outlook-bridge
outlook-bridge
Claude が Outlook classic(Windows、COM 経由)でメールを検索・閲覧するための MCP サーバー — list_folders、search_mail、read_mail、get_thread、read_attachment。完全な設計は docs/superpowers/specs/2026-08-24-outlook-bridge-design.md、実装計画は docs/superpowers/plans/2026-08-24-outlook-bridge-a.md を参照。
読み取り専用 — 書き込みツールなし
このサーバーには send_mail、delete_mail、move_mail、mark_as_read や、メールを変更・削除・送信するツールは一切ありません。Win32MailStore 内のどのメソッドも .Send()、.Save()、.Delete()、.Move()、.MarkAsRead() を呼び出したり、Outlook のプロパティに値を代入したりしません。唯一の例外: read_attachment は、テキスト抽出のために添付ファイルをサーバー自身が作成した一時ディレクトリ(tempfile.TemporaryDirectory)に書き出し、その後すぐにそのディレクトリを削除します — SaveAsFile は読み取り API であり、Outlook 内の何も変更しません。
Related MCP server: outlook-mcp
Linux(開発機)での実行 — FakeMailStore
Outlook も Windows も不要です。FakeMailStore は YAML フィクスチャ(約50通の合成メール: 複数フォルダ、複数ストア、会話スレッド、各種添付ファイル、ベトナム語メール、長文ボディ、空メール、メール以外のアイテム)を読み込み、Win32MailStore と同じ MailStore インターフェースを実装します。
python -m venv .venv
.venv/bin/pip install -e ".[dev]"
# Chạy server với store giả (không cần Outlook)
OUTLOOK_BRIDGE_FAKE=1 OUTLOOK_BRIDGE_FIXTURE=tests/fixtures/mailbox.yaml \
.venv/bin/python server.pyテストの実行
Linux(ロジックの大部分 — 純粋な Python + FakeMailStore):
.venv/bin/pytestWindows(両ストアに共通のコントラクトテストスイート — これが Win32MailStore が実際に FakeMailStore と動作を一致させていることを証明する唯一の方法であり、「動く」だけではありません):
set OUTLOOK_BRIDGE_CONTRACT_WIN32=1
.venv\Scripts\pytest tests/contract -vこのスイートの一部のケースは、実際のメールボックスでは意図的に SKIP されます(データは FakeMailStore のフィクスチャにのみ存在)— SKIP を問題の兆候と見なす前に、docs/WINDOWS-RUNBOOK.md の「意図的な SKIP テスト」セクションを参照してください。
Windows でのインストールと MCP サーバーの登録は docs/INSTALL-windows.md、実際の Windows マシンで初めて作業する際の手順は docs/WINDOWS-RUNBOOK.md を参照してください。
環境診断 — doctor.py
python doctor.py # trên Linux: báo "không phải Windows", degrade an toàn
python doctor.py --verbose # trên Windows: thêm chi tiết root.Name, cây folder, giá trị raw結果 | 意味 | 対応 |
| COM パスは正常 | MCP サーバー登録の準備完了 |
| このアーキテクチャはそのマシンでは使用不可 | 停止 — 代替手段なし(下記リスク R2) |
| 使用は可能だが、本文検索は逐次走査にフォールバックする(遅い、結果に警告あり) | 通常どおり使用 |
誰も解決できていない2つのリスク(仕様 §13)
R2 — New Outlook が徐々に Outlook classic を置き換え、COM も消えていく。
Microsoft はユーザーを New Outlook へ強制移行しており、New Outlook は COM サーバーを登録しません(これが発生すると doctor.py は com_ok: False を報告します)。これは賞味期限付きのものであり、修正可能なバグではありません。発生した場合の唯一の脱出経路は、Microsoft Graph API ベースで Win32MailStore を書き直すことです — プロジェクトのアーキテクチャ(COM の詳細はすべて win32_store.py と doctor.py のちょうど2ファイルにのみ存在)により、被害はその2ファイルの書き直しに限定され、システム全体には及びません。
R3 — 社内メールの内容が Anthropic の API を経由する。 COM は完全にローカルで動作します(メールを読むためにマシンから何も出ません)が、Claude がメールの内容に基づいて回答するには、その内容を API に送信する必要があります。これは AI アシスタントでメールを読むことの本質的なトレードオフであり、どのサーバーも代わりに解決してはくれません。
唯一の制御手段: config.toml の folder_allowlist。これを特定のフォルダリスト(ストア修飾、例: "Mailbox - Nguyen Van A/Inbox")に設定すると、このサーバーが見えるメールの範囲を制限できます — 許可リスト外のメールは、どのツールからも、どの呼び出し経路でも(検索、ID による読み取り、スレッド読み取り、添付ファイルのダウンロード)、会話スレッドが許可リストの境界をまたぐ場合でも読み取られません。
一致は完全一致であり、プレフィックス一致ではありません。 "Inbox" を許可しても "Inbox/Bao cao" は許可されません — 許可する各フォルダは個別にリストする必要があります。これは意図的な設計選択であり、制限ではありません。プレフィックスベースの許可リストは、設定者が想定していない機密のサブフォルダを誤って許可してしまう可能性が高いからです。folder_allowlist を設定しない場合(デフォルト、空リスト)、メールボックス内のすべてのフォルダが読み取り可能になります — このサーバーを実際の企業メールボックスに向ける前に設定してください。list_folders からストア修飾フォルダ名を取得する方法は、docs/WINDOWS-RUNBOOK.md のステップ2を参照してください。
さらに厳しくする必要がある場合: folder_allowlist を特定の数フォルダに絞り込むか、それでも不十分な場合は、メールの全内容ではなくメタデータとスニペットのみを返すことを検討してください(現在この機能を持つツールはありません。新しいツールが必要になります)。
Available Tools
5 toolsget_threadA
Lấy toàn bộ mail trong cùng luồng hội thoại, sắp từ cũ tới mới.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| mail_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral burden. It usefully discloses the sorting order (old to new) and the scope ('all emails in the thread'). However, it does not explain how the 'limit' parameter interacts with 'toàn bộ' (all), nor does it mention pagination, auth, or response shape.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single focused sentence with no filler. It front-loads the primary action and scope, and the sorting detail adds useful information without bloating the text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a relatively simple two-parameter tool with an output schema, so the description does not need to detail return values. Still, the meaning of 'limit', the potential conflict with 'all', and the absence of any usage boundaries leave a few gaps that an agent would have to infer.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description needs to clarify parameters, but it never mentions mail_id or limit. The phrase 'same conversation thread' indirectly implies the role of mail_id, but no direct mapping or additional meaning is provided for either parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('get') and a well-defined resource ('all emails in the same conversation thread'), and clarifies the ordering (old to new). This distinguishes it from siblings like read_mail, which targets a single message, and search_mail, which searches across mail.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the use case: you call this when you need the full thread associated with a mail, rather than one individual message. However, it does not explicitly name alternatives or say when not to use it, so the guidance remains implicit rather than prescriptive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_foldersA
Liệt kê cây folder của Outlook kèm số item và số mail chưa đọc.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral disclosure burden. It does disclose meaningful return context by saying the folder tree includes item counts and unread mail counts. It does not explicitly state read-only behavior or access prerequisites, but for a parameterless list operation this is a moderate rather than severe gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, tight sentence with the action and resource up front, followed by the two useful counts. There is no filler or repetition of the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless listing tool with an output schema, the description covers the essential behavior: it returns the Outlook folder tree with item and unread counts. It is slightly incomplete in not stating the scope of the tree (e.g., all folders vs. accessible folders) or any access caveats, but the output schema likely fills in return details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters, so the baseline is 4. There are no parameter semantics to explain, and the description appropriately focuses on what the tool returns rather than input details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource: listing the Outlook folder tree, and additionally specifies the included data (item count and unread mail count). This clearly separates it from siblings like read_mail, search_mail, get_thread, and read_attachment, which all operate on individual messages rather than the folder hierarchy.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use when an agent needs an overview of Outlook folders and their counts, and the sibling tools are clearly message-oriented, so the intended context is reasonably inferable. However, it does not explicitly state when to use this tool versus alternatives or provide any exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_attachmentA
Trích text từ một tệp đính kèm. ref là tên tệp hoặc chỉ số từ read_mail.
Hỗ trợ txt/csv/md/json/xml/pdf/xlsx/docx.
| Name | Required | Description | Default |
|---|---|---|---|
| ref | Yes | ||
| mail_id | Yes | ||
| max_chars | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the behavioral burden. It states that the tool extracts text and supports specific formats, which is useful. However, it does not mention truncation via max_chars or behavior for unsupported attachment types, leaving some important behavioral gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded with the core action, followed by ref semantics and supported formats. Every sentence adds useful information with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a simple tool with an output schema, and the description covers the core purpose, ref semantics, and supported formats. It is adequate, but missing clarification about mail_id provenance and max_chars behavior leaves room for agent misinterpretation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It usefully explains `ref` as a filename or index from read_mail. However, `mail_id` and `max_chars` are not described at all; their meanings are only inferable from the parameter names and default value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'Trích text từ một tệp đính kèm' (extract text from an attachment). This clearly differentiates it from sibling tools like read_mail, get_thread, list_folders, and search_mail, none of which target attachments.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear workflow context by stating that `ref` is a filename or index from read_mail, which tells the agent how the tool relates to a sibling. It does not explicitly list when not to use it, but the attachment-specific purpose makes the appropriate use case clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_mailA
Đọc nội dung đầy đủ của 1-10 mail theo handle từ search_mail. Liệt kê tên tệp đính kèm nhưng KHÔNG đọc nội dung tệp — dùng read_attachment cho việc đó.
| Name | Required | Description | Default |
|---|---|---|---|
| ids | Yes | ||
| max_body_chars | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral disclosure burden. It transparently states the operation, the 1-10 email limit, and the boundary that attachment filenames are listed but file contents are not read. However, it omits the effect of max_body_chars on body truncation, which is relevant given the claim of reading 'full' content.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the core purpose, followed by a critical negative behavior and the correct alternative. Every sentence earns its place and there is no fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has an output schema, so return values need not be described. The description covers the operation, input source, count limit, and attachment-handling boundary. The main gap is the undocumented behavior of max_body_chars, but the overall context is sufficient for safe invocation in most cases.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It usefully clarifies that ids are handles from search_mail and that 1-10 emails are supported, but it says nothing about max_body_chars, its default, or its truncation behavior. The description partially compensates for the missing schema descriptions but not fully.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb ('Đọc nội dung đầy đủ'), a precise resource (1-10 emails), and a clear source for those emails ('theo handle từ search_mail'). It also distinguishes itself from read_attachment by stating that it only lists attachment names and does not read file contents.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly states when to use the tool — after search_mail, to read full email content — and explicitly directs the agent to read_attachment for attachment contents. It does not contrast against get_thread or list_folders, so the guidance is strong but not exhaustive across all siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_mailA
Tìm mail. Trả danh sách gọn kèm handle (h1, h2...) để dùng cho read_mail.
query tìm trong nội dung mail; folder="*" tìm mọi folder.
Ngày theo định dạng YYYY-MM-DD.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| query | No | ||
| since | No | ||
| until | No | ||
| folder | No | ||
| offset | No | ||
| sender | No | ||
| subject | No | ||
| unread_only | No | ||
| flagged_only | No | ||
| has_attachments | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the disclosure burden. It reveals the compact list output, handle semantics, query scope, folder wildcard, and date format. However, it does not mention matching behavior, sorting, pagination semantics, or side-effect/safety profile; the disclosure is useful but partial.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short, purposeful sentences. The main purpose is front-loaded, the output/handle chain is stated next, and the parameter/date notes are dense but non-redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description gives enough to start using the tool: output shape, handle purpose, folder wildcard, and date format. But with 11 parameters and no annotations, important semantics (limit/offset, sender/subject matching, boolean filters) are left to inference; the tool is functional but not fully specified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 11 parameters, so the description must compensate. It adds meaning for query, folder (including '*' wildcard), and since/until date format, but leaves sender, subject, unread_only, flagged_only, has_attachments, limit, and offset without behavioral clarification beyond their names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with 'Tìm mail' (search mail), then states the output ('danh sách gọn kèm handle') and the downstream use (read_mail). This is a specific verb-plus-resource statement that clearly separates search_mail from siblings like read_mail, get_thread, and list_folders.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives concrete usage cues: query searches mail content, folder='*' searches all folders, dates use YYYY-MM-DD, and returned handles feed read_mail. It stops short of naming when not to use search_mail or explicitly comparing alternatives, so it is not a full 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
v0.1.0- First observed
get_thread - First observed
list_folders - First observed
read_attachment - First observed
read_mail - First observed
search_mail
TDQS
Scored across 5 tools
Each tool targets a distinct aspect: thread retrieval, attachment extraction, individual mail reading, folder listing, and search. No two tools overlap in purpose, and the descriptions clarify the boundaries (e.g., read_mail vs get_thread).
All tool names follow a consistent verb_noun pattern in snake_case: get_thread, read_attachment, read_mail, list_folders, search_mail. The verbs are specific and predictable.
Five tools is well-scoped for an email read/search bridge. Each tool serves a clear, non-redundant function in the core workflow of finding and reading emails with attachments.
The tool surface covers the full read/search lifecycle: search returns handles, read_mail consumes them, get_thread expands conversations, list_folders scopes searches, and read_attachment handles file content. No obvious missing operations for the apparent read-only purpose.
Maintenance
Related MCP Connectors
Search Gmail and Outlook, save drafts, manage email rules, and view email stats.
Your own AI reads, searches and drafts in your mailbox, on your Windows computer.
Read, send, file and search email in any Gmail, Microsoft 365 or IMAP mailbox, plus its calendar.
Manage Microsoft 365 email, calendar, contacts and inbox rules via the Graph API with OAuth 2.0.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceEnables AI assistants to manage Microsoft Outlook emails, calendar events, contacts, and folders via COM automation.1MIT
- FlicenseAqualityDmaintenanceControls the Microsoft Outlook desktop app via COM automation, enabling email, calendar, and contact management without needing Graph API or Azure registration.14-
- AlicenseNot gradedqualityDmaintenanceEnables AI assistants to read, send, and manage Outlook mail locally on Windows via COM/MAPI, without cloud APIs.133 npm1MIT
- FlicenseNot gradedqualityCmaintenanceReads and searches your local Microsoft Outlook desktop mailbox via COM, supporting folder listing, message/thread retrieval, attachment saving, bulk export, and draft creation without sending, requiring no OAuth or admin consent.-