multi-mail
A multi-account Gmail MCP server for searching, reading, drafting, and sending email across several mailboxes.
List connected Gmail accounts and their aliases.
Search one mailbox or all mailboxes using Gmail search syntax, with pagination.
Read full emails and entire threads; HTML bodies are converted to text with configurable length limits.
List labels/folders for use in searches.
Create drafts, including replies, with
to/cc/bcc, optional HTML, and reply-all support.List pending drafts and send existing drafts.
Send new emails or threaded replies immediately.
Use ChatGPT-style
searchandfetchtools to search all mailboxes and fetch a message byaccount:messageId.This schema does not expose the README's attachment, label-modification, or calendar tools.
Provides tools for working with multiple Gmail accounts, including searching mailboxes, reading messages and threads, listing labels, creating drafts, sending emails and threaded replies, and searching across all connected accounts.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@multi-mailsearch all accounts for unread emails from Sarah and draft a reply"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
English · עברית
multi-mail MCP
An MCP server for several Gmail accounts at once. It searches, reads, drafts and sends mail, and works with Claude Desktop, Claude Code and ChatGPT.
It has two transports:
stdio (
dist/server.js) runs locally, for Claude Desktop and Claude Code.Streamable HTTP (
dist/http.js) is for ChatGPT, or any client that connects by URL. A token is required.
Each user brings their own Google OAuth client. Because of that, no Google app verification is needed and nothing passes through a third party. Mail goes only between your machine and Google.
The story behind it, with the comparison and examples: One MCP server for every Gmail account, in Claude and ChatGPT.
Tools
Tool | What it does |
| Lists the connected accounts and their aliases |
| Searches one mailbox, or all of them with |
| Returns a full message: headers, the body as text (HTML is converted), and attachment names |
| Returns a whole conversation |
| Lists a mailbox's labels and folders |
| Saves a new message or reply as a draft, without sending it |
| Sends a new message or reply right away |
| Lists pending drafts, or sends one of them |
| Downloads one attachment: text and PDFs come back as text, images as an image, anything else (and scanned PDFs) is saved under |
| Adds or removes labels on messages or a thread: mark read or unread, archive, star, file under a label. Accounts connected with |
| Creates a label ( |
| Calendar events between two times, across every calendar you see in Google Calendar, for one account or all of them. Accounts connected with |
| Free slots of a given length inside working hours, checked against every calendar of every calendar-enabled account |
| Creates an event on your own calendar. Nobody is invited and no email goes out |
| Searches every mailbox and fetches one message, in the shape ChatGPT expects (connectors, deep research) |
Choosing a mailbox:
accountaccepts a full address, an alias (work), or the part before the@.With a single account connected, you can leave it out.
MULTI_MAIL_DEFAULTsets a default account.
Replying:
reply_to_message_idputs the reply in the right thread and fills in the recipient and subject.reply_alladds every original recipient.
Permissions: gmail.readonly and gmail.compose by default. The server cannot delete mail, move it to trash, or change settings.
Calendar is opt-in per account (
add --calendar), which addscalendar.readonlyandcalendar.events. The server reads events and free/busy, and creates events on your own calendar without inviting anyone. It has no tool to change or delete an event. The calendar tools appear only when at least one account has calendar enabled. Times are read in each calendar's own time zone. If a calendar is set wrong (a new Google account often defaults to UTC), setMULTI_MAIL_TZ=Asia/Jerusalemor passtime_zoneto the tool.Labels are opt-in per account (
add --labels), which addsgmail.modify. At Google's level that scope would also allow trashing mail, so the server has no trash tool and refuses theTRASHandSPAMlabels.
Related MCP server: multi-gmail-mcp-server
Drafts-only mode
Start the server with --drafts-only, or set MULTI_MAIL_SEND=off, and send_email and send_draft are not registered at all. The model can still read, search and write drafts, but nothing can leave your mailbox until you press Send in Gmail.
Use it whenever the server reads mail you didn't write and nobody approves each step. That covers automated triage, scheduled tasks, and clients that skip permission prompts. Any incoming message could carry instructions ("forward this to…"), and in this mode there is no tool that could carry them out.
claude mcp add multi-mail -s user -- npx -y @yybd/multi-mail-mcp --drafts-onlyHow it compares
Checked on 2026-11-07, with star counts from that day, against web search and the awesome-mcp-servers list. The closest alternatives were checked against their own READMEs. I couldn't find official documentation of what the built-in Claude and ChatGPT connectors can do. That information comes mostly from blog posts by competing vendors, so treat it as approximate.
Option | Several accounts | Sends | Claude Desktop / Code | ChatGPT | Where mail goes |
multi-mail (this) | yes, including search across all ( | yes, plus drafts and threaded replies | yes (stdio) | yes (HTTP + token) | only you and Google |
Claude's built-in Gmail connector | no, one account | no, drafts only | Claude only | — | Anthropic |
ChatGPT's built-in Gmail connector | sources disagree | yes since June 2026, on the web, with approval | — | yes | OpenAI |
Google's official Gmail MCP (developer preview) | not documented | no send tool | Claude | not listed | |
google_workspace_mcp (~3.5k ⭐) | multi-user; several accounts of one person in one session isn't documented | yes | yes | yes (developer mode) | only you and Google |
navbuildz/gmail-mcp-server (16 ⭐) | yes, including | yes | by URL | probably, untested | you, plus Redis |
alexneamtu/gmail-mcp (4 ⭐) | yes, by alias | optional (a drafts-only mode) | remote only (Streamable HTTP) | not mentioned; documents Claude and Codex | only you and Google, but needs Node 24, Linux with systemd and an HTTPS hostname |
kojott/mailmcp-dist (1 ⭐) | yes, any IMAP provider including Gmail | yes, allowlisted, plus attachments | yes ( | yes | your server, or their shared one; Gmail by app password over IMAP; commercial licence |
orieg/gws-connector (3 ⭐) | yes, routed by label, email or domain | yes | Claude Code and other local clients | not mentioned | only you and Google; Go, 49 tools across Gmail, Calendar, Drive, Sheets and more |
honest-gmail-mcp (0 ⭐) | one account per server instance; run several instances for several accounts | yes, with attachments | yes (stdio) | no | only you and Google |
dmorrill/gmail-mcp-multi, jwlutz/gmail_connector, 3vening/gmail-mcp and others | yes | yes (some only after you opt in) | yes (stdio) | no, local only | only you and Google |
Composio / Zapier MCP / Pipedream | Composio: yes | yes | yes (URL) | yes (URL) | through the vendor, paid |
Takeaways:
The built-in connectors don't give you several accounts plus sending in every client.
Several self-hosted servers now handle more than one Gmail account. Each makes a different trade-off:
alexneamtu/gmail-mcp is remote-only and needs a Linux server with an HTTPS hostname.
mailmcp reaches Gmail over IMAP with app passwords, under a commercial licence.
gws-connector covers the whole Workspace for local clients, without ChatGPT.
Most of the rest run locally only, so ChatGPT can't connect to them.
Hosted brokers route your mail and tokens through a third party.
multi-mail's niche is one MIT-licensed
npxpackage that runs locally over stdio and, when you want ChatGPT, over token-protected HTTP. It uses the Gmail API with your own OAuth client and keeps a narrow scope:It has no delete permission.
Tokens stay on your machine with
600permissions.The HTTP server won't start without a token.
multi-mail covers mail and Google Calendar. For the rest of Workspace, such as Drive or Docs, google_workspace_mcp is the mature choice, or gws-connector across several accounts.
Setup
You need Node.js 20 or newer. There's nothing to install: every command below runs the published package through npx.
git clone https://github.com/yybd/multi-mail-mcp.git multi-mail && cd multi-mail && npm install && npm run buildThen use node dist/main.js wherever this guide says npx -y @yybd/multi-mail-mcp. Inside the source folder, npx -y @yybd/multi-mail-mcp fails with command not found: npx sees that the folder is the package itself and doesn't download it. Run npx from any other folder, or use npm run cli -- list there.
1. Create your own Google OAuth client (once)
Do this once, from one Google account. The same client then works for every mailbox you connect. If you already have a Google Cloud project for personal tools, you can add the client there instead of creating a new project.
Project. Go to console.cloud.google.com/projectcreate, name the project (for example
multi-mail) and click Create. Make sure it's selected in the top bar.Gmail API. On the Gmail API page, click Enable. If you'll use the calendar, also enable the Google Calendar API.
Consent screen. In Google Auth Platform, click Get started and fill in:
App name: anything you like.
Support email: yours.
Audience: External.
Contact email: yours.
Accept the terms and click Create. You don't need to add scopes here; the server asks for them itself.
Publish. Under Audience, click Publish app, then Confirm. The status should read In production.
⚠️ In Testing mode, access expires every 7 days.
For personal use, Google doesn't need to verify the app.
If you stay in Testing anyway, add every Gmail address under Test users.
Client. Under Clients, click Create client, choose the type Desktop app, and click Create. Then click Download JSON right away, because the secret is shown in full only in that dialog. Save the file like this:
mkdir -p ~/.multi-mail && mv ~/Downloads/client_secret_*.json ~/.multi-mail/credentials.json && chmod 600 ~/.multi-mail/credentials.json2. Connect your mailboxes
Run this once per mailbox, with a different alias each time:
npx -y @yybd/multi-mail-mcp add --alias worknpx -y @yybd/multi-mail-mcp add --alias homeEach add opens a browser where you pick a Google account and approve access.
You'll see "Google hasn't verified this app". That's expected, because it's your own app. Click Advanced, then Go to … (unsafe).
Tick every permission box. If one is missing, the CLI stops and tells you which.
Managing accounts:
npx -y @yybd/multi-mail-mcp listlists the connected accounts.checkverifies every account still has access.alias <account> <name>sets or changes an alias. The account can be its current alias, its address, or the part before@. For example,npx -y @yybd/multi-mail-mcp alias tech workrenamestechtowork, and it takes effect immediately, without a restart.remove <account>disconnects an account.add <account> --calendarreconnects an account with Google Calendar. This needs the Google Calendar API enabled in the same Cloud project as the Gmail API (step 2 of the OAuth setup). The flags combine, for exampleadd work --labels --calendar.add <account> --labelsreconnects an account with label permission (needed formodify_labelsandcreate_label). Runningaddagain without--labelstakes it away.
Tokens live in ~/.multi-mail/accounts/ with 600 permissions; MULTI_MAIL_HOME moves that folder. A running server picks up a newly added account without a restart.
Connect your clients
Claude Code
claude mcp add multi-mail -s user -- npx -y @yybd/multi-mail-mcpClaude Desktop
In ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"multi-mail": {
"command": "npx",
"args": ["-y", "@yybd/multi-mail-mcp"]
}
}
}Then restart Claude Desktop. If it can't find npx, use its full path (which npx, for example /opt/homebrew/bin/npx).
ChatGPT
ChatGPT only connects to remote HTTPS servers, so you run the HTTP mode and expose it through a tunnel. Run these one after another:
npx -y @yybd/multi-mail-mcp tokenMCP_AUTH_TOKEN=<token> npx -y @yybd/multi-mail-mcp httpcloudflared tunnel --url http://127.0.0.1:3333ngrok http 3333 also works instead of cloudflared.
In ChatGPT, open Settings → Apps & Connectors → Advanced, turn on Developer mode, then click Create and fill in:
URL:
https://<your-tunnel-host>/mcp?api_key=<token>Authentication: No authentication (the token is already in the URL).
Security of HTTP mode:
The server listens on
127.0.0.1only.It refuses to start without an
MCP_AUTH_TOKENof at least 24 characters.Clients that can send headers may use
Authorization: Bearer <token>instead ofapi_key.⚠️ Anyone with the full URL can read and send from your mailboxes. Treat it like a password, and rotate the token (
token) if it leaks.
HTTP environment variables: PORT (default 3333), HOST (default 127.0.0.1), MCP_AUTH_TOKEN.
Development
npm testThe tests run offline, with no Google account. They cover Hebrew/UTF-8 MIME encoding, account selection, the tool list over stdio and HTTP, and token enforcement.
Layout:
src/config.ts— accounts and filessrc/gmail.ts— Gmail callssrc/mime.ts— building and parsing messagessrc/mcp.ts— the toolssrc/server.ts/src/http.ts— transportssrc/cli.ts— account management
Not supported yet: attaching files to outgoing mail.
License
MIT — see LICENSE.
Available Tools
14 toolscreate_draftCreate a draftA
Save a message (new or reply) in Gmail Drafts without sending it. The safe default for writing.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | Cc recipients, same format as "to". | |
| to | No | Recipients: "a@x.com, Name <b@y.com>" or a list. Optional when replying. | |
| bcc | No | Bcc recipients, same format as "to". They are not shown to the other recipients. | |
| body | Yes | Plain-text body. | |
| html | No | Optional HTML version of the body. | |
| account | No | Mailbox to write from (email, alias or local part). | |
| subject | No | Optional when replying ("Re: …" is added). | |
| reply_all | No | With reply_to_message_id and no "to": copy all original recipients. | |
| reply_to_message_id | No | Reply in the thread of this message id. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare a non-destructive write (readOnlyHint=false, destructiveHint=false), and the description usefully reinforces that nothing is transmitted to recipients. It says nothing about what the call returns (a draft id?), whether repeated calls duplicate drafts, or how the saved draft is later sent via send_draft — a notable gap given there is no output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, with the action and its key constraint front-loaded and the routing hint second. No filler or restatement of the title.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a nine-parameter compose tool with no output schema and no annotation coverage of results, the description leaves the agent unsure what comes back and how to follow up. The sending-suppression fact is covered, but the draft lifecycle is not.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and all nine parameters carry inline descriptions, including conditional optionality (to/subject optional when replying, reply_all semantics). The description adds no parameter-level detail beyond that, so the schema does all the work and baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a concrete verb and resource ("Save a message ... in Gmail Drafts") and immediately negates the confusable action ("without sending it"), which separates it from send_email and send_draft. It stops short of naming those siblings explicitly, so differentiation relies on inference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
"The safe default for writing" gives the agent a clear selection rule for the compose-without-transmitting case, and "new or reply" covers both entry points. It offers no explicit exclusion or pointer to send_email/send_draft for the opposite case, so it is clear context rather than full when/when-not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_labelCreate a labelA
Create a new user label in one mailbox and return its id and name, ready for modify_labels. Use it when the user wants mail filed under a label that list_labels does not show yet. A "/" makes a nested label, e.g. "Projects/Acme". Fails if a label with that name already exists. Only for accounts connected with --labels.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | The new label's name; "/" nests it under a parent. | |
| account | No | Which mailbox: email address, alias, or local part. Optional when only one account is connected. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare write/non-destructive/non-open-world; the description adds the missing context an agent needs: the return payload (id and name) feeding modify_labels, the duplicate-name failure mode, and the account-level connection requirement. It also documents the '/' nesting behavior as a mutation semantic.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the action and return value, then trigger, then edge cases, then prerequisite — every sentence carries information. Minor redundancy in restating the '/' nesting rule that the schema already explains.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, yet the description names the returned fields (id, name) and their purpose, so an agent knows what it gets back. For a 2-parameter write tool with annotations, nothing material is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both parameters are already documented, and the description's nesting note largely restates the schema's own "'/" nests it under a parent" text. It adds the concrete example "Projects/Acme" but no new constraints such as name length or character rules, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("Create a new user label") plus scope ("in one mailbox") and outcome ("return its id and name"). It is clearly separable from list_labels (read) and modify_labels (apply to messages) named in the same sentence.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit trigger: "when the user wants mail filed under a label that list_labels does not show yet," which both names the sibling to check first and the condition that selects this tool. It also gives a hard prerequisite ("Only for accounts connected with --labels") and a pre-condition failure (name already exists), leaving little to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetchFetch a messageBRead-only
Full text of a message returned by the search tool (id is "account:messageId").
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | A result id from the search tool, in the form "account:messageId". |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds the constraint that ids originate from search (implying failure on foreign ids), but it says nothing about whether attachments or headers are included, error behavior, or payload size limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One front-loaded sentence that leads with the return value and then supplies the id form. Slightly redundant with the schema's own parameter description, but there is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter read tool with full schema coverage and safety annotations, most of what an agent needs is present. With no output schema, however, the description is the only source describing the return value, and "full text" leaves open whether headers, metadata, or attachments are included.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the single parameter's schema description is essentially identical to the note in the tool description. The description restates rather than extends the meaning, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the specific resource and result ("full text of a message returned by the search tool") and pins down the id format, so an agent knows this is a message-body retrieval by search result id. It does not distinguish itself from near-identical siblings such as read_email or read_thread, which is the main clarity gap.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied through the precondition that the id must come from the search tool, which does usefully tell the agent it cannot pass arbitrary message ids. There is no explicit statement of when to pick this over read_email or search_emails, and no exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_attachmentGet an attachmentARead-only
Download one attachment of a message and return its contents. Text files and PDFs with a text layer come back as text, PNG/JPEG/GIF/WebP images (up to 5 MB) as an image you can see; any other file, and a scanned PDF, is saved under ~/.multi-mail/attachments and its path is returned with a note. Use it after read_email when the user needs what an attached invoice, report or photo says. Pick the file by part_id from read_email's attachment list, or by filename; a message with a single attachment needs neither. Returns an error listing the attachments if none matches. Does not change the mailbox.
| Name | Required | Description | Default |
|---|---|---|---|
| save | No | Also save the file under ~/.multi-mail/attachments. | |
| account | No | Which mailbox: email address, alias, or local part. Optional when only one account is connected. | |
| part_id | No | partId from the attachments list of read_email. | |
| filename | No | Attachment file name, when part_id is not known. | |
| max_chars | No | Longest text to return for text and PDF files (default 50,000); longer text is cut and marked. | |
| message_id | Yes | Message id from search_emails or read_email. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so 'Does not change the mailbox' is largely redundant. However the description adds substantial behavior the annotations cannot convey: the content-type routing (text/PDF-with-text-layer to text, images up to 5 MB returned visually, everything else and scanned PDFs written to ~/.multi-mail/attachments with a path), plus the not-found error listing available attachments. It does not mention truncation behavior for max_chars or the save flag semantics, keeping it short of complete.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with what it does and returns, then selection rules, then the safety note. Every sentence carries distinct information; nothing repeats the schema verbatim.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, and the description compensates fully by mapping each return form (text, visible image, saved file path with note, error listing attachments). For a 6-parameter read tool with full annotation coverage, nothing an agent needs is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description earns the extra point by explaining selector precedence — part_id preferred, filename as fallback, neither required for single-attachment messages — which is genuine cross-parameter logic the schema does not state.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb+resource ('Download one attachment of a message and return its contents') and immediately scopes it to a single attachment of a specific message, distinguishing it from read_email which only lists attachments. An agent knows exactly what this returns.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit sequencing guidance: 'Use it after read_email when the user needs what an attached invoice, report or photo says.' It also tells the agent how to select the target (part_id from read_email's list, or filename) and that a single-attachment message needs neither selector — a genuine decision rule, not a hint.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_accountsList mail accountsARead-only
List the Gmail accounts this server can use. Call it first when the user has not said which mailbox, or to learn the aliases to pass as "account" to every other tool. Returns each account's email, alias, and whether labels and calendar are enabled for it, the default account if one is set, and whether sending is enabled or the server is in drafts-only mode. Takes no input and changes nothing.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so 'changes nothing' largely restates the safety profile. The real added value is the enumeration of return contents: email, alias, labels/calendar enablement, default account, and drafts-only versus sending mode, which tells the agent what signals it can act on afterwards.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each doing distinct work: purpose, when-to-call, and what comes back. The scoping information is front-loaded and there is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description carries the full burden of describing return values, and it does so field by field, including the operationally important drafts-only mode flag and default-account marker.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, so the baseline is 4; the description correctly confirms 'takes no input', removing any doubt about whether an account filter is required. Nothing further is possible for an empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource ('List the Gmail accounts this server can use'), which is unmistakably distinct from siblings like list_labels or list_drafts that also list things.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives an explicit call condition ('first when the user has not said which mailbox') and states the downstream purpose: obtaining the alias values to pass as 'account' to every other tool. That is a clear when-to-use plus a named relationship to all siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_draftsList draftsARead-only
List the drafts saved in one mailbox: for each, the draftId (needed by send_draft), the message id, thread id, date, recipients, subject and a short snippet. Use it to check what is waiting to be sent, or to find a draft made earlier with create_draft. To read a draft's full text, pass its message id to read_email. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
| account | No | Which mailbox: email address, alias, or local part. Optional when only one account is connected. | |
| max_results | No | How many drafts to return (1–100). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotation readOnlyHint=true already declares the safety profile, and the trailing "Read-only." merely restates it. What the description genuinely adds beyond structured data is the returned field set (draftId, message id, thread id, date, recipients, subject, snippet) and the linkage that draftId is required by send_draft — but with no output schema, this still leaves the exact response shape to inference.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the action and result contents, then usage, then the handoff to read_email. Nothing is padded; the only near-redundancy is the two-word "Read-only." closing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description compensates well by enumerating the fields returned and flagging the one field (draftId) that unlocks a sibling tool. For a two-optional-parameter read tool, an agent has everything needed to select and call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and both parameters are fully documented in the schema, so the baseline applies. The phrase "in one mailbox" hints at the account parameter's role but adds no detail on alias/local-part handling or result-limit behavior beyond what the schema already says.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("List the drafts saved in one mailbox") and immediately differentiates scope: listing only, not reading full text. An agent can distinguish it from send_draft, create_draft, and read_email without consulting any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives two concrete use cases ("check what is waiting to be sent" and "find a draft made earlier with create_draft") and an explicit alternative with its trigger condition ("To read a draft's full text, pass its message id to read_email"). The routing decision is fully determined.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_labelsList labelsARead-only
List every label of one mailbox: system labels such as INBOX, UNREAD, STARRED, SENT, and the user's own labels (Gmail's folders), each with its id, name and type, sorted by name. Use it to find the exact name for a "label:" search in search_emails, or the name or id to pass to modify_labels. Works on every account, with or without --labels. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
| account | No | Which mailbox: email address, alias, or local part. Optional when only one account is connected. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so the bar is lower, yet the description adds real content: which label categories are returned, the fields per label, and the sort order. It does not discuss volume, pagination, or what happens on an unknown/unconnected account, and restates "Read-only" redundantly.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences: identity of the tool first, then the two routing use cases, then an availability note. The trailing "Read-only" earns little since annotation readOnlyHint already says it, but overall there is no wasted bulk.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-optional-param, read-only list tool with no output schema, the description covers content, fields, ordering, and downstream usage, which is everything an agent needs to call it and consume the result correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the single optional account parameter is fully documented there, so the description adds no meaning about it beyond referencing "one mailbox" implicitly. Baseline 3 is appropriate when the schema carries the parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("List every label of one mailbox") and scopes it precisely: system labels plus user labels, each with id, name and type, sorted by name. It is clearly distinguishable from siblings create_label and modify_labels, which mutate the same resource.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives two concrete when-to-use paths: finding the exact name for a "label:" search in search_emails, or the name/id to pass to modify_labels. It also preempts an availability question with "Works on every account, with or without --labels."
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
modify_labelsChange labelsAIdempotent
Add or remove labels on specific messages, or on every message of a thread. This is how to mark read (remove UNREAD), mark unread (add UNREAD), archive (remove INBOX), star (add STARRED), or file mail under a label. Labels are names in any case, or ids from list_labels; unknown names return an error, and create_label makes new ones. Returns the account and the label ids that were added and removed. Only for accounts connected with --labels (otherwise the error says how to enable it). TRASH and SPAM are refused, so nothing can be deleted or marked as spam.
| Name | Required | Description | Default |
|---|---|---|---|
| add | No | Labels to add. | |
| remove | No | Labels to remove. | |
| account | No | Which mailbox: email address, alias, or local part. Optional when only one account is connected. | |
| thread_id | No | Change every message in this thread instead. | |
| message_ids | No | Message ids to change. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations (readOnlyHint=false, idempotentHint=true, destructiveHint=false) by disclosing error behavior for unknown label names, the exact return payload (account plus added/removed label ids), and an explicit safety boundary: TRASH and SPAM are refused, so deletion and spam-marking are impossible. The connection prerequisite is also surfaced. Nothing here contradicts the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the purpose, then use cases, then error/return behavior, with no filler. A couple of sentences are densely packed with semicolon-joined clauses, which slightly hurts scannability but every clause carries information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Although there is no output schema, the description names the return values, the failure modes, and the account prerequisite. For a 5-parameter mutation tool with all-optional params, an agent has everything needed to call it correctly and to know what it cannot do.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds real meaning the schema lacks: labels may be names in any case or ids from list_labels, and unknown names produce an error. It also implicitly explains the message_ids vs. thread_id choice. It does not cover edge cases such as passing both targeting parameters or empty add/remove.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb pair and resource ('Add or remove labels') plus the two targeting modes (specific messages vs. every message of a thread). It is clearly distinguishable from siblings create_label and list_labels, which are named as complements rather than alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives concrete when-to-use recipes mapped to intent: mark read = remove UNREAD, mark unread = add UNREAD, archive = remove INBOX, star = add STARRED, file mail = add a label. It also routes the agent to list_labels for ids and create_label for new labels, and states the prerequisite (account connected with --labels) with a fallback error hint.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_emailRead a messageARead-only
Read one message in full: from, to, cc, reply-to, date, subject, labels, the body as plain text (HTML is converted to text), and the list of attachments with part_id, name, type and size. Use it after search_emails when you need what a single message says; use read_thread instead for the whole conversation. The body is cut at max_chars and marked "[truncated]" with truncated=true; attachment contents are not included (fetch one with get_attachment). An unknown message_id returns an error saying the message was not found. Read-only; does not mark the message as read.
| Name | Required | Description | Default |
|---|---|---|---|
| account | No | Which mailbox: email address, alias, or local part. Optional when only one account is connected. | |
| max_chars | No | Longest body to return, in characters (default 20,000). Raise it for long newsletters or legal text. | |
| message_id | Yes | The message id ("id") returned by search_emails or list_drafts. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare readOnlyHint=true and openWorldHint=false, but the description goes well beyond them: HTML-to-text conversion, body truncation with the exact marker and truncated flag, attachment contents excluded, unknown message_id producing a 'not found' error, and the fact that reading does not mark the message as read. Those are the non-obvious behaviors an agent would otherwise have to discover by trial.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is front-loaded with what is returned, then routing, then edge cases (truncation, missing attachments, bad id, side effects) — a logical order with no filler sentences. Every clause carries operational information; the long opening list is a payload description, not verbosity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description correctly compensates by enumerating the returned fields and flagging the truncation indicator. For a 3-parameter read tool it fully covers routing, limits, failure mode, and side-effect profile — nothing an agent needs to call it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description nonetheless adds behavioral meaning to max_chars by explaining that the body is cut at that limit, marked '[truncated]', and flagged with truncated=true, which tells the agent how to react to the value rather than just what it is. message_id semantics (unknown id returns a 'not found' error) are also surfaced, though account is left entirely to the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The first sentence gives a specific verb and resource ('Read one message in full') and enumerates exactly what is returned: from, to, cc, reply-to, date, subject, labels, body as plain text, and attachments with part_id/name/type/size. It explicitly distinguishes itself from read_thread (whole conversation) and get_attachment (attachment contents), so an agent can route without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It states the trigger clearly ('after search_emails when you need what a single message says') and names the two alternatives with the conditions that select them: read_thread for a whole conversation, get_attachment for attachment contents. Both a when-to-use and a when-to-use-something-else are present.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_threadRead a conversationARead-only
Read a whole conversation: every message in the thread, oldest first, each with the same fields as read_email (headers, plain-text body, attachment list). Use it when the reply history matters, such as before answering or summarising a back-and-forth; use read_email for a single message. max_chars is shared across the thread: each message gets an equal part of it (at least 2,000 characters), and longer bodies are cut and marked "[truncated]". An unknown thread_id returns an error. Read-only.
| Name | Required | Description | Default |
|---|---|---|---|
| account | No | Which mailbox: email address, alias, or local part. Optional when only one account is connected. | |
| max_chars | No | Total characters for all bodies together (default 40,000), split evenly between the messages. | |
| thread_id | Yes | The "threadId" returned by search_emails or read_email. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and openWorldHint=false, so the safety profile is covered and 'Read-only' is redundant. The description still adds real behavior beyond the annotations: oldest-first ordering, the shared max_chars budget split evenly with a 2,000-character floor per message, '[truncated]' marking for cut bodies, and an error on unknown thread_id. The only gap is the shape of that error response, which is minor.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with what is read and in what order, then selection guidance, then the truncation rule and error behavior. No filler sentences, and each clause contributes a distinct fact an agent needs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a three-parameter read tool with no output schema, it covers ordering, field parity with read_email, truncation semantics, and failure on a bad thread_id. Nothing an agent needs in order to call it correctly or interpret the result is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description goes further by clarifying that max_chars applies across the whole thread rather than per message and that each message gets an equal share with a 2,000-character minimum. That resolves the main ambiguity an agent could hit when setting the value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource — 'Read a whole conversation: every message in the thread, oldest first' — and pins the return shape by reference ('same fields as read_email'). It explicitly separates itself from the closest sibling, read_email, so an agent can choose without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives both a positive condition ('when the reply history matters, such as before answering or summarising a back-and-forth') and an explicit alternative ('use read_email for a single message'). The routing decision is fully specified rather than implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
searchSearch all mailboxesARead-only
Search every connected Gmail account (Gmail query syntax). Returns result ids for the fetch tool.
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | Gmail search query. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds two behaviors annotations do not: the search spans all connected accounts, and the return is ids rather than message content, implying a required follow-up call. It omits result caps, pagination, and how cross-account hits are ordered.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, zero padding, with the scope stated before the return-value note. Nothing could be removed without losing information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter read tool with no output schema, the description covers scope, query dialect, and that the return is ids for fetch. Remaining gaps are pagination and result limits, which matter for a tool that fans out across every connected account.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 100% schema coverage and a single documented parameter, the baseline is 3. The description restates that the query is Gmail syntax, which the schema already says ('Gmail search query'), so it adds little beyond confirming the query language.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource and adds meaningful scope: 'every connected Gmail account' with Gmail query syntax. It stops short of distinguishing itself from the sibling search_emails, so the cross-account vs. single-account contrast is only implied rather than stated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The sentence 'Returns result ids for the fetch tool' gives a useful chaining instruction, which is real usage guidance. However, it never states when to prefer this over the sibling search_emails, nor any exclusion or preconditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_emailsSearch mailARead-only
Search one mailbox, or all of them with account="all", using Gmail search syntax. Returns id, thread id, date, from, to, subject and snippet — use read_email for the full body. An empty query lists the newest mail.
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | Gmail query, e.g. "from:bank is:unread newer_than:30d". | |
| account | No | Email, alias, or "all" to search every connected mailbox. | |
| page_token | No | nextPageToken from a previous call (single account only). | |
| max_results | No | How many messages to return (1–100). With account="all", the newest across all mailboxes. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so safety is covered. The description adds real behavioral context beyond that: it enumerates the returned fields (id, thread id, date, from, to, subject, snippet) and defines the empty-query fallback, which shapes what the agent should expect back. It does not mention pagination or result limits, though max_results and page_token are documented in the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, each doing distinct work: scope and syntax, then return fields and the read_email handoff, then the empty-query default. Front-loaded with the search scope, and nothing is padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description correctly spells out the returned fields and routing to read_email for bodies. For a read-only search tool whose annotations carry the safety profile, this is close to complete; only pagination and the 100-result cap are left to the schema, which is a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the parameter docs already carry the syntax detail, making 3 the baseline. The description nonetheless adds meaning the schema lacks: it explains the empty-query default behavior and reinforces account="all" as an aggregation mode, which affects how the agent interprets the results.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource ('Search one mailbox, or all of them... using Gmail search syntax') and names its scope precisely. It goes further than the sibling names alone: it hands off 'full body' retrieval to read_email, so an agent can tell search_emails apart from read_email and read_thread without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives clear operating context: the account="all" mode for cross-mailbox search, the read_email alternative for full bodies, and the default that an empty query returns the newest mail. It does not address when to prefer this over the generic 'search' sibling, which is the one routing question an agent still has to infer.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
send_draftSend a draftA
Send an existing draft. Only when the user explicitly asked to send it.
| Name | Required | Description | Default |
|---|---|---|---|
| account | No | Which mailbox: email address, alias, or local part. Optional when only one account is connected. | |
| draft_id | Yes | draftId from create_draft or list_drafts. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare this is a non-read-only, open-world, non-destructive operation, so the safety baseline is covered. The description adds a meaningful consent guardrail beyond that. It omits what happens to the draft after sending (is it consumed/moved?) and what the call returns, which matters for a mutation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, zero waste. The action statement comes first and the consent constraint immediately after, which is the right order for a mutation with a guardrail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter send action, the description covers the core action and the consent rule but leaves the post-send state and return value unaddressed, and there is no output schema to cover that gap. It is adequate but not complete for a destructive-adjacent side-effecting call.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, with draft_id's provenance (create_draft or list_drafts) and the optional account fallback fully documented in the schema. The description adds no parameter meaning of its own, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
"Send an existing draft" gives a specific verb and resource that is unambiguous. It does not, however, distinguish itself from the sibling send_email, which an agent could easily confuse with this tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The second sentence is an explicit gating condition: only send when the user explicitly asked. That is real when-to-use guidance. It stops short of naming the alternative (send_email for a new message) or stating what to do when consent is ambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
send_emailSend an emailA
Send a message (new or reply) immediately. Only when the user explicitly asked to send; confirm recipients, subject and body with them first.
| Name | Required | Description | Default |
|---|---|---|---|
| cc | No | Cc recipients, same format as "to". | |
| to | No | Recipients: "a@x.com, Name <b@y.com>" or a list. Optional when replying. | |
| bcc | No | Bcc recipients, same format as "to". They are not shown to the other recipients. | |
| body | Yes | Plain-text body. | |
| html | No | Optional HTML version of the body. | |
| account | No | Mailbox to write from (email, alias or local part). | |
| subject | No | Optional when replying ("Re: …" is added). | |
| reply_all | No | With reply_to_message_id and no "to": copy all original recipients. | |
| reply_to_message_id | No | Reply in the thread of this message id. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare the safety profile (readOnly=false, destructive=false, openWorld=true), and the description adds the trait that matters most: dispatch happens immediately with no undo step, so consent must be secured first. It does not mention rate limits, send quotas, or what happens on delivery failure, which keeps it short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no filler. The capability statement comes first and the safety constraint second, so the agent reads the routing rule before the guardrail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a nine-parameter outbound-mutation tool the schema carries all field detail, and the description covers the two things the schema cannot: when to send and the requirement to confirm first. The only real gap is the absence of a stated fallback to create_draft when the user has not yet confirmed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and every parameter, including reply_all and reply_to_message_id semantics, is already documented there. The description only echoes the recipient/subject/body trio during the confirmation instruction, adding no new meaning beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("Send a message") and covers both modes (new or reply), so an agent knows exactly what the tool produces. The word "immediately" implicitly separates it from the draft-creating siblings, but no sibling is named, so differentiation is left to inference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit gating condition — only after the user explicitly asked to send — plus a confirmation prerequisite covering recipients, subject and body. It does not name the alternative path (create_draft / send_draft) for the case where the user has not confirmed, which would have made routing unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
10 tool updates
v0.2.1- Changed
create_draft2 fields changed- added
Input schema / properties / bcc / descriptionAdded value: +"Bcc recipients, same format as \"to\". They are not shown to the other recipients." - added
Input schema / properties / cc / descriptionAdded value: +"Cc recipients, same format as \"to\"."
- Added
create_label - Changed
fetch1 field changed- added
Input schema / properties / id / descriptionAdded value: +"A result id from the search tool, in the form \"account:messageId\"."
- Added
get_attachment - Changed
list_drafts1 field changed- added
Input schema / properties / max_results / descriptionAdded value: +"How many drafts to return (1–100)."
- Added
modify_labels - Changed
read_email2 fields changed- added
Input schema / properties / max_chars / descriptionAdded value: +"Longest body to return, in characters (default 20,000). Raise it for long newsletters or legal text." - changed
Input schema / properties / message_id / descriptionPrevious value: -"Message id from search_emails."New value: +"The message id (\"id\") returned by search_emails or list_drafts."
- Changed
read_thread2 fields changed- changed
Input schema / properties / max_chars / descriptionPrevious value: -"Total budget across the thread."New value: +"Total characters for all bodies together (default 40,000), split evenly between the messages." - changed
Input schema / properties / thread_id / descriptionPrevious value: -"threadId from search_emails or read_email."New value: +"The \"threadId\" returned by search_emails or read_email."
- Changed
search_emails1 field changed- added
Input schema / properties / max_results / descriptionAdded value: +"How many messages to return (1–100). With account=\"all\", the newest across all mailboxes."
- Changed
send_email2 fields changed- added
Input schema / properties / bcc / descriptionAdded value: +"Bcc recipients, same format as \"to\". They are not shown to the other recipients." - added
Input schema / properties / cc / descriptionAdded value: +"Cc recipients, same format as \"to\"."
11 tool updates
v0.1.1- First observed
create_draft - First observed
fetch - First observed
list_accounts - First observed
list_drafts - First observed
list_labels - First observed
read_email - First observed
read_thread - First observed
search - First observed
search_emails - First observed
send_draft - First observed
send_email
TDQS
Scored across 14 tools
The set contains two overlapping pairs: search_emails vs. search, and read_email vs. fetch. Both search tools can search all accounts, and fetch returns message text that read_email already provides with richer metadata, so an agent has unclear boundaries and may misselect.
Almost all tools follow a clear snake_case verb_noun pattern such as list_accounts, read_email, create_draft, and modify_labels. The bare names search and fetch deviate from this pattern and are also the least descriptive, but the overall convention remains predictable.
Fourteen tools are reasonable for a multi-account mail server covering reading, searching, labels, drafts, attachments, and sending. The count is slightly inflated by the redundant search/fetch pair, but most tools earn their place.
Core mail workflows are well covered: account listing, search, reading messages and threads, attachments, labels, drafts, and sending. Minor gaps include draft editing and any explicit reply/forward wrapper, though those can be approximated through create_draft and send_email.
Maintenance
Related MCP Connectors
Connect any mailbox to Claude, ChatGPT & AI: read, send, reply, schedule & search emails.
Connect any IMAP/SMTP mailbox to Claude & ChatGPT: search, read, sort, draft. Sends only with OK.
Manage Gmail end-to-end: search, read, send, draft, label, and organize threads. Automate workflow…
Your mailboxes in ChatGPT and Claude: Gmail, iCloud, Fastmail, any IMAP. Passwords stay yours.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceEnables reading, sending, searching, and managing Gmail through Claude using the official Google Gmail API.123 npm3MIT
- AlicenseNot gradedqualityDmaintenanceEnables searching and summarizing emails across multiple Gmail accounts simultaneously through Claude.1MIT
- AlicenseNot gradedqualityDmaintenanceEnables Claude to read, search, send, and manage Gmail messages and threads through natural language.318 npmMIT
- AlicenseAqualityDmaintenanceConnects multiple Gmail accounts to Claude Desktop via MCP, enabling email search, labeling, drafts, and confirmed sending through natural language.13147 npmMIT