Mailbox MCP

Send an email

send_email

Destructive

Send a new email from the connected mailbox, with files attached if you pass them. This delivers real mail to real people and cannot be undone. IT GOES OUT AS BOTH PLAIN TEXT AND HTML even when you supply only text: the HTML part is built from those same words and carries the mailbox owner's own signature where they have set one, which is what their mail client would have sent. So do not write a sign-off or paste a signature in yourself, or the message arrives signed twice. plainTextOnly sends the plain part alone. EXACTLY ONE COPY IS FILED in the real Sent folder, and the reply says whether that filing worked - a send can succeed while the filing fails, and the Sent copy is what the owner looks for afterwards, so pass that on rather than reporting a clean send. The reply also names any recipient the mail server REJECTED while accepting the others: that is a partial success, not a failure, and the person has to be told which addresses did not take. Sending as another address needs one list_identities reports; anything else is refused rather than quietly sent from the default. Attachments are capped at 10 MB across the whole message.

Input Schema

TableJSON Schema

Name	Required	Description
`cc`	No
`to`	Yes	Recipient email addresses.
`from`	No	Send as one of the other addresses on this mailbox instead of its default. Use it only when the user names an address to send from. It must be one already added to the mailbox; anything else is refused with the list of addresses that would have worked. The mail server still decides whether it will carry the address, and may refuse it at send time.
`html`	No	Optional HTML body. Send real markup, used exactly as given and never escaped or unescaped by us: `<p>Hi</p>`, never `<p>Hi</p>`. Escaped markup is delivered as visible tags and nothing will warn you. Leave it out unless you have real markup to send: the message still goes out as HTML, built from `text`, carrying the mailbox owner's HTML signature.
`text`	Yes	Plain text body.
`subject`	Yes
`attachments`	No	Files to attach. FOUR WAYS IN, AND ONLY ONE OF THEM COSTS YOU ANYTHING. For a file already in this mailbox, call read_email on the message holding it and pass the `ref` from its `attachments` list as `fileRef`. For a file on the web, pass its https:// link as `url` and this server fetches it. For a file on the person's own computer, make a link with create_upload_link and pass its `uploadId` once the file is up - one entry attaches everything that arrived there. Those three work at any size, because the bytes never pass through this conversation. `content` is the last resort and is only for something you generated yourself in this conversation that exists nowhere else: it costs roughly 450,000 tokens per megabyte, so keep it under about 50 KB. All attachments TOGETHER must come to under 10 MB - a whole-message limit, not an allowance per file, so three 4 MB files are refused however they arrived.
`plainTextOnly`	No	Send with no HTML part at all. Leave this out unless the user has asked for plain text or the recipient is a list that rejects HTML - it drops the mailbox owner's HTML signature and their formatting. Do not set it to be cautious; HTML is the normal format and what their own mail client sends.
`requestReadReceipt`	No	Ask the recipient's mail program to confirm when the message is opened, exactly as Outlook's "request a read receipt" tick box does. Only set it when the user asks for it. TELL THEM WHAT IT REALLY DOES before promising anything: it is a request their mail program may ignore and that many clients ask them to approve, so most messages never produce one however promptly they are read - consumer Gmail never sends one, Workspace only if an administrator enabled it, Apple Mail only behind a setting that ships off. Use check_receipts afterwards to see whether one came back, and never treat silence there as evidence the message was unread. There is no delivery-receipt option: that needs an SMTP feature none of the mail providers this connects to offer.

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

First observedSep 5, 2026

TDQS

A4.6/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes far beyond the destructiveHint annotation by exposing non-obvious behaviors: dual plain-text/HTML construction, signature duplication risk, sent-folder filing failure that can accompany a successful send, partial recipient rejection, identity requirements, and the 10 MB whole-message cap. These are critical for correct agent behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded and dense with material warnings, but it is a long all-caps-heavy block that could be restructured for quicker scanning. Every sentence carries risk-relevant meaning, so the length is mostly justified.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a high-stakes irreversible send with no output schema, the description explains the important return behaviors — sent-folder filing result, rejected recipients, partial success — along with identity, attachment, and formatting caveats. Combined with the rich input schema, an agent has everything needed to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already describes most parameters in detail, so the baseline is solid. The description adds useful cross-parameter behavior such as plainTextOnly's role, the list_identities prerequisite for the from field, and the whole-message attachment total, while leaving self-evident parameters like subject and cc to their names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a concrete action — send a new email from the connected mailbox — and clearly identifies the resource and scope. The phrase 'delivers real mail to real people and cannot be undone' distinguishes it from draft-style siblings and makes the side-effectful nature unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Clearly positions the tool as the final, irreversible send action, warning against manual signatures and describing partial-failure reporting. It gives rich when-to-use guidance inside parameters, though it does not explicitly name alternatives such as draft_email for non-final composition.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Mailbox MCP tools Inspect

Try in Browser

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.3/5.0

Disambiguation4/5

Most tools target clearly distinct actions and resource types, and the near-overlapping pairs (archive_email vs move_email, check_bounces vs check_receipts) are explicitly cross-referenced in their descriptions. However, the delivery-status pair genuinely overlaps — both scan inbound mail to answer "did my message get there?" — and archive_email is functionally a role-aware move_email, so an agent could still select the wrong one without careful reading.

Naming Consistency4/5

Virtually every tool follows a consistent verb_noun pattern with clear prefix families (check_*, create_*, draft_*, list_*, mark_*, read_*). The single outlier is not_junk, which breaks the mark_* symmetry of its counterpart mark_junk and is not a standard verb-noun construction, though it remains perfectly readable.

Tool Count3/5

31 tools is firmly in the heavy range, though email is a genuinely broad domain spanning send/reply/forward, three draft variants, folder management, flags, junk handling, and diagnostics. Real consolidation was possible — check_bounces and check_receipts could be one delivery-status tool, archive_email is a special case of move_email, and the read-state/flag pairs could take boolean parameters — but each tool has a defensible job.

Completeness4/5

The core email lifecycle is thoroughly covered: send/reply/forward, three draft types plus draft editing, read/search/list/thread, full folder CRUD, move/archive/delete, flags, read state, junk handling, and file-upload intake. Minor gaps exist — there is no permanent-deletion or purge tool, no filter/rules management, and identity/contact maintenance is deliberately out of scope — but real user workflows can be completed without dead ends.

Resources

Need Help?