apple-mail-mcp-server
The Apple Mail MCP Server provides programmatic access to Apple Mail on macOS, enabling AI assistants to read, send, search, and manage emails. Key capabilities:
Account & Mailbox Management
List accounts and mailboxes
Create, rename/move, and delete mailboxes
Reading & Searching Email
Search messages by sender, subject, body, date range, read/unread/flagged status, attachments, etc. (supports IMAP, local DB, or AppleScript backends)
Fetch full message details (body, headers, attachments) and retrieve entire conversation threads
Message Actions
Mark as read/unread, flag/unflag, change flag color, move, or delete messages (to Trash)
Save attachments to disk or read attachment content inline
Draft Management
Create new drafts (new email, reply, or forward) with HTML bodies and file attachments; optionally send immediately
Update or delete existing drafts
Rules Management
List, create, update, and delete Mail.app filtering rules with conditions (sender, subject, body, headers) and actions (move, flag, mark read, forward, delete, etc.)
Template Management
List, read, save, render (with variable substitution and reply-context), and delete email templates
Statistics
Aggregate inbox analytics (message volume, read/unread/flagged counts, top senders) over a configurable time window
Diagnostics
Diagnose mail access, search backend availability, and configuration health for an account/mailbox
Provides programmatic access to Apple Mail, enabling AI assistants to read, send, search, and manage emails on macOS, including message actions, drafts, mailbox CRUD, and rules management.
Supports Gmail accounts configured in Apple Mail, with optional IMAP-based fast search and management via app-specific passwords.
Supports iCloud email accounts configured in Apple Mail, with optional IMAP-based fast search and management via keychain-stored app-specific passwords.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@apple-mail-mcp-servershow me my last 5 unread emails"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Apple Mail PingZero MCP Server
An MCP server that provides programmatic access to Apple Mail, enabling AI assistants like Claude to read, send, search, and manage emails on macOS.
Built on
apple-mail-fast-mcpby Morgan Jeffries, MIT-licensed, whose architecture this project inherits wholesale. See Credits and origins.
⚠️ Pre-1.0 — expect breaking changes. The MCP tool surface (tool names, parameters, return shapes) is still evolving as the project matures. Pin to a specific commit or tag when installing from git, and review the CHANGELOG before upgrading.
apple-mail-pz-mcp --versiontells you exactly what you are running.
Tools (27)
Grouped by lifecycle (13 read-only, 14 mutating):
Discovery —
get_server_version,diagnose_mail_access,list_accounts,list_mailboxes,list_rules,list_templates: inspect access/search health and enumerate what's configured (no external cache — call per account).Read —
search_messages,get_messages,get_thread,get_statistics,get_attachment_content,get_template,render_template: read messages/threads, aggregate inbox stats, pull an attachment's content inline, and render templates.Message actions —
update_message(read/flag/move in one pass),delete_messages(→ Trash),save_attachments(to disk, byte-capped).Drafts —
create_draft(new / reply / forward, optionallysend_now),update_draft,delete_draft.Mailbox CRUD —
create_mailbox,update_mailbox(rename or move),delete_mailbox.Rules —
create_rule,update_rule,delete_rule.Templates (write) —
save_template,delete_template.
Destructive operations (delete_*, create_rule with move/forward/delete actions, create_draft with send_now=true) prompt for confirmation via MCP elicitation. See docs/reference/TOOLS.md for full parameters and return shapes.
Related MCP server: macos-mail-mcp
Prerequisites
macOS 10.15 (Catalina) or later
Python 3.10 or later
Apple Mail configured with at least one account
uv (recommended) or pip
Installation
All 27 tools install by default. Destructive tools confirm each action through MCP elicitation and fail closed if the host cannot prompt — so on Claude Desktop and Cowork, which don't implement elicitation yet, those tools return a confirmation error instead of acting. If you'd rather not see them at all, run with
--read-only(or tick Read-only mode when installing the.mcpb).
Claude Desktop — install from file (.mcpb)
The lowest-friction path for Claude Desktop: grab the apple-mail-pz-mcp-<version>.mcpb
bundle from the Releases
page and open it (or drag it into Settings → Extensions). Claude Desktop manages Python
and dependencies for you via uv — no manual venv, no config JSON to hand-edit. macOS only.
To build the bundle yourself: ./scripts/build-mcpb.sh → dist/apple-mail-pz-mcp-<version>.mcpb
(requires Node for the mcpb packer).
Claude Code — install as a plugin
One command in Claude Code, no config JSON:
/plugin marketplace add wylieswanson/apple-mail-pz-mcp
/plugin install apple-mail-pz@apple-mail-pz-mcpClaude Code launches the server via uv run from the plugin directory (resolves dependencies
from the bundled pyproject.toml/uv.lock — no PyPI needed), so you only need uv installed.
macOS only. See docs/reference/TOOLS.md for IMAP setup and the
read/write split.
Codex CLI
Add to ~/.codex/config.toml (or run codex mcp add). Point at the installed console
script rather than uv run --directory …: Codex's startup_timeout_sec defaults to 10
seconds, and a cold uv dependency resolve will exceed it.
[mcp_servers.apple-mail]
command = "apple-mail-pz-mcp" # or the absolute path from `which apple-mail-pz-mcp`
env = { APPLE_MAIL_MCP_LOCAL_DB = "1" }
startup_timeout_sec = 30
# Read-only if you want it — then `default_tools_approval_mode = "auto"` is safe,
# because every exposed tool is read-only.
# args = ["--read-only"]
# default_tools_approval_mode = "auto"Two Codex-specific notes. Elicitation landed around v0.119; on older builds the write
tools fail closed exactly as they do on Cowork. And Codex's per-tool approval_mode means
you do not need the two-connector split below — set approval_mode per tool instead.
uv tool / uvx (any MCP client)
Not published to PyPI — install straight from the repo:
# install the console script onto your PATH (recommended)
uv tool install git+https://github.com/wylieswanson/apple-mail-pz-mcp
# or run it on demand, no install
uvx --from git+https://github.com/wylieswanson/apple-mail-pz-mcp apple-mail-pz-mcpuv tool install freezes the git commit into the build, so apple-mail-pz-mcp --version
reports exactly what you installed. Then point your MCP client at the installed script:
{
"mcpServers": {
"apple-mail": { "command": "/Users/you/.local/bin/apple-mail-pz-mcp" }
}
}Use the absolute path from which apple-mail-pz-mcp: MCP hosts spawn servers with a
restricted PATH, so a bare command name is a common cause of "server failed to start".
From source (development)
git clone https://github.com/wylieswanson/apple-mail-pz-mcp.git
cd apple-mail-pz-mcp
uv sync --devConfiguration
Skip this section if you installed the
.mcpbbundle — it wires up Claude Desktop for you. The manual config below is for source installs.
Add to your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json). uv sync installs a console script at .venv/bin/apple-mail-pz-mcp; point Claude Desktop at its absolute path — it's the most reliable form under Claude Desktop's restricted spawn environment (no reliance on uv being on PATH):
{
"mcpServers": {
"apple-mail": {
"command": "/path/to/apple-mail-pz-mcp/.venv/bin/apple-mail-pz-mcp"
}
}
}(Equivalent alternative if you prefer driving it through uv: "command": "uv", "args": ["--directory", "/path/to/apple-mail-pz-mcp", "run", "apple-mail-pz-mcp"].)
Read-only mode and the elicitation caveat
Every destructive tool confirms the operation through MCP elicitation and fails closed: if the client can't prompt the user, the tool returns error_type: "confirmation_required" rather than proceeding. That is a deliberate security property — an earlier version silently proceeded, which was a real bypass of the confirmation gate.
The consequence is that the write tools only function on a host that implements elicitation:
Host | Elicitation | Write tools |
Claude Code | Yes | Work |
Codex CLI ≥ ~v0.119 | Yes | Work |
Codex CLI, older | No | Fail closed |
Claude Desktop / Cowork | No ( | Fail closed |
They are still installed by default, because that's a host limitation rather than a property of this server, and hosts are fixing it. If you'd rather the model not see tools it cannot use on your host, start the server in read-only mode — it exposes the 13 read tools and skips registering the 14 mutating ones:
apple-mail-pz-mcp --read-only # flag
APPLE_MAIL_MCP_READ_ONLY=1 apple-mail-pz-mcp # or env var, for hosts that only pass envThe .mcpb bundle surfaces this as a Read-only mode checkbox at install time. Whatever you do, don't work around the gate by making confirmation pass silently.
Optional: split read / write servers
Claude Desktop prompts per-tool for permission. If you want to batch-approve the 13 read tools (version / diagnose / list / search / get) and still gate the 14 mutating tools per call, run the connector twice — once with --read-only, once without — under two separate mcpServers entries:
{
"mcpServers": {
"apple-mail-read": {
"command": "/path/to/apple-mail-pz-mcp/.venv/bin/apple-mail-pz-mcp",
"args": ["--read-only"]
},
"apple-mail-write": {
"command": "/path/to/apple-mail-pz-mcp/.venv/bin/apple-mail-pz-mcp"
}
}
}The --read-only server exposes only the 13 read tools, so Claude Desktop's per-server permission UI naturally groups them. The full server still gates writes individually. Trade-off: 2× connector processes. See docs/reference/TOOLS.md for the per-tool classification and a note on MCP annotation hints (readOnlyHint / destructiveHint / idempotentHint) which forward-compatible hosts may use to provide the same UX without the split.
What version am I running?
Three ways to ask, depending on who's asking.
From a shell — reports the release, the commit it was built from, when that commit was made, and (for an installed build) when the wheel was built:
$ apple-mail-pz-mcp --version
apple-mail-pz-mcp 0.11.1 | commit 0ef7dd33b850 | committed 2026-07-09T14:40:02-07:00 | built 2026-07-09T22:29:46+00:00From an MCP host — the server reports its version in serverInfo at initialize, so hosts that show connector versions will display it without any tool call.
From an agent mid-conversation — diagnose_mail_access returns a server block:
{
"version": "0.11.1",
"commit": "0ef7dd33b850",
"commit_date": "2026-07-09T14:40:02-07:00",
"built_at": "2026-07-09T22:29:46+00:00",
"dirty": false,
"source": "build",
"read_only": false
}source tells you how much to trust the commit: build means it was frozen into the wheel at build time, git means it was read live from a source checkout (and dirty says whether that tree had uncommitted changes), and unknown means the package was installed from an sdist built outside a repo — in which case the commit is genuinely unrecoverable and the server says so rather than guessing.
Permissions
On first run, macOS will prompt for Automation access. Grant permission in: System Settings > Privacy & Security > Automation > Terminal (or your IDE)
Experimental: local Mail index accelerator
This fork can optionally accelerate search_messages metadata queries by
reading Apple Mail's local Envelope Index SQLite database in read-only mode:
{
"mcpServers": {
"apple-mail-read": {
"command": "/path/to/apple-mail-pz-mcp/.venv/bin/apple-mail-pz-mcp",
"args": ["--read-only"],
"env": { "APPLE_MAIL_MCP_LOCAL_DB": "1" }
}
}
}What it covers today: account/mailbox-scoped search_messages filters for
sender, subject, read/unread, flagged, dates, received_within_hours, and
limit. Supported metadata-only queries prefer the local DB first, then fall
back to IMAP or AppleScript. Body/text search, has_attachment, and
attachment metadata still use IMAP when configured or AppleScript fallback.
This path requires Full Disk Access for the host app because it reads
~/Library/Mail/V*/MailData/Envelope Index. If the local database is missing,
unreadable, or has an unexpected schema, the connector falls back to
AppleScript. The database is opened with mode=ro; the connector never writes
to Mail's store. When APPLE_MAIL_MCP_LOCAL_DB=1 is set, the server emits a
one-time startup warning if the Envelope Index is unavailable so you can catch
Full Disk Access problems without waiting for a slow fallback query.
Run diagnose_mail_access(account="iCloud", mailbox="INBOX") from your MCP
client to see whether the running process can read Mail's store and which
search backends are configured. search_messages responses also include a
search_backend field (imap, local-db, applescript, or source) and
search_elapsed_ms. If diagnostics report mail_directory_readable: false,
grant Full Disk Access to the exact app that launches the server (Claude
Desktop, iTerm, Terminal, or your IDE), then fully quit and reopen that app.
Optional: faster search via IMAP
search_messages works out of the box via AppleScript. For large mailboxes (thousands of messages), AppleScript's whose clause can take 1–5 seconds per query. If you want faster server-side search, you can enable IMAP delegation per account by adding a Keychain entry.
How it works. If credentials exist for an account, the server uses IMAP (fast, server-side SEARCH). Otherwise — or on any IMAP failure (offline, wrong password, timeout) — it silently falls back to AppleScript. You never lose functionality; you only gain speed when IMAP is configured and reachable. The normal opt-in is a Keychain entry (below); an environment-variable fallback (further down) covers contexts where the Keychain isn't usable.
One-time setup per account — the setup-imap subcommand walks you through it:
apple-mail-pz-mcp setup-imap --account iCloudSubstitute the Mail.app account name exactly — whatever it's labeled in Mail.app (e.g. iCloud, Gmail, "Yahoo!"). The guided flow (#384):
detects your provider from the account's IMAP host and points you at the right app-password page — iCloud (account.apple.com → App-Specific Passwords), Gmail (myaccount.google.com/apppasswords), Yahoo, Outlook, Fastmail (generic guidance for anything else) — with the provider's 2FA steps, and offers to open the page in your browser;
explains that this is a scoped, revocable app-specific password — limited to that one account — unlike granting full disk access;
looks up the account's primary email from Mail.app (override with
--email, which is persisted so runtime uses the same login — see the iCloud quirk below);prompts via
getpassso the password never lands in shell history;writes to Keychain at
apple-mail-fast-mcp.imap.<account>(idempotent — re-running with a new password updates the entry; pre-renameapple-mail-mcp.imap.entries still resolve via a read-through fallback removed at 1.0.0);opens an IMAP connection and runs a real LOGIN to confirm the password works. On rejection it rolls back the Keychain entry and lets you paste again (up to 3 tries) so a bad password never leaves a broken item behind.
If you see a one-time "security wants to use the 'login' keychain" prompt on the next IMAP-backed call, click Always Allow.
To remove the entry later: apple-mail-pz-mcp setup-imap --account iCloud --uninstall.
Environment-variable fallback (uvx / headless / CI)
Some contexts have no usable Keychain: uvx runs (ephemeral binary paths break the Keychain ACL, causing re-prompts or failures), Docker / CI (no Keychain at all), and background services (the ACL prompt blocks forever with no UI attached). For those, you can supply the IMAP password via an environment variable instead:
APPLE_MAIL_MCP_IMAP_PASSWORD_<SUFFIX><SUFFIX> is the Mail.app account name uppercased, with each run of non-alphanumeric characters collapsed to a single underscore and leading/trailing underscores trimmed:
Account name | Environment variable |
|
|
|
|
|
|
|
|
When set to a non-empty value, the env var is used in preference to any Keychain entry for that account (it's checked first, with no security shell-out). An empty or whitespace-only value is ignored and the Keychain path is used. The lookup composes with the name↔UUID fallback, so an env var keyed on the account name is still found when a caller passes the account's UUID.
⚠️ Security tradeoff. Environment variables are far less private than the Keychain — they're visible via
ps -E,launchctl getenv,/proc-style introspection, and process crash dumps, and they're easy to leak into logs or shell history. Use this only when the Keychain genuinely isn't an option (uvx, Docker, CI, headless). For Claude Desktop and standard local installs, stick withsetup-imap+ Keychain.Caveat: the name→suffix mapping isn't reversible —
Yahoo!andYahooboth map toYAHOO, and an account name with no ASCII letters/digits has no env-var form (use the Keychain for those).
Verifying the setup. The setup-imap command does this for you. If you want to spot-check post-hoc:
uv run python -c "from apple_mail_fast_mcp.mail_connector import AppleMailConnector; \
print(AppleMailConnector().search_messages(account='<ACCOUNT_NAME>', limit=1))"If IMAP is working, the call returns in ~1 second. If it logs a WARNING about falling back (visible with --log-level=DEBUG), check that the account name matches Mail.app's account name exactly and that the email in your Keychain entry matches what email addresses of account returns.
Known provider quirks.
iCloud: the IMAP server accepts
@icloud.com/@me.comaliases as LOGIN username, not the Apple ID email. The server (andsetup-imap) readsemail addresses of accountfrom Mail.app for that reason. If your iCloud Apple ID is a third-party address (e.g. a@gmail.comApple ID) and Mail.app reports no@icloud.comaddress for the account, auto-detection can't find the right login —setup-imapwill fail with a hint to re-run with--email <your @icloud.com/@me.com address>. That--emailvalue is persisted (in~/.apple_mail_mcp/imap_login_overrides.json) so runtime resolution uses the same login (#341). It's a general override — use it for any account whose auto-detected IMAP login is wrong.Yahoo: app passwords have been progressively deprecated; the option may not be available for all accounts. If Yahoo's account-security page doesn't show the option, IMAP setup isn't possible for that account and AppleScript is the only path.
Gmail: requires 2-Step Verification enabled. If your Google Workspace admin has disabled app passwords at the tenant level, IMAP setup isn't possible for that account.
Gmail thread retrieval — All Mail visibility tradeoff.
find_thread_members(used internally by thread-aware queries) is fastest when[Gmail]/All Mailis exposed over IMAP — that path is ~5 round-trips, mailbox-count-independent. Many users hide All Mail (Gmail Settings → Forwarding and POP/IMAP → Folder size limits → "Do not show in IMAP") because it duplicates every message. When hidden, the connector falls back to a per-mailbox X-GM-THRID iteration (still ~6× faster than the universal BFS, but proportional to your label count — ~25s on a 92-label account). Expose All Mail if you want the headline speed; keep it hidden if you prefer the cleaner IMAP folder list.
Write operations (create_draft, update_draft, including the send_now=true send path) always use AppleScript regardless of IMAP configuration — these need Mail.app's compose UI.
Development
# Setup
uv sync --dev
# Common commands
make test # Run unit tests
make lint # Lint with ruff
make typecheck # Type check with mypy
make check-all # All checks (lint, typecheck, test, complexity, version-sync, parity)
make coverage # Coverage report
make test-integration # Integration tests (requires Mail.app)
# Validation scripts
./scripts/check_version_sync.sh # Version consistency
./scripts/check_client_server_parity.sh # Connector-server alignment
./scripts/check_complexity.sh # Cyclomatic complexity
./scripts/check_applescript_safety.sh # AppleScript safety auditBranch Convention
{type}/issue-{num}-{description} — e.g., feature/issue-42-thread-support
Architecture
server.py (FastMCP tools — thin orchestration, validation, elicitation gates)
-> mail_connector.py (dispatch + domain logic)
-> AppleScript path: subprocess.run(["osascript", ...]) -> Apple Mail.app (universal baseline)
-> IMAP fast path: imap_connector.py -> the account's IMAP server (when hinted + Keychain creds)Dispatch model. AppleScript is the always-available baseline. When a read/mutation call supplies
an account (and, where relevant, mailbox) hint and the account has Keychain IMAP credentials,
the connector takes a server-side IMAP fast path; on any IMAP failure it falls back to AppleScript, so
you never lose functionality — you only gain speed. See
docs/reference/ARCHITECTURE.md for the full dispatch model, the
dual-emit message-ID scheme, the drafts lifecycle, and the IMAP thread tiers.
server.py — MCP tool registration, input validation, confirmation (elicitation) gates, response formatting
mail_connector.py — AppleScript generation/execution + IMAP-fast-path dispatch
imap_connector.py — IMAP client + connection pool (search, fetch, bulk-mutation fast paths)
security.py — Input sanitization, audit logging, confirmation flows
utils.py — Pure functions: escaping, parsing, validation
exceptions.py — Typed exception hierarchy
Security
Local execution only (no cloud processing)
Uses existing Mail.app authentication; IMAP app-passwords (opt-in) live in the macOS Keychain, never in the repo or config
All inputs sanitized and AppleScript-escaped (defense against AppleScript injection)
Destructive operations require user confirmation via MCP elicitation; rate limits + audit logging on top
save_attachmentsis byte-capped (per-attachment + aggregate) against disk-fill DoS
Docs:
SECURITY.md — vulnerability-reporting policy
docs/SECURITY.md — user-facing security posture & privacy
docs/guides/THREAT_MODEL.md — STRIDE trust-boundary analysis
docs/guides/SECURITY_CHECKLIST.md — per-feature contributor checklist
Contributing
See CONTRIBUTING.md for development workflow, coding standards, and PR process.
Credits and origins
This project is a continuation of apple-mail-fast-mcp, created by Morgan Jeffries and released under the MIT License. Effectively all of the engineering that makes this server work is theirs:
the AppleScript connector and its hard-won gotchas — JSON emission via ASObjC, the
|name|:record-key quirk,whose-clause search;the IMAP fast path, connection pooling, and Gmail
X-GM-THRIDthread strategies;the security model — double sanitization, path-traversal-safe name validation, rate limiting, audit logging, and the fail-closed confirmation gate on every destructive tool;
the test discipline: 1544 unit, 35 e2e, and 62 integration tests, and the validation scripts that keep the docs honest.
That project itself succeeded apple-mail-mcp; the lineage is preserved in the CHANGELOG and in the Keychain read-through fallbacks, which still resolve credentials written under both earlier names.
The direction
apple-mail-pz-mcp (PingZero) evolves the tool surface for LLM efficiency rather than for human API aesthetics. The working thesis: an agent's cost is dominated by round-trips and by tokens spent re-reading what it already fetched. Two corollaries follow — the tool surface should cost as little as possible to have, and as few calls as possible to use — and both are measurable, so neither is taken on faith.
What this fork has changed so far
Made the thesis falsifiable. Nothing here gets optimized before it gets measured.
scripts/schema_budget.py(make schema-budget) measures thetools/listpayload every request carries before the model does any work: 17,281 bytes read-only, 40,885 bytes for all 27 tools.make check-allratchets it against a committed baseline, so growth must be re-recorded deliberately rather than drifting.evals/agent_tool_usability/task_eval.py(make eval-tasks) drives a real model to completion against the real MCP server and reports round-trips and tokens per completed task, grading the resulting mailbox rather than the model's summary. Each task declares the call budget a competent agent needs. Upstream's eval asks whether a model picks the right tool; this one asks what finishing costs.Acting on that: 1,032 bytes trimmed from every request (~279 tokens, 5.8% of the read-only surface) by deleting tool-description prose that carried no decision the model has to make.
Behaves predictably across MCP hosts, rather than only on the one it was developed against.
Hosts that serialize every tool argument as a string — Cowork, and Codex via schema flattening — no longer break array and object parameters. A stringified
"null"on an optional parameter now means omitted, where it previously became the one-element list["null"]and silently filtered a search to nothing while reporting success.Elicitation-less hosts are documented rather than designed around: the destructive-tool gate still fails closed, and users who don't want to see tools their host can't run pass
--read-only. See the compatibility matrix in AGENTS.md.Read-only is opt-in, not the default — via
--read-only,APPLE_MAIL_MCP_READ_ONLY=1, or a checkbox when installing the.mcpb. Writes are a first-class mode.First-class Codex CLI setup, and a root
AGENTS.mdso Claude Code, Cowork, and Codex read the same instructions.
Says what it is. --version, MCP serverInfo, and diagnose_mail_access all report the release, the git commit it was built from, when that commit was made, and whether writes are registered — including when Mail access is broken, which is when you'd ask. See What version am I running?.
Still inherited, still upstream's: bounded bodies and attachments, the fail-closed confirmation gate, the AppleScript connector, the IMAP fast path.
This is an independent fork, not a staging area for upstream. Nothing here presumes upstream wants any of it back — though anyone, upstream included, is free to take any of it under the MIT License. If you build on this in turn, the same courtesy applies: keep Morgan's copyright notice, because most of this code is theirs.
License
MIT — Copyright (c) 2025 Morgan. The original copyright notice is retained unmodified; this project adds no separate copyright claim.
Available Tools
25 toolscreate_draftA
Create a draft (fresh, reply, or forward). Optionally send immediately.
Mail.app's actual primitive is the draft — every outgoing message is a draft until sent. This tool lets callers create one, optionally seeded from an existing message (reply or forward), and either save it for later or send it now.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | ||
| to | No | ||
| bcc | No | ||
| body | No | Body text. For reply/forward, a non-empty body REPLACES Mail's auto-quoted content; an empty body leaves the auto-quote intact (matches Mail.app's default reply behavior). | |
| subject | No | Subject. Required when both seeds are None. For reply/forward, ``None`` keeps Mail's ``Re:``/``Fwd:`` prefix. | |
| reply_to | No | Id of a message to reply to. Accepts either Mail.app's internal numeric id or an RFC 5322 Message-ID — pass the ``id`` field from any ``search_messages`` / ``get_messages`` row verbatim. Mutually exclusive with ``forward_of``. When set, ``to``/``cc`` recipients and ``subject`` are auto-derived from the original (override by passing them explicitly). | |
| send_now | No | ``False`` (default) saves as draft. ``True`` sends immediately and elicits user confirmation. | |
| body_html | No | Optional HTML body. When set, the draft is built as a multipart/alternative (HTML + a plain-text alternative taken from ``body``, or derived from the HTML when ``body`` is empty). HTML drafts are created over the clean IMAP path, so they REQUIRE IMAP credentials for the account and are limited to fresh save-as-draft: passing ``body_html`` with ``send_now`` or with ``reply_to``/``forward_of`` is rejected, and if IMAP can't engage the call fails (``error_type: "html_requires_imap"``) rather than silently downgrading to plain text. HTML is caller-trusted (not sanitized). (#251) | |
| reply_all | No | For ``reply_to`` only — use ``reply to all``. | |
| forward_of | No | Id of a message to forward. Accepts the same id forms as ``reply_to``. Mutually exclusive with ``reply_to``. ``to`` is required (recipient of the forward). | |
| from_account | No | Mail.app account name or UUID. ``None`` uses Mail's default; on a save-as-draft with exactly one enabled account, that account is adopted so the clean (no iOS quote bug) IMAP draft path can engage. | |
| seed_mailbox | No | Mailbox the reply_to/forward_of message lives in (e.g. the ``mailbox`` field from its ``search_messages`` row). Lets the clean save-as-draft path fetch the original directly so reply/forward drafts render without the iOS quote bug — supply it especially for replies to filed (non-INBOX) mail. Defaults to INBOX; a miss falls back transparently. | |
| template_name | No | Optional template to render for ``subject`` and ``body``. Caller-supplied ``subject``/``body`` override the rendered output. ``template_vars`` override auto-fills. | |
| template_vars | No | Variables to pass to the template renderer. Requires ``template_name``. | |
| attachment_paths | No | List of file paths to attach. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate it is not read-only, idempotent, or destructive. The description adds behavioral traits: send_now elicits user confirmation, HTML body requires IMAP and has constraints, and body replacement behavior for replies/forwards. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise: a short first sentence capturing the core action, followed by a slightly longer second paragraph adding context. It is front-loaded and avoids unnecessary words, though the second paragraph could be trimmed slightly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 15 parameters and high schema coverage, the description provides good overall context: modes (fresh/reply/forward), send behavior, HTML constraints, and auto-quote handling. It is complete enough for typical usage, though some error scenarios beyond HTML are not detailed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is high (80%), so the baseline is 3. The description adds minimal extra meaning beyond the schema's built-in parameter descriptions; it reiterates the overall purpose but does not significantly enhance individual parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool creates a draft (fresh, reply, or forward) and optionally sends it immediately. It uses a specific verb ('Create') and resource ('draft'), and distinguishes the tool from siblings like update_draft by indicating it is for creation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains that the tool is for creating a draft from scratch or from an existing message, with an option to send. While it provides clear context, it does not explicitly contrast with alternative tools (e.g., update_draft for modifications) but the purpose is clear enough for an agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_mailboxBIdempotent
Create a new mailbox/folder.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Name of the new mailbox | |
| account | Yes | Mail.app account display name (e.g., "Gmail", "iCloud") or UUID (from list_accounts) to create the mailbox in. Names are convenient but unstable across renames; UUIDs are stable. | |
| parent_mailbox | No | Optional parent mailbox for nesting (None = top-level) |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate the tool is mutating (readOnlyHint=false) and idempotent (idempotentHint=true). The description adds 'create' but doesn't disclose side effects or permission requirements. Given annotations cover key traits, the description adds minimal value.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that communicates the core purpose without wasted words. It is appropriately front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description lacks important context such as required preconditions (e.g., account must exist), uniqueness constraints on mailbox names, or details about the return value. Given the existence of an output schema and annotations, more behavioral context is expected.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema itself documents all parameters well. The description does not add additional meaning beyond what the schema provides, earning a baseline score of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Create') and resource ('mailbox/folder'), clearly stating the action. It distinguishes from siblings like update_mailbox and delete_mailbox, but could be more explicit about the resource type.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like list_mailboxes or update_mailbox. There are no prerequisites, conditions, or scenarios mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_ruleA
Create a new Mail.app rule.
Rules with actions that can move, forward, or delete mail
(delete / forward_to / move_to / copy_to) require user confirmation —
a single create can install automation that auto-forwards or deletes
all future mail (#222). Organizational-only rules (mark_read,
mark_flagged, flag_color) are created without a prompt. Mail.app
appends new rules to the end of the rule list, so the returned
rule_index equals the new total rule count.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Rule display name. Need not be unique. | |
| actions | Yes | Dict with at least one truthy entry from: - move_to: {"account": str, "mailbox": str} - copy_to: {"account": str, "mailbox": str} - mark_read: bool - mark_flagged: bool (with optional flag_color enum) - flag_color: 'none' | 'red' | 'orange' | 'yellow' | 'green' | 'blue' | 'purple' | 'gray' - delete: bool - forward_to: list[str] of email addresses | |
| enabled | No | Whether the rule is enabled on creation. Default True. | |
| conditions | Yes | List of condition dicts (at least one required). Each: - field: 'from' | 'to' | 'subject' | 'body' | 'any_recipient' | 'header_name' - operator: 'contains' | 'does_not_contain' | 'begins_with' | 'ends_with' | 'equals' - value: substring or value to match - header_name: required iff field == 'header_name' | |
| match_logic | No | 'all' (AND across conditions) or 'any' (OR). Default 'all'. | all |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are basic (no read-only, idempotent, or destructive hints). The description adds crucial behavioral traits: confirmation prompts for certain actions, no prompt for others, rule appending behavior, and the meaning of rule_index. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise (5 sentences), front-loaded with purpose, and structured logically. Every sentence adds necessary context without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (5 params, nested objects, output schema), the description covers all key behavioral aspects: confirmation, rule ordering, output index meaning. No gaps for safe and correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so schema already documents parameters well. The description adds value by explaining which actions trigger user confirmation, a behavioral aspect not in the schema. This helps the agent understand the real-world effect of the 'actions' parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it creates a new Mail.app rule, with specific verb and resource. It distinguishes from siblings like update_rule, delete_rule, list_rules by detailing creation behavior and rule types.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly tells when user confirmation is needed (actions that move/forward/delete) and when not (organizational-only). Also explains rule ordering and output semantics (rule_index equals new total count). This helps the agent decide when to use create vs update.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_draftADestructiveIdempotent
Delete (move to Trash) an existing draft.
Lifecycle endpoint for cancellation. Mail.app moves the message to the Deleted Messages mailbox; recovery is technically possible but Mail.app no longer treats trashed drafts as editable, so this is effectively a one-way discard. No elicitation (recoverable from Trash) and no rate limit (local operation).
| Name | Required | Description | Default |
|---|---|---|---|
| draft_id | Yes | Mail.app id of the draft. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond annotations, the description adds that recovery is technically possible but the draft becomes non-editable, making it effectively one-way. It also notes no rate limit and local operation, providing useful behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise (4 sentences) and front-loads the main action. The second sentence ('Lifecycle endpoint for cancellation') adds slight redundancy but does not detract significantly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple tool with one parameter and existing annotations/output schema, the description covers the action, effective behavior, recovery, rate limit, and local operation, making it fully adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is one parameter (draft_id) with schema coverage at 100%. The description does not add extra information about the parameter beyond what the schema provides, so it meets the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description begins with 'Delete (move to Trash) an existing draft,' clearly stating the verb and resource. It distinguishes from sibling tools like delete_messages by specifying it's for drafts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage as a 'lifecycle endpoint for cancellation,' but does not explicitly state when not to use it or list alternatives. However, the context of drafts versus messages provides clear guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_mailboxADestructiveIdempotent
Delete a mailbox via IMAP.
Mail.app's AppleScript dictionary doesn't expose a working delete
primitive for mailboxes, so this operation goes through IMAP. Requires
IMAP credentials in Keychain (#73 opt-in flow) — returns
error_type: "imap_required" when missing.
Always elicits user confirmation (destructive). By default refuses
non-empty mailboxes to prevent accidental data loss; pass
delete_messages=True to cascade.
Refused (#164): targeting the bare [Gmail] parent or any
[Gmail]/... child path returns error_type: "unsupported_gmail_system_label". Gmail's IMAP server doesn't
support DELETE for these paths.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Mailbox name. Slash-separated for nested mailboxes. | |
| account | Yes | Mail.app account display name or UUID. | |
| delete_messages | No | When False (default), refuse if the mailbox contains messages. When True, cascade-delete the mailbox and its contents. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and readOnlyHint=false, but the description adds significant behavioral details: it requires IMAP credentials from Keychain, always elicits user confirmation, refuses non-empty mailboxes by default with a cascade option, and returns specific error types for missing credentials or unsupported Gmail paths. No contradiction with annotations; it enriches the agent's understanding.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is moderately long but well-structured with paragraphs for method, behavior, and constraints. Each sentence provides distinct value (e.g., reason for IMAP, credential requirement, cascade behavior, Gmail restriction). No fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the destructive nature, multiple constraints (empty check, Gmail paths, credential requirement), the description is thorough. It covers the operation method, prerequisite, user confirmation, and error handling. Since output schema exists, return values don't need explanation. The description is complete for safe and correct tool use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with parameter descriptions, but the tool description adds practical context: name is slash-separated for nested mailboxes, account is display name or UUID, and delete_messages defaults to false and cascade-deletes when true. This adds meaning beyond the schema without redundancy.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states 'Delete a mailbox via IMAP', which is a specific verb and resource. It distinguishes itself from siblings like 'delete_messages' by explaining why IMAP is used instead of AppleScript, and it's clearly a different operation from 'create_mailbox'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains when to use the tool (deleting a mailbox) and provides critical conditions: it refuses non-empty mailboxes by default, requires delete_messages=True to cascade, and unsupported for [Gmail] paths. It also mentions the IMAP credentials prerequisite. While it doesn't explicitly list alternatives, the context and mention of unsupported paths give good guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_messagesADestructiveIdempotent
Delete messages (always moves to the account's Trash mailbox).
Destructive: gated behind user confirmation via MCP elicitation (issue #239), matching delete_rule / delete_mailbox / delete_template.
| Name | Required | Description | Default |
|---|---|---|---|
| account | No | Optional account name (or UUID) the messages live in. Must be provided together with `source_mailbox`. When both are given, the operation is much faster. | |
| permanent | No | Reserved; currently a no-op. Mail.app's AppleScript dictionary exposes no path to permanent-delete that bypasses Trash (issue #111). Passing True emits a DeprecationWarning; messages still go to Trash. Recoverable from the account's Trash mailbox until that mailbox is emptied. | |
| message_ids | Yes | List of message IDs to delete | |
| source_mailbox | No | Optional source mailbox name; see `account`. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds critical context beyond annotations: messages always go to Trash, the 'permanent' parameter is currently a no-op and deprecated, and behavior matches sibling delete tools. This complements the destructiveHint=true annotation with practical details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is brief and front-loaded with the core action. The additional note about user confirmation is useful but could be more structured. Still, every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of annotations, full schema, and output schema, the description sufficiently covers the tool's behavior: it explains the Trash behavior, no-op permanent parameter, and confirmation requirement. No further gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema covers all 4 parameters with descriptions (100% coverage). The description adds value by clarifying that 'permanent' is a no-op, which is not evident from the schema alone. Baseline 3, plus extra context justifies 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with 'Delete messages (always moves to the account's Trash mailbox)', clearly stating the action and specificity (moves to Trash). This distinguishes it from sibling tools like delete_draft, delete_mailbox, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description notes that the tool is 'Destructive: gated behind user confirmation via MCP elicitation (issue #239)', which provides usage guidance about requiring user confirmation. However, it does not explicitly state when not to use this tool or provide alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_ruleADestructiveIdempotent
Delete a Mail.app rule by 1-based positional index.
Destructive — requires user confirmation via MCP elicitation before running. Cannot be undone (Mail.app does not version rule history).
| Name | Required | Description | Default |
|---|---|---|---|
| rule_index | Yes | 1-based positional index from list_rules. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide destructiveHint and idempotentHint. Description adds that it requires user confirmation and that Mail.app does not version rule history, adding context beyond annotations. No contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences that efficiently convey purpose and key behavioral details. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given one parameter, clear annotations, and existence of an output schema, the description is complete for a delete operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Single parameter has full schema coverage with description that matches the tool's text. The description does not add new meaning beyond the schema; both specify it's 1-based and from list_rules. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states verb (delete), resource (Mail.app rule), and method (by 1-based positional index). Distinguishes from sibling tools like delete_draft or delete_mailbox.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly warns about destructive nature and need for user confirmation, and that action cannot be undone. No guidance on when to avoid using it, but for a delete tool this is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_templateADestructiveIdempotent
Delete a template by name.
Destructive — requires user confirmation via MCP elicitation before running.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Template name to delete. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond annotations (destructiveHint=true), the description adds the requirement for user confirmation, which is critical for safe execution. This provides actionable behavioral context not covered by structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, first stating purpose and second adding behavioral note. Every sentence adds value; no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite simplicity, the description fully covers purpose and key behavioral aspect (user confirmation). With an output schema present (not shown), the description is sufficient for correct tool invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a clear description for the 'name' parameter. The tool description adds no further parameter details, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Delete a template by name', specifying the verb (delete), resource (template), and method (by name). It distinguishes from sibling tools like delete_draft, delete_mailbox, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly notes 'requires user confirmation via MCP elicitation before running', guiding the agent to involve the user for destructive actions. It could be more explicit about when not to use, but given the context, it's clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_attachment_contentARead-onlyIdempotent
Read one attachment's content inline, without writing it to disk.
For "triage" workflows where you want to inspect an attachment (a text
file, JSON, a small PDF) before deciding what to do with it — instead of
save_attachments → read the file → clean up.
| Name | Required | Description | Default |
|---|---|---|---|
| account | No | Mail.app account name or UUID. Supply it (with ``mailbox``) to use the faster IMAP path; pass the same value you read the message with so the attachment ordering matches. | |
| mailbox | No | Folder the message lives in (for the IMAP path). | |
| message_id | Yes | Message id, as returned by ``search_messages`` / ``get_messages`` (RFC 5322 Message-ID on the IMAP path, Mail's internal id on the AppleScript path). | |
| attachment_index | Yes | 0-based index into the message's attachments, in the same order ``get_attachments`` / ``get_messages`` (``include_attachments=True``) report them. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, and non-destructive. The description adds context by clarifying no disk write, and hints at supported file types (text, JSON, small PDFs), but could be more explicit about limitations (e.g., size constraints).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short paragraphs with no extraneous content. The key purpose and usage scenario are front-loaded, and every sentence provides essential information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of an output schema and annotations, the description adequately covers usage context, behavioral traits, and parameter semantics, leaving no significant gaps for a read operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but the description adds value by explaining the rationale for account/mailbox (faster IMAP path) and linking attachment_index to sibling tool output, which helps the agent understand parameter relationships.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states the action (read content) and resource (attachment), and distinguishes itself by emphasizing 'inline, without writing to disk.' This clearly separates it from sibling tools like save_attachments.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a concrete use-case ('triage' workflows) and explicitly contrasts with the alternative workflow of save_attachments + read + cleanup, making it clear when to choose this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_messagesARead-onlyIdempotent
Get full details of one or more messages, with bodies.
Returns a list of message dicts (possibly of length 0 or 1). Pair with
search_messages (metadata-only) and get_thread (thread member
ids) to fetch bodies for specific messages.
| Name | Required | Description | Default |
|---|---|---|---|
| account | No | Mail.app account name. Together with ``mailbox``, activates the IMAP fast path for explicit ids: one round-trip lookup instead of an account×mailbox AppleScript scan (issue #72). Ignored for the ``"SELECTED"`` sentinel (selection is global). | |
| mailbox | No | Folder to look in for the IMAP fast path (e.g. "INBOX"). | |
| message_ids | Yes | List of message ids to fetch. May include the literal token ``"SELECTED"``, which the server resolves at call time to Mail.app's current UI selection (zero-or-more messages). Mixed lists like ``["SELECTED", "12345"]`` are valid. Empty list is a no-op (returns empty result, no error). Missing ids drop out silently (partial-results convention) — the response contains whatever was found. | |
| headers_only | No | Skip body fetch on the IMAP path for explicit ids (default: False). Silently ignored on the AppleScript fallback. | |
| include_content | No | Include message bodies (default: True). | |
| include_attachments | No | Include per-attachment metadata (name, mime_type, size, downloaded) on each message (default: True). Bounded cost — id-list cardinality is typically 1-10. Free on the IMAP fast path; cheap-enough on the AppleScript fallback for typical id counts. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false. The description adds that it returns a list of message dicts (possibly length 0 or 1), which is useful but not beyond what annotations imply. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core purpose, followed by actionable pairing advice. No unnecessary words, every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, the description adequately covers core behavior and pairing context. For a tool with 6 parameters and 1 required, the description is complete enough for agent selection.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema fully documents all 6 parameters. The description does not add significant meaning beyond the schema for parameters, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves full details of messages with bodies, and explicitly distinguishes it from sibling tools search_messages (metadata-only) and get_thread (thread member ids). This provides specific verb+resource differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description advises pairing with search_messages and get_thread to fetch bodies, providing clear context for use. It does not explicitly state when not to use, but the pairing guidance is effective.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_statisticsARead-onlyIdempotent
Aggregate inbox statistics over a mailbox and time window.
A read-only analytics roll-up computed from a single search_messages
pass — message volume, read/unread/flagged counts, read ratio, and the
top senders (by full address or domain). This is the consolidated
inbox-stats tool; per-folder unread counts live on list_mailboxes
and are not duplicated here.
The window defaults to the last ~30 days (received_within_hours=720);
pass date_from/date_to for an explicit range. Stats are computed
over at most scan_limit of the most recent messages in the window —
window_fully_covered is False when the window held more than that,
so the numbers are a recent-sample rather than a silent truncation.
| Name | Required | Description | Default |
|---|---|---|---|
| by | No | Group top senders by "address" (default) or "domain". | address |
| account | Yes | Mail.app account name (e.g. "Gmail"). Required. | |
| date_to | No | ISO date upper bound. | |
| mailbox | No | Mailbox to summarize (default "INBOX"). | INBOX |
| date_from | No | ISO date lower bound (composes with the window). | |
| scan_limit | No | Max messages aggregated (default 500; bounds cost). | |
| top_senders_limit | No | How many top senders to return (default 10). | |
| received_within_hours | No | Window size in hours (default 720 ≈ 30 days). |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and idempotentHint, so safety and idempotency are covered. The description adds transparency about the computational basis ('computed from a single search_messages pass'), the default window, and the truncation behavior (window_fully_covered flag). This provides valuable behavioral context beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is approximately 150 words, well-structured with a clear opening sentence followed by detailed explanations. Every sentence adds value: the first states purpose, the second distinguishes from siblings, the third explains defaults and behavior. No redundant or filler content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (8 parameters, output schema), the description is complete. It covers what is returned (volume, counts, ratio, top senders), the truncation indicator, and the relationship to search_messages. The presence of an output schema means return values need not be detailed further.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so parameters are fully defined. The description adds context: it explains that 'by' groups top senders by 'address' or 'domain', that 'scan_limit' bounds cost, that 'received_within_hours' defaults to 720 (≈30 days), and that 'date_from'/'date_to' compose with the window. This enhances understanding beyond the schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it aggregates inbox statistics over a mailbox and time window, specifying exactly what is computed (message volume, read/unread/flagged counts, read ratio, top senders). It also distinguishes itself from the sibling tool list_mailboxes, which provides per-folder unread counts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit when-to-use guidance: it is 'the consolidated inbox-stats tool' and notes that per-folder unread counts 'live on list_mailboxes and are not duplicated here', directly naming an alternative. It also explains the default window and how to set explicit ranges.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_templateARead-onlyIdempotent
Read a single template by name.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Template name (alphanumerics, underscore, hyphen; 1-64 chars). |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint, idempotentHint, destructiveHint. The description adds no additional behavioral context beyond what annotations state, such as response format or permissions. Minimal added value.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence with five words, no redundancy, and front-loaded with the key action and resource. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple with one parameter, a well-described input schema, output schema present, and annotations covering safety. The description is sufficient for an agent to understand the tool's purpose and usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the parameter 'name' has a clear description. The description restates that the tool reads by name, but does not add extra semantics beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Read' and the resource 'template by name', distinguishing it from sibling tools like list_templates (list all) and save_template (create/update).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use (retrieve a specific template by name) but does not explicitly state when not to use or mention alternatives like list_templates for overview. However, the context from sibling tools is clear enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_threadARead-onlyIdempotent
Return all messages in the thread containing the given message.
Looks up the anchor message by its id, then reconstructs the
conversation via the connector's tiered IMAP threading dispatch
(Tier 1 X-GM-THRID for Gmail, Tier 3 header-search BFS fallback)
or the AppleScript path. Result rows are sorted by date_received
ascending.
The returned ids can be piped into search_messages(source=[ids])
for filtered metadata or get_messages([ids]) for full bodies.
Known limitation: thread members whose subject was rewritten mid-conversation are missed on the AppleScript fallback path (subject prefilter tradeoff).
| Name | Required | Description | Default |
|---|---|---|---|
| message_id | Yes | Internal id of any message in the thread (from ``search_messages`` or ``get_messages`` results). |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond annotations (readOnlyHint, idempotentHint), the description adds behavioral details: sorting by date_received ascending, threading dispatch method (Tiered IMAP, AppleScript fallback), and a known limitation about subject rewrite. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is front-loaded with main purpose and then provides technical details. Could be slightly more concise, but every sentence adds value. Good structure.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given output schema exists for return values, the description adequately covers the tool's behavior, threading algorithm, limitations, and integration with sibling tools. Sufficient for accurate invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for message_id. Description adds context that it is an 'Internal id of any message in the thread' and how it is used as anchor, which adds some value beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'Return all messages in the thread containing the given message.' It details the lookup and reconstruction process, and the tool name 'get_thread' aligns with this purpose. Distinguishes from siblings like get_messages and search_messages.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains how returned ids can be piped into search_messages or get_messages for further processing, providing a usage pattern. However, it doesn't explicitly state when to use this tool vs alternatives or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_accountsARead-onlyIdempotent
List all configured email accounts in Apple Mail.
Returns each account's id (UUID), display name, email addresses, account type, and enabled state. Account ids are stable across name changes; prefer them over names for identifying accounts.
Returns: Dictionary containing the accounts list.
Example: >>> list_accounts() {"success": True, "accounts": [ {"id": "B21B254B-...", "name": "Gmail", "email_addresses": ["me@gmail.com"], "account_type": "imap", "enabled": True}, ... ]}
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false. The description adds return value details but no additional behavioral traits. No contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is concise, well-structured with sections for return details and an example. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with no parameters and an output schema, the description is complete. It explains return fields, includes a stability tip, and provides an example.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters, so schema coverage is 100%. Description adds value by explaining return values and providing an example, meeting the baseline for zero-parameter tools.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists all configured email accounts in Apple Mail, specifies the returned fields (id, name, email addresses, type, enabled state), and distinguishes from sibling tools like list_mailboxes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides a usage hint about preferring account IDs over names due to stability, but does not explicitly state when to use this tool vs alternatives. The hint adds practical guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_mailboxesARead-onlyIdempotent
List all mailboxes for an account.
| Name | Required | Description | Default |
|---|---|---|---|
| account | Yes | Mail.app account display name (e.g., "Gmail", "iCloud") or UUID (from list_accounts). Names are convenient but unstable across renames; UUIDs are stable. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, destructiveHint. Description adds no behavioral traits beyond the basic function. No contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no wasted words, front-loaded purpose. Highly concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Simple tool with good annotations and output schema. Description is minimal but sufficient. Could mention obtaining account via list_accounts, but not necessary.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers all parameters with sufficient descriptions (100% coverage). Tool description does not add new information about parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states verb 'List', resource 'mailboxes', and scope 'for an account'. It distinguishes from sibling tools like list_accounts or list_rules.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives (e.g., after listing accounts). Does not mention prerequisites like needing an account name or UUID.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_rulesARead-onlyIdempotent
List all Mail.app rules (read-only).
Returns each rule's display name and enabled state. Rule names are NOT guaranteed unique — Mail allows duplicates — and rules have no stable id via AppleScript. This tool is read-only; mutation (enable/disable, create, delete) is tracked as a separate enhancement.
Returns: Dictionary containing the rules list.
Example: >>> list_rules() {"success": True, "rules": [ {"name": "Junk filter", "enabled": True}, {"name": "News From Apple", "enabled": False}, ... ], "count": 2}
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint and idempotentHint. The description adds value by disclosing return format, uniqueness caveats, and AppleScript limitations beyond what annotations convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured: immediate purpose, then key caveats, then return format with example. Every sentence adds value, no waste.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameters, good annotations, and output schema, the description fully covers purpose, behavior, return structure, and edge cases (duplicate names, no stable ID).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so baseline is 4. The description does not need to add parameter info.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'List all Mail.app rules (read-only)' with a specific verb and resource, and distinguishes from sibling mutation tools like create_rule, delete_rule, update_rule.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly notes read-only nature and that mutation is tracked separately, implying when to use. It provides caveats about duplicate names and no stable IDs, but doesn't explicitly state when not to use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_templatesARead-onlyIdempotent
List all stored email templates.
Templates live as files at ~/.apple_mail_mcp/templates/.md. Override the location with the APPLE_MAIL_MCP_HOME environment variable.
Returns: Dictionary with each template's name and subject (or null if no subject header is set).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (readOnlyHint, idempotentHint, destructiveHint false), the description reveals that templates are stored as files at a specific path and can be overridden via an environment variable. It also describes the return structure (dictionary with name and subject), adding significant behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise, using only five lines to convey the purpose, location, customization option, and return format. Every sentence provides essential information without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the zero parameters and the presence of an output schema, the description fully covers the tool's purpose, storage location, and return structure. No additional information is needed for an agent to correctly select and invoke the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters are defined, and the schema coverage is 100%. The description does not need to add param info, so a baseline of 4 is appropriate since it fully covers the input requirements.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it lists all stored email templates, with specific verb 'list' and resource 'email templates'. It also details file location and environment variable override, distinguishing it from sibling tools like get_template.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives like get_template or other list tools. The context is implied but not stated, leaving the agent to infer from the tool's name and purpose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
render_templateARead-onlyIdempotent
Render a template into ready-to-send subject and body text.
No side effects — caller is responsible for passing the rendered
text to create_draft or update_draft (with send_now=True
when ready to send).
With message_id, the original sender's display name and email,
the original subject, and today's date are auto-populated as
recipient_name, recipient_email, original_subject, and
today. Without message_id, only today is auto-filled.
User-supplied vars always override auto-fills on conflict.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Template name to render. | |
| vars | No | Optional dict of variable overrides / additional values. | |
| message_id | No | Optional source-message id for reply context. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnly, idempotent, non-destructive; description adds context on auto-population with message_id and override behavior, no contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Concise, front-loaded with purpose, uses bullet-like structure for additional details, no extraneous text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given output schema existence, description covers side effects, usage flow, and auto-population details, fully meeting completeness requirements.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% so baseline 3; description adds meaning by explaining how message_id auto-populates recipient_name, recipient_email, etc., and that vars override auto-fills.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it renders a template into subject and body text, distinguishing from sibling tools like create_draft and update_draft.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states no side effects, that caller must pass rendered text to create_draft/update_draft, and when to use send_now=True, providing clear context for usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
save_attachmentsBIdempotent
Save attachments from a message to a directory.
| Name | Required | Description | Default |
|---|---|---|---|
| account | No | Mail.app account name or UUID. Supply it (with ``mailbox``) to take the faster IMAP path — one fetch instead of an account×mailbox AppleScript scan. Pass the same values you read the message with so attachment ordering matches (#371). Strongly recommended on Gmail, where the AppleScript fallback's unindexed cross-scan can take minutes and time out. | |
| mailbox | No | Folder the message lives in (e.g. "INBOX"), used with ``account`` for the IMAP fast path. | |
| message_id | Yes | Message ID from search results | |
| save_directory | Yes | Directory path to save attachments to | |
| attachment_indices | No | Specific attachment indices to save (0-based), None for all |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate idempotentHint=true and destructiveHint=false. The description adds no behavioral context beyond the action itself, such as overwrite behavior or error handling. It does not contradict the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is front-loaded and contains no unnecessary words. It efficiently conveys the core function.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has an output schema (not shown but known) and detailed parameter descriptions in the schema, the description is minimally adequate. However, it lacks details on behavior (e.g., how missing directories are handled, attachment types) that would fully inform an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage, so the schema already documents all parameters thoroughly. The tool description does not add any additional semantic meaning beyond repeating the action.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Save' and resource 'attachments' from a message to a directory. It is specific and distinguishes from sibling tools like 'get_attachment_content' which returns content rather than saving.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus alternatives (e.g., get_attachment_content). It does not provide context for optimal selection or mention any prerequisites or limitations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
save_templateBIdempotent
Create or overwrite a template.
| Name | Required | Description | Default |
|---|---|---|---|
| body | Yes | Template body text. May contain {placeholder} tokens. | |
| name | Yes | Template name (alphanumerics, underscore, hyphen; 1-64 chars). | |
| subject | No | Optional subject template. May also contain placeholders. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description aligns with annotations (idempotentHint=true, destructiveHint=false) by indicating overwrite behavior. However, it does not disclose any additional side effects or permissions needed beyond what annotations already convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence. While it is not wasteful, it could be slightly more structured (e.g., adding a note about idempotency) without adding length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a write tool with an output schema, the description is minimally adequate but does not clarify behavior when a template already exists (e.g., overwrite vs error), which is partially covered by the idempotentHint annotation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 100% schema description coverage, the schema already documents all three parameters. The description adds no extra meaning or constraints beyond what is in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('create or overwrite') and the resource ('template'). It distinguishes itself from sibling tools like create_draft (drafts) and delete_template (deletion).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool vs alternatives, such as render_template or get_template. There is no mention of when not to use it or preconditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_messagesARead-onlyIdempotent
Search for messages matching criteria. Returns metadata-only rows.
Two corpus modes:
source=None(default): search the given account/mailbox using the IMAP/AppleScript SEARCH path.accountis required.source=[id1, id2, ...]: scope the search to the specific messages identified by the given ids.account/mailboxare ignored; the connector resolves each id self-sufficiently. The resulting message dicts are post-filtered by the other criteria (sender_contains,read_status, etc.) — full filter composition. The literal token"SELECTED"may appear in the list and is server-resolved at call time to Mail.app's current UI selection (zero-or-more messages). Mixed lists like["SELECTED", "12345"]are valid. Missing ids drop out silently (partial-results).
For thread retrieval, call get_thread(message_id) to expand an
anchor into thread member ids, then optionally pipe those ids into
source=[ids] for filtered metadata browsing or into
get_messages([ids]) for full bodies.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum results to return (default: 50). | |
| source | No | Optional list of message ids (with optional ``"SELECTED"`` sentinel) to restrict the search to. ``None`` (default) searches the account/mailbox normally. | |
| account | No | Mail.app account display name (e.g., "Gmail", "iCloud") or UUID (from list_accounts). Required when ``source is None``; ignored when ``source`` is a list. Names are convenient but unstable across renames; UUIDs are stable. | |
| date_to | No | Inclusive upper bound on date received (full day included). ISO 8601 YYYY-MM-DD. | |
| mailbox | No | Mailbox name (default: "INBOX"). Ignored when ``source`` is a list. | INBOX |
| date_from | No | Inclusive lower bound on date received. ISO 8601 YYYY-MM-DD. | |
| is_flagged | No | Filter by flagged status (true=flagged, false=not flagged). | |
| read_status | No | Filter by read status (true=read, false=unread). | |
| body_contains | No | Substring match against message body content. IMAP uses ``BODY`` predicate (sub-second); AppleScript reads ``content of msg`` per candidate (very slow on large mailboxes — measured 148s for 100 cold-cache messages). When the call commits to AppleScript with this filter set, a ``warnings`` field is included in the response. Case-insensitive on both paths. | |
| text_contains | No | Substring match against headers + body (RFC 3501 ``TEXT`` semantics). On AppleScript, approximated as ``content + subject + sender`` (recipients and other headers not matched). Same perf characteristics as ``body_contains``. | |
| has_attachment | No | Filter messages with (true) or without (false) attachments. | |
| sender_contains | No | Filter by sender email/domain substring. | |
| subject_contains | No | Filter by subject keywords substring. | |
| include_attachments | No | When True, each row includes an ``attachments`` field listing per-attachment metadata (name, mime_type, size, downloaded). Default False — opt-in because the AppleScript fallback path can be slow on cold caches (#142). Free on the IMAP fast path. To fetch attachment metadata for a known list of ids cheaply, prefer ``get_messages([ids])`` (default-on attachments, bounded cardinality). | |
| received_within_hours | No | Relative-time filter. When set, only return messages received within the last N hours (hour precision). Composes with ``date_from`` / ``date_to`` — the most restrictive filter wins. Must be a positive int. Days = 24, weeks = 168, etc. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond readOnlyHint/idempotentHint annotations, describes that it returns metadata-only rows, includes performance warnings for body_contains/text_contains, and explains include_attachments overhead. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-structured with sections and bullet points, front-loaded with purpose. Slightly lengthy but all content is justified by the tool's complexity. Could be condensed slightly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Comprehensive coverage of 15 parameters, modes, filtering, performance, and related tools. Output schema exists, so return value explanation is unnecessary. No gaps identified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description adds context for source/account/mailbox interaction and mode behavior, but individual parameter descriptions are already thorough in schema. Still adds value beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states 'Search for messages matching criteria' and distinguishes two corpus modes. Verb+resource is specific, and sibling differentiation is implicit via mode explanations (e.g., compare to get_messages for full bodies).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly explains when to use each mode (source=None vs source=list) and when to prefer alternatives like get_messages or get_thread. Provides clear context for filtering composition.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update_draftADestructiveIdempotent
Update an existing draft. Implemented as delete-and-recreate.
Returns a NEW draft_id — Mail.app forbids mutating saved drafts, so update is implemented by reading the draft's current state, deleting it, and creating a new draft with the merged fields. Threading headers (for reply seeds) and forward anchor are preserved via persisted seed metadata.
Field merge semantics: any non-None argument overrides the existing
value. None keeps the existing value. attachment_paths=None
PRESERVES existing attachments (extracted via Mail's save
command); [] explicitly clears them; a list replaces.
For drafts created externally (not via create_draft), seed
recovery falls back to scanning Mail.app for the In-Reply-To header
— this can be slow on large mailboxes (~30s+ per call). Forward
seeds without disk state are misclassified as fresh; pass an
explicit body if so.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | ||
| to | No | ||
| bcc | No | ||
| body | No | Override body. None keeps existing. Non-None replaces (including the empty string, which clears). | |
| subject | No | Override subject. None keeps existing. | |
| draft_id | Yes | Mail.app id of the existing draft. | |
| send_now | No | ``False`` (default) saves new draft. ``True`` sends after eliciting confirmation. | |
| body_html | No | Optional HTML body for the recreated draft (see ``create_draft``). Requires IMAP credentials and is limited to drafts whose seed is a fresh draft (not reply/forward) and to ``send_now=False``. NOTE: because the draft is recreated and draft state captures only plain text, an existing HTML draft is NOT preserved across an update unless ``body_html`` is passed again. (#251) | |
| from_account | No | Override sender. | |
| template_name | No | ||
| template_vars | No | ||
| attachment_paths | No | Override attachments. None preserves existing via temp-dir extraction; [] clears; list replaces. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond annotations (destructive, idempotent), the description reveals the delete-and-recreate implementation, new draft_id return, seed preservation, attachment handling, and limitations with external drafts. This is highly transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with key facts upfront, then detailed semantics. It is slightly verbose but every sentence adds important information, balancing completeness and readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (destructive, idempotent, 12 parameters, behavioral nuances), the description covers critical aspects: new ID, merge rules, attachment handling, external draft performance, and HTML limitations. The output schema likely covers return values, making it complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers 58% of parameters with descriptions, and the description adds global merge semantics and specific behavior for attachment_paths and body_html. It does not detail all 12 parameters individually, but the provided context is valuable.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Update an existing draft') and the resource ('draft'). It distinguishes from siblings like create_draft by noting it operates on existing drafts and returns a new draft_id, making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implicitly tells when to use (to modify a draft) and provides caveats (e.g., external drafts may be slow), but it does not explicitly contrast with create_draft or delete_draft. However, the context is clear enough for an agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update_mailboxADestructiveIdempotent
Rename and/or re-parent (move) an existing mailbox.
Two delivery paths:
Rename only (
new_nameset,new_parentisNone): AppleScript. Fast, no IMAP credentials needed.Move (
new_parentset; optionally combined with rename): IMAP RENAME. Requires IMAP credentials in Keychain (#73 opt-in flow) — returnserror_type: "imap_required"when missing.
At least one of new_name / new_parent must be provided.
Refused (#164): operations targeting the bare [Gmail] parent or
any [Gmail]/... child path return error_type: "unsupported_gmail_system_label". Applies to both the source
name and the resulting destination (new_parent join). Gmail's
IMAP server doesn't support normal RENAME semantics for these paths;
user-created Gmail labels (Newsletters, etc.) behave normally.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Current mailbox name. Slash-separated for nested mailboxes (e.g. ``"Archive/2024"``). | |
| account | Yes | Mail.app account display name or UUID. | |
| new_name | No | Replacement leaf name. ``None`` to keep the current leaf when moving. Path-traversal characters stripped via ``sanitize_mailbox_name``; an entirely-stripped value returns ``validation_error``. | |
| new_parent | No | Destination parent path. ``None`` keeps current parent (rename-only). ``""`` (empty string) moves to top-level. Non-empty string moves under that path. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate mutation (readOnlyHint=false) and destructiveness (destructiveHint=true). The description adds details: IMAP credentials required for moves, error types like 'imap_required' and 'unsupported_gmail_system_label', and the AppleScript vs IMAP distinction. This enriches the behavioral model beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with bullet points and clear separation of modes. It is slightly long but each sentence adds necessary context. It is front-loaded with the core purpose. Could be slightly more concise, but overall efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the complexity of two operational modes, prerequisites, error conditions, and Gmail-specific restrictions. With an output schema existing (as per context), it does not need to detail return values. All critical aspects are addressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but the description adds significant meaning: explains the two operational modes, the conditions for new_name and new_parent (at least one required), and special cases like empty string for new_parent. This greatly aids parameter understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Rename and/or re-parent (move) an existing mailbox,' using specific verbs and resource. It distinguishes from siblings like create_mailbox and delete_mailbox by focusing on modification operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description outlines two delivery paths (rename-only vs move) with distinct mechanisms (AppleScript, IMAP RENAME) and prerequisites (IMAP credentials). It also notes when Gmail system labels are unsupported, providing context for when not to use. It could explicitly state when to use this over alternatives like create_mailbox, but that is implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update_messageADestructiveIdempotent
Update one or more messages: change read state, flag, and/or move, in one atomic call (#135).
Patch semantics — caller specifies only the fields to change. All
specified mutations apply in a single AppleScript pass via the
bulk-update helper. Replaces the previous mark_as_read,
move_messages, and flag_message tools.
Order of operations (matters for IMAP): read-state and flag changes apply first (in source mailbox), then the move. IMAP requires the message to exist in the source folder for STORE before MOVE.
| Name | Required | Description | Default |
|---|---|---|---|
| account | No | Account name or UUID hosting the destination mailbox. Required when `destination_mailbox` is set; also used with `source_mailbox` for narrow-path optimization. | |
| flagged | No | True to flag (default red if no `flag_color` set), False to clear the flag, None to leave unchanged. | |
| flag_color | No | Color name (orange, red, yellow, blue, green, purple, gray, none). Implies `flagged=True` unless "none". Validated against the existing flag-color schema. | |
| gmail_mode | No | **Deprecated and ignored (#364).** Previously selected a copy+delete strategy that silently routed Gmail moves through Trash and lost the message. The move strategy is now chosen automatically (IMAP relabel when configured; otherwise a verified AppleScript move). A Gmail label move that can't be confirmed returns `error_type: "imap_required"` — configure IMAP with `apple-mail-fast-mcp setup-imap --account <name>`. Slated for removal at v1.0. | |
| message_ids | Yes | List of message IDs to update. | |
| read_status | No | True to mark as read, False to mark as unread, None to leave unchanged. | |
| source_mailbox | No | Source mailbox name. With `account`, narrows the AppleScript scan to one mailbox (O(N) instead of cross-scan). Required for reliable Gmail moves (the move is verified against the source). | |
| destination_mailbox | No | Move messages here (requires `account`). |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate idempotent (true) and destructive (true). The description adds atomic behavior, patch semantics, and real-world IMAP order constraints (read/flag before move). It also explains deprecated gmail_mode. This goes beyond annotations, providing valuable behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, front-loaded with the core purpose, and each sentence adds value. It efficiently covers atomicity, replacement of old tools, and IMAP considerations without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (8 parameters, output schema present), the description covers purpose, usage context, behavioral details, deprecation, and order of operations. The output schema handles return values, making the description complete for effective tool selection and invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with detailed parameter descriptions. The tool description adds overall context (atomic, patch semantics) but does not significantly enhance individual parameter meaning beyond what the schema already provides. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it updates messages by changing read state, flag, and/or move, all in one atomic call. It specifies the resource (messages) and actions, and distinguishes from siblings like delete_messages by focusing on update operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says it replaces previous separate tools (mark_as_read, move_messages, flag_message) and provides order-of-operations guidance for IMAP. It lacks an explicit statement of when not to use it, but provides sufficient context for typical use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update_ruleADestructiveIdempotent
Update an existing Mail.app rule (patch semantics).
Patch semantics: only fields you provide are changed. conditions and
actions, when provided, REPLACE their respective structures wholesale
(not merged).
Conditional confirmation: prompts the user via MCP elicitation when the
patch touches conditions or match_logic (which alter matching
scope), or replaces actions with a set that includes a dangerous
action (move / forward / delete / copy). An actions patch limited to
organizational flags (mark_read / mark_flagged / flag_color)
skips the prompt, as do patches limited to enabled and/or name
(trivially reversible). The enable/disable path replaces the removed
set_rule_enabled tool: call update_rule(rule_index, enabled=True|False).
Refuses to update any rule whose existing actions include something outside the supported schema (run-AppleScript, redirect, reply text, play sound, custom highlight color); raises MailUnsupportedRuleActionError. Edit such rules in Mail.app's UI.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | New name (only set if not None). | |
| actions | No | If provided, REPLACES all action flags wholesale. | |
| enabled | No | New enabled state (only set if not None). | |
| conditions | No | If provided, REPLACES all existing conditions. | |
| rule_index | Yes | 1-based positional index from list_rules. | |
| match_logic | No | 'all' or 'any', only set if not None. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructive and idempotent, but description adds conditional confirmation, refusal behavior, and patch semantics. No contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Long but well-structured; each section adds unique value. Slight redundancy in explaining patch semantics twice, but overall efficient for the complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With output schema present and 6 params, the description covers all behavioral nuances: patching, confirmation, refusal, and deprecation replacement. No gaps identified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but description adds vital context: wholesale replacement of conditions/actions, only-set-if-not-None behavior, and the enable/disable shortcut. This is well beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Update an existing Mail.app rule (patch semantics)' and distinguishes from sibling tools like create_rule and delete_rule with specific verb and resource.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Extensive guidelines: explains patch semantics, when confirmation triggers (conditions/match_logic/dangerous actions), when it skips (flags, name, enabled), and refusal for unsupported actions. Also notes that enable/disable replaces set_rule_enabled.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
25 tool updates
v0.10.2- First observed
create_draft - First observed
create_mailbox - First observed
create_rule - First observed
delete_draft - First observed
delete_mailbox - First observed
delete_messages - First observed
delete_rule - First observed
delete_template - First observed
get_attachment_content - First observed
get_messages - First observed
get_statistics - First observed
get_template - First observed
get_thread - First observed
list_accounts - First observed
list_mailboxes - First observed
list_rules - First observed
list_templates - First observed
render_template - First observed
save_attachments - First observed
save_template - First observed
search_messages - First observed
update_draft - First observed
update_mailbox - First observed
update_message - First observed
update_rule
TDQS
Scored across 25 tools
Every tool targets a distinct action and resource (drafts, mailboxes, rules, messages, templates, accounts, statistics, attachments) with no overlap. Descriptions clarify boundaries, e.g., get_messages vs get_thread vs search_messages.
All tool names follow a consistent verb_noun pattern in snake_case (e.g., create_draft, list_mailboxes, update_rule). There are no deviations or mixed conventions.
25 tools cover the full lifecycle of email management including messages, drafts, mailboxes, rules, templates, and accounts. Each tool serves a unique and necessary purpose, making the count well-scoped for the domain.
The tool surface covers CRUD operations for all core entities (messages, drafts, mailboxes, rules, templates) plus additional utilities like search, statistics, attachment handling, and account listing. No obvious gaps for typical Apple Mail workflows.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Email infrastructure for AI agents — send, receive, search, and reply to email over MCP.
Connect any mailbox to Claude, ChatGPT & AI: read, send, reply, schedule & search emails.
Email inboxes for AI agents: send, receive, reply, search, and manage threaded email over MCP.
MCP server connecting AI agents to 100+ apps (Gmail, Slack, Notion, GitHub) via one-click OAuth.
Related MCP Servers
- AlicenseAqualityAmaintenanceMCP server that gives Claude and other MCP hosts full access to Mail.app on macOS — search, read, send, reply, flag, move, and more across all accounts configured in Mail.app.24981MIT
- AlicenseAqualityAmaintenanceAn MCP server for Apple Mail that enables Claude to read, search, manage, and compose emails via AppleScript.202171MIT
- AlicenseNot gradedqualityCmaintenanceAn MCP server that gives AI assistants comprehensive access to Apple Mail accounts, enabling email discovery, reading, flag management, and server-side message retrieval.MIT
- AlicenseAqualityBmaintenanceA read-only MCP server that lets Claude Desktop interact with Apple Mail on macOS via AppleScript. It enables listing mailboxes, searching emails, and reading email content without making network calls.3MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/wylieswanson/apple-mail-pz-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server