protonmail-mcp
protonmail-mcp
Предоставьте вашему ИИ-агенту для программирования доступ к вашему ProtonMail — поиск, чтение, черновики и отправка — из Claude Code, Claude Desktop, Cursor или любого MCP клиента.
«Проверь мой Proton и скажи, с чем мне нужно разобраться сегодня». «Найди последнее письмо Сары и подготовь ответ: четверг в 14:00 подходит — пока не отправляй».
Поскольку Proton использует сквозное шифрование, публичного почтового API нет — поэтому этот инструмент общается с Proton Bridge, официальным локальным шлюзом, который Proton предоставляет именно для этого. Всё остаётся на 127.0.0.1; ваша расшифрованная почта никогда не покидает вашу машину, и здесь нет никакого облачного сервиса.
Прежде чем начать — единственное требование
Вам нужен Proton Bridge, запущенный на той же машине.
Bridge требует платного тарифа Proton (Mail Plus / Proton Unlimited). Бесплатные аккаунты Proton не могут использовать Bridge, а значит, не могут использовать и этот инструмент. Это ограничение Proton, а не наше.
Bridge работает на macOS, Windows и Linux (на серверах — без графического интерфейса через
protonmail-bridge --cli).Bridge выдаёт для каждого аккаунта собственные сгенерированные имя пользователя и пароль IMAP/SMTP — здесь нужно использовать именно их, а не обычный логин Proton.
Related MCP server: ProtonMail MCP Server
Установка
# Claude Code — one line, no global install:
claude mcp add protonmail --scope user -- npx -y protonmail-mcpЗатем укажите ему, как подключиться к Bridge — через переменные окружения или файл конфигурации.
Файл конфигурации (~/.config/protonmail-mcp/config.json):
{
"user": "you@proton.me",
"pass": "your-bridge-generated-password",
"imapPort": 1143,
"smtpPort": 1025
}Или переменные окружения: PROTONMAIL_USER, PROTONMAIL_PASS, PROTONMAIL_IMAP_PORT, PROTONMAIL_SMTP_PORT. (Скопируйте config.example.json, чтобы получить полный набор параметров.)
Проверьте, что всё работает, прежде чем подключать его к агенту:
npx protonmail-mcp doctorЭта команда подключается к Bridge, выполняет аутентификацию и выводит список ваших почтовых ящиков — так любая проблема с настройкой проявится здесь в виде понятного сообщения, а не загадочной ошибки посреди разговора.
Другие MCP-клиенты
Подойдёт любой MCP-клиент — укажите ему команду protonmail-mcp через stdio. Для клиента с JSON-конфигурацией (Claude Desktop, Cursor, …):
{
"mcpServers": {
"protonmail": {
"command": "npx",
"args": ["-y", "protonmail-mcp"],
"env": { "PROTONMAIL_USER": "you@proton.me", "PROTONMAIL_PASS": "…" }
}
}
}Инструменты
Чтение (безопасно — разрешите агенту выполнять их свободно):
Инструмент | Что делает |
| Список папок и меток |
| Последние сообщения в почтовом ящике (краткие сводки) |
| Непрочитанные сообщения (краткие сводки) |
| Поиск по тексту / отправителю / получателю / теме / диапазону дат |
| Полное сообщение по uid (цитируемая история обрезается по умолчанию) |
Запись (ваш MCP-клиент должен спрашивать разрешение перед выполнением):
Инструмент | Что делает |
| Сохранить черновик (не отправляет) |
| Ответ в треде — по умолчанию сохраняет черновик, |
| Отправить новое письмо немедленно |
| Переключить флаг прочитано/не прочитано |
| Перемещение между папками |
| Переместить в Корзину (можно восстановить, пока не очищена) |
Установите "readOnly": true (или PROTONMAIL_READONLY=1), чтобы зарегистрировать только инструменты чтения — это жёсткая гарантия, что агент никогда не сможет отправить, переместить или удалить письма, независимо от настроек подтверждения в клиенте.
Модель безопасности
Значимые инструменты записи — send_message, trash_message и reply_to_message с send=true — названы и описаны так, что естественным барьером становится подтверждение каждого инструмента в вашем MCP-клиенте; операции чтения никогда не запрашивают подтверждения. Предпочитайте черновики отправке: агент пишет, вы проверяете в Proton, вы нажимаете «Отправить». Для работы в автоматическом режиме без графического интерфейса запустите readOnly — и одобрять будет просто нечего.
На телефоне
Это локальный сервер, поэтому он доступен везде, где находится ваш агент. Свяжите машину с BrainBoxx — и вы сможете делать всё это прямо с телефона: «проверь мой Proton и скажи, что требует внимания» в поезде, а ответы уже будут в черновиках к тому времени, как вы доберётесь до дома.
Как это работает
MCP client (Claude Code / Cursor / …)
│ MCP over stdio
▼
protonmail-mcp ──IMAP──► 127.0.0.1:1143 ┐
│ ──SMTP──► 127.0.0.1:1025 ├─ Proton Bridge ──► Proton Mail
└── clean JSON in, tool calls out ┘ (local, TLS, your machine only)Bridge предъявляет самоподписанный сертификат на localhost (это ожидаемо); инструмент доверяет ему по умолчанию для 127.0.0.1. Установите "allowSelfSigned": false, чтобы включить полную проверку, если вы предоставили Bridge доверенный сертификат.
Лицензия
MIT © 2026 Simon Stark. Не аффилирован с Proton AG и не одобрен ею.
Available Tools
8 toolscreate_draftA
Compose a new email and save it to Drafts. Does NOT send — you review and send it yourself in Proton. Can include local file attachments.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | ||
| to | Yes | Recipient address(es). | |
| bcc | No | ||
| body | No | Plain-text body. Provide this OR html. | |
| html | No | HTML body for a formatted email. A plain-text alternative is generated automatically. | |
| subject | Yes | Subject line. | |
| attachments | No | Local file paths to attach — absolute, or relative to the working directory (e.g. "./report.pdf" from the project you're in). A leading ~ is expanded. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral burden. It discloses the most critical behavioral trait: this tool does not send, only saves a draft. It also mentions local file attachment support. However, it doesn't detail other behaviors such as whether a draft confirmation is returned or how drafts are stored, but the key non-sending distinction from send_message is covered.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, each with a distinct purpose: the main action, the non-sending clarification, and the attachment capability. It is front-loaded with the primary function and contains no filler words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 7-parameter tool with no output schema and no annotations, the description covers the most important behavioral caveat (no sending) and the basic draft workflow. It does not explain return values, but that isn't required without an output schema. cc/bcc and html/body alternatives are left to the schema, which documents them adequately. Overall, it is complete for the core use case.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 71%, so the schema documents most parameters. The description adds minimal parameter-specific information beyond the schema—it only mentions 'local file attachments', which the schema already covers. cc and bcc lack descriptions in both the schema and the description, so there is no compensation for those gaps. Overall, the description adds little value for parameter understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses a specific verb ('Compose'), names the resource ('new email'), and the action ('save it to Drafts'). The explicit 'Does NOT send' distinguishes it from send_message, and 'new email' distinguishes it from reply/forward tools. This gives clear differentiation from siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly states that after using this tool, the user reviews and sends the email manually in Proton, implying this tool is for draft creation rather than sending. It explicitly negates sending, which tells an agent when NOT to use it, but it doesn't name alternative tools like send_message. The workflow guidance is clear but not fully explicit about sibling selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
download_attachmentA
Save an attachment from a message to disk (into the configured download directory). Identify it by filename or 0-based index (from get_message); if the message has just one attachment, neither is needed. Returns the saved file path.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | The message uid. | |
| index | No | 0-based attachment index (alternative to filename). | |
| mailbox | No | The mailbox the uid belongs to (default "INBOX"). | |
| filename | No | The attachment filename to save. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral burden. It clearly discloses the disk-write side effect, the configured destination directory, and the return value. Minor omissions like overwrite behavior and permission requirements exist, but the core behavioral traits are transparently stated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three concise sentences front-load the primary action and destination, then provide identification rules and the return value. There is no repetition of schema details or wasted wording.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a straightforward four-parameter tool with no output schema, the description covers what the tool does, how to identify the target attachment, the special single-attachment case, and the returned saved file path. The schema handles the remaining parameter details, so nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already describes all four parameters at 100% coverage. The description adds valuable semantic relationships: filename and index are alternatives, and neither is needed for a single-attachment message. This goes beyond the schema's isolated parameter descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Save') with a clear resource ('an attachment from a message to disk'), making the tool's function immediately obvious. It also distinguishes itself from the sibling mail-handling tools by focusing on attachment persistence rather than message composition or search.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear practical context: identify the attachment by filename or 0-based index from get_message, and omit both when there is only one attachment. It does not explicitly name alternatives or exclusions, but the workflow guidance makes appropriate use clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
forwardA
Forward a message to new recipients, carrying its original attachments. Optional intro note via body. Sends immediately unless draft=true. Can add further local file attachments.
| Name | Required | Description | Default |
|---|---|---|---|
| to | Yes | Recipient address(es) to forward to. | |
| uid | Yes | The message to forward. | |
| body | No | An optional plain-text note above the forwarded message. | |
| html | No | An optional HTML note above the forwarded message. | |
| draft | No | Save to Drafts instead of sending (default false). | |
| mailbox | No | The mailbox the uid belongs to (default "INBOX"). | |
| attachments | No | Local file paths to attach — absolute, or relative to the working directory (e.g. "./report.pdf" from the project you're in). A leading ~ is expanded. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses the key side effect ('Sends immediately unless draft=true'), that original attachments are carried, and that additional local file attachments can be added. This is meaningful behavioral transparency, though it stops short of mentioning irreversibility or the exact return/response behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is only three sentences, each earning its place: core action, optional body note, and send-vs-draft plus extra attachments. It is front-loaded with the essential purpose and contains no redundant or filler language.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 7-parameter mutation tool with no output schema and no annotations, the description covers the essential decision-critical behavior: immediate send versus draft, preservation of original attachments, and the ability to add local files. The remaining details (mailbox semantics, return value) are adequately handled by the schema or are minor for this operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and each parameter already has a clear description. The description's references to 'intro note via body' and 'further local file attachments' merely restate what the schema already says, so it adds no new meaning beyond the structured definitions. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Forward a message to new recipients, carrying its original attachments.' This clearly differentiates forward from reply/reply_all (new recipients) and from send_message (carries the original message's attachments). The action and scope are unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the use case — forwarding an existing message to new recipients — but it never explicitly contrasts this with siblings like reply_all, create_draft, or send_message, nor does it state when not to use it. 'Sends immediately unless draft=true' gives operational context, not usage guidance among alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_messageA
Read one full message by uid (from a search result). Quoted reply history and signatures are trimmed by default for readability; pass full=true to keep everything. The result lists any attachments (name/type/size) — use download_attachment to save one.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | The message uid from a search result. | |
| full | No | Keep the entire body including quoted history (default false). | |
| mailbox | No | The mailbox the uid belongs to (default "INBOX"). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the burden of disclosure. It reveals that quoted reply history and signatures are trimmed by default, that full=true retains them, and that the result lists attachments with name/type/size. This is useful behavioral context beyond the schema, though error handling and side effects are not covered.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each earning its place: purpose, default behavior, and attachment handling with a pointer to the sibling tool. The core message is front-loaded and there is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read tool with no output schema and no annotations, the description adequately explains the purpose, input origin, default trimming behavior, and attachment metadata in the result. It could be more explicit about what else the response contains (headers, subject) and about using search_mail first, but it leaves no ambiguity about how to invoke it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%: all three parameters already have descriptions. The description adds only minor framing (e.g., 'for readability' and 'to keep everything') but doesn't materially extend the schema semantics for uid, full, or mailbox.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Read') and resource ('one full message by uid'), and adds the origin context 'from a search result.' This clearly differentiates it from action-oriented siblings like reply, forward, and send_message, and no sibling duplicates this read operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: the message is read by uid obtained from a search result, indicating the agent should first use search_mail. It explicitly names download_attachment as the tool to use when an attachment needs to be saved, providing an alternative for a sub-task. It doesn't explicitly exclude other uses, but the context is strong.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
replyA
Reply to a message (to its sender), correctly threaded, quoting the original. Sends immediately unless draft=true (saves to Drafts for you to review). Can include local file attachments.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | The message being replied to. | |
| body | No | Plain-text body. Provide this OR html. | |
| html | No | HTML body for a formatted email. A plain-text alternative is generated automatically. | |
| draft | No | Save to Drafts instead of sending (default false). | |
| mailbox | No | The mailbox the uid belongs to (default "INBOX"). | |
| attachments | No | Local file paths to attach — absolute, or relative to the working directory (e.g. "./report.pdf" from the project you're in). A leading ~ is expanded. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It reveals key traits: sends immediately, supports draft mode for review, preserves threading/quoting, and allows local file attachments. This is meaningful behavioral context beyond the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences that front-load the core purpose before mentioning the draft behavior and attachments. Every sentence adds useful information without fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no annotations and no output schema, the description covers the essential behavioral aspects (send vs. draft, threading, quoting, attachments). The rich schema fills parameter details. Minor gaps like return values and mailbox semantics are not critical for an email reply tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters. The description reinforces draft and attachments but does not add significant meaning beyond what the schema provides. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: 'Reply to a message (to its sender)', which is specific and differentiates it from reply_all by singling out the sender. It also mentions 'correctly threaded, quoting the original', which further distinguishes it from forward.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: use this tool to reply to a message's sender, and the draft parameter provides an alternative behavior. It does not explicitly mention sibling tools or exclusions, but the purpose statement makes the tool's primary use unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
reply_allA
Reply to a message and everyone on it (sender + all other recipients, excluding you), threaded and quoting the original. Sends immediately unless draft=true. Can include local file attachments.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | The message being replied to. | |
| body | No | Plain-text body. Provide this OR html. | |
| html | No | HTML body for a formatted email. A plain-text alternative is generated automatically. | |
| draft | No | Save to Drafts instead of sending (default false). | |
| mailbox | No | The mailbox the uid belongs to (default "INBOX"). | |
| attachments | No | Local file paths to attach — absolute, or relative to the working directory (e.g. "./report.pdf" from the project you're in). A leading ~ is expanded. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of disclosing behavior. It explicitly states that the message is sent immediately unless draft=true, that it quotes the original, that it is threaded, and that local file attachments are supported. This gives an agent a strong mental model of the tool's side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact, front-loaded with the core purpose, and each sentence adds distinct value: first the recipient/thread/quote behavior, then the send/draft and attachment behavior. There is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the essential behavior of the tool well, including side effects and key options. It is slightly incomplete in that it does not mention what return value or confirmation an agent should expect after sending, and no output schema exists to fill that gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all six parameters fully. The description adds some context around draft behavior and attachments, but it does not substantially extend parameter meaning beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a precise action: reply to a message and everyone on it, with the recipient scope explicitly defined as sender plus all other recipients excluding the user. It also clarifies threading and quoting behavior. This clearly distinguishes it from siblings like 'reply' and 'forward'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description makes the intended use clear by specifying the full recipient list and the immediate-send behavior unless draft=true. It does not explicitly name alternatives or say 'use reply for sender-only', but the recipient-scope language effectively implies when this tool is appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_mailA
Search email by any combination of free-text, sender, recipient, subject, and date range. With NO filters it returns your most recent inbox messages. Returns summaries (no body) newest first — use get_message with a result's uid to read the full text.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Match a recipient. | |
| from | No | Match the sender (name or address substring). | |
| limit | No | Max results (default 20). | |
| query | No | Free text to match in the message body. | |
| since | No | Only messages on/after this date (ISO 8601, e.g. 2026-08-01). | |
| before | No | Only messages before this date (ISO 8601). | |
| unread | No | Restrict to unread messages. | |
| mailbox | No | Mailbox to search (default "INBOX"). | |
| subject | No | Match the subject. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the behavioral burden; it discloses that results are summaries, excludes bodies, and are ordered newest first. It does not cover auth/rate-limit/error behavior, but nothing in the description is misleading.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences front-load the search capability and then add the no-filter behavior and follow-up action. Every sentence contributes new information without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only search tool with fully documented optional parameters, the description covers invocation defaults, output shape, ordering, and how to get full content. No output schema exists, so the explicit summary/uid guidance is sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, giving a baseline of 3. The description adds value by stating filters can be combined arbitrarily and clarifying the no-filter default, which is not evident from the individual schema fields alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a concrete action — searching email — with the exact dimensions it searches: free-text, sender, recipient, subject, and date range. It also differentiates itself from get_message by noting it returns summaries, so an agent can select it correctly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit guidance on the no-filter case (returns recent inbox) and explicitly routes to get_message when full text is needed. This makes the boundary between search_mail and its retrieval sibling clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
send_messageA
Send a new email immediately. This goes out the moment it runs — the client should confirm first. To let a human review before sending, use create_draft instead. Can include local file attachments.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | ||
| to | Yes | Recipient address(es). | |
| bcc | No | ||
| body | No | Plain-text body. Provide this OR html. | |
| html | No | HTML body for a formatted email. A plain-text alternative is generated automatically. | |
| subject | Yes | Subject line. | |
| attachments | No | Local file paths to attach — absolute, or relative to the working directory (e.g. "./report.pdf" from the project you're in). A leading ~ is expanded. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral burden. It clearly discloses that the email is sent irrevocably and immediately: 'This goes out the moment it runs — the client should confirm first.' It also notes local file attachments. It doesn't mention failure behavior or permissions, but the core irreversible side effect is well communicated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each earning its place: immediate behavior, user confirmation requirement, and the alternative tool. The most important operational fact—immediate sending—is front-loaded first.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a sending tool with no annotations and no output schema, the description covers the critical execution context: the action is immediate, irreversible in practice, and should be confirmed by the client. It also provides the sibling alternative. It doesn't describe return values or error conditions, but these are less critical for an email-send operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 71% and the schema already documents to, body, html, subject, and attachments. The description adds only that attachments are local files, which is slightly redundant with the schema. It does not clarify cc/bcc semantics, but those parameter names are reasonably self-explanatory. Overall the description adds minimal meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'Send a new email immediately.' It clearly distinguishes this from reply, forward, and draft tools by emphasizing 'new email' and 'immediately.' An agent can confidently identify what the tool does and how it differs from siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly tells the agent when not to use this tool: 'To let a human review before sending, use create_draft instead.' This is a direct, usable routing instruction that names the alternative and the condition that selects it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
8 tool updates
v0.1.13- First observed
create_draft - First observed
download_attachment - First observed
forward - First observed
get_message - First observed
reply - First observed
reply_all - First observed
search_mail - First observed
send_message
TDQS
Scored across 8 tools
Most tools are clearly distinct: search/get/download form a retrieval pipeline, and create_draft/send_message are explicitly contrasted. reply, reply_all, and forward could be confused, but their descriptions precisely define recipient behavior and threading.
Most tools follow a clear verb_noun pattern like search_mail, get_message, download_attachment, create_draft, send_message. However, reply and forward are bare verbs, and reply_all mixes a verb with an adverb, creating minor inconsistency.
Eight tools is a well-scoped set for an email-focused server. Each tool covers a distinct core email action without unnecessary redundancy or bloat.
The set covers search, read, download attachments, reply, reply-all, forward, draft, and send — the essential email workflows. Minor gaps like delete, move, or archive exist, but agents can handle common tasks end-to-end.
Maintenance
Related MCP Connectors
MCP server that gives your AI agent its own email inbox (Pidgeon).
Email infrastructure for AI agents — send, receive, search, and reply to email over MCP.
Email safety MCP server. Detects phishing, prompt injection, CEO fraud for AI agents.
Email inboxes for AI agents: send, receive, reply, search, and manage threaded email over MCP.
Related MCP Servers
- AlicenseAqualityDmaintenanceA read-only MCP server that connects to Proton Mail via Proton Bridge, enabling AI assistants to search, list, and read emails securely without leaving your machine.422 npm1MIT
- AlicenseNot gradedqualityFmaintenanceAn MCP server that connects to ProtonMail via Bridge, enabling AI assistants like Claude to manage your email.3MIT
- FlicenseNot gradedqualityBmaintenanceA lightweight MCP server providing AI agents a scoped, read-and-draft-only view into Proton Mail via Proton Bridge, with code-enforced restrictions preventing external access or sending.-
- FlicenseNot gradedqualityCmaintenanceA security-first MCP server that provides AI agents with a scoped, read-and-draft-only view into Proton Mail via Proton Bridge, ensuring no emails can be sent and access is restricted to configured workspaces.1-