Skip to main content
Glama
proton-mcp

proton-mcp

by RndmJoker

Send a message

send_message
Destructive

Composes and sends an email through Proton Mail Bridge with To, Cc, and Bcc recipients, plain text or permitted HTML body, and user confirmation before sending.

Instructions

Composes a message and sends it. By default every send asks the user to confirm first, through the client, showing the sender, every recipient separated into To, Cc and Bcc, and the subject. It carries no part of the message itself and links to a page where the whole thing can be read as the recipient will see it, and a client that cannot show the question cannot send. The user can allow a tool to send without asking, within bounds they choose; the answer then says that it did. The body is plain text and markup is not interpreted. HTML written here is delivered as visible characters, so the recipient would read the tags rather than see formatting. Give a message its shape with line breaks, blank lines, indentation and plain lists, and write a link as the bare address so that what is read is what is followed. A message may instead be written as markup, in the html field, which is delivered as formatting rather than as visible tags. Give one or the other, not both: a message that carries markup has its plain text half dropped, so the half that was confirmed would never arrive. Permitted are headings, paragraphs, line breaks, rules, quotes, emphasis, lists, tables, links and images, with colour, font, alignment, spacing and borders. Anything else is refused rather than quietly removed, and the answer names what and why. Note that the preview page linked from the confirmation lists every address in the message in full, including the ones behind links and images, and every alt text, because those are what a recipient reads. The question in the client stays short and carries counts instead. Text is UTF-8 everywhere: subject, body and addresses. Write characters as the language actually spells them, including umlauts, accents, sharp s, quotation marks and any other non-ASCII character. Do not transliterate them away (no "ae" for "ä", no "ss" for "ß"): the subject is encoded for transport and decoded again on arrival, and the body carries its character set, both verified against the Bridge. A transliterated message is simply a message with the wrong words in it.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "send_message"
  }
}

Input Schema

NameRequiredDescriptionDefault
ccNoRecipients in copy, visible to everyone. Each entry is an address, optionally as "Display Name <name@example.com>".
toNoThe main recipients. Each entry is an address, optionally as "Display Name <name@example.com>".
bccNoRecipients in blind copy. They receive it; the others do not see them. Each entry is an address, optionally as "Display Name <name@example.com>".
htmlNoThe body as markup instead of plain text. Give this or text, not both. Permitted are headings, paragraphs, line breaks, rules, quotes, emphasis, lists, tables, links and images, with colour, font, alignment, spacing and borders. Images may point at a full address; anything outside the permitted set is refused with a reason rather than removed.
textNoThe body, as plain text.
subjectNoThe subject line.
markupLevelNoHow much markup is permitted. "standard" covers ordinary formatted mail. "extended" permits every CSS property, including ones that can hide content, and makes the confirmation carry a warning telling the person to open the preview. Prefer "standard"; reach for "extended" only when asked for something that needs it, such as a button, which requires display:inline-block.standard

Schema Changelog

Changes observed during successful MCP inspections.

  1. Addedv0.4.11

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Well beyond the annotations, it discloses the confirmation flow (sender, To/Cc/Bcc split out, subject), that a client unable to render the question cannot send, that users can pre-authorize sends within bounds, and that refusals name what was rejected and why. It also discloses a privacy-relevant trait: the preview page lists every address and alt text in full. The one missing piece for a destructiveHint=true write is that a sent message cannot be recalled or undone, which the description never states.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose is front-loaded in the first sentence, which is good. But the plain-text-versus-markup rule is explained twice at length, and the prose is discursive enough ('the half that was confirmed would never arrive') that an agent must work to extract the actionable rules. Several sentences could be compressed without losing information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex, irreversible, open-world write with no output schema, the description covers confirmation behavior, failure modes, markup policy, encoding and the preview page. The notable gap is recipient requirements: with zero required parameters, an agent gets no statement about whether to, cc or bcc must be non-empty, nor what the successful response contains beyond 'the answer then says that it did'.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline would be 3, but the description adds genuine meaning on top: that markup in the text field is delivered as visible characters rather than interpreted, and that subject, body and addresses are UTF-8 and must not be transliterated, with a concrete reason (the subject is transport-encoded and decoded on arrival, verified against the Bridge). That is operational guidance the schema does not carry.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence names a specific verb and resource: 'Composes a message and sends it.' That is unambiguous about what the tool does. It does not, however, distinguish itself from the sibling tools send_reply, send_forward and send_draft, so an agent must infer that this one is for a brand-new message rather than a continuation of an existing thread.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit conditional guidance for two real decisions: use html or text, not both, and prefer markupLevel 'standard' over 'extended' unless something like a button is needed. It also warns that plain-text bodies are delivered literally. What it never addresses is tool selection against siblings (send_reply, send_forward, send_draft) or whether a message with no recipients at all is valid, which matters because no parameters are marked required.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.