MultiMail
MultiMail enables AI agents to send, receive, and manage emails through the Model Context Protocol (MCP). Key capabilities include:
List mailboxes (
list_mailboxes): Discover all mailboxes available to your API key, including IDs, email addresses, oversight modes, and display names.Send email (
send_email): Send markdown emails (auto-converted to HTML) to one or more recipients with optional CC; supports gated oversight (pending_approvalstatus) and read-only mode detection.Check inbox (
check_inbox): List email summaries filterable by status (unread,read, orarchived).Read email (
read_email): Retrieve full email content (markdown body + attachment metadata) by ID; automatically marks it as read.Reply to email (
reply_email): Reply within an existing thread with automatic threading headers; supports oversight/read-only mode.Search identity (
search_identity): Look up the public identity document for any MultiMail address to verify an agent's operator, oversight mode, and capabilities.Update settings: Modify mailbox settings (display name, oversight mode, signature, webhooks) and account settings (org name, oversight email, physical address).
Delete mailbox: Permanently delete a mailbox (requires admin scope).
Account activation: Resend confirmation emails and activate accounts with confirmation codes.
Works with Claude.ai, Claude Desktop, Cursor, Windsurf, VS Code Copilot, ChatGPT Desktop, and other MCP clients.
Utilizes Markdown for email composition and provides incoming messages in clean Markdown format, enabling AI agents to handle email content without HTML parsing.
@multimail/mcp-server
Your agent doesn't have email yet because nobody trusts it with email yet. MultiMail fixes that. A real email address with a trust ladder from read-only to fully autonomous, cryptographic identity on every message, and per-recipient sending controls.
Quick start
{
"mcpServers": {
"multimail": {
"type": "url",
"url": "https://mcp.multimail.dev/mcp"
}
}
}Remote server. No install. Authenticates via OAuth on first connect.
Works with Claude.ai, Claude Desktop, Claude Code, Cursor, Windsurf, Copilot (VS Code), ChatGPT Desktop, and any MCP client that supports remote servers.
Alternative: local stdio server
{
"mcpServers": {
"multimail": {
"command": "npx",
"args": ["-y", "@multimail/mcp-server"],
"env": {
"MULTIMAIL_API_KEY": "mm_live_...",
"MULTIMAIL_MAILBOX_ID": "01KJ1NHN8J..."
}
}
}
}Get a key at multimail.dev. Or run without one to create an account interactively.
Config file locations
Client | Config file |
Claude Code |
|
Claude Desktop |
|
Cursor |
|
Windsurf |
|
Copilot (VS Code) |
|
OpenCode |
|
ChatGPT Desktop | Settings > MCP Servers |
Related MCP server: MCP Email Server
Trust ladder
Every mailbox has an oversight mode. Start restrictive, graduate as the agent earns trust.
Mode | Behavior |
| Agent reads email. All sends blocked. |
| Every action requires human approval. |
| Outbound held for approval. Inbound immediate. (default) |
| Agent sends freely. Copies go to oversight address. |
| Full send/receive. No gates. |
Agents request upgrades via the API. The operator approves with a one-time code. Downgrades need no approval. The agent can always restrict itself.
The gated approval flow is formally verified in Lean 4. No email reaches delivery without passing through operator approval, for every possible code path.
Per-recipient allowlist
In gated_send mode, allowlisted recipients bypass the approval queue. Add exact addresses (vendor@example.com) or domain wildcards (*@example.com). Every addition requires operator email approval. The agent cannot self-approve allowlist changes.
The practical middle ground: routine correspondence with known contacts goes immediately, new recipients still require oversight.
Cryptographic identity
Every outbound email carries a signed X-MultiMail-Identity header (ECDSA P-256). The payload includes operator name, oversight mode, capabilities, and verification status. Recipients verify against the public key at GET /.well-known/multimail-signing-key.
A separate X-MultiMail-Reputation header links to privacy-preserving reputation data: bounce rates, complaint rates, account age. No raw addresses exposed.
Without verified identity, recipients cannot distinguish your agent from a spammer. With it, they can verify the operator, the oversight level, and the sending history before reading a word.
Agent DID relay (optional). If your agent has bound a did:key to its MultiMail account, pass an optional ucan parameter to send_email / reply_email. MultiMail relays your agent's self-signed UCAN verbatim in a separate X-Agent-Identity header (did="…"; ucan="…") — it does not sign or vouch for it; recipient tooling verifies the delegation independently. Inert unless a DID is bound.
Agent self-registration (auth.md)
Agents can register themselves without a browser. The protocol uses verified-email identity assertion, following the auth.md convention inspired by WorkOS AuthKit:
POST /agent/auth -> claim_token + OTP sent to operator email
POST /agent/auth/claim/complete -> API key + tenant_id + granted scopesDiscovery follows RFC 9728:
GET /.well-known/oauth-protected-resource(resource metadata)GET /.well-known/oauth-authorization-server(authorization metadata withagent_authextension)GET /auth.md(human/agent-readable registration guide)
The WWW-Authenticate header on 401 responses points agents to these endpoints automatically. An agent that hits a 401 can follow the link, read the registration protocol, and onboard itself.
Content scanning
Every outbound email is scanned before delivery. Emails enter pending_scan status, then transition to delivery or pending_send_approval (in gated modes). Inbound emails go through the same pipeline. Phishing, malware, and prompt injection patterns are flagged before reaching the agent's inbox.
How it works
Email bodies are markdown in, formatted HTML out. Inbound HTML arrives as clean markdown (15x fewer tokens than raw MIME).
Threading is automatic. Reply to an email and headers are set correctly.
Sends return
pending_scanwhile scanned. Gated mailboxes then transition topending_send_approvalfor human review. Do not retry.Every outbound email carries a cryptographically signed
X-MultiMail-Identityheader.Reputation data via
X-MultiMail-Reputationheader: bounce rates, complaint rates, account age. Privacy-preserving, updated daily.
Tools (50)
Tool | Description |
Core email | |
| Send email as markdown. Supports attachments, |
| List emails with filters: status, sender, subject, date range, direction, attachments, pagination. |
| Full email content. Trusted metadata and untrusted body returned as separate content blocks. |
| Reply in-thread. Threading headers set automatically. |
| All emails in a conversation thread with participants and metadata. |
| Download attachment as base64 with content type. |
| Cancel a pending or scheduled email. |
| Edit scheduled email before it sends. |
| Block until matching email arrives or timeout (max 120s). |
| Get all tags on an email. Persistent key-value agent memory across sessions. |
| Set tags on an email. Merges with existing tags. |
| Delete a specific tag key from an email. |
Oversight | |
| Emails awaiting oversight decision (requires oversight scope). |
| Approve or reject a pending email (requires oversight scope). |
| Request or apply oversight mode upgrade (action: request|apply). |
Sending allowlist | |
| List sending allowlist entries. |
| Add a recipient to the sending allowlist. Operator approval required. |
| Remove an allowlist entry. |
Mailbox management | |
| All mailboxes with ID, address, oversight mode, display name. |
| First-run setup: oversight mode, display name, CC/BCC, scheduling, signature. |
| Update settings (display name, oversight mode, signature, webhooks). |
| Create mailbox (admin scope + operator approval). |
| Permanently delete a mailbox (admin scope). |
Account & billing | |
| Account status, plan, quota, sending enabled, enforcement tier. |
| Update org name, oversight email, physical address. |
| Permanently delete account and all data (admin scope). |
| Quota and usage stats for the billing period. |
| Upgrade to paid plan (Builder $9/mo, Pro $29/mo, Scale $99/mo). |
| Cancel paid subscription, revert to starter at period end. |
| Stripe portal URL for self-service billing. |
Signup (no API key needed) | |
| ALTCHA proof-of-work challenge for account creation. |
| Create account with solved PoW challenge. |
| Resend activation email with new code. |
| Activate account using confirmation code. |
| Guided onboarding on the public /onboard endpoint. |
API keys & audit | |
| List all API keys (admin scope). |
| Create API key with scopes (admin + operator approval). |
| Revoke an API key (admin scope). |
| Account audit log (admin scope). |
Contacts & spam | |
| Search contacts by name or email. |
| Add a contact. |
| Delete a contact. |
| Report spam or clear spam status (action: report|clear). |
| Spam-flagged and quarantined emails. |
| List suppressed recipients with pagination. |
| Remove a recipient from the suppression list. |
Webhooks | |
| Create webhook for real-time email event notifications. |
| List all webhooks. |
| Delete a webhook. |
Meta | |
| Report a bug, site problem, or feature request. |
Example prompts
Find the most recent email from alice@example.com, summarize what she's asking,
then draft a reply saying I'll review this week. Don't send until I approve.Check my inbox and summarize the last 5 unread emails.
For each: sender, subject, time, and whether it needs action today.Review the pending approval queue. For each pending email: who it goes to,
the subject, risk factors, and whether to approve or reject.Show my current sending allowlist. Then add *@acme.com so emails to Acme skip approval.Environment variables
Variable | Required | Description |
| For stdio mode | Your API key ( |
| No | Default mailbox ID. If unset, pass |
| No | API base URL. Defaults to |
Also available
REST API:
https://api.multimail.dev(OpenAPI spec)CLI:
npx -y @mvanhorn/printing-press install multimail(every API endpoint as a shell command)SDKs: Python, Vercel AI SDK, LangChain, LlamaIndex, CrewAI, AutoGen
Development
npm install
npm run dev # Run with tsx
npm run build # Compile TypeScript
npm start # Run compiled versionLicense
MIT
By using MultiMail you agree to the Terms of Service and Acceptable Use Policy.
Available Tools
7 toolscheck_inboxAInspect
List emails in your inbox. Returns email summaries including id, from, to, subject, status, received_at, and has_attachments. Does NOT include the email body — call read_email with the email ID to get the full message content.
| Name | Required | Description | Default |
|---|---|---|---|
| status | No | Filter by email status (default: all) | |
| mailbox_id | No | Mailbox ID (uses MULTIMAIL_MAILBOX_ID env var if not provided) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It effectively describes the return format (email summaries with specific fields) and clarifies what is not included (email body), which is valuable context. However, it lacks details on potential behavioral traits like pagination, rate limits, authentication requirements, or error handling, leaving some gaps for a tool with no annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose in the first sentence, followed by essential details on return values and tool differentiation. Every sentence adds value—clarifying included fields, excluded content, and when to use alternatives—with no redundant or unnecessary information, making it highly efficient and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (listing emails with filtering), no annotations, and no output schema, the description does a good job by specifying the return format and tool differentiation. However, it could be more complete by mentioning potential limitations (e.g., pagination, default sorting) or error scenarios, which would help an agent use it more effectively in varied contexts.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 100%, so the schema already documents both parameters ('status' and 'mailbox_id') with descriptions and enum values. The description does not add any parameter-specific information beyond what the schema provides, such as default behaviors or usage examples. This meets the baseline of 3 for high schema coverage without additional param details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('List emails in your inbox') and resource ('emails'), distinguishing it from siblings like 'read_email' (which gets full content) and 'list_mailboxes' (which lists mailboxes rather than emails). It provides precise scope by mentioning what's included (summaries with specific fields) and what's excluded (email body).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use this tool ('List emails in your inbox') versus alternatives ('call read_email with the email ID to get the full message content'), providing clear guidance on tool selection. It differentiates from 'read_email' by specifying that this tool returns summaries only, not full content.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_mailboxesAInspect
List all mailboxes available to this API key. Returns each mailbox's ID, email address, oversight mode, and display name. Use this to discover your mailbox ID if MULTIMAIL_MAILBOX_ID is not set.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses what the tool returns ('Returns each mailbox's ID, email address, oversight mode, and display name'), which is valuable behavioral information. However, it doesn't mention potential limitations like pagination, rate limits, or authentication requirements, leaving some gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is perfectly concise with two sentences: the first states purpose and return values, the second provides usage guidance. Every word earns its place, and the structure is front-loaded with the core functionality.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (0 parameters, no annotations, no output schema), the description is quite complete. It explains what the tool does, what it returns, and when to use it. The only minor gap is the lack of output format details, but for a list operation this is acceptable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has 0 parameters with 100% schema description coverage, so the baseline would be 4. The description appropriately doesn't discuss parameters since there are none, which is correct and efficient.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('List all mailboxes') and resource ('available to this API key'), distinguishing it from sibling tools like check_inbox or read_email which operate on specific mailboxes rather than listing them. It provides a concrete purpose beyond just the tool name.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use this tool: 'Use this to discover your mailbox ID if MULTIMAIL_MAILBOX_ID is not set.' This provides clear guidance on the primary use case and distinguishes it from alternatives like check_inbox which require a mailbox ID.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_emailAInspect
Get the full content of a specific email, including the markdown body and attachment metadata. Automatically marks unread emails as read. Use the email ID from check_inbox results.
| Name | Required | Description | Default |
|---|---|---|---|
| email_id | Yes | The email ID to read | |
| mailbox_id | No | Mailbox ID (uses MULTIMAIL_MAILBOX_ID env var if not provided) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It effectively describes key behaviors: it retrieves email content and 'Automatically marks unread emails as read,' which is a critical side effect not obvious from the tool name. It lacks details on error handling or rate limits, but covers the main operational behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately sized and front-loaded, with three concise sentences that each add value: the first states the purpose, the second reveals a key behavioral trait, and the third provides usage guidance. There is no wasted text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (read operation with side effects), no annotations, and no output schema, the description is mostly complete. It covers purpose, behavior, and usage context, but lacks details on return values (e.g., structure of the response) and error conditions, which would be helpful for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both parameters ('email_id' and 'mailbox_id') fully. The description adds no additional parameter semantics beyond what the schema provides, such as format examples or usage tips, meeting the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('Get the full content'), resource ('a specific email'), and scope ('including the markdown body and attachment metadata'). It distinguishes from siblings like 'check_inbox' (which lists emails) and 'send_email' (which sends emails).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use this tool ('Use the email ID from check_inbox results'), establishing a workflow dependency. However, it does not explicitly state when not to use it or name alternatives (e.g., vs. 'search_identity' for finding emails).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
reply_emailAInspect
Reply to an email in its existing thread. Threading headers (In-Reply-To, References) are set automatically. The body is written in markdown. If the mailbox is in read_only mode, this returns a 403 error with upgrade instructions. If the mailbox uses gated oversight, the response status will be 'pending_approval' — the reply is queued for human review. Do not retry or resend when you see pending_approval.
| Name | Required | Description | Default |
|---|---|---|---|
| email_id | Yes | The email ID to reply to | |
| markdown | Yes | Reply body in markdown format | |
| cc | No | CC email addresses | |
| mailbox_id | No | Mailbox ID (uses MULTIMAIL_MAILBOX_ID env var if not provided) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden and does so well by disclosing key behavioral traits: automatic threading header handling, markdown body format, error responses (403 with upgrade instructions), and queuing behavior for gated oversight ('pending_approval' status). It does not cover all possible behaviors like rate limits or auth needs, but adds substantial context beyond basic functionality.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately sized and front-loaded, starting with the core purpose and then adding critical behavioral details. Every sentence adds value, such as error handling and status warnings, with no wasted words or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of an email reply tool with no annotations and no output schema, the description is mostly complete, covering purpose, usage context, and key behaviors. However, it lacks details on return values or success responses, which could be important for agent handling, preventing a perfect score.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters. The description does not add meaning beyond the schema, such as explaining parameter interactions or constraints. Baseline 3 is appropriate as the schema handles parameter documentation adequately.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('Reply to an email in its existing thread') and resource ('email'), distinguishing it from siblings like 'send_email' (new email) and 'read_email' (viewing). It specifies that threading headers are handled automatically, which adds precision.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for usage by mentioning error conditions (403 error for read-only mode, 'pending_approval' for gated oversight) and advising against retries in specific cases. However, it does not explicitly compare to alternatives like 'send_email' or state when not to use it, keeping it from a perfect score.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
resend_confirmationAInspect
Resend the operator anti-spam confirmation email. Use this if the account is stuck in 'pending_operator_confirmation' status because the original confirmation email was lost or filtered. Rate limited to 1 request per 5 minutes. Only works for unconfirmed accounts.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It effectively describes key behavioral traits: the rate limit ('Rate limited to 1 request per 5 minutes'), the precondition ('Only works for unconfirmed accounts'), and the specific use case (accounts stuck in pending_operator_confirmation). However, it doesn't mention error conditions or what happens after the email is resent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is perfectly concise with three sentences that each serve a distinct purpose: stating the action, providing usage context, and disclosing behavioral constraints. There is zero wasted text, and the most critical information (what the tool does) is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (administrative action with rate limits), no annotations, and no output schema, the description does a good job covering the essential context: purpose, usage conditions, and behavioral constraints. However, it doesn't describe what the tool returns or what happens after the email is sent, leaving some gaps in completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has 0 parameters with 100% schema description coverage, so the baseline would be 4. The description doesn't need to explain parameters, but it does implicitly confirm there are no required inputs by describing the tool's function without mentioning any parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('Resend the operator anti-spam confirmation email') and the resource it operates on (confirmation emails for accounts). It distinguishes this tool from siblings by focusing on a specific administrative function rather than general email operations like sending, reading, or searching.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use this tool ('if the account is stuck in pending_operator_confirmation status because the original confirmation email was lost or filtered') and when not to use it ('Only works for unconfirmed accounts'). This provides clear context and exclusions, though it doesn't name specific alternative tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_identityAInspect
Look up the public identity document for any MultiMail email address. Returns the agent's operator, oversight mode, capabilities, and whether the operator is verified. No authentication required. Use this to verify another agent's identity before sending sensitive information.
| Name | Required | Description | Default |
|---|---|---|---|
| address | Yes | The email address to look up (e.g. sandy@multimail.dev) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden and does well by disclosing key behavioral traits: it's a read-only lookup ('look up'), requires no authentication ('No authentication required'), and describes the return content. However, it doesn't mention potential errors, rate limits, or data freshness, leaving some gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is efficiently structured in two sentences: the first states purpose and returns, the second provides usage guidance. Every phrase adds value with zero waste, making it easy to parse and front-loaded with essential information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple lookup tool with 1 parameter and no output schema, the description is nearly complete: it covers purpose, usage, behavioral aspects, and return values. It lacks details on error cases or output structure, but given the low complexity, this is a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents the single 'address' parameter. The description adds no additional parameter details beyond implying it's for email addresses, which the schema's format already specifies. Baseline 3 is appropriate as the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('look up') and resource ('public identity document for any MultiMail email address'), specifying it returns operator, oversight mode, capabilities, and verification status. It distinguishes from siblings like check_inbox or send_email by focusing on identity verification rather than email operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly states when to use this tool ('to verify another agent's identity before sending sensitive information'), providing clear context for its application. While it doesn't name specific alternatives, the guidance is direct and actionable for the intended use case.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
send_emailAInspect
Send an email from your MultiMail address. The body is written in markdown and automatically converted to formatted HTML for delivery. If the mailbox is in read_only mode, this returns a 403 error with upgrade instructions — use request-upgrade to ask the operator for more autonomy. If the mailbox uses gated oversight, the response status will be 'pending_approval' — this means the email is queued for human review. Do not retry or resend when you see pending_approval.
| Name | Required | Description | Default |
|---|---|---|---|
| to | Yes | Recipient email addresses | |
| subject | Yes | Email subject line | |
| markdown | Yes | Email body in markdown format | |
| cc | No | CC email addresses | |
| mailbox_id | No | Mailbox ID (uses MULTIMAIL_MAILBOX_ID env var if not provided) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It excellently describes multiple behavioral traits: markdown-to-HTML conversion, error handling for read_only mode (403 with upgrade instructions), and gated oversight behavior (pending_approval status with no-retry policy). This provides comprehensive behavioral context beyond basic functionality.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is efficiently structured with three sentences, each serving a distinct purpose: core functionality, error handling, and approval workflow. There's zero wasted language, and critical information is front-loaded about the main sending functionality before detailing edge cases.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations and no output schema, the description provides exceptional completeness. It covers the core functionality, input format (markdown), error scenarios (403, pending_approval), and behavioral constraints (no retry). This gives the agent sufficient context to use the tool correctly despite the lack of structured metadata.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 100%, so the baseline is 3. The description doesn't add specific parameter semantics beyond what's in the schema, though it does mention markdown format for the body which aligns with the schema's 'markdown' parameter description. No additional parameter context is provided.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('send an email'), identifies the resource ('from your MultiMail address'), and distinguishes it from siblings like 'reply_email' or 'check_inbox' by focusing on sending new emails. It provides additional context about markdown conversion that further clarifies its unique function.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly provides when-to-use guidance by mentioning the 'read_only mode' scenario (returns 403 error) and directing users to 'use request-upgrade' as an alternative. It also explains the 'pending_approval' status for gated oversight mailboxes and explicitly states 'Do not retry or resend' in that case, providing clear usage boundaries.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
TDQS
Each tool has a distinct and clearly defined purpose with no overlap. For example, check_inbox lists emails, read_email retrieves full content, send_email and reply_email handle different sending actions, and search_identity serves a unique verification function. The descriptions explicitly differentiate tools, preventing agent misselection.
All tool names follow a consistent verb_noun pattern using snake_case, such as check_inbox, list_mailboxes, and send_email. This uniformity makes the tool set predictable and easy to navigate, with no deviations in naming conventions.
With 7 tools, the server is well-scoped for email management, covering core operations like reading, sending, replying, searching, and administrative tasks. Each tool serves a necessary function without redundancy, fitting the domain appropriately.
The tool set covers essential email workflows including inbox checking, reading, sending, replying, identity verification, and administrative actions. A minor gap exists in lacking explicit tools for deleting emails or managing attachments beyond metadata, but agents can work around this with the provided operations.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Hosted email for AI agents: create inboxes, send, receive, and reply over MCP with scoped API keys
Hosted email MCP for AI agents with inboxes, send/receive, memory, recovery, and credits.
Email infrastructure for AI agents — send, receive, search, and reply to email over MCP.
Email inboxes for AI agents: send, receive, reply, search, and manage threaded email over MCP.
Related MCP Servers
- AlicenseNot gradedqualityFmaintenanceServer for Gmail integration in Claude Desktop with auto authentication support. This server enables AI assistants to manage Gmail through natural language interactions.20,6271,165MIT
- AlicenseAqualityAmaintenanceProvides IMAP and SMTP capabilities, enabling developers to manage email services with seamless integration and automated workflows.15320BSD 3-Clause
- AlicenseAqualityAmaintenanceA simple MCP server that enables users to send emails using Resend's API, integrating with tools like Cursor and Claude Desktop for seamless email composition and delivery.10221,862566MIT
- -licenseCqualityCmaintenanceGives on-the-fly inboxes to AI agents. Agents / LLM's can send, receive, and take action in isolated inboxes. Built for AI unlike Gmail. Check us out at agentmail.to1092
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/multimail-dev/mcp-server'
If you have feedback or need assistance with the MCP directory API, please join our Discord server