Exchange EWS MCP
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Exchange EWS MCPshow my upcoming meetings this week"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Exchange EWS MCP v0.9.0
English | 简体中文
📮 Give your on-premises Exchange an AI assistant.
Tired of copying last week's report? Digging through old mail before every reply? Checking calendars one person at a time just to book a meeting?
Exchange EWS MCP connects an MCP Agent to Microsoft Exchange through EWS + NTLM. The Agent can search mail, prepare drafts, update weekly reports, check availability, and manage meetings — while important sends stay under user control.
Designed foron-premises Exchange with EWS + NTLM. It is not an Exchange Online / Microsoft Graph OAuth client.
✨ Highlights
📧 Search mail, compose drafts, reply, forward, edit drafts, add attachments.
👥 Resolve recipients from full pinyin names or complete email addresses.
📝 Update weekly reports while preserving the original Outlook HTML layout, including reports synthesized from other people's weekly-report emails.
📅 Check availability, find common time, create/edit meetings, and send invitations after confirmation.
🔐 Store passwords in Windows Credential Manager.
🛡️ Draft-first workflows keep the final send under user control.
Related MCP server: OWA Exchange MCP Server
🧭 Architecture
flowchart LR
A["MCP client / Agent"] -->|stdio| S["Exchange EWS MCP"]
S --> M["Semantic mail workflows"]
S --> W["Weekly-report workflow"]
S --> C["Calendar coordination"]
M --> E["EWS client + NTLM"]
W --> E
C --> E
E --> X["On-premises Exchange"]
M --> R["Local reference store"]
W --> R
C --> R
S --> K["Windows Credential Manager"]The server runs locally on Windows and exposes higher-level mail and calendar workflows to the Agent. Exchange credentials and low-level Exchange IDs stay behind the server.
🚀 Quick start
Clone → install → connect Exchange → paste one server path into your MCP client.
1. Requirements
Windows 10/11 or Windows Server
Python 3.10–3.13
Access to your Exchange EWS endpoint
An Exchange account allowed to use EWS with NTLM
2. Install
git clone https://github.com/ShermanGu/exchange-ews-mcp.git
cd exchange-ews-mcp
.\install.cmdThe installer creates .venv and installs everything locally.
3. Configure Exchange
.\.venv\Scripts\exchange-ews-mcp.exe configureSet the current mailbox user:
.\.venv\Scripts\exchange-ews-mcp.exe set-current-user `
--email "you@company.example" `
--display-name "Your Name"Check the connection:
.\.venv\Scripts\exchange-ews-mcp.exe status
.\.venv\Scripts\exchange-ews-mcp.exe testYour password is stored in Windows Credential Manager, not in the repository.
4. Set calendar preferences
.\.venv\Scripts\exchange-ews-mcp.exe set-calendar-preferences `
--time-zone "Asia/Shanghai" `
--workday-start "09:00" `
--workday-end "18:00" `
--slot-minutes 305. Connect your MCP client
✅ Recommended: point directly to the EXE
After installation, the production MCP server is:
<repo>\.venv\Scripts\exchange-ews-mcp-server.exeIf your MCP client has Command and Arguments fields:
Command:
D:\tools\exchange-ews-mcp\.venv\Scripts\exchange-ews-mcp-server.exe
Arguments:
<leave empty>Use an absolute path, save the configuration, then restart the MCP client.
Or use JSON
{
"mcpServers": {
"exchange-ews": {
"command": "D:\\tools\\exchange-ews-mcp\\.venv\\Scripts\\exchange-ews-mcp-server.exe"
}
}
}You can also run:
.\.venv\Scripts\exchange-ews-mcp.exe mcp-config6. Verify
.\.venv\Scripts\exchange-ews-mcp.exe version
.\.venv\Scripts\exchange-ews-mcp.exe tool-listExpected version: 0.9.0 · Production tools: 11
🎉 Done — your Agent can now work with Exchange.
💬 Try these prompts
Find my latest weekly report and update it with this week's progress.Summarize the weekly reports A and B sent me, then use that summary to generate my new weekly-report draft.Draft an email to wangxiaoming saying integration testing is complete. Don't send it.Find the earliest one-hour slot next week when lixiaohong and I are both free, create a meeting, and save it without sending.🧰 Main capabilities
Area | Capabilities |
Search/read mail, compose drafts, reply, forward, edit drafts, attachments | |
People | Recipient resolution and ambiguity handling |
Weekly reports | Read recent history and create an updated Reply All or fresh Compose draft without rebuilding HTML |
Calendar | Availability, common slots, calendar reads, create/update meetings, send invitations |
The compact mail facade uses search_mail, read_mail, resolve_people, save_mail_draft, and edit_mail_draft. Weekly reports use the single weekly_report entry followed by continue_action; HTML always remains server-owned. Calendar creation/editing uses save_meeting; confirmed sending uses send_meeting_invitation.
📝 Weekly reports
Direct user update ───────────────┐
├→ weekly_report(request=...)
search_mail/read_mail → LLM summary ┘
↓
Read recent history + slots
↓
Agent routes request by loc
↓
Update only relevant text
↓
Create an unsent Reply All or Compose draftFor aggregation prompts, the Agent first searches/reads the source reports and summarizes them; that summary becomes the request passed to weekly_report. The tool itself does not search other users' mail.
The Agent does not regenerate the whole HTML template. The server keeps the existing layout and updates approved text slots only. The Agent receives three weeks of context total (current editable report plus two prior reports), uses short local slot IDs such as s1, and the server automatically advances supported Subject date/week markers for the next draft.
🔒 Safety in short
Mail is draft-first.
Meeting sends require explicit confirmation.
Credentials stay in Windows Credential Manager.
Ambiguous recipients or meeting times are returned for confirmation instead of guessed.
📚 Documentation
Agent connection · Agent tools · Architecture · Weekly reports · Development tests · Changelog
For contributors: CONTRIBUTING.md · SECURITY.md
Limitations
Windows is the primary runtime target. EWS behavior depends on Exchange version and mailbox policy. Weekly-report editing currently expects a supported Outlook/Word HTML reply structure. Exchange Online users should generally prefer Microsoft Graph and modern authentication.
License
Released under the MIT License.
Available Tools
11 toolscontinue_actionB
恢复人员/邮件/时间确认,或提交 weekly_report 周报修改。
周报 selections 仅支持 changes 和可选 subject;changes 每项使用 weekly_report 返回的短 id/text,例如 {"id":"s3","text":"完成接口联调"}。weekly_report 返回的 subject 已是 Server 自动顺延后的默认草稿主题;通常无需再次提交 subject。
| Name | Required | Description | Default |
|---|---|---|---|
| selections | Yes | ||
| resume_token | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It usefully discloses that the subject returned by weekly_report is a server auto-advanced default and usually need not be resubmitted, which is real behavioral context. But it says nothing about confirmation types, permissions, or the consequences of submitting the resume path.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the two purposes, then follows with the weekly_report format detail and the subject note. Content is dense but each sentence carries information; minor redundancy in re-explaining the subject.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values need not be described. For a 2-param tool with a nested object at 0% schema coverage, the weekly_report selections are well covered but resume_token and the confirmation-type selections are left undefined, so an agent cannot fully call the resume path with confidence.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It does document the selections structure in detail (changes with short id/text, optional subject, worked example), but resume_token — the central parameter for a resume tool — is never explained beyond the implied 'resume' sense.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific dual purpose: resume people/mail/time confirmations, or submit weekly_report modifications. The verb+resource is clear and it distinguishes the weekly_report path from the sibling of the same name. It stops short of explaining how the two modes relate.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives concrete guidance for the weekly_report path (selections supports only changes and optional subject, with an id/text example). However it offers no when-to-use guidance for the resume path — it never says how a resume_token arises or what condition should lead an agent here instead of a sibling.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
edit_mail_draftA
修改邮件草稿并可追加允许目录中的本地附件,绝不发送。
所有附件会在第一次 Exchange 写入前完成路径和大小校验。draft_ref 只能是 邮件草稿引用;会议必须使用 save_meeting。
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | ||
| to | No | ||
| bcc | No | ||
| subject | No | ||
| body_html | No | ||
| draft_ref | Yes | ||
| importance | No | ||
| attachments | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations the description carries the full burden, and it delivers: it guarantees the draft is never sent and that all attachments undergo path and size validation before the first Exchange write, which is meaningful safety/consistency context. It omits auth requirements and what happens to fields not supplied.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences with the purpose, the no-send guarantee and the routing constraint front-loaded; little waste. It is efficient, though the second sentence could be tightened slightly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values need not be described, and the description covers the two non-obvious parameters plus the critical safety behavior. For an 8-param mutation tool with zero annotation coverage it is largely sufficient, though additional field-level context would help.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 8 params, so the description must compensate. It adds real meaning for draft_ref (mail-draft reference only) and attachments (must live in allowed directories, size-checked), but says nothing about cc/to/bcc/subject/body_html/importance beyond their self-evident names, so half the parameters remain unelaborated.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Names a specific verb (修改/edit) and resource (邮件草稿/mail draft), states the scope (may append local attachments, never sends), and explicitly separates itself from a sibling by declaring that meetings must use save_meeting. An agent can tell this apart from save_meeting without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear routing: draft_ref is only a mail-draft reference and meetings must go to save_meeting, which is a concrete alternative. However it does not clarify when to use this versus the sibling save_mail_draft (creating/persisting a draft), leaving that boundary to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
find_meeting_timesC
解析参会人并查找共同空闲时间。
人员查询只接受姓名拼音或完整邮箱。默认把当前用户作为 Organizer, 同时尊重 Exchange 返回的个人工作时间;缺失时使用本地日历偏好。
| Name | Required | Description | Default |
|---|---|---|---|
| window_end | Yes | ||
| max_results | No | ||
| include_self | No | ||
| window_start | Yes | ||
| lookback_days | No | ||
| attendee_queries | Yes | ||
| duration_minutes | No | ||
| interval_minutes | No | ||
| respect_attendee_working_hours | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose useful non-obvious behavior: attendee queries accept only pinyin names or full emails, the current user is injected as Organizer by default, and working-hours data comes from Exchange with a local-calendar fallback. It does not state whether the tool only reads calendars (no invites sent) or anything about result limits or errors.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short, front-loaded sentences with no filler; the core action leads and the constraints follow. It is efficient, though it under-covers rather than over-explains.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 9-parameter tool with 0% schema coverage and no annotations, the description leaves most inputs undefined. The presence of an output schema excuses return-value discussion, but the input-side gaps are substantial.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 9 parameters, so the description must compensate, yet it only addresses attendee_queries format and partially respect_attendee_working_hours and include_self semantics. Window format, duration_minutes, interval_minutes, max_results, and lookback_days are entirely unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening sentence states a specific verb and resource — parsing attendees and finding shared free time — which is a distinct capability from siblings like read_calendar or save_meeting. However, it never explicitly contrasts itself with those siblings, so an agent must infer the boundary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No statement of when to use this tool versus read_calendar or send_meeting_invitation, and no prerequisites beyond the mention of which attendees are accepted. The default-organizer note hints at behavior but does not guide tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_calendarA
按时间范围列出日程,或按 calendar_ref 读取一个日历项目。
读取单项时只提供 calendar_ref;列出日程时同时提供 start/end。
| Name | Required | Description | Default |
|---|---|---|---|
| end | No | ||
| limit | No | ||
| start | No | ||
| calendar_ref | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden, and it does little: 'read' implies a safe operation, but permission requirements, whether results are paginated (a limit param exists), and what happens with an empty range are all unstated. For a parameterized read with zero annotation coverage, this is a notable gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, zero filler, with the mode distinction front-loaded. Every clause directly supports correct invocation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values need not be explained, which the description correctly omits. Still, with 4 undocumented params, no annotations, and no sibling differentiation, the definition leaves the agent guessing about limit semantics and timestamp formatting.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% and there are 4 params, so the description must compensate — it does partially, by defining the mutually exclusive roles of calendar_ref vs. start/end. However, 'limit' is never mentioned and the expected format of start/end (ISO string? date?) is left undefined in both schema and description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb+resource ('read/list calendar items') and, unusually, distinguishes two operating modes — single-item read via calendar_ref vs. range listing via start/end. It is clearer than most siblings' abbreviated names, though it never explicitly contrasts itself with calendar-adjacent siblings like find_meeting_times or save_meeting.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives concrete routing rules: supply only calendar_ref for a single item, supply start/end for a listing. That is real when-to-use guidance. It stops short of naming alternatives (e.g. use find_meeting_times to schedule) or stating what happens if both modes' params are mixed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_mailC
读取邮件或草稿的正文、收发件人和附件元数据。
message_ref 与 draft_ref 必须且只能提供一个;不接受底层 Exchange ItemId。
| Name | Required | Description | Default |
|---|---|---|---|
| draft_ref | No | ||
| message_ref | No | ||
| max_body_chars | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It discloses a real constraint (exactly one of message_ref/draft_ref, no raw Exchange ItemId), which is useful, but says nothing about permissions, error behavior, or side effects. readOnly could be inferred but is not stated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two compact sentences with no filler; the return-value summary is front-loaded and the constraint follows. Size is appropriate for the tool's simplicity. Minor deduction because the constraint sentence could be sharper.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values needn't be explained in prose. But with zero annotations and zero schema description coverage, the description should say more about the ref formats, permission needs, and the max_body_chars parameter to be fully actionable. It covers the critical mutual-exclusivity rule but leaves other gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the schema provides only names/types and no semantic help. The description does add meaning: it clarifies that message_ref and draft_ref are mutually exclusive and exactly-one-required, and that raw Exchange ItemId is rejected. However, it never explains max_body_chars or the ref format, so compensation is partial.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (读取) and resources (邮件或草稿) plus what fields are returned (正文、收发件人、附件元数据). Distinguishes itself from write siblings like save_mail_draft/edit_mail_draft by being a read operation, though there is no explicit sibling differentiation (e.g., vs search_mail).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use or when-not-to-use guidance relative to alternatives. The only usage-adjacent note is a mutual-exclusivity constraint on identifiers, which is a parameter rule, not tool-selection guidance. An agent has no signal why it should pick read_mail over search_mail.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
resolve_peopleA
使用姓名拼音或完整邮箱解析人员,并结合历史邮件消歧。
裸拼音会收集所有已配置公司域名下、邮箱 local-part 以该拼音开头的候选; 不会优先选择无数字后缀的邮箱。多个候选中若只有一个存在历史来往才自动选择。
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| query | Yes | ||
| auto_select | No | ||
| lookback_days | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does meaningfully: it discloses that bare pinyin collects candidates across all configured company domains by email local-part prefix, that it does not prefer non-digit-suffixed emails, and that auto-selection only fires when exactly one candidate has historical correspondence. It omits permission/auth requirements and result shape, but the disambiguation semantics are unusually well surfaced.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two dense, front-loaded sentences with no filler; the core resolution contract comes first and the disambiguation edge cases follow. Nothing padding, though it is information-heavy for its length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described, and the disambiguation logic is covered. However, with no annotations and 0% parameter coverage, gaps remain around limit/lookback_days semantics and the absence of any mutation/side-effect statement for what is an identity-resolving lookup.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It effectively documents the query parameter (pinyin vs full email) and the trigger logic behind auto_select, but leaves 'limit' and 'lookback_days' unexplained (the '历史来往' reference only vaguely implies a history window). Partial compensation for a 4-parameter, zero-coverage schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('解析人员' / resolve people) via pinyin name or full email, and adds the disambiguation mechanism. It clearly distinguishes itself from the mail/calendar siblings, none of which resolve identities, though it does not name those siblings explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied rather than stated: an agent infers this is a name/email-to-person lookup, but there is no explicit when-to-use, when-not-to-use, or pointer to a prerequisite such as resolving a person before sending an invitation. The rules about bare pinyin describe behavior more than they route the agent between tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
save_mail_draftA
新建、回复、Reply All 或转发邮件草稿,绝不发送。
compose 需要 subject/to_queries;其他模式需要 source_message_ref。reply 和 reply_all 不接受收件人;forward 需要 to_queries。reply/forward 创建后如需 改主题或加附件,继续调用 edit_mail_draft。
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | ||
| subject | No | ||
| body_html | Yes | ||
| cc_queries | No | ||
| to_queries | No | ||
| attachments | No | ||
| bcc_queries | No | ||
| lookback_days | No | ||
| source_message_ref | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden and does disclose the key behavioral trait — the draft is never sent (non-destructive, non-delivering) — plus the mode-dependent recipient rules that would otherwise cause errors. It does not cover whether drafts persist/overwrite or whether permissions are needed, but the safety profile is clear and an output schema exists for returns.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with purpose and the never-sends constraint, then a dense block of conditional parameter rules; no filler sentences. It is slightly terse/run-on across four sentences but every clause carries actionable information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 9-parameter, mode-conditional mutation tool with zero annotations, the description covers the critical selection logic and the safety boundary, and an output schema handles return values. It falls short on the auxiliary parameters (attachments, cc/bcc, lookback_days), which an agent may need to guess about.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, and it does for the hardest part: mode-conditional requiredness of subject/to_queries/source_message_ref and the recipient restrictions on reply/reply_all/forward. However cc_queries, bcc_queries, attachments, and lookback_days get no mention, leaving roughly half the parameters undocumented anywhere.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('新建...邮件草稿' = create mail drafts) across four named modes and immediately bounds scope with '绝不发送' (never sends), which cleanly separates it from any send action. It also names the sibling edit_mail_draft as the follow-up path.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit per-mode routing: compose requires subject/to_queries, other modes require source_message_ref, reply/reply_all take no recipients, forward requires to_queries. It also states the follow-up condition for edit_mail_draft, so an agent knows both when to pick this tool and what to do next.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
save_meetingA
创建或修改会议并始终保持未发送状态。
没有 calendar_ref 时创建:需要 attendee_queries、subject、body_html,以及 确定的 start/end;如需查找候选时间,先调用 find_meeting_times。提供 calendar_ref 时更新现有未发送会议;attendee_queries 此时只接受完整邮箱。 发送邀请必须另行调用 send_meeting_invitation。
| Name | Required | Description | Default |
|---|---|---|---|
| end | No | ||
| start | No | ||
| subject | No | ||
| location | No | ||
| body_html | No | ||
| calendar_ref | No | ||
| lookback_days | No | ||
| attendee_queries | No | ||
| reminder_minutes | No | ||
| check_availability | No | ||
| optional_attendees | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden and does useful work: it discloses the persistent draft/unsent state, which fields are conditionally required, and that attendee_queries changes semantics between create (resolvable queries) and update (full emails only). It does not cover permissions or what happens to omitted fields on update, which keeps it short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the purpose and state invariant, then presents the create/update branches in separate, scannable clauses with no filler. Slightly dense for a three-line description but every clause carries operational information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values need no explanation, and the draft-state disclosure substantially de-risks the mutation. Remaining gaps are secondary — no auth/permission context and no statement about how update handles unspecified fields.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% across 11 parameters, so the description must compensate. It adds real meaning for the conditional params (calendar_ref, attendee_queries, subject, body_html, start/end) and their requiredness per mode, but leaves location, lookback_days, reminder_minutes, check_availability, and optional_attendees entirely unexplained in both schema and description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb set and resource — creates or modifies a meeting — and immediately pins down the invariant that the item is always left unsent. It also names its two relevant siblings (find_meeting_times, send_meeting_invitation), so an agent can place it precisely among the calendar tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit branch conditions: no calendar_ref → create (with required fields listed); calendar_ref present → update an existing unsent meeting. It also routes two adjacent needs to alternatives — candidate-time lookup to find_meeting_times and invitation sending to send_meeting_invitation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_mailB
统一查找邮件并返回类型安全的稳定引用。
普通邮件返回 message_ref;草稿返回 draft_ref,不会同时伪装成可回复的消息。 无过滤条件时列出 inbox/sentitems 中最近邮件;姓名拼音或完整邮箱由 Server 解析和消歧。需要用户选择时返回 resume_token,由 continue_action 恢复。
| Name | Required | Description | Default |
|---|---|---|---|
| after | No | ||
| limit | No | ||
| before | No | ||
| offset | No | ||
| folders | No | ||
| unread_only | No | ||
| sender_query | No | ||
| lookback_days | No | ||
| has_attachments | No | ||
| subject_contains | No | ||
| participant_query | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden and does disclose meaningful traits: the type-safe ref distinction (drafts are not disguised as replyable messages), server-side name/pinyin disambiguation, and the resume_token handoff to continue_action. It omits safety profile (read-only vs mutating), pagination behavior despite limit/offset, and rate limits, so it is strong but not complete.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Dense but front-loaded: purpose and return contract come first, then default behavior, then the resume flow. Four short sentences, each carrying information with no filler. Slightly terse for the amount of undocumented surface it must cover.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and the description does describe the ref/resume contract. But against 11 parameters at 0% schema coverage and zero annotations, the description leaves most filter parameters semantically undefined, which is a real gap for a query tool of this complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 11 parameters, so the description must compensate and largely fails to. It only alludes to filter semantics indirectly ('无过滤条件时' covers folders defaults, and '姓名拼音或完整邮箱由 Server 解析' touches sender/participant query resolution), leaving after, before, limit, offset, lookback_days, unread_only, has_attachments and subject_contains completely undocumented in both schema and description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a clear verb+resource ('统一查找邮件') and immediately specifies the return contract: message_ref for regular mail, draft_ref for drafts. This distinguishes it from read_mail (single message retrieval) implicitly, though it never names a sibling as an alternative. Purpose is clear but sibling differentiation is only partial.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives one concrete usage scenario (no filters → lists recent inbox/sentitems mail) and explains that a resume_token is returned when user disambiguation is needed, which continue_action restores. However, it never states when to prefer search_mail over read_mail, nor any conditions/exclusions around filtering. Guidance is implied and incomplete.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
send_meeting_invitationA
发送一个已保存但尚未发送的会议邀请。
只有显式设置 confirm_send=true 才会发送;已发送或已取消的会议会被拒绝, 避免重复邀请。必须使用 save_meeting/read_calendar 返回的 calendar_ref。
| Name | Required | Description | Default |
|---|---|---|---|
| calendar_ref | Yes | ||
| confirm_send | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden: it discloses a deliberate send gate (default false means nothing is sent), idempotency-style protection against duplicate invites, and a hard cross-tool prerequisite on calendar_ref. It omits what happens after a successful send (recall/cancellation) and any permission requirements, which matters for an unannotated, irreversible-looking mutation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short lines, front-loaded with the action and the gating condition, followed by rejection behavior and the prerequisite. No sentence is redundant with the name or schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and the description covers the mutation's precondition and failure states. For a write tool with zero annotations, a note on permissions or post-send irreversibility would close the remaining gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, and it does for both parameters: confirm_send is given real gating semantics (explicit true required, default false is a no-op) and calendar_ref is given provenance (must come from save_meeting/read_calendar). Only the expected format/identity of calendar_ref is left unstated.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource (send a saved, not-yet-sent meeting invitation) and immediately distinguishes itself from save_meeting and read_calendar, which it names as the sources of calendar_ref. An agent can tell this apart from its siblings without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly names the precondition (confirm_send=true must be set explicitly), the states that cause rejection (already-sent or cancelled meetings, to avoid duplicate invitations), and the alternative tools that supply the required reference. This is effectively when-to-use, when-not-to-use and alternatives in three lines.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
weekly_reportA
处理“周报”请求的唯一 Agent 入口。
request 是“本次要写入新周报的最终修改需求”。它既可以直接来自用户,也可以是 Agent 在调用本工具之前通过 search_mail/read_mail 读取其他人的周报或相关邮件后,先用 LLM 总结 得到的自然语言输入。若用户要求“总结 A、B 发给我的周报并生成我的周报”,应先完成邮件 搜索、读取和总结,再把总结结果作为 request 调用 weekly_report;不要把“去搜索并总结 A、B” 这类元指令原样作为 request。weekly_report 本身只处理自己的周报模板,不负责搜索他人的邮件。
返回紧凑 JSON:resume_token、mode、subject、request、instructions、最新模板的 slots, 以及前两周 history。slots.id 是本次上下文局部短 ID(s1、s2...),必须原样 使用,不得猜测或自行构造;loc 是压缩后的模板结构上下文,只用于理解版面和语义, 不参与真正写入定位。
生成下一周内容时,必须先语义拆解 request,再进行 slot routing。slot.loc 是原周报的显式
结构路径,每个路径文本后面的括号都会标明该文本在表格中的位置/层级身份,例如:
周报(纵向表头) = nl2sql项目(横向表头) > 项目进展(二级纵向表头)。= 表示一级
纵向表头与一级横向表头在当前内容位置交叉,> 表示继续进入更具体的下一级表头,越靠右
越具体。路由时主要理解括号前的真实表头文字,括号里的纵向/横向/二级等位置用于理解层级
和消歧;slot.text 是该路径末端当前承载的实际内容。不能因为某个 slot 文本关键词看起来最
相似,就把整段 request 放入该 slot。一段输入可以修改多个 slot;属于不同 loc 的事实必须
分别更新;只有确认属于同一 loc 的多条事实才合并后改写。用户本次事实
优先于历史;只提交确实需要变化的槽位;聊天性、情绪性或与正式周报无关的信息可以
忽略;无法可靠确定归属时不要猜测或修改无关 slot。
将口语化事实改写为简洁、正式、客观的周报文本;延续历史中的正式项目名和
技术术语,不得虚构事实。必须检查正文中所有周期性日期/周次并顺延。Server
会自动把可识别的 Subject 日期/周次顺延一周;返回的 subject 已是默认草稿主题。
然后调用 continue_action(resume_token=..., selections={"changes":[{"id":"s1","text":"..."}]})。
仅当用户明确要求不同主题时才传 selections.subject 覆盖默认值。本地参数错误时修正后复用同一 token;只有明确
context_stale、token 过期/已使用/被取代时才重新调用 weekly_report。
本工具不创建草稿,也绝不向 Agent 暴露 HTML。Server 会在 continue_action 阶段自动决定 Reply All 或新建草稿。
| Name | Required | Description | Default |
|---|---|---|---|
| folder | No | sentitems | |
| folders | No | ||
| request | Yes | ||
| lookback_days | No | ||
| subject_contains | No | 周报 | |
| reference_materials | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and discharges it: it specifies the returned JSON fields, the meaning and immutability of slots.id and loc, that it never creates drafts or exposes HTML, that the Server auto-advances Subject dates and chooses Reply All vs new draft, and the exact token-reuse/expiry rules. This is unusually rich disclosure for a mutation-style workflow.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The text is long but dense, front-loaded with the identity claim and the critical semantics of `request` before moving to return shape and workflow. Given the complexity of the slot-routing and token lifecycle, most sentences earn their place, though a few procedural details could be trimmed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, yet the description still helpfully covers the return payload, token lifecycle, subject auto-advance, and the two-step continue_action handoff, so the workflow is complete. The main shortfall is the undocumented non-required parameters, which leaves how the tool sources prior weekly reports implicit.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 6 parameters, so the description must compensate. It thoroughly explains only `request`; folder, folders, lookback_days, subject_contains, and reference_materials (a nested object array) are never explained, leaving an agent to guess how prior reports are located or what reference_materials should contain.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description declares itself the sole Agent entry point for weekly-report (周报) requests, a specific verb+resource, and explicitly distinguishes itself from siblings by stating it does not search other people's mail (search_mail/read_mail do). An agent can tell it apart from the mail and draft tools without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit when-to-use sequencing: do search_mail/read_mail + LLM summarization first, then pass the summarized result as request, and specifically warns not to pass meta-instructions like '去搜索并总结 A、B' verbatim. It also names the follow-up tool (continue_action) and the conditions for re-invoking weekly_report.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
11 tool updates
v0.1.0- First observed
continue_action - First observed
edit_mail_draft - First observed
find_meeting_times - First observed
read_calendar - First observed
read_mail - First observed
resolve_people - First observed
save_mail_draft - First observed
save_meeting - First observed
search_mail - First observed
send_meeting_invitation - First observed
weekly_report
TDQS
Scored across 11 tools
Each tool targets a clearly distinct operation across mail, calendar, meetings, people resolution, and weekly reports. Overlaps in people resolution are contextual but descriptions make the intended tool unambiguous, and continue_action is explicitly tied to resume tokens.
All tool names use snake_case and most follow a predictable verb_noun pattern (read_calendar, search_mail, save_meeting). weekly_report is a noun phrase without a verb, which is a minor deviation from the otherwise consistent convention.
Eleven tools is well within the appropriate range for an Exchange EWS server covering mail, calendar, meetings, and a specialized weekly-report workflow. Each tool appears to earn its place without excessive fragmentation.
The mail surface can search, read, and draft but never send an email, creating a dead end for a core Exchange operation. Calendar tools also lack cancel/delete or modification of sent meetings, which are significant lifecycle gaps for the apparent domain.
Maintenance
Related MCP Connectors
Your IMAP mailbox as an MCP server: read, search and (if you allow it) organize mail. Open source.
Hosted MCP server for your Gmail, Outlook and IMAP mail, with mailboxes and scopes set per agent.
Hosted email MCP for your own Gmail, Outlook.com, Microsoft 365, iCloud or IMAP inbox: read, search, draft, reply in thread, forward and file mail. It moves or flags up to 500 messages in one call, and a send leaves exactly one copy in Sent. A calendar is a separate connection, and connecting one adds diary and scheduling tools.
MCP server for MailTempo's public free temporary email inboxes.
Related MCP Servers
- AlicenseCqualityBmaintenanceSecure MCP server for on-prem Microsoft Exchange (EWS) with tools for email, calendar, contacts, folders, attachments, and free/busy availability.3111MIT
- AlicenseAqualityDmaintenanceMCP server for any Microsoft Exchange / OWA deployment. Gives LLM agents access to email, calendar, directory search, folders, availability, and meeting analytics via 30 tools.3046 PyPI10MIT
- AlicenseAqualityDmaintenanceA local stdio MCP server that enables reading, sending, and searching emails, as well as listing calendar events via Microsoft Graph API, using device-code authentication.10467 npmMIT
- AlicenseAqualityAmaintenanceLocal-first Microsoft Outlook MCP server: a single Go binary that manages calendar events and mail through the Microsoft Graph API over stdio, with tokens stored in the OS keychain and no Entra ID app registration required. Exposes four aggregate tools (calendar, mail, account, system) dispatched by an operation verb, with multi-account support and read-only and mail-gating modes.445MIT