apple-mail-mcp
✉️ apple-mail-mcp
あなたのApple Mailを、完全にエージェント操作可能に。
Mac上でローカルに動作します。 Mailストアを読み取り専用で開き、クライアントが要求したものだけを返し、クライアントが明示的に送信ツールを呼び出したときだけ送信します。サードパーティの中継はなく、メールのクラウドコピーもありません。
Claude、Codex、Cursor、VS Code、または任意のローカルMCPクライアントを使用して、Apple Mailを通じてメールの検索、閲覧、トリアージ、送信ができます。あなたのメールボックスは、質問したり、検索したり、委任したりできるものになります。数秒で何でも見つけ、レビュー済みのプランで数百件のメッセージを整理し、正しいアイデンティティで洗練されたメールを送信し、Macがスリープ中でもExchangeが予定されたメッセージを配信します。

✨ できること
🔍 メールボックスに質問する。 「先週ステファンが議事メモについて何を送ってきた?」 検索はデータベース速度で実行されます。送信者、メールボックス、日付、未読、添付ファイルに対応し、会話全体を再構築します。
🕳️ Mail自体では見つけられないものを見つける。 Mailの組み込み検索は、ほとんどのメッセージの最初の行をなぞるだけです。apple-mail-mcpはMac上のすべてのメッセージの本文をインデックス化します。Exchangeアカウントでは、Mailがダウンロードしたことのない本文も、サーバー上の自分のメールボックスから直接取得します。何も返さなかったクエリが、20件を返すようになります。
🎭 正しい自分として送信する。 仕事用メールは仕事用レーンで、プライベートはGmailで。1つのパラメータでアイデンティティを選択します。すべてのメッセージは、どこでも正しく表示されるクリーンで標準準拠のメールとしてゼロから作成されます。Outlookも含めて(Outlookで空白になってしまうAppleScript作成パスは、このプロジェクトが存在する理由です)。
⏰ 「Send Later」のようにスケジュールするが、スクリプト可能。 スケジュールされたメッセージは完全な状態で固定されます。添付ファイル、アイデンティティ、正確なテキスト。Exchangeは要求された時刻にサーバーサイドで実行でき、ふたを閉じたままでも動作します。他のプロバイダはローカルのバックグラウンド送信を使用し、次のパスで配信します(またはMacが起きた直後)。
🗂️ 恐れずに大規模トリアージ。 「この40通のニュースレターを整理して」 はレビュー可能なプランになります。承認されるまで何も動かず、すべてのメッセージは触れる前に再チェックされ、結果はその後Mail自身のレコードと照合して検証されます。削除はMailのゴミ箱を意味します。何も消去されません。
📝 下書きは下書きのある場所に。 実際のExchange下書きフォルダに作成し、OutlookやOWAで開く準備ができています。作成されるだけで、自動送信はされません。
Related MCP server: Mac Local Mail MCP
⚡ 他と違う理由
他のApple-Mail MCPは、検索と操作の両方にAppleScriptを使用します。これはそうではありません。その違いは明らかです:
操作 | AppleScriptのwhose句 | apple-mailbox-mcp |
🔍 30万件のメッセージを検索 | 数秒からタイムアウト | ミリ秒単位 |
🎯 71kメールボックスの1件のメッセージに宛てる | 7〜10秒(計測済み) | < 0.1 ms |
✉️ メールを送信 | 本文がOutlookで空白になる | どこでも、プレーン+HTMLで表示される |
⏰ メールをスケジュール | — | Exchangeではサーバーサイド、その他では信頼性の高いローカルキュー |
🗂️ 一括トリアージ | メッセージごとに1回の呼び出し、fire-and-forget | 1つのレビュー済みプラン、1回の適用、検証済み |
上記のすべての数値は、実際の約30万件のメッセージストアで計測されました。スクリプトと完全な方法はdocs/benchmarks.mdにあります。
🛡️ 信頼できるように構築
✅ プラン → レビュー → 適用 → 検証。 一括操作は、何かが起こる前に読めるプランに凍結されます。結果はその後、Mail自身のストアに対して確認されます。決して想定されたままにはされません。
🗑️ 何も消去されません。 「削除」はMailのゴミ箱にファイルし、破壊的なプランには独自の別個の上限付きドアがあります。
👓 読み取り専用メールモード。
EMAIL_MCP_READ_ONLY=1を設定すると、セッションには11個の非変更メールツールのみが存在します。検索はローカルの本文インデックスを維持することがあり、添付ファイルの取得は要求されたファイルを設定済みの一時ディレクトリに書き込みます。💾 クラッシュセーフなスケジュールキュー。 マニフェストの更新はフラッシュされ、原子的に置き換えられるため、中断された書き換えでも最後の有効なレコードが保持されます。ファイルが独立して破損した場合、診断はキューが空であると主張する代わりにそのファイルを特定し、正常なスケジュール済みメッセージは動き続けます。
🧾 ローカルでベストエフォートのアクティビティ台帳。 送信、スケジュール、キャンセル、トリアージの実行は、書き込み不能なログがメールをブロックすることなく記録されます。照合のために、メッセージ自体、そのMessage-ID、およびスケジュールレコードが信頼できる情報源であり続けます。
🔒 サードパーティのメールリレーはありません。 メールコンテンツは、送信するメールと、Exchange/IMAP本文バックフィル、下書き、サーバーサイドスケジュールのための自分のプロバイダへのオプションアクセスを除き、ローカルに留まります。SMTPパスワードはmacOSキーチェーンまたは1Passwordに留まり、Microsoft OAuthトークンは
~/.email-mcp/graph/の下のプライベートな0600キャッシュにあります。📜 文書化された契約。 v1.0以降、すべてのツールの形状、エラーコード、上限は追加的に進化し、800以上の自動テストで支えられています。
🤝 すべてのMCPクライアントに明確。 全21ツールが自身の機能を特定し、すべての入力を説明し、読み取り、変更、またはデータを削除できるかを宣言します。新しいクライアントは構造化された結果を受け取り、古いクライアントは同じJSONテキストを保持します。保守されているMCP 1.x系と現在のMCP 2.xの両方がテストされています。
🧱 ワークフローを壊さずに進化できるように構築。 メールルールはMCP、Mail.app、Exchange、配信、ローカルストレージから分離されています。プロバイダやSDKの変更はエッジに留まり、21ツールの契約は安定したままです。依存関係ルールはCIで強制され、アーキテクチャガイドで説明されています。
📦 検証できるリリース。 すべてのタグ付きリリースは、公開前にクリーンな環境でビルドおよびインストールされます。GitHubには、ソースコードだけでなく、ホイール、ソースアーカイブ、SHA-256チェックサム、署名付きビルドの来歴が含まれています。
🩺 自己診断。
apple-mail-mcp statusは、1つの読みやすい準備、スケジュール、リカバリ画面を提供します。apple-mail-mcp doctorは、完全な診断詳細と、赤いものすべてに対する正確な修正を提供します。
🚀 クイックスタート
ターミナルアプリにフルディスクアクセスを許可します(システム設定 → プライバシーとセキュリティ → フルディスクアクセス)。その後、ターミナルを終了して再度開きます。これはAppleが定めた唯一の手動トグルです。これに関するポップアップはありません。
インストールとセットアップ:
uvx apple-mailbox-mcp setup # or: pipx install apple-mailbox-mcpクライアントに登録します — Claude Codeの場合は1行:
claude mcp add --transport stdio --scope user apple-mail -- uvx apple-mailbox-mcpまたは、Claude Desktop / Cursor / VS Codeの場合は同じJSONブロック(
claude_desktop_config.json/.cursor/mcp.json/.vscode/mcp.json):{ "mcpServers": { "apple-mail": { "command": "uvx", "args": ["apple-mailbox-mcp"] } } }確認:
uvx apple-mailbox-mcp statusで1つの準備画面が表示されます。または、クライアントにdoctorツールを実行するよう依頼するだけです。赤い行にはすべて正確な修正が付いています。大規模なメールボックスでの初回の本文インデックス構築はバックグラウンドで実行され、数分かかることがあります。検索は即座に機能し、インデックスが埋まるにつれて完了します。
setupを実行する前に、ターミナルアプリにフルディスクアクセス(システム設定 → プライバシーとセキュリティ → フルディスクアクセス)を許可してください。これが読み取りを高速かつローカルに保つ方法です。これに関するポップアップはありません。これはAppleが定めた唯一の手動トグルであり、setupは不足していることを検出した場合、正確なペインまで案内します。
setupはすべてを平易な言葉で尋ね(空のEnterで推奨される回答を受け入れます)、送信アイデンティティを提供し、本文検索インデックスを構築し、夜間の更新が実際に実行されることを検証し、最後にMCPクライアントに貼り付ける1つのブロックを出力します:
{
"mcpServers": {
"apple-mail": { "command": "apple-mail-mcp" }
}
}セットアップは明確な準備完了の判定、または番号付きのリカバリ手順で終了します。トリアージが初めて要求したときに自動化 → Mailを許可してください。インストール、次のスケジュール済みメッセージ、失敗したスケジュール送信は、いつでもapple-mail-mcp statusで確認できます。完全な技術的詳細にはapple-mail-mcp doctorを使用してください。
💡 ターミナルに不慣れですか? 間違って見えるが間違いではない3つのこと:
brew install pipxはタイプしたyを要求します(Enterだけでは拒否されます)。pipx ensurepathは⚠️を表示することがあります。その後の「pipx is ready to go!」という行が判定です。ensurepathの後は、apple-mail-mcpが見つかるようにターミナルを一度閉じて再度開いてください。
🔧 トラブルシューティング
症状 | 修正 |
クライアントがサーバーの起動に失敗したと言うが、 | GUIアプリはシェルのPATHを継承しません。絶対パスを使用してください: |
| サーバーを起動するアプリ(ターミナルではなくクライアント)にフルディスクアクセスがありません。許可し、そのアプリを完全に終了して再度開いてください。 |
検索で最近のメールは見つかるが古いメールの本文が見つからない | 本文インデックスがまだ構築中です。10万件以上のメールボックスでの初回ビルドには数分かかります。 |
送信が |
|
トリアージが初回に何もしない | macOSが尋ねたときに自動化 → Mailを許可してください。プロンプトはインストール時ではなく初回使用時に表示されます。 |
🧰 21のツール
グループ | ツール |
🔍 読み取り(8) |
|
✉️ 送信(6) |
|
🗂️ トリアージ(5) |
|
🩺 メタ(2) |
|
添付ファイルは双方向対応、サイズ上限付き。返信はすべてのクライアントで正しくスレッド表示されます。スケジュール送信はスリープを生き延びます — 蓋を閉じている間に送信予定だったメッセージは、起動後の最初のティックで送信されるか、Exchange経由で正確に時間通りに送信されます。
🎭 あなたのアドレス、あなたの経路
From: アドレスがメールの送信経路を決定します。~/.email-mcp/identities.toml:
default = "work"
[work] # sent through a host you already trust, over SSH
from_addr = "you@example.org"
driver = "ssh_sendmail"
host = "bastion.example.org" # any login host you already SSH to
[gmail] # classic SMTP — the app password stays in 1Password
from_addr = "you@gmail.com"
driver = "smtp"
host = "smtp.gmail.com"
op = "op://Personal/gmail app password/password"Exchangeアイデンティティは、サインインを1回追加するだけでその他の機能を利用できます: 実際のDraftsフォルダに格納される下書きと、サーバー自体が実行するスケジュール送信 — 蓋が閉じていても、Macがスリープしていても。setup はこれをシンプルな質問1つで提示します。受信には送信設定が一切不要です。
21のツール · 849のテスト · v1.0以来の追加型ワイヤー契約 305kメッセージのストアでエンドツーエンドにライブ調整済み。
1台のMacのために構築 — そして、Mail.appを実行するMacを持つすべての人のために。
Available Tools
21 toolsauditRead the activity historyARead-onlyIdempotent
Read the local mutation ledger with time, tool, event, plan, and operation filters.
| Name | Required | Description | Default |
|---|---|---|---|
| tool | No | Only return activity emitted by this tool name. | |
| event | No | Only return activity with this event name. | |
| limit | No | Maximum number of results to return. | |
| since | No | Inclusive ISO-8601 start bound; calendar prefixes are accepted. | |
| until | No | Inclusive ISO-8601 end bound; calendar prefixes are accepted. | |
| plan_id | No | Triage plan ID returned by a planning tool. | |
| operation_id | No | Operation ID that joins related activity across processes. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, covering the safety profile. The description adds context that the resource is a 'local mutation ledger' and enumerates filter dimensions, which is useful beyond annotations. However, it does not describe return format or any additional behavioral nuances, though an output schema exists. This adds moderate value beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that front-loads the primary action ('Read the local mutation ledger') and then lists the filter dimensions. There is no wasted wording, and every part contributes to understanding the tool's scope.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 7 parameters, an output schema, and annotations fully covering safety, the description is largely complete. It explains the core function and the available filters. It does not explicitly mention output details, but the output schema presumably covers that. The only minor gap is that it doesn't state why one might use this tool (e.g., for debugging), but given its uniqueness among siblings, this is acceptable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with each parameter having a description, so the schema fully documents parameters. The description summarizes them as 'time, tool, event, plan, and operation filters', which maps to since/until, tool, event, plan_id, operation_id. This adds minimal meaning beyond the schema's own descriptions, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reads a 'local mutation ledger' and lists the specific filters (time, tool, event, plan, operation). This is a specific verb+resource combination that distinguishes it from all sibling tools, which are email-centric. The title 'Read the activity history' reinforces it, but the description goes further.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for inspecting mutation history, but does not explicitly state when to use it versus alternatives or provide exclusions. Since no sibling tool is similar, the need for explicit guidance is lower, but the description still lacks an explicit 'use this when...' statement. Thus, usage is implied but not elaborated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cancel_scheduledCancel a scheduled emailADestructiveIdempotent
Revoke a pending scheduled email locally and, when needed, in Exchange.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Scheduled-email ID returned when it was created. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructiveHint=true and readOnlyHint=false, so the description does not need to restate that. However, it adds valuable context beyond annotations by specifying the cancellation is 'locally and, when needed, in Exchange', disclosing the conditional scope of the operation. This is additional behavioral information not captured in the schema or annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler. Every word adds value, specifying the action, the target, and the conditional scope. It is concise yet complete.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (one parameter, one action), the presence of an output schema, and annotations covering safety (destructive, idempotent), the description is complete enough for an agent to invoke it correctly. It clearly states what will happen and the scope, with no missing critical information.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers the single parameter 'id' fully (100% description coverage), so the description does not need to add parameter details. It doesn't, and the baseline is 3 given high schema coverage. No additional meaning is provided beyond the schema, but none is required here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states a specific verb ('Revoke'), a specific resource ('pending scheduled email'), and a scope ('locally and, when needed, in Exchange'). This clearly distinguishes it from sibling tools like schedule_email (creating) and list_scheduled (listing). An agent can immediately tell what this tool does without consulting other definitions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage (cancel scheduled emails) but provides no explicit guidance on when to use it versus alternatives, nor any exclusions or prerequisites. It does not mention, for example, that it should not be used for already-sent emails. Only implied usage is present, no explicit routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_draftCreate an email draftA
Create a never-sent draft in the selected identity's server-side Drafts folder.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | Optional comma-separated Cc recipients. | |
| to | Yes | Comma-separated primary recipients, including optional display names. | |
| body | Yes | Plain-text email content; paragraph breaks are preserved. | |
| subject | Yes | Email subject line. | |
| in_reply_to | No | Optional Message-ID of the message being answered, so the mail threads as a reply. | |
| from_identity | No | Configured sending identity; omit it to use the default. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, destructiveHint=false, idempotentHint=false, and openWorldHint=true, so the safety profile is covered. The description adds useful context about persistence ('server-side Drafts folder' of the selected identity), but says nothing about duplicate drafts on repeated calls, quota, or auth requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single tight sentence with the storage behavior front-loaded and zero filler. Nothing is wasted or repeated from structured fields.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With a full output schema and annotations carrying the safety profile, the description is nearly sufficient for calling the tool. It could add a note on duplicate creation or the interaction with send_email, but nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all six parameters are already documented in the schema. The description adds no syntax, formatting, or default behavior beyond what the schema provides, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb (Create) and resource (draft), and adds the scope qualifier 'never-sent' plus the storage location ('server-side Drafts folder'). The 'never-sent' wording implicitly separates it from send_email without needing to open the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'never-sent' framing implies this is for composing without sending, but the description never explicitly says when to choose this over send_email, reply_email, or schedule_email. Usage is only implied, not stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
doctorCheck email setupARead-onlyIdempotent
Diagnose permissions, identities, transports, scheduling, storage, and indexing.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds useful behavioral context by enumerating the exact areas under diagnosis (permissions, identities, transports, etc.), which goes beyond what the generic annotations convey. No contradiction detected.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, well-structured sentence that leads with the verb and concisely lists the diagnostic scope. No filler, and every word adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter tool with an output schema (present but not detailed), the description covers the main intent and what it inspects. It does not describe the return format or how results are presented, but the existence of an output schema shifts that burden, and the summary of diagnostic areas is sufficient for an agent to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, so the baseline is 4. The description correctly does not attempt to explain parameters that don't exist, and the schema confirms no inputs are required.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Diagnose') and a clear resource scope (permissions, identities, transports, scheduling, storage, indexing). It is not a tautology and conveys the tool's role as a health-check. However, it does not explicitly distinguish it from the sibling tool 'audit', which may have overlapping purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is used for diagnosing email setup issues but provides no explicit when-to-use or when-not-to-use guidance, nor does it reference alternatives like 'audit' or other diagnostic siblings. The usage context is implied but not stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_attachmentSave an attachment for readingARead-onlyIdempotent
Save one attachment to the configured temporary directory for reading.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Envelope ID of the email containing the attachment. | |
| attachment_id | Yes | Attachment part ID returned by get_email. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, and idempotentHint=true. The description adds the specific behavior of saving to a configured temporary directory, which is beyond annotations and informs the agent of a side effect (writing a local file) that is still non-destructive. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that is front-loaded with the core action ('Save one attachment') and provides a concise purpose. No wasted words; every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple, has an output schema, and annotations cover safety. The description adds the essential behavior of saving to a temp directory. It lacks an explicit hint about needing to call get_email first, but that is inferable from the schema and sibling names. Overall, sufficient for a low-complexity tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents id and attachment_id. The description does not add extra parameter-level meaning beyond noting 'one attachment' and the temp directory. Baseline 3 is appropriate when schema carries the parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb ('Save') and resource ('one attachment') with a purpose ('for reading'). It is distinct from siblings like get_email (which retrieves content) and get_thread (which retrieves threads), so the purpose is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when needing to read an attachment, but it does not explicitly state when not to use it or mention alternatives. There is no guidance on the prerequisite of calling get_email to obtain an attachment_id, though the schema description covers that. Thus, usage context is clear but exclusions/alternatives are absent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_emailRead an emailARead-onlyIdempotent
Read one email by envelope ID at full, metadata, or minimal detail.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Envelope ID returned by search, recent, or thread tools. | |
| view | No | Payload size: full, metadata without bodies, or minimal. | full |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the description does not need to repeat the safety profile. The description adds the detail-level options, which are useful, but it does not disclose behavior around missing IDs or failure handling. This is acceptable given the strong annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one concise sentence that front-loads the core action and resource, then packs the detail-level variants compactly. There is no filler or redundant explanation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read operation with strong annotations and well-described parameters, the description is nearly complete. It conveys the resource, ID source, and detail levels, though it does not specify the exact return structure for each view. This is a minor gap for such a straightforward retrieval tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides full descriptions for both parameters, including the enum, default, and payload-size explanation for 'view'. The description repeats the view concept but adds little meaning beyond the schema. Baseline 3 is appropriate because schema coverage is high.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Read') and resource ('one email by envelope ID'), and specifies the available detail levels. It clearly distinguishes the tool from sibling tools like schedule_email and mailbox_delete, which involve different actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The main description does not name alternatives, but the parameter description for 'id' provides clear context: this tool is used when an envelope ID has been obtained from search, recent, or thread tools. This gives sufficient usage context, though it does not explicitly state when not to use the tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_emails_batchRead multiple emailsARead-onlyIdempotent
Read up to 50 emails in one bounded request, with per-ID errors.
| Name | Required | Description | Default |
|---|---|---|---|
| ids | Yes | Envelope IDs returned by search, recent, or thread tools. | |
| view | No | Payload size: full, metadata without bodies, or minimal. | full |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the description does not need to repeat those. It adds value by disclosing a bounded request (limit of 50) and 'per-ID errors', indicating partial failure handling. This goes beyond the annotations and helps the agent predict behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, compact sentence: 'Read up to 50 emails in one bounded request, with per-ID errors.' It front-loads the core action and includes key constraints efficiently without any filler. Every phrase contributes to understanding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the existence of an output schema and thorough parameter documentation, the description covers the essential context: it explains the batch nature, the limit, and error handling. It does not mention what happens if more than 50 IDs are supplied, but the schema's maxItems=50 covers validation. Overall, it's sufficient for an agent to call correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with rich parameter descriptions (e.g., ids 'Envelope IDs returned by search, recent, or thread tools' and view enum with meanings). The tool description does not add meaning beyond the schema, which already explains both parameters adequately. Base score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Read'), a resource ('emails'), and a distinctive scope ('up to 50', 'one bounded request'), which clearly separates it from siblings like search_emails (searching) or list_recent (listing). It also mentions 'per-ID errors', adding specificity. This is a clear, non-tautological purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies a batch operation but does not explicitly state when to use this over get_email (single) or search_emails. It mentions 'bounded request' but lacks explicit guidance on selecting this tool versus alternatives. An agent could infer from the name and 'multiple emails', but explicit when-to-use instructions are absent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_threadRead an email threadARead-onlyIdempotent
Return the messages in one conversation in chronological order.
| Name | Required | Description | Default |
|---|---|---|---|
| thread_id | Yes | Conversation ID returned on an email reference. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, and idempotentHint=true, so the safety profile is known. The description adds the chronological ordering and the scope of 'one conversation', but doesn't discuss error cases or pagination. With annotations covering safety, a 3 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, under 20 words, states the core action without any filler. Ideal conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only tool with a single parameter and a comprehensive schema, the description fully covers what the tool does. The output schema presumably details the return structure, and annotations cover safety. Nothing an agent needs is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the schema description for thread_id already explains it as 'Conversation ID returned on an email reference.' The tool description adds no further parameter details, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Return') and resource ('messages in one conversation') and specifies order ('chronological'), clearly distinguishing it from sibling tools like get_email which returns a single email.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It clearly implies usage when you have a thread_id from an email reference. However, it does not explicitly contrast with alternatives like get_email or search_emails, so it misses the explicit when-not guidance for a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_mailboxesList mailboxesARead-onlyIdempotent
List configured mailboxes with server and locally readable counts.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, so the description only needs to add context beyond that. It does by specifying that the tool returns counts for server and locally readable mailboxes, which is useful but doesn't disclose the full return structure. With annotations handling safety, this adds meaningful context without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, clear sentence with no filler. The key action and resource are front-loaded, and the additional count detail is presented efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple, parameterless list tool, the description is complete. It covers the purpose and the specific output (counts), and the presence of an output schema means return details need no further explanation. No essential information is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline of 4 applies. The description correctly has nothing to add about parameters, and the 100% schema coverage (empty properties) confirms no missing information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'List' and the resource 'configured mailboxes,' and adds the specific detail that it returns server and locally readable counts. This is distinct from sibling tools like search_emails or get_email, so an agent can easily understand its purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool (when you need a list of configured mailboxes) but does not explicitly mention alternatives or exclusions. No sibling tool appears to overlap directly, so the guidance is adequate without being explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_recentList recent emailsCRead-onlyIdempotent
List recent messages, optionally scoped to an account and mailbox.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of results to return. | |
| account | No | Account UUID; omit it to include every configured account. | |
| mailbox | No | Mailbox name to search, such as INBOX or Archive. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of disclosing behavioral traits. It implies a read-only operation but does not explain recency ordering, pagination, permission requirements, or what happens with unfiltered accounts. The description adds little beyond what the name already says.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one wasted-word-free sentence and front-loads the core action. It is efficient, though it remains thin enough that most of the burden is carried by the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations and no output schema, the description is too sparce to fully contextualize the tool. It does not define 'recent', specify ordering, describe returned fields, or differentiate this from the many email-related sibling tools. An agent would need to infer significant details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All parameters have helpful schema descriptions, high schema_description_coverage, so the baseline is 3. The description's mention of optional scoping repeats what the schema already states; no additional param meaning or format details are offered.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb (list) and resource (recent messages), and adds optional account/mailbox scoping. It does not explicitly contrast itself with sibling tools like search_emails or get_emails_bath, so it falls just short of strong differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to choose this tool over alternatives such as search_emails or get_thread. The phrase 'optimaly scoped' describes parameter behavior rather than usage context, and no exclusion or precondition is offered.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_scheduledList scheduled emailsARead-onlyIdempotent
List healthy and damaged scheduled-mail records by lifecycle state.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of results to return. | |
| state | No | Scheduled-mail state to return; omit it to include all states. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only contain a title, so the description must carry behavioral weight. It discloses that both healthy and damaged records are returned, a non-obvious trait. However, it does not confirm read-only safety or describe helper behavior around the 'damaged' category.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with no filler, front-loaded with the verb and resource. Every word contributes to the intended scope.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has a simple two-parameter schema, but no output schema and no behavioral annotations. The description lacks definitions for 'damaged' and does not mention pagination or return format, which an agent might need for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already documents both parameters well, including the state enum and limit bounds. The description's 'by lifecycle state' only restates the state filter, adding no new parameter meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description specifies the verb 'List' and the resource 'scheduled-mail records', which distinguishes it from sibling tools like list_mailboxes. The phrase 'healthy and damaged' adds a useful classification but is not fully defined, slightly reducing clarity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use guidance or alternatives are mentioned. The context implies this is the tool for listing scheduled emails, but no exclusions or comparative guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mailbox_createCreate a mailboxAIdempotent
Create a mailbox idempotently and report live and index verification.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Mailbox path within the account; slashes create nested folders. | |
| account | Yes | Account UUID that will own the mailbox. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover idempotency and non-read-only behavior, but the description adds that the tool reports live and index verification after creation. This adds behavioral context beyond the structured data and does not contradict the annotations, even though the exact meaning of 'live and index verification' is not expanded.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one front-loaded sentence that states the action, the idempotent property, and the verification outcome. Every phrase adds relevant information, with no waste or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with only two required scalar parameters, a detailed schema, and annotations covering idempotency and mutation, the description provides enough context for correct invocation. The main gap is that the verification reporting is not described in terms of a concrete return shape, and error behavior for an invalid account is unspecified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already fully documents both account and path, including the nested-folder behavior of slashes. Since schema coverage is high, the description does not need to contribute additional parameter meaning; it is at baseline for this situation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource — 'Create a mailbox' — and adds idempotency, which distinguishes this tool from siblings like mailbox_delete and create_draft. The phrase 'report live and index verification' also clarifies what the operation does beyond just creation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It is clear this tool is for creating mailboxes, and the idempotency qualifier implies it can be used when a mailbox might already exist. However, the description does not explicitly say when to prefer this over listing mailboxes or other related alternatives, so the usage guidance is implied rather than direct.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mailbox_deleteDelete a mailboxADestructiveIdempotent
Delete an empty mailbox only, with live verification and safe fallback.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Mailbox path within the account; slashes create nested folders. | |
| account | Yes | Account UUID that owns the mailbox. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already flag the tool as destructive and non-read-only. The description adds valuable context: 'live verification' (checks emptiness at call time) and 'safe fallback' (presumably aborts if non-empty). This goes beyond the annotation flags, though the fallback mechanism is somewhat vague.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single 11-word sentence with the core action and constraint front-loaded. Every phrase earns its place, and there is no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter destructive tool with a full input schema and annotation coverage, the description covers the key condition (empty-only) and the safety behavior. The exact behavior of the 'safe fallback' is unspecified, but the output schema likely documents the return value, so this is a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%: both parameters are described in the input schema, including path semantics with slashes and account UUID. The description itself adds no parameter-specific detail, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Delete'), resource ('mailbox'), and a clear precondition ('empty mailbox only'). This distinguishes it from sibling tools like mailbox_create and triage_plan_delete, and the 'empty only' qualifier precisely scopes the operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Delete an empty mailbox only' explicitly sets the condition for safe invocation and implies the tool is not for non-empty mailboxes. It doesn't name alternative tools, but no competing mailbox-deletion sibling exists, so the guidance is sufficient for selecting it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
refresh_mailRefresh mailARead-onlyIdempotent
Ask Mail.app to fetch new mail and report the before/after snapshot.
| Name | Required | Description | Default |
|---|---|---|---|
| wait_seconds | No | Seconds to wait after Mail.app starts refreshing. | |
| timeout_seconds | No | Maximum seconds allowed for the Mail.app refresh request. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds the behavioral detail that it reports a before/after snapshot, which goes beyond the annotations. It also notes that it asks Mail.app, indicating an external app interaction. Since annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, the safety profile is covered. The description provides a bit of extra context but does not disclose any limitations or side effects beyond what the parameters suggest (wait and timeout).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one sentence with no filler; it gets straight to the point. It front-loads the main action ('fetch new mail') and then adds the snapshot detail. It is concise and structured well, though it could arguably include a bit more structured detail, but it earns its place with its efficiency.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (two optional parameters, high schema coverage, and annotations covering safety), the description is mostly complete. It mentions the before/after snapshot, which is a key output behavior. The output schema exists, so return values need not be explained. The only minor gap is that it doesn't mention any prerequisites like Mail.app being running, but that is likely implied. Overall, an agent has enough to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 100%, with both parameters (wait_seconds and timeout_seconds) fully described in the schema. The tool description does not add any parameter-specific information, but per the rubric, a baseline of 3 is appropriate when the schema covers the parameters comprehensively. No additional semantic value is provided by the description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that the tool asks Mail.app to fetch new mail and reports a before/after snapshot. This is a specific action on a specific resource, and the snapshot detail adds unique behavior. However, it does not explicitly distinguish itself from sibling tools like search_emails or list_recent, though the verb 'refresh' and the snapshot concept make its role clear enough.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies that this tool is for fetching new mail, which is a clear context for when to use it. However, it provides no explicit guidance about when not to use it or mentions any alternatives such as search_emails or get_email. The usage is implied by the action itself, but there is no direct comparison or exclusion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
reply_emailReply to an emailB
Reply with correct threading, optional history, attachments, and reply-all.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | Optional comma-separated Cc recipients. | |
| id | Yes | Envelope ID of the email being answered. | |
| bcc | No | Optional comma-separated Bcc recipients. | |
| body | Yes | Plain-text email content; paragraph breaks are preserved. | |
| reply_all | No | Also copy the original To and Cc recipients, excluding yourself. | |
| attachments | No | Optional list of local file paths, one path per item. | |
| from_identity | No | Configured sending identity; omit it to use the default. | |
| include_history | No | Quote the original message below the new reply. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare the mutable, non-idempotent, open-world nature of the call. The description adds the useful behavioral trait that replies are threaded correctly and history is quoted by default, but it doesn't state side effects like whether a sent reply is also filed in the mailbox or how it interacts with drafts.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single compact sentence that front-loads the core action and lists the salient options without filler. Every clause maps to a real capability of the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present and full parameter documentation, the description covers the essentials an agent needs. It is only slightly thin on the reply-versus-send routing decision, which is the main remaining gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all eight parameters are already documented in the schema, including reply_all semantics and include_history default. The description adds nothing beyond what the schema states, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb (Reply) and resource (email) and enumerates the distinguishing features: threading, optional history, attachments, reply-all. It doesn't explicitly contrast with siblings like send_email or create_draft, so an agent must infer the difference, but the purpose itself is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to reply versus use send_email or create_draft, and no prerequisites such as requiring a valid envelope ID from a prior read. The agent is left to infer that this is the answer-to-existing-message path.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
schedule_emailSchedule an emailB
Freeze an email now and schedule local or Exchange-side delivery.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | Optional comma-separated Cc recipients. | |
| to | Yes | Comma-separated primary recipients, including optional display names. | |
| bcc | No | Optional comma-separated Bcc recipients. | |
| body | Yes | Plain-text email content; paragraph breaks are preserved. | |
| send_at | Yes | Delivery time in ISO-8601; a timestamp without an offset is local time. | |
| subject | Yes | Email subject line. | |
| references | No | Optional References header of the message being answered; in_reply_to is appended to it. | |
| attachments | No | Optional list of local file paths, one path per item. | |
| in_reply_to | No | Optional Message-ID of the message being answered, so the mail threads as a reply. | |
| from_identity | No | Configured sending identity; omit it to use the default. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, idempotentHint=false, destructiveHint=false and openWorldHint=true, so the safety profile is covered. The description adds one genuinely useful behavioral fact: content is 'frozen' now, implying attachments (local file paths) and body are resolved at schedule time, not delivery time. It says nothing about cancellation, permission requirements, or what happens if delivery fails.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with the core action first and the delivery-mode nuance trailing. Zero filler, no restatement of the title or parameter list.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 10-parameter, non-idempotent, open-world mutation tool, one sentence is thin. The output schema means return values needn't be explained and the 100%-covered schema handles parameters, but the description omits the scheduling lifecycle (how to view or cancel scheduled mail) and the timing consequence of 'freeze now' for attachment paths.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% across all 10 parameters, so the schema already carries the semantics (Cc/Bcc format, ISO-8601 send_at with local-time default, reply threading via in_reply_to/references, attachment paths). The description contributes no additional parameter meaning, which is the expected baseline when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('schedule ... delivery') and adds the unusual but informative 'freeze an email now', which tells the agent the message content is captured at scheduling time rather than send time. It does not explicitly name the sibling it contrasts with (send_email for immediate delivery, create_draft for unsent drafts), so sibling differentiation is only implied.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use or when-not-to-use guidance and no alternative named, despite the presence of send_email, create_draft, list_scheduled and cancel_scheduled as siblings. The only usage signal is the incidental phrase 'local or Exchange-side delivery', which hints at two scheduling modes but never tells the agent how to choose or what to expect.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_emailsSearch emailsARead-onlyIdempotent
Search local envelope data and indexed body content. Check the returned FTS coverage before treating no matches as proof that no email exists. Sender filters are case-insensitive substring matches.
| Name | Required | Description | Default |
|---|---|---|---|
| after | No | Only include mail after this ISO-8601 date or timestamp. | |
| limit | No | Maximum number of results to return. | |
| query | No | Words to find in the subject, sender, snippet, or indexed body. | |
| before | No | Only include mail before this ISO-8601 date or timestamp. | |
| offset | No | Number of matching results to skip for pagination. | |
| account | No | Account UUID; omit it to include every configured account. | |
| mailbox | No | Mailbox name to search, such as INBOX or Archive. | |
| to_addr | No | Recipient name, address, or address fragment to match. | |
| from_addr | No | Sender name, address, or address fragment to match. | |
| unread_only | No | When true, include only unread messages. | |
| has_attachment | No | True for mail with attachments, false for mail without them. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/non-destructive, so the safety profile is covered. The description adds genuinely new behavioral context that annotations cannot convey: the returned FTS coverage signal and the need to check it before concluding an email is absent, plus the case-insensitive substring matching semantics of sender filters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, each carrying distinct information: what is searched, how to interpret empty results, and one matching-semantics detail. No filler or repetition of the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained. For an 11-parameter filter tool with full schema documentation, the description supplies the one thing the schema cannot (the FTS coverage caveat). It is complete enough, though it could note the account/mailbox scoping interaction.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description goes beyond the schema by specifying that sender filters are case-insensitive substring matches, which the from_addr/to_addr schema text ('name, address, or address fragment to match') does not state explicitly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and dual resource scope: 'Search local envelope data and indexed body content.' Clear what it does, but it draws no boundary against siblings like list_recent, get_email, or get_thread, so the agent must infer when this broad search is preferable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The FTS-coverage caveat gives useful guidance on interpreting results ('check coverage before treating no matches as proof'), which is implied usage guidance. However, there is no explicit when-to-use versus list_recent or get_email, and no statement of prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
send_emailSend an emailB
Compose standards-correct MIME and send it through the selected identity.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | Optional comma-separated Cc recipients. | |
| to | Yes | Comma-separated primary recipients, including optional display names. | |
| bcc | No | Optional comma-separated Bcc recipients. | |
| body | Yes | Plain-text email content; paragraph breaks are preserved. | |
| subject | Yes | Email subject line. | |
| attachments | No | Optional list of local file paths, one path per item. | |
| from_identity | No | Configured sending identity; omit it to use the default. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, openWorldHint=true, idempotentHint=false, and destructiveHint=false, so the safety profile is covered. The description adds a modest detail about MIME composition quality but omits consequences the agent would care about: that sending is irreversible, that repeated calls produce duplicate mail, and whether a copy is retained in Sent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler, which is well sized for the tool. The wording is slightly cryptic ('standards-correct MIME', 'selected identity') rather than plainly informative, keeping it short of a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need no explanation, and the annotations carry the safety profile. For a straightforward send operation with fully described parameters, the description supplies enough to invoke the tool correctly; the remaining gaps (usage routing, irreversibility) are shared with the sibling set rather than blocking correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter (to, cc, bcc, body, subject, attachments, from_identity) is already documented in the schema. The description's only parameter-relevant content is the vague reference to 'the selected identity', which adds no syntax or format detail beyond what the schema provides, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('send' + email) and adds the mechanism ('compose standards-correct MIME'). However, it does not differentiate from close siblings such as reply_email, schedule_email, or create_draft, so an agent cannot tell from the description alone which send path applies to a reply or a scheduled message.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use or when-not-to-use guidance and no named alternative. The phrase 'through the selected identity' hints that from_identity matters, but nothing tells the agent to prefer this over create_draft, schedule_email, or reply_email for the corresponding scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
triage_applyApply reviewed mailbox changesADestructiveIdempotent
Apply one reviewed plan, optionally excluding selected envelope IDs, and verify the retained messages. A successful claim consumes the whole plan once.
| Name | Required | Description | Default |
|---|---|---|---|
| plan_id | Yes | Triage plan ID returned by a planning tool. | |
| exclude_ids | No | Envelope IDs from this reviewed plan to leave untouched. Omit or pass an empty list to apply the full plan. At least one message must remain selected. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, idempotentHint=true and openWorldHint=true. The description adds genuine context beyond them: the plan is a single-use claim consumed exactly once, exclusion IDs are left untouched, and the retained messages are verified afterward. It still doesn't say what operation is actually applied to the selected messages.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core action and closing with the single-use consumption rule. Every clause carries information; no padding or restatement of the title.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return values need no explanation, and annotations plus a 100%-covered schema handle safety and parameters. The description supplies the one-shot consumption semantics that the schema can't express, leaving only the nature of the applied changes implicit.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters are fully documented in the schema, including the empty-list and at-least-one-remaining rules. The description only restates the exclusion behavior, adding little beyond the structured fields. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('apply one reviewed plan') and adds the exclusion and verification scope, which separates it from triage_plan (which produces the plan). It never names siblings explicitly, so an agent must infer the pairing from context, but the operation itself is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'One reviewed plan' implies this runs after a review/planning step, but the description never says to call triage_plan first, or when to use triage_plan_delete versus this tool. Usage is implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
triage_planPrepare mailbox changesA
Prepare a reviewable bulk-change plan; sender filters use case-insensitive substring matching.
| Name | Required | Description | Default |
|---|---|---|---|
| after | No | Only include mail after this ISO-8601 date or timestamp. | |
| limit | No | Maximum messages to stage; 0 uses the configured safe plan cap. | |
| query | No | Words to find in the subject, sender, snippet, or indexed body. | |
| before | No | Only include mail before this ISO-8601 date or timestamp. | |
| account | No | Account UUID; omit it to include every configured account. | |
| actions | No | Mailbox actions to stage for every selected message. | |
| mailbox | No | Mailbox name to search, such as INBOX or Archive. | |
| to_addr | No | Recipient name, address, or address fragment to match. | |
| from_addr | No | Sender name, address, or address fragment to match. | |
| unread_only | No | When true, include only unread messages. | |
| has_attachment | No | True for mail with attachments, false for mail without them. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are all false hints, so they do not clarify side effects. The description adds that the result is a 'reviewable' plan, suggesting changes are not applied immediately, and it adds the case-insensitive substring behavior. However, it does not explicitly state that no mailbox changes are actually made, whether the plan is persisted, or what side effects occur when preparing it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with two short clauses and no filler. The core action, 'prepare a reviewable bulk-change plan,' is front-loaded, and the matching behavior is added as a useful secondary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The schema richly documents all 11 parameters and an output schema exists, so return-value details are covered. What is missing is workflow context: that the plan should be reviewed and then applied via triage_apply, and that preparing the plan does not itself apply mailbox changes. For a non-read-only tool with this many parameters, the one-sentence description is minimally sufficient but leaves important behavioral gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3 because parameter descriptions already exist. The description adds meaningful value by specifying that sender filters match case-insensitively as substrings, which is not stated in the from_addr/to_addr schema entries. It doesn't elaborate on every parameter, but the schema already handles those details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The verb 'prepare' and the object 'reviewable bulk-change plan' state a specific, concrete function: this tool stages changes for review rather than executing them. This distinguishes it from siblings like triage_apply. The generic title 'Prepare mailbox changes' is clarified by the description's focus on producing a plan.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no explicit when-to-use guidance or alternatives. 'Reviewable bulk-change plan' implies a plan-then-apply workflow, and sibling triage_apply exists, but the description never says to use this before triage_apply or that triage_apply should be used afterward. The matching-semantics clause is about filtering behavior, not tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
triage_plan_deletePrepare email deletionB
Prepare a capped Trash plan whose sender filter is exact, never a broad substring match.
| Name | Required | Description | Default |
|---|---|---|---|
| after | No | Only include mail after this ISO-8601 date or timestamp. | |
| limit | No | Maximum messages to stage; 0 uses the configured deletion cap. | |
| query | No | Words to find in the subject, sender, snippet, or indexed body. | |
| before | No | Only include mail before this ISO-8601 date or timestamp. | |
| account | No | Account UUID; omit it to include every configured account. | |
| mailbox | No | Mailbox name to search, such as INBOX or Archive. | |
| to_addr | No | Recipient name, address, or address fragment to match. | |
| from_addr | No | Exact sender email address to match; fragments never select mail. | |
| unread_only | No | When true, include only unread messages. | |
| has_attachment | No | True for mail with attachments, false for mail without them. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already signal read/write and destructive hints, so the description's added 'capped Trash plan' and exact-sender rule provide some extra context. However, it does not explain side effects, what 'capped' means operationally, or what happens when this plan is applied.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with no filler, and the central constraint about exact sender matching is placed immediately after the main action. It could be more informative, but it is structured efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 10-parameter tool that prepares a deletion plan, the description is too thin. It omits how a capped plan relates to the limit parameter, whether any deletion is performed immediately, and what distinguishes it from triage_plan or triage_apply.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameters are already documented. The description's main semantic addition, exact sender matching, is also already stated in the from_addr schema, so it adds little beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies a specific action and object: preparing a capped Trash plan, and adds a concrete selection rule (exact sender match). It is clearer than the name alone, though it does not explicitly contrast with sibling tools such as triage_plan.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance about when to use this tool rather than triage_plan, search_emails, or triage_apply. The sentence states a behavior but not a decision context or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
2 tool updates
v1.8.2- Changed
create_draft1 field changed- changed
Input schema / properties / in_reply_to / descriptionPrevious value: -"Optional Message-ID used to thread the draft as a reply."New value: +"Optional Message-ID of the message being answered, so the mail threads as a reply."
- Changed
schedule_email2 fields changed- added
Input schema / properties / in_reply_toAdded value: +{ + "default": "", + "description": "Optional Message-ID of the message being answered, so the mail threads as a reply.", + "title": "In Reply To", + "type": "string" +} - added
Input schema / properties / referencesAdded value: +{ + "default": "", + "description": "Optional References header of the message being answered; in_reply_to is appended to it.", + "title": "References", + "type": "string" +}
1 tool update
v1.8.0- Changed
triage_apply1 field changed- added
Input schema / properties / exclude_idsAdded value: +{ + "anyOf": [ + { + "items": { + "type": "string" + }, + "type": "array" + }, + { + "type": "null" + } + ], + "default": null, + "description": "Envelope IDs from this reviewed plan to leave untouched. Omit or pass an empty list to apply the full plan. At least one message must remain selected.", + "title": "Exclude Ids" +}
3 tool updates
v1.6.0- Changed
reply_email1 field changed- changed
Output schema / anyOfPrevious value: -[ - { - "additionalProperties": true, - "properties": { - "attachments": { - "items": { - "type": "string" - }, - "type": "array" - }, - "bcc": { - "items": { - "type": "string" - }, - "type": "array" - }, - "bootstrapped": { - "type": "boolean" - }, - "cc": { - "items": { - "type": "string" - }, - "type": "array" - }, - "error": { - "anyOf": [ - { - "type": "string" - }, - { - "type": "null" - } - ] - }, - "message_id": { - "type": "string" - }, - "ok": { - "type": "boolean" - }, - "subject": { - "type": "string" - }, - "to": { - "items": { - "type": "string" - }, - "type": "array" - } - }, - "required": [ - "ok", - "message_id", - "to", - "cc", - "bcc", - "subject", - "attachments", - "bootstrapped", - "error" - ], - "type": "object" - }, - { - "additionalProperties": true, - "properties": { - "code": { - "type": "string" - }, - "error": { - "type": "string" - }, - "fix": { - "type": "string" - }, - "ok": { - "const": false - }, - "operation_id": { - "type": "string" - } - }, - "required": [ - "ok", - "code", - "error" - ], - "type": "object" - } -]New value: +[ + { + "additionalProperties": true, + "properties": { + "accepted": { + "items": { + "type": "string" + }, + "type": "array" + }, + "attachments": { + "items": { + "type": "string" + }, + "type": "array" + }, + "bcc": { + "items": { + "type": "string" + }, + "type": "array" + }, + "bootstrapped": { + "type": "boolean" + }, + "cc": { + "items": { + "type": "string" + }, + "type": "array" + }, + "code": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ] + }, + "error": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ] + }, + "message_id": { + "type": "string" + }, + "ok": { + "type": "boolean" + }, + "refused": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "subject": { + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "required": [ + "ok", + "message_id", + "to", + "cc", + "bcc", + "subject", + "attachments", + "bootstrapped", + "error", + "accepted", + "refused", + "code" + ], + "type": "object" + }, + { + "additionalProperties": true, + "properties": { + "code": { + "type": "string" + }, + "error": { + "type": "string" + }, + "fix": { + "type": "string" + }, + "ok": { + "const": false + }, + "operation_id": { + "type": "string" + } + }, + "required": [ + "ok", + "code", + "error" + ], + "type": "object" + } +]
- Changed
schedule_email1 field changed- changed
Output schema / anyOfPrevious value: -[ - { - "additionalProperties": true, - "properties": { - "attachments": { - "items": { - "type": "string" - }, - "type": "array" - }, - "attempts": { - "type": "integer" - }, - "bcc": { - "items": { - "type": "string" - }, - "type": "array" - }, - "cc": { - "items": { - "type": "string" - }, - "type": "array" - }, - "created_at": { - "type": "string" - }, - "delivered_at": { - "anyOf": [ - { - "type": "string" - }, - { - "type": "null" - } - ] - }, - "executor": { - "type": "string" - }, - "graph_draft_id": { - "anyOf": [ - { - "type": "string" - }, - { - "type": "null" - } - ] - }, - "id": { - "type": "string" - }, - "identity": { - "type": "string" - }, - "last_error": { - "anyOf": [ - { - "type": "string" - }, - { - "type": "null" - } - ] - }, - "message_id": { - "type": "string" - }, - "next_attempt_at": { - "anyOf": [ - { - "type": "string" - }, - { - "type": "null" - } - ] - }, - "ok": { - "const": true - }, - "send_at": { - "type": "string" - }, - "status": { - "type": "string" - }, - "subject": { - "type": "string" - }, - "to": { - "items": { - "type": "string" - }, - "type": "array" - } - }, - "required": [ - "ok", - "id", - "send_at", - "created_at", - "to", - "cc", - "bcc", - "subject", - "attachments", - "message_id", - "status", - "attempts", - "next_attempt_at", - "last_error", - "delivered_at", - "identity", - "executor", - "graph_draft_id" - ], - "type": "object" - }, - { - "additionalProperties": true, - "properties": { - "code": { - "type": "string" - }, - "error": { - "type": "string" - }, - "fix": { - "type": "string" - }, - "ok": { - "const": false - }, - "operation_id": { - "type": "string" - } - }, - "required": [ - "ok", - "code", - "error" - ], - "type": "object" - } -]New value: +[ + { + "additionalProperties": true, + "properties": { + "accepted": { + "items": { + "type": "string" + }, + "type": "array" + }, + "attachments": { + "items": { + "type": "string" + }, + "type": "array" + }, + "attempts": { + "type": "integer" + }, + "bcc": { + "items": { + "type": "string" + }, + "type": "array" + }, + "cc": { + "items": { + "type": "string" + }, + "type": "array" + }, + "claimed_at": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ] + }, + "code": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ] + }, + "created_at": { + "type": "string" + }, + "delivered_at": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ] + }, + "executor": { + "type": "string" + }, + "graph_draft_id": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ] + }, + "id": { + "type": "string" + }, + "identity": { + "type": "string" + }, + "last_error": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ] + }, + "message_id": { + "type": "string" + }, + "next_attempt_at": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ] + }, + "ok": { + "const": true + }, + "refused": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "send_at": { + "type": "string" + }, + "status": { + "type": "string" + }, + "subject": { + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "required": [ + "ok", + "id", + "send_at", + "created_at", + "to", + "cc", + "bcc", + "subject", + "attachments", + "message_id", + "status", + "attempts", + "next_attempt_at", + "last_error", + "delivered_at", + "identity", + "executor", + "graph_draft_id", + "accepted", + "refused", + "code", + "claimed_at" + ], + "type": "object" + }, + { + "additionalProperties": true, + "properties": { + "code": { + "type": "string" + }, + "error": { + "type": "string" + }, + "fix": { + "type": "string" + }, + "ok": { + "const": false + }, + "operation_id": { + "type": "string" + } + }, + "required": [ + "ok", + "code", + "error" + ], + "type": "object" + } +]
- Changed
send_email1 field changed- changed
Output schema / anyOfPrevious value: -[ - { - "additionalProperties": true, - "properties": { - "attachments": { - "items": { - "type": "string" - }, - "type": "array" - }, - "bcc": { - "items": { - "type": "string" - }, - "type": "array" - }, - "bootstrapped": { - "type": "boolean" - }, - "cc": { - "items": { - "type": "string" - }, - "type": "array" - }, - "error": { - "anyOf": [ - { - "type": "string" - }, - { - "type": "null" - } - ] - }, - "message_id": { - "type": "string" - }, - "ok": { - "type": "boolean" - }, - "subject": { - "type": "string" - }, - "to": { - "items": { - "type": "string" - }, - "type": "array" - } - }, - "required": [ - "ok", - "message_id", - "to", - "cc", - "bcc", - "subject", - "attachments", - "bootstrapped", - "error" - ], - "type": "object" - }, - { - "additionalProperties": true, - "properties": { - "code": { - "type": "string" - }, - "error": { - "type": "string" - }, - "fix": { - "type": "string" - }, - "ok": { - "const": false - }, - "operation_id": { - "type": "string" - } - }, - "required": [ - "ok", - "code", - "error" - ], - "type": "object" - } -]New value: +[ + { + "additionalProperties": true, + "properties": { + "accepted": { + "items": { + "type": "string" + }, + "type": "array" + }, + "attachments": { + "items": { + "type": "string" + }, + "type": "array" + }, + "bcc": { + "items": { + "type": "string" + }, + "type": "array" + }, + "bootstrapped": { + "type": "boolean" + }, + "cc": { + "items": { + "type": "string" + }, + "type": "array" + }, + "code": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ] + }, + "error": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ] + }, + "message_id": { + "type": "string" + }, + "ok": { + "type": "boolean" + }, + "refused": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "subject": { + "type": "string" + }, + "to": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "required": [ + "ok", + "message_id", + "to", + "cc", + "bcc", + "subject", + "attachments", + "bootstrapped", + "error", + "accepted", + "refused", + "code" + ], + "type": "object" + }, + { + "additionalProperties": true, + "properties": { + "code": { + "type": "string" + }, + "error": { + "type": "string" + }, + "fix": { + "type": "string" + }, + "ok": { + "const": false + }, + "operation_id": { + "type": "string" + } + }, + "required": [ + "ok", + "code", + "error" + ], + "type": "object" + } +]
21 tool updates
v0.1.0- First observed
audit - First observed
cancel_scheduled - First observed
create_draft - First observed
doctor - First observed
get_attachment - First observed
get_email - First observed
get_emails_batch - First observed
get_thread - First observed
list_mailboxes - First observed
list_recent - First observed
list_scheduled - First observed
mailbox_create - First observed
mailbox_delete - First observed
refresh_mail - First observed
reply_email - First observed
schedule_email - First observed
search_emails - First observed
send_email - First observed
triage_apply - First observed
triage_plan - First observed
triage_plan_delete
TDQS
Scored across 21 tools
Most tools are clearly distinct: send, reply, schedule, and draft are separate, while read operations are split by single, batch, thread, search, and recent listing. Minor overlap exists between triage_plan and triage_plan_delete, and between search_emails and list_recent, but descriptions clarify their boundaries.
Most names follow verb_noun (get_email, list_mailboxes, send_email), but mailbox_create/mailbox_delete reverse the order, triage tools mix noun and verb patterns, and doctor/audit are bare nouns. The set remains readable, but the convention is not fully consistent.
At 21 tools, the surface is borderline heavy for an email client, though many map to legitimate lifecycle operations. It also includes niche diagnostic and audit tools, pushing it into the 16-25 range that feels somewhat over-scoped.
Core email lifecycle is well covered: send, reply, draft, schedule, search, read, batch, thread, attachments, mailbox management, triage, audit, and diagnostics. Missing forward_email and direct draft editing or flagging are minor gaps that most agents can work around.
Maintenance
Related MCP Connectors
Hosted email MCP for your own Gmail, Outlook.com, Microsoft 365, iCloud or IMAP inbox: read, search, draft, reply in thread, forward and file mail. It moves or flags up to 500 messages in one call, and a send leaves exactly one copy in Sent. A calendar is a separate connection, and connecting one adds diary and scheduling tools.
Email infrastructure for AI agents — send, receive, search, and reply to email over MCP.
Your IMAP mailbox as an MCP server: read, search and (if you allow it) organize mail. Open source.
Your mailbox for MCP clients: search, read, draft, send, rules and notes. Sending is off by default.
Related MCP Servers
- AlicenseAqualityDmaintenanceA local MCP server for searching and reading downloaded Apple Mail data without changing mail state.68MIT
- AlicenseNot gradedqualityDmaintenanceEnables MCP clients to search, read, and inspect Apple Mail on macOS, including conversations and attachments. It can create new, reply, reply-all, or forward drafts, but cannot send or modify existing messages.MIT
- AlicenseNot gradedqualityBmaintenanceMCP server that gives an AI assistant access to IMAP/SMTP mailboxes to read, search, organize, draft, and send email, with local mirroring and full-text search, no third-party data path, and credentials stored only in the macOS Keychain.17 npmMIT
- AlicenseNot gradedqualityBmaintenanceEnables searching, reading full conversations, and sending email across multiple IMAP/SMTP mailboxes from any MCP client, with multi-user support and per-user API tokens.MIT