apple-mail-mcp
✉️ apple-mail-mcp
Tu Apple Mail, totalmente operativo por agentes.
Se ejecuta localmente en tu Mac. Abre el almacén de Mail en modo solo lectura, devuelve solo lo que un cliente pide y envía solo cuando el cliente llama explícitamente a la herramienta de envío. Sin relé de terceros, sin copia en la nube de tu correo.
Usa Claude, Codex, Cursor, VS Code o cualquier cliente MCP local para buscar, leer, clasificar y enviar correo a través de Apple Mail: tu bandeja de entrada se convierte en algo que puedes preguntar, buscar y delegar — encuentra cualquier cosa en segundos, archiva cientos de mensajes mediante un plan revisado, envía correo pulido con la identidad correcta y deja que Exchange entregue mensajes programados incluso mientras tu Mac está dormido.

✨ Lo que puedes hacer
🔍 Pregunta a tu bandeja de entrada. "¿Qué me envió Stefan sobre el memo la semana pasada?" La búsqueda corre a velocidad de base de datos — remitente, buzón, fechas, no leídos, adjuntos — y reconstruye conversaciones completas.
🕳️ Encuentra lo que Mail no puede. La búsqueda integrada de Mail solo hojea la primera línea de la mayoría de los mensajes. apple-mail-mcp indexa el cuerpo de cada mensaje en tu Mac — y para cuentas de Exchange incluso obtiene los cuerpos que Mail nunca descargó, directamente de tu propio buzón en el servidor. Las consultas que no devolvían nada devuelven veinte.
🎭 Envía como el tú correcto. El correo de trabajo por el carril de trabajo, el personal por Gmail — un parámetro elige la identidad. Cada mensaje se compone desde cero como correo limpio y conforme a estándares que se renderiza en todas partes, incluido Outlook (la ruta de composición de AppleScript que llega en blanco en Outlook es la razón por la que existe este proyecto).
⏰ Programa como "Enviar más tarde", pero scriptable. Un mensaje programado queda congelado por completo: adjuntos, identidad, texto exacto. Exchange puede ejecutarlo en el servidor a la hora solicitada, con la tapa cerrada; otros proveedores usan un remitente local en segundo plano y lo entregan en su siguiente pasada (o justo después de que el Mac se despierte).
🗂️ Clasifica a escala, sin miedo. "Archiva estos 40 boletines" se convierte en un plan revisable: nada se mueve hasta que se aprueba, cada mensaje se vuelve a comprobar antes de tocarlo y el resultado se verifica después contra los propios registros de Mail. Eliminar significa la Papelera de Mail: nada se borra jamás.
📝 Redacta donde viven tus borradores. Compón en tu carpeta real de Borradores de Exchange, lista para abrir en Outlook u OWA: creada, nunca enviada automáticamente.
Related MCP server: Mac Local Mail MCP
⚡ Por qué es diferente
Cualquier otro MCP de Apple Mail usa AppleScript tanto para encontrar como para actuar. Este no — y se nota:
Operación | Cláusula whose de AppleScript | apple-mailbox-mcp |
🔍 Buscar 300k mensajes | segundos a tiempo de espera | milisegundos |
🎯 Abordar un mensaje en un buzón de 71k | 7–10 s (medido) | < 0.1 ms |
✉️ Enviar correo | el cuerpo se renderiza en blanco en Outlook | se renderiza en todas partes, texto+HTML |
⏰ Programar correo | — | en el servidor con Exchange; cola local fiable en el resto |
🗂️ Clasificación masiva | una llamada por mensaje, dispara y olvida | un plan revisado, una aplicación, verificado |
Cada número anterior se midió en un almacén real de ~300,000 mensajes; el script y el método completo están en docs/benchmarks.md.
🛡️ Construido para ser confiable
✅ Plan → revisar → aplicar → verificar. Las acciones masivas se congelan en un plan que puedes leer antes de que ocurra nada; el resultado se confirma después contra el propio almacén de Mail, nunca se asume.
🗑️ Nada se borra jamás. "Eliminar" archiva en la Papelera de Mail, y los planes destructivos tienen su propia puerta separada y limitada.
👓 Modo de correo de solo lectura. Establece
EMAIL_MCP_READ_ONLY=1y solo existen las 11 herramientas de correo no mutantes en la sesión. La búsqueda puede mantener su índice de cuerpo local, y la recuperación de adjuntos escribe el archivo solicitado en el directorio temporal configurado.💾 Una cola programada a prueba de fallos. Las actualizaciones del manifiesto se vacían y se reemplazan atómicamente, por lo que una reescritura interrumpida mantiene el último registro válido. Si un archivo se daña de forma independiente, los diagnósticos lo nombran en lugar de afirmar que la cola está vacía, mientras que los mensajes programados saludables siguen moviéndose.
🧾 Un libro de actividades local, de mejor esfuerzo. Los envíos, programaciones, cancelaciones y ejecuciones de clasificación se registran sin que un registro no escribible bloquee el correo. Para la conciliación, el mensaje en sí, su Message-ID y su registro programado siguen siendo autoritativos.
🔒 Sin relé de correo de terceros. El contenido del correo permanece local, excepto el correo que envías y el acceso opcional a tu propio proveedor para el relleno de cuerpos de Exchange/IMAP, borradores y programación en el servidor. Las contraseñas SMTP permanecen en el Llavero de macOS o en 1Password; los tokens OAuth de Microsoft viven en una caché privada 0600 bajo
~/.email-mcp/graph/.📜 Un contrato por escrito. Desde v1.0, las formas, códigos de error y límites de cada herramienta evolucionan de forma aditiva, mantenidos por más de 800 pruebas automatizadas.
🤝 Claro para cada cliente MCP. Las 21 herramientas identifican lo que hacen, explican cada entrada y declaran si leen, cambian o pueden eliminar datos. Los clientes más nuevos reciben resultados estructurados; los más antiguos mantienen el mismo texto JSON. Se prueban tanto la línea MCP 1.x mantenida como la MCP 2.x actual.
🧱 Diseñado para evolucionar sin romper tu flujo de trabajo. Las reglas de correo están aisladas de MCP, Mail.app, Exchange, entrega y almacenamiento local. Los cambios de proveedor o SDK permanecen en el borde mientras el contrato de 21 herramientas permanece estable. Las reglas de dependencia se aplican en CI y se explican en la guía de arquitectura.
📦 Lanzamientos que puedes verificar. Cada lanzamiento etiquetado se compila e instala en un entorno limpio antes de publicarse. GitHub incluye el wheel, el archivo fuente, las sumas de verificación SHA-256 y la procedencia de compilación firmada, no solo el código fuente.
🩺 Autodiagnóstico.
apple-mail-mcp statusofrece una pantalla legible de preparación, programación y recuperación.apple-mail-mcp doctorproporciona el detalle de diagnóstico completo y una corrección exacta para cualquier cosa en rojo.
🚀 Inicio rápido
Concede Acceso Total al Disco a tu aplicación de terminal (Ajustes del Sistema → Privacidad y Seguridad → Acceso Total al Disco), luego sal y vuelve a abrir la terminal. Este es el único interruptor manual de Apple: no hay ventana emergente para ello.
Instala y configura:
uvx apple-mailbox-mcp setup # or: pipx install apple-mailbox-mcpRegístrate con tu cliente — una línea para Claude Code:
claude mcp add --transport stdio --scope user apple-mail -- uvx apple-mailbox-mcpo el mismo bloque JSON para Claude Desktop / Cursor / VS Code (
claude_desktop_config.json/.cursor/mcp.json/.vscode/mcp.json):{ "mcpServers": { "apple-mail": { "command": "uvx", "args": ["apple-mailbox-mcp"] } } }Verifica:
uvx apple-mailbox-mcp statusimprime una pantalla de preparación — o simplemente pide a tu cliente que ejecute la herramientadoctor; cada línea roja viene con su corrección exacta. La primera compilación del índice de cuerpo en un buzón grande se ejecuta en segundo plano y puede tardar unos minutos; la búsqueda funciona de inmediato y se completa a medida que se llena el índice.
Antes de ejecutar setup, concede a tu aplicación de terminal Acceso Total al Disco (Ajustes del Sistema → Privacidad y Seguridad → Acceso Total al Disco) — así la lectura sigue siendo rápida y local. No hay ventana emergente para esto; es el único interruptor manual de Apple, y setup te lleva al panel exacto si lo encuentra faltante.
setup pregunta todo en palabras claras (Enter vacío acepta la respuesta recomendada), ofrece una identidad de envío, construye el índice de búsqueda de cuerpo, verifica que la actualización nocturna realmente se ejecute y termina imprimiendo el bloque que pegas en tu cliente MCP:
{
"mcpServers": {
"apple-mail": { "command": "apple-mail-mcp" }
}
}El setup termina con un veredicto claro de listo o pasos de recuperación numerados. Concede Automatización → Mail cuando la clasificación lo pida por primera vez. Comprueba la instalación, el próximo mensaje programado y los envíos programados fallidos en cualquier momento con apple-mail-mcp status; usa apple-mail-mcp doctor para el detalle técnico completo.
💡 ¿Nuevo en la terminal? Tres cosas que parecen mal y no lo están:
brew install pipxquiere unaytecleada (Enter solo se rechaza);pipx ensurepathpuede imprimir un ⚠️ — la línea "pipx is ready to go!" después es el veredicto; y después deensurepath, cierra y vuelve a abrir la terminal una vez para que se encuentreapple-mail-mcp.
🔧 Solución de problemas
Síntoma | Corrección |
Cliente dice que el servidor no pudo iniciar, pero | Las aplicaciones GUI no heredan el PATH de tu shell. Usa la ruta absoluta: |
| Falta Acceso Total al Disco para la aplicación que lanza el servidor (el cliente, no la terminal). Concédelo, luego sal y vuelve a abrir esa aplicación por completo. |
La búsqueda encuentra correo reciente pero no cuerpos de correo antiguo | El índice de cuerpo aún se está construyendo: la primera compilación en un buzón de más de 100k tarda minutos. |
El envío falla con | Ejecuta |
La clasificación no hace nada la primera vez | Concede Automatización → Mail cuando macOS lo pida; el aviso aparece en el primer uso, no en la instalación. |
🧰 Las 21 herramientas
Grupo | Herramientas |
🔍 Lectura (8) |
|
✉️ Envío (6) |
|
🗂️ Clasificación (5) |
|
🩺 Meta (2) |
|
Adjuntos en ambos sentidos, con presupuesto de tamaño. Las respuestas se encadenan correctamente en todos los clientes. La programación sobrevive al sueño — un mensaje que debía enviarse con la tapa cerrada sale en el primer tic tras despertar, o exactamente a tiempo mediante Exchange.
🎭 Tus direcciones, tus carriles
La dirección From: decide cómo viaja el correo. ~/.email-mcp/identities.toml:
default = "work"
[work] # sent through a host you already trust, over SSH
from_addr = "you@example.org"
driver = "ssh_sendmail"
host = "bastion.example.org" # any login host you already SSH to
[gmail] # classic SMTP — the app password stays in 1Password
from_addr = "you@gmail.com"
driver = "smtp"
host = "smtp.gmail.com"
op = "op://Personal/gmail app password/password"Las identidades de Exchange pueden añadir un único inicio de sesión para
desbloquear los extras: borradores guardados en tu carpeta Drafts real, y
envíos programados ejecutados por el propio servidor — con la tapa cerrada,
el Mac dormido. setup lo ofrece en una única pregunta sencilla. Leer no
requiere ninguna configuración de envío.
21 herramientas · 849 pruebas · contrato de protocolo aditivo desde v1.0 Calibrado en vivo de extremo a extremo sobre un almacén de 305k mensajes.
Construido para un Mac — y para cualquiera cuyo Mac ejecute Mail.app.
Available Tools
21 toolsauditRead the activity historyARead-onlyIdempotent
Read the local mutation ledger with time, tool, event, plan, and operation filters.
| Name | Required | Description | Default |
|---|---|---|---|
| tool | No | Only return activity emitted by this tool name. | |
| event | No | Only return activity with this event name. | |
| limit | No | Maximum number of results to return. | |
| since | No | Inclusive ISO-8601 start bound; calendar prefixes are accepted. | |
| until | No | Inclusive ISO-8601 end bound; calendar prefixes are accepted. | |
| plan_id | No | Triage plan ID returned by a planning tool. | |
| operation_id | No | Operation ID that joins related activity across processes. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, covering the safety profile. The description adds context that the resource is a 'local mutation ledger' and enumerates filter dimensions, which is useful beyond annotations. However, it does not describe return format or any additional behavioral nuances, though an output schema exists. This adds moderate value beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that front-loads the primary action ('Read the local mutation ledger') and then lists the filter dimensions. There is no wasted wording, and every part contributes to understanding the tool's scope.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 7 parameters, an output schema, and annotations fully covering safety, the description is largely complete. It explains the core function and the available filters. It does not explicitly mention output details, but the output schema presumably covers that. The only minor gap is that it doesn't state why one might use this tool (e.g., for debugging), but given its uniqueness among siblings, this is acceptable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with each parameter having a description, so the schema fully documents parameters. The description summarizes them as 'time, tool, event, plan, and operation filters', which maps to since/until, tool, event, plan_id, operation_id. This adds minimal meaning beyond the schema's own descriptions, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reads a 'local mutation ledger' and lists the specific filters (time, tool, event, plan, operation). This is a specific verb+resource combination that distinguishes it from all sibling tools, which are email-centric. The title 'Read the activity history' reinforces it, but the description goes further.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for inspecting mutation history, but does not explicitly state when to use it versus alternatives or provide exclusions. Since no sibling tool is similar, the need for explicit guidance is lower, but the description still lacks an explicit 'use this when...' statement. Thus, usage is implied but not elaborated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cancel_scheduledCancel a scheduled emailADestructiveIdempotent
Revoke a pending scheduled email locally and, when needed, in Exchange.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Scheduled-email ID returned when it was created. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructiveHint=true and readOnlyHint=false, so the description does not need to restate that. However, it adds valuable context beyond annotations by specifying the cancellation is 'locally and, when needed, in Exchange', disclosing the conditional scope of the operation. This is additional behavioral information not captured in the schema or annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler. Every word adds value, specifying the action, the target, and the conditional scope. It is concise yet complete.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (one parameter, one action), the presence of an output schema, and annotations covering safety (destructive, idempotent), the description is complete enough for an agent to invoke it correctly. It clearly states what will happen and the scope, with no missing critical information.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers the single parameter 'id' fully (100% description coverage), so the description does not need to add parameter details. It doesn't, and the baseline is 3 given high schema coverage. No additional meaning is provided beyond the schema, but none is required here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states a specific verb ('Revoke'), a specific resource ('pending scheduled email'), and a scope ('locally and, when needed, in Exchange'). This clearly distinguishes it from sibling tools like schedule_email (creating) and list_scheduled (listing). An agent can immediately tell what this tool does without consulting other definitions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage (cancel scheduled emails) but provides no explicit guidance on when to use it versus alternatives, nor any exclusions or prerequisites. It does not mention, for example, that it should not be used for already-sent emails. Only implied usage is present, no explicit routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_draftCreate an email draftA
Create a never-sent draft in the selected identity's server-side Drafts folder.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | Optional comma-separated Cc recipients. | |
| to | Yes | Comma-separated primary recipients, including optional display names. | |
| body | Yes | Plain-text email content; paragraph breaks are preserved. | |
| subject | Yes | Email subject line. | |
| in_reply_to | No | Optional Message-ID of the message being answered, so the mail threads as a reply. | |
| from_identity | No | Configured sending identity; omit it to use the default. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, destructiveHint=false, idempotentHint=false, and openWorldHint=true, so the safety profile is covered. The description adds useful context about persistence ('server-side Drafts folder' of the selected identity), but says nothing about duplicate drafts on repeated calls, quota, or auth requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single tight sentence with the storage behavior front-loaded and zero filler. Nothing is wasted or repeated from structured fields.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With a full output schema and annotations carrying the safety profile, the description is nearly sufficient for calling the tool. It could add a note on duplicate creation or the interaction with send_email, but nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all six parameters are already documented in the schema. The description adds no syntax, formatting, or default behavior beyond what the schema provides, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb (Create) and resource (draft), and adds the scope qualifier 'never-sent' plus the storage location ('server-side Drafts folder'). The 'never-sent' wording implicitly separates it from send_email without needing to open the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'never-sent' framing implies this is for composing without sending, but the description never explicitly says when to choose this over send_email, reply_email, or schedule_email. Usage is only implied, not stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
doctorCheck email setupARead-onlyIdempotent
Diagnose permissions, identities, transports, scheduling, storage, and indexing.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds useful behavioral context by enumerating the exact areas under diagnosis (permissions, identities, transports, etc.), which goes beyond what the generic annotations convey. No contradiction detected.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, well-structured sentence that leads with the verb and concisely lists the diagnostic scope. No filler, and every word adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter tool with an output schema (present but not detailed), the description covers the main intent and what it inspects. It does not describe the return format or how results are presented, but the existence of an output schema shifts that burden, and the summary of diagnostic areas is sufficient for an agent to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, so the baseline is 4. The description correctly does not attempt to explain parameters that don't exist, and the schema confirms no inputs are required.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Diagnose') and a clear resource scope (permissions, identities, transports, scheduling, storage, indexing). It is not a tautology and conveys the tool's role as a health-check. However, it does not explicitly distinguish it from the sibling tool 'audit', which may have overlapping purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is used for diagnosing email setup issues but provides no explicit when-to-use or when-not-to-use guidance, nor does it reference alternatives like 'audit' or other diagnostic siblings. The usage context is implied but not stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_attachmentSave an attachment for readingARead-onlyIdempotent
Save one attachment to the configured temporary directory for reading.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Envelope ID of the email containing the attachment. | |
| attachment_id | Yes | Attachment part ID returned by get_email. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, and idempotentHint=true. The description adds the specific behavior of saving to a configured temporary directory, which is beyond annotations and informs the agent of a side effect (writing a local file) that is still non-destructive. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that is front-loaded with the core action ('Save one attachment') and provides a concise purpose. No wasted words; every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple, has an output schema, and annotations cover safety. The description adds the essential behavior of saving to a temp directory. It lacks an explicit hint about needing to call get_email first, but that is inferable from the schema and sibling names. Overall, sufficient for a low-complexity tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents id and attachment_id. The description does not add extra parameter-level meaning beyond noting 'one attachment' and the temp directory. Baseline 3 is appropriate when schema carries the parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb ('Save') and resource ('one attachment') with a purpose ('for reading'). It is distinct from siblings like get_email (which retrieves content) and get_thread (which retrieves threads), so the purpose is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when needing to read an attachment, but it does not explicitly state when not to use it or mention alternatives. There is no guidance on the prerequisite of calling get_email to obtain an attachment_id, though the schema description covers that. Thus, usage context is clear but exclusions/alternatives are absent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_emailRead an emailARead-onlyIdempotent
Read one email by envelope ID at full, metadata, or minimal detail.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Envelope ID returned by search, recent, or thread tools. | |
| view | No | Payload size: full, metadata without bodies, or minimal. | full |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the description does not need to repeat the safety profile. The description adds the detail-level options, which are useful, but it does not disclose behavior around missing IDs or failure handling. This is acceptable given the strong annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one concise sentence that front-loads the core action and resource, then packs the detail-level variants compactly. There is no filler or redundant explanation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read operation with strong annotations and well-described parameters, the description is nearly complete. It conveys the resource, ID source, and detail levels, though it does not specify the exact return structure for each view. This is a minor gap for such a straightforward retrieval tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides full descriptions for both parameters, including the enum, default, and payload-size explanation for 'view'. The description repeats the view concept but adds little meaning beyond the schema. Baseline 3 is appropriate because schema coverage is high.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Read') and resource ('one email by envelope ID'), and specifies the available detail levels. It clearly distinguishes the tool from sibling tools like schedule_email and mailbox_delete, which involve different actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The main description does not name alternatives, but the parameter description for 'id' provides clear context: this tool is used when an envelope ID has been obtained from search, recent, or thread tools. This gives sufficient usage context, though it does not explicitly state when not to use the tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_emails_batchRead multiple emailsARead-onlyIdempotent
Read up to 50 emails in one bounded request, with per-ID errors.
| Name | Required | Description | Default |
|---|---|---|---|
| ids | Yes | Envelope IDs returned by search, recent, or thread tools. | |
| view | No | Payload size: full, metadata without bodies, or minimal. | full |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the description does not need to repeat those. It adds value by disclosing a bounded request (limit of 50) and 'per-ID errors', indicating partial failure handling. This goes beyond the annotations and helps the agent predict behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, compact sentence: 'Read up to 50 emails in one bounded request, with per-ID errors.' It front-loads the core action and includes key constraints efficiently without any filler. Every phrase contributes to understanding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the existence of an output schema and thorough parameter documentation, the description covers the essential context: it explains the batch nature, the limit, and error handling. It does not mention what happens if more than 50 IDs are supplied, but the schema's maxItems=50 covers validation. Overall, it's sufficient for an agent to call correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with rich parameter descriptions (e.g., ids 'Envelope IDs returned by search, recent, or thread tools' and view enum with meanings). The tool description does not add meaning beyond the schema, which already explains both parameters adequately. Base score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Read'), a resource ('emails'), and a distinctive scope ('up to 50', 'one bounded request'), which clearly separates it from siblings like search_emails (searching) or list_recent (listing). It also mentions 'per-ID errors', adding specificity. This is a clear, non-tautological purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies a batch operation but does not explicitly state when to use this over get_email (single) or search_emails. It mentions 'bounded request' but lacks explicit guidance on selecting this tool versus alternatives. An agent could infer from the name and 'multiple emails', but explicit when-to-use instructions are absent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_threadRead an email threadARead-onlyIdempotent
Return the messages in one conversation in chronological order.
| Name | Required | Description | Default |
|---|---|---|---|
| thread_id | Yes | Conversation ID returned on an email reference. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, and idempotentHint=true, so the safety profile is known. The description adds the chronological ordering and the scope of 'one conversation', but doesn't discuss error cases or pagination. With annotations covering safety, a 3 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, under 20 words, states the core action without any filler. Ideal conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only tool with a single parameter and a comprehensive schema, the description fully covers what the tool does. The output schema presumably details the return structure, and annotations cover safety. Nothing an agent needs is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the schema description for thread_id already explains it as 'Conversation ID returned on an email reference.' The tool description adds no further parameter details, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Return') and resource ('messages in one conversation') and specifies order ('chronological'), clearly distinguishing it from sibling tools like get_email which returns a single email.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It clearly implies usage when you have a thread_id from an email reference. However, it does not explicitly contrast with alternatives like get_email or search_emails, so it misses the explicit when-not guidance for a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_mailboxesList mailboxesARead-onlyIdempotent
List configured mailboxes with server and locally readable counts.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, so the description only needs to add context beyond that. It does by specifying that the tool returns counts for server and locally readable mailboxes, which is useful but doesn't disclose the full return structure. With annotations handling safety, this adds meaningful context without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, clear sentence with no filler. The key action and resource are front-loaded, and the additional count detail is presented efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple, parameterless list tool, the description is complete. It covers the purpose and the specific output (counts), and the presence of an output schema means return details need no further explanation. No essential information is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline of 4 applies. The description correctly has nothing to add about parameters, and the 100% schema coverage (empty properties) confirms no missing information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'List' and the resource 'configured mailboxes,' and adds the specific detail that it returns server and locally readable counts. This is distinct from sibling tools like search_emails or get_email, so an agent can easily understand its purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool (when you need a list of configured mailboxes) but does not explicitly mention alternatives or exclusions. No sibling tool appears to overlap directly, so the guidance is adequate without being explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_recentList recent emailsCRead-onlyIdempotent
List recent messages, optionally scoped to an account and mailbox.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of results to return. | |
| account | No | Account UUID; omit it to include every configured account. | |
| mailbox | No | Mailbox name to search, such as INBOX or Archive. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of disclosing behavioral traits. It implies a read-only operation but does not explain recency ordering, pagination, permission requirements, or what happens with unfiltered accounts. The description adds little beyond what the name already says.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one wasted-word-free sentence and front-loads the core action. It is efficient, though it remains thin enough that most of the burden is carried by the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations and no output schema, the description is too sparce to fully contextualize the tool. It does not define 'recent', specify ordering, describe returned fields, or differentiate this from the many email-related sibling tools. An agent would need to infer significant details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All parameters have helpful schema descriptions, high schema_description_coverage, so the baseline is 3. The description's mention of optional scoping repeats what the schema already states; no additional param meaning or format details are offered.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb (list) and resource (recent messages), and adds optional account/mailbox scoping. It does not explicitly contrast itself with sibling tools like search_emails or get_emails_bath, so it falls just short of strong differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to choose this tool over alternatives such as search_emails or get_thread. The phrase 'optimaly scoped' describes parameter behavior rather than usage context, and no exclusion or precondition is offered.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_scheduledList scheduled emailsARead-onlyIdempotent
List healthy and damaged scheduled-mail records by lifecycle state.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of results to return. | |
| state | No | Scheduled-mail state to return; omit it to include all states. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only contain a title, so the description must carry behavioral weight. It discloses that both healthy and damaged records are returned, a non-obvious trait. However, it does not confirm read-only safety or describe helper behavior around the 'damaged' category.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with no filler, front-loaded with the verb and resource. Every word contributes to the intended scope.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has a simple two-parameter schema, but no output schema and no behavioral annotations. The description lacks definitions for 'damaged' and does not mention pagination or return format, which an agent might need for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already documents both parameters well, including the state enum and limit bounds. The description's 'by lifecycle state' only restates the state filter, adding no new parameter meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description specifies the verb 'List' and the resource 'scheduled-mail records', which distinguishes it from sibling tools like list_mailboxes. The phrase 'healthy and damaged' adds a useful classification but is not fully defined, slightly reducing clarity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use guidance or alternatives are mentioned. The context implies this is the tool for listing scheduled emails, but no exclusions or comparative guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mailbox_createCreate a mailboxAIdempotent
Create a mailbox idempotently and report live and index verification.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Mailbox path within the account; slashes create nested folders. | |
| account | Yes | Account UUID that will own the mailbox. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover idempotency and non-read-only behavior, but the description adds that the tool reports live and index verification after creation. This adds behavioral context beyond the structured data and does not contradict the annotations, even though the exact meaning of 'live and index verification' is not expanded.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one front-loaded sentence that states the action, the idempotent property, and the verification outcome. Every phrase adds relevant information, with no waste or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with only two required scalar parameters, a detailed schema, and annotations covering idempotency and mutation, the description provides enough context for correct invocation. The main gap is that the verification reporting is not described in terms of a concrete return shape, and error behavior for an invalid account is unspecified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already fully documents both account and path, including the nested-folder behavior of slashes. Since schema coverage is high, the description does not need to contribute additional parameter meaning; it is at baseline for this situation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource — 'Create a mailbox' — and adds idempotency, which distinguishes this tool from siblings like mailbox_delete and create_draft. The phrase 'report live and index verification' also clarifies what the operation does beyond just creation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It is clear this tool is for creating mailboxes, and the idempotency qualifier implies it can be used when a mailbox might already exist. However, the description does not explicitly say when to prefer this over listing mailboxes or other related alternatives, so the usage guidance is implied rather than direct.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mailbox_deleteDelete a mailboxADestructiveIdempotent
Delete an empty mailbox only, with live verification and safe fallback.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Mailbox path within the account; slashes create nested folders. | |
| account | Yes | Account UUID that owns the mailbox. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already flag the tool as destructive and non-read-only. The description adds valuable context: 'live verification' (checks emptiness at call time) and 'safe fallback' (presumably aborts if non-empty). This goes beyond the annotation flags, though the fallback mechanism is somewhat vague.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single 11-word sentence with the core action and constraint front-loaded. Every phrase earns its place, and there is no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter destructive tool with a full input schema and annotation coverage, the description covers the key condition (empty-only) and the safety behavior. The exact behavior of the 'safe fallback' is unspecified, but the output schema likely documents the return value, so this is a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%: both parameters are described in the input schema, including path semantics with slashes and account UUID. The description itself adds no parameter-specific detail, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Delete'), resource ('mailbox'), and a clear precondition ('empty mailbox only'). This distinguishes it from sibling tools like mailbox_create and triage_plan_delete, and the 'empty only' qualifier precisely scopes the operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Delete an empty mailbox only' explicitly sets the condition for safe invocation and implies the tool is not for non-empty mailboxes. It doesn't name alternative tools, but no competing mailbox-deletion sibling exists, so the guidance is sufficient for selecting it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
refresh_mailRefresh mailARead-onlyIdempotent
Ask Mail.app to fetch new mail and report the before/after snapshot.
| Name | Required | Description | Default |
|---|---|---|---|
| wait_seconds | No | Seconds to wait after Mail.app starts refreshing. | |
| timeout_seconds | No | Maximum seconds allowed for the Mail.app refresh request. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds the behavioral detail that it reports a before/after snapshot, which goes beyond the annotations. It also notes that it asks Mail.app, indicating an external app interaction. Since annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, the safety profile is covered. The description provides a bit of extra context but does not disclose any limitations or side effects beyond what the parameters suggest (wait and timeout).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one sentence with no filler; it gets straight to the point. It front-loads the main action ('fetch new mail') and then adds the snapshot detail. It is concise and structured well, though it could arguably include a bit more structured detail, but it earns its place with its efficiency.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (two optional parameters, high schema coverage, and annotations covering safety), the description is mostly complete. It mentions the before/after snapshot, which is a key output behavior. The output schema exists, so return values need not be explained. The only minor gap is that it doesn't mention any prerequisites like Mail.app being running, but that is likely implied. Overall, an agent has enough to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 100%, with both parameters (wait_seconds and timeout_seconds) fully described in the schema. The tool description does not add any parameter-specific information, but per the rubric, a baseline of 3 is appropriate when the schema covers the parameters comprehensively. No additional semantic value is provided by the description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that the tool asks Mail.app to fetch new mail and reports a before/after snapshot. This is a specific action on a specific resource, and the snapshot detail adds unique behavior. However, it does not explicitly distinguish itself from sibling tools like search_emails or list_recent, though the verb 'refresh' and the snapshot concept make its role clear enough.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies that this tool is for fetching new mail, which is a clear context for when to use it. However, it provides no explicit guidance about when not to use it or mentions any alternatives such as search_emails or get_email. The usage is implied by the action itself, but there is no direct comparison or exclusion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
reply_emailReply to an emailB
Reply with correct threading, optional history, attachments, and reply-all.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | Optional comma-separated Cc recipients. | |
| id | Yes | Envelope ID of the email being answered. | |
| bcc | No | Optional comma-separated Bcc recipients. | |
| body | Yes | Plain-text email content; paragraph breaks are preserved. | |
| reply_all | No | Also copy the original To and Cc recipients, excluding yourself. | |
| attachments | No | Optional list of local file paths, one path per item. | |
| from_identity | No | Configured sending identity; omit it to use the default. | |
| include_history | No | Quote the original message below the new reply. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare the mutable, non-idempotent, open-world nature of the call. The description adds the useful behavioral trait that replies are threaded correctly and history is quoted by default, but it doesn't state side effects like whether a sent reply is also filed in the mailbox or how it interacts with drafts.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single compact sentence that front-loads the core action and lists the salient options without filler. Every clause maps to a real capability of the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present and full parameter documentation, the description covers the essentials an agent needs. It is only slightly thin on the reply-versus-send routing decision, which is the main remaining gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all eight parameters are already documented in the schema, including reply_all semantics and include_history default. The description adds nothing beyond what the schema states, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb (Reply) and resource (email) and enumerates the distinguishing features: threading, optional history, attachments, reply-all. It doesn't explicitly contrast with siblings like send_email or create_draft, so an agent must infer the difference, but the purpose itself is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to reply versus use send_email or create_draft, and no prerequisites such as requiring a valid envelope ID from a prior read. The agent is left to infer that this is the answer-to-existing-message path.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
schedule_emailSchedule an emailB
Freeze an email now and schedule local or Exchange-side delivery.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | Optional comma-separated Cc recipients. | |
| to | Yes | Comma-separated primary recipients, including optional display names. | |
| bcc | No | Optional comma-separated Bcc recipients. | |
| body | Yes | Plain-text email content; paragraph breaks are preserved. | |
| send_at | Yes | Delivery time in ISO-8601; a timestamp without an offset is local time. | |
| subject | Yes | Email subject line. | |
| references | No | Optional References header of the message being answered; in_reply_to is appended to it. | |
| attachments | No | Optional list of local file paths, one path per item. | |
| in_reply_to | No | Optional Message-ID of the message being answered, so the mail threads as a reply. | |
| from_identity | No | Configured sending identity; omit it to use the default. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, idempotentHint=false, destructiveHint=false and openWorldHint=true, so the safety profile is covered. The description adds one genuinely useful behavioral fact: content is 'frozen' now, implying attachments (local file paths) and body are resolved at schedule time, not delivery time. It says nothing about cancellation, permission requirements, or what happens if delivery fails.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with the core action first and the delivery-mode nuance trailing. Zero filler, no restatement of the title or parameter list.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 10-parameter, non-idempotent, open-world mutation tool, one sentence is thin. The output schema means return values needn't be explained and the 100%-covered schema handles parameters, but the description omits the scheduling lifecycle (how to view or cancel scheduled mail) and the timing consequence of 'freeze now' for attachment paths.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% across all 10 parameters, so the schema already carries the semantics (Cc/Bcc format, ISO-8601 send_at with local-time default, reply threading via in_reply_to/references, attachment paths). The description contributes no additional parameter meaning, which is the expected baseline when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('schedule ... delivery') and adds the unusual but informative 'freeze an email now', which tells the agent the message content is captured at scheduling time rather than send time. It does not explicitly name the sibling it contrasts with (send_email for immediate delivery, create_draft for unsent drafts), so sibling differentiation is only implied.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use or when-not-to-use guidance and no alternative named, despite the presence of send_email, create_draft, list_scheduled and cancel_scheduled as siblings. The only usage signal is the incidental phrase 'local or Exchange-side delivery', which hints at two scheduling modes but never tells the agent how to choose or what to expect.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_emailsSearch emailsARead-onlyIdempotent
Search local envelope data and indexed body content. Check the returned FTS coverage before treating no matches as proof that no email exists. Sender filters are case-insensitive substring matches.
| Name | Required | Description | Default |
|---|---|---|---|
| after | No | Only include mail after this ISO-8601 date or timestamp. | |
| limit | No | Maximum number of results to return. | |
| query | No | Words to find in the subject, sender, snippet, or indexed body. | |
| before | No | Only include mail before this ISO-8601 date or timestamp. | |
| offset | No | Number of matching results to skip for pagination. | |
| account | No | Account UUID; omit it to include every configured account. | |
| mailbox | No | Mailbox name to search, such as INBOX or Archive. | |
| to_addr | No | Recipient name, address, or address fragment to match. | |
| from_addr | No | Sender name, address, or address fragment to match. | |
| unread_only | No | When true, include only unread messages. | |
| has_attachment | No | True for mail with attachments, false for mail without them. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/non-destructive, so the safety profile is covered. The description adds genuinely new behavioral context that annotations cannot convey: the returned FTS coverage signal and the need to check it before concluding an email is absent, plus the case-insensitive substring matching semantics of sender filters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, each carrying distinct information: what is searched, how to interpret empty results, and one matching-semantics detail. No filler or repetition of the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained. For an 11-parameter filter tool with full schema documentation, the description supplies the one thing the schema cannot (the FTS coverage caveat). It is complete enough, though it could note the account/mailbox scoping interaction.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description goes beyond the schema by specifying that sender filters are case-insensitive substring matches, which the from_addr/to_addr schema text ('name, address, or address fragment to match') does not state explicitly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and dual resource scope: 'Search local envelope data and indexed body content.' Clear what it does, but it draws no boundary against siblings like list_recent, get_email, or get_thread, so the agent must infer when this broad search is preferable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The FTS-coverage caveat gives useful guidance on interpreting results ('check coverage before treating no matches as proof'), which is implied usage guidance. However, there is no explicit when-to-use versus list_recent or get_email, and no statement of prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
send_emailSend an emailB
Compose standards-correct MIME and send it through the selected identity.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | Optional comma-separated Cc recipients. | |
| to | Yes | Comma-separated primary recipients, including optional display names. | |
| bcc | No | Optional comma-separated Bcc recipients. | |
| body | Yes | Plain-text email content; paragraph breaks are preserved. | |
| subject | Yes | Email subject line. | |
| attachments | No | Optional list of local file paths, one path per item. | |
| from_identity | No | Configured sending identity; omit it to use the default. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, openWorldHint=true, idempotentHint=false, and destructiveHint=false, so the safety profile is covered. The description adds a modest detail about MIME composition quality but omits consequences the agent would care about: that sending is irreversible, that repeated calls produce duplicate mail, and whether a copy is retained in Sent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler, which is well sized for the tool. The wording is slightly cryptic ('standards-correct MIME', 'selected identity') rather than plainly informative, keeping it short of a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need no explanation, and the annotations carry the safety profile. For a straightforward send operation with fully described parameters, the description supplies enough to invoke the tool correctly; the remaining gaps (usage routing, irreversibility) are shared with the sibling set rather than blocking correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter (to, cc, bcc, body, subject, attachments, from_identity) is already documented in the schema. The description's only parameter-relevant content is the vague reference to 'the selected identity', which adds no syntax or format detail beyond what the schema provides, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('send' + email) and adds the mechanism ('compose standards-correct MIME'). However, it does not differentiate from close siblings such as reply_email, schedule_email, or create_draft, so an agent cannot tell from the description alone which send path applies to a reply or a scheduled message.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use or when-not-to-use guidance and no named alternative. The phrase 'through the selected identity' hints that from_identity matters, but nothing tells the agent to prefer this over create_draft, schedule_email, or reply_email for the corresponding scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
triage_applyApply reviewed mailbox changesADestructiveIdempotent
Apply one reviewed plan, optionally excluding selected envelope IDs, and verify the retained messages. A successful claim consumes the whole plan once.
| Name | Required | Description | Default |
|---|---|---|---|
| plan_id | Yes | Triage plan ID returned by a planning tool. | |
| exclude_ids | No | Envelope IDs from this reviewed plan to leave untouched. Omit or pass an empty list to apply the full plan. At least one message must remain selected. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, idempotentHint=true and openWorldHint=true. The description adds genuine context beyond them: the plan is a single-use claim consumed exactly once, exclusion IDs are left untouched, and the retained messages are verified afterward. It still doesn't say what operation is actually applied to the selected messages.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core action and closing with the single-use consumption rule. Every clause carries information; no padding or restatement of the title.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return values need no explanation, and annotations plus a 100%-covered schema handle safety and parameters. The description supplies the one-shot consumption semantics that the schema can't express, leaving only the nature of the applied changes implicit.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters are fully documented in the schema, including the empty-list and at-least-one-remaining rules. The description only restates the exclusion behavior, adding little beyond the structured fields. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('apply one reviewed plan') and adds the exclusion and verification scope, which separates it from triage_plan (which produces the plan). It never names siblings explicitly, so an agent must infer the pairing from context, but the operation itself is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'One reviewed plan' implies this runs after a review/planning step, but the description never says to call triage_plan first, or when to use triage_plan_delete versus this tool. Usage is implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
triage_planPrepare mailbox changesA
Prepare a reviewable bulk-change plan; sender filters use case-insensitive substring matching.
| Name | Required | Description | Default |
|---|---|---|---|
| after | No | Only include mail after this ISO-8601 date or timestamp. | |
| limit | No | Maximum messages to stage; 0 uses the configured safe plan cap. | |
| query | No | Words to find in the subject, sender, snippet, or indexed body. | |
| before | No | Only include mail before this ISO-8601 date or timestamp. | |
| account | No | Account UUID; omit it to include every configured account. | |
| actions | No | Mailbox actions to stage for every selected message. | |
| mailbox | No | Mailbox name to search, such as INBOX or Archive. | |
| to_addr | No | Recipient name, address, or address fragment to match. | |
| from_addr | No | Sender name, address, or address fragment to match. | |
| unread_only | No | When true, include only unread messages. | |
| has_attachment | No | True for mail with attachments, false for mail without them. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are all false hints, so they do not clarify side effects. The description adds that the result is a 'reviewable' plan, suggesting changes are not applied immediately, and it adds the case-insensitive substring behavior. However, it does not explicitly state that no mailbox changes are actually made, whether the plan is persisted, or what side effects occur when preparing it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with two short clauses and no filler. The core action, 'prepare a reviewable bulk-change plan,' is front-loaded, and the matching behavior is added as a useful secondary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The schema richly documents all 11 parameters and an output schema exists, so return-value details are covered. What is missing is workflow context: that the plan should be reviewed and then applied via triage_apply, and that preparing the plan does not itself apply mailbox changes. For a non-read-only tool with this many parameters, the one-sentence description is minimally sufficient but leaves important behavioral gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3 because parameter descriptions already exist. The description adds meaningful value by specifying that sender filters match case-insensitively as substrings, which is not stated in the from_addr/to_addr schema entries. It doesn't elaborate on every parameter, but the schema already handles those details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The verb 'prepare' and the object 'reviewable bulk-change plan' state a specific, concrete function: this tool stages changes for review rather than executing them. This distinguishes it from siblings like triage_apply. The generic title 'Prepare mailbox changes' is clarified by the description's focus on producing a plan.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no explicit when-to-use guidance or alternatives. 'Reviewable bulk-change plan' implies a plan-then-apply workflow, and sibling triage_apply exists, but the description never says to use this before triage_apply or that triage_apply should be used afterward. The matching-semantics clause is about filtering behavior, not tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
triage_plan_deletePrepare email deletionB
Prepare a capped Trash plan whose sender filter is exact, never a broad substring match.
| Name | Required | Description | Default |
|---|---|---|---|
| after | No | Only include mail after this ISO-8601 date or timestamp. | |
| limit | No | Maximum messages to stage; 0 uses the configured deletion cap. | |
| query | No | Words to find in the subject, sender, snippet, or indexed body. | |
| before | No | Only include mail before this ISO-8601 date or timestamp. | |
| account | No | Account UUID; omit it to include every configured account. | |
| mailbox | No | Mailbox name to search, such as INBOX or Archive. | |
| to_addr | No | Recipient name, address, or address fragment to match. | |
| from_addr | No | Exact sender email address to match; fragments never select mail. | |
| unread_only | No | When true, include only unread messages. | |
| has_attachment | No | True for mail with attachments, false for mail without them. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already signal read/write and destructive hints, so the description's added 'capped Trash plan' and exact-sender rule provide some extra context. However, it does not explain side effects, what 'capped' means operationally, or what happens when this plan is applied.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with no filler, and the central constraint about exact sender matching is placed immediately after the main action. It could be more informative, but it is structured efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 10-parameter tool that prepares a deletion plan, the description is too thin. It omits how a capped plan relates to the limit parameter, whether any deletion is performed immediately, and what distinguishes it from triage_plan or triage_apply.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameters are already documented. The description's main semantic addition, exact sender matching, is also already stated in the from_addr schema, so it adds little beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies a specific action and object: preparing a capped Trash plan, and adds a concrete selection rule (exact sender match). It is clearer than the name alone, though it does not explicitly contrast with sibling tools such as triage_plan.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance about when to use this tool rather than triage_plan, search_emails, or triage_apply. The sentence states a behavior but not a decision context or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
2 tool updates
v1.8.2- Changed
create_draft1 field changed- changed
Input schema / properties / in_reply_to / descriptionPrevious value: -"Optional Message-ID used to thread the draft as a reply."New value: +"Optional Message-ID of the message being answered, so the mail threads as a reply."
- Changed
schedule_email2 fields changed- added
Input schema / properties / in_reply_toAdded value: +{ + "default": "", + "description": "Optional Message-ID of the message being answered, so the mail threads as a reply.", + "title": "In Reply To", + "type": "string" +} - added
Input schema / properties / referencesAdded value: +{ + "default": "", + "description": "Optional References header of the message being answered; in_reply_to is appended to it.", + "title": "References", + "type": "string" +}
1 tool update
v1.8.0- Changed
triage_apply1 field changed- added
Input schema / properties / exclude_idsAdded value: +{ + "anyOf": [ + { + "items": { + "type": "string" + }, + "type": "array" + }, + { + "type": "null" + } + ], + "default": null, + "description": "Envelope IDs from this reviewed plan to leave untouched. Omit or pass an empty list to apply the full plan. At least one message must remain selected.", + "title": "Exclude Ids" +}
3 tool updates
v1.6.0- Changed
reply_email1 field changed- changed
Output schema / anyOfPrevious value: -[ - { - "additionalProperties": true, - "properties": { - "attachments": { - "items": { - "type": "string" - }, - "type": "array" - }, - "bcc": { - "items": { - "type": "string" - }, - "type": "array" - }, - "bootstrapped": { - "type": "boolean" - }, - "cc": { - "items": { - "type": "string" - }, - "type": "array" - }, - "error": { - "anyOf": [ - { - "type": "string" - }, - { - "type": "null" - } - ] - }, - "message_id": { - "type": "string" - }, - "ok": { - "type": "boolean" - }, - "subject": { - "type": "string" - }, - "to": { - "items": { - "type": "string" - }, - "type": "array" - } - }, - "required": [ - "ok", - "message_id", - "to", - "cc", - "bcc", - "subject", - "attachments", - "bootstrapped", - "error" - ], - "type": "object" - }, - { - "additionalProperties": true, - "properties": { - "code": { - "type": "string" - }, - "error": { - "type": "string" - }, - "fix": { - "type": "string" - }, - "ok": { - "const": false - }, - "operation_id": { - "type": "string" - } - }, - "required": [ - "ok", - "code", - "error" - ], - "type": "object" - } -]New value: +[ + { + "additionalProperties": true, + "properties": { + "accepted": { + "items": { + "type": "string" + }, + "type": "array" + }, + "attachments": { + "items": { + "type": "string" + }, + "type": "array" + }, + "bcc": { + "items": { + "type": "string" + }, + "type": "array" + }, + "bootstrapped": { + "type": "boolean" + }, + "cc": { + "items": { + "type": "string" + }, + "type": "array" + }, + "code": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ] + }, + "error": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ] + }, + "message_id": { + "type": "string" + }, + "ok": { + "type": "boolean" + }, + "refused": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "subject": { + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "required": [ + "ok", + "message_id", + "to", + "cc", + "bcc", + "subject", + "attachments", + "bootstrapped", + "error", + "accepted", + "refused", + "code" + ], + "type": "object" + }, + { + "additionalProperties": true, + "properties": { + "code": { + "type": "string" + }, + "error": { + "type": "string" + }, + "fix": { + "type": "string" + }, + "ok": { + "const": false + }, + "operation_id": { + "type": "string" + } + }, + "required": [ + "ok", + "code", + "error" + ], + "type": "object" + } +]
- Changed
schedule_email1 field changed- changed
Output schema / anyOfPrevious value: -[ - { - "additionalProperties": true, - "properties": { - "attachments": { - "items": { - "type": "string" - }, - "type": "array" - }, - "attempts": { - "type": "integer" - }, - "bcc": { - "items": { - "type": "string" - }, - "type": "array" - }, - "cc": { - "items": { - "type": "string" - }, - "type": "array" - }, - "created_at": { - "type": "string" - }, - "delivered_at": { - "anyOf": [ - { - "type": "string" - }, - { - "type": "null" - } - ] - }, - "executor": { - "type": "string" - }, - "graph_draft_id": { - "anyOf": [ - { - "type": "string" - }, - { - "type": "null" - } - ] - }, - "id": { - "type": "string" - }, - "identity": { - "type": "string" - }, - "last_error": { - "anyOf": [ - { - "type": "string" - }, - { - "type": "null" - } - ] - }, - "message_id": { - "type": "string" - }, - "next_attempt_at": { - "anyOf": [ - { - "type": "string" - }, - { - "type": "null" - } - ] - }, - "ok": { - "const": true - }, - "send_at": { - "type": "string" - }, - "status": { - "type": "string" - }, - "subject": { - "type": "string" - }, - "to": { - "items": { - "type": "string" - }, - "type": "array" - } - }, - "required": [ - "ok", - "id", - "send_at", - "created_at", - "to", - "cc", - "bcc", - "subject", - "attachments", - "message_id", - "status", - "attempts", - "next_attempt_at", - "last_error", - "delivered_at", - "identity", - "executor", - "graph_draft_id" - ], - "type": "object" - }, - { - "additionalProperties": true, - "properties": { - "code": { - "type": "string" - }, - "error": { - "type": "string" - }, - "fix": { - "type": "string" - }, - "ok": { - "const": false - }, - "operation_id": { - "type": "string" - } - }, - "required": [ - "ok", - "code", - "error" - ], - "type": "object" - } -]New value: +[ + { + "additionalProperties": true, + "properties": { + "accepted": { + "items": { + "type": "string" + }, + "type": "array" + }, + "attachments": { + "items": { + "type": "string" + }, + "type": "array" + }, + "attempts": { + "type": "integer" + }, + "bcc": { + "items": { + "type": "string" + }, + "type": "array" + }, + "cc": { + "items": { + "type": "string" + }, + "type": "array" + }, + "claimed_at": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ] + }, + "code": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ] + }, + "created_at": { + "type": "string" + }, + "delivered_at": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ] + }, + "executor": { + "type": "string" + }, + "graph_draft_id": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ] + }, + "id": { + "type": "string" + }, + "identity": { + "type": "string" + }, + "last_error": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ] + }, + "message_id": { + "type": "string" + }, + "next_attempt_at": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ] + }, + "ok": { + "const": true + }, + "refused": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "send_at": { + "type": "string" + }, + "status": { + "type": "string" + }, + "subject": { + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "required": [ + "ok", + "id", + "send_at", + "created_at", + "to", + "cc", + "bcc", + "subject", + "attachments", + "message_id", + "status", + "attempts", + "next_attempt_at", + "last_error", + "delivered_at", + "identity", + "executor", + "graph_draft_id", + "accepted", + "refused", + "code", + "claimed_at" + ], + "type": "object" + }, + { + "additionalProperties": true, + "properties": { + "code": { + "type": "string" + }, + "error": { + "type": "string" + }, + "fix": { + "type": "string" + }, + "ok": { + "const": false + }, + "operation_id": { + "type": "string" + } + }, + "required": [ + "ok", + "code", + "error" + ], + "type": "object" + } +]
- Changed
send_email1 field changed- changed
Output schema / anyOfPrevious value: -[ - { - "additionalProperties": true, - "properties": { - "attachments": { - "items": { - "type": "string" - }, - "type": "array" - }, - "bcc": { - "items": { - "type": "string" - }, - "type": "array" - }, - "bootstrapped": { - "type": "boolean" - }, - "cc": { - "items": { - "type": "string" - }, - "type": "array" - }, - "error": { - "anyOf": [ - { - "type": "string" - }, - { - "type": "null" - } - ] - }, - "message_id": { - "type": "string" - }, - "ok": { - "type": "boolean" - }, - "subject": { - "type": "string" - }, - "to": { - "items": { - "type": "string" - }, - "type": "array" - } - }, - "required": [ - "ok", - "message_id", - "to", - "cc", - "bcc", - "subject", - "attachments", - "bootstrapped", - "error" - ], - "type": "object" - }, - { - "additionalProperties": true, - "properties": { - "code": { - "type": "string" - }, - "error": { - "type": "string" - }, - "fix": { - "type": "string" - }, - "ok": { - "const": false - }, - "operation_id": { - "type": "string" - } - }, - "required": [ - "ok", - "code", - "error" - ], - "type": "object" - } -]New value: +[ + { + "additionalProperties": true, + "properties": { + "accepted": { + "items": { + "type": "string" + }, + "type": "array" + }, + "attachments": { + "items": { + "type": "string" + }, + "type": "array" + }, + "bcc": { + "items": { + "type": "string" + }, + "type": "array" + }, + "bootstrapped": { + "type": "boolean" + }, + "cc": { + "items": { + "type": "string" + }, + "type": "array" + }, + "code": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ] + }, + "error": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ] + }, + "message_id": { + "type": "string" + }, + "ok": { + "type": "boolean" + }, + "refused": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "subject": { + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "required": [ + "ok", + "message_id", + "to", + "cc", + "bcc", + "subject", + "attachments", + "bootstrapped", + "error", + "accepted", + "refused", + "code" + ], + "type": "object" + }, + { + "additionalProperties": true, + "properties": { + "code": { + "type": "string" + }, + "error": { + "type": "string" + }, + "fix": { + "type": "string" + }, + "ok": { + "const": false + }, + "operation_id": { + "type": "string" + } + }, + "required": [ + "ok", + "code", + "error" + ], + "type": "object" + } +]
21 tool updates
v0.1.0- First observed
audit - First observed
cancel_scheduled - First observed
create_draft - First observed
doctor - First observed
get_attachment - First observed
get_email - First observed
get_emails_batch - First observed
get_thread - First observed
list_mailboxes - First observed
list_recent - First observed
list_scheduled - First observed
mailbox_create - First observed
mailbox_delete - First observed
refresh_mail - First observed
reply_email - First observed
schedule_email - First observed
search_emails - First observed
send_email - First observed
triage_apply - First observed
triage_plan - First observed
triage_plan_delete
TDQS
Scored across 21 tools
Most tools are clearly distinct: send, reply, schedule, and draft are separate, while read operations are split by single, batch, thread, search, and recent listing. Minor overlap exists between triage_plan and triage_plan_delete, and between search_emails and list_recent, but descriptions clarify their boundaries.
Most names follow verb_noun (get_email, list_mailboxes, send_email), but mailbox_create/mailbox_delete reverse the order, triage tools mix noun and verb patterns, and doctor/audit are bare nouns. The set remains readable, but the convention is not fully consistent.
At 21 tools, the surface is borderline heavy for an email client, though many map to legitimate lifecycle operations. It also includes niche diagnostic and audit tools, pushing it into the 16-25 range that feels somewhat over-scoped.
Core email lifecycle is well covered: send, reply, draft, schedule, search, read, batch, thread, attachments, mailbox management, triage, audit, and diagnostics. Missing forward_email and direct draft editing or flagging are minor gaps that most agents can work around.
Maintenance
Related MCP Connectors
Hosted email MCP for your own Gmail, Outlook.com, Microsoft 365, iCloud or IMAP inbox: read, search, draft, reply in thread, forward and file mail. It moves or flags up to 500 messages in one call, and a send leaves exactly one copy in Sent. A calendar is a separate connection, and connecting one adds diary and scheduling tools.
Email infrastructure for AI agents — send, receive, search, and reply to email over MCP.
Your IMAP mailbox as an MCP server: read, search and (if you allow it) organize mail. Open source.
Your mailbox for MCP clients: search, read, draft, send, rules and notes. Sending is off by default.
Related MCP Servers
- AlicenseAqualityDmaintenanceA local MCP server for searching and reading downloaded Apple Mail data without changing mail state.68MIT
- AlicenseNot gradedqualityDmaintenanceEnables MCP clients to search, read, and inspect Apple Mail on macOS, including conversations and attachments. It can create new, reply, reply-all, or forward drafts, but cannot send or modify existing messages.MIT
- AlicenseNot gradedqualityBmaintenanceMCP server that gives an AI assistant access to IMAP/SMTP mailboxes to read, search, organize, draft, and send email, with local mirroring and full-text search, no third-party data path, and credentials stored only in the macOS Keychain.17 npmMIT
- AlicenseNot gradedqualityBmaintenanceEnables searching, reading full conversations, and sending email across multiple IMAP/SMTP mailboxes from any MCP client, with multi-user support and per-user API tokens.MIT