + "title": "Account Ids", + "type": "array" +} - changed
Input schema / requiredPrevious value: -[ - "account_id" -]New value: +[ + "account_ids" +] - added
Output schema / $defs / MailboxBatchOutputAdded value: +{ + "properties": { + "account_id": { + "title": "Account Id", + "type": "string" + }, + "error": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ], + "title": "Error" + }, + "mailboxes": { + "items": { + "$ref": "#/$defs/MailboxOutput" + }, + "title": "Mailboxes", + "type": "array" + }, + "ok": { + "title": "Ok", + "type": "boolean" + } + }, + "required": [ + "account_id", + "ok", + "mailboxes", + "error" + ], + "title": "MailboxBatchOutput", + "type": "object" +} - changed
Output schema / properties / result / items / $refPrevious value: -"#/$defs/MailboxOutput"New value: +"#/$defs/MailboxBatchOutput"
- Changed
search_emails5 fields changed- added
Input schema / $defsAdded value: +{ + "SearchTargetInput": { + "properties": { + "account_id": { + "title": "Account Id", + "type": "string" + }, + "mailbox": { + "title": "Mailbox", + "type": "string" + } + }, + "required": [ + "account_id", + "mailbox" + ], + "title": "SearchTargetInput", + "type": "object" + } +} - removed
Input schema / properties / accountsRemoved value: -{ - "items": { - "type": "string" - }, - "title": "Accounts", - "type": "array" -} - removed
Input schema / properties / mailboxesRemoved value: -{ - "anyOf": [ - { - "items": { - "type": "string" - }, - "type": "array" - }, - { - "type": "null" - } - ], - "default": null, - "title": "Mailboxes" -} - added
Input schema / properties / targetsAdded value: +{ + "items": { + "$ref": "#/$defs/SearchTargetInput" + }, + "title": "Targets", + "type": "array" +} - changed
Input schema / requiredPrevious value: -[ - "accounts" -]New value: +[ + "targets" +]
2 tool updates
v0.7.0- Changed
create_draft2 fields changed- added
Input schema / $defsAdded value: +{ + "IdentityOutput": { + "properties": { + "account_id": { + "title": "Account Id", + "type": "string" + }, + "mailbox": { + "title": "Mailbox", + "type": "string" + }, + "uid": { + "title": "Uid", + "type": "string" + }, + "uid_validity": { + "title": "Uid Validity", + "type": "string" + } + }, + "required": [ + "account_id", + "mailbox", + "uid_validity", + "uid" + ], + "title": "IdentityOutput", + "type": "object" + } +} - added
Input schema / properties / reply_to_messageAdded value: +{ + "anyOf": [ + { + "$ref": "#/$defs/IdentityOutput" + }, + { + "type": "null" + } + ], + "default": null +}
- Changed
list_accounts1 field changed- added
Output schema / $defs / AccountOutput / properties / sender_nameAdded value: +{ + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ], + "default": null, + "title": "Sender Name" +}
2 tool updates
v0.5.0- Changed
create_draft1 field changed- added
Input schema / properties / html_bodyAdded value: +{ + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ], + "default": null, + "title": "Html Body" +}
- Changed
update_draft1 field changed- added
Input schema / properties / html_bodyAdded value: +{ + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ], + "default": null, + "title": "Html Body" +}
4 tool updates
v0.3.0- Changed
list_accounts1 field changed- added
Output schema / $defs / AccountOutput / properties / sender_addressAdded value: +{ + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ], + "default": null, + "title": "Sender Address" +}
- Added
move_email - Added
move_emails_batch - Changed
save_attachment1 field changed- added
Output schema / properties / saved_pathAdded value: +{ + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ], + "default": null, + "title": "Saved Path" +}
14 tool updates
v0.1.4- First observed
create_draft - First observed
get_email - First observed
get_email_html - First observed
get_emails - First observed
list_accounts - First observed
list_attachment_inputs - First observed
list_mailboxes - First observed
save_attachment - First observed
search_emails - First observed
set_read_state - First observed
set_read_state_batch - First observed
set_star - First observed
set_star_batch - First observed
update_draft
TDQS
Scored across 16 tools
Most tools target distinct operations, and single vs. batch pairs are clearly separated by the '_batch' suffix and cardinality ranges. Minor potential confusion between get_email (plain text/headers) and get_email_html (HTML) since both read the same message in different representations.
Consistent snake_case with a predictable verb_noun pattern (list_, get_, create_, set_, move_, search_, save_). Batch variants consistently append '_batch'. The only minor irregularity is 'get_email_html' using a content-type suffix, but the convention remains clear.
16 tools is slightly above the ideal 3-15 range but each has a clear role; batch variants support scale without redundancy. Not excessive for an IMAP client covering read, draft, flag, and move operations.
Core read/search, draft lifecycle (create/update), flag setting, move, and attachment save are present. However, no delete/expunge for messages or drafts, and no mailbox creation—notable gaps for a full IMAP surface.
Maintenance
Related MCP Connectors
Read, send, file and search email in any Gmail, Microsoft 365 or IMAP mailbox, plus its calendar.
Never-stored live email: read, send, organize, schedule and auto-triage Gmail or any IMAP mailbox.
Email infrastructure for AI agents — send, receive, search, and reply to email over MCP.
Read and search FranklyMail email and prepare drafts, replies, and forwards for human approval.
Related MCP Servers
- AlicenseNot gradedqualityBmaintenanceEnables MCP clients to search, read, and inspect Apple Mail on macOS, including conversations and attachments. It can create new, reply, reply-all, or forward drafts, but cannot send or modify existing messages.MIT
- AlicenseNot gradedqualityAmaintenanceEnables safe, multi-account Gmail and Microsoft 365 operations with explicit aliases, including searching, reading, drafting, archiving, labels/categories, and human-reviewed sending via a localhost approval window.MIT
- AlicenseAqualityAmaintenanceEnables read-only, provider-agnostic email access over IMAP, allowing users to list folders, search and read messages, and download attachments without ever marking messages as read.6MIT
- AlicenseAqualityAmaintenanceEnables MCP clients to read, search, organise, and manage IMAP mailbox messages, including saving attachments and drafting replies, while treating mail content as untrusted and keeping write capabilities opt-in.6101 npm1MIT