Apple Mail MCP

Overview Schema Source Related Servers Discussions Admin

save_attachment

Destructive

Save a single email attachment from Apple Mail to the restricted attachments folder, optionally choosing a subfolder or overwrite with confirmation; paths outside the folder are refused.

Instructions

Save one attachment to disk, inside the attachments folder.

Files can only be written inside the attachments folder (APPLE_MAIL_MCP_ATTACHMENTS_DIR, default ~/Downloads/apple-mail-mcp). Paths outside it are refused. The attachment's filename comes from the sender and is cleaned (no path separators, no leading dots); the result reports both name (as saved) and original_name.

Args: account, mailbox, id: As returned by search_messages. index: 1-based index from list_attachments. target_dir: Optional subfolder. Relative paths are taken relative to the attachments folder; absolute paths must be inside it. Default: the folder itself. Created if missing. overwrite: If false (default), append " (2)", " (3)" etc. when the name is taken. True replaces existing files and requires confirm=true. confirm: Required with overwrite=true. Get the user's approval first.

Returns {saved_path, name, original_name, size, downloaded}.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "account": "<account>",
      "mailbox": "<mailbox>",
      "id": "<id>",
      "index": "<index>"
    },
    "name": "save_attachment"
  }
}

Input Schema

Name	Required	Description	Default
`id`	Yes
`index`	Yes
`account`	Yes
`confirm`	No
`mailbox`	Yes
`overwrite`	No
`target_dir`	No

Schema Changelog

Changes observed during successful MCP inspections.

First observedv0.2.0Nov 9, 2026

TDQS

A4.7/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare a destructive, non-idempotent write, and the description adds real context beyond them: the path sandbox (APPLE_MAIL_MCP_ATTACHMENTS_DIR, default ~/Downloads/apple-mail-mcp, absolute paths refused), filename sanitization from untrusted sender input, the overwrite suffix behavior, and the confirm gate. It also discloses the return keys, so the agent knows what it gets back.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose is front-loaded, then constraints, then args, then returns – a sensible order with no filler. There is minor redundancy as the folder-restriction rule is stated twice (parenthetical env var plus 'Paths outside it are refused'), which barely costs the reader.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-parameter write tool with no output schema and no annotation detail on permissions, the description covers everything an agent needs: the sandbox boundary, the confirm/overwrite interaction, filename handling, and the return shape. Nothing material is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description carries the full burden and does: it explains the provenance of account/mailbox/id/index, the relative-vs-absolute resolution and auto-creation for target_dir, the default suffixing for overwrite, and the dependency that confirm is required when overwrite=true. That is meaning no bare schema field name conveys.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

First sentence states a specific verb ('Save'), resource ('one attachment'), and destination constraint ('inside the attachments folder'). The singular 'one attachment' also implicitly separates it from save_all_attachments without needing to name it.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The Args block gives real workflow context by pointing at sibling tools for obtaining inputs ('As returned by search_messages', '1-based index from list_attachments'), which tells an agent how to reach this call. It never explicitly says when not to use it or names save_all_attachments as the batch alternative, so exclusions are left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server