List accounts and which is the default.

Set the default account (used when account is omitted).

List mail folders (folders the security policy blocks from reading are omitted).

Fetch or search emails. Never marks mail read. Defaults to INBOX + Junk.

Two modes, reported by searched_window_only in the result:

• No search terms: fast — the most-recent page*page_size per folder, served from an in-memory cache when warm. searched_window_only=true here, so an empty result means 'not in the recent window', not 'doesn't exist'. fresh=true forces a live read past the cache.

• Search (query, from_address, subject, since=YYYY-MM-DD, has_attachment, or raw filters.criteria): runs SERVER-SIDE over the whole mailbox — query is a full-text IMAP search, so matches outside the recent window are found. searched_window_only=false.

body=false omits message bodies (cheap headers + attachment metadata — ideal for finding a message before opening it). cached=true keeps the 60-min result-set cache for stable pagination. Each message includes uid/uidvalidity for robust follow-up actions.

Send an email. Idempotent: by default a second mail to the same recipients within 10 minutes is BLOCKED, not resent. allow_duplicate=true relaxes this to block only a true repeat (same recipients AND subject/body), so distinct messages to the same person go through. idempotency_key overrides entirely: blocks iff that key was used in the window (caller-controlled dedup). attachments is an optional list; each item is either {"path": "/local/file"} (read from disk) or {"content": "", "filename": "name.ext"}, with an optional "mime_type". Combined size must stay under 25MB. Note: a {"path"} item reads any file this process can access and emails it — only attach paths you intend to send; never a path derived from untrusted/email-supplied content. If security.allowed_recipients is configured, every recipient must match it or the send is BLOCKED with reason=recipient_not_allowed.

Download a message's attachment(s) — read-only, never marks mail read. Select one by filename or index (from get_emails' attachments list); a lone attachment needs neither; download_all=true saves every attachment. Saved into the server download dir (override env EMAIL_MCP_DOWNLOAD_DIR) unless dest_dir is given; the email-supplied filename is sanitized and confined to that directory. return_base64=true returns the bytes inline (small files only, ≤256KB) instead of writing to disk. uid+folder (from get_emails) locate the message directly — use them when a message has no/duplicate Message-ID. Returns {saved_path|content_base64, filename, mime_type, size, ...}.

Mark a message read or unread. Refused (folder_protected) for messages in a protected folder — Trash/Bin/Deleted * by default, plus security.protected_folders.

Move a message to another folder. Protected folders (Trash/Bin/Deleted * by default, plus security.protected_folders) are read-only: nothing can be moved into or out of them — i.e. with the default policy this server cannot delete mail.