IMAP MCP
Allows reading, searching, sending, and managing email messages in mailboxes hosted on cPanel-based mail servers over IMAP and SMTP.
Allows reading, searching, sending, and managing messages on self-hosted Dovecot IMAP and SMTP mail servers.
Allows reading, searching, sending, and managing email messages in mailboxes hosted on Plesk-based mail servers over IMAP and SMTP.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@IMAP MCPsearch my inbox for unread emails from my boss"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
IMAP MCP
An MCP server that gives Claude read, manage and send access to any IMAP mailbox, for the mail that Google and Microsoft connectors do not cover: hosting company mailboxes (xneelo, cPanel, Plesk), self hosted Dovecot, anything that speaks plain IMAP and SMTP.
Runs locally over stdio. Your password stays in a local .env file, and mail goes directly from this machine to your mail server.
What Claude gets
Tool | What it does |
| Configured mailboxes, and whether each password is set |
| Every folder, plus the detected Sent, Trash and Drafts folders |
| Search by sender, recipient, subject, text, date, unread, flagged. Newest first, header only by default |
| One message: headers, body as text, attachment list |
| Save one attachment to disk and return the path |
| Mark read or unread |
| seen, flagged, answered, draft, deleted |
| Move or archive to another folder |
| Move to Trash, or erase permanently after confirmation |
| Send new mail, after a preview and confirmation |
| Threaded reply, sender only or reply all, after a preview |
| Save a draft for you to send yourself |
Related MCP server: IMAP MCP Server
Safety rules built in
Reading never marks mail as read. Every fetch uses BODY.PEEK and folders open read only, so Claude browsing the mailbox does not change its state.
get_message(mark_seen=True)is the only exception and has to be asked for.Sending and permanent deletion take two steps. The first call returns the exact message or the exact target plus a
confirmation_tokenand does nothing. Only a second call withcommit=Trueand that token acts. Change any argument between the two calls and the token stops matching.Delete means Trash.
delete_messagesmoves to the Trash folder unless you passpermanent=True.Per account read_only. Set
"read_only": trueon an account and every write tool refuses, while reading keeps working.Sent mail is filed. SMTP does not copy what it sends, so after a send the same bytes are appended to the Sent folder, where your normal mail client expects them.
Attachments go to disk, never into the conversation.
Setup
Install:
uv venv --python 3.12 uv pip install -e ".[dev]"Copy
accounts.example.jsontoaccounts.jsonand fill in your mail server details. Ask your host for the IMAP and SMTP settings if you do not have them. Passwords do not go in this file.Copy
.env.exampleto.envand add one password per account. The variable name is the account name, uppercased, with anything that is not a letter or digit turned into an underscore: accountworkreadsIMAP_PASSWORD_WORK. AddSMTP_PASSWORD_<NAME>only if the SMTP password differs.Prove the account works before wiring it in:
.venv\Scripts\python.exe scripts\smoke.pyRegister the server with Claude Code:
claude mcp add --scope user imap -- "C:\Claude Projects\IMAP MCP\.venv\Scripts\python.exe" -m imap_mcp.serverRestart Claude Code and check
/mcp.
Account fields
Field | Default | Notes |
| required | How you refer to the account in a prompt |
| required | |
| required | Usually the full email address |
| 993 | 143 for starttls or none |
|
|
|
| none | Leave blank to disable sending |
| 587 | 465 for ssl |
|
|
|
|
| Only if it differs |
|
| The address mail is sent as |
| blank | Display name on outgoing mail |
| detected | Set these only if detection picks the wrong folder |
| false | Blocks every write tool for this account |
| true | Set false only for a host whose certificate is broken. The connection stays encrypted, the server identity stops being checked |
| 60 | Seconds |
Sent, Trash and Drafts are found from the server's SPECIAL-USE flags, falling
back to the usual names including the Dovecot style INBOX.Sent.
Shared hosting and certificates
Hosts like xneelo point mail.yourdomain.co.za at a shared server whose
certificate is issued for the server's own name, so strict TLS verification
fails on the vanity hostname even though the connection is fine. Find the real
server name and use that instead:
python -c "import socket; print(socket.gethostbyaddr(socket.gethostbyname('mail.yourdomain.co.za')))"That returns something like www12.cpt3.host-h.net, which its certificate does
cover. The tradeoff is that if the host migrates your mailbox to another server,
the hostname changes and login starts failing: rerun the line above and update
accounts.json. The alternative is keeping the vanity hostname with
"verify_tls": false.
Not supported
OAuth2, so Gmail and Microsoft 365 are out of scope: they have first party connectors already. Password authentication over TLS only. Gmail with an app password does work if you want it here anyway.
Tests
.venv\Scripts\python.exe -m pytest # 35 unit tests, no networkEnd to end against a throwaway mail server in Docker, which exercises all 12 tools including sending, moving and permanent deletion without touching a real mailbox:
docker run -d --rm --name imapmcp-greenmail -p 3143:3143 -p 3025:3025 ^
-e GREENMAIL_OPTS="-Dgreenmail.setup.test.all -Dgreenmail.hostname=0.0.0.0 -Dgreenmail.auth.disabled" ^
greenmail/standalone:2.1.0
.venv\Scripts\python.exe scripts\e2e_greenmail.py
docker stop imapmcp-greenmailAvailable Tools
12 toolscreate_draftA
Save a draft in the Drafts folder for the user to review and send from their own mail client. Nothing is sent, so no confirmation is needed.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | ||
| to | No | ||
| bcc | No | ||
| body | No | ||
| account | No | ||
| subject | No | ||
| html_body | No | ||
| attachments | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description correctly takes on the burden of behavioral disclosure. It explicitly states that nothing is sent and that no confirmation is needed, which are the key safety-relevant behaviors. It does not describe all side effects (e.g., overwriting an existing draft or return value), but it covers the most important non-sending behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no wasted words. The primary purpose is front-loaded, and the critical non-sending caveat is included concisely.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 8 optional parameters, no parameter descriptions, no annotations, and no output schema. The description provides only the core purpose and safety caveat, leaving substantial gaps around parameter usage, expected return, and account requirements. This is insufficient for a tool with this complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for the 8 undocumented parameters. It does not mention to, cc, bcc, subject, body, html_body, attachments, or account, nor does it clarify that all fields are optional. The parameter names are somewhat self-explanatory, but the description adds no semantic value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('Save a draft in the Drafts folder') and explicitly differentiates this tool from sending by saying 'Nothing is sent'. This clearly distinguishes create_draft from siblings like send_message and reply_to_message.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description establishes clear usage context: use this tool when the user needs to review and send later from their own mail client, not when an immediate send is intended. It lacks explicit naming of alternatives or a direct 'when not to use', but the implied routing is strong.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_messagesA
Delete messages. By default they move to Trash and can be recovered. permanent=True erases them, and that path previews first: call once to get a confirmation_token, then again with commit=True and that token.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | No | ||
| uids | No | ||
| commit | No | ||
| folder | No | INBOX | |
| account | No | ||
| permanent | No | ||
| confirmation_token | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden and does well: it discloses that deletion is recoverable by default, that permanent deletion erases messages, and that the permanent path requires a two-step confirmation using confirmation_token and commit=True. This is exactly the kind of behavioral context an agent needs for a destructive tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three compact sentences front-load the main operation and then expand on the two deletion modes without wasted wording. The two-step confirmation flow is explained tersely but completely.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is behaviorally strong but not fully complete for a 7-parameter tool with no output schema. It leaves several invocation details to inference, especially how to specify which messages to delete and whether account/folder values need to be considered.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It explains permanent, commit, and confirmation_token, which are the least obvious parameters. However, it does not clarify the relationship or selection between uid and uids, nor the role of folder and account beyond their schema defaults.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb and resource ('Delete messages') and adds important scope by explaining the default Trash behavior and the permanent-delete path. It distinguishes deletion from sibling operations like move_messages, though it does not explicitly name a sibling for comparison.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies that this tool is used when messages need to be removed, and it explains the soft-delete versus permanent-delete workflows. However, it does not explicitly state when to prefer this tool over alternatives such as move_messages, nor does it describe any preconditions or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_attachmentA
Save one attachment to disk and return the path. Identify it by index or filename from get_message. Defaults to the downloads folder in the project.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | No | ||
| index | No | ||
| folder | No | INBOX | |
| account | No | ||
| filename | No | ||
| download_dir | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavioral traits. It states the primary action (saving to disk) and the default download directory, but omits important details such as whether the operation is destructive (overwrites existing files), requires authentication, or involves network calls. It also does not mention error conditions or reversibility. This is a significant gap for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, consisting of two sentences that efficiently state the action, identification method, and default directory. It is well-structured and front-loaded with the core functionality, with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 6 parameters with no schema descriptions and no output schema. The description covers only a few aspects (identification and default download dir) but leaves other parameters unexplained, does not describe the return format beyond 'path', and lacks error handling or prerequisite details. This is incomplete for a tool with this complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must explain the parameters. It explains that index or filename can identify the attachment, and that download_dir defaults to the project's downloads folder. However, it does not explain the uid, folder, or account parameters, which are likely needed to specify the message. This incomplete coverage fails to compensate for the missing schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool saves one attachment to disk and returns the path, with identification via index or filename from get_message. It is specific and distinguishes itself from sibling tools that handle message operations rather than attachment saving.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context on how to identify the attachment (via index or filename from get_message), implying a prerequisite that get_message must be called first. It does not explicitly state when not to use it or alternatives, but the context is sufficient for an agent to understand its purpose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_messageA
Fetch one message by uid: headers, body as text, and the list of attachments (names and sizes, not their content). Long bodies are truncated at max_chars and flagged as such. The message stays unread unless mark_seen=True.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | No | ||
| folder | No | INBOX | |
| account | No | ||
| mark_seen | No | ||
| max_chars | No | ||
| include_html | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral burden and does it well: it discloses the side effect ('stays unread unless mark_seen=True'), truncation at max_chars with a flag, and the exclusion of attachment content. It could add error behavior or response-shape details, but this is already substantial.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences with no filler: the core output is front-loaded, and each following sentence adds a distinct behavioral fact. It is compact yet complete enough for an agent to understand the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 6-parameter tool with no output schema and no annotations, the description does a strong job covering return composition and side effects. Remaining gaps are folder/account selection semantics, include_html behavior, and how the truncation flag is represented in the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaning to uid, max_chars, and mark_seen, which is helpful given 0% schema description coverage. However, folder, account, and include_html receive no explanation beyond their parameter names and defaults, leaving a meaningful gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names the exact operation ('Fetch one message by uid') and enumerates the return payload: headers, body as text, and attachment names/sizes. It also disambiguates from attachment retrieval by explicitly stating the content is not included.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The intended use case is implied: use this when you have a message uid and need a single message's contents. It does not explicitly route away from sibling tools like search_messages when no uid is available or get_attachment when attachment bytes are needed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_accountsA
List the configured mailboxes and whether each has its password set.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral disclosure. 'List' clearly implies a read-only operation with no side effects, and the description explicitly states the output scope (configured mailboxes and password-set booleans). This is sufficient for a simple, non-mutating tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that front-loads the verb and resource, includes the key output detail, and contains no filler. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless, read-only list tool with no output schema, the description is complete. It tells the agent exactly what will be returned (mailboxes and password-set status), and there are no additional inputs or behaviors an agent would need to know.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4. The description does not need to explain parameters, and there are none in the schema to document.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb ('List') and resource ('configured mailboxes'), plus a concrete attribute (password-set status). It distinguishes this tool from all siblings, which focus on messages, drafts, and folders rather than account configuration.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use the tool: when you need to see configured mailboxes and their password status. It does not explicitly exclude alternatives, but given that no sibling tool deals with mailbox/account configuration, the intended usage is unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_foldersA
List every folder in a mailbox, with the detected Sent, Trash and Drafts folders. Folder names are case sensitive and may be nested, so always take names from here rather than guessing.
| Name | Required | Description | Default |
|---|---|---|---|
| account | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses meaningful behaviors: special-folder detection, case sensitivity of folder names, and possible nesting. The read-only nature is clear from 'List', and no side effects are implied. It stops short of describing response format or account-selection behavior, but core transparency is solid.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two purposeful sentences with no filler. The primary action is front-loaded, and the critical guidance about case sensitivity and taking names from here is delivered as a concise, actionable directive.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The core purpose and a key constraint are present, making the tool usable in simple cases. However, the description does not explain how the optional account parameter behaves, what a response contains, or how this interacts with account selection, especially given the sibling list_accounts tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter, 'account', is optional with a default but is never mentioned in the description. Since schema description coverage is 0%, the description should compensate by explaining which mailbox account the tool acts on or what an empty account means, but it does not.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('List') and a specific resource ('every folder in a mailbox'), and adds the useful detail that Sent, Trash, and Drafts folders are detected. This clearly distinguishes it from siblings like list_accounts, search_messages, or get_message.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'always take names from here rather than guessing' gives the agent a clear directive to use this tool as the authoritative source for folder names. It implies the tool should be used before operations that require exact folder names, though it does not explicitly name alternatives or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mark_readC
Mark one or more messages read (read_state=True) or unread.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | No | ||
| uids | No | ||
| folder | No | INBOX | |
| account | No | ||
| read_state | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It does disclose the core mutation (setting read_state true or false), but it does not mention permissions, whether the operation is reversible, what happens when both uid and uids are supplied, or any error/side-effect behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with no filler. The core behavior is front-loaded, and the parenthetical '(read_state=True)' efficiently ties the human description to the schema parameter.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With five parameters, zero required, no annotations, and no output schema, this one-line description is under-specified. An agent would need to infer how account and folder affect the operation, whether uid or uids is preferred, and what calling the tool returns or confirms.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It maps 'one or more' to uid/uids and mentions read_state=True, but it does not explain the distinction between uid and uids, nor what folder and account mean or how they behave with defaults.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Mark') and the resource ('one or more messages') plus the direction ('read... or unread'). It is specific enough to be understood on its own, but it does not explicitly differentiate itself from siblings like set_flag, which could also touch message state.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance about when to use this tool versus alternatives such as set_flag, delete_messages, or move_messages. The description only states what it does, not under what circumstances it should be chosen.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
move_messagesA
Move messages to another folder, for example to archive them. Use an exact folder name from list_folders. UIDs change on move.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | No | ||
| uids | No | ||
| folder | No | INBOX | |
| account | No | ||
| destination | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral disclosure burden. It does disclose a meaningful side effect: 'UIDs change on move', which is exactly the kind of warning an agent needs. However, it does not mention permissions, error behavior, reversibility, or what the operation returns.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences with no filler. The primary action is front-loaded, followed by essential usage guidance and a critical behavioral warning. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given five optional-looking parameters, no annotations, 0% schema coverage, and no output schema, the description leaves too much ambiguous. It does not clarify which parameter is the target folder, whether to pass uid or uids, or how account is resolved. The UID warning and list_folders hint help, but the invocation contract is still underspecified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, but it only partially clarifies folder naming. It does not explain the relationship between uid and uids, the role of the source folder parameter versus destination, or how account should be populated. The phrase 'another folder' is not explicitly mapped to the destination property.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific action: 'Move messages to another folder', clearly identifying the resource (messages) and the operation (moving to a folder). It also gives a concrete example ('to archive them') and is clearly distinct from sibling tools like delete_messages, send_message, or mark_read.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit operational guidance: use an exact folder name from list_folders, which is a useful precondition and directs the agent to a sibling tool. It provides context for when this tool fits, such as archiving, but does not explicitly state when not to use it versus alternatives like delete_messages.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
reply_to_messageA
Reply to a message, keeping the thread intact. Goes to the sender only unless reply_all=True. Previews first and sends on the second call with commit=True and the confirmation_token, exactly like send_message.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | No | ||
| body | No | ||
| commit | No | ||
| folder | No | INBOX | |
| account | No | ||
| html_body | No | ||
| reply_all | No | ||
| attachments | No | ||
| quote_original | No | ||
| confirmation_token | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and discloses the important two-phase commit behavior ('Previews first and sends on the second call'). It also explains reply_all recipient behavior and thread preservation. It does not detail side effects of preview or whether the first call mutates anything, but the core behavioral contract is clear.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler. The core purpose is front-loaded, and the second sentence packs the critical workflow detail into a compact reference to send_message.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 10-parameter tool with no annotations and no output schema, the description is too thin. It does not explain what the preview response contains, how to obtain or interpret confirmation_token, which message uid refers to, or what the final send returns. The reliance on 'exactly like send_message' is helpful but not self-contained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, but it only explains reply_all, commit, and confirmation_token. The other seven parameters (uid, body, folder, account, html_body, attachments, quote_original) receive no explanation and are not obviously inferred from the description alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Reply'), a specific resource ('a message'), and a key scoping detail ('keeping the thread intact'). It also distinguishes itself from send_message by specifying recipient behavior ('Goes to the sender only unless reply_all=True').
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear operational guidance: preview first, then send with commit=True and confirmation_token. The 'exactly like send_message' reference strongly implies a shared workflow, but does not explicitly state when to choose this over alternatives like send_message or create_draft for new emails.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_messagesA
Search a folder and return message headers, newest first.
Dates are YYYY-MM-DD and IMAP compares by day only. 'text' is a server side substring search across the whole message and its behaviour varies by server. include_snippet=True adds the first 200 characters of each body, which means downloading every match, so keep the limit small when using it. raw_criteria takes a raw IMAP search string and overrides the other filters. Reading never marks anything as seen.
| Name | Required | Description | Default |
|---|---|---|---|
| text | No | ||
| limit | No | ||
| since | No | ||
| before | No | ||
| folder | No | INBOX | |
| offset | No | ||
| unseen | No | ||
| account | No | ||
| flagged | No | ||
| subject | No | ||
| to_address | No | ||
| from_address | No | ||
| raw_criteria | No | ||
| include_snippet | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It effectively explains that reading never marks messages as seen, describes server-dependent behavior for 'text', warns about performance implications of include_snippet, and clarifies date comparison semantics. It does not cover auth or rate limits, but the key behavioral traits are well disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loads the core purpose, then provides targeted details on tricky parameters. Each sentence contributes new information without redundancy. It could be slightly more structured but is efficient overall.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 14 parameters and no output schema or annotations, the description is reasonably complete for a search tool. It explains key behaviors like read safety, date handling, and performance costs. However, it omits details like how multiple filters combine (AND/OR), pagination semantics of limit/offset, and the meaning of an empty text search. These gaps prevent a higher score.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has zero description coverage, so the description must compensate. It adds meaning for several parameters: date format and day-only comparison, server-side substring behavior of 'text', the download cost of include_snippet, and raw_criteria overriding other filters. However, many parameters (limit, offset, folder, unseen, flagged, subject, to_address, from_address, account) are left unexplained, though their names are self-descriptive. Partial coverage earns a 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool searches a folder and returns message headers, with a specific ordering (newest first). This distinguishes it from siblings like get_message (single message retrieval) and list_folders (folder listing). The verb 'search' and resource 'folder' are explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides practical usage tips, such as keeping the limit small when include_snippet is true, and notes that raw_criteria overrides other filters. However, it does not explicitly compare against alternatives or state when not to use it, though the context is clear enough for an agent to infer appropriate usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
send_messageA
Send a new mail. The first call returns a preview of the exact message plus a confirmation_token and sends nothing. Call again with identical arguments, commit=True and that token to actually send. A copy is filed in the Sent folder. attachments are local file paths.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | ||
| to | No | ||
| bcc | No | ||
| body | No | ||
| commit | No | ||
| account | No | ||
| subject | No | ||
| html_body | No | ||
| attachments | No | ||
| confirmation_token | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations available, the description carries the full burden and does a strong job: it discloses the non-sending preview, the required commit token flow, the Sent-folder copy, and the local-path requirement for attachments. It omits some details like error behavior and token expiration, but the critical behavioral traits are transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences with no filler. The most important behavioral caveat, the preview-then-commit sequence, is front-loaded, and each sentence contributes unique information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no output schema and no annotations, the description covers the full calling protocol, side effects, and the token requirement. Minor gaps remain around exact preview return structure, error cases, and account selection, but an agent has enough to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate. It adds meaningful semantics for attachments, commit, confirmation_token, and 'identical arguments'. However, most parameters like to, cc, bcc, body, html_body, and account are left to inference from their names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action as 'Send a new mail' and adds the two-call preview/commit behavior. The word 'new' distinguishes it from reply_to_message, though it does not explicitly name alternatives like create_draft.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives concrete procedural instructions: first call previews and returns a token, second call with commit=True actually sends. However, it does not explicitly say when to prefer this tool over siblings such as create_draft or reply_to_message, or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
set_flagC
Add or remove an IMAP flag: seen, flagged, answered, draft or deleted.
| Name | Required | Description | Default |
|---|---|---|---|
| uid | No | ||
| flag | No | flagged | |
| uids | No | ||
| value | No | ||
| folder | No | INBOX | |
| account | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of disclosing behavioral traits. It only says 'add or remove' but does not explain the effect of the 'value' parameter (whether true adds and false removes), nor any side effects like persistence, authentication requirements, or error conditions. This is a significant gap for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that is easy to parse and front-loads the core purpose. However, it lacks any structural breakdown of parameters or usage, but that's a completeness issue, not a conciseness one. It earns a 4 for being appropriately sized.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 6 parameters, no output schema, and no annotations, yet the description provides only the function's purpose and flag list. It does not cover parameter semantics, return values, or any edge cases, making it inadequate for an agent to call it correctly without additional schema documentation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage, and the description does not compensate. It fails to explain the meaning of 'uid', 'uids', 'value', 'folder', or 'account'. Even the list of flags is not explicitly tied to the 'flag' parameter. An agent would have to guess the semantics from parameter names and defaults, which is insufficient.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: adding or removing an IMAP flag, and enumerates the valid flag values. This distinguishes it from generic message operations, though it doesn't explicitly differentiate from mark_read, which could be seen as a subset. Still, it's specific enough for an agent to understand the core purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like mark_read or delete_messages. There is no mention of exclusions or conditions, so an agent would have to infer usage from the function name and description, which is insufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
12 tool updates
v0.1.0- First observed
create_draft - First observed
delete_messages - First observed
get_attachment - First observed
get_message - First observed
list_accounts - First observed
list_folders - First observed
mark_read - First observed
move_messages - First observed
reply_to_message - First observed
search_messages - First observed
send_message - First observed
set_flag
TDQS
Scored across 12 tools
Most tools have distinct purposes, but mark_read and set_flag overlap on the 'seen' flag, and delete_messages vs set_flag's 'deleted' could confuse agents. However, descriptions clarify the differences, so ambiguity is limited.
All 12 tools follow a consistent verb_noun pattern in snake_case (e.g., delete_messages, get_attachment, list_folders). No stylistic deviations or mixed conventions.
12 tools is within the ideal 3-15 range. Each tool covers a core email operation (send, read, search, manage), with no redundancies or missing essentials.
The surface covers key IMAP workflows: send, reply, draft, search, get message, attachment download, move, delete, flags, and folder/account listing. Minor gaps exist (e.g., folder creation, expunge, raw message fetch), but agents can accomplish typical tasks without failures.
Maintenance
Related MCP Connectors
Connect any mailbox to Claude, ChatGPT & AI: read, send, reply, schedule & search emails.
Your mailboxes in ChatGPT and Claude: Gmail, iCloud, Fastmail, any IMAP. Passwords stay yours.
Email inboxes and calendars for AI agents: send, receive, search, draft and schedule.
Email inboxes and calendars for AI agents: send, receive, search, draft and schedule.
Related MCP Servers
- AlicenseAqualityAmaintenanceEnables Claude to interact with email accounts via IMAP and SMTP, providing tools for searching, reading, sending, and managing emails across multiple providers.40500 npm96MIT
- FlicenseNot gradedqualityDmaintenanceEnables Claude to read, search, send, and manage emails across multiple IMAP/SMTP accounts via a single deployment.-
- FlicenseNot gradedqualityBmaintenanceEnables Claude to read, search, draft, send, flag, and move email across multiple IMAP/SMTP mailboxes while keeping credentials local.-
- FlicenseNot gradedqualityDmaintenanceEnables Claude Code to manage email inboxes via IMAP, including reading, categorizing, phishing detection, archiving, junking, and sending emails with user permission.-