Skip to main content
Glama
PhamHoang16

outlook-bridge

by PhamHoang16

outlook-bridge

Claude가 Outlook 클래식(Windows, COM 경유)에서 메일을 검색하고 읽을 수 있게 해주는 MCP 서버 — list_folders, search_mail, read_mail, get_thread, read_attachment. 전체 설계는 docs/superpowers/specs/2026-08-24-outlook-bridge-design.md에서, 구현 계획은 docs/superpowers/plans/2026-08-24-outlook-bridge-a.md에서 확인할 수 있습니다.

읽기 전용 — 쓰기 도구 없음

이 서버에는 send_mail, delete_mail, move_mail, mark_as_read 또는 메일을 수정/삭제/전송하는 어떤 도구도 없습니다. Win32MailStore의 어떤 메서드도 .Send(), .Save(), .Delete(), .Move(), .MarkAsRead()를 호출하거나 Outlook 속성에 값을 할당하지 않습니다. 유일한 예외: read_attachment는 텍스트를 추출하기 위해 서버가 직접 생성한 임시 디렉터리(tempfile.TemporaryDirectory)에 첨부 파일을 기록한 후, 해당 디렉터리를 즉시 삭제합니다 — SaveAsFile은 읽기 API이며 Outlook 내부의 어떤 것도 수정하지 않습니다.

Related MCP server: outlook-mcp

Linux(개발 머신)에서 실행 — FakeMailStore

Outlook도 Windows도 필요 없습니다. FakeMailStore는 YAML 픽스처(합성 메일 약 50통: 여러 폴더, 여러 스토어, 대화 스레드, 다양한 유형의 첨부 파일, 베트남어 메일, 긴 본문 메일, 빈 메일, 메일이 아닌 항목)를 로드하고 Win32MailStore가 구현하는 것과 동일한 MailStore 인터페이스를 구현합니다.

python -m venv .venv
.venv/bin/pip install -e ".[dev]"

# Chạy server với store giả (không cần Outlook)
OUTLOOK_BRIDGE_FAKE=1 OUTLOOK_BRIDGE_FIXTURE=tests/fixtures/mailbox.yaml \
  .venv/bin/python server.py

테스트 실행

Linux(대부분의 로직 — 순수 Python + FakeMailStore):

.venv/bin/pytest

Windows(두 스토어에 공통으로 사용되는 계약 테스트 세트 — 이것이 Win32MailStore가 실제로 FakeMailStore와 동작이 일치함을 증명하는 유일한 방법이며, 단지 "실행된다"는 것만 증명하는 것이 아닙니다):

set OUTLOOK_BRIDGE_CONTRACT_WIN32=1
.venv\Scripts\pytest tests/contract -v

이 세트의 일부 케이스는 실제 사서함에서 의도적으로 SKIP됩니다(데이터가 FakeMailStore의 픽스처에만 존재함) — SKIP을 문제의 신호로 간주하기 전에 docs/WINDOWS-RUNBOOK.md의 "의도적 SKIP 테스트" 섹션을 참조하세요.

Windows에서 MCP 서버를 설치하고 등록하려면 docs/INSTALL-windows.md를, 실제 Windows 머신 앞에 처음 앉았을 때 수행할 작업 순서는 docs/WINDOWS-RUNBOOK.md를 참조하세요.

환경 진단 — doctor.py

python doctor.py            # trên Linux: báo "không phải Windows", degrade an toàn
python doctor.py --verbose  # trên Windows: thêm chi tiết root.Name, cây folder, giá trị raw

결과

의미

조치

com_ok: True, inbox_count 숫자 출력

COM 경로 정상

MCP 서버 등록 준비 완료

com_ok: False + New Outlook / GPO 언급

해당 머신에서는 이 아키텍처를 사용할 수 없음

중단 — 대체 방안 없음(아래 R2 위험)

com_ok: True, index_ok: False

여전히 사용 가능하지만, 본문 내용 검색은 순차 탐색으로 자동 폴백됨(더 느리고, 결과에 경고가 표시됨)

정상적으로 사용

아직 아무도 해결하지 못한 두 가지 위험(spec §13)

R2 — New Outlook이 점차 Outlook 클래식을 대체하고 COM도 함께 사라집니다. Microsoft는 사용자를 COM 서버를 등록하지 않는 New Outlook으로 강제 마이그레이션하고 있습니다(doctor.py가 이 경우 com_ok: False를 보고합니다). 이것은 수명이 제한된 것이지, 패치할 수 있는 버그가 아닙니다. 발생 시 유일한 탈출구는 Microsoft Graph API 기반으로 Win32MailStore를 다시 작성하는 것입니다 — 프로젝트의 아키텍처(모든 COM 세부 사항이 정확히 두 파일, win32_store.py와 doctor.py에만 있음)는 피해를 정확히 그 두 파일의 재작성으로 제한하며, 전체 시스템을 다시 작성할 필요는 없습니다.

R3 — 회사 내부 메일 내용이 Anthropic의 API를 통과합니다. COM은 완전히 로컬에서 실행되지만(메일을 읽기 위해 어떤 것도 머신을 떠나지 않음), Claude가 메일 내용을 기반으로 답변하려면 해당 내용을 API로 보내야 합니다. 이것은 AI 어시스턴트를 사용하여 메일을 읽는 것의 본질적인 트레이드오프입니다 — 어떤 서버도 이를 대신 해결해 주지 않습니다.

유일한 통제 수단: config.toml의 folder_allowlist. 이를 특정 폴더 목록(store-qualified, 예: "Mailbox - Nguyen Van A/Inbox")으로 설정하면 이 서버가 볼 수 있는 메일 범위가 제한됩니다 — allowlist 밖의 메일은 어떤 도구로도, 어떤 호출 경로로도(검색, ID로 읽기, 스레드 읽기, 첨부 파일 다운로드) 읽을 수 없으며, 대화 스레드가 allowlist 경계를 넘는 경우에도 마찬가지입니다.

일치는 정확히 일치(PREFIX 아님)입니다. "Inbox"를 허용해도 "Inbox/Bao cao"는 허용되지 않습니다 — 허용하려는 각 폴더는 개별적으로 나열해야 합니다. 이것은 제한이 아니라 의도적인 설계 선택입니다: 접두사 기반 allowlist는 구성자가 생각하지 못한 민감한 하위 폴더를 실수로 통과시키기 쉽습니다. folder_allowlist를 구성하지 않으면(기본값, 빈 목록) 사서함의 모든 폴더를 읽을 수 있습니다 — 이 서버를 실제 회사 사서함에 연결하기 전에 구성하세요. list_folders에서 정확한 store-qualified 폴더 이름을 얻는 방법은 docs/WINDOWS-RUNBOOK.md 2단계를 참조하세요.

더 강하게 제한해야 한다면: folder_allowlist를 몇 개의 특정 폴더로 좁히거나, 그래도 부족하다면 전체 메일 내용 대신 메타데이터 + 스니펫만 반환하는 방안을 고려하세요(현재 이 작업을 수행하는 도구는 없으며, 새 도구가 필요합니다).

Available Tools

5 tools
get_threadA

Lấy toàn bộ mail trong cùng luồng hội thoại, sắp từ cũ tới mới.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
mail_idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral burden. It usefully discloses the sorting order (old to new) and the scope ('all emails in the thread'). However, it does not explain how the 'limit' parameter interacts with 'toàn bộ' (all), nor does it mention pagination, auth, or response shape.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single focused sentence with no filler. It front-loads the primary action and scope, and the sorting detail adds useful information without bloating the text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a relatively simple two-parameter tool with an output schema, so the description does not need to detail return values. Still, the meaning of 'limit', the potential conflict with 'all', and the absence of any usage boundaries leave a few gaps that an agent would have to infer.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description needs to clarify parameters, but it never mentions mail_id or limit. The phrase 'same conversation thread' indirectly implies the role of mail_id, but no direct mapping or additional meaning is provided for either parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('get') and a well-defined resource ('all emails in the same conversation thread'), and clarifies the ordering (old to new). This distinguishes it from siblings like read_mail, which targets a single message, and search_mail, which searches across mail.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the use case: you call this when you need the full thread associated with a mail, rather than one individual message. However, it does not explicitly name alternatives or say when not to use it, so the guidance remains implicit rather than prescriptive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_foldersA

Liệt kê cây folder của Outlook kèm số item và số mail chưa đọc.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral disclosure burden. It does disclose meaningful return context by saying the folder tree includes item counts and unread mail counts. It does not explicitly state read-only behavior or access prerequisites, but for a parameterless list operation this is a moderate rather than severe gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, tight sentence with the action and resource up front, followed by the two useful counts. There is no filler or repetition of the tool name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameterless listing tool with an output schema, the description covers the essential behavior: it returns the Outlook folder tree with item and unread counts. It is slightly incomplete in not stating the scope of the tree (e.g., all folders vs. accessible folders) or any access caveats, but the output schema likely fills in return details.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero parameters, so the baseline is 4. There are no parameter semantics to explain, and the description appropriately focuses on what the tool returns rather than input details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource: listing the Outlook folder tree, and additionally specifies the included data (item count and unread mail count). This clearly separates it from siblings like read_mail, search_mail, get_thread, and read_attachment, which all operate on individual messages rather than the folder hierarchy.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies use when an agent needs an overview of Outlook folders and their counts, and the sibling tools are clearly message-oriented, so the intended context is reasonably inferable. However, it does not explicitly state when to use this tool versus alternatives or provide any exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

read_attachmentA

Trích text từ một tệp đính kèm. ref là tên tệp hoặc chỉ số từ read_mail. Hỗ trợ txt/csv/md/json/xml/pdf/xlsx/docx.

ParametersJSON Schema
NameRequiredDescriptionDefault
refYes
mail_idYes
max_charsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the behavioral burden. It states that the tool extracts text and supports specific formats, which is useful. However, it does not mention truncation via max_chars or behavior for unsupported attachment types, leaving some important behavioral gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded with the core action, followed by ref semantics and supported formats. Every sentence adds useful information with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a simple tool with an output schema, and the description covers the core purpose, ref semantics, and supported formats. It is adequate, but missing clarification about mail_id provenance and max_chars behavior leaves room for agent misinterpretation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It usefully explains `ref` as a filename or index from read_mail. However, `mail_id` and `max_chars` are not described at all; their meanings are only inferable from the parameter names and default value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: 'Trích text từ một tệp đính kèm' (extract text from an attachment). This clearly differentiates it from sibling tools like read_mail, get_thread, list_folders, and search_mail, none of which target attachments.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear workflow context by stating that `ref` is a filename or index from read_mail, which tells the agent how the tool relates to a sibling. It does not explicitly list when not to use it, but the attachment-specific purpose makes the appropriate use case clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

read_mailA

Đọc nội dung đầy đủ của 1-10 mail theo handle từ search_mail. Liệt kê tên tệp đính kèm nhưng KHÔNG đọc nội dung tệp — dùng read_attachment cho việc đó.

ParametersJSON Schema
NameRequiredDescriptionDefault
idsYes
max_body_charsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral disclosure burden. It transparently states the operation, the 1-10 email limit, and the boundary that attachment filenames are listed but file contents are not read. However, it omits the effect of max_body_chars on body truncation, which is relevant given the claim of reading 'full' content.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the core purpose, followed by a critical negative behavior and the correct alternative. Every sentence earns its place and there is no fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has an output schema, so return values need not be described. The description covers the operation, input source, count limit, and attachment-handling boundary. The main gap is the undocumented behavior of max_body_chars, but the overall context is sufficient for safe invocation in most cases.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It usefully clarifies that ids are handles from search_mail and that 1-10 emails are supported, but it says nothing about max_body_chars, its default, or its truncation behavior. The description partially compensates for the missing schema descriptions but not fully.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb ('Đọc nội dung đầy đủ'), a precise resource (1-10 emails), and a clear source for those emails ('theo handle từ search_mail'). It also distinguishes itself from read_attachment by stating that it only lists attachment names and does not read file contents.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly states when to use the tool — after search_mail, to read full email content — and explicitly directs the agent to read_attachment for attachment contents. It does not contrast against get_thread or list_folders, so the guidance is strong but not exhaustive across all siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_mailA

Tìm mail. Trả danh sách gọn kèm handle (h1, h2...) để dùng cho read_mail. query tìm trong nội dung mail; folder="*" tìm mọi folder. Ngày theo định dạng YYYY-MM-DD.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
queryNo
sinceNo
untilNo
folderNo
offsetNo
senderNo
subjectNo
unread_onlyNo
flagged_onlyNo
has_attachmentsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the disclosure burden. It reveals the compact list output, handle semantics, query scope, folder wildcard, and date format. However, it does not mention matching behavior, sorting, pagination semantics, or side-effect/safety profile; the disclosure is useful but partial.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short, purposeful sentences. The main purpose is front-loaded, the output/handle chain is stated next, and the parameter/date notes are dense but non-redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description gives enough to start using the tool: output shape, handle purpose, folder wildcard, and date format. But with 11 parameters and no annotations, important semantics (limit/offset, sender/subject matching, boolean filters) are left to inference; the tool is functional but not fully specified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 11 parameters, so the description must compensate. It adds meaning for query, folder (including '*' wildcard), and since/until date format, but leaves sender, subject, unread_only, flagged_only, has_attachments, limit, and offset without behavioral clarification beyond their names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with 'Tìm mail' (search mail), then states the output ('danh sách gọn kèm handle') and the downstream use (read_mail). This is a specific verb-plus-resource statement that clearly separates search_mail from siblings like read_mail, get_thread, and list_folders.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives concrete usage cues: query searches mail content, folder='*' searches all folders, dates use YYYY-MM-DD, and returned handles feed read_mail. It stops short of naming when not to use search_mail or explicitly comparing alternatives, so it is not a full 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 5 tool updatesv0.1.0
    • First observedget_thread
    • First observedlist_folders
    • First observedread_attachment
    • First observedread_mail
    • First observedsearch_mail

TDQS

A4.2/5.0

Scored across 5 tools

Disambiguation5/5

Each tool targets a distinct aspect: thread retrieval, attachment extraction, individual mail reading, folder listing, and search. No two tools overlap in purpose, and the descriptions clarify the boundaries (e.g., read_mail vs get_thread).

Naming Consistency5/5

All tool names follow a consistent verb_noun pattern in snake_case: get_thread, read_attachment, read_mail, list_folders, search_mail. The verbs are specific and predictable.

Tool Count5/5

Five tools is well-scoped for an email read/search bridge. Each tool serves a clear, non-redundant function in the core workflow of finding and reading emails with attachments.

Completeness5/5

The tool surface covers the full read/search lifecycle: search returns handles, read_mail consumes them, get_thread expands conversations, list_folders scopes searches, and read_attachment handles file content. No obvious missing operations for the apparent read-only purpose.

Maintenance

ActivitySlowing
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables AI assistants to manage Microsoft Outlook emails, calendar events, contacts, and folders via COM automation.
    1
    MIT
  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables AI assistants to read, send, and manage Outlook mail locally on Windows via COM/MAPI, without cloud APIs.
    133 npm
    1
    MIT
  • F
    license
    Not graded
    quality
    C
    maintenance
    Reads and searches your local Microsoft Outlook desktop mailbox via COM, supporting folder listing, message/thread retrieval, attachment saving, bulk export, and draft creation without sending, requiring no OAuth or admin consent.
    -