outlook-mcp-server
outlook-mcp-server
Локальный MCP сервер, который даёт Claude (Desktop или Code) доступ на чтение/запись к личной почте Hotmail / Outlook.com через Microsoft Graph API, используя поток авторизационного кода OAuth 2.0 (с PKCE) против платформы удостоверений Microsoft.
Он предоставляет шесть инструментов: list_messages, get_message, search_messages, send_message, create_draft и list_folders.
Всё выполняется локально через stdio — здесь нет размещённого сервиса, и ваша почта никогда не проходит ни через что, кроме вашей машины и собственного Graph API Microsoft.
Как это работает
Аутентификация: MSAL Node выполняет поток авторизационного кода + PKCE против
https://login.microsoftonline.com/consumers(только личные учётные записи — см. Выбор арендатора), используя кратковременный локальный HTTP-сервер как цель перенаправления. Токеры (включая refresh-токенoffline_access) кэшируются и незаметно обновляются при последующих запусках.Хранилище: кэш токенов сериализуется MSAL, шифруется AES-256-GCM с локально сгенерированным ключом и записывается в
~/.outlook-mcp-server/token-cache.enc(режим0600). Сам ключ находится в~/.outlook-mcp-server/cache.key(также0600). См. замечания по безопасности относительно модели угроз, которую это (не) покрывает.Вызовы Graph: тонкий Fetch-клиент вызывает
https://graph.microsoft.com/v1.0/...с текущим токеном доступа.MCP-сервер: построен на
@modelcontextprotocol/sdk, говорит через stdio, поэтому может быть запущен непосредственно Claude Desktop / Claude Code как дочерний процесс.
Related MCP server: Outlook MCP Python
Предварительные требования
Node.js 18+
Учётная запись Microsoft (Hotmail, Outlook.com или Live) — почтовый ящик, к которому Claude должен получить доступ.
Бесплатная Azure-учётная запись для регистрации приложения допуска, он не должен быть платной подпиской Azure.
1. Установка
git clone <this repo>
cd outlook-mcp-server
npm install2. Регистрация приложения в Azure Portal
Эта регистрация выдаёт идентификатор клиента, который этот сервер использует для доступа к Microsoft Graph от вашего имени. npm run setup (ниже) проведёт вас через это интерактивно, но шаги такие:
Перейдите на portal.azure.com и войдите с любой учётной записью Microsoft.
Найдите Регистрации приложений → + Новая регистрация.
Заполните форму:
Имя: любое, например
outlook-mcp-server.Поддерживаемые типы учётных записей: «Только личные учётные записи Microsoft». Это ограничивает приложение учётными записями Hotmail/Outlook.com/Live, а не рабочими/учебными (Azure AD) арендаторами.
URI перенаправления: платформа «Публичный клиент/нативный (мобильные и настольные)», значение
http://localhost:8765/callback(или другой порт — просто будьте последовательны, когда скрипт настройки спросит).
Нажмите Зарегистрировать, затем скопируйте Идентификатор приложения (клиента) на странице обзора.
Перейдите в Разрешения API → + Добавить разрешение → Microsoft Graph → Делегированные разрешения и добавьте:
Mail.ReadMail.ReadWriteMail.Sendoffline_access(часто присутствует по умолчанию)
Делегированные разрешения для личных учётных записей Microsoft не требуют согласия администратора — вы сами согласитесь при входе в шаге 3 ниже.
(Необязательно, дополнительно) Если вы предпочитаете использовать конфиденциальный клиент с секретом клиента вместо потока PKCE для публичного клиента, добавьте платформу Web с URI перенаправления и создайте секрет в разделе Сертификаты и секреты. Большинству людей следует пропустить этот шаг.
3. Настройка (аутентификация + конфигурация)
npm run setupЭто:
Выведет приведённый выше пошаговый инструктор.
Запросит идентификатор клиента (и необязательный секрет / аренду / URI перенаправления) и сохранит его в
~/.outlook-mcp-server/config.json.Откроет браузер для входа и согласия.
Проверит, что токен работает, вызвав
GET /meи напечатав ваше имя/почту.Выведет JSON-фрагмент для добавления в вашу конфигурацию Claude (см. ниже).
Позже вы сможете пройти аутентификацию заново (отозванный токен, смена аккаунта и т.д.) без повторного ввода данных регистрации приложения:
npm run login4. Сборка и регистрация в Claude
npm run buildClaude Desktop — добавьте в claude_desktop_config.json
(~/Library/Application Support/Claude/claude_desktop_config.json на macOS,
%APPDATA%\Claude\claude_desktop_config.json на Windows):
{
"mcpServers": {
"outlook": {
"command": "node",
"args": ["/absolute/path/to/outlook-mcp-server/dist/src/index.js"]
}
}
}Claude Code:
claude mcp add outlook -- node /absolute/path/to/outlook-mcp-server/dist/src/index.jsПерезапустите Claude Desktop / Claude Code. Нижеописанные инструменты должны стать доступны.
Инструменты
Инструмент | Описание |
| Получение списка сообщений из папки (по умолчанию |
| Получение полного содержимого (тело, все получатели) одного сообщения по идентификатору. |
| Полнотекстовый поиск ( |
| Отправка email немедленно ( |
| Создание черновика в папке «Черновики» без отправки. |
| Получение списка почтовых папок и их идентификаторов для использования с параметром |
Все инструменты возвращают JSON (как текстовое содержимое MCP) и при ошибках Graph API возвращают ошибки инструмента вместо краха сервера.
Выбор аренды
По умолчанию используется тенант consumers
(https://login.microsoftonline.com/consumers), который принимает только личные учётные записи Microsoft (Hotmail/Outlook.com/Live) — рабочая или учебная учётная запись будет отклонена при входе. Если нужно поддерживать и личные, и Azure AD учётные записи, задайте тенант как common во время npm run setup (или через OUTLOOK_MCP_TENANT=common). Этот проект разработан и протестирован для случая личных учётных записей (consumers).
Этот проект.
Справочник по конфигурации
Всё можно задать через npm run setup (записывается в
~/.outlook-mcp-server/config.json) или через переменные окружения, которые имеют приоритет — см. .env.example:
Переменная | Назначение |
| Идентификатор клиента регистрации Azure app. |
| Только если используется конфиденциальный клиент (платформа Web). |
|
|
| Должен совпадать с регистрацией приложения Azure. |
| Где хранятся конфигурация/кэш токенов. По умолчанию |
Примечания по безопасности
the token cache is encrypted at rest with a locally-generated AES-256-GCM key (
~/.outlook-mcp-server/cache.key, mode0600). This protects against casual disclosure — accidental commits, backups, other unprivileged users on a shared machine — but not against an attacker who already has read access to your user account's files, since the key sits next to the encrypted cache. For stronger protection, swap theICachePlugininsrc/auth/tokenCache.tsfor one backed by your OS keychain (e.g. viakeytar) — the plugin interface is intentionally isolated to that one file.Never commit
~/.outlook-mcp-server/(it's outside the repo by default) or a.envfile containingOUTLOOK_MCP_CLIENT_SECRET.send_messagesends immediately with no confirmation step inside this server — Claude is expected to confirm intent with you before calling it for anything sensitive. Prefercreate_draftwhen you want a review step.Requested scopes are limited to
Mail.Read,Mail.ReadWrite,Mail.Send, andoffline_access— no calendar, contacts, or broaderMail.*application-level access.
Troubleshooting
AADSTS50020/ “user account ... does not exist in tenant” — you're hitting a tenant that doesn't accept personal accounts, or you're signing in with a work/school account againstconsumers. Confirm the app registration's “Supported account types” is “Personal Microsoft accounts only” andOUTLOOK_MCP_TENANTisconsumers(orcommonif you intentionally want both).AADSTS50011/ redirect URI mismatch — theredirectUriin~/.outlook-mcp-server/config.jsonmust exactly match a redirect URI configured on the Azure app registration, including the port.“Not signed in” tool errors — run
npm run login.Port already in use during setup/login — another process is using the redirect URI's port; stop it, or reconfigure the app registration and
npm run setupwith a different port.
Разработка
npm run dev # run the MCP server directly from TypeScript (stdio)
npm run build # compile to dist/
npm run clean # remove dist/Структура проекта
src/
index.ts MCP server entrypoint (stdio transport)
config.ts Config loading (env + config file)
auth/
crypto.ts AES-256-GCM file encryption helpers
tokenCache.ts MSAL ICachePlugin backed by crypto.ts
msalClient.ts MSAL app factory + silent token acquisition
loginFlow.ts Interactive loopback OAuth flow
graph/
client.ts Generic Microsoft Graph fetch wrapper
mail.ts Mail-specific Graph calls
types.ts Graph response types
tools/ One file per MCP tool, registered in index.ts
scripts/
setup.ts Interactive one-time (and re-runnable) setupAvailable Tools
6 toolscreate_draftCreate a draft emailA
Create a draft message in the mailbox's Drafts folder without sending it. Prefer this over send_message whenever the user should review the email first.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | List of email addresses. | |
| to | No | List of email addresses. | |
| bcc | No | List of email addresses. | |
| body | No | Email body content. | |
| subject | No | Email subject line. | |
| bodyType | No | Content type of `body` (default text). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description must convey behavioral traits on its own. It clearly discloses that the email is not sent and is instead stored in the Drafts folder. While it does not mention potential side effects (e.g., overwriting existing drafts) or required permissions, these are not critical for a draft-creation tool. The disclosure is sufficient for a simple operation, earning a 4 rather than 3.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences: the first states the core purpose, the second gives usage guidance. It is front-loaded and every word earns its place. No fluff or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is relatively simple with six well-documented parameters and no output schema. The description provides the essential purpose and usage context. It could mention what the tool returns (e.g., draft ID) but that is not crucial for the agent's selection decision. The description covers the action, location, and when to use it, making it mostly complete for this tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the input schema already documents all six parameters (to, cc, bcc, body, subject, bodyType) with their types and semantics. The description adds no additional parameter details, but it also does not need to because the schema is complete. Baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: 'Create a draft message in the mailbox's Drafts folder without sending it.' It specifies the verb (create), the resource (draft message), the location (Drafts folder), and the key distinction from sending. This unambiguously differentiates it from its sibling send_message.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Prefer this over send_message whenever the user should review the email first.' This directly instructs when to use this tool versus an alternative, making the usage context crystal clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_messageGet full email messageA
Fetch the full content (including body, all recipients, and sender) of a single message by its Graph message ID, as returned by list_messages or search_messages.
| Name | Required | Description | Default |
|---|---|---|---|
| messageId | Yes | The Graph message ID. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It states the tool fetches full content, which implies a read operation, but does not disclose any side effects, permissions, or limitations. It adds some context (what is included in the content) but lacks details like whether it marks messages as read or requires specific scopes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, front-loaded with the action and resource, and includes the key detail about where the ID comes from. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool is simple (one parameter, no output schema, no nested objects), the description is complete enough. It explains what the tool does, what the parameter is, and how to obtain it. It could mention return format, but the absence of an output schema and the simplicity of the tool make this acceptable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 100% (the only parameter messageId is described as 'The Graph message ID.'). The description adds that the ID is 'as returned by list_messages or search_messages', which provides useful context beyond the schema. However, the schema already covers the parameter meaning, so the description adds marginal value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool fetches full content of a single message by its Graph message ID, specifying the resource (message) and the action (fetch full content including body, recipients, sender). It also distinguishes from siblings by referencing list_messages or search_messages as sources for the ID.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage: use this tool when you have a message ID from list_messages or search_messages and need full content. It does not explicitly state when not to use it or mention alternatives, but the context is clear enough for an agent to decide.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_foldersList mail foldersA
List top-level mail folders in the mailbox (Inbox, Sent Items, Drafts, Archive, custom folders, etc.) along with their IDs and item counts. Use a returned folder ID with list_messages or search_messages to target that folder.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description implicitly indicates a read-only operation via 'list', but lacks an explicit statement about no side effects or modifications. Since no annotations are provided, the description carries full burden, and this is a minor omission.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that conveys the essential information without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
While the description mentions IDs and item counts, it does not specify the exact return format (e.g., array, object) or potential errors. Given the absence of an output schema, a bit more detail on the return structure would be helpful, but the current level is adequate for a simple list operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters, so the description correctly omits any parameter details. The schema is empty, and no additional explanation is needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists top-level mail folders with IDs and counts, and it distinguishes itself from sibling tools by focusing on folder enumeration rather than message operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly instructs to use the returned folder ID with list_messages or search_messages, providing clear when-to-use and how to chain with other tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_messagesList email messagesA
List messages from a mail folder (default: inbox), newest first by default. Supports date-range and read/unread filtering. Use list_folders first if you need a folder ID other than a well-known name like 'inbox', 'drafts', 'sentitems', 'archive', or 'junkemail'.
| Name | Required | Description | Default |
|---|---|---|---|
| top | No | Max messages to return (default 25, max 100). | |
| skip | No | Pagination offset. | |
| since | No | ISO 8601 date-time; only messages received on/after this. | |
| until | No | ISO 8601 date-time; only messages received on/before this. | |
| folder | No | Well-known folder name (inbox, drafts, sentitems, deleteditems, archive, junkemail, outbox) or a folder ID. Defaults to inbox. | |
| orderBy | No | Field to sort by (default receivedDateTime). | |
| unreadOnly | No | If true, only unread messages. If false, only read ones. | |
| orderDirection | No | Sort direction (default desc, i.e. newest first). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It does not explicitly state side effects or read-only nature, though listing is implicitly non-destructive. It lacks details on error handling or edge cases.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences, well-structured, and free of redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so return format is not required. The description covers main behavior and parameters, though it omits details like pagination mechanics beyond the parameters, but this is sufficient given the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All parameters are described in the schema, and the description adds helpful context about folder IDs and defaults, enhancing understanding beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the tool lists messages from a folder, specifies default folder and ordering, and distinguishes from siblings by focusing on listing instead of searching or getting individual messages.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit guidance to use list_folders when needing a folder ID, and mentions filtering capabilities, but does not explicitly compare with search_messages or get_message for when to use them.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_messagesSearch email messagesA
Full-text search across mail (subject, body, sender, recipients, attachments) using Microsoft Graph's $search, ranked by relevance. Optionally scope the search to one folder. For structured filtering (date ranges, read/unread) without free-text search, prefer list_messages instead.
| Name | Required | Description | Default |
|---|---|---|---|
| top | No | Max results to return (default 25, max 100). | |
| query | Yes | Free-text search query. | |
| folder | No | Optional well-known folder name or folder ID to restrict the search to. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the behavioral disclosure. It adds notable behaviors: full-text scope across fields, relevance ranking, optional folder scoping. It does not mention page limits, but the top parameter is documented. The description gives enough context for a search operation without contradicting any annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core function, and no redundancy. Every clause earns its place, making it an exemplar of concise tool documentation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a search tool with a simple parameter set and no output schema, the description covers the main functionality, adds an explicit alternative, and clarifies optional folder scoping. It omits pagination details, but the top parameter is documented in the schema, so the description is sufficiently complete for practical use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description adds context by noting 'Optionally scope the search to one folder,' giving extra meaning to the folder parameter. It does not elaborate on top or query beyond schema, but the added folder context justifies a 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it performs full-text search across mail fields (subject, body, sender, recipients, attachments) and specifies the ranking mechanism (relevance). It also distinguishes itself from sibling list_messages by contrasting free-text search against structured filtering, making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use (free-text search) and when not to (structured filtering without free-text) and names the preferred alternative (list_messages). This gives the agent clear decision-making guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
send_messageSend an emailA
Send a new email immediately from the signed-in mailbox. This sends right away — there is no confirmation step, so only call this once you (and the user, if appropriate) are sure about the recipients and content. Use create_draft instead if the message should be reviewed before sending.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | List of email addresses. | |
| to | Yes | List of email addresses. | |
| bcc | No | List of email addresses. | |
| body | Yes | Email body content. | |
| subject | Yes | Email subject line. | |
| bodyType | No | Content type of `body` (default text). | |
| saveToSentItems | No | Save a copy to Sent Items (default true). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, but the description discloses that sending is immediate and non-confirmatory: 'this sends right away — there is no confirmation step.' It also implies irreversibility by advising careful consideration. It does not mention failure handling or permissions, but it covers the core behavioral trait.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the purpose, and each sentence adds value: the first states the action, the second explains the immediate nature and gives an alternative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple send action with full schema and no output schema, the description covers the purpose, usage context, and behavioral nuance. It provides sufficient context for an agent to decide when to use this tool versus create_draft.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already describes all parameters with 100% coverage, so the description adds no additional parameter meaning. The description doesn't mention any parameter specifics, but the schema suffices.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the function: 'Send a new email immediately from the signed-in mailbox.' It distinguishes from sibling create_draft by referencing alternative usage, making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly provides when-not to use: 'Use create_draft instead if the message should be reviewed before sending.' It also advises certainty before calling: 'only call this once you (and the user, if appropriate) are sure about the recipients and content.'
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v1.0.0- First observed
create_draft - First observed
get_message - First observed
list_folders - First observed
list_messages - First observed
search_messages - First observed
send_message
TDQS
Scored across 6 tools
Most tools have clearly distinct purposes: listing, fetching, searching, folder enumeration, sending, and drafting. The only possible confusion is between list_messages and search_messages, but their descriptions clearly differentiate structured filtering from full-text relevance search.
All tool names follow a consistent verb_noun snake_case pattern: list_messages, get_message, search_messages, list_folders, send_message, create_draft. There are no style mixups or vague verbs.
Six tools is a well-scoped set for an Outlook mail server. Each tool covers a distinct core email operation without unnecessary bloat or missing essentials.
The tool surface covers the primary mail workflows: listing, searching, reading, sending, drafting, and folder navigation. Some common operations like reply, forward, delete, move, or updating drafts are absent, but the core read/send workflow is solid.
Maintenance
Related MCP Connectors
Email infrastructure for AI agents — send, receive, search, and reply to email over MCP.
MCP server for Nylas — read email, calendars, events and contacts, and send email or create events.
Your IMAP mailbox as an MCP server: read, search and (if you allow it) organize mail. Open source.
Your agent needs a mailbox of its own — to receive, thread, draft and send, with attachments, without borrowing your personal inbox or your company's SMTP. **What you can ask for** • "Create an inbox for this agent and tell me its address." • "Read the new messages in this thread and draft a reply." • "Send this message with the attachment and wait for the response." • "Search this inbox for everything from that domain." • "Show delivery metrics and the events on this inbox." **How to use it** Point any MCP client at https://mcp.aisa.one/mail/mcp and sign in with OAuth — there is no key to create or paste. 49 tools: create and delete inboxes, list and read messages, raw message bodies, attachments, threads, drafts and draft attachments, send and reply, message search, inbox events, metrics, and list entries — reads and writes. **Why this rather than the source** A real inbox an agent owns, rather than an SMTP credential it borrows from a human. **It is also a door to the rest** The same login reaches 26 sources and 580+ operations. Find the contact elsewhere in the catalogue, then write to them from here — without adding a second server. **What it costs** Finding and inspecting an operation is free. Running one is billed per call at API prices, with no seat and no monthly minimum, and every call takes max_price_usd so an agent cannot overspend by accident. **Where else it reaches** https://mcp.aisa.one/sales/mcp finds the person to write to.
Related MCP Servers
- AlicenseBqualityDmaintenanceA MCP server for Claude that reads Outlook emails its attachments through the Microsoft Graph API.619MIT
- FlicenseNot gradedqualityDmaintenanceA Python-based MCP server for Microsoft Outlook integration using Microsoft Graph API, enabling email reading/sending, calendar management, and contact operations through Claude Desktop.1-
- AlicenseNot gradedqualityDmaintenanceMCP server that enables Claude to manage Outlook emails, including reading, sending, organizing, drafting, and bulk operations via Microsoft Graph API.15 npm1MIT
- AlicenseAqualityDmaintenanceAn MCP server that gives Claude Code and Codex full control of a personal Outlook.com mailbox and calendar via the Microsoft Graph API, enabling mail, draft, folder, and calendar operations through natural language.312MIT