Skip to main content
Glama
protonmail-mcp

protonmail-mcp

by apexxapps

protonmail-mcp

Geben Sie Ihrem KI-Codierungsagenten Zugriff auf Ihre ProtonMail – suchen, lesen, entwerfen und senden – von Claude Code, Claude Desktop, Cursor oder einem beliebigen MCP-Client.

„Schau in mein Proton und sag mir, was ich heute erledigen muss.“ „Finde Sarahs letzte E-Mail und entwirf eine Antwort, dass Donnerstag um 14 Uhr passt – noch nicht senden.“

Da Proton Ende-zu-Ende-verschlüsselt ist, gibt es keine öffentliche Mail-API – dieses Tool spricht daher mit Proton Bridge, dem offiziellen lokalen Gateway, das Proton genau dafür bereitstellt. Alles bleibt auf 127.0.0.1; Ihre entschlüsselte Post verlässt nie Ihren Rechner, und nichts davon ist ein gehosteter Dienst.


Bevor Sie beginnen – die eine Voraussetzung

Sie benötigen Proton Bridge auf demselben Rechner.

  • Bridge erfordert einen kostenpflichtigen Proton-Tarif (Mail Plus / Proton Unlimited). Kostenlose Proton-Konten können Bridge nicht nutzen und daher auch nicht dieses Tool. Das ist eine Proton-Einschränkung, nicht unsere.

  • Bridge läuft auf macOS, Windows und Linux (headless über protonmail-bridge --cli auf Servern).

  • Bridge gibt jedem Konto seinen eigenen generierten IMAP/SMTP-Benutzernamen und ein eigenes Passwort – verwenden Sie diese hier, nicht Ihren normalen Proton-Login.

Related MCP server: ProtonMail MCP Server

Installation

# Claude Code — one line, no global install:
claude mcp add protonmail --scope user -- npx -y protonmail-mcp

Teilen Sie ihm dann mit, wie Bridge zu erreichen ist – entweder über Umgebungsvariablen oder eine Konfigurationsdatei.

Konfigurationsdatei (~/.config/protonmail-mcp/config.json):

{
  "user": "you@proton.me",
  "pass": "your-bridge-generated-password",
  "imapPort": 1143,
  "smtpPort": 1025
}

Oder Umgebungsvariablen: PROTONMAIL_USER, PROTONMAIL_PASS, PROTONMAIL_IMAP_PORT, PROTONMAIL_SMTP_PORT. (Kopieren Sie config.example.json, um alle Optionen zu sehen.)

Prüfen Sie, dass es funktioniert, bevor Sie es in einen Agenten einbinden:

npx protonmail-mcp doctor

Das verbindet sich mit Bridge, authentifiziert sich und listet Ihre Postfächer auf – so zeigt sich jedes Einrichtungsproblem hier mit einer klaren Meldung, anstatt mitten im Gespräch kryptisch zu scheitern.

Andere MCP-Clients

Jeder MCP-Client funktioniert – weisen Sie ihn über stdio auf den Befehl protonmail-mcp hin. Für einen JSON-Konfig-Client (Claude Desktop, Cursor, …):

{
  "mcpServers": {
    "protonmail": {
      "command": "npx",
      "args": ["-y", "protonmail-mcp"],
      "env": { "PROTONMAIL_USER": "you@proton.me", "PROTONMAIL_PASS": "…" }
    }
  }
}

Werkzeuge

Lesen (sicher – lassen Sie den Agenten diese ohne Einschränkung ausführen):

Werkzeug

Was es tut

list_mailboxes

Ordner/Labels auflisten

list_recent_mail

Neueste Nachrichten in einem Postfach (Zusammenfassungen)

get_unread_mail

Ungelesene Nachrichten (Zusammenfassungen)

search_mail

Suche nach Text / von / an / Betreff / Datumsbereich

get_message

Vollständige Nachricht per uid (zitierter Verlauf standardmäßig gekürzt)

Schreiben (Ihr MCP-Client sollte vor der Ausführung nachfragen):

Werkzeug

Was es tut

create_draft

Einen Entwurf speichern (sendet nie)

reply_to_message

Antwort im Thread – speichert standardmäßig einen Entwurf, send=true zum Senden

send_message

Sendet eine neue E-Mail sofort

mark_read / mark_unread

Lese-Flag umschalten

archive_message / move_message

Zwischen Ordnern verschieben

trash_message

In den Papierkorb verschieben (wiederherstellbar, bis geleert)

Setzen Sie "readOnly": true (oder PROTONMAIL_READONLY=1), um nur die Lese-Werkzeuge zu registrieren – eine harte Garantie, dass der Agent niemals senden, verschieben oder löschen kann, unabhängig von den Genehmigungseinstellungen des Clients.

Sicherheitsmodell

Die relevanten Schreib-Werkzeuge – send_message, trash_message und reply_to_message mit send=true – sind so benannt und beschrieben, dass die werkzeugbezogene Genehmigung Ihres MCP-Clients die natürliche Hürde darstellt; Lesevorgänge fragen nie nach. Bevorzugen Sie Entwerfen gegenüber Senden: Der Agent schreibt, Sie prüfen in Proton, Sie drücken auf Senden. Für einen unbeaufsichtigten/Headless-Betrieb verwenden Sie readOnly, und es gibt schlicht nichts Gefährliches zu genehmigen.

Auf Ihrem Telefon

Dies ist ein lokaler Server, daher ist er erreichbar, wo auch immer Ihr Agent ist. Koppeln Sie den Rechner mit BrainBoxx und Sie können das Ganze aus Ihrer Hosentasche erledigen – „schau in mein Proton und sag mir, was erledigt werden muss“ im Zug, Antworten bereits entworfen, wenn Sie nach Hause kommen.

So funktioniert es

MCP client (Claude Code / Cursor / …)
        │  MCP over stdio
        ▼
   protonmail-mcp   ──IMAP──►  127.0.0.1:1143  ┐
        │          ──SMTP──►  127.0.0.1:1025  ├─ Proton Bridge ──► Proton Mail
        └── clean JSON in, tool calls out       ┘   (local, TLS, your machine only)

Bridge präsentiert ein selbstsigniertes Zertifikat auf localhost (erwartet); dieses vertraut ihm standardmäßig für 127.0.0.1. Setzen Sie "allowSelfSigned": false, um die vollständige Überprüfung zu erzwingen, wenn Sie Bridge ein vertrauenswürdiges Zertifikat gegeben haben.

Lizenz

MIT © 2026 Simon Stark. Nicht verbunden mit oder unterstützt von Proton AG.

Available Tools

8 tools
create_draftA

Compose a new email and save it to Drafts. Does NOT send — you review and send it yourself in Proton. Can include local file attachments.

NameRequiredDescriptionDefault
ccNo
toYesRecipient address(es).
bccNo
bodyNoPlain-text body. Provide this OR html.
htmlNoHTML body for a formatted email. A plain-text alternative is generated automatically.
subjectYesSubject line.
attachmentsNoLocal file paths to attach — absolute, or relative to the working directory (e.g. "./report.pdf" from the project you're in). A leading ~ is expanded.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full behavioral burden. It discloses the most critical behavioral trait: this tool does not send, only saves a draft. It also mentions local file attachment support. However, it doesn't detail other behaviors such as whether a draft confirmation is returned or how drafts are stored, but the key non-sending distinction from send_message is covered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, each with a distinct purpose: the main action, the non-sending clarification, and the attachment capability. It is front-loaded with the primary function and contains no filler words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-parameter tool with no output schema and no annotations, the description covers the most important behavioral caveat (no sending) and the basic draft workflow. It does not explain return values, but that isn't required without an output schema. cc/bcc and html/body alternatives are left to the schema, which documents them adequately. Overall, it is complete for the core use case.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 71%, so the schema documents most parameters. The description adds minimal parameter-specific information beyond the schema—it only mentions 'local file attachments', which the schema already covers. cc and bcc lack descriptions in both the schema and the description, so there is no compensation for those gaps. Overall, the description adds little value for parameter understanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description uses a specific verb ('Compose'), names the resource ('new email'), and the action ('save it to Drafts'). The explicit 'Does NOT send' distinguishes it from send_message, and 'new email' distinguishes it from reply/forward tools. This gives clear differentiation from siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly states that after using this tool, the user reviews and sends the email manually in Proton, implying this tool is for draft creation rather than sending. It explicitly negates sending, which tells an agent when NOT to use it, but it doesn't name alternative tools like send_message. The workflow guidance is clear but not fully explicit about sibling selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

download_attachmentA

Save an attachment from a message to disk (into the configured download directory). Identify it by filename or 0-based index (from get_message); if the message has just one attachment, neither is needed. Returns the saved file path.

NameRequiredDescriptionDefault
uidYesThe message uid.
indexNo0-based attachment index (alternative to filename).
mailboxNoThe mailbox the uid belongs to (default "INBOX").
filenameNoThe attachment filename to save.

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral burden. It clearly discloses the disk-write side effect, the configured destination directory, and the return value. Minor omissions like overwrite behavior and permission requirements exist, but the core behavioral traits are transparently stated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three concise sentences front-load the primary action and destination, then provide identification rules and the return value. There is no repetition of schema details or wasted wording.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a straightforward four-parameter tool with no output schema, the description covers what the tool does, how to identify the target attachment, the special single-attachment case, and the returned saved file path. The schema handles the remaining parameter details, so nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already describes all four parameters at 100% coverage. The description adds valuable semantic relationships: filename and index are alternatives, and neither is needed for a single-attachment message. This goes beyond the schema's isolated parameter descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Save') with a clear resource ('an attachment from a message to disk'), making the tool's function immediately obvious. It also distinguishes itself from the sibling mail-handling tools by focusing on attachment persistence rather than message composition or search.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear practical context: identify the attachment by filename or 0-based index from get_message, and omit both when there is only one attachment. It does not explicitly name alternatives or exclusions, but the workflow guidance makes appropriate use clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

forwardA

Forward a message to new recipients, carrying its original attachments. Optional intro note via body. Sends immediately unless draft=true. Can add further local file attachments.

NameRequiredDescriptionDefault
toYesRecipient address(es) to forward to.
uidYesThe message to forward.
bodyNoAn optional plain-text note above the forwarded message.
htmlNoAn optional HTML note above the forwarded message.
draftNoSave to Drafts instead of sending (default false).
mailboxNoThe mailbox the uid belongs to (default "INBOX").
attachmentsNoLocal file paths to attach — absolute, or relative to the working directory (e.g. "./report.pdf" from the project you're in). A leading ~ is expanded.

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses the key side effect ('Sends immediately unless draft=true'), that original attachments are carried, and that additional local file attachments can be added. This is meaningful behavioral transparency, though it stops short of mentioning irreversibility or the exact return/response behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is only three sentences, each earning its place: core action, optional body note, and send-vs-draft plus extra attachments. It is front-loaded with the essential purpose and contains no redundant or filler language.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-parameter mutation tool with no output schema and no annotations, the description covers the essential decision-critical behavior: immediate send versus draft, preservation of original attachments, and the ability to add local files. The remaining details (mailbox semantics, return value) are adequately handled by the schema or are minor for this operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and each parameter already has a clear description. The description's references to 'intro note via body' and 'further local file attachments' merely restate what the schema already says, so it adds no new meaning beyond the structured definitions. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Forward a message to new recipients, carrying its original attachments.' This clearly differentiates forward from reply/reply_all (new recipients) and from send_message (carries the original message's attachments). The action and scope are unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the use case — forwarding an existing message to new recipients — but it never explicitly contrasts this with siblings like reply_all, create_draft, or send_message, nor does it state when not to use it. 'Sends immediately unless draft=true' gives operational context, not usage guidance among alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_messageA

Read one full message by uid (from a search result). Quoted reply history and signatures are trimmed by default for readability; pass full=true to keep everything. The result lists any attachments (name/type/size) — use download_attachment to save one.

NameRequiredDescriptionDefault
uidYesThe message uid from a search result.
fullNoKeep the entire body including quoted history (default false).
mailboxNoThe mailbox the uid belongs to (default "INBOX").

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the burden of disclosure. It reveals that quoted reply history and signatures are trimmed by default, that full=true retains them, and that the result lists attachments with name/type/size. This is useful behavioral context beyond the schema, though error handling and side effects are not covered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each earning its place: purpose, default behavior, and attachment handling with a pointer to the sibling tool. The core message is front-loaded and there is no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read tool with no output schema and no annotations, the description adequately explains the purpose, input origin, default trimming behavior, and attachment metadata in the result. It could be more explicit about what else the response contains (headers, subject) and about using search_mail first, but it leaves no ambiguity about how to invoke it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%: all three parameters already have descriptions. The description adds only minor framing (e.g., 'for readability' and 'to keep everything') but doesn't materially extend the schema semantics for uid, full, or mailbox.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Read') and resource ('one full message by uid'), and adds the origin context 'from a search result.' This clearly differentiates it from action-oriented siblings like reply, forward, and send_message, and no sibling duplicates this read operation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context: the message is read by uid obtained from a search result, indicating the agent should first use search_mail. It explicitly names download_attachment as the tool to use when an attachment needs to be saved, providing an alternative for a sub-task. It doesn't explicitly exclude other uses, but the context is strong.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

replyA

Reply to a message (to its sender), correctly threaded, quoting the original. Sends immediately unless draft=true (saves to Drafts for you to review). Can include local file attachments.

NameRequiredDescriptionDefault
uidYesThe message being replied to.
bodyNoPlain-text body. Provide this OR html.
htmlNoHTML body for a formatted email. A plain-text alternative is generated automatically.
draftNoSave to Drafts instead of sending (default false).
mailboxNoThe mailbox the uid belongs to (default "INBOX").
attachmentsNoLocal file paths to attach — absolute, or relative to the working directory (e.g. "./report.pdf" from the project you're in). A leading ~ is expanded.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It reveals key traits: sends immediately, supports draft mode for review, preserves threading/quoting, and allows local file attachments. This is meaningful behavioral context beyond the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences that front-load the core purpose before mentioning the draft behavior and attachments. Every sentence adds useful information without fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no annotations and no output schema, the description covers the essential behavioral aspects (send vs. draft, threading, quoting, attachments). The rich schema fills parameter details. Minor gaps like return values and mailbox semantics are not critical for an email reply tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all parameters. The description reinforces draft and attachments but does not add significant meaning beyond what the schema provides. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action: 'Reply to a message (to its sender)', which is specific and differentiates it from reply_all by singling out the sender. It also mentions 'correctly threaded, quoting the original', which further distinguishes it from forward.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context: use this tool to reply to a message's sender, and the draft parameter provides an alternative behavior. It does not explicitly mention sibling tools or exclusions, but the purpose statement makes the tool's primary use unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

reply_allA

Reply to a message and everyone on it (sender + all other recipients, excluding you), threaded and quoting the original. Sends immediately unless draft=true. Can include local file attachments.

NameRequiredDescriptionDefault
uidYesThe message being replied to.
bodyNoPlain-text body. Provide this OR html.
htmlNoHTML body for a formatted email. A plain-text alternative is generated automatically.
draftNoSave to Drafts instead of sending (default false).
mailboxNoThe mailbox the uid belongs to (default "INBOX").
attachmentsNoLocal file paths to attach — absolute, or relative to the working directory (e.g. "./report.pdf" from the project you're in). A leading ~ is expanded.

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of disclosing behavior. It explicitly states that the message is sent immediately unless draft=true, that it quotes the original, that it is threaded, and that local file attachments are supported. This gives an agent a strong mental model of the tool's side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact, front-loaded with the core purpose, and each sentence adds distinct value: first the recipient/thread/quote behavior, then the send/draft and attachment behavior. There is no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the essential behavior of the tool well, including side effects and key options. It is slightly incomplete in that it does not mention what return value or confirmation an agent should expect after sending, and no output schema exists to fill that gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all six parameters fully. The description adds some context around draft behavior and attachments, but it does not substantially extend parameter meaning beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a precise action: reply to a message and everyone on it, with the recipient scope explicitly defined as sender plus all other recipients excluding the user. It also clarifies threading and quoting behavior. This clearly distinguishes it from siblings like 'reply' and 'forward'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description makes the intended use clear by specifying the full recipient list and the immediate-send behavior unless draft=true. It does not explicitly name alternatives or say 'use reply for sender-only', but the recipient-scope language effectively implies when this tool is appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_mailA

Search email by any combination of free-text, sender, recipient, subject, and date range. With NO filters it returns your most recent inbox messages. Returns summaries (no body) newest first — use get_message with a result's uid to read the full text.

NameRequiredDescriptionDefault
toNoMatch a recipient.
fromNoMatch the sender (name or address substring).
limitNoMax results (default 20).
queryNoFree text to match in the message body.
sinceNoOnly messages on/after this date (ISO 8601, e.g. 2026-08-01).
beforeNoOnly messages before this date (ISO 8601).
unreadNoRestrict to unread messages.
mailboxNoMailbox to search (default "INBOX").
subjectNoMatch the subject.

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries the behavioral burden; it discloses that results are summaries, excludes bodies, and are ordered newest first. It does not cover auth/rate-limit/error behavior, but nothing in the description is misleading.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences front-load the search capability and then add the no-filter behavior and follow-up action. Every sentence contributes new information without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only search tool with fully documented optional parameters, the description covers invocation defaults, output shape, ordering, and how to get full content. No output schema exists, so the explicit summary/uid guidance is sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, giving a baseline of 3. The description adds value by stating filters can be combined arbitrarily and clarifying the no-filter default, which is not evident from the individual schema fields alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a concrete action — searching email — with the exact dimensions it searches: free-text, sender, recipient, subject, and date range. It also differentiates itself from get_message by noting it returns summaries, so an agent can select it correctly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit guidance on the no-filter case (returns recent inbox) and explicitly routes to get_message when full text is needed. This makes the boundary between search_mail and its retrieval sibling clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

send_messageA

Send a new email immediately. This goes out the moment it runs — the client should confirm first. To let a human review before sending, use create_draft instead. Can include local file attachments.

NameRequiredDescriptionDefault
ccNo
toYesRecipient address(es).
bccNo
bodyNoPlain-text body. Provide this OR html.
htmlNoHTML body for a formatted email. A plain-text alternative is generated automatically.
subjectYesSubject line.
attachmentsNoLocal file paths to attach — absolute, or relative to the working directory (e.g. "./report.pdf" from the project you're in). A leading ~ is expanded.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral burden. It clearly discloses that the email is sent irrevocably and immediately: 'This goes out the moment it runs — the client should confirm first.' It also notes local file attachments. It doesn't mention failure behavior or permissions, but the core irreversible side effect is well communicated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each earning its place: immediate behavior, user confirmation requirement, and the alternative tool. The most important operational fact—immediate sending—is front-loaded first.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a sending tool with no annotations and no output schema, the description covers the critical execution context: the action is immediate, irreversible in practice, and should be confirmed by the client. It also provides the sibling alternative. It doesn't describe return values or error conditions, but these are less critical for an email-send operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 71% and the schema already documents to, body, html, subject, and attachments. The description adds only that attachments are local files, which is slightly redundant with the schema. It does not clarify cc/bcc semantics, but those parameter names are reasonably self-explanatory. Overall the description adds minimal meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: 'Send a new email immediately.' It clearly distinguishes this from reply, forward, and draft tools by emphasizing 'new email' and 'immediately.' An agent can confidently identify what the tool does and how it differs from siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly tells the agent when not to use this tool: 'To let a human review before sending, use create_draft instead.' This is a direct, usable routing instruction that names the alternative and the condition that selects it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 8 tool updatesv0.1.13
    • First observedcreate_draft
    • First observeddownload_attachment
    • First observedforward
    • First observedget_message
    • First observedreply
    • First observedreply_all
    • First observedsearch_mail
    • First observedsend_message

TDQS

A4.2/5.0

Scored across 8 tools

Disambiguation4/5

Most tools are clearly distinct: search/get/download form a retrieval pipeline, and create_draft/send_message are explicitly contrasted. reply, reply_all, and forward could be confused, but their descriptions precisely define recipient behavior and threading.

Naming Consistency4/5

Most tools follow a clear verb_noun pattern like search_mail, get_message, download_attachment, create_draft, send_message. However, reply and forward are bare verbs, and reply_all mixes a verb with an adverb, creating minor inconsistency.

Tool Count5/5

Eight tools is a well-scoped set for an email-focused server. Each tool covers a distinct core email action without unnecessary redundancy or bloat.

Completeness4/5

The set covers search, read, download attachments, reply, reply-all, forward, draft, and send — the essential email workflows. Minor gaps like delete, move, or archive exist, but agents can handle common tasks end-to-end.

Maintenance

ActivityInactive
ResponsivenessNo recent community issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    D
    maintenance
    A read-only MCP server that connects to Proton Mail via Proton Bridge, enabling AI assistants to search, list, and read emails securely without leaving your machine.
    4
    19 npm
    1
    MIT
  • A
    license
    Not graded
    quality
    D
    maintenance
    An MCP server that connects to ProtonMail via Bridge, enabling AI assistants like Claude to manage your email.
    3
    MIT
  • F
    license
    Not graded
    quality
    B
    maintenance
    A lightweight MCP server providing AI agents a scoped, read-and-draft-only view into Proton Mail via Proton Bridge, with code-enforced restrictions preventing external access or sending.
    -
  • F
    license
    Not graded
    quality
    D
    maintenance
    A security-first MCP server that provides AI agents with a scoped, read-and-draft-only view into Proton Mail via Proton Bridge, ensuring no emails can be sent and access is restricted to configured workspaces.
    2
    -