Skip to main content
Glama
Lonestarrk
by Lonestarrk

m365-mcp-gdpr

MCP-server som ger Claude åtkomst till Microsoft 365 – Outlook, kalender, Teams och en SharePoint-mapp för releaser – via Microsoft Graph, med pseudonymisering av personuppgifter innan något lämnar er maskin.

Det är samma data som Microsoft 365 Copilot arbetar mot. Copilot har inget eget API för att läsa/skriva mejl, så servern pratar direkt med Microsoft Graph.

Vad den kan

Servern är uppdelad i delar som slås på var för sig med M365_MCP_FEATURES (se Välja delar). Som standard är bara sharepoint påslagen.

Del

Verktyg

Beskrivning

mail

list_folders

Mappar med antal (olästa)

mail

list_messages

Lista mejl i en mapp, filtrera på olästa

mail

search_messages

Fritextsök i hela brevlådan

mail

read_message

Läs ett mejl (bilagors innehåll hämtas inte)

mail

mark_read, flag_message, set_categories, move_message

Administrera

mail

create_draft, create_reply_draft, update_draft, delete_draft

Utkast

calendar

calendar_list_events, calendar_get_event

Läs kalendern för en period, eller en händelse med beskrivning

calendar

calendar_create_event

Boka tid i din egen kalender (t.ex. fokustid) – aldrig med deltagare

calendar

calendar_delete_event

Ta bort egen händelse utan deltagare

teams

teams_list_chats, teams_read_chat

Lista chattar och läs meddelanden

teams

teams_list_teams, teams_list_channels, teams_read_channel

Lista team och kanaler, läs inlägg

sharepoint

sharepoint_upload_release

Ladda upp en lokal fil (t.ex. release-zip) till en förbestämd SharePoint-mapp

sharepoint

sharepoint_list_releases

Lista filer i release-mappen, med länkar

Valfritt: en lokal granskningssida som visar exakt vad Claude får.

Servern skickar aldrig något till andra personer. Allt som når någon annan granskas och skickas av en människa:

  • Mejl: bara utkast. Servern begär aldrig Mail.Send, så den saknar behörighet att skicka. delete_draft vägrar radera något som inte är ett utkast.

  • Kalender: bara tid i din egen kalender. Möten med deltagare skapas inte (det skickar inbjudningar), och möten med deltagare raderas inte (det skickar avbokningar).

  • Teams: bara läsning. Teams har inga utkast, så servern begär ingen skrivbehörighet.

Namn, deltagare, platser och meddelandetext i mejl, kalender och Teams tvättas på samma sätt innan de når Claude.

Related MCP server: Microsoft 365 MCP Server

Hur GDPR-tvätten fungerar

Outlook ──Graph──▶ [ MCP-server: redact() ] ──tokens──▶ Claude
Outlook ◀─Graph─── [ MCP-server: restore() ] ◀─tokens── Claude
                        │
                   Vault (endast RAM)
  1. När ett mejl hämtas lär sig servern namn och adresser ur avsändare/mottagare.

  2. Ämne, förhandsvisning, brödtext, bilagenamn och adresser tvättas. Ersätts med stabila tokens:

    Hej [[PERSON_1_FIRST]]! Mitt personnummer är 18830702-6115, ring
    [[PHONE_1]]. Adress: [[ADDRESS_1]]. /[[PERSON_2]] [[EMAIL_3]]
  3. Kopplingen token → riktigt värde finns bara i serverprocessens minne och skickas aldrig till modellen. Den försvinner när servern stängs.

  4. När Claude skriver ett utkast med tokens byts de tillbaka till riktiga värden innan utkastet sparas i Outlook. Okända tokens avvisas.

Detekteras: e-postadresser, telefonnummer (svenska + internationella), IBAN, kortnummer (Luhn), IP-adresser, svenska gatuadresser och postnummer+ort, samt personnamn från mejlhuvuden, e-postadresser (fornamn.efternamn@) och en valfri namnlista. Med REDACT_USE_NER=1 används även spaCys svenska NER-modell för namn i fritext.

Personnummer från Sverige (även samordningsnummer), Danmark (CPR), Norge (fødselsnummer, D-nummer) och Finland (henkilötunnus) ersätts inte med en token utan med ett påhittat nummer i samma format, med födelseår på 1800-talet, t.ex. 18830702-6115. Ingen levande person kan ha det, och där formatet har kontrollsiffra är den giltig. Svenska nummer med bindestreck fångas även om kontrollsiffran är fel (felskrivna nummer är fortfarande personuppgifter). Tio siffror utan bindestreck kräver rätt kontrollsiffra, så att vanliga order- och telefonnummer inte tvättas i onödan. Fejknumret byts tillbaka till det riktiga om Claude använder det i ett utkast.

Begränsningar – läs detta

  • Regelbaserad tvätt är aldrig 100 %. Namn i fritext på personer som inte förekommer i mejlhuvuden fångas bara med NER eller namnlista. Hälsodata, fackmedlemskap och andra känsliga uppgifter (art. 9) i fritext fångas inte.

  • Pseudonymiserade uppgifter är fortfarande personuppgifter enligt GDPR (art. 4.5, skäl 26). Tvätten är en skyddsåtgärd (dataminimering, art. 25 och 32) – den ersätter inte rättslig grund, personuppgiftsbiträdesavtal (DPA) med Anthropic, registerförteckning eller eventuell DPIA.

  • Mejl-ID:n och datum skickas otvättade (de är inte personuppgifter i sig).

Installation

1. App-registrering i Microsoft Entra ID

  1. Entra admin center → App registrations → New registration.

  2. Supported account types: Endast den här organisationen.

  3. Authentication → Add a platform → Mobile and desktop applications, lägg till:

    • http://localhost (inloggning via webbläsare)

    • ms-appx-web://Microsoft.AAD.BrokerPlugin/<client-id> (Windows inbyggda kontoruta)

    • msauth.com.msauth.unsignedapp://auth (Mac med Company Portal)

  4. Authentication → Allow public client flows = Yes (behövs bara för --device-code).

  5. API permissions → Microsoft Graph → Delegated: User.Read plus behörigheten för varje del ni ska använda (se Välja delar): Sites.ReadWrite.All för sharepoint, Mail.ReadWrite för mail, Calendars.ReadWrite för calendar och Chat.Read, Team.ReadBasic.All, Channel.ReadBasic.All, ChannelMessage.Read.All för teams. Sites.ReadWrite.All och ChannelMessage.Read.All kräver admin consent. Behörigheterna är delegerade: servern kommer bara åt det du själv har behörighet till.

  6. Notera Application (client) ID och Directory (tenant) ID.

2. Installera programmet

Kräver Python 3.11 eller senare. Installera med pipx, så hamnar programmet i en egen miljö och kommandot m365-mcp-gdpr blir tillgängligt överallt:

pipx install git+https://github.com/Lonestarrk/m365-mcp-gdpr

Mac med Company Portal (för inloggningsrutan i stället för webbläsaren):

pipx install "m365-mcp-gdpr[broker] @ git+https://github.com/Lonestarrk/m365-mcp-gdpr"

Är repot privat behöver du vara inloggad mot GitHub på datorn först, t.ex. med gh auth login.

3. Installera i Claude Code

claude mcp add m365 --scope user \
  -e M365_MCP_CLIENT_ID=<client-id> \
  -e M365_MCP_TENANT_ID=<tenant-id> \
  -e M365_MCP_LOGIN_HINT=<din jobbmejl> \
  -e M365_MCP_FEATURES=sharepoint \
  -e SHAREPOINT_SITE="matildafoodtech.sharepoint.com:/sites/<webbplats>" \
  -e SHAREPOINT_FOLDER="<mapp för releaser>" \
  -e SHAREPOINT_UPLOAD_ROOTS="<sökväg till projektets dist-mapp>" \
  -- m365-mcp-gdpr
  • --scope user gör servern tillgänglig i alla dina projekt. Utan den gäller den bara i mappen du står i.

  • På Windows (PowerShell/cmd): skriv allt på en rad utan \.

  • SharePoint-raderna kan utelämnas om du bara ska använda mejl, och tvärtom. Alla inställningar finns under Konfiguration.

Starta Claude Code och kör /mcp. m365 ska stå som ansluten. Första gången Claude använder servern öppnas inloggningen (se nedan).

Ändra inställningar: ta bort och lägg till igen:

claude mcp remove m365 --scope user
claude mcp add m365 --scope user ...

Uppdatera till senaste versionen: pipx upgrade m365-mcp-gdpr och starta om Claude Code.

Avinstallera: claude mcp remove m365 --scope user, m365-mcp-gdpr logout och pipx uninstall m365-mcp-gdpr.

4. Logga in

Inloggningen sker med ditt vanliga jobbkonto:

  • Windows: systemets egen kontoruta visas, med ditt jobbkonto förvalt. Ofta behövs inget lösenord alls om du redan är inloggad i Windows med jobbkontot.

  • Mac: via Company Portal om den är installerad (se steg 2), annars öppnas Microsofts inloggningssida i webbläsaren.

  • Linux: Microsofts inloggningssida öppnas i webbläsaren.

Tvåfaktorsinloggning (t.ex. Microsoft Authenticator) sköts som vanligt i den rutan.

Du behöver bara logga in en gång. Inloggningen sparas krypterat i operativsystemets nyckelring (Windows DPAPI, macOS Keychain, Linux libsecret) och förnyas tyst i bakgrunden. Den håller så länge du använder den regelbundet – som standard upphör den efter 90 dagar utan användning. Er IT kan ha regler (Conditional Access, "sign-in frequency") som kräver ny inloggning oftare; det styrs av organisationen, inte av servern.

Inloggningen öppnas automatiskt första gången Claude använder servern. På Windows rekommenderas att logga in i förväg i ett terminalfönster: när Claude Code startar servern i bakgrunden kan kontorutan hamna bakom andra fönster. Efter första inloggningen sker allt tyst. Kör i en terminal (macOS/Linux):

M365_MCP_CLIENT_ID=<client-id> M365_MCP_TENANT_ID=<tenant-id> m365-mcp-gdpr login

PowerShell:

$env:M365_MCP_CLIENT_ID="<client-id>"; $env:M365_MCP_TENANT_ID="<tenant-id>"; m365-mcp-gdpr login

m365-mcp-gdpr logout tar bort den sparade inloggningen. På en dator utan webbläsare: m365-mcp-gdpr login --device-code.

Claude Desktop

Lägg till i claude_desktop_config.json och starta om Claude Desktop:

{
  "mcpServers": {
    "m365": {
      "command": "m365-mcp-gdpr",
      "env": {
        "M365_MCP_CLIENT_ID": "<client-id>",
        "M365_MCP_TENANT_ID": "<tenant-id>"
      }
    }
  }
}

Välja delar av Microsoft 365

M365_MCP_FEATURES är en kommaseparerad lista över de delar servern ska ge Claude tillgång till:

Värde

Ger

sharepoint (standard)

Uppladdning och listning av releaser i en SharePoint-mapp

mail

Läsa, organisera och skriva utkast i Outlook, med GDPR-tvätt

calendar

Läsa kalendern och boka tid för dig själv, med GDPR-tvätt

teams

Läsa chattar och kanaler, med GDPR-tvätt

t.ex. sharepoint,calendar

Flera delar, kommaseparerat

all

Allt ovan

Behörigheter per del:

Del

Microsoft Graph-behörighet (delegerad)

sharepoint

Sites.ReadWrite.All

mail

Mail.ReadWrite

calendar

Calendars.ReadWrite

teams

Chat.Read, Team.ReadBasic.All, Channel.ReadBasic.All, ChannelMessage.Read.All

alltid

User.Read

En del som inte är påslagen är avstängd på två nivåer:

  1. Verktygen finns inte. Claude ser dem inte och kan inte anropa dem.

  2. Behörigheten begärs inte. Inloggningen ber bara Microsoft om behörigheterna för de påslagna delarna. Med bara sharepoint innehåller inloggningen ingen rätt till mejlen alls, så Microsoft skulle vägra även om något gick fel i servern.

Slår du på en ny del senare får du logga in en gång till, för att godkänna den nya behörigheten. Ett felstavat namn stoppar servern med ett tydligt felmeddelande.

Granskningssida (valfri)

Vill du se exakt vad Claude får, kan servern visa en lokal webbsida med varje anrop sida vid sida: till vänster det tvättade som skickades till Claude (tokens i blått), till höger originalet med de tvättade delarna markerade (gult). För utkast syns även vad som skickas vidare till Microsoft efter att tokens bytts tillbaka.

Granskningssidan

Slå på den genom att lägga till -e M365_MCP_AUDIT=1 i claude mcp add. När Claude Code startar servern öppnas sidan automatiskt i webbläsaren.

Eftersom sidan visar riktiga personuppgifter är den skyddad:

  • Avstängd som standard. Ingenting registreras när den är av.

  • Bara din dator. Den lyssnar bara på 127.0.0.1 och avvisar andra adresser.

  • Hemlig länk. Adressen innehåller en slumpad nyckel som byts vid varje start. Länken skickas aldrig till Claude.

  • Inget på disk. De senaste 200 anropen finns bara i minnet och försvinner när servern stängs. Knappen Rensa tömmer dem direkt.

Sidan visar det som går via den här servern. Vill du se all trafik från Claude Code till Anthropic (det du skriver, filer Claude läser osv.) kan du köra Claude Code genom en lokal proxy som mitmproxy: sätt HTTPS_PROXY=http://127.0.0.1:8080 och NODE_EXTRA_CA_CERTS till mitmproxys certifikat innan du startar claude.

SharePoint-releaser

Servern kan lägga releaser som Claude Code byggt i en fast SharePoint-mapp, så att kollegor alltid hittar senaste versionen. Claude kan bara ladda upp till den konfigurerade mappen (och undermappar till den), aldrig någon annanstans.

Mappen ställs in med SHAREPOINT_SITE, SHAREPOINT_FOLDER och SHAREPOINT_UPLOAD_ROOTS (se Installera i Claude Code).

Exempel i Claude Code: "Bygg en release, zippa dist-mappen och ladda upp den till SharePoint i undermappen v1.4.0." Befintliga filer skrivs inte över om du inte ber om det. Filer över 4 MB laddas upp i delar, så stora releaser fungerar.

Konfiguration

Variabel

Beskrivning

M365_MCP_CLIENT_ID

Krävs. Client ID från app-registreringen

M365_MCP_TENANT_ID

Tenant-ID (standard organizations)

M365_MCP_CACHE_DIR

Var token-cachen sparas

M365_MCP_LOGIN_HINT

Ditt jobbmejl, förifyllt i inloggningsrutan

M365_MCP_AUTO_LOGIN

0 = öppna aldrig inloggning automatiskt, kräv login i förväg

M365_MCP_BROKER

0 = använd webbläsaren även där Windows/Mac-kontorutan finns

REDACT_ALLOWLIST / REDACT_ALLOWLIST_FILE

Termer som inte ska tvättas (företagsnamn, orter, produkter)

REDACT_NAMES / REDACT_NAMES_FILE

Extra namn som alltid ska tvättas (t.ex. kundregister-export), ett per rad

SHAREPOINT_SITE

Webbplats som värd:/sites/Namn, t.ex. matildafoodtech.sharepoint.com:/sites/Utveckling

SHAREPOINT_DRIVE

Dokumentbibliotekets namn (standard: webbplatsens standardbibliotek)

SHAREPOINT_FOLDER

Mappen releaser laddas upp till, t.ex. Releases/MinApp

SHAREPOINT_UPLOAD_ROOTS

Valfritt. Kommaseparerade lokala mappar som får laddas upp från – rekommenderas, så att Claude inte kan ladda upp andra filer

M365_MCP_FEATURES

Vilka delar som är påslagna: sharepoint (standard), mail, calendar, teams eller all (se ovan)

M365_MCP_TIMEZONE

Tidszon för kalendern, t.ex. Europe/Stockholm (standard: UTC)

M365_MCP_AUDIT

1 = starta granskningssidan (se ovan)

M365_MCP_AUDIT_PORT

Fast port för granskningssidan (standard: slumpad ledig port)

M365_MCP_AUDIT_OPEN

0 = öppna inte webbläsaren automatiskt; länken skrivs i serverns logg

REDACT_USE_NER

1 = aktivera spaCy-NER. Kräver pip install 'm365-mcp-gdpr[ner]' och python -m spacy download sv_core_news_sm

Utveckling

pip install -e '.[dev]'
pytest

Available Tools

12 tools
create_draftB

Skapa ett nytt utkast i Utkast-mappen. Skickas INTE.

Använd tokens (t.ex. [[EMAIL_1]], [[PERSON_2_FIRST]]) ordagrant – de ersätts med riktiga värden.

NameRequiredDescriptionDefault
ccNo
toNo
bodyYes
subjectYes

TDQS

B3.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It does disclose two non-obvious behaviors: nothing is sent, and tokens like [[EMAIL_1]] are substituted with real values. It omits permissions, which folder is used if ambiguous, and what (draft id?) is returned for chaining into update_draft.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with the creation statement and the not-sent warning front-loaded, then the token rule. No filler; the stray escaped newline is the only blemish.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a four-parameter mutation tool with no annotations and no output schema, the description should say what is returned (e.g. a draft identifier needed by update_draft or delete_draft) and clarify recipient formatting. Those gaps make it incomplete for correct chaining.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% for four parameters, so the description must compensate but largely doesn't: it never explains to vs cc, subject, or body, nor whether recipients are comma strings or arrays. Only the token-substitution rule for parameter values adds real meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Skapa ett nytt utkast') plus the target location ('Utkast-mappen'), and adds the key constraint that it is not sent. It doesn't name create_reply_draft or update_draft, so the boundary with the closest siblings is left to inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'Skickas INTE' clause implies this is for composing without sending, which is useful context, but it never says when to prefer create_reply_draft (for replies) or update_draft (for existing drafts). Usage is implied rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_reply_draftB

Skapa ett svarsutkast på ett befintligt meddelande. Skickas INTE.

NameRequiredDescriptionDefault
bodyYes
reply_allNo
message_idYes

TDQS

B3.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does add the crucial behavioral fact that nothing is sent ('Skickas INTE'). However it omits whether the draft appears in a Drafts folder, whether it requires auth, and how reply_all affects the output.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with no filler, and the non-sending nature of the operation is front-loaded for emphasis. Efficient, though the Swedish text is terse enough to border on underspecified.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

A mutation tool with no annotations, no output schema, and 0% parameter coverage needs substantially more from its description. As written, an agent knows it creates an unsent reply but not how reply_all behaves or what the draft result looks like.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and the description explains none of the three parameters. 'Befintligt meddelande' vaguely implies message_id, but body and especially reply_all are left completely unexplained, so the description fails to compensate for the schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Skapa ett svarsutkast') scoped to 'ett befintligt meddelande', which distinguishes it from the sibling create_draft. It stops short of describing what the resulting draft contains or where it lives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'på ett befintligt meddelande' implies this is for replying to an existing message rather than composing new mail, but it never explicitly contrasts itself with create_draft or update_draft. Usage is implied rather than guided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

delete_draftA

Radera ett utkast. Fungerar bara på utkast, aldrig på mottagna mejl.

NameRequiredDescriptionDefault
draft_idYes

Output Schema

NameRequiredDescription
resultYes

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It discloses the scope precondition, but says nothing about irreversibility, whether confirmation is required, permission needs, or what happens to the draft's content after deletion — significant gaps for a destructive operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, the action first and the scope constraint second, with zero filler. Nothing could be removed without losing meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and the scope constraint is covered. However, for a destructive single-parameter tool with no annotations and no documented parameter, the omission of irreversibility and draft_id semantics leaves it only minimally sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter draft_id has 0% schema description coverage and is never mentioned in the description, so nothing explains its format, where to obtain it, or whether it accepts an ID from list_messages or create_draft. The description does not compensate for the coverage gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

"Radera ett utkast" gives a specific verb (delete) plus resource (draft), and the second sentence narrows scope to drafts and explicitly excludes received emails, which separates it from message-level siblings like move_message or read_message. It stops short of naming the sibling to use instead, so it is clear but not fully differentiated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states a clear applicability condition (only drafts) and an explicit exclusion (never received emails), which is real when/when-not guidance. It does not point to update_draft or create_draft as the alternative path when the target is not a draft, so routing is only partly complete.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

flag_messageC

Flagga eller avflagga ett meddelande för uppföljning.

NameRequiredDescriptionDefault
flaggedNo
message_idYes

Output Schema

NameRequiredDescription
resultYes

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It implies a toggle mutation but says nothing about permissions, idempotency, or what happens when 'flagged' is omitted and defaults to true. For a mutation tool with zero annotation coverage this is a significant gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single compact sentence with zero waste. It is appropriately sized, though being a single clause it front-loads nothing beyond the verb and resource.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Although an output schema exists and needn't be re-explained, a mutation tool with no annotations and 0% parameter coverage needs more: default-value behavior and permission/scope context are missing, leaving the agent under-informed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It conveys that 'flagged' toggles state, but does not explain that the boolean defaults to true (i.e., omission means flag, not unflag) nor what message_id accepts.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb pair (flag/unflag) and resource (meddelande/message) with the purpose 'för uppföljning' (for follow-up). It is clearly distinguishable from siblings like mark_read or move_message, though it doesn't explicitly name alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this versus mark_read or set_categories, nor any prerequisites or exclusions. The phrase 'för uppföljning' hints at intent but stops short of telling the agent when to select this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_foldersA

Lista mappar i brevlådan med antal (olästa) meddelanden.

NameRequiredDescriptionDefault

No parameters

Output Schema

NameRequiredDescription
resultYes

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral burden. It usefully discloses that results include unread-message counts, but it does not state permission requirements, ordering, or that the operation is read-only, leaving meaningful gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single efficient sentence that front-loads the operation and resource. Every part of the sentence adds useful meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained in detail, and the description states the folder list plus unread counts. It is adequate for a simple no-parameter tool, though a brief read-only or permissions note would improve completeness given the absence of annotations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so baseline is 4. The description adds no parameter information because there are none to explain.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb, "Lista", and resource, "mappar", and adds a useful detail: counts of unread messages. It does not explicitly distinguish itself from message-oriented siblings such as list_messages or search_messages, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides no explicit when-to-use or when-not guidance and does not point to alternative tools for message retrieval. A reader can infer it is for folder-level listing, but the description supplies no routing rules.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_messagesC

Lista meddelanden i en mapp, nyast först.

folder: mapp-id eller välkänt namn (inbox, drafts, sentitems, archive, deleteditems, junkemail).

NameRequiredDescriptionDefault
topNo
skipNo
folderNoinbox
unread_onlyNo

Output Schema

NameRequiredDescription
resultYes

TDQS

C2.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It does disclose one genuine behavioral trait beyond structured data — results are ordered newest-first — but says nothing about pagination behavior, permissions, or how many messages a page contains despite top/skip existing.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short lines with the purpose front-loaded and no filler. The terseness is a symptom of missing content rather than of padding, so conciseness itself is not the problem.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation, but for a paginated list tool with zero annotation coverage and 0% parameter documentation, the missing top/skip/unread_only semantics are a real gap. An agent cannot tell how to page through a large mailbox.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for four parameters and only addresses one. The folder guidance is genuinely valuable, listing well-known names (inbox, drafts, sentitems, archive, deleteditems, junkemail) that are absent from the schema, but top, skip, and unread_only remain entirely undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("Lista meddelanden i en mapp") plus a meaningful ordering guarantee ("nyast först"). It does not differentiate itself from the sibling search_messages, so an agent must infer that this is a plain folder listing rather than a query tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no statement of when to use this versus search_messages (for filtered/query retrieval) or read_message (for content). The only guidance is implicit in the phrase "i en mapp", leaving the agent to guess at the alternative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mark_readC

Markera ett meddelande som läst eller oläst.

NameRequiredDescriptionDefault
is_readNo
message_idYes

Output Schema

NameRequiredDescription
resultYes

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full disclosure burden. It implies a mutation of read state but says nothing about idempotency, whether marking unread resets anything, permission requirements, or whether the change is synced to the server.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One short, front-loaded sentence with no filler. Its brevity is appropriate for the surface area, though the space saved is spent on nothing useful for the agent.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists so return values need not be explained, but for a two-parameter mutation tool with zero metadata coverage the description is too thin. It should at minimum explain the `is_read` toggle and default behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, yet the description explains neither parameter. Critically, `is_read` defaults to true, meaning omitting it marks a message read — a behavior the description's 'read or unread' phrasing leaves ambiguous rather than clarifying.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Markera ett meddelande') plus the target state (read or unread), which is distinct from read_message (fetch content) and flag_message. It does not explicitly differentiate itself from those siblings, and the description is in Swedish while the tool names are English, which adds a small parsing burden.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this versus read_message or flag_message, nor any precondition such as needing the message to already exist or be in a given folder. The agent must infer usage entirely from the name and schema.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

move_messageB

Flytta ett meddelande. destination: mapp-id eller välkänt namn (archive, deleteditems, inbox …).

NameRequiredDescriptionDefault
message_idYes
destinationYes

TDQS

B3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full disclosure burden, and it says almost nothing beyond "move". It omits permissions required, whether the destination folder must pre-exist, whether the message keeps its id, and what errors occur — all material for a mutation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with the action stated first and the non-obvious parameter hint second; no filler. The brevity is close to under-specification rather than padding, so it is efficient but slightly thin.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no annotations, no output schema, and 0% schema description coverage, the description should carry more: destination format details, failure behavior, and the effect on the source folder are all missing. Also, the description is in Swedish while the tool name and sibling tools are English, which is an avoidable inconsistency for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and the schema only labels the fields "Message Id" and "Destination", so the description's clarification that destination accepts a folder id OR a well-known name (archive, deleteditems, inbox …) adds genuinely necessary semantics. message_id is left unexplained, but its meaning is self-evident.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

"Flytta ett meddelande" states a specific verb (move) plus resource (message), which is clearly distinguishable from siblings like list_messages, read_message or delete_draft. It does not explicitly name a contrasting sibling (e.g. a copy operation), so it stops short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no indication of when to use this tool versus alternatives, no prerequisites (must the message exist, must the destination exist), and no note on what happens to the source message. Usage is only inferable from the tool name itself.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

read_messageB

Läs ett helt meddelande (pseudonymiserat). Bilagornas innehåll hämtas inte.

NameRequiredDescriptionDefault
message_idYes

TDQS

B3.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does disclose two real behaviors: content is pseudonymized and attachment bodies are not fetched. It omits other consequential behavior — whether reading marks the message as read (a separate mark_read sibling exists, implying it does not), permissions, and error behavior when the id is invalid.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, no filler, and the scoping limitation is stated up front as a caveat. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter read tool with no output schema, the description covers the essential caveats (pseudonymization, no attachments) but leaves return shape and the meaning of message_id unexplained. Adequate but with clear gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% for the single parameter, so the description must compensate and does not: message_id is never mentioned or illustrated (format, source of the id from list_messages/search_messages results). The only implicit signal is that the tool takes an id at all.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Läs ett helt meddelande'), and the qualifier 'helt' vs the list/search siblings implies full-body retrieval. It does not explicitly contrast itself with list_messages or search_messages, so differentiation is inferred rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this versus search_messages or list_messages, and no prerequisites (e.g. whether the message must be in the inbox first). The 'helt meddelande' phrasing hints at a fetch-by-id use case, but nothing explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_messagesB

Fritextsök i hela brevlådan. Tokens som [[PERSON_1]] får användas i söksträngen.

NameRequiredDescriptionDefault
topNo
queryYes

Output Schema

NameRequiredDescription
resultYes

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does disclose one genuinely useful behavior: placeholder tokens like [[PERSON_1]] may appear in the query string. It says nothing about result ordering, pagination via 'top', permissions, or scope limits beyond 'whole mailbox'.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with no filler, and the core purpose is front-loaded before the token-syntax detail. Nothing redundant, though the second sentence could be slightly more explicit about where tokens are allowed.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described. For a two-parameter search tool the description covers purpose and the non-obvious query syntax; the remaining gap is the undocumented 'top' parameter and any pagination behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for both parameters. It clarifies that 'query' is a free-text search string supporting placeholder tokens, but leaves 'top' (default 20, clearly a result-count limit) completely unexplained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Fritextsök i hela brevlådan') and scopes it to the entire mailbox, which distinguishes it from folder-scoped siblings like list_messages/list_folders. It stops short of explicitly naming an alternative, so differentiation is implied rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit when-to-use or when-not-to-use guidance. The phrase 'hela brevlådan' implicitly tells an agent this is a global search rather than a folder listing, but nothing says when to prefer search_messages over list_messages or read_message.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

set_categoriesB

Sätt Outlook-kategorier på ett meddelande (ersätter befintliga).

NameRequiredDescriptionDefault
categoriesYes
message_idYes

Output Schema

NameRequiredDescription
resultYes

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It does disclose the single most important trait — existing categories are replaced (destructive overwrite) — which is genuinely valuable and not inferable from any structured field. It says nothing about error behavior for unknown message IDs, whether unknown category names are silently accepted, or permission requirements.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One short sentence, no filler, with the consequential detail (replacement of existing values) placed immediately after the action so it is read before invocation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and the destructive semantics are covered. What is missing is the 0%-covered parameter semantics — chiefly whether category names must already exist — which matters for calling this correctly, though the core risk is disclosed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and neither parameter is documented. The description implies the two arguments (message, categories) but adds nothing on message_id format, whether categories are free-form strings or must match pre-existing Outlook master categories, or what an empty array means (clearing all categories).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: set Outlook categories on a message. That is clearly distinct from the mutation siblings (move_message, flag_message, mark_read), none of which touch categories. It stops short of naming sibling alternatives, and the description is in Swedish while the tool name and sibling set are English, which adds a small comprehension cost.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No statement of when to use this versus mark_read/flag_message/move_message for organizing mail, and no prerequisites such as categories needing to exist in the mailbox's master category list. The parenthetical '(ersätter befintliga)' is a behavioral warning rather than usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

update_draftB

Uppdatera ett befintligt utkast. Fält som utelämnas lämnas orörda.

NameRequiredDescriptionDefault
ccNo
toNo
bodyNo
subjectNo
draft_idYes

Output Schema

NameRequiredDescription
resultYes

TDQS

B3.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations at all, the description carries the full burden. It does disclose one genuinely useful behavior — omitted fields are left untouched — but says nothing about permissions, failure modes, or how an explicitly passed null differs from an omitted field, which matters because every field is nullable with a null default.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the operation and followed by the key semantic rule; nothing is redundant. Given the documentation vacuum elsewhere, the terseness is economical rather than padded, though a sentence could be repurposed to real effect.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a five-parameter mutation tool with no annotations and no schema descriptions, the definition is too thin: parameter meanings, null-vs-omitted semantics, and error conditions are all missing. An output schema exists, so return values need not be explained, but that does not offset the input-side gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across five parameters, so the description must compensate and it does not: it names none of draft_id, to, cc, subject, body, nor explains expected formats (arrays of addresses). The generic 'omitted fields' sentence adds a little meaning but leaves every parameter undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Uppdatera ett befintligt utkast') and adds the partial-update rule. It is clearly distinguishable from create_draft/delete_draft by name, but it never explicitly contrasts itself with those siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: you update a draft that already exists, so create_draft/create_reply_draft are the alternatives for new content. There is no explicit when-to-use, no prerequisites (does the draft_id have to exist / be owned by the caller?), and no exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 12 tool updatesv0.1.0
    • First observedcreate_draft
    • First observedcreate_reply_draft
    • First observeddelete_draft
    • First observedflag_message
    • First observedlist_folders
    • First observedlist_messages
    • First observedmark_read
    • First observedmove_message
    • First observedread_message
    • First observedsearch_messages
    • First observedset_categories
    • First observedupdate_draft

TDQS

A3.5/5.0

Scored across 12 tools

Disambiguation5/5

Each tool targets a distinct action or resource: folder listing, message listing/searching/reading, status changes, moving, categorizing, and draft lifecycle. Overlaps such as list_messages vs. search_messages are clearly differentiated by scope, and draft creation vs. reply-draft creation is explicit.

Naming Consistency5/5

All tool names use consistent snake_case with a predictable verb_noun pattern (list_folders, read_message, create_draft, update_draft, delete_draft). Minor variations like mark_read and create_reply_draft remain readable and follow the same convention.

Tool Count5/5

Twelve tools are well-scoped for an Outlook/GDPR email client, covering reading, organizing, and draft management without excessive fragmentation. Each tool appears to earn its place.

Completeness4/5

The surface covers core mailbox reading, search, organization, flagging, categorization, and draft create/reply/update/delete workflows. Gaps include sending messages, deleting received messages, and attachment content access, though some omissions may be intentional under GDPR constraints.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    Connects Claude to Microsoft 365 Outlook and Google Gmail APIs for email search, invoice detection, attachment handling, folder/label management, and draft creation. Uses Anthropic OAuth for secure authentication.
    21 npm
    ISC
  • F
    license
    Not graded
    quality
    B
    maintenance
    Enables Claude to read, search, draft, send, flag, and move email across multiple IMAP/SMTP mailboxes while keeping credentials local.
    -