cpanel-mail-mcp
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@cpanel-mail-mcpshow my latest 5 emails in Inbox"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
cpanel-mail-mcp
MCP server for IMAP/SMTP email accounts — works with cPanel, Gmail (app passwords), Outlook, Fastmail, iCloud, or any provider that speaks plain IMAP + SMTP.
Features
22 typed MCP tools — one per operation with Pydantic input/output schemas, tool annotations (
readOnlyHint/destructiveHint/…), and actionable error messagesFull mailbox management — read, search, threading, move, copy, flag, star, delete, reply, forward, drafts, calendar invites, folder create/delete/rename
Multi-user server mode — one instance, many users, each with their own bearer token and mailbox (per-request isolation)
OAuth 2.1 via Cloudflare Access — optional SSO (Google / GitHub / Email OTP) instead of shared bearer tokens; server exposes RFC 9728 protected-resource metadata, RFC 8414 AS metadata, and RFC 7591 DCR — proxied over CF Access SaaS OIDC
Idempotent sends — pass
idempotency_keyonsend_email/reply_email/forward_email/send_inviteto safely retry after client timeoutsPer-caller rate limiting — sliding window (send: 30/min, read: 300/min defaults), tunable per bucket
Attachment size guard — configurable cap (default 25 MB total)
Multi-account — manage multiple email accounts from different providers
Read, search, list — full IMAP support with folder browsing
Send emails — plain text, HTML, or both (multipart/alternative)
Attachments — send via file path or base64-encoded inline data
Download attachments — extract attachments from received emails as base64
Calendar invites — send proper ICS invitations with Accept/Decline buttons
Save to Sent — automatically saves sent emails to the Sent folder via IMAP
Optional send gate — configurable confirmation code to prevent accidental sends
International folders — handles UTF-7 encoded folder names (German, etc.)
Compact MCP surface — one
emailtool with lazy action discovery to reduce client context use
Related MCP server: MCP Mail Organizer
Install
With uvx (recommended, no venv setup)
claude mcp add cpanel-mail \
-e CPANEL_USER=you@example.com \
-e CPANEL_PASS='your_password' \
-e CPANEL_SMTP_HOST=mail.example.com \
-e CPANEL_IMAP_HOST=mail.example.com \
-- uvx cpanel-mail-mcpWith pipx
pipx install cpanel-mail-mcp
claude mcp add cpanel-mail \
-e CPANEL_USER=you@example.com -e CPANEL_PASS='...' \
-e CPANEL_SMTP_HOST=mail.example.com -e CPANEL_IMAP_HOST=mail.example.com \
-- cpanel-mail-mcpDevelopment install (from a git checkout)
git clone https://github.com/rosauceda/cpanel-mail-mcp
cd cpanel-mail-mcp
python -m venv .venv && source .venv/bin/activate
pip install -e .
cp .env.example .env # edit
cpanel-mail-mcp # runs the stdio server
# or: python -m cpanel_mail_mcpConfiguration
Three ways, in priority order:
1. EMAIL_ACCOUNTS_JSON (best for multi-account)
export EMAIL_ACCOUNTS_JSON='[
{"name":"work","user":"me@work.com","password":"...",
"smtp_host":"mail.work.com","imap_host":"mail.work.com",
"sent_folder":"INBOX.Sent"},
{"name":"gmail","user":"me@gmail.com","password":"app_pass",
"smtp_host":"smtp.gmail.com","smtp_port":587,
"imap_host":"imap.gmail.com","sent_folder":"[Gmail]/Sent Mail"}
]'2. EMAIL_ACCOUNTS_FILE
Point to a JSON file with the same shape.
3. Legacy single-account (CPANEL_*)
Backwards compatible with 0.1.x installs. See .env.example.
Account fields
field | required | default |
| no |
|
| yes | — |
| yes | — |
| yes | — |
| no |
|
| yes | — |
| no |
|
| no |
|
| no |
|
| no |
|
| no | — |
| no |
|
sso_emails is a list of external identities (e.g. Google login addresses)
that map to this account. Only used in OAuth mode: the JWT email claim is
looked up here before falling back to user. Handy when the SSO identity
differs from the mailbox address — e.g. logging in with me@gmail.com to
access me@company.com.
Loading a dev .env
The server auto-loads .env from the current working directory. Point it
elsewhere with:
export EMAIL_ENV_FILE=/absolute/path/to/.envTools
Since 0.7.0 the server exposes one tool per operation (was a single
dispatcher tool before). Every tool has a typed Pydantic input schema, an
outputSchema for structuredContent, and annotations
(readOnlyHint / destructiveHint / idempotentHint / openWorldHint)
so clients can render the right approval UI.
tool | annotations | purpose |
| read-only, idempotent | Accounts visible to caller (no secrets) |
| read-only, idempotent, openWorld | IMAP folders (UTF-7 decoded) |
| read-only, idempotent, openWorld | Paginated list of recent messages |
| read-only, idempotent, openWorld | IMAP SEARCH by FROM/TO/SUBJECT/BODY/TEXT |
| read-only, idempotent, openWorld | Headers + body (opt: attachments as base64) |
| read-only, idempotent, openWorld | Fetch attachments by name filter |
| read-only, idempotent, openWorld | Group messages by Message-ID/References |
| destructive, idempotent | Send new message (attachments, HTML, save-to-sent) |
| destructive, idempotent | Reply to UID, preserves References chain |
| destructive, idempotent | Forward UID (attaches original body + files) |
| destructive, idempotent | ICS calendar invite (RFC 5545, METHOD:REQUEST) |
| non-destructive, idempotent | APPEND a draft to Drafts folder |
| non-destructive, idempotent, openWorld | Toggle \Seen flag |
| non-destructive, idempotent, openWorld | Toggle \Flagged flag |
| non-destructive, idempotent | RFC 6851 MOVE (COPY+EXPUNGE fallback) |
| non-destructive | IMAP COPY |
| destructive, idempotent | Soft-delete → Trash (or hard with |
| non-destructive | IMAP CREATE + SUBSCRIBE |
| destructive, idempotent | IMAP DELETE (must be empty) |
| non-destructive | IMAP RENAME |
Example — send with attachment + Save-to-Sent
{
"tool": "send_email",
"arguments": {
"to": "someone@example.com",
"subject": "Report",
"text": "See attached.",
"html": "<p>See <b>attached</b>.</p>",
"attachments": [
{"path": "/tmp/report.pdf"},
{"name": "note.txt", "content": "hi from inline"}
],
"idempotency_key": "report-2026-07-20-A"
}
}Attachment shapes accepted:
{"path": "/local/file.pdf", "name": "renamed.pdf"?}— read from disk{"name": "x.bin", "content_base64": "..."}— inline base64{"name": "x.txt", "content": "hello", "mime": "text/plain"?}— inline text
Total attachment size is capped by MCP_MAX_ATTACHMENT_MB (default 25 MB).
Idempotent sends
Any of send_email, reply_email, forward_email, send_invite accept
idempotency_key. Second call with the same (caller, key) within 5
minutes returns the cached first response (idempotent_replay: true) — no
duplicate delivery on client retries.
Rate limiting
Per-caller sliding window; defaults:
send bucket (send/reply/forward/invite/draft): 30 requests/min
read bucket (everything else): 300 requests/min
Tune via MCP_RATE_LIMIT_SEND_PER_MIN / MCP_RATE_LIMIT_READ_PER_MIN.
When exceeded, the tool returns a structured error with retry_after_seconds.
Reply / forward preserve threading
reply_email copies the original Message-ID into In-Reply-To and appends
it to References so mail clients thread correctly. forward_email adds a
standard Fwd: prefix and quotes the original headers + body inline; any
attachments on the original are re-attached to the forward.
Pick an account (multi-account setup)
Every tool accepts an optional account param; omit it to use the first
configured account. In multi-user OAuth mode this field is ignored — the
account is chosen by the caller's bearer token or SSO email.
Run as an HTTP server (LXC / VPS / homelab)
By default cpanel-mail-mcp runs over stdio — your MCP client
launches it per session. To run it 24/7 as a shared HTTPS endpoint,
you have two shapes:
Multi-user (recommended for a team)
One instance, many users. Each person has their own bearer token, and the server enforces that they can only touch their own mailbox. Setup:
# on the server (Debian/Ubuntu LXC as root)
apt install -y curl # if not present
curl -fsSL https://raw.githubusercontent.com/rosauceda/cpanel-mail-mcp/main/deploy/install.sh | bash
# after logging out and back in (so $EMAIL_USERS_FILE is exported):
cpanel-mail-mcp admin add-user --email juan@dominio.com --host mail.dominio.com
# prompts for password → prints juan's bearer token → hand it to juan
systemctl enable --now cpanel-mail-mcpEach user, in their Claude Code:
claude mcp add --transport http --scope user cpanel-mail \
--header "Authorization: Bearer <THEIR_TOKEN>" \
https://mcp.yourdomain.com/mcpFull docs, admin CLI, migration, Cloudflare Tunnel example, hardened
systemd unit → deploy/.
Single-tenant (only you)
export MCP_TRANSPORT=streamable-http
export MCP_HOST=127.0.0.1
export MCP_PORT=8080
export MCP_AUTH_TOKEN="$(python3 -c 'import secrets; print(secrets.token_urlsafe(36))')"
export EMAIL_ACCOUNTS_JSON='[{...one account...}]' # or EMAIL_ACCOUNTS_FILE
cpanel-mail-mcpEndpoints:
POST /mcp— MCP Streamable HTTP transport (requires bearer token)GET /health— plainokfor reverse-proxy probes
OAuth 2.1 via Cloudflare Access (optional, for MCP clients that require OAuth)
Adds SSO on top of the multi-user mode. Cloudflare Access SaaS OIDC does the
actual user login (Google / GitHub / Email OTP); the server verifies the
resulting JWT and maps email → account. Also exposes:
GET /.well-known/oauth-protected-resource(RFC 9728) — root and/mcppath-suffixedGET /.well-known/oauth-authorization-server(RFC 8414) — composed metadata that adds aregistration_endpointPOST /register(RFC 7591 Dynamic Client Registration) — returns the pre-configured CF client credentials so DCR-only clients can registerWWW-Authenticate: Bearer realm="mcp", resource_metadata="..."on 401 responses
Env vars to enable:
var | purpose |
| audience tag / SaaS app Client ID |
| full CF OIDC issuer URL |
| same as above (enables the DCR proxy) |
| SaaS app Client ID |
| SaaS app Client Secret |
| public URL of this server |
Full setup (CF dashboard config, systemd env file, ingress) →
deploy/README.md.
Client compatibility
Client | Auth mode | Status |
Claude Code CLI ( | Multi-user bearer | ✅ Works |
Claude Code CLI + OAuth ( | OAuth 2.1 with static credentials | ✅ Works |
Anthropic Messages API ( | Static bearer, no OAuth flow | ✅ Works |
claude.ai Custom Connector (web) | OAuth 2.1 via CF Access OIDC | ⚠️ Beta — see below |
claude.ai Custom Connector — known issue (may be fixed in 0.7.0)
Custom Connectors is still marked BETA. Earlier versions (≤0.6.x) exposed a
single email dispatcher tool with a generic params: dict; Anthropic's
frontend rejected the setup with an opaque ofid_... reference before
opening the OAuth browser. In 0.7.0 the surface changed to 22 individually
typed tools with outputSchema and annotations, which may help.
If setup still fails on 0.7.0+:
Fill in the OAuth Client ID and Secreto del cliente OAuth fields from your CF Access SaaS app manually (leaving them empty relies on DCR, which we proxy but Claude's frontend may still fail on).
Contact Anthropic support with the exact
ofid_...reference from the error toast — only they can look up what specifically failed.Meanwhile use the Claude Code CLI (works fully) or the Messages API with a static
authorization_token.
Send gate (recommended when an agent has this tool)
Prevent accidental sends by requiring a shared secret:
export EMAIL_SEND_CONFIRMATION_CODE=please-sendEvery send / send_invite call must include confirm: "please-send" in
params, or the server refuses.
Security notes
.envis git-ignored. Never commit it.Prefer a dedicated mailbox (e.g.
mcp@yourdomain.com) with a small quota.If your provider supports app passwords (Gmail, Fastmail, iCloud), use one instead of your primary password.
MCP env vars end up in
~/.claude.jsonon your machine — treat that file like a keychain.
License
MIT — see LICENSE.
Tool Definition Quality
Average 3.5/5 across 22 of 22 tools scored. Lowest: 2.2/5.
Each tool targets a distinct action or resource. For example, star_email and unstar_email are opposites, and folder operations (create, delete, rename) are clearly separated. No overlapping purposes.
Most tools follow a verb_noun pattern (e.g., send_email, create_folder). However, list_recent deviates slightly (verb_adjective), but it's still intuitive and the overall pattern is consistent.
22 tools cover essential email operations without being excessive. Each tool has a clear purpose, and the number is well-scoped for a mail server.
The tool set covers email lifecycle: send, receive, search, organize folders, mark flags, and manage drafts. Missing features like spam handling are non-essential; core operations are complete.
Available Tools
22 toolscopy_emailB
Copy a message to another folder without removing the original.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | ||
| account | No | ||
| source_folder | Yes | ||
| destination_folder | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| uid | Yes | |
| account | Yes | |
| new_uid | No | |
| source_folder | Yes | |
| destination_folder | Yes |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate non-destructive (destructiveHint false). Description adds 'without removing the original', which is consistent but adds little beyond that. No disclosure of other behaviors (e.g., idempotency, folder existence).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence with no wasted words. Efficient but lacks depth.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutating tool with multiple parameters and no schema descriptions, the description is too brief. Lacks details on error handling, return value (despite output schema existing), and prerequisites like folder existence.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so description must compensate. However, description does not explain any parameters. Parameter names (uid, source_folder, etc.) are somewhat self-explanatory but no additional details on format, required constraints, or defaults.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the action (copy) and resource (email message to another folder). Distinguishes from move_email sibling by stating 'without removing the original'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Description implies when to use (copying vs. moving) but does not explicitly mention alternatives like move_email or provide context on when not to use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_folderA
Create a new IMAP folder and subscribe to it.
| Name | Required | Description | Default |
|---|---|---|---|
| folder | Yes | ||
| account | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| action | Yes | |
| folder | Yes | |
| account | Yes | |
| new_name | No |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide safety profile (non-destructive, non-idempotent). The description adds 'subscribe' behavior, which is helpful but not extensive. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence is concise and front-loaded. No unnecessary words, but could include a brief note on parameters without harming conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple creation tool with output schema present, the description is fairly complete. Basic parameter info and return value explanation would improve it further.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% with no enum descriptions. The description does not elaborate on the 'folder' or 'account' parameters beyond their names, missing an opportunity to compensate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states 'Create a new IMAP folder and subscribe to it,' with a clear verb and resource. It distinguishes from sibling tools like delete_folder or rename_folder.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use (creating IMAP folders), but provides no explicit guidance on when not to use or alternatives. Context from sibling tools is absent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_emailADestructiveIdempotent
Delete a message. Soft-delete by default (moves to Trash).
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | ||
| folder | No | INBOX | |
| account | No | ||
| permanent | No | If false (default), move to Trash. If true, expunge in place. | |
| trash_folder | No | INBOX.Trash |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| uid | Yes | |
| folder | Yes | |
| account | Yes | |
| permanently_deleted | Yes | True if hard-deleted (Expunge). False if only moved to Trash. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations include destructiveHint: true, and the description adds behavioral context: soft-delete by default and the existence of a permanent parameter. This clarifies the degree of destruction beyond the annotation, though it does not mention behavior for already-deleted emails or recovery options.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no fluff. First sentence states the core purpose; second adds a critical behavior detail. Well-front-loaded and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 5 parameters and low schema coverage, the description only marginally covers the tool's behavior. It explains the delete mechanism but omits details on required parameter uid, optional folders, and output. While output schema exists, the description could still benefit from noting that the tool has a return value.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With schema description coverage at only 20%, the description adds meaning for the permanent parameter by explaining its effect. However, it provides no explanation for uid, folder, account, or trash_folder, leaving several parameters without semantic context. The description partially compensates but not fully.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Delete' and resource 'message', and distinguishes soft-delete (moves to Trash) from permanent deletion. This differentiates it from sibling tools like move_email and delete_folder.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for deleting emails but does not provide explicit guidance on when to use vs alternatives (e.g., move_email for organizing), nor does it give when-not-to-use scenarios. The context of soft-delete is stated but not compared to permanent deletion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_folderADestructiveIdempotent
Delete an empty IMAP folder. Fails if not empty (per RFC).
| Name | Required | Description | Default |
|---|---|---|---|
| folder | Yes | ||
| account | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| action | Yes | |
| folder | Yes | |
| account | Yes | |
| new_name | No |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds value beyond annotations by specifying that the tool fails if the folder is not empty (per RFC). Annotations already indicate destructiveness and idempotency, but the description provides the emptyness constraint and failure behavior, which is critical for correct invocation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no wasted words: action, resource, key constraint. Perfectly front-loaded and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has two parameters (one required) and an output schema, the description covers the core behavior but lacks parameter explanations and any prerequisites. It is adequate for a simple tool but could be more complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description should compensate by explaining parameter meaning, but it does not. The terms 'folder' and 'account' are not clarified (e.g., folder path, account identifier), leaving ambiguity for the agent.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Delete an empty IMAP folder' with a specific verb and resource, and includes a distinguishing constraint (fails if not empty) that differentiates it from sibling folder operations like create_folder and rename_folder.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when the folder is empty but does not explicitly state when to use this tool over alternatives, nor does it provide when-not or prerequisite conditions. The constraint 'fails if not empty' gives some guidance, but it lacks direct comparison to siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
download_attachmentsARead-onlyIdempotent
Return message attachments as base64. Filter by filenames to save bytes.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | Message UID. | |
| folder | No | INBOX | |
| account | No | ||
| filenames | No | Only fetch these filenames. |
Output Schema
| Name | Required | Description |
|---|---|---|
| uid | Yes | |
| folder | Yes | |
| account | Yes | |
| attachments | Yes |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and openWorldHint, covering safety and idempotency. The description adds the base64 format detail but omits other behavioral traits like potential large payloads or that missing filenames returns all attachments. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no wasted words. The first sentence fronts the core purpose; the second provides actionable guidance. Highly efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity, annotations covering safety, and presence of an output schema, the description is largely sufficient. Minor omission: does not mention that omitting filenames downloads all attachments, but this is inferable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50% (uid and filenames described). The description adds meaning to filenames (saving byte cost) but does not elaborate on folder or account parameters. Overall, it adds some value beyond the schema but leaves gaps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool returns message attachments in base64 format, with an option to filter by filenames. It specifies the exact resource and action, distinguishing it from sibling tools which focus on reading email content or managing folders/stars.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a usage hint ('Filter by filenames to save bytes'), which helps agents know when to leverage filtering. However, it does not explicitly state when to use this tool versus alternatives (e.g., read_email), though as the only attachment downloader, context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
forward_emailADestructiveIdempotent
Forward a message. Subject gets Fwd: prefix; original headers quoted.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | ||
| to | Yes | ||
| bcc | No | ||
| uid | Yes | UID of the message to forward. | |
| text | No | Additional note to include above the forwarded body. | |
| folder | No | INBOX | |
| account | No | ||
| confirm | No | ||
| save_to_sent | No | ||
| idempotency_key | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| account | Yes | |
| message_id | No | |
| recipients | Yes | |
| saved_to_sent | No | |
| idempotent_replay | No | True when this response was replayed from an earlier identical call within the idempotency window. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate destructive and idempotent behavior; the description adds transparency about message modifications (subject prefix, header quoting). No contradictions. Additional behavioral context beyond annotations is present.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that covers the essential behavioral characteristics without unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having output schema, the description fails to address the complexity of 10 parameters, required fields, or behavior specifics. It is insufficient for an agent to confidently invoke this tool without additional inference.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is low (20%), and the description does not elaborate on parameter meanings beyond the basic function. Only 'uid' and 'text' are documented in schema; the description adds no parameter guidance.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (forward a message) and specifies unique behaviors (subject prefix 'Fwd:' and quoting original headers). This distinguishes it from siblings like reply_email and send_email.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives, no prerequisites, and no exclusions. It only describes the action without contextual usage advice.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_threadBRead-onlyIdempotent
Group messages sharing Message-ID / References / In-Reply-To headers.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | Any message UID in the thread. | |
| limit | No | ||
| folder | No | INBOX | |
| account | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| folder | Yes | |
| account | Yes | |
| subject | Yes | |
| messages | Yes | |
| root_uid | Yes |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint, openWorldHint, and idempotentHint, indicating safe non-destructive read behavior. The description adds minimal behavioral context beyond grouping logic, but does not contradict annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence, directly stating the tool's purpose. While brief, it is front-loaded and lacks unnecessary words. A bit more detail would be justified but current length is efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, the description does not need to detail return format. However, it omits any mention of default behavior (e.g., ordering, inclusion of duplicates). Still, minimal completeness is achieved for the given complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is low (25%). The description does not elaborate on any parameter semantics, leaving the agent without additional meaning beyond the schema's own descriptions (e.g., uid 'Any message UID in the thread').
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool groups messages based on Message-ID/References/In-Reply-To headers, which precisely identifies the action and resource. It effectively distinguishes from siblings like read_email (single message) or search_emails (query-based).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives such as read_email or search_emails. It lacks any context about prerequisites, conditions, or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_accountsARead-onlyIdempotent
List email accounts this caller can act on (no secrets returned).
In multi-user OAuth mode, only the caller's own account is returned; in single-tenant mode, all configured accounts appear.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| accounts | Yes |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Description adds context beyond annotations: explains that no secrets are returned and details mode-dependent behavior (multi-user vs single-tenant). Annotations already indicate read-only and idempotent, so no contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences. First sentence states purpose and a key trait, second explains behavioral nuance. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameters, detailed annotations, and presence of output schema, the description fully covers necessary context including mode-specific behavior and security implication (no secrets).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters, so baseline of 4 applies. Description does not need to add parameter info; schema coverage is 100% with zero params.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states verb (list), resource (email accounts), and scope (caller can act on). Distinguishes from siblings by focusing on account listing and mentioning no secrets returned.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear context for when to use (to see which accounts are actionable), but does not explicitly state when not to use or mention alternatives. However, given sibling tools are operation-specific, usage is well implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_foldersARead-onlyIdempotent
List every IMAP folder (mailbox) the account can see, UTF-7 decoded.
| Name | Required | Description | Default |
|---|---|---|---|
| account | No | Account name (list_accounts). Omit to use the default. |
Output Schema
| Name | Required | Description |
|---|---|---|
| account | Yes | |
| folders | Yes |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark it as read-only and idempotent. The description adds behavioral detail about UTF-7 decoding, which is beyond what annotations provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that conveys the purpose and a key detail. It is front-loaded with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one optional parameter, read-only, output schema exists), the description is complete and sufficient for an AI agent to understand usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The one optional parameter is already described well in the input schema (100% coverage). The description adds no extra parameter information, so baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'list', the resource 'IMAP folder (mailbox)', and the scope 'every...the account can see', with an additional detail about UTF-7 decoding. It distinguishes from siblings like list_accounts and list_recent by specifying folders.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use (to list all folders) but does not provide explicit guidance on when not to use or alternatives. For a simple list tool, this is acceptable but minimal.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_recentARead-onlyIdempotent
List the most recent messages in a folder (metadata only, newest first).
Use cursor (=previous next_cursor) to page further back in time.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max messages per page. | |
| cursor | No | Pass the previous response's `next_cursor` to page older. | |
| folder | No | IMAP folder name. Case-sensitive. | INBOX |
| account | No | Account name; omit for default. |
Output Schema
| Name | Required | Description |
|---|---|---|
| folder | Yes | |
| account | Yes | |
| messages | Yes | |
| next_cursor | No | Pass as `cursor` to the next `list_recent` call to fetch the previous page (older messages). null when there are no more. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate readOnly, idempotent, openWorld. Description adds 'metadata only, newest first' and pagination behavior, providing context beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero wasted words. Front-loaded with the core action. Efficient and clear.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given output schema exists (context signal) and annotations cover safety, the description provides essential behavior and pagination. Could mention it lists message headers, but metadata-only is indicated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with good descriptions. The description adds no new parameter meaning beyond what the schema already provides, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states 'List the most recent messages in a folder (metadata only, newest first)' – a specific verb+resource with clear scope, distinguishing it from siblings like search_emails or read_email.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly explains cursor-based pagination with 'Use cursor (=previous next_cursor) to page further back in time.' Lacks when-not-to-use or alternatives, but sufficient for typical usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mark_readCIdempotent
Add the \Seen flag.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | ||
| folder | No | INBOX | |
| account | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| uid | Yes | |
| folder | Yes | |
| account | Yes | |
| flags_after | No |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate the tool is idempotent and non-destructive, but the description adds no behavioral context beyond stating the action. It does not disclose what happens to existing flags or the response format.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one sentence and concise, but it is under-specified. It lacks crucial information, making it minimal rather than efficiently comprehensive.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has multiple parameters and an output schema, the description is incomplete. It does not explain how parameters affect behavior or what the output contains, leaving significant gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description provides no explanation of the parameters (uid, folder, account). The agent must infer parameter semantics solely from names and types, which is insufficient.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Add the \Seen flag' communicates that the tool marks an email as read, but it is vague and relies on technical jargon. While it distinguishes from mark_unread, it does not clearly state the effect in plain language.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like mark_unread or star_email. The agent receives no context for selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mark_unreadCIdempotent
Remove the \Seen flag.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | ||
| folder | No | INBOX | |
| account | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| uid | Yes | |
| folder | Yes | |
| account | Yes | |
| flags_after | No |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate idempotent and non-destructive behavior. The description adds only the action of removing the Seen flag, offering minimal additional context beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, which is concise but lacks structure and essential information. It earns its place but does not provide a complete overview.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having an output schema, the description is too minimal given the tool's three parameters and the presence of siblings. It fails to cover usage context or return value semantics.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the tool description does not explain any of the three parameters (uid, folder, account), leaving the agent without necessary context.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Remove the \Seen flag' clearly states the specific action on a specific resource (the Seen flag), distinguishing it from siblings like mark_read.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like mark_read or unstar_email. The description does not mention context or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
move_emailBIdempotent
Move a message between folders (RFC 6851 MOVE with COPY+EXPUNGE fallback).
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | ||
| account | No | ||
| source_folder | Yes | ||
| destination_folder | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| uid | Yes | |
| account | Yes | |
| new_uid | No | |
| source_folder | Yes | |
| destination_folder | Yes |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description mentions a fallback (COPY+EXPUNGE), which may be destructive, but annotations claim destructiveHint=false. This contradiction is not addressed. Additionally, idempotentHint=true is plausible but not explained. The description does not clarify behavioral traits beyond the basic operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, front-loaded with the core action. Could add a bit more context on fallback behavior without excessive length, but still efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 4 parameters with no schema descriptions, existence of an output schema (undescribed), and potential behavioral contradictions, the description is inadequate. It does not explain return values, prerequisites, or failure states.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description only says 'message between folders', providing no meaning for parameters like uid, account, source_folder, destination_folder. Users must infer from names alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool moves a message between folders, using specific protocol (RFC 6851 MOVE with fallback). This distinguishes it from sibling tools like copy_email (copy) and delete_email (delete).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the tool name and description (move, not copy or delete), but no explicit guidance is given about when to use this vs alternatives. No when-not-to-use or prerequisites mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_emailARead-onlyIdempotent
Fetch full headers + body of a message. Attachments listed by name+mime.
Set include_attachments=true to also embed each attachment as base64
(respects the size limit; large attachments may push you over context).
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | Message UID (from list_recent/search). | |
| folder | No | INBOX | |
| account | No | ||
| include_attachments | No | If true, embed attachments as base64. |
Output Schema
| Name | Required | Description |
|---|---|---|
| cc | No | |
| to | Yes | |
| uid | Yes | |
| date | No | |
| from | Yes | |
| subject | Yes | |
| body_html | Yes | |
| body_text | Yes | |
| attachments | Yes |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint, openWorldHint, idempotentHint. The description adds critical behavioral context: attachments are listed by name+mime by default, and embedding requires include_attachments=true with a size limit caveat. This goes beyond annotations and helps the agent understand context limitations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with main purpose, no redundant phrases. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity and sibling tools, the description is mostly complete. It could mention that for file downloads, use download_attachments, but the output schema likely documents return values. The caveat about attachment size and context is valuable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50% (2 of 4 parameters have descriptions). The description adds meaning for 'uid' (implying it comes from list_recent/search) and 'include_attachments' (explains behavior and context limit). It does not cover 'folder' or 'account', but their defaults are clear from schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Fetch'), the resource ('message'), and the content retrieved ('full headers + body', 'attachments listed by name+mime'). It distinguishes from sibling tools like list_recent (list messages) or download_attachments (download files).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for reading a specific email, but does not explicitly state when to use this tool vs alternatives like list_recent or download_attachments. No guidance on when not to use or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rename_folderC
Rename an IMAP folder.
| Name | Required | Description | Default |
|---|---|---|---|
| folder | Yes | ||
| account | No | ||
| new_name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| action | Yes | |
| folder | Yes | |
| account | Yes | |
| new_name | No |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate openWorldHint=true, implying potential unknown side effects, but the description does not elaborate on behavior such as renaming consequences, permissions, or error handling. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise (4 words). While it lacks detail, it is not verbose. It could be improved with a bit more structure, but it is efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 3 parameters (2 required) and an output schema, the description is insufficient. It does not mention return values, errors, or constraints like minLength, which are present in the schema but not explained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the burden falls entirely on the description, which merely states the tool's purpose without explaining the parameters (e.g., what 'folder' and 'new_name' mean, or the optional 'account' parameter). The schema provides names only.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action and resource: 'Rename an IMAP folder.' It uses a specific verb and resource, and distinguishes from sibling tools like create_folder and delete_folder. However, it could be more precise by including the parameters involved.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives such as move_email or create_folder. The description lacks any context about prerequisites or appropriate scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
reply_emailADestructiveIdempotent
Reply to a message. Preserves Message-ID linking + Subject Re: prefix.
reply_all=true includes the original To and Cc in the reply.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | UID of the message to reply to. | |
| html | No | ||
| text | No | ||
| folder | No | INBOX | |
| account | No | ||
| confirm | No | ||
| reply_all | No | Include original To/Cc in the reply. | |
| attachments | No | ||
| save_to_sent | No | ||
| idempotency_key | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| account | Yes | |
| message_id | No | |
| recipients | Yes | |
| saved_to_sent | No | |
| idempotent_replay | No | True when this response was replayed from an earlier identical call within the idempotency window. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds behavioral context beyond annotations: it reveals email threading preservation (Message-ID, Subject prefix). Annotations already mark destructiveHint=true, so no contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: two sentences plus a single note. Every sentence adds value, and the key information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 10 parameters and 20% coverage, the description is incomplete. It covers the core purpose and one parameter but lacks details on others. The presence of an output schema partially mitigates this.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With schema description coverage at 20%, the description only adds meaning for reply_all. It does not describe other key parameters like html, text, attachments, etc., leaving agents without needed context.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Reply to a message' and details threading behavior (Message-ID, Subject Re: prefix). This distinguishes it from sibling tools like send_email and forward_email.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains the reply_all parameter's effect but does not provide when-to-use vs alternatives (e.g., forward, send new), nor when not to use the tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
save_draftBIdempotent
Save an unsent draft in the account's Drafts folder.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | ||
| to | No | ||
| bcc | No | ||
| html | No | ||
| text | No | ||
| folder | No | Override Drafts folder (default: account.drafts_folder). | |
| account | No | ||
| subject | No | ||
| attachments | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| error | No | |
| folder | Yes | |
| account | Yes | |
| response | No |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate write operation (readOnlyHint=false) and idempotence. The description adds minimal behavioral context beyond 'save an unsent draft', lacking details on overwriting, side effects, or authentication requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, 10 words, front-loaded with key action and target. Efficient but very minimal; could include more detail without losing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 9 optional parameters and an output schema, the description is inadequate. It does not clarify required fields, return structure, or common usage patterns, leaving significant gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 11% (one parameter documented). The tool description does not explain any parameters, forcing reliance on the incomplete schema. With 9 parameters, the description should provide summary but does not.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (save), the object (unsent draft), and the location (Drafts folder). It distinguishes well from sibling tools like send_email or delete_email.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use or when-not-to-use guidance is provided. While the description implies this is for unsent drafts, it does not mention alternatives or prerequisites, leaving the agent to infer usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_emailsARead-onlyIdempotent
IMAP SEARCH over one field. Wraps query in quotes for IMAP.
Note: IMAP SEARCH is substring, case-insensitive on most servers, and doesn't support boolean operators. For richer queries, chain calls.
| Name | Required | Description | Default |
|---|---|---|---|
| field | No | One of FROM, TO, SUBJECT, BODY, TEXT. | SUBJECT |
| limit | No | ||
| query | Yes | Search term. | |
| folder | No | IMAP folder to search. | INBOX |
| account | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| field | Yes | |
| query | Yes | |
| folder | Yes | |
| account | Yes | |
| results | Yes |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses key behavioral traits beyond annotations: IMAP SEARCH behavior (substring, case-insensitive, no boolean operators) and the fact that the query is wrapped in quotes. Annotations already indicate read-only and idempotent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Concise two-sentence structure with front-loaded purpose and behavioral note. Could include more detail without being verbose, but no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Adequate given existing annotations and output schema; covers search behavior limitations but does not explain the openWorldHint or parameter interactions.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Does not add meaning beyond the input schema; schema coverage is 60% (3 of 5 params have descriptions), but the tool description provides no additional parameter details or clarifications.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it performs IMAP SEARCH over one field, specifying the resource (emails). However, it does not explicitly distinguish from siblings, though no other search tools exist.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides limitations (substring, case-insensitive, no boolean operators) and suggests chaining calls for richer queries, giving implicit guidance on when to use alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
send_emailADestructiveIdempotent
Send an email. Supports HTML, attachments, and Save-to-Sent.
On retries after a client timeout, pass the same idempotency_key you
used the first time to prevent duplicate delivery.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | ||
| to | Yes | Recipient(s), comma-separated. | |
| bcc | No | ||
| html | No | HTML body; sent as multipart/alternative when both are set. | |
| text | No | Plain-text body. | |
| account | No | ||
| confirm | No | Send-gate code if EMAIL_SEND_CONFIRMATION_CODE is set. | |
| subject | No | ||
| reply_to | No | ||
| attachments | No | [{path|content|content_base64, name?, mime?}, ...] | |
| save_to_sent | No | Override the account's Save-to-Sent default. | |
| idempotency_key | No | Opaque key; identical (key, caller) within 5 min returns the cached result. |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| account | Yes | |
| message_id | No | |
| recipients | Yes | |
| saved_to_sent | No | |
| idempotent_replay | No | True when this response was replayed from an earlier identical call within the idempotency window. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond annotations (readOnly=false, destructiveHint=true, idempotentHint=true), the description adds valuable behavioral context: supports HTML, attachments, Save-to-Sent, and retry idempotency. It does not cover all side effects (e.g., irreversible send) but adds meaningful info.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise: three sentences that front-load the purpose and then add key details. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (12 params, 1 required, many siblings), the description covers main features and retry behavior but lacks usage guidelines and full parameter semantics. Annotations fill some gaps, but completeness is average.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 58% schema description coverage (7 of 12 params documented), the description adds extra context for html, attachments, save_to_sent, and idempotency_key. However, many parameters (cc, bcc, reply_to, text, account, confirm) are not addressed, so the description only partially compensates for schema gaps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Send' and resource 'email', and highlights key features (HTML, attachments, Save-to-Sent). This distinguishes it from sibling tools like send_invite, reply_email, or forward_email.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool vs alternatives such as reply_email, forward_email, or send_invite. The description only hints at retry behavior but not comparative usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
send_inviteBDestructiveIdempotent
Send a calendar invite (RFC 5545 ICS, METHOD:REQUEST).
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | ||
| to | Yes | ||
| bcc | No | ||
| end | Yes | ||
| html | No | ||
| text | No | ||
| start | Yes | ISO 8601 or 'YYYY-MM-DD HH:MM'. Naive = UTC. | |
| account | No | ||
| confirm | No | ||
| subject | Yes | ||
| location | No | ||
| attendees | No | ||
| organizer | No | ||
| description | No | ||
| save_to_sent | No | ||
| idempotency_key | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| account | Yes | |
| message_id | No | |
| recipients | Yes | |
| saved_to_sent | No | |
| idempotent_replay | No | True when this response was replayed from an earlier identical call within the idempotency window. |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate the tool is write-only, idempotent, and destructive. The description adds the technical detail that it uses RFC 5545 ICS with METHOD:REQUEST, which is useful context but does not disclose behaviors like what happens if the account is not specified or how errors are handled. It does not contradict annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no unnecessary words. It efficiently communicates the core purpose. However, it is perhaps too concise given the complexity of the tool; a slightly longer description could improve clarity without losing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the high parameter count (16) and the presence of an output schema, the description is too sparse. It does not explain the expected behavior for optional parameters, the format of the ICS file, or how the tool interacts with accounts. More context is needed for an agent to use it correctly without external knowledge.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 6%, meaning only one parameter (start) has a description. The tool description does not explain the meaning or format of any parameter beyond what the names imply. For a tool with 16 parameters, this is insufficient. The description should at least clarify that 'to', 'start', 'end', and 'subject' are required.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states it sends a calendar invite using RFC 5545 ICS with METHOD:REQUEST. This clearly differentiates from sibling tools like send_email, which send standard emails. The verb 'send' and resource 'calendar invite' are specific.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not provide explicit guidance on when to use this tool versus alternatives. While the intent is implied by naming it 'send_invite' and specifying calendar invite, it does not contrast with send_email or other tools. No when-not-to-use or prerequisite information is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
star_emailBIdempotent
Add the \Flagged (starred) flag.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | ||
| folder | No | INBOX | |
| account | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| uid | Yes | |
| folder | Yes | |
| account | Yes | |
| flags_after | No |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide idempotentHint=true and destructiveHint=false, so the agent knows the tool is idempotent and non-destructive. The description adds no additional behavioral context beyond restating the action, so it meets a baseline but provides no extra value.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, direct sentence that immediately conveys the core action. It is highly concise with no wasted words, making it easy to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the existence of 21 sibling tools and three parameters with no schema descriptions, this minimal description is insufficient. It lacks information about required parameters (uid), default folder, output, and how to use alongside other tools. Particularly missing is guidance on the effect of repeating the action or handling accounts.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description fails to explain any of the three parameters (uid, folder, account). It adds zero meaning beyond the schema structure, leaving the agent without guidance on how to populate inputs correctly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Add the \Flagged (starred) flag' clearly states the action and resource. It directly contrasts with the sibling 'unstar_email' which removes the flag, making the tool's purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like 'unstar_email' or other email actions. The description lacks any context about recommended scenarios or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
unstar_emailCIdempotent
Remove the \Flagged flag.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | ||
| folder | No | INBOX | |
| account | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| uid | Yes | |
| folder | Yes | |
| account | Yes | |
| flags_after | No |
Tool Definition Quality
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate idempotentHint and destructiveHint, but the description adds no additional behavioral context (e.g., what happens if already unflagged). It merely restates the action without enhancing transparency beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short (one sentence), making it concise but insufficiently informative for a multi-parameter tool. It is front-loaded, but lacks structure or elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameter coverage and no explanation of output or behavior, the description is incomplete for effective tool use. It does not leverage the existing output schema or add needed context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description fails to explain the parameters (uid, folder, account). No added meaning for any parameter, leaving the agent to rely solely on names and types.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states 'Remove the \Flagged flag', which clearly indicates the action of unstarring an email, aligning with the tool name 'unstar_email'. It is a specific verb-resource pair, but could be more explicit about it being an email flag.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives, such as 'star_email' for starring. The description lacks context about prerequisites or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Read, search, send, organize, draft and schedule email across your inboxes from any MCP client.
Read, send, file and search email in any IMAP or Microsoft 365 mailbox, and check it arrived.
1Manage Gmail end-to-end: search, read, send, draft, label, and organize threads. Automate workflow…
Email infrastructure for AI agents — send, receive, search, and reply to email over MCP.
Related MCP Servers
- AlicenseAqualityAmaintenanceProvides IMAP and SMTP capabilities, enabling developers to manage email services with seamless integration and automated workflows.15320BSD 3-Clause
- AlicenseNot gradedqualityDmaintenanceEnables comprehensive email management through IMAP/SMTP protocols with tools for searching, organizing, moving, flagging, and sending emails across various email providers. Features safe preview mode for destructive operations and supports multiple email providers including Gmail, Outlook, and Chinese email services.26MIT
- AlicenseAqualityFmaintenanceEnables email management through SMTP and IMAP protocols with support for sending emails with attachments, searching and filtering messages, replying/forwarding with threading, organizing mailboxes, and managing multiple email accounts.5234MIT
- AlicenseNot gradedqualityDmaintenanceEnables email management through IMAP and SMTP protocols, supporting reading, sending, replying to emails with proper threading, and downloading attachments. Supports multiple email accounts with flexible configuration options.1BSD 3-Clause
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/rosauceda/cpanel-mail-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server